src/or/policies.c

   1 /* Copyright (c) 2001-2004, Roger Dingledine.
   2  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. */
   3 /* See LICENSE for licensing information */
   4 /* $Id$ */
   5 const char policies_c_id[] = \
   6   "$Id$";
   7
   8 /**
   9  * \file policies.c
  10  * \brief Code to parse and use address policies and exit policies.
  11  **/
  12
  13 #include "or.h"
  14
  15 static addr_policy_t *socks_policy = NULL;
  16 static addr_policy_t *dir_policy = NULL;
  17 static addr_policy_t *authdir_reject_policy = NULL;
  18 static addr_policy_t *authdir_invalid_policy = NULL;
  19 static addr_policy_t *authdir_badexit_policy = NULL;
  20
  21 /** Parsed addr_policy_t describing which addresses we believe we can start
  22  * circuits at. */
  23 static addr_policy_t *reachable_or_addr_policy = NULL;
  24 /** Parsed addr_policy_t describing which addresses we believe we can connect
  25  * to directories at. */
  26 static addr_policy_t *reachable_dir_addr_policy = NULL;
  27
  28 /**
  29  * Given a linked list of config lines containing "allow" and "deny"
  30  * tokens, parse them and append the result to <b>dest</b>. Return -1
  31  * if any tokens are malformed, else return 0.
  32  */
  33 static int
  34 parse_addr_policy(config_line_t *cfg, addr_policy_t **dest,
  35                   int assume_action)
  36 {
  37   addr_policy_t **nextp;
  38   smartlist_t *entries;
  39   int r = 0;
  40
  41   if (!cfg)
  42     return 0;
  43
  44   nextp = dest;
  45
  46   while (*nextp)
  47     nextp = &((*nextp)->next);
  48
  49   entries = smartlist_create();
  50   for (; cfg; cfg = cfg->next) {
  51     smartlist_split_string(entries, cfg->value, ",",
  52                            SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0);
  53     SMARTLIST_FOREACH(entries, const char *, ent,
  54     {
  55       log_debug(LD_CONFIG,"Adding new entry '%s'",ent);
  56       *nextp = router_parse_addr_policy_from_string(ent, assume_action);
  57       if (*nextp) {
  58         if (addr_mask_get_bits((*nextp)->msk)<0) {
  59           log_warn(LD_CONFIG, "Address policy element '%s' can't be expressed "
  60                    "as a bit prefix.", ent);
  61         }
  62         /* Advance nextp to the end of the policy. */
  63         while (*nextp)
  64           nextp = &((*nextp)->next);
  65       } else {
  66         log_warn(LD_CONFIG,"Malformed policy '%s'.", ent);
  67         r = -1;
  68       }
  69     });
  70     SMARTLIST_FOREACH(entries, char *, ent, tor_free(ent));
  71     smartlist_clear(entries);
  72   }
  73   smartlist_free(entries);
  74   return r;
  75 }
  76
  77 /** Helper: parse the Reachable(Dir|OR)?Addresses fields into
  78  * reachable_(or|dir)_addr_policy. */
  79 static void
  80 parse_reachable_addresses(void)
  81 {
  82   or_options_t *options = get_options();
  83
  84   if (options->ReachableDirAddresses &&
  85       options->ReachableORAddresses &&
  86       options->ReachableAddresses) {
  87     log_warn(LD_CONFIG,
  88              "Both ReachableDirAddresses and ReachableORAddresses are set. "
  89              "ReachableAddresses setting will be ignored.");
  90   }
  91   addr_policy_free(reachable_or_addr_policy);
  92   reachable_or_addr_policy = NULL;
  93   if (!options->ReachableORAddresses && options->ReachableAddresses)
  94     log_info(LD_CONFIG,
  95              "Using ReachableAddresses as ReachableORAddresses.");
  96   if (parse_addr_policy(options->ReachableORAddresses ?
  97                           options->ReachableORAddresses :
  98                           options->ReachableAddresses,
  99                         &reachable_or_addr_policy, ADDR_POLICY_ACCEPT)) {
 100     log_warn(LD_CONFIG,
 101              "Error parsing Reachable%sAddresses entry; ignoring.",
 102              options->ReachableORAddresses ? "OR" : "");
 103   }
 104
 105   addr_policy_free(reachable_dir_addr_policy);
 106   reachable_dir_addr_policy = NULL;
 107   if (!options->ReachableDirAddresses && options->ReachableAddresses)
 108     log_info(LD_CONFIG,
 109              "Using ReachableAddresses as ReachableDirAddresses");
 110   if (parse_addr_policy(options->ReachableDirAddresses ?
 111                           options->ReachableDirAddresses :
 112                           options->ReachableAddresses,
 113                         &reachable_dir_addr_policy, ADDR_POLICY_ACCEPT)) {
 114     if (options->ReachableDirAddresses)
 115       log_warn(LD_CONFIG,
 116                "Error parsing ReachableDirAddresses entry; ignoring.");
 117   }
 118 }
 119
 120 /** Return true iff the firewall options might block any address:port
 121  * combination.
 122  */
 123 int
 124 firewall_is_fascist_or(void)
 125 {
 126   return reachable_or_addr_policy != NULL;
 127 }
 128
 129 /** Return true iff <b>policy</b> (possibly NULL) will allow a
 130  * connection to <b>addr</b>:<b>port</b>.
 131  */
 132 static int
 133 addr_policy_permits_address(uint32_t addr, uint16_t port,
 134                             addr_policy_t *policy)
 135 {
 136   addr_policy_result_t p;
 137   p = compare_addr_to_addr_policy(addr, port, policy);
 138   switch (p) {
 139     case ADDR_POLICY_PROBABLY_ACCEPTED:
 140     case ADDR_POLICY_ACCEPTED:
 141       return 1;
 142     case ADDR_POLICY_PROBABLY_REJECTED:
 143     case ADDR_POLICY_REJECTED:
 144       return 0;
 145     default:
 146       log_warn(LD_BUG, "Unexpected result: %d", (int)p);
 147       return 0;
 148   }
 149 }
 150
 151 int
 152 fascist_firewall_allows_address_or(uint32_t addr, uint16_t port)
 153 {
 154   return addr_policy_permits_address(addr, port,
 155                                      reachable_or_addr_policy);
 156 }
 157
 158 int
 159 fascist_firewall_allows_address_dir(uint32_t addr, uint16_t port)
 160 {
 161   return addr_policy_permits_address(addr, port,
 162                                      reachable_dir_addr_policy);
 163 }
 164
 165 /** Return 1 if <b>addr</b> is permitted to connect to our dir port,
 166  * based on <b>dir_policy</b>. Else return 0.
 167  */
 168 int
 169 dir_policy_permits_address(uint32_t addr)
 170 {
 171   return addr_policy_permits_address(addr, 1, dir_policy);
 172 }
 173
 174 /** Return 1 if <b>addr</b> is permitted to connect to our socks port,
 175  * based on <b>socks_policy</b>. Else return 0.
 176  */
 177 int
 178 socks_policy_permits_address(uint32_t addr)
 179 {
 180   return addr_policy_permits_address(addr, 1, socks_policy);
 181 }
 182
 183 /** Return 1 if <b>addr</b>:<b>port</b> is permitted to publish to our
 184  * directory, based on <b>authdir_reject_policy</b>. Else return 0.
 185  */
 186 int
 187 authdir_policy_permits_address(uint32_t addr, uint16_t port)
 188 {
 189   return addr_policy_permits_address(addr, port, authdir_reject_policy);
 190 }
 191
 192 /** Return 1 if <b>addr</b>:<b>port</b> is considered valid in our
 193  * directory, based on <b>authdir_invalid_policy</b>. Else return 0.
 194  */
 195 int
 196 authdir_policy_valid_address(uint32_t addr, uint16_t port)
 197 {
 198   return addr_policy_permits_address(addr, port, authdir_invalid_policy);
 199 }
 200
 201 /** Return 1 if <b>addr</b>:<b>port</b> should be marked as a bad exit,
 202  * based on <b>authdir_badexit_policy</b>. Else return 0.
 203  */
 204 int
 205 authdir_policy_badexit_address(uint32_t addr, uint16_t port)
 206 {
 207   return ! addr_policy_permits_address(addr, port, authdir_badexit_policy);
 208 }
 209
 210 #define REJECT(arg) \
 211   do { *msg = tor_strdup(arg); goto err; } while (0)
 212 int
 213 validate_addr_policies(or_options_t *options, char **msg)
 214 {
 215   addr_policy_t *addr_policy=NULL;
 216   *msg = NULL;
 217
 218   if (policies_parse_exit_policy(options->ExitPolicy, &addr_policy,
 219                                  options->ExitPolicyRejectPrivate))
 220     REJECT("Error in ExitPolicy entry.");
 221
 222   /* The rest of these calls *append* to addr_policy. So don't actually
 223    * use the results for anything other than checking if they parse! */
 224   if (parse_addr_policy(options->DirPolicy, &addr_policy, -1))
 225     REJECT("Error in DirPolicy entry.");
 226   if (parse_addr_policy(options->SocksPolicy, &addr_policy, -1))
 227     REJECT("Error in SocksPolicy entry.");
 228   if (parse_addr_policy(options->ReachableAddresses, &addr_policy,
 229                         ADDR_POLICY_ACCEPT))
 230     REJECT("Error in ReachableAddresses entry.");
 231   if (parse_addr_policy(options->ReachableORAddresses, &addr_policy,
 232                         ADDR_POLICY_ACCEPT))
 233     REJECT("Error in ReachableORAddresses entry.");
 234   if (parse_addr_policy(options->ReachableDirAddresses, &addr_policy,
 235                         ADDR_POLICY_ACCEPT))
 236     REJECT("Error in ReachableDirAddresses entry.");
 237   if (parse_addr_policy(options->AuthDirReject, &addr_policy,
 238                         ADDR_POLICY_REJECT))
 239     REJECT("Error in AuthDirReject entry.");
 240   if (parse_addr_policy(options->AuthDirInvalid, &addr_policy,
 241                         ADDR_POLICY_REJECT))
 242     REJECT("Error in AuthDirInvalid entry.");
 243
 244 err:
 245   addr_policy_free(addr_policy);
 246   return *msg ? -1 : 0;
 247 #undef REJECT
 248 }
 249
 250 /* Parse <b>string</b> in the same way that the exit policy
 251  * is parsed, and put the processed version in *<b>policy</b>.
 252  * Ignore port specifiers.
 253  */
 254 static void
 255 load_policy_from_option(config_line_t *config, addr_policy_t **policy,
 256                         int assume_action)
 257 {
 258   addr_policy_t *n;
 259   addr_policy_free(*policy);
 260   *policy = NULL;
 261   parse_addr_policy(config, policy, assume_action);
 262   /* ports aren't used. */
 263   for (n=*policy; n; n = n->next) {
 264     n->prt_min = 1;
 265     n->prt_max = 65535;
 266   }
 267 }
 268
 269 void
 270 policies_parse_from_options(or_options_t *options)
 271 {
 272   load_policy_from_option(options->SocksPolicy, &socks_policy, -1);
 273   load_policy_from_option(options->DirPolicy, &dir_policy, -1);
 274   load_policy_from_option(options->AuthDirReject,
 275                           &authdir_reject_policy, ADDR_POLICY_REJECT);
 276   load_policy_from_option(options->AuthDirInvalid,
 277                           &authdir_invalid_policy, ADDR_POLICY_REJECT);
 278   load_policy_from_option(options->AuthDirBadExit,
 279                           &authdir_badexit_policy, ADDR_POLICY_REJECT);
 280   parse_reachable_addresses();
 281 }
 282
 283 /** Compare two provided address policy items, and return -1, 0, or 1
 284  * if the first is less than, equal to, or greater than the second. */
 285 static int
 286 cmp_single_addr_policy(addr_policy_t *a, addr_policy_t *b)
 287 {
 288   int r;
 289   if ((r=((int)a->policy_type - (int)b->policy_type)))
 290     return r;
 291   if ((r=((int)a->addr - (int)b->addr)))
 292     return r;
 293   if ((r=((int)a->msk - (int)b->msk)))
 294     return r;
 295   if ((r=((int)a->prt_min - (int)b->prt_min)))
 296     return r;
 297   if ((r=((int)a->prt_max - (int)b->prt_max)))
 298     return r;
 299   return 0;
 300 }
 301
 302 /** Like cmp_single_addr_policy() above, but looks at the
 303  * whole set of policies in each case. */
 304 int
 305 cmp_addr_policies(addr_policy_t *a, addr_policy_t *b)
 306 {
 307   int r;
 308   while (a && b) {
 309     if ((r=cmp_single_addr_policy(a,b)))
 310       return r;
 311     a = a->next;
 312     b = b->next;
 313   }
 314   if (!a && !b)
 315     return 0;
 316   if (a)
 317     return -1;
 318   else
 319     return 1;
 320 }
 321
 322 /** Decide whether a given addr:port is definitely accepted,
 323  * definitely rejected, probably accepted, or probably rejected by a
 324  * given policy.  If <b>addr</b> is 0, we don't know the IP of the
 325  * target address. If <b>port</b> is 0, we don't know the port of the
 326  * target address.
 327  *
 328  * For now, the algorithm is pretty simple: we look for definite and
 329  * uncertain matches.  The first definite match is what we guess; if
 330  * it was preceded by no uncertain matches of the opposite policy,
 331  * then the guess is definite; otherwise it is probable.  (If we
 332  * have a known addr and port, all matches are definite; if we have an
 333  * unknown addr/port, any address/port ranges other than "all" are
 334  * uncertain.)
 335  *
 336  * We could do better by assuming that some ranges never match typical
 337  * addresses (127.0.0.1, and so on).  But we'll try this for now.
 338  */
 339 addr_policy_result_t
 340 compare_addr_to_addr_policy(uint32_t addr, uint16_t port,
 341                             addr_policy_t *policy)
 342 {
 343   int maybe_reject = 0;
 344   int maybe_accept = 0;
 345   int match = 0;
 346   int maybe = 0;
 347   addr_policy_t *tmpe;
 348
 349   for (tmpe=policy; tmpe; tmpe=tmpe->next) {
 350     maybe = 0;
 351     if (!addr) {
 352       /* Address is unknown. */
 353       if ((port >= tmpe->prt_min && port <= tmpe->prt_max) ||
 354            (!port && tmpe->prt_min<=1 && tmpe->prt_max>=65535)) {
 355         /* The port definitely matches. */
 356         if (tmpe->msk == 0) {
 357           match = 1;
 358         } else {
 359           maybe = 1;
 360         }
 361       } else if (!port) {
 362         /* The port maybe matches. */
 363         maybe = 1;
 364       }
 365     } else {
 366       /* Address is known */
 367       if ((addr & tmpe->msk) == (tmpe->addr & tmpe->msk)) {
 368         if (port >= tmpe->prt_min && port <= tmpe->prt_max) {
 369           /* Exact match for the policy */
 370           match = 1;
 371         } else if (!port) {
 372           maybe = 1;
 373         }
 374       }
 375     }
 376     if (maybe) {
 377       if (tmpe->policy_type == ADDR_POLICY_REJECT)
 378         maybe_reject = 1;
 379       else
 380         maybe_accept = 1;
 381     }
 382     if (match) {
 383       if (tmpe->policy_type == ADDR_POLICY_ACCEPT) {
 384         /* If we already hit a clause that might trigger a 'reject', than we
 385          * can't be sure of this certain 'accept'.*/
 386         return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED :
 387                               ADDR_POLICY_ACCEPTED;
 388       } else {
 389         return maybe_accept ? ADDR_POLICY_PROBABLY_REJECTED :
 390                               ADDR_POLICY_REJECTED;
 391       }
 392     }
 393   }
 394   /* accept all by default. */
 395   return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED : ADDR_POLICY_ACCEPTED;
 396 }
 397
 398 /** Return true iff the address policy <b>a</b> covers every case that
 399  * would be covered by <b>b</b>, so that a,b is redundant. */
 400 static int
 401 addr_policy_covers(addr_policy_t *a, addr_policy_t *b)
 402 {
 403   /* We can ignore accept/reject, since "accept *:80, reject *:80" reduces
 404    * to "accept *:80". */
 405   if (a->msk & ~b->msk) {
 406     /* There's a wildcard bit in b->msk that's not a wildcard in a. */
 407     return 0;
 408   }
 409   if ((a->addr & a->msk) != (b->addr & a->msk)) {
 410     /* There's a fixed bit in a that's set differently in b. */
 411     return 0;
 412   }
 413   return (a->prt_min <= b->prt_min && a->prt_max >= b->prt_max);
 414 }
 415
 416 /** Return true iff the address policies <b>a</b> and <b>b</b> intersect,
 417  * that is, there exists an address/port that is covered by <b>a</b> that
 418  * is also covered by <b>b</b>.
 419  */
 420 static int
 421 addr_policy_intersects(addr_policy_t *a, addr_policy_t *b)
 422 {
 423   /* All the bits we care about are those that are set in both
 424    * netmasks.  If they are equal in a and b's networkaddresses
 425    * then the networks intersect.  If there is a difference,
 426    * then they do not. */
 427   if (((a->addr ^ b->addr) & a->msk & b->msk) != 0)
 428     return 0;
 429   if (a->prt_max < b->prt_min || b->prt_max < a->prt_min)
 430     return 0;
 431   return 1;
 432 }
 433
 434 /** Add the exit policy described by <b>more</b> to <b>policy</b>.
 435  */
 436 static void
 437 append_exit_policy_string(addr_policy_t **policy, const char *more)
 438 {
 439   config_line_t tmp;
 440
 441   tmp.key = NULL;
 442   tmp.value = (char*) more;
 443   tmp.next = NULL;
 444   parse_addr_policy(&tmp, policy, -1);
 445 }
 446
 447 /** Detect and excise "dead code" from the policy *<b>dest</b>. */
 448 static void
 449 exit_policy_remove_redundancies(addr_policy_t **dest)
 450 {
 451   addr_policy_t *ap, *tmp, *victim, *previous;
 452
 453   /* Step one: find a *:* entry and cut off everything after it. */
 454   for (ap=*dest; ap; ap=ap->next) {
 455     if (ap->msk == 0 && ap->prt_min <= 1 && ap->prt_max >= 65535) {
 456       /* This is a catch-all line -- later lines are unreachable. */
 457       if (ap->next) {
 458         addr_policy_free(ap->next);
 459         ap->next = NULL;
 460       }
 461     }
 462   }
 463
 464   /* Step two: for every entry, see if there's a redundant entry
 465    * later on, and remove it. */
 466   for (ap=*dest; ap; ap=ap->next) {
 467     tmp=ap;
 468     while (tmp) {
 469       if (tmp->next && addr_policy_covers(ap, tmp->next)) {
 470         log(LOG_DEBUG, LD_CONFIG, "Removing exit policy %s.  It is made "
 471             "redundant by %s.", tmp->next->string, ap->string);
 472         victim = tmp->next;
 473         tmp->next = victim->next;
 474         victim->next = NULL;
 475         addr_policy_free(victim);
 476       } else {
 477         tmp=tmp->next;
 478       }
 479     }
 480   }
 481
 482   /* Step three: for every entry A, see if there's an entry B making this one
 483    * redundant later on.  This is the case if A and B are of the same type
 484    * (accept/reject), A is a subset of B, and there is no other entry of
 485    * different type in between those two that intersects with A.
 486    *
 487    * Anybody want to doublecheck the logic here? XXX
 488    */
 489   ap = *dest;
 490   previous = NULL;
 491   while (ap) {
 492     for (tmp=ap->next; tmp; tmp=tmp->next) {
 493       if (ap->policy_type != tmp->policy_type &&
 494           addr_policy_intersects(ap, tmp)) {
 495         tmp = NULL; /* so that we advance previous and ap */
 496         break;
 497       }
 498       if (ap->policy_type == tmp->policy_type &&
 499           addr_policy_covers(tmp, ap)) {
 500         log(LOG_DEBUG, LD_CONFIG, "Removing exit policy %s.  It is already "
 501             "covered by %s.", ap->string, tmp->string);
 502         victim = ap;
 503         ap = ap->next;
 504
 505         if (previous) {
 506           assert(previous->next == victim);
 507           previous->next = victim->next;
 508         } else {
 509           assert(*dest == victim);
 510           *dest = victim->next;
 511         }
 512
 513         victim->next = NULL;
 514         addr_policy_free(victim);
 515         break;
 516       }
 517     }
 518     if (!tmp) {
 519       previous = ap;
 520       ap = ap->next;
 521     }
 522   }
 523 }
 524
 525 #define DEFAULT_EXIT_POLICY                                         \
 526   "reject *:25,reject *:119,reject *:135-139,reject *:445,"         \
 527   "reject *:465,reject *:563,reject *:587,"                         \
 528   "reject *:1214,reject *:4661-4666,"                               \
 529   "reject *:6346-6429,reject *:6699,reject *:6881-6999,accept *:*"
 530
 531 /** Parse the exit policy <b>cfg</b> into the linked list *<b>dest</b>. If
 532  * cfg doesn't end in an absolute accept or reject, add the default exit
 533  * policy afterwards. If <b>rejectprivate</b> is true, prepend
 534  * "reject private:*" to the policy. Return -1 if we can't parse cfg,
 535  * else return 0.
 536  */
 537 int
 538 policies_parse_exit_policy(config_line_t *cfg, addr_policy_t **dest,
 539                            int rejectprivate)
 540 {
 541   if (rejectprivate)
 542     append_exit_policy_string(dest, "reject private:*");
 543   if (parse_addr_policy(cfg, dest, -1))
 544     return -1;
 545   append_exit_policy_string(dest, DEFAULT_EXIT_POLICY);
 546
 547   exit_policy_remove_redundancies(dest);
 548   return 0;
 549 }
 550
 551 /** Return true iff <b>ri</b> is "useful as an exit node", meaning
 552  * it allows exit to at least one /8 address space for at least
 553  * two of ports 80, 443, and 6667. */
 554 int
 555 exit_policy_is_general_exit(addr_policy_t *policy)
 556 {
 557   static const int ports[] = { 80, 443, 6667 };
 558   int n_allowed = 0;
 559   int i;
 560   for (i = 0; i < 3; ++i) {
 561     struct addr_policy_t *p = policy;
 562     for ( ; p; p = p->next) {
 563       if (p->prt_min > ports[i] || p->prt_max < ports[i])
 564         continue; /* Doesn't cover our port. */
 565       if ((p->msk & 0x00fffffful) != 0)
 566         continue; /* Narrower than a /8. */
 567       if ((p->addr & 0xff000000ul) == 0x7f000000ul)
 568         continue; /* 127.x */
 569       /* We have a match that is at least a /8. */
 570       if (p->policy_type == ADDR_POLICY_ACCEPT) {
 571         ++n_allowed;
 572         break; /* stop considering this port */
 573       }
 574     }
 575   }
 576   return n_allowed >= 2;
 577 }
 578
 579 /** Return false if <b>policy</b> might permit access to some addr:port;
 580  * otherwise if we are certain it rejects everything, return true. */
 581 int
 582 policy_is_reject_star(addr_policy_t *p)
 583 {
 584   for ( ; p; p = p->next) {
 585     if (p->policy_type == ADDR_POLICY_ACCEPT)
 586       return 0;
 587     else if (p->policy_type == ADDR_POLICY_REJECT &&
 588              p->prt_min <= 1 && p->prt_max == 65535 &&
 589              p->msk == 0)
 590       return 1;
 591   }
 592   return 1;
 593 }
 594
 595 /** Write a single address policy to the buf_len byte buffer at buf.  Return
 596  * the number of characters written, or -1 on failure. */
 597 int
 598 policy_write_item(char *buf, size_t buflen, addr_policy_t *policy)
 599 {
 600   struct in_addr in;
 601   size_t written = 0;
 602   char addrbuf[INET_NTOA_BUF_LEN];
 603   int result;
 604
 605   in.s_addr = htonl(policy->addr);
 606   tor_inet_ntoa(&in, addrbuf, sizeof(addrbuf));
 607   /* write accept/reject 1.2.3.4 */
 608   result = tor_snprintf(buf, buflen, "%s %s",
 609             policy->policy_type == ADDR_POLICY_ACCEPT ? "accept" : "reject",
 610             policy->msk == 0 ? "*" : addrbuf);
 611   if (result < 0)
 612     return -1;
 613   written += strlen(buf);
 614   /* If the mask is 0xffffffff, we don't need to give it.  If the mask is 0,
 615    * we already wrote "*". */
 616   if (policy->msk != 0xFFFFFFFFu && policy->msk != 0) {
 617     int n_bits = addr_mask_get_bits(policy->msk);
 618     if (n_bits >= 0) {
 619       if (tor_snprintf(buf+written, buflen-written, "/%d", n_bits)<0)
 620         return -1;
 621     } else {
 622       /* Write "/255.255.0.0" */
 623       in.s_addr = htonl(policy->msk);
 624       tor_inet_ntoa(&in, addrbuf, sizeof(addrbuf));
 625       if (tor_snprintf(buf+written, buflen-written, "/%s", addrbuf)<0)
 626         return -1;
 627     }
 628     written += strlen(buf+written);
 629   }
 630   if (policy->prt_min <= 1 && policy->prt_max == 65535) {
 631     /* There is no port set; write ":*" */
 632     if (written+4 > buflen)
 633       return -1;
 634     strlcat(buf+written, ":*", buflen-written);
 635     written += 2;
 636   } else if (policy->prt_min == policy->prt_max) {
 637     /* There is only one port; write ":80". */
 638     result = tor_snprintf(buf+written, buflen-written, ":%d", policy->prt_min);
 639     if (result<0)
 640       return -1;
 641     written += result;
 642   } else {
 643     /* There is a range of ports; write ":79-80". */
 644     result = tor_snprintf(buf+written, buflen-written, ":%d-%d",
 645                           policy->prt_min, policy->prt_max);
 646     if (result<0)
 647       return -1;
 648     written += result;
 649   }
 650   if (written < buflen)
 651     buf[written] = '\0';
 652   else
 653     return -1;
 654
 655   return (int)written;
 656 }
 657
 658 int
 659 getinfo_helper_policies(control_connection_t *conn,
 660                         const char *question, char **answer)
 661 {
 662   (void) conn;
 663   if (!strcmp(question, "exit-policy/default")) {
 664     *answer = tor_strdup(DEFAULT_EXIT_POLICY);
 665   }
 666   return 0;
 667 }
 668
 669 /** Release all storage held by <b>p</b> */
 670 void
 671 addr_policy_free(addr_policy_t *p)
 672 {
 673   addr_policy_t *e;
 674
 675   while (p) {
 676     e = p;
 677     p = p->next;
 678     tor_free(e->string);
 679     tor_free(e);
 680   }
 681 }
 682
 683 void
 684 policies_free_all(void)
 685 {
 686   addr_policy_free(reachable_or_addr_policy);
 687   reachable_or_addr_policy = NULL;
 688   addr_policy_free(reachable_dir_addr_policy);
 689   reachable_dir_addr_policy = NULL;
 690   addr_policy_free(socks_policy);
 691   socks_policy = NULL;
 692   addr_policy_free(dir_policy);
 693   dir_policy = NULL;
 694   addr_policy_free(authdir_reject_policy);
 695   authdir_reject_policy = NULL;
 696   addr_policy_free(authdir_invalid_policy);
 697   authdir_invalid_policy = NULL;
 698 }
 699