Code to parse and use address policies and exit policies. More...

#include "core/or/or.h"
#include "feature/client/bridges.h"
#include "app/config/config.h"
#include "core/or/policies.h"
#include "feature/dirparse/policy_parse.h"
#include "feature/nodelist/microdesc.h"
#include "feature/nodelist/networkstatus.h"
#include "feature/nodelist/nodelist.h"
#include "feature/relay/router.h"
#include "feature/relay/routermode.h"
#include "lib/geoip/geoip.h"
#include "ht.h"
#include "lib/crypt_ops/crypto_rand.h"
#include "lib/encoding/confline.h"
#include "trunnel/ed25519_cert.h"
#include "core/or/addr_policy_st.h"
#include "feature/dirclient/dir_server_st.h"
#include "feature/nodelist/microdesc_st.h"
#include "feature/nodelist/node_st.h"
#include "core/or/port_cfg_st.h"
#include "feature/nodelist/routerinfo_st.h"
#include "feature/nodelist/routerstatus_st.h"

Data Structures
struct	policy_summary_item_t

struct	policy_map_ent_t

Macros
#define	POLICIES_PRIVATE

#define	MAX_EXITPOLICY_SUMMARY_LEN 1000

#define	REJECT(arg) STMT_BEGIN *msg = tor_strdup(arg); goto err; STMT_END

#define	CMP_FIELD(field)

#define	DEFAULT_EXIT_POLICY

#define	REDUCED_EXIT_POLICY

#define	AT(x) ((policy_summary_item_t*)smartlist_get(summary, x))

#define	IPV4_BITS (32)

#define	REJECT_CUTOFF_SCALE_IPV4 (0)

#define	REJECT_CUTOFF_COUNT_IPV4

#define	IPV6_BITS (128)

#define	REJECT_CUTOFF_SCALE_IPV6 (64)

#define	REJECT_CUTOFF_COUNT_IPV6

Functions
static int	policies_parse_exit_policy_internal (config_line_t cfg, smartlist_t dest, int ipv6_exit, int rejectprivate, const smartlist_t configured_addresses, int reject_interface_addresses, int reject_configured_port_addresses, int add_default_policy, int add_reduced_policy)

void	policy_expand_private (smartlist_t **policy)

void	policy_expand_unspec (smartlist_t **policy)

static int	parse_addr_policy (config_line_t cfg, smartlist_t *dest, int assume_action)

static int	parse_reachable_addresses (void)

static int	firewall_is_fascist_impl (void)

int	firewall_is_fascist_or (void)

int	firewall_is_fascist_dir (void)

static int	addr_policy_permits_tor_addr (const tor_addr_t addr, uint16_t port, smartlist_t policy)

STATIC int	reachable_addr_allows (const tor_addr_t addr, uint16_t port, smartlist_t firewall_policy, int pref_only, int pref_ipv6)

int	reachable_addr_use_ipv6 (const or_options_t *options)

static int	reachable_addr_prefer_ipv6_impl (const or_options_t *options)

int	reachable_addr_prefer_ipv6_orport (const or_options_t *options)

int	reachable_addr_prefer_ipv6_dirport (const or_options_t *options)

int	reachable_addr_allows_addr (const tor_addr_t *addr, uint16_t port, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)

static int	reachable_addr_allows_ap (const tor_addr_port_t *ap, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)

static int	reachable_addr_allows_base (const tor_addr_t ipv4_addr, uint16_t ipv4_orport, uint16_t ipv4_dirport, const tor_addr_t ipv6_addr, uint16_t ipv6_orport, uint16_t ipv6_dirport, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)

static int	reachable_addr_allows_ri_impl (const routerinfo_t *ri, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)

static int	reachable_addr_allows_rs_impl (const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)

int	reachable_addr_allows_rs (const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only)

static int	reachable_addr_allows_md_impl (const microdesc_t *md, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)

int	reachable_addr_allows_node (const node_t *node, firewall_connection_t fw_connection, int pref_only)

int	reachable_addr_allows_dir_server (const dir_server_t *ds, firewall_connection_t fw_connection, int pref_only)

static const tor_addr_port_t *	reachable_addr_choose_impl (const tor_addr_port_t a, const tor_addr_port_t b, int want_a, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)

STATIC const tor_addr_port_t *	reachable_addr_choose (const tor_addr_port_t a, const tor_addr_port_t b, int want_a, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)

static void	reachable_addr_choose_base (const tor_addr_t ipv4_addr, uint16_t ipv4_orport, uint16_t ipv4_dirport, const tor_addr_t ipv6_addr, uint16_t ipv6_orport, uint16_t ipv6_dirport, firewall_connection_t fw_connection, int pref_only, int pref_ipv6, tor_addr_port_t *ap)

void	reachable_addr_choose_from_rs (const routerstatus_t rs, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t ap)

void	reachable_addr_choose_from_ls (const smartlist_t lspecs, int pref_only, tor_addr_port_t ap)

void	reachable_addr_choose_from_node (const node_t node, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t ap)

void	reachable_addr_choose_from_dir_server (const dir_server_t ds, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t ap)

int	dir_policy_permits_address (const tor_addr_t *addr)

int	socks_policy_permits_address (const tor_addr_t *addr)

int	metrics_policy_permits_address (const tor_addr_t *addr)

static int	addr_is_in_cc_list (const tor_addr_t addr, const smartlist_t cc_list)

int	authdir_policy_permits_address (const tor_addr_t *addr, uint16_t port)

int	authdir_policy_valid_address (const tor_addr_t *addr, uint16_t port)

int	authdir_policy_badexit_address (const tor_addr_t *addr, uint16_t port)

int	authdir_policy_middleonly_address (const tor_addr_t *addr, uint16_t port)

int	policy_using_default_exit_options (const or_options_t *or_options)

int	validate_addr_policies (const or_options_t options, char *msg)

static int	load_policy_from_option (config_line_t config, const char option_name, smartlist_t **policy, int assume_action)

static int	parse_metrics_port_policy (const or_options_t *options)

int	policies_parse_from_options (const or_options_t *options)

static int	single_addr_policy_eq (const addr_policy_t a, const addr_policy_t b)

int	addr_policies_eq (const smartlist_t a, const smartlist_t b)

static	HT_HEAD (policy_map, policy_map_ent_t)

static unsigned int	policy_hash (const policy_map_ent_t *ent)

	HT_PROTOTYPE (policy_map, policy_map_ent_t, node, policy_hash, policy_eq)

	HT_GENERATE2 (policy_map, policy_map_ent_t, node, policy_hash, policy_eq, 0.6, tor_reallocarray_, tor_free_)

addr_policy_t *	addr_policy_get_canonical_entry (addr_policy_t *e)

static addr_policy_result_t	compare_known_tor_addr_to_addr_policy (const tor_addr_t addr, uint16_t port, const smartlist_t policy)

static addr_policy_result_t	compare_known_tor_addr_to_addr_policy_noport (const tor_addr_t addr, const smartlist_t policy)

static addr_policy_result_t	compare_unknown_tor_addr_to_addr_policy (uint16_t port, const smartlist_t *policy)

addr_policy_result_t	compare_tor_addr_to_addr_policy (const tor_addr_t addr, uint16_t port, const smartlist_t policy)

static int	addr_policy_covers (addr_policy_t a, addr_policy_t b)

static int	addr_policy_intersects (addr_policy_t a, addr_policy_t b)

STATIC void	append_exit_policy_string (smartlist_t *policy, const char more)

void	addr_policy_append_reject_addr (smartlist_t *dest, const tor_addr_t addr)

static int	tor_addr_is_public_for_reject (const tor_addr_t *addr)

static void	addr_policy_append_reject_addr_filter (smartlist_t *dest, const tor_addr_t addr, int ipv4_rules, int ipv6_rules)

void	addr_policy_append_reject_addr_list (smartlist_t *dest, const smartlist_t addrs)

static void	addr_policy_append_reject_addr_list_filter (smartlist_t *dest, const smartlist_t addrs, int ipv4_rules, int ipv6_rules)

static void	exit_policy_remove_redundancies (smartlist_t *dest)

void	policies_parse_exit_policy_reject_private (smartlist_t *dest, int ipv6_exit, const smartlist_t configured_addresses, int reject_interface_addresses, int reject_configured_port_addresses)

static void	policies_log_first_redundant_entry (const smartlist_t *policy)

int	policies_parse_exit_policy (config_line_t cfg, smartlist_t dest, exit_policy_parser_cfg_t options, const smartlist_t configured_addresses)

static void	policies_copy_addr_to_smartlist (smartlist_t addr_list, const tor_addr_t addr)

static void	policies_copy_outbound_addresses_to_smartlist (smartlist_t addr_list, const or_options_t or_options)

int	policies_parse_exit_policy_from_options (const or_options_t or_options, const tor_addr_t ipv4_local_address, const tor_addr_t ipv6_local_address, smartlist_t *result)

void	policies_exit_policy_append_reject_star (smartlist_t **dest)

void	policies_set_node_exitpolicy_to_reject_all (node_t *node)

static int	exit_policy_is_general_exit_helper (smartlist_t *policy, int port)

int	exit_policy_is_general_exit (smartlist_t *policy)

int	policy_is_reject_star (const smartlist_t *policy, sa_family_t family, int default_reject)

int	policy_write_item (char buf, size_t buflen, const addr_policy_t policy, int format_for_desc)

static smartlist_t *	policy_summary_create (void)

static policy_summary_item_t *	policy_summary_item_split (policy_summary_item_t *old, uint16_t new_starts)

static int	policy_summary_split (smartlist_t *summary, uint16_t prt_min, uint16_t prt_max)

static void	policy_summary_accept (smartlist_t *summary, uint16_t prt_min, uint16_t prt_max, sa_family_t family)

static void	policy_summary_reject (smartlist_t *summary, maskbits_t maskbits, uint16_t prt_min, uint16_t prt_max, sa_family_t family)

static void	policy_summary_add_item (smartlist_t summary, addr_policy_t p)

char *	policy_summarize (smartlist_t *policy, sa_family_t family)

short_policy_t *	parse_short_policy (const char *summary)

char *	write_short_policy (const short_policy_t *policy)

void	short_policy_free_ (short_policy_t *policy)

addr_policy_result_t	compare_tor_addr_to_short_policy (const tor_addr_t addr, uint16_t port, const short_policy_t policy)

int	short_policy_is_reject_star (const short_policy_t *policy)

addr_policy_result_t	compare_tor_addr_to_node_policy (const tor_addr_t addr, uint16_t port, const node_t node)

char *	policy_dump_to_string (const smartlist_t *policy_list, int include_ipv4, int include_ipv6)

int	getinfo_helper_policies (control_connection_t conn, const char question, char answer, const char errmsg)

void	addr_policy_list_free_ (smartlist_t *lst)

void	addr_policy_free_ (addr_policy_t *p)

void	policies_free_all (void)

Variables
static smartlist_t *	socks_policy = NULL

static smartlist_t *	dir_policy = NULL

static smartlist_t *	metrics_policy = NULL

static smartlist_t *	authdir_reject_policy = NULL

static smartlist_t *	authdir_invalid_policy = NULL

static smartlist_t *	authdir_badexit_policy = NULL

static smartlist_t *	authdir_middleonly_policy = NULL

static smartlist_t *	reachable_or_addr_policy = NULL

static smartlist_t *	reachable_dir_addr_policy = NULL

static const char *	private_nets []

Detailed Description

Code to parse and use address policies and exit policies.

We have two key kinds of address policy: full and compressed. A full policy is an array of accept/reject patterns, to be applied in order. A short policy is simply a list of ports. This module handles both kinds, including generic functions to apply them to addresses, and also including code to manage the global policies that we apply to incoming and outgoing connections.

Definition in file policies.c.

Macro Definition Documentation

◆ AT

#define AT ( x ) ((policy_summary_item_t*)smartlist_get(summary, x))

Definition at line 2407 of file policies.c.

◆ CMP_FIELD

#define CMP_FIELD ( field )

Value:

    do {                   \
    if (a->field != b->field) {                 \
      return 0;                                 \
    }                                           \
  } while (0)

◆ DEFAULT_EXIT_POLICY

#define DEFAULT_EXIT_POLICY

Value:

  "reject *:25,reject *:119,reject *:135-139,reject *:445,"         \
  "reject *:563,reject *:1214,reject *:4661-4666,"                  \
  "reject *:6346-6429,reject *:6699,reject *:6881-6999,accept *:*"

Definition at line 1921 of file policies.c.

◆ IPV4_BITS

#define IPV4_BITS (32)

Definition at line 2409 of file policies.c.

◆ IPV6_BITS

#define IPV6_BITS (128)

Definition at line 2417 of file policies.c.

◆ MAX_EXITPOLICY_SUMMARY_LEN

#define MAX_EXITPOLICY_SUMMARY_LEN 1000

Maximum length of an exit policy summary.

Definition at line 45 of file policies.c.

◆ POLICIES_PRIVATE

#define POLICIES_PRIVATE

Definition at line 18 of file policies.c.

◆ REDUCED_EXIT_POLICY

#define REDUCED_EXIT_POLICY

Value:

  "accept *:20-23,accept *:43,accept *:53,accept *:79-81,accept *:88,"        \
  "accept *:110,accept *:143,accept *:194,accept *:220,accept *:389,"         \
  "accept *:443,accept *:464,accept *:465,accept *:531,accept *:543-544,"     \
  "accept *:554,accept *:563,accept *:587,accept *:636,accept *:706,"         \
  "accept *:749,accept *:873,accept *:902-904,accept *:981,accept *:989-995," \
  "accept *:1194,accept *:1220,accept *:1293,accept *:1500,accept *:1533,"    \
  "accept *:1677,accept *:1723,accept *:1755,accept *:1863,"                  \
  "accept *:2082-2083,accept *:2086-2087,accept *:2095-2096,"                 \
  "accept *:2102-2104,accept *:3128,accept *:3389,accept *:3690,"             \
  "accept *:4321,accept *:4643,accept *:5050,accept *:5190,"                  \
  "accept *:5222-5223,accept *:5228,accept *:5900,accept *:6660-6669,"        \
  "accept *:6679,accept *:6697,accept *:8000,accept *:8008,accept *:8074,"    \
  "accept *:8080,accept *:8082,accept *:8087-8088,accept *:8232-8233,"        \
  "accept *:8332-8333,accept *:8443,accept *:8888,accept *:9418,"             \
  "accept *:9999,accept *:10000,accept *:11371,accept *:19294,"               \
  "accept *:19638,accept *:50002,accept *:64738,reject *:*"

Definition at line 1926 of file policies.c.

◆ REJECT

#define REJECT ( arg ) STMT_BEGIN *msg = tor_strdup(arg); goto err; STMT_END

Definition at line 1136 of file policies.c.

◆ REJECT_CUTOFF_COUNT_IPV4

#define REJECT_CUTOFF_COUNT_IPV4

Value:

(UINT64_C(1) << \

(IPV4_BITS - REJECT_CUTOFF_SCALE_IPV4 - 7))

Definition at line 2414 of file policies.c.

◆ REJECT_CUTOFF_COUNT_IPV6

#define REJECT_CUTOFF_COUNT_IPV6

Value:

(UINT64_C(1) << \

(IPV6_BITS - REJECT_CUTOFF_SCALE_IPV6 - 16))

Definition at line 2426 of file policies.c.

◆ REJECT_CUTOFF_SCALE_IPV4

#define REJECT_CUTOFF_SCALE_IPV4 (0)

Definition at line 2411 of file policies.c.

◆ REJECT_CUTOFF_SCALE_IPV6

#define REJECT_CUTOFF_SCALE_IPV6 (64)

Definition at line 2419 of file policies.c.

Function Documentation

◆ addr_is_in_cc_list()

static int addr_is_in_cc_list	(	const tor_addr_t *	addr,
		const smartlist_t *	cc_list
	)

static

Return true iff the address addr is in a country listed in the case-insensitive list of country codes cc_list.

Definition at line 1080 of file policies.c.

Referenced by authdir_policy_badexit_address(), authdir_policy_middleonly_address(), authdir_policy_permits_address(), and authdir_policy_valid_address().

◆ addr_policies_eq()

int addr_policies_eq	(	const smartlist_t *	a,
		const smartlist_t *	b
	)

As single_addr_policy_eq, but compare every element of two policies.

Definition at line 1324 of file policies.c.

Referenced by router_differences_are_cosmetic().

◆ addr_policy_append_reject_addr()

void addr_policy_append_reject_addr	(	smartlist_t **	dest,
		const tor_addr_t *	addr
	)

Add "reject <b>addr</b>:*" to dest, creating the list as needed.

Definition at line 1617 of file policies.c.

Referenced by addr_policy_append_reject_addr_list().

◆ addr_policy_append_reject_addr_filter()

static void addr_policy_append_reject_addr_filter	(	smartlist_t **	dest,
		const tor_addr_t *	addr,
		int	ipv4_rules,
		int	ipv6_rules
	)

static

Definition at line 1652 of file policies.c.

◆ addr_policy_append_reject_addr_list()

void addr_policy_append_reject_addr_list	(	smartlist_t **	dest,
		const smartlist_t *	addrs
	)

Add "reject addr:*" to dest, for each addr in addrs, creating the list as needed.

Definition at line 1674 of file policies.c.

◆ addr_policy_append_reject_addr_list_filter()

static void addr_policy_append_reject_addr_list_filter	(	smartlist_t **	dest,
		const smartlist_t *	addrs,
		int	ipv4_rules,
		int	ipv6_rules
	)

static

Add "reject addr:*" to dest, for each addr in addrs, creating the list as needed. Filter using

Definition at line 1688 of file policies.c.

Referenced by policies_parse_exit_policy_reject_private().

◆ addr_policy_covers()

static int addr_policy_covers	(	addr_policy_t *	a,
		addr_policy_t *	b
	)

static

Return true iff the address policy a covers every case that would be covered by b, so that a,b is redundant.

Definition at line 1558 of file policies.c.

◆ addr_policy_free_()

void addr_policy_free_ ( addr_policy_t * p )

Release all storage held by p.

Definition at line 3096 of file policies.c.

◆ addr_policy_get_canonical_entry()

addr_policy_t * addr_policy_get_canonical_entry ( addr_policy_t * e )

Given a pointer to an addr_policy_t, return a copy of the pointer to the "canonical" copy of that addr_policy_t; the canonical copy is a single reference-counted object.

Definition at line 1389 of file policies.c.

◆ addr_policy_intersects()

static int addr_policy_intersects	(	addr_policy_t *	a,
		addr_policy_t *	b
	)

static

Return true iff the address policies a and b intersect, that is, there exists an address/port that is covered by a that is also covered by b.

Definition at line 1582 of file policies.c.

◆ addr_policy_list_free_()

void addr_policy_list_free_ ( smartlist_t * lst )

Release all storage held by p.

Definition at line 3086 of file policies.c.

◆ addr_policy_permits_tor_addr()

static int addr_policy_permits_tor_addr	(	const tor_addr_t *	addr,
		uint16_t	port,
		smartlist_t *	policy
	)

static

Return true iff policy (possibly NULL) will allow a connection to addr:port.

Definition at line 379 of file policies.c.

Referenced by authdir_policy_badexit_address(), authdir_policy_middleonly_address(), authdir_policy_permits_address(), authdir_policy_valid_address(), dir_policy_permits_address(), metrics_policy_permits_address(), reachable_addr_allows(), and socks_policy_permits_address().

◆ append_exit_policy_string()

STATIC void append_exit_policy_string	(	smartlist_t **	policy,
		const char *	more
	)

Add the exit policy described by more to policy.

Definition at line 1603 of file policies.c.

Referenced by parse_metrics_port_policy(), policies_exit_policy_append_reject_star(), policies_parse_exit_policy_from_options(), and policies_parse_exit_policy_internal().

◆ authdir_policy_badexit_address()

int authdir_policy_badexit_address	(	const tor_addr_t *	addr,
		uint16_t	port
	)

Return 1 if addr:port should be marked as a bad exit, based on authdir_badexit_policy. Else return 0.

Definition at line 1118 of file policies.c.

◆ authdir_policy_middleonly_address()

int authdir_policy_middleonly_address	(	const tor_addr_t *	addr,
		uint16_t	port
	)

Return 1 if addr:port should be marked as MiddleOnly, based on authdir_middleonly_policy. Else return 0.

Definition at line 1129 of file policies.c.

◆ authdir_policy_permits_address()

int authdir_policy_permits_address	(	const tor_addr_t *	addr,
		uint16_t	port
	)

Return 1 if addr:port is permitted to publish to our directory, based on authdir_reject_policy. Else return 0.

Definition at line 1096 of file policies.c.

◆ authdir_policy_valid_address()

int authdir_policy_valid_address	(	const tor_addr_t *	addr,
		uint16_t	port
	)

Return 1 if addr:port is considered valid in our directory, based on authdir_invalid_policy. Else return 0.

Definition at line 1107 of file policies.c.

◆ compare_known_tor_addr_to_addr_policy()

static addr_policy_result_t compare_known_tor_addr_to_addr_policy	(	const tor_addr_t *	addr,
		uint16_t	port,
		const smartlist_t *	policy
	)

static

Helper for compare_tor_addr_to_addr_policy. Implements the case where addr and port are both known.

Definition at line 1413 of file policies.c.

◆ compare_known_tor_addr_to_addr_policy_noport()

static addr_policy_result_t compare_known_tor_addr_to_addr_policy_noport	(	const tor_addr_t *	addr,
		const smartlist_t *	policy
	)

static

Helper for compare_tor_addr_to_addr_policy. Implements the case where addr is known but port is not.

Definition at line 1441 of file policies.c.

◆ compare_tor_addr_to_addr_policy()

addr_policy_result_t compare_tor_addr_to_addr_policy	(	const tor_addr_t *	addr,
		uint16_t	port,
		const smartlist_t *	policy
	)

Decide whether a given addr:port is definitely accepted, definitely rejected, probably accepted, or probably rejected by a given policy. If addr is 0, we don't know the IP of the target address. If port is 0, we don't know the port of the target address. (At least one of addr and port must be provided. If you want to know whether a policy would definitely reject an unknown address:port, use policy_is_reject_star().)

We could do better by assuming that some ranges never match typical addresses (127.0.0.1, and so on). But we'll try this for now.

Definition at line 1536 of file policies.c.

Referenced by addr_policy_permits_tor_addr(), compare_tor_addr_to_node_policy(), router_compare_to_my_exit_policy(), and routerset_contains2().

◆ compare_tor_addr_to_node_policy()

addr_policy_result_t compare_tor_addr_to_node_policy	(	const tor_addr_t *	addr,
		uint16_t	port,
		const node_t *	node
	)

Decide whether addr:port is probably or definitely accepted or rejected by node. See compare_tor_addr_to_addr_policy for details on addr/port interpretation.

Definition at line 2907 of file policies.c.

Referenced by connection_ap_can_use_exit(), router_exit_policy_all_nodes_reject(), and router_find_exact_exit_enclave().

◆ compare_tor_addr_to_short_policy()

addr_policy_result_t compare_tor_addr_to_short_policy	(	const tor_addr_t *	addr,
		uint16_t	port,
		const short_policy_t *	policy
	)

See whether the addr:port address is likely to be accepted or rejected by the summarized policy policy. Return values are as for compare_tor_addr_to_addr_policy. Unlike the regular addr_policy functions, requires the port be specified.

Definition at line 2842 of file policies.c.

Referenced by compare_tor_addr_to_node_policy(), and router_compare_to_my_exit_policy().

◆ compare_unknown_tor_addr_to_addr_policy()

static addr_policy_result_t compare_unknown_tor_addr_to_addr_policy	(	uint16_t	port,
		const smartlist_t *	policy
	)

static

Helper for compare_tor_addr_to_addr_policy. Implements the case where port is known but address is not.

Definition at line 1484 of file policies.c.

◆ dir_policy_permits_address()

int dir_policy_permits_address ( const tor_addr_t * addr )

Return 1 if addr is permitted to connect to our dir port, based on dir_policy. Else return 0.

Definition at line 1054 of file policies.c.

◆ exit_policy_is_general_exit()

int exit_policy_is_general_exit ( smartlist_t * policy )

Return true iff ri is "useful as an exit node", meaning it allows exit to at least one /8 address space for each of ports 80 and 443.

Definition at line 2250 of file policies.c.

◆ exit_policy_is_general_exit_helper()

static int exit_policy_is_general_exit_helper	(	smartlist_t *	policy,
		int	port
	)

static

Return 1 if there is at least one /8 subnet in policy that allows exiting to port. Otherwise, return 0.

Definition at line 2202 of file policies.c.

Referenced by exit_policy_is_general_exit().

◆ exit_policy_remove_redundancies()

static void exit_policy_remove_redundancies ( smartlist_t * dest )

static

Detect and excise "dead code" from the policy *dest.

Definition at line 1703 of file policies.c.

◆ firewall_is_fascist_dir()

int firewall_is_fascist_dir ( void )

Return true iff the firewall options, including ClientUseIPv4 0 and ClientUseIPv6 0, might block any Dir address:port combination. Address preferences may still change which address is selected even if this function returns false.

Definition at line 370 of file policies.c.

◆ firewall_is_fascist_impl()

static int firewall_is_fascist_impl ( void )

static

Definition at line 344 of file policies.c.

◆ firewall_is_fascist_or()

int firewall_is_fascist_or ( void )

Return true iff the firewall options, including ClientUseIPv4 0 and ClientUseIPv6 0, might block any OR address:port combination. Address preferences may still change which address is selected even if this function returns false.

Definition at line 359 of file policies.c.

◆ getinfo_helper_policies()

int getinfo_helper_policies	(	control_connection_t *	conn,
		const char *	question,
		char **	answer,
		const char **	errmsg
	)

Implementation for GETINFO control command: knows the answer for questions about "exit-policy/..."

Definition at line 2988 of file policies.c.

◆ HT_HEAD()

static HT_HEAD	(	policy_map	,
		policy_map_ent_t
	)

static

Definition at line 1348 of file policies.c.

◆ load_policy_from_option()

static int load_policy_from_option	(	config_line_t *	config,
		const char *	option_name,
		smartlist_t **	policy,
		int	assume_action
	)

static

Parse string in the same way that the exit policy is parsed, and put the processed version in *policy. Ignore port specifiers.

Definition at line 1215 of file policies.c.

Referenced by parse_metrics_port_policy(), and policies_parse_from_options().

◆ metrics_policy_permits_address()

int metrics_policy_permits_address ( const tor_addr_t * addr )

Return 1 if addr is permitted to connect to our metrics port, based on metrics_policy. Else return 0.

Definition at line 1072 of file policies.c.

Referenced by metrics_request_allowed().

◆ parse_addr_policy()

static int parse_addr_policy	(	config_line_t *	cfg,
		smartlist_t **	dest,
		int	assume_action
	)

static

Given a linked list of config lines containing "accept[6]" and "reject[6]" tokens, parse them and append the result to dest. Return -1 if any tokens are malformed (and don't append any), else return 0.

If assume_action is nonnegative, then insert its action (ADDR_POLICY_ACCEPT or ADDR_POLICY_REJECT) for items that specify no action.

Definition at line 199 of file policies.c.

Referenced by append_exit_policy_string(), and policies_parse_exit_policy_internal().

◆ parse_metrics_port_policy()

static int parse_metrics_port_policy ( const or_options_t * options )

static

Helper: Parse the MetricsPortPolicy option into the metrics_policy and set the reject all by default.

Return 0 on success else -1.

Definition at line 1254 of file policies.c.

◆ parse_reachable_addresses()

static int parse_reachable_addresses ( void )

static

Helper: parse the Reachable(Dir|OR)?Addresses fields into reachable_(or|dir)_addr_policy. The options should already have been validated by validate_addr_policies.

Definition at line 262 of file policies.c.

◆ parse_short_policy()

short_policy_t * parse_short_policy ( const char * summary )

Convert a summarized policy string into a short_policy_t. Return NULL if the string is not well-formed.

Definition at line 2705 of file policies.c.

◆ policies_copy_addr_to_smartlist()

static void policies_copy_addr_to_smartlist	(	smartlist_t *	addr_list,
		const tor_addr_t *	addr
	)

static

Helper function that adds a copy of addr to a smartlist as long as it is non-NULL and not tor_addr_is_null().

The caller is responsible for freeing all the tor_addr_t* in the smartlist.

Definition at line 2066 of file policies.c.

Referenced by policies_copy_outbound_addresses_to_smartlist().

◆ policies_copy_outbound_addresses_to_smartlist()

static void policies_copy_outbound_addresses_to_smartlist	(	smartlist_t *	addr_list,
		const or_options_t *	or_options
	)

static

Helper function that adds copies of or_options->OutboundBindAddresses to a smartlist as tor_addr_t *, as long as or_options is non-NULL, and the addresses are not tor_addr_is_null(), by passing them to policies_add_addr_to_smartlist.

The caller is responsible for freeing all the tor_addr_t* in the smartlist.

Definition at line 2083 of file policies.c.

◆ policies_exit_policy_append_reject_star()

void policies_exit_policy_append_reject_star ( smartlist_t ** dest )

Add "reject *:*" to the end of the policy in *dest, allocating *dest as needed.

Definition at line 2186 of file policies.c.

◆ policies_free_all()

void policies_free_all ( void )

Release all storage held by policy variables.

Definition at line 3117 of file policies.c.

◆ policies_log_first_redundant_entry()

static void policies_log_first_redundant_entry ( const smartlist_t * policy )

static

Iterate through policy looking for redundant entries. Log a warning message with the first redundant entry, if any is found.

Definition at line 1862 of file policies.c.

Referenced by policies_parse_exit_policy_internal().

◆ policies_parse_exit_policy()

int policies_parse_exit_policy	(	config_line_t *	cfg,
		smartlist_t **	dest,
		exit_policy_parser_cfg_t	options,
		const smartlist_t *	configured_addresses
	)

Parse exit policy in cfg into dest smartlist.

Prepend an entry that rejects all IPv6 destinations unless EXIT_POLICY_IPV6_ENABLED bit is set in options bitmask.

If EXIT_POLICY_REJECT_PRIVATE bit is set in options:

prepend an entry that rejects all destinations in all netblocks reserved for private use.
prepend entries that reject the advertised relay addresses in configured_addresses If EXIT_POLICY_REJECT_LOCAL_INTERFACES bit is set in options:
prepend entries that reject publicly routable addresses on this exit relay by calling policies_parse_exit_policy_internal
prepend entries that reject the outbound bind addresses in configured_addresses
prepend entries that reject all configured port addresses

If EXIT_POLICY_ADD_DEFAULT bit is set in options, append default exit policy entries to result smartlist.

Definition at line 2040 of file policies.c.

◆ policies_parse_exit_policy_from_options()

int policies_parse_exit_policy_from_options	(	const or_options_t *	or_options,
		const tor_addr_t *	ipv4_local_address,
		const tor_addr_t *	ipv6_local_address,
		smartlist_t **	result
	)

Parse ExitPolicy member of or_options into result smartlist. If or_options->IPv6Exit is false, prepend an entry that rejects all IPv6 destinations.

If or_options->ExitPolicyRejectPrivate is true:

prepend an entry that rejects all destinations in all netblocks reserved for private use.
if ipv4_local_address is non-zero, treat it as a host-order IPv4 address, and add it to the list of configured addresses.
if ipv6_local_address is non-NULL, and not the null tor_addr_t, add it to the list of configured addresses. If or_options->ExitPolicyRejectLocalInterfaces is true:
if or_options->OutboundBindAddresses[][0] (=IPv4) is not the null tor_addr_t, add it to the list of configured addresses.
if or_options->OutboundBindAddresses[][1] (=IPv6) is not the null tor_addr_t, add it to the list of configured addresses.

If or_options->BridgeRelay is false, append entries of default Tor exit policy into result smartlist.

If or_options->ExitRelay is false, or is auto without specifying an exit policy, then make our exit policy into "reject *:*" regardless.

Definition at line 2123 of file policies.c.

Referenced by validate_addr_policies().

◆ policies_parse_exit_policy_internal()

static int policies_parse_exit_policy_internal	(	config_line_t *	cfg,
		smartlist_t **	dest,
		int	ipv6_exit,
		int	rejectprivate,
		const smartlist_t *	configured_addresses,
		int	reject_interface_addresses,
		int	reject_configured_port_addresses,
		int	add_default_policy,
		int	add_reduced_policy
	)

static

Parse the exit policy cfg into the linked list *dest.

If ipv6_exit is false, prepend "reject *6:*" to the policy.

If configured_addresses contains addresses:

prepend entries that reject the addresses in this list. These may be the advertised relay addresses and/or the outbound bind addresses, depending on the ExitPolicyRejectPrivate and ExitPolicyRejectLocalInterfaces settings. If rejectprivate is true:
prepend "reject private:*" to the policy. If reject_interface_addresses is true:
prepend entries that reject publicly routable interface addresses on this exit relay by calling policies_parse_exit_policy_reject_private If reject_configured_port_addresses is true:
prepend entries that reject all configured port addresses

If cfg doesn't end in an absolute accept or reject and if add_default_policy is true, add the default exit policy afterwards.

Return -1 if we can't parse cfg, else return 0.

This function is used to parse the exit policy from our torrc. For the functions used to parse the exit policy from a router descriptor, see router_add_exit_policy.

Definition at line 1972 of file policies.c.

◆ policies_parse_exit_policy_reject_private()

void policies_parse_exit_policy_reject_private	(	smartlist_t **	dest,
		int	ipv6_exit,
		const smartlist_t *	configured_addresses,
		int	reject_interface_addresses,
		int	reject_configured_port_addresses
	)

Reject private helper for policies_parse_exit_policy_internal: rejects publicly routable addresses on this exit relay.

Add reject entries to the linked list *dest:

if configured_addresses is non-NULL, add entries that reject each tor_addr_t in the list as a destination.
if reject_interface_addresses is true, add entries that reject each public IPv4 and IPv6 address of each interface on this machine.
if reject_configured_port_addresses is true, add entries that reject each IPv4 and IPv6 address configured for a port.

IPv6 entries are only added if ipv6_exit is true. (All IPv6 addresses are already blocked by policies_parse_exit_policy_internal if ipv6_exit is false.)

The list in dest is created as needed.

Definition at line 1805 of file policies.c.

Referenced by policies_parse_exit_policy_internal().

◆ policies_parse_from_options()

int policies_parse_from_options ( const or_options_t * options )

Set all policies based on options, which should have been validated first by validate_addr_policies.

Definition at line 1268 of file policies.c.

◆ policies_set_node_exitpolicy_to_reject_all()

void policies_set_node_exitpolicy_to_reject_all ( node_t * node )

Replace the exit policy of node with reject *:*

Definition at line 2194 of file policies.c.

◆ policy_dump_to_string()

char * policy_dump_to_string	(	const smartlist_t *	policy_list,
		int	include_ipv4,
		int	include_ipv6
	)

Given policy_list, a list of addr_policy_t, produce a string representation of the list. If include_ipv4 is true, include IPv4 entries. If include_ipv6 is true, include IPv6 entries.

Definition at line 2945 of file policies.c.

◆ policy_expand_private()

void policy_expand_private ( smartlist_t ** policy )

Replace all "private" entries in *policy with their expanded equivalents.

Definition at line 110 of file policies.c.

◆ policy_expand_unspec()

void policy_expand_unspec ( smartlist_t ** policy )

Expand each of the AF_UNSPEC elements in *policy (which indicate protocol-neutral wildcards) into a pair of wildcard elements: one IPv4- specific and one IPv6-specific.

Definition at line 150 of file policies.c.

◆ policy_hash()

static unsigned int policy_hash ( const policy_map_ent_t * ent )

static

Return a hashcode for ent

Definition at line 1359 of file policies.c.

◆ policy_is_reject_star()

int policy_is_reject_star	(	const smartlist_t *	policy,
		sa_family_t	family,
		int	default_reject
	)

Return false if policy might permit access to some addr:port; otherwise if we are certain it rejects everything, return true. If no part of policy matches, return default_reject. NULL policies are allowed, and treated as empty.

Definition at line 2264 of file policies.c.

◆ policy_summarize()

char * policy_summarize	(	smartlist_t *	policy,
		sa_family_t	family
	)

Create a string representing a summary for an exit policy. The summary will either be an "accept" plus a comma-separated list of port ranges or a "reject" plus port-ranges, depending on which is shorter.

If no exits are allowed at all then "reject 1-65535" is returned. If no ports are blocked instead of "reject " we return "accept 1-65535". (These are an exception to the shorter-representation-wins rule).

Definition at line 2593 of file policies.c.

◆ policy_summary_accept()

static void policy_summary_accept	(	smartlist_t *	summary,
		uint16_t	prt_min,
		uint16_t	prt_max,
		sa_family_t	family
	)

static

Mark port ranges as accepted if they are below the reject_count for family

Definition at line 2464 of file policies.c.

◆ policy_summary_add_item()

static void policy_summary_add_item	(	smartlist_t *	summary,
		addr_policy_t *	p
	)

static

Add a single exit policy item to our summary:

If it is an accept, ignore it unless it is for all IP addresses ("*", i.e. its prefixlen/maskbits is 0). Otherwise call policy_summary_accept().

If it is a reject, ignore it if it is about one of the private networks. Otherwise call policy_summary_reject().

Definition at line 2552 of file policies.c.

◆ policy_summary_create()

static smartlist_t * policy_summary_create ( void )

static

Create a new exit policy summary, initially only with a single port 1-64k item

Definition at line 2364 of file policies.c.

◆ policy_summary_item_split()

static policy_summary_item_t * policy_summary_item_split	(	policy_summary_item_t *	old,
		uint16_t	new_starts
	)

static

Split the summary item in item at the port new_starts. The current item is changed to end at new-starts - 1, the new item copies reject_count and accepted from the old item, starts at new_starts and ends at the port where the original item previously ended.

Definition at line 2388 of file policies.c.

◆ policy_summary_reject()

static void policy_summary_reject	(	smartlist_t *	summary,
		maskbits_t	maskbits,
		uint16_t	prt_min,
		uint16_t	prt_max,
		sa_family_t	family
	)

static

Count the number of addresses in a network in family with prefixlen maskbits against the given portrange.

Definition at line 2487 of file policies.c.

◆ policy_summary_split()

static int policy_summary_split	(	smartlist_t *	summary,
		uint16_t	prt_min,
		uint16_t	prt_max
	)

static

Split an exit policy summary so that prt_min and prt_max fall at exactly the start and end of an item respectively.

Definition at line 2433 of file policies.c.

◆ policy_using_default_exit_options()

int policy_using_default_exit_options ( const or_options_t * or_options )

Check or_options to determine whether or not we are using the default options for exit policy. Return true if so, false otherwise.

Definition at line 1142 of file policies.c.

Referenced by policies_parse_exit_policy_from_options().

◆ policy_write_item()

int policy_write_item	(	char *	buf,
		size_t	buflen,
		const addr_policy_t *	policy,
		int	format_for_desc
	)

Write a single address policy to the buf_len byte buffer at buf. Return the number of characters written, or -1 on failure.

Definition at line 2288 of file policies.c.

◆ reachable_addr_allows()

STATIC int reachable_addr_allows	(	const tor_addr_t *	addr,
		uint16_t	port,
		smartlist_t *	firewall_policy,
		int	pref_only,
		int	pref_ipv6
	)

Return true iff we think our firewall will let us make a connection to addr:port.

If we are configured as a server, ignore any address family preference and just use IPv4. Otherwise:

return false for all IPv4 addresses:
- if ClientUseIPv4 is 0, or if pref_only and pref_ipv6 are both true;
return false for all IPv6 addresses:
- if reachable_addr_use_ipv6() is 0, or
- if pref_only is true and pref_ipv6 is false.

Return false if addr is NULL or tor_addr_is_null(), or if port is 0.

Definition at line 412 of file policies.c.

◆ reachable_addr_allows_addr()

int reachable_addr_allows_addr	(	const tor_addr_t *	addr,
		uint16_t	port,
		firewall_connection_t	fw_connection,
		int	pref_only,
		int	pref_ipv6
	)

Return true iff we think our firewall will let us make a connection to addr:port. Uses ReachableORAddresses or ReachableDirAddresses based on fw_connection. If pref_only is true, return true if addr is in the client's preferred address family, which is IPv6 if pref_ipv6 is true, and IPv4 otherwise. If pref_only is false, ignore pref_ipv6, and return true if addr is allowed.

Definition at line 536 of file policies.c.

Referenced by bridge_passes_guard_filter(), directory_command_should_use_begindir(), reachable_addr_allows_ap(), and reachable_addr_allows_base().

◆ reachable_addr_allows_ap()

static int reachable_addr_allows_ap	(	const tor_addr_port_t *	ap,
		firewall_connection_t	fw_connection,
		int	pref_only,
		int	pref_ipv6
	)

static

Return true iff we think our firewall will let us make a connection to addr:port (ap). Uses ReachableORAddresses or ReachableDirAddresses based on fw_connection. pref_only and pref_ipv6 work as in reachable_addr_allows_addr().

Definition at line 561 of file policies.c.

Referenced by reachable_addr_choose_impl().

◆ reachable_addr_allows_base()

static int reachable_addr_allows_base	(	const tor_addr_t *	ipv4_addr,
		uint16_t	ipv4_orport,
		uint16_t	ipv4_dirport,
		const tor_addr_t *	ipv6_addr,
		uint16_t	ipv6_orport,
		uint16_t	ipv6_dirport,
		firewall_connection_t	fw_connection,
		int	pref_only,
		int	pref_ipv6
	)

static

Return true iff we think our firewall will let us make a connection to ipv4h_addr/ipv6_addr. Uses ipv4_orport/ipv6_orport/ReachableORAddresses or ipv4_dirport/ipv6_dirport/ReachableDirAddresses based on IPv4/IPv6 and fw_connection. pref_only and pref_ipv6 work as in reachable_addr_allows_addr().

Definition at line 578 of file policies.c.

Referenced by reachable_addr_allows_ri_impl(), and reachable_addr_allows_rs_impl().

◆ reachable_addr_allows_dir_server()

int reachable_addr_allows_dir_server	(	const dir_server_t *	ds,
		firewall_connection_t	fw_connection,
		int	pref_only
	)

Like reachable_addr_allows_rs(), but takes ds.

Definition at line 731 of file policies.c.

◆ reachable_addr_allows_md_impl()

static int reachable_addr_allows_md_impl	(	const microdesc_t *	md,
		firewall_connection_t	fw_connection,
		int	pref_only,
		int	pref_ipv6
	)

static

Return true iff we think our firewall will let us make a connection to ipv6_addr:ipv6_orport based on ReachableORAddresses. If fw_connection is FIREWALL_DIR_CONNECTION, returns 0. pref_only and pref_ipv6 work as in reachable_addr_allows_addr().

Definition at line 671 of file policies.c.

◆ reachable_addr_allows_node()

int reachable_addr_allows_node	(	const node_t *	node,
		firewall_connection_t	fw_connection,
		int	pref_only
	)

Like reachable_addr_allows_base(), but takes node, and looks up pref_ipv6 from node_ipv6_or/dir_preferred().

Definition at line 693 of file policies.c.

Referenced by node_passes_guard_filter().

◆ reachable_addr_allows_ri_impl()

static int reachable_addr_allows_ri_impl	(	const routerinfo_t *	ri,
		firewall_connection_t	fw_connection,
		int	pref_only,
		int	pref_ipv6
	)

static

Like reachable_addr_allows_base(), but takes ri.

Definition at line 608 of file policies.c.

◆ reachable_addr_allows_rs()

int reachable_addr_allows_rs	(	const routerstatus_t *	rs,
		firewall_connection_t	fw_connection,
		int	pref_only
	)

Like reachable_addr_allows_base(), but takes rs. When rs is a fake_status from a dir_server_t, it can have a reachable address, even when the corresponding node does not. nodes can be missing addresses when there's no consensus (IPv4 and IPv6), or when there is a microdescriptor consensus, but no microdescriptors (microdescriptors have IPv6, the microdesc consensus does not).

Definition at line 647 of file policies.c.

Referenced by reachable_addr_allows_dir_server().

◆ reachable_addr_allows_rs_impl()

static int reachable_addr_allows_rs_impl	(	const routerstatus_t *	rs,
		firewall_connection_t	fw_connection,
		int	pref_only,
		int	pref_ipv6
	)

static

Like reachable_addr_allows_rs, but takes pref_ipv6.

Definition at line 625 of file policies.c.

◆ reachable_addr_choose()

STATIC const tor_addr_port_t * reachable_addr_choose	(	const tor_addr_port_t *	a,
		const tor_addr_port_t *	b,
		int	want_a,
		firewall_connection_t	fw_connection,
		int	pref_only,
		int	pref_ipv6
	)

If a and b are both valid and preferred by fw_connection, choose one based on want_a and return it. Otherwise, return whichever is preferred. If neither are preferred, and pref_only is false:

If a and b are both allowed by fw_connection, choose one based on want_a and return it.
Otherwise, return whichever is preferred. Otherwise, return NULL.

Definition at line 792 of file policies.c.

◆ reachable_addr_choose_base()

static void reachable_addr_choose_base	(	const tor_addr_t *	ipv4_addr,
		uint16_t	ipv4_orport,
		uint16_t	ipv4_dirport,
		const tor_addr_t *	ipv6_addr,
		uint16_t	ipv6_orport,
		uint16_t	ipv6_dirport,
		firewall_connection_t	fw_connection,
		int	pref_only,
		int	pref_ipv6,
		tor_addr_port_t *	ap
	)

static

Copy an address and port into ap that we think our firewall will let us connect to. Uses ipv4_addr/ipv6_addr and ipv4_orport/ipv6_orport/ReachableORAddresses or ipv4_dirport/ipv6_dirport/ReachableDirAddresses based on IPv4/IPv6 and fw_connection. If pref_only, only choose preferred addresses. In either case, choose a preferred address before an address that's not preferred. If both addresses could be chosen (they are both preferred or both allowed) choose IPv6 if pref_ipv6 is true, otherwise choose IPv4.

Definition at line 825 of file policies.c.

◆ reachable_addr_choose_from_dir_server()

void reachable_addr_choose_from_dir_server	(	const dir_server_t *	ds,
		firewall_connection_t	fw_connection,
		int	pref_only,
		tor_addr_port_t *	ap
	)

Like reachable_addr_choose_from_rs(), but takes ds.

Definition at line 1027 of file policies.c.

◆ reachable_addr_choose_from_ls()

void reachable_addr_choose_from_ls	(	const smartlist_t *	lspecs,
		int	pref_only,
		tor_addr_port_t *	ap
	)

Like reachable_addr_choose_base(), but takes in a smartlist lspecs consisting of one or more link specifiers. We assume fw_connection is FIREWALL_OR_CONNECTION as link specifiers cannot contain DirPorts.

Definition at line 913 of file policies.c.

◆ reachable_addr_choose_from_node()

void reachable_addr_choose_from_node	(	const node_t *	node,
		firewall_connection_t	fw_connection,
		int	pref_only,
		tor_addr_port_t *	ap
	)

Like reachable_addr_choose_base(), but takes node, and looks up the node's IPv6 preference rather than taking an argument for pref_ipv6.

Definition at line 988 of file policies.c.

Referenced by extend_info_from_node(), and reachable_addr_choose_from_rs().

◆ reachable_addr_choose_from_rs()

void reachable_addr_choose_from_rs	(	const routerstatus_t *	rs,
		firewall_connection_t	fw_connection,
		int	pref_only,
		tor_addr_port_t *	ap
	)

Like reachable_addr_choose_base(), but takes rs. Consults the corresponding node, then falls back to rs if node is NULL. This should only happen when there's no valid consensus, and rs doesn't correspond to a bridge client's bridge.

Definition at line 874 of file policies.c.

Referenced by reachable_addr_choose_from_dir_server().

◆ reachable_addr_choose_impl()

static const tor_addr_port_t * reachable_addr_choose_impl	(	const tor_addr_port_t *	a,
		const tor_addr_port_t *	b,
		int	want_a,
		firewall_connection_t	fw_connection,
		int	pref_only,
		int	pref_ipv6
	)

static

If a and b are both valid and allowed by fw_connection, choose one based on want_a and return it. Otherwise, return whichever is allowed. Otherwise, return NULL. pref_only and pref_ipv6 work as in reachable_addr_allows_addr().

Definition at line 754 of file policies.c.

Referenced by reachable_addr_choose().

◆ reachable_addr_prefer_ipv6_dirport()

int reachable_addr_prefer_ipv6_dirport ( const or_options_t * options )

Do we prefer to connect to IPv6 DirPorts?

(node_ipv6_dir_preferred() doesn't support bridge client per-node IPv6 preferences. There's no reason to use it instead of this function.)

Definition at line 512 of file policies.c.

◆ reachable_addr_prefer_ipv6_impl()

static int reachable_addr_prefer_ipv6_impl ( const or_options_t * options )

static

Do we prefer to connect to IPv6, ignoring ClientPreferIPv6ORPort and ClientPreferIPv6DirPort? If we're unsure, return -1, otherwise, return 1 for IPv6 and 0 for IPv4.

Definition at line 466 of file policies.c.

Referenced by reachable_addr_prefer_ipv6_dirport(), and reachable_addr_prefer_ipv6_orport().

◆ reachable_addr_prefer_ipv6_orport()

int reachable_addr_prefer_ipv6_orport ( const or_options_t * options )

Do we prefer to connect to IPv6 ORPorts? Use node_ipv6_or_preferred() whenever possible: it supports bridge client per-node IPv6 preferences.

Definition at line 490 of file policies.c.

◆ reachable_addr_use_ipv6()

int reachable_addr_use_ipv6 ( const or_options_t * options )

Is this client configured to use IPv6? Returns true if the client might use IPv6 for some of its connections (including dual-stack and IPv6-only clients), and false if it will never use IPv6 for any connections. Use node_ipv6_or/dir_preferred() when checking a specific node and OR/Dir port: it supports bridge client per-node IPv6 preferences.

Definition at line 451 of file policies.c.

Referenced by reachable_addr_allows(), and reachable_addr_prefer_ipv6_impl().

◆ short_policy_free_()

void short_policy_free_ ( short_policy_t * policy )

Release all storage held in policy.

Definition at line 2832 of file policies.c.

◆ short_policy_is_reject_star()

int short_policy_is_reject_star ( const short_policy_t * policy )

Return true iff policy seems reject all ports

Definition at line 2890 of file policies.c.

◆ single_addr_policy_eq()

static int single_addr_policy_eq	(	const addr_policy_t *	a,
		const addr_policy_t *	b
	)

static

Compare two provided address policy items, and renturn -1, 0, or 1 if the first is less than, equal to, or greater than the second.

Definition at line 1300 of file policies.c.

◆ socks_policy_permits_address()

int socks_policy_permits_address ( const tor_addr_t * addr )

Return 1 if addr is permitted to connect to our socks port, based on socks_policy. Else return 0.

Definition at line 1063 of file policies.c.

◆ tor_addr_is_public_for_reject()

static int tor_addr_is_public_for_reject ( const tor_addr_t * addr )

static

Definition at line 1640 of file policies.c.

◆ validate_addr_policies()

int validate_addr_policies	(	const or_options_t *	options,
		char **	msg
	)

Config helper: If there's any problem with the policy configuration options in options, return -1 and set msg to a newly allocated description of the error. Else return 0.

Definition at line 1152 of file policies.c.

◆ write_short_policy()

char * write_short_policy ( const short_policy_t * policy )

Write policy back out into a string.

Definition at line 2806 of file policies.c.

Variable Documentation

◆ authdir_badexit_policy

smartlist_t* authdir_badexit_policy = NULL

static

Policy that addresses for incoming router descriptors must not match in order to not be marked as BadExit.

Definition at line 61 of file policies.c.

Referenced by authdir_policy_badexit_address().

◆ authdir_invalid_policy

smartlist_t* authdir_invalid_policy = NULL

static

Policy that addresses for incoming router descriptors must match in order to be marked as valid in our networkstatus.

Definition at line 58 of file policies.c.

Referenced by authdir_policy_valid_address().

◆ authdir_middleonly_policy

smartlist_t* authdir_middleonly_policy = NULL

static

Policy that addresses for incoming router descriptors must not match in order to not be marked as MiddleOnly.

Definition at line 64 of file policies.c.

Referenced by authdir_policy_middleonly_address().

◆ authdir_reject_policy

smartlist_t* authdir_reject_policy = NULL

static

Policy that addresses for incoming router descriptors must match in order to be published by us.

Definition at line 55 of file policies.c.

Referenced by authdir_policy_permits_address(), and policies_parse_from_options().

◆ dir_policy

smartlist_t* dir_policy = NULL

static

Policy that addresses for incoming directory connections must match.

Definition at line 50 of file policies.c.

Referenced by dir_policy_permits_address(), and policies_parse_from_options().

◆ metrics_policy

smartlist_t* metrics_policy = NULL

static

Policy for incoming MetricsPort connections that must match.

Definition at line 52 of file policies.c.

Referenced by metrics_policy_permits_address(), and parse_metrics_port_policy().

◆ private_nets

const char* private_nets[]

static

Initial value:

= {
  "0.0.0.0/8", "169.254.0.0/16",
  "127.0.0.0/8", "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12",
  "[::]/8",
  "[fc00::]/7", "[fe80::]/10", "[fec0::]/10", "[ff00::]/8", "[::]/127",
  NULL
}

Private networks. This list is used in two places, once to expand the "private" keyword when parsing our own exit policy, secondly to ignore just such networks when building exit policy summaries. It is important that all authorities agree on that list when creating summaries, so don't just change this without a proper migration plan and a proposal and stuff.

Definition at line 88 of file policies.c.

Referenced by policy_expand_private().

◆ reachable_dir_addr_policy

smartlist_t* reachable_dir_addr_policy = NULL

static

Parsed addr_policy_t describing which addresses we believe we can connect to directories at.

Definition at line 71 of file policies.c.

Referenced by firewall_is_fascist_dir().

◆ reachable_or_addr_policy

smartlist_t* reachable_or_addr_policy = NULL

static

Parsed addr_policy_t describing which addresses we believe we can start circuits at.

Definition at line 68 of file policies.c.

Referenced by firewall_is_fascist_or().

◆ socks_policy

smartlist_t* socks_policy = NULL

static

Policy that addresses for incoming SOCKS connections must match.

Definition at line 48 of file policies.c.

Referenced by policies_parse_from_options(), and socks_policy_permits_address().

Data Structures

Macros

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ AT

◆ CMP_FIELD

◆ DEFAULT_EXIT_POLICY

◆ IPV4_BITS

◆ IPV6_BITS

◆ MAX_EXITPOLICY_SUMMARY_LEN

◆ POLICIES_PRIVATE

◆ REDUCED_EXIT_POLICY

◆ REJECT

◆ REJECT_CUTOFF_COUNT_IPV4

◆ REJECT_CUTOFF_COUNT_IPV6

◆ REJECT_CUTOFF_SCALE_IPV4

◆ REJECT_CUTOFF_SCALE_IPV6

Function Documentation

◆ addr_is_in_cc_list()

◆ addr_policies_eq()

◆ addr_policy_append_reject_addr()

◆ addr_policy_append_reject_addr_filter()

◆ addr_policy_append_reject_addr_list()

◆ addr_policy_append_reject_addr_list_filter()

◆ addr_policy_covers()

◆ addr_policy_free_()

◆ addr_policy_get_canonical_entry()

◆ addr_policy_intersects()

◆ addr_policy_list_free_()

◆ addr_policy_permits_tor_addr()

◆ append_exit_policy_string()

◆ authdir_policy_badexit_address()

◆ authdir_policy_middleonly_address()

◆ authdir_policy_permits_address()

◆ authdir_policy_valid_address()

◆ compare_known_tor_addr_to_addr_policy()

◆ compare_known_tor_addr_to_addr_policy_noport()

◆ compare_tor_addr_to_addr_policy()

◆ compare_tor_addr_to_node_policy()

◆ compare_tor_addr_to_short_policy()

◆ compare_unknown_tor_addr_to_addr_policy()

◆ dir_policy_permits_address()

◆ exit_policy_is_general_exit()

◆ exit_policy_is_general_exit_helper()

◆ exit_policy_remove_redundancies()

◆ firewall_is_fascist_dir()

◆ firewall_is_fascist_impl()

◆ firewall_is_fascist_or()

◆ getinfo_helper_policies()

◆ HT_HEAD()

◆ load_policy_from_option()

◆ metrics_policy_permits_address()

◆ parse_addr_policy()

◆ parse_metrics_port_policy()

◆ parse_reachable_addresses()

◆ parse_short_policy()

◆ policies_copy_addr_to_smartlist()

◆ policies_copy_outbound_addresses_to_smartlist()

◆ policies_exit_policy_append_reject_star()

◆ policies_free_all()

◆ policies_log_first_redundant_entry()

◆ policies_parse_exit_policy()

◆ policies_parse_exit_policy_from_options()

◆ policies_parse_exit_policy_internal()

◆ policies_parse_exit_policy_reject_private()

◆ policies_parse_from_options()

◆ policies_set_node_exitpolicy_to_reject_all()

◆ policy_dump_to_string()

◆ policy_expand_private()

◆ policy_expand_unspec()

◆ policy_hash()

◆ policy_is_reject_star()

◆ policy_summarize()

◆ policy_summary_accept()

◆ policy_summary_add_item()

◆ policy_summary_create()

◆ policy_summary_item_split()

◆ policy_summary_reject()