policies.h 7.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2017, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file policies.h
  8. * \brief Header file for policies.c.
  9. **/
  10. #ifndef TOR_POLICIES_H
  11. #define TOR_POLICIES_H
  12. /* (length of
  13. * "accept6 [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]/128:65535-65535\n"
  14. * plus a terminating NUL, rounded up to a nice number.)
  15. */
  16. #define POLICY_BUF_LEN 72
  17. #define EXIT_POLICY_IPV6_ENABLED (1 << 0)
  18. #define EXIT_POLICY_REJECT_PRIVATE (1 << 1)
  19. #define EXIT_POLICY_ADD_DEFAULT (1 << 2)
  20. #define EXIT_POLICY_REJECT_LOCAL_INTERFACES (1 << 3)
  21. #define EXIT_POLICY_ADD_REDUCED (1 << 4)
  22. #define EXIT_POLICY_OPTION_MAX EXIT_POLICY_ADD_REDUCED
  23. /* All options set: used for unit testing */
  24. #define EXIT_POLICY_OPTION_ALL ((EXIT_POLICY_OPTION_MAX << 1) - 1)
  25. typedef enum firewall_connection_t {
  26. FIREWALL_OR_CONNECTION = 0,
  27. FIREWALL_DIR_CONNECTION = 1
  28. } firewall_connection_t;
  29. typedef int exit_policy_parser_cfg_t;
  30. int firewall_is_fascist_or(void);
  31. int firewall_is_fascist_dir(void);
  32. int fascist_firewall_use_ipv6(const or_options_t *options);
  33. int fascist_firewall_prefer_ipv6_orport(const or_options_t *options);
  34. int fascist_firewall_prefer_ipv6_dirport(const or_options_t *options);
  35. int fascist_firewall_allows_address_addr(const tor_addr_t *addr,
  36. uint16_t port,
  37. firewall_connection_t fw_connection,
  38. int pref_only, int pref_ipv6);
  39. int fascist_firewall_allows_rs(const routerstatus_t *rs,
  40. firewall_connection_t fw_connection,
  41. int pref_only);
  42. int fascist_firewall_allows_node(const node_t *node,
  43. firewall_connection_t fw_connection,
  44. int pref_only);
  45. int fascist_firewall_allows_dir_server(const dir_server_t *ds,
  46. firewall_connection_t fw_connection,
  47. int pref_only);
  48. void fascist_firewall_choose_address_rs(const routerstatus_t *rs,
  49. firewall_connection_t fw_connection,
  50. int pref_only, tor_addr_port_t* ap);
  51. void fascist_firewall_choose_address_node(const node_t *node,
  52. firewall_connection_t fw_connection,
  53. int pref_only, tor_addr_port_t* ap);
  54. void fascist_firewall_choose_address_dir_server(const dir_server_t *ds,
  55. firewall_connection_t fw_connection,
  56. int pref_only, tor_addr_port_t* ap);
  57. int dir_policy_permits_address(const tor_addr_t *addr);
  58. int socks_policy_permits_address(const tor_addr_t *addr);
  59. int authdir_policy_permits_address(uint32_t addr, uint16_t port);
  60. int authdir_policy_valid_address(uint32_t addr, uint16_t port);
  61. int authdir_policy_badexit_address(uint32_t addr, uint16_t port);
  62. int validate_addr_policies(const or_options_t *options, char **msg);
  63. void policy_expand_private(smartlist_t **policy);
  64. void policy_expand_unspec(smartlist_t **policy);
  65. int policies_parse_from_options(const or_options_t *options);
  66. addr_policy_t *addr_policy_get_canonical_entry(addr_policy_t *ent);
  67. int addr_policies_eq(const smartlist_t *a, const smartlist_t *b);
  68. MOCK_DECL(addr_policy_result_t, compare_tor_addr_to_addr_policy,
  69. (const tor_addr_t *addr, uint16_t port, const smartlist_t *policy));
  70. addr_policy_result_t compare_tor_addr_to_node_policy(const tor_addr_t *addr,
  71. uint16_t port, const node_t *node);
  72. int policies_parse_exit_policy_from_options(
  73. const or_options_t *or_options,
  74. uint32_t local_address,
  75. const tor_addr_t *ipv6_local_address,
  76. smartlist_t **result);
  77. int policies_parse_exit_policy(config_line_t *cfg, smartlist_t **dest,
  78. exit_policy_parser_cfg_t options,
  79. const smartlist_t *configured_addresses);
  80. void policies_parse_exit_policy_reject_private(
  81. smartlist_t **dest,
  82. int ipv6_exit,
  83. const smartlist_t *configured_addresses,
  84. int reject_interface_addresses,
  85. int reject_configured_port_addresses);
  86. void policies_exit_policy_append_reject_star(smartlist_t **dest);
  87. void addr_policy_append_reject_addr(smartlist_t **dest,
  88. const tor_addr_t *addr);
  89. void addr_policy_append_reject_addr_list(smartlist_t **dest,
  90. const smartlist_t *addrs);
  91. void policies_set_node_exitpolicy_to_reject_all(node_t *exitrouter);
  92. int exit_policy_is_general_exit(smartlist_t *policy);
  93. int policy_is_reject_star(const smartlist_t *policy, sa_family_t family,
  94. int reject_by_default);
  95. char * policy_dump_to_string(const smartlist_t *policy_list,
  96. int include_ipv4,
  97. int include_ipv6);
  98. int getinfo_helper_policies(control_connection_t *conn,
  99. const char *question, char **answer,
  100. const char **errmsg);
  101. int policy_write_item(char *buf, size_t buflen, const addr_policy_t *item,
  102. int format_for_desc);
  103. void addr_policy_list_free_(smartlist_t *p);
  104. #define addr_policy_list_free(lst) \
  105. FREE_AND_NULL(smartlist_t, addr_policy_list_free_, (lst))
  106. void addr_policy_free_(addr_policy_t *p);
  107. #define addr_policy_free(p) \
  108. FREE_AND_NULL(addr_policy_t, addr_policy_free_, (p))
  109. void policies_free_all(void);
  110. char *policy_summarize(smartlist_t *policy, sa_family_t family);
  111. short_policy_t *parse_short_policy(const char *summary);
  112. char *write_short_policy(const short_policy_t *policy);
  113. void short_policy_free_(short_policy_t *policy);
  114. #define short_policy_free(p) \
  115. FREE_AND_NULL(short_policy_t, short_policy_free_, (p))
  116. int short_policy_is_reject_star(const short_policy_t *policy);
  117. addr_policy_result_t compare_tor_addr_to_short_policy(
  118. const tor_addr_t *addr, uint16_t port,
  119. const short_policy_t *policy);
  120. #ifdef POLICIES_PRIVATE
  121. STATIC void append_exit_policy_string(smartlist_t **policy, const char *more);
  122. STATIC int fascist_firewall_allows_address(const tor_addr_t *addr,
  123. uint16_t port,
  124. smartlist_t *firewall_policy,
  125. int pref_only, int pref_ipv6);
  126. STATIC const tor_addr_port_t * fascist_firewall_choose_address(
  127. const tor_addr_port_t *a,
  128. const tor_addr_port_t *b,
  129. int want_a,
  130. firewall_connection_t fw_connection,
  131. int pref_only, int pref_ipv6);
  132. #endif /* defined(POLICIES_PRIVATE) */
  133. #endif /* !defined(TOR_POLICIES_H) */