summaryrefslogtreecommitdiff
path: root/src/or/config.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/or/config.c')
-rw-r--r--src/or/config.c265
1 files changed, 42 insertions, 223 deletions
diff --git a/src/or/config.c b/src/or/config.c
index 92808682e8..e1c1cbf80e 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -206,10 +206,10 @@ static config_var_t option_vars_[] = {
V(AccountingStart, STRING, NULL),
V(Address, STRING, NULL),
V(AllowDotExit, BOOL, "0"),
- V(AllowInvalidNodes, CSV, "middle,rendezvous"),
+ OBSOLETE("AllowInvalidNodes"),
V(AllowNonRFC953Hostnames, BOOL, "0"),
- V(AllowSingleHopCircuits, BOOL, "0"),
- V(AllowSingleHopExits, BOOL, "0"),
+ OBSOLETE("AllowSingleHopCircuits"),
+ OBSOLETE("AllowSingleHopExits"),
V(AlternateBridgeAuthority, LINELIST, NULL),
V(AlternateDirAuthority, LINELIST, NULL),
OBSOLETE("AlternateHSAuthority"),
@@ -264,7 +264,7 @@ static config_var_t option_vars_[] = {
V(ConstrainedSockets, BOOL, "0"),
V(ConstrainedSockSize, MEMUNIT, "8192"),
V(ContactInfo, STRING, NULL),
- V(ControlListenAddress, LINELIST, NULL),
+ OBSOLETE("ControlListenAddress"),
VPORT(ControlPort),
V(ControlPortFileGroupReadable,BOOL, "0"),
V(ControlPortWriteToFile, FILENAME, NULL),
@@ -281,7 +281,7 @@ static config_var_t option_vars_[] = {
V(DisableNetwork, BOOL, "0"),
V(DirAllowPrivateAddresses, BOOL, "0"),
V(TestingAuthDirTimeToLearnReachability, INTERVAL, "30 minutes"),
- V(DirListenAddress, LINELIST, NULL),
+ OBSOLETE("DirListenAddress"),
V(DirPolicy, LINELIST, NULL),
VPORT(DirPort),
V(DirPortFrontPage, FILENAME, NULL),
@@ -295,7 +295,7 @@ static config_var_t option_vars_[] = {
OBSOLETE("DisableV2DirectoryInfo_"),
OBSOLETE("DynamicDHGroups"),
VPORT(DNSPort),
- V(DNSListenAddress, LINELIST, NULL),
+ OBSOLETE("DNSListenAddress"),
V(DownloadExtraInfo, BOOL, "0"),
V(TestingEnableConnBwEvent, BOOL, "0"),
V(TestingEnableCellStatsEvent, BOOL, "0"),
@@ -306,7 +306,7 @@ static config_var_t option_vars_[] = {
V(TestingEstimatedDescriptorPropagationTime, INTERVAL, "10 minutes"),
V(ExcludeNodes, ROUTERSET, NULL),
V(ExcludeExitNodes, ROUTERSET, NULL),
- V(ExcludeSingleHopRelays, BOOL, "1"),
+ OBSOLETE("ExcludeSingleHopRelays"),
V(ExitNodes, ROUTERSET, NULL),
V(ExitPolicy, LINELIST, NULL),
V(ExitPolicyRejectPrivate, BOOL, "1"),
@@ -326,7 +326,7 @@ static config_var_t option_vars_[] = {
OBSOLETE("FallbackNetworkstatusFile"),
V(FascistFirewall, BOOL, "0"),
V(FirewallPorts, CSV, ""),
- V(FastFirstHopPK, AUTOBOOL, "auto"),
+ OBSOLETE("FastFirstHopPK"),
V(FetchDirInfoEarly, BOOL, "0"),
V(FetchDirInfoExtraEarly, BOOL, "0"),
V(FetchServerDescriptors, BOOL, "1"),
@@ -363,8 +363,8 @@ static config_var_t option_vars_[] = {
VAR("HiddenServiceNumIntroductionPoints", LINELIST_S, RendConfigLines, NULL),
VAR("HiddenServiceStatistics", BOOL, HiddenServiceStatistics_option, "1"),
V(HidServAuth, LINELIST, NULL),
- V(CloseHSClientCircuitsImmediatelyOnTimeout, BOOL, "0"),
- V(CloseHSServiceRendCircuitsImmediatelyOnTimeout, BOOL, "0"),
+ OBSOLETE("CloseHSClientCircuitsImmediatelyOnTimeout"),
+ OBSOLETE("CloseHSServiceRendCircuitsImmediatelyOnTimeout"),
V(HiddenServiceSingleHopMode, BOOL, "0"),
V(HiddenServiceNonAnonymousMode,BOOL, "0"),
V(HTTPProxy, STRING, NULL),
@@ -401,17 +401,17 @@ static config_var_t option_vars_[] = {
V(MyFamily, STRING, NULL),
V(NewCircuitPeriod, INTERVAL, "30 seconds"),
OBSOLETE("NamingAuthoritativeDirectory"),
- V(NATDListenAddress, LINELIST, NULL),
+ OBSOLETE("NATDListenAddress"),
VPORT(NATDPort),
V(Nickname, STRING, NULL),
OBSOLETE("PredictedPortsRelevanceTime"),
- V(WarnUnsafeSocks, BOOL, "1"),
+ OBSOLETE("WarnUnsafeSocks"),
VAR("NodeFamily", LINELIST, NodeFamilies, NULL),
V(NumCPUs, UINT, "0"),
V(NumDirectoryGuards, UINT, "0"),
V(NumEntryGuards, UINT, "0"),
V(OfflineMasterKey, BOOL, "0"),
- V(ORListenAddress, LINELIST, NULL),
+ OBSOLETE("ORListenAddress"),
VPORT(ORPort),
V(OutboundBindAddress, LINELIST, NULL),
V(OutboundBindAddressOR, LINELIST, NULL),
@@ -486,7 +486,7 @@ static config_var_t option_vars_[] = {
V(SchedulerHighWaterMark__, MEMUNIT, "101 MB"),
V(SchedulerMaxFlushCells__, UINT, "1000"),
V(ShutdownWaitLength, INTERVAL, "30 seconds"),
- V(SocksListenAddress, LINELIST, NULL),
+ OBSOLETE("SocksListenAddress"),
V(SocksPolicy, LINELIST, NULL),
VPORT(SocksPort),
V(SocksTimeout, INTERVAL, "2 minutes"),
@@ -499,10 +499,10 @@ static config_var_t option_vars_[] = {
V(TokenBucketRefillInterval, MSEC_INTERVAL, "100 msec"),
V(Tor2webMode, BOOL, "0"),
V(Tor2webRendezvousPoints, ROUTERSET, NULL),
- V(TLSECGroup, STRING, NULL),
+ OBSOLETE("TLSECGroup"),
V(TrackHostExits, CSV, NULL),
V(TrackHostExitsExpire, INTERVAL, "30 minutes"),
- V(TransListenAddress, LINELIST, NULL),
+ OBSOLETE("TransListenAddress"),
VPORT(TransPort),
V(TransProxyType, STRING, "default"),
OBSOLETE("TunnelDirConns"),
@@ -667,35 +667,8 @@ static const config_deprecation_t option_deprecation_notes_[] = {
/* Deprecated since 0.2.9.2-alpha... */
{ "AllowDotExit", "Unrestricted use of the .exit notation can be used for "
"a wide variety of application-level attacks." },
- { "AllowInvalidNodes", "There is no reason to enable this option; at best "
- "it will make you easier to track." },
- { "AllowSingleHopCircuits", "Almost no relays actually allow single-hop "
- "exits, making this option pointless." },
- { "AllowSingleHopExits", "Turning this on will make your relay easier "
- "to abuse." },
{ "ClientDNSRejectInternalAddresses", "Turning this on makes your client "
"easier to fingerprint, and may open you to esoteric attacks." },
- { "ExcludeSingleHopRelays", "Turning it on makes your client easier to "
- "fingerprint." },
- { "FastFirstHopPK", "Changing this option does not make your client more "
- "secure, but does make it easier to fingerprint." },
- { "CloseHSClientCircuitsImmediatelyOnTimeout", "This option makes your "
- "client easier to fingerprint." },
- { "CloseHSServiceRendCircuitsImmediatelyOnTimeout", "This option makes "
- "your hidden services easier to fingerprint." },
- { "WarnUnsafeSocks", "Changing this option makes it easier for you "
- "to accidentally lose your anonymity by leaking DNS information" },
- { "TLSECGroup", "The default is a nice secure choice; the other option "
- "is less secure." },
- { "ControlListenAddress", "Use ControlPort instead." },
- { "DirListenAddress", "Use DirPort instead, possibly with the "
- "NoAdvertise sub-option" },
- { "DNSListenAddress", "Use DNSPort instead." },
- { "SocksListenAddress", "Use SocksPort instead." },
- { "TransListenAddress", "Use TransPort instead." },
- { "NATDListenAddress", "Use NATDPort instead." },
- { "ORListenAddress", "Use ORPort instead, possibly with the "
- "NoAdvertise sub-option" },
/* End of options deprecated since 0.2.9.2-alpha. */
{ NULL, NULL }
@@ -1558,23 +1531,6 @@ get_effective_bwburst(const or_options_t *options)
return (uint32_t)bw;
}
-/** Return True if any changes from <b>old_options</b> to
- * <b>new_options</b> needs us to refresh our TLS context. */
-static int
-options_transition_requires_fresh_tls_context(const or_options_t *old_options,
- const or_options_t *new_options)
-{
- tor_assert(new_options);
-
- if (!old_options)
- return 0;
-
- if (!opt_streq(old_options->TLSECGroup, new_options->TLSECGroup))
- return 1;
-
- return 0;
-}
-
/**
* Return true if changing the configuration from <b>old</b> to <b>new</b>
* affects the guard susbsystem.
@@ -1793,13 +1749,6 @@ options_act(const or_options_t *old_options)
log_warn(LD_BUG,"Error initializing keys; exiting");
return -1;
}
- } else if (old_options &&
- options_transition_requires_fresh_tls_context(old_options,
- options)) {
- if (router_initialize_tls_context() < 0) {
- log_warn(LD_BUG,"Error initializing TLS context.");
- return -1;
- }
}
/* Write our PID to the PID file. If we do not have write permissions we
@@ -3012,6 +2961,10 @@ options_validate(or_options_t *old_options, or_options_t *options,
tor_assert(msg);
*msg = NULL;
+ if (parse_ports(options, 1, msg, &n_ports,
+ &world_writable_control_socket) < 0)
+ return -1;
+
/* Set UseEntryGuards from the configured value, before we check it below.
* We change UseEntryGuards when it's incompatible with other options,
* but leave UseEntryGuards_option with the original value.
@@ -3030,10 +2983,6 @@ options_validate(or_options_t *old_options, or_options_t *options,
"for details.", uname);
}
- if (parse_ports(options, 1, msg, &n_ports,
- &world_writable_control_socket) < 0)
- return -1;
-
if (parse_outbound_addresses(options, 1, msg) < 0)
return -1;
@@ -3126,14 +3075,12 @@ options_validate(or_options_t *old_options, or_options_t *options,
if (strcasecmp(options->TransProxyType, "default") &&
!options->TransPort_set) {
- REJECT("Cannot use TransProxyType without any valid TransPort or "
- "TransListenAddress.");
+ REJECT("Cannot use TransProxyType without any valid TransPort.");
}
}
#else
if (options->TransPort_set)
- REJECT("TransPort and TransListenAddress are disabled "
- "in this build.");
+ REJECT("TransPort is disabled in this build.");
#endif
if (options->TokenBucketRefillInterval <= 0
@@ -3170,15 +3117,6 @@ options_validate(or_options_t *old_options, or_options_t *options,
}
}
- if (options->TLSECGroup && (strcasecmp(options->TLSECGroup, "P256") &&
- strcasecmp(options->TLSECGroup, "P224"))) {
- COMPLAIN("Unrecognized TLSECGroup: Falling back to the default.");
- tor_free(options->TLSECGroup);
- }
- if (!evaluate_ecgroup_for_tls(options->TLSECGroup)) {
- REJECT("Unsupported TLSECGroup.");
- }
-
if (options->ExcludeNodes && options->StrictNodes) {
COMPLAIN("You have asked to exclude certain relays from all positions "
"in your circuits. Expect hidden services and other Tor "
@@ -3386,28 +3324,6 @@ options_validate(or_options_t *old_options, or_options_t *options,
server_mode(options));
options->MaxMemInQueues_low_threshold = (options->MaxMemInQueues / 4) * 3;
- options->AllowInvalid_ = 0;
-
- if (options->AllowInvalidNodes) {
- SMARTLIST_FOREACH_BEGIN(options->AllowInvalidNodes, const char *, cp) {
- if (!strcasecmp(cp, "entry"))
- options->AllowInvalid_ |= ALLOW_INVALID_ENTRY;
- else if (!strcasecmp(cp, "exit"))
- options->AllowInvalid_ |= ALLOW_INVALID_EXIT;
- else if (!strcasecmp(cp, "middle"))
- options->AllowInvalid_ |= ALLOW_INVALID_MIDDLE;
- else if (!strcasecmp(cp, "introduction"))
- options->AllowInvalid_ |= ALLOW_INVALID_INTRODUCTION;
- else if (!strcasecmp(cp, "rendezvous"))
- options->AllowInvalid_ |= ALLOW_INVALID_RENDEZVOUS;
- else {
- tor_asprintf(msg,
- "Unrecognized value '%s' in AllowInvalidNodes", cp);
- return -1;
- }
- } SMARTLIST_FOREACH_END(cp);
- }
-
if (!options->SafeLogging ||
!strcasecmp(options->SafeLogging, "0")) {
options->SafeLogging_ = SAFELOG_SCRUB_NONE;
@@ -4104,13 +4020,6 @@ options_validate(or_options_t *old_options, or_options_t *options,
"AlternateDirAuthority and AlternateBridgeAuthority configured.");
}
- if (options->AllowSingleHopExits && !options->DirAuthorities) {
- COMPLAIN("You have set AllowSingleHopExits; now your relay will allow "
- "others to make one-hop exits. However, since by default most "
- "clients avoid relays that set this option, most clients will "
- "ignore you.");
- }
-
#define CHECK_DEFAULT(arg) \
STMT_BEGIN \
if (!options->TestingTorNetwork && \
@@ -6471,14 +6380,9 @@ warn_client_dns_cache(const char *option, int disabling)
/**
* Parse port configuration for a single port type.
*
- * Read entries of the "FooPort" type from the list <b>ports</b>, and
- * entries of the "FooListenAddress" type from the list
- * <b>listenaddrs</b>. Two syntaxes are supported: a legacy syntax
- * where FooPort is at most a single entry containing a port number and
- * where FooListenAddress has any number of address:port combinations;
- * and a new syntax where there are no FooListenAddress entries and
- * where FooPort can have any number of entries of the format
- * "[Address:][Port] IsolationOptions".
+ * Read entries of the "FooPort" type from the list <b>ports</b>. Syntax is
+ * that FooPort can have any number of entries of the format
+ * "[Address:][Port] IsolationOptions".
*
* In log messages, describe the port type as <b>portname</b>.
*
@@ -6492,9 +6396,6 @@ warn_client_dns_cache(const char *option, int disabling)
* ports are not on a local address. If CL_PORT_FORBID_NONLOCAL is set,
* this is a control port with no password set: don't even allow it.
*
- * Unless CL_PORT_ALLOW_EXTRA_LISTENADDR is set in <b>flags</b>, warn
- * if FooListenAddress is set but FooPort is 0.
- *
* If CL_PORT_SERVER_OPTIONS is set in <b>flags</b>, do not allow stream
* isolation options in the FooPort entries; instead allow the
* server-port option set.
@@ -6509,7 +6410,6 @@ warn_client_dns_cache(const char *option, int disabling)
STATIC int
parse_port_config(smartlist_t *out,
const config_line_t *ports,
- const config_line_t *listenaddrs,
const char *portname,
int listener_type,
const char *defaultaddr,
@@ -6526,90 +6426,12 @@ parse_port_config(smartlist_t *out,
const unsigned forbid_nonlocal = flags & CL_PORT_FORBID_NONLOCAL;
const unsigned default_to_group_writable =
flags & CL_PORT_DFLT_GROUP_WRITABLE;
- const unsigned allow_spurious_listenaddr =
- flags & CL_PORT_ALLOW_EXTRA_LISTENADDR;
const unsigned takes_hostnames = flags & CL_PORT_TAKES_HOSTNAMES;
const unsigned is_unix_socket = flags & CL_PORT_IS_UNIXSOCKET;
int got_zero_port=0, got_nonzero_port=0;
char *unix_socket_path = NULL;
- /* FooListenAddress is deprecated; let's make it work like it used to work,
- * though. */
- if (listenaddrs) {
- int mainport = defaultport;
-
- if (ports && ports->next) {
- log_warn(LD_CONFIG, "%sListenAddress can't be used when there are "
- "multiple %sPort lines", portname, portname);
- return -1;
- } else if (ports) {
- if (!strcmp(ports->value, "auto")) {
- mainport = CFG_AUTO_PORT;
- } else {
- int ok;
- mainport = (int)tor_parse_long(ports->value, 10, 0, 65535, &ok, NULL);
- if (!ok) {
- log_warn(LD_CONFIG, "%sListenAddress can only be used with a single "
- "%sPort with value \"auto\" or 1-65535 and no options set.",
- portname, portname);
- return -1;
- }
- }
- }
-
- if (mainport == 0) {
- if (allow_spurious_listenaddr)
- return 1; /*DOCDOC*/
- log_warn(LD_CONFIG, "%sPort must be defined if %sListenAddress is used",
- portname, portname);
- return -1;
- }
-
- if (use_server_options && out) {
- /* Add a no_listen port. */
- port_cfg_t *cfg = port_cfg_new(0);
- cfg->type = listener_type;
- cfg->port = mainport;
- tor_addr_make_unspec(&cfg->addr); /* Server ports default to 0.0.0.0 */
- cfg->server_cfg.no_listen = 1;
- cfg->server_cfg.bind_ipv4_only = 1;
- /* cfg->entry_cfg defaults are already set by port_cfg_new */
- smartlist_add(out, cfg);
- }
-
- for (; listenaddrs; listenaddrs = listenaddrs->next) {
- tor_addr_t addr;
- uint16_t port = 0;
- if (tor_addr_port_lookup(listenaddrs->value, &addr, &port) < 0) {
- log_warn(LD_CONFIG, "Unable to parse %sListenAddress '%s'",
- portname, listenaddrs->value);
- return -1;
- }
- if (out) {
- port_cfg_t *cfg = port_cfg_new(0);
- cfg->type = listener_type;
- cfg->port = port ? port : mainport;
- tor_addr_copy(&cfg->addr, &addr);
- cfg->entry_cfg.session_group = SESSION_GROUP_UNSET;
- cfg->entry_cfg.isolation_flags = ISO_DEFAULT;
- cfg->server_cfg.no_advertise = 1;
- smartlist_add(out, cfg);
- }
- }
-
- if (warn_nonlocal && out) {
- if (is_control)
- warn_nonlocal_controller_ports(out, forbid_nonlocal);
- else if (is_ext_orport)
- warn_nonlocal_ext_orports(out, portname);
- else
- warn_nonlocal_client_ports(out, portname, listener_type);
- }
- return 0;
- } /* end if (listenaddrs) */
-
- /* No ListenAddress lines. If there's no FooPort, then maybe make a default
- * one. */
+ /* If there's no FooPort, then maybe make a default one. */
if (! ports) {
if (defaultport && defaultaddr && out) {
port_cfg_t *cfg = port_cfg_new(is_unix_socket ? strlen(defaultaddr) : 0);
@@ -7080,36 +6902,35 @@ parse_ports(or_options_t *options, int validate_only,
const unsigned gw_flag = options->SocksSocketsGroupWritable ?
CL_PORT_DFLT_GROUP_WRITABLE : 0;
if (parse_port_config(ports,
- options->SocksPort_lines, options->SocksListenAddress,
+ options->SocksPort_lines,
"Socks", CONN_TYPE_AP_LISTENER,
"127.0.0.1", 9050,
- CL_PORT_WARN_NONLOCAL|CL_PORT_ALLOW_EXTRA_LISTENADDR|
- CL_PORT_TAKES_HOSTNAMES|gw_flag) < 0) {
- *msg = tor_strdup("Invalid SocksPort/SocksListenAddress configuration");
+ CL_PORT_WARN_NONLOCAL|CL_PORT_TAKES_HOSTNAMES|gw_flag) < 0) {
+ *msg = tor_strdup("Invalid SocksPort configuration");
goto err;
}
if (parse_port_config(ports,
- options->DNSPort_lines, options->DNSListenAddress,
+ options->DNSPort_lines,
"DNS", CONN_TYPE_AP_DNS_LISTENER,
"127.0.0.1", 0,
CL_PORT_WARN_NONLOCAL|CL_PORT_TAKES_HOSTNAMES) < 0) {
- *msg = tor_strdup("Invalid DNSPort/DNSListenAddress configuration");
+ *msg = tor_strdup("Invalid DNSPort configuration");
goto err;
}
if (parse_port_config(ports,
- options->TransPort_lines, options->TransListenAddress,
+ options->TransPort_lines,
"Trans", CONN_TYPE_AP_TRANS_LISTENER,
"127.0.0.1", 0,
CL_PORT_WARN_NONLOCAL) < 0) {
- *msg = tor_strdup("Invalid TransPort/TransListenAddress configuration");
+ *msg = tor_strdup("Invalid TransPort configuration");
goto err;
}
if (parse_port_config(ports,
- options->NATDPort_lines, options->NATDListenAddress,
+ options->NATDPort_lines,
"NATD", CONN_TYPE_AP_NATD_LISTENER,
"127.0.0.1", 0,
CL_PORT_WARN_NONLOCAL) < 0) {
- *msg = tor_strdup("Invalid NatdPort/NatdListenAddress configuration");
+ *msg = tor_strdup("Invalid NatdPort configuration");
goto err;
}
{
@@ -7125,16 +6946,14 @@ parse_ports(or_options_t *options, int validate_only,
if (parse_port_config(ports,
options->ControlPort_lines,
- options->ControlListenAddress,
"Control", CONN_TYPE_CONTROL_LISTENER,
"127.0.0.1", 0,
control_port_flags) < 0) {
- *msg = tor_strdup("Invalid ControlPort/ControlListenAddress "
- "configuration");
+ *msg = tor_strdup("Invalid ControlPort configuration");
goto err;
}
- if (parse_port_config(ports, options->ControlSocket, NULL,
+ if (parse_port_config(ports, options->ControlSocket,
"ControlSocket",
CONN_TYPE_CONTROL_LISTENER, NULL, 0,
control_port_flags | CL_PORT_IS_UNIXSOCKET) < 0) {
@@ -7144,15 +6963,15 @@ parse_ports(or_options_t *options, int validate_only,
}
if (! options->ClientOnly) {
if (parse_port_config(ports,
- options->ORPort_lines, options->ORListenAddress,
+ options->ORPort_lines,
"OR", CONN_TYPE_OR_LISTENER,
"0.0.0.0", 0,
CL_PORT_SERVER_OPTIONS) < 0) {
- *msg = tor_strdup("Invalid ORPort/ORListenAddress configuration");
+ *msg = tor_strdup("Invalid ORPort configuration");
goto err;
}
if (parse_port_config(ports,
- options->ExtORPort_lines, NULL,
+ options->ExtORPort_lines,
"ExtOR", CONN_TYPE_EXT_OR_LISTENER,
"127.0.0.1", 0,
CL_PORT_SERVER_OPTIONS|CL_PORT_WARN_NONLOCAL) < 0) {
@@ -7160,11 +6979,11 @@ parse_ports(or_options_t *options, int validate_only,
goto err;
}
if (parse_port_config(ports,
- options->DirPort_lines, options->DirListenAddress,
+ options->DirPort_lines,
"Dir", CONN_TYPE_DIR_LISTENER,
"0.0.0.0", 0,
CL_PORT_SERVER_OPTIONS) < 0) {
- *msg = tor_strdup("Invalid DirPort/DirListenAddress configuration");
+ *msg = tor_strdup("Invalid DirPort configuration");
goto err;
}
}
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion