From fe18776349f22d84bf953905e82b6f5dc95eabcb Mon Sep 17 00:00:00 2001
From: Neel Chauhan <neel@neelc.org>
Date: Fri, 20 Jul 2018 21:36:23 -0400
Subject: [PATCH 1/4] Don't prepend reject *:* to Reachable(OR/Dir)Addresses in
 options_validate()

---
 src/app/config/config.c | 25 -------------------------
 1 file changed, 25 deletions(-)

diff --git a/src/app/config/config.c b/src/app/config/config.c
index c7310f775b..adbba0659e 100644
--- a/src/app/config/config.c
+++ b/src/app/config/config.c
@@ -3359,7 +3359,6 @@ STATIC int
 options_validate(or_options_t *old_options, or_options_t *options,
                  or_options_t *default_options, int from_setconf, char **msg)
 {
-  int i;
   config_line_t *cl;
   const char *uname = get_uname();
   int n_ports=0;
@@ -3680,30 +3679,6 @@ options_validate(or_options_t *old_options, or_options_t *options,
     }
   }
 
-  /* Terminate Reachable*Addresses with reject *
-   */
-  for (i=0; i<3; i++) {
-    config_line_t **linep =
-      (i==0) ? &options->ReachableAddresses :
-        (i==1) ? &options->ReachableORAddresses :
-                 &options->ReachableDirAddresses;
-    if (!*linep)
-      continue;
-    /* We need to end with a reject *:*, not an implicit accept *:* */
-    for (;;) {
-      linep = &((*linep)->next);
-      if (!*linep) {
-        *linep = tor_malloc_zero(sizeof(config_line_t));
-        (*linep)->key = tor_strdup(
-          (i==0) ?  "ReachableAddresses" :
-            (i==1) ? "ReachableORAddresses" :
-                     "ReachableDirAddresses");
-        (*linep)->value = tor_strdup("reject *:*");
-        break;
-      }
-    }
-  }
-
   if ((options->ReachableAddresses ||
        options->ReachableORAddresses ||
        options->ReachableDirAddresses ||

From f80cfc44767e9f70cbb99c090579bb7cfbf8e996 Mon Sep 17 00:00:00 2001
From: Neel Chauhan <neel@neelc.org>
Date: Fri, 20 Jul 2018 21:38:28 -0400
Subject: [PATCH 2/4] Add a "reject *:*" line after parsing in
 parse_reachable_addresses()

---
 src/core/or/policies.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/core/or/policies.c b/src/core/or/policies.c
index e01415f95e..7f5d5dd10f 100644
--- a/src/core/or/policies.c
+++ b/src/core/or/policies.c
@@ -317,6 +317,14 @@ parse_reachable_addresses(void)
     }
   }
 
+  /* Prepend a reject *.* to reachable_(or|dir)_addr_policy */
+  if (!ret && (options->ReachableDirAddresses ||
+               options->ReachableORAddresses ||
+               options->ReachableAddresses)) {
+    append_exit_policy_string(&reachable_or_addr_policy, "reject *:*");
+    append_exit_policy_string(&reachable_dir_addr_policy, "reject *:*");
+  }
+
   return ret;
 }
 

From 7651518b6d725a6f7e654460f998ac2797925a9f Mon Sep 17 00:00:00 2001
From: Neel Chauhan <neel@neelc.org>
Date: Fri, 20 Jul 2018 21:39:09 -0400
Subject: [PATCH 3/4] Add changes file for Bug #20874

---
 changes/bug20874 | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 changes/bug20874

diff --git a/changes/bug20874 b/changes/bug20874
new file mode 100644
index 0000000000..ebec999224
--- /dev/null
+++ b/changes/bug20874
@@ -0,0 +1,7 @@
+  o Minor bugfixes (client, reachableaddresses):
+    - Instead of adding an "reject *:*" line to ReachableAddresses when
+      loading the configuration, add one to the policy after parsing it
+      in parse_reachable_addresses(). This prevents extra "reject *.*"
+      lines from accumulating on reloads. Fixes bug 20874; bugfix on
+      0.3.5.1-alpha. Patch by Neel Chauhan.
+

From f282375fb7d9c527e4bff19dc1e8c6dc7627d137 Mon Sep 17 00:00:00 2001
From: Neel Chauhan <neel@neelc.org>
Date: Sat, 11 Aug 2018 15:39:00 -0400
Subject: [PATCH 4/4] Add regression test for Bug #20874

---
 src/test/test_options.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/test/test_options.c b/src/test/test_options.c
index 4e890205b2..2cd8419a9a 100644
--- a/src/test/test_options.c
+++ b/src/test/test_options.c
@@ -1634,6 +1634,18 @@ test_options_validate__reachable_addresses(void *ignored)
   tt_str_op(tdata->opt->ReachableAddresses->value, OP_EQ, "*:82");
   tor_free(msg);
 
+  free_options_test_data(tdata);
+  mock_clean_saved_logs();
+  tdata = get_options_test_data("FascistFirewall 1\n"
+                                "ReachableAddresses *:82\n"
+                                "MaxClientCircuitsPending 1\n"
+                                "ConnLimit 1\n");
+
+  ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg);
+  tt_int_op(ret, OP_EQ, -1);
+  tt_ptr_op(tdata->opt->ReachableAddresses->next, OP_EQ, NULL);
+  tor_free(msg);
+
 #define SERVERS_REACHABLE_MSG "Servers must be able to freely connect to" \
   " the rest of the Internet, so they must not set Reachable*Addresses or" \
   " FascistFirewall or FirewallPorts or ClientUseIPv4 0."