[or-cvs] Split ReachableAddresses into ReachableDirAddresses and Rea...
Peter Palfrader
weasel at seul.org
Mon Feb 13 21:17:22 UTC 2006
Update of /home/or/cvsroot/tor/src/or
In directory moria:/tmp/cvs-serv11087/src/or
Modified Files:
circuitbuild.c config.c directory.c or.h routerlist.c
Log Message:
Split ReachableAddresses into ReachableDirAddresses and ReachableORAddresses
Index: circuitbuild.c
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/circuitbuild.c,v
retrieving revision 1.216
retrieving revision 1.217
diff -u -p -d -r1.216 -r1.217
--- circuitbuild.c 13 Feb 2006 08:28:42 -0000 1.216
+++ circuitbuild.c 13 Feb 2006 21:17:19 -0000 1.217
@@ -1518,14 +1518,14 @@ choose_good_entry_server(uint8_t purpose
smartlist_add(excluded, r);
routerlist_add_family(excluded, r);
}
- if (firewall_is_fascist()) {
+ if (firewall_is_fascist_or()) {
/* exclude all ORs that listen on the wrong port */
routerlist_t *rl = router_get_routerlist();
int i;
for (i=0; i < smartlist_len(rl->routers); i++) {
r = smartlist_get(rl->routers, i);
- if (!fascist_firewall_allows_address(r->addr,r->or_port))
+ if (!fascist_firewall_allows_address_or(r->addr,r->or_port))
smartlist_add(excluded, r);
}
}
@@ -1717,8 +1717,8 @@ entry_is_live(entry_guard_t *e, int need
return NULL;
if (router_is_unreliable(r, need_uptime, need_capacity, 0))
return NULL;
- if (firewall_is_fascist() &&
- !fascist_firewall_allows_address(r->addr,r->or_port))
+ if (firewall_is_fascist_or() &&
+ !fascist_firewall_allows_address_or(r->addr,r->or_port))
return NULL;
return r;
}
Index: config.c
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/config.c,v
retrieving revision 1.512
retrieving revision 1.513
diff -u -p -d -r1.512 -r1.513
--- config.c 13 Feb 2006 09:02:35 -0000 1.512
+++ config.c 13 Feb 2006 21:17:19 -0000 1.513
@@ -198,6 +198,8 @@ static config_var_t _option_vars[] = {
VAR("PidFile", STRING, PidFile, NULL),
VAR("ProtocolWarnings", BOOL, ProtocolWarnings, "0"),
VAR("ReachableAddresses", LINELIST, ReachableAddresses, NULL),
+ VAR("ReachableORAddresses",LINELIST, ReachableORAddresses, NULL),
+ VAR("ReachableDirAddresses",LINELIST, ReachableDirAddresses, NULL),
VAR("RecommendedVersions", LINELIST, RecommendedVersions, NULL),
VAR("RecommendedClientVersions", LINELIST, RecommendedClientVersions, NULL),
VAR("RecommendedServerVersions", LINELIST, RecommendedServerVersions, NULL),
@@ -431,7 +433,8 @@ static char *torrc_fname = NULL;
/** Persistent serialized state. */
static or_state_t *global_state = NULL;
/** DOCDOC */
-static addr_policy_t *reachable_addr_policy = NULL;
+static addr_policy_t *reachable_or_addr_policy = NULL;
+static addr_policy_t *reachable_dir_addr_policy = NULL;
static void *
config_alloc(config_format_t *fmt)
@@ -488,9 +491,13 @@ config_free_all(void)
global_state = NULL;
}
tor_free(torrc_fname);
- if (reachable_addr_policy) {
- addr_policy_free(reachable_addr_policy);
- reachable_addr_policy = NULL;
+ if (reachable_or_addr_policy) {
+ addr_policy_free(reachable_or_addr_policy);
+ reachable_or_addr_policy = NULL;
+ }
+ if (reachable_dir_addr_policy) {
+ addr_policy_free(reachable_dir_addr_policy);
+ reachable_dir_addr_policy = NULL;
}
}
@@ -1830,14 +1837,30 @@ parse_reachable_addresses(void)
{
or_options_t *options = get_options();
- addr_policy_free(reachable_addr_policy);
- reachable_addr_policy = NULL;
+ addr_policy_free(reachable_or_addr_policy);
+ reachable_or_addr_policy = NULL;
+ if (!options->ReachableORAddresses && options->ReachableAddresses)
+ log_notice(LD_CONFIG, "Using ReachableAddresses for "
+ "ReachableORAddresses");
+ if (config_parse_addr_policy(options->ReachableORAddresses ?
+ options->ReachableORAddresses :
+ options->ReachableAddresses,
+ &reachable_or_addr_policy,
+ ADDR_POLICY_ACCEPT)) {
+ log_warn(LD_CONFIG, "Error in ReachableORAddresses entry; ignoring.");
+ }
- if (config_parse_addr_policy(options->ReachableAddresses,
- &reachable_addr_policy,
+ addr_policy_free(reachable_dir_addr_policy);
+ reachable_dir_addr_policy = NULL;
+ if (!options->ReachableDirAddresses && options->ReachableAddresses)
+ log_notice(LD_CONFIG, "Using ReachableAddresses for "
+ "ReachableDirAddresses");
+ if (config_parse_addr_policy(options->ReachableDirAddresses ?
+ options->ReachableDirAddresses :
+ options->ReachableAddresses,
+ &reachable_dir_addr_policy,
ADDR_POLICY_ACCEPT)) {
- log_warn(LD_CONFIG, "Error in ReachableAddresses entry; ignoring.");
- return;
+ log_warn(LD_CONFIG, "Error in ReachableDirAddresses entry; ignoring.");
}
}
@@ -1845,18 +1868,25 @@ parse_reachable_addresses(void)
* combination.
*/
int
-firewall_is_fascist(void)
+firewall_is_fascist_or(void)
{
- return reachable_addr_policy ? 1 : 0;
+ return !!reachable_or_addr_policy;
}
/** Return true iff we are configured to think that the local fascist
- * firewall (if any) will allow a connection to <b>addr</b>:<b>port</b>. */
+ * firewall (if any) will allow a connection to <b>addr</b>:<b>port</b>.
+ *
+ * If dir_or_or is 1 then it consults ReachableDirAddresses,
+ * if it is 2, then ReachableORAddresses are consulted.
+ * */
int
-fascist_firewall_allows_address(uint32_t addr, uint16_t port)
+_fascist_firewall_allows_address(uint32_t addr, uint16_t port, int dir_or_or)
{
+ assert(dir_or_or == 1 || dir_or_or == 2);
addr_policy_result_t p = router_compare_addr_to_addr_policy(
- addr, port, reachable_addr_policy);
+ addr, port, dir_or_or == 1 ?
+ reachable_dir_addr_policy :
+ reachable_or_addr_policy);
switch (p) {
case ADDR_POLICY_PROBABLY_ACCEPTED:
@@ -1871,6 +1901,18 @@ fascist_firewall_allows_address(uint32_t
}
}
+int
+fascist_firewall_allows_address_or(uint32_t addr, uint16_t port)
+{
+ return _fascist_firewall_allows_address(addr, port, 2);
+}
+
+int
+fascist_firewall_allows_address_dir(uint32_t addr, uint16_t port)
+{
+ return _fascist_firewall_allows_address(addr, port, 1);
+}
+
/** Return 0 if every setting in <b>options</b> is reasonable. Else
* warn and return -1. Should have no side effects, except for
* normalizing the contents of <b>options</b>.
@@ -1886,6 +1928,7 @@ options_validate(or_options_t *old_optio
int from_setconf)
{
int result = 0;
+ int i;
config_line_t *cl;
addr_policy_t *addr_policy=NULL;
const char *uname;
@@ -2066,16 +2109,16 @@ options_validate(or_options_t *old_optio
result = -1;
if (options->FascistFirewall && !options->ReachableAddresses) {
- smartlist_t *instead = smartlist_create();
- config_line_t *new_line = tor_malloc_zero(sizeof(config_line_t));
- new_line->key = tor_strdup("ReachableAddresses");
- /* If we're configured with the old format, we need to prepend some
- * open ports. */
- if (!smartlist_len(options->FirewallPorts)) {
- smartlist_add(options->FirewallPorts, tor_strdup("80"));
- smartlist_add(options->FirewallPorts, tor_strdup("443"));
- }
- SMARTLIST_FOREACH(options->FirewallPorts, const char *, portno,
+ if (smartlist_len(options->FirewallPorts)) {
+ /* We already have firewall ports set, so migrate them to
+ * ReachableAddresses, which will set ReachableOR and ReachableDir-
+ * Addresses if they aren't set otherwise*/
+ smartlist_t *instead = smartlist_create();
+ config_line_t *new_line = tor_malloc_zero(sizeof(config_line_t));
+ new_line->key = tor_strdup("ReachableAddresses");
+ /* If we're configured with the old format, we need to prepend some
+ * open ports. */
+ SMARTLIST_FOREACH(options->FirewallPorts, const char *, portno,
{
int p = atoi(portno);
char *s;
@@ -2084,19 +2127,44 @@ options_validate(or_options_t *old_optio
tor_snprintf(s, 16, "*:%d", p);
smartlist_add(instead, s);
});
- new_line->value = smartlist_join_strings(instead,",",0,NULL);
- /* These have been deprecated since 0.1.1.5-alpha-cvs */
- log(LOG_NOTICE, LD_CONFIG, "Converting FascistFirewall and FirewallPorts "
- "config options to new format: \"ReachableAddresses %s\"",
- new_line->value);
- options->ReachableAddresses = new_line;
- SMARTLIST_FOREACH(instead, char *, cp, tor_free(cp));
- smartlist_free(instead);
+ new_line->value = smartlist_join_strings(instead,",",0,NULL);
+ /* These have been deprecated since 0.1.1.5-alpha-cvs */
+ log(LOG_NOTICE, LD_CONFIG, "Converting FascistFirewall and FirewallPorts "
+ "config options to new format: \"ReachableAddresses %s\"",
+ new_line->value);
+ options->ReachableAddresses = new_line;
+ SMARTLIST_FOREACH(instead, char *, cp, tor_free(cp));
+ smartlist_free(instead);
+ } else {
+ /* We do not have FirewallPorts set, so add 80 to ReachableDir-,
+ * and 443 to ReachableORAddresses */
+ if (!options->ReachableDirAddresses) {
+ config_line_t *new_line = tor_malloc_zero(sizeof(config_line_t));
+ new_line->key = tor_strdup("ReachableDirAddresses");
+ new_line->value = tor_strdup("*:80");
+ options->ReachableDirAddresses = new_line;
+ log(LOG_NOTICE, LD_CONFIG, "Converting FascistFirewall config option "
+ "to new format: \"ReachableDirAddresses *:80\"");
+ }
+ if (!options->ReachableORAddresses) {
+ config_line_t *new_line = tor_malloc_zero(sizeof(config_line_t));
+ new_line->key = tor_strdup("ReachableORAddresses");
+ new_line->value = tor_strdup("*:443");
+ options->ReachableORAddresses = new_line;
+ log(LOG_NOTICE, LD_CONFIG, "Converting FascistFirewall config option "
+ "to new format: \"ReachableORAddresses *:443\"");
+ }
+ }
}
- if (options->ReachableAddresses) {
+ for (i=0; i<3; i++){
+ config_line_t **linep =
+ (i==0) ? &options->ReachableAddresses :
+ (i==1) ? &options->ReachableORAddresses :
+ &options->ReachableDirAddresses;
+ if (!*linep)
+ continue;
/* We need to end with a reject *:*, not an implicit accept *:* */
- config_line_t **linep = &options->ReachableAddresses;
for (;;) {
if (!strcmp((*linep)->value, "reject *:*")) /* already there */
break;
@@ -2110,9 +2178,12 @@ options_validate(or_options_t *old_optio
}
}
- if (options->ReachableAddresses && server_mode(options))
+ if ((options->ReachableAddresses ||
+ options->ReachableORAddresses ||
+ options->ReachableDirAddresses) &&
+ server_mode(options))
REJECT("Servers must be able to freely connect to the rest "
- "of the Internet, so they must not set ReachableAddresses "
+ "of the Internet, so they must not set Reachable*Addresses "
"or FascistFirewall.");
options->_AllowUnverified = 0;
@@ -2292,12 +2363,18 @@ options_validate(or_options_t *old_optio
if (config_parse_addr_policy(options->ReachableAddresses, &addr_policy,
ADDR_POLICY_ACCEPT))
REJECT("Error in ReachableAddresses entry.");
+ if (config_parse_addr_policy(options->ReachableORAddresses, &addr_policy,
+ ADDR_POLICY_ACCEPT))
+ REJECT("Error in ReachableORAddresses entry.");
+ if (config_parse_addr_policy(options->ReachableDirAddresses, &addr_policy,
+ ADDR_POLICY_ACCEPT))
+ REJECT("Error in ReachableDirAddresses entry.");
if (config_parse_addr_policy(options->AuthDirReject, &addr_policy,
ADDR_POLICY_REJECT))
- REJECT("Error in ReachableAddresses entry.");
+ REJECT("Error in AuthDirReject entry.");
if (config_parse_addr_policy(options->AuthDirInvalid, &addr_policy,
ADDR_POLICY_REJECT))
- REJECT("Error in ReachableAddresses entry.");
+ REJECT("Error in AuthDirInvalid entry.");
addr_policy_free(addr_policy);
Index: directory.c
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/directory.c,v
retrieving revision 1.355
retrieving revision 1.356
diff -u -p -d -r1.355 -r1.356
--- directory.c 13 Feb 2006 09:37:53 -0000 1.355
+++ directory.c 13 Feb 2006 21:17:20 -0000 1.356
@@ -146,7 +146,7 @@ directory_post_to_dirservers(uint8_t pur
if (post_to_v1_only && !ds->is_v1_authority)
continue;
post_via_tor = purpose_is_private(purpose) ||
- !fascist_firewall_allows_address(ds->addr,ds->dir_port);
+ !fascist_firewall_allows_address_dir(ds->addr,ds->dir_port);
directory_initiate_command_routerstatus(rs, purpose, post_via_tor,
NULL, payload, payload_len);
});
Index: or.h
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/or.h,v
retrieving revision 1.793
retrieving revision 1.794
diff -u -p -d -r1.793 -r1.794
--- or.h 13 Feb 2006 06:25:16 -0000 1.793
+++ or.h 13 Feb 2006 21:17:20 -0000 1.794
@@ -1278,6 +1278,10 @@ typedef struct {
* (strings). */
config_line_t *ReachableAddresses; /**< Which IP:ports our firewall allows
* (exit policy.) */
+ config_line_t *ReachableORAddresses; /**< Which IP:ports our firewall allows
+ * (exit policy.) */
+ config_line_t *ReachableDirAddresses; /**< Which IP:ports our firewall allows
+ * (exit policy.) */
/** Application ports that require all nodes in circ to have sufficient
* uptime. */
@@ -1613,8 +1617,9 @@ int or_state_save(void);
int config_getinfo_helper(const char *question, char **answer);
-int firewall_is_fascist(void);
-int fascist_firewall_allows_address(uint32_t addr, uint16_t port);
+int firewall_is_fascist_or(void);
+int fascist_firewall_allows_address_or(uint32_t addr, uint16_t port);
+int fascist_firewall_allows_address_dir(uint32_t addr, uint16_t port);
/********************************* connection.c ***************************/
Index: routerlist.c
===================================================================
RCS file: /home/or/cvsroot/tor/src/or/routerlist.c,v
retrieving revision 1.445
retrieving revision 1.446
diff -u -p -d -r1.445 -r1.446
--- routerlist.c 13 Feb 2006 10:32:59 -0000 1.445
+++ routerlist.c 13 Feb 2006 21:17:20 -0000 1.446
@@ -437,7 +437,7 @@ router_pick_directory_server_impl(int re
if (requireother && router_digest_is_me(status->identity_digest))
continue;
if (fascistfirewall) {
- if (!fascist_firewall_allows_address(status->addr, status->dir_port))
+ if (!fascist_firewall_allows_address_dir(status->addr, status->dir_port))
continue;
}
is_trusted = router_digest_is_trusted_dir(status->identity_digest);
@@ -482,7 +482,7 @@ router_pick_trusteddirserver_impl(int ne
if (requireother && me && router_digest_is_me(d->digest))
continue;
if (fascistfirewall) {
- if (!fascist_firewall_allows_address(d->addr, d->dir_port))
+ if (!fascist_firewall_allows_address_dir(d->addr, d->dir_port))
continue;
}
smartlist_add(sl, &d->fake_status);
More information about the tor-commits
mailing list