aboutsummaryrefslogtreecommitdiff
path: root/src/util
AgeCommit message (Collapse)Author
2022-01-06Merge bitcoin/bitcoin#23760: util: move MapIntoRange() for reuse in fuzz testsMarcoFalke
df2307cdc3d08233d17beb9a50c144baaef1f44e util: move MapIntoRange() for reuse in fuzz tests (fanquake) Pull request description: ACKs for top commit: shaavan: ACK df2307cdc3d08233d17beb9a50c144baaef1f44e Tree-SHA512: 31bf18f50a82e442ff025d6be0db5666b463a1fc16ec6b2112c77bb815515d27f8a537a0c9934c7daa3f4d526b47e8d6333f75a13b271e6efa550f8e71504b0a
2022-01-05Merge bitcoin/bitcoin#21879: refactor: wrap accept() and extend usage of SockW. J. van der Laan
6bf6e9fd9dece67878595a5f3361851c25833c49 net: change CreateNodeFromAcceptedSocket() to take Sock (Vasil Dimov) 9e3cbfca7c9efa620c0cce73503772805cc1fa82 net: use Sock in CConnman::ListenSocket (Vasil Dimov) f8bd13f85ae5404adef23a52719d804a5c36b1e8 net: add new method Sock::Accept() that wraps accept() (Vasil Dimov) Pull request description: _This is a piece of https://github.com/bitcoin/bitcoin/pull/21878, chopped off to ease review._ Introduce an `accept(2)` wrapper `Sock::Accept()` and extend the usage of `Sock` in `CConnman::ListenSocket` and `CreateNodeFromAcceptedSocket()`. ACKs for top commit: laanwj: Code review ACK 6bf6e9fd9dece67878595a5f3361851c25833c49 jamesob: ACK 6bf6e9fd9dece67878595a5f3361851c25833c49 ([`jamesob/ackr/21879.2.vasild.wrap_accept_and_extend_u`](https://github.com/jamesob/bitcoin/tree/ackr/21879.2.vasild.wrap_accept_and_extend_u)) jonatack: ACK 6bf6e9fd9dece67878595a5f3361851c25833c49 per `git range-diff ea989de 976f6e8 6bf6e9f` -- only change since my last review was `s/listen_socket.socket/listen_socket.sock->Get()/` in `src/net.cpp: CConnman::SocketHandlerListening()` -- re-read the code changes, rebase/debug build/ran units following my previous full review (https://github.com/bitcoin/bitcoin/pull/21879#pullrequestreview-761251278) w0xlt: tACK 6bf6e9f Tree-SHA512: dc6d1acc4f255f1f7e8cf6dd74e97975cf3d5959e9fc2e689f74812ac3526d5ee8b6a32eca605925d10a4f7b6ff1ce5e900344311e587d19786b48c54d021b64
2022-01-05Merge bitcoin/bitcoin#23411: refactor: Avoid integer overflow in ApplyStats ↵MarcoFalke
when activating snapshot fa996c58e8a31ebe610d186cef408b6dd3b385a8 refactor: Avoid integer overflow in ApplyStats when activating snapshot (MarcoFalke) fac01888d17423d6c23a9ce15d98fc88fb34e3cc Move AdditionOverflow to util, Add CheckedAdd with unit tests (MarcoFalke) fa526d8fb6ab8f2678a30d4536aa9c45218f5269 Add dev doc to CCoinsStats::m_hash_type and make it const (MarcoFalke) faff051560552d4405896e01920a18f698155a56 style: Remove unused whitespace (MarcoFalke) Pull request description: A snapshot contains the utxo set, including the out value. To activate the snapshot, the hash needs to be calculated. As a side-effect, the total amount in the snapshot is calculated (as the sum of all out values), but never used. Instead of running into an integer overflow in an unused result, don't calculate the result in the first place. Other code paths (using the active utxo set) can not run into an integer overflow, since the active utxo set is valid. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39716 ACKs for top commit: shaavan: reACK fa996c58e8a31ebe610d186cef408b6dd3b385a8 vasild: ACK fa996c58e8a31ebe610d186cef408b6dd3b385a8 Tree-SHA512: 4f207f634841f6f634fd02ae1e5907e343fd767524fd0e8149aa99fa9a1834fe50167d14874834d45236e9c325d567925f28129bacb7d80be29cf22277a16a14
2021-12-30scripted-diff: Bump copyright headersHennadii Stepanov
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: * 2020: fa0074e2d82928016a43ca408717154a1c70a4db * 2019: aaaaad6ac95b402fe18d019d67897ced6b316ee0
2021-12-23util: move MapIntoRange() for reuse in fuzz testsfanquake
2021-12-17Move AdditionOverflow to util, Add CheckedAdd with unit testsMarcoFalke
2021-12-13Reduce size of strencodings decode tablesMarcoFalke
2021-12-13Fix implicit integer sign changes in strencodingsMarcoFalke
2021-12-08fuzz: Fix RPC internal bug detectionMarcoFalke
2021-12-01net: add new method Sock::Accept() that wraps accept()Vasil Dimov
This will help to increase `Sock` usage and make more code mockable.
2021-11-25Merge bitcoin/bitcoin#21206: refactor: Make CWalletTx sync state type-safeW. J. van der Laan
d8ee8f3cd32bbfefec931724f5798cbb088ceb6f refactor: Make CWalletTx sync state type-safe (Russell Yanofsky) Pull request description: Current `CWalletTx` state representation makes it possible to set inconsistent states that won't be handled correctly by wallet sync code or serialized & deserialized back into the same form. For example, it is possible to call `setConflicted` without setting a conflicting block hash, or `setConfirmed` with no transaction index. And it's possible update individual `m_confirm` and `fInMempool` data fields without setting an overall consistent state that can be serialized and handled correctly. Fix this without changing behavior by using `std::variant`, instead of an enum and collection of fields, to represent sync state, so state tracking code is safer and more legible. This is a first step to fixing state tracking bugs https://github.com/bitcoin-core/bitcoin-devwiki/wiki/Wallet-Transaction-Conflict-Tracking, by adding an extra margin of safety that can prevent new bugs from being introduced as existing bugs are fixed. ACKs for top commit: laanwj: re-ACK d8ee8f3cd32bbfefec931724f5798cbb088ceb6f jonatack: Code review ACK d8ee8f3cd32bbfefec931724f5798cbb088ceb6f Tree-SHA512: b9f15e9d99dbdbdd3ef7a76764e11f66949f50e6227e284126f209e4cb106af6d55e9a9e8c7d4aa216ddc92c6d5acc6f4aa4746f209bbd77f03831b51a2841c3
2021-11-24Merge bitcoin/bitcoin#23451: span: Add std::byte helpersMarcoFalke
faa3ec2304051be7cfbe301cfbfbda3faf7514fc span: Add std::byte helpers (MarcoFalke) fa18038f519db76befb9a7bd0b1540143bfeb12b refactor: Use ignore helper when unserializing an invalid pubkey (MarcoFalke) fabe18d0b39b4b918bf60e3a313eaa36fb4067f2 Use value_type in CDataStream where possible (MarcoFalke) Pull request description: This adds (currently unused) span std::byte helpers, so that they can be used in new code. The refactors are also required for https://github.com/bitcoin/bitcoin/pull/23438, but they are split up because the other pull doesn't compile with msvc right now. The third commit is not needed for the other pull, but still nice. ACKs for top commit: klementtan: reACK faa3ec2. Verified that all the new `std::byte` helper functions are tested. laanwj: Code review ACK faa3ec2304051be7cfbe301cfbfbda3faf7514fc Tree-SHA512: b1f6af39f03ea4dfebf20d4a8538fa993a6104e7fc92ddf0c4606a7efc3ca9a8c1a4741d98a1418569c11bb9ce9258bf0c0c06d93d85ed7e208902a2db04e407
2021-11-24Merge bitcoin/bitcoin#23249: util: ParseByteUnits - Parse a string with ↵MarcoFalke
suffix unit 21b58f430fa05fdb7c5db79b545302417a5dbceb util: ParseByteUnits - Parse a string with suffix unit [k|K|m|M|g|G|t|T] (Douglas Chimento) Pull request description: A convenience utility for parsing human readable strings sizes e.g. `500G` is `500 * 1 << 30` The argument/setting `maxuploadtarget` now accept human readable byte units `[k|K|m|M|g|G||t|T]` This change backward compatible, defaults to `M` if no unit specified. ACKs for top commit: vasild: ACK 21b58f430fa05fdb7c5db79b545302417a5dbceb ryanofsky: Code review ACK 21b58f430fa05fdb7c5db79b545302417a5dbceb. Only changes since last review are dropping optional has_value call, fixing comment punctuation, squashing commits. Tree-SHA512: c9b85acc0f77c847a0290b27ac5dc586ecc078110cf133063140576a04c11aa9c553159b9b4993488edcf6e60db6837de7c83b2964639bc21e8ffa4d455a5eb7
2021-11-19util: Add missing fstatfs to syscall sandboxMarcoFalke
2021-11-17util: ParseByteUnits - Parse a string with suffix unit [k|K|m|M|g|G|t|T]Douglas Chimento
A convenience utility for human readable arguments/config e.g. -maxuploadtarget=500g
2021-11-16doc: Fix typos in endif header commentsMarcoFalke
2021-11-15refactor: Make CWalletTx sync state type-safeRussell Yanofsky
Current CWalletTx state representation makes it possible to set inconsistent states that won't be handled correctly by wallet sync code or serialized & deserialized back into the same form. For example, it is possible to call setConflicted without setting a conflicting block hash, or setConfirmed with no transaction index. And it's possible update individual m_confirm and fInMempool data fields without setting an overall consistent state that can be serialized and handled correctly. Fix this without changing behavior by using std::variant, instead of an enum and collection of fields, to represent sync state, so state tracking code is safer and more legible. This is a first step to fixing state tracking bugs https://github.com/bitcoin-core/bitcoin-devwiki/wiki/Wallet-Transaction-Conflict-Tracking, by adding an extra margin of safety that can prevent new bugs from being introduced as existing bugs are fixed.
2021-11-10Merge bitcoin/bitcoin#23173: Add `ChainstateManager::ProcessTransaction`MarcoFalke
0fdb619aaf1d62598263361a6082d182be1af792 [validation] Always call mempool.check() after processing a new transaction (John Newbery) 2c64270bbe523ef87e7225c351464e7c716f0b3e [refactor] Don't call AcceptToMemoryPool() from outside validation.cpp (John Newbery) 92a3aeecf6a82e9cbc9fda11022b0548efd24d05 [validation] Add CChainState::ProcessTransaction() (John Newbery) 36167faea92c97ddea7403280a5074073c8e5f90 [logging/documentation] Remove reference to AcceptToMemoryPool from error string (John Newbery) 4c24142b1ec121623f81ba644d77341bc1bd88dd [validation] Remove comment about AcceptToMemoryPool() (John Newbery) 5759fd12b8d5937e9187fa33489a95b1d8e6d1e5 [test] Don't set bypass_limits to true in txvalidation_tests.cpp (John Newbery) 497c9e29640858bb3beb20089c2d4f9e133c7e42 [test] Don't set bypass_limits to true in txvalidationcache_tests.cpp (John Newbery) Pull request description: Similarly to how #18698 added `ProcessNewBlock()` and `ProcessNewBlockHeaders()` methods to the `ChainstateManager` class, this PR adds a new `ProcessTransaction()` method. Code outside validation no longer calls `AcceptToMemoryPool()` directly, but calls through the higher-level `ProcessTransaction()` method. Advantages: - The interface is simplified. Calling code no longer needs to know about the active chainstate or mempool object, since `AcceptToMemoryPool()` can only ever be called for the active chainstate, and that chainstate knows which mempool it's using. We can also remove the `bypass_limits` argument, since that can only be used internally in validation. - responsibility for calling `CTxMemPool::check()` is removed from the callers, and run automatically by `ChainstateManager` every time `ProcessTransaction()` is called. ACKs for top commit: lsilva01: tACK 0fdb619 on Ubuntu 20.04 theStack: Code-review ACK 0fdb619aaf1d62598263361a6082d182be1af792 ryanofsky: Code review ACK 0fdb619aaf1d62598263361a6082d182be1af792. Only changes since last review: splitting & joining commits, adding more explanations to commit messages, tweaking MEMPOOL_ERROR string, fixing up argument name comments. Tree-SHA512: 0b395c2e3ef242f0d41d47174b1646b0a73aeece38f1fe29349837e6fb832f4bf8d57e1a1eaed82a97c635cfd59015a7e07f824e0d7c00b2bee4144e80608172
2021-11-09span: Add std::byte helpersMarcoFalke
Also, add Span<std::byte> interface to strencondings.
2021-11-03[logging/documentation] Remove reference to AcceptToMemoryPool from error stringJohn Newbery
User-facing error messages should not leak internal implementation details like function names. Update the MEMPOOL_REJECTED error string from "Transaction rejected by AcceptToMemoryPool" to the more generic "Transaction rejected by mempool". Also update the MEMPOOL_ERROR error message from "AcceptToMemoryPool failed" to the more precise "Mempool internal error" since this error indicates and internal (e.g. logic/hardware/etc) failure, and not a transaction rejection.
2021-10-25scripted-diff: disable unimplemented ArgsManager BOOL/INT/STRING flagsRussell Yanofsky
This commit does not change behavior in any way. See previous commit for complete rationale, but these flags are being disabled because they aren't implemented and will otherwise break backwards compatibility when they are implemented. -BEGIN VERIFY SCRIPT- sed -i 's:\(ALLOW_.*\) \(//!< unimplemented\):// \1\2:' src/util/system.h sed -i '/DISALLOW_NEGATION.*scripted-diff/d' src/util/system.cpp git grep -l 'ArgsManager::ALLOW_\(INT\|STRING\)' | xargs sed -i 's/ArgsManager::ALLOW_\(INT\|STRING\)/ArgsManager::ALLOW_ANY | ArgsManager::DISALLOW_NEGATION/g' git grep -l 'ALLOW_BOOL' -- ':!src/util/system.h' | xargs sed -i 's/ALLOW_BOOL/ALLOW_ANY/g' -END VERIFY SCRIPT-
2021-10-25refactor: Add explicit DISALLOW_NEGATION ArgsManager flag to clarify flag usageRussell Yanofsky
Currently, ALLOW_{INT|BOOL|STRING} flags don't do any real validation, so current uses of these flags are misleading and will also break backwards compatibility whenever these flags are implemented in a future PR (draft PR is #16545). An additional complication is that while these flags don't do any real settings validation, they do affect whether setting negation syntax is allowed. Fix this mess by disabling ALLOW_{INT|BOOL|STRING} flags until they are implemented, and adding an unambiguous DISALLOW_NEGATION flag. This is done in two commits, with this commit adding the DISALLOW_NEGATION flag, and the next commit disabling the ALLOW_{INT|BOOL|STRING} flags.
2021-10-25refactor: Split InterpretOption into Interpret{Key,Value} functionsRussell Yanofsky
Co-authored-by: Anthony Towns <aj@erisian.com.au>
2021-10-19Add missing gettimeofday to syscall sandboxMarcoFalke
Also, sort entries. Can be reviewed with: --color-moved=dimmed-zebra
2021-10-15Merge bitcoin/bitcoin#22937: refactor: Forbid calling unsafe ↵W. J. van der Laan
fs::path(std::string) constructor and fs::path::string() method 6544ea5035268025207d2402db2f7d90fde947a6 refactor: Block unsafe fs::path std::string conversion calls (Russell Yanofsky) b39a477ec69a51b2016d3a8c70c0c77670f87f2b refactor: Add fs::PathToString, fs::PathFromString, u8string, u8path functions (Russell Yanofsky) Pull request description: The `fs::path` class has a `std::string` constructor which will implicitly convert from strings. Implicit conversions like this are not great in general because they can hide complexity and inefficiencies in the code, but this case is especially bad, because after the transition from `boost::filesystem` to `std::filesystem` in #20744 the behavior of this constructor on windows will be more complicated and can mangle path strings. The `fs::path` class also has a `.string()` method which is inverse of the constructor and has the same problems. Fix this by replacing the unsafe method calls with `PathToString` and `PathFromString` function calls, and by forbidding unsafe method calls in the future. ACKs for top commit: kiminuo: ACK 6544ea5035268025207d2402db2f7d90fde947a6 laanwj: Code review ACK 6544ea5035268025207d2402db2f7d90fde947a6 hebasto: re-ACK 6544ea5035268025207d2402db2f7d90fde947a6, only added `fsbridge_stem` test case, updated comment, and rebased since my [previous](https://github.com/bitcoin/bitcoin/pull/22937#pullrequestreview-765503126) review. Verified with the following command: Tree-SHA512: c36324740eb4ee55151146626166c00d5ccc4b6f3df777e75c112bcb4d1db436c1d9cc8c29a1e7fb96051457d317961ab42e6c380c3be2771d135771b2b49fa0
2021-10-12Merge bitcoin/bitcoin#23227: bitcoin-tx: Avoid treating integer overflow as OP_0Samuel Dobson
fa43e7c2d9dc5e2df70acd2019bdd24023c1d333 bitcoin-tx: Avoid treating overflow as OP_0 (MarcoFalke) fa053c0019bc8b2174c485f4885f894f2b5de472 style: Fix whitespace in Parse* functions (MarcoFalke) fa03dec7e98bdda8aa596ef7943cf0a8d0bcb127 refactor: Use C++11 range based for loop in ParseScript (MarcoFalke) fad55e79ca18a5894a8da6db6309c323eecbb178 doc: Fixup ToIntegral docs (MarcoFalke) Pull request description: Seems odd to treat integer overflow as `OP_0`, so fix that. ACKs for top commit: theStack: re-ACK fa43e7c2d9dc5e2df70acd2019bdd24023c1d333 shaavan: ACK fa43e7c2d9dc5e2df70acd2019bdd24023c1d333 Tree-SHA512: 1bbe2de62d853badc18d57d169c6e78ddcdff037e5a85357995dead11c8e67a4fe35087e08a181c60753f8ce91058b7fcc06f5b7901afedc78fbacea8bc3ef4f
2021-10-11util: Add mincore and clone3 to syscall sandboxMarcoFalke
2021-10-08doc: Fixup ToIntegral docsMarcoFalke
2021-10-07Merge bitcoin/bitcoin#23196: util: Make syscall sandbox compilable with ↵W. J. van der Laan
kernel 4.4.0 ac402e749c91d40ce7066993f72f426b67196bd7 util: Conditionalize some syscalls in syscall name table (W. J. van der Laan) 64085b37f8d5c018372f013e925a725b67b527fc util: Add __NR_copy_file_range syscall constant for sandbox (W. J. van der Laan) Pull request description: Make the new syscall sandbox compilable with kernel 4.4.0. This defines a further syscall constant `__NR_copy_file_range` to make sure all syscalls used in the profile are available even if not defined in the kernel headers. Also, make a few syscalls optional in the syscall name table: - `__NR_pkey_alloc` - `__NR_pkey_free` - `__NR_pkey_mprotect` - `__NR_preadv2` - `__NR_pwritev2` ACKs for top commit: practicalswift: cr ACK ac402e749c91d40ce7066993f72f426b67196bd7 Tree-SHA512: be6c55bf0a686bcdfad0b80b950d0d7d77a559ac234fc997b47514bdba44865a371c96dd8d34a811ba46424a84f410e23f75485b9b1e69e529b7d40e0b4b91b8
2021-10-06util: Add mremap syscall to AllowAddressSpaceAccessMarcoFalke
2021-10-05util: Conditionalize some syscalls in syscall name tableW. J. van der Laan
Put these in `#ifdef` as they are newer syscalls that might not be defined on all kernels: __NR_pkey_alloc __NR_pkey_free __NR_pkey_mprotect __NR_preadv2 __NR_pwritev2 Thanks to jamesob for reporting.
2021-10-05util: Add __NR_copy_file_range syscall constant for sandboxW. J. van der Laan
Kernel 4.4.0 doesn't define this.
2021-10-05refactor: Block unsafe fs::path std::string conversion callsRussell Yanofsky
There is no change in behavior. This just helps prepare for the transition from boost::filesystem to std::filesystem by avoiding calls to methods which will be unsafe after the transaction to std::filesystem to due lack of a boost::filesystem::path::imbue equivalent and inability to set a predictable locale. Co-authored-by: Hennadii Stepanov <32963518+hebasto@users.noreply.github.com> Co-authored-by: Kiminuo <kiminuo@protonmail.com> Co-authored-by: MarcoFalke <falke.marco@gmail.com>
2021-10-05Merge bitcoin/bitcoin#23178: util: Fix GUIX build with syscall sandboxW. J. van der Laan
2d0279987ef04edda5f61c171768b9527cc936cc util: Make sure syscall numbers used in profile are defined (W. J. van der Laan) 8289d19ea5d9935883f71a32e2f8f82ba7a283fb util: Define SECCOMP_RET_KILL_PROCESS if not provided by the headers (W. J. van der Laan) Pull request description: Looks like we've broke the GUIX build in #20487. This attempts to fix it: - Define `__NR_statx` `__NR_getrandom` `__NR_membarrier` as some kernel headers lack them, and it's important to have the same profile independent on what kernel is used for building. - Define `SECCOMP_RET_KILL_PROCESS` as it isn't defined in the headers. ACKs for top commit: practicalswift: cr ACK 2d0279987ef04edda5f61c171768b9527cc936cc Tree-SHA512: c264c66f90af76bf364150e44d0a31876c2ef99f05777fcdd098a23f1e80efef43028f54bf9b3dad016110056d303320ed9741b0cb4c6266175fa9d5589b4277
2021-10-05util: Make sure syscall numbers used in profile are definedW. J. van der Laan
Define the following syscall numbers for x86_64, so that the profile will be the same no matter what kernel is built against, including kernels that don't have `__NR_statx`: ```c++ #define __NR_statx 332 #define __NR_getrandom 318 #define __NR_membarrier 324 ```
2021-10-05Merge bitcoin/bitcoin#23179: sandbox: add `newfstatat` & `copy_file_range` ↵MarcoFalke
to allowed filesystem syscalls 44d77d2213e6bd2e2f700dd8c3c3f932bc1bcb48 sandbox: add copy_file_range to allowed filesystem syscalls (fanquake) ee08741c9c6c6931c521f57d179532277dced546 sandbox: add newfstatat to allowed filesystem syscalls (fanquake) Pull request description: Similar to #23178, this is a follow up to #20487, which has broken running the unit tests for some developers. Fix this by adding `newfstatat` to the list of allowed filesystem related calls. ACKs for top commit: achow101: ACK 44d77d2213e6bd2e2f700dd8c3c3f932bc1bcb48 laanwj: Code review ACK 44d77d2213e6bd2e2f700dd8c3c3f932bc1bcb48 practicalswift: cr ACK 44d77d2213e6bd2e2f700dd8c3c3f932bc1bcb48 Tree-SHA512: ce9d1b441ebf25bd2cf290566e05864223c1418dab315c962e1094ad877db5dd9fcab94ab98a46da8b712a8f5f46675d62ca3349215d8df46ec5b3c4d72dbaa6
2021-10-05Merge bitcoin/bitcoin#22951: consensus: move amount.h into consensusMarcoFalke
9d0379cea6c164610d05287ae6dd4e66f35b92b3 consensus: use <cstdint> over <stdint.h> in amount.h (fanquake) 863e52fe63a67fa020fb1ef527b9095a35ab77a5 consensus: make COIN & MAX_MONEY constexpr (fanquake) d09071da5bc997f2de1f55ca7a9babc3d7619329 [MOVEONLY] consensus: move amount.h into consensus (fanquake) Pull request description: A first step (of a few) towards some source code reorganization, as well as making libbitcoinconsensus slightly more self contained. Related to #15732. ACKs for top commit: MarcoFalke: concept ACK 9d0379cea6c164610d05287ae6dd4e66f35b92b 🏝 Tree-SHA512: 97fc79262dcb8c00996852a288fee69ddf8398ae2c95700bba5b326f1f38ffcfaf8fa66e29d0cb446d9b3f4e608a96525fae0c2ad9cd531ad98ad2a4a687cd6a
2021-10-05util: Define SECCOMP_RET_KILL_PROCESS if not provided by the headersW. J. van der Laan
Define `SECCOMP_RET_KILL_PROCESS` as it isn't defined in the headers, as is the case for the GUIX build on this platform.
2021-10-05sandbox: add copy_file_range to allowed filesystem syscallsfanquake
2021-10-05sandbox: add newfstatat to allowed filesystem syscallsfanquake
2021-10-04Merge bitcoin/bitcoin#20487: Add syscall sandboxing using seccomp-bpf (Linux ↵W. J. van der Laan
secure computing mode) 4747da3a5b639b5a336b737e7e3cbf060cf2efcf Add syscall sandboxing (seccomp-bpf) (practicalswift) Pull request description: Add experimental syscall sandboxing using seccomp-bpf (Linux secure computing mode). Enable filtering of system calls using seccomp-bpf: allow only explicitly allowlisted (expected) syscalls to be called. The syscall sandboxing implemented in this PR is an experimental feature currently available only under Linux x86-64. To enable the experimental syscall sandbox the `-sandbox=<mode>` option must be passed to `bitcoind`: ``` -sandbox=<mode> Use the experimental syscall sandbox in the specified mode (-sandbox=log-and-abort or -sandbox=abort). Allow only expected syscalls to be used by bitcoind. Note that this is an experimental new feature that may cause bitcoind to exit or crash unexpectedly: use with caution. In the "log-and-abort" mode the invocation of an unexpected syscall results in a debug handler being invoked which will log the incident and terminate the program (without executing the unexpected syscall). In the "abort" mode the invocation of an unexpected syscall results in the entire process being killed immediately by the kernel without executing the unexpected syscall. ``` The allowed syscalls are defined on a per thread basis. I've used this feature since summer 2020 and I find it to be a helpful testing/debugging addition which makes it much easier to reason about the actual capabilities required of each type of thread in Bitcoin Core. --- Quick start guide: ``` $ ./configure $ src/bitcoind -regtest -debug=util -sandbox=log-and-abort … 2021-06-09T12:34:56Z Experimental syscall sandbox enabled (-sandbox=log-and-abort): bitcoind will terminate if an unexpected (not allowlisted) syscall is invoked. … 2021-06-09T12:34:56Z Syscall filter installed for thread "addcon" 2021-06-09T12:34:56Z Syscall filter installed for thread "dnsseed" 2021-06-09T12:34:56Z Syscall filter installed for thread "net" 2021-06-09T12:34:56Z Syscall filter installed for thread "msghand" 2021-06-09T12:34:56Z Syscall filter installed for thread "opencon" 2021-06-09T12:34:56Z Syscall filter installed for thread "init" … # A simulated execve call to show the sandbox in action: 2021-06-09T12:34:56Z ERROR: The syscall "execve" (syscall number 59) is not allowed by the syscall sandbox in thread "msghand". Please report. … Aborted (core dumped) $ ``` --- [About seccomp and seccomp-bpf](https://en.wikipedia.org/wiki/Seccomp): > In computer security, seccomp (short for secure computing mode) is a facility in the Linux kernel. seccomp allows a process to make a one-way transition into a "secure" state where it cannot make any system calls except exit(), sigreturn(), and read() and write() to already-open file descriptors. Should it attempt any other system calls, the kernel will terminate the process with SIGKILL or SIGSYS. In this sense, it does not virtualize the system's resources but isolates the process from them entirely. > > […] > > seccomp-bpf is an extension to seccomp that allows filtering of system calls using a configurable policy implemented using Berkeley Packet Filter rules. It is used by OpenSSH and vsftpd as well as the Google Chrome/Chromium web browsers on Chrome OS and Linux. (In this regard seccomp-bpf achieves similar functionality, but with more flexibility and higher performance, to the older systrace—which seems to be no longer supported for Linux.) ACKs for top commit: laanwj: Code review and lightly tested ACK 4747da3a5b639b5a336b737e7e3cbf060cf2efcf Tree-SHA512: e1c28e323eb4409a46157b7cc0fc29a057ba58d1ee2de268962e2ade28ebd4421b5c2536c64a3af6e9bd3f54016600fec88d016adb49864b63edea51ad838e17
2021-10-04Merge bitcoin/bitcoin#23156: refactor: Remove unused ParsePrechecks and ↵MarcoFalke
ParseDouble fa9d72a7947d2cff541794e21e0040c3c1d43b32 Remove unused ParseDouble and ParsePrechecks (MarcoFalke) fa3cd2853530c86c261ac7266ffe4f1726fe9ce6 refactor: Remove unused ParsePrechecks from ParseIntegral (MarcoFalke) Pull request description: All of the `ParsePrechecks` are already done by `ToIntegral`, so remove them from `ParseIntegral`. Also: * Remove redundant `{}`. See https://github.com/bitcoin/bitcoin/pull/20457#discussion_r720116866 * Add missing failing c-string test case * Add missing failing test cases for non-int32_t integral types ACKs for top commit: laanwj: Code review ACK fa9d72a7947d2cff541794e21e0040c3c1d43b32, good find on ParseDouble not being used at all, and testing for behavior of embedded NULL characters is always a good thing. practicalswift: cr ACK fa9d72a7947d2cff541794e21e0040c3c1d43b32 Tree-SHA512: 3d654dcaebbf312dd57e54241f9aa6d35b1d1d213c37e4c6b8b9a69bcbe8267a397474a8b86b57740fbdd8e3d03b4cdb6a189a9eb8e05cd38035dab195410aa7
2021-10-04Remove unused ParseDouble and ParsePrechecksMarcoFalke
2021-10-01refactor: Remove unused ParsePrechecks from ParseIntegralMarcoFalke
Also: * Remove redundant {} from return statement * Add missing failing c-string test case and "-" and "+" strings * Add missing failing test cases for non-int32_t integral types
2021-10-01Add syscall sandboxing (seccomp-bpf)practicalswift
2021-09-30Replace use of locale dependent atoi(…) with locale-independent ↵practicalswift
std::from_chars(…) (C++17) test: Add test cases for LocaleIndependentAtoi fuzz: Assert legacy atoi(s) == LocaleIndependentAtoi<int>(s) fuzz: Assert legacy atoi64(s) == LocaleIndependentAtoi<int64_t>(s)
2021-09-30Merge bitcoin/bitcoin#20457: util: Make Parse{Int,UInt}{32,64} use locale ↵W. J. van der Laan
independent std::from_chars(…) (C++17) instead of locale dependent strto{l,ll,ul,ull} 4747db876154ddd828c03d9eda10ecf8b25d8dc8 util: Introduce ToIntegral<T>(const std::string&) for locale independent parsing using std::from_chars(…) (C++17) (practicalswift) Pull request description: Make `Parse{Int,UInt}{32,64}` use locale independent `std::from_chars(…)` (C++17) instead of locale dependent `strto{l,ll,ul,ull}`. [About `std::from_chars`](https://en.cppreference.com/w/cpp/utility/from_chars): _"Unlike other parsing functions in C++ and C libraries, `std::from_chars` is locale-independent, non-allocating, and non-throwing."_ ACKs for top commit: laanwj: Code review ACK 4747db876154ddd828c03d9eda10ecf8b25d8dc8 Tree-SHA512: 40f2cd582bc19ddcf2c498eca3379167619eff6aa047bbac2f73b8fd8ecaefe5947c66700a189f83848751f9f8c05645e83afd4a44a1679062aee5440dba880a
2021-09-30[MOVEONLY] consensus: move amount.h into consensusfanquake
Move amount.h to consensus/amount.h. Renames, adds missing and removes uneeded includes.
2021-09-18util: Introduce ToIntegral<T>(const std::string&) for locale independent ↵practicalswift
parsing using std::from_chars(…) (C++17) util: Avoid locale dependent functions strtol/strtoll/strtoul/strtoull in ParseInt32/ParseInt64/ParseUInt32/ParseUInt64 fuzz: Assert equivalence between new and old Parse{Int,Uint}{8,32,64} functions test: Add unit tests for ToIntegral<T>(const std::string&)
2021-09-11Cleanup headers after #20788Hennadii Stepanov