Commit Graph

228 Commits

Author SHA1 Message Date
Jacob Appelbaum
2aac39a779 Implement DisableAllSwap to avoid putting secret info in page files.
This commit implements a new config option: 'DisableAllSwap'
This option probably only works properly when Tor is started as root.
We added two new functions: tor_mlockall() and tor_set_max_memlock().
tor_mlockall() attempts to mlock() all current and all future memory pages.
For tor_mlockall() to work properly we set the process rlimits for memory to
RLIM_INFINITY (and beyond) inside of tor_set_max_memlock().
We behave differently from mlockall() by only allowing tor_mlockall() to be
called one single time. All other calls will result in a return code of 1.
It is not possible to change DisableAllSwap while running.
A sample configuration item was added to the torrc.complete.in config file.
A new item in the man page for DisableAllSwap was added.
Thanks to Moxie Marlinspike and Chris Palmer for their feedback on this patch.

Please note that we make no guarantees about the quality of your OS and its
mlock/mlockall implementation. It is possible that this will do nothing at all.
It is also possible that you can ulimit the mlock properties of a given user
such that root is not required. This has not been extensively tested and is
unsupported. I have included some comments for possible ways we can handle
this on win32.
2009-10-27 04:28:40 -04:00
Sebastian Hahn
5e01a86b42 some cleanups:
documentation fix for get_uint64
remove extra "." from a log line
fix a long line
2009-09-15 07:12:12 -04:00
Nick Mathewson
3886467f38 Add a new tor_strtok_r for platforms that don't have one, plus tests.
I don't think we actually use (or plan to use) strtok_r in a reentrant
way anywhere in our code, but would be nice not to have to think about
whether we're doing it.
2009-08-09 17:30:15 -07:00
Nick Mathewson
fd992deeea Don't attempt to log messages to a controller from a worker thread.
This patch adds a function to determine whether we're in the main
thread, and changes control_event_logmsg() to return immediately if
we're in a subthread.  This is necessary because otherwise we will
call connection_write_to_buf, which modifies non-locked data
structures.

Bugfix on 0.2.0.x; fix for at least one of the things currently
called "bug 977".
2009-05-30 18:16:24 -04:00
Nick Mathewson
ec7e054668 Spell-check Tor. 2009-05-27 17:55:51 -04:00
Nick Mathewson
c36efb0c45 Use a mutex to protect the count of open sockets.
This matters because a cpuworker can close its socket when it
finishes.  Cpuworker typically runs in another thread, so without a
lock here, we can have a race condition and get confused about how
many sockets are open.  Possible fix for bug 939.
2009-05-13 09:38:48 -04:00
Karsten Loesing
9b32e8c141 Update copyright to 2009. 2009-05-04 11:28:27 -04:00
Nick Mathewson
cbbc0c9c86 Actually use tor_sscanf() to parse untrusted input.
svn:r18761
2009-03-03 18:02:36 +00:00
Nick Mathewson
9f8d095e0f Add and use set/get_uint64 on onion tags. [bug 604; backportable]
It seems that 64-bit Sparc Solaris demands 64-bit-aligned access to
uint64_t, but does not 64-bit-align the stack-allocated char array we
use for cpuworker tags.  So this patch adds a set/get_uint64 pair, and
uses them to access the conn_id field in the tag.

svn:r18743
2009-03-02 19:15:05 +00:00
Nick Mathewson
f99098cca4 Use prctl to reenable core dumps when we have setuid to a non-root user.
svn:r18449
2009-02-09 15:20:17 +00:00
Nick Mathewson
fe987d3a17 Remove some deadcode and use tor_inet_aton uniformly.
svn:r18422
2009-02-09 03:13:05 +00:00
Nick Mathewson
3f8ab367c1 Fix warning on panther compile, and bug 913. Backport candidate.
svn:r18203
2009-01-21 03:51:14 +00:00
Nick Mathewson
a87980c2eb Add a better (non-locale-having) ctypes implementation to avoid protocol and parsing mismatches on different platforms.
svn:r18189
2009-01-20 21:33:56 +00:00
Nick Mathewson
9c94b428d9 Fix the oldest bug in a while: stop accepting 1.2.3 as a valid IPv4 address on any platform.
svn:r17887
2009-01-04 19:47:17 +00:00
Nick Mathewson
c4b8fef362 Remove svn $Id$s from our source, and remove tor --version --version.
The subversion $Id$ fields made every commit force a rebuild of
whatever file got committed.  They were not actually useful for
telling the version of Tor files in the wild.

svn:r17867
2009-01-04 00:35:51 +00:00
Nick Mathewson
52932d6f1a Remove some code that is #ifdefed out, and that we no longer seem to use, if we ever did.
svn:r17827
2008-12-30 04:16:49 +00:00
Nick Mathewson
b4d387c28b Make freelist_len in memarea.c static; document a few variables.
svn:r17741
2008-12-22 19:14:08 +00:00
Nick Mathewson
b68379b13b Add DOCDOC entries for undocumented static and global variables.
svn:r17739
2008-12-22 19:00:05 +00:00
Nick Mathewson
1e5f457461 Fix most DOCDOCs remaining and/or added by redox.
svn:r17734
2008-12-22 17:53:04 +00:00
Nick Mathewson
1725c0c8a5 Add DOCDOC comments for all undocumented functions. Add missing *s to other comments so that they will get recognized as doxygen.
svn:r17729
2008-12-22 14:56:28 +00:00
Nick Mathewson
98066d62bc Lower sprintf buffer max to ~SSIZE_T_MAX from SIZE_T_CEILING, since we need to compare it to a signed int.
svn:r17600
2008-12-11 21:11:22 +00:00
Nick Mathewson
d60d8976b9 Better error message when told to setuid to ourself.
svn:r17543
2008-12-09 23:26:12 +00:00
Nick Mathewson
07c8b2be21 Compile without warnings on mingw.
svn:r17522
2008-12-08 19:52:26 +00:00
Nick Mathewson
6fb06f334a Try to fix windows mmap code.
svn:r17493
2008-12-05 19:36:35 +00:00
Nick Mathewson
7f793fa733 Simplify mmap object layout to avoid confusing static analysis tools, and us too.
svn:r17490
2008-12-05 02:17:41 +00:00
Nick Mathewson
2be5215181 Fix a hard-to-trigger memory leak in log_credential status. Found by Coverity scan. CID 349.
svn:r17484
2008-12-05 01:29:59 +00:00
Roger Dingledine
96a185d9b7 style cleanup
svn:r17457
2008-12-02 23:42:21 +00:00
Nick Mathewson
6221bdd294 Add two lseek wrappers to compat.[ch]: one to return current fd position, and one to move the fd to the end of the file.
svn:r17454
2008-12-02 23:26:04 +00:00
Nick Mathewson
4cddcf8873 Cast uid_t and gid_t to unsigned before passing to printf %u.
svn:r17392
2008-11-26 16:13:12 +00:00
Nick Mathewson
bc597758dc Use fcntl for file locking when flock() is not available.
svn:r17391
2008-11-26 16:10:56 +00:00
Nick Mathewson
a95e0e7355 apply sebastian's fix for bug 859. Apparently on win32 one must lock at least one byte when locking, but locking a nonexistant byte is okay. )
svn:r17244
2008-11-11 15:29:40 +00:00
Nick Mathewson
6c50ab6e61 Document a couple of functions.
svn:r17239
2008-11-10 20:40:01 +00:00
Roger Dingledine
c62d5f6a5c beg nick for some documentation on the locking functions
svn:r17233
2008-11-10 00:48:13 +00:00
Roger Dingledine
0554e87f58 better error message when you set User but start tor as non-root.
hopefully will address bug 857.


svn:r17232
2008-11-10 00:41:07 +00:00
Nick Mathewson
13e079f9ec Log a little more when credential-switching fails.
svn:r17228
2008-11-09 16:54:54 +00:00
Roger Dingledine
b32e600d50 while we're cleaning code, get rid of some unreachable code at
the bottom of switch_id


svn:r17205
2008-11-07 04:35:41 +00:00
Roger Dingledine
14773f42a7 now that we drop privs more thoroughly, switch_id() is no longer
idempotent. so now we remember if we've succeeded, and if so we
don't even try.


svn:r17204
2008-11-07 04:34:47 +00:00
Roger Dingledine
7c65792500 remove more redundant code from r17200
svn:r17203
2008-11-07 04:11:03 +00:00
Nick Mathewson
1b98f45b3d Developers should usually configure with --enable-gcc-warnings, and should regularly make check-spaces. Also, int fn() does not mean the same in C as it does in C++ or Java.
svn:r17201
2008-11-07 02:53:46 +00:00
Steven Murdoch
9d68ed08e9 Patch from Jacob Appelbaum and me to make User option more robust, properly set supplementary groups, deprecated the Group option, and log more information on credential switching
svn:r17200
2008-11-07 02:06:12 +00:00
Nick Mathewson
c33dde4ac1 Fix mingw build with --enable-gcc-warnings set.
svn:r16759
2008-09-04 21:58:09 +00:00
Roger Dingledine
9f823f54d5 remove some redundant includes. i expect the first one to be a problem
for tas, but who knows.


svn:r16723
2008-09-01 21:16:07 +00:00
Nick Mathewson
f80ac31d74 Add a lockfile to the Tor data directory to avoid situations where two Tors start with the same datadir, or where a --list-fingerprints races with a server to create keys, or such.
svn:r16722
2008-09-01 20:06:26 +00:00
Nick Mathewson
88e6162649 r17848@tombo: nickm | 2008-08-22 12:10:11 -0400
Make definition of tor_mutex_t go into compat.h, so that it is possible to inline mutexes in critical objects.  Add init/uninit functions for mutexes allocated inside other structs.


svn:r16623
2008-08-22 16:24:52 +00:00
Nick Mathewson
9da0482007 r17358@pc-10-8-1-079: nickm | 2008-07-25 16:41:03 +0200
Split out the address manipulation functions from compat and util: they were about 21% of the total of those, and spread out too much.


svn:r16208
2008-07-25 14:43:24 +00:00
Nick Mathewson
3ce6e2fba2 r17346@aud-055: nickm | 2008-07-24 15:37:19 +0200
Make generic address manipulation functions work better.  Switch address policy code to use tor_addr_t, so it can handle IPv6.  That is a good place to start.


svn:r16178
2008-07-24 13:44:04 +00:00
Nick Mathewson
09cd8fa371 r19795@catbus: nickm | 2008-05-16 14:54:24 -0400
Rename tor_addr_t manipulation functions for a consistent style.


svn:r14639
2008-05-16 19:19:49 +00:00
Nick Mathewson
05b184de01 r15304@tombo: nickm | 2008-04-23 16:31:40 -0400
Forward-port: I had apparently broken OSX and Freebsd by not initializing threading before we initialize the logging system.  This patch should do so, and fix bug 671.


svn:r14430
2008-04-23 20:32:31 +00:00
Nick Mathewson
299014b2c7 r15251@tombo: nickm | 2008-04-22 11:59:46 -0400
On platforms using pthreads, allow a thread to acquire a lock it already holds.  This is crucial for logging: otherwise any log message thrown from inside the logging process (especially from control.c) will deadlock.  Win32 CriticalSections are already recursive.  Bug spotted by nwf.  Bugfix on 0.2.0.16-alpha.  Backport candidate. I hope this is portable.


svn:r14406
2008-04-22 15:59:59 +00:00
Nick Mathewson
199d65d059 r18927@catbus: nickm | 2008-03-18 11:11:49 -0400
Combine common code in set_max_file_descriptors(): all that varies from platform to platform in the no-getrlimit() case is the connection limit and the platform name.


svn:r14101
2008-03-18 15:11:52 +00:00