Merge branch 'bug17027-reject-private-all-interfaces-v2' into bug16069-bug17027

src/test/test_policy.c:
Merged calls to policies_parse_exit_policy by adding additional arguments.
fixup to remaining instance of ~EXIT_POLICY_IPV6_ENABLED.
Compacting logic test now produces previous list length of 4, corrected this.

src/config/torrc.sample.in:
src/config/torrc.minimal.in-staging:
Merged torrc modification dates in favour of latest.

diff --cc doc/tor.1.txt
index 4f922c8f14ab5362232b35136554be748f24cb82,5ac6164f0f434e68750244ed73ca1e23c5ce5d60..736cf75b51c38ad2f5cb6025e84af74ebed6d3a3
--- 1/doc/tor.1.txt
--- 2/doc/tor.1.txt
+++ b/doc/tor.1.txt
@@@ -1586,12 -1577,12 +1586,15 @@@ is non-zero)
         reject *:6881-6999
         accept *:*
  
 +    Since the default exit policy uses accept/reject *, it applies to both
 +    IPv4 and IPv6 addresses.
 +
  [[ExitPolicyRejectPrivate]] **ExitPolicyRejectPrivate** **0**|**1**::
-     Reject all private (local) networks, along with your own public IP address,
-     at the beginning of your exit policy. See above entry on ExitPolicy.
+     Reject all private (local) networks, along with your own configured public
+     IPv4 and IPv6 addresses, at the beginning of your exit policy. Also reject
+     any public IPv4 and IPv6 addresses on any interface on the relay. (If
+     IPv6Exit is not set, all IPv6 addresses will be rejected anyway.)
+     See above entry on ExitPolicy.
      (Default: 1)
  
  [[IPv6Exit]] **IPv6Exit** **0**|**1**::

diff --cc src/common/address.c
Simple merge

diff --cc src/common/address.h
Simple merge

diff --cc src/config/torrc.minimal.in-staging
index c17f7eb87ec82a1cac9b9b34045a175dde885d76,8ce16bb59874ed558ebbd5c4656409a886bf2c7e..ed3300fdcc190a4325592121a66f2d50f3781080
--- 1/src/config/torrc.minimal.in-staging
--- 2/src/config/torrc.minimal.in-staging
+++ b/src/config/torrc.minimal.in-staging
@@@ -172,13 -171,13 +172,15 @@@
  ## users will be told that those destinations are down.
  ##
  ## For security, by default Tor rejects connections to private (local)
- ## networks, including to your public IP address. See the man page entry
- ## for ExitPolicyRejectPrivate if you want to allow "exit enclaving".
+ ## networks, including to the configured public IPv4 and IPv6 addresses,
+ ## and any public IPv4 and IPv6 addresses on any interface on the relay.
+ ## See the man page entry for ExitPolicyRejectPrivate if you want to allow
+ ## "exit enclaving".
  ##
 -#ExitPolicy accept *:6660-6667,reject *:* # allow irc ports but no more
 -#ExitPolicy accept *:119 # accept nntp as well as default exit policy
 +#ExitPolicy accept *:6660-6667,reject *:* # allow irc ports on IPv4 and IPv6 but no more
 +#ExitPolicy accept *:119 # accept nntp ports on IPv4 and IPv6 as well as default exit policy
 +#ExitPolicy accept *4:119 # accept nntp ports on IPv4 only as well as default exit policy
 +#ExitPolicy accept6 *6:119 # accept nntp ports on IPv6 only as well as default exit policy
  #ExitPolicy reject *:* # no exits allowed
  
  ## Bridge relays (or "bridges") are Tor relays that aren't listed in the

diff --cc src/config/torrc.sample.in
index c17f7eb87ec82a1cac9b9b34045a175dde885d76,8ce16bb59874ed558ebbd5c4656409a886bf2c7e..ed3300fdcc190a4325592121a66f2d50f3781080
--- 1/src/config/torrc.sample.in
--- 2/src/config/torrc.sample.in
+++ b/src/config/torrc.sample.in
@@@ -172,13 -171,13 +172,15 @@@
  ## users will be told that those destinations are down.
  ##
  ## For security, by default Tor rejects connections to private (local)
- ## networks, including to your public IP address. See the man page entry
- ## for ExitPolicyRejectPrivate if you want to allow "exit enclaving".
+ ## networks, including to the configured public IPv4 and IPv6 addresses,
+ ## and any public IPv4 and IPv6 addresses on any interface on the relay.
+ ## See the man page entry for ExitPolicyRejectPrivate if you want to allow
+ ## "exit enclaving".
  ##
 -#ExitPolicy accept *:6660-6667,reject *:* # allow irc ports but no more
 -#ExitPolicy accept *:119 # accept nntp as well as default exit policy
 +#ExitPolicy accept *:6660-6667,reject *:* # allow irc ports on IPv4 and IPv6 but no more
 +#ExitPolicy accept *:119 # accept nntp ports on IPv4 and IPv6 as well as default exit policy
 +#ExitPolicy accept *4:119 # accept nntp ports on IPv4 only as well as default exit policy
 +#ExitPolicy accept6 *6:119 # accept nntp ports on IPv6 only as well as default exit policy
  #ExitPolicy reject *:* # no exits allowed
  
  ## Bridge relays (or "bridges") are Tor relays that aren't listed in the

diff --cc src/or/policies.c
Simple merge

diff --cc src/test/test_policy.c
index e9be9e4ffc6ada163f5f46ada187205555720ed2,d7d3cf0c0d4a1c95d1136d214f27f4c0ffd20908..37c36fed99d4e51a454515da984c4c4e0334b2d2
--- 1/src/test/test_policy.c
--- 2/src/test/test_policy.c
+++ b/src/test/test_policy.c
@@@ -77,8 -77,7 +77,8 @@@ test_policies_general(void *arg
    int i;
    smartlist_t *policy = NULL, *policy2 = NULL, *policy3 = NULL,
                *policy4 = NULL, *policy5 = NULL, *policy6 = NULL,
 -              *policy7 = NULL, *policy12 = NULL;
 +              *policy7 = NULL, *policy8 = NULL, *policy9 = NULL,
-               *policy10 = NULL, *policy11 = NULL;
++              *policy10 = NULL, *policy11 = NULL, *policy12 = NULL;
    addr_policy_t *p;
    tor_addr_t tar;
    config_line_t line;
@@@ -119,13 -117,20 +120,22 @@@
  
    tt_assert(policy2);
  
+   tor_addr_parse(&tar, "[2000::1234]");
+   tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy12,
+                                                  EXIT_POLICY_IPV6_ENABLED |
+                                                  EXIT_POLICY_REJECT_PRIVATE |
+                                                  EXIT_POLICY_ADD_DEFAULT,
+                                                  0x0306090cu, &tar, 1));
+ 
+   tt_assert(policy12);
+ 
    policy3 = smartlist_new();
 -  p = router_parse_addr_policy_item_from_string("reject *:*",-1);
 +  p = router_parse_addr_policy_item_from_string("reject *:*", -1,
 +                                                &malformed_list);
    tt_assert(p != NULL);
    smartlist_add(policy3, p);
 -  p = router_parse_addr_policy_item_from_string("accept *:*",-1);
 +  p = router_parse_addr_policy_item_from_string("accept *:*", -1,
 +                                                &malformed_list);
    tt_assert(p != NULL);
    smartlist_add(policy3, p);
  
@@@ -193,32 -184,6 +203,34 @@@
    tt_assert(p != NULL);
    smartlist_add(policy7, p);
  
-                                                  EXIT_POLICY_ADD_DEFAULT, 0));
 +  tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy8,
 +                                                 EXIT_POLICY_IPV6_ENABLED |
 +                                                 EXIT_POLICY_REJECT_PRIVATE |
-                                                  EXIT_POLICY_ADD_DEFAULT, 0));
++                                                 EXIT_POLICY_ADD_DEFAULT, 0,
++                                                 NULL, 0));
 +
 +  tt_assert(policy8);
 +
 +  tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy9,
 +                                                 EXIT_POLICY_REJECT_PRIVATE |
++                                                 EXIT_POLICY_ADD_DEFAULT, 0,
++                                                 NULL, 0));
 +
 +  tt_assert(policy9);
 +
 +  /* accept6 * and reject6 * produce IPv6 wildcards only */
 +  policy10 = smartlist_new();
 +  p = router_parse_addr_policy_item_from_string("accept6 *:*", -1,
 +                                                &malformed_list);
 +  tt_assert(p != NULL);
 +  smartlist_add(policy10, p);
 +
 +  policy11 = smartlist_new();
 +  p = router_parse_addr_policy_item_from_string("reject6 *:*", -1,
 +                                                &malformed_list);
 +  tt_assert(p != NULL);
 +  smartlist_add(policy11, p);
 +
    tt_assert(!exit_policy_is_general_exit(policy));
    tt_assert(exit_policy_is_general_exit(policy2));
    tt_assert(!exit_policy_is_general_exit(NULL));
@@@ -463,10 -358,7 +476,11 @@@
    addr_policy_list_free(policy5);
    addr_policy_list_free(policy6);
    addr_policy_list_free(policy7);
 +  addr_policy_list_free(policy8);
 +  addr_policy_list_free(policy9);
 +  addr_policy_list_free(policy10);
 +  addr_policy_list_free(policy11);
+   addr_policy_list_free(policy12);
    tor_free(policy_str);
    if (sm) {
      SMARTLIST_FOREACH(sm, char *, s, tor_free(s));