- tor-commits - lists.torproject.org

[torspec/master] Correct description of v3 introduce cells to match implementation
by nickm＠torproject.org 19 Jul '12

19 Jul '12

commit 117f14323a04c5fd5228ca3e849abd10b9c5e742 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jul 19 11:18:01 2012 -0400 Correct description of v3 introduce cells to match implementation We said that every v3 introduce cell needs to have an AUTHL field. But it turns out we only produce that field when we are using a nonzero authentication method. It's not possible to make clients or services begin matching the spec without incompatibility, so instead let's make the spec match our behavior. --- rend-spec.txt | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/rend-spec.txt b/rend-spec.txt index 023c83b..d1db467 100644 --- a/rend-spec.txt +++ b/rend-spec.txt @@ -636,8 +636,9 @@ OR (in the v3 intro protocol) VER Version byte: set to 3. [1 octet] AUTHT The auth type that is used [1 octet] - AUTHL Length of auth data [2 octets] - AUTHD Auth data [variable] + If AUTHT != [00]: + AUTHL Length of auth data [2 octets] + AUTHD Auth data [variable] TS A timestamp [4 octets] IP Rendezvous point's address [4 octets] PORT Rendezvous point's OR port [2 octets]

1 0

r25720: {website} add philadelphia inquirer story. (website/trunk/press/en)
by Andrew Lewman 19 Jul '12

19 Jul '12

Author: phobos Date: 2012-07-19 18:30:37 +0000 (Thu, 19 Jul 2012) New Revision: 25720 Modified: website/trunk/press/en/inthemedia.wml Log: add philadelphia inquirer story. Modified: website/trunk/press/en/inthemedia.wml =================================================================== --- website/trunk/press/en/inthemedia.wml 2012-07-18 19:51:24 UTC (rev 25719) +++ website/trunk/press/en/inthemedia.wml 2012-07-19 18:30:37 UTC (rev 25720) @@ -32,6 +32,11 @@ <th>Topic</th> </tr> </thead> +<tr style="background-color: #e5e5e5;"> +<td>2012 Jul 19</td> +<td>Philadelphia Inquirer</td> +<td><a href="http://www.philly.com/philly/business/20120719_Tech_Life__Fostering_anonymi…">Tech Life: Fostering anonymity online</a></td> +</tr> <tr> <td>2012 Jul 13</td> <td>NATO</td>

1 0

[flashproxy/master] Add a modules directory.
by dcf＠torproject.org 19 Jul '12

19 Jul '12

commit 4f24bc9e2876ba83e30c92e332aa8517472853a0 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jul 19 09:02:06 2012 -0700 Add a modules directory. This is going to hold Brian's Drupal module and possibly others in the future (e.g. Wordpress). --- modules/README | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/modules/README b/modules/README new file mode 100644 index 0000000..a14264a --- /dev/null +++ b/modules/README @@ -0,0 +1,2 @@ +This directory contains modules and plugins for making flash proxies +work with other systems such as web publishing platforms.

1 0

[flashproxy/master] Add Drupal module by Brian Duggan.
by dcf＠torproject.org 19 Jul '12

19 Jul '12

commit a39b1cb23e80d48152684b0da65eea7ed0811ed1 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jul 19 09:11:47 2012 -0700 Add Drupal module by Brian Duggan. Brian did research and found out what files and syntax are needed for a Drupal 7 module. This module loads and runs the flash proxy program, but it doesn't put a badge on the page. The module originally had a copy of flashproxy.js with the only change being an additional line at the bottom to start the proxy running. I changed that into a symlink to the main flashproxy.js, and added a new flashproxy-start.js that calls the start method. I haven't tested these changes at all or even know if I have the syntax right. --- modules/drupal/flashproxy-start.js | 1 + modules/drupal/flashproxy.info | 5 +++++ modules/drupal/flashproxy.js | 1 + modules/drupal/flashproxy.module | 2 ++ 4 files changed, 9 insertions(+), 0 deletions(-) diff --git a/modules/drupal/flashproxy-start.js b/modules/drupal/flashproxy-start.js new file mode 100644 index 0000000..fe7d10b --- /dev/null +++ b/modules/drupal/flashproxy-start.js @@ -0,0 +1 @@ +flashproxy_badge_insert().start(); diff --git a/modules/drupal/flashproxy.info b/modules/drupal/flashproxy.info new file mode 100644 index 0000000..2f9b174 --- /dev/null +++ b/modules/drupal/flashproxy.info @@ -0,0 +1,5 @@ +name = Flashproxy Module +description = Insert Flashproxy js into some or all pages on your site. +core = 7.x +scripts[] = flashproxy.js +scripts[] = flashproxy-start.js diff --git a/modules/drupal/flashproxy.js b/modules/drupal/flashproxy.js new file mode 120000 index 0000000..db0eda6 --- /dev/null +++ b/modules/drupal/flashproxy.js @@ -0,0 +1 @@ +../../flashproxy.js \ No newline at end of file diff --git a/modules/drupal/flashproxy.module b/modules/drupal/flashproxy.module new file mode 100644 index 0000000..a4abe2d --- /dev/null +++ b/modules/drupal/flashproxy.module @@ -0,0 +1,2 @@ +<?php +

1 0

[stem/master] Adding exit_policy to stem's __init__.py
by atagar＠torproject.org 19 Jul '12

19 Jul '12

commit d7ca32639205ca99ca053270b98b90dee4cc7986 Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Jul 19 09:08:25 2012 -0700 Adding exit_policy to stem's __init__.py Forgot to add the new exit_policy.py module. --- stem/__init__.py | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/stem/__init__.py b/stem/__init__.py index faee5db..c05fcda 100644 --- a/stem/__init__.py +++ b/stem/__init__.py @@ -14,6 +14,7 @@ __all__ = [ "util", "connection", "control", + "exit_policy", "prereq", "process", "socket",

1 0

[stem/master] Add ExitPolicy, ExitPolicyIterator from arm/torTools
by atagar＠torproject.org 19 Jul '12

19 Jul '12

commit 88c436276f1aa0d20206499099b689eb50ace573 Author: Sathyanarayanan Gunasekaran <gsathya.ceg(a)gmail.com> Date: Thu Mar 22 23:20:43 2012 +0530 Add ExitPolicy, ExitPolicyIterator from arm/torTools --- stem/exit_policy.py | 237 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 237 insertions(+), 0 deletions(-) diff --git a/stem/exit_policy.py b/stem/exit_policy.py new file mode 100644 index 0000000..40cad39 --- /dev/null +++ b/stem/exit_policy.py @@ -0,0 +1,237 @@ +import re + +class ExitPolicyIterator: + """ + Basic iterator for cycling through ExitPolicy entries. + """ + + def __init__(self, head): + self.head = head + + def next(self): + if self.head: + lastHead = self.head + self.head = self.head.nextRule + return lastHead + else: raise StopIteration + +class ExitPolicy: + """ + Single rule from the user's exit policy. These are chained together to form + complete policies. + """ + + def __init__(self, ruleEntry, nextRule): + """ + Exit policy rule constructor. + + Arguments: + ruleEntry - tor exit policy rule (for instance, "reject *:135-139") + nextRule - next rule to be checked when queries don't match this policy + """ + + # cached summary string + self.summaryStr = None + + # sanitize the input a bit, cleaning up tabs and stripping quotes + ruleEntry = ruleEntry.replace("\\t", " ").replace("\"", "") + + self.ruleEntry = ruleEntry + self.nextRule = nextRule + self.isAccept = ruleEntry.startswith("accept") + + # strips off "accept " or "reject " and extra spaces + ruleEntry = ruleEntry[7:].replace(" ", "") + + # split ip address (with mask if provided) and port + if ":" in ruleEntry: entryIp, entryPort = ruleEntry.split(":", 1) + else: entryIp, entryPort = ruleEntry, "*" + + # sets the ip address component + self.isIpWildcard = entryIp == "*" or entryIp.endswith("/0") + + # checks for the private alias (which expands this to a chain of entries) + if entryIp.lower() == "private": + entryIp = PRIVATE_IP_RANGES[0] + + # constructs the chain backwards (last first) + lastHop = self.nextRule + prefix = "accept " if self.isAccept else "reject " + suffix = ":" + entryPort + for addr in PRIVATE_IP_RANGES[-1:0:-1]: + lastHop = ExitPolicy(prefix + addr + suffix, lastHop) + + self.nextRule = lastHop # our next hop is the start of the chain + + if "/" in entryIp: + ipComp = entryIp.split("/", 1) + self.ipAddress = ipComp[0] + self.ipMask = int(ipComp[1]) + else: + self.ipAddress = entryIp + self.ipMask = 32 + + # constructs the binary address just in case of comparison with a mask + if self.ipAddress != "*": + self.ipAddressBin = "" + for octet in self.ipAddress.split("."): + # Converts the int to a binary string, padded with zeros. Source: + # http://www.daniweb.com/code/snippet216539.html + self.ipAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + else: + self.ipAddressBin = "0" * 32 + + # sets the port component + self.minPort, self.maxPort = 0, 0 + self.isPortWildcard = entryPort == "*" + + if entryPort != "*": + if "-" in entryPort: + portComp = entryPort.split("-", 1) + self.minPort = int(portComp[0]) + self.maxPort = int(portComp[1]) + else: + self.minPort = int(entryPort) + self.maxPort = int(entryPort) + + # if both the address and port are wildcards then we're effectively the + # last entry so cut off the remaining chain + if self.isIpWildcard and self.isPortWildcard: + self.nextRule = None + + def isExitingAllowed(self): + """ + Provides true if the policy allows exiting whatsoever, false otherwise. + """ + + if self.isAccept: return True + elif self.isIpWildcard and self.isPortWildcard: return False + elif not self.nextRule: return False # fell off policy (shouldn't happen) + else: return self.nextRule.isExitingAllowed() + + def check(self, ipAddress, port): + """ + Checks if the rule chain allows exiting to this address, returning true if + so and false otherwise. + """ + + port = int(port) + + # does the port check first since comparing ip masks is more work + isPortMatch = self.isPortWildcard or (port >= self.minPort and port <= self.maxPort) + + if isPortMatch: + isIpMatch = self.isIpWildcard or self.ipAddress == ipAddress + + # expands the check to include the mask if it has one + if not isIpMatch and self.ipMask != 32: + inputAddressBin = "" + for octet in ipAddress.split("."): + inputAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + + isIpMatch = self.ipAddressBin[:self.ipMask] == inputAddressBin[:self.ipMask] + + if isIpMatch: return self.isAccept + + # our policy doesn't concern this address, move on to the next one + if self.nextRule: return self.nextRule.check(ipAddress, port) + else: return True # fell off the chain without a conclusion (shouldn't happen...) + + def getSummary(self): + """ + Provides a summary description of the policy chain similar to the + consensus. This excludes entries that don't cover all ips, and is either + a whitelist or blacklist policy based on the final entry. For instance... + accept 80, 443 # just accepts ports 80/443 + reject 1-1024, 5555 # just accepts non-privilaged ports, excluding 5555 + """ + + if not self.summaryStr: + # determines if we're a whitelist or blacklist + isWhitelist = False # default in case we don't have a catch-all policy at the end + + for rule in self: + if rule.isIpWildcard and rule.isPortWildcard: + isWhitelist = not rule.isAccept + break + + # Iterates over the rules and adds the the ports we'll return (ie, allows + # if a whitelist and rejects if a blacklist). Reguardless of a port's + # allow/reject policy, all further entries with that port are ignored since + # policies respect the first matching rule. + + displayPorts, skipPorts = [], [] + + for rule in self: + if not rule.isIpWildcard: continue + + if rule.minPort == rule.maxPort: + portRange = [rule.minPort] + else: + portRange = range(rule.minPort, rule.maxPort + 1) + + for port in portRange: + if port in skipPorts: continue + + # if accept + whitelist or reject + blacklist then add + if rule.isAccept == isWhitelist: + displayPorts.append(port) + + # all further entries with this port are to be ignored + skipPorts.append(port) + + # gets a list of the port ranges + if displayPorts: + displayRanges, tmpRange = [], [] + displayPorts.sort() + displayPorts.append(None) # ending item to include last range in loop + + for port in displayPorts: + if not tmpRange or tmpRange[-1] + 1 == port: + tmpRange.append(port) + else: + if len(tmpRange) > 1: + displayRanges.append("%i-%i" % (tmpRange[0], tmpRange[-1])) + else: + displayRanges.append(str(tmpRange[0])) + + tmpRange = [port] + else: + # everything for the inverse + isWhitelist = not isWhitelist + displayRanges = ["1-65535"] + + # constructs the summary string + labelPrefix = "accept " if isWhitelist else "reject " + + self.summaryStr = (labelPrefix + ", ".join(displayRanges)).strip() + + return self.summaryStr + + def __iter__(self): + return ExitPolicyIterator(self) + + def __str__(self): + # This provides the actual policy rather than the entry used to construct + # it so the 'private' keyword is expanded. + + acceptanceLabel = "accept" if self.isAccept else "reject" + + if self.isIpWildcard: + ipLabel = "*" + elif self.ipMask != 32: + ipLabel = "%s/%i" % (self.ipAddress, self.ipMask) + else: ipLabel = self.ipAddress + + if self.isPortWildcard: + portLabel = "*" + elif self.minPort != self.maxPort: + portLabel = "%i-%i" % (self.minPort, self.maxPort) + else: portLabel = str(self.minPort) + + myPolicy = "%s %s:%s" % (acceptanceLabel, ipLabel, portLabel) + + if self.nextRule: + return myPolicy + ", " + str(self.nextRule) + else: return myPolicy +

1 0

[stem/master] Overhaul exit_policy.py
by atagar＠torproject.org 19 Jul '12

19 Jul '12

commit 80228a52e3f9507547cf924156a1bcafdea6540b Author: Sathyanarayanan Gunasekaran <gsathya.ceg(a)gmail.com> Date: Fri Mar 23 12:21:01 2012 +0530 Overhaul exit_policy.py - Fix Indentation issues - Remove ExitPolicyIterator class - Add ExitPolicyLine class - This class represent a single line from the Exit Policy. (provides much better abstraction IMHO) - __init__(), __str__(), and check() are copied from ExitPolicy - Changes in ExitPolicy - - Now, it acts a wrapper class to ExitPolicyLine - It contains a list ExitPolicy._policies which stores all the policies and each item in _policies is an object of ExitPolicyLine - check(), isExitingAllowed(), __str__(), and __iter__() are changed to provide a wrapper of sorts for ExitPolicyLine - add() is now used to add an exit policy line - This creates an object of ExitPolicyLine and adds it to ExitPolicy._policies --- stem/exit_policy.py | 358 ++++++++++++++++++++------------------------------- 1 files changed, 138 insertions(+), 220 deletions(-) diff --git a/stem/exit_policy.py b/stem/exit_policy.py index 40cad39..15c2b2c 100644 --- a/stem/exit_policy.py +++ b/stem/exit_policy.py @@ -1,237 +1,155 @@ -import re +# ip address ranges substituted by the 'private' keyword +PRIVATE_IP_RANGES = ("0.0.0.0/8", "169.254.0.0/16", "127.0.0.0/8", "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12") -class ExitPolicyIterator: - """ - Basic iterator for cycling through ExitPolicy entries. - """ - - def __init__(self, head): - self.head = head - - def next(self): - if self.head: - lastHead = self.head - self.head = self.head.nextRule - return lastHead - else: raise StopIteration +class ExitPolicyLine: + def __init__(self, ruleEntry): + # sanitize the input a bit, cleaning up tabs and stripping quotes + ruleEntry = ruleEntry.replace("\\t", " ").replace("\"", "") -class ExitPolicy: - """ - Single rule from the user's exit policy. These are chained together to form - complete policies. - """ - - def __init__(self, ruleEntry, nextRule): - """ - Exit policy rule constructor. - - Arguments: - ruleEntry - tor exit policy rule (for instance, "reject *:135-139") - nextRule - next rule to be checked when queries don't match this policy - """ + self.ruleEntry = ruleEntry + self.isAccept = ruleEntry.startswith("accept") + + # strips off "accept " or "reject " and extra spaces + ruleEntry = ruleEntry[7:].replace(" ", "") + + # split ip address (with mask if provided) and port + if ":" in ruleEntry: entryIp, entryPort = ruleEntry.split(":", 1) + else: entryIp, entryPort = ruleEntry, "*" + + # sets the ip address component + self.isIpWildcard = entryIp == "*" or entryIp.endswith("/0") + + # checks for the private alias (which expands this to a chain of entries) + if entryIp.lower() == "private": + # constructs the chain backwards (last first) + prefix = "accept " if self.isAccept else "reject " + suffix = ":" + entryPort + for addr in PRIVATE_IP_RANGES: + # TODO: Add ExitPolicy.add method + ExitPolicy.add(prefix + addr + suffix) + + if "/" in entryIp: + ipComp = entryIp.split("/", 1) + self.ipAddress = ipComp[0] + self.ipMask = int(ipComp[1]) + else: + self.ipAddress = entryIp + self.ipMask = 32 + + # constructs the binary address just in case of comparison with a mask + if self.ipAddress != "*": + self.ipAddressBin = "" + for octet in self.ipAddress.split("."): + # Converts the int to a binary string, padded with zeros. Source: + # http://www.daniweb.com/code/snippet216539.html + self.ipAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + else: + self.ipAddressBin = "0" * 32 + + # sets the port component + self.minPort, self.maxPort = 0, 0 + self.isPortWildcard = entryPort == "*" + + if entryPort != "*": + if "-" in entryPort: + portComp = entryPort.split("-", 1) + self.minPort = int(portComp[0]) + self.maxPort = int(portComp[1]) + else: + self.minPort = int(entryPort) + self.maxPort = int(entryPort) + + def __str__(self): + # This provides the actual policy rather than the entry used to construct + # it so the 'private' keyword is expanded. + + acceptanceLabel = "accept" if self.isAccept else "reject" - # cached summary string - self.summaryStr = None + if self.isIpWildcard: + ipLabel = "*" + elif self.ipMask != 32: + ipLabel = "%s/%i" % (self.ipAddress, self.ipMask) + else: ipLabel = self.ipAddress - # sanitize the input a bit, cleaning up tabs and stripping quotes - ruleEntry = ruleEntry.replace("\\t", " ").replace("\"", "") + if self.isPortWildcard: + portLabel = "*" + elif self.minPort != self.maxPort: + portLabel = "%i-%i" % (self.minPort, self.maxPort) + else: portLabel = str(self.minPort) - self.ruleEntry = ruleEntry - self.nextRule = nextRule - self.isAccept = ruleEntry.startswith("accept") + myPolicy = "%s %s:%s" % (acceptanceLabel, ipLabel, portLabel) + return myPolicy - # strips off "accept " or "reject " and extra spaces - ruleEntry = ruleEntry[7:].replace(" ", "") + def check(self, ipAddress, port): + """ + Checks if the rule chain allows exiting to this address, returning true if + so and false otherwise. + """ - # split ip address (with mask if provided) and port - if ":" in ruleEntry: entryIp, entryPort = ruleEntry.split(":", 1) - else: entryIp, entryPort = ruleEntry, "*" + port = int(port) - # sets the ip address component - self.isIpWildcard = entryIp == "*" or entryIp.endswith("/0") + # does the port check first since comparing ip masks is more work + isPortMatch = self.isPortWildcard or (port >= self.minPort and port <= self.maxPort) - # checks for the private alias (which expands this to a chain of entries) - if entryIp.lower() == "private": - entryIp = PRIVATE_IP_RANGES[0] - - # constructs the chain backwards (last first) - lastHop = self.nextRule - prefix = "accept " if self.isAccept else "reject " - suffix = ":" + entryPort - for addr in PRIVATE_IP_RANGES[-1:0:-1]: - lastHop = ExitPolicy(prefix + addr + suffix, lastHop) + if isPortMatch: + isIpMatch = self.isIpWildcard or self.ipAddress == ipAddress + + # expands the check to include the mask if it has one + if not isIpMatch and self.ipMask != 32: + inputAddressBin = "" + for octet in ipAddress.split("."): + inputAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + + isIpMatch = self.ipAddressBin[:self.ipMask] == inputAddressBin[:self.ipMask] + + if isIpMatch: return self.isAccept + + # fell off the chain without a conclusion (shouldn't happen...) + return False - self.nextRule = lastHop # our next hop is the start of the chain - - if "/" in entryIp: - ipComp = entryIp.split("/", 1) - self.ipAddress = ipComp[0] - self.ipMask = int(ipComp[1]) - else: - self.ipAddress = entryIp - self.ipMask = 32 - - # constructs the binary address just in case of comparison with a mask - if self.ipAddress != "*": - self.ipAddressBin = "" - for octet in self.ipAddress.split("."): - # Converts the int to a binary string, padded with zeros. Source: - # http://www.daniweb.com/code/snippet216539.html - self.ipAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) - else: - self.ipAddressBin = "0" * 32 - - # sets the port component - self.minPort, self.maxPort = 0, 0 - self.isPortWildcard = entryPort == "*" - - if entryPort != "*": - if "-" in entryPort: - portComp = entryPort.split("-", 1) - self.minPort = int(portComp[0]) - self.maxPort = int(portComp[1]) - else: - self.minPort = int(entryPort) - self.maxPort = int(entryPort) - - # if both the address and port are wildcards then we're effectively the - # last entry so cut off the remaining chain - if self.isIpWildcard and self.isPortWildcard: - self.nextRule = None - - def isExitingAllowed(self): + +class ExitPolicy: """ - Provides true if the policy allows exiting whatsoever, false otherwise. + Single rule from the user's exit policy. These are chained together to form + complete policies. """ - - if self.isAccept: return True - elif self.isIpWildcard and self.isPortWildcard: return False - elif not self.nextRule: return False # fell off policy (shouldn't happen) - else: return self.nextRule.isExitingAllowed() - def check(self, ipAddress, port): - """ - Checks if the rule chain allows exiting to this address, returning true if - so and false otherwise. - """ - - port = int(port) - - # does the port check first since comparing ip masks is more work - isPortMatch = self.isPortWildcard or (port >= self.minPort and port <= self.maxPort) - - if isPortMatch: - isIpMatch = self.isIpWildcard or self.ipAddress == ipAddress - - # expands the check to include the mask if it has one - if not isIpMatch and self.ipMask != 32: - inputAddressBin = "" - for octet in ipAddress.split("."): - inputAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) - - isIpMatch = self.ipAddressBin[:self.ipMask] == inputAddressBin[:self.ipMask] - - if isIpMatch: return self.isAccept - - # our policy doesn't concern this address, move on to the next one - if self.nextRule: return self.nextRule.check(ipAddress, port) - else: return True # fell off the chain without a conclusion (shouldn't happen...) + def __init__(self): + """ + Exit policy rule constructor. + """ + self._policies = [] - def getSummary(self): - """ - Provides a summary description of the policy chain similar to the - consensus. This excludes entries that don't cover all ips, and is either - a whitelist or blacklist policy based on the final entry. For instance... - accept 80, 443 # just accepts ports 80/443 - reject 1-1024, 5555 # just accepts non-privilaged ports, excluding 5555 - """ - - if not self.summaryStr: - # determines if we're a whitelist or blacklist - isWhitelist = False # default in case we don't have a catch-all policy at the end - - for rule in self: - if rule.isIpWildcard and rule.isPortWildcard: - isWhitelist = not rule.isAccept - break - - # Iterates over the rules and adds the the ports we'll return (ie, allows - # if a whitelist and rejects if a blacklist). Reguardless of a port's - # allow/reject policy, all further entries with that port are ignored since - # policies respect the first matching rule. - - displayPorts, skipPorts = [], [] - - for rule in self: - if not rule.isIpWildcard: continue - - if rule.minPort == rule.maxPort: - portRange = [rule.minPort] - else: - portRange = range(rule.minPort, rule.maxPort + 1) - - for port in portRange: - if port in skipPorts: continue - - # if accept + whitelist or reject + blacklist then add - if rule.isAccept == isWhitelist: - displayPorts.append(port) - - # all further entries with this port are to be ignored - skipPorts.append(port) - - # gets a list of the port ranges - if displayPorts: - displayRanges, tmpRange = [], [] - displayPorts.sort() - displayPorts.append(None) # ending item to include last range in loop - - for port in displayPorts: - if not tmpRange or tmpRange[-1] + 1 == port: - tmpRange.append(port) - else: - if len(tmpRange) > 1: - displayRanges.append("%i-%i" % (tmpRange[0], tmpRange[-1])) - else: - displayRanges.append(str(tmpRange[0])) - - tmpRange = [port] - else: - # everything for the inverse - isWhitelist = not isWhitelist - displayRanges = ["1-65535"] - - # constructs the summary string - labelPrefix = "accept " if isWhitelist else "reject " - - self.summaryStr = (labelPrefix + ", ".join(displayRanges)).strip() - - return self.summaryStr + def add(self, ruleEntry): + self._policies.append(ExitPolicyLine(ruleEntry)) + + def isExitingAllowed(self): + """ + Provides true if the policy allows exiting whatsoever, false otherwise. + """ + for policy in self._policies: + if policy.isAccept: return True + elif policy.isIpWildcard and self.isPortWildcard: return False + - def __iter__(self): - return ExitPolicyIterator(self) + def check(self, ipAddress, port): + """ + Checks if the rule chain allows exiting to this address, returning true if + so and false otherwise. + """ + + for policy in self._policies: + if policy.check(ipAddress, port): return True + + return False - def __str__(self): - # This provides the actual policy rather than the entry used to construct - # it so the 'private' keyword is expanded. - - acceptanceLabel = "accept" if self.isAccept else "reject" - - if self.isIpWildcard: - ipLabel = "*" - elif self.ipMask != 32: - ipLabel = "%s/%i" % (self.ipAddress, self.ipMask) - else: ipLabel = self.ipAddress - - if self.isPortWildcard: - portLabel = "*" - elif self.minPort != self.maxPort: - portLabel = "%i-%i" % (self.minPort, self.maxPort) - else: portLabel = str(self.minPort) - - myPolicy = "%s %s:%s" % (acceptanceLabel, ipLabel, portLabel) - - if self.nextRule: - return myPolicy + ", " + str(self.nextRule) - else: return myPolicy + def __iter__(self): + for policy in self._policies: + yield policy + + def __str__(self): + # This provides the actual policy rather than the entry used to construct + # it so the 'private' keyword is expanded. + + return ' , '.join([str(policy) for policy in self._policies])

1 0

[stem/master] Parse "private" alias better
by atagar＠torproject.org 19 Jul '12

19 Jul '12

commit 607e32a3cf3d69ed185ecee4e62f55e7101d587a Author: Sathyanarayanan Gunasekaran <gsathya.ceg(a)gmail.com> Date: Fri Mar 23 14:10:54 2012 +0530 Parse "private" alias better --- stem/exit_policy.py | 17 +++++++---------- 1 files changed, 7 insertions(+), 10 deletions(-) diff --git a/stem/exit_policy.py b/stem/exit_policy.py index 15c2b2c..287b620 100644 --- a/stem/exit_policy.py +++ b/stem/exit_policy.py @@ -19,15 +19,6 @@ class ExitPolicyLine: # sets the ip address component self.isIpWildcard = entryIp == "*" or entryIp.endswith("/0") - # checks for the private alias (which expands this to a chain of entries) - if entryIp.lower() == "private": - # constructs the chain backwards (last first) - prefix = "accept " if self.isAccept else "reject " - suffix = ":" + entryPort - for addr in PRIVATE_IP_RANGES: - # TODO: Add ExitPolicy.add method - ExitPolicy.add(prefix + addr + suffix) - if "/" in entryIp: ipComp = entryIp.split("/", 1) self.ipAddress = ipComp[0] @@ -121,7 +112,13 @@ class ExitPolicy: self._policies = [] def add(self, ruleEntry): - self._policies.append(ExitPolicyLine(ruleEntry)) + # checks for the private alias (which expands this to a chain of entries) + if "private" in ruleEntry.lower(): + for addr in PRIVATE_IP_RANGES: + newEntry = ruleEntry.replace("private", addr) + self._policies.append(ExitPolicyLine(newEntry)) + else: + self._policies.append(ExitPolicyLine(ruleEntry)) def isExitingAllowed(self): """

1 0

[stem/master] Add ExitPolicy.get_summary()
by atagar＠torproject.org 19 Jul '12

19 Jul '12

commit 0a1c6238cc95f37a1b26369247d5d9876ba2b804 Author: Sathyanarayanan Gunasekaran <gsathya.ceg(a)gmail.com> Date: Thu May 17 22:19:10 2012 +0530 Add ExitPolicy.get_summary() This provides a summary description of the policy chain similar to the consensus. --- stem/exit_policy.py | 84 ++++++++++++++++++++++++++++++++++++++++++++++++-- 1 files changed, 80 insertions(+), 4 deletions(-) diff --git a/stem/exit_policy.py b/stem/exit_policy.py index 0a51f5f..dcee159 100644 --- a/stem/exit_policy.py +++ b/stem/exit_policy.py @@ -3,9 +3,13 @@ Tor Exit Policy information and requirements for its features. These can be easily parsed and compared, for instance... >>> exit_policies = stem.exit_policy.ExitPolicy() +>>> exit_policies.add("accept *:80") +>>> exit_policies.add("accept *:443") >>> exit_policies.add("reject *:*") >>> print exit_policies -reject *:* +accept *:80 , accept *:443, reject *:* +>>> print exit_policies.get_summary() +accept 80, 443 ExitPolicyLine - Single rule from the exit policy |- __str__ - string representation @@ -16,7 +20,9 @@ ExitPolicy - List of ExitPolicyLine objects |- __iter__ - ExitPolicyLine entries for the exit policy |- check - check if exiting to this ip is allowed |- add - add new rule to the exit policy - +- isExitingAllowed - check if exit node + |- get_summary - provides a summary description of the policy chain + +- is_exiting_allowed - check if exit node + """ # ip address ranges substituted by the 'private' keyword @@ -140,6 +146,7 @@ class ExitPolicy: ExitPolicy constructor """ self._policies = [] + self.summary = "" def add(self, rule_entry): """ @@ -156,7 +163,76 @@ class ExitPolicy: self._policies.append(ExitPolicyLine(new_entry)) else: self._policies.append(ExitPolicyLine(rule_entry)) - + + def get_summary(self): + """ + Provides a summary description of the policy chain similar to the + consensus. This excludes entries that don't cover all ips, and is either + a whitelist or blacklist policy based on the final entry. + """ + + if not self.summary: + # determines if we're a whitelist or blacklist + is_whitelist = False # default in case we don't have a catch-all policy at the end + + for policy in self._policies: + if policy.is_ip_wildcard and policy.is_port_wildcard: + is_whitelist = not policy.is_accept + break + + # Iterates over the policys and adds the the ports we'll return (ie, allows + # if a whitelist and rejects if a blacklist). Reguardless of a port's + # allow/reject policy, all further entries with that port are ignored since + # policies respect the first matching policy. + + display_ports, skip_ports = [], [] + + for policy in self._policies: + if not policy.is_ip_wildcard: continue + + if policy.min_port == policy.max_port: + port_range = [policy.min_port] + else: + port_range = range(policy.min_port, policy.max_port + 1) + + for port in port_range: + if port in skip_ports: continue + + # if accept + whitelist or reject + blacklist then add + if policy.is_accept == is_whitelist: + display_ports.append(port) + + # all further entries with this port are to be ignored + skip_ports.append(port) + + # gets a list of the port ranges + if display_ports: + display_ranges, temp_range = [], [] + display_ports.sort() + display_ports.append(None) # ending item to include last range in loop + + for port in display_ports: + if not temp_range or temp_range[-1] + 1 == port: + temp_range.append(port) + else: + if len(temp_range) > 1: + display_ranges.append("%i-%i" % (temp_range[0], temp_range[-1])) + else: + display_ranges.append(str(temp_range[0])) + + temp_range = [port] + else: + # everything for the inverse + is_whitelist = not is_whitelist + display_ranges = ["1-65535"] + + # constructs the summary string + label_prefix = "accept " if is_whitelist else "reject " + + self.summary = (label_prefix + ", ".join(display_ranges)).strip() + + return self.summary + def is_exiting_allowed(self): """ Provides true if the policy allows exiting whatsoever, false otherwise. @@ -188,4 +264,4 @@ class ExitPolicy: Provides the string used to construct the Exit Policy """ return ' , '.join([str(policy) for policy in self._policies]) - +

1 0

[stem/master] Add doc and fix whitespace
by atagar＠torproject.org 19 Jul '12

19 Jul '12

commit 4d88884b0cfdc98ca4c4741d4e1073267418038c Author: Sathyanarayanan Gunasekaran <gsathya.ceg(a)gmail.com> Date: Fri Mar 23 15:18:44 2012 +0530 Add doc and fix whitespace --- stem/exit_policy.py | 303 +++++++++++++++++++++++++++++---------------------- 1 files changed, 171 insertions(+), 132 deletions(-) diff --git a/stem/exit_policy.py b/stem/exit_policy.py index 287b620..0a51f5f 100644 --- a/stem/exit_policy.py +++ b/stem/exit_policy.py @@ -1,152 +1,191 @@ +""" +Tor Exit Policy information and requirements for its features. These can be +easily parsed and compared, for instance... + +>>> exit_policies = stem.exit_policy.ExitPolicy() +>>> exit_policies.add("reject *:*") +>>> print exit_policies +reject *:* + +ExitPolicyLine - Single rule from the exit policy + |- __str__ - string representation + +- check - check if exiting to this ip is allowed + +ExitPolicy - List of ExitPolicyLine objects + |- __str__ - string representation + |- __iter__ - ExitPolicyLine entries for the exit policy + |- check - check if exiting to this ip is allowed + |- add - add new rule to the exit policy + +- isExitingAllowed - check if exit node +""" + # ip address ranges substituted by the 'private' keyword PRIVATE_IP_RANGES = ("0.0.0.0/8", "169.254.0.0/16", "127.0.0.0/8", "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12") class ExitPolicyLine: - def __init__(self, ruleEntry): - # sanitize the input a bit, cleaning up tabs and stripping quotes - ruleEntry = ruleEntry.replace("\\t", " ").replace("\"", "") - - self.ruleEntry = ruleEntry - self.isAccept = ruleEntry.startswith("accept") - - # strips off "accept " or "reject " and extra spaces - ruleEntry = ruleEntry[7:].replace(" ", "") - - # split ip address (with mask if provided) and port - if ":" in ruleEntry: entryIp, entryPort = ruleEntry.split(":", 1) - else: entryIp, entryPort = ruleEntry, "*" - - # sets the ip address component - self.isIpWildcard = entryIp == "*" or entryIp.endswith("/0") - - if "/" in entryIp: - ipComp = entryIp.split("/", 1) - self.ipAddress = ipComp[0] - self.ipMask = int(ipComp[1]) - else: - self.ipAddress = entryIp - self.ipMask = 32 - - # constructs the binary address just in case of comparison with a mask - if self.ipAddress != "*": - self.ipAddressBin = "" - for octet in self.ipAddress.split("."): - # Converts the int to a binary string, padded with zeros. Source: - # http://www.daniweb.com/code/snippet216539.html - self.ipAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) - else: - self.ipAddressBin = "0" * 32 + """ + Single rule from the user's exit policy. These are chained together to form + complete policies. + """ - # sets the port component - self.minPort, self.maxPort = 0, 0 - self.isPortWildcard = entryPort == "*" - - if entryPort != "*": - if "-" in entryPort: - portComp = entryPort.split("-", 1) - self.minPort = int(portComp[0]) - self.maxPort = int(portComp[1]) - else: - self.minPort = int(entryPort) - self.maxPort = int(entryPort) - - def __str__(self): - # This provides the actual policy rather than the entry used to construct - # it so the 'private' keyword is expanded. - - acceptanceLabel = "accept" if self.isAccept else "reject" + def __init__(self, rule_entry): + """ + Exit Policy line constructor. + """ + # sanitize the input a bit, cleaning up tabs and stripping quotes + rule_entry = rule_entry.replace("\\t", " ").replace("\"", "") - if self.isIpWildcard: - ipLabel = "*" - elif self.ipMask != 32: - ipLabel = "%s/%i" % (self.ipAddress, self.ipMask) - else: ipLabel = self.ipAddress + self.rule_entry = rule_entry + self.is_accept = rule_entry.startswith("accept") - if self.isPortWildcard: - portLabel = "*" - elif self.minPort != self.maxPort: - portLabel = "%i-%i" % (self.minPort, self.maxPort) - else: portLabel = str(self.minPort) + # strips off "accept " or "reject " and extra spaces + rule_entry = rule_entry[7:].replace(" ", "") - myPolicy = "%s %s:%s" % (acceptanceLabel, ipLabel, portLabel) - return myPolicy + # split ip address (with mask if provided) and port + if ":" in rule_entry: entry_ip, entry_port = rule_entry.split(":", 1) + else: entry_ip, entry_port = rule_entry, "*" - def check(self, ipAddress, port): - """ - Checks if the rule chain allows exiting to this address, returning true if - so and false otherwise. - """ + # sets the ip address component + self.is_ip_wildcard = entry_ip == "*" or entry_ip.endswith("/0") - port = int(port) + # separate host and mask + if "/" in entry_ip: + ip_comp = entry_ip.split("/", 1) + self.ip_address = ip_comp[0] + self.ip_mask = int(ip_comp[1]) + else: + self.ip_address = entry_ip + self.ip_mask = 32 - # does the port check first since comparing ip masks is more work - isPortMatch = self.isPortWildcard or (port >= self.minPort and port <= self.maxPort) + # constructs the binary address just in case of comparison with a mask + if self.ip_address != "*": + self.ip_address_bin = "" + for octet in self.ip_address.split("."): + # Converts the int to a binary string, padded with zeros. Source: + # http://www.daniweb.com/code/snippet216539.html + self.ip_address_bin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + else: + self.ip_address_bin = "0" * 32 + + # sets the port component + self.min_port, self.max_port = 0, 0 + self.is_port_wildcard = entry_port == "*" - if isPortMatch: - isIpMatch = self.isIpWildcard or self.ipAddress == ipAddress + if entry_port != "*": + if "-" in entry_port: + port_comp = entry_port.split("-", 1) + self.min_port = int(port_comp[0]) + self.max_port = int(port_comp[1]) + else: + self.min_port = int(entry_port) + self.max_port = int(entry_port) - # expands the check to include the mask if it has one - if not isIpMatch and self.ipMask != 32: - inputAddressBin = "" - for octet in ipAddress.split("."): - inputAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) - - isIpMatch = self.ipAddressBin[:self.ipMask] == inputAddressBin[:self.ipMask] - - if isIpMatch: return self.isAccept + def __str__(self): + # This provides the actual policy rather than the entry used to construct + # it so the 'private' keyword is expanded. + + acceptance_label = "accept" if self.is_accept else "reject" + + if self.is_ip_wildcard: + ip_label = "*" + elif self.ip_mask != 32: + ip_label = "%s/%i" % (self.ip_address, self.ip_mask) + else: ip_label = self.ip_address + + if self.is_port_wildcard: + port_label = "*" + elif self.min_port != self.max_port: + port_label = "%i-%i" % (self.min_port, self.max_port) + else: port_label = str(self.min_port) + + my_policy = "%s %s:%s" % (acceptance_label, ip_label, port_label) + return my_policy + + def check(self, ip_address, port): + """ + Checks if the rule chain allows exiting to this address, returning true if + so and false otherwise. + """ + + port = int(port) + + # does the port check first since comparing ip masks is more work + is_port_match = self.is_port_wildcard or (port >= self.min_port and port <= self.max_port) + + if is_port_match: + is_ip_match = self.is_ip_wildcard or self.ip_address == ip_address + + # expands the check to include the mask if it has one + if not is_ip_match and self.ip_mask != 32: + input_address_bin = "" + for octet in ip_address.split("."): + input_address_bin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) + + is_ip_match = self.ip_address_bin[:self.ip_mask] == input_address_bin[:self.ip_mask] + + if is_ip_match: return self.is_accept - # fell off the chain without a conclusion (shouldn't happen...) - return False + # fell off the chain without a conclusion (shouldn't happen...) + return False - + class ExitPolicy: + """ + Provides a wrapper to ExitPolicyLine. This is iterable and can be stringified for + individual Exit Policy lines. + """ + + def __init__(self): """ - Single rule from the user's exit policy. These are chained together to form - complete policies. + ExitPolicy constructor """ - - def __init__(self): - """ - Exit policy rule constructor. - """ - self._policies = [] - - def add(self, ruleEntry): - # checks for the private alias (which expands this to a chain of entries) - if "private" in ruleEntry.lower(): - for addr in PRIVATE_IP_RANGES: - newEntry = ruleEntry.replace("private", addr) - self._policies.append(ExitPolicyLine(newEntry)) - else: - self._policies.append(ExitPolicyLine(ruleEntry)) - - def isExitingAllowed(self): - """ - Provides true if the policy allows exiting whatsoever, false otherwise. - """ - for policy in self._policies: - if policy.isAccept: return True - elif policy.isIpWildcard and self.isPortWildcard: return False - - - def check(self, ipAddress, port): - """ - Checks if the rule chain allows exiting to this address, returning true if - so and false otherwise. - """ - - for policy in self._policies: - if policy.check(ipAddress, port): return True + self._policies = [] - return False - - def __iter__(self): - for policy in self._policies: - yield policy + def add(self, rule_entry): + """ + This method is used to add an Exit Policy rule to the list of policies. + + Arguments: + rule_entry (str) - exit policy rule in the format "accept|reject ADDR[/MASK][:PORT]" + ex - "accept 18.7.22.69:*" + """ + # checks for the private alias (which expands this to a chain of entries) + if "private" in rule_entry.lower(): + for addr in PRIVATE_IP_RANGES: + new_entry = rule_entry.replace("private", addr) + self._policies.append(ExitPolicyLine(new_entry)) + else: + self._policies.append(ExitPolicyLine(rule_entry)) + + def is_exiting_allowed(self): + """ + Provides true if the policy allows exiting whatsoever, false otherwise. + """ + for policy in self._policies: + if policy.is_accept: return True + elif policy.is_ip_wildcard and policy.is_port_wildcard: return False + + def check(self, ip_address, port): + """ + Checks if the rule chain allows exiting to this address, returning true if + so and false otherwise. + """ + + for policy in self._policies: + if policy.check(ip_address, port): return True + + return False + + def __iter__(self): + """ + Provides an ordered listing of policies in this Exit Policy + """ + for policy in self._policies: + yield policy + + def __str__(self): + """ + Provides the string used to construct the Exit Policy + """ + return ' , '.join([str(policy) for policy in self._policies]) - def __str__(self): - # This provides the actual policy rather than the entry used to construct - # it so the 'private' keyword is expanded. - - return ' , '.join([str(policy) for policy in self._policies]) -

1 0