nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-27 22:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Bug 20261: Disable IsolateClientAddr on AF_LOCAL SocksPorts.

Browse Source 
The client addr is essentially meaningless in this context (yes, it is
possible to explicitly `bind()` AF_LOCAL client side sockets to a path,
but no one does it, and there are better ways to grant that sort of
feature if people want it like using `SO_PASSCRED`).
This commit is contained in:
Yawning Angel 2016-09-30 18:43:31 +00:00
parent 53255e925c
commit 847e001d28
3 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
changes/bug20261 Normal file
View File

@ -0,0 +1,4 @@
o Minor bugfixes (client, unix domain sockets):
- Disable IsolateClientAddr when using AF_UNIX backed SocksPorts
as the client address is meaningless. Fixes bug 20261; bugfix on
0.2.6.3-alpha.

5
doc/tor.1.txt
View File

@ -1046,8 +1046,9 @@ The following options are useful only for clients (that is, if
another. Recognized isolation flags are: another. Recognized isolation flags are:
**IsolateClientAddr**;; **IsolateClientAddr**;;
Don't share circuits with streams from a different Don't share circuits with streams from a different
client address. (On by default and strongly recommended; client address. (On by default and strongly recommended when
you can disable it with **NoIsolateClientAddr**.) supported; you can disable it with **NoIsolateClientAddr**.
Unsupported and force-disabled when using Unix domain sockets.)
**IsolateSOCKSAuth**;; **IsolateSOCKSAuth**;;
Don't share circuits with streams for which different Don't share circuits with streams for which different
SOCKS authentication was provided. (On by default; SOCKS authentication was provided. (On by default;

7
src/or/config.c
View File

@ -6838,6 +6838,13 @@ parse_port_config(smartlist_t *out,
goto err; goto err;
} }
if (unix_socket_path && (isolation & ISO_CLIENTADDR)) {
/* `IsolateClientAddr` is nonsensical in the context of AF_LOCAL.
* just silently remove the isolation flag.
*/
isolation &= ~ISO_CLIENTADDR;
}
if (out && port) { if (out && port) {
size_t namelen = unix_socket_path ? strlen(unix_socket_path) : 0; size_t namelen = unix_socket_path ? strlen(unix_socket_path) : 0;
port_cfg_t *cfg = port_cfg_new(namelen); port_cfg_t *cfg = port_cfg_new(namelen);