diff options
| author | teor (Tim Wilson-Brown) <teor2345@gmail.com> | 2015-09-14 11:46:58 +1000 |
|---|---|---|
| committer | teor (Tim Wilson-Brown) <teor2345@gmail.com> | 2015-09-16 00:13:12 +1000 |
| commit | d3358a0a05f661f78286d43fcc71d79daa090460 (patch) | |
| tree | 97ac4142acc945a76077cf16b95c75bf1a108079 /src/or | |
| parent | 36ad8d8fdc18e9006cd1316deb79b37c77cf2892 (diff) | |
| download | tor-d3358a0a05f661f78286d43fcc71d79daa090460.tar.gz tor-d3358a0a05f661f78286d43fcc71d79daa090460.zip | |
ExitPolicy accept6/reject6 produces IPv6 wildcard addresses only
In previous versions of Tor, ExitPolicy accept6/reject6 * produced
policy entries for IPv4 and IPv6 wildcard addresses.
To reduce operator confusion, change accept6/reject6 * to only produce
an IPv6 wildcard address.
Resolves bug #16069.
Patch on 2eb7eafc9d78 and a96c0affcb4c (25 Oct 2012),
released in 0.2.4.7-alpha.
Diffstat (limited to 'src/or')
| -rw-r--r-- | src/or/routerparse.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 2f7e50e60a..7bb18ecc30 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3820,6 +3820,12 @@ router_parse_addr_policy(directory_token_t *tok, unsigned fmt_flags) else newe.policy_type = ADDR_POLICY_ACCEPT; + /* accept6/reject6 * produces an IPv6 wildcard address only. + * (accept/reject * produces rules for IPv4 and IPv6 wildcard addresses.) */ + if (tok->tp == K_ACCEPT6 || tok->tp == K_REJECT6) { + fmt_flags |= TAPMP_STAR_IPV6_ONLY; + } + if (tor_addr_parse_mask_ports(arg, fmt_flags, &newe.addr, &newe.maskbits, &newe.prt_min, &newe.prt_max) < 0) { log_warn(LD_DIR,"Couldn't parse line %s. Dropping", escaped(arg)); @@ -3829,9 +3835,12 @@ router_parse_addr_policy(directory_token_t *tok, unsigned fmt_flags) return addr_policy_get_canonical_entry(&newe); } -/** Parse an exit policy line of the format "accept/reject private:...". +/** Parse an exit policy line of the format "accept[6]/reject[6] private:...". * This didn't exist until Tor 0.1.1.15, so nobody should generate it in * router descriptors until earlier versions are obsolete. + * + * accept/reject and accept6/reject6 private all produce rules for both + * IPv4 and IPv6 addresses. */ static addr_policy_t * router_parse_addr_policy_private(directory_token_t *tok) |