aboutsummaryrefslogtreecommitdiffstats
path: root/erts
diff options
context:
space:
mode:
Diffstat (limited to 'erts')
-rw-r--r--erts/doc/src/erl.xml27
-rw-r--r--erts/doc/src/erl_dist_protocol.xml11
-rw-r--r--erts/emulator/test/nif_SUITE.erl87
-rw-r--r--erts/emulator/test/nif_SUITE_data/nif_SUITE.c31
-rw-r--r--erts/etc/common/erlexec.c2
-rw-r--r--erts/etc/common/escript.c18
-rw-r--r--erts/etc/unix/etp-commands.in32
7 files changed, 157 insertions, 51 deletions
diff --git a/erts/doc/src/erl.xml b/erts/doc/src/erl.xml
index e1aa5ce76e..8b152b83f5 100644
--- a/erts/doc/src/erl.xml
+++ b/erts/doc/src/erl.xml
@@ -379,6 +379,16 @@
<c><![CDATA[Host]]></c> is the fully qualified host name of the
current host. For short names, use flag <c><![CDATA[-sname]]></c>
instead.</p>
+ <warning>
+ <p>
+ Starting a distributed node without also specifying
+ <seealso marker="#proto_dist"><c>-proto_dist inet_tls</c></seealso>
+ will expose the node to attacks that may give the attacker
+ complete access to the node and in extension the cluster.
+ When using un-secure distributed nodes, make sure that the
+ network is configured to keep potential attackers out.
+ </p>
+ </warning>
</item>
<tag><c><![CDATA[-noinput]]></c></tag>
<item>
@@ -428,12 +438,17 @@
</item>
<tag><c><![CDATA[-proto_dist Proto]]></c></tag>
<item>
+ <marker id="proto_dist"/>
<p>Specifies a protocol for Erlang distribution:</p>
<taglist>
<tag><c>inet_tcp</c></tag>
<item>TCP over IPv4 (the default)</item>
<tag><c>inet_tls</c></tag>
- <item>Distribution over TLS/SSL</item>
+ <item>Distribution over TLS/SSL, See the
+ <seealso marker="ssl:ssl_distribution">
+ Using SSL for Erlang Distribution</seealso> User's Guide
+ for details on how to setup a secure distributed node.
+ </item>
<tag><c>inet6_tcp</c></tag>
<item>TCP over IPv6</item>
</taglist>
@@ -497,6 +512,16 @@
exist between nodes running with flag <c><![CDATA[-sname]]></c>
and those running with flag <c><![CDATA[-name]]></c>, as node
names must be unique in distributed Erlang systems.</p>
+ <warning>
+ <p>
+ Starting a distributed node without also specifying
+ <seealso marker="#proto_dist"><c>-proto_dist inet_tls</c></seealso>
+ will expose the node to attacks that may give the attacker
+ complete access to the node and in extension the cluster.
+ When using un-secure distributed nodes, make sure that the
+ network is configured to keep potential attackers out.
+ </p>
+ </warning>
</item>
<tag><marker id="start_epmd"/><c>-start_epmd true | false</c></tag>
<item>
diff --git a/erts/doc/src/erl_dist_protocol.xml b/erts/doc/src/erl_dist_protocol.xml
index ee74983730..8391408a2e 100644
--- a/erts/doc/src/erl_dist_protocol.xml
+++ b/erts/doc/src/erl_dist_protocol.xml
@@ -70,6 +70,17 @@
<p>The integers in all multibyte fields are in big-endian order.</p>
+ <warning>
+ <p>
+ The Erlang Distribution protocol is not by itself secure and does not
+ aim to be so. In order to get secure distribution the distributed nodes
+ should be configured to use distribution over tls.
+ See the <seealso marker="ssl:ssl_distribution">
+ Using SSL for Erlang Distribution</seealso> User's Guide
+ for details on how to setup a secure distributed node.
+ </p>
+ </warning>
+
<section>
<title>EPMD Protocol</title>
<p>The requests served by the EPMD are summarized in the following
diff --git a/erts/emulator/test/nif_SUITE.erl b/erts/emulator/test/nif_SUITE.erl
index 1eb58699b2..bcea9e3539 100644
--- a/erts/emulator/test/nif_SUITE.erl
+++ b/erts/emulator/test/nif_SUITE.erl
@@ -488,7 +488,7 @@ select(Config) when is_list(Config) ->
%% Wait for read
eagain = read_nif(R, 3),
0 = select_nif(R,?ERL_NIF_SELECT_READ,R,null,Ref),
- [] = flush(),
+ [] = flush(0),
ok = write_nif(W, <<"hej">>),
[{select, R, Ref, ready_input}] = flush(),
0 = select_nif(R,?ERL_NIF_SELECT_READ,R,self(),Ref2),
@@ -505,7 +505,7 @@ select(Config) when is_list(Config) ->
%% Wait for write
Written = write_full(W, $a),
0 = select_nif(W,?ERL_NIF_SELECT_WRITE,W,self(),Ref),
- [] = flush(),
+ [] = flush(0),
Written = read_nif(R,byte_size(Written)),
[{select, W, Ref, ready_output}] = flush(),
@@ -515,7 +515,7 @@ select(Config) when is_list(Config) ->
[{fd_resource_stop, W_ptr, _}] = flush(),
{1, {W_ptr,_}} = last_fd_stop_call(),
true = is_closed_nif(W),
- [] = flush(),
+ [] = flush(0),
0 = select_nif(R,?ERL_NIF_SELECT_READ,R,self(),Ref),
[{select, R, Ref, ready_input}] = flush(),
eof = read_nif(R,1),
@@ -540,7 +540,7 @@ select_2(Config) ->
0 = select_nif(R,?ERL_NIF_SELECT_READ,R,null,Ref1),
0 = select_nif(R,?ERL_NIF_SELECT_READ,R,self(),Ref2),
- [] = flush(),
+ [] = flush(0),
ok = write_nif(W, <<"hej">>),
[{select, R, Ref2, ready_input}] = flush(),
<<"hej">> = read_nif(R, 3),
@@ -551,7 +551,7 @@ select_2(Config) ->
Papa = self(),
spawn_link(fun() ->
0 = select_nif(R,?ERL_NIF_SELECT_READ,R,null,Ref1),
- [] = flush(),
+ [] = flush(0),
Papa ! sync,
[{select, R, Ref1, ready_input}] = flush(),
<<"hej">> = read_nif(R, 3),
@@ -560,7 +560,7 @@ select_2(Config) ->
sync = receive_any(),
ok = write_nif(W, <<"hej">>),
done = receive_any(),
- [] = flush(),
+ [] = flush(0),
check_stop_ret(select_nif(R,?ERL_NIF_SELECT_STOP,R,null,Ref1)),
[{fd_resource_stop, R_ptr, _}] = flush(),
@@ -629,6 +629,15 @@ monitor_process_a(Config) ->
monitor_process_b(Config) ->
ensure_lib_loaded(Config),
+ monitor_process_b_do(false),
+ case erlang:system_info(threads) of
+ true -> monitor_process_b_do(true);
+ false -> ok
+ end,
+ ok.
+
+
+monitor_process_b_do(FromThread) ->
Pid = spawn_link(fun() ->
receive
return -> ok
@@ -637,8 +646,11 @@ monitor_process_b(Config) ->
R_ptr = alloc_monitor_resource_nif(),
{0,_} = monitor_process_nif(R_ptr, Pid, true, self()),
[R_ptr] = monitored_by(Pid),
- ok = release_resource(R_ptr),
- [] = flush(),
+ case FromThread of
+ false -> ok = release_resource(R_ptr);
+ true -> ok = release_resource_from_thread(R_ptr)
+ end,
+ [] = flush(0),
{R_ptr, _, 1} = last_resource_dtor_call(),
[] = monitored_by(Pid),
Pid ! return,
@@ -660,7 +672,7 @@ monitor_process_c(Config) ->
exit
end),
[{Pid, done, R_ptr, Mon1},
- {monitor_resource_down, R_ptr, Pid, Mon2}] = flush(),
+ {monitor_resource_down, R_ptr, Pid, Mon2}] = flush(2),
compare_monitors_nif(Mon1, Mon2),
{R_ptr, _, 1} = last_resource_dtor_call(),
ok.
@@ -708,7 +720,7 @@ demonitor_process(Config) ->
1 = demonitor_process_nif(R_ptr, MonBin2),
ok = release_resource(R_ptr),
- [] = flush(),
+ [] = flush(0),
{R_ptr, _, 1} = last_resource_dtor_call(),
[] = monitored_by(Pid),
Pid ! return,
@@ -2307,10 +2319,16 @@ receive_any(Timeout) ->
after Timeout -> timeout end.
flush() ->
- flush(10).
-flush(Timeout) ->
+ flush(1).
+
+flush(0) ->
+ flush(0, 10); % don't waste too much time waiting for nothing
+flush(N) ->
+ flush(N, 1000).
+
+flush(N, Timeout) ->
receive M ->
- [M | flush(Timeout)]
+ [M | flush(N-1)]
after Timeout ->
[]
end.
@@ -2619,9 +2637,9 @@ nif_snprintf(Config) ->
nif_internal_hash(Config) ->
ensure_lib_loaded(Config),
HashValueBitSize = nif_hash_result_bitsize(internal),
- Terms = unique([random_term() || _ <- lists:seq(1, 5000)]),
+ Terms = unique([random_term() || _ <- lists:seq(1, 500)]),
HashValues = [hash_nif(internal, Term, 0) || Term <- Terms],
- test_bit_distribution_fitness(HashValues, HashValueBitSize, 0.05).
+ test_bit_distribution_fitness(HashValues, HashValueBitSize).
nif_internal_hash_salted(Config) ->
ensure_lib_loaded(Config),
@@ -2630,7 +2648,7 @@ nif_internal_hash_salted(Config) ->
nif_phash2(Config) ->
ensure_lib_loaded(Config),
HashValueBitSize = nif_hash_result_bitsize(phash2),
- Terms = unique([random_term() || _ <- lists:seq(1, 5000)]),
+ Terms = unique([random_term() || _ <- lists:seq(1, 500)]),
HashValues =
lists:map(
fun (Term) ->
@@ -2643,12 +2661,12 @@ nif_phash2(Config) ->
HashValue
end,
Terms),
- test_bit_distribution_fitness(HashValues, HashValueBitSize, 0.05).
+ test_bit_distribution_fitness(HashValues, HashValueBitSize).
test_salted_nif_hash(HashType) ->
HashValueBitSize = nif_hash_result_bitsize(HashType),
- Terms = unique([random_term() || _ <- lists:seq(1, 5000)]),
- Salts = unique([random_uint32() || _ <- lists:seq(1, 100)]),
+ Terms = unique([random_term() || _ <- lists:seq(1, 500)]),
+ Salts = unique([random_uint32() || _ <- lists:seq(1, 50)]),
{HashValuesPerSalt, HashValuesPerTerm} =
lists:mapfoldl(
fun (Salt, Acc) ->
@@ -2669,22 +2687,20 @@ test_salted_nif_hash(HashType) ->
% Test per-salt hash distribution of different terms
lists:foreach(
fun ({_Salt, HashValues}) ->
- test_bit_distribution_fitness(HashValues, HashValueBitSize, 0.05)
+ test_bit_distribution_fitness(HashValues, HashValueBitSize)
end,
HashValuesPerSalt),
% Test per-term hash distribution of different salts
dict:fold(
fun (_Term, HashValues, Acc) ->
- % Be more tolerant of relative deviation,
- % as there's fewer hash values here.
- test_bit_distribution_fitness(HashValues, HashValueBitSize, 0.30),
+ test_bit_distribution_fitness(HashValues, HashValueBitSize),
Acc
end,
ok,
HashValuesPerTerm).
-test_bit_distribution_fitness(Integers, BitSize, MaxRelativeDeviation) ->
+test_bit_distribution_fitness(Integers, BitSize) ->
MaxInteger = (1 bsl BitSize) - 1,
OnesPerBit =
lists:foldl(
@@ -2700,19 +2716,29 @@ test_bit_distribution_fitness(Integers, BitSize, MaxRelativeDeviation) ->
orddict:new(),
Integers),
- ExpectedNrOfOnes = length(Integers) div 2,
+ N = length(Integers),
+ ExpectedNrOfOnes = N div 2,
+ %% ExpectedNrOfOnes should have a binomial distribution
+ %% with a standard deviation as:
+ ExpectedStdDev = math:sqrt(N) / 2,
+ %% which can be approximated as a normal distribution
+ %% where we allow a deviation of 6 std.devs
+ %% for a fail probability of 0.000000002:
+ MaxStdDevs = 6,
+
FailureText =
orddict:fold(
fun (BitIndex, NrOfOnes, Acc) ->
- RelativeDeviation = abs(NrOfOnes - ExpectedNrOfOnes) / length(Integers),
- case RelativeDeviation >= MaxRelativeDeviation of
- false -> Acc;
+ Deviation = abs(NrOfOnes - ExpectedNrOfOnes) / ExpectedStdDev,
+ case Deviation >= MaxStdDevs of
+ false ->
+ Acc;
true ->
[Acc,
io_lib:format(
"Unreasonable deviation on number of set bits (i=~p): "
- "expected ~p, got ~p (relative dev. ~.3f)~n",
- [BitIndex, ExpectedNrOfOnes, NrOfOnes, RelativeDeviation])]
+ "expected ~p, got ~p (# std.dev ~.3f > ~p)~n",
+ [BitIndex, ExpectedNrOfOnes, NrOfOnes, Deviation, MaxStdDevs])]
end
end,
[],
@@ -2789,6 +2815,7 @@ alloc_resource(_,_) -> ?nif_stub.
make_resource(_) -> ?nif_stub.
get_resource(_,_) -> ?nif_stub.
release_resource(_) -> ?nif_stub.
+release_resource_from_thread(_) -> ?nif_stub.
last_resource_dtor_call() -> ?nif_stub.
make_new_resource(_,_) -> ?nif_stub.
check_is(_,_,_,_,_,_,_,_,_,_,_) -> ?nif_stub.
diff --git a/erts/emulator/test/nif_SUITE_data/nif_SUITE.c b/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
index 3747291e7e..15d31162ed 100644
--- a/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
+++ b/erts/emulator/test/nif_SUITE_data/nif_SUITE.c
@@ -972,6 +972,30 @@ static ERL_NIF_TERM release_resource(ErlNifEnv* env, int argc, const ERL_NIF_TER
return enif_make_atom(env,"ok");
}
+static void* threaded_release_resource(void* resource)
+{
+ enif_release_resource(resource);
+}
+
+static ERL_NIF_TERM release_resource_from_thread(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
+{
+ void* resource;
+ ErlNifTid tid;
+ int err;
+
+ if (!get_pointer(env, argv[0], &resource)) {
+ return enif_make_badarg(env);
+ }
+ if (enif_thread_create("nif_SUITE:release_resource_from_thread", &tid,
+ threaded_release_resource, resource, NULL) != 0) {
+ return enif_make_badarg(env);
+ }
+ err = enif_thread_join(tid, NULL);
+ assert(err == 0);
+ return atom_ok;
+}
+
+
/*
* argv[0] an atom
* argv[1] a binary
@@ -2537,6 +2561,7 @@ static ERL_NIF_TERM monitor_frenzy_nif(ErlNifEnv* env, int argc, const ERL_NIF_T
static unsigned long spawn_cnt = 0;
static unsigned long kill_cnt = 0;
static unsigned long proc_histogram[FRENZY_PROCS_MAX];
+ static int initialized = 0;
static const unsigned int primes[] = {7, 13, 17, 19};
@@ -2556,7 +2581,7 @@ static ERL_NIF_TERM monitor_frenzy_nif(ErlNifEnv* env, int argc, const ERL_NIF_T
if (enif_is_atom(env, Op)) {
if (Op == atom_init) {
- if (procs_lock || !enif_get_uint(env, Rnd, &frenzy_rand_bits_max))
+ if (initialized || !enif_get_uint(env, Rnd, &frenzy_rand_bits_max))
return enif_make_badarg(env);
procs_lock = enif_mutex_create("nif_SUITE:monitor_frenzy.procs");
@@ -2583,6 +2608,7 @@ static ERL_NIF_TERM monitor_frenzy_nif(ErlNifEnv* env, int argc, const ERL_NIF_T
spawn_cnt = 1;
kill_cnt = 0;
+ initialized = 1;
return enif_make_uint(env, 0); /* SelfPix */
}
else if (Op == atom_stats) {
@@ -2613,7 +2639,7 @@ static ERL_NIF_TERM monitor_frenzy_nif(ErlNifEnv* env, int argc, const ERL_NIF_T
enif_make_ulong(env, res_dtor_cnt)));
}
- else if (Op == atom_stop && procs_lock) { /* stop all */
+ else if (Op == atom_stop && initialized) { /* stop all */
/* Release all resources */
for (rix = 0; rix < FRENZY_RESOURCES_MAX; rix++) {
@@ -2903,6 +2929,7 @@ static ErlNifFunc nif_funcs[] =
{"make_resource", 1, make_resource},
{"get_resource", 2, get_resource},
{"release_resource", 1, release_resource},
+ {"release_resource_from_thread", 1, release_resource_from_thread},
{"last_resource_dtor_call", 0, last_resource_dtor_call},
{"make_new_resource", 2, make_new_resource},
{"check_is", 11, check_is},
diff --git a/erts/etc/common/erlexec.c b/erts/etc/common/erlexec.c
index 70520eea15..51ed2d0dff 100644
--- a/erts/etc/common/erlexec.c
+++ b/erts/etc/common/erlexec.c
@@ -555,7 +555,7 @@ int main(int argc, char **argv)
if(s) {
add_Eargs(s); /* argv[0] = scriptname*/
} else {
- add_Eargs(progname); /* argv[0] = erl or cerl */
+ add_Eargs(emu); /* argv[0] = erl or cerl */
}
/*
* Add the bindir to the path (unless it is there already).
diff --git a/erts/etc/common/escript.c b/erts/etc/common/escript.c
index 630e241882..7f0af77a4c 100644
--- a/erts/etc/common/escript.c
+++ b/erts/etc/common/escript.c
@@ -433,7 +433,7 @@ main(int argc, char** argv)
char* emulator;
char* env;
char* basename;
- char* absname;
+ char* def_emu_lookup_path;
char scriptname[PMAX];
char** last_opt;
char** first_opt;
@@ -480,6 +480,7 @@ main(int argc, char** argv)
#else
if (strcmp(basename, "escript") == 0) {
#endif
+ def_emu_lookup_path = argv[0];
/*
* Locate all options before the script name.
*/
@@ -498,27 +499,24 @@ main(int argc, char** argv)
argc--;
argv++;
} else {
+ char *absname = find_prog(argv[0]);
#ifdef __WIN32__
- int len;
-#endif
- absname = find_prog(argv[0]);
-#ifdef __WIN32__
- len = strlen(absname);
+ int len = strlen(absname);
if (len >= 4 && _stricmp(absname+len-4, ".exe") == 0) {
absname[len-4] = '\0';
}
#endif
-
erts_snprintf(scriptname, sizeof(scriptname), "%s.escript",
absname);
- efree(absname);
+ efree(absname);
+ def_emu_lookup_path = scriptname;
}
/* Determine path to emulator */
emulator = env = get_env("ESCRIPT_EMULATOR");
if (emulator == NULL) {
- emulator = get_default_emulator(scriptname);
+ emulator = get_default_emulator(def_emu_lookup_path);
}
if (strlen(emulator) >= PMAX)
@@ -528,7 +526,7 @@ main(int argc, char** argv)
* Push initial arguments.
*/
- push_words(emulator);
+ PUSH(emulator);
free_env_val(env);
PUSH("+B");
diff --git a/erts/etc/unix/etp-commands.in b/erts/etc/unix/etp-commands.in
index fc7b614c21..8f70f879d5 100644
--- a/erts/etc/unix/etp-commands.in
+++ b/erts/etc/unix/etp-commands.in
@@ -1,3 +1,4 @@
+# -*- gdb-script -*-
#
# %CopyrightBegin%
#
@@ -2153,13 +2154,22 @@ define etp-processes
printf "No processes, since system isn't initialized!\n"
else
set $proc_ix = 0
- while $proc_ix < erts_proc.r.o.max
- set $proc = (Process *) *((UWord *) &erts_proc.r.o.tab[$proc_ix])
- if ($proc != ((Process *) 0) && $proc != &erts_invalid_process)
+ set $proc_max_ix = erts_proc.r.o.max
+ set $proc_tab = erts_proc.r.o.tab
+ set $invalid_proc = &erts_invalid_process
+ set $proc_decentile = $proc_max_ix / 10
+ set $proc_printile = $proc_decentile
+ while $proc_ix < $proc_max_ix
+ set $proc = (Process *) *((UWord *) ($proc_tab + $proc_ix))
+ if ($proc != ((Process *) 0) && $proc != $invalid_proc)
printf "---\n"
printf " Pix: %d\n", $proc_ix
etp-process-info $proc
end
+ if $proc_ix == $proc_printile
+ printf "--- %d%% (%d / %d) searched\n", $proc_printile / $proc_decentile * 10, $proc_ix, $proc_max_ix
+ set $proc_printile += $proc_decentile
+ end
set $proc_ix++
end
printf "---\n",
@@ -2479,15 +2489,19 @@ document etp-port-info
%---------------------------------------------------------------------------
end
-
define etp-ports
if (!erts_initialized)
printf "No ports, since system isn't initialized!\n"
else
set $port_ix = 0
- while $port_ix < erts_port.r.o.max
- set $port = (Port *) *((UWord *) &erts_port.r.o.tab[$port_ix])
- if ($port != ((Port *) 0) && $port != &erts_invalid_port)
+ set $port_max_ix = erts_port.r.o.max
+ set $port_tab = erts_port.r.o.tab
+ set $invalid_port = &erts_invalid_port
+ set $port_decentile = $port_max_ix / 10
+ set $port_printile = $port_decentile
+ while $port_ix < $port_max_ix
+ set $port = (Port *) *((UWord *) ($port_tab + $port_ix))
+ if ($port != ((Port *) 0) && $port != $invalid_port)
if (*(((Uint32 *) &(((Port *) $port)->state))) & 0x100) == 0
# I.e, not free
printf "---\n"
@@ -2495,6 +2509,10 @@ define etp-ports
etp-port-info $port
end
end
+ if $port_ix == $port_printile
+ printf "--- %d%% (%d / %d) searched\n", $port_printile / $port_decentile * 10, $port_ix, $port_max_ix
+ set $port_printile += $port_decentile
+ end
set $port_ix++
end
printf "---\n",
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-10 11:40:25 +0000