fixed bug where sandbox_getaddrinfo() would fail when -Sandbox is 0

diff --git a/src/common/address.c b/src/common/address.c
index 5c8603ee2066c7f7d5097fd7851e441488b6a3f6..a46aeb0d457298d8cd2f37a5bfc308a4b9487a5a 100644 (file)
--- a/src/common/address.c
+++ b/src/common/address.c
@@ -235,7 +235,7 @@ tor_addr_lookup(const char *name, uint16_t family, tor_addr_t *addr)
     memset(&hints, 0, sizeof(hints));
     hints.ai_family = family;
     hints.ai_socktype = SOCK_STREAM;
-    err = sandbox_getaddrinfo(name, &res);
+    err = sandbox_getaddrinfo(name, hints, &res);
     if (!err) {
       best = NULL;
       for (res_p = res; res_p; res_p = res_p->ai_next) {

diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index 1f0584cce14c4e5d1f4528f188da84866f7d4684..19c28981ed816669f6ddd6dbe33fcd84b79f9a40 100644 (file)
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -54,6 +54,7 @@
 #include <time.h>
 #include <poll.h>
 
+static int sandbox_active = 0;
 static sandbox_cfg_t *filter_dynamic = NULL;
 static sb_addr_info_t *sb_addr_info = NULL;
 
@@ -948,7 +949,8 @@ sandbox_cfg_allow_execve_array(sandbox_cfg_t **cfg, ...)
 }
 
 int
-sandbox_getaddrinfo(const char *name, struct addrinfo **res)
+sandbox_getaddrinfo(const char *name, struct addrinfo hints,
+    struct addrinfo **res)
 {
   sb_addr_info_t *el;
 
@@ -956,18 +958,31 @@ sandbox_getaddrinfo(const char *name, struct addrinfo **res)
 
   for (el = sb_addr_info; el; el = el->next) {
     if (!strcmp(el->name, name)) {
-      *res = (struct addrinfo *)malloc(sizeof(struct addrinfo));
+      *res = (struct addrinfo *) malloc(sizeof(struct addrinfo));
       if (!res) {
         return -2;
       }
 
       memcpy(*res, el->info, sizeof(struct addrinfo));
-
       return 0;
     }
   }
 
+  if (!sandbox_active) {
+    if (getaddrinfo(name, NULL, &hints, res)) {
+      log_err(LD_BUG,"(Sandbox) getaddrinfo failed!");
+      return -1;
+    }
+
+    return 0;
+  }
+
+  // getting here means something went wrong
   log_err(LD_BUG,"(Sandbox) failed to get address %s!", name);
+  if (*res) {
+    free(*res);
+    res = NULL;
+  }
   return -1;
 }
 
@@ -1069,7 +1084,14 @@ install_syscall_filter(sandbox_cfg_t* cfg)
     goto end;
   }
 
-  rc = seccomp_load(ctx);
+  // loading the seccomp2 filter
+  if((rc = seccomp_load(ctx))) {
+    log_err(LD_BUG, "(Sandbox) failed to load!");
+    goto end;
+  }
+
+  // marking the sandbox as active
+  sandbox_active = 1;
 
  end:
   seccomp_release(ctx);

diff --git a/src/common/sandbox.h b/src/common/sandbox.h
index 59474c4fe83c0d692f6061775ae8009b8651513f..503bb7084667f8b869a5b45bfc80ed348e30372c 100644 (file)
--- a/src/common/sandbox.h
+++ b/src/common/sandbox.h
@@ -133,7 +133,8 @@ typedef struct {
 int sandbox_add_addrinfo(const char *addr);
 
 /** Replacement for getaddrinfo(), using pre-recorded results. */
-int sandbox_getaddrinfo(const char *name, struct addrinfo **res);
+int sandbox_getaddrinfo(const char *name, struct addrinfo hints,
+    struct addrinfo **res);
 
 /** Use <b>fd</b> to log non-survivable sandbox violations. */
 void sandbox_set_debugging_fd(int fd);