February 2017 - tor-commits - lists.torproject.org

[tor/release-0.2.9] Scale IPv6 address counts in policy_summary_reject to avoid overflow
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 408c53b7a78767e04124fec4c4d470fe474e4906 Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 15:31:33 2017 +1100 Scale IPv6 address counts in policy_summary_reject to avoid overflow This disregards anything smaller than an IPv6 /64, and rejects ports that are rejected on an IPv6 /16 or larger. Adjust existing unit tests, and add more to cover exceptional cases. No IPv4 behaviour changes. Fixes bug 21357 --- src/or/policies.c | 35 +++++++++++++++++++++++++++++------ src/test/test_policy.c | 42 ++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 69 insertions(+), 8 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index cac475d..6037ee3 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2300,15 +2300,24 @@ policy_summary_item_split(policy_summary_item_t* old, uint16_t new_starts) #define AT(x) ((policy_summary_item_t*)smartlist_get(summary, x)) #define IPV4_BITS (32) +/* Every IPv4 address is counted as one rejection */ +#define REJECT_CUTOFF_SCALE_IPV4 (0) /* Ports are rejected in an IPv4 summary if they are rejected in more than two * IPv4 /8 address blocks */ #define REJECT_CUTOFF_COUNT_IPV4 (U64_LITERAL(1) << \ - (IPV4_BITS - 7)) + (IPV4_BITS - REJECT_CUTOFF_SCALE_IPV4 - 7)) #define IPV6_BITS (128) -/* Ports are rejected in an IPv6 summary if they are rejected in at least one - * IPv6 /64. */ -#define REJECT_CUTOFF_COUNT_IPV6 (UINT64_MAX) +/* IPv6 /64s are counted as one rejection, anything smaller is ignored */ +#define REJECT_CUTOFF_SCALE_IPV6 (64) +/* Ports are rejected in an IPv6 summary if they are rejected in more than one + * IPv6 /16 address block. + * This is rougly equivalent to the IPv4 cutoff, as only five IPv6 /12s (and + * some scattered smaller blocks) have been allocated to the RIRs. + * Network providers are typically allocated one or more IPv6 /32s. + */ +#define REJECT_CUTOFF_COUNT_IPV6 (U64_LITERAL(1) << \ + (IPV6_BITS - REJECT_CUTOFF_SCALE_IPV6 - 16)) /** Split an exit policy summary so that prt_min and prt_max * fall at exactly the start and end of an item respectively. @@ -2381,14 +2390,28 @@ policy_summary_reject(smartlist_t *summary, int addrbits = (family == AF_INET) ? IPV4_BITS : IPV6_BITS; tor_assert_nonfatal_once(addrbits >= maskbits); + /* We divide IPv6 address counts by (1 << scale) to keep them in a uint64_t + */ + int scale = ((family == AF_INET) ? + REJECT_CUTOFF_SCALE_IPV4 : + REJECT_CUTOFF_SCALE_IPV6); + + tor_assert_nonfatal_once(addrbits >= scale); + if (maskbits > (addrbits - scale)) { + tor_assert_nonfatal_once(family == AF_INET6); + /* The address range is so small, we'd need billions of them to reach the + * rejection limit. So we ignore this range in the reject count. */ + return; + } + uint64_t count = 0; - if (addrbits - maskbits >= 64) { + if (addrbits - scale - maskbits >= 64) { tor_assert_nonfatal_once(family == AF_INET6); /* The address range is so large, it's an automatic rejection for all ports * in the range. */ count = UINT64_MAX; } else { - count = (U64_LITERAL(1) << (addrbits - maskbits)); + count = (U64_LITERAL(1) << (addrbits - scale - maskbits)); } tor_assert_nonfatal_once(count > 0); while (i < smartlist_len(summary) && diff --git a/src/test/test_policy.c b/src/test/test_policy.c index fb7195a..f2d42b9 100644 --- a/src/test/test_policy.c +++ b/src/test/test_policy.c @@ -594,13 +594,51 @@ test_policies_general(void *arg) /* short policy with configured netblocks */ test_policy_summary_helper("reject 149.56.0.0/16," "reject6 2607:5300::/32," + "reject6 2608:5300::/64," + "reject6 2609:5300::/96," + "accept *:80," + "accept *:443," + "reject *:*", + "accept 80,443"); + /* short policy with large netblocks that do not count as a rejection */ + test_policy_summary_helper("reject 148.0.0.0/7," + "reject6 2600::/16," "accept *:80," "accept *:443," "reject *:*", "accept 80,443"); /* short policy with large netblocks that count as a rejection */ - test_policy_summary_helper("reject 149.0.0.0/6," - "reject6 2600::/6," + test_policy_summary_helper("reject 148.0.0.0/6," + "reject6 2600::/15," + "accept *:80," + "accept *:443," + "reject *:*", + "reject 1-65535"); + /* short policy with huge netblocks that count as a rejection */ + test_policy_summary_helper("reject 128.0.0.0/1," + "reject6 8000::/1," + "accept *:80," + "accept *:443," + "reject *:*", + "reject 1-65535"); + /* short policy which blocks everything using netblocks */ + test_policy_summary_helper("reject 0.0.0.0/0," + "reject6 ::/0," + "accept *:80," + "accept *:443," + "reject *:*", + "reject 1-65535"); + /* short policy which has repeated redundant netblocks */ + test_policy_summary_helper("reject 0.0.0.0/0," + "reject 0.0.0.0/0," + "reject 0.0.0.0/0," + "reject 0.0.0.0/0," + "reject 0.0.0.0/0," + "reject6 ::/0," + "reject6 ::/0," + "reject6 ::/0," + "reject6 ::/0," + "reject6 ::/0," "accept *:80," "accept *:443," "reject *:*",

1 0

[tor/master] Merge branch 'maint-0.2.9'
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit e210015d2f464464c8f06931eff09a0b4ff5bd6b Merge: 64b0ee2 9379984 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 09:24:29 2017 -0500 Merge branch 'maint-0.2.9'

1 0

[tor/maint-0.2.9] Merge branch 'teor_bug21357-v2_029' into maint-0.2.9
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 9379984128365487d732a89a851a1132b8edbfa0 Merge: dff390d bed94a9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 09:24:08 2017 -0500 Merge branch 'teor_bug21357-v2_029' into maint-0.2.9 changes/bug21357 | 7 + src/or/policies.c | 95 +++++++-- src/or/policies.h | 3 + src/test/test_policy.c | 534 +++++++++++++++++++++++++++++++++++++++++++++++-- 4 files changed, 609 insertions(+), 30 deletions(-)

1 0

[tor/release-0.2.9] Fix IPv6 support in policy_summary_reject and policy_summary_accept
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 4667a40ca944134866b95b10407a7e471206aa00 Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 15:28:46 2017 +1100 Fix IPv6 support in policy_summary_reject and policy_summary_accept This interim fix results in too many IPv6 rejections. No behaviour change for IPv4 counts, except for overflow fixes that would require 4 billion redundant 0.0.0.0/0 policy entries to trigger. Part of 21357 --- src/or/policies.c | 60 +++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 47 insertions(+), 13 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index 71062eb..cac475d 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2304,6 +2304,12 @@ policy_summary_item_split(policy_summary_item_t* old, uint16_t new_starts) * IPv4 /8 address blocks */ #define REJECT_CUTOFF_COUNT_IPV4 (U64_LITERAL(1) << \ (IPV4_BITS - 7)) + +#define IPV6_BITS (128) +/* Ports are rejected in an IPv6 summary if they are rejected in at least one + * IPv6 /64. */ +#define REJECT_CUTOFF_COUNT_IPV6 (UINT64_MAX) + /** Split an exit policy summary so that prt_min and prt_max * fall at exactly the start and end of an item respectively. */ @@ -2336,40 +2342,68 @@ policy_summary_split(smartlist_t *summary, return start_at_index; } -/** Mark port ranges as accepted if they are below the reject_count */ +/** Mark port ranges as accepted if they are below the reject_count for family + */ static void policy_summary_accept(smartlist_t *summary, - uint16_t prt_min, uint16_t prt_max) + uint16_t prt_min, uint16_t prt_max, + sa_family_t family) { + tor_assert_nonfatal_once(family == AF_INET || family == AF_INET6); + uint64_t family_reject_count = ((family == AF_INET) ? + REJECT_CUTOFF_COUNT_IPV4 : + REJECT_CUTOFF_COUNT_IPV6); + int i = policy_summary_split(summary, prt_min, prt_max); while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { if (!AT(i)->accepted && - AT(i)->reject_count <= REJECT_CUTOFF_COUNT_IPV4) + AT(i)->reject_count <= family_reject_count) AT(i)->accepted = 1; i++; } tor_assert(i < smartlist_len(summary) || prt_max==65535); } -/** Count the number of addresses in a network with prefixlen maskbits - * against the given portrange. */ +/** Count the number of addresses in a network in family with prefixlen + * maskbits against the given portrange. */ static void policy_summary_reject(smartlist_t *summary, maskbits_t maskbits, - uint16_t prt_min, uint16_t prt_max) + uint16_t prt_min, uint16_t prt_max, + sa_family_t family) { + tor_assert_nonfatal_once(family == AF_INET || family == AF_INET6); + int i = policy_summary_split(summary, prt_min, prt_max); - /* XXX: ipv4 specific */ + /* The length of a single address mask */ - int addrbits = IPV4_BITS; + int addrbits = (family == AF_INET) ? IPV4_BITS : IPV6_BITS; tor_assert_nonfatal_once(addrbits >= maskbits); - uint64_t count = (U64_LITERAL(1) << (addrbits-maskbits)); + uint64_t count = 0; + if (addrbits - maskbits >= 64) { + tor_assert_nonfatal_once(family == AF_INET6); + /* The address range is so large, it's an automatic rejection for all ports + * in the range. */ + count = UINT64_MAX; + } else { + count = (U64_LITERAL(1) << (addrbits - maskbits)); + } tor_assert_nonfatal_once(count > 0); while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { - AT(i)->reject_count += count; + if (AT(i)->reject_count <= UINT64_MAX - count) { + AT(i)->reject_count += count; + } else { + /* IPv4 would require a 4-billion address redundant policy to get here, + * but IPv6 just needs to have ::/0 */ + if (family == AF_INET) { + tor_assert_nonfatal_unreached_once(); + } + /* If we do get here, use saturating arithmetic */ + AT(i)->reject_count = UINT64_MAX; + } i++; } tor_assert(i < smartlist_len(summary) || prt_max==65535); @@ -2389,7 +2423,7 @@ policy_summary_add_item(smartlist_t *summary, addr_policy_t *p) { if (p->policy_type == ADDR_POLICY_ACCEPT) { if (p->maskbits == 0) { - policy_summary_accept(summary, p->prt_min, p->prt_max); + policy_summary_accept(summary, p->prt_min, p->prt_max, p->addr.family); } } else if (p->policy_type == ADDR_POLICY_REJECT) { @@ -2410,7 +2444,8 @@ policy_summary_add_item(smartlist_t *summary, addr_policy_t *p) } if (!is_private) { - policy_summary_reject(summary, p->maskbits, p->prt_min, p->prt_max); + policy_summary_reject(summary, p->maskbits, p->prt_min, p->prt_max, + p->addr.family); } } else tor_assert(0); @@ -2444,7 +2479,6 @@ policy_summarize(smartlist_t *policy, sa_family_t family) } if (f != family) continue; - /* XXXX-ipv6 More family work is needed */ policy_summary_add_item(summary, p); } SMARTLIST_FOREACH_END(p);

1 0

[tor/release-0.2.9] Refactor policy_summary_reject to prepare for IPv6 changes
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 82850d0da6c29fe50e2622f0cde0142ca9530ae4 Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 15:18:47 2017 +1100 Refactor policy_summary_reject to prepare for IPv6 changes No behaviour change, apart from non-fatal assertions Part of 21357 --- src/or/policies.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index 1262bef..71062eb 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2299,7 +2299,11 @@ policy_summary_item_split(policy_summary_item_t* old, uint16_t new_starts) * my immortal soul, he can clean it up himself. */ #define AT(x) ((policy_summary_item_t*)smartlist_get(summary, x)) -#define REJECT_CUTOFF_COUNT (1<<25) +#define IPV4_BITS (32) +/* Ports are rejected in an IPv4 summary if they are rejected in more than two + * IPv4 /8 address blocks */ +#define REJECT_CUTOFF_COUNT_IPV4 (U64_LITERAL(1) << \ + (IPV4_BITS - 7)) /** Split an exit policy summary so that prt_min and prt_max * fall at exactly the start and end of an item respectively. */ @@ -2341,7 +2345,7 @@ policy_summary_accept(smartlist_t *summary, while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { if (!AT(i)->accepted && - AT(i)->reject_count <= REJECT_CUTOFF_COUNT) + AT(i)->reject_count <= REJECT_CUTOFF_COUNT_IPV4) AT(i)->accepted = 1; i++; } @@ -2357,7 +2361,12 @@ policy_summary_reject(smartlist_t *summary, { int i = policy_summary_split(summary, prt_min, prt_max); /* XXX: ipv4 specific */ - uint64_t count = (U64_LITERAL(1) << (32-maskbits)); + /* The length of a single address mask */ + int addrbits = IPV4_BITS; + tor_assert_nonfatal_once(addrbits >= maskbits); + + uint64_t count = (U64_LITERAL(1) << (addrbits-maskbits)); + tor_assert_nonfatal_once(count > 0); while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { AT(i)->reject_count += count;

1 0

[tor/master] Merge branch 'teor_bug21357-v2_029' into maint-0.2.9
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 9379984128365487d732a89a851a1132b8edbfa0 Merge: dff390d bed94a9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 09:24:08 2017 -0500 Merge branch 'teor_bug21357-v2_029' into maint-0.2.9 changes/bug21357 | 7 + src/or/policies.c | 95 +++++++-- src/or/policies.h | 3 + src/test/test_policy.c | 534 +++++++++++++++++++++++++++++++++++++++++++++++-- 4 files changed, 609 insertions(+), 30 deletions(-)

1 0

[tor/maint-0.2.9] Fix IPv6 support in policy_summary_reject and policy_summary_accept
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 4667a40ca944134866b95b10407a7e471206aa00 Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 15:28:46 2017 +1100 Fix IPv6 support in policy_summary_reject and policy_summary_accept This interim fix results in too many IPv6 rejections. No behaviour change for IPv4 counts, except for overflow fixes that would require 4 billion redundant 0.0.0.0/0 policy entries to trigger. Part of 21357 --- src/or/policies.c | 60 +++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 47 insertions(+), 13 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index 71062eb..cac475d 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2304,6 +2304,12 @@ policy_summary_item_split(policy_summary_item_t* old, uint16_t new_starts) * IPv4 /8 address blocks */ #define REJECT_CUTOFF_COUNT_IPV4 (U64_LITERAL(1) << \ (IPV4_BITS - 7)) + +#define IPV6_BITS (128) +/* Ports are rejected in an IPv6 summary if they are rejected in at least one + * IPv6 /64. */ +#define REJECT_CUTOFF_COUNT_IPV6 (UINT64_MAX) + /** Split an exit policy summary so that prt_min and prt_max * fall at exactly the start and end of an item respectively. */ @@ -2336,40 +2342,68 @@ policy_summary_split(smartlist_t *summary, return start_at_index; } -/** Mark port ranges as accepted if they are below the reject_count */ +/** Mark port ranges as accepted if they are below the reject_count for family + */ static void policy_summary_accept(smartlist_t *summary, - uint16_t prt_min, uint16_t prt_max) + uint16_t prt_min, uint16_t prt_max, + sa_family_t family) { + tor_assert_nonfatal_once(family == AF_INET || family == AF_INET6); + uint64_t family_reject_count = ((family == AF_INET) ? + REJECT_CUTOFF_COUNT_IPV4 : + REJECT_CUTOFF_COUNT_IPV6); + int i = policy_summary_split(summary, prt_min, prt_max); while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { if (!AT(i)->accepted && - AT(i)->reject_count <= REJECT_CUTOFF_COUNT_IPV4) + AT(i)->reject_count <= family_reject_count) AT(i)->accepted = 1; i++; } tor_assert(i < smartlist_len(summary) || prt_max==65535); } -/** Count the number of addresses in a network with prefixlen maskbits - * against the given portrange. */ +/** Count the number of addresses in a network in family with prefixlen + * maskbits against the given portrange. */ static void policy_summary_reject(smartlist_t *summary, maskbits_t maskbits, - uint16_t prt_min, uint16_t prt_max) + uint16_t prt_min, uint16_t prt_max, + sa_family_t family) { + tor_assert_nonfatal_once(family == AF_INET || family == AF_INET6); + int i = policy_summary_split(summary, prt_min, prt_max); - /* XXX: ipv4 specific */ + /* The length of a single address mask */ - int addrbits = IPV4_BITS; + int addrbits = (family == AF_INET) ? IPV4_BITS : IPV6_BITS; tor_assert_nonfatal_once(addrbits >= maskbits); - uint64_t count = (U64_LITERAL(1) << (addrbits-maskbits)); + uint64_t count = 0; + if (addrbits - maskbits >= 64) { + tor_assert_nonfatal_once(family == AF_INET6); + /* The address range is so large, it's an automatic rejection for all ports + * in the range. */ + count = UINT64_MAX; + } else { + count = (U64_LITERAL(1) << (addrbits - maskbits)); + } tor_assert_nonfatal_once(count > 0); while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { - AT(i)->reject_count += count; + if (AT(i)->reject_count <= UINT64_MAX - count) { + AT(i)->reject_count += count; + } else { + /* IPv4 would require a 4-billion address redundant policy to get here, + * but IPv6 just needs to have ::/0 */ + if (family == AF_INET) { + tor_assert_nonfatal_unreached_once(); + } + /* If we do get here, use saturating arithmetic */ + AT(i)->reject_count = UINT64_MAX; + } i++; } tor_assert(i < smartlist_len(summary) || prt_max==65535); @@ -2389,7 +2423,7 @@ policy_summary_add_item(smartlist_t *summary, addr_policy_t *p) { if (p->policy_type == ADDR_POLICY_ACCEPT) { if (p->maskbits == 0) { - policy_summary_accept(summary, p->prt_min, p->prt_max); + policy_summary_accept(summary, p->prt_min, p->prt_max, p->addr.family); } } else if (p->policy_type == ADDR_POLICY_REJECT) { @@ -2410,7 +2444,8 @@ policy_summary_add_item(smartlist_t *summary, addr_policy_t *p) } if (!is_private) { - policy_summary_reject(summary, p->maskbits, p->prt_min, p->prt_max); + policy_summary_reject(summary, p->maskbits, p->prt_min, p->prt_max, + p->addr.family); } } else tor_assert(0); @@ -2444,7 +2479,6 @@ policy_summarize(smartlist_t *policy, sa_family_t family) } if (f != family) continue; - /* XXXX-ipv6 More family work is needed */ policy_summary_add_item(summary, p); } SMARTLIST_FOREACH_END(p);

1 0

[tor/release-0.2.9] Changes file for 21357: Stop rejecting all IPv6 traffic on some Exits
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit bed94a9ed9974d7ecd93078604baed14e548d531 Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 16:39:21 2017 +1100 Changes file for 21357: Stop rejecting all IPv6 traffic on some Exits This issue was triggered by 17027 in 0.2.8.1-alpha, which rejects a relay's own IPv6 address. Bugfix on commit 004f3f4e53 in 0.2.4.7-alpha. --- changes/bug21357 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/changes/bug21357 b/changes/bug21357 new file mode 100644 index 0000000..a1cb43a --- /dev/null +++ b/changes/bug21357 @@ -0,0 +1,7 @@ + o Major bugfixes (IPv6 Exits): + - Stop rejecting all IPv6 traffic on Exits whose exit policy rejects IPv6 + addresses. Instead, only reject a port over IPv6 if the exit policy + rejects that port on more than an IPv6 /16 of addresses. This bug was + made worse by 17027 in 0.2.8.1-alpha, which rejects a relay's own IPv6 + address by default. + Fixes bug 21357; bugfix on commit 004f3f4e53 in 0.2.4.7-alpha.

1 0

[tor/maint-0.2.9] Refactor policy_summary_reject to prepare for IPv6 changes
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 82850d0da6c29fe50e2622f0cde0142ca9530ae4 Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 15:18:47 2017 +1100 Refactor policy_summary_reject to prepare for IPv6 changes No behaviour change, apart from non-fatal assertions Part of 21357 --- src/or/policies.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index 1262bef..71062eb 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2299,7 +2299,11 @@ policy_summary_item_split(policy_summary_item_t* old, uint16_t new_starts) * my immortal soul, he can clean it up himself. */ #define AT(x) ((policy_summary_item_t*)smartlist_get(summary, x)) -#define REJECT_CUTOFF_COUNT (1<<25) +#define IPV4_BITS (32) +/* Ports are rejected in an IPv4 summary if they are rejected in more than two + * IPv4 /8 address blocks */ +#define REJECT_CUTOFF_COUNT_IPV4 (U64_LITERAL(1) << \ + (IPV4_BITS - 7)) /** Split an exit policy summary so that prt_min and prt_max * fall at exactly the start and end of an item respectively. */ @@ -2341,7 +2345,7 @@ policy_summary_accept(smartlist_t *summary, while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { if (!AT(i)->accepted && - AT(i)->reject_count <= REJECT_CUTOFF_COUNT) + AT(i)->reject_count <= REJECT_CUTOFF_COUNT_IPV4) AT(i)->accepted = 1; i++; } @@ -2357,7 +2361,12 @@ policy_summary_reject(smartlist_t *summary, { int i = policy_summary_split(summary, prt_min, prt_max); /* XXX: ipv4 specific */ - uint64_t count = (U64_LITERAL(1) << (32-maskbits)); + /* The length of a single address mask */ + int addrbits = IPV4_BITS; + tor_assert_nonfatal_once(addrbits >= maskbits); + + uint64_t count = (U64_LITERAL(1) << (addrbits-maskbits)); + tor_assert_nonfatal_once(count > 0); while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { AT(i)->reject_count += count;

1 0

[tor/release-0.2.9] Fix write_short_policy usage comment
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit e95b8f7df9faf61dea8f523da7548a7217aa831a Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 13:48:09 2017 +1100 Fix write_short_policy usage comment --- src/or/policies.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index 227e168..1262bef 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2624,8 +2624,7 @@ parse_short_policy(const char *summary) return result; } -/** Write <b>policy</b> back out into a string. Used only for unit tests - * currently. */ +/** Write <b>policy</b> back out into a string. */ char * write_short_policy(const short_policy_t *policy) {

1 0