Tor
0.4.7.0-alpha-dev
|
Code to parse and use address policies and exit policies. More...
#include "core/or/or.h"
#include "feature/client/bridges.h"
#include "app/config/config.h"
#include "core/or/policies.h"
#include "feature/dirparse/policy_parse.h"
#include "feature/nodelist/microdesc.h"
#include "feature/nodelist/networkstatus.h"
#include "feature/nodelist/nodelist.h"
#include "feature/relay/router.h"
#include "feature/relay/routermode.h"
#include "lib/geoip/geoip.h"
#include "ht.h"
#include "lib/crypt_ops/crypto_rand.h"
#include "lib/encoding/confline.h"
#include "trunnel/ed25519_cert.h"
#include "core/or/addr_policy_st.h"
#include "feature/dirclient/dir_server_st.h"
#include "feature/nodelist/microdesc_st.h"
#include "feature/nodelist/node_st.h"
#include "core/or/port_cfg_st.h"
#include "feature/nodelist/routerinfo_st.h"
#include "feature/nodelist/routerstatus_st.h"
Go to the source code of this file.
Data Structures | |
struct | policy_summary_item_t |
struct | policy_map_ent_t |
Macros | |
#define | POLICIES_PRIVATE |
#define | MAX_EXITPOLICY_SUMMARY_LEN 1000 |
#define | REJECT(arg) STMT_BEGIN *msg = tor_strdup(arg); goto err; STMT_END |
#define | CMP_FIELD(field) |
#define | DEFAULT_EXIT_POLICY |
#define | REDUCED_EXIT_POLICY |
#define | AT(x) ((policy_summary_item_t*)smartlist_get(summary, x)) |
#define | IPV4_BITS (32) |
#define | REJECT_CUTOFF_SCALE_IPV4 (0) |
#define | REJECT_CUTOFF_COUNT_IPV4 |
#define | IPV6_BITS (128) |
#define | REJECT_CUTOFF_SCALE_IPV6 (64) |
#define | REJECT_CUTOFF_COUNT_IPV6 |
Functions | |
static int | policies_parse_exit_policy_internal (config_line_t *cfg, smartlist_t **dest, int ipv6_exit, int rejectprivate, const smartlist_t *configured_addresses, int reject_interface_addresses, int reject_configured_port_addresses, int add_default_policy, int add_reduced_policy) |
void | policy_expand_private (smartlist_t **policy) |
void | policy_expand_unspec (smartlist_t **policy) |
static int | parse_addr_policy (config_line_t *cfg, smartlist_t **dest, int assume_action) |
static int | parse_reachable_addresses (void) |
static int | firewall_is_fascist_impl (void) |
int | firewall_is_fascist_or (void) |
int | firewall_is_fascist_dir (void) |
static int | addr_policy_permits_tor_addr (const tor_addr_t *addr, uint16_t port, smartlist_t *policy) |
STATIC int | reachable_addr_allows (const tor_addr_t *addr, uint16_t port, smartlist_t *firewall_policy, int pref_only, int pref_ipv6) |
int | reachable_addr_use_ipv6 (const or_options_t *options) |
static int | reachable_addr_prefer_ipv6_impl (const or_options_t *options) |
int | reachable_addr_prefer_ipv6_orport (const or_options_t *options) |
int | reachable_addr_prefer_ipv6_dirport (const or_options_t *options) |
int | reachable_addr_allows_addr (const tor_addr_t *addr, uint16_t port, firewall_connection_t fw_connection, int pref_only, int pref_ipv6) |
static int | reachable_addr_allows_ap (const tor_addr_port_t *ap, firewall_connection_t fw_connection, int pref_only, int pref_ipv6) |
static int | reachable_addr_allows_base (const tor_addr_t *ipv4_addr, uint16_t ipv4_orport, uint16_t ipv4_dirport, const tor_addr_t *ipv6_addr, uint16_t ipv6_orport, uint16_t ipv6_dirport, firewall_connection_t fw_connection, int pref_only, int pref_ipv6) |
static int | reachable_addr_allows_ri_impl (const routerinfo_t *ri, firewall_connection_t fw_connection, int pref_only, int pref_ipv6) |
static int | reachable_addr_allows_rs_impl (const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only, int pref_ipv6) |
int | reachable_addr_allows_rs (const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only) |
static int | reachable_addr_allows_md_impl (const microdesc_t *md, firewall_connection_t fw_connection, int pref_only, int pref_ipv6) |
int | reachable_addr_allows_node (const node_t *node, firewall_connection_t fw_connection, int pref_only) |
int | reachable_addr_allows_dir_server (const dir_server_t *ds, firewall_connection_t fw_connection, int pref_only) |
static const tor_addr_port_t * | reachable_addr_choose_impl (const tor_addr_port_t *a, const tor_addr_port_t *b, int want_a, firewall_connection_t fw_connection, int pref_only, int pref_ipv6) |
STATIC const tor_addr_port_t * | reachable_addr_choose (const tor_addr_port_t *a, const tor_addr_port_t *b, int want_a, firewall_connection_t fw_connection, int pref_only, int pref_ipv6) |
static void | reachable_addr_choose_base (const tor_addr_t *ipv4_addr, uint16_t ipv4_orport, uint16_t ipv4_dirport, const tor_addr_t *ipv6_addr, uint16_t ipv6_orport, uint16_t ipv6_dirport, firewall_connection_t fw_connection, int pref_only, int pref_ipv6, tor_addr_port_t *ap) |
void | reachable_addr_choose_from_rs (const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap) |
void | reachable_addr_choose_from_ls (const smartlist_t *lspecs, int pref_only, tor_addr_port_t *ap) |
void | reachable_addr_choose_from_node (const node_t *node, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap) |
void | reachable_addr_choose_from_dir_server (const dir_server_t *ds, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap) |
int | dir_policy_permits_address (const tor_addr_t *addr) |
int | socks_policy_permits_address (const tor_addr_t *addr) |
int | metrics_policy_permits_address (const tor_addr_t *addr) |
static int | addr_is_in_cc_list (const tor_addr_t *addr, const smartlist_t *cc_list) |
int | authdir_policy_permits_address (const tor_addr_t *addr, uint16_t port) |
int | authdir_policy_valid_address (const tor_addr_t *addr, uint16_t port) |
int | authdir_policy_badexit_address (const tor_addr_t *addr, uint16_t port) |
static int | policy_using_default_exit_options (const or_options_t *or_options) |
int | validate_addr_policies (const or_options_t *options, char **msg) |
static int | load_policy_from_option (config_line_t *config, const char *option_name, smartlist_t **policy, int assume_action) |
static int | parse_metrics_port_policy (const or_options_t *options) |
int | policies_parse_from_options (const or_options_t *options) |
static int | single_addr_policy_eq (const addr_policy_t *a, const addr_policy_t *b) |
int | addr_policies_eq (const smartlist_t *a, const smartlist_t *b) |
static | HT_HEAD (policy_map, policy_map_ent_t) |
static unsigned int | policy_hash (const policy_map_ent_t *ent) |
HT_PROTOTYPE (policy_map, policy_map_ent_t, node, policy_hash, policy_eq) | |
HT_GENERATE2 (policy_map, policy_map_ent_t, node, policy_hash, policy_eq, 0.6, tor_reallocarray_, tor_free_) | |
addr_policy_t * | addr_policy_get_canonical_entry (addr_policy_t *e) |
static addr_policy_result_t | compare_known_tor_addr_to_addr_policy (const tor_addr_t *addr, uint16_t port, const smartlist_t *policy) |
static addr_policy_result_t | compare_known_tor_addr_to_addr_policy_noport (const tor_addr_t *addr, const smartlist_t *policy) |
static addr_policy_result_t | compare_unknown_tor_addr_to_addr_policy (uint16_t port, const smartlist_t *policy) |
addr_policy_result_t | compare_tor_addr_to_addr_policy (const tor_addr_t *addr, uint16_t port, const smartlist_t *policy) |
static int | addr_policy_covers (addr_policy_t *a, addr_policy_t *b) |
static int | addr_policy_intersects (addr_policy_t *a, addr_policy_t *b) |
STATIC void | append_exit_policy_string (smartlist_t **policy, const char *more) |
void | addr_policy_append_reject_addr (smartlist_t **dest, const tor_addr_t *addr) |
static int | tor_addr_is_public_for_reject (const tor_addr_t *addr) |
static void | addr_policy_append_reject_addr_filter (smartlist_t **dest, const tor_addr_t *addr, int ipv4_rules, int ipv6_rules) |
void | addr_policy_append_reject_addr_list (smartlist_t **dest, const smartlist_t *addrs) |
static void | addr_policy_append_reject_addr_list_filter (smartlist_t **dest, const smartlist_t *addrs, int ipv4_rules, int ipv6_rules) |
static void | exit_policy_remove_redundancies (smartlist_t *dest) |
void | policies_parse_exit_policy_reject_private (smartlist_t **dest, int ipv6_exit, const smartlist_t *configured_addresses, int reject_interface_addresses, int reject_configured_port_addresses) |
static void | policies_log_first_redundant_entry (const smartlist_t *policy) |
int | policies_parse_exit_policy (config_line_t *cfg, smartlist_t **dest, exit_policy_parser_cfg_t options, const smartlist_t *configured_addresses) |
static void | policies_copy_addr_to_smartlist (smartlist_t *addr_list, const tor_addr_t *addr) |
static void | policies_copy_outbound_addresses_to_smartlist (smartlist_t *addr_list, const or_options_t *or_options) |
int | policies_parse_exit_policy_from_options (const or_options_t *or_options, const tor_addr_t *ipv4_local_address, const tor_addr_t *ipv6_local_address, smartlist_t **result) |
void | policies_exit_policy_append_reject_star (smartlist_t **dest) |
void | policies_set_node_exitpolicy_to_reject_all (node_t *node) |
static int | exit_policy_is_general_exit_helper (smartlist_t *policy, int port) |
int | exit_policy_is_general_exit (smartlist_t *policy) |
int | policy_is_reject_star (const smartlist_t *policy, sa_family_t family, int default_reject) |
int | policy_write_item (char *buf, size_t buflen, const addr_policy_t *policy, int format_for_desc) |
static smartlist_t * | policy_summary_create (void) |
static policy_summary_item_t * | policy_summary_item_split (policy_summary_item_t *old, uint16_t new_starts) |
static int | policy_summary_split (smartlist_t *summary, uint16_t prt_min, uint16_t prt_max) |
static void | policy_summary_accept (smartlist_t *summary, uint16_t prt_min, uint16_t prt_max, sa_family_t family) |
static void | policy_summary_reject (smartlist_t *summary, maskbits_t maskbits, uint16_t prt_min, uint16_t prt_max, sa_family_t family) |
static void | policy_summary_add_item (smartlist_t *summary, addr_policy_t *p) |
char * | policy_summarize (smartlist_t *policy, sa_family_t family) |
short_policy_t * | parse_short_policy (const char *summary) |
char * | write_short_policy (const short_policy_t *policy) |
void | short_policy_free_ (short_policy_t *policy) |
addr_policy_result_t | compare_tor_addr_to_short_policy (const tor_addr_t *addr, uint16_t port, const short_policy_t *policy) |
int | short_policy_is_reject_star (const short_policy_t *policy) |
addr_policy_result_t | compare_tor_addr_to_node_policy (const tor_addr_t *addr, uint16_t port, const node_t *node) |
char * | policy_dump_to_string (const smartlist_t *policy_list, int include_ipv4, int include_ipv6) |
int | getinfo_helper_policies (control_connection_t *conn, const char *question, char **answer, const char **errmsg) |
void | addr_policy_list_free_ (smartlist_t *lst) |
void | addr_policy_free_ (addr_policy_t *p) |
void | policies_free_all (void) |
Variables | |
static smartlist_t * | socks_policy = NULL |
static smartlist_t * | dir_policy = NULL |
static smartlist_t * | metrics_policy = NULL |
static smartlist_t * | authdir_reject_policy = NULL |
static smartlist_t * | authdir_invalid_policy = NULL |
static smartlist_t * | authdir_badexit_policy = NULL |
static smartlist_t * | reachable_or_addr_policy = NULL |
static smartlist_t * | reachable_dir_addr_policy = NULL |
static const char * | private_nets [] |
Code to parse and use address policies and exit policies.
We have two key kinds of address policy: full and compressed. A full policy is an array of accept/reject patterns, to be applied in order. A short policy is simply a list of ports. This module handles both kinds, including generic functions to apply them to addresses, and also including code to manage the global policies that we apply to incoming and outgoing connections.
Definition in file policies.c.
#define CMP_FIELD | ( | field | ) |
#define DEFAULT_EXIT_POLICY |
Definition at line 1901 of file policies.c.
#define MAX_EXITPOLICY_SUMMARY_LEN 1000 |
Maximum length of an exit policy summary.
Definition at line 45 of file policies.c.
#define REDUCED_EXIT_POLICY |
Definition at line 1906 of file policies.c.
#define REJECT_CUTOFF_COUNT_IPV4 |
Definition at line 2394 of file policies.c.
#define REJECT_CUTOFF_COUNT_IPV6 |
Definition at line 2406 of file policies.c.
|
static |
Return true iff the address addr is in a country listed in the case-insensitive list of country codes cc_list.
Definition at line 1077 of file policies.c.
Referenced by authdir_policy_badexit_address(), authdir_policy_permits_address(), and authdir_policy_valid_address().
int addr_policies_eq | ( | const smartlist_t * | a, |
const smartlist_t * | b | ||
) |
As single_addr_policy_eq, but compare every element of two policies.
Definition at line 1304 of file policies.c.
Referenced by router_differences_are_cosmetic().
void addr_policy_append_reject_addr | ( | smartlist_t ** | dest, |
const tor_addr_t * | addr | ||
) |
Add "reject <b>addr</b>:*" to dest, creating the list as needed.
Definition at line 1597 of file policies.c.
Referenced by addr_policy_append_reject_addr_list().
void addr_policy_append_reject_addr_list | ( | smartlist_t ** | dest, |
const smartlist_t * | addrs | ||
) |
Add "reject addr:*" to dest, for each addr in addrs, creating the list as needed.
Definition at line 1654 of file policies.c.
|
static |
Add "reject addr:*" to dest, for each addr in addrs, creating the list as needed. Filter using
Definition at line 1668 of file policies.c.
Referenced by policies_parse_exit_policy_reject_private().
|
static |
Return true iff the address policy a covers every case that would be covered by b, so that a,b is redundant.
Definition at line 1538 of file policies.c.
void addr_policy_free_ | ( | addr_policy_t * | p | ) |
Release all storage held by p.
Definition at line 3076 of file policies.c.
addr_policy_t* addr_policy_get_canonical_entry | ( | addr_policy_t * | e | ) |
Given a pointer to an addr_policy_t, return a copy of the pointer to the "canonical" copy of that addr_policy_t; the canonical copy is a single reference-counted object.
Definition at line 1369 of file policies.c.
|
static |
Return true iff the address policies a and b intersect, that is, there exists an address/port that is covered by a that is also covered by b.
Definition at line 1562 of file policies.c.
void addr_policy_list_free_ | ( | smartlist_t * | lst | ) |
Release all storage held by p.
Definition at line 3066 of file policies.c.
|
static |
Return true iff policy (possibly NULL) will allow a connection to addr:port.
Definition at line 376 of file policies.c.
Referenced by authdir_policy_badexit_address(), authdir_policy_permits_address(), authdir_policy_valid_address(), dir_policy_permits_address(), metrics_policy_permits_address(), reachable_addr_allows(), and socks_policy_permits_address().
STATIC void append_exit_policy_string | ( | smartlist_t ** | policy, |
const char * | more | ||
) |
Add the exit policy described by more to policy.
Definition at line 1583 of file policies.c.
Referenced by parse_metrics_port_policy(), policies_exit_policy_append_reject_star(), policies_parse_exit_policy_from_options(), and policies_parse_exit_policy_internal().
int authdir_policy_badexit_address | ( | const tor_addr_t * | addr, |
uint16_t | port | ||
) |
Return 1 if addr:port should be marked as a bad exit, based on authdir_badexit_policy. Else return 0.
Definition at line 1115 of file policies.c.
int authdir_policy_permits_address | ( | const tor_addr_t * | addr, |
uint16_t | port | ||
) |
Return 1 if addr:port is permitted to publish to our directory, based on authdir_reject_policy. Else return 0.
Definition at line 1093 of file policies.c.
int authdir_policy_valid_address | ( | const tor_addr_t * | addr, |
uint16_t | port | ||
) |
Return 1 if addr:port is considered valid in our directory, based on authdir_invalid_policy. Else return 0.
Definition at line 1104 of file policies.c.
|
static |
Helper for compare_tor_addr_to_addr_policy. Implements the case where addr and port are both known.
Definition at line 1393 of file policies.c.
|
static |
Helper for compare_tor_addr_to_addr_policy. Implements the case where addr is known but port is not.
Definition at line 1421 of file policies.c.
addr_policy_result_t compare_tor_addr_to_addr_policy | ( | const tor_addr_t * | addr, |
uint16_t | port, | ||
const smartlist_t * | policy | ||
) |
Decide whether a given addr:port is definitely accepted, definitely rejected, probably accepted, or probably rejected by a given policy. If addr is 0, we don't know the IP of the target address. If port is 0, we don't know the port of the target address. (At least one of addr and port must be provided. If you want to know whether a policy would definitely reject an unknown address:port, use policy_is_reject_star().)
We could do better by assuming that some ranges never match typical addresses (127.0.0.1, and so on). But we'll try this for now.
Definition at line 1516 of file policies.c.
Referenced by addr_policy_permits_tor_addr(), compare_tor_addr_to_node_policy(), router_compare_to_my_exit_policy(), and routerset_contains2().
addr_policy_result_t compare_tor_addr_to_node_policy | ( | const tor_addr_t * | addr, |
uint16_t | port, | ||
const node_t * | node | ||
) |
Decide whether addr:port is probably or definitely accepted or rejected by node. See compare_tor_addr_to_addr_policy for details on addr/port interpretation.
Definition at line 2887 of file policies.c.
Referenced by circuit_stream_is_being_handled(), connection_ap_can_use_exit(), connection_ap_get_begincell_flags(), router_exit_policy_all_nodes_reject(), and router_find_exact_exit_enclave().
addr_policy_result_t compare_tor_addr_to_short_policy | ( | const tor_addr_t * | addr, |
uint16_t | port, | ||
const short_policy_t * | policy | ||
) |
See whether the addr:port address is likely to be accepted or rejected by the summarized policy policy. Return values are as for compare_tor_addr_to_addr_policy. Unlike the regular addr_policy functions, requires the port be specified.
Definition at line 2822 of file policies.c.
Referenced by compare_tor_addr_to_node_policy(), and router_compare_to_my_exit_policy().
|
static |
Helper for compare_tor_addr_to_addr_policy. Implements the case where port is known but address is not.
Definition at line 1464 of file policies.c.
int dir_policy_permits_address | ( | const tor_addr_t * | addr | ) |
Return 1 if addr is permitted to connect to our dir port, based on dir_policy. Else return 0.
Definition at line 1051 of file policies.c.
int exit_policy_is_general_exit | ( | smartlist_t * | policy | ) |
Return true iff ri is "useful as an exit node", meaning it allows exit to at least one /8 address space for each of ports 80 and 443.
Definition at line 2230 of file policies.c.
|
static |
Return 1 if there is at least one /8 subnet in policy that allows exiting to port. Otherwise, return 0.
Definition at line 2182 of file policies.c.
Referenced by exit_policy_is_general_exit().
|
static |
Detect and excise "dead code" from the policy *dest.
Definition at line 1683 of file policies.c.
int firewall_is_fascist_dir | ( | void | ) |
Return true iff the firewall options, including ClientUseIPv4 0 and ClientUseIPv6 0, might block any Dir address:port combination. Address preferences may still change which address is selected even if this function returns false.
Definition at line 367 of file policies.c.
int firewall_is_fascist_or | ( | void | ) |
Return true iff the firewall options, including ClientUseIPv4 0 and ClientUseIPv6 0, might block any OR address:port combination. Address preferences may still change which address is selected even if this function returns false.
Definition at line 356 of file policies.c.
int getinfo_helper_policies | ( | control_connection_t * | conn, |
const char * | question, | ||
char ** | answer, | ||
const char ** | errmsg | ||
) |
Implementation for GETINFO control command: knows the answer for questions about "exit-policy/..."
Definition at line 2968 of file policies.c.
|
static |
Parse string in the same way that the exit policy is parsed, and put the processed version in *policy. Ignore port specifiers.
Definition at line 1198 of file policies.c.
Referenced by parse_metrics_port_policy(), and policies_parse_from_options().
int metrics_policy_permits_address | ( | const tor_addr_t * | addr | ) |
Return 1 if addr is permitted to connect to our metrics port, based on socks_policy. Else return 0.
Definition at line 1069 of file policies.c.
Referenced by metrics_request_allowed().
|
static |
Given a linked list of config lines containing "accept[6]" and "reject[6]" tokens, parse them and append the result to dest. Return -1 if any tokens are malformed (and don't append any), else return 0.
If assume_action is nonnegative, then insert its action (ADDR_POLICY_ACCEPT or ADDR_POLICY_REJECT) for items that specify no action.
Definition at line 196 of file policies.c.
Referenced by append_exit_policy_string(), and policies_parse_exit_policy_internal().
|
static |
Helper: Parse the MetricsPortPolicy option into the metrics_policy and set the reject all by default.
Return 0 on success else -1.
Definition at line 1237 of file policies.c.
|
static |
Helper: parse the Reachable(Dir|OR)?Addresses fields into reachable_(or|dir)_addr_policy. The options should already have been validated by validate_addr_policies.
Definition at line 259 of file policies.c.
short_policy_t* parse_short_policy | ( | const char * | summary | ) |
Convert a summarized policy string into a short_policy_t. Return NULL if the string is not well-formed.
Definition at line 2685 of file policies.c.
|
static |
Helper function that adds a copy of addr to a smartlist as long as it is non-NULL and not tor_addr_is_null().
The caller is responsible for freeing all the tor_addr_t* in the smartlist.
Definition at line 2046 of file policies.c.
Referenced by policies_copy_outbound_addresses_to_smartlist().
|
static |
Helper function that adds copies of or_options->OutboundBindAddresses to a smartlist as tor_addr_t *, as long as or_options is non-NULL, and the addresses are not tor_addr_is_null(), by passing them to policies_add_addr_to_smartlist.
The caller is responsible for freeing all the tor_addr_t* in the smartlist.
Definition at line 2063 of file policies.c.
void policies_exit_policy_append_reject_star | ( | smartlist_t ** | dest | ) |
Add "reject *:*" to the end of the policy in *dest, allocating *dest as needed.
Definition at line 2166 of file policies.c.
void policies_free_all | ( | void | ) |
Release all storage held by policy variables.
Definition at line 3097 of file policies.c.
|
static |
Iterate through policy looking for redundant entries. Log a warning message with the first redundant entry, if any is found.
Definition at line 1842 of file policies.c.
Referenced by policies_parse_exit_policy_internal().
int policies_parse_exit_policy | ( | config_line_t * | cfg, |
smartlist_t ** | dest, | ||
exit_policy_parser_cfg_t | options, | ||
const smartlist_t * | configured_addresses | ||
) |
Parse exit policy in cfg into dest smartlist.
Prepend an entry that rejects all IPv6 destinations unless EXIT_POLICY_IPV6_ENABLED bit is set in options bitmask.
If EXIT_POLICY_REJECT_PRIVATE bit is set in options:
If EXIT_POLICY_ADD_DEFAULT bit is set in options, append default exit policy entries to result smartlist.
Definition at line 2020 of file policies.c.
int policies_parse_exit_policy_from_options | ( | const or_options_t * | or_options, |
const tor_addr_t * | ipv4_local_address, | ||
const tor_addr_t * | ipv6_local_address, | ||
smartlist_t ** | result | ||
) |
Parse ExitPolicy member of or_options into result smartlist. If or_options->IPv6Exit is false, prepend an entry that rejects all IPv6 destinations.
If or_options->ExitPolicyRejectPrivate is true:
If or_options->BridgeRelay is false, append entries of default Tor exit policy into result smartlist.
If or_options->ExitRelay is false, or is auto without specifying an exit policy, then make our exit policy into "reject *:*" regardless.
Definition at line 2103 of file policies.c.
Referenced by validate_addr_policies().
|
static |
Parse the exit policy cfg into the linked list *dest.
If ipv6_exit is false, prepend "reject *6:*" to the policy.
If configured_addresses contains addresses:
If cfg doesn't end in an absolute accept or reject and if add_default_policy is true, add the default exit policy afterwards.
Return -1 if we can't parse cfg, else return 0.
This function is used to parse the exit policy from our torrc. For the functions used to parse the exit policy from a router descriptor, see router_add_exit_policy.
Definition at line 1952 of file policies.c.
void policies_parse_exit_policy_reject_private | ( | smartlist_t ** | dest, |
int | ipv6_exit, | ||
const smartlist_t * | configured_addresses, | ||
int | reject_interface_addresses, | ||
int | reject_configured_port_addresses | ||
) |
Reject private helper for policies_parse_exit_policy_internal: rejects publicly routable addresses on this exit relay.
Add reject entries to the linked list *dest:
IPv6 entries are only added if ipv6_exit is true. (All IPv6 addresses are already blocked by policies_parse_exit_policy_internal if ipv6_exit is false.)
The list in dest is created as needed.
Definition at line 1785 of file policies.c.
Referenced by policies_parse_exit_policy_internal().
int policies_parse_from_options | ( | const or_options_t * | options | ) |
Set all policies based on options, which should have been validated first by validate_addr_policies.
Definition at line 1251 of file policies.c.
void policies_set_node_exitpolicy_to_reject_all | ( | node_t * | node | ) |
Replace the exit policy of node with reject *:*
Definition at line 2174 of file policies.c.
char* policy_dump_to_string | ( | const smartlist_t * | policy_list, |
int | include_ipv4, | ||
int | include_ipv6 | ||
) |
Given policy_list, a list of addr_policy_t, produce a string representation of the list. If include_ipv4 is true, include IPv4 entries. If include_ipv6 is true, include IPv6 entries.
Definition at line 2925 of file policies.c.
void policy_expand_private | ( | smartlist_t ** | policy | ) |
Replace all "private" entries in *policy with their expanded equivalents.
Definition at line 107 of file policies.c.
void policy_expand_unspec | ( | smartlist_t ** | policy | ) |
Expand each of the AF_UNSPEC elements in *policy (which indicate protocol-neutral wildcards) into a pair of wildcard elements: one IPv4- specific and one IPv6-specific.
Definition at line 147 of file policies.c.
|
static |
Return a hashcode for ent
Definition at line 1339 of file policies.c.
int policy_is_reject_star | ( | const smartlist_t * | policy, |
sa_family_t | family, | ||
int | default_reject | ||
) |
Return false if policy might permit access to some addr:port; otherwise if we are certain it rejects everything, return true. If no part of policy matches, return default_reject. NULL policies are allowed, and treated as empty.
Definition at line 2244 of file policies.c.
char* policy_summarize | ( | smartlist_t * | policy, |
sa_family_t | family | ||
) |
Create a string representing a summary for an exit policy. The summary will either be an "accept" plus a comma-separated list of port ranges or a "reject" plus port-ranges, depending on which is shorter.
If no exits are allowed at all then "reject 1-65535" is returned. If no ports are blocked instead of "reject " we return "accept 1-65535". (These are an exception to the shorter-representation-wins rule).
Definition at line 2573 of file policies.c.
|
static |
Mark port ranges as accepted if they are below the reject_count for family
Definition at line 2444 of file policies.c.
|
static |
Add a single exit policy item to our summary:
If it is an accept, ignore it unless it is for all IP addresses ("*", i.e. its prefixlen/maskbits is 0). Otherwise call policy_summary_accept().
If it is a reject, ignore it if it is about one of the private networks. Otherwise call policy_summary_reject().
Definition at line 2532 of file policies.c.
|
static |
Create a new exit policy summary, initially only with a single port 1-64k item
Definition at line 2344 of file policies.c.
|
static |
Split the summary item in item at the port new_starts. The current item is changed to end at new-starts - 1, the new item copies reject_count and accepted from the old item, starts at new_starts and ends at the port where the original item previously ended.
Definition at line 2368 of file policies.c.
|
static |
Count the number of addresses in a network in family with prefixlen maskbits against the given portrange.
Definition at line 2467 of file policies.c.
|
static |
Split an exit policy summary so that prt_min and prt_max fall at exactly the start and end of an item respectively.
Definition at line 2413 of file policies.c.
|
static |
Check or_options to determine whether or not we are using the default options for exit policy. Return true if so, false otherwise.
Definition at line 1128 of file policies.c.
Referenced by policies_parse_exit_policy_from_options().
int policy_write_item | ( | char * | buf, |
size_t | buflen, | ||
const addr_policy_t * | policy, | ||
int | format_for_desc | ||
) |
Write a single address policy to the buf_len byte buffer at buf. Return the number of characters written, or -1 on failure.
Definition at line 2268 of file policies.c.
STATIC int reachable_addr_allows | ( | const tor_addr_t * | addr, |
uint16_t | port, | ||
smartlist_t * | firewall_policy, | ||
int | pref_only, | ||
int | pref_ipv6 | ||
) |
Return true iff we think our firewall will let us make a connection to addr:port.
If we are configured as a server, ignore any address family preference and just use IPv4. Otherwise:
Return false if addr is NULL or tor_addr_is_null(), or if port is 0.
Definition at line 409 of file policies.c.
int reachable_addr_allows_addr | ( | const tor_addr_t * | addr, |
uint16_t | port, | ||
firewall_connection_t | fw_connection, | ||
int | pref_only, | ||
int | pref_ipv6 | ||
) |
Return true iff we think our firewall will let us make a connection to addr:port. Uses ReachableORAddresses or ReachableDirAddresses based on fw_connection. If pref_only is true, return true if addr is in the client's preferred address family, which is IPv6 if pref_ipv6 is true, and IPv4 otherwise. If pref_only is false, ignore pref_ipv6, and return true if addr is allowed.
Definition at line 533 of file policies.c.
Referenced by bridge_passes_guard_filter(), directory_command_should_use_begindir(), reachable_addr_allows_ap(), and reachable_addr_allows_base().
|
static |
Return true iff we think our firewall will let us make a connection to addr:port (ap). Uses ReachableORAddresses or ReachableDirAddresses based on fw_connection. pref_only and pref_ipv6 work as in reachable_addr_allows_addr().
Definition at line 558 of file policies.c.
Referenced by reachable_addr_choose_impl().
|
static |
Return true iff we think our firewall will let us make a connection to ipv4h_addr/ipv6_addr. Uses ipv4_orport/ipv6_orport/ReachableORAddresses or ipv4_dirport/ipv6_dirport/ReachableDirAddresses based on IPv4/IPv6 and fw_connection. pref_only and pref_ipv6 work as in reachable_addr_allows_addr().
Definition at line 575 of file policies.c.
Referenced by reachable_addr_allows_ri_impl(), and reachable_addr_allows_rs_impl().
int reachable_addr_allows_dir_server | ( | const dir_server_t * | ds, |
firewall_connection_t | fw_connection, | ||
int | pref_only | ||
) |
Like reachable_addr_allows_rs(), but takes ds.
Definition at line 728 of file policies.c.
|
static |
Return true iff we think our firewall will let us make a connection to ipv6_addr:ipv6_orport based on ReachableORAddresses. If fw_connection is FIREWALL_DIR_CONNECTION, returns 0. pref_only and pref_ipv6 work as in reachable_addr_allows_addr().
Definition at line 668 of file policies.c.
int reachable_addr_allows_node | ( | const node_t * | node, |
firewall_connection_t | fw_connection, | ||
int | pref_only | ||
) |
Like reachable_addr_allows_base(), but takes node, and looks up pref_ipv6 from node_ipv6_or/dir_preferred().
Definition at line 690 of file policies.c.
Referenced by node_passes_guard_filter().
|
static |
Like reachable_addr_allows_base(), but takes ri.
Definition at line 605 of file policies.c.
int reachable_addr_allows_rs | ( | const routerstatus_t * | rs, |
firewall_connection_t | fw_connection, | ||
int | pref_only | ||
) |
Like reachable_addr_allows_base(), but takes rs. When rs is a fake_status from a dir_server_t, it can have a reachable address, even when the corresponding node does not. nodes can be missing addresses when there's no consensus (IPv4 and IPv6), or when there is a microdescriptor consensus, but no microdescriptors (microdescriptors have IPv6, the microdesc consensus does not).
Definition at line 644 of file policies.c.
Referenced by reachable_addr_allows_dir_server().
|
static |
Like reachable_addr_allows_rs, but takes pref_ipv6.
Definition at line 622 of file policies.c.
STATIC const tor_addr_port_t* reachable_addr_choose | ( | const tor_addr_port_t * | a, |
const tor_addr_port_t * | b, | ||
int | want_a, | ||
firewall_connection_t | fw_connection, | ||
int | pref_only, | ||
int | pref_ipv6 | ||
) |
If a and b are both valid and preferred by fw_connection, choose one based on want_a and return it. Otherwise, return whichever is preferred. If neither are preferred, and pref_only is false:
Definition at line 789 of file policies.c.
|
static |
Copy an address and port into ap that we think our firewall will let us connect to. Uses ipv4_addr/ipv6_addr and ipv4_orport/ipv6_orport/ReachableORAddresses or ipv4_dirport/ipv6_dirport/ReachableDirAddresses based on IPv4/IPv6 and fw_connection. If pref_only, only choose preferred addresses. In either case, choose a preferred address before an address that's not preferred. If both addresses could be chosen (they are both preferred or both allowed) choose IPv6 if pref_ipv6 is true, otherwise choose IPv4.
Definition at line 822 of file policies.c.
void reachable_addr_choose_from_dir_server | ( | const dir_server_t * | ds, |
firewall_connection_t | fw_connection, | ||
int | pref_only, | ||
tor_addr_port_t * | ap | ||
) |
Like reachable_addr_choose_from_rs(), but takes ds.
Definition at line 1024 of file policies.c.
void reachable_addr_choose_from_ls | ( | const smartlist_t * | lspecs, |
int | pref_only, | ||
tor_addr_port_t * | ap | ||
) |
Like reachable_addr_choose_base(), but takes in a smartlist lspecs consisting of one or more link specifiers. We assume fw_connection is FIREWALL_OR_CONNECTION as link specifiers cannot contain DirPorts.
Definition at line 910 of file policies.c.
void reachable_addr_choose_from_node | ( | const node_t * | node, |
firewall_connection_t | fw_connection, | ||
int | pref_only, | ||
tor_addr_port_t * | ap | ||
) |
Like reachable_addr_choose_base(), but takes node, and looks up the node's IPv6 preference rather than taking an argument for pref_ipv6.
Definition at line 985 of file policies.c.
Referenced by extend_info_from_node(), and reachable_addr_choose_from_rs().
void reachable_addr_choose_from_rs | ( | const routerstatus_t * | rs, |
firewall_connection_t | fw_connection, | ||
int | pref_only, | ||
tor_addr_port_t * | ap | ||
) |
Like reachable_addr_choose_base(), but takes rs. Consults the corresponding node, then falls back to rs if node is NULL. This should only happen when there's no valid consensus, and rs doesn't correspond to a bridge client's bridge.
Definition at line 871 of file policies.c.
Referenced by reachable_addr_choose_from_dir_server().
|
static |
If a and b are both valid and allowed by fw_connection, choose one based on want_a and return it. Otherwise, return whichever is allowed. Otherwise, return NULL. pref_only and pref_ipv6 work as in reachable_addr_allows_addr().
Definition at line 751 of file policies.c.
Referenced by reachable_addr_choose().
int reachable_addr_prefer_ipv6_dirport | ( | const or_options_t * | options | ) |
Do we prefer to connect to IPv6 DirPorts?
(node_ipv6_dir_preferred() doesn't support bridge client per-node IPv6 preferences. There's no reason to use it instead of this function.)
Definition at line 509 of file policies.c.
|
static |
Do we prefer to connect to IPv6, ignoring ClientPreferIPv6ORPort and ClientPreferIPv6DirPort? If we're unsure, return -1, otherwise, return 1 for IPv6 and 0 for IPv4.
Definition at line 463 of file policies.c.
Referenced by reachable_addr_prefer_ipv6_dirport(), and reachable_addr_prefer_ipv6_orport().
int reachable_addr_prefer_ipv6_orport | ( | const or_options_t * | options | ) |
Do we prefer to connect to IPv6 ORPorts? Use node_ipv6_or_preferred() whenever possible: it supports bridge client per-node IPv6 preferences.
Definition at line 487 of file policies.c.
int reachable_addr_use_ipv6 | ( | const or_options_t * | options | ) |
Is this client configured to use IPv6? Returns true if the client might use IPv6 for some of its connections (including dual-stack and IPv6-only clients), and false if it will never use IPv6 for any connections. Use node_ipv6_or/dir_preferred() when checking a specific node and OR/Dir port: it supports bridge client per-node IPv6 preferences.
Definition at line 448 of file policies.c.
Referenced by reachable_addr_allows(), and reachable_addr_prefer_ipv6_impl().
void short_policy_free_ | ( | short_policy_t * | policy | ) |
Release all storage held in policy.
Definition at line 2812 of file policies.c.
int short_policy_is_reject_star | ( | const short_policy_t * | policy | ) |
Return true iff policy seems reject all ports
Definition at line 2870 of file policies.c.
|
static |
Compare two provided address policy items, and renturn -1, 0, or 1 if the first is less than, equal to, or greater than the second.
Definition at line 1280 of file policies.c.
int socks_policy_permits_address | ( | const tor_addr_t * | addr | ) |
Return 1 if addr is permitted to connect to our socks port, based on socks_policy. Else return 0.
Definition at line 1060 of file policies.c.
int validate_addr_policies | ( | const or_options_t * | options, |
char ** | msg | ||
) |
Config helper: If there's any problem with the policy configuration options in options, return -1 and set msg to a newly allocated description of the error. Else return 0.
Definition at line 1138 of file policies.c.
char* write_short_policy | ( | const short_policy_t * | policy | ) |
Write policy back out into a string.
Definition at line 2786 of file policies.c.
|
static |
Policy that addresses for incoming router descriptors must not match in order to not be marked as BadExit.
Definition at line 61 of file policies.c.
Referenced by authdir_policy_badexit_address().
|
static |
Policy that addresses for incoming router descriptors must match in order to be marked as valid in our networkstatus.
Definition at line 58 of file policies.c.
Referenced by authdir_policy_valid_address().
|
static |
Policy that addresses for incoming router descriptors must match in order to be published by us.
Definition at line 55 of file policies.c.
Referenced by authdir_policy_permits_address(), and policies_parse_from_options().
|
static |
Policy that addresses for incoming directory connections must match.
Definition at line 50 of file policies.c.
Referenced by dir_policy_permits_address(), and policies_parse_from_options().
|
static |
Policy for incoming MetricsPort connections that must match.
Definition at line 52 of file policies.c.
Referenced by metrics_policy_permits_address(), and parse_metrics_port_policy().
|
static |
Private networks. This list is used in two places, once to expand the "private" keyword when parsing our own exit policy, secondly to ignore just such networks when building exit policy summaries. It is important that all authorities agree on that list when creating summaries, so don't just change this without a proper migration plan and a proposal and stuff.
Definition at line 85 of file policies.c.
Referenced by policy_expand_private().
|
static |
Parsed addr_policy_t describing which addresses we believe we can connect to directories at.
Definition at line 68 of file policies.c.
Referenced by firewall_is_fascist_dir().
|
static |
Parsed addr_policy_t describing which addresses we believe we can start circuits at.
Definition at line 65 of file policies.c.
Referenced by firewall_is_fascist_or().
|
static |
Policy that addresses for incoming SOCKS connections must match.
Definition at line 48 of file policies.c.
Referenced by policies_parse_from_options(), and socks_policy_permits_address().