[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [stem/master] Switching exit policy's can_exit_to() and is_match() be permissive



commit caee7d6c968fd6cd9912dc4a554d66e303316b61
Author: Damian Johnson <atagar@xxxxxxxxxxxxxx>
Date:   Sat Mar 23 19:50:52 2013 -0700

    Switching exit policy's can_exit_to() and is_match() be permissive
    
    Switching how the ExitPolicy's can_exit_to() and ExitPolicyRule's is_match()
    handle an undefined address or port. Previously we reported if we matched or
    allowed exiting to *all* instance of the defined destination. Now, however,
    rather if we match against *any*.
    
    Change was requested by Aaron Johnson. You can still get the old behavior by
    setting the 'strict' argument.
---
 stem/exit_policy.py           |   29 ++++++++++++++++++-----------
 test/unit/exit_policy/rule.py |   33 ++++++++++++++++++++++-----------
 2 files changed, 40 insertions(+), 22 deletions(-)

diff --git a/stem/exit_policy.py b/stem/exit_policy.py
index d187d62..2b0d6d4 100644
--- a/stem/exit_policy.py
+++ b/stem/exit_policy.py
@@ -156,29 +156,31 @@ class ExitPolicy(object):
     self._summary_representation = None
     self._can_exit_to_cache = {}
 
-  def can_exit_to(self, address = None, port = None):
+  def can_exit_to(self, address = None, port = None, strict = False):
     """
     Checks if this policy allows exiting to a given destination or not. If the
-    address or port is omitted then this will check if we allow for its
-    wildcard.
+    address or port is omitted then this will check if we're allowed to exit to
+    any instances of the defined address or port.
 
     :param str address: IPv4 or IPv6 address (with or without brackets)
     :param int port: port number
+    :param bool strict: if the address or port is excluded then check if we can
+      exit to **all** instances of the defined address or port
 
     :returns: **True** if exiting to this destination is allowed, **False** otherwise
     """
 
-    if not (address, port) in self._can_exit_to_cache:
+    if not (address, port, strict) in self._can_exit_to_cache:
       result = self._is_allowed_default
 
       for rule in self._get_rules():
-        if rule.is_match(address, port):
+        if rule.is_match(address, port, strict):
           result = rule.is_accept
           break
 
-      self._can_exit_to_cache[(address, port)] = result
+      self._can_exit_to_cache[(address, port, strict)] = result
 
-    return self._can_exit_to_cache[(address, port)]
+    return self._can_exit_to_cache[(address, port, strict)]
 
   def is_exiting_allowed(self):
     """
@@ -529,13 +531,16 @@ class ExitPolicyRule(object):
 
     return self.min_port in (0, 1) and self.max_port == 65535
 
-  def is_match(self, address = None, port = None):
+  def is_match(self, address = None, port = None, strict = False):
     """
     **True** if we match against the given destination, **False** otherwise. If
-    the address or port is omitted then that'll only match against a wildcard.
+    the address or port is omitted then this will check if we're allowed to
+    exit to any instances of the defined address or port.
 
     :param str address: IPv4 or IPv6 address (with or without brackets)
     :param int port: port number
+    :param bool strict: if the address or port is excluded then check if we can
+      exit to **all** instances of the defined address or port
 
     :returns: **bool** indicating if we match against this destination
 
@@ -566,7 +571,8 @@ class ExitPolicyRule(object):
       # mask applied matches.
 
       if address is None:
-        return False
+        if strict:
+          return False
       else:
         comparison_addr_bin = int(stem.util.connection._get_address_binary(address), 2)
         comparison_addr_bin &= self._get_mask_bin()
@@ -576,7 +582,8 @@ class ExitPolicyRule(object):
 
     if not self.is_port_wildcard():
       if port is None:
-        return False
+        if strict:
+          return False
       elif port < self.min_port or port > self.max_port:
         return False
 
diff --git a/test/unit/exit_policy/rule.py b/test/unit/exit_policy/rule.py
index 1bf3911..0fe369b 100644
--- a/test/unit/exit_policy/rule.py
+++ b/test/unit/exit_policy/rule.py
@@ -216,8 +216,10 @@ class TestExitPolicyRule(unittest.TestCase):
         ("FE80:0000:0000:0000:0202:B3FF:FE1E:8329", 80): True,
         ("[FE80:0000:0000:0000:0202:B3FF:FE1E:8329]", 80): True,
         ("192.168.0.1", None): True,
-        (None, 80): True,
-        (None, None): True,
+        (None, 80, False): True,
+        (None, 80, True): True,
+        (None, None, False): True,
+        (None, None, True): True,
       },
       "reject 255.255.255.255/0:*": {
         ("192.168.0.1", 80): True,
@@ -226,8 +228,10 @@ class TestExitPolicyRule(unittest.TestCase):
         ("FE80:0000:0000:0000:0202:B3FF:FE1E:8329", 80): False,
         ("[FE80:0000:0000:0000:0202:B3FF:FE1E:8329]", 80): False,
         ("192.168.0.1", None): True,
-        (None, 80): False,
-        (None, None): False,
+        (None, 80, False): True,
+        (None, 80, True): False,
+        (None, None, False): True,
+        (None, None, True): False,
       },
     }
 
@@ -249,7 +253,8 @@ class TestExitPolicyRule(unittest.TestCase):
         ("192.168.0.50", 80): True,
         ("192.168.0.51", 80): False,
         ("192.168.0.49", 80): False,
-        (None, 80): False,
+        (None, 80, False): True,
+        (None, 80, True): False,
         ("192.168.0.50", None): True,
       },
       "reject 0.0.0.0/24:*": {
@@ -259,7 +264,8 @@ class TestExitPolicyRule(unittest.TestCase):
         ("0.0.1.0", 80): False,
         ("0.1.0.0", 80): False,
         ("1.0.0.0", 80): False,
-        (None, 80): False,
+        (None, 80, False): True,
+        (None, 80, True): False,
         ("0.0.0.0", None): True,
       },
     }
@@ -278,7 +284,8 @@ class TestExitPolicyRule(unittest.TestCase):
         ("[FE80:0000:0000:0000:0202:B3FF:FE1E:8329]", 80): True,
         ("FE80:0000:0000:0000:0202:B3FF:FE1E:8330", 80): False,
         ("FE80:0000:0000:0000:0202:B3FF:FE1E:8328", 80): False,
-        (None, 80): False,
+        (None, 80, False): True,
+        (None, 80, True): False,
         ("FE80:0000:0000:0000:0202:B3FF:FE1E:8329", None): True,
       },
       "reject [FE80:0000:0000:0000:0202:B3FF:FE1E:8329]/112:*": {
@@ -287,8 +294,10 @@ class TestExitPolicyRule(unittest.TestCase):
         ("FE80:0000:0000:0000:0202:B3FF:FE1E:FFFF", 80): True,
         ("FE80:0000:0000:0000:0202:B3FF:FE1F:8329", 80): False,
         ("FE81:0000:0000:0000:0202:B3FF:FE1E:8329", 80): False,
-        (None, 80): False,
-        ("FE80:0000:0000:0000:0202:B3FF:FE1E:8329", None): True,
+        (None, 80, False): True,
+        (None, 80, True): False,
+        ("FE80:0000:0000:0000:0202:B3FF:FE1E:8329", None, False): True,
+        ("FE80:0000:0000:0000:0202:B3FF:FE1E:8329", None, True): True,
       },
     }
 
@@ -305,7 +314,8 @@ class TestExitPolicyRule(unittest.TestCase):
         ("192.168.0.50", 81): False,
         ("192.168.0.50", 79): False,
         (None, 80): True,
-        ("192.168.0.50", None): False,
+        ("192.168.0.50", None, False): True,
+        ("192.168.0.50", None, True): False,
       },
       "reject *:80-85": {
         ("192.168.0.50", 79): False,
@@ -314,7 +324,8 @@ class TestExitPolicyRule(unittest.TestCase):
         ("192.168.0.50", 85): True,
         ("192.168.0.50", 86): False,
         (None, 83): True,
-        ("192.168.0.50", None): False,
+        ("192.168.0.50", None, False): True,
+        ("192.168.0.50", None, True): False,
       },
     }
 

_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits