/* Copyright (c) 2001-2004, Roger Dingledine.

 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.

 * Copyright (c) 2007-2021, The Tor Project, Inc. */

/* See LICENSE for licensing information */

/**
 * \file policies.c
 * \brief Code to parse and use address policies and exit policies.

 *
 * We have two key kinds of address policy: full and compressed.  A full
 * policy is an array of accept/reject patterns, to be applied in order.
 * A short policy is simply a list of ports.  This module handles both
 * kinds, including generic functions to apply them to addresses, and
 * also including code to manage the global policies that we apply to
 * incoming and outgoing connections.

 **/

#define POLICIES_PRIVATE

#include "core/or/or.h"
#include "feature/client/bridges.h"
#include "app/config/config.h"

#include "core/or/policies.h"

#include "feature/dirparse/policy_parse.h"

#include "feature/nodelist/microdesc.h"
#include "feature/nodelist/networkstatus.h"
#include "feature/nodelist/nodelist.h"
#include "feature/relay/router.h"

#include "feature/relay/routermode.h"

#include "lib/geoip/geoip.h"

#include "ht.h"

#include "lib/crypt_ops/crypto_rand.h"

#include "lib/encoding/confline.h"

#include "trunnel/ed25519_cert.h"

#include "core/or/addr_policy_st.h"
#include "feature/dirclient/dir_server_st.h"
#include "feature/nodelist/microdesc_st.h"
#include "feature/nodelist/node_st.h"
#include "core/or/port_cfg_st.h"
#include "feature/nodelist/routerinfo_st.h"
#include "feature/nodelist/routerstatus_st.h"

/** Maximum length of an exit policy summary. */
#define MAX_EXITPOLICY_SUMMARY_LEN 1000

/** Policy that addresses for incoming SOCKS connections must match. */

static smartlist_t *socks_policy = NULL;

/** Policy that addresses for incoming directory connections must match. */

static smartlist_t *dir_policy = NULL;

/** Policy for incoming MetricsPort connections that must match. */
static smartlist_t *metrics_policy = NULL;

/** Policy that addresses for incoming router descriptors must match in order
 * to be published by us. */

static smartlist_t *authdir_reject_policy = NULL;

/** Policy that addresses for incoming router descriptors must match in order
 * to be marked as valid in our networkstatus. */

static smartlist_t *authdir_invalid_policy = NULL;

/** Policy that addresses for incoming router descriptors must <b>not</b>
 * match in order to not be marked as BadExit. */

static smartlist_t *authdir_badexit_policy = NULL;

/** Parsed addr_policy_t describing which addresses we believe we can start
 * circuits at. */

static smartlist_t *reachable_or_addr_policy = NULL;

/** Parsed addr_policy_t describing which addresses we believe we can connect
 * to directories at. */

static smartlist_t *reachable_dir_addr_policy = NULL;

/** Element of an exit policy summary */
typedef struct policy_summary_item_t {
    uint16_t prt_min; /**< Lowest port number to accept/reject. */
    uint16_t prt_max; /**< Highest port number to accept/reject. */
    uint64_t reject_count; /**< Number of IP-Addresses that are rejected to

                                this port range. */

    unsigned int accepted:1; /** Has this port already been accepted */

} policy_summary_item_t;

/** Private networks.  This list is used in two places, once to expand the
 *  "private" keyword when parsing our own exit policy, secondly to ignore
 *  just such networks when building exit policy summaries.  It is important
 *  that all authorities agree on that list when creating summaries, so don't
 *  just change this without a proper migration plan and a proposal and stuff.
 */
static const char *private_nets[] = {
  "0.0.0.0/8", "169.254.0.0/16",
  "127.0.0.0/8", "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12",

  "[::]/8",
  "[fc00::]/7", "[fe80::]/10", "[fec0::]/10", "[ff00::]/8", "[::]/127",
  NULL
};

static int policies_parse_exit_policy_internal(

                                      config_line_t *cfg,
                                      smartlist_t **dest,
                                      int ipv6_exit,
                                      int rejectprivate,
                                      const smartlist_t *configured_addresses,
                                      int reject_interface_addresses,
                                      int reject_configured_port_addresses,

                                      int add_default_policy,
                                      int add_reduced_policy);

/** Replace all "private" entries in *<b>policy</b> with their expanded
 * equivalents. */
void
policy_expand_private(smartlist_t **policy)
{
  uint16_t port_min, port_max;

  int i;
  smartlist_t *tmp;

  if (!*policy) /*XXXX disallow NULL policies? */

    return;

  tmp = smartlist_new();

  SMARTLIST_FOREACH_BEGIN(*policy, addr_policy_t *, p) {

     if (! p->is_private) {
       smartlist_add(tmp, p);
       continue;
     }
     for (i = 0; private_nets[i]; ++i) {

       addr_policy_t newpolicy;
       memcpy(&newpolicy, p, sizeof(addr_policy_t));
       newpolicy.is_private = 0;
       newpolicy.is_canonical = 0;

       if (tor_addr_parse_mask_ports(private_nets[i], 0,
                               &newpolicy.addr,

                               &newpolicy.maskbits, &port_min, &port_max)<0) {

         tor_assert_unreached();

       }

       smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy));

     }
     addr_policy_free(p);

  } SMARTLIST_FOREACH_END(p);

  smartlist_free(*policy);
  *policy = tmp;
}

/** Expand each of the AF_UNSPEC elements in *<b>policy</b> (which indicate
 * protocol-neutral wildcards) into a pair of wildcard elements: one IPv4-
 * specific and one IPv6-specific. */
void
policy_expand_unspec(smartlist_t **policy)
{
  smartlist_t *tmp;
  if (!*policy)
    return;

  tmp = smartlist_new();
  SMARTLIST_FOREACH_BEGIN(*policy, addr_policy_t *, p) {
    sa_family_t family = tor_addr_family(&p->addr);
    if (family == AF_INET6 || family == AF_INET || p->is_private) {
      smartlist_add(tmp, p);
    } else if (family == AF_UNSPEC) {
      addr_policy_t newpolicy_ipv4;
      addr_policy_t newpolicy_ipv6;
      memcpy(&newpolicy_ipv4, p, sizeof(addr_policy_t));
      memcpy(&newpolicy_ipv6, p, sizeof(addr_policy_t));
      newpolicy_ipv4.is_canonical = 0;
      newpolicy_ipv6.is_canonical = 0;
      if (p->maskbits != 0) {
        log_warn(LD_BUG, "AF_UNSPEC policy with maskbits==%d", p->maskbits);
        newpolicy_ipv4.maskbits = 0;
        newpolicy_ipv6.maskbits = 0;
      }
      tor_addr_from_ipv4h(&newpolicy_ipv4.addr, 0);
      tor_addr_from_ipv6_bytes(&newpolicy_ipv6.addr,

          (const uint8_t *)"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0");

      smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv4));
      smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv6));
      addr_policy_free(p);
    } else {
      log_warn(LD_BUG, "Funny-looking address policy with family %d", family);
      smartlist_add(tmp, p);
    }
  } SMARTLIST_FOREACH_END(p);

  smartlist_free(*policy);
  *policy = tmp;
}

/**

 * Given a linked list of config lines containing "accept[6]" and "reject[6]"

 * tokens, parse them and append the result to <b>dest</b>. Return -1

 * if any tokens are malformed (and don't append any), else return 0.

 *
 * If <b>assume_action</b> is nonnegative, then insert its action
 * (ADDR_POLICY_ACCEPT or ADDR_POLICY_REJECT) for items that specify no
 * action.

 */
static int

parse_addr_policy(config_line_t *cfg, smartlist_t **dest,

                  int assume_action)
{

  smartlist_t *result;

  smartlist_t *entries;

  addr_policy_t *item;

  int malformed_list;

  int r = 0;

  if (!cfg)
    return 0;

  result = smartlist_new();
  entries = smartlist_new();

  for (; cfg; cfg = cfg->next) {
    smartlist_split_string(entries, cfg->value, ",",
                           SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0);

    SMARTLIST_FOREACH_BEGIN(entries, const char *, ent) {

      log_debug(LD_CONFIG,"Adding new entry '%s'",ent);

      malformed_list = 0;
      item = router_parse_addr_policy_item_from_string(ent, assume_action,
                                                       &malformed_list);

      if (item) {
        smartlist_add(result, item);

      } else if (malformed_list) {
        /* the error is so severe the entire list should be discarded */
        log_warn(LD_CONFIG, "Malformed policy '%s'. Discarding entire policy "
                 "list.", ent);

        r = -1;

      } else {
        /* the error is minor: don't add the item, but keep processing the
         * rest of the policies in the list */
        log_debug(LD_CONFIG, "Ignored policy '%s' due to non-fatal error. "
                  "The remainder of the policy list will be used.",
                  ent);

      }

    } SMARTLIST_FOREACH_END(ent);

    SMARTLIST_FOREACH(entries, char *, ent, tor_free(ent));
    smartlist_clear(entries);
  }
  smartlist_free(entries);

  if (r == -1) {
    addr_policy_list_free(result);
  } else {
    policy_expand_private(&result);

    policy_expand_unspec(&result);

    if (*dest) {
      smartlist_add_all(*dest, result);
      smartlist_free(result);
    } else {
      *dest = result;
    }
  }

  return r;
}

/** Helper: parse the Reachable(Dir|OR)?Addresses fields into

 * reachable_(or|dir)_addr_policy.  The options should already have
 * been validated by validate_addr_policies.
 */
static int

parse_reachable_addresses(void)
{

  const or_options_t *options = get_options();

  int ret = 0;

  if (options->ReachableDirAddresses &&
      options->ReachableORAddresses &&
      options->ReachableAddresses) {
    log_warn(LD_CONFIG,
             "Both ReachableDirAddresses and ReachableORAddresses are set. "
             "ReachableAddresses setting will be ignored.");
  }

  addr_policy_list_free(reachable_or_addr_policy);

  reachable_or_addr_policy = NULL;
  if (!options->ReachableORAddresses && options->ReachableAddresses)
    log_info(LD_CONFIG,
             "Using ReachableAddresses as ReachableORAddresses.");
  if (parse_addr_policy(options->ReachableORAddresses ?
                          options->ReachableORAddresses :
                          options->ReachableAddresses,
                        &reachable_or_addr_policy, ADDR_POLICY_ACCEPT)) {
    log_warn(LD_CONFIG,
             "Error parsing Reachable%sAddresses entry; ignoring.",
             options->ReachableORAddresses ? "OR" : "");

    ret = -1;

  }

  addr_policy_list_free(reachable_dir_addr_policy);

  reachable_dir_addr_policy = NULL;
  if (!options->ReachableDirAddresses && options->ReachableAddresses)
    log_info(LD_CONFIG,
             "Using ReachableAddresses as ReachableDirAddresses");
  if (parse_addr_policy(options->ReachableDirAddresses ?
                          options->ReachableDirAddresses :
                          options->ReachableAddresses,
                        &reachable_dir_addr_policy, ADDR_POLICY_ACCEPT)) {
    if (options->ReachableDirAddresses)
      log_warn(LD_CONFIG,
               "Error parsing ReachableDirAddresses entry; ignoring.");

    ret = -1;

  }

  /* We ignore ReachableAddresses for relays */
  if (!server_mode(options)) {

    if (policy_is_reject_star(reachable_or_addr_policy, AF_UNSPEC, 0)
        || policy_is_reject_star(reachable_dir_addr_policy, AF_UNSPEC,0)) {

      log_warn(LD_CONFIG, "Tor cannot connect to the Internet if "
               "ReachableAddresses, ReachableORAddresses, or "
               "ReachableDirAddresses reject all addresses. Please accept "
               "some addresses in these options.");

    } else if (options->ClientUseIPv4 == 1

       && (policy_is_reject_star(reachable_or_addr_policy, AF_INET, 0)
           || policy_is_reject_star(reachable_dir_addr_policy, AF_INET, 0))) {

          log_warn(LD_CONFIG, "You have set ClientUseIPv4 1, but "
                   "ReachableAddresses, ReachableORAddresses, or "
                   "ReachableDirAddresses reject all IPv4 addresses. "
                   "Tor will not connect using IPv4.");

    } else if (reachable_addr_use_ipv6(options)

       && (policy_is_reject_star(reachable_or_addr_policy, AF_INET6, 0)
         || policy_is_reject_star(reachable_dir_addr_policy, AF_INET6, 0))) {

          log_warn(LD_CONFIG, "You have configured tor to use or prefer IPv6 "
                   "(or UseBridges 1), but "

                   "ReachableAddresses, ReachableORAddresses, or "
                   "ReachableDirAddresses reject all IPv6 addresses. "
                   "Tor will not connect using IPv6.");

    }
  }

  /* Append a reject *:* to reachable_(or|dir)_addr_policy */

  if (!ret && (options->ReachableDirAddresses ||
               options->ReachableORAddresses ||
               options->ReachableAddresses)) {
    append_exit_policy_string(&reachable_or_addr_policy, "reject *:*");
    append_exit_policy_string(&reachable_dir_addr_policy, "reject *:*");
  }

  return ret;

}

/* Return true iff ClientUseIPv4 0 or ClientUseIPv6 0 might block any OR or Dir
 * address:port combination. */
static int
firewall_is_fascist_impl(void)

{
  const or_options_t *options = get_options();
  /* Assume every non-bridge relay has an IPv4 address.
   * Clients which use bridges may only know the IPv6 address of their

   * bridge, but they will connect regardless of the ClientUseIPv6 setting. */
  return options->ClientUseIPv4 == 0;

}

/** Return true iff the firewall options, including ClientUseIPv4 0 and
 * ClientUseIPv6 0, might block any OR address:port combination.

 * Address preferences may still change which address is selected even if
 * this function returns false.

 */
int
firewall_is_fascist_or(void)
{

  return (reachable_or_addr_policy != NULL || firewall_is_fascist_impl());
}

/** Return true iff the firewall options, including ClientUseIPv4 0 and
 * ClientUseIPv6 0, might block any Dir address:port combination.

 * Address preferences may still change which address is selected even if
 * this function returns false.

 */
int
firewall_is_fascist_dir(void)
{
  return (reachable_dir_addr_policy != NULL || firewall_is_fascist_impl());

}

/** Return true iff <b>policy</b> (possibly NULL) will allow a
 * connection to <b>addr</b>:<b>port</b>.
 */
static int

addr_policy_permits_tor_addr(const tor_addr_t *addr, uint16_t port,

                            smartlist_t *policy)

{
  addr_policy_result_t p;

  p = compare_tor_addr_to_addr_policy(addr, port, policy);

  switch (p) {
    case ADDR_POLICY_PROBABLY_ACCEPTED:
    case ADDR_POLICY_ACCEPTED:
      return 1;
    case ADDR_POLICY_PROBABLY_REJECTED:
    case ADDR_POLICY_REJECTED:
      return 0;
    default:
      log_warn(LD_BUG, "Unexpected result: %d", (int)p);
      return 0;
  }
}

/** Return true iff we think our firewall will let us make a connection to
 * addr:port.
 *

 * If we are configured as a server, ignore any address family preference and
 * just use IPv4.

 * Otherwise:
 *  - return false for all IPv4 addresses:
 *    - if ClientUseIPv4 is 0, or
 *      if pref_only and pref_ipv6 are both true;
 *  - return false for all IPv6 addresses:

 *    - if reachable_addr_use_ipv6() is 0, or

 *    - if pref_only is true and pref_ipv6 is false.
 *
 * Return false if addr is NULL or tor_addr_is_null(), or if port is 0. */
STATIC int

reachable_addr_allows(const tor_addr_t *addr,

                                uint16_t port,
                                smartlist_t *firewall_policy,
                                int pref_only, int pref_ipv6)

{

  const or_options_t *options = get_options();

  const int client_mode = !server_mode(options);

  if (!addr || tor_addr_is_null(addr) || !port) {
    return 0;
  }

  /* Clients stop using IPv4 if it's disabled. In most cases, clients also
   * stop using IPv4 if it's not preferred.
   * Servers must have IPv4 enabled and preferred. */
  if (tor_addr_family(addr) == AF_INET && client_mode &&
      (!options->ClientUseIPv4 || (pref_only && pref_ipv6))) {
    return 0;

  }

  /* Clients and Servers won't use IPv6 unless it's enabled (and in most
   * cases, IPv6 must also be preferred before it will be used). */

  if (tor_addr_family(addr) == AF_INET6 &&

      (!reachable_addr_use_ipv6(options) || (pref_only && !pref_ipv6))) {

    return 0;

  }

  return addr_policy_permits_tor_addr(addr, port,

                                      firewall_policy);
}

/** Is this client configured to use IPv6?

 * Returns true if the client might use IPv6 for some of its connections
 * (including dual-stack and IPv6-only clients), and false if it will never
 * use IPv6 for any connections.

 * Use node_ipv6_or/dir_preferred() when checking a specific node and OR/Dir
 * port: it supports bridge client per-node IPv6 preferences.

 */

int

reachable_addr_use_ipv6(const or_options_t *options)

{

  /* Clients use IPv6 if it's set, or they use bridges, or they don't use

   * IPv4, or they prefer it.
   * ClientPreferIPv6DirPort is deprecated, but check it anyway. */
  return (options->ClientUseIPv6 == 1 || options->ClientUseIPv4 == 0 ||
          options->ClientPreferIPv6ORPort == 1 ||

          options->ClientPreferIPv6DirPort == 1 || options->UseBridges == 1);

}

/** Do we prefer to connect to IPv6, ignoring ClientPreferIPv6ORPort and
 * ClientPreferIPv6DirPort?
 * If we're unsure, return -1, otherwise, return 1 for IPv6 and 0 for IPv4.
 */
static int

reachable_addr_prefer_ipv6_impl(const or_options_t *options)

{
  /*
   Cheap implementation of config options ClientUseIPv4 & ClientUseIPv6 --
   If we're a server or IPv6 is disabled, use IPv4.
   If IPv4 is disabled, use IPv6.
   */

  if (server_mode(options) || !reachable_addr_use_ipv6(options)) {

    return 0;
  }

  if (!options->ClientUseIPv4) {
    return 1;
  }

  return -1;
}

/** Do we prefer to connect to IPv6 ORPorts?

 * Use node_ipv6_or_preferred() whenever possible: it supports bridge client
 * per-node IPv6 preferences.

 */
int

reachable_addr_prefer_ipv6_orport(const or_options_t *options)

{

  int pref_ipv6 = reachable_addr_prefer_ipv6_impl(options);

  if (pref_ipv6 >= 0) {
    return pref_ipv6;
  }

  /* We can use both IPv4 and IPv6 - which do we prefer? */

  if (options->ClientPreferIPv6ORPort == 1) {

    return 1;
  }

  return 0;

}

/** Do we prefer to connect to IPv6 DirPorts?

 *
 * (node_ipv6_dir_preferred() doesn't support bridge client per-node IPv6
 * preferences. There's no reason to use it instead of this function.)

 */

int

reachable_addr_prefer_ipv6_dirport(const or_options_t *options)

{

  int pref_ipv6 = reachable_addr_prefer_ipv6_impl(options);

  if (pref_ipv6 >= 0) {
    return pref_ipv6;
  }

  /* We can use both IPv4 and IPv6 - which do we prefer? */
  if (options->ClientPreferIPv6DirPort == 1) {
    return 1;
  }

  return 0;

}

/** Return true iff we think our firewall will let us make a connection to
 * addr:port. Uses ReachableORAddresses or ReachableDirAddresses based on
 * fw_connection.

 * If pref_only is true, return true if addr is in the client's preferred
 * address family, which is IPv6 if pref_ipv6 is true, and IPv4 otherwise.
 * If pref_only is false, ignore pref_ipv6, and return true if addr is allowed.

 */

int

reachable_addr_allows_addr(const tor_addr_t *addr, uint16_t port,

                                     firewall_connection_t fw_connection,

                                     int pref_only, int pref_ipv6)

{
  if (fw_connection == FIREWALL_OR_CONNECTION) {

    return reachable_addr_allows(addr, port,

                               reachable_or_addr_policy,

                               pref_only, pref_ipv6);

  } else if (fw_connection == FIREWALL_DIR_CONNECTION) {

    return reachable_addr_allows(addr, port,

                               reachable_dir_addr_policy,

                               pref_only, pref_ipv6);

  } else {

    log_warn(LD_BUG, "Bad firewall_connection_t value %d.",
             fw_connection);
    return 0;
  }
}

/** Return true iff we think our firewall will let us make a connection to
 * addr:port (ap). Uses ReachableORAddresses or ReachableDirAddresses based on
 * fw_connection.

 * pref_only and pref_ipv6 work as in reachable_addr_allows_addr().

 */

static int

reachable_addr_allows_ap(const tor_addr_port_t *ap,

                                   firewall_connection_t fw_connection,

                                   int pref_only, int pref_ipv6)

{
  tor_assert(ap);

  return reachable_addr_allows_addr(&ap->addr, ap->port,

                                              fw_connection, pref_only,
                                              pref_ipv6);

}

/** Return true iff we think our firewall will let us make a connection to
 * ipv4h_addr/ipv6_addr. Uses ipv4_orport/ipv6_orport/ReachableORAddresses or
 * ipv4_dirport/ipv6_dirport/ReachableDirAddresses based on IPv4/IPv6 and
 * <b>fw_connection</b>.

 * pref_only and pref_ipv6 work as in reachable_addr_allows_addr().

 */

static int

reachable_addr_allows_base(const tor_addr_t *ipv4_addr, uint16_t ipv4_orport,

                             uint16_t ipv4_dirport,
                             const tor_addr_t *ipv6_addr, uint16_t ipv6_orport,
                             uint16_t ipv6_dirport,
                             firewall_connection_t fw_connection,

                             int pref_only, int pref_ipv6)

{

  if (reachable_addr_allows_addr(ipv4_addr,

                                      (fw_connection == FIREWALL_OR_CONNECTION
                                       ? ipv4_orport
                                       : ipv4_dirport),
                                      fw_connection,

                                      pref_only, pref_ipv6)) {

    return 1;
  }

  if (reachable_addr_allows_addr(ipv6_addr,

                                      (fw_connection == FIREWALL_OR_CONNECTION
                                       ? ipv6_orport
                                       : ipv6_dirport),
                                      fw_connection,

                                      pref_only, pref_ipv6)) {

    return 1;
  }

  return 0;
}

/** Like reachable_addr_allows_base(), but takes ri. */

static int

reachable_addr_allows_ri_impl(const routerinfo_t *ri,

                                firewall_connection_t fw_connection,

                                int pref_only, int pref_ipv6)

{
  if (!ri) {
    return 0;
  }

  /* Assume IPv4 and IPv6 DirPorts are the same */

  return reachable_addr_allows_base(&ri->ipv4_addr, ri->ipv4_orport,

                                      ri->ipv4_dirport, &ri->ipv6_addr,
                                      ri->ipv6_orport, ri->ipv4_dirport,
                                      fw_connection, pref_only, pref_ipv6);

}

/** Like reachable_addr_allows_rs, but takes pref_ipv6. */

static int

reachable_addr_allows_rs_impl(const routerstatus_t *rs,

                                firewall_connection_t fw_connection,

                                int pref_only, int pref_ipv6)

{
  if (!rs) {
    return 0;
  }

  /* Assume IPv4 and IPv6 DirPorts are the same */

  return reachable_addr_allows_base(&rs->ipv4_addr, rs->ipv4_orport,

                                      rs->ipv4_dirport, &rs->ipv6_addr,
                                      rs->ipv6_orport, rs->ipv4_dirport,
                                      fw_connection, pref_only, pref_ipv6);

}

/** Like reachable_addr_allows_base(), but takes rs.

 * When rs is a fake_status from a dir_server_t, it can have a reachable
 * address, even when the corresponding node does not.
 * nodes can be missing addresses when there's no consensus (IPv4 and IPv6),
 * or when there is a microdescriptor consensus, but no microdescriptors
 * (microdescriptors have IPv6, the microdesc consensus does not). */

int

reachable_addr_allows_rs(const routerstatus_t *rs,

                           firewall_connection_t fw_connection, int pref_only)

{

  if (!rs) {
    return 0;
  }

  /* We don't have access to the node-specific IPv6 preference, so use the
   * generic IPv6 preference instead. */
  const or_options_t *options = get_options();
  int pref_ipv6 = (fw_connection == FIREWALL_OR_CONNECTION

                   ? reachable_addr_prefer_ipv6_orport(options)
                   : reachable_addr_prefer_ipv6_dirport(options));

  return reachable_addr_allows_rs_impl(rs, fw_connection, pref_only,

                                         pref_ipv6);

}

/** Return true iff we think our firewall will let us make a connection to
 * ipv6_addr:ipv6_orport based on ReachableORAddresses.
 * If <b>fw_connection</b> is FIREWALL_DIR_CONNECTION, returns 0.

 * pref_only and pref_ipv6 work as in reachable_addr_allows_addr().

 */

static int

reachable_addr_allows_md_impl(const microdesc_t *md,

                                firewall_connection_t fw_connection,

                                int pref_only, int pref_ipv6)

{
  if (!md) {
    return 0;
  }

  /* Can't check dirport, it doesn't have one */
  if (fw_connection == FIREWALL_DIR_CONNECTION) {
    return 0;
  }

  /* Also can't check IPv4, doesn't have that either */

  return reachable_addr_allows_addr(&md->ipv6_addr, md->ipv6_orport,

                                              fw_connection, pref_only,
                                              pref_ipv6);

}

/** Like reachable_addr_allows_base(), but takes node, and looks up pref_ipv6

 * from node_ipv6_or/dir_preferred(). */

int

reachable_addr_allows_node(const node_t *node,

                             firewall_connection_t fw_connection,
                             int pref_only)

{

  if (!node) {
    return 0;
  }

  node_assert_ok(node);

  const int pref_ipv6 = (fw_connection == FIREWALL_OR_CONNECTION
                         ? node_ipv6_or_preferred(node)
                         : node_ipv6_dir_preferred(node));

  /* Sometimes, the rs is missing the IPv6 address info, and we need to go
   * all the way to the md */