Commit Graph

16398 Commits

Author SHA1 Message Date
Nick Mathewson
053f2cb7c8 Let tor-resolve generate PTR requests for IPv6 addresses 2012-11-14 23:16:57 -05:00
Nick Mathewson
50af1087c4 Accept reverse resolve requests for IPv6 addresses 2012-11-14 23:16:57 -05:00
Nick Mathewson
4db49f2b27 Add IPv6 support to tor-resolve so it can hear about IPv6 answers 2012-11-14 23:16:57 -05:00
Nick Mathewson
0f899518cf Make DNS resolve requests work for IPv6
* If there's an IPv4 and an IPv6 address, return both in the resolved
  cell.
* Treat all resolve requests as permitting IPv6, since by the spec they're
  allowed to, and by the code that won't break anything.
2012-11-14 23:16:57 -05:00
Nick Mathewson
bb2145b45b Fix a bug in policy_is_reject_star() that was making IPv4 exits break
IPv4-only exits have an implicit "reject [::]/0", which was making
policy_is_reject_star() return 1 for them, making us refuse to do
hostname lookups.

This fix chanes policy_is_reject_star() to ask about which family we meant.
2012-11-14 23:16:57 -05:00
Nick Mathewson
85e8d35fca Add some missing doxygen for ipv6 exit code 2012-11-14 23:16:57 -05:00
Nick Mathewson
882b389668 Actually send back correctly-formed IPv6 CONNECTED cells
We had some old code to send back connected cells for IPv6 addresses,
but it was wrong.  Fortunately, it was also unreachable.
2012-11-14 23:16:41 -05:00
Nick Mathewson
6b36142bcc Remove some unused defines in dns.c 2012-11-14 23:16:40 -05:00
Nick Mathewson
7197c9f14a Repair DNS NEXIST hijacking workaround
The code previously detected wildcarding and replaced wildcarded
answers with DNS_STATUS_FAILED_PERMANENT.  But that status variable
was no longer used!  Remove the status variable, and instead change
the value of 'result' in evdns_callback.

Thank goodness for compiler warnings. In this case,
unused-but-set-variable.

Thanks to Linus for finding this one.
2012-11-14 23:16:40 -05:00
Nick Mathewson
363cf02455 Implement a PreferIPv6 flag for SocksPorts 2012-11-14 23:16:40 -05:00
Nick Mathewson
c4830bfbe2 Define a wrapper for evdns_base_resolve_ipv6 for systems w/o libevent 2 2012-11-14 23:16:40 -05:00
Nick Mathewson
35ce42118f Make address_is_invalid_destination recognize ipv6 addrs as valid. 2012-11-14 23:16:40 -05:00
Nick Mathewson
1cc7736575 Actually generate microdescriptors with p6 lines. 2012-11-14 23:16:40 -05:00
Nick Mathewson
54ee7ff148 Remove a since-fixed XXX; improve a doxygen comment 2012-11-14 23:16:40 -05:00
Nick Mathewson
004f3f4e53 Actually advertise IPv6 exit policies.
I have a theory that my tests will work better if the code I'm testing
isn't disabled.
2012-11-14 23:16:40 -05:00
Nick Mathewson
2889bd2642 Revise the DNS subsystem to handle IPv6 exits.
Now, every cached_resolve_t can remember an IPv4 result *and* an IPv6
result.  As a light protection against timing-based distinguishers for
IPv6 users (and against complexity!), every forward request generates
an IPv4 *and* an IPv6 request, assuming that we're an IPv6 exit.  Once
we have answers or errors for both, we act accordingly.

This patch additionally makes some useful refactorings in the dns.c
code, though there is quite a bit more of useful refactoring that could
be done.

Additionally, have a new interface for the argument passed to the
evdns_callback function.  Previously, it was just the original address
we were resolving.  But it turns out that, on error, evdns doesn't
tell you the type of the query, so on a failure we didn't know whether
IPv4 or IPv6 queries were failing.

The new convention is to have the first byte of that argument include
the query type.  I've refactored the code a bit to make that simpler.
2012-11-14 23:16:25 -05:00
Nick Mathewson
a58e17bcc3 Change signature of router_compare_to_my_exit_policy so dns can use it
Also, fix the function so it actually looks at our ipv6 exit policy.
2012-11-14 23:16:25 -05:00
Nick Mathewson
25cf286fb1 Whitespace cleanup 2012-11-14 23:16:24 -05:00
Nick Mathewson
0487c0d579 Reindent a block in dns.c 2012-11-14 23:16:24 -05:00
Nick Mathewson
807b781a3d Actually send BEGIN cell flags
This uses advertised IPv6 ports as an implicit version check.
2012-11-14 23:16:24 -05:00
Nick Mathewson
93591383a9 When asking for a specific address type, others aren't acceptable 2012-11-14 23:16:24 -05:00
Nick Mathewson
d276894772 I think it is correct to decorate these addresses. 2012-11-14 23:16:24 -05:00
Nick Mathewson
6e27282dab Better checking of exit policies for connections by hostname 2012-11-14 23:16:24 -05:00
Nick Mathewson
5ee1de65b0 Only send begin cell flags when we have some to send 2012-11-14 23:16:24 -05:00
Nick Mathewson
a62c03fe2c Never support IPv6 traffic on a SOCKS4 connection. 2012-11-14 23:16:24 -05:00
Nick Mathewson
898f9c8bcc Add a function to set a tor_addr_t to a null address 2012-11-14 23:16:23 -05:00
Nick Mathewson
cac5335195 Get the client side of receiving an IPv6 address to work
This makes it so we can handle getting an IPv6 in the 3 different
formats we specified it for in RESOLVED cells,
END_STREAM_REASON_EXITPOLICY cells, and CONNECTED cells.

We don't cache IPv6 addresses yet, since proposal 205 isn't
implemented.

There's a refactored function for parsing connected cells; it has unit
tests.
2012-11-14 23:16:23 -05:00
Nick Mathewson
93dc7dcf41 Reject IPv4 or IPv6 addresses from the user depending on SOCKS settings 2012-11-14 23:16:23 -05:00
Nick Mathewson
111321ed16 Rename ipv{4,6}_only to bind_ipv{4,6}_only
This is to avoid confusion with the ipv{4,6}_traffic flags.
2012-11-14 23:16:23 -05:00
Nick Mathewson
4bec25c3cd Add {No,}IPv{4,6}Traffic options to SOCKSPort
These options are for telling the SOCKSPort that it should allow or
not allow connections to IPv4/IPv6 addresses.

These aren't implemented yet; this is just the code to read the
options and get them into the entrey_connection_t.
2012-11-14 23:16:23 -05:00
Nick Mathewson
b7843ca554 Make DNS callback pass IPv6 answers to dns_answer_found
Also, count ipv6 timeouts vs others.  If we have too many ipv6
requests time out, then we could be degrading performance because of a
broken DNS server that ignores AAAA requests.  Other cases in which
we never learn an AAAA address aren't so bad, since they don't slow
A (ipv4) answers down very much.
2012-11-14 23:16:23 -05:00
Nick Mathewson
00633b9446 Make dns wildcarding checks work for ipv6 2012-11-14 23:16:22 -05:00
Nick Mathewson
9016d9e829 Add an IPv6Exit configuration option
Don't advertise an IPv6 exit policy, or accept IPv6 exit requests,
if IPv6Exit is not true.
2012-11-14 23:16:22 -05:00
Nick Mathewson
c3faa0ebd5 Simplest version of server-side IPv6 support (no dns)
This is a relatively simple set of changes: we mostly need to
remove a few "but not for IPv6" changes.  We also needed to tweak
the handling of DNS code to generate RESOLVED cells that could get
an IPv6 answer in return.
2012-11-14 23:16:22 -05:00
Nick Mathewson
c64ee7099f Record, send, and receive flags in BEGIN cells 2012-11-14 23:16:22 -05:00
Nick Mathewson
b35a0d1132 Add IPv6 support to compare_to_addr_to_node_policy 2012-11-14 23:16:22 -05:00
Nick Mathewson
04ea550141 Authorities put p6 lines into microdescriptors. 2012-11-14 23:16:22 -05:00
Nick Mathewson
c53adac122 Parse IPv6 policy summaries from router descriptors and microdescs 2012-11-14 23:16:22 -05:00
Nick Mathewson
a96c0affcb Better policy support for IPv6
Now, "accept *:80" means "accept all addresses on port 80", and not
just IPv4.  For just v4, say "accept *4:80"; for just v6 say "accept
*6:80".

We can parse these policies from torrc just fine, and we should be
successfully keeping them out of descriptors for now.

We also now include appropriate IPv6 addresses in "reject private:*"
2012-11-14 23:16:21 -05:00
Nick Mathewson
2eb7eafc9d Add a new family-specific syntax for tor_addr_parse_mask_ports
By default, "*" means "All IPv4 addresses" with
tor_addr_parse_mask_ports, so I won't break anything.  But if the new
EXTENDED_STAR flag is provided, then * means "any address", *4 means
"any IPv4 address" (that is, 0.0.0.0/0), and "*6" means "any IPv6
address" (that is, [::]/0).

This is going to let us have a syntax for specifying exit policies in
torrc that won't drive people mad.

Also, add a bunch of unit tests for tor_addr_parse_mask_ports to test
these new features, and to increase coverage.
2012-11-14 23:16:21 -05:00
Nick Mathewson
462ebb270a Refactor begin cell parsing into its own function, with tests.
Add 'flags' argument to begin cells, per proposal 208.
2012-11-14 23:16:21 -05:00
Nick Mathewson
ca8843df0a Refactor client_dns_set_{reverse_,}addressmap() to take a circ
We'd like these functions to be circuit-relative so that we can
implement a per-circuit DNS cache and per-circuit DNS cache rules for
proposal 205 or its successors.  I'm doing this now, as a part of the
IPv6 exits code, since there are about to be a few more instances
of code using this.
2012-11-14 23:16:21 -05:00
Nick Mathewson
7908ab2093 Move address map into its own file. 2012-11-14 23:16:20 -05:00
Andrea Shepard
2cb82c33bc Merge branch 'bug7267' of ssh://git-rw.torproject.org/user/andrea/tor 2012-11-13 18:54:24 -08:00
Andrea Shepard
3db3daa663 Add comment explaining different channel close functions 2012-11-13 18:50:37 -08:00
Nick Mathewson
02a43e5eb6 Merge remote-tracking branch 'public/bug7059' 2012-11-13 21:50:07 -05:00
Nick Mathewson
b17aa28e46 Actually distribute the geoip6 file.
Fixes a bug (with no ticket) on 0.2.4.6-alpha.
2012-11-13 21:24:28 -05:00
Andrea Shepard
3b517ea5f4 Add changes file for bug 7267 2012-11-13 13:46:36 -08:00
Andrea Shepard
7ab3004223 Call channel_mark_for_close() properly in hibernate_go_dormant() 2012-11-13 13:45:00 -08:00
Roger Dingledine
83b1a50cc0 bump to 0.2.4.6-alpha-dev 2012-11-13 01:46:59 -05:00