July 2012 - tor-commits - lists.torproject.org

[tor/master] Try to re-approximate the older semantics of nodelist_add_routerinfo
by nickm＠torproject.org 19 Jul '12

19 Jul '12

commit 6208106c18c696756fe2be8f941992e31aa66a8d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 17 20:00:19 2012 -0400 Try to re-approximate the older semantics of nodelist_add_routerinfo --- src/or/nodelist.c | 73 ++++++++++++++++++++------------------------------ src/or/nodelist.h | 3 +- src/or/routerlist.c | 8 ++++- 3 files changed, 36 insertions(+), 48 deletions(-) diff --git a/src/or/nodelist.c b/src/or/nodelist.c index bbbb9eb..6ce8dcf 100644 --- a/src/or/nodelist.c +++ b/src/or/nodelist.c @@ -115,63 +115,48 @@ node_get_or_create(const char *identity_digest) return node; } -/** Replace old router with new in nodelist. If - * old and new in fact are the same relays (having the - * same identity_digest) the node_t of old is used for - * new. Otherwise the node_t of old is dropped and - * new gets a new one (which might be a recycled node_t in - * case we already have one matching its identity). - */ -node_t * -nodelist_replace_routerinfo(routerinfo_t *old, routerinfo_t *new) -{ - node_t *node = NULL; - tor_assert(old); - tor_assert(new); - - if (tor_memeq(old->cache_info.identity_digest, - new->cache_info.identity_digest, DIGEST_LEN)) { - /* NEW == OLD, reuse node_t. */ - node = node_get_mutable_by_id(old->cache_info.identity_digest); - if (node) { - tor_assert(node->ri == old); - if (!routers_have_same_or_addrs(old, new)) { - /* These mustn't carry over when the address and orport - change. */ - node->last_reachable = node->last_reachable6 = 0; - node->testing_since = node->testing_since6 = 0; - } - } - } else { - /* NEW != OLD, get a new node_t. */ - nodelist_remove_routerinfo(old); - } - node = nodelist_add_routerinfo(node, new); - - return node; +/** Called when a node's address changes. */ +static void +node_addrs_changed(node_t *node) +{ + node->last_reachable = node->last_reachable6 = 0; + node->testing_since = node->testing_since6 = 0; + node->country = -1; } - -/** Add ri to the nodelist. If node_in is not NULL, use - that node rather than creating a new. */ +/** Add ri to an appropriate node in the nodelist. If we replace an + * old routerinfo, and ri_old_out is not NULL, set *ri_old_out + * to the previous routerinfo. + */ node_t * -nodelist_add_routerinfo(node_t *node_in, routerinfo_t *ri) +nodelist_set_routerinfo(routerinfo_t *ri, routerinfo_t **ri_old_out) { - node_t *node = NULL; + node_t *node; + const char *id_digest; + int had_router = 0; + tor_assert(ri); - if (node_in) { - node = node_in; + init_nodelist(); + id_digest = ri->cache_info.identity_digest; + node = node_get_or_create(id_digest); + + if (node->ri) { + if (!routers_have_same_or_addrs(node->ri, ri)) { + node_addrs_changed(node); + } + had_router = 1; + if (ri_old_out) + *ri_old_out = node->ri; } else { - tor_assert(ri); - init_nodelist(); - node = node_get_or_create(ri->cache_info.identity_digest); + if (ri_old_out) + *ri_old_out = NULL; } node->ri = ri; if (node->country == -1) node_set_country(node); - if (authdir_mode(get_options())) { + if (authdir_mode(get_options()) && !had_router) { const char *discard=NULL; uint32_t status = dirserv_router_get_status(ri, &discard); dirserv_set_node_flags_from_authoritative_status(node, status); diff --git a/src/or/nodelist.h b/src/or/nodelist.h index b110fe5..6c1d541 100644 --- a/src/or/nodelist.h +++ b/src/or/nodelist.h @@ -15,8 +15,7 @@ node_t *node_get_mutable_by_id(const char *identity_digest); const node_t *node_get_by_id(const char *identity_digest); const node_t *node_get_by_hex_id(const char *identity_digest); -node_t *nodelist_replace_routerinfo(routerinfo_t *old, routerinfo_t *new); -node_t *nodelist_add_routerinfo(node_t *node, routerinfo_t *ri); +node_t *nodelist_set_routerinfo(routerinfo_t *ri, routerinfo_t **ri_old_out); node_t *nodelist_add_microdesc(microdesc_t *md); void nodelist_set_consensus(networkstatus_t *ns); diff --git a/src/or/routerlist.c b/src/or/routerlist.c index a349a4d..c96a726 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2877,7 +2877,7 @@ routerlist_insert(routerlist_t *rl, routerinfo_t *ri) &ri->cache_info); smartlist_add(rl->routers, ri); ri->cache_info.routerlist_index = smartlist_len(rl->routers) - 1; - nodelist_add_routerinfo(NULL, ri); + nodelist_set_routerinfo(ri, NULL); router_dir_info_changed(); #ifdef DEBUG_ROUTERLIST routerlist_assert_ok(rl); @@ -3106,7 +3106,11 @@ routerlist_replace(routerlist_t *rl, routerinfo_t *ri_old, tor_assert(0 <= idx && idx < smartlist_len(rl->routers)); tor_assert(smartlist_get(rl->routers, idx) == ri_old); - nodelist_replace_routerinfo(ri_old, ri_new); + { + routerinfo_t *ri_old_tmp=NULL; + nodelist_set_routerinfo(ri_new, &ri_old_tmp); + tor_assert(ri_old == ri_old_tmp); + } router_dir_info_changed(); if (idx >= 0) {

1 0

[tor/master] Merge branch 'tickets_5529_5534_5974_6406'
by nickm＠torproject.org 19 Jul '12

19 Jul '12

1 0

r25721: {website} More accurately describe start time (I hope). Also, if peopl (website/trunk/about/en)
by Mike Perry 19 Jul '12

19 Jul '12

Author: mikeperry Date: 2012-07-19 21:12:15 +0000 (Thu, 19 Jul 2012) New Revision: 25721 Modified: website/trunk/about/en/jobs-browserhacker.wml Log: More accurately describe start time (I hope). Also, if people want to avoid mad Google juice for their name and salary in our tax returns, this is neither legally nor technically required of them as contractors. (Which is what the job post claims to be for). Finally, if Steve Jobs gets to demand Insanely Great, I get to demand Insanely Creative. Modified: website/trunk/about/en/jobs-browserhacker.wml =================================================================== --- website/trunk/about/en/jobs-browserhacker.wml 2012-07-19 18:30:37 UTC (rev 25720) +++ website/trunk/about/en/jobs-browserhacker.wml 2012-07-19 21:12:15 UTC (rev 25721) @@ -13,11 +13,11 @@ <h1>The Tor Project is looking for a Browser Hacker!</h1> -Your job would be to work on Torbutton and patches to our Firefox-based -browser, as well as a potential Android port. This would be a contractor -position for the remainder of 2012 plus Q1 2013 (starting as soon -as you're ready and with plenty of work to keep you busy), with the -possibility of later in 2013 and beyond. +Your job would be to work on Torbutton and patches to our +Firefox-based browser, as well as a potential Android port. This would +be a contractor position likely starting in October and going through +Q1 2013, with the possibility of later in 2013 and beyond. There may +also be a possibility for part-time work prior to October. @@ -52,7 +52,8 @@ from either group.</li> <li>Be comfortable with transparency: as a non-profit, everything we do is in -public, including your name and pay rate.</li> +public, including your name (or at least your business name) and pay +rate.</li> </ul> @@ -71,7 +72,8 @@ <li>Already be familiar with compiling software for the Android platform.</li> -<li>Be capable of creative yet also ruthlessly pragmatic thinking.</li> +<li>Be capable of insanely creative yet also ruthlessly pragmatic +thinking.</li> <li>Be familiar with probability, statistics, and information theory.</li>

1 0

[torspec/master] Correct description of v3 introduce cells to match implementation
by nickm＠torproject.org 19 Jul '12

19 Jul '12

commit 117f14323a04c5fd5228ca3e849abd10b9c5e742 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jul 19 11:18:01 2012 -0400 Correct description of v3 introduce cells to match implementation We said that every v3 introduce cell needs to have an AUTHL field. But it turns out we only produce that field when we are using a nonzero authentication method. It's not possible to make clients or services begin matching the spec without incompatibility, so instead let's make the spec match our behavior. --- rend-spec.txt | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/rend-spec.txt b/rend-spec.txt index 023c83b..d1db467 100644 --- a/rend-spec.txt +++ b/rend-spec.txt @@ -636,8 +636,9 @@ OR (in the v3 intro protocol) VER Version byte: set to 3. [1 octet] AUTHT The auth type that is used [1 octet] - AUTHL Length of auth data [2 octets] - AUTHD Auth data [variable] + If AUTHT != [00]: + AUTHL Length of auth data [2 octets] + AUTHD Auth data [variable] TS A timestamp [4 octets] IP Rendezvous point's address [4 octets] PORT Rendezvous point's OR port [2 octets]

1 0

r25720: {website} add philadelphia inquirer story. (website/trunk/press/en)
by Andrew Lewman 19 Jul '12

19 Jul '12

Author: phobos Date: 2012-07-19 18:30:37 +0000 (Thu, 19 Jul 2012) New Revision: 25720 Modified: website/trunk/press/en/inthemedia.wml Log: add philadelphia inquirer story. Modified: website/trunk/press/en/inthemedia.wml =================================================================== --- website/trunk/press/en/inthemedia.wml 2012-07-18 19:51:24 UTC (rev 25719) +++ website/trunk/press/en/inthemedia.wml 2012-07-19 18:30:37 UTC (rev 25720) @@ -32,6 +32,11 @@ <th>Topic</th> </tr> </thead> +<tr style="background-color: #e5e5e5;"> +<td>2012 Jul 19</td> +<td>Philadelphia Inquirer</td> +<td><a href="http://www.philly.com/philly/business/20120719_Tech_Life__Fostering_anonymi…">Tech Life: Fostering anonymity online</a></td> +</tr> <tr> <td>2012 Jul 13</td> <td>NATO</td>

1 0

[flashproxy/master] Add a modules directory.
by dcf＠torproject.org 19 Jul '12

19 Jul '12

commit 4f24bc9e2876ba83e30c92e332aa8517472853a0 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jul 19 09:02:06 2012 -0700 Add a modules directory. This is going to hold Brian's Drupal module and possibly others in the future (e.g. Wordpress). --- modules/README | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/modules/README b/modules/README new file mode 100644 index 0000000..a14264a --- /dev/null +++ b/modules/README @@ -0,0 +1,2 @@ +This directory contains modules and plugins for making flash proxies +work with other systems such as web publishing platforms.

1 0

[flashproxy/master] Add Drupal module by Brian Duggan.
by dcf＠torproject.org 19 Jul '12

19 Jul '12

commit a39b1cb23e80d48152684b0da65eea7ed0811ed1 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jul 19 09:11:47 2012 -0700 Add Drupal module by Brian Duggan. Brian did research and found out what files and syntax are needed for a Drupal 7 module. This module loads and runs the flash proxy program, but it doesn't put a badge on the page. The module originally had a copy of flashproxy.js with the only change being an additional line at the bottom to start the proxy running. I changed that into a symlink to the main flashproxy.js, and added a new flashproxy-start.js that calls the start method. I haven't tested these changes at all or even know if I have the syntax right. --- modules/drupal/flashproxy-start.js | 1 + modules/drupal/flashproxy.info | 5 +++++ modules/drupal/flashproxy.js | 1 + modules/drupal/flashproxy.module | 2 ++ 4 files changed, 9 insertions(+), 0 deletions(-) diff --git a/modules/drupal/flashproxy-start.js b/modules/drupal/flashproxy-start.js new file mode 100644 index 0000000..fe7d10b --- /dev/null +++ b/modules/drupal/flashproxy-start.js @@ -0,0 +1 @@ +flashproxy_badge_insert().start(); diff --git a/modules/drupal/flashproxy.info b/modules/drupal/flashproxy.info new file mode 100644 index 0000000..2f9b174 --- /dev/null +++ b/modules/drupal/flashproxy.info @@ -0,0 +1,5 @@ +name = Flashproxy Module +description = Insert Flashproxy js into some or all pages on your site. +core = 7.x +scripts[] = flashproxy.js +scripts[] = flashproxy-start.js diff --git a/modules/drupal/flashproxy.js b/modules/drupal/flashproxy.js new file mode 120000 index 0000000..db0eda6 --- /dev/null +++ b/modules/drupal/flashproxy.js @@ -0,0 +1 @@ +../../flashproxy.js \ No newline at end of file diff --git a/modules/drupal/flashproxy.module b/modules/drupal/flashproxy.module new file mode 100644 index 0000000..a4abe2d --- /dev/null +++ b/modules/drupal/flashproxy.module @@ -0,0 +1,2 @@ +<?php +

1 0

[stem/master] Adding exit_policy to stem's __init__.py
by atagar＠torproject.org 19 Jul '12

19 Jul '12

commit d7ca32639205ca99ca053270b98b90dee4cc7986 Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Jul 19 09:08:25 2012 -0700 Adding exit_policy to stem's __init__.py Forgot to add the new exit_policy.py module. --- stem/__init__.py | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/stem/__init__.py b/stem/__init__.py index faee5db..c05fcda 100644 --- a/stem/__init__.py +++ b/stem/__init__.py @@ -14,6 +14,7 @@ __all__ = [ "util", "connection", "control", + "exit_policy", "prereq", "process", "socket",

1 0

[stem/master] Add ExitPolicy, ExitPolicyIterator from arm/torTools
by atagar＠torproject.org 19 Jul '12

19 Jul '12

commit 88c436276f1aa0d20206499099b689eb50ace573 Author: Sathyanarayanan Gunasekaran <gsathya.ceg(a)gmail.com> Date: Thu Mar 22 23:20:43 2012 +0530 Add ExitPolicy, ExitPolicyIterator from arm/torTools --- stem/exit_policy.py | 237 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 237 insertions(+), 0 deletions(-) diff --git a/stem/exit_policy.py b/stem/exit_policy.py new file mode 100644 index 0000000..40cad39 --- /dev/null +++ b/stem/exit_policy.py @@ -0,0 +1,237 @@ +import re + +class ExitPolicyIterator: + """ + Basic iterator for cycling through ExitPolicy entries. + """ + + def __init__(self, head): + self.head = head + + def next(self): + if self.head: + lastHead = self.head + self.head = self.head.nextRule + return lastHead + else: raise StopIteration + +class ExitPolicy: + """ + Single rule from the user's exit policy. These are chained together to form + complete policies. + """ + + def __init__(self, ruleEntry, nextRule): + """ + Exit policy rule constructor. + + Arguments: + ruleEntry - tor exit policy rule (for instance, "reject *:135-139") + nextRule - next rule to be checked when queries don't match this policy + """ + + # cached summary string + self.summaryStr = None + + # sanitize the input a bit, cleaning up tabs and stripping quotes + ruleEntry = ruleEntry.replace("\\t", " ").replace("\"", "") + + self.ruleEntry = ruleEntry + self.nextRule = nextRule + self.isAccept = ruleEntry.startswith("accept") + + # strips off "accept " or "reject " and extra spaces + ruleEntry = ruleEntry[7:].replace(" ", "") + + # split ip address (with mask if provided) and port + if ":" in ruleEntry: entryIp, entryPort = ruleEntry.split(":", 1) + else: entryIp, entryPort = ruleEntry, "*" + + # sets the ip address component + self.isIpWildcard = entryIp == "*" or entryIp.endswith("/0") + + # checks for the private alias (which expands this to a chain of entries) + if entryIp.lower() == "private": + entryIp = PRIVATE_IP_RANGES[0] + + # constructs the chain backwards (last first) + lastHop = self.nextRule + prefix = "accept " if self.isAccept else "reject " + suffix = ":" + entryPort + for addr in PRIVATE_IP_RANGES[-1:0:-1]: + lastHop = ExitPolicy(prefix + addr + suffix, lastHop) + + self.nextRule = lastHop # our next hop is the start of the chain + + if "/" in entryIp: + ipComp = entryIp.split("/", 1) + self.ipAddress = ipComp[0] + self.ipMask = int(ipComp[1]) + else: + self.ipAddress = entryIp + self.ipMask = 32 + + # constructs the binary address just in case of comparison with a mask + if self.ipAddress != "*": + self.ipAddressBin = "" + for octet in self.ipAddress.split("."): + # Converts the int to a binary string, padded with zeros. Source: + # http://www.daniweb.com/code/snippet216539.html + self.ipAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + else: + self.ipAddressBin = "0" * 32 + + # sets the port component + self.minPort, self.maxPort = 0, 0 + self.isPortWildcard = entryPort == "*" + + if entryPort != "*": + if "-" in entryPort: + portComp = entryPort.split("-", 1) + self.minPort = int(portComp[0]) + self.maxPort = int(portComp[1]) + else: + self.minPort = int(entryPort) + self.maxPort = int(entryPort) + + # if both the address and port are wildcards then we're effectively the + # last entry so cut off the remaining chain + if self.isIpWildcard and self.isPortWildcard: + self.nextRule = None + + def isExitingAllowed(self): + """ + Provides true if the policy allows exiting whatsoever, false otherwise. + """ + + if self.isAccept: return True + elif self.isIpWildcard and self.isPortWildcard: return False + elif not self.nextRule: return False # fell off policy (shouldn't happen) + else: return self.nextRule.isExitingAllowed() + + def check(self, ipAddress, port): + """ + Checks if the rule chain allows exiting to this address, returning true if + so and false otherwise. + """ + + port = int(port) + + # does the port check first since comparing ip masks is more work + isPortMatch = self.isPortWildcard or (port >= self.minPort and port <= self.maxPort) + + if isPortMatch: + isIpMatch = self.isIpWildcard or self.ipAddress == ipAddress + + # expands the check to include the mask if it has one + if not isIpMatch and self.ipMask != 32: + inputAddressBin = "" + for octet in ipAddress.split("."): + inputAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + + isIpMatch = self.ipAddressBin[:self.ipMask] == inputAddressBin[:self.ipMask] + + if isIpMatch: return self.isAccept + + # our policy doesn't concern this address, move on to the next one + if self.nextRule: return self.nextRule.check(ipAddress, port) + else: return True # fell off the chain without a conclusion (shouldn't happen...) + + def getSummary(self): + """ + Provides a summary description of the policy chain similar to the + consensus. This excludes entries that don't cover all ips, and is either + a whitelist or blacklist policy based on the final entry. For instance... + accept 80, 443 # just accepts ports 80/443 + reject 1-1024, 5555 # just accepts non-privilaged ports, excluding 5555 + """ + + if not self.summaryStr: + # determines if we're a whitelist or blacklist + isWhitelist = False # default in case we don't have a catch-all policy at the end + + for rule in self: + if rule.isIpWildcard and rule.isPortWildcard: + isWhitelist = not rule.isAccept + break + + # Iterates over the rules and adds the the ports we'll return (ie, allows + # if a whitelist and rejects if a blacklist). Reguardless of a port's + # allow/reject policy, all further entries with that port are ignored since + # policies respect the first matching rule. + + displayPorts, skipPorts = [], [] + + for rule in self: + if not rule.isIpWildcard: continue + + if rule.minPort == rule.maxPort: + portRange = [rule.minPort] + else: + portRange = range(rule.minPort, rule.maxPort + 1) + + for port in portRange: + if port in skipPorts: continue + + # if accept + whitelist or reject + blacklist then add + if rule.isAccept == isWhitelist: + displayPorts.append(port) + + # all further entries with this port are to be ignored + skipPorts.append(port) + + # gets a list of the port ranges + if displayPorts: + displayRanges, tmpRange = [], [] + displayPorts.sort() + displayPorts.append(None) # ending item to include last range in loop + + for port in displayPorts: + if not tmpRange or tmpRange[-1] + 1 == port: + tmpRange.append(port) + else: + if len(tmpRange) > 1: + displayRanges.append("%i-%i" % (tmpRange[0], tmpRange[-1])) + else: + displayRanges.append(str(tmpRange[0])) + + tmpRange = [port] + else: + # everything for the inverse + isWhitelist = not isWhitelist + displayRanges = ["1-65535"] + + # constructs the summary string + labelPrefix = "accept " if isWhitelist else "reject " + + self.summaryStr = (labelPrefix + ", ".join(displayRanges)).strip() + + return self.summaryStr + + def __iter__(self): + return ExitPolicyIterator(self) + + def __str__(self): + # This provides the actual policy rather than the entry used to construct + # it so the 'private' keyword is expanded. + + acceptanceLabel = "accept" if self.isAccept else "reject" + + if self.isIpWildcard: + ipLabel = "*" + elif self.ipMask != 32: + ipLabel = "%s/%i" % (self.ipAddress, self.ipMask) + else: ipLabel = self.ipAddress + + if self.isPortWildcard: + portLabel = "*" + elif self.minPort != self.maxPort: + portLabel = "%i-%i" % (self.minPort, self.maxPort) + else: portLabel = str(self.minPort) + + myPolicy = "%s %s:%s" % (acceptanceLabel, ipLabel, portLabel) + + if self.nextRule: + return myPolicy + ", " + str(self.nextRule) + else: return myPolicy +

1 0

[stem/master] Overhaul exit_policy.py
by atagar＠torproject.org 19 Jul '12

19 Jul '12

commit 80228a52e3f9507547cf924156a1bcafdea6540b Author: Sathyanarayanan Gunasekaran <gsathya.ceg(a)gmail.com> Date: Fri Mar 23 12:21:01 2012 +0530 Overhaul exit_policy.py - Fix Indentation issues - Remove ExitPolicyIterator class - Add ExitPolicyLine class - This class represent a single line from the Exit Policy. (provides much better abstraction IMHO) - __init__(), __str__(), and check() are copied from ExitPolicy - Changes in ExitPolicy - - Now, it acts a wrapper class to ExitPolicyLine - It contains a list ExitPolicy._policies which stores all the policies and each item in _policies is an object of ExitPolicyLine - check(), isExitingAllowed(), __str__(), and __iter__() are changed to provide a wrapper of sorts for ExitPolicyLine - add() is now used to add an exit policy line - This creates an object of ExitPolicyLine and adds it to ExitPolicy._policies --- stem/exit_policy.py | 358 ++++++++++++++++++++------------------------------- 1 files changed, 138 insertions(+), 220 deletions(-) diff --git a/stem/exit_policy.py b/stem/exit_policy.py index 40cad39..15c2b2c 100644 --- a/stem/exit_policy.py +++ b/stem/exit_policy.py @@ -1,237 +1,155 @@ -import re +# ip address ranges substituted by the 'private' keyword +PRIVATE_IP_RANGES = ("0.0.0.0/8", "169.254.0.0/16", "127.0.0.0/8", "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12") -class ExitPolicyIterator: - """ - Basic iterator for cycling through ExitPolicy entries. - """ - - def __init__(self, head): - self.head = head - - def next(self): - if self.head: - lastHead = self.head - self.head = self.head.nextRule - return lastHead - else: raise StopIteration +class ExitPolicyLine: + def __init__(self, ruleEntry): + # sanitize the input a bit, cleaning up tabs and stripping quotes + ruleEntry = ruleEntry.replace("\\t", " ").replace("\"", "") -class ExitPolicy: - """ - Single rule from the user's exit policy. These are chained together to form - complete policies. - """ - - def __init__(self, ruleEntry, nextRule): - """ - Exit policy rule constructor. - - Arguments: - ruleEntry - tor exit policy rule (for instance, "reject *:135-139") - nextRule - next rule to be checked when queries don't match this policy - """ + self.ruleEntry = ruleEntry + self.isAccept = ruleEntry.startswith("accept") + + # strips off "accept " or "reject " and extra spaces + ruleEntry = ruleEntry[7:].replace(" ", "") + + # split ip address (with mask if provided) and port + if ":" in ruleEntry: entryIp, entryPort = ruleEntry.split(":", 1) + else: entryIp, entryPort = ruleEntry, "*" + + # sets the ip address component + self.isIpWildcard = entryIp == "*" or entryIp.endswith("/0") + + # checks for the private alias (which expands this to a chain of entries) + if entryIp.lower() == "private": + # constructs the chain backwards (last first) + prefix = "accept " if self.isAccept else "reject " + suffix = ":" + entryPort + for addr in PRIVATE_IP_RANGES: + # TODO: Add ExitPolicy.add method + ExitPolicy.add(prefix + addr + suffix) + + if "/" in entryIp: + ipComp = entryIp.split("/", 1) + self.ipAddress = ipComp[0] + self.ipMask = int(ipComp[1]) + else: + self.ipAddress = entryIp + self.ipMask = 32 + + # constructs the binary address just in case of comparison with a mask + if self.ipAddress != "*": + self.ipAddressBin = "" + for octet in self.ipAddress.split("."): + # Converts the int to a binary string, padded with zeros. Source: + # http://www.daniweb.com/code/snippet216539.html + self.ipAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + else: + self.ipAddressBin = "0" * 32 + + # sets the port component + self.minPort, self.maxPort = 0, 0 + self.isPortWildcard = entryPort == "*" + + if entryPort != "*": + if "-" in entryPort: + portComp = entryPort.split("-", 1) + self.minPort = int(portComp[0]) + self.maxPort = int(portComp[1]) + else: + self.minPort = int(entryPort) + self.maxPort = int(entryPort) + + def __str__(self): + # This provides the actual policy rather than the entry used to construct + # it so the 'private' keyword is expanded. + + acceptanceLabel = "accept" if self.isAccept else "reject" - # cached summary string - self.summaryStr = None + if self.isIpWildcard: + ipLabel = "*" + elif self.ipMask != 32: + ipLabel = "%s/%i" % (self.ipAddress, self.ipMask) + else: ipLabel = self.ipAddress - # sanitize the input a bit, cleaning up tabs and stripping quotes - ruleEntry = ruleEntry.replace("\\t", " ").replace("\"", "") + if self.isPortWildcard: + portLabel = "*" + elif self.minPort != self.maxPort: + portLabel = "%i-%i" % (self.minPort, self.maxPort) + else: portLabel = str(self.minPort) - self.ruleEntry = ruleEntry - self.nextRule = nextRule - self.isAccept = ruleEntry.startswith("accept") + myPolicy = "%s %s:%s" % (acceptanceLabel, ipLabel, portLabel) + return myPolicy - # strips off "accept " or "reject " and extra spaces - ruleEntry = ruleEntry[7:].replace(" ", "") + def check(self, ipAddress, port): + """ + Checks if the rule chain allows exiting to this address, returning true if + so and false otherwise. + """ - # split ip address (with mask if provided) and port - if ":" in ruleEntry: entryIp, entryPort = ruleEntry.split(":", 1) - else: entryIp, entryPort = ruleEntry, "*" + port = int(port) - # sets the ip address component - self.isIpWildcard = entryIp == "*" or entryIp.endswith("/0") + # does the port check first since comparing ip masks is more work + isPortMatch = self.isPortWildcard or (port >= self.minPort and port <= self.maxPort) - # checks for the private alias (which expands this to a chain of entries) - if entryIp.lower() == "private": - entryIp = PRIVATE_IP_RANGES[0] - - # constructs the chain backwards (last first) - lastHop = self.nextRule - prefix = "accept " if self.isAccept else "reject " - suffix = ":" + entryPort - for addr in PRIVATE_IP_RANGES[-1:0:-1]: - lastHop = ExitPolicy(prefix + addr + suffix, lastHop) + if isPortMatch: + isIpMatch = self.isIpWildcard or self.ipAddress == ipAddress + + # expands the check to include the mask if it has one + if not isIpMatch and self.ipMask != 32: + inputAddressBin = "" + for octet in ipAddress.split("."): + inputAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + + isIpMatch = self.ipAddressBin[:self.ipMask] == inputAddressBin[:self.ipMask] + + if isIpMatch: return self.isAccept + + # fell off the chain without a conclusion (shouldn't happen...) + return False - self.nextRule = lastHop # our next hop is the start of the chain - - if "/" in entryIp: - ipComp = entryIp.split("/", 1) - self.ipAddress = ipComp[0] - self.ipMask = int(ipComp[1]) - else: - self.ipAddress = entryIp - self.ipMask = 32 - - # constructs the binary address just in case of comparison with a mask - if self.ipAddress != "*": - self.ipAddressBin = "" - for octet in self.ipAddress.split("."): - # Converts the int to a binary string, padded with zeros. Source: - # http://www.daniweb.com/code/snippet216539.html - self.ipAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) - else: - self.ipAddressBin = "0" * 32 - - # sets the port component - self.minPort, self.maxPort = 0, 0 - self.isPortWildcard = entryPort == "*" - - if entryPort != "*": - if "-" in entryPort: - portComp = entryPort.split("-", 1) - self.minPort = int(portComp[0]) - self.maxPort = int(portComp[1]) - else: - self.minPort = int(entryPort) - self.maxPort = int(entryPort) - - # if both the address and port are wildcards then we're effectively the - # last entry so cut off the remaining chain - if self.isIpWildcard and self.isPortWildcard: - self.nextRule = None - - def isExitingAllowed(self): + +class ExitPolicy: """ - Provides true if the policy allows exiting whatsoever, false otherwise. + Single rule from the user's exit policy. These are chained together to form + complete policies. """ - - if self.isAccept: return True - elif self.isIpWildcard and self.isPortWildcard: return False - elif not self.nextRule: return False # fell off policy (shouldn't happen) - else: return self.nextRule.isExitingAllowed() - def check(self, ipAddress, port): - """ - Checks if the rule chain allows exiting to this address, returning true if - so and false otherwise. - """ - - port = int(port) - - # does the port check first since comparing ip masks is more work - isPortMatch = self.isPortWildcard or (port >= self.minPort and port <= self.maxPort) - - if isPortMatch: - isIpMatch = self.isIpWildcard or self.ipAddress == ipAddress - - # expands the check to include the mask if it has one - if not isIpMatch and self.ipMask != 32: - inputAddressBin = "" - for octet in ipAddress.split("."): - inputAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) - - isIpMatch = self.ipAddressBin[:self.ipMask] == inputAddressBin[:self.ipMask] - - if isIpMatch: return self.isAccept - - # our policy doesn't concern this address, move on to the next one - if self.nextRule: return self.nextRule.check(ipAddress, port) - else: return True # fell off the chain without a conclusion (shouldn't happen...) + def __init__(self): + """ + Exit policy rule constructor. + """ + self._policies = [] - def getSummary(self): - """ - Provides a summary description of the policy chain similar to the - consensus. This excludes entries that don't cover all ips, and is either - a whitelist or blacklist policy based on the final entry. For instance... - accept 80, 443 # just accepts ports 80/443 - reject 1-1024, 5555 # just accepts non-privilaged ports, excluding 5555 - """ - - if not self.summaryStr: - # determines if we're a whitelist or blacklist - isWhitelist = False # default in case we don't have a catch-all policy at the end - - for rule in self: - if rule.isIpWildcard and rule.isPortWildcard: - isWhitelist = not rule.isAccept - break - - # Iterates over the rules and adds the the ports we'll return (ie, allows - # if a whitelist and rejects if a blacklist). Reguardless of a port's - # allow/reject policy, all further entries with that port are ignored since - # policies respect the first matching rule. - - displayPorts, skipPorts = [], [] - - for rule in self: - if not rule.isIpWildcard: continue - - if rule.minPort == rule.maxPort: - portRange = [rule.minPort] - else: - portRange = range(rule.minPort, rule.maxPort + 1) - - for port in portRange: - if port in skipPorts: continue - - # if accept + whitelist or reject + blacklist then add - if rule.isAccept == isWhitelist: - displayPorts.append(port) - - # all further entries with this port are to be ignored - skipPorts.append(port) - - # gets a list of the port ranges - if displayPorts: - displayRanges, tmpRange = [], [] - displayPorts.sort() - displayPorts.append(None) # ending item to include last range in loop - - for port in displayPorts: - if not tmpRange or tmpRange[-1] + 1 == port: - tmpRange.append(port) - else: - if len(tmpRange) > 1: - displayRanges.append("%i-%i" % (tmpRange[0], tmpRange[-1])) - else: - displayRanges.append(str(tmpRange[0])) - - tmpRange = [port] - else: - # everything for the inverse - isWhitelist = not isWhitelist - displayRanges = ["1-65535"] - - # constructs the summary string - labelPrefix = "accept " if isWhitelist else "reject " - - self.summaryStr = (labelPrefix + ", ".join(displayRanges)).strip() - - return self.summaryStr + def add(self, ruleEntry): + self._policies.append(ExitPolicyLine(ruleEntry)) + + def isExitingAllowed(self): + """ + Provides true if the policy allows exiting whatsoever, false otherwise. + """ + for policy in self._policies: + if policy.isAccept: return True + elif policy.isIpWildcard and self.isPortWildcard: return False + - def __iter__(self): - return ExitPolicyIterator(self) + def check(self, ipAddress, port): + """ + Checks if the rule chain allows exiting to this address, returning true if + so and false otherwise. + """ + + for policy in self._policies: + if policy.check(ipAddress, port): return True + + return False - def __str__(self): - # This provides the actual policy rather than the entry used to construct - # it so the 'private' keyword is expanded. - - acceptanceLabel = "accept" if self.isAccept else "reject" - - if self.isIpWildcard: - ipLabel = "*" - elif self.ipMask != 32: - ipLabel = "%s/%i" % (self.ipAddress, self.ipMask) - else: ipLabel = self.ipAddress - - if self.isPortWildcard: - portLabel = "*" - elif self.minPort != self.maxPort: - portLabel = "%i-%i" % (self.minPort, self.maxPort) - else: portLabel = str(self.minPort) - - myPolicy = "%s %s:%s" % (acceptanceLabel, ipLabel, portLabel) - - if self.nextRule: - return myPolicy + ", " + str(self.nextRule) - else: return myPolicy + def __iter__(self): + for policy in self._policies: + yield policy + + def __str__(self): + # This provides the actual policy rather than the entry used to construct + # it so the 'private' keyword is expanded. + + return ' , '.join([str(policy) for policy in self._policies])

1 0