Merge branch 'tor-gitlab/mr/579'

This commit is contained in:
David Goulet 2022-10-31 15:28:36 -04:00
commit c733ccda99
3 changed files with 30 additions and 0 deletions

View File

@ -0,0 +1,5 @@
o Minor features (relays):
- Set the Linux-specific IP_BIND_ADDRESS_NO_PORT option on outgoing
sockets, allowing relays using OutboundBindAddress to make more outgoing
connections than ephemeral ports, as long as they are to separate
destinations. Related to issue 40597; patch by Alex Xu (Hello71).

View File

@ -2234,6 +2234,23 @@ connection_connect_sockaddr,(connection_t *conn,
tor_socket_strerror(errno));
}
#ifdef IP_BIND_ADDRESS_NO_PORT
static int try_ip_bind_address_no_port = 1;
if (bindaddr && try_ip_bind_address_no_port &&
setsockopt(s, SOL_IP, IP_BIND_ADDRESS_NO_PORT, &(int){1}, sizeof(int))) {
if (errno == EINVAL) {
log_notice(LD_NET, "Tor was built with support for "
"IP_BIND_ADDRESS_NO_PORT, but the current kernel "
"doesn't support it. This might cause Tor to run out "
"of ephemeral ports more quickly.");
try_ip_bind_address_no_port = 0;
} else {
log_warn(LD_NET, "Error setting IP_BIND_ADDRESS_NO_PORT on new "
"connection: %s", tor_socket_strerror(errno));
}
}
#endif
if (bindaddr && bind(s, bindaddr, bindaddr_len) < 0) {
*socket_error = tor_socket_errno(s);
if (ERRNO_IS_EADDRINUSE(*socket_error)) {

View File

@ -1033,6 +1033,14 @@ sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
return rc;
#endif /* defined(IPV6_V6ONLY) */
#ifdef IP_BIND_ADDRESS_NO_PORT
rc = seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt),
SCMP_CMP(1, SCMP_CMP_EQ, SOL_IP),
SCMP_CMP(2, SCMP_CMP_EQ, IP_BIND_ADDRESS_NO_PORT));
if (rc)
return rc;
#endif
return 0;
}