[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Patch: Adding country codes to *Nodes config options
This patch allows users to add country codes to the following configuration
options: EntryNodes, ExitNodes, ExcludeNodes, ExcludeExitNodes.
As a side effect, it adds the ability to specify IP address patterns for
EntryNodes and ExitNodes.
Country codes are specified as: {cc} and are not case sensitive. So for example:
EntryNodes {gb},{DE},$AAAAAAAAAAAAAAAAA, Unnamed, 233.233.0.0./8
How the patch works:
- EntryNodes and ExitNodes become routerset_t's.
- The element 'int country' is added to routerinfo_t.
- The pattern {cc}, where cc is a valid country code, is added to routerset_t.
- Invalid country codes will cause the entire config option to be rejected.
- When a {cc} is specified in a *Nodes option, routerlist is iterated and the
identity digest of all routers with a matching country is added to the
routerset_t digest list. If the particular digest already exists, it is added
anyway.
- Every time Tor parses a new router it checks to see if the router's country is
specified in any *Nodes option. If so, it adds the router to the option's
routerset. (router_parse_entry_from_string is the only place where a router's
routerinfo_t is created/updated right?)
- I think _ExcludeExitNodesUnion was leaking because it was not part of
option_vars. I've added it option_vars for now - but it looks as though
config_var_t should be updated to allow internal options that can be memory
managed in config_var_t but not set/unset/updated by the user. I can't see an
unintrusive way of doing that, so have left it alone for now.
- routerset_equal is an unfortunate duplication of opt_streq. Maybe there's a
better way?
Index: src/or/config.c
===================================================================
--- src/or/config.c (revision 16912)
+++ src/or/config.c (working copy)
@@ -194,11 +194,12 @@
V(DNSListenAddress, LINELIST, NULL),
V(DownloadExtraInfo, BOOL, "0"),
V(EnforceDistinctSubnets, BOOL, "1"),
- V(EntryNodes, STRING, NULL),
+ V(EntryNodes, ROUTERSET, NULL),
V(TestingEstimatedDescriptorPropagationTime, INTERVAL, "10 minutes"),
V(ExcludeNodes, ROUTERSET, NULL),
V(ExcludeExitNodes, ROUTERSET, NULL),
- V(ExitNodes, STRING, NULL),
+ V(_ExcludeExitNodesUnion, ROUTERSET, NULL),
+ V(ExitNodes, ROUTERSET, NULL),
V(ExitPolicy, LINELIST, NULL),
V(ExitPolicyRejectPrivate, BOOL, "1"),
V(FallbackNetworkstatusFile, FILENAME,
@@ -1340,7 +1341,7 @@
/* Check if we need to parse and add the EntryNodes config option. */
if (options->EntryNodes &&
(!old_options ||
- !opt_streq(old_options->EntryNodes, options->EntryNodes)))
+ (!routerset_equal(old_options->ExitNodes,options->ExitNodes))))
entry_nodes_should_be_added();
/* Since our options changed, we might need to regenerate and upload our
@@ -1701,7 +1702,6 @@
case CONFIG_TYPE_LINELIST_S:
config_line_append((config_line_t**)lvalue, c->key, c->value);
break;
-
case CONFIG_TYPE_OBSOLETE:
log_warn(LD_CONFIG, "Skipping obsolete configuration option '%s'", c->key);
break;
@@ -2964,17 +2964,17 @@
}
if (options->StrictExitNodes &&
- (!options->ExitNodes || !strlen(options->ExitNodes)) &&
+ (!options->ExitNodes) &&
(!old_options ||
(old_options->StrictExitNodes != options->StrictExitNodes) ||
- (!opt_streq(old_options->ExitNodes, options->ExitNodes))))
+ (!routerset_equal(old_options->ExitNodes,options->ExitNodes))))
COMPLAIN("StrictExitNodes set, but no ExitNodes listed.");
if (options->StrictEntryNodes &&
- (!options->EntryNodes || !strlen(options->EntryNodes)) &&
+ (!options->EntryNodes) &&
(!old_options ||
(old_options->StrictEntryNodes != options->StrictEntryNodes) ||
- (!opt_streq(old_options->EntryNodes, options->EntryNodes))))
+ (!routerset_equal(old_options->EntryNodes,options->EntryNodes))))
COMPLAIN("StrictEntryNodes set, but no EntryNodes listed.");
if (options->AuthoritativeDir) {
@@ -3334,10 +3334,6 @@
if (options->UseEntryGuards && ! options->NumEntryGuards)
REJECT("Cannot enable UseEntryGuards with NumEntryGuards set to 0");
- if (check_nickname_list(options->ExitNodes, "ExitNodes", msg))
- return -1;
- if (check_nickname_list(options->EntryNodes, "EntryNodes", msg))
- return -1;
if (check_nickname_list(options->MyFamily, "MyFamily", msg))
return -1;
for (cl = options->NodeFamilies; cl; cl = cl->next) {
Index: src/or/routerlist.c
===================================================================
--- src/or/routerlist.c (revision 16912)
+++ src/or/routerlist.c (working copy)
@@ -4721,6 +4721,54 @@
return result;
}
+/** Helper. Add <b>router</b> to any routersets which contain its country. */
+static void
+routerset_add_routerdigest(routerset_t *target, const routerinfo_t *router,
+ const char *description)
+{
+ log_debug(LD_CONFIG, "Adding identity for router %s to %s",
+ router->nickname, description);
+ digestmap_set(target->digests, router->cache_info.identity_digest,
+ (void*)1);
+}
+
+/** Add all routers in country <b>c</b> to <b>routerstoadd</b>. Return 0
+ * if <b>c</b> is not a valid country.*/
+static int
+routerset_add_routers_by_country(smartlist_t *routerstoadd, const char *c,
+ int running_only)
+{
+ char *country;
+
+ if (!strchr(c,'{') && !strchr(c,'}'))
+ return 0;
+
+ country=tor_strdup(c);
+ tor_strstrip(country,"}");
+ tor_strstrip(country,"{");
+ tor_strlower(country);
+
+ if (!geoip_is_valid_country(country)) {
+ log(LOG_WARN, LD_CONFIG, "Country Code '%s' is not valid, ignoring.",
+ country);
+ tor_free(country);
+ return 0;
+ }
+
+ SMARTLIST_FOREACH(routerlist->routers, routerinfo_t *, router,
+ {
+ if (!strcmp(country,geoip_get_country_name(router->country))) {
+ log_debug(LD_CONFIG, "Adding identity for router %s from %s",
+ router->nickname, country);
+ if (!running_only || router->is_running) {
+ smartlist_add(routerstoadd, router);
+ }
+ }
+ });
+ tor_free(country);
+ return 1;
+}
+
/** Parse the string <b>s</b> to create a set of routerset entries, and add
* them to <b>target</b>. In log messages, refer to the string as
* <b>description</b>. Return 0 on success, -1 on failure.
@@ -4733,6 +4781,7 @@
routerset_parse(routerset_t *target, const char *s, const char *description)
{
int r = 0;
+ smartlist_t *cc_routers=smartlist_create();
smartlist_t *list = smartlist_create();
smartlist_split_string(list, s, ",",
SPLIT_SKIP_SPACE | SPLIT_IGNORE_BLANK, 0);
@@ -4748,6 +4797,14 @@
} else if (is_legal_nickname(nick)) {
log_debug(LD_CONFIG, "Adding nickname %s to %s", nick, description);
strmap_set_lc(target->names, nick, (void*)1);
+ } else if (routerset_add_routers_by_country(cc_routers, nick, 1)) {
+ log_debug(LD_CONFIG, "Adding identities in %s to %s", nick,
+ description);
+ SMARTLIST_FOREACH(cc_routers, routerinfo_t *, router,
+ {
+ routerset_add_routerdigest(target, router, description);
+ });
+ smartlist_clear(cc_routers);
} else if ((strchr(nick,'.') || strchr(nick, '*')) &&
(p = router_parse_addr_policy_item_from_string(
nick, ADDR_POLICY_REJECT))) {
@@ -4763,6 +4820,7 @@
});
smartlist_add_all(target->list, list);
smartlist_free(list);
+ smartlist_free(cc_routers);
return r;
}
@@ -4779,6 +4837,19 @@
tor_free(s);
}
+/** Helper. Return true iff <b>routers</b> contains <b>country</b>. */
+static int
+routerset_contains_country(routerset_t *routers, const char *country)
+{
+ char *rs;
+ int r=0;
+ rs=routerset_to_string(routers);
+ if (strstr(rs,country))
+ r=1;
+ tor_free(rs);
+ return r;
+}
+
/** Helper. Return true iff <b>set</b> contains a router based on the other
* provided fields. */
static int
@@ -4827,9 +4898,11 @@
routerset_get_all_routers(smartlist_t *out, const routerset_t *routerset,
int running_only)
{
+ smartlist_t *cc_routers=NULL;
tor_assert(out);
if (!routerset || !routerset->list)
return;
+ cc_routers=smartlist_create();
if (!warned_nicknames)
warned_nicknames = smartlist_create();
SMARTLIST_FOREACH(routerset->list, const char *, name, {
@@ -4837,6 +4910,10 @@
if (router) {
if (!running_only || router->is_running)
smartlist_add(out, router);
+ }else if (routerset_add_routers_by_country(cc_routers, name,
+ running_only)) {
+ smartlist_add_all(out, cc_routers);
+ smartlist_clear(cc_routers);
}
});
if (smartlist_len(routerset->policies)) {
@@ -4848,6 +4925,7 @@
smartlist_add(out, router);
});
}
+ smartlist_free(cc_routers);
}
/** Remove every routerinfo_t from <b>lst</b> that is in <b>routerset</b>. */
@@ -4875,6 +4953,72 @@
return smartlist_join_strings(set->list, ",", 0, NULL);
}
+/** Return 1 if <b>old</b> and <b>new</b> match, otherwise return 0. */
+int
+routerset_equal(const routerset_t *old, const routerset_t *new)
+{
+ char *s1;
+ char *s2;
+ int r=0;
+
+ s1=routerset_to_string(old);
+ s2=routerset_to_string(new);
+ if (!s1 && !s2)
+ r=1;
+ else if (s1 && s2 && !strcmp(s1,s2))
+ r=1;
+ else
+ r=0;
+
+ tor_free(s1);
+ tor_free(s2);
+ return r;
+}
+
+/** Helper. Add <b>router</b> to any routersets which contain its country. */
+void
+routerset_update_router_country(const routerinfo_t *router)
+{
+ or_options_t *options=get_options();
+ char country[4];
+ int update_excludes=0;
+
+ if (!options->ExitNodes && !options->EntryNodes &&
+ !options->ExcludeNodes && !options->ExcludeExitNodes)
+ return;
+
+ tor_snprintf(country,sizeof(country),"{%s}",
+ geoip_get_country_name(router->country));
+
+ if (options->ExitNodes &&
+ routerset_contains_country(options->ExitNodes,country))
+ routerset_add_routerdigest(options->ExitNodes, router, "Exit Nodes");
+
+ if (options->EntryNodes &&
+ routerset_contains_country(options->EntryNodes,country))
+ routerset_add_routerdigest(options->EntryNodes, router, "Entry Nodes");
+
+ if (options->ExcludeNodes &&
+ routerset_contains_country(options->ExcludeNodes,country)) {
+ update_excludes=1;
+ routerset_add_routerdigest(options->ExcludeNodes, router, "Exclude Nodes");
+ }
+
+ if (options->ExcludeExitNodes &&
+ routerset_contains_country(options->ExcludeExitNodes,country)) {
+ update_excludes=1;
+ routerset_add_routerdigest(options->ExcludeExitNodes, router,
+ "ExcludeExit Nodes");
+ }
+
+ if (update_excludes) {
+ routerset_free(options->_ExcludeExitNodesUnion);
+ options->_ExcludeExitNodesUnion = routerset_new();
+ routerset_union(options->_ExcludeExitNodesUnion,options->ExcludeExitNodes);
+ routerset_union(options->_ExcludeExitNodesUnion,options->ExcludeNodes);
+ }
+}
+
/** Free all storage held in <b>routerset</b>. */
void
routerset_free(routerset_t *routerset)
Index: src/or/or.h
===================================================================
--- src/or/or.h (revision 16912)
+++ src/or/or.h (working copy)
@@ -1348,7 +1348,8 @@
time_t last_reachable;
/** When did we start testing reachability for this OR? */
time_t testing_since;
-
+ /** According to the geoip db what country is this router in? */
+ int country;
} routerinfo_t;
/** Information needed to keep and cache a signed extra-info document. */
@@ -2065,17 +2066,18 @@
char *Address; /**< OR only: configured address for this onion router. */
char *PidFile; /**< Where to store PID of Tor process. */
- char *ExitNodes; /**< Comma-separated list of nicknames of ORs to consider
- * as exits. */
- char *EntryNodes; /**< Comma-separated list of nicknames of ORs to consider
- * as entry points. */
+ struct routerset_t *ExitNodes; /**< Comma-separated list of nicknames of ORs
+ * to consider as exits. */
+ struct routerset_t *EntryNodes; /**< Comma-separated list of nicknames of ORs
+ * to consider as entry points. */
int StrictExitNodes; /**< Boolean: When none of our ExitNodes are up, do we
* stop building circuits? */
int StrictEntryNodes; /**< Boolean: When none of our EntryNodes are up, do we
* stop building circuits? */
struct routerset_t *ExcludeNodes; /**< Comma-separated list of nicknames of
- * ORs not to use in circuits. */
- struct routerset_t *ExcludeExitNodes; /**<DODOC */
+ * ORs not to use in circuits. */
+ struct routerset_t *ExcludeExitNodes; /**< Comma-separated list of ORs
+ * not to consider as exits. */
/** Union of ExcludeNodes and ExcludeExitNodes */
struct routerset_t *_ExcludeExitNodesUnion;
@@ -3432,6 +3434,7 @@
int geoip_get_n_countries(void);
const char *geoip_get_country_name(int num);
int geoip_is_loaded(void);
+int geoip_is_valid_country(const char *country);
/** Indicates an action that we might be noting geoip statistics on.
* Note that if we're noticing CONNECT, we're a bridge, and if we're noticing
* the others, we're not.
@@ -4262,6 +4265,8 @@
void routerset_subtract_routers(smartlist_t *out,
const routerset_t *routerset);
char *routerset_to_string(const routerset_t *routerset);
+void routerset_update_router_country(const routerinfo_t *router);
+int routerset_equal(const routerset_t *old, const routerset_t *new);
void routerset_free(routerset_t *routerset);
int hid_serv_get_responsible_directories(smartlist_t *responsible_dirs,
Index: src/or/geoip.c
===================================================================
--- src/or/geoip.c (revision 16912)
+++ src/or/geoip.c (working copy)
@@ -42,6 +42,20 @@
/** A list of all known geoip_entry_t, sorted by ip_low. */
static smartlist_t *geoip_entries = NULL;
+/** Return 1 if the <b>country</b> is a valid 2-letter country code,
+ * otherwise return 0.
+ */
+int
+geoip_is_valid_country(const char *country)
+{
+ void *_idxplus1;
+
+ _idxplus1 = strmap_get_lc(country_idxplus1_by_lc_code, country);
+ if (!_idxplus1)
+ return 0;
+ return 1;
+}
+
/** Add an entry to the GeoIP table, mapping all IPs between <b>low</b> and
* <b>high</b>, inclusive, to the 2-letter country code <b>country</b>.
*/
Index: src/or/routerparse.c
===================================================================
--- src/or/routerparse.c (revision 16912)
+++ src/or/routerparse.c (working copy)
@@ -1397,6 +1397,9 @@
router->platform = tor_strdup("<unknown>");
}
+ router->country = geoip_get_country_by_ip(router->addr);
+ routerset_update_router_country(router);
+
goto done;
err:
Index: src/or/circuitbuild.c
===================================================================
--- src/or/circuitbuild.c (revision 16912)
+++ src/or/circuitbuild.c (working copy)
@@ -1282,7 +1282,7 @@
n_pending_connections);
preferredexits = smartlist_create();
- add_nickname_list_to_smartlist(preferredexits,options->ExitNodes,1);
+ routerset_get_all_routers(preferredexits,options->ExitNodes,1);
sl = smartlist_create();
@@ -1403,6 +1403,24 @@
return NULL;
}
+/** Log a warning if the user specified an exit for the circuit that
+ * has been excluded from use by ExcludeNodes or ExcludeExitNodes. */
+static void
+warn_if_router_excluded(extend_info_t *exit)
+{
+ or_options_t *options = get_options();
+ routerinfo_t *ri = router_get_by_digest(exit->identity_digest);
+
+ if (!ri || !options->_ExcludeExitNodesUnion)
+ return;
+
+ if (routerset_contains_router(options->_ExcludeExitNodesUnion, ri))
+ log_warn(LD_CIRC,"Requested exit node '%s' is in ExcludeNodes, "
+ "or ExcludeExitNodes, using anyway.",exit->nickname);
+
+ return;
+}
+
/** Decide a suitable length for circ's cpath, and pick an exit
* router (or use <b>exit</b> if provided). Store these in the
* cpath. Return 0 if ok, -1 if circuit should be closed. */
@@ -1423,6 +1441,7 @@
}
if (exit) { /* the circuit-builder pre-requested one */
+ warn_if_router_excluded(exit);
log_info(LD_CIRC,"Using requested exit node '%s'", exit->nickname);
exit = extend_info_dup(exit);
} else { /* we have to decide one */
@@ -1836,7 +1855,7 @@
else if (options->UseBridges && ri->purpose != ROUTER_PURPOSE_BRIDGE)
*reason = "not a bridge";
else if (!options->UseBridges && !ri->is_possible_guard &&
- !router_nickname_is_in_list(ri, options->EntryNodes))
+ !routerset_contains_router(options->EntryNodes,ri))
*reason = "not recommended as a guard";
else if (routerset_contains_router(options->ExcludeNodes, ri))
*reason = "excluded";
@@ -1860,7 +1879,6 @@
control_event_guard(e->nickname, e->identity, "GOOD");
changed = 1;
}
-
return changed;
}
@@ -2350,8 +2368,9 @@
return;
}
- log_info(LD_CIRC,"Adding configured EntryNodes '%s'.",
- options->EntryNodes);
+ if (options->EntryNodes)
+ log_info(LD_CIRC,"Adding configured EntryNodes '%s'.",
+ routerset_to_string(options->EntryNodes));
entry_routers = smartlist_create();
entry_fps = smartlist_create();
@@ -2359,7 +2378,7 @@
old_entry_guards_not_on_list = smartlist_create();
/* Split entry guards into those on the list and those not. */
- add_nickname_list_to_smartlist(entry_routers, options->EntryNodes, 0);
+ routerset_get_all_routers(entry_routers, options->EntryNodes, 0);
SMARTLIST_FOREACH(entry_routers, routerinfo_t *, ri,
smartlist_add(entry_fps,ri->cache_info.identity_digest));
SMARTLIST_FOREACH(entry_guards, entry_guard_t *, e, {
Index: contrib/checkSpace.pl
===================================================================
--- contrib/checkSpace.pl (revision 16912)
+++ contrib/checkSpace.pl (working copy)
@@ -73,7 +73,7 @@
s!//.*!!;
}
## Warn about braces preceded by non-space.
- if (/([^\s])\{/) {
+ if (/([^\s'])\{/) {
print " $1\{:$fn:$.\n";
}
## Warn about multiple internal spaces.
Index: doc/tor.1.in
===================================================================
--- doc/tor.1.in (revision 16912)
+++ doc/tor.1.in (working copy)
@@ -422,28 +422,28 @@
.LP
.TP
\fBExcludeNodes \fR\fInode\fR,\fInode\fR,\fI...\fP
-A list of identity fingerprints, nicknames, and address patterns of
-nodes to never use when building a circuit. (Example: ExcludeNodes
-SlowServer, $ABCDEFFFFFFFFFFFFFFF, 255.254.0.0/8)
+A list of identity fingerprints, nicknames, country codes and address patterns
+of nodes to never use when building a circuit. (Example: ExcludeNodes
+SlowServer, $ABCDEFFFFFFFFFFFFFFF, {cc}, 255.254.0.0/8)
.LP
.TP
\fBExcludeExitNodes \fR\fInode\fR,\fInode\fR,\fI...\fP
-A list of identity fingerprints, nicknames, and address patterns of
-nodes to never use when picking an exit node. Note that any node
+A list of identity fingerprints, nicknames, country codes and address patterns
+of nodes to never use when picking an exit node. Note that any node
listed in ExcludeNodes is automatically considered to be part of this
list.
.LP
.TP
\fBEntryNodes \fR\fInode\fR,\fInode\fR,\fI...\fP
-A list of identity fingerprints or nicknames of preferred nodes to use for the
-first hop in the circuit.
+A list of identity fingerprints, nicknames, country codes and address patterns
+of nodes to use for the first hop in the circuit.
These are treated only as preferences unless StrictEntryNodes (see
below) is also set.
.LP
.TP
\fBExitNodes \fR\fInode\fR,\fInode\fR,\fI...\fP
-A list of identity fingerprints or nicknames of preferred nodes to use for the
-last hop in the circuit.
+A list of identity fingerprints, nicknames, country codes and address patterns
+of nodes to use for the last hop in the circuit.
These are treated only as preferences unless StrictExitNodes (see
below) is also set.
.LP