Tor 0.4.9.0-alpha-dev
policies.h
Go to the documentation of this file.
1/* Copyright (c) 2001 Matej Pfajfar.
2 * Copyright (c) 2001-2004, Roger Dingledine.
3 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4 * Copyright (c) 2007-2021, The Tor Project, Inc. */
5/* See LICENSE for licensing information */
6
7/**
8 * \file policies.h
9 * \brief Header file for policies.c.
10 **/
11
12#ifndef TOR_POLICIES_H
13#define TOR_POLICIES_H
14
15/* (length of
16 * "accept6 [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]/128:65535-65535\n"
17 * plus a terminating NUL, rounded up to a nice number.)
18 */
19#define POLICY_BUF_LEN 72
20
21#define EXIT_POLICY_IPV6_ENABLED (1 << 0)
22#define EXIT_POLICY_REJECT_PRIVATE (1 << 1)
23#define EXIT_POLICY_ADD_DEFAULT (1 << 2)
24#define EXIT_POLICY_REJECT_LOCAL_INTERFACES (1 << 3)
25#define EXIT_POLICY_ADD_REDUCED (1 << 4)
26#define EXIT_POLICY_OPTION_MAX EXIT_POLICY_ADD_REDUCED
27/* All options set: used for unit testing */
28#define EXIT_POLICY_OPTION_ALL ((EXIT_POLICY_OPTION_MAX << 1) - 1)
29
30typedef enum firewall_connection_t {
31 FIREWALL_OR_CONNECTION = 0,
32 FIREWALL_DIR_CONNECTION = 1
33} firewall_connection_t;
34
35typedef int exit_policy_parser_cfg_t;
36
37/** Outcome of applying an address policy to an address. */
38typedef enum {
39 /** The address was accepted */
41 /** The address was rejected */
43 /** Part of the address was unknown, but as far as we can tell, it was
44 * accepted. */
46 /** Part of the address was unknown, but as far as we can tell, it was
47 * rejected. */
50
51/** A single entry in a parsed policy summary, describing a range of ports. */
52typedef struct short_policy_entry_t {
53 uint16_t min_port, max_port;
55
56/** A short_poliy_t is the parsed version of a policy summary. */
57typedef struct short_policy_t {
58 /** True if the members of 'entries' are port ranges to accept; false if
59 * they are port ranges to reject */
60 unsigned int is_accept : 1;
61 /** The actual number of values in 'entries'. */
62 unsigned int n_entries : 31;
63 /** An array of 0 or more short_policy_entry_t values, each describing a
64 * range of ports that this policy accepts or rejects (depending on the
65 * value of is_accept).
66 */
67 short_policy_entry_t entries[FLEXIBLE_ARRAY_MEMBER];
69
72int reachable_addr_use_ipv6(const or_options_t *options);
75
77 uint16_t port,
78 firewall_connection_t fw_connection,
79 int pref_only, int pref_ipv6);
80
82 firewall_connection_t fw_connection,
83 int pref_only);
85 firewall_connection_t fw_connection,
86 int pref_only);
88 firewall_connection_t fw_connection,
89 int pref_only);
90
92 firewall_connection_t fw_connection,
93 int pref_only, tor_addr_port_t* ap);
95 int pref_only, tor_addr_port_t* ap);
97 firewall_connection_t fw_connection,
98 int pref_only, tor_addr_port_t* ap);
100 firewall_connection_t fw_connection,
101 int pref_only, tor_addr_port_t* ap);
102
106int authdir_policy_permits_address(const tor_addr_t *addr, uint16_t port);
107int authdir_policy_valid_address(const tor_addr_t *addr, uint16_t port);
108int authdir_policy_badexit_address(const tor_addr_t *addr, uint16_t port);
109int authdir_policy_middleonly_address(const tor_addr_t *addr, uint16_t port);
110
112int validate_addr_policies(const or_options_t *options, char **msg);
114void policy_expand_unspec(smartlist_t **policy);
115int policies_parse_from_options(const or_options_t *options);
116
118int addr_policies_eq(const smartlist_t *a, const smartlist_t *b);
120 (const tor_addr_t *addr, uint16_t port, const smartlist_t *policy));
122 uint16_t port, const node_t *node);
123
125 const or_options_t *or_options,
126 const tor_addr_t *ipv4_local_address,
127 const tor_addr_t *ipv6_local_address,
128 smartlist_t **result);
129struct config_line_t;
131 exit_policy_parser_cfg_t options,
132 const smartlist_t *configured_addresses);
134 smartlist_t **dest,
135 int ipv6_exit,
136 const smartlist_t *configured_addresses,
137 int reject_interface_addresses,
138 int reject_configured_port_addresses);
141 const tor_addr_t *addr);
143 const smartlist_t *addrs);
146int policy_is_reject_star(const smartlist_t *policy, sa_family_t family,
147 int reject_by_default);
148char * policy_dump_to_string(const smartlist_t *policy_list,
149 int include_ipv4,
150 int include_ipv6);
152 const char *question, char **answer,
153 const char **errmsg);
154int policy_write_item(char *buf, size_t buflen, const addr_policy_t *item,
155 int format_for_desc);
156
158#define addr_policy_list_free(lst) \
159 FREE_AND_NULL(smartlist_t, addr_policy_list_free_, (lst))
161#define addr_policy_free(p) \
162 FREE_AND_NULL(addr_policy_t, addr_policy_free_, (p))
163void policies_free_all(void);
164
165char *policy_summarize(smartlist_t *policy, sa_family_t family);
166
167short_policy_t *parse_short_policy(const char *summary);
168char *write_short_policy(const short_policy_t *policy);
170#define short_policy_free(p) \
171 FREE_AND_NULL(short_policy_t, short_policy_free_, (p))
174 const tor_addr_t *addr, uint16_t port,
175 const short_policy_t *policy);
176
177#ifdef POLICIES_PRIVATE
178STATIC void append_exit_policy_string(smartlist_t **policy, const char *more);
180 uint16_t port,
181 smartlist_t *firewall_policy,
182 int pref_only, int pref_ipv6);
184 const tor_addr_port_t *a,
185 const tor_addr_port_t *b,
186 int want_a,
187 firewall_connection_t fw_connection,
188 int pref_only, int pref_ipv6);
189
190#endif /* defined(POLICIES_PRIVATE) */
191
192#endif /* !defined(TOR_POLICIES_H) */
uint16_t sa_family_t
Definition: inaddr_st.h:77
STATIC int reachable_addr_allows(const tor_addr_t *addr, uint16_t port, smartlist_t *firewall_policy, int pref_only, int pref_ipv6)
Definition: policies.c:412
STATIC const tor_addr_port_t * reachable_addr_choose(const tor_addr_port_t *a, const tor_addr_port_t *b, int want_a, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)
Definition: policies.c:792
STATIC void append_exit_policy_string(smartlist_t **policy, const char *more)
Definition: policies.c:1603
void addr_policy_append_reject_addr(smartlist_t **dest, const tor_addr_t *addr)
Definition: policies.c:1617
void policies_set_node_exitpolicy_to_reject_all(node_t *exitrouter)
Definition: policies.c:2194
void addr_policy_free_(addr_policy_t *p)
Definition: policies.c:3096
int addr_policies_eq(const smartlist_t *a, const smartlist_t *b)
Definition: policies.c:1324
int reachable_addr_prefer_ipv6_dirport(const or_options_t *options)
Definition: policies.c:512
int policies_parse_exit_policy_from_options(const or_options_t *or_options, const tor_addr_t *ipv4_local_address, const tor_addr_t *ipv6_local_address, smartlist_t **result)
Definition: policies.c:2123
int policies_parse_exit_policy(struct config_line_t *cfg, smartlist_t **dest, exit_policy_parser_cfg_t options, const smartlist_t *configured_addresses)
Definition: policies.c:2040
int reachable_addr_prefer_ipv6_orport(const or_options_t *options)
Definition: policies.c:490
void policy_expand_private(smartlist_t **policy)
Definition: policies.c:110
int reachable_addr_allows_rs(const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only)
Definition: policies.c:647
int firewall_is_fascist_or(void)
Definition: policies.c:359
int metrics_policy_permits_address(const tor_addr_t *addr)
Definition: policies.c:1072
void policies_parse_exit_policy_reject_private(smartlist_t **dest, int ipv6_exit, const smartlist_t *configured_addresses, int reject_interface_addresses, int reject_configured_port_addresses)
Definition: policies.c:1805
void addr_policy_append_reject_addr_list(smartlist_t **dest, const smartlist_t *addrs)
Definition: policies.c:1674
int reachable_addr_allows_addr(const tor_addr_t *addr, uint16_t port, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)
Definition: policies.c:536
void reachable_addr_choose_from_node(const node_t *node, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:988
void reachable_addr_choose_from_dir_server(const dir_server_t *ds, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:1027
int reachable_addr_allows_node(const node_t *node, firewall_connection_t fw_connection, int pref_only)
Definition: policies.c:693
void addr_policy_list_free_(smartlist_t *p)
Definition: policies.c:3086
int getinfo_helper_policies(control_connection_t *conn, const char *question, char **answer, const char **errmsg)
Definition: policies.c:2988
void reachable_addr_choose_from_ls(const smartlist_t *lspecs, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:913
void reachable_addr_choose_from_rs(const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:874
int policies_parse_from_options(const or_options_t *options)
Definition: policies.c:1268
char * policy_dump_to_string(const smartlist_t *policy_list, int include_ipv4, int include_ipv6)
Definition: policies.c:2945
int authdir_policy_badexit_address(const tor_addr_t *addr, uint16_t port)
Definition: policies.c:1118
int reachable_addr_allows_dir_server(const dir_server_t *ds, firewall_connection_t fw_connection, int pref_only)
Definition: policies.c:731
int policy_write_item(char *buf, size_t buflen, const addr_policy_t *item, int format_for_desc)
Definition: policies.c:2288
addr_policy_result_t compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, const smartlist_t *policy)
Definition: policies.c:1536
char * write_short_policy(const short_policy_t *policy)
Definition: policies.c:2806
int reachable_addr_use_ipv6(const or_options_t *options)
Definition: policies.c:451
addr_policy_result_t compare_tor_addr_to_short_policy(const tor_addr_t *addr, uint16_t port, const short_policy_t *policy)
Definition: policies.c:2842
int policy_is_reject_star(const smartlist_t *policy, sa_family_t family, int reject_by_default)
Definition: policies.c:2264
int firewall_is_fascist_dir(void)
Definition: policies.c:370
int dir_policy_permits_address(const tor_addr_t *addr)
Definition: policies.c:1054
void policy_expand_unspec(smartlist_t **policy)
Definition: policies.c:150
int authdir_policy_permits_address(const tor_addr_t *addr, uint16_t port)
Definition: policies.c:1096
addr_policy_result_t
Definition: policies.h:38
@ ADDR_POLICY_PROBABLY_ACCEPTED
Definition: policies.h:45
@ ADDR_POLICY_ACCEPTED
Definition: policies.h:40
@ ADDR_POLICY_PROBABLY_REJECTED
Definition: policies.h:48
@ ADDR_POLICY_REJECTED
Definition: policies.h:42
int policy_using_default_exit_options(const or_options_t *or_options)
Definition: policies.c:1142
void policies_free_all(void)
Definition: policies.c:3117
void short_policy_free_(short_policy_t *policy)
Definition: policies.c:2832
int validate_addr_policies(const or_options_t *options, char **msg)
Definition: policies.c:1152
int authdir_policy_middleonly_address(const tor_addr_t *addr, uint16_t port)
Definition: policies.c:1129
int socks_policy_permits_address(const tor_addr_t *addr)
Definition: policies.c:1063
char * policy_summarize(smartlist_t *policy, sa_family_t family)
Definition: policies.c:2593
addr_policy_t * addr_policy_get_canonical_entry(addr_policy_t *ent)
Definition: policies.c:1389
addr_policy_result_t compare_tor_addr_to_node_policy(const tor_addr_t *addr, uint16_t port, const node_t *node)
Definition: policies.c:2907
int authdir_policy_valid_address(const tor_addr_t *addr, uint16_t port)
Definition: policies.c:1107
short_policy_t * parse_short_policy(const char *summary)
Definition: policies.c:2705
int short_policy_is_reject_star(const short_policy_t *policy)
Definition: policies.c:2890
int exit_policy_is_general_exit(smartlist_t *policy)
Definition: policies.c:2250
void policies_exit_policy_append_reject_star(smartlist_t **dest)
Definition: policies.c:2186
Definition: node_st.h:34
Definition: policies.h:52
unsigned int n_entries
Definition: policies.h:62
unsigned int is_accept
Definition: policies.h:60
short_policy_entry_t entries[FLEXIBLE_ARRAY_MEMBER]
Definition: policies.h:67
#define STATIC
Definition: testsupport.h:32
#define MOCK_DECL(rv, funcname, arglist)
Definition: testsupport.h:127