mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-11 05:33:47 +01:00
remove obsolete address policy code
svn:r6243
This commit is contained in:
parent
e1c8e3ca6e
commit
e20aad8d46
@ -2500,97 +2500,6 @@ router_exit_policy_all_routers_reject(uint32_t addr, uint16_t port,
|
|||||||
return 1; /* all will reject. */
|
return 1; /* all will reject. */
|
||||||
}
|
}
|
||||||
|
|
||||||
#if 0
|
|
||||||
/**
|
|
||||||
* If <b>policy</b> implicitly allows connections to any port in the
|
|
||||||
* IP set <b>addr</b>/<b>mask</b>, then set *<b>policy_out</b> to the
|
|
||||||
* part of the policy that allows it, and return 1. Else return 0.
|
|
||||||
*
|
|
||||||
* A policy allows an IP:Port combination <em>implicitly</em> if
|
|
||||||
* it is included in a *: pattern, or in a fallback pattern.
|
|
||||||
*/
|
|
||||||
static int
|
|
||||||
policy_includes_addr_mask_implicitly(addr_policy_t *policy,
|
|
||||||
uint32_t addr, uint32_t mask,
|
|
||||||
addr_policy_t **policy_out)
|
|
||||||
{
|
|
||||||
uint32_t addr2;
|
|
||||||
tor_assert(policy_out);
|
|
||||||
addr &= mask;
|
|
||||||
addr2 = addr | ~mask;
|
|
||||||
for (; policy; policy=policy->next) {
|
|
||||||
/* Does this policy cover all of the address range we're looking at? */
|
|
||||||
/* Boolean logic time: range X is contained in range Y if, for
|
|
||||||
* each bit B, all possible values of B in X are values of B in Y.
|
|
||||||
* In "addr", we have every fixed bit set to its value, and every
|
|
||||||
* free bit set to 0. In "addr2", we have every fixed bit set to
|
|
||||||
* its value, and every free bit set to 1. So if addr and addr2 are
|
|
||||||
* both in the policy, the range is covered by the policy.
|
|
||||||
*/
|
|
||||||
uint32_t p_addr = policy->addr & policy->msk;
|
|
||||||
if (p_addr == (addr & policy->msk) &&
|
|
||||||
p_addr == (addr2 & policy->msk) &&
|
|
||||||
(policy->prt_min <= 1 && policy->prt_max == 65535) &&
|
|
||||||
policy->policy_type == ADDR_POLICY_REJECT) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
/* Does this policy cover some of the address range we're looking at? */
|
|
||||||
/* Boolean logic time: range X and range Y intersect if there is
|
|
||||||
* some z such that z & Xmask == Xaddr and z & Ymask == Yaddr.
|
|
||||||
* This is FALSE iff there is some bit b where Xmask == yMask == 1
|
|
||||||
* and Xaddr != Yaddr. So if X intersects with Y iff at every
|
|
||||||
* place where Xmask&Ymask==1, Xaddr == Yaddr, or equivalently,
|
|
||||||
* Xaddr&Xmask&Ymask == Yaddr&Xmask&Ymask.
|
|
||||||
*/
|
|
||||||
if ((policy->addr & policy->msk & mask) == (addr & policy->msk) &&
|
|
||||||
policy->policy_type == ADDR_POLICY_ACCEPT) {
|
|
||||||
*policy_out = policy;
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
*policy_out = NULL;
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
/** If <b>policy</b> implicitly allows connections to any port on
|
|
||||||
* 127.*, 192.168.*, etc, then warn (if <b>should_warn</b> is set) and return
|
|
||||||
* true. Else return false.
|
|
||||||
**/
|
|
||||||
int
|
|
||||||
exit_policy_implicitly_allows_local_networks(addr_policy_t *policy,
|
|
||||||
int should_warn)
|
|
||||||
{
|
|
||||||
addr_policy_t *p;
|
|
||||||
int r=0,i;
|
|
||||||
static struct {
|
|
||||||
uint32_t addr; uint32_t mask; const char *network;
|
|
||||||
} private_networks[] = {
|
|
||||||
{ 0x00000000, 0xff000000, "\"this\" network (0.0.0.0/8)" },
|
|
||||||
{ 0x7f000000, 0xff000000, "localhost (127.0.0.0/8)" },
|
|
||||||
{ 0x0a000000, 0xff000000, "addresses in private network 10.0.0.0/8" },
|
|
||||||
{ 0xa9fe0000, 0xffff0000, "addresses in private network 169.254.0.0/16" },
|
|
||||||
{ 0xac100000, 0xfff00000, "addresses in private network 172.16.0.0/12" },
|
|
||||||
{ 0xc0a80000, 0xffff0000, "addresses in private network 192.168.0.0/16" },
|
|
||||||
{ 0,0,NULL},
|
|
||||||
};
|
|
||||||
for (i=0; private_networks[i].mask; ++i) {
|
|
||||||
p = NULL;
|
|
||||||
/* log_info(LD_CONFIG,
|
|
||||||
"Checking network %s", private_networks[i].network); */
|
|
||||||
if (policy_includes_addr_mask_implicitly(
|
|
||||||
policy, private_networks[i].addr, private_networks[i].mask, &p)) {
|
|
||||||
if (should_warn)
|
|
||||||
log_warn(LD_CONFIG, "Exit policy %s implicitly accepts %s",
|
|
||||||
p?p->string:"(default)",
|
|
||||||
private_networks[i].network);
|
|
||||||
r = 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return r;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
/** Return true iff <b>router</b> does not permit exit streams.
|
/** Return true iff <b>router</b> does not permit exit streams.
|
||||||
*/
|
*/
|
||||||
int
|
int
|
||||||
|
Loading…
Reference in New Issue
Block a user