|
@@ -2500,97 +2500,6 @@ router_exit_policy_all_routers_reject(uint32_t addr, uint16_t port,
|
|
|
return 1;
|
|
|
}
|
|
|
|
|
|
-#if 0
|
|
|
-
|
|
|
- * If <b>policy</b> implicitly allows connections to any port in the
|
|
|
- * IP set <b>addr</b>/<b>mask</b>, then set *<b>policy_out</b> to the
|
|
|
- * part of the policy that allows it, and return 1. Else return 0.
|
|
|
- *
|
|
|
- * A policy allows an IP:Port combination <em>implicitly</em> if
|
|
|
- * it is included in a *: pattern, or in a fallback pattern.
|
|
|
- */
|
|
|
-static int
|
|
|
-policy_includes_addr_mask_implicitly(addr_policy_t *policy,
|
|
|
- uint32_t addr, uint32_t mask,
|
|
|
- addr_policy_t **policy_out)
|
|
|
-{
|
|
|
- uint32_t addr2;
|
|
|
- tor_assert(policy_out);
|
|
|
- addr &= mask;
|
|
|
- addr2 = addr | ~mask;
|
|
|
- for (; policy; policy=policy->next) {
|
|
|
-
|
|
|
-
|
|
|
- * each bit B, all possible values of B in X are values of B in Y.
|
|
|
- * In "addr", we have every fixed bit set to its value, and every
|
|
|
- * free bit set to 0. In "addr2", we have every fixed bit set to
|
|
|
- * its value, and every free bit set to 1. So if addr and addr2 are
|
|
|
- * both in the policy, the range is covered by the policy.
|
|
|
- */
|
|
|
- uint32_t p_addr = policy->addr & policy->msk;
|
|
|
- if (p_addr == (addr & policy->msk) &&
|
|
|
- p_addr == (addr2 & policy->msk) &&
|
|
|
- (policy->prt_min <= 1 && policy->prt_max == 65535) &&
|
|
|
- policy->policy_type == ADDR_POLICY_REJECT) {
|
|
|
- return 0;
|
|
|
- }
|
|
|
-
|
|
|
-
|
|
|
- * some z such that z & Xmask == Xaddr and z & Ymask == Yaddr.
|
|
|
- * This is FALSE iff there is some bit b where Xmask == yMask == 1
|
|
|
- * and Xaddr != Yaddr. So if X intersects with Y iff at every
|
|
|
- * place where Xmask&Ymask==1, Xaddr == Yaddr, or equivalently,
|
|
|
- * Xaddr&Xmask&Ymask == Yaddr&Xmask&Ymask.
|
|
|
- */
|
|
|
- if ((policy->addr & policy->msk & mask) == (addr & policy->msk) &&
|
|
|
- policy->policy_type == ADDR_POLICY_ACCEPT) {
|
|
|
- *policy_out = policy;
|
|
|
- return 1;
|
|
|
- }
|
|
|
- }
|
|
|
- *policy_out = NULL;
|
|
|
- return 1;
|
|
|
-}
|
|
|
-
|
|
|
-
|
|
|
- * 127.*, 192.168.*, etc, then warn (if <b>should_warn</b> is set) and return
|
|
|
- * true. Else return false.
|
|
|
- **/
|
|
|
-int
|
|
|
-exit_policy_implicitly_allows_local_networks(addr_policy_t *policy,
|
|
|
- int should_warn)
|
|
|
-{
|
|
|
- addr_policy_t *p;
|
|
|
- int r=0,i;
|
|
|
- static struct {
|
|
|
- uint32_t addr; uint32_t mask; const char *network;
|
|
|
- } private_networks[] = {
|
|
|
- { 0x00000000, 0xff000000, "\"this\" network (0.0.0.0/8)" },
|
|
|
- { 0x7f000000, 0xff000000, "localhost (127.0.0.0/8)" },
|
|
|
- { 0x0a000000, 0xff000000, "addresses in private network 10.0.0.0/8" },
|
|
|
- { 0xa9fe0000, 0xffff0000, "addresses in private network 169.254.0.0/16" },
|
|
|
- { 0xac100000, 0xfff00000, "addresses in private network 172.16.0.0/12" },
|
|
|
- { 0xc0a80000, 0xffff0000, "addresses in private network 192.168.0.0/16" },
|
|
|
- { 0,0,NULL},
|
|
|
- };
|
|
|
- for (i=0; private_networks[i].mask; ++i) {
|
|
|
- p = NULL;
|
|
|
-
|
|
|
- "Checking network %s", private_networks[i].network); */
|
|
|
- if (policy_includes_addr_mask_implicitly(
|
|
|
- policy, private_networks[i].addr, private_networks[i].mask, &p)) {
|
|
|
- if (should_warn)
|
|
|
- log_warn(LD_CONFIG, "Exit policy %s implicitly accepts %s",
|
|
|
- p?p->string:"(default)",
|
|
|
- private_networks[i].network);
|
|
|
- r = 1;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- return r;
|
|
|
-}
|
|
|
-
|
|
|
-#endif
|
|
|
|
|
|
*/
|
|
|
int
|