Commit Graph

36202 Commits

Author SHA1 Message Date
Daniel Pinto
d28bfb2cd5 Fix seccomp sandbox rules for opening directories #40020
Different versions of glibc use either open or openat for the
opendir function. This commit adds logic to use the correct rule
for each glibc version, namely:
- Until 2.14 open is used
- From 2.15 to to 2.21 openat is used
- From 2.22 to 2.26 open is used
- From 2.27 onwards openat is used
2020-07-20 22:30:13 +01:00
Daniel Pinto
c79b4397d3 Fix seccomp sandbox rules for openat #27315
The need for casting negative syscall arguments depends on the
glibc version. This affects the rules for the openat syscall which
uses the constant AT_FDCWD that is defined as a negative number.
This commit adds logic to only apply the cast when necessary, on
glibc versions from 2.27 onwards.
2020-07-20 22:30:00 +01:00
Nick Mathewson
f5d773c600 Merge remote-tracking branch 'tor-gitlab/mr/51' 2020-07-20 16:50:32 -04:00
Nick Mathewson
d6570eaf5d Merge remote-tracking branch 'tor-gitlab/mr/59' 2020-07-20 16:37:11 -04:00
David Goulet
a576f37cfe relay: Don't log at warn level when we find an address
Dirauth code use the warn log severity when calling find_my_address() which
made it that every time we would find an address, it would log a warning.

These are not needed below info level and thus set them to info level. An IP
change is set to notice by default.

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
75434a1df1 relay: Use flags in relay_find_addr_to_publish()
Instead of a boolean saying "cache_only" add the concept of flags so we add
semantic through out the code and allow ourselves to have more options in the
future.

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
230293c169 control: With GETINFO, don't trigger an address resolve
Tell the relay find address interface to only use the cache so we don't
trigger an address resolve everytime the "GETINFO address" is called.

Related #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
433a1949e8 relay: Handle dir address suggestion with new interface
We now use relay_address_new_suggestion() when a suggested address is received
from a directory.

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
0b89eba7d5 addr: Use false/true with relay_find_addr_to_publish()
Previous development introduced the error of using 0/1 for a boolean
parameter. Fix that everywhere

Related #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
a37a027e61 test: Unit test for relay_find_addr_to_publish()
Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
c98cffbc07 test: Unit test for relay_address_new_suggestion()
Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
8178a34b80 relay: Remove router_pick_published_address()
Unused at this commit.

Closes #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
4a41761101 test: Move unit tests to new find address interface
Remove use of router_pick_published_address() and use
relay_find_addr_to_publish instead.

Related to #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
75a2e7fcb7 control: GETINFO address/ use new find address API
At the moment, this command only returns the IPv4. Do so by using the new
relay_find_addr_to_publish().

New commands to return IPv4 and IPv6 will be done with the work in tor#40039.

Related to #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
1a347b4790 relay: Deciding to fetch from authority, use new find address API
Use the new relay_has_address_set() interface when deciding if we need to
fetch directory information from an authority as a relay.

If no IPv4 address is found, we'll proceed with a fetch so we can learn our
address in the HTTP header or NETINFO cell that a trusted authority will send
us back.

Related to #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
35871e46e8 relay: Don't lookup our address before rebuilding our descriptor
Tor periodic events have moved to a role base model where relays have specific
events. One of those is to rebuild the descriptor and that is ran every
minute.

This removes the call to router_rebuild_descriptor() from
router_get_my_routerinfo_with_err() because that is the only code path that
can call for a rebuild every second.

Instead, when we mark the descriptor as dirty, immediately reschedule the
descriptor check periodic event so it can be rebuilt that way instead of
randomly when router_get_my_routerinfo_with_err() is called.

Related to #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
502f3f5afe relay: Publish IPv4/IPv6 from resolved address cache
When a relay builds a new descriptor, use the new relay_find_addr_to_publish()
interface to find the address to publish per family.

This commit also make the check for address consistency to also work for a
configured IPv6 for which before it was IPv4 only.

Related to #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
9f61a6bdc3 pt: Use new address discovery interface when creating extrainfo
In case the transport has no usable address configured (likely 0.0.0.0 or
[::]), attempt to find the IPv4 and on failure, fallback to the IPv6. If none
are found, a log error is emitted and the transport is skiped.

Related to #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
b239f178a2 addr: New function to find address to publish
In order for a relay to find which address to publish in its descriptor,
router_pick_published_address() is used. However, that function only supports
AF_INET and uses the directory server suggested address discovery mechanism.

This new function uses a new interface so that the caller can request an
address family and get the tor_addr_t object. Furthermore, it drops the use of
directory servers address discovery (tor#33244) and instead uses the new
suggested cache that is populated at the moment from data in the NETINFO cell
coming from the directory authorities.

At this commit, function is unused.

Related to #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:54:13 -04:00
David Goulet
c18e52af7c addr: Continue discovery if Address exits but not for wanted family
Commit b14b1f2b1d was a mistake.

In case an Address statement is missing for the wanted family but another one
exists for another family, simply continue the address discovery.

It is not a mistake to be missing an Address statement for a family because
the address could simply be discovered by the next methods. Not all address
family requires a specific Address statement.

However, we do bail if we couldn't find any valid address for the requested
family _and_ a resolve failed meaning we had a hostname but couldn't resolve
it. In that case, we can't know if that hostname would have been for v4 or v6
thus we can't continue the address discovery properly.

Couple unit tests case were removed to match this reality.

Related #40025

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-20 14:51:42 -04:00
Alexander Færøy
b18e274919 Merge branch 'tor-gitlab/mr/66' 2020-07-20 14:22:29 +00:00
Alexander Færøy
8638723d57 Merge branch 'tor-gitlab/mr/65' 2020-07-20 14:19:45 +00:00
Daniel Pinto
29307c0625 Add running glibc version to the log. #40047
Also adds the compiled and running glibc version when using the
--library-versions flag.
2020-07-17 18:45:57 +01:00
Nick Mathewson
0401993197 Add git-resquash.sh to repository
This differs from my old git-resquash.sh in that it uses the newer
`git rebase --keep-base` if available
2020-07-17 12:24:01 -04:00
Nick Mathewson
2225c3c369 Merge branch 'ticket40042_squashed' 2020-07-17 11:44:27 -04:00
Nick Mathewson
11f125ec78 Clean up documentation for connection_t.address 2020-07-17 11:42:49 -04:00
Nick Mathewson
f64cf09eb2 Document some channel_matches_extend_info issues that confused me. 2020-07-17 11:42:49 -04:00
Nick Mathewson
adec471595 Clean up documentation for connection_t.addr a bit more. 2020-07-17 11:42:49 -04:00
Nick Mathewson
7b3bd45cfe or_connection_t: replace real_addr with canonical_orport.
Instead of replacing connection_t.{addr,port} with a canonical
orport, and tracking the truth in real_addr, we now leave
connection_t.addr alone, and put the canonical address in
canonical_orport.

Closes #40042

Closes #33898
2020-07-17 11:42:49 -04:00
Nick Mathewson
44da920670 Add a tor_addr_port_copy() function. 2020-07-17 11:42:49 -04:00
Nick Mathewson
09601c3c4d Use gitlab-friendly URLs when formatting changelogs as HTML
Our old https://bugs.torproject.org/nnnn URLs only work for bugs
numbered before 40000.  Newer gitlab bugs need to have specific
projects mentioned.

This patch assumes that bugs are in tpo/core/tor by default, but
allows us to refer to several other projects by saying
e.g. "chutney#40002" if we want.
2020-07-17 09:31:32 -04:00
Nick Mathewson
ff68aeb492 When choosing an orport from an extendinfo, pick randomly.
(This is not fully general yet: we only pick randomly among
_supported_ addresses, and each extendinfo contains at most one IPv4
address and at most one IPv6 address, no matter what the extend cell
had.)

This change will help dual-stack relays do IPv6 reachability tests,
in theory, by having them sometimes do IPv4 connections and
sometimes do ipv6 connections.

Closes ticket 33220.
2020-07-17 09:15:08 -04:00
Nick Mathewson
5f969681a0 Combine text into existing "what does not need a changes file" section. 2020-07-16 14:54:17 -04:00
Nick Mathewson
85219d887d Merge remote-tracking branch 'tor-gitlab/mr/57' 2020-07-16 14:53:03 -04:00
David Goulet
b83c6ab737 Merge branch 'tor-gitlab/mr/56' 2020-07-16 14:15:25 -04:00
David Goulet
e66eba664a doc: Fix wrong path in include.am
Tracing.md moved to doc/tracing/ so fix the distcheck path in include.am. Also
add the new EventsCircuit.md file.

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-16 14:07:33 -04:00
David Goulet
ca1003b791 doc: Update our requirements for changes file
Closes tpo/core/team#3.

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-16 13:34:52 -04:00
David Goulet
aa9561164a nodelist: Fix possible NULL deref
Found by coverity with CID 1465290. Fix unreleased code.

Fixes #40049

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-16 13:23:03 -04:00
Alexander Færøy
62201b0f71 Merge remote-tracking branch 'tor-gitlab/mr/55' 2020-07-16 17:20:25 +00:00
Nick Mathewson
4b24b36289 Remove unneeded generate_ed_link_cert() in tests.
This fixes CID 1465291, which was a complaint that we never actually
checked the return value of this function.  It turns out that this
function was failing, and it didn't matter, because it wasn't
necessary for this test.
2020-07-16 12:59:51 -04:00
David Goulet
f6fc062119 Merge branch 'tor-gitlab/mr/54' 2020-07-16 12:55:26 -04:00
Nick Mathewson
f0204a3c34 Changes file for CONST_TO_*() functions.
Closes #40046.
2020-07-16 12:55:21 -04:00
Nick Mathewson
7ebfa607b2 Use CONST_TO_* macros in more places.
This is an automated commit made with a python script.

After running the automated script, I had to hand-revert the cases where it
made the conversion functions call themselves.

Additionally, I had to edit a variable declaration in control_bootstrap.c so
that the result of a const cast could be put in a const field.
2020-07-16 12:55:06 -04:00
Alexander Færøy
77b7cbb663 Use Debian for Gitlab CI.
See: tor#40048.
2020-07-16 16:48:03 +00:00
Nick Mathewson
b3eb409157 Define const variants for our channel_tls_t* casts. 2020-07-16 10:21:38 -04:00
Alexander Færøy
39b54bf1dd Merge branch 'tor-gitlab/merge-requests/53' 2020-07-16 14:19:18 +00:00
David Goulet
9c653e58b4 doc: Document circuit subsystem tracing events
Create a doc/tracing/ directory to contain a top level README.md which is the
previously named Tracing.md and add the EventsCircuit.md which describes the
circuit subsystem tracing events in depth.

Closes #40036

Signed-off-by: David Goulet <dgoulet@torproject.org>
2020-07-16 14:19:04 +00:00
Nick Mathewson
47a48e2f5a Define new CONST_TO_*_CONN() functions for const-to-const casts
These names are analogous to the CONST_TO_*_CIRC() functions we have
for circuits.

Part of #40046.
2020-07-16 10:08:15 -04:00
Nick Mathewson
b0d7b10088 Improve documentation for our TO_*_CONN() cast functions.
Preliminary work for #40046.
2020-07-16 09:57:52 -04:00
Nick Mathewson
10d8555e7d Add unit tests for connection_describe(). 2020-07-16 09:02:10 -04:00