June 2012 - tor-commits - lists.torproject.org

[tor/master] Make the option-checker code work with osx clang
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit e6dbe693b7fd90a495b98ec790205ff4ac56fea9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 11 15:52:36 2012 -0400 Make the option-checker code work with osx clang This is a matter of making gcc and friends squirm more loudly when they get an option they don't like (-pedantic) and making clang shut up with it gets an option it tolerates but doesnt know (-Qunknown-argument). Is there no better way? --- acinclude.m4 | 4 ++-- configure.in | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/acinclude.m4 b/acinclude.m4 index c482e37..c5037fa 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -46,7 +46,7 @@ AC_DEFUN([TOR_CHECK_CFLAGS], [ AS_VAR_PUSHDEF([VAR],[tor_cv_cflags_$1]) AC_CACHE_CHECK([whether the compiler accepts $1], VAR, [ tor_saved_CFLAGS="$CFLAGS" - CFLAGS="$CFLAGS $1" + CFLAGS="$CFLAGS -pedantic $1" AC_TRY_COMPILE([], [return 0;], [AS_VAR_SET(VAR,yes)], [AS_VAR_SET(VAR,no)]) @@ -63,7 +63,7 @@ AC_DEFUN([TOR_CHECK_LDFLAGS], [ AS_VAR_PUSHDEF([VAR],[tor_cv_ldflags_$1]) AC_CACHE_CHECK([whether the linker accepts $1], VAR, [ tor_saved_LDFLAGS="$LDFLAGS" - LDFLAGS="$LDFLAGS $1" + LDFLAGS="$LDFLAGS -pedantic $1" AC_TRY_LINK([], [return 0;], [AS_VAR_SET(VAR,yes)], [AS_VAR_SET(VAR,no)]) diff --git a/configure.in b/configure.in index d894c73..3e64575 100644 --- a/configure.in +++ b/configure.in @@ -173,6 +173,7 @@ AM_PROG_CC_C_O if test x$enable_gcc_hardening != xno; then CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2" + TOR_CHECK_CFLAGS(-Qunused-arguments) TOR_CHECK_CFLAGS(-fstack-protector-all) TOR_CHECK_CFLAGS(-Wstack-protector) TOR_CHECK_CFLAGS(-fwrapv)

1 0

[tor/master] Try to manually test for whether the compiler hardening flags work
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit e36cd016337f26188f572e0bd511a4f8b72c07dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 11 15:08:16 2012 -0400 Try to manually test for whether the compiler hardening flags work Also, make the check for whether they're on by default work; there's no need to mess around with this "$enableval" silliness. --- acinclude.m4 | 34 ++++++++++++++++++++++++++++++++++ configure.in | 31 ++++++++++++++++--------------- 2 files changed, 50 insertions(+), 15 deletions(-) diff --git a/acinclude.m4 b/acinclude.m4 index ccfecff..c482e37 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -41,6 +41,40 @@ AC_DEFUN([TOR_DEFINE_CODEPATH], AC_SUBST(TOR_LDFLAGS_$2) ]) +dnl 1:flags +AC_DEFUN([TOR_CHECK_CFLAGS], [ + AS_VAR_PUSHDEF([VAR],[tor_cv_cflags_$1]) + AC_CACHE_CHECK([whether the compiler accepts $1], VAR, [ + tor_saved_CFLAGS="$CFLAGS" + CFLAGS="$CFLAGS $1" + AC_TRY_COMPILE([], [return 0;], + [AS_VAR_SET(VAR,yes)], + [AS_VAR_SET(VAR,no)]) + CFLAGS="$tor_saved_CFLAGS" + ]) + if test x$VAR = xyes; then + CFLAGS="$CFLAGS $1" + fi + AS_VAR_POPDEF([VAR]) +]) + +dnl 1:flags +AC_DEFUN([TOR_CHECK_LDFLAGS], [ + AS_VAR_PUSHDEF([VAR],[tor_cv_ldflags_$1]) + AC_CACHE_CHECK([whether the linker accepts $1], VAR, [ + tor_saved_LDFLAGS="$LDFLAGS" + LDFLAGS="$LDFLAGS $1" + AC_TRY_LINK([], [return 0;], + [AS_VAR_SET(VAR,yes)], + [AS_VAR_SET(VAR,no)]) + LDFLAGS="$tor_saved_LDFLAGS" + ]) + if test x$VAR = xyes; then + LDFLAGS="$LDFLAGS $1" + fi + AS_VAR_POPDEF([VAR]) +]) + dnl 1:libname AC_DEFUN([TOR_WARN_MISSING_LIB], [ h="" diff --git a/configure.in b/configure.in index 4a3ed0e..d894c73 100644 --- a/configure.in +++ b/configure.in @@ -122,25 +122,12 @@ dnl -D_FORTIFY_SOURCE=2 -fstack-protector-all dnl Others suggest '/gs /safeseh /nxcompat /dynamicbase' for non-gcc on Windows dnl This requires that we use gcc and that we add -O2 to the CFLAGS. AC_ARG_ENABLE(gcc-hardening, - AS_HELP_STRING(--disable-gcc-hardening, disable compiler security checks), - [], - [enableval=yes;]) -[if test x$enableval = xyes; then - CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2 -fstack-protector-all" - CFLAGS="$CFLAGS -fwrapv -fPIE -Wstack-protector" - CFLAGS="$CFLAGS --param ssp-buffer-size=1" - LDFLAGS="$LDFLAGS -pie" -fi] + AS_HELP_STRING(--disable-gcc-hardening, disable compiler security checks)) dnl Linker hardening options dnl Currently these options are ELF specific - you can't use this with MacOSX AC_ARG_ENABLE(linker-hardening, - AS_HELP_STRING(--disable-linker-hardening, disable linker security fixups), - [], - [enableval=yes;]) -AC_CHECK_HEADER([elf.h], [if test x$enableval = xyes; then - LDFLAGS="$LDFLAGS -z relro -z now" -fi]) + AS_HELP_STRING(--disable-linker-hardening, disable linker security fixups)) AC_ARG_ENABLE(local-appdata, AS_HELP_STRING(--enable-local-appdata, default to host local application data paths on Windows)) @@ -184,6 +171,20 @@ AM_CONDITIONAL(NAT_PMP, test x$natpmp = xtrue) AM_CONDITIONAL(MINIUPNPC, test x$upnp = xtrue) AM_PROG_CC_C_O +if test x$enable_gcc_hardening != xno; then + CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2" + TOR_CHECK_CFLAGS(-fstack-protector-all) + TOR_CHECK_CFLAGS(-Wstack-protector) + TOR_CHECK_CFLAGS(-fwrapv) + TOR_CHECK_CFLAGS(-fPIE) + TOR_CHECK_CFLAGS(--param ssp-buffer-size=1) + TOR_CHECK_LDFLAGS(-pie) +fi + +if test x$enable_linker_hardening != xno; then + TOR_CHECK_LDFLAGS(-z relro -z now) +fi + ifdef([AC_C_FLEXIBLE_ARRAY_MEMBER], [ AC_C_FLEXIBLE_ARRAY_MEMBER ], [

1 0

[tor/master] fix for bug #5210: enable GCC and LD hardening by default
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit 62f3121a3d209fb4f826988d53b1aac93842502c Author: Florent Daigniere <nextgens(a)freenetproject.org> Date: Thu Mar 15 10:02:30 2012 +0000 fix for bug #5210: enable GCC and LD hardening by default --- changes/bug5210 | 2 ++ configure.in | 12 ++++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/changes/bug5210 b/changes/bug5210 new file mode 100644 index 0000000..b07e7f1 --- /dev/null +++ b/changes/bug5210 @@ -0,0 +1,2 @@ + o Security fixes: + - Enable gcc and ld hardening by default. Fixes bug 5210. diff --git a/configure.in b/configure.in index 7415ce8..4a3ed0e 100644 --- a/configure.in +++ b/configure.in @@ -122,19 +122,23 @@ dnl -D_FORTIFY_SOURCE=2 -fstack-protector-all dnl Others suggest '/gs /safeseh /nxcompat /dynamicbase' for non-gcc on Windows dnl This requires that we use gcc and that we add -O2 to the CFLAGS. AC_ARG_ENABLE(gcc-hardening, - AS_HELP_STRING(--enable-gcc-hardening, enable compiler security checks), + AS_HELP_STRING(--disable-gcc-hardening, disable compiler security checks), + [], + [enableval=yes;]) [if test x$enableval = xyes; then CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2 -fstack-protector-all" CFLAGS="$CFLAGS -fwrapv -fPIE -Wstack-protector" CFLAGS="$CFLAGS --param ssp-buffer-size=1" LDFLAGS="$LDFLAGS -pie" -fi]) +fi] dnl Linker hardening options dnl Currently these options are ELF specific - you can't use this with MacOSX AC_ARG_ENABLE(linker-hardening, - AS_HELP_STRING(--enable-linker-hardening, enable linker security fixups), -[if test x$enableval = xyes; then + AS_HELP_STRING(--disable-linker-hardening, disable linker security fixups), + [], + [enableval=yes;]) +AC_CHECK_HEADER([elf.h], [if test x$enableval = xyes; then LDFLAGS="$LDFLAGS -z relro -z now" fi])

1 0

[tor/master] Document ADDRMAPSRC_NONE.
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit c18b6ec3d40593ff411809acac972a51ab451d52 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 11 21:49:08 2012 -0400 Document ADDRMAPSRC_NONE. --- src/or/or.h | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/or/or.h b/src/or/or.h index f1260d1..b77f4c6 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3857,7 +3857,9 @@ typedef enum { * Tor server that told us what its value was. */ ADDRMAPSRC_DNS, - /** DOCDOC */ + /** No remapping has occurred. This isn't a possible value for an + * addrmap_entry_t; it's used as a null value when we need to answer "Why + * did this remapping happen." */ ADDRMAPSRC_NONE } addressmap_entry_source_t;

1 0

[tor/master] Do not try to use -pie on windows; it appears to break badly and weirdly
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit 4717951cfaa7bc97ace35b6a542495680844f407 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 11 12:22:48 2012 -0400 Do not try to use -pie on windows; it appears to break badly and weirdly --- configure.in | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/configure.in b/configure.in index 7167ca9..051c924 100644 --- a/configure.in +++ b/configure.in @@ -566,9 +566,11 @@ if test x$enable_gcc_hardening != xno; then TOR_CHECK_CFLAGS(-fstack-protector-all) TOR_CHECK_CFLAGS(-Wstack-protector) TOR_CHECK_CFLAGS(-fwrapv) - TOR_CHECK_CFLAGS(-fPIE) TOR_CHECK_CFLAGS(--param ssp-buffer-size=1) - TOR_CHECK_LDFLAGS(-pie, "$all_ldflags_for_check", "$all_libs_for_check") + if test "$bwin32" = "false"; then + TOR_CHECK_CFLAGS(-fPIE) + TOR_CHECK_LDFLAGS(-pie, "$all_ldflags_for_check", "$all_libs_for_check") + fi fi if test x$enable_linker_hardening != xno; then

1 0

[tor/master] Make our compiler-hardening checks robust against MinGW
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit ebaaa4834f803015e68d348f330fcef88de34a92 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 11 11:00:48 2012 -0400 Make our compiler-hardening checks robust against MinGW First, specify -Werror when we are testing each option; if it causes a warning to appear, we shouldn't be adding it. Second, do not attempt to add these options until after we have found the libraries we want. Previously, I would hit a bug where the linker hardening options worked fine when we weren't linking anything, but failed completely once we added openssl or libevent. --- acinclude.m4 | 12 ++++++++++-- configure.in | 39 +++++++++++++++++++++++---------------- 2 files changed, 33 insertions(+), 18 deletions(-) diff --git a/acinclude.m4 b/acinclude.m4 index c5037fa..5e09c96 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -46,7 +46,7 @@ AC_DEFUN([TOR_CHECK_CFLAGS], [ AS_VAR_PUSHDEF([VAR],[tor_cv_cflags_$1]) AC_CACHE_CHECK([whether the compiler accepts $1], VAR, [ tor_saved_CFLAGS="$CFLAGS" - CFLAGS="$CFLAGS -pedantic $1" + CFLAGS="$CFLAGS -pedantic -Werror $1" AC_TRY_COMPILE([], [return 0;], [AS_VAR_SET(VAR,yes)], [AS_VAR_SET(VAR,no)]) @@ -59,15 +59,23 @@ AC_DEFUN([TOR_CHECK_CFLAGS], [ ]) dnl 1:flags +dnl 2:extra ldflags +dnl 3:extra libraries AC_DEFUN([TOR_CHECK_LDFLAGS], [ AS_VAR_PUSHDEF([VAR],[tor_cv_ldflags_$1]) AC_CACHE_CHECK([whether the linker accepts $1], VAR, [ + tor_saved_CFLAGS="$CFLAGS" tor_saved_LDFLAGS="$LDFLAGS" - LDFLAGS="$LDFLAGS -pedantic $1" + tor_saved_LIBS="$LIBS" + CFLAGS="$CFLAGS -pedantic -Werror" + LDFLAGS="$LDFLAGS $2 $1" + LIBS="$LIBS $3" AC_TRY_LINK([], [return 0;], [AS_VAR_SET(VAR,yes)], [AS_VAR_SET(VAR,no)]) + CFLAGS="$tor_saved_CFLAGS" LDFLAGS="$tor_saved_LDFLAGS" + LIBS="$tor_saved_LIBS" ]) if test x$VAR = xyes; then LDFLAGS="$LDFLAGS $1" diff --git a/configure.in b/configure.in index 3e64575..7167ca9 100644 --- a/configure.in +++ b/configure.in @@ -171,21 +171,6 @@ AM_CONDITIONAL(NAT_PMP, test x$natpmp = xtrue) AM_CONDITIONAL(MINIUPNPC, test x$upnp = xtrue) AM_PROG_CC_C_O -if test x$enable_gcc_hardening != xno; then - CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2" - TOR_CHECK_CFLAGS(-Qunused-arguments) - TOR_CHECK_CFLAGS(-fstack-protector-all) - TOR_CHECK_CFLAGS(-Wstack-protector) - TOR_CHECK_CFLAGS(-fwrapv) - TOR_CHECK_CFLAGS(-fPIE) - TOR_CHECK_CFLAGS(--param ssp-buffer-size=1) - TOR_CHECK_LDFLAGS(-pie) -fi - -if test x$enable_linker_hardening != xno; then - TOR_CHECK_LDFLAGS(-z relro -z now) -fi - ifdef([AC_C_FLEXIBLE_ARRAY_MEMBER], [ AC_C_FLEXIBLE_ARRAY_MEMBER ], [ @@ -566,8 +551,29 @@ else fi AC_SUBST(TOR_ZLIB_LIBS) -dnl Make sure to enable support for large off_t if available. +dnl --------------------------------------------------------------------- +dnl Now that we know about our major libraries, we can check for compiler +dnl and linker hardening options. We need to do this with the libraries known, +dnl since sometimes the linker will like an option but not be willing to +dnl use it with a build of a library. +all_ldflags_for_check="$TOR_LDFLAGS_zlib $TOR_LDFLAGS_openssl $TOR_LDFLAGS_libevent" +all_libs_for_check="$TOR_ZLIB_LIBS $TOR_LIB_MATH $TOR_LIBEVENT_LIBS $TOR_OPENSSL_LIBS $TOR_LIB_WS32 $TOR_LIB_GDI" + +if test x$enable_gcc_hardening != xno; then + CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2" + TOR_CHECK_CFLAGS(-Qunused-arguments) + TOR_CHECK_CFLAGS(-fstack-protector-all) + TOR_CHECK_CFLAGS(-Wstack-protector) + TOR_CHECK_CFLAGS(-fwrapv) + TOR_CHECK_CFLAGS(-fPIE) + TOR_CHECK_CFLAGS(--param ssp-buffer-size=1) + TOR_CHECK_LDFLAGS(-pie, "$all_ldflags_for_check", "$all_libs_for_check") +fi + +if test x$enable_linker_hardening != xno; then + TOR_CHECK_LDFLAGS(-z relro -z now, "$all_ldflags_for_check", "$all_libs_for_check") +fi dnl ------------------------------------------------------ dnl Where do you live, libnatpmp? And how do we call you? @@ -609,6 +615,7 @@ if test "$upnp" = "true"; then [/usr/lib/]) fi +dnl Make sure to enable support for large off_t if available. AC_SYS_LARGEFILE AC_CHECK_HEADERS(

1 0

[tor/master] fixup! An attempt at bug3940 and making AllowDotExit 0 work with MapAddress
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit ba9a12119c88676fa0dd2a282d927840cd5d94fb Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 11 21:50:52 2012 -0400 fixup! An attempt at bug3940 and making AllowDotExit 0 work with MapAddress --- src/or/connection_edge.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 12f9d6b..0dd43f2 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1935,8 +1935,8 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, (exit_source == ADDRMAPSRC_NONE && !options->AllowDotExit)) { /* It shouldn't be possible to get a .exit address from any of these * sources. */ - log_warn(LD_BUG,"Address '%s.exit', with impossible source for the .exit " - "part. Refusing.", + log_warn(LD_BUG,"Address '%s.exit', with impossible source for the " + ".exit part. Refusing.", safe_str_client(socks->address)); control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s", escaped(socks->address));

1 0

[tor/master] Merge remote-tracking branch 'public/bug5210'
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit 62a77f1117335f2ddee86f696379dde106ad1ee0 Merge: 9dd4e5a 4717951 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 13 11:37:11 2012 -0400 Merge remote-tracking branch 'public/bug5210' acinclude.m4 | 42 ++++++++++++++++++++++++++++++++++++++++++ changes/bug5210 | 2 ++ configure.in | 39 +++++++++++++++++++++++++++------------ 3 files changed, 71 insertions(+), 12 deletions(-) diff --cc configure.in index 656a324,051c924..18869a1 --- a/configure.in +++ b/configure.in @@@ -595,36 -606,18 +609,37 @@@ dnl There are no packages for Debian o if test "$upnp" = "true"; then AC_DEFINE(MINIUPNPC, 1, [Define to 1 if we are building with UPnP.]) - TOR_SEARCH_LIBRARY(libminiupnpc, $trylibminiupnpcdir, [-lminiupnpc $TOR_LIB_WS32 $TOR_LIB_IPHLPAPI], - [#include <miniupnpc/miniwget.h> - #include <miniupnpc/miniupnpc.h> - #include <miniupnpc/upnpcommands.h>], - [void upnpDiscover(int delay, const char * multicastif, - const char * minissdpdsock, int sameport);], - [upnpDiscover(1, 0, 0, 0); exit(0);], - [--with-libminiupnpc-dir], - [/usr/lib/]) + + dnl Before we call TOR_SEARCH_LIBRARY we'll do a quick compile test + dnl to see if we have miniupnpc-1.5 or -1.6 + AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include <miniupnpc/miniupnpc.h>], + [upnpDiscover(1, 0, 0, 0);exit(0);])],[miniupnpc15="true"],[miniupnpc15="false"]) + + if test "$miniupnpc15" = "true" ; then + AC_DEFINE([MINIUPNPC15],[1],[libminiupnpc version 1.5 found]) + TOR_SEARCH_LIBRARY(libminiupnpc, $trylibminiupnpcdir, [-lminiupnpc $TOR_LIB_WS32 $TOR_LIB_IPHLPAPI], + [#include <miniupnpc/miniwget.h> + #include <miniupnpc/miniupnpc.h> + #include <miniupnpc/upnpcommands.h>], + [void upnpDiscover(int delay, const char * multicastif, + const char * minissdpdsock, int sameport);], + [upnpDiscover(1, 0, 0, 0); exit(0);], + [--with-libminiupnpc-dir], + [/usr/lib/]) + else + TOR_SEARCH_LIBRARY(libminiupnpc, $trylibminiupnpcdir, [-lminiupnpc $TOR_LIB_WS32 $TOR_LIB_IPHLPAPI], + [#include <miniupnpc/miniwget.h> + #include <miniupnpc/miniupnpc.h> + #include <miniupnpc/upnpcommands.h>], + [void upnpDiscover(int delay, const char * multicastif, + const char * minissdpdsock, int sameport, int ipv6, int * error);], + [upnpDiscover(1, 0, 0, 0, 0, 0); exit(0);], + [--with-libminiupnpc-dir], + [/usr/lib/]) + fi fi + dnl Make sure to enable support for large off_t if available. AC_SYS_LARGEFILE AC_CHECK_HEADERS(

1 0

[tor/master] Merge remote-tracking branch 'public/bug3940_redux'
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit 5a3d9636f5e0ead80a46163af9ffadcbf6d5195f Merge: 62a77f1 ba9a121 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 13 11:40:38 2012 -0400 Merge remote-tracking branch 'public/bug3940_redux' changes/bug3940_redux | 5 ++ src/or/connection_edge.c | 104 ++++++++++++++++++++++++++++++--------------- src/or/connection_edge.h | 5 +- src/or/or.h | 5 ++ src/or/relay.c | 2 +- src/test/test.c | 8 ++-- src/test/test_config.c | 46 ++++++++++---------- 7 files changed, 110 insertions(+), 65 deletions(-)

1 0

[tor/master] Document the new exit_source_out argument to addressmap_rewrite
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit b2be6c7f9716ec18c0fb57f10d2bfdf8c1569d3e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 4 17:15:21 2012 -0400 Document the new exit_source_out argument to addressmap_rewrite --- src/or/connection_edge.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index b15e135..12f9d6b 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1096,7 +1096,12 @@ addressmap_match_superdomains(char *address) * expiry time of the result, or to time_max if the result does * not expire. * - * DOCDOC exit_source_out; + * If exit_source_out is non-null, we set it as follows. If we the + * address starts out as a non-exit address, and we remap it to an .exit + * address at any point, then set *exit_source_out to the + * address_entry_source_t of the first such rule. Set *exit_source_out + * to ADDRMAPSRC_NONE if there is no such rewrite. + * */ int addressmap_rewrite(char *address, size_t maxlen, time_t *expires_out,

1 0