[or-cvs] Generalize FirewallPorts to FirewallIPs so I can run happil...
Nick Mathewson
nickm at seul.org
Sun Aug 7 21:24:02 UTC 2005
Update of /home/or/cvsroot/tor/src/or
In directory moria:/tmp/cvs-serv17792/src/or
Modified Files:
circuitbuild.c config.c directory.c or.h routerlist.c
Log Message:
Generalize FirewallPorts to FirewallIPs so I can run happily when locked in net 18.
Index: circuitbuild.c
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/circuitbuild.c,v
retrieving revision 1.131
retrieving revision 1.132
diff -u -d -r1.131 -r1.132
--- circuitbuild.c 4 Aug 2005 19:56:41 -0000 1.131
+++ circuitbuild.c 7 Aug 2005 21:24:00 -0000 1.132
@@ -1427,8 +1427,8 @@
for (i=0; i < smartlist_len(rl->routers); i++) {
r = smartlist_get(rl->routers, i);
- if (!smartlist_string_num_isin(options->FirewallPorts, r->or_port))
- smartlist_add(excluded, r);
+ if (!fascist_firewall_allows_address(options,r->addr,r->or_port))
+ smartlist_add(excluded, r);
}
}
choice = router_choose_random_node(options->EntryNodes, options->ExcludeNodes,
Index: config.c
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/config.c,v
retrieving revision 1.379
retrieving revision 1.380
diff -u -d -r1.379 -r1.380
--- config.c 5 Aug 2005 01:35:43 -0000 1.379
+++ config.c 7 Aug 2005 21:24:00 -0000 1.380
@@ -122,7 +122,8 @@
VAR("ExitNodes", STRING, ExitNodes, NULL),
VAR("ExitPolicy", LINELIST, ExitPolicy, NULL),
VAR("FascistFirewall", BOOL, FascistFirewall, "0"),
- VAR("FirewallPorts", CSV, FirewallPorts, "80,443"),
+ VAR("FirewallPorts", CSV, FirewallPorts, ""),
+ VAR("FirewallIPs", CSV, FirewallIPs, NULL),
VAR("Group", STRING, Group, NULL),
VAR("HardwareAccel", BOOL, HardwareAccel, "1"),
VAR("HashedControlPassword",STRING, HashedControlPassword, NULL),
@@ -1414,6 +1415,8 @@
return config_dump(&options_format, options, minimal);
}
+/* Return 0 if every element of sl is string holding a decimal representation
+ * of a port number, or if sl is NULL. Otherwise return -1. */
static int
validate_ports_csv(smartlist_t *sl, const char *name)
{
@@ -1435,6 +1438,58 @@
return result;
}
+/* Return 0 if every element of sl is string holding an IP with optional mask
+ * and port, or if sl is NULL. Otherwise return -1. */
+static int
+validate_addr_port_ranges_csv(smartlist_t *sl, const char *name)
+{
+ uint32_t addr, mask;
+ uint16_t port_min, port_max;
+ int result = 0;
+ tor_assert(name);
+
+ if (!sl)
+ return 0;
+
+ SMARTLIST_FOREACH(sl, const char *, cp,
+ {
+ if (parse_addr_and_port_range(cp, &addr, &mask, &port_min, &port_max)<0) {
+ log(LOG_WARN, "IP/port range '%s' invalid in %s", cp, name);
+ result=-1;
+ }
+ });
+ return result;
+}
+
+/** Return true iff we are configured to thing that the local fascist firewall
+ * (if any) will allow a connection to <b>addr</b>:<b>port</b> */
+int
+fascist_firewall_allows_address(or_options_t *options, uint32_t addr,
+ uint16_t port)
+{
+ uint32_t ipaddr, ipmask;
+ uint16_t portmin, portmax;
+ if (!options->FascistFirewall)
+ return 1;
+
+ if (smartlist_string_num_isin(options->FirewallPorts, port))
+ return 1;
+
+ if (!options->FirewallIPs)
+ return 0;
+
+ SMARTLIST_FOREACH(options->FirewallIPs, const char *, cp,
+ {
+ if (parse_addr_and_port_range(cp, &ipaddr, &ipmask, &portmin, &portmax)<0)
+ continue;
+ if ((addr&ipmask) == (ipaddr&ipmask) &&
+ (portmin <= port) && (port <= portmax))
+ return 1;
+ });
+
+ return 0;
+}
+
/** Return 0 if every setting in <b>options</b> is reasonable. Else
* warn and return -1. Should have no side effects, except for
* normalizing the contents of <b>options</b>. */
@@ -1576,6 +1631,17 @@
"FirewallPorts") < 0)
result = -1;
+ if (validate_addr_port_ranges_csv(options->FirewallIPs,
+ "FirewallIPs") < 0)
+ result = -1;
+
+ if (options->FascistFirewall &&
+ !smartlist_len(options->FirewallIPs) &&
+ !smartlist_len(options->FirewallPorts)) {
+ smartlist_add(options->FirewallPorts, tor_strdup("80"));
+ smartlist_add(options->FirewallPorts, tor_strdup("443"));
+ }
+
if (validate_ports_csv(options->LongLivedPorts,
"LongLivedPorts") < 0)
result = -1;
Index: directory.c
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/directory.c,v
retrieving revision 1.239
retrieving revision 1.240
diff -u -d -r1.239 -r1.240
--- directory.c 22 Jul 2005 17:32:25 -0000 1.239
+++ directory.c 7 Aug 2005 21:24:00 -0000 1.240
@@ -137,9 +137,8 @@
/* Pay attention to fascistfirewall when we're uploading a
* router descriptor, but not when uploading a service
* descriptor -- those use Tor. */
- if (get_options()->FascistFirewall && purpose == DIR_PURPOSE_UPLOAD_DIR &&
- !get_options()->HttpProxy) {
- if (!smartlist_string_num_isin(get_options()->FirewallPorts, ds->dir_port))
+ if (purpose == DIR_PURPOSE_UPLOAD_DIR && !get_options()->HttpProxy) {
+ if (!fascist_firewall_allows_address(get_options(),ds->addr,ds->dir_port))
continue;
}
directory_initiate_command_trusted_dir(ds, purpose, purpose_is_private(purpose),
Index: or.h
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/or.h,v
retrieving revision 1.635
retrieving revision 1.636
diff -u -d -r1.635 -r1.636
--- or.h 7 Aug 2005 19:20:55 -0000 1.635
+++ or.h 7 Aug 2005 21:24:00 -0000 1.636
@@ -1094,6 +1094,7 @@
int RunAsDaemon; /**< If true, run in the background. (Unix only) */
int FascistFirewall; /**< Whether to prefer ORs reachable on open ports. */
smartlist_t *FirewallPorts; /**< Which ports our firewall allows (strings). */
+ smartlist_t *FirewallIPs; /**< Which IPs our firewall allows (strings). */
/** Application ports that require all nodes in circ to have sufficient uptime. */
smartlist_t *LongLivedPorts;
/** Should we try to reuse the same exit node for a given host */
@@ -1375,6 +1376,9 @@
int config_getinfo_helper(const char *question, char **answer);
+int fascist_firewall_allows_address(or_options_t *options, uint32_t addr,
+ uint16_t port);
+
/********************************* connection.c ***************************/
const char *conn_type_to_string(int type);
@@ -1653,6 +1657,7 @@
int we_are_hibernating(void);
void consider_hibernation(time_t now);
int accounting_getinfo_helper(const char *question, char **answer);
+void accounting_set_bandwidth_usage_from_state(or_state_t *state);
/********************************* main.c ***************************/
Index: routerlist.c
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/routerlist.c,v
retrieving revision 1.245
retrieving revision 1.246
diff -u -d -r1.245 -r1.246
--- routerlist.c 22 Jul 2005 21:12:10 -0000 1.245
+++ routerlist.c 7 Aug 2005 21:24:00 -0000 1.246
@@ -187,7 +187,8 @@
if (requireother && router_is_me(router))
continue;
if (fascistfirewall) {
- if (!smartlist_string_num_isin(get_options()->FirewallPorts, router->dir_port))
+ if (!fascist_firewall_allows_address(get_options(),router->addr,
+ router->dir_port))
continue;
}
/* before 0.0.9rc5-cvs, only trusted dirservers served status info. */
@@ -230,7 +231,7 @@
!memcmp(me->identity_digest, d->digest, DIGEST_LEN))
continue;
if (fascistfirewall) {
- if (!smartlist_string_num_isin(get_options()->FirewallPorts, d->dir_port))
+ if (!fascist_firewall_allows_address(get_options(),d->addr,d->dir_port))
continue;
}
smartlist_add(sl, d);
More information about the tor-commits
mailing list