src/common/address.c

   1 /* Copyright (c) 2003-2004, Roger Dingledine
   2  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
   3  * Copyright (c) 2007-2010, The Tor Project, Inc. */
   4 /* See LICENSE for licensing information */
   5
   6 /**
   7  * \file address.c
   8  * \brief Functions to use and manipulate the tor_addr_t structure.
   9  **/
  10
  11 #include "orconfig.h"
  12 #include "compat.h"
  13 #include "util.h"
  14 #include "address.h"
  15 #include "torlog.h"
  16
  17 #ifdef MS_WINDOWS
  18 #include <process.h>
  19 #include <windows.h>
  20 #endif
  21
  22 #ifdef HAVE_SYS_TIME_H
  23 #include <sys/time.h>
  24 #endif
  25 #ifdef HAVE_UNISTD_H
  26 #include <unistd.h>
  27 #endif
  28 #ifdef HAVE_ERRNO_H
  29 #include <errno.h>
  30 #endif
  31 #ifdef HAVE_NETINET_IN_H
  32 #include <netinet/in.h>
  33 #endif
  34 #ifdef HAVE_ARPA_INET_H
  35 #include <arpa/inet.h>
  36 #endif
  37 #ifdef HAVE_SYS_SOCKET_H
  38 #include <sys/socket.h>
  39 #endif
  40 #ifdef HAVE_NETDB_H
  41 #include <netdb.h>
  42 #endif
  43 #ifdef HAVE_SYS_PARAM_H
  44 #include <sys/param.h> /* FreeBSD needs this to know what version it is */
  45 #endif
  46 #include <stdarg.h>
  47 #include <stdio.h>
  48 #include <stdlib.h>
  49 #include <string.h>
  50 #include <assert.h>
  51
  52 /** Convert the tor_addr_t in <b>a</b>, with port in <b>port</b>, into a
  53  * socklen object in *<b>sa_out</b> of object size <b>len</b>.  If not enough
  54  * room is free, or on error, return -1.  Else return the length of the
  55  * sockaddr. */
  56 /* XXXX021 This returns socklen_t.  socklen_t is sometimes unsigned.  This
  57  *   function claims to return -1 sometimes.  Problematic! */
  58 socklen_t
  59 tor_addr_to_sockaddr(const tor_addr_t *a,
  60                      uint16_t port,
  61                      struct sockaddr *sa_out,
  62                      socklen_t len)
  63 {
  64   sa_family_t family = tor_addr_family(a);
  65   if (family == AF_INET) {
  66     struct sockaddr_in *sin;
  67     if (len < (int)sizeof(struct sockaddr_in))
  68       return -1;
  69     sin = (struct sockaddr_in *)sa_out;
  70     memset(sin, 0, sizeof(struct sockaddr_in));
  71 #ifdef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN
  72     sin->sin_len = sizeof(struct sockaddr_in);
  73 #endif
  74     sin->sin_family = AF_INET;
  75     sin->sin_port = htons(port);
  76     sin->sin_addr.s_addr = tor_addr_to_ipv4n(a);
  77     return sizeof(struct sockaddr_in);
  78   } else if (family == AF_INET6) {
  79     struct sockaddr_in6 *sin6;
  80     if (len < (int)sizeof(struct sockaddr_in6))
  81       return -1;
  82     sin6 = (struct sockaddr_in6 *)sa_out;
  83     memset(sin6, 0, sizeof(struct sockaddr_in6));
  84 #ifdef HAVE_STRUCT_SOCKADDR_IN6_SIN6_LEN
  85     sin6->sin6_len = sizeof(struct sockaddr_in6);
  86 #endif
  87     sin6->sin6_family = AF_INET6;
  88     sin6->sin6_port = htons(port);
  89     memcpy(&sin6->sin6_addr, tor_addr_to_in6(a), sizeof(struct in6_addr));
  90     return sizeof(struct sockaddr_in6);
  91   } else {
  92     return -1;
  93   }
  94 }
  95
  96 /** Set the tor_addr_t in <b>a</b> to contain the socket address contained in
  97  * <b>sa</b>. */
  98 int
  99 tor_addr_from_sockaddr(tor_addr_t *a, const struct sockaddr *sa,
 100                        uint16_t *port_out)
 101 {
 102   tor_assert(a);
 103   tor_assert(sa);
 104   if (sa->sa_family == AF_INET) {
 105     struct sockaddr_in *sin = (struct sockaddr_in *) sa;
 106     tor_addr_from_ipv4n(a, sin->sin_addr.s_addr);
 107     if (port_out)
 108       *port_out = ntohs(sin->sin_port);
 109   } else if (sa->sa_family == AF_INET6) {
 110     struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) sa;
 111     tor_addr_from_in6(a, &sin6->sin6_addr);
 112     if (port_out)
 113       *port_out = ntohs(sin6->sin6_port);
 114   } else {
 115     tor_addr_make_unspec(a);
 116     return -1;
 117   }
 118   return 0;
 119 }
 120
 121 /** Set address <b>a</b> to the unspecified address.  This address belongs to
 122  * no family. */
 123 void
 124 tor_addr_make_unspec(tor_addr_t *a)
 125 {
 126   memset(a, 0, sizeof(*a));
 127   a->family = AF_UNSPEC;
 128 }
 129
 130 /** Similar behavior to Unix gethostbyname: resolve <b>name</b>, and set
 131  * *<b>addr</b> to the proper IP address and family. The <b>family</b>
 132  * argument (which must be AF_INET, AF_INET6, or AF_UNSPEC) declares a
 133  * <i>preferred</i> family, though another one may be returned if only one
 134  * family is implemented for this address.
 135  *
 136  * Return 0 on success, -1 on failure; 1 on transient failure.
 137  */
 138 int
 139 tor_addr_lookup(const char *name, uint16_t family, tor_addr_t *addr)
 140 {
 141   /* Perhaps eventually this should be replaced by a tor_getaddrinfo or
 142    * something.
 143    */
 144   struct in_addr iaddr;
 145   struct in6_addr iaddr6;
 146   tor_assert(name);
 147   tor_assert(addr);
 148   tor_assert(family == AF_INET || family == AF_INET6 || family == AF_UNSPEC);
 149   if (!*name) {
 150     /* Empty address is an error. */
 151     return -1;
 152   } else if (tor_inet_pton(AF_INET, name, &iaddr)) {
 153     /* It's an IPv4 IP. */
 154     if (family == AF_INET6)
 155       return -1;
 156     tor_addr_from_in(addr, &iaddr);
 157     return 0;
 158   } else if (tor_inet_pton(AF_INET6, name, &iaddr6)) {
 159     if (family == AF_INET)
 160       return -1;
 161     tor_addr_from_in6(addr, &iaddr6);
 162     return 0;
 163   } else {
 164 #ifdef HAVE_GETADDRINFO
 165     int err;
 166     struct addrinfo *res=NULL, *res_p;
 167     struct addrinfo *best=NULL;
 168     struct addrinfo hints;
 169     int result = -1;
 170     memset(&hints, 0, sizeof(hints));
 171     hints.ai_family = family;
 172     hints.ai_socktype = SOCK_STREAM;
 173     err = getaddrinfo(name, NULL, &hints, &res);
 174     if (!err) {
 175       best = NULL;
 176       for (res_p = res; res_p; res_p = res_p->ai_next) {
 177         if (family == AF_UNSPEC) {
 178           if (res_p->ai_family == AF_INET) {
 179             best = res_p;
 180             break;
 181           } else if (res_p->ai_family == AF_INET6 && !best) {
 182             best = res_p;
 183           }
 184         } else if (family == res_p->ai_family) {
 185           best = res_p;
 186           break;
 187         }
 188       }
 189       if (!best)
 190         best = res;
 191       if (best->ai_family == AF_INET) {
 192         tor_addr_from_in(addr,
 193                          &((struct sockaddr_in*)best->ai_addr)->sin_addr);
 194         result = 0;
 195       } else if (best->ai_family == AF_INET6) {
 196         tor_addr_from_in6(addr,
 197                           &((struct sockaddr_in6*)best->ai_addr)->sin6_addr);
 198         result = 0;
 199       }
 200       freeaddrinfo(res);
 201       return result;
 202     }
 203     return (err == EAI_AGAIN) ? 1 : -1;
 204 #else
 205     struct hostent *ent;
 206     int err;
 207 #ifdef HAVE_GETHOSTBYNAME_R_6_ARG
 208     char buf[2048];
 209     struct hostent hostent;
 210     int r;
 211     r = gethostbyname_r(name, &hostent, buf, sizeof(buf), &ent, &err);
 212 #elif defined(HAVE_GETHOSTBYNAME_R_5_ARG)
 213     char buf[2048];
 214     struct hostent hostent;
 215     ent = gethostbyname_r(name, &hostent, buf, sizeof(buf), &err);
 216 #elif defined(HAVE_GETHOSTBYNAME_R_3_ARG)
 217     struct hostent_data data;
 218     struct hostent hent;
 219     memset(&data, 0, sizeof(data));
 220     err = gethostbyname_r(name, &hent, &data);
 221     ent = err ? NULL : &hent;
 222 #else
 223     ent = gethostbyname(name);
 224 #ifdef MS_WINDOWS
 225     err = WSAGetLastError();
 226 #else
 227     err = h_errno;
 228 #endif
 229 #endif /* endif HAVE_GETHOSTBYNAME_R_6_ARG. */
 230     if (ent) {
 231       if (ent->h_addrtype == AF_INET) {
 232         tor_addr_from_in(addr, (struct in_addr*) ent->h_addr);
 233       } else if (ent->h_addrtype == AF_INET6) {
 234         tor_addr_from_in6(addr, (struct in6_addr*) ent->h_addr);
 235       } else {
 236         tor_assert(0); /* gethostbyname() returned a bizarre addrtype */
 237       }
 238       return 0;
 239     }
 240 #ifdef MS_WINDOWS
 241     return (err == WSATRY_AGAIN) ? 1 : -1;
 242 #else
 243     return (err == TRY_AGAIN) ? 1 : -1;
 244 #endif
 245 #endif
 246   }
 247 }
 248
 249 /** Return true iff <b>ip</b> is an IP reserved to localhost or local networks
 250  * in RFC1918 or RFC4193 or RFC4291. (fec0::/10, deprecated by RFC3879, is
 251  * also treated as internal for now.)
 252  */
 253 int
 254 tor_addr_is_internal(const tor_addr_t *addr, int for_listening)
 255 {
 256   uint32_t iph4 = 0;
 257   uint32_t iph6[4];
 258   sa_family_t v_family;
 259   v_family = tor_addr_family(addr);
 260
 261   if (v_family == AF_INET) {
 262     iph4 = tor_addr_to_ipv4h(addr);
 263   } else if (v_family == AF_INET6) {
 264     if (tor_addr_is_v4(addr)) { /* v4-mapped */
 265       v_family = AF_INET;
 266       iph4 = ntohl(tor_addr_to_in6_addr32(addr)[3]);
 267     }
 268   }
 269
 270   if (v_family == AF_INET6) {
 271     const uint32_t *a32 = tor_addr_to_in6_addr32(addr);
 272     iph6[0] = ntohl(a32[0]);
 273     iph6[1] = ntohl(a32[1]);
 274     iph6[2] = ntohl(a32[2]);
 275     iph6[3] = ntohl(a32[3]);
 276     if (for_listening && !iph6[0] && !iph6[1] && !iph6[2] && !iph6[3]) /* :: */
 277       return 0;
 278
 279     if (((iph6[0] & 0xfe000000) == 0xfc000000) || /* fc00/7  - RFC4193 */
 280         ((iph6[0] & 0xffc00000) == 0xfe800000) || /* fe80/10 - RFC4291 */
 281         ((iph6[0] & 0xffc00000) == 0xfec00000))   /* fec0/10 D- RFC3879 */
 282       return 1;
 283
 284     if (!iph6[0] && !iph6[1] && !iph6[2] &&
 285         ((iph6[3] & 0xfffffffe) == 0x00000000))  /* ::/127 */
 286       return 1;
 287
 288     return 0;
 289   } else if (v_family == AF_INET) {
 290     if (for_listening && !iph4) /* special case for binding to 0.0.0.0 */
 291       return 0;
 292     if (((iph4 & 0xff000000) == 0x0a000000) || /*       10/8 */
 293         ((iph4 & 0xff000000) == 0x00000000) || /*        0/8 */
 294         ((iph4 & 0xff000000) == 0x7f000000) || /*      127/8 */
 295         ((iph4 & 0xffff0000) == 0xa9fe0000) || /* 169.254/16 */
 296         ((iph4 & 0xfff00000) == 0xac100000) || /*  172.16/12 */
 297         ((iph4 & 0xffff0000) == 0xc0a80000))   /* 192.168/16 */
 298       return 1;
 299     return 0;
 300   }
 301
 302   /* unknown address family... assume it's not safe for external use */
 303   /* rather than tor_assert(0) */
 304   log_warn(LD_BUG, "tor_addr_is_internal() called with a non-IP address.");
 305   return 1;
 306 }
 307
 308 /** Convert a tor_addr_t <b>addr</b> into a string, and store it in
 309  *  <b>dest</b> of size <b>len</b>.  Returns a pointer to dest on success,
 310  *  or NULL on failure.  If <b>decorate</b>, surround IPv6 addresses with
 311  *  brackets.
 312  */
 313 const char *
 314 tor_addr_to_str(char *dest, const tor_addr_t *addr, int len, int decorate)
 315 {
 316   const char *ptr;
 317   tor_assert(addr && dest);
 318
 319   switch (tor_addr_family(addr)) {
 320     case AF_INET:
 321       if (len<3)
 322         return NULL;
 323         ptr = tor_inet_ntop(AF_INET, &addr->addr.in_addr, dest, len);
 324       break;
 325     case AF_INET6:
 326       if (decorate)
 327         ptr = tor_inet_ntop(AF_INET6, &addr->addr.in6_addr, dest+1, len-2);
 328       else
 329         ptr = tor_inet_ntop(AF_INET6, &addr->addr.in6_addr, dest, len);
 330       if (ptr && decorate) {
 331         *dest = '[';
 332         memcpy(dest+strlen(dest), "]", 2);
 333         tor_assert(ptr == dest+1);
 334         ptr = dest;
 335       }
 336       break;
 337     default:
 338       return NULL;
 339   }
 340   return ptr;
 341 }
 342
 343 /** Parse an .in-addr.arpa or .ip6.arpa address from <b>address</b>.  Return 0
 344  * if this is not an .in-addr.arpa address or an .ip6.arpa address.  Return -1
 345  * if this is an ill-formed .in-addr.arpa address or an .ip6.arpa address.
 346  * Also return -1 if <b>family</b> is not AF_UNSPEC, and the parsed address
 347  * family does not match <b>family</b>.  On success, return 1, and store the
 348  * result, if any, into <b>result</b>, if provided.
 349  *
 350  * If <b>accept_regular</b> is set and the address is in neither recognized
 351  * reverse lookup hostname format, try parsing the address as a regular
 352  * IPv4 or IPv6 address too.
 353  */
 354 int
 355 tor_addr_parse_reverse_lookup_name(tor_addr_t *result, const char *address,
 356                                    int family, int accept_regular)
 357 {
 358   if (!strcasecmpend(address, ".in-addr.arpa")) {
 359     /* We have an in-addr.arpa address. */
 360     char buf[INET_NTOA_BUF_LEN];
 361     size_t len;
 362     struct in_addr inaddr;
 363     if (family == AF_INET6)
 364       return -1;
 365
 366     len = strlen(address) - strlen(".in-addr.arpa");
 367     if (len >= INET_NTOA_BUF_LEN)
 368       return -1; /* Too long. */
 369
 370     memcpy(buf, address, len);
 371     buf[len] = '\0';
 372     if (tor_inet_aton(buf, &inaddr) == 0)
 373       return -1; /* malformed. */
 374
 375     /* reverse the bytes */
 376     inaddr.s_addr = (uint32_t)
 377       (((inaddr.s_addr & 0x000000ff) << 24)
 378        |((inaddr.s_addr & 0x0000ff00) << 8)
 379        |((inaddr.s_addr & 0x00ff0000) >> 8)
 380        |((inaddr.s_addr & 0xff000000) >> 24));
 381
 382     if (result) {
 383       tor_addr_from_in(result, &inaddr);
 384     }
 385     return 1;
 386   }
 387
 388   if (!strcasecmpend(address, ".ip6.arpa")) {
 389     const char *cp;
 390     int i;
 391     int n0, n1;
 392     struct in6_addr in6;
 393
 394     if (family == AF_INET)
 395       return -1;
 396
 397     cp = address;
 398     for (i = 0; i < 16; ++i) {
 399       n0 = hex_decode_digit(*cp++); /* The low-order nybble appears first. */
 400       if (*cp++ != '.') return -1;  /* Then a dot. */
 401       n1 = hex_decode_digit(*cp++); /* The high-order nybble appears first. */
 402       if (*cp++ != '.') return -1;  /* Then another dot. */
 403       if (n0<0 || n1 < 0) /* Both nybbles must be hex. */
 404         return -1;
 405
 406       /* We don't check the length of the string in here.  But that's okay,
 407        * since we already know that the string ends with ".ip6.arpa", and
 408        * there is no way to frameshift .ip6.arpa so it fits into the pattern
 409        * of hexdigit, period, hexdigit, period that we enforce above.
 410        */
 411
 412       /* Assign from low-byte to high-byte. */
 413       in6.s6_addr[15-i] = n0 | (n1 << 4);
 414     }
 415     if (strcasecmp(cp, "ip6.arpa"))
 416       return -1;
 417
 418     if (result) {
 419       tor_addr_from_in6(result, &in6);
 420     }
 421     return 1;
 422   }
 423
 424   if (accept_regular) {
 425     tor_addr_t tmp;
 426     int r = tor_addr_from_str(&tmp, address);
 427     if (r < 0)
 428       return 0;
 429     if (r != family && family != AF_UNSPEC)
 430       return -1;
 431
 432     if (result)
 433       memcpy(result, &tmp, sizeof(tor_addr_t));
 434
 435     return 1;
 436   }
 437
 438   return 0;
 439 }
 440
 441 /** Convert <b>addr</b> to an in-addr.arpa name or a .ip6.arpa name, and store
 442  * the result in the <b>outlen</b>-byte buffer at <b>out</b>.  Return 0 on
 443  * success, -1 on failure. */
 444 int
 445 tor_addr_to_reverse_lookup_name(char *out, size_t outlen,
 446                                 const tor_addr_t *addr)
 447 {
 448   if (addr->family == AF_INET) {
 449     uint32_t a = tor_addr_to_ipv4h(addr);
 450
 451     return tor_snprintf(out, outlen, "%d.%d.%d.%d.in-addr.arpa",
 452                         (int)(uint8_t)((a    )&0xff),
 453                         (int)(uint8_t)((a>>8 )&0xff),
 454                         (int)(uint8_t)((a>>16)&0xff),
 455                         (int)(uint8_t)((a>>24)&0xff));
 456   } else if (addr->family == AF_INET6) {
 457     int i;
 458     char *cp = out;
 459     const uint8_t *bytes = tor_addr_to_in6_addr8(addr);
 460     if (outlen < REVERSE_LOOKUP_NAME_BUF_LEN)
 461       return -1;
 462     for (i = 15; i >= 0; --i) {
 463       uint8_t byte = bytes[i];
 464       *cp++ = "0123456789abcdef"[byte & 0x0f];
 465       *cp++ = '.';
 466       *cp++ = "0123456789abcdef"[byte >> 4];
 467       *cp++ = '.';
 468     }
 469     memcpy(cp, "ip6.arpa", 9); /* 8 characters plus NUL */
 470     return 0;
 471   }
 472   return -1;
 473 }
 474
 475 /** Parse a string <b>s</b> containing an IPv4/IPv6 address, and possibly
 476  *  a mask and port or port range.  Store the parsed address in
 477  *  <b>addr_out</b>, a mask (if any) in <b>mask_out</b>, and port(s) (if any)
 478  *  in <b>port_min_out</b> and <b>port_max_out</b>.
 479  *
 480  * The syntax is:
 481  *   Address OptMask OptPortRange
 482  *   Address ::= IPv4Address / "[" IPv6Address "]" / "*"
 483  *   OptMask ::= "/" Integer /
 484  *   OptPortRange ::= ":*" / ":" Integer / ":" Integer "-" Integer /
 485  *
 486  *  - If mask, minport, or maxport are NULL, we do not want these
 487  *    options to be set; treat them as an error if present.
 488  *  - If the string has no mask, the mask is set to /32 (IPv4) or /128 (IPv6).
 489  *  - If the string has one port, it is placed in both min and max port
 490  *    variables.
 491  *  - If the string has no port(s), port_(min|max)_out are set to 1 and 65535.
 492  *
 493  *  Return an address family on success, or -1 if an invalid address string is
 494  *  provided.
 495  */
 496 int
 497 tor_addr_parse_mask_ports(const char *s, tor_addr_t *addr_out,
 498                           maskbits_t *maskbits_out,
 499                           uint16_t *port_min_out, uint16_t *port_max_out)
 500 {
 501   char *base = NULL, *address, *mask = NULL, *port = NULL, *rbracket = NULL;
 502   char *endptr;
 503   int any_flag=0, v4map=0;
 504   sa_family_t family;
 505   struct in6_addr in6_tmp;
 506   struct in_addr in_tmp;
 507
 508   tor_assert(s);
 509   tor_assert(addr_out);
 510
 511   /* IP, [], /mask, ports */
 512 #define MAX_ADDRESS_LENGTH (TOR_ADDR_BUF_LEN+2+(1+INET_NTOA_BUF_LEN)+12+1)
 513
 514   if (strlen(s) > MAX_ADDRESS_LENGTH) {
 515     log_warn(LD_GENERAL, "Impossibly long IP %s; rejecting", escaped(s));
 516     goto err;
 517   }
 518   base = tor_strdup(s);
 519
 520   /* Break 'base' into separate strings. */
 521   address = base;
 522   if (*address == '[') {  /* Probably IPv6 */
 523     address++;
 524     rbracket = strchr(address, ']');
 525     if (!rbracket) {
 526       log_warn(LD_GENERAL,
 527                "No closing IPv6 bracket in address pattern; rejecting.");
 528       goto err;
 529     }
 530   }
 531   mask = strchr((rbracket?rbracket:address),'/');
 532   port = strchr((mask?mask:(rbracket?rbracket:address)), ':');
 533   if (port)
 534     *port++ = '\0';
 535   if (mask)
 536     *mask++ = '\0';
 537   if (rbracket)
 538     *rbracket = '\0';
 539   if (port && mask)
 540     tor_assert(port > mask);
 541   if (mask && rbracket)
 542     tor_assert(mask > rbracket);
 543
 544   /* Now "address" is the a.b.c.d|'*'|abcd::1 part...
 545    *     "mask" is the Mask|Maskbits part...
 546    * and "port" is the *|port|min-max part.
 547    */
 548
 549   /* Process the address portion */
 550   memset(addr_out, 0, sizeof(tor_addr_t));
 551
 552   if (!strcmp(address, "*")) {
 553     family = AF_INET; /* AF_UNSPEC ???? XXXX_IP6 */
 554     tor_addr_from_ipv4h(addr_out, 0);
 555     any_flag = 1;
 556   } else if (tor_inet_pton(AF_INET6, address, &in6_tmp) > 0) {
 557     family = AF_INET6;
 558     tor_addr_from_in6(addr_out, &in6_tmp);
 559   } else if (tor_inet_pton(AF_INET, address, &in_tmp) > 0) {
 560     family = AF_INET;
 561     tor_addr_from_in(addr_out, &in_tmp);
 562   } else {
 563     log_warn(LD_GENERAL, "Malformed IP %s in address pattern; rejecting.",
 564              escaped(address));
 565     goto err;
 566   }
 567
 568   v4map = tor_addr_is_v4(addr_out);
 569
 570   /* Parse mask */
 571   if (maskbits_out) {
 572     int bits = 0;
 573     struct in_addr v4mask;
 574
 575     if (mask) {  /* the caller (tried to) specify a mask */
 576       bits = (int) strtol(mask, &endptr, 10);
 577       if (!*endptr) {  /* strtol converted everything, so it was an integer */
 578         if ((bits<0 || bits>128) ||
 579             (family == AF_INET && bits > 32)) {
 580           log_warn(LD_GENERAL,
 581                    "Bad number of mask bits (%d) on address range; rejecting.",
 582                    bits);
 583           goto err;
 584         }
 585       } else {  /* mask might still be an address-style mask */
 586         if (tor_inet_pton(AF_INET, mask, &v4mask) > 0) {
 587           bits = addr_mask_get_bits(ntohl(v4mask.s_addr));
 588           if (bits < 0) {
 589             log_warn(LD_GENERAL,
 590                      "IPv4-style mask %s is not a prefix address; rejecting.",
 591                      escaped(mask));
 592             goto err;
 593           }
 594         } else { /* Not IPv4; we don't do address-style IPv6 masks. */
 595           log_warn(LD_GENERAL,
 596                    "Malformed mask on address range %s; rejecting.",
 597                    escaped(s));
 598           goto err;
 599         }
 600       }
 601       if (family == AF_INET6 && v4map) {
 602         if (bits > 32 && bits < 96) { /* Crazy */
 603           log_warn(LD_GENERAL,
 604                    "Bad mask bits %i for V4-mapped V6 address; rejecting.",
 605                    bits);
 606           goto err;
 607         }
 608         /* XXXX_IP6 is this really what we want? */
 609         bits = 96 + bits%32; /* map v4-mapped masks onto 96-128 bits */
 610       }
 611     } else { /* pick an appropriate mask, as none was given */
 612       if (any_flag)
 613         bits = 0;  /* This is okay whether it's V6 or V4 (FIX V4-mapped V6!) */
 614       else if (tor_addr_family(addr_out) == AF_INET)
 615         bits = 32;
 616       else if (tor_addr_family(addr_out) == AF_INET6)
 617         bits = 128;
 618     }
 619     *maskbits_out = (maskbits_t) bits;
 620   } else {
 621     if (mask) {
 622       log_warn(LD_GENERAL,
 623                "Unexpected mask in address %s; rejecting", escaped(s));
 624       goto err;
 625     }
 626   }
 627
 628   /* Parse port(s) */
 629   if (port_min_out) {
 630     uint16_t port2;
 631     if (!port_max_out) /* caller specified one port; fake the second one */
 632       port_max_out = &port2;
 633
 634     if (parse_port_range(port, port_min_out, port_max_out) < 0) {
 635       goto err;
 636     } else if ((*port_min_out != *port_max_out) && port_max_out == &port2) {
 637       log_warn(LD_GENERAL,
 638                "Wanted one port from address range, but there are two.");
 639
 640       port_max_out = NULL;  /* caller specified one port, so set this back */
 641       goto err;
 642     }
 643   } else {
 644     if (port) {
 645       log_warn(LD_GENERAL,
 646                "Unexpected ports in address %s; rejecting", escaped(s));
 647       goto err;
 648     }
 649   }
 650
 651   tor_free(base);
 652   return tor_addr_family(addr_out);
 653  err:
 654   tor_free(base);
 655   return -1;
 656 }
 657
 658 /** Determine whether an address is IPv4, either native or IPv4-mapped IPv6.
 659  * Note that this is about representation only, as any decent stack will
 660  * reject IPv4-mapped addresses received on the wire (and won't use them
 661  * on the wire either).
 662  */
 663 int
 664 tor_addr_is_v4(const tor_addr_t *addr)
 665 {
 666   tor_assert(addr);
 667
 668   if (tor_addr_family(addr) == AF_INET)
 669     return 1;
 670
 671   if (tor_addr_family(addr) == AF_INET6) {
 672     /* First two don't need to be ordered */
 673     uint32_t *a32 = tor_addr_to_in6_addr32(addr);
 674     if (a32[0] == 0 && a32[1] == 0 && ntohl(a32[2]) == 0x0000ffffu)
 675       return 1;
 676   }
 677
 678   return 0; /* Not IPv4 - unknown family or a full-blood IPv6 address */
 679 }
 680
 681 /** Determine whether an address <b>addr</b> is null, either all zeroes or
 682  *  belonging to family AF_UNSPEC.
 683  */
 684 int
 685 tor_addr_is_null(const tor_addr_t *addr)
 686 {
 687   tor_assert(addr);
 688
 689   switch (tor_addr_family(addr)) {
 690     case AF_INET6: {
 691       uint32_t *a32 = tor_addr_to_in6_addr32(addr);
 692       return (a32[0] == 0) && (a32[1] == 0) && (a32[2] == 0) && (a32[3] == 0);
 693     }
 694     case AF_INET:
 695       return (tor_addr_to_ipv4n(addr) == 0);
 696     case AF_UNSPEC:
 697       return 1;
 698     default:
 699       log_warn(LD_BUG, "Called with unknown address family %d",
 700                (int)tor_addr_family(addr));
 701       return 0;
 702   }
 703   //return 1;
 704 }
 705
 706 /** Return true iff <b>addr</b> is a loopback address */
 707 int
 708 tor_addr_is_loopback(const tor_addr_t *addr)
 709 {
 710   tor_assert(addr);
 711   switch (tor_addr_family(addr)) {
 712     case AF_INET6: {
 713       /* ::1 */
 714       uint32_t *a32 = tor_addr_to_in6_addr32(addr);
 715       return (a32[0] == 0) && (a32[1] == 0) && (a32[2] == 0) && (a32[3] == 1);
 716     }
 717     case AF_INET:
 718       /* 127.0.0.1 */
 719       return (tor_addr_to_ipv4h(addr) & 0xff000000) == 0x7f000000;
 720     case AF_UNSPEC:
 721       return 0;
 722     default:
 723       tor_fragile_assert();
 724       return 0;
 725   }
 726 }
 727
 728 /** Set <b>dest</b> to equal the IPv4 address in <b>v4addr</b> (given in
 729  * network order). */
 730 void
 731 tor_addr_from_ipv4n(tor_addr_t *dest, uint32_t v4addr)
 732 {
 733   tor_assert(dest);
 734   memset(dest, 0, sizeof(tor_addr_t));
 735   dest->family = AF_INET;
 736   dest->addr.in_addr.s_addr = v4addr;
 737 }
 738
 739 /** Set <b>dest</b> to equal the IPv6 address in the 16 bytes at
 740  * <b>ipv6_bytes</b>. */
 741 void
 742 tor_addr_from_ipv6_bytes(tor_addr_t *dest, const char *ipv6_bytes)
 743 {
 744   tor_assert(dest);
 745   tor_assert(ipv6_bytes);
 746   memset(dest, 0, sizeof(tor_addr_t));
 747   dest->family = AF_INET6;
 748   memcpy(dest->addr.in6_addr.s6_addr, ipv6_bytes, 16);
 749 }
 750
 751 /** Set <b>dest</b> equal to the IPv6 address in the in6_addr <b>in6</b>. */
 752 void
 753 tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6)
 754 {
 755   tor_addr_from_ipv6_bytes(dest, (const char*)in6->s6_addr);
 756 }
 757
 758 /** Copy a tor_addr_t from <b>src</b> to <b>dest</b>.
 759  */
 760 void
 761 tor_addr_copy(tor_addr_t *dest, const tor_addr_t *src)
 762 {
 763   if (src == dest)
 764     return;
 765   tor_assert(src);
 766   tor_assert(dest);
 767   memcpy(dest, src, sizeof(tor_addr_t));
 768 }
 769
 770 /** Given two addresses <b>addr1</b> and <b>addr2</b>, return 0 if the two
 771  * addresses are equivalent under the mask mbits, less than 0 if addr1
 772  * precedes addr2, and greater than 0 otherwise.
 773  *
 774  * Different address families (IPv4 vs IPv6) are always considered unequal if
 775  * <b>how</b> is CMP_EXACT; otherwise, IPv6-mapped IPv4 addresses are
 776  * considered equivalent to their IPv4 equivalents.
 777  */
 778 int
 779 tor_addr_compare(const tor_addr_t *addr1, const tor_addr_t *addr2,
 780                  tor_addr_comparison_t how)
 781 {
 782   return tor_addr_compare_masked(addr1, addr2, 128, how);
 783 }
 784
 785 /** As tor_addr_compare(), but only looks at the first <b>mask</b> bits of
 786  * the address.
 787  *
 788  * Reduce over-specific masks (>128 for ipv6, >32 for ipv4) to 128 or 32.
 789  *
 790  * The mask is interpreted relative to <b>addr1</b>, so that if a is
 791  * ::ffff:1.2.3.4, and b is 3.4.5.6,
 792  * tor_addr_compare_masked(a,b,100,CMP_SEMANTIC) is the same as
 793  * -tor_addr_compare_masked(b,a,4,CMP_SEMANTIC).
 794  *
 795  * We guarantee that the ordering from tor_addr_compare_masked is a total
 796  * order on addresses, but not that it is any particular order, or that it
 797  * will be the same from one version to the next.
 798  */
 799 int
 800 tor_addr_compare_masked(const tor_addr_t *addr1, const tor_addr_t *addr2,
 801                         maskbits_t mbits, tor_addr_comparison_t how)
 802 {
 803 #define TRISTATE(a,b) (((a)<(b))?-1: (((a)==(b))?0:1))
 804   sa_family_t family1, family2, v_family1, v_family2;
 805
 806   tor_assert(addr1 && addr2);
 807
 808   v_family1 = family1 = tor_addr_family(addr1);
 809   v_family2 = family2 = tor_addr_family(addr2);
 810
 811   if (family1==family2) {
 812     /* When the families are the same, there's only one way to do the
 813      * comparison: exactly. */
 814     int r;
 815     switch (family1) {
 816       case AF_UNSPEC:
 817         return 0; /* All unspecified addresses are equal */
 818       case AF_INET: {
 819         uint32_t a1 = tor_addr_to_ipv4h(addr1);
 820         uint32_t a2 = tor_addr_to_ipv4h(addr2);
 821         if (mbits <= 0)
 822           return 0;
 823         if (mbits > 32)
 824           mbits = 32;
 825         a1 >>= (32-mbits);
 826         a2 >>= (32-mbits);
 827         r = TRISTATE(a1, a2);
 828         return r;
 829       }
 830       case AF_INET6: {
 831         const uint8_t *a1 = tor_addr_to_in6_addr8(addr1);
 832         const uint8_t *a2 = tor_addr_to_in6_addr8(addr2);
 833         const int bytes = mbits >> 3;
 834         const int leftover_bits = mbits & 7;
 835         if (bytes && (r = memcmp(a1, a2, bytes))) {
 836           return r;
 837         } else if (leftover_bits) {
 838           uint8_t b1 = a1[bytes] >> (8-leftover_bits);
 839           uint8_t b2 = a2[bytes] >> (8-leftover_bits);
 840           return TRISTATE(b1, b2);
 841         } else {
 842           return 0;
 843         }
 844       }
 845       default:
 846         tor_fragile_assert();
 847         return 0;
 848     }
 849   } else if (how == CMP_EXACT) {
 850     /* Unequal families and an exact comparison?  Stop now! */
 851     return TRISTATE(family1, family2);
 852   }
 853
 854   if (mbits == 0)
 855     return 0;
 856
 857   if (family1 == AF_INET6 && tor_addr_is_v4(addr1))
 858     v_family1 = AF_INET;
 859   if (family2 == AF_INET6 && tor_addr_is_v4(addr2))
 860     v_family2 = AF_INET;
 861   if (v_family1 == v_family2) {
 862     /* One or both addresses are a mapped ipv4 address. */
 863     uint32_t a1, a2;
 864     if (family1 == AF_INET6) {
 865       a1 = tor_addr_to_mapped_ipv4h(addr1);
 866       if (mbits <= 96)
 867         return 0;
 868       mbits -= 96; /* We just decided that the first 96 bits of a1 "match". */
 869     } else {
 870       a1 = tor_addr_to_ipv4h(addr1);
 871     }
 872     if (family2 == AF_INET6) {
 873       a2 = tor_addr_to_mapped_ipv4h(addr2);
 874     } else {
 875       a2 = tor_addr_to_ipv4h(addr2);
 876     }
 877     if (mbits <= 0) return 0;
 878     if (mbits > 32) mbits = 32;
 879     a1 >>= (32-mbits);
 880     a2 >>= (32-mbits);
 881     return TRISTATE(a1, a2);
 882   } else {
 883     /* Unequal families, and semantic comparison, and no semantic family
 884      * matches. */
 885     return TRISTATE(family1, family2);
 886   }
 887 }
 888
 889 /** Return a hash code based on the address addr */
 890 unsigned int
 891 tor_addr_hash(const tor_addr_t *addr)
 892 {
 893   switch (tor_addr_family(addr)) {
 894   case AF_INET:
 895     return tor_addr_to_ipv4h(addr);
 896   case AF_UNSPEC:
 897     return 0x4e4d5342;
 898   case AF_INET6: {
 899     const uint32_t *u = tor_addr_to_in6_addr32(addr);
 900     return u[0] + u[1] + u[2] + u[3];
 901     }
 902   default:
 903     tor_fragile_assert();
 904     return 0;
 905   }
 906 }
 907
 908 /** Return a newly allocated string with a representation of <b>addr</b>. */
 909 char *
 910 tor_dup_addr(const tor_addr_t *addr)
 911 {
 912   char buf[TOR_ADDR_BUF_LEN];
 913   tor_addr_to_str(buf, addr, sizeof(buf), 0);
 914   return tor_strdup(buf);
 915 }
 916
 917 /** Return a string representing the address <b>addr</b>.  This string is
 918  * statically allocated, and must not be freed.  Each call to
 919  * <b>fmt_addr</b> invalidates the last result of the function.  This
 920  * function is not thread-safe. */
 921 const char *
 922 fmt_addr(const tor_addr_t *addr)
 923 {
 924   static char buf[TOR_ADDR_BUF_LEN];
 925   if (!addr) return "<null>";
 926   tor_addr_to_str(buf, addr, sizeof(buf), 0);
 927   return buf;
 928 }
 929
 930 /** Convert the string in <b>src</b> to a tor_addr_t <b>addr</b>.  The string
 931  * may be an IPv4 address, an IPv6 address, or an IPv6 address surrounded by
 932  * square brackets.
 933  *
 934  *  Return an address family on success, or -1 if an invalid address string is
 935  *  provided. */
 936 int
 937 tor_addr_from_str(tor_addr_t *addr, const char *src)
 938 {
 939   char *tmp = NULL; /* Holds substring if we got a dotted quad. */
 940   int result;
 941   struct in_addr in_tmp;
 942   struct in6_addr in6_tmp;
 943   tor_assert(addr && src);
 944   if (src[0] == '[' && src[1])
 945     src = tmp = tor_strndup(src+1, strlen(src)-2);
 946
 947   if (tor_inet_pton(AF_INET6, src, &in6_tmp) > 0) {
 948     result = AF_INET6;
 949     tor_addr_from_in6(addr, &in6_tmp);
 950   } else if (tor_inet_pton(AF_INET, src, &in_tmp) > 0) {
 951     result = AF_INET;
 952     tor_addr_from_in(addr, &in_tmp);
 953   } else {
 954     result = -1;
 955   }
 956
 957   tor_free(tmp);
 958   return result;
 959 }
 960
 961 /** Parse an address or address-port combination from <b>s</b>, resolve the
 962  * address as needed, and put the result in <b>addr_out</b> and (optionally)
 963  * <b>port_out</b>.  Return 0 on success, negative on failure. */
 964 int
 965 tor_addr_port_parse(const char *s, tor_addr_t *addr_out, uint16_t *port_out)
 966 {
 967   const char *port;
 968   tor_addr_t addr;
 969   uint16_t portval;
 970   char *tmp = NULL;
 971
 972   tor_assert(s);
 973   tor_assert(addr_out);
 974
 975   s = eat_whitespace(s);
 976
 977   if (*s == '[') {
 978     port = strstr(s, "]");
 979     if (!port)
 980       goto err;
 981     tmp = tor_strndup(s+1, port-(s+1));
 982     port = port+1;
 983     if (*port == ':')
 984       port++;
 985     else
 986       port = NULL;
 987   } else {
 988     port = strchr(s, ':');
 989     if (port)
 990       tmp = tor_strndup(s, port-s);
 991     else
 992       tmp = tor_strdup(s);
 993     if (port)
 994       ++port;
 995   }
 996
 997   if (tor_addr_lookup(tmp, AF_UNSPEC, &addr) < 0)
 998     goto err;
 999   tor_free(tmp);
1000
1001   if (port) {
1002     portval = (int) tor_parse_long(port, 10, 1, 65535, NULL, NULL);
1003     if (!portval)
1004       goto err;
1005   } else {
1006     portval = 0;
1007   }
1008
1009   if (port_out)
1010     *port_out = portval;
1011   tor_addr_copy(addr_out, &addr);
1012
1013   return 0;
1014  err:
1015   tor_free(tmp);
1016   return -1;
1017 }
1018
1019 /** Set *<b>addr</b> to the IP address (if any) of whatever interface
1020  * connects to the Internet.  This address should only be used in checking
1021  * whether our address has changed.  Return 0 on success, -1 on failure.
1022  */
1023 int
1024 get_interface_address6(int severity, sa_family_t family, tor_addr_t *addr)
1025 {
1026   int sock=-1, r=-1;
1027   struct sockaddr_storage my_addr, target_addr;
1028   socklen_t my_addr_len;
1029
1030   tor_assert(addr);
1031
1032   memset(addr, 0, sizeof(tor_addr_t));
1033   memset(&target_addr, 0, sizeof(target_addr));
1034   my_addr_len = (socklen_t)sizeof(my_addr);
1035   /* Use the "discard" service port */
1036   ((struct sockaddr_in*)&target_addr)->sin_port = 9;
1037   /* Don't worry: no packets are sent. We just need to use a real address
1038    * on the actual Internet. */
1039   if (family == AF_INET6) {
1040     struct sockaddr_in6 *sin6 = (struct sockaddr_in6*)&target_addr;
1041     sock = tor_open_socket(PF_INET6,SOCK_DGRAM,IPPROTO_UDP);
1042     my_addr_len = (socklen_t)sizeof(struct sockaddr_in6);
1043     sin6->sin6_family = AF_INET6;
1044     S6_ADDR16(sin6->sin6_addr)[0] = htons(0x2002); /* 2002:: */
1045   } else if (family == AF_INET) {
1046     struct sockaddr_in *sin = (struct sockaddr_in*)&target_addr;
1047     sock = tor_open_socket(PF_INET,SOCK_DGRAM,IPPROTO_UDP);
1048     my_addr_len = (socklen_t)sizeof(struct sockaddr_in);
1049     sin->sin_family = AF_INET;
1050     sin->sin_addr.s_addr = htonl(0x12000001); /* 18.0.0.1 */
1051   } else {
1052     return -1;
1053   }
1054   if (sock < 0) {
1055     int e = tor_socket_errno(-1);
1056     log_fn(severity, LD_NET, "unable to create socket: %s",
1057            tor_socket_strerror(e));
1058     goto err;
1059   }
1060
1061   if (connect(sock,(struct sockaddr *)&target_addr,
1062               (socklen_t)sizeof(target_addr))<0) {
1063     int e = tor_socket_errno(sock);
1064     log_fn(severity, LD_NET, "connect() failed: %s", tor_socket_strerror(e));
1065     goto err;
1066   }
1067
1068   if (getsockname(sock,(struct sockaddr*)&my_addr, &my_addr_len)) {
1069     int e = tor_socket_errno(sock);
1070     log_fn(severity, LD_NET, "getsockname() to determine interface failed: %s",
1071            tor_socket_strerror(e));
1072     goto err;
1073   }
1074
1075   tor_addr_from_sockaddr(addr, (struct sockaddr*)&my_addr, NULL);
1076   r=0;
1077  err:
1078   if (sock >= 0)
1079     tor_close_socket(sock);
1080   return r;
1081 }
1082
1083 /* ======
1084  * IPv4 helpers
1085  * XXXX022 IPv6 deprecate some of these.
1086  */
1087
1088 /** Return true iff <b>ip</b> (in host order) is an IP reserved to localhost,
1089  * or reserved for local networks by RFC 1918.
1090  */
1091 int
1092 is_internal_IP(uint32_t ip, int for_listening)
1093 {
1094   tor_addr_t myaddr;
1095   myaddr.family = AF_INET;
1096   myaddr.addr.in_addr.s_addr = htonl(ip);
1097
1098   return tor_addr_is_internal(&myaddr, for_listening);
1099 }
1100
1101 /** Parse a string of the form "host[:port]" from <b>addrport</b>.  If
1102  * <b>address</b> is provided, set *<b>address</b> to a copy of the
1103  * host portion of the string.  If <b>addr</b> is provided, try to
1104  * resolve the host portion of the string and store it into
1105  * *<b>addr</b> (in host byte order).  If <b>port_out</b> is provided,
1106  * store the port number into *<b>port_out</b>, or 0 if no port is given.
1107  * If <b>port_out</b> is NULL, then there must be no port number in
1108  * <b>addrport</b>.
1109  * Return 0 on success, -1 on failure.
1110  */
1111 int
1112 parse_addr_port(int severity, const char *addrport, char **address,
1113                 uint32_t *addr, uint16_t *port_out)
1114 {
1115   const char *colon;
1116   char *_address = NULL;
1117   int _port;
1118   int ok = 1;
1119
1120   tor_assert(addrport);
1121
1122   colon = strchr(addrport, ':');
1123   if (colon) {
1124     _address = tor_strndup(addrport, colon-addrport);
1125     _port = (int) tor_parse_long(colon+1,10,1,65535,NULL,NULL);
1126     if (!_port) {
1127       log_fn(severity, LD_GENERAL, "Port %s out of range", escaped(colon+1));
1128       ok = 0;
1129     }
1130     if (!port_out) {
1131       char *esc_addrport = esc_for_log(addrport);
1132       log_fn(severity, LD_GENERAL,
1133              "Port %s given on %s when not required",
1134              escaped(colon+1), esc_addrport);
1135       tor_free(esc_addrport);
1136       ok = 0;
1137     }
1138   } else {
1139     _address = tor_strdup(addrport);
1140     _port = 0;
1141   }
1142
1143   if (addr) {
1144     /* There's an addr pointer, so we need to resolve the hostname. */
1145     if (tor_lookup_hostname(_address,addr)) {
1146       log_fn(severity, LD_NET, "Couldn't look up %s", escaped(_address));
1147       ok = 0;
1148       *addr = 0;
1149     }
1150   }
1151
1152   if (address && ok) {
1153     *address = _address;
1154   } else {
1155     if (address)
1156       *address = NULL;
1157     tor_free(_address);
1158   }
1159   if (port_out)
1160     *port_out = ok ? ((uint16_t) _port) : 0;
1161
1162   return ok ? 0 : -1;
1163 }
1164
1165 /** If <b>mask</b> is an address mask for a bit-prefix, return the number of
1166  * bits.  Otherwise, return -1. */
1167 int
1168 addr_mask_get_bits(uint32_t mask)
1169 {
1170   int i;
1171   if (mask == 0)
1172     return 0;
1173   if (mask == 0xFFFFFFFFu)
1174     return 32;
1175   for (i=0; i<=32; ++i) {
1176     if (mask == (uint32_t) ~((1u<<(32-i))-1)) {
1177       return i;
1178     }
1179   }
1180   return -1;
1181 }
1182
1183 /** Compare two addresses <b>a1</b> and <b>a2</b> for equality under a
1184  * netmask of <b>mbits</b> bits.  Return -1, 0, or 1.
1185  *
1186  * XXXX_IP6 Temporary function to allow masks as bitcounts everywhere.  This
1187  * will be replaced with an IPv6-aware version as soon as 32-bit addresses are
1188  * no longer passed around.
1189  */
1190 int
1191 addr_mask_cmp_bits(uint32_t a1, uint32_t a2, maskbits_t bits)
1192 {
1193   if (bits > 32)
1194     bits = 32;
1195   else if (bits == 0)
1196     return 0;
1197
1198   a1 >>= (32-bits);
1199   a2 >>= (32-bits);
1200
1201   if (a1 < a2)
1202     return -1;
1203   else if (a1 > a2)
1204     return 1;
1205   else
1206     return 0;
1207 }
1208
1209 /** Parse a string <b>s</b> in the format of (*|port(-maxport)?)?, setting the
1210  * various *out pointers as appropriate.  Return 0 on success, -1 on failure.
1211  */
1212 int
1213 parse_port_range(const char *port, uint16_t *port_min_out,
1214                  uint16_t *port_max_out)
1215 {
1216   int port_min, port_max, ok;
1217   tor_assert(port_min_out);
1218   tor_assert(port_max_out);
1219
1220   if (!port || *port == '\0' || strcmp(port, "*") == 0) {
1221     port_min = 1;
1222     port_max = 65535;
1223   } else {
1224     char *endptr = NULL;
1225     port_min = (int)tor_parse_long(port, 10, 0, 65535, &ok, &endptr);
1226     if (!ok) {
1227       log_warn(LD_GENERAL,
1228                "Malformed port %s on address range; rejecting.",
1229                escaped(port));
1230       return -1;
1231     } else if (endptr && *endptr == '-') {
1232       port = endptr+1;
1233       endptr = NULL;
1234       port_max = (int)tor_parse_long(port, 10, 1, 65536, &ok, &endptr);
1235       if (!ok) {
1236         log_warn(LD_GENERAL,
1237                  "Malformed port %s on address range; rejecting.",
1238                  escaped(port));
1239         return -1;
1240       }
1241     } else {
1242       port_max = port_min;
1243     }
1244     if (port_min > port_max) {
1245       log_warn(LD_GENERAL, "Insane port range on address policy; rejecting.");
1246       return -1;
1247     }
1248   }
1249
1250   if (port_min < 1)
1251     port_min = 1;
1252   if (port_max > 65535)
1253     port_max = 65535;
1254
1255   *port_min_out = (uint16_t) port_min;
1256   *port_max_out = (uint16_t) port_max;
1257
1258   return 0;
1259 }
1260
1261 /** Parse a string <b>s</b> in the format of
1262  * (IP(/mask|/mask-bits)?|*)(:(*|port(-maxport))?)?, setting the various
1263  * *out pointers as appropriate.  Return 0 on success, -1 on failure.
1264  */
1265 int
1266 parse_addr_and_port_range(const char *s, uint32_t *addr_out,
1267                           maskbits_t *maskbits_out, uint16_t *port_min_out,
1268                           uint16_t *port_max_out)
1269 {
1270   char *address;
1271   char *mask, *port, *endptr;
1272   struct in_addr in;
1273   int bits;
1274
1275   tor_assert(s);
1276   tor_assert(addr_out);
1277   tor_assert(maskbits_out);
1278   tor_assert(port_min_out);
1279   tor_assert(port_max_out);
1280
1281   address = tor_strdup(s);
1282   /* Break 'address' into separate strings.
1283    */
1284   mask = strchr(address,'/');
1285   port = strchr(mask?mask:address,':');
1286   if (mask)
1287     *mask++ = '\0';
1288   if (port)
1289     *port++ = '\0';
1290   /* Now "address" is the IP|'*' part...
1291    *     "mask" is the Mask|Maskbits part...
1292    * and "port" is the *|port|min-max part.
1293    */
1294
1295   if (strcmp(address,"*")==0) {
1296     *addr_out = 0;
1297   } else if (tor_inet_aton(address, &in) != 0) {
1298     *addr_out = ntohl(in.s_addr);
1299   } else {
1300     log_warn(LD_GENERAL, "Malformed IP %s in address pattern; rejecting.",
1301              escaped(address));
1302     goto err;
1303   }
1304
1305   if (!mask) {
1306     if (strcmp(address,"*")==0)
1307       *maskbits_out = 0;
1308     else
1309       *maskbits_out = 32;
1310   } else {
1311     endptr = NULL;
1312     bits = (int) strtol(mask, &endptr, 10);
1313     if (!*endptr) {
1314       /* strtol handled the whole mask. */
1315       if (bits < 0 || bits > 32) {
1316         log_warn(LD_GENERAL,
1317                  "Bad number of mask bits on address range; rejecting.");
1318         goto err;
1319       }
1320       *maskbits_out = bits;
1321     } else if (tor_inet_aton(mask, &in) != 0) {
1322       bits = addr_mask_get_bits(ntohl(in.s_addr));
1323       if (bits < 0) {
1324         log_warn(LD_GENERAL,
1325                  "Mask %s on address range isn't a prefix; dropping",
1326                  escaped(mask));
1327         goto err;
1328       }
1329       *maskbits_out = bits;
1330     } else {
1331       log_warn(LD_GENERAL,
1332                "Malformed mask %s on address range; rejecting.",
1333                escaped(mask));
1334       goto err;
1335     }
1336   }
1337
1338   if (parse_port_range(port, port_min_out, port_max_out)<0)
1339     goto err;
1340
1341   tor_free(address);
1342   return 0;
1343  err:
1344   tor_free(address);
1345   return -1;
1346 }
1347
1348 /** Given an IPv4 in_addr struct *<b>in</b> (in network order, as usual),
1349  *  write it as a string into the <b>buf_len</b>-byte buffer in
1350  *  <b>buf</b>.
1351  */
1352 int
1353 tor_inet_ntoa(const struct in_addr *in, char *buf, size_t buf_len)
1354 {
1355   uint32_t a = ntohl(in->s_addr);
1356   return tor_snprintf(buf, buf_len, "%d.%d.%d.%d",
1357                       (int)(uint8_t)((a>>24)&0xff),
1358                       (int)(uint8_t)((a>>16)&0xff),
1359                       (int)(uint8_t)((a>>8 )&0xff),
1360                       (int)(uint8_t)((a    )&0xff));
1361 }
1362
1363 /** Given a host-order <b>addr</b>, call tor_inet_ntop() on it
1364  *  and return a strdup of the resulting address.
1365  */
1366 char *
1367 tor_dup_ip(uint32_t addr)
1368 {
1369   char buf[TOR_ADDR_BUF_LEN];
1370   struct in_addr in;
1371
1372   in.s_addr = htonl(addr);
1373   tor_inet_ntop(AF_INET, &in, buf, sizeof(buf));
1374   return tor_strdup(buf);
1375 }
1376
1377 /**
1378  * Set *<b>addr</b> to the host-order IPv4 address (if any) of whatever
1379  * interface connects to the Internet.  This address should only be used in
1380  * checking whether our address has changed.  Return 0 on success, -1 on
1381  * failure.
1382  */
1383 int
1384 get_interface_address(int severity, uint32_t *addr)
1385 {
1386   tor_addr_t local_addr;
1387   int r;
1388
1389   r = get_interface_address6(severity, AF_INET, &local_addr);
1390   if (r>=0)
1391     *addr = tor_addr_to_ipv4h(&local_addr);
1392   return r;
1393 }
1394