December 2015 - tor-commits - lists.torproject.org

[translation/abouttor-homepage_completed] Update translations for abouttor-homepage_completed
by translation＠torproject.org 09 Dec '15

09 Dec '15

commit eef3a580a278c39380fb0c0463a53a69225d9e52 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Dec 9 17:15:54 2015 +0000 Update translations for abouttor-homepage_completed --- hu/aboutTor.dtd | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/hu/aboutTor.dtd b/hu/aboutTor.dtd index c96e527..2be68c0 100644 --- a/hu/aboutTor.dtd +++ b/hu/aboutTor.dtd @@ -6,14 +6,14 @@ <!ENTITY aboutTor.title "A Tor-ról"> -<!ENTITY aboutTor.outOfDateTorOn.label "EGYÉBKÉNT, ez a böngésző elég régi verzió"> -<!ENTITY aboutTor.outOfDateTorOff.label "TOVÁBBÁ, ez a böngésző elég régi verzió"> +<!ENTITY aboutTor.outOfDateTorOn.label "FIGYELMEZTETÉS: ez a böngésző elavult."> +<!ENTITY aboutTor.outOfDateTorOff.label "TOVÁBBÁ, ez a böngésző elavult."> <!ENTITY aboutTor.outOfDate2.label "Kattinson a hagymára, és válassza a Tor Browser frissítését."> <!ENTITY aboutTor.check.label "A Tor hálózati beállítások tesztelése"> -<!ENTITY aboutTor.success.label "Gratulálunk!"> -<!ENTITY aboutTor.success2.label "A böngésző Tor használatára beállítva."> +<!ENTITY aboutTor.success.label "Üdvözli a Tor Browser"> +<!ENTITY aboutTor.success2.label "Csatlakoztatva a Tor hálózathoz."> <!ENTITY aboutTor.success3.label "Most már képes rá, hogy névtelenül böngésszen az Interneten."> <!ENTITY aboutTor.failure.label "Valami nem jól működik!"> <!ENTITY aboutTor.failure2.label "A tor nem működik ebben a böngészőben."> @@ -47,3 +47,6 @@ <!ENTITY aboutTor.footer.label "A Tor Project egy a US 501(c)(3) szerinti non-profit, amely kutatással, fejéesztéssel és oktatással foglakozik az online anonimitás és személyes adatvédelem területén."> <!ENTITY aboutTor.learnMore.label "Tudjon meg többet a Tor Project-ről »"> <!ENTITY aboutTor.learnMore.link "https://www.torproject.org/about/overview.html.en"> + +<!ENTITY aboutTor.donate.donate "Támogatás"> +<!ENTITY aboutTor.donate.supportTor "Kérem támogassa a Tor-t!">

1 0

[translation/abouttor-homepage] Update translations for abouttor-homepage
by translation＠torproject.org 09 Dec '15

09 Dec '15

commit 6ddda3ba44fdde5eadcebfc19124e6a06a697c8f Author: Translation commit bot <translation(a)torproject.org> Date: Wed Dec 9 17:15:48 2015 +0000 Update translations for abouttor-homepage --- hu/aboutTor.dtd | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/hu/aboutTor.dtd b/hu/aboutTor.dtd index f33987c..2be68c0 100644 --- a/hu/aboutTor.dtd +++ b/hu/aboutTor.dtd @@ -6,14 +6,14 @@ <!ENTITY aboutTor.title "A Tor-ról"> -<!ENTITY aboutTor.outOfDateTorOn.label "WARNING: this browser is out of date."> -<!ENTITY aboutTor.outOfDateTorOff.label "TOVÁBBÁ, ez a böngésző elég régi verzió"> +<!ENTITY aboutTor.outOfDateTorOn.label "FIGYELMEZTETÉS: ez a böngésző elavult."> +<!ENTITY aboutTor.outOfDateTorOff.label "TOVÁBBÁ, ez a böngésző elavult."> <!ENTITY aboutTor.outOfDate2.label "Kattinson a hagymára, és válassza a Tor Browser frissítését."> <!ENTITY aboutTor.check.label "A Tor hálózati beállítások tesztelése"> -<!ENTITY aboutTor.success.label "Welcome to Tor Browser"> -<!ENTITY aboutTor.success2.label "Connected to the Tor network."> +<!ENTITY aboutTor.success.label "Üdvözli a Tor Browser"> +<!ENTITY aboutTor.success2.label "Csatlakoztatva a Tor hálózathoz."> <!ENTITY aboutTor.success3.label "Most már képes rá, hogy névtelenül böngésszen az Interneten."> <!ENTITY aboutTor.failure.label "Valami nem jól működik!"> <!ENTITY aboutTor.failure2.label "A tor nem működik ebben a böngészőben."> @@ -49,4 +49,4 @@ <!ENTITY aboutTor.learnMore.link "https://www.torproject.org/about/overview.html.en"> <!ENTITY aboutTor.donate.donate "Támogatás"> -<!ENTITY aboutTor.donate.supportTor "Please support Tor!"> +<!ENTITY aboutTor.donate.supportTor "Kérem támogassa a Tor-t!">

1 0

[tor/master] Mark a couple more arguments as unused.
by nickm＠torproject.org 09 Dec '15

09 Dec '15

commit 631e3517e3baa99a83702e01bb7ef26667bd3dd8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 9 11:58:32 2015 -0500 Mark a couple more arguments as unused. --- src/common/crypto.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/common/crypto.c b/src/common/crypto.c index 4554933..5569ec7 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2445,6 +2445,8 @@ crypto_strongest_rand_fallback(uint8_t *out, size_t out_len) { #ifdef _WIN32 /* Windows exclusively uses crypto_strongest_rand_syscall(). */ + (void)out; + (void)out_len; return -1; #else static const char *filenames[] = {

1 0

[tor/master] Try to fix windows build more.
by nickm＠torproject.org 09 Dec '15

09 Dec '15

commit 13fee1baf79750edd6cf7066f096b914db3ece2c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 9 08:59:01 2015 -0500 Try to fix windows build more. patch from rubiate on #16651 --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 5f3b7cb..4dbb3c4 100644 --- a/configure.ac +++ b/configure.ac @@ -501,7 +501,7 @@ AC_CHECK_MEMBERS([struct event.min_heap_idx], , , AC_CHECK_HEADERS(event2/event.h event2/dns.h event2/bufferevent_ssl.h) -LIBS="$save_LIBS" +LIBS="$STATIC_LIBEVENT_FLAGS $TOR_LIB_WS32 $save_LIBS" AM_CONDITIONAL(USE_EXTERNAL_EVDNS, test x$ac_cv_header_event2_dns_h = xyes)

1 0

[tor/master] Merge branch 'refactor-effective-entry'
by nickm＠torproject.org 09 Dec '15

09 Dec '15

commit b3eba8ef12c714e1b97b9026da96d27433064a1e Merge: caff665 580d788 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 9 11:05:41 2015 -0500 Merge branch 'refactor-effective-entry' changes/feature17608 | 4 ++ src/or/policies.c | 122 +++++++++++++++++++++++++++----------------------- src/or/policies.h | 2 +- 3 files changed, 71 insertions(+), 57 deletions(-)

1 0

[tor/master] Assert that memory held by rephist is freed
by nickm＠torproject.org 09 Dec '15

09 Dec '15

commit 91ab2ac5aa3a94ebe3d53e9dc2b5cb0ee2b59b3c Author: cypherpunks <cypherpunks(a)torproject.org> Date: Wed Dec 2 10:11:32 2015 +0100 Assert that memory held by rephist is freed The internal memory allocation and history object counters of the reputation code can be used to verify the correctness of (part of) the code. Using these counters revealed an issue where the memory allocation counter is not decreased when the bandwidth arrays are freed. A new function ensures the memory allocation counter is decreased when a bandwidth array is freed. This commit also removes an unnecessary cast which was found while working on the code. --- changes/bug17753 | 4 ++++ src/or/rephist.c | 43 ++++++++++++++++++++++++++++++++++--------- 2 files changed, 38 insertions(+), 9 deletions(-) diff --git a/changes/bug17753 b/changes/bug17753 new file mode 100644 index 0000000..7d227d8 --- /dev/null +++ b/changes/bug17753 @@ -0,0 +1,4 @@ + o Minor bugfixes (code correctness) + - Assert that allocated memory held by the reputation code is freed + according to its internal counters. Fixes bug 17753; bugfix on + tor-0.1.1.1-alpha. diff --git a/src/or/rephist.c b/src/or/rephist.c index 4f7aaae..343a066 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -148,7 +148,7 @@ get_link_history(const char *from_id, const char *to_id) return NULL; if (tor_digest_is_zero(to_id)) return NULL; - lhist = (link_history_t*) digestmap_get(orhist->link_history_map, to_id); + lhist = digestmap_get(orhist->link_history_map, to_id); if (!lhist) { lhist = tor_malloc_zero(sizeof(link_history_t)); rephist_total_alloc += sizeof(link_history_t); @@ -1250,6 +1250,18 @@ bw_array_new(void) return b; } +/** Free storage held by bandwidth array b. */ +static void +bw_array_free(bw_array_t *b) +{ + if (!b) { + return; + } + + rephist_total_alloc -= sizeof(bw_array_t); + tor_free(b); +} + /** Recent history of bandwidth observations for read operations. */ static bw_array_t *read_array = NULL; /** Recent history of bandwidth observations for write operations. */ @@ -1266,10 +1278,11 @@ static bw_array_t *dir_write_array = NULL; static void bw_arrays_init(void) { - tor_free(read_array); - tor_free(write_array); - tor_free(dir_read_array); - tor_free(dir_write_array); + bw_array_free(read_array); + bw_array_free(write_array); + bw_array_free(dir_read_array); + bw_array_free(dir_write_array); + read_array = bw_array_new(); write_array = bw_array_new(); dir_read_array = bw_array_new(); @@ -3172,10 +3185,19 @@ rep_hist_free_all(void) { hs_stats_free(hs_stats); digestmap_free(history_map, free_or_history); - tor_free(read_array); - tor_free(write_array); - tor_free(dir_read_array); - tor_free(dir_write_array); + + bw_array_free(read_array); + read_array = NULL; + + bw_array_free(write_array); + write_array = NULL; + + bw_array_free(dir_read_array); + dir_read_array = NULL; + + bw_array_free(dir_write_array); + dir_write_array = NULL; + tor_free(exit_bytes_read); tor_free(exit_bytes_written); tor_free(exit_streams); @@ -3190,5 +3212,8 @@ rep_hist_free_all(void) } rep_hist_desc_stats_term(); total_descriptor_downloads = 0; + + tor_assert(rephist_total_alloc == 0); + tor_assert(rephist_total_num == 0); }

1 0

[tor/master] Tweak policies_log_first_redundant_entry even more
by nickm＠torproject.org 09 Dec '15

09 Dec '15

commit 580d788b3f85ee04f8893325b902bf28727a451b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 9 11:04:56 2015 -0500 Tweak policies_log_first_redundant_entry even more * Use smartlist_foreach_begin/end instead of a plain for loop. * constify the pointers. --- src/or/policies.c | 13 ++++++------- src/or/policies.h | 2 +- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index ec29b23..07f8cd7 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -1129,12 +1129,10 @@ policies_log_first_redundant_entry(const smartlist_t *policy) int found_final_effective_entry = 0; int first_redundant_entry = 0; tor_assert(policy); - for (int i = 0; i < smartlist_len(policy); ++i) { + SMARTLIST_FOREACH_BEGIN(policy, const addr_policy_t *, p) { sa_family_t family; - addr_policy_t *p; int found_ipv4_wildcard = 0, found_ipv6_wildcard = 0; - - p = smartlist_get(policy, i); + const int i = p_sl_idx; /* Look for accept/reject *[4|6|]:* entires */ if (p->prt_min <= 1 && p->prt_max == 65535 && p->maskbits == 0) { @@ -1162,10 +1160,11 @@ policies_log_first_redundant_entry(const smartlist_t *policy) } break; } - } + } SMARTLIST_FOREACH_END(p); + /* Work out if there are redundant trailing entries in the policy list */ if (found_final_effective_entry && first_redundant_entry > 0) { - addr_policy_t *p; + const addr_policy_t *p; /* Longest possible policy is * "accept6 ffff:ffff:..255/128:10000-65535", * which contains a max-length IPv6 address, plus 24 characters. */ @@ -1504,7 +1503,7 @@ policy_is_reject_star(const smartlist_t *policy, sa_family_t family) /** Write a single address policy to the buf_len byte buffer at buf. Return * the number of characters written, or -1 on failure. */ int -policy_write_item(char *buf, size_t buflen, addr_policy_t *policy, +policy_write_item(char *buf, size_t buflen, const addr_policy_t *policy, int format_for_desc) { size_t written = 0; diff --git a/src/or/policies.h b/src/or/policies.h index bb56bf4..007f494 100644 --- a/src/or/policies.h +++ b/src/or/policies.h @@ -75,7 +75,7 @@ char * policy_dump_to_string(const smartlist_t *policy_list, int getinfo_helper_policies(control_connection_t *conn, const char *question, char **answer, const char **errmsg); -int policy_write_item(char *buf, size_t buflen, addr_policy_t *item, +int policy_write_item(char *buf, size_t buflen, const addr_policy_t *item, int format_for_desc); void addr_policy_list_free(smartlist_t *p);

1 0

[tor/master] Make policies_log_first_redundant_entry take a const smartlist_t *
by nickm＠torproject.org 09 Dec '15

09 Dec '15

commit bca4095b93615d5f77554b440b7935daff6773de Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Sun Dec 6 21:30:52 2015 +1100 Make policies_log_first_redundant_entry take a const smartlist_t * Also fixup code style. --- src/or/policies.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index 275bab2..692eaa1 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -1119,25 +1119,22 @@ policies_parse_exit_policy_reject_private( } } -#define DEFAULT_EXIT_POLICY \ - "reject *:25,reject *:119,reject *:135-139,reject *:445," \ - "reject *:563,reject *:1214,reject *:4661-4666," \ - "reject *:6346-6429,reject *:6699,reject *:6881-6999,accept *:*" - /** - * Iterates through *dest and logs a warning with first + * Iterates through dest and logs a warning with first * redundant entry if found */ -static void -policies_log_first_redundant_entry(smartlist_t** dest) { +static void +policies_log_first_redundant_entry(const smartlist_t* dest) +{ int found_final_effective_entry = 0; int first_redundant_entry = 0; - for (int i = 0; i < smartlist_len(*dest); ++i) { + tor_assert(dest); + for (int i = 0; i < smartlist_len(dest); ++i) { sa_family_t family; addr_policy_t *p; int found_ipv4_wildcard = 0, found_ipv6_wildcard = 0; - p = smartlist_get(*dest, i); + p = smartlist_get(dest, i); /* Look for accept/reject *[4|6|]:* entires */ if (p->prt_min <= 1 && p->prt_max == 65535 && p->maskbits == 0) { @@ -1160,7 +1157,7 @@ policies_log_first_redundant_entry(smartlist_t** dest) { if (found_ipv4_wildcard && found_ipv6_wildcard) { found_final_effective_entry = 1; /* if we're not on the final entry in the list */ - if (i < smartlist_len(*dest) - 1) { + if (i < smartlist_len(dest) - 1) { first_redundant_entry = i + 1; } break; @@ -1174,8 +1171,8 @@ policies_log_first_redundant_entry(smartlist_t** dest) { * which contains a max-length IPv6 address, plus 24 characters. */ char line[TOR_ADDR_BUF_LEN + 32]; - tor_assert(first_redundant_entry < smartlist_len(*dest)); - p = smartlist_get(*dest, first_redundant_entry); + tor_assert(first_redundant_entry < smartlist_len(dest)); + p = smartlist_get(dest, first_redundant_entry); /* since we've already parsed the policy into an addr_policy_t struct, * we might not log exactly what the user typed in */ policy_write_item(line, TOR_ADDR_BUF_LEN + 32, p, 0); @@ -1187,6 +1184,11 @@ policies_log_first_redundant_entry(smartlist_t** dest) { } } +#define DEFAULT_EXIT_POLICY \ + "reject *:25,reject *:119,reject *:135-139,reject *:445," \ + "reject *:563,reject *:1214,reject *:4661-4666," \ + "reject *:6346-6429,reject *:6699,reject *:6881-6999,accept *:*" + /** Parse the exit policy cfg into the linked list *dest. * * If ipv6_exit is false, prepend "reject *6:*" to the policy. @@ -1235,7 +1237,7 @@ policies_parse_exit_policy_internal(config_line_t *cfg, /* Before we add the default policy and final rejects, check to see if * there are any lines after accept *:* or reject *:*. These lines have no * effect, and are most likely an error. */ - policies_log_first_redundant_entry(dest); + policies_log_first_redundant_entry(*dest); if (add_default_policy) { append_exit_policy_string(dest, DEFAULT_EXIT_POLICY);

1 0

[tor/master] Tweak policies_log_first_redundant_entry more.
by nickm＠torproject.org 09 Dec '15

09 Dec '15

commit db433b8dc3c8684e6a86365e12336a708f67edaa Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 9 11:02:10 2015 -0500 Tweak policies_log_first_redundant_entry more. * Since the variable is no longer modified, it should be called 'policy' instead of 'dest'. ("Dest" is short for "destination".) * Fixed the space issue that dgoulet found on the ticket. * Fixed the comment a little. (We use the imperative for function documentation.) --- src/or/policies.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index 692eaa1..ec29b23 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -1120,21 +1120,21 @@ policies_parse_exit_policy_reject_private( } /** - * Iterates through dest and logs a warning with first - * redundant entry if found + * Iterate through policy looking for redundant entries. Log a + * warning message with the first redundant entry, if any is found. */ static void -policies_log_first_redundant_entry(const smartlist_t* dest) +policies_log_first_redundant_entry(const smartlist_t *policy) { int found_final_effective_entry = 0; int first_redundant_entry = 0; - tor_assert(dest); - for (int i = 0; i < smartlist_len(dest); ++i) { + tor_assert(policy); + for (int i = 0; i < smartlist_len(policy); ++i) { sa_family_t family; addr_policy_t *p; int found_ipv4_wildcard = 0, found_ipv6_wildcard = 0; - p = smartlist_get(dest, i); + p = smartlist_get(policy, i); /* Look for accept/reject *[4|6|]:* entires */ if (p->prt_min <= 1 && p->prt_max == 65535 && p->maskbits == 0) { @@ -1157,7 +1157,7 @@ policies_log_first_redundant_entry(const smartlist_t* dest) if (found_ipv4_wildcard && found_ipv6_wildcard) { found_final_effective_entry = 1; /* if we're not on the final entry in the list */ - if (i < smartlist_len(dest) - 1) { + if (i < smartlist_len(policy) - 1) { first_redundant_entry = i + 1; } break; @@ -1171,8 +1171,8 @@ policies_log_first_redundant_entry(const smartlist_t* dest) * which contains a max-length IPv6 address, plus 24 characters. */ char line[TOR_ADDR_BUF_LEN + 32]; - tor_assert(first_redundant_entry < smartlist_len(dest)); - p = smartlist_get(dest, first_redundant_entry); + tor_assert(first_redundant_entry < smartlist_len(policy)); + p = smartlist_get(policy, first_redundant_entry); /* since we've already parsed the policy into an addr_policy_t struct, * we might not log exactly what the user typed in */ policy_write_item(line, TOR_ADDR_BUF_LEN + 32, p, 0); @@ -1237,7 +1237,7 @@ policies_parse_exit_policy_internal(config_line_t *cfg, /* Before we add the default policy and final rejects, check to see if * there are any lines after accept *:* or reject *:*. These lines have no * effect, and are most likely an error. */ - policies_log_first_redundant_entry(*dest); + policies_log_first_redundant_entry(*dest); if (add_default_policy) { append_exit_policy_string(dest, DEFAULT_EXIT_POLICY);

1 0

[tor/master] Refactor policies_parse_exit_policy_internal
by nickm＠torproject.org 09 Dec '15

09 Dec '15

commit ba5053b45dd14bd2fb982a29360fe0e1dc4525dc Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Sun Dec 6 21:28:21 2015 +1100 Refactor policies_parse_exit_policy_internal Move logging of redundant policy entries in policies_parse_exit_policy_internal into its own function. Closes ticket 17608; patch from "juce". --- changes/feature17608 | 4 ++ src/or/policies.c | 103 +++++++++++++++++++++++++++----------------------- 2 files changed, 60 insertions(+), 47 deletions(-) diff --git a/changes/feature17608 b/changes/feature17608 new file mode 100644 index 0000000..d56bb7d --- /dev/null +++ b/changes/feature17608 @@ -0,0 +1,4 @@ + o Minor feature (refactoring): + - Move logging of redundant policy entries in + policies_parse_exit_policy_internal into its own function. + Closes ticket 17608; patch from "juce". diff --git a/src/or/policies.c b/src/or/policies.c index 126ba46..275bab2 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -1124,54 +1124,12 @@ policies_parse_exit_policy_reject_private( "reject *:563,reject *:1214,reject *:4661-4666," \ "reject *:6346-6429,reject *:6699,reject *:6881-6999,accept *:*" -/** Parse the exit policy cfg into the linked list *dest. - * - * If ipv6_exit is false, prepend "reject *6:*" to the policy. - * - * If rejectprivate is true: - * - prepend "reject private:*" to the policy. - * - prepend entries that reject publicly routable addresses on this exit - * relay by calling policies_parse_exit_policy_reject_private - * - * If cfg doesn't end in an absolute accept or reject and if - * add_default_policy is true, add the default exit - * policy afterwards. - * - * Return -1 if we can't parse cfg, else return 0. - * - * This function is used to parse the exit policy from our torrc. For - * the functions used to parse the exit policy from a router descriptor, - * see router_add_exit_policy. +/** + * Iterates through *dest and logs a warning with first + * redundant entry if found */ -static int -policies_parse_exit_policy_internal(config_line_t *cfg, - smartlist_t **dest, - int ipv6_exit, - int rejectprivate, - const smartlist_t *configured_addresses, - int reject_interface_addresses, - int reject_configured_port_addresses, - int add_default_policy) -{ - if (!ipv6_exit) { - append_exit_policy_string(dest, "reject *6:*"); - } - if (rejectprivate) { - /* Reject IPv4 and IPv6 reserved private netblocks */ - append_exit_policy_string(dest, "reject private:*"); - /* Reject IPv4 and IPv6 publicly routable addresses on this exit relay */ - policies_parse_exit_policy_reject_private( - dest, ipv6_exit, - configured_addresses, - reject_interface_addresses, - reject_configured_port_addresses); - } - if (parse_addr_policy(cfg, dest, -1)) - return -1; - - /* Before we add the default policy and final rejects, check to see if - * there are any lines after accept *:* or reject *:*. These lines have no - * effect, and are most likely an error. */ +static void +policies_log_first_redundant_entry(smartlist_t** dest) { int found_final_effective_entry = 0; int first_redundant_entry = 0; for (int i = 0; i < smartlist_len(*dest); ++i) { @@ -1227,6 +1185,57 @@ policies_parse_exit_policy_internal(config_line_t *cfg, "accept/reject *:* as the last entry in any exit policy.)", line); } +} + +/** Parse the exit policy cfg into the linked list *dest. + * + * If ipv6_exit is false, prepend "reject *6:*" to the policy. + * + * If rejectprivate is true: + * - prepend "reject private:*" to the policy. + * - prepend entries that reject publicly routable addresses on this exit + * relay by calling policies_parse_exit_policy_reject_private + * + * If cfg doesn't end in an absolute accept or reject and if + * add_default_policy is true, add the default exit + * policy afterwards. + * + * Return -1 if we can't parse cfg, else return 0. + * + * This function is used to parse the exit policy from our torrc. For + * the functions used to parse the exit policy from a router descriptor, + * see router_add_exit_policy. + */ +static int +policies_parse_exit_policy_internal(config_line_t *cfg, + smartlist_t **dest, + int ipv6_exit, + int rejectprivate, + const smartlist_t *configured_addresses, + int reject_interface_addresses, + int reject_configured_port_addresses, + int add_default_policy) +{ + if (!ipv6_exit) { + append_exit_policy_string(dest, "reject *6:*"); + } + if (rejectprivate) { + /* Reject IPv4 and IPv6 reserved private netblocks */ + append_exit_policy_string(dest, "reject private:*"); + /* Reject IPv4 and IPv6 publicly routable addresses on this exit relay */ + policies_parse_exit_policy_reject_private( + dest, ipv6_exit, + configured_addresses, + reject_interface_addresses, + reject_configured_port_addresses); + } + if (parse_addr_policy(cfg, dest, -1)) + return -1; + + /* Before we add the default policy and final rejects, check to see if + * there are any lines after accept *:* or reject *:*. These lines have no + * effect, and are most likely an error. */ + policies_log_first_redundant_entry(dest); if (add_default_policy) { append_exit_policy_string(dest, DEFAULT_EXIT_POLICY);

1 0