test_policy.c 71 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881
  1. /* Copyright (c) 2013-2016, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. #include "or.h"
  4. #define CONFIG_PRIVATE
  5. #include "config.h"
  6. #include "router.h"
  7. #include "routerparse.h"
  8. #define POLICIES_PRIVATE
  9. #include "policies.h"
  10. #include "test.h"
  11. /* Helper: assert that short_policy parses and writes back out as itself,
  12. or as <b>expected</b> if that's provided. */
  13. static void
  14. test_short_policy_parse(const char *input,
  15. const char *expected)
  16. {
  17. short_policy_t *short_policy = NULL;
  18. char *out = NULL;
  19. if (expected == NULL)
  20. expected = input;
  21. short_policy = parse_short_policy(input);
  22. tt_assert(short_policy);
  23. out = write_short_policy(short_policy);
  24. tt_str_op(out, OP_EQ, expected);
  25. done:
  26. tor_free(out);
  27. short_policy_free(short_policy);
  28. }
  29. /** Helper: Parse the exit policy string in <b>policy_str</b>, and make sure
  30. * that policies_summarize() produces the string <b>expected_summary</b> from
  31. * it. */
  32. static void
  33. test_policy_summary_helper(const char *policy_str,
  34. const char *expected_summary)
  35. {
  36. config_line_t line;
  37. smartlist_t *policy = smartlist_new();
  38. char *summary = NULL;
  39. char *summary_after = NULL;
  40. int r;
  41. short_policy_t *short_policy = NULL;
  42. line.key = (char*)"foo";
  43. line.value = (char *)policy_str;
  44. line.next = NULL;
  45. r = policies_parse_exit_policy(&line, &policy,
  46. EXIT_POLICY_IPV6_ENABLED |
  47. EXIT_POLICY_ADD_DEFAULT, NULL);
  48. tt_int_op(r,OP_EQ, 0);
  49. summary = policy_summarize(policy, AF_INET);
  50. tt_assert(summary != NULL);
  51. tt_str_op(summary,OP_EQ, expected_summary);
  52. short_policy = parse_short_policy(summary);
  53. tt_assert(short_policy);
  54. summary_after = write_short_policy(short_policy);
  55. tt_str_op(summary,OP_EQ, summary_after);
  56. done:
  57. tor_free(summary_after);
  58. tor_free(summary);
  59. if (policy)
  60. addr_policy_list_free(policy);
  61. short_policy_free(short_policy);
  62. }
  63. /** Run unit tests for generating summary lines of exit policies */
  64. static void
  65. test_policies_general(void *arg)
  66. {
  67. int i;
  68. smartlist_t *policy = NULL, *policy2 = NULL, *policy3 = NULL,
  69. *policy4 = NULL, *policy5 = NULL, *policy6 = NULL,
  70. *policy7 = NULL, *policy8 = NULL, *policy9 = NULL,
  71. *policy10 = NULL, *policy11 = NULL, *policy12 = NULL;
  72. addr_policy_t *p;
  73. tor_addr_t tar, tar2;
  74. smartlist_t *addr_list = NULL;
  75. config_line_t line;
  76. smartlist_t *sm = NULL;
  77. char *policy_str = NULL;
  78. short_policy_t *short_parsed = NULL;
  79. int malformed_list = -1;
  80. (void)arg;
  81. policy = smartlist_new();
  82. p = router_parse_addr_policy_item_from_string("reject 192.168.0.0/16:*", -1,
  83. &malformed_list);
  84. tt_assert(p != NULL);
  85. tt_int_op(ADDR_POLICY_REJECT,OP_EQ, p->policy_type);
  86. tor_addr_from_ipv4h(&tar, 0xc0a80000u);
  87. tt_int_op(0,OP_EQ, tor_addr_compare(&p->addr, &tar, CMP_EXACT));
  88. tt_int_op(16,OP_EQ, p->maskbits);
  89. tt_int_op(1,OP_EQ, p->prt_min);
  90. tt_int_op(65535,OP_EQ, p->prt_max);
  91. smartlist_add(policy, p);
  92. tor_addr_from_ipv4h(&tar, 0x01020304u);
  93. tt_assert(ADDR_POLICY_ACCEPTED ==
  94. compare_tor_addr_to_addr_policy(&tar, 2, policy));
  95. tor_addr_make_unspec(&tar);
  96. tt_assert(ADDR_POLICY_PROBABLY_ACCEPTED ==
  97. compare_tor_addr_to_addr_policy(&tar, 2, policy));
  98. tor_addr_from_ipv4h(&tar, 0xc0a80102);
  99. tt_assert(ADDR_POLICY_REJECTED ==
  100. compare_tor_addr_to_addr_policy(&tar, 2, policy));
  101. tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy2,
  102. EXIT_POLICY_IPV6_ENABLED |
  103. EXIT_POLICY_REJECT_PRIVATE |
  104. EXIT_POLICY_ADD_DEFAULT, NULL));
  105. tt_assert(policy2);
  106. tor_addr_from_ipv4h(&tar, 0x0306090cu);
  107. tor_addr_parse(&tar2, "[2000::1234]");
  108. addr_list = smartlist_new();
  109. smartlist_add(addr_list, &tar);
  110. smartlist_add(addr_list, &tar2);
  111. tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy12,
  112. EXIT_POLICY_IPV6_ENABLED |
  113. EXIT_POLICY_REJECT_PRIVATE |
  114. EXIT_POLICY_ADD_DEFAULT,
  115. addr_list));
  116. smartlist_free(addr_list);
  117. addr_list = NULL;
  118. tt_assert(policy12);
  119. policy3 = smartlist_new();
  120. p = router_parse_addr_policy_item_from_string("reject *:*", -1,
  121. &malformed_list);
  122. tt_assert(p != NULL);
  123. smartlist_add(policy3, p);
  124. p = router_parse_addr_policy_item_from_string("accept *:*", -1,
  125. &malformed_list);
  126. tt_assert(p != NULL);
  127. smartlist_add(policy3, p);
  128. policy4 = smartlist_new();
  129. p = router_parse_addr_policy_item_from_string("accept *:443", -1,
  130. &malformed_list);
  131. tt_assert(p != NULL);
  132. smartlist_add(policy4, p);
  133. p = router_parse_addr_policy_item_from_string("accept *:443", -1,
  134. &malformed_list);
  135. tt_assert(p != NULL);
  136. smartlist_add(policy4, p);
  137. policy5 = smartlist_new();
  138. p = router_parse_addr_policy_item_from_string("reject 0.0.0.0/8:*", -1,
  139. &malformed_list);
  140. tt_assert(p != NULL);
  141. smartlist_add(policy5, p);
  142. p = router_parse_addr_policy_item_from_string("reject 169.254.0.0/16:*", -1,
  143. &malformed_list);
  144. tt_assert(p != NULL);
  145. smartlist_add(policy5, p);
  146. p = router_parse_addr_policy_item_from_string("reject 127.0.0.0/8:*", -1,
  147. &malformed_list);
  148. tt_assert(p != NULL);
  149. smartlist_add(policy5, p);
  150. p = router_parse_addr_policy_item_from_string("reject 192.168.0.0/16:*",
  151. -1, &malformed_list);
  152. tt_assert(p != NULL);
  153. smartlist_add(policy5, p);
  154. p = router_parse_addr_policy_item_from_string("reject 10.0.0.0/8:*", -1,
  155. &malformed_list);
  156. tt_assert(p != NULL);
  157. smartlist_add(policy5, p);
  158. p = router_parse_addr_policy_item_from_string("reject 172.16.0.0/12:*", -1,
  159. &malformed_list);
  160. tt_assert(p != NULL);
  161. smartlist_add(policy5, p);
  162. p = router_parse_addr_policy_item_from_string("reject 80.190.250.90:*", -1,
  163. &malformed_list);
  164. tt_assert(p != NULL);
  165. smartlist_add(policy5, p);
  166. p = router_parse_addr_policy_item_from_string("reject *:1-65534", -1,
  167. &malformed_list);
  168. tt_assert(p != NULL);
  169. smartlist_add(policy5, p);
  170. p = router_parse_addr_policy_item_from_string("reject *:65535", -1,
  171. &malformed_list);
  172. tt_assert(p != NULL);
  173. smartlist_add(policy5, p);
  174. p = router_parse_addr_policy_item_from_string("accept *:1-65535", -1,
  175. &malformed_list);
  176. tt_assert(p != NULL);
  177. smartlist_add(policy5, p);
  178. policy6 = smartlist_new();
  179. p = router_parse_addr_policy_item_from_string("accept 43.3.0.0/9:*", -1,
  180. &malformed_list);
  181. tt_assert(p != NULL);
  182. smartlist_add(policy6, p);
  183. policy7 = smartlist_new();
  184. p = router_parse_addr_policy_item_from_string("accept 0.0.0.0/8:*", -1,
  185. &malformed_list);
  186. tt_assert(p != NULL);
  187. smartlist_add(policy7, p);
  188. tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy8,
  189. EXIT_POLICY_IPV6_ENABLED |
  190. EXIT_POLICY_REJECT_PRIVATE |
  191. EXIT_POLICY_ADD_DEFAULT,
  192. NULL));
  193. tt_assert(policy8);
  194. tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy9,
  195. EXIT_POLICY_REJECT_PRIVATE |
  196. EXIT_POLICY_ADD_DEFAULT,
  197. NULL));
  198. tt_assert(policy9);
  199. /* accept6 * and reject6 * produce IPv6 wildcards only */
  200. policy10 = smartlist_new();
  201. p = router_parse_addr_policy_item_from_string("accept6 *:*", -1,
  202. &malformed_list);
  203. tt_assert(p != NULL);
  204. smartlist_add(policy10, p);
  205. policy11 = smartlist_new();
  206. p = router_parse_addr_policy_item_from_string("reject6 *:*", -1,
  207. &malformed_list);
  208. tt_assert(p != NULL);
  209. smartlist_add(policy11, p);
  210. tt_assert(!exit_policy_is_general_exit(policy));
  211. tt_assert(exit_policy_is_general_exit(policy2));
  212. tt_assert(!exit_policy_is_general_exit(NULL));
  213. tt_assert(!exit_policy_is_general_exit(policy3));
  214. tt_assert(!exit_policy_is_general_exit(policy4));
  215. tt_assert(!exit_policy_is_general_exit(policy5));
  216. tt_assert(!exit_policy_is_general_exit(policy6));
  217. tt_assert(!exit_policy_is_general_exit(policy7));
  218. tt_assert(exit_policy_is_general_exit(policy8));
  219. tt_assert(exit_policy_is_general_exit(policy9));
  220. tt_assert(!exit_policy_is_general_exit(policy10));
  221. tt_assert(!exit_policy_is_general_exit(policy11));
  222. tt_assert(cmp_addr_policies(policy, policy2));
  223. tt_assert(cmp_addr_policies(policy, NULL));
  224. tt_assert(!cmp_addr_policies(policy2, policy2));
  225. tt_assert(!cmp_addr_policies(NULL, NULL));
  226. tt_assert(!policy_is_reject_star(policy2, AF_INET));
  227. tt_assert(policy_is_reject_star(policy, AF_INET));
  228. tt_assert(policy_is_reject_star(policy10, AF_INET));
  229. tt_assert(!policy_is_reject_star(policy10, AF_INET6));
  230. tt_assert(policy_is_reject_star(policy11, AF_INET));
  231. tt_assert(policy_is_reject_star(policy11, AF_INET6));
  232. tt_assert(policy_is_reject_star(NULL, AF_INET));
  233. tt_assert(policy_is_reject_star(NULL, AF_INET6));
  234. addr_policy_list_free(policy);
  235. policy = NULL;
  236. /* make sure assume_action works */
  237. malformed_list = 0;
  238. p = router_parse_addr_policy_item_from_string("127.0.0.1",
  239. ADDR_POLICY_ACCEPT,
  240. &malformed_list);
  241. tt_assert(p);
  242. addr_policy_free(p);
  243. tt_assert(!malformed_list);
  244. p = router_parse_addr_policy_item_from_string("127.0.0.1:*",
  245. ADDR_POLICY_ACCEPT,
  246. &malformed_list);
  247. tt_assert(p);
  248. addr_policy_free(p);
  249. tt_assert(!malformed_list);
  250. p = router_parse_addr_policy_item_from_string("[::]",
  251. ADDR_POLICY_ACCEPT,
  252. &malformed_list);
  253. tt_assert(p);
  254. addr_policy_free(p);
  255. tt_assert(!malformed_list);
  256. p = router_parse_addr_policy_item_from_string("[::]:*",
  257. ADDR_POLICY_ACCEPT,
  258. &malformed_list);
  259. tt_assert(p);
  260. addr_policy_free(p);
  261. tt_assert(!malformed_list);
  262. p = router_parse_addr_policy_item_from_string("[face::b]",
  263. ADDR_POLICY_ACCEPT,
  264. &malformed_list);
  265. tt_assert(p);
  266. addr_policy_free(p);
  267. tt_assert(!malformed_list);
  268. p = router_parse_addr_policy_item_from_string("[b::aaaa]",
  269. ADDR_POLICY_ACCEPT,
  270. &malformed_list);
  271. tt_assert(p);
  272. addr_policy_free(p);
  273. tt_assert(!malformed_list);
  274. p = router_parse_addr_policy_item_from_string("*",
  275. ADDR_POLICY_ACCEPT,
  276. &malformed_list);
  277. tt_assert(p);
  278. addr_policy_free(p);
  279. tt_assert(!malformed_list);
  280. p = router_parse_addr_policy_item_from_string("*4",
  281. ADDR_POLICY_ACCEPT,
  282. &malformed_list);
  283. tt_assert(p);
  284. addr_policy_free(p);
  285. tt_assert(!malformed_list);
  286. p = router_parse_addr_policy_item_from_string("*6",
  287. ADDR_POLICY_ACCEPT,
  288. &malformed_list);
  289. tt_assert(p);
  290. addr_policy_free(p);
  291. tt_assert(!malformed_list);
  292. /* These are all ambiguous IPv6 addresses, it's good that we reject them */
  293. p = router_parse_addr_policy_item_from_string("acce::abcd",
  294. ADDR_POLICY_ACCEPT,
  295. &malformed_list);
  296. tt_assert(!p);
  297. tt_assert(malformed_list);
  298. malformed_list = 0;
  299. p = router_parse_addr_policy_item_from_string("7:1234",
  300. ADDR_POLICY_ACCEPT,
  301. &malformed_list);
  302. tt_assert(!p);
  303. tt_assert(malformed_list);
  304. malformed_list = 0;
  305. p = router_parse_addr_policy_item_from_string("::",
  306. ADDR_POLICY_ACCEPT,
  307. &malformed_list);
  308. tt_assert(!p);
  309. tt_assert(malformed_list);
  310. malformed_list = 0;
  311. /* make sure compacting logic works. */
  312. policy = NULL;
  313. line.key = (char*)"foo";
  314. line.value = (char*)"accept *:80,reject private:*,reject *:*";
  315. line.next = NULL;
  316. tt_int_op(0, OP_EQ, policies_parse_exit_policy(&line,&policy,
  317. EXIT_POLICY_IPV6_ENABLED |
  318. EXIT_POLICY_ADD_DEFAULT, NULL));
  319. tt_assert(policy);
  320. //test_streq(policy->string, "accept *:80");
  321. //test_streq(policy->next->string, "reject *:*");
  322. tt_int_op(smartlist_len(policy),OP_EQ, 4);
  323. /* test policy summaries */
  324. /* check if we properly ignore private IP addresses */
  325. test_policy_summary_helper("reject 192.168.0.0/16:*,"
  326. "reject 0.0.0.0/8:*,"
  327. "reject 10.0.0.0/8:*,"
  328. "accept *:10-30,"
  329. "accept *:90,"
  330. "reject *:*",
  331. "accept 10-30,90");
  332. /* check all accept policies, and proper counting of rejects */
  333. test_policy_summary_helper("reject 11.0.0.0/9:80,"
  334. "reject 12.0.0.0/9:80,"
  335. "reject 13.0.0.0/9:80,"
  336. "reject 14.0.0.0/9:80,"
  337. "accept *:*", "accept 1-65535");
  338. test_policy_summary_helper("reject 11.0.0.0/9:80,"
  339. "reject 12.0.0.0/9:80,"
  340. "reject 13.0.0.0/9:80,"
  341. "reject 14.0.0.0/9:80,"
  342. "reject 15.0.0.0:81,"
  343. "accept *:*", "accept 1-65535");
  344. test_policy_summary_helper("reject 11.0.0.0/9:80,"
  345. "reject 12.0.0.0/9:80,"
  346. "reject 13.0.0.0/9:80,"
  347. "reject 14.0.0.0/9:80,"
  348. "reject 15.0.0.0:80,"
  349. "accept *:*",
  350. "reject 80");
  351. /* no exits */
  352. test_policy_summary_helper("accept 11.0.0.0/9:80,"
  353. "reject *:*",
  354. "reject 1-65535");
  355. /* port merging */
  356. test_policy_summary_helper("accept *:80,"
  357. "accept *:81,"
  358. "accept *:100-110,"
  359. "accept *:111,"
  360. "reject *:*",
  361. "accept 80-81,100-111");
  362. /* border ports */
  363. test_policy_summary_helper("accept *:1,"
  364. "accept *:3,"
  365. "accept *:65535,"
  366. "reject *:*",
  367. "accept 1,3,65535");
  368. /* holes */
  369. test_policy_summary_helper("accept *:1,"
  370. "accept *:3,"
  371. "accept *:5,"
  372. "accept *:7,"
  373. "reject *:*",
  374. "accept 1,3,5,7");
  375. test_policy_summary_helper("reject *:1,"
  376. "reject *:3,"
  377. "reject *:5,"
  378. "reject *:7,"
  379. "accept *:*",
  380. "reject 1,3,5,7");
  381. /* Short policies with unrecognized formats should get accepted. */
  382. test_short_policy_parse("accept fred,2,3-5", "accept 2,3-5");
  383. test_short_policy_parse("accept 2,fred,3", "accept 2,3");
  384. test_short_policy_parse("accept 2,fred,3,bob", "accept 2,3");
  385. test_short_policy_parse("accept 2,-3,500-600", "accept 2,500-600");
  386. /* Short policies with nil entries are accepted too. */
  387. test_short_policy_parse("accept 1,,3", "accept 1,3");
  388. test_short_policy_parse("accept 100-200,,", "accept 100-200");
  389. test_short_policy_parse("reject ,1-10,,,,30-40", "reject 1-10,30-40");
  390. /* Try parsing various broken short policies */
  391. #define TT_BAD_SHORT_POLICY(s) \
  392. do { \
  393. tt_ptr_op(NULL, OP_EQ, (short_parsed = parse_short_policy((s)))); \
  394. } while (0)
  395. TT_BAD_SHORT_POLICY("accept 200-199");
  396. TT_BAD_SHORT_POLICY("");
  397. TT_BAD_SHORT_POLICY("rejekt 1,2,3");
  398. TT_BAD_SHORT_POLICY("reject ");
  399. TT_BAD_SHORT_POLICY("reject");
  400. TT_BAD_SHORT_POLICY("rej");
  401. TT_BAD_SHORT_POLICY("accept 2,3,100000");
  402. TT_BAD_SHORT_POLICY("accept 2,3x,4");
  403. TT_BAD_SHORT_POLICY("accept 2,3x,4");
  404. TT_BAD_SHORT_POLICY("accept 2-");
  405. TT_BAD_SHORT_POLICY("accept 2-x");
  406. TT_BAD_SHORT_POLICY("accept 1-,3");
  407. TT_BAD_SHORT_POLICY("accept 1-,3");
  408. /* Make sure that IPv4 addresses are ignored in accept6/reject6 lines. */
  409. p = router_parse_addr_policy_item_from_string("accept6 1.2.3.4:*", -1,
  410. &malformed_list);
  411. tt_assert(p == NULL);
  412. tt_assert(!malformed_list);
  413. p = router_parse_addr_policy_item_from_string("reject6 2.4.6.0/24:*", -1,
  414. &malformed_list);
  415. tt_assert(p == NULL);
  416. tt_assert(!malformed_list);
  417. p = router_parse_addr_policy_item_from_string("accept6 *4:*", -1,
  418. &malformed_list);
  419. tt_assert(p == NULL);
  420. tt_assert(!malformed_list);
  421. /* Make sure malformed policies are detected as such. */
  422. p = router_parse_addr_policy_item_from_string("bad_token *4:*", -1,
  423. &malformed_list);
  424. tt_assert(p == NULL);
  425. tt_assert(malformed_list);
  426. p = router_parse_addr_policy_item_from_string("accept6 **:*", -1,
  427. &malformed_list);
  428. tt_assert(p == NULL);
  429. tt_assert(malformed_list);
  430. p = router_parse_addr_policy_item_from_string("accept */15:*", -1,
  431. &malformed_list);
  432. tt_assert(p == NULL);
  433. tt_assert(malformed_list);
  434. p = router_parse_addr_policy_item_from_string("reject6 */:*", -1,
  435. &malformed_list);
  436. tt_assert(p == NULL);
  437. tt_assert(malformed_list);
  438. p = router_parse_addr_policy_item_from_string("accept 127.0.0.1/33:*", -1,
  439. &malformed_list);
  440. tt_assert(p == NULL);
  441. tt_assert(malformed_list);
  442. p = router_parse_addr_policy_item_from_string("accept6 [::1]/129:*", -1,
  443. &malformed_list);
  444. tt_assert(p == NULL);
  445. tt_assert(malformed_list);
  446. p = router_parse_addr_policy_item_from_string("reject 8.8.8.8/-1:*", -1,
  447. &malformed_list);
  448. tt_assert(p == NULL);
  449. tt_assert(malformed_list);
  450. p = router_parse_addr_policy_item_from_string("reject 8.8.4.4:10-5", -1,
  451. &malformed_list);
  452. tt_assert(p == NULL);
  453. tt_assert(malformed_list);
  454. p = router_parse_addr_policy_item_from_string("reject 1.2.3.4:-1", -1,
  455. &malformed_list);
  456. tt_assert(p == NULL);
  457. tt_assert(malformed_list);
  458. /* Test a too-long policy. */
  459. {
  460. char *policy_strng = NULL;
  461. smartlist_t *chunks = smartlist_new();
  462. smartlist_add(chunks, tor_strdup("accept "));
  463. for (i=1; i<10000; ++i)
  464. smartlist_add_asprintf(chunks, "%d,", i);
  465. smartlist_add(chunks, tor_strdup("20000"));
  466. policy_strng = smartlist_join_strings(chunks, "", 0, NULL);
  467. SMARTLIST_FOREACH(chunks, char *, ch, tor_free(ch));
  468. smartlist_free(chunks);
  469. short_parsed = parse_short_policy(policy_strng);/* shouldn't be accepted */
  470. tor_free(policy_strng);
  471. tt_ptr_op(NULL, OP_EQ, short_parsed);
  472. }
  473. /* truncation ports */
  474. sm = smartlist_new();
  475. for (i=1; i<2000; i+=2) {
  476. char buf[POLICY_BUF_LEN];
  477. tor_snprintf(buf, sizeof(buf), "reject *:%d", i);
  478. smartlist_add(sm, tor_strdup(buf));
  479. }
  480. smartlist_add(sm, tor_strdup("accept *:*"));
  481. policy_str = smartlist_join_strings(sm, ",", 0, NULL);
  482. test_policy_summary_helper( policy_str,
  483. "accept 2,4,6,8,10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40,42,44,"
  484. "46,48,50,52,54,56,58,60,62,64,66,68,70,72,74,76,78,80,82,84,86,88,90,"
  485. "92,94,96,98,100,102,104,106,108,110,112,114,116,118,120,122,124,126,128,"
  486. "130,132,134,136,138,140,142,144,146,148,150,152,154,156,158,160,162,164,"
  487. "166,168,170,172,174,176,178,180,182,184,186,188,190,192,194,196,198,200,"
  488. "202,204,206,208,210,212,214,216,218,220,222,224,226,228,230,232,234,236,"
  489. "238,240,242,244,246,248,250,252,254,256,258,260,262,264,266,268,270,272,"
  490. "274,276,278,280,282,284,286,288,290,292,294,296,298,300,302,304,306,308,"
  491. "310,312,314,316,318,320,322,324,326,328,330,332,334,336,338,340,342,344,"
  492. "346,348,350,352,354,356,358,360,362,364,366,368,370,372,374,376,378,380,"
  493. "382,384,386,388,390,392,394,396,398,400,402,404,406,408,410,412,414,416,"
  494. "418,420,422,424,426,428,430,432,434,436,438,440,442,444,446,448,450,452,"
  495. "454,456,458,460,462,464,466,468,470,472,474,476,478,480,482,484,486,488,"
  496. "490,492,494,496,498,500,502,504,506,508,510,512,514,516,518,520,522");
  497. done:
  498. addr_policy_list_free(policy);
  499. addr_policy_list_free(policy2);
  500. addr_policy_list_free(policy3);
  501. addr_policy_list_free(policy4);
  502. addr_policy_list_free(policy5);
  503. addr_policy_list_free(policy6);
  504. addr_policy_list_free(policy7);
  505. addr_policy_list_free(policy8);
  506. addr_policy_list_free(policy9);
  507. addr_policy_list_free(policy10);
  508. addr_policy_list_free(policy11);
  509. addr_policy_list_free(policy12);
  510. tor_free(policy_str);
  511. if (sm) {
  512. SMARTLIST_FOREACH(sm, char *, s, tor_free(s));
  513. smartlist_free(sm);
  514. }
  515. short_policy_free(short_parsed);
  516. }
  517. /** Helper: Check that policy_list contains address */
  518. static int
  519. test_policy_has_address_helper(const smartlist_t *policy_list,
  520. const tor_addr_t *addr)
  521. {
  522. int found = 0;
  523. tt_assert(policy_list);
  524. tt_assert(addr);
  525. SMARTLIST_FOREACH_BEGIN(policy_list, addr_policy_t*, p) {
  526. if (tor_addr_eq(&p->addr, addr)) {
  527. found = 1;
  528. }
  529. } SMARTLIST_FOREACH_END(p);
  530. return found;
  531. done:
  532. return 0;
  533. }
  534. #define TEST_IPV4_ADDR (0x01020304)
  535. #define TEST_IPV6_ADDR ("2002::abcd")
  536. /** Run unit tests for rejecting the configured addresses on this exit relay
  537. * using policies_parse_exit_policy_reject_private */
  538. static void
  539. test_policies_reject_exit_address(void *arg)
  540. {
  541. smartlist_t *policy = NULL;
  542. tor_addr_t ipv4_addr, ipv6_addr;
  543. smartlist_t *ipv4_list, *ipv6_list, *both_list, *dupl_list;
  544. (void)arg;
  545. tor_addr_from_ipv4h(&ipv4_addr, TEST_IPV4_ADDR);
  546. tor_addr_parse(&ipv6_addr, TEST_IPV6_ADDR);
  547. ipv4_list = smartlist_new();
  548. ipv6_list = smartlist_new();
  549. both_list = smartlist_new();
  550. dupl_list = smartlist_new();
  551. smartlist_add(ipv4_list, &ipv4_addr);
  552. smartlist_add(both_list, &ipv4_addr);
  553. smartlist_add(dupl_list, &ipv4_addr);
  554. smartlist_add(dupl_list, &ipv4_addr);
  555. smartlist_add(dupl_list, &ipv4_addr);
  556. smartlist_add(ipv6_list, &ipv6_addr);
  557. smartlist_add(both_list, &ipv6_addr);
  558. smartlist_add(dupl_list, &ipv6_addr);
  559. smartlist_add(dupl_list, &ipv6_addr);
  560. /* IPv4-Only Exits */
  561. /* test that IPv4 addresses are rejected on an IPv4-only exit */
  562. policies_parse_exit_policy_reject_private(&policy, 0, ipv4_list, 0, 0);
  563. tt_assert(policy);
  564. tt_assert(smartlist_len(policy) == 1);
  565. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  566. addr_policy_list_free(policy);
  567. policy = NULL;
  568. /* test that IPv6 addresses are NOT rejected on an IPv4-only exit
  569. * (all IPv6 addresses are rejected by policies_parse_exit_policy_internal
  570. * on IPv4-only exits, so policies_parse_exit_policy_reject_private doesn't
  571. * need to do anything) */
  572. policies_parse_exit_policy_reject_private(&policy, 0, ipv6_list, 0, 0);
  573. tt_assert(policy == NULL);
  574. /* test that only IPv4 addresses are rejected on an IPv4-only exit */
  575. policies_parse_exit_policy_reject_private(&policy, 0, both_list, 0, 0);
  576. tt_assert(policy);
  577. tt_assert(smartlist_len(policy) == 1);
  578. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  579. addr_policy_list_free(policy);
  580. policy = NULL;
  581. /* Test that lists with duplicate entries produce the same results */
  582. policies_parse_exit_policy_reject_private(&policy, 0, dupl_list, 0, 0);
  583. tt_assert(policy);
  584. tt_assert(smartlist_len(policy) == 1);
  585. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  586. addr_policy_list_free(policy);
  587. policy = NULL;
  588. /* IPv4/IPv6 Exits */
  589. /* test that IPv4 addresses are rejected on an IPv4/IPv6 exit */
  590. policies_parse_exit_policy_reject_private(&policy, 1, ipv4_list, 0, 0);
  591. tt_assert(policy);
  592. tt_assert(smartlist_len(policy) == 1);
  593. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  594. addr_policy_list_free(policy);
  595. policy = NULL;
  596. /* test that IPv6 addresses are rejected on an IPv4/IPv6 exit */
  597. policies_parse_exit_policy_reject_private(&policy, 1, ipv6_list, 0, 0);
  598. tt_assert(policy);
  599. tt_assert(smartlist_len(policy) == 1);
  600. tt_assert(test_policy_has_address_helper(policy, &ipv6_addr));
  601. addr_policy_list_free(policy);
  602. policy = NULL;
  603. /* test that IPv4 and IPv6 addresses are rejected on an IPv4/IPv6 exit */
  604. policies_parse_exit_policy_reject_private(&policy, 1, both_list, 0, 0);
  605. tt_assert(policy);
  606. tt_assert(smartlist_len(policy) == 2);
  607. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  608. tt_assert(test_policy_has_address_helper(policy, &ipv6_addr));
  609. addr_policy_list_free(policy);
  610. policy = NULL;
  611. /* Test that lists with duplicate entries produce the same results */
  612. policies_parse_exit_policy_reject_private(&policy, 1, dupl_list, 0, 0);
  613. tt_assert(policy);
  614. tt_assert(smartlist_len(policy) == 2);
  615. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  616. tt_assert(test_policy_has_address_helper(policy, &ipv6_addr));
  617. addr_policy_list_free(policy);
  618. policy = NULL;
  619. done:
  620. addr_policy_list_free(policy);
  621. smartlist_free(ipv4_list);
  622. smartlist_free(ipv6_list);
  623. smartlist_free(both_list);
  624. smartlist_free(dupl_list);
  625. }
  626. static smartlist_t *test_configured_ports = NULL;
  627. /** Returns test_configured_ports */
  628. static const smartlist_t *
  629. mock_get_configured_ports(void)
  630. {
  631. return test_configured_ports;
  632. }
  633. /** Run unit tests for rejecting publicly routable configured port addresses
  634. * on this exit relay using policies_parse_exit_policy_reject_private */
  635. static void
  636. test_policies_reject_port_address(void *arg)
  637. {
  638. smartlist_t *policy = NULL;
  639. port_cfg_t *ipv4_port = NULL;
  640. port_cfg_t *ipv6_port = NULL;
  641. (void)arg;
  642. test_configured_ports = smartlist_new();
  643. ipv4_port = port_cfg_new(0);
  644. tor_addr_from_ipv4h(&ipv4_port->addr, TEST_IPV4_ADDR);
  645. smartlist_add(test_configured_ports, ipv4_port);
  646. ipv6_port = port_cfg_new(0);
  647. tor_addr_parse(&ipv6_port->addr, TEST_IPV6_ADDR);
  648. smartlist_add(test_configured_ports, ipv6_port);
  649. MOCK(get_configured_ports, mock_get_configured_ports);
  650. /* test that an IPv4 port is rejected on an IPv4-only exit, but an IPv6 port
  651. * is NOT rejected (all IPv6 addresses are rejected by
  652. * policies_parse_exit_policy_internal on IPv4-only exits, so
  653. * policies_parse_exit_policy_reject_private doesn't need to do anything
  654. * with IPv6 addresses on IPv4-only exits) */
  655. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 0, 1);
  656. tt_assert(policy);
  657. tt_assert(smartlist_len(policy) == 1);
  658. tt_assert(test_policy_has_address_helper(policy, &ipv4_port->addr));
  659. addr_policy_list_free(policy);
  660. policy = NULL;
  661. /* test that IPv4 and IPv6 ports are rejected on an IPv4/IPv6 exit */
  662. policies_parse_exit_policy_reject_private(&policy, 1, NULL, 0, 1);
  663. tt_assert(policy);
  664. tt_assert(smartlist_len(policy) == 2);
  665. tt_assert(test_policy_has_address_helper(policy, &ipv4_port->addr));
  666. tt_assert(test_policy_has_address_helper(policy, &ipv6_port->addr));
  667. addr_policy_list_free(policy);
  668. policy = NULL;
  669. done:
  670. addr_policy_list_free(policy);
  671. if (test_configured_ports) {
  672. SMARTLIST_FOREACH(test_configured_ports,
  673. port_cfg_t *, p, port_cfg_free(p));
  674. smartlist_free(test_configured_ports);
  675. test_configured_ports = NULL;
  676. }
  677. UNMOCK(get_configured_ports);
  678. }
  679. static smartlist_t *mock_ipv4_addrs = NULL;
  680. static smartlist_t *mock_ipv6_addrs = NULL;
  681. /* mock get_interface_address6_list, returning a deep copy of the template
  682. * address list ipv4_interface_address_list or ipv6_interface_address_list */
  683. static smartlist_t *
  684. mock_get_interface_address6_list(int severity,
  685. sa_family_t family,
  686. int include_internal)
  687. {
  688. (void)severity;
  689. (void)include_internal;
  690. smartlist_t *clone_list = smartlist_new();
  691. smartlist_t *template_list = NULL;
  692. if (family == AF_INET) {
  693. template_list = mock_ipv4_addrs;
  694. } else if (family == AF_INET6) {
  695. template_list = mock_ipv6_addrs;
  696. } else {
  697. return NULL;
  698. }
  699. tt_assert(template_list);
  700. SMARTLIST_FOREACH_BEGIN(template_list, tor_addr_t *, src_addr) {
  701. tor_addr_t *dest_addr = tor_malloc(sizeof(tor_addr_t));
  702. memset(dest_addr, 0, sizeof(*dest_addr));
  703. tor_addr_copy_tight(dest_addr, src_addr);
  704. smartlist_add(clone_list, dest_addr);
  705. } SMARTLIST_FOREACH_END(src_addr);
  706. return clone_list;
  707. done:
  708. free_interface_address6_list(clone_list);
  709. return NULL;
  710. }
  711. /** Run unit tests for rejecting publicly routable interface addresses on this
  712. * exit relay using policies_parse_exit_policy_reject_private */
  713. static void
  714. test_policies_reject_interface_address(void *arg)
  715. {
  716. smartlist_t *policy = NULL;
  717. smartlist_t *public_ipv4_addrs =
  718. get_interface_address6_list(LOG_INFO, AF_INET, 0);
  719. smartlist_t *public_ipv6_addrs =
  720. get_interface_address6_list(LOG_INFO, AF_INET6, 0);
  721. tor_addr_t ipv4_addr, ipv6_addr;
  722. (void)arg;
  723. /* test that no addresses are rejected when none are supplied/requested */
  724. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 0, 0);
  725. tt_assert(policy == NULL);
  726. /* test that only IPv4 interface addresses are rejected on an IPv4-only exit
  727. * (and allow for duplicates)
  728. */
  729. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 1, 0);
  730. if (policy) {
  731. tt_assert(smartlist_len(policy) <= smartlist_len(public_ipv4_addrs));
  732. addr_policy_list_free(policy);
  733. policy = NULL;
  734. }
  735. /* test that IPv4 and IPv6 interface addresses are rejected on an IPv4/IPv6
  736. * exit (and allow for duplicates) */
  737. policies_parse_exit_policy_reject_private(&policy, 1, NULL, 1, 0);
  738. if (policy) {
  739. tt_assert(smartlist_len(policy) <= (smartlist_len(public_ipv4_addrs)
  740. + smartlist_len(public_ipv6_addrs)));
  741. addr_policy_list_free(policy);
  742. policy = NULL;
  743. }
  744. /* Now do it all again, but mocked */
  745. tor_addr_from_ipv4h(&ipv4_addr, TEST_IPV4_ADDR);
  746. mock_ipv4_addrs = smartlist_new();
  747. smartlist_add(mock_ipv4_addrs, (void *)&ipv4_addr);
  748. tor_addr_parse(&ipv6_addr, TEST_IPV6_ADDR);
  749. mock_ipv6_addrs = smartlist_new();
  750. smartlist_add(mock_ipv6_addrs, (void *)&ipv6_addr);
  751. MOCK(get_interface_address6_list, mock_get_interface_address6_list);
  752. /* test that no addresses are rejected when none are supplied/requested */
  753. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 0, 0);
  754. tt_assert(policy == NULL);
  755. /* test that only IPv4 interface addresses are rejected on an IPv4-only exit
  756. */
  757. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 1, 0);
  758. tt_assert(policy);
  759. tt_assert(smartlist_len(policy) == smartlist_len(mock_ipv4_addrs));
  760. addr_policy_list_free(policy);
  761. policy = NULL;
  762. /* test that IPv4 and IPv6 interface addresses are rejected on an IPv4/IPv6
  763. * exit */
  764. policies_parse_exit_policy_reject_private(&policy, 1, NULL, 1, 0);
  765. tt_assert(policy);
  766. tt_assert(smartlist_len(policy) == (smartlist_len(mock_ipv4_addrs)
  767. + smartlist_len(mock_ipv6_addrs)));
  768. addr_policy_list_free(policy);
  769. policy = NULL;
  770. done:
  771. addr_policy_list_free(policy);
  772. free_interface_address6_list(public_ipv4_addrs);
  773. free_interface_address6_list(public_ipv6_addrs);
  774. UNMOCK(get_interface_address6_list);
  775. /* we don't use free_interface_address6_list on these lists because their
  776. * address pointers are stack-based */
  777. smartlist_free(mock_ipv4_addrs);
  778. smartlist_free(mock_ipv6_addrs);
  779. }
  780. #undef TEST_IPV4_ADDR
  781. #undef TEST_IPV6_ADDR
  782. static void
  783. test_dump_exit_policy_to_string(void *arg)
  784. {
  785. char *ep;
  786. addr_policy_t *policy_entry;
  787. int malformed_list = -1;
  788. routerinfo_t *ri = tor_malloc_zero(sizeof(routerinfo_t));
  789. (void)arg;
  790. ri->policy_is_reject_star = 1;
  791. ri->exit_policy = NULL; // expecting "reject *:*"
  792. ep = router_dump_exit_policy_to_string(ri,1,1);
  793. tt_str_op("reject *:*",OP_EQ, ep);
  794. tor_free(ep);
  795. ri->exit_policy = smartlist_new();
  796. ri->policy_is_reject_star = 0;
  797. policy_entry = router_parse_addr_policy_item_from_string("accept *:*", -1,
  798. &malformed_list);
  799. smartlist_add(ri->exit_policy,policy_entry);
  800. ep = router_dump_exit_policy_to_string(ri,1,1);
  801. tt_str_op("accept *:*",OP_EQ, ep);
  802. tor_free(ep);
  803. policy_entry = router_parse_addr_policy_item_from_string("reject *:25", -1,
  804. &malformed_list);
  805. smartlist_add(ri->exit_policy,policy_entry);
  806. ep = router_dump_exit_policy_to_string(ri,1,1);
  807. tt_str_op("accept *:*\nreject *:25",OP_EQ, ep);
  808. tor_free(ep);
  809. policy_entry =
  810. router_parse_addr_policy_item_from_string("reject 8.8.8.8:*", -1,
  811. &malformed_list);
  812. smartlist_add(ri->exit_policy,policy_entry);
  813. ep = router_dump_exit_policy_to_string(ri,1,1);
  814. tt_str_op("accept *:*\nreject *:25\nreject 8.8.8.8:*",OP_EQ, ep);
  815. tor_free(ep);
  816. policy_entry =
  817. router_parse_addr_policy_item_from_string("reject6 [FC00::]/7:*", -1,
  818. &malformed_list);
  819. smartlist_add(ri->exit_policy,policy_entry);
  820. ep = router_dump_exit_policy_to_string(ri,1,1);
  821. tt_str_op("accept *:*\nreject *:25\nreject 8.8.8.8:*\n"
  822. "reject6 [fc00::]/7:*",OP_EQ, ep);
  823. tor_free(ep);
  824. policy_entry =
  825. router_parse_addr_policy_item_from_string("accept6 [c000::]/3:*", -1,
  826. &malformed_list);
  827. smartlist_add(ri->exit_policy,policy_entry);
  828. ep = router_dump_exit_policy_to_string(ri,1,1);
  829. tt_str_op("accept *:*\nreject *:25\nreject 8.8.8.8:*\n"
  830. "reject6 [fc00::]/7:*\naccept6 [c000::]/3:*",OP_EQ, ep);
  831. done:
  832. if (ri->exit_policy) {
  833. SMARTLIST_FOREACH(ri->exit_policy, addr_policy_t *,
  834. entry, addr_policy_free(entry));
  835. smartlist_free(ri->exit_policy);
  836. }
  837. tor_free(ri);
  838. tor_free(ep);
  839. }
  840. static routerinfo_t *mock_desc_routerinfo = NULL;
  841. static const routerinfo_t *
  842. mock_router_get_my_routerinfo(void)
  843. {
  844. return mock_desc_routerinfo;
  845. }
  846. #define DEFAULT_POLICY_STRING "reject *:*"
  847. #define TEST_IPV4_ADDR (0x02040608)
  848. #define TEST_IPV6_ADDR ("2003::ef01")
  849. static or_options_t mock_options;
  850. static const or_options_t *
  851. mock_get_options(void)
  852. {
  853. return &mock_options;
  854. }
  855. /** Run unit tests for generating summary lines of exit policies */
  856. static void
  857. test_policies_getinfo_helper_policies(void *arg)
  858. {
  859. (void)arg;
  860. int rv = 0;
  861. size_t ipv4_len = 0, ipv6_len = 0;
  862. char *answer = NULL;
  863. const char *errmsg = NULL;
  864. routerinfo_t mock_my_routerinfo;
  865. memset(&mock_my_routerinfo, 0, sizeof(mock_my_routerinfo));
  866. rv = getinfo_helper_policies(NULL, "exit-policy/default", &answer, &errmsg);
  867. tt_assert(rv == 0);
  868. tt_assert(answer != NULL);
  869. tt_assert(strlen(answer) > 0);
  870. tor_free(answer);
  871. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/default",
  872. &answer, &errmsg);
  873. tt_assert(rv == 0);
  874. tt_assert(answer != NULL);
  875. tt_assert(strlen(answer) > 0);
  876. tor_free(answer);
  877. memset(&mock_my_routerinfo, 0, sizeof(routerinfo_t));
  878. MOCK(router_get_my_routerinfo, mock_router_get_my_routerinfo);
  879. mock_my_routerinfo.exit_policy = smartlist_new();
  880. mock_desc_routerinfo = &mock_my_routerinfo;
  881. memset(&mock_options, 0, sizeof(or_options_t));
  882. MOCK(get_options, mock_get_options);
  883. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  884. &answer, &errmsg);
  885. tt_assert(rv == 0);
  886. tt_assert(answer != NULL);
  887. tt_assert(strlen(answer) == 0);
  888. tor_free(answer);
  889. rv = getinfo_helper_policies(NULL, "exit-policy/ipv4", &answer,
  890. &errmsg);
  891. tt_assert(rv == 0);
  892. tt_assert(answer != NULL);
  893. ipv4_len = strlen(answer);
  894. tt_assert(ipv4_len == 0 || ipv4_len == strlen(DEFAULT_POLICY_STRING));
  895. tt_assert(ipv4_len == 0 || !strcasecmp(answer, DEFAULT_POLICY_STRING));
  896. tor_free(answer);
  897. rv = getinfo_helper_policies(NULL, "exit-policy/ipv6", &answer,
  898. &errmsg);
  899. tt_assert(rv == 0);
  900. tt_assert(answer != NULL);
  901. ipv6_len = strlen(answer);
  902. tt_assert(ipv6_len == 0 || ipv6_len == strlen(DEFAULT_POLICY_STRING));
  903. tt_assert(ipv6_len == 0 || !strcasecmp(answer, DEFAULT_POLICY_STRING));
  904. tor_free(answer);
  905. rv = getinfo_helper_policies(NULL, "exit-policy/full", &answer,
  906. &errmsg);
  907. tt_assert(rv == 0);
  908. tt_assert(answer != NULL);
  909. /* It's either empty or it's the default */
  910. tt_assert(strlen(answer) == 0 || !strcasecmp(answer, DEFAULT_POLICY_STRING));
  911. tor_free(answer);
  912. mock_my_routerinfo.addr = TEST_IPV4_ADDR;
  913. tor_addr_parse(&mock_my_routerinfo.ipv6_addr, TEST_IPV6_ADDR);
  914. append_exit_policy_string(&mock_my_routerinfo.exit_policy, "accept *4:*");
  915. append_exit_policy_string(&mock_my_routerinfo.exit_policy, "reject *6:*");
  916. mock_options.IPv6Exit = 1;
  917. tor_addr_from_ipv4h(&mock_options.OutboundBindAddressIPv4_, TEST_IPV4_ADDR);
  918. tor_addr_parse(&mock_options.OutboundBindAddressIPv6_, TEST_IPV6_ADDR);
  919. mock_options.ExitPolicyRejectPrivate = 1;
  920. mock_options.ExitPolicyRejectLocalInterfaces = 1;
  921. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  922. &answer, &errmsg);
  923. tt_assert(rv == 0);
  924. tt_assert(answer != NULL);
  925. tt_assert(strlen(answer) > 0);
  926. tor_free(answer);
  927. mock_options.ExitPolicyRejectPrivate = 1;
  928. mock_options.ExitPolicyRejectLocalInterfaces = 0;
  929. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  930. &answer, &errmsg);
  931. tt_assert(rv == 0);
  932. tt_assert(answer != NULL);
  933. tt_assert(strlen(answer) > 0);
  934. tor_free(answer);
  935. mock_options.ExitPolicyRejectPrivate = 0;
  936. mock_options.ExitPolicyRejectLocalInterfaces = 1;
  937. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  938. &answer, &errmsg);
  939. tt_assert(rv == 0);
  940. tt_assert(answer != NULL);
  941. tt_assert(strlen(answer) > 0);
  942. tor_free(answer);
  943. mock_options.ExitPolicyRejectPrivate = 0;
  944. mock_options.ExitPolicyRejectLocalInterfaces = 0;
  945. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  946. &answer, &errmsg);
  947. tt_assert(rv == 0);
  948. tt_assert(answer != NULL);
  949. tt_assert(strlen(answer) == 0);
  950. tor_free(answer);
  951. rv = getinfo_helper_policies(NULL, "exit-policy/ipv4", &answer,
  952. &errmsg);
  953. tt_assert(rv == 0);
  954. tt_assert(answer != NULL);
  955. ipv4_len = strlen(answer);
  956. tt_assert(ipv4_len > 0);
  957. tor_free(answer);
  958. rv = getinfo_helper_policies(NULL, "exit-policy/ipv6", &answer,
  959. &errmsg);
  960. tt_assert(rv == 0);
  961. tt_assert(answer != NULL);
  962. ipv6_len = strlen(answer);
  963. tt_assert(ipv6_len > 0);
  964. tor_free(answer);
  965. rv = getinfo_helper_policies(NULL, "exit-policy/full", &answer,
  966. &errmsg);
  967. tt_assert(rv == 0);
  968. tt_assert(answer != NULL);
  969. tt_assert(strlen(answer) > 0);
  970. tt_assert(strlen(answer) == ipv4_len + ipv6_len + 1);
  971. tor_free(answer);
  972. done:
  973. tor_free(answer);
  974. UNMOCK(get_options);
  975. UNMOCK(router_get_my_routerinfo);
  976. addr_policy_list_free(mock_my_routerinfo.exit_policy);
  977. }
  978. #undef DEFAULT_POLICY_STRING
  979. #undef TEST_IPV4_ADDR
  980. #undef TEST_IPV6_ADDR
  981. #define TEST_IPV4_ADDR_STR "1.2.3.4"
  982. #define TEST_IPV6_ADDR_STR "[1002::4567]"
  983. #define REJECT_IPv4_FINAL_STR "reject 0.0.0.0/0:*"
  984. #define REJECT_IPv6_FINAL_STR "reject [::]/0:*"
  985. #define OTHER_IPV4_ADDR_STR "6.7.8.9"
  986. #define OTHER_IPV6_ADDR_STR "[afff::]"
  987. /** Run unit tests for fascist_firewall_allows_address */
  988. static void
  989. test_policies_fascist_firewall_allows_address(void *arg)
  990. {
  991. (void)arg;
  992. tor_addr_t ipv4_addr, ipv6_addr, r_ipv4_addr, r_ipv6_addr;
  993. tor_addr_t n_ipv4_addr, n_ipv6_addr;
  994. const uint16_t port = 1234;
  995. smartlist_t *policy = NULL;
  996. smartlist_t *e_policy = NULL;
  997. addr_policy_t *item = NULL;
  998. int malformed_list = 0;
  999. /* Setup the options and the items in the policies */
  1000. memset(&mock_options, 0, sizeof(or_options_t));
  1001. MOCK(get_options, mock_get_options);
  1002. policy = smartlist_new();
  1003. item = router_parse_addr_policy_item_from_string("accept "
  1004. TEST_IPV4_ADDR_STR ":*",
  1005. ADDR_POLICY_ACCEPT,
  1006. &malformed_list);
  1007. tt_assert(item);
  1008. tt_assert(!malformed_list);
  1009. smartlist_add(policy, item);
  1010. item = router_parse_addr_policy_item_from_string("accept "
  1011. TEST_IPV6_ADDR_STR,
  1012. ADDR_POLICY_ACCEPT,
  1013. &malformed_list);
  1014. tt_assert(item);
  1015. tt_assert(!malformed_list);
  1016. smartlist_add(policy, item);
  1017. /* Normally, policy_expand_unspec would do this for us */
  1018. item = router_parse_addr_policy_item_from_string(REJECT_IPv4_FINAL_STR,
  1019. ADDR_POLICY_ACCEPT,
  1020. &malformed_list);
  1021. tt_assert(item);
  1022. tt_assert(!malformed_list);
  1023. smartlist_add(policy, item);
  1024. item = router_parse_addr_policy_item_from_string(REJECT_IPv6_FINAL_STR,
  1025. ADDR_POLICY_ACCEPT,
  1026. &malformed_list);
  1027. tt_assert(item);
  1028. tt_assert(!malformed_list);
  1029. smartlist_add(policy, item);
  1030. item = NULL;
  1031. e_policy = smartlist_new();
  1032. /*
  1033. char *polstr = policy_dump_to_string(policy, 1, 1);
  1034. printf("%s\n", polstr);
  1035. tor_free(polstr);
  1036. */
  1037. /* Parse the addresses */
  1038. tor_addr_parse(&ipv4_addr, TEST_IPV4_ADDR_STR);
  1039. tor_addr_parse(&ipv6_addr, TEST_IPV6_ADDR_STR);
  1040. tor_addr_parse(&r_ipv4_addr, OTHER_IPV4_ADDR_STR);
  1041. tor_addr_parse(&r_ipv6_addr, OTHER_IPV6_ADDR_STR);
  1042. tor_addr_make_null(&n_ipv4_addr, AF_INET);
  1043. tor_addr_make_null(&n_ipv6_addr, AF_INET6);
  1044. /* Test the function's address matching with IPv4 and IPv6 on */
  1045. memset(&mock_options, 0, sizeof(or_options_t));
  1046. mock_options.ClientUseIPv4 = 1;
  1047. mock_options.ClientUseIPv6 = 1;
  1048. mock_options.UseBridges = 0;
  1049. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0)
  1050. == 1);
  1051. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0)
  1052. == 1);
  1053. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0)
  1054. == 0);
  1055. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0)
  1056. == 0);
  1057. /* Preferring IPv4 */
  1058. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 1, 0)
  1059. == 1);
  1060. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 1, 0)
  1061. == 0);
  1062. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 1, 0)
  1063. == 0);
  1064. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 1, 0)
  1065. == 0);
  1066. /* Preferring IPv6 */
  1067. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 1, 1)
  1068. == 0);
  1069. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 1, 1)
  1070. == 1);
  1071. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 1, 1)
  1072. == 0);
  1073. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 1, 1)
  1074. == 0);
  1075. /* Test the function's address matching with UseBridges on */
  1076. memset(&mock_options, 0, sizeof(or_options_t));
  1077. mock_options.ClientUseIPv4 = 1;
  1078. mock_options.ClientUseIPv6 = 1;
  1079. mock_options.UseBridges = 1;
  1080. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0)
  1081. == 1);
  1082. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0)
  1083. == 1);
  1084. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0)
  1085. == 0);
  1086. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0)
  1087. == 0);
  1088. /* Preferring IPv4 */
  1089. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 1, 0)
  1090. == 1);
  1091. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 1, 0)
  1092. == 0);
  1093. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 1, 0)
  1094. == 0);
  1095. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 1, 0)
  1096. == 0);
  1097. /* Preferring IPv6 */
  1098. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 1, 1)
  1099. == 0);
  1100. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 1, 1)
  1101. == 1);
  1102. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 1, 1)
  1103. == 0);
  1104. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 1, 1)
  1105. == 0);
  1106. /* bridge clients always use IPv6, regardless of ClientUseIPv6 */
  1107. mock_options.ClientUseIPv4 = 1;
  1108. mock_options.ClientUseIPv6 = 0;
  1109. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0)
  1110. == 1);
  1111. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0)
  1112. == 1);
  1113. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0)
  1114. == 0);
  1115. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0)
  1116. == 0);
  1117. /* Test the function's address matching with IPv4 on */
  1118. memset(&mock_options, 0, sizeof(or_options_t));
  1119. mock_options.ClientUseIPv4 = 1;
  1120. mock_options.ClientUseIPv6 = 0;
  1121. mock_options.UseBridges = 0;
  1122. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0)
  1123. == 1);
  1124. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0)
  1125. == 0);
  1126. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0)
  1127. == 0);
  1128. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0)
  1129. == 0);
  1130. /* Test the function's address matching with IPv6 on */
  1131. memset(&mock_options, 0, sizeof(or_options_t));
  1132. mock_options.ClientUseIPv4 = 0;
  1133. mock_options.ClientUseIPv6 = 1;
  1134. mock_options.UseBridges = 0;
  1135. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0)
  1136. == 0);
  1137. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0)
  1138. == 1);
  1139. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0)
  1140. == 0);
  1141. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0)
  1142. == 0);
  1143. /* Test the function's address matching with ClientUseIPv4 0.
  1144. * This means "use IPv6" regardless of the other settings. */
  1145. memset(&mock_options, 0, sizeof(or_options_t));
  1146. mock_options.ClientUseIPv4 = 0;
  1147. mock_options.ClientUseIPv6 = 0;
  1148. mock_options.UseBridges = 0;
  1149. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0)
  1150. == 0);
  1151. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0)
  1152. == 1);
  1153. tt_assert(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0)
  1154. == 0);
  1155. tt_assert(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0)
  1156. == 0);
  1157. /* Test the function's address matching for unusual inputs */
  1158. memset(&mock_options, 0, sizeof(or_options_t));
  1159. mock_options.ClientUseIPv4 = 1;
  1160. mock_options.ClientUseIPv6 = 1;
  1161. mock_options.UseBridges = 1;
  1162. /* NULL and tor_addr_is_null addresses are rejected */
  1163. tt_assert(fascist_firewall_allows_address(NULL, port, policy, 0, 0) == 0);
  1164. tt_assert(fascist_firewall_allows_address(&n_ipv4_addr, port, policy, 0, 0)
  1165. == 0);
  1166. tt_assert(fascist_firewall_allows_address(&n_ipv6_addr, port, policy, 0, 0)
  1167. == 0);
  1168. /* zero ports are rejected */
  1169. tt_assert(fascist_firewall_allows_address(&ipv4_addr, 0, policy, 0, 0)
  1170. == 0);
  1171. tt_assert(fascist_firewall_allows_address(&ipv6_addr, 0, policy, 0, 0)
  1172. == 0);
  1173. /* NULL and empty policies accept everything */
  1174. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, NULL, 0, 0)
  1175. == 1);
  1176. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, NULL, 0, 0)
  1177. == 1);
  1178. tt_assert(fascist_firewall_allows_address(&ipv4_addr, port, e_policy, 0, 0)
  1179. == 1);
  1180. tt_assert(fascist_firewall_allows_address(&ipv6_addr, port, e_policy, 0, 0)
  1181. == 1);
  1182. done:
  1183. addr_policy_free(item);
  1184. addr_policy_list_free(policy);
  1185. addr_policy_list_free(e_policy);
  1186. UNMOCK(get_options);
  1187. }
  1188. #undef REJECT_IPv4_FINAL_STR
  1189. #undef REJECT_IPv6_FINAL_STR
  1190. #undef OTHER_IPV4_ADDR_STR
  1191. #undef OTHER_IPV6_ADDR_STR
  1192. #define TEST_IPV4_OR_PORT 1234
  1193. #define TEST_IPV4_DIR_PORT 2345
  1194. #define TEST_IPV6_OR_PORT 61234
  1195. #define TEST_IPV6_DIR_PORT 62345
  1196. /* Check that fascist_firewall_choose_address_rs() returns the expected
  1197. * results. */
  1198. #define CHECK_CHOSEN_ADDR_RS(fake_rs, fw_connection, pref_only, expect_rv, \
  1199. expect_ap) \
  1200. STMT_BEGIN \
  1201. tor_addr_port_t chosen_rs_ap; \
  1202. tor_addr_make_null(&chosen_rs_ap.addr, AF_INET); \
  1203. chosen_rs_ap.port = 0; \
  1204. tt_int_op(fascist_firewall_choose_address_rs(&(fake_rs), \
  1205. (fw_connection), \
  1206. (pref_only), \
  1207. &chosen_rs_ap), \
  1208. OP_EQ, (expect_rv)); \
  1209. tt_assert(tor_addr_eq(&(expect_ap).addr, &chosen_rs_ap.addr)); \
  1210. tt_int_op((expect_ap).port, OP_EQ, chosen_rs_ap.port); \
  1211. STMT_END
  1212. /* Check that fascist_firewall_choose_address_node() returns the expected
  1213. * results. */
  1214. #define CHECK_CHOSEN_ADDR_NODE(fake_node, fw_connection, pref_only, \
  1215. expect_rv, expect_ap) \
  1216. STMT_BEGIN \
  1217. tor_addr_port_t chosen_node_ap; \
  1218. tor_addr_make_null(&chosen_node_ap.addr, AF_INET); \
  1219. chosen_node_ap.port = 0; \
  1220. tt_int_op(fascist_firewall_choose_address_node(&(fake_node), \
  1221. (fw_connection), \
  1222. (pref_only), \
  1223. &chosen_node_ap), \
  1224. OP_EQ, (expect_rv)); \
  1225. tt_assert(tor_addr_eq(&(expect_ap).addr, &chosen_node_ap.addr)); \
  1226. tt_int_op((expect_ap).port, OP_EQ, chosen_node_ap.port); \
  1227. STMT_END
  1228. /* Check that fascist_firewall_choose_address_rs and
  1229. * fascist_firewall_choose_address_node() both return the expected results. */
  1230. #define CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, fw_connection, pref_only, \
  1231. expect_rv, expect_ap) \
  1232. STMT_BEGIN \
  1233. CHECK_CHOSEN_ADDR_RS(fake_rs, fw_connection, pref_only, expect_rv, \
  1234. expect_ap); \
  1235. CHECK_CHOSEN_ADDR_NODE(fake_node, fw_connection, pref_only, expect_rv, \
  1236. expect_ap); \
  1237. STMT_END
  1238. /** Run unit tests for fascist_firewall_choose_address */
  1239. static void
  1240. test_policies_fascist_firewall_choose_address(void *arg)
  1241. {
  1242. (void)arg;
  1243. tor_addr_port_t ipv4_or_ap, ipv4_dir_ap, ipv6_or_ap, ipv6_dir_ap;
  1244. tor_addr_port_t n_ipv4_ap, n_ipv6_ap;
  1245. /* Setup the options */
  1246. memset(&mock_options, 0, sizeof(or_options_t));
  1247. MOCK(get_options, mock_get_options);
  1248. /* Parse the addresses */
  1249. tor_addr_parse(&ipv4_or_ap.addr, TEST_IPV4_ADDR_STR);
  1250. ipv4_or_ap.port = TEST_IPV4_OR_PORT;
  1251. tor_addr_parse(&ipv4_dir_ap.addr, TEST_IPV4_ADDR_STR);
  1252. ipv4_dir_ap.port = TEST_IPV4_DIR_PORT;
  1253. tor_addr_parse(&ipv6_or_ap.addr, TEST_IPV6_ADDR_STR);
  1254. ipv6_or_ap.port = TEST_IPV6_OR_PORT;
  1255. tor_addr_parse(&ipv6_dir_ap.addr, TEST_IPV6_ADDR_STR);
  1256. ipv6_dir_ap.port = TEST_IPV6_DIR_PORT;
  1257. tor_addr_make_null(&n_ipv4_ap.addr, AF_INET);
  1258. n_ipv4_ap.port = 0;
  1259. tor_addr_make_null(&n_ipv6_ap.addr, AF_INET6);
  1260. n_ipv6_ap.port = 0;
  1261. /* Sanity check fascist_firewall_choose_address with IPv4 and IPv6 on */
  1262. memset(&mock_options, 0, sizeof(or_options_t));
  1263. mock_options.ClientUseIPv4 = 1;
  1264. mock_options.ClientUseIPv6 = 1;
  1265. mock_options.UseBridges = 0;
  1266. /* Prefer IPv4 */
  1267. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 1,
  1268. FIREWALL_OR_CONNECTION, 0, 0)
  1269. == &ipv4_or_ap);
  1270. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 1,
  1271. FIREWALL_OR_CONNECTION, 1, 0)
  1272. == &ipv4_or_ap);
  1273. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &ipv6_dir_ap, 1,
  1274. FIREWALL_DIR_CONNECTION, 0, 0)
  1275. == &ipv4_dir_ap);
  1276. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &ipv6_dir_ap, 1,
  1277. FIREWALL_DIR_CONNECTION, 1, 0)
  1278. == &ipv4_dir_ap);
  1279. /* Prefer IPv6 */
  1280. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 0,
  1281. FIREWALL_OR_CONNECTION, 0, 1)
  1282. == &ipv6_or_ap);
  1283. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 0,
  1284. FIREWALL_OR_CONNECTION, 1, 1)
  1285. == &ipv6_or_ap);
  1286. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &ipv6_dir_ap, 0,
  1287. FIREWALL_DIR_CONNECTION, 0, 1)
  1288. == &ipv6_dir_ap);
  1289. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &ipv6_dir_ap, 0,
  1290. FIREWALL_DIR_CONNECTION, 1, 1)
  1291. == &ipv6_dir_ap);
  1292. /* Unusual inputs */
  1293. /* null preferred OR addresses */
  1294. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &n_ipv6_ap, 0,
  1295. FIREWALL_OR_CONNECTION, 0, 1)
  1296. == &ipv4_or_ap);
  1297. tt_assert(fascist_firewall_choose_address(&n_ipv4_ap, &ipv6_or_ap, 1,
  1298. FIREWALL_OR_CONNECTION, 0, 0)
  1299. == &ipv6_or_ap);
  1300. /* null both OR addresses */
  1301. tt_assert(fascist_firewall_choose_address(&n_ipv4_ap, &n_ipv6_ap, 0,
  1302. FIREWALL_OR_CONNECTION, 0, 1)
  1303. == NULL);
  1304. tt_assert(fascist_firewall_choose_address(&n_ipv4_ap, &n_ipv6_ap, 1,
  1305. FIREWALL_OR_CONNECTION, 0, 0)
  1306. == NULL);
  1307. /* null preferred Dir addresses */
  1308. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &n_ipv6_ap, 0,
  1309. FIREWALL_DIR_CONNECTION, 0, 1)
  1310. == &ipv4_dir_ap);
  1311. tt_assert(fascist_firewall_choose_address(&n_ipv4_ap, &ipv6_dir_ap, 1,
  1312. FIREWALL_DIR_CONNECTION, 0, 0)
  1313. == &ipv6_dir_ap);
  1314. /* null both Dir addresses */
  1315. tt_assert(fascist_firewall_choose_address(&n_ipv4_ap, &n_ipv6_ap, 0,
  1316. FIREWALL_DIR_CONNECTION, 0, 1)
  1317. == NULL);
  1318. tt_assert(fascist_firewall_choose_address(&n_ipv4_ap, &n_ipv6_ap, 1,
  1319. FIREWALL_DIR_CONNECTION, 0, 0)
  1320. == NULL);
  1321. /* Prefer IPv4 but want IPv6 (contradictory) */
  1322. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 0,
  1323. FIREWALL_OR_CONNECTION, 0, 0)
  1324. == &ipv4_or_ap);
  1325. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 0,
  1326. FIREWALL_OR_CONNECTION, 1, 0)
  1327. == &ipv4_or_ap);
  1328. /* Prefer IPv6 but want IPv4 (contradictory) */
  1329. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 1,
  1330. FIREWALL_OR_CONNECTION, 0, 1)
  1331. == &ipv6_or_ap);
  1332. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 1,
  1333. FIREWALL_OR_CONNECTION, 1, 1)
  1334. == &ipv6_or_ap);
  1335. /* Make a fake rs. There will be no corresponding node.
  1336. * This is what happens when there's no consensus and we're bootstrapping
  1337. * from authorities / fallbacks. */
  1338. routerstatus_t fake_rs;
  1339. memset(&fake_rs, 0, sizeof(routerstatus_t));
  1340. /* In a routerstatus, the OR and Dir addresses are the same */
  1341. fake_rs.addr = tor_addr_to_ipv4h(&ipv4_or_ap.addr);
  1342. fake_rs.or_port = ipv4_or_ap.port;
  1343. fake_rs.dir_port = ipv4_dir_ap.port;
  1344. tor_addr_copy(&fake_rs.ipv6_addr, &ipv6_or_ap.addr);
  1345. fake_rs.ipv6_orport = ipv6_or_ap.port;
  1346. /* In a routerstatus, the IPv4 and IPv6 DirPorts are the same.*/
  1347. ipv6_dir_ap.port = TEST_IPV4_DIR_PORT;
  1348. /* Make a fake node. Even though it contains the fake_rs, a lookup won't
  1349. * find the node from the rs, because they're not in the hash table. */
  1350. node_t fake_node;
  1351. memset(&fake_node, 0, sizeof(node_t));
  1352. fake_node.rs = &fake_rs;
  1353. /* Choose an address with IPv4 and IPv6 on */
  1354. memset(&mock_options, 0, sizeof(or_options_t));
  1355. mock_options.ClientUseIPv4 = 1;
  1356. mock_options.ClientUseIPv6 = 1;
  1357. mock_options.UseBridges = 0;
  1358. /* Preferring IPv4 */
  1359. mock_options.ClientPreferIPv6ORPort = 0;
  1360. mock_options.ClientPreferIPv6DirPort = 0;
  1361. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1362. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1363. &mock_options);
  1364. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1365. ipv4_or_ap);
  1366. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1367. ipv4_or_ap);
  1368. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1369. ipv4_dir_ap);
  1370. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1371. ipv4_dir_ap);
  1372. /* Auto (Preferring IPv4) */
  1373. mock_options.ClientPreferIPv6ORPort = -1;
  1374. mock_options.ClientPreferIPv6DirPort = -1;
  1375. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1376. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1377. &mock_options);
  1378. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1379. ipv4_or_ap);
  1380. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1381. ipv4_or_ap);
  1382. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1383. ipv4_dir_ap);
  1384. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1385. ipv4_dir_ap);
  1386. /* Preferring IPv6 */
  1387. mock_options.ClientPreferIPv6ORPort = 1;
  1388. mock_options.ClientPreferIPv6DirPort = 1;
  1389. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1390. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1391. &mock_options);
  1392. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1393. ipv6_or_ap);
  1394. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1395. ipv6_or_ap);
  1396. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1397. ipv6_dir_ap);
  1398. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1399. ipv6_dir_ap);
  1400. /* Preferring IPv4 OR / IPv6 Dir */
  1401. mock_options.ClientPreferIPv6ORPort = 0;
  1402. mock_options.ClientPreferIPv6DirPort = 1;
  1403. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1404. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1405. &mock_options);
  1406. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1407. ipv4_or_ap);
  1408. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1409. ipv4_or_ap);
  1410. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1411. ipv6_dir_ap);
  1412. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1413. ipv6_dir_ap);
  1414. /* Preferring IPv6 OR / IPv4 Dir */
  1415. mock_options.ClientPreferIPv6ORPort = 1;
  1416. mock_options.ClientPreferIPv6DirPort = 0;
  1417. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1418. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1419. &mock_options);
  1420. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1421. ipv6_or_ap);
  1422. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1423. ipv6_or_ap);
  1424. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1425. ipv4_dir_ap);
  1426. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1427. ipv4_dir_ap);
  1428. /* Choose an address with UseBridges on */
  1429. memset(&mock_options, 0, sizeof(or_options_t));
  1430. mock_options.UseBridges = 1;
  1431. mock_options.ClientUseIPv4 = 1;
  1432. mock_options.ClientUseIPv6 = 1;
  1433. /* Preferring IPv4 */
  1434. mock_options.ClientPreferIPv6ORPort = 0;
  1435. mock_options.ClientPreferIPv6DirPort = 0;
  1436. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1437. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1438. &mock_options);
  1439. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1440. ipv4_or_ap);
  1441. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1442. ipv4_or_ap);
  1443. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1444. ipv4_dir_ap);
  1445. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1446. ipv4_dir_ap);
  1447. /* Auto:
  1448. * - bridge clients prefer the configured bridge OR address from the node,
  1449. * (the configured address family sets node.ipv6_preferred)
  1450. * - other clients prefer IPv4 OR by default (see above),
  1451. * - all clients, including bridge clients, prefer IPv4 Dir by default.
  1452. */
  1453. mock_options.ClientPreferIPv6ORPort = -1;
  1454. mock_options.ClientPreferIPv6DirPort = -1;
  1455. /* Simulate the initialisation of fake_node.ipv6_preferred with a bridge
  1456. * configured with an IPv4 address */
  1457. fake_node.ipv6_preferred = 0;
  1458. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 0, 1, ipv4_or_ap);
  1459. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 1, 1, ipv4_or_ap);
  1460. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1461. ipv4_dir_ap);
  1462. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1463. ipv4_dir_ap);
  1464. /* Simulate the initialisation of fake_node.ipv6_preferred with a bridge
  1465. * configured with an IPv6 address */
  1466. fake_node.ipv6_preferred = 1;
  1467. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 0, 1, ipv6_or_ap);
  1468. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 1, 1, ipv6_or_ap);
  1469. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1470. ipv4_dir_ap);
  1471. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1472. ipv4_dir_ap);
  1473. /* When a rs has no node, it defaults to IPv4 under auto. */
  1474. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_OR_CONNECTION, 0, 1, ipv4_or_ap);
  1475. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_OR_CONNECTION, 1, 1, ipv4_or_ap);
  1476. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_DIR_CONNECTION, 0, 1, ipv4_dir_ap);
  1477. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_DIR_CONNECTION, 1, 1, ipv4_dir_ap);
  1478. /* Preferring IPv6 */
  1479. mock_options.ClientPreferIPv6ORPort = 1;
  1480. mock_options.ClientPreferIPv6DirPort = 1;
  1481. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1482. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1483. &mock_options);
  1484. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1485. ipv6_or_ap);
  1486. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1487. ipv6_or_ap);
  1488. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1489. ipv6_dir_ap);
  1490. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1491. ipv6_dir_ap);
  1492. /* In the default configuration (Auto / IPv6 off), bridge clients should
  1493. * use both IPv4 and IPv6, but only prefer IPv6 for bridges configured with
  1494. * an IPv6 address, regardless of ClientUseIPv6. (See above.) */
  1495. mock_options.ClientUseIPv6 = 0;
  1496. mock_options.ClientPreferIPv6ORPort = -1;
  1497. mock_options.ClientPreferIPv6DirPort = -1;
  1498. /* Simulate the initialisation of fake_node.ipv6_preferred with a bridge
  1499. * configured with an IPv4 address */
  1500. fake_node.ipv6_preferred = 0;
  1501. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 0, 1, ipv4_or_ap);
  1502. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 1, 1, ipv4_or_ap);
  1503. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1504. ipv4_dir_ap);
  1505. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1506. ipv4_dir_ap);
  1507. /* Simulate the initialisation of fake_node.ipv6_preferred with a bridge
  1508. * configured with an IPv6 address */
  1509. fake_node.ipv6_preferred = 1;
  1510. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 0, 1, ipv6_or_ap);
  1511. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 1, 1, ipv6_or_ap);
  1512. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1513. ipv4_dir_ap);
  1514. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1515. ipv4_dir_ap);
  1516. /* When a rs has no node, it defaults to IPv4 under auto. */
  1517. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_OR_CONNECTION, 0, 1, ipv4_or_ap);
  1518. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_OR_CONNECTION, 1, 1, ipv4_or_ap);
  1519. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_DIR_CONNECTION, 0, 1, ipv4_dir_ap);
  1520. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_DIR_CONNECTION, 1, 1, ipv4_dir_ap);
  1521. /* Choose an address with IPv4 on */
  1522. memset(&mock_options, 0, sizeof(or_options_t));
  1523. mock_options.ClientUseIPv4 = 1;
  1524. mock_options.ClientUseIPv6 = 0;
  1525. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1526. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1527. &mock_options);
  1528. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1529. ipv4_or_ap);
  1530. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1531. ipv4_or_ap);
  1532. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1533. ipv4_dir_ap);
  1534. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1535. ipv4_dir_ap);
  1536. /* Choose an address with IPv6 on */
  1537. memset(&mock_options, 0, sizeof(or_options_t));
  1538. mock_options.ClientUseIPv4 = 0;
  1539. mock_options.ClientUseIPv6 = 1;
  1540. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1541. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1542. &mock_options);
  1543. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1544. ipv6_or_ap);
  1545. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1546. ipv6_or_ap);
  1547. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1548. ipv6_dir_ap);
  1549. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1550. ipv6_dir_ap);
  1551. /* Choose an address with ClientUseIPv4 0.
  1552. * This means "use IPv6" regardless of the other settings. */
  1553. memset(&mock_options, 0, sizeof(or_options_t));
  1554. mock_options.ClientUseIPv4 = 0;
  1555. mock_options.ClientUseIPv6 = 0;
  1556. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1557. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1558. &mock_options);
  1559. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1560. ipv6_or_ap);
  1561. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1562. ipv6_or_ap);
  1563. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1564. ipv6_dir_ap);
  1565. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1566. ipv6_dir_ap);
  1567. /* Choose an address with ORPort_set 1 (server mode).
  1568. * This means "use IPv4" regardless of the other settings. */
  1569. memset(&mock_options, 0, sizeof(or_options_t));
  1570. mock_options.ORPort_set = 1;
  1571. mock_options.ClientUseIPv4 = 0;
  1572. mock_options.ClientUseIPv6 = 1;
  1573. mock_options.ClientPreferIPv6ORPort = 1;
  1574. mock_options.ClientPreferIPv6DirPort = 1;
  1575. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1576. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1577. &mock_options);
  1578. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1579. ipv4_or_ap);
  1580. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1581. ipv4_or_ap);
  1582. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1583. ipv4_dir_ap);
  1584. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1585. ipv4_dir_ap);
  1586. done:
  1587. UNMOCK(get_options);
  1588. }
  1589. #undef TEST_IPV4_ADDR_STR
  1590. #undef TEST_IPV6_ADDR_STR
  1591. #undef TEST_IPV4_OR_PORT
  1592. #undef TEST_IPV4_DIR_PORT
  1593. #undef TEST_IPV6_OR_PORT
  1594. #undef TEST_IPV6_DIR_PORT
  1595. #undef CHECK_CHOSEN_ADDR_RS
  1596. #undef CHECK_CHOSEN_ADDR_NODE
  1597. #undef CHECK_CHOSEN_ADDR_RN
  1598. struct testcase_t policy_tests[] = {
  1599. { "router_dump_exit_policy_to_string", test_dump_exit_policy_to_string, 0,
  1600. NULL, NULL },
  1601. { "general", test_policies_general, 0, NULL, NULL },
  1602. { "getinfo_helper_policies", test_policies_getinfo_helper_policies, 0, NULL,
  1603. NULL },
  1604. { "reject_exit_address", test_policies_reject_exit_address, 0, NULL, NULL },
  1605. { "reject_interface_address", test_policies_reject_interface_address, 0,
  1606. NULL, NULL },
  1607. { "reject_port_address", test_policies_reject_port_address, 0, NULL, NULL },
  1608. { "fascist_firewall_allows_address",
  1609. test_policies_fascist_firewall_allows_address, 0, NULL, NULL },
  1610. { "fascist_firewall_choose_address",
  1611. test_policies_fascist_firewall_choose_address, 0, NULL, NULL },
  1612. END_OF_TESTCASES
  1613. };