Tor  0.4.5.0-alpha-dev
policies.h
Go to the documentation of this file.
1 /* Copyright (c) 2001 Matej Pfajfar.
2  * Copyright (c) 2001-2004, Roger Dingledine.
3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4  * Copyright (c) 2007-2020, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
6 
7 /**
8  * \file policies.h
9  * \brief Header file for policies.c.
10  **/
11 
12 #ifndef TOR_POLICIES_H
13 #define TOR_POLICIES_H
14 
15 /* (length of
16  * "accept6 [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]/128:65535-65535\n"
17  * plus a terminating NUL, rounded up to a nice number.)
18  */
19 #define POLICY_BUF_LEN 72
20 
21 #define EXIT_POLICY_IPV6_ENABLED (1 << 0)
22 #define EXIT_POLICY_REJECT_PRIVATE (1 << 1)
23 #define EXIT_POLICY_ADD_DEFAULT (1 << 2)
24 #define EXIT_POLICY_REJECT_LOCAL_INTERFACES (1 << 3)
25 #define EXIT_POLICY_ADD_REDUCED (1 << 4)
26 #define EXIT_POLICY_OPTION_MAX EXIT_POLICY_ADD_REDUCED
27 /* All options set: used for unit testing */
28 #define EXIT_POLICY_OPTION_ALL ((EXIT_POLICY_OPTION_MAX << 1) - 1)
29 
30 typedef enum firewall_connection_t {
31  FIREWALL_OR_CONNECTION = 0,
32  FIREWALL_DIR_CONNECTION = 1
33 } firewall_connection_t;
34 
35 typedef int exit_policy_parser_cfg_t;
36 
37 /** Outcome of applying an address policy to an address. */
38 typedef enum {
39  /** The address was accepted */
41  /** The address was rejected */
43  /** Part of the address was unknown, but as far as we can tell, it was
44  * accepted. */
46  /** Part of the address was unknown, but as far as we can tell, it was
47  * rejected. */
50 
51 /** A single entry in a parsed policy summary, describing a range of ports. */
52 typedef struct short_policy_entry_t {
53  uint16_t min_port, max_port;
55 
56 /** A short_poliy_t is the parsed version of a policy summary. */
57 typedef struct short_policy_t {
58  /** True if the members of 'entries' are port ranges to accept; false if
59  * they are port ranges to reject */
60  unsigned int is_accept : 1;
61  /** The actual number of values in 'entries'. */
62  unsigned int n_entries : 31;
63  /** An array of 0 or more short_policy_entry_t values, each describing a
64  * range of ports that this policy accepts or rejects (depending on the
65  * value of is_accept).
66  */
67  short_policy_entry_t entries[FLEXIBLE_ARRAY_MEMBER];
69 
70 int firewall_is_fascist_or(void);
71 int firewall_is_fascist_dir(void);
72 int fascist_firewall_use_ipv6(const or_options_t *options);
75 
77  uint16_t port,
78  firewall_connection_t fw_connection,
79  int pref_only, int pref_ipv6);
80 
82  firewall_connection_t fw_connection,
83  int pref_only);
84 int fascist_firewall_allows_node(const node_t *node,
85  firewall_connection_t fw_connection,
86  int pref_only);
88  firewall_connection_t fw_connection,
89  int pref_only);
90 
92  firewall_connection_t fw_connection,
93  int pref_only, tor_addr_port_t* ap);
95  int pref_only, tor_addr_port_t* ap);
97  firewall_connection_t fw_connection,
98  int pref_only, tor_addr_port_t* ap);
100  firewall_connection_t fw_connection,
101  int pref_only, tor_addr_port_t* ap);
102 
103 int dir_policy_permits_address(const tor_addr_t *addr);
105 int authdir_policy_permits_address(const tor_addr_t *addr, uint16_t port);
106 int authdir_policy_valid_address(const tor_addr_t *addr, uint16_t port);
107 int authdir_policy_badexit_address(const tor_addr_t *addr, uint16_t port);
108 
109 int validate_addr_policies(const or_options_t *options, char **msg);
110 void policy_expand_private(smartlist_t **policy);
111 void policy_expand_unspec(smartlist_t **policy);
112 int policies_parse_from_options(const or_options_t *options);
113 
115 int addr_policies_eq(const smartlist_t *a, const smartlist_t *b);
117  (const tor_addr_t *addr, uint16_t port, const smartlist_t *policy));
119  uint16_t port, const node_t *node);
120 
122  const or_options_t *or_options,
123  const tor_addr_t *ipv4_local_address,
124  const tor_addr_t *ipv6_local_address,
125  smartlist_t **result);
126 struct config_line_t;
128  exit_policy_parser_cfg_t options,
129  const smartlist_t *configured_addresses);
131  smartlist_t **dest,
132  int ipv6_exit,
133  const smartlist_t *configured_addresses,
134  int reject_interface_addresses,
135  int reject_configured_port_addresses);
138  const tor_addr_t *addr);
140  const smartlist_t *addrs);
143 int policy_is_reject_star(const smartlist_t *policy, sa_family_t family,
144  int reject_by_default);
145 char * policy_dump_to_string(const smartlist_t *policy_list,
146  int include_ipv4,
147  int include_ipv6);
149  const char *question, char **answer,
150  const char **errmsg);
151 int policy_write_item(char *buf, size_t buflen, const addr_policy_t *item,
152  int format_for_desc);
153 
155 #define addr_policy_list_free(lst) \
156  FREE_AND_NULL(smartlist_t, addr_policy_list_free_, (lst))
158 #define addr_policy_free(p) \
159  FREE_AND_NULL(addr_policy_t, addr_policy_free_, (p))
160 void policies_free_all(void);
161 
162 char *policy_summarize(smartlist_t *policy, sa_family_t family);
163 
164 short_policy_t *parse_short_policy(const char *summary);
165 char *write_short_policy(const short_policy_t *policy);
166 void short_policy_free_(short_policy_t *policy);
167 #define short_policy_free(p) \
168  FREE_AND_NULL(short_policy_t, short_policy_free_, (p))
171  const tor_addr_t *addr, uint16_t port,
172  const short_policy_t *policy);
173 
174 #ifdef POLICIES_PRIVATE
175 STATIC void append_exit_policy_string(smartlist_t **policy, const char *more);
177  uint16_t port,
178  smartlist_t *firewall_policy,
179  int pref_only, int pref_ipv6);
181  const tor_addr_port_t *a,
182  const tor_addr_port_t *b,
183  int want_a,
184  firewall_connection_t fw_connection,
185  int pref_only, int pref_ipv6);
186 
187 #endif /* defined(POLICIES_PRIVATE) */
188 
189 #endif /* !defined(TOR_POLICIES_H) */
short_policy_t::n_entries
unsigned int n_entries
Definition: policies.h:62
fascist_firewall_prefer_ipv6_dirport
int fascist_firewall_prefer_ipv6_dirport(const or_options_t *options)
Definition: policies.c:507
fascist_firewall_use_ipv6
int fascist_firewall_use_ipv6(const or_options_t *options)
Definition: policies.c:446
ADDR_POLICY_PROBABLY_REJECTED
@ ADDR_POLICY_PROBABLY_REJECTED
Definition: policies.h:48
policy_summarize
char * policy_summarize(smartlist_t *policy, sa_family_t family)
Definition: policies.c:2543
short_policy_t
Definition: policies.h:57
tor_addr_t
Definition: address.h:69
short_policy_is_reject_star
int short_policy_is_reject_star(const short_policy_t *policy)
Definition: policies.c:2840
ADDR_POLICY_REJECTED
@ ADDR_POLICY_REJECTED
Definition: policies.h:42
dir_policy_permits_address
int dir_policy_permits_address(const tor_addr_t *addr)
Definition: policies.c:1049
compare_tor_addr_to_addr_policy
addr_policy_result_t compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, const smartlist_t *policy)
Definition: policies.c:1486
firewall_is_fascist_or
int firewall_is_fascist_or(void)
Definition: policies.c:354
fascist_firewall_allows_address_addr
int fascist_firewall_allows_address_addr(const tor_addr_t *addr, uint16_t port, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)
Definition: policies.c:531
policies_free_all
void policies_free_all(void)
Definition: policies.c:3067
parse_short_policy
short_policy_t * parse_short_policy(const char *summary)
Definition: policies.c:2655
authdir_policy_valid_address
int authdir_policy_valid_address(const tor_addr_t *addr, uint16_t port)
Definition: policies.c:1093
authdir_policy_permits_address
int authdir_policy_permits_address(const tor_addr_t *addr, uint16_t port)
Definition: policies.c:1082
routerstatus_t
Definition: routerstatus_st.h:19
policies_parse_exit_policy
int policies_parse_exit_policy(struct config_line_t *cfg, smartlist_t **dest, exit_policy_parser_cfg_t options, const smartlist_t *configured_addresses)
Definition: policies.c:1990
fascist_firewall_choose_address_node
void fascist_firewall_choose_address_node(const node_t *node, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:983
addr_policy_t
Definition: addr_policy_st.h:26
exit_policy_is_general_exit
int exit_policy_is_general_exit(smartlist_t *policy)
Definition: policies.c:2200
authdir_policy_badexit_address
int authdir_policy_badexit_address(const tor_addr_t *addr, uint16_t port)
Definition: policies.c:1104
ADDR_POLICY_PROBABLY_ACCEPTED
@ ADDR_POLICY_PROBABLY_ACCEPTED
Definition: policies.h:45
addr_policy_list_free_
void addr_policy_list_free_(smartlist_t *p)
Definition: policies.c:3036
policies_parse_from_options
int policies_parse_from_options(const or_options_t *options)
Definition: policies.c:1224
fascist_firewall_choose_address
STATIC const tor_addr_port_t * fascist_firewall_choose_address(const tor_addr_port_t *a, const tor_addr_port_t *b, int want_a, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)
Definition: policies.c:787
addr_policies_eq
int addr_policies_eq(const smartlist_t *a, const smartlist_t *b)
Definition: policies.c:1274
policies_parse_exit_policy_from_options
int policies_parse_exit_policy_from_options(const or_options_t *or_options, const tor_addr_t *ipv4_local_address, const tor_addr_t *ipv6_local_address, smartlist_t **result)
Definition: policies.c:2073
policy_write_item
int policy_write_item(char *buf, size_t buflen, const addr_policy_t *item, int format_for_desc)
Definition: policies.c:2238
tor_addr_port_t
Definition: address.h:81
append_exit_policy_string
STATIC void append_exit_policy_string(smartlist_t **policy, const char *more)
Definition: policies.c:1553
policies_exit_policy_append_reject_star
void policies_exit_policy_append_reject_star(smartlist_t **dest)
Definition: policies.c:2136
node_t
Definition: node_st.h:34
policies_parse_exit_policy_reject_private
void policies_parse_exit_policy_reject_private(smartlist_t **dest, int ipv6_exit, const smartlist_t *configured_addresses, int reject_interface_addresses, int reject_configured_port_addresses)
Definition: policies.c:1755
firewall_is_fascist_dir
int firewall_is_fascist_dir(void)
Definition: policies.c:365
fascist_firewall_prefer_ipv6_orport
int fascist_firewall_prefer_ipv6_orport(const or_options_t *options)
Definition: policies.c:485
ADDR_POLICY_ACCEPTED
@ ADDR_POLICY_ACCEPTED
Definition: policies.h:40
MOCK_DECL
#define MOCK_DECL(rv, funcname, arglist)
Definition: testsupport.h:127
dir_server_t
Definition: dir_server_st.h:21
getinfo_helper_policies
int getinfo_helper_policies(control_connection_t *conn, const char *question, char **answer, const char **errmsg)
Definition: policies.c:2938
short_policy_free_
void short_policy_free_(short_policy_t *policy)
Definition: policies.c:2782
fascist_firewall_choose_address_dir_server
void fascist_firewall_choose_address_dir_server(const dir_server_t *ds, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:1022
addr_policy_append_reject_addr
void addr_policy_append_reject_addr(smartlist_t **dest, const tor_addr_t *addr)
Definition: policies.c:1567
short_policy_t::is_accept
unsigned int is_accept
Definition: policies.h:60
compare_tor_addr_to_short_policy
addr_policy_result_t compare_tor_addr_to_short_policy(const tor_addr_t *addr, uint16_t port, const short_policy_t *policy)
Definition: policies.c:2792
fascist_firewall_choose_address_rs
void fascist_firewall_choose_address_rs(const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:869
fascist_firewall_allows_dir_server
int fascist_firewall_allows_dir_server(const dir_server_t *ds, firewall_connection_t fw_connection, int pref_only)
Definition: policies.c:726
addr_policy_append_reject_addr_list
void addr_policy_append_reject_addr_list(smartlist_t **dest, const smartlist_t *addrs)
Definition: policies.c:1624
addr_policy_result_t
addr_policy_result_t
Definition: policies.h:38
control_connection_t
Definition: control_connection_st.h:19
fascist_firewall_allows_address
STATIC int fascist_firewall_allows_address(const tor_addr_t *addr, uint16_t port, smartlist_t *firewall_policy, int pref_only, int pref_ipv6)
Definition: policies.c:407
policy_expand_unspec
void policy_expand_unspec(smartlist_t **policy)
Definition: policies.c:145
validate_addr_policies
int validate_addr_policies(const or_options_t *options, char **msg)
Definition: policies.c:1127
config_line_t
Definition: confline.h:29
short_policy_t::entries
short_policy_entry_t entries[FLEXIBLE_ARRAY_MEMBER]
Definition: policies.h:67
policies_set_node_exitpolicy_to_reject_all
void policies_set_node_exitpolicy_to_reject_all(node_t *exitrouter)
Definition: policies.c:2144
addr_policy_get_canonical_entry
addr_policy_t * addr_policy_get_canonical_entry(addr_policy_t *ent)
Definition: policies.c:1339
sa_family_t
uint16_t sa_family_t
Definition: inaddr_st.h:77
socks_policy_permits_address
int socks_policy_permits_address(const tor_addr_t *addr)
Definition: policies.c:1058
or_options_t
Definition: or_options_st.h:45
compare_tor_addr_to_node_policy
addr_policy_result_t compare_tor_addr_to_node_policy(const tor_addr_t *addr, uint16_t port, const node_t *node)
Definition: policies.c:2857
STATIC
#define STATIC
Definition: testsupport.h:32
fascist_firewall_allows_rs
int fascist_firewall_allows_rs(const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only)
Definition: policies.c:642
addr_policy_free_
void addr_policy_free_(addr_policy_t *p)
Definition: policies.c:3046
policy_expand_private
void policy_expand_private(smartlist_t **policy)
Definition: policies.c:105
smartlist_t
Definition: smartlist_core.h:26
policy_dump_to_string
char * policy_dump_to_string(const smartlist_t *policy_list, int include_ipv4, int include_ipv6)
Definition: policies.c:2895
write_short_policy
char * write_short_policy(const short_policy_t *policy)
Definition: policies.c:2756
fascist_firewall_choose_address_ls
void fascist_firewall_choose_address_ls(const smartlist_t *lspecs, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:908
fascist_firewall_allows_node
int fascist_firewall_allows_node(const node_t *node, firewall_connection_t fw_connection, int pref_only)
Definition: policies.c:688
policy_is_reject_star
int policy_is_reject_star(const smartlist_t *policy, sa_family_t family, int reject_by_default)
Definition: policies.c:2214
short_policy_entry_t
Definition: policies.h:52