policies.h 7.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2017, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file policies.h
  8. * \brief Header file for policies.c.
  9. **/
  10. #ifndef TOR_POLICIES_H
  11. #define TOR_POLICIES_H
  12. /* (length of
  13. * "accept6 [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]/128:65535-65535\n"
  14. * plus a terminating NUL, rounded up to a nice number.)
  15. */
  16. #define POLICY_BUF_LEN 72
  17. #define EXIT_POLICY_IPV6_ENABLED (1 << 0)
  18. #define EXIT_POLICY_REJECT_PRIVATE (1 << 1)
  19. #define EXIT_POLICY_ADD_DEFAULT (1 << 2)
  20. #define EXIT_POLICY_REJECT_LOCAL_INTERFACES (1 << 3)
  21. #define EXIT_POLICY_OPTION_MAX EXIT_POLICY_REJECT_LOCAL_INTERFACES
  22. /* All options set: used for unit testing */
  23. #define EXIT_POLICY_OPTION_ALL ((EXIT_POLICY_OPTION_MAX << 1) - 1)
  24. typedef enum firewall_connection_t {
  25. FIREWALL_OR_CONNECTION = 0,
  26. FIREWALL_DIR_CONNECTION = 1
  27. } firewall_connection_t;
  28. typedef int exit_policy_parser_cfg_t;
  29. int firewall_is_fascist_or(void);
  30. int firewall_is_fascist_dir(void);
  31. int fascist_firewall_use_ipv6(const or_options_t *options);
  32. int fascist_firewall_prefer_ipv6_orport(const or_options_t *options);
  33. int fascist_firewall_prefer_ipv6_dirport(const or_options_t *options);
  34. int fascist_firewall_allows_address_addr(const tor_addr_t *addr,
  35. uint16_t port,
  36. firewall_connection_t fw_connection,
  37. int pref_only, int pref_ipv6);
  38. int fascist_firewall_allows_rs(const routerstatus_t *rs,
  39. firewall_connection_t fw_connection,
  40. int pref_only);
  41. int fascist_firewall_allows_node(const node_t *node,
  42. firewall_connection_t fw_connection,
  43. int pref_only);
  44. int fascist_firewall_allows_dir_server(const dir_server_t *ds,
  45. firewall_connection_t fw_connection,
  46. int pref_only);
  47. int fascist_firewall_choose_address_rs(const routerstatus_t *rs,
  48. firewall_connection_t fw_connection,
  49. int pref_only, tor_addr_port_t* ap);
  50. int fascist_firewall_choose_address_node(const node_t *node,
  51. firewall_connection_t fw_connection,
  52. int pref_only, tor_addr_port_t* ap);
  53. int fascist_firewall_choose_address_dir_server(const dir_server_t *ds,
  54. firewall_connection_t fw_connection,
  55. int pref_only, tor_addr_port_t* ap);
  56. int dir_policy_permits_address(const tor_addr_t *addr);
  57. int socks_policy_permits_address(const tor_addr_t *addr);
  58. int authdir_policy_permits_address(uint32_t addr, uint16_t port);
  59. int authdir_policy_valid_address(uint32_t addr, uint16_t port);
  60. int authdir_policy_badexit_address(uint32_t addr, uint16_t port);
  61. int validate_addr_policies(const or_options_t *options, char **msg);
  62. void policy_expand_private(smartlist_t **policy);
  63. void policy_expand_unspec(smartlist_t **policy);
  64. int policies_parse_from_options(const or_options_t *options);
  65. addr_policy_t *addr_policy_get_canonical_entry(addr_policy_t *ent);
  66. int addr_policies_eq(const smartlist_t *a, const smartlist_t *b);
  67. MOCK_DECL(addr_policy_result_t, compare_tor_addr_to_addr_policy,
  68. (const tor_addr_t *addr, uint16_t port, const smartlist_t *policy));
  69. addr_policy_result_t compare_tor_addr_to_node_policy(const tor_addr_t *addr,
  70. uint16_t port, const node_t *node);
  71. int policies_parse_exit_policy_from_options(
  72. const or_options_t *or_options,
  73. uint32_t local_address,
  74. const tor_addr_t *ipv6_local_address,
  75. smartlist_t **result);
  76. int policies_parse_exit_policy(config_line_t *cfg, smartlist_t **dest,
  77. exit_policy_parser_cfg_t options,
  78. const smartlist_t *configured_addresses);
  79. void policies_parse_exit_policy_reject_private(
  80. smartlist_t **dest,
  81. int ipv6_exit,
  82. const smartlist_t *configured_addresses,
  83. int reject_interface_addresses,
  84. int reject_configured_port_addresses);
  85. void policies_exit_policy_append_reject_star(smartlist_t **dest);
  86. void addr_policy_append_reject_addr(smartlist_t **dest,
  87. const tor_addr_t *addr);
  88. void addr_policy_append_reject_addr_list(smartlist_t **dest,
  89. const smartlist_t *addrs);
  90. void policies_set_node_exitpolicy_to_reject_all(node_t *exitrouter);
  91. int exit_policy_is_general_exit(smartlist_t *policy);
  92. int policy_is_reject_star(const smartlist_t *policy, sa_family_t family,
  93. int reject_by_default);
  94. char * policy_dump_to_string(const smartlist_t *policy_list,
  95. int include_ipv4,
  96. int include_ipv6);
  97. int getinfo_helper_policies(control_connection_t *conn,
  98. const char *question, char **answer,
  99. const char **errmsg);
  100. int policy_write_item(char *buf, size_t buflen, const addr_policy_t *item,
  101. int format_for_desc);
  102. void addr_policy_list_free(smartlist_t *p);
  103. void addr_policy_free(addr_policy_t *p);
  104. void policies_free_all(void);
  105. char *policy_summarize(smartlist_t *policy, sa_family_t family);
  106. short_policy_t *parse_short_policy(const char *summary);
  107. char *write_short_policy(const short_policy_t *policy);
  108. void short_policy_free(short_policy_t *policy);
  109. int short_policy_is_reject_star(const short_policy_t *policy);
  110. addr_policy_result_t compare_tor_addr_to_short_policy(
  111. const tor_addr_t *addr, uint16_t port,
  112. const short_policy_t *policy);
  113. #ifdef POLICIES_PRIVATE
  114. STATIC void append_exit_policy_string(smartlist_t **policy, const char *more);
  115. STATIC int fascist_firewall_allows_address(const tor_addr_t *addr,
  116. uint16_t port,
  117. smartlist_t *firewall_policy,
  118. int pref_only, int pref_ipv6);
  119. STATIC const tor_addr_port_t * fascist_firewall_choose_address(
  120. const tor_addr_port_t *a,
  121. const tor_addr_port_t *b,
  122. int want_a,
  123. firewall_connection_t fw_connection,
  124. int pref_only, int pref_ipv6);
  125. #endif /* defined(POLICIES_PRIVATE) */
  126. #endif /* !defined(TOR_POLICIES_H) */