November 2012 - tor-commits - lists.torproject.org

[tor/master] Add manual page entries for new IPv6-exits options
by nickm＠torproject.org 15 Nov '12

15 Nov '12

commit 61d740ed0156e20d539bdfbe48b13a42167c2c8f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Nov 14 23:35:13 2012 -0500 Add manual page entries for new IPv6-exits options --- doc/tor.1.txt | 20 ++++++++++++++++++-- 1 files changed, 18 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 6c02f45..1e1ff1e 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -864,7 +864,7 @@ The following options are useful only for clients (that is, if the same circuit. Currently, two addresses are "too close" if they lie in the same /16 range. (Default: 1) -**SOCKSPort** \['address':]__port__|**auto** [_isolation flags_]:: +**SOCKSPort** \['address':]__port__|**auto** [_flags_] [_isolation flags_]:: Open this port to listen for connections from SOCKS-speaking applications. Set this to 0 if you don't want to allow application connections via SOCKS. Set it to "auto" to have Tor pick a port for @@ -897,7 +897,19 @@ The following options are useful only for clients (that is, if on this port to share circuits with streams from every other port with the same session group. (By default, streams received on different SOCKSPorts, TransPorts, etc are always isolated from one - another. This option overrides that behavior.) + another. This option overrides that behavior.) + ++ + Other recognized _flags_ for a SOCKSPort are: + **NoIPv4Traffic**;; + Tell exits to not connect to IPv4 addresses in response to SOCKS + requests on this connection. + **IPv6Traffic**;; + Tell exits to allow IPv6 addresses in response to SOCKS requests on + this connection, so long as SOCKS5 is in use. (SOCKS4 can't handle + IPv6.) + **PreferIPv6**;; + Tells exits that, if a host has both an IPv4 and an IPv6 address, + we would prefer to connect to it via IPv6. (IPv4 is the default.) **SOCKSListenAddress** __IP__[:__PORT__]:: Bind to this address to listen for connections from Socks-speaking @@ -1275,6 +1287,10 @@ is non-zero): at the beginning of your exit policy. See above entry on ExitPolicy. (Default: 1) +**IPv6Exit** **0**|**1**:: + If set, and we are an exit node, allow clients to use us for IPv6 + traffic. (Default: 0) + **MaxOnionsPending** __NUM__:: If you have more than this number of onionskins queued for decrypt, reject new ones. (Default: 100)

1 0

[tor/master] Remove some XXXX commens in dns.c
by nickm＠torproject.org 15 Nov '12

15 Nov '12

commit a4fce0fee855288d600636462f1ca9acf30e036f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 15 12:17:36 2012 -0500 Remove some XXXX commens in dns.c Previously, I was freaking out about passing an unspec address to dns_found_answer() on an error, since I was using the address type to determine whether the error was an error on an ipv4 address lookup or on an ipv6 address lookup. But now dns_found_answer() has a separate orig_query_type argument to tell what kind of query it is, so there's no need to freak out. --- src/or/dns.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/or/dns.c b/src/or/dns.c index 9834bd7..870494a 100644 --- a/src/or/dns.c +++ b/src/or/dns.c @@ -1580,7 +1580,7 @@ evdns_callback(int result, char type, int count, int ttl, void *addresses, const char *hostname = NULL; int was_wildcarded = 0; - tor_addr_make_unspec(&addr); /*WRONG WRONG WRONG XXXX XXXXX IPV6 prop208*/ + tor_addr_make_unspec(&addr); /* Keep track of whether IPv6 is working */ if (type == DNS_IPv6_AAAA) { @@ -1615,7 +1615,7 @@ evdns_callback(int result, char type, int count, int ttl, void *addresses, safe_str(escaped_address), escaped_safe_str(answer_buf)); was_wildcarded = 1; - tor_addr_make_null(&addr, AF_INET); /* ???? */ + tor_addr_make_unspec(&addr); result = DNS_ERR_NOTEXIST; } else { log_debug(LD_EXIT, "eventdns said that %s resolves to %s", @@ -1637,7 +1637,7 @@ evdns_callback(int result, char type, int count, int ttl, void *addresses, safe_str(escaped_address), escaped_safe_str(answer_buf)); was_wildcarded = 1; - tor_addr_make_unspec(&addr); /* WRONG WRONG ETC XXXXXXXX */ + tor_addr_make_unspec(&addr); result = DNS_ERR_NOTEXIST; } else { log_debug(LD_EXIT, "eventdns said that %s resolves to %s",

1 0

[tor/master] Add a changes file for IPv6 exits
by nickm＠torproject.org 15 Nov '12

15 Nov '12

commit b1ad84dce61d11ffb0a3dff71ba404cf478e211c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Nov 14 23:35:55 2012 -0500 Add a changes file for IPv6 exits --- changes/ipv6_exits | 18 ++++++++++++++++++ 1 files changed, 18 insertions(+), 0 deletions(-) diff --git a/changes/ipv6_exits b/changes/ipv6_exits new file mode 100644 index 0000000..97af751 --- /dev/null +++ b/changes/ipv6_exits @@ -0,0 +1,18 @@ + o Major features: + + - Tor now has (alpha) support for exiting to IPv6 addresses. To + enable it as an exit node, make sure that you have IPv6 + connectivity, set the IPv6Exit flag to 1. Also make sure your + exit policy reads as you would like: the address * applies to + all address families, whereas *4 is IPv4 address only, and *6 + is IPv6 addresses only. On the client side, you'll need to + wait till the authorities have upgraded, wait for enough exits + to support IPv6, apply the "IPv6Traffic" flag to a SocksPort, + and use Socks5. Closes ticket 5547, implements proposal 117 as + revised in proposal 208. + + We DO NOT recommend that clients with actual anonymity needs + start using IPv6 over Tor yet: not enough exits support it + yet, and there are some DNS-caching related issues that need + to be solved first. +

1 0

[tor/master] Merge branch 'ipv6_exits'
by nickm＠torproject.org 15 Nov '12

15 Nov '12

1 0

[tor/master] Fix up some comments in connection_edge.c
by nickm＠torproject.org 15 Nov '12

15 Nov '12

commit 12f997528d17739290a54347edd2ce54042efa2d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 15 12:17:30 2012 -0500 Fix up some comments in connection_edge.c --- src/or/connection_edge.c | 12 +++++++++--- 1 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 426b993..41c75a2 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -2204,7 +2204,11 @@ connection_ap_handshake_socks_reply(entry_connection_t *conn, char *reply, /** Read a RELAY_BEGIN or RELAY_BEGINDIR cell from cell, decode it, and * place the result in bcell. On success return 0; on failure return * <0 and set *end_reason_out to the end reason we should send back to - * the client. */ + * the client. + * + * Return -1 in the case where want to send a RELAY_END cell, and < -1 when + * we don't. + **/ /* static */ int begin_cell_parse(const cell_t *cell, begin_cell_t *bcell, uint8_t *end_reason_out) @@ -2217,7 +2221,7 @@ begin_cell_parse(const cell_t *cell, begin_cell_t *bcell, relay_header_unpack(&rh, cell->payload); if (rh.length > RELAY_PAYLOAD_SIZE) { - return -2; /*XXXX why not TORPROTOL? */ + return -2; /*XXXX why not TORPROTOCOL? */ } bcell->stream_id = rh.stream_id; @@ -2389,7 +2393,9 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) } log_debug(LD_EXIT,"Creating new exit connection."); - n_stream = edge_connection_new(CONN_TYPE_EXIT, AF_INET);/*XXXX IPv6*/ + /* The 'AF_INET' here is temporary; we might need to change it later in + * connection_exit_connect(). */ + n_stream = edge_connection_new(CONN_TYPE_EXIT, AF_INET); /* Remember the tunneled request ID in the new edge connection, so that * we can measure download times. */

1 0

[tor/master] Set IPv4/IPv6 flags correctly when being a SOCKS client
by nickm＠torproject.org 15 Nov '12

15 Nov '12

commit 1e46952f36c5fb83d0f3e60e90951bb9e8ea8d77 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 15 13:00:19 2012 -0500 Set IPv4/IPv6 flags correctly when being a SOCKS client --- src/or/connection.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/or/connection.c b/src/or/connection.c index ecfb8a9..f9d8a6d 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1115,7 +1115,7 @@ connection_listener_new(const struct sockaddr *listensockaddr, lis_conn->session_group = global_next_session_group--; } } - if (type == CONN_TYPE_AP) { + if (type == CONN_TYPE_AP_LISTENER) { lis_conn->socks_ipv4_traffic = port_cfg->ipv4_traffic; lis_conn->socks_ipv6_traffic = port_cfg->ipv6_traffic; lis_conn->socks_prefer_ipv6 = port_cfg->prefer_ipv6;

1 0

[tor/master] Add a new family-specific syntax for tor_addr_parse_mask_ports
by nickm＠torproject.org 15 Nov '12

15 Nov '12

commit 2eb7eafc9d789cb5063dd36021412434b656bf75 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 24 12:33:18 2012 -0400 Add a new family-specific syntax for tor_addr_parse_mask_ports By default, "*" means "All IPv4 addresses" with tor_addr_parse_mask_ports, so I won't break anything. But if the new EXTENDED_STAR flag is provided, then * means "any address", *4 means "any IPv4 address" (that is, 0.0.0.0/0), and "*6" means "any IPv6 address" (that is, [::]/0). This is going to let us have a syntax for specifying exit policies in torrc that won't drive people mad. Also, add a bunch of unit tests for tor_addr_parse_mask_ports to test these new features, and to increase coverage. --- src/common/address.c | 31 +++++++++++- src/common/address.h | 3 +- src/or/config.c | 1 + src/or/policies.c | 7 ++- src/or/routerparse.c | 5 +- src/test/test_addr.c | 126 ++++++++++++++++++++++++++++++++++++++++++++------ 6 files changed, 151 insertions(+), 22 deletions(-) diff --git a/src/common/address.c b/src/common/address.c index a714ead..3f00c1e 100644 --- a/src/common/address.c +++ b/src/common/address.c @@ -559,9 +559,22 @@ tor_addr_to_PTR_name(char *out, size_t outlen, * * Return an address family on success, or -1 if an invalid address string is * provided. + * + * If 'flags & TAPMP_EXTENDED_STAR' is false, then the wildcard address '*' + * yield an IPv4 wildcard. + * + * If 'flags & TAPMP_EXTENDED_STAR' is true, then the wildcard address '*' + * yields an AF_UNSPEC wildcard address, and the following change is made + * in the grammar above: + * Address ::= IPv4Address / "[" IPv6Address "]" / "*" / "*4" / "*6" + * with the new "*4" and "*6" productions creating a wildcard to match + * IPv4 or IPv6 addresses. + * */ int -tor_addr_parse_mask_ports(const char *s, tor_addr_t *addr_out, +tor_addr_parse_mask_ports(const char *s, + unsigned flags, + tor_addr_t *addr_out, maskbits_t *maskbits_out, uint16_t *port_min_out, uint16_t *port_max_out) { @@ -618,9 +631,23 @@ tor_addr_parse_mask_ports(const char *s, tor_addr_t *addr_out, memset(addr_out, 0, sizeof(tor_addr_t)); if (!strcmp(address, "*")) { - family = AF_INET; /* AF_UNSPEC ???? XXXX_IP6 */ + if (flags & TAPMP_EXTENDED_STAR) { + family = AF_UNSPEC; + tor_addr_make_unspec(addr_out); + } else { + family = AF_INET; + tor_addr_from_ipv4h(addr_out, 0); + } + any_flag = 1; + } else if (!strcmp(address, "*4") && (flags & TAPMP_EXTENDED_STAR)) { + family = AF_INET; tor_addr_from_ipv4h(addr_out, 0); any_flag = 1; + } else if (!strcmp(address, "*6") && (flags & TAPMP_EXTENDED_STAR)) { + static char nil_bytes[16] = { 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 }; + family = AF_INET6; + tor_addr_from_ipv6_bytes(addr_out, nil_bytes); + any_flag = 1; } else if (tor_inet_pton(AF_INET6, address, &in6_tmp) > 0) { family = AF_INET6; tor_addr_from_in6(addr_out, &in6_tmp); diff --git a/src/common/address.h b/src/common/address.h index 067b7a0..6bf9461 100644 --- a/src/common/address.h +++ b/src/common/address.h @@ -183,7 +183,8 @@ int tor_addr_parse_PTR_name(tor_addr_t *result, const char *address, int tor_addr_port_lookup(const char *s, tor_addr_t *addr_out, uint16_t *port_out); -int tor_addr_parse_mask_ports(const char *s, +#define TAPMP_EXTENDED_STAR 1 +int tor_addr_parse_mask_ports(const char *s, unsigned flags, tor_addr_t *addr_out, maskbits_t *mask_out, uint16_t *port_min_out, uint16_t *port_max_out); const char * tor_addr_to_str(char *dest, const tor_addr_t *addr, size_t len, diff --git a/src/or/config.c b/src/or/config.c index 9af55e9..f8ac67e 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -276,6 +276,7 @@ static config_var_t option_vars_[] = { V(HTTPProxyAuthenticator, STRING, NULL), V(HTTPSProxy, STRING, NULL), V(HTTPSProxyAuthenticator, STRING, NULL), + // V(IPv6EXit, BOOL, "0"), VAR("ServerTransportPlugin", LINELIST, ServerTransportPlugin, NULL), V(Socks4Proxy, STRING, NULL), V(Socks5Proxy, STRING, NULL), diff --git a/src/or/policies.c b/src/or/policies.c index 09ba10b..442377b 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -87,7 +87,8 @@ policy_expand_private(smartlist_t **policy) memcpy(&newpolicy, p, sizeof(addr_policy_t)); newpolicy.is_private = 0; newpolicy.is_canonical = 0; - if (tor_addr_parse_mask_ports(private_nets[i], &newpolicy.addr, + if (tor_addr_parse_mask_ports(private_nets[i], 0, + &newpolicy.addr, &newpolicy.maskbits, &port_min, &port_max)<0) { tor_assert(0); } @@ -1192,8 +1193,8 @@ policy_summary_add_item(smartlist_t *summary, addr_policy_t *p) for (i = 0; private_nets[i]; ++i) { tor_addr_t addr; maskbits_t maskbits; - if (tor_addr_parse_mask_ports(private_nets[i], &addr, - &maskbits, NULL, NULL)<0) { + if (tor_addr_parse_mask_ports(private_nets[i], 0, &addr, + &maskbits, NULL, NULL)<0) { tor_assert(0); } if (tor_addr_compare(&p->addr, &addr, CMP_EXACT) == 0 && diff --git a/src/or/routerparse.c b/src/or/routerparse.c index a333780..6069c8d 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -1280,7 +1280,8 @@ find_single_ipv6_orport(const smartlist_t *list, uint16_t port_min, port_max; tor_assert(t->n_args >= 1); /* XXXX Prop186 the full spec allows much more than this. */ - if (tor_addr_parse_mask_ports(t->args[0], &a, &bits, &port_min, + if (tor_addr_parse_mask_ports(t->args[0], 0, + &a, &bits, &port_min, &port_max) == AF_INET6 && bits == 128 && port_min == port_max) { @@ -3737,7 +3738,7 @@ router_parse_addr_policy(directory_token_t *tok) else newe.policy_type = ADDR_POLICY_ACCEPT; - if (tor_addr_parse_mask_ports(arg, &newe.addr, &newe.maskbits, + if (tor_addr_parse_mask_ports(arg, 0, &newe.addr, &newe.maskbits, &newe.prt_min, &newe.prt_max) < 0) { log_warn(LD_DIR,"Couldn't parse line %s. Dropping", escaped(arg)); return NULL; diff --git a/src/test/test_addr.c b/src/test/test_addr.c index 0dcc017..6d0fe5a 100644 --- a/src/test/test_addr.c +++ b/src/test/test_addr.c @@ -159,7 +159,8 @@ test_addr_basic(void) * as pt1..pt2. */ #define test_addr_mask_ports_parse(xx, f, ip1, ip2, ip3, ip4, mm, pt1, pt2) \ STMT_BEGIN \ - test_eq(tor_addr_parse_mask_ports(xx, &t1, &mask, &port1, &port2), f); \ + test_eq(tor_addr_parse_mask_ports(xx, 0, &t1, &mask, &port1, &port2), \ + f); \ p1=tor_inet_ntop(AF_INET6, &t1.addr.in6_addr, bug, sizeof(bug)); \ test_eq(htonl(ip1), tor_addr_to_in6_addr32(&t1)[0]); \ test_eq(htonl(ip2), tor_addr_to_in6_addr32(&t1)[1]); \ @@ -401,11 +402,11 @@ test_addr_ip6_helpers(void) test_addr_compare("0::2:2:1", <, "0::ffff:0.3.2.1"); test_addr_compare("0::ffff:0.3.2.1", >, "0::0:0:0"); test_addr_compare("0::ffff:5.2.2.1", <, "::ffff:6.0.0.0"); /* XXXX wrong. */ - tor_addr_parse_mask_ports("[::ffff:2.3.4.5]", &t1, NULL, NULL, NULL); - tor_addr_parse_mask_ports("2.3.4.5", &t2, NULL, NULL, NULL); + tor_addr_parse_mask_ports("[::ffff:2.3.4.5]", 0, &t1, NULL, NULL, NULL); + tor_addr_parse_mask_ports("2.3.4.5", 0, &t2, NULL, NULL, NULL); test_assert(tor_addr_compare(&t1, &t2, CMP_SEMANTIC) == 0); - tor_addr_parse_mask_ports("[::ffff:2.3.4.4]", &t1, NULL, NULL, NULL); - tor_addr_parse_mask_ports("2.3.4.5", &t2, NULL, NULL, NULL); + tor_addr_parse_mask_ports("[::ffff:2.3.4.4]", 0, &t1, NULL, NULL, NULL); + tor_addr_parse_mask_ports("2.3.4.5", 0, &t2, NULL, NULL, NULL); test_assert(tor_addr_compare(&t1, &t2, CMP_SEMANTIC) < 0); /* test compare_masked */ @@ -568,6 +569,7 @@ test_addr_ip6_helpers(void) test_streq(rbuf, addr_PTR); } + /* XXXX turn this into a separate function; it's not all IPv6. */ /* test tor_addr_parse_mask_ports */ test_addr_mask_ports_parse("[::f]/17:47-95", AF_INET6, 0, 0, 0, 0x0000000f, 17, 47, 95); @@ -581,27 +583,123 @@ test_addr_ip6_helpers(void) 0xabcd0002, 0, 0, 0x044a0000, 128, 2, 65000); test_streq(p1, "abcd:2::44a:0"); - r=tor_addr_parse_mask_ports("[fefef::]/112", &t1, NULL, NULL, NULL); + /* Try some long addresses. */ + r=tor_addr_parse_mask_ports("[ffff:1111:1111:1111:1111:1111:1111:1111]", + 0, &t1, NULL, NULL, NULL); + test_assert(r == AF_INET6); + r=tor_addr_parse_mask_ports("[ffff:1111:1111:1111:1111:1111:1111:11111]", + 0, &t1, NULL, NULL, NULL); + test_assert(r == -1); + r=tor_addr_parse_mask_ports("[ffff:1111:1111:1111:1111:1111:1111:1111:1]", + 0, &t1, NULL, NULL, NULL); + test_assert(r == -1); + r=tor_addr_parse_mask_ports( + "[ffff:1111:1111:1111:1111:1111:1111:ffff:" + "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:" + "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:" + "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]", + 0, &t1, NULL, NULL, NULL); + test_assert(r == -1); + /* Try some failing cases. */ + r=tor_addr_parse_mask_ports("[fefef::]/112", 0, &t1, NULL, NULL, NULL); + test_assert(r == -1); + r=tor_addr_parse_mask_ports("[fefe::/112", 0, &t1, NULL, NULL, NULL); + test_assert(r == -1); + r=tor_addr_parse_mask_ports("[fefe::", 0, &t1, NULL, NULL, NULL); + test_assert(r == -1); + r=tor_addr_parse_mask_ports("[fefe::X]", 0, &t1, NULL, NULL, NULL); + test_assert(r == -1); + r=tor_addr_parse_mask_ports("efef::/112", 0, &t1, NULL, NULL, NULL); + test_assert(r == -1); + r=tor_addr_parse_mask_ports("[f:f:f:f:f:f:f:f::]",0,&t1, NULL, NULL, NULL); test_assert(r == -1); - r=tor_addr_parse_mask_ports("efef::/112", &t1, NULL, NULL, NULL); + r=tor_addr_parse_mask_ports("[::f:f:f:f:f:f:f:f]",0,&t1, NULL, NULL, NULL); test_assert(r == -1); - r=tor_addr_parse_mask_ports("[f:f:f:f:f:f:f:f::]", &t1, NULL, NULL, NULL); + r=tor_addr_parse_mask_ports("[f:f:f:f:f:f:f:f:f]",0,&t1, NULL, NULL, NULL); test_assert(r == -1); - r=tor_addr_parse_mask_ports("[::f:f:f:f:f:f:f:f]", &t1, NULL, NULL, NULL); + r=tor_addr_parse_mask_ports("[f:f:f:f:f::]/fred",0,&t1,&mask, NULL, NULL); test_assert(r == -1); - r=tor_addr_parse_mask_ports("[f:f:f:f:f:f:f:f:f]", &t1, NULL, NULL, NULL); + r=tor_addr_parse_mask_ports("[f:f:f:f:f::]/255.255.0.0", + 0,&t1, NULL, NULL, NULL); + test_assert(r == -1); + /* This one will get rejected because it isn't a pure prefix. */ + r=tor_addr_parse_mask_ports("1.1.2.3/255.255.64.0",0,&t1, &mask,NULL,NULL); test_assert(r == -1); /* Test for V4-mapped address with mask < 96. (arguably not valid) */ - r=tor_addr_parse_mask_ports("[::ffff:1.1.2.2/33]", &t1, &mask, NULL, NULL); + r=tor_addr_parse_mask_ports("[::ffff:1.1.2.2/33]",0,&t1, &mask, NULL, NULL); + test_assert(r == -1); + r=tor_addr_parse_mask_ports("1.1.2.2/33",0,&t1, &mask, NULL, NULL); + test_assert(r == -1); + /* Try extended wildcard addresses with out TAPMP_EXTENDED_STAR*/ + r=tor_addr_parse_mask_ports("*4",0,&t1, &mask, NULL, NULL); + test_assert(r == -1); + r=tor_addr_parse_mask_ports("*6",0,&t1, &mask, NULL, NULL); + test_assert(r == -1); +#if 0 + /* Try a mask with a wildcard. */ + r=tor_addr_parse_mask_ports("*/16",0,&t1, &mask, NULL, NULL); test_assert(r == -1); - r=tor_addr_parse_mask_ports("1.1.2.2/33", &t1, &mask, NULL, NULL); + r=tor_addr_parse_mask_ports("*4/16",TAPMP_EXTENDED_STAR, + &t1, &mask, NULL, NULL); test_assert(r == -1); - r=tor_addr_parse_mask_ports("1.1.2.2/31", &t1, &mask, NULL, NULL); + r=tor_addr_parse_mask_ports("*6/30",TAPMP_EXTENDED_STAR, + &t1, &mask, NULL, NULL); + test_assert(r == -1); +#endif + /* Basic mask tests*/ + r=tor_addr_parse_mask_ports("1.1.2.2/31",0,&t1, &mask, NULL, NULL); + test_assert(r == AF_INET); + tt_int_op(mask,==,31); + tt_int_op(tor_addr_family(&t1),==,AF_INET); + tt_int_op(tor_addr_to_ipv4h(&t1),==,0x01010202); + r=tor_addr_parse_mask_ports("3.4.16.032:1-2",0,&t1, &mask, &port1, &port2); + test_assert(r == AF_INET); + tt_int_op(mask,==,32); + tt_int_op(tor_addr_family(&t1),==,AF_INET); + tt_int_op(tor_addr_to_ipv4h(&t1),==,0x03041020); + test_assert(port1 == 1); + test_assert(port2 == 2); + r=tor_addr_parse_mask_ports("1.1.2.3/255.255.128.0",0,&t1, &mask,NULL,NULL); test_assert(r == AF_INET); - r=tor_addr_parse_mask_ports("[efef::]/112", &t1, &mask, &port1, &port2); + tt_int_op(mask,==,17); + tt_int_op(tor_addr_family(&t1),==,AF_INET); + tt_int_op(tor_addr_to_ipv4h(&t1),==,0x01010203); + r=tor_addr_parse_mask_ports("[efef::]/112",0,&t1, &mask, &port1, &port2); test_assert(r == AF_INET6); test_assert(port1 == 1); test_assert(port2 == 65535); + /* Try regular wildcard behavior without TAPMP_EXTENDED_STAR */ + r=tor_addr_parse_mask_ports("*:80-443",0,&t1,&mask,&port1,&port2); + tt_int_op(r,==,AF_INET); /* Old users of this always get inet */ + tt_int_op(tor_addr_family(&t1),==,AF_INET); + tt_int_op(tor_addr_to_ipv4h(&t1),==,0); + tt_int_op(mask,==,0); + tt_int_op(port1,==,80); + tt_int_op(port2,==,443); + /* Now try wildcards *with* TAPMP_EXTENDED_STAR */ + r=tor_addr_parse_mask_ports("*:8000-9000",TAPMP_EXTENDED_STAR, + &t1,&mask,&port1,&port2); + tt_int_op(r,==,AF_UNSPEC); + tt_int_op(tor_addr_family(&t1),==,AF_UNSPEC); + tt_int_op(mask,==,0); + tt_int_op(port1,==,8000); + tt_int_op(port2,==,9000); + r=tor_addr_parse_mask_ports("*4:6667",TAPMP_EXTENDED_STAR, + &t1,&mask,&port1,&port2); + tt_int_op(r,==,AF_INET); + tt_int_op(tor_addr_family(&t1),==,AF_INET); + tt_int_op(tor_addr_to_ipv4h(&t1),==,0); + tt_int_op(mask,==,0); + tt_int_op(port1,==,6667); + tt_int_op(port2,==,6667); + r=tor_addr_parse_mask_ports("*6",TAPMP_EXTENDED_STAR, + &t1,&mask,&port1,&port2); + tt_int_op(r,==,AF_INET6); + tt_int_op(tor_addr_family(&t1),==,AF_INET6); + tt_assert(tor_mem_is_zero((const char*)tor_addr_to_in6_addr32(&t1), 16)); + tt_int_op(mask,==,0); + tt_int_op(port1,==,1); + tt_int_op(port2,==,65535); /* make sure inet address lengths >= max */ test_assert(INET_NTOA_BUF_LEN >= sizeof("255.255.255.255"));

1 0

[tor/master] Refactor client_dns_set_{reverse_, }addressmap() to take a circ
by nickm＠torproject.org 15 Nov '12

15 Nov '12

commit ca8843df0adb088b028b5599cd3062ea608f716b Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 28 17:13:37 2012 -0400 Refactor client_dns_set_{reverse_,}addressmap() to take a circ We'd like these functions to be circuit-relative so that we can implement a per-circuit DNS cache and per-circuit DNS cache rules for proposal 205 or its successors. I'm doing this now, as a part of the IPv6 exits code, since there are about to be a few more instances of code using this. --- src/or/addressmap.c | 14 +++++++++----- src/or/addressmap.h | 6 ++++-- src/or/connection_edge.c | 13 ++++++++++--- src/or/relay.c | 7 +++++-- 4 files changed, 28 insertions(+), 12 deletions(-) diff --git a/src/or/addressmap.c b/src/or/addressmap.c index fec83a7..4aa46fc 100644 --- a/src/or/addressmap.c +++ b/src/or/addressmap.c @@ -571,7 +571,8 @@ client_dns_clear_failures(const char *address) * ttlseconds; otherwise, we use the default. */ static void -client_dns_set_addressmap_impl(const char *address, const char *name, +client_dns_set_addressmap_impl(origin_circuit_t *on_circ, + const char *address, const char *name, const char *exitname, int ttl) { @@ -579,6 +580,7 @@ client_dns_set_addressmap_impl(const char *address, const char *name, char extendedaddress[MAX_SOCKS_ADDR_LEN+MAX_VERBOSE_NICKNAME_LEN+10]; /* 123.123.123.123.<hex or nickname>.exit\0 or just 123.123.123.123\0 */ char extendedval[INET_NTOA_BUF_LEN+MAX_VERBOSE_NICKNAME_LEN+10]; + (void)on_circ; tor_assert(address); tor_assert(name); @@ -617,7 +619,8 @@ client_dns_set_addressmap_impl(const char *address, const char *name, * ttlseconds; otherwise, we use the default. */ void -client_dns_set_addressmap(const char *address, uint32_t val, +client_dns_set_addressmap(origin_circuit_t *on_circ, + const char *address, uint32_t val, const char *exitname, int ttl) { @@ -631,7 +634,7 @@ client_dns_set_addressmap(const char *address, uint32_t val, in.s_addr = htonl(val); tor_inet_ntoa(&in,valbuf,sizeof(valbuf)); - client_dns_set_addressmap_impl(address, valbuf, exitname, ttl); + client_dns_set_addressmap_impl(on_circ, address, valbuf, exitname, ttl); } /** Add a cache entry noting that address (ordinarily a dotted quad) @@ -644,13 +647,14 @@ client_dns_set_addressmap(const char *address, uint32_t val, * ttlseconds; otherwise, we use the default. */ void -client_dns_set_reverse_addressmap(const char *address, const char *v, +client_dns_set_reverse_addressmap(origin_circuit_t *on_circ, + const char *address, const char *v, const char *exitname, int ttl) { char *s = NULL; tor_asprintf(&s, "REVERSE[%s]", address); - client_dns_set_addressmap_impl(s, v, exitname, ttl); + client_dns_set_addressmap_impl(on_circ, s, v, exitname, ttl); tor_free(s); } diff --git a/src/or/addressmap.h b/src/or/addressmap.h index 911c7ac..dd8fc9b 100644 --- a/src/or/addressmap.h +++ b/src/or/addressmap.h @@ -28,14 +28,16 @@ int parse_virtual_addr_network(const char *val, int validate_only, char **msg); int client_dns_incr_failures(const char *address); void client_dns_clear_failures(const char *address); -void client_dns_set_addressmap(const char *address, uint32_t val, +void client_dns_set_addressmap(origin_circuit_t *on_circ, + const char *address, uint32_t val, const char *exitname, int ttl); const char *addressmap_register_virtual_address(int type, char *new_address); void addressmap_get_mappings(smartlist_t *sl, time_t min_expires, time_t max_expires, int want_expiry); int address_is_in_virtual_range(const char *addr); void clear_trackexithost_mappings(const char *exitname); -void client_dns_set_reverse_addressmap(const char *address, const char *v, +void client_dns_set_reverse_addressmap(origin_circuit_t *on_circ, + const char *address, const char *v, const char *exitname, int ttl); #endif diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 1ee88f3..f548576 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1915,14 +1915,21 @@ connection_ap_handshake_socks_resolved(entry_connection_t *conn, size_t replylen; if (ttl >= 0) { + origin_circuit_t *origin_circ = NULL; + circuit_t *circ = ENTRY_TO_EDGE_CONN(conn)->on_circuit; + if (CIRCUIT_IS_ORIGIN(circ)) /* should always be true */ + origin_circ = TO_ORIGIN_CIRCUIT(circ); if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) { uint32_t a = ntohl(get_uint32(answer)); - if (a) - client_dns_set_addressmap(conn->socks_request->address, a, + if (a) { + client_dns_set_addressmap(origin_circ, + conn->socks_request->address, a, conn->chosen_exit_name, ttl); + } } else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) { char *cp = tor_strndup((char*)answer, answer_len); - client_dns_set_reverse_addressmap(conn->socks_request->address, + client_dns_set_reverse_addressmap(origin_circ, + conn->socks_request->address, cp, conn->chosen_exit_name, ttl); tor_free(cp); diff --git a/src/or/relay.c b/src/or/relay.c index 25fc2e7..76e9d25 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -725,7 +725,9 @@ connection_ap_process_end_not_open( connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL); return 0; } - client_dns_set_addressmap(conn->socks_request->address, addr, + + client_dns_set_addressmap(circ, + conn->socks_request->address, addr, conn->chosen_exit_name, ttl); } /* check if he *ought* to have allowed it */ @@ -898,7 +900,8 @@ connection_edge_process_relay_cell_not_open( ttl = (int)ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+4)); else ttl = -1; - client_dns_set_addressmap(entry_conn->socks_request->address, addr, + client_dns_set_addressmap(TO_ORIGIN_CIRCUIT(circ), + entry_conn->socks_request->address, addr, entry_conn->chosen_exit_name, ttl); remap_event_helper(entry_conn, addr);

1 0

[tor/master] Better policy support for IPv6
by nickm＠torproject.org 15 Nov '12

15 Nov '12

commit a96c0affcb4cda1a2e0d83d123993d10efc6e396 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 24 15:03:29 2012 -0400 Better policy support for IPv6 Now, "accept *:80" means "accept all addresses on port 80", and not just IPv4. For just v4, say "accept *4:80"; for just v6 say "accept *6:80". We can parse these policies from torrc just fine, and we should be successfully keeping them out of descriptors for now. We also now include appropriate IPv6 addresses in "reject private:*" --- src/or/dirserv.c | 2 +- src/or/dirvote.c | 2 +- src/or/or.h | 10 +++- src/or/policies.c | 135 ++++++++++++++++++++++++++++++++++++++++--------- src/or/policies.h | 3 +- src/or/router.c | 6 +- src/or/routerparse.c | 15 ++++-- src/or/routerset.c | 1 + src/test/test.c | 4 +- 9 files changed, 139 insertions(+), 39 deletions(-) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index e7aa582..1d63be0 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -2237,7 +2237,7 @@ routerstatus_format_entry(char *buf, size_t buf_len, } if (desc) { - summary = policy_summarize(desc->exit_policy); + summary = policy_summarize(desc->exit_policy, AF_INET); r = tor_snprintf(cp, buf_len - (cp-buf), "p %s\n", summary); if (r<0) { log_warn(LD_BUG, "Not enough space in buffer."); diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 7020943..f8b8d37 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -3552,7 +3552,7 @@ dirvote_create_microdescriptor(const routerinfo_t *ri, int consensus_method) if (crypto_pk_write_public_key_to_string(ri->onion_pkey, &key, &keylen)<0) goto done; - summary = policy_summarize(ri->exit_policy); + summary = policy_summarize(ri->exit_policy, AF_INET); if (ri->declared_family) family = smartlist_join_strings(ri->declared_family, " ", 0, NULL); diff --git a/src/or/or.h b/src/or/or.h index 6510725..42bf0a8 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1730,7 +1730,15 @@ typedef struct addr_policy_t { maskbits_t maskbits; /**< Accept/reject all addresses a such that the * first maskbits bits of a match * addr. */ - tor_addr_t addr; /**< Base address to accept or reject. */ + /** Base address to accept or reject. + * + * Note that wildcards are treated + * differntly depending on address family. An AF_UNSPEC address means + * "All addresses, IPv4 or IPv6." An AF_INET address with maskbits==0 means + * "All IPv4 addresses" and an AF_INET6 address with maskbits == 0 means + * "All IPv6 addresses". + **/ + tor_addr_t addr; uint16_t prt_min; /**< Lowest port number to accept/reject. */ uint16_t prt_max; /**< Highest port number to accept/reject. */ } addr_policy_t; diff --git a/src/or/policies.c b/src/or/policies.c index 442377b..8367446 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -59,8 +59,10 @@ typedef struct policy_summary_item_t { static const char *private_nets[] = { "0.0.0.0/8", "169.254.0.0/16", "127.0.0.0/8", "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12", - // "fc00::/7", "fe80::/10", "fec0::/10", "::/127", - NULL }; + "[::]/8", + "[fc00::]/7", "[fe80::]/10", "[fec0::]/10", "[ff00::]/8", "[::]/127", + NULL +}; /** Replace all "private" entries in *policy with their expanded * equivalents. */ @@ -101,6 +103,49 @@ policy_expand_private(smartlist_t **policy) *policy = tmp; } +/** Expand each of the AF_UNSPEC elements in *policy (which indicate + * protocol-neutral wildcards) into a pair of wildcard elements: one IPv4- + * specific and one IPv6-specific. */ +void +policy_expand_unspec(smartlist_t **policy) +{ + smartlist_t *tmp; + if (!*policy) + return; + + tmp = smartlist_new(); + SMARTLIST_FOREACH_BEGIN(*policy, addr_policy_t *, p) { + sa_family_t family = tor_addr_family(&p->addr); + if (family == AF_INET6 || family == AF_INET || p->is_private) { + smartlist_add(tmp, p); + } else if (family == AF_UNSPEC) { + addr_policy_t newpolicy_ipv4; + addr_policy_t newpolicy_ipv6; + memcpy(&newpolicy_ipv4, p, sizeof(addr_policy_t)); + memcpy(&newpolicy_ipv6, p, sizeof(addr_policy_t)); + newpolicy_ipv4.is_canonical = 0; + newpolicy_ipv6.is_canonical = 0; + if (p->maskbits != 0) { + log_warn(LD_BUG, "AF_UNSPEC policy with maskbits==%d", p->maskbits); + newpolicy_ipv4.maskbits = 0; + newpolicy_ipv6.maskbits = 0; + } + tor_addr_from_ipv4h(&newpolicy_ipv4.addr, 0); + tor_addr_from_ipv6_bytes(&newpolicy_ipv6.addr, + "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"); + smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv4)); + smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv6)); + addr_policy_free(p); + } else { + log_warn(LD_BUG, "Funny-looking address policy with family %d", family); + smartlist_add(tmp, p); + } + } SMARTLIST_FOREACH_END(p); + + smartlist_free(*policy); + *policy = tmp; +} + /** * Given a linked list of config lines containing "allow" and "deny" * tokens, parse them and append the result to dest. Return -1 @@ -145,6 +190,7 @@ parse_addr_policy(config_line_t *cfg, smartlist_t **dest, addr_policy_list_free(result); } else { policy_expand_private(&result); + policy_expand_unspec(&result); if (*dest) { smartlist_add_all(*dest, result); @@ -735,6 +781,10 @@ compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, static int addr_policy_covers(addr_policy_t *a, addr_policy_t *b) { + if (tor_addr_family(&a->addr) != tor_addr_family(&b->addr)) { + /* You can't cover a different family. */ + return 0; + } /* We can ignore accept/reject, since "accept *:80, reject *:80" reduces * to "accept *:80". */ if (a->maskbits > b->maskbits) { @@ -790,20 +840,32 @@ append_exit_policy_string(smartlist_t **policy, const char *more) static void exit_policy_remove_redundancies(smartlist_t *dest) { - addr_policy_t *ap, *tmp, *victim; + addr_policy_t *ap, *tmp; int i, j; - /* Step one: find a *:* entry and cut off everything after it. */ - for (i = 0; i < smartlist_len(dest); ++i) { - ap = smartlist_get(dest, i); - if (ap->maskbits == 0 && ap->prt_min <= 1 && ap->prt_max >= 65535) { - /* This is a catch-all line -- later lines are unreachable. */ - while (i+1 < smartlist_len(dest)) { - victim = smartlist_get(dest, i+1); - smartlist_del(dest, i+1); - addr_policy_free(victim); + /* Step one: kill every ipv4 thing after *4:*, every IPv6 thing after *6:* + */ + { + int kill_v4=0, kill_v6=0; + for (i = 0; i < smartlist_len(dest); ++i) { + sa_family_t family; + ap = smartlist_get(dest, i); + family = tor_addr_family(&ap->addr); + if ((family == AF_INET && kill_v4) || + (family == AF_INET6 && kill_v6)) { + smartlist_del_keeporder(dest, i--); + addr_policy_free(ap); + continue; + } + + if (ap->maskbits == 0 && ap->prt_min <= 1 && ap->prt_max >= 65535) { + /* This is a catch-all line -- later lines are unreachable. */ + if (family == AF_INET) { + kill_v4 = 1; + } else if (family == AF_INET6) { + kill_v6 = 1; + } } - break; } } @@ -869,6 +931,10 @@ exit_policy_remove_redundancies(smartlist_t *dest) * policy afterwards. If rejectprivate is true, prepend * "reject private:*" to the policy. Return -1 if we can't parse cfg, * else return 0. + * + * This function is used to parse the exit policy from our torrc. For + * the functions used to parse the exit policy from a router descriptor, + * see router_add_exit_policy. */ int policies_parse_exit_policy(config_line_t *cfg, smartlist_t **dest, @@ -885,10 +951,12 @@ policies_parse_exit_policy(config_line_t *cfg, smartlist_t **dest, } if (parse_addr_policy(cfg, dest, -1)) return -1; - if (add_default_policy) + if (add_default_policy) { append_exit_policy_string(dest, DEFAULT_EXIT_POLICY); - else - append_exit_policy_string(dest, "reject *:*"); + } else { + append_exit_policy_string(dest, "reject *4:*"); + append_exit_policy_string(dest, "reject *6:*"); + } exit_policy_remove_redundancies(*dest); return 0; @@ -899,7 +967,8 @@ policies_parse_exit_policy(config_line_t *cfg, smartlist_t **dest, void policies_exit_policy_append_reject_star(smartlist_t **dest) { - append_exit_policy_string(dest, "reject *:*"); + append_exit_policy_string(dest, "reject *4:*"); + append_exit_policy_string(dest, "reject *6:*"); } /** Replace the exit policy of node with reject *:* */ @@ -1001,17 +1070,26 @@ policy_write_item(char *buf, size_t buflen, addr_policy_t *policy, const char *addrpart; int result; const int is_accept = policy->policy_type == ADDR_POLICY_ACCEPT; - const int is_ip6 = tor_addr_family(&policy->addr) == AF_INET6; + const sa_family_t family = tor_addr_family(&policy->addr); + const int is_ip6 = (family == AF_INET6); tor_addr_to_str(addrbuf, &policy->addr, sizeof(addrbuf), 1); /* write accept/reject 1.2.3.4 */ - if (policy->is_private) + if (policy->is_private) { addrpart = "private"; - else if (policy->maskbits == 0) - addrpart = "*"; - else + } else if (policy->maskbits == 0) { + if (format_for_desc) + addrpart = "*"; + else if (family == AF_INET6) + addrpart = "*6"; + else if (family == AF_INET) + addrpart = "*4"; + else + addrpart = "*"; + } else { addrpart = addrbuf; + } result = tor_snprintf(buf, buflen, "%s%s %s", is_accept ? "accept" : "reject", @@ -1220,7 +1298,7 @@ policy_summary_add_item(smartlist_t *summary, addr_policy_t *p) * is an exception to the shorter-representation-wins rule). */ char * -policy_summarize(smartlist_t *policy) +policy_summarize(smartlist_t *policy, sa_family_t family) { smartlist_t *summary = policy_summary_create(); smartlist_t *accepts, *rejects; @@ -1232,9 +1310,16 @@ policy_summarize(smartlist_t *policy) tor_assert(policy); /* Create the summary list */ - SMARTLIST_FOREACH(policy, addr_policy_t *, p, { + SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, p) { + sa_family_t f = tor_addr_family(&p->addr); + if (f != AF_INET && f != AF_INET6) { + log_warn(LD_BUG, "Weird family when summarizing address policy"); + } + if (f != family) + continue; + /* XXXX-ipv6 More family work is needed */ policy_summary_add_item(summary, p); - }); + } SMARTLIST_FOREACH_END(p); /* Now create two lists of strings, one for accepted and one * for rejected ports. We take care to merge ranges so that diff --git a/src/or/policies.h b/src/or/policies.h index 431e69e..e9d214d 100644 --- a/src/or/policies.h +++ b/src/or/policies.h @@ -31,6 +31,7 @@ int authdir_policy_badexit_address(uint32_t addr, uint16_t port); int validate_addr_policies(const or_options_t *options, char **msg); void policy_expand_private(smartlist_t **policy); +void policy_expand_unspec(smartlist_t **policy); int policies_parse_from_options(const or_options_t *options); addr_policy_t *addr_policy_get_canonical_entry(addr_policy_t *ent); @@ -58,7 +59,7 @@ void addr_policy_list_free(smartlist_t *p); void addr_policy_free(addr_policy_t *p); void policies_free_all(void); -char *policy_summarize(smartlist_t *policy); +char *policy_summarize(smartlist_t *policy, sa_family_t family); short_policy_t *parse_short_policy(const char *summary); char *write_short_policy(const short_policy_t *policy); diff --git a/src/or/router.c b/src/or/router.c index 1cac63a..efe24d7 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -2001,7 +2001,6 @@ router_dump_router_to_string(char *s, size_t maxlen, routerinfo_t *router, size_t onion_pkeylen, identity_pkeylen; size_t written; int result=0; - addr_policy_t *tmpe; char *family_line; char *extra_or_address = NULL; const or_options_t *options = get_options(); @@ -2130,11 +2129,12 @@ router_dump_router_to_string(char *s, size_t maxlen, routerinfo_t *router, if (!router->exit_policy || !smartlist_len(router->exit_policy)) { strlcat(s+written, "reject *:*\n", maxlen-written); written += strlen("reject *:*\n"); - tmpe = NULL; } else if (router->exit_policy) { int i; for (i = 0; i < smartlist_len(router->exit_policy); ++i) { - tmpe = smartlist_get(router->exit_policy, i); + addr_policy_t *tmpe = smartlist_get(router->exit_policy, i); + if (tor_addr_family(&tmpe->addr) == AF_INET6) + continue; /* Don't include IPv6 parts of address policy */ result = policy_write_item(s+written, maxlen-written, tmpe, 1); if (result < 0) { log_warn(LD_BUG,"descriptor policy_write_item ran out of room!"); diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 6069c8d..7c1dd88 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -535,7 +535,8 @@ static token_rule_t microdesc_token_table[] = { /* static function prototypes */ static int router_add_exit_policy(routerinfo_t *router,directory_token_t *tok); -static addr_policy_t *router_parse_addr_policy(directory_token_t *tok); +static addr_policy_t *router_parse_addr_policy(directory_token_t *tok, + unsigned fmt_flags); static addr_policy_t *router_parse_addr_policy_private(directory_token_t *tok); static int router_get_hash_impl(const char *s, size_t s_len, char *digest, @@ -3633,6 +3634,10 @@ networkstatus_parse_detached_signatures(const char *s, const char *eos) /** Parse the addr policy in the string s and return it. If * assume_action is nonnegative, then insert its action (ADDR_POLICY_ACCEPT or * ADDR_POLICY_REJECT) for items that specify no action. + * + * The addr_policy_t returned by this function can have its address set to + * AF_UNSPEC for '*'. Use policy_expand_unspec() to turn this into a pair + * of AF_INET and AF_INET6 items. */ addr_policy_t * router_parse_addr_policy_item_from_string(const char *s, int assume_action) @@ -3672,7 +3677,7 @@ router_parse_addr_policy_item_from_string(const char *s, int assume_action) goto err; } - r = router_parse_addr_policy(tok); + r = router_parse_addr_policy(tok, TAPMP_EXTENDED_STAR); goto done; err: r = NULL; @@ -3691,7 +3696,7 @@ static int router_add_exit_policy(routerinfo_t *router, directory_token_t *tok) { addr_policy_t *newe; - newe = router_parse_addr_policy(tok); + newe = router_parse_addr_policy(tok, 0); if (!newe) return -1; if (! router->exit_policy) @@ -3716,7 +3721,7 @@ router_add_exit_policy(routerinfo_t *router, directory_token_t *tok) /** Given a K_ACCEPT or K_REJECT token and a router, create and return * a new exit_policy_t corresponding to the token. */ static addr_policy_t * -router_parse_addr_policy(directory_token_t *tok) +router_parse_addr_policy(directory_token_t *tok, unsigned fmt_flags) { addr_policy_t newe; char *arg; @@ -3738,7 +3743,7 @@ router_parse_addr_policy(directory_token_t *tok) else newe.policy_type = ADDR_POLICY_ACCEPT; - if (tor_addr_parse_mask_ports(arg, 0, &newe.addr, &newe.maskbits, + if (tor_addr_parse_mask_ports(arg, fmt_flags, &newe.addr, &newe.maskbits, &newe.prt_min, &newe.prt_max) < 0) { log_warn(LD_DIR,"Couldn't parse line %s. Dropping", escaped(arg)); return NULL; diff --git a/src/or/routerset.c b/src/or/routerset.c index 8a5ff21..a495863 100644 --- a/src/or/routerset.c +++ b/src/or/routerset.c @@ -148,6 +148,7 @@ routerset_parse(routerset_t *target, const char *s, const char *description) SMARTLIST_DEL_CURRENT(list, nick); } } SMARTLIST_FOREACH_END(nick); + policy_expand_unspec(&target->policies); smartlist_add_all(target->list, list); smartlist_free(list); if (added_countries) diff --git a/src/test/test.c b/src/test/test.c index fc3c36e..6652e77 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -1046,7 +1046,7 @@ test_policy_summary_helper(const char *policy_str, r = policies_parse_exit_policy(&line, &policy, 0, NULL, 1); test_eq(r, 0); - summary = policy_summarize(policy); + summary = policy_summarize(policy, AF_INET); test_assert(summary != NULL); test_streq(summary, expected_summary); @@ -1192,7 +1192,7 @@ test_policies(void) test_assert(policy); //test_streq(policy->string, "accept *:80"); //test_streq(policy->next->string, "reject *:*"); - test_eq(smartlist_len(policy), 2); + test_eq(smartlist_len(policy), 4); /* test policy summaries */ /* check if we properly ignore private IP addresses */

1 0

[tor/master] Parse IPv6 policy summaries from router descriptors and microdescs
by nickm＠torproject.org 15 Nov '12

15 Nov '12

commit c53adac122e88dbd943febfdd1f3deeab9e8309a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 24 21:59:55 2012 -0400 Parse IPv6 policy summaries from router descriptors and microdescs --- src/or/microdesc.c | 1 + src/or/or.h | 10 ++++++++-- src/or/routerlist.c | 1 + src/or/routerparse.c | 15 +++++++++++++++ 4 files changed, 25 insertions(+), 2 deletions(-) diff --git a/src/or/microdesc.c b/src/or/microdesc.c index 42a35f0..e274313 100644 --- a/src/or/microdesc.c +++ b/src/or/microdesc.c @@ -583,6 +583,7 @@ microdesc_free(microdesc_t *md) smartlist_free(md->family); } short_policy_free(md->exit_policy); + short_policy_free(md->ipv6_exit_policy); tor_free(md); } diff --git a/src/or/or.h b/src/or/or.h index 42bf0a8..05d27b1 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1878,7 +1878,10 @@ typedef struct { /** How many bytes/s is this router known to handle? */ uint32_t bandwidthcapacity; smartlist_t *exit_policy; /**< What streams will this OR permit - * to exit? NULL for 'reject *:*'. */ + * to exit on IPv4? NULL for 'reject *:*'. */ + /** What streams will this OR permit to exit on IPv6? + * NULL for 'reject *:*' */ + struct short_policy_t *ipv6_exit_policy; long uptime; /**< How many seconds the router claims to have been up */ smartlist_t *declared_family; /**< Nicknames of router which this router * claims are its family. */ @@ -2084,8 +2087,11 @@ typedef struct microdesc_t { uint16_t ipv6_orport; /** As routerinfo_t.family */ smartlist_t *family; - /** Exit policy summary */ + /** IPv4 exit policy summary */ short_policy_t *exit_policy; + /** IPv6 exit policy summary */ + short_policy_t *ipv6_exit_policy; + } microdesc_t; /** A node_t represents a Tor router. diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 1cefef9..1735837 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2402,6 +2402,7 @@ routerinfo_free(routerinfo_t *router) smartlist_free(router->declared_family); } addr_policy_list_free(router->exit_policy); + short_policy_free(router->ipv6_exit_policy); memset(router, 77, sizeof(routerinfo_t)); diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 7c1dd88..5607479 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -66,6 +66,7 @@ typedef enum { K_SERVER_VERSIONS, K_OR_ADDRESS, K_P, + K_P6, K_R, K_A, K_S, @@ -77,6 +78,7 @@ typedef enum { K_CACHES_EXTRA_INFO, K_HIDDEN_SERVICE_DIR, K_ALLOW_SINGLE_HOP_EXITS, + K_IPV6_POLICY, K_DIRREQ_END, K_DIRREQ_V2_IPS, @@ -271,6 +273,7 @@ static token_rule_t routerdesc_token_table[] = { T0N("reject6", K_REJECT6, ARGS, NO_OBJ ), T0N("accept6", K_ACCEPT6, ARGS, NO_OBJ ), T1_START( "router", K_ROUTER, GE(5), NO_OBJ ), + T01("ipv6-policy", K_IPV6_POLICY, CONCAT_ARGS, NO_OBJ), T1( "signing-key", K_SIGNING_KEY, NO_ARGS, NEED_KEY_1024 ), T1( "onion-key", K_ONION_KEY, NO_ARGS, NEED_KEY_1024 ), T1_END( "router-signature", K_ROUTER_SIGNATURE, NO_ARGS, NEED_OBJ ), @@ -527,6 +530,7 @@ static token_rule_t microdesc_token_table[] = { T0N("a", K_A, GE(1), NO_OBJ ), T01("family", K_FAMILY, ARGS, NO_OBJ ), T01("p", K_P, CONCAT_ARGS, NO_OBJ ), + T01("p6", K_P6, CONCAT_ARGS, NO_OBJ ), A01("@last-listed", A_LAST_LISTED, CONCAT_ARGS, NO_OBJ ), END_OF_TABLE }; @@ -1573,6 +1577,14 @@ router_parse_entry_from_string(const char *s, const char *end, if (policy_is_reject_star(router->exit_policy)) router->policy_is_reject_star = 1; + if ((tok = find_opt_by_keyword(tokens, K_IPV6_POLICY)) && tok->n_args) { + router->ipv6_exit_policy = parse_short_policy(tok->args[0]); + if (! router->ipv6_exit_policy) { + log_warn(LD_DIR , "Error in ipv6-policy %s", escaped(tok->args[0])); + goto err; + } + } + if ((tok = find_opt_by_keyword(tokens, K_FAMILY)) && tok->n_args) { int i; router->declared_family = smartlist_new(); @@ -4484,6 +4496,9 @@ microdescs_parse_from_string(const char *s, const char *eos, if ((tok = find_opt_by_keyword(tokens, K_P))) { md->exit_policy = parse_short_policy(tok->args[0]); } + if ((tok = find_opt_by_keyword(tokens, K_P6))) { + md->ipv6_exit_policy = parse_short_policy(tok->args[0]); + } crypto_digest256(md->digest, md->body, md->bodylen, DIGEST_SHA256);

1 0