commit e2e09a2dbeae508ef8539e48eff1babb6aa0346e Author: teor (Tim Wilson-Brown) <teor2345@gmail.com> Date: Wed Dec 16 08:47:47 2015 +1100 Warn when comparing against an AF_UNSPEC address in a policy It produces unexpected results, and it's most likely a bug. --- changes/feature17863 | 6 ++++++ src/or/policies.c | 12 ++++++++++++ 2 files changed, 18 insertions(+) diff --git a/changes/feature17863 b/changes/feature17863 new file mode 100644 index 0000000..86c4e2c --- /dev/null +++ b/changes/feature17863 @@ -0,0 +1,6 @@ + o Minor feature (IPv6): + - Add address policy assume_action support for IPv6 addresses. + - Limit IPv6 mask bits to 128. + - Warn when comparing against an AF_UNSPEC address in a policy, + it's almost always a bug. + Closes ticket 17863; patch by "teor". diff --git a/src/or/policies.c b/src/or/policies.c index 32a7ec2..c9bce1b 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -696,6 +696,10 @@ compare_known_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, /* We know the address and port, and we know the policy, so we can just * compute an exact match. */ SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, tmpe) { + if (tmpe->addr.family == AF_UNSPEC) { + log_warn(LD_BUG, "Policy contains an AF_UNSPEC address, which only " + "matches other AF_UNSPEC addresses."); + } /* Address is known */ if (!tor_addr_compare_masked(addr, &tmpe->addr, tmpe->maskbits, CMP_EXACT)) { @@ -723,6 +727,10 @@ compare_known_tor_addr_to_addr_policy_noport(const tor_addr_t *addr, int maybe_accept = 0, maybe_reject = 0; SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, tmpe) { + if (tmpe->addr.family == AF_UNSPEC) { + log_warn(LD_BUG, "Policy contains an AF_UNSPEC address, which only " + "matches other AF_UNSPEC addresses."); + } if (!tor_addr_compare_masked(addr, &tmpe->addr, tmpe->maskbits, CMP_EXACT)) { if (tmpe->prt_min <= 1 && tmpe->prt_max >= 65535) { @@ -762,6 +770,10 @@ compare_unknown_tor_addr_to_addr_policy(uint16_t port, int maybe_accept = 0, maybe_reject = 0; SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, tmpe) { + if (tmpe->addr.family == AF_UNSPEC) { + log_warn(LD_BUG, "Policy contains an AF_UNSPEC address, which only " + "matches other AF_UNSPEC addresses."); + } if (tmpe->prt_min <= port && port <= tmpe->prt_max) { if (tmpe->maskbits == 0) { /* Definitely matches, since it covers all addresses. */