os-tor new exit settings (#567)

* Quick fixes to allow IPv6 and Outboundbinding

-allow specification of secondary ORPort (intended for IPv6)
-allow specification of 2 source addresses via source IP fields,
especially usefull for exits.
-default directory port to 9030 and set to mandatory (needed for relay)

All of the IPv6 fields use the same input verification as the HOST
field, should perhaps be changed?

* ...

* forgot torrc....

* Include manual config in torrc file

include optional /usr/local/etc/torrc.exitpolicy after after exit
policies set via interface before default reject to allow easy config of
custom exit policy.

* Cleanup for merge

* Scheduler KIST is Linux 2.6.39+ only, should not be enabled on BSD
https://www.torproject.org/docs/tor-manual.html.en

* Cleaning up torrc whitespaces, fixed regex

* fixing up things

* Do actual IPv4 validation (reject any invalid IPv4)

* Provide dropdown menu on general settings tab to allow choice in scheduler order and schedulers with following options:
-KISTLite,Vanilla (default)
-Vanilla,KISTLite
-KISTLite
-Vanilla

* fixed missing options

* whitespace

* removed comma from default option for scheduler

* Delete opnsense.tgz

* Adding settings for Exits to new Exit Settings tab.

* Fixed ExitACL to allow wildcards.

Removed usage of accept6/reject6 in favor of accept *4 and *6

Using 'any' for wildcard networks, which coincidentally won't break validation

* Moved all exit options back to under relay pane.

added some more options for exits

* whitespaces

* whitespace

* remove leftover unused exit.xml

exit.xml was leftover from approach with separate page for exit settings. 
Removing, is unused

security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/acl_exitpolicy.xml

@@ -9,12 +9,13 @@
     <id>exitpolicy.type</id>
     <label>Protocol</label>
     <type>dropdown</type>
+    <help>Leave at both when specifying network below, otherwise when using wildcards change to match desired network</help>
   </field>
   <field>
     <id>exitpolicy.network</id>
     <label>Network</label>
     <type>text</type>
-    <help>Network on which this ACL is appied.</help>
+    <help>Network on which this ACL is appied. Enter 'any' to use wildcard adressing</help>
   </field>
   <field>
     <id>exitpolicy.startport</id>

security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/relay.xml

@@ -69,11 +69,6 @@
     <label>Directory Port</label>
     <type>text</type>
   </field>
-  <field>
-    <id>relay.exitrejectprivateip</id>
-    <label>Reject Private IPs</label>
-    <type>checkbox</type>
-  </field>
   <field>
     <id>relay.relay</id>
     <label>Bridge</label>
@@ -85,4 +80,27 @@
     <label>Publish Server Descriptor</label>
     <type>checkbox</type>
   </field>
+  <field>
+    <id>relay.exitenabled</id>
+    <label>Exit Enable</label>
+    <type>checkbox</type>
+    <help>Act as an exit.</help>
+  </field>
+  <field>
+    <id>relay.exitipv6</id>
+    <label>IPv6 Exit</label>
+    <type>checkbox</type>
+    <help>Allow Exit using IPv6 protocol</help>
+  </field>
+  <field>
+    <id>relay.exitrejectprivateip</id>
+    <label>Reject Private IPs</label>
+    <type>checkbox</type>
+    <help>Reject exiting to private IP space</help>
+  </field>
+  <field>
+    <id>relay.exitrejectlocalif</id>
+    <label>Reject Local Interfaces IPs</label>
+    <type>checkbox</type>
+  </field>
 </form>

security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/ACLExitPolicy.xml

@@ -8,9 +8,10 @@
         <Required>Y</Required>
       </enabled>
       <type type="OptionField">
-        <default>v6</default>
+        <default>both</default>
         <Required>Y</Required>
         <OptionValues>
+          <both>both</both>
           <v4>IPv4</v4>
           <v6>IPv6</v6>
         </OptionValues>

security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/Relay.xml

@@ -67,5 +67,17 @@
         <default>0</default>
         <Required>Y</Required>
     </publish>
+    <exitenabled type="BooleanField">
+      <default>0</default>
+      <Required>Y</Required>
+    </exitenabled>
+    <exitipv6 type="BooleanField">
+      <default>0</default>
+      <Required>N</Required>
+    </exitipv6>
+    <exitrejectlocalif type="BooleanField">
+        <default>1</default>
+        <Required>Y</Required>
+    </exitrejectlocalif>
   </items>
 </model>

security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc

@@ -202,10 +202,21 @@ DirPort {% if helpers.exists('OPNsense.tor.relay.host') and OPNsense.tor.relay.h
 ## distribution for a sample.
 #DirPortFrontPage /usr/local/etc/tor/tor-exit-notice.html
 
+{% if helpers.exists('OPNsense.tor.relay.exitenabled') %}
+ExitRelay {{ OPNsense.tor.relay.exitenabled }}
+{% endif %}
+
+{% if helpers.exists('OPNsense.tor.relay.exitipv6') %}
+IPv6Exit {{ OPNsense.tor.relay.exitipv6 }}
+{% endif %}
+
 {% if helpers.exists('OPNsense.tor.relay.exitrejectprivateip') %}
 ExitPolicyRejectPrivate {{ OPNsense.tor.relay.exitrejectprivateip }}
 {% endif %}
 
+{% if helpers.exists('OPNsense.tor.relay.exitrejectlocalif') %}
+ExitPolicyRejectLocalInterfaces {{ OPNsense.tor.relay.exitrejectlocalif }}
+{% endif %}
 
 {% if helpers.exists('OPNsense.tor.exitpolicy') %}
 {%   if helpers.exists('OPNsense.tor.exitpolicy.policy') %}
@@ -213,8 +224,7 @@ ExitPolicyRejectPrivate {{ OPNsense.tor.relay.exitrejectprivateip }}
 
 {%     for policy in helpers.toList('OPNsense.tor.exitpolicy.policy') %}
 {%       if policy.enabled == '1' %}
-ExitPolicy {{ policy.action }}{% if policy.type == 'v6' %}6{% endif
-            %} {% if policy.network == '' %}*{% if 'v' in policy.type %}{{ policy.type|replace('v','') }}{% endif%}{% else
+ExitPolicy {{ policy.action }} {% if policy.network == 'any' %}*{% if 'v' in policy.type %}{{ policy.type|replace('v','') }}{% endif%}{% else
             %}{{ policy.network }}{% endif
             %}{% if 'startport' in policy %}:{{ policy.startport
               }}{% if 'endport' in policy %}-{{ policy.endport }}{% endif