test_policy.c 95 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392
  1. /* Copyright (c) 2013-2017, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. #include "or.h"
  4. #define CONFIG_PRIVATE
  5. #include "config.h"
  6. #include "router.h"
  7. #include "routerparse.h"
  8. #define POLICIES_PRIVATE
  9. #include "policies.h"
  10. #include "test.h"
  11. /* Helper: assert that short_policy parses and writes back out as itself,
  12. or as <b>expected</b> if that's provided. */
  13. static void
  14. test_short_policy_parse(const char *input,
  15. const char *expected)
  16. {
  17. short_policy_t *short_policy = NULL;
  18. char *out = NULL;
  19. if (expected == NULL)
  20. expected = input;
  21. short_policy = parse_short_policy(input);
  22. tt_assert(short_policy);
  23. out = write_short_policy(short_policy);
  24. tt_str_op(out, OP_EQ, expected);
  25. done:
  26. tor_free(out);
  27. short_policy_free(short_policy);
  28. }
  29. /** Helper: Parse the exit policy string in <b>policy_str</b> with
  30. * <b>options</b>, and make sure that policies_summarize() produces the string
  31. * <b>expected_summary</b> from it when called with family. */
  32. static void
  33. test_policy_summary_helper_family_flags(const char *policy_str,
  34. const char *expected_summary,
  35. sa_family_t family,
  36. exit_policy_parser_cfg_t options)
  37. {
  38. config_line_t line;
  39. smartlist_t *policy = smartlist_new();
  40. char *summary = NULL;
  41. char *summary_after = NULL;
  42. int r;
  43. short_policy_t *short_policy = NULL;
  44. int success = 0;
  45. line.key = (char*)"foo";
  46. line.value = (char *)policy_str;
  47. line.next = NULL;
  48. r = policies_parse_exit_policy(&line, &policy,
  49. options, NULL);
  50. tt_int_op(r,OP_EQ, 0);
  51. summary = policy_summarize(policy, family);
  52. tt_ptr_op(summary, OP_NE, NULL);
  53. tt_str_op(summary,OP_EQ, expected_summary);
  54. short_policy = parse_short_policy(summary);
  55. tt_assert(short_policy);
  56. summary_after = write_short_policy(short_policy);
  57. tt_str_op(summary,OP_EQ, summary_after);
  58. success = 1;
  59. done:
  60. /* If we don't print the flags on failure, it's very hard to diagnose bugs */
  61. if (!success)
  62. TT_DECLARE("CTXT", ("\n IPv%d\n Options: %x\n Policy: %s",
  63. family == AF_INET ? 4 : 6, options, policy_str));
  64. tor_free(summary_after);
  65. tor_free(summary);
  66. if (policy)
  67. addr_policy_list_free(policy);
  68. short_policy_free(short_policy);
  69. }
  70. /** Like test_policy_summary_helper_family_flags, but tries all the different
  71. * flag combinations */
  72. static void
  73. test_policy_summary_helper_family(const char *policy_str,
  74. const char *expected_summary,
  75. sa_family_t family)
  76. {
  77. for (exit_policy_parser_cfg_t opt = 0;
  78. opt <= EXIT_POLICY_OPTION_ALL;
  79. opt++) {
  80. if (family == AF_INET6 && !(opt & EXIT_POLICY_IPV6_ENABLED))
  81. /* Skip the test: IPv6 addresses need IPv6 enabled */
  82. continue;
  83. if (opt & EXIT_POLICY_REJECT_LOCAL_INTERFACES)
  84. /* Skip the test: local interfaces are machine-specific */
  85. continue;
  86. test_policy_summary_helper_family_flags(policy_str, expected_summary,
  87. family, opt);
  88. }
  89. }
  90. /** Like test_policy_summary_helper_family, but uses expected_summary for
  91. * both IPv4 and IPv6. */
  92. static void
  93. test_policy_summary_helper(const char *policy_str,
  94. const char *expected_summary)
  95. {
  96. test_policy_summary_helper_family(policy_str, expected_summary, AF_INET);
  97. test_policy_summary_helper_family(policy_str, expected_summary, AF_INET6);
  98. }
  99. /** Like test_policy_summary_helper_family, but uses expected_summary4 for
  100. * IPv4 and expected_summary6 for IPv6. */
  101. static void
  102. test_policy_summary_helper6(const char *policy_str,
  103. const char *expected_summary4,
  104. const char *expected_summary6)
  105. {
  106. test_policy_summary_helper_family(policy_str, expected_summary4, AF_INET);
  107. test_policy_summary_helper_family(policy_str, expected_summary6, AF_INET6);
  108. }
  109. /** Run unit tests for generating summary lines of exit policies */
  110. static void
  111. test_policies_general(void *arg)
  112. {
  113. int i;
  114. smartlist_t *policy = NULL, *policy2 = NULL, *policy3 = NULL,
  115. *policy4 = NULL, *policy5 = NULL, *policy6 = NULL,
  116. *policy7 = NULL, *policy8 = NULL, *policy9 = NULL,
  117. *policy10 = NULL, *policy11 = NULL, *policy12 = NULL;
  118. addr_policy_t *p;
  119. tor_addr_t tar, tar2;
  120. smartlist_t *addr_list = NULL;
  121. config_line_t line;
  122. smartlist_t *sm = NULL;
  123. char *policy_str = NULL;
  124. short_policy_t *short_parsed = NULL;
  125. int malformed_list = -1;
  126. (void)arg;
  127. policy = smartlist_new();
  128. p = router_parse_addr_policy_item_from_string("reject 192.168.0.0/16:*", -1,
  129. &malformed_list);
  130. tt_ptr_op(p, OP_NE, NULL);
  131. tt_int_op(ADDR_POLICY_REJECT,OP_EQ, p->policy_type);
  132. tor_addr_from_ipv4h(&tar, 0xc0a80000u);
  133. tt_int_op(0,OP_EQ, tor_addr_compare(&p->addr, &tar, CMP_EXACT));
  134. tt_int_op(16,OP_EQ, p->maskbits);
  135. tt_int_op(1,OP_EQ, p->prt_min);
  136. tt_int_op(65535,OP_EQ, p->prt_max);
  137. smartlist_add(policy, p);
  138. tor_addr_from_ipv4h(&tar, 0x01020304u);
  139. tt_assert(ADDR_POLICY_ACCEPTED ==
  140. compare_tor_addr_to_addr_policy(&tar, 2, policy));
  141. tor_addr_make_unspec(&tar);
  142. tt_assert(ADDR_POLICY_PROBABLY_ACCEPTED ==
  143. compare_tor_addr_to_addr_policy(&tar, 2, policy));
  144. tor_addr_from_ipv4h(&tar, 0xc0a80102);
  145. tt_assert(ADDR_POLICY_REJECTED ==
  146. compare_tor_addr_to_addr_policy(&tar, 2, policy));
  147. tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy2,
  148. EXIT_POLICY_IPV6_ENABLED |
  149. EXIT_POLICY_REJECT_PRIVATE |
  150. EXIT_POLICY_ADD_DEFAULT, NULL));
  151. tt_assert(policy2);
  152. tor_addr_from_ipv4h(&tar, 0x0306090cu);
  153. tor_addr_parse(&tar2, "[2000::1234]");
  154. addr_list = smartlist_new();
  155. smartlist_add(addr_list, &tar);
  156. smartlist_add(addr_list, &tar2);
  157. tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy12,
  158. EXIT_POLICY_IPV6_ENABLED |
  159. EXIT_POLICY_REJECT_PRIVATE |
  160. EXIT_POLICY_ADD_DEFAULT,
  161. addr_list));
  162. smartlist_free(addr_list);
  163. addr_list = NULL;
  164. tt_assert(policy12);
  165. policy3 = smartlist_new();
  166. p = router_parse_addr_policy_item_from_string("reject *:*", -1,
  167. &malformed_list);
  168. tt_ptr_op(p, OP_NE, NULL);
  169. smartlist_add(policy3, p);
  170. p = router_parse_addr_policy_item_from_string("accept *:*", -1,
  171. &malformed_list);
  172. tt_ptr_op(p, OP_NE, NULL);
  173. smartlist_add(policy3, p);
  174. policy4 = smartlist_new();
  175. p = router_parse_addr_policy_item_from_string("accept *:443", -1,
  176. &malformed_list);
  177. tt_ptr_op(p, OP_NE, NULL);
  178. smartlist_add(policy4, p);
  179. p = router_parse_addr_policy_item_from_string("accept *:443", -1,
  180. &malformed_list);
  181. tt_ptr_op(p, OP_NE, NULL);
  182. smartlist_add(policy4, p);
  183. policy5 = smartlist_new();
  184. p = router_parse_addr_policy_item_from_string("reject 0.0.0.0/8:*", -1,
  185. &malformed_list);
  186. tt_ptr_op(p, OP_NE, NULL);
  187. smartlist_add(policy5, p);
  188. p = router_parse_addr_policy_item_from_string("reject 169.254.0.0/16:*", -1,
  189. &malformed_list);
  190. tt_ptr_op(p, OP_NE, NULL);
  191. smartlist_add(policy5, p);
  192. p = router_parse_addr_policy_item_from_string("reject 127.0.0.0/8:*", -1,
  193. &malformed_list);
  194. tt_ptr_op(p, OP_NE, NULL);
  195. smartlist_add(policy5, p);
  196. p = router_parse_addr_policy_item_from_string("reject 192.168.0.0/16:*",
  197. -1, &malformed_list);
  198. tt_ptr_op(p, OP_NE, NULL);
  199. smartlist_add(policy5, p);
  200. p = router_parse_addr_policy_item_from_string("reject 10.0.0.0/8:*", -1,
  201. &malformed_list);
  202. tt_ptr_op(p, OP_NE, NULL);
  203. smartlist_add(policy5, p);
  204. p = router_parse_addr_policy_item_from_string("reject 172.16.0.0/12:*", -1,
  205. &malformed_list);
  206. tt_ptr_op(p, OP_NE, NULL);
  207. smartlist_add(policy5, p);
  208. p = router_parse_addr_policy_item_from_string("reject 80.190.250.90:*", -1,
  209. &malformed_list);
  210. tt_ptr_op(p, OP_NE, NULL);
  211. smartlist_add(policy5, p);
  212. p = router_parse_addr_policy_item_from_string("reject *:1-65534", -1,
  213. &malformed_list);
  214. tt_ptr_op(p, OP_NE, NULL);
  215. smartlist_add(policy5, p);
  216. p = router_parse_addr_policy_item_from_string("reject *:65535", -1,
  217. &malformed_list);
  218. tt_ptr_op(p, OP_NE, NULL);
  219. smartlist_add(policy5, p);
  220. p = router_parse_addr_policy_item_from_string("accept *:1-65535", -1,
  221. &malformed_list);
  222. tt_ptr_op(p, OP_NE, NULL);
  223. smartlist_add(policy5, p);
  224. policy6 = smartlist_new();
  225. p = router_parse_addr_policy_item_from_string("accept 43.3.0.0/9:*", -1,
  226. &malformed_list);
  227. tt_ptr_op(p, OP_NE, NULL);
  228. smartlist_add(policy6, p);
  229. policy7 = smartlist_new();
  230. p = router_parse_addr_policy_item_from_string("accept 0.0.0.0/8:*", -1,
  231. &malformed_list);
  232. tt_ptr_op(p, OP_NE, NULL);
  233. smartlist_add(policy7, p);
  234. tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy8,
  235. EXIT_POLICY_IPV6_ENABLED |
  236. EXIT_POLICY_REJECT_PRIVATE |
  237. EXIT_POLICY_ADD_DEFAULT,
  238. NULL));
  239. tt_assert(policy8);
  240. tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy9,
  241. EXIT_POLICY_REJECT_PRIVATE |
  242. EXIT_POLICY_ADD_DEFAULT,
  243. NULL));
  244. tt_assert(policy9);
  245. /* accept6 * and reject6 * produce IPv6 wildcards only */
  246. policy10 = smartlist_new();
  247. p = router_parse_addr_policy_item_from_string("accept6 *:*", -1,
  248. &malformed_list);
  249. tt_ptr_op(p, OP_NE, NULL);
  250. smartlist_add(policy10, p);
  251. policy11 = smartlist_new();
  252. p = router_parse_addr_policy_item_from_string("reject6 *:*", -1,
  253. &malformed_list);
  254. tt_ptr_op(p, OP_NE, NULL);
  255. smartlist_add(policy11, p);
  256. tt_assert(!exit_policy_is_general_exit(policy));
  257. tt_assert(exit_policy_is_general_exit(policy2));
  258. tt_assert(!exit_policy_is_general_exit(NULL));
  259. tt_assert(!exit_policy_is_general_exit(policy3));
  260. tt_assert(!exit_policy_is_general_exit(policy4));
  261. tt_assert(!exit_policy_is_general_exit(policy5));
  262. tt_assert(!exit_policy_is_general_exit(policy6));
  263. tt_assert(!exit_policy_is_general_exit(policy7));
  264. tt_assert(exit_policy_is_general_exit(policy8));
  265. tt_assert(exit_policy_is_general_exit(policy9));
  266. tt_assert(!exit_policy_is_general_exit(policy10));
  267. tt_assert(!exit_policy_is_general_exit(policy11));
  268. tt_assert(!addr_policies_eq(policy, policy2));
  269. tt_assert(!addr_policies_eq(policy, NULL));
  270. tt_assert(addr_policies_eq(policy2, policy2));
  271. tt_assert(addr_policies_eq(NULL, NULL));
  272. tt_assert(!policy_is_reject_star(policy2, AF_INET, 1));
  273. tt_assert(policy_is_reject_star(policy, AF_INET, 1));
  274. tt_assert(policy_is_reject_star(policy10, AF_INET, 1));
  275. tt_assert(!policy_is_reject_star(policy10, AF_INET6, 1));
  276. tt_assert(policy_is_reject_star(policy11, AF_INET, 1));
  277. tt_assert(policy_is_reject_star(policy11, AF_INET6, 1));
  278. tt_assert(policy_is_reject_star(NULL, AF_INET, 1));
  279. tt_assert(policy_is_reject_star(NULL, AF_INET6, 1));
  280. tt_assert(!policy_is_reject_star(NULL, AF_INET, 0));
  281. tt_assert(!policy_is_reject_star(NULL, AF_INET6, 0));
  282. addr_policy_list_free(policy);
  283. policy = NULL;
  284. /* make sure assume_action works */
  285. malformed_list = 0;
  286. p = router_parse_addr_policy_item_from_string("127.0.0.1",
  287. ADDR_POLICY_ACCEPT,
  288. &malformed_list);
  289. tt_assert(p);
  290. addr_policy_free(p);
  291. tt_assert(!malformed_list);
  292. p = router_parse_addr_policy_item_from_string("127.0.0.1:*",
  293. ADDR_POLICY_ACCEPT,
  294. &malformed_list);
  295. tt_assert(p);
  296. addr_policy_free(p);
  297. tt_assert(!malformed_list);
  298. p = router_parse_addr_policy_item_from_string("[::]",
  299. ADDR_POLICY_ACCEPT,
  300. &malformed_list);
  301. tt_assert(p);
  302. addr_policy_free(p);
  303. tt_assert(!malformed_list);
  304. p = router_parse_addr_policy_item_from_string("[::]:*",
  305. ADDR_POLICY_ACCEPT,
  306. &malformed_list);
  307. tt_assert(p);
  308. addr_policy_free(p);
  309. tt_assert(!malformed_list);
  310. p = router_parse_addr_policy_item_from_string("[face::b]",
  311. ADDR_POLICY_ACCEPT,
  312. &malformed_list);
  313. tt_assert(p);
  314. addr_policy_free(p);
  315. tt_assert(!malformed_list);
  316. p = router_parse_addr_policy_item_from_string("[b::aaaa]",
  317. ADDR_POLICY_ACCEPT,
  318. &malformed_list);
  319. tt_assert(p);
  320. addr_policy_free(p);
  321. tt_assert(!malformed_list);
  322. p = router_parse_addr_policy_item_from_string("*",
  323. ADDR_POLICY_ACCEPT,
  324. &malformed_list);
  325. tt_assert(p);
  326. addr_policy_free(p);
  327. tt_assert(!malformed_list);
  328. p = router_parse_addr_policy_item_from_string("*4",
  329. ADDR_POLICY_ACCEPT,
  330. &malformed_list);
  331. tt_assert(p);
  332. addr_policy_free(p);
  333. tt_assert(!malformed_list);
  334. p = router_parse_addr_policy_item_from_string("*6",
  335. ADDR_POLICY_ACCEPT,
  336. &malformed_list);
  337. tt_assert(p);
  338. addr_policy_free(p);
  339. tt_assert(!malformed_list);
  340. /* These are all ambiguous IPv6 addresses, it's good that we reject them */
  341. p = router_parse_addr_policy_item_from_string("acce::abcd",
  342. ADDR_POLICY_ACCEPT,
  343. &malformed_list);
  344. tt_ptr_op(p, OP_EQ, NULL);
  345. tt_assert(malformed_list);
  346. malformed_list = 0;
  347. p = router_parse_addr_policy_item_from_string("7:1234",
  348. ADDR_POLICY_ACCEPT,
  349. &malformed_list);
  350. tt_ptr_op(p, OP_EQ, NULL);
  351. tt_assert(malformed_list);
  352. malformed_list = 0;
  353. p = router_parse_addr_policy_item_from_string("::",
  354. ADDR_POLICY_ACCEPT,
  355. &malformed_list);
  356. tt_ptr_op(p, OP_EQ, NULL);
  357. tt_assert(malformed_list);
  358. malformed_list = 0;
  359. /* make sure compacting logic works. */
  360. policy = NULL;
  361. line.key = (char*)"foo";
  362. line.value = (char*)"accept *:80,reject private:*,reject *:*";
  363. line.next = NULL;
  364. tt_int_op(0, OP_EQ, policies_parse_exit_policy(&line,&policy,
  365. EXIT_POLICY_IPV6_ENABLED |
  366. EXIT_POLICY_ADD_DEFAULT, NULL));
  367. tt_assert(policy);
  368. //test_streq(policy->string, "accept *:80");
  369. //test_streq(policy->next->string, "reject *:*");
  370. tt_int_op(smartlist_len(policy),OP_EQ, 4);
  371. /* test policy summaries */
  372. /* check if we properly ignore private IP addresses */
  373. test_policy_summary_helper("reject 192.168.0.0/16:*,"
  374. "reject 0.0.0.0/8:*,"
  375. "reject 10.0.0.0/8:*,"
  376. "accept *:10-30,"
  377. "accept *:90,"
  378. "reject *:*",
  379. "accept 10-30,90");
  380. /* check all accept policies, and proper counting of rejects */
  381. test_policy_summary_helper("reject 11.0.0.0/9:80,"
  382. "reject 12.0.0.0/9:80,"
  383. "reject 13.0.0.0/9:80,"
  384. "reject 14.0.0.0/9:80,"
  385. "accept *:*", "accept 1-65535");
  386. test_policy_summary_helper("reject 11.0.0.0/9:80,"
  387. "reject 12.0.0.0/9:80,"
  388. "reject 13.0.0.0/9:80,"
  389. "reject 14.0.0.0/9:80,"
  390. "reject 15.0.0.0:81,"
  391. "accept *:*", "accept 1-65535");
  392. test_policy_summary_helper6("reject 11.0.0.0/9:80,"
  393. "reject 12.0.0.0/9:80,"
  394. "reject 13.0.0.0/9:80,"
  395. "reject 14.0.0.0/9:80,"
  396. "reject 15.0.0.0:80,"
  397. "accept *:*",
  398. "reject 80",
  399. "accept 1-65535");
  400. /* no exits */
  401. test_policy_summary_helper("accept 11.0.0.0/9:80,"
  402. "reject *:*",
  403. "reject 1-65535");
  404. /* port merging */
  405. test_policy_summary_helper("accept *:80,"
  406. "accept *:81,"
  407. "accept *:100-110,"
  408. "accept *:111,"
  409. "reject *:*",
  410. "accept 80-81,100-111");
  411. /* border ports */
  412. test_policy_summary_helper("accept *:1,"
  413. "accept *:3,"
  414. "accept *:65535,"
  415. "reject *:*",
  416. "accept 1,3,65535");
  417. /* holes */
  418. test_policy_summary_helper("accept *:1,"
  419. "accept *:3,"
  420. "accept *:5,"
  421. "accept *:7,"
  422. "reject *:*",
  423. "accept 1,3,5,7");
  424. test_policy_summary_helper("reject *:1,"
  425. "reject *:3,"
  426. "reject *:5,"
  427. "reject *:7,"
  428. "accept *:*",
  429. "reject 1,3,5,7");
  430. /* long policies */
  431. /* standard long policy on many exits */
  432. test_policy_summary_helper("accept *:20-23,"
  433. "accept *:43,"
  434. "accept *:53,"
  435. "accept *:79-81,"
  436. "accept *:88,"
  437. "accept *:110,"
  438. "accept *:143,"
  439. "accept *:194,"
  440. "accept *:220,"
  441. "accept *:389,"
  442. "accept *:443,"
  443. "accept *:464,"
  444. "accept *:531,"
  445. "accept *:543-544,"
  446. "accept *:554,"
  447. "accept *:563,"
  448. "accept *:636,"
  449. "accept *:706,"
  450. "accept *:749,"
  451. "accept *:873,"
  452. "accept *:902-904,"
  453. "accept *:981,"
  454. "accept *:989-995,"
  455. "accept *:1194,"
  456. "accept *:1220,"
  457. "accept *:1293,"
  458. "accept *:1500,"
  459. "accept *:1533,"
  460. "accept *:1677,"
  461. "accept *:1723,"
  462. "accept *:1755,"
  463. "accept *:1863,"
  464. "accept *:2082,"
  465. "accept *:2083,"
  466. "accept *:2086-2087,"
  467. "accept *:2095-2096,"
  468. "accept *:2102-2104,"
  469. "accept *:3128,"
  470. "accept *:3389,"
  471. "accept *:3690,"
  472. "accept *:4321,"
  473. "accept *:4643,"
  474. "accept *:5050,"
  475. "accept *:5190,"
  476. "accept *:5222-5223,"
  477. "accept *:5228,"
  478. "accept *:5900,"
  479. "accept *:6660-6669,"
  480. "accept *:6679,"
  481. "accept *:6697,"
  482. "accept *:8000,"
  483. "accept *:8008,"
  484. "accept *:8074,"
  485. "accept *:8080,"
  486. "accept *:8087-8088,"
  487. "accept *:8332-8333,"
  488. "accept *:8443,"
  489. "accept *:8888,"
  490. "accept *:9418,"
  491. "accept *:9999,"
  492. "accept *:10000,"
  493. "accept *:11371,"
  494. "accept *:12350,"
  495. "accept *:19294,"
  496. "accept *:19638,"
  497. "accept *:23456,"
  498. "accept *:33033,"
  499. "accept *:64738,"
  500. "reject *:*",
  501. "accept 20-23,43,53,79-81,88,110,143,194,220,389,"
  502. "443,464,531,543-544,554,563,636,706,749,873,"
  503. "902-904,981,989-995,1194,1220,1293,1500,1533,"
  504. "1677,1723,1755,1863,2082-2083,2086-2087,"
  505. "2095-2096,2102-2104,3128,3389,3690,4321,4643,"
  506. "5050,5190,5222-5223,5228,5900,6660-6669,6679,"
  507. "6697,8000,8008,8074,8080,8087-8088,8332-8333,"
  508. "8443,8888,9418,9999-10000,11371,12350,19294,"
  509. "19638,23456,33033,64738");
  510. /* short policy with configured addresses */
  511. test_policy_summary_helper("reject 149.56.1.1:*,"
  512. "reject [2607:5300:1:1::1:0]:*,"
  513. "accept *:80,"
  514. "accept *:443,"
  515. "reject *:*",
  516. "accept 80,443");
  517. /* short policy with configured and local interface addresses */
  518. test_policy_summary_helper("reject 149.56.1.0:*,"
  519. "reject 149.56.1.1:*,"
  520. "reject 149.56.1.2:*,"
  521. "reject 149.56.1.3:*,"
  522. "reject 149.56.1.4:*,"
  523. "reject 149.56.1.5:*,"
  524. "reject 149.56.1.6:*,"
  525. "reject 149.56.1.7:*,"
  526. "reject [2607:5300:1:1::1:0]:*,"
  527. "reject [2607:5300:1:1::1:1]:*,"
  528. "reject [2607:5300:1:1::1:2]:*,"
  529. "reject [2607:5300:1:1::1:3]:*,"
  530. "reject [2607:5300:1:1::2:0]:*,"
  531. "reject [2607:5300:1:1::2:1]:*,"
  532. "reject [2607:5300:1:1::2:2]:*,"
  533. "reject [2607:5300:1:1::2:3]:*,"
  534. "accept *:80,"
  535. "accept *:443,"
  536. "reject *:*",
  537. "accept 80,443");
  538. /* short policy with configured netblocks */
  539. test_policy_summary_helper("reject 149.56.0.0/16,"
  540. "reject6 2607:5300::/32,"
  541. "reject6 2608:5300::/64,"
  542. "reject6 2609:5300::/96,"
  543. "accept *:80,"
  544. "accept *:443,"
  545. "reject *:*",
  546. "accept 80,443");
  547. /* short policy with large netblocks that do not count as a rejection */
  548. test_policy_summary_helper("reject 148.0.0.0/7,"
  549. "reject6 2600::/16,"
  550. "accept *:80,"
  551. "accept *:443,"
  552. "reject *:*",
  553. "accept 80,443");
  554. /* short policy with large netblocks that count as a rejection */
  555. test_policy_summary_helper("reject 148.0.0.0/6,"
  556. "reject6 2600::/15,"
  557. "accept *:80,"
  558. "accept *:443,"
  559. "reject *:*",
  560. "reject 1-65535");
  561. /* short policy with huge netblocks that count as a rejection */
  562. test_policy_summary_helper("reject 128.0.0.0/1,"
  563. "reject6 8000::/1,"
  564. "accept *:80,"
  565. "accept *:443,"
  566. "reject *:*",
  567. "reject 1-65535");
  568. /* short policy which blocks everything using netblocks */
  569. test_policy_summary_helper("reject 0.0.0.0/0,"
  570. "reject6 ::/0,"
  571. "accept *:80,"
  572. "accept *:443,"
  573. "reject *:*",
  574. "reject 1-65535");
  575. /* short policy which has repeated redundant netblocks */
  576. test_policy_summary_helper("reject 0.0.0.0/0,"
  577. "reject 0.0.0.0/0,"
  578. "reject 0.0.0.0/0,"
  579. "reject 0.0.0.0/0,"
  580. "reject 0.0.0.0/0,"
  581. "reject6 ::/0,"
  582. "reject6 ::/0,"
  583. "reject6 ::/0,"
  584. "reject6 ::/0,"
  585. "reject6 ::/0,"
  586. "accept *:80,"
  587. "accept *:443,"
  588. "reject *:*",
  589. "reject 1-65535");
  590. /* longest possible policy
  591. * (1-2,4-5,... is longer, but gets reduced to 3,6,... )
  592. * Going all the way to 65535 is incredibly slow, so we just go slightly
  593. * more than the expected length */
  594. test_policy_summary_helper("accept *:1,"
  595. "accept *:3,"
  596. "accept *:5,"
  597. "accept *:7,"
  598. "accept *:9,"
  599. "accept *:11,"
  600. "accept *:13,"
  601. "accept *:15,"
  602. "accept *:17,"
  603. "accept *:19,"
  604. "accept *:21,"
  605. "accept *:23,"
  606. "accept *:25,"
  607. "accept *:27,"
  608. "accept *:29,"
  609. "accept *:31,"
  610. "accept *:33,"
  611. "accept *:35,"
  612. "accept *:37,"
  613. "accept *:39,"
  614. "accept *:41,"
  615. "accept *:43,"
  616. "accept *:45,"
  617. "accept *:47,"
  618. "accept *:49,"
  619. "accept *:51,"
  620. "accept *:53,"
  621. "accept *:55,"
  622. "accept *:57,"
  623. "accept *:59,"
  624. "accept *:61,"
  625. "accept *:63,"
  626. "accept *:65,"
  627. "accept *:67,"
  628. "accept *:69,"
  629. "accept *:71,"
  630. "accept *:73,"
  631. "accept *:75,"
  632. "accept *:77,"
  633. "accept *:79,"
  634. "accept *:81,"
  635. "accept *:83,"
  636. "accept *:85,"
  637. "accept *:87,"
  638. "accept *:89,"
  639. "accept *:91,"
  640. "accept *:93,"
  641. "accept *:95,"
  642. "accept *:97,"
  643. "accept *:99,"
  644. "accept *:101,"
  645. "accept *:103,"
  646. "accept *:105,"
  647. "accept *:107,"
  648. "accept *:109,"
  649. "accept *:111,"
  650. "accept *:113,"
  651. "accept *:115,"
  652. "accept *:117,"
  653. "accept *:119,"
  654. "accept *:121,"
  655. "accept *:123,"
  656. "accept *:125,"
  657. "accept *:127,"
  658. "accept *:129,"
  659. "accept *:131,"
  660. "accept *:133,"
  661. "accept *:135,"
  662. "accept *:137,"
  663. "accept *:139,"
  664. "accept *:141,"
  665. "accept *:143,"
  666. "accept *:145,"
  667. "accept *:147,"
  668. "accept *:149,"
  669. "accept *:151,"
  670. "accept *:153,"
  671. "accept *:155,"
  672. "accept *:157,"
  673. "accept *:159,"
  674. "accept *:161,"
  675. "accept *:163,"
  676. "accept *:165,"
  677. "accept *:167,"
  678. "accept *:169,"
  679. "accept *:171,"
  680. "accept *:173,"
  681. "accept *:175,"
  682. "accept *:177,"
  683. "accept *:179,"
  684. "accept *:181,"
  685. "accept *:183,"
  686. "accept *:185,"
  687. "accept *:187,"
  688. "accept *:189,"
  689. "accept *:191,"
  690. "accept *:193,"
  691. "accept *:195,"
  692. "accept *:197,"
  693. "accept *:199,"
  694. "accept *:201,"
  695. "accept *:203,"
  696. "accept *:205,"
  697. "accept *:207,"
  698. "accept *:209,"
  699. "accept *:211,"
  700. "accept *:213,"
  701. "accept *:215,"
  702. "accept *:217,"
  703. "accept *:219,"
  704. "accept *:221,"
  705. "accept *:223,"
  706. "accept *:225,"
  707. "accept *:227,"
  708. "accept *:229,"
  709. "accept *:231,"
  710. "accept *:233,"
  711. "accept *:235,"
  712. "accept *:237,"
  713. "accept *:239,"
  714. "accept *:241,"
  715. "accept *:243,"
  716. "accept *:245,"
  717. "accept *:247,"
  718. "accept *:249,"
  719. "accept *:251,"
  720. "accept *:253,"
  721. "accept *:255,"
  722. "accept *:257,"
  723. "accept *:259,"
  724. "accept *:261,"
  725. "accept *:263,"
  726. "accept *:265,"
  727. "accept *:267,"
  728. "accept *:269,"
  729. "accept *:271,"
  730. "accept *:273,"
  731. "accept *:275,"
  732. "accept *:277,"
  733. "accept *:279,"
  734. "accept *:281,"
  735. "accept *:283,"
  736. "accept *:285,"
  737. "accept *:287,"
  738. "accept *:289,"
  739. "accept *:291,"
  740. "accept *:293,"
  741. "accept *:295,"
  742. "accept *:297,"
  743. "accept *:299,"
  744. "accept *:301,"
  745. "accept *:303,"
  746. "accept *:305,"
  747. "accept *:307,"
  748. "accept *:309,"
  749. "accept *:311,"
  750. "accept *:313,"
  751. "accept *:315,"
  752. "accept *:317,"
  753. "accept *:319,"
  754. "accept *:321,"
  755. "accept *:323,"
  756. "accept *:325,"
  757. "accept *:327,"
  758. "accept *:329,"
  759. "accept *:331,"
  760. "accept *:333,"
  761. "accept *:335,"
  762. "accept *:337,"
  763. "accept *:339,"
  764. "accept *:341,"
  765. "accept *:343,"
  766. "accept *:345,"
  767. "accept *:347,"
  768. "accept *:349,"
  769. "accept *:351,"
  770. "accept *:353,"
  771. "accept *:355,"
  772. "accept *:357,"
  773. "accept *:359,"
  774. "accept *:361,"
  775. "accept *:363,"
  776. "accept *:365,"
  777. "accept *:367,"
  778. "accept *:369,"
  779. "accept *:371,"
  780. "accept *:373,"
  781. "accept *:375,"
  782. "accept *:377,"
  783. "accept *:379,"
  784. "accept *:381,"
  785. "accept *:383,"
  786. "accept *:385,"
  787. "accept *:387,"
  788. "accept *:389,"
  789. "accept *:391,"
  790. "accept *:393,"
  791. "accept *:395,"
  792. "accept *:397,"
  793. "accept *:399,"
  794. "accept *:401,"
  795. "accept *:403,"
  796. "accept *:405,"
  797. "accept *:407,"
  798. "accept *:409,"
  799. "accept *:411,"
  800. "accept *:413,"
  801. "accept *:415,"
  802. "accept *:417,"
  803. "accept *:419,"
  804. "accept *:421,"
  805. "accept *:423,"
  806. "accept *:425,"
  807. "accept *:427,"
  808. "accept *:429,"
  809. "accept *:431,"
  810. "accept *:433,"
  811. "accept *:435,"
  812. "accept *:437,"
  813. "accept *:439,"
  814. "accept *:441,"
  815. "accept *:443,"
  816. "accept *:445,"
  817. "accept *:447,"
  818. "accept *:449,"
  819. "accept *:451,"
  820. "accept *:453,"
  821. "accept *:455,"
  822. "accept *:457,"
  823. "accept *:459,"
  824. "accept *:461,"
  825. "accept *:463,"
  826. "accept *:465,"
  827. "accept *:467,"
  828. "accept *:469,"
  829. "accept *:471,"
  830. "accept *:473,"
  831. "accept *:475,"
  832. "accept *:477,"
  833. "accept *:479,"
  834. "accept *:481,"
  835. "accept *:483,"
  836. "accept *:485,"
  837. "accept *:487,"
  838. "accept *:489,"
  839. "accept *:491,"
  840. "accept *:493,"
  841. "accept *:495,"
  842. "accept *:497,"
  843. "accept *:499,"
  844. "accept *:501,"
  845. "accept *:503,"
  846. "accept *:505,"
  847. "accept *:507,"
  848. "accept *:509,"
  849. "accept *:511,"
  850. "accept *:513,"
  851. "accept *:515,"
  852. "accept *:517,"
  853. "accept *:519,"
  854. "accept *:521,"
  855. "accept *:523,"
  856. "accept *:525,"
  857. "accept *:527,"
  858. "accept *:529,"
  859. "reject *:*",
  860. "accept 1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,"
  861. "31,33,35,37,39,41,43,45,47,49,51,53,55,57,59,61,"
  862. "63,65,67,69,71,73,75,77,79,81,83,85,87,89,91,93,"
  863. "95,97,99,101,103,105,107,109,111,113,115,117,"
  864. "119,121,123,125,127,129,131,133,135,137,139,141,"
  865. "143,145,147,149,151,153,155,157,159,161,163,165,"
  866. "167,169,171,173,175,177,179,181,183,185,187,189,"
  867. "191,193,195,197,199,201,203,205,207,209,211,213,"
  868. "215,217,219,221,223,225,227,229,231,233,235,237,"
  869. "239,241,243,245,247,249,251,253,255,257,259,261,"
  870. "263,265,267,269,271,273,275,277,279,281,283,285,"
  871. "287,289,291,293,295,297,299,301,303,305,307,309,"
  872. "311,313,315,317,319,321,323,325,327,329,331,333,"
  873. "335,337,339,341,343,345,347,349,351,353,355,357,"
  874. "359,361,363,365,367,369,371,373,375,377,379,381,"
  875. "383,385,387,389,391,393,395,397,399,401,403,405,"
  876. "407,409,411,413,415,417,419,421,423,425,427,429,"
  877. "431,433,435,437,439,441,443,445,447,449,451,453,"
  878. "455,457,459,461,463,465,467,469,471,473,475,477,"
  879. "479,481,483,485,487,489,491,493,495,497,499,501,"
  880. "503,505,507,509,511,513,515,517,519,521,523");
  881. /* Short policies with unrecognized formats should get accepted. */
  882. test_short_policy_parse("accept fred,2,3-5", "accept 2,3-5");
  883. test_short_policy_parse("accept 2,fred,3", "accept 2,3");
  884. test_short_policy_parse("accept 2,fred,3,bob", "accept 2,3");
  885. test_short_policy_parse("accept 2,-3,500-600", "accept 2,500-600");
  886. /* Short policies with nil entries are accepted too. */
  887. test_short_policy_parse("accept 1,,3", "accept 1,3");
  888. test_short_policy_parse("accept 100-200,,", "accept 100-200");
  889. test_short_policy_parse("reject ,1-10,,,,30-40", "reject 1-10,30-40");
  890. /* Try parsing various broken short policies */
  891. #define TT_BAD_SHORT_POLICY(s) \
  892. do { \
  893. tt_ptr_op(NULL, OP_EQ, (short_parsed = parse_short_policy((s)))); \
  894. } while (0)
  895. TT_BAD_SHORT_POLICY("accept 200-199");
  896. TT_BAD_SHORT_POLICY("");
  897. TT_BAD_SHORT_POLICY("rejekt 1,2,3");
  898. TT_BAD_SHORT_POLICY("reject ");
  899. TT_BAD_SHORT_POLICY("reject");
  900. TT_BAD_SHORT_POLICY("rej");
  901. TT_BAD_SHORT_POLICY("accept 2,3,100000");
  902. TT_BAD_SHORT_POLICY("accept 2,3x,4");
  903. TT_BAD_SHORT_POLICY("accept 2,3x,4");
  904. TT_BAD_SHORT_POLICY("accept 2-");
  905. TT_BAD_SHORT_POLICY("accept 2-x");
  906. TT_BAD_SHORT_POLICY("accept 1-,3");
  907. TT_BAD_SHORT_POLICY("accept 1-,3");
  908. /* Make sure that IPv4 addresses are ignored in accept6/reject6 lines. */
  909. p = router_parse_addr_policy_item_from_string("accept6 1.2.3.4:*", -1,
  910. &malformed_list);
  911. tt_ptr_op(p, OP_EQ, NULL);
  912. tt_assert(!malformed_list);
  913. p = router_parse_addr_policy_item_from_string("reject6 2.4.6.0/24:*", -1,
  914. &malformed_list);
  915. tt_ptr_op(p, OP_EQ, NULL);
  916. tt_assert(!malformed_list);
  917. p = router_parse_addr_policy_item_from_string("accept6 *4:*", -1,
  918. &malformed_list);
  919. tt_ptr_op(p, OP_EQ, NULL);
  920. tt_assert(!malformed_list);
  921. /* Make sure malformed policies are detected as such. */
  922. p = router_parse_addr_policy_item_from_string("bad_token *4:*", -1,
  923. &malformed_list);
  924. tt_ptr_op(p, OP_EQ, NULL);
  925. tt_assert(malformed_list);
  926. p = router_parse_addr_policy_item_from_string("accept6 **:*", -1,
  927. &malformed_list);
  928. tt_ptr_op(p, OP_EQ, NULL);
  929. tt_assert(malformed_list);
  930. p = router_parse_addr_policy_item_from_string("accept */15:*", -1,
  931. &malformed_list);
  932. tt_ptr_op(p, OP_EQ, NULL);
  933. tt_assert(malformed_list);
  934. p = router_parse_addr_policy_item_from_string("reject6 */:*", -1,
  935. &malformed_list);
  936. tt_ptr_op(p, OP_EQ, NULL);
  937. tt_assert(malformed_list);
  938. p = router_parse_addr_policy_item_from_string("accept 127.0.0.1/33:*", -1,
  939. &malformed_list);
  940. tt_ptr_op(p, OP_EQ, NULL);
  941. tt_assert(malformed_list);
  942. p = router_parse_addr_policy_item_from_string("accept6 [::1]/129:*", -1,
  943. &malformed_list);
  944. tt_ptr_op(p, OP_EQ, NULL);
  945. tt_assert(malformed_list);
  946. p = router_parse_addr_policy_item_from_string("reject 8.8.8.8/-1:*", -1,
  947. &malformed_list);
  948. tt_ptr_op(p, OP_EQ, NULL);
  949. tt_assert(malformed_list);
  950. p = router_parse_addr_policy_item_from_string("reject 8.8.4.4:10-5", -1,
  951. &malformed_list);
  952. tt_ptr_op(p, OP_EQ, NULL);
  953. tt_assert(malformed_list);
  954. p = router_parse_addr_policy_item_from_string("reject 1.2.3.4:-1", -1,
  955. &malformed_list);
  956. tt_ptr_op(p, OP_EQ, NULL);
  957. tt_assert(malformed_list);
  958. /* Test a too-long policy. */
  959. {
  960. char *policy_strng = NULL;
  961. smartlist_t *chunks = smartlist_new();
  962. smartlist_add_strdup(chunks, "accept ");
  963. for (i=1; i<10000; ++i)
  964. smartlist_add_asprintf(chunks, "%d,", i);
  965. smartlist_add_strdup(chunks, "20000");
  966. policy_strng = smartlist_join_strings(chunks, "", 0, NULL);
  967. SMARTLIST_FOREACH(chunks, char *, ch, tor_free(ch));
  968. smartlist_free(chunks);
  969. short_parsed = parse_short_policy(policy_strng);/* shouldn't be accepted */
  970. tor_free(policy_strng);
  971. tt_ptr_op(NULL, OP_EQ, short_parsed);
  972. }
  973. /* truncation ports */
  974. sm = smartlist_new();
  975. for (i=1; i<2000; i+=2) {
  976. char buf[POLICY_BUF_LEN];
  977. tor_snprintf(buf, sizeof(buf), "reject *:%d", i);
  978. smartlist_add_strdup(sm, buf);
  979. }
  980. smartlist_add_strdup(sm, "accept *:*");
  981. policy_str = smartlist_join_strings(sm, ",", 0, NULL);
  982. test_policy_summary_helper( policy_str,
  983. "accept 2,4,6,8,10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40,42,44,"
  984. "46,48,50,52,54,56,58,60,62,64,66,68,70,72,74,76,78,80,82,84,86,88,90,"
  985. "92,94,96,98,100,102,104,106,108,110,112,114,116,118,120,122,124,126,128,"
  986. "130,132,134,136,138,140,142,144,146,148,150,152,154,156,158,160,162,164,"
  987. "166,168,170,172,174,176,178,180,182,184,186,188,190,192,194,196,198,200,"
  988. "202,204,206,208,210,212,214,216,218,220,222,224,226,228,230,232,234,236,"
  989. "238,240,242,244,246,248,250,252,254,256,258,260,262,264,266,268,270,272,"
  990. "274,276,278,280,282,284,286,288,290,292,294,296,298,300,302,304,306,308,"
  991. "310,312,314,316,318,320,322,324,326,328,330,332,334,336,338,340,342,344,"
  992. "346,348,350,352,354,356,358,360,362,364,366,368,370,372,374,376,378,380,"
  993. "382,384,386,388,390,392,394,396,398,400,402,404,406,408,410,412,414,416,"
  994. "418,420,422,424,426,428,430,432,434,436,438,440,442,444,446,448,450,452,"
  995. "454,456,458,460,462,464,466,468,470,472,474,476,478,480,482,484,486,488,"
  996. "490,492,494,496,498,500,502,504,506,508,510,512,514,516,518,520,522");
  997. done:
  998. addr_policy_list_free(policy);
  999. addr_policy_list_free(policy2);
  1000. addr_policy_list_free(policy3);
  1001. addr_policy_list_free(policy4);
  1002. addr_policy_list_free(policy5);
  1003. addr_policy_list_free(policy6);
  1004. addr_policy_list_free(policy7);
  1005. addr_policy_list_free(policy8);
  1006. addr_policy_list_free(policy9);
  1007. addr_policy_list_free(policy10);
  1008. addr_policy_list_free(policy11);
  1009. addr_policy_list_free(policy12);
  1010. tor_free(policy_str);
  1011. if (sm) {
  1012. SMARTLIST_FOREACH(sm, char *, s, tor_free(s));
  1013. smartlist_free(sm);
  1014. }
  1015. short_policy_free(short_parsed);
  1016. }
  1017. /** Helper: Check that policy_list contains address */
  1018. static int
  1019. test_policy_has_address_helper(const smartlist_t *policy_list,
  1020. const tor_addr_t *addr)
  1021. {
  1022. int found = 0;
  1023. tt_assert(policy_list);
  1024. tt_assert(addr);
  1025. SMARTLIST_FOREACH_BEGIN(policy_list, addr_policy_t*, p) {
  1026. if (tor_addr_eq(&p->addr, addr)) {
  1027. found = 1;
  1028. }
  1029. } SMARTLIST_FOREACH_END(p);
  1030. return found;
  1031. done:
  1032. return 0;
  1033. }
  1034. #define TEST_IPV4_ADDR (0x01020304)
  1035. #define TEST_IPV6_ADDR ("2002::abcd")
  1036. /** Run unit tests for rejecting the configured addresses on this exit relay
  1037. * using policies_parse_exit_policy_reject_private */
  1038. static void
  1039. test_policies_reject_exit_address(void *arg)
  1040. {
  1041. smartlist_t *policy = NULL;
  1042. tor_addr_t ipv4_addr, ipv6_addr;
  1043. smartlist_t *ipv4_list, *ipv6_list, *both_list, *dupl_list;
  1044. (void)arg;
  1045. tor_addr_from_ipv4h(&ipv4_addr, TEST_IPV4_ADDR);
  1046. tor_addr_parse(&ipv6_addr, TEST_IPV6_ADDR);
  1047. ipv4_list = smartlist_new();
  1048. ipv6_list = smartlist_new();
  1049. both_list = smartlist_new();
  1050. dupl_list = smartlist_new();
  1051. smartlist_add(ipv4_list, &ipv4_addr);
  1052. smartlist_add(both_list, &ipv4_addr);
  1053. smartlist_add(dupl_list, &ipv4_addr);
  1054. smartlist_add(dupl_list, &ipv4_addr);
  1055. smartlist_add(dupl_list, &ipv4_addr);
  1056. smartlist_add(ipv6_list, &ipv6_addr);
  1057. smartlist_add(both_list, &ipv6_addr);
  1058. smartlist_add(dupl_list, &ipv6_addr);
  1059. smartlist_add(dupl_list, &ipv6_addr);
  1060. /* IPv4-Only Exits */
  1061. /* test that IPv4 addresses are rejected on an IPv4-only exit */
  1062. policies_parse_exit_policy_reject_private(&policy, 0, ipv4_list, 0, 0);
  1063. tt_assert(policy);
  1064. tt_int_op(smartlist_len(policy), OP_EQ, 1);
  1065. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  1066. addr_policy_list_free(policy);
  1067. policy = NULL;
  1068. /* test that IPv6 addresses are NOT rejected on an IPv4-only exit
  1069. * (all IPv6 addresses are rejected by policies_parse_exit_policy_internal
  1070. * on IPv4-only exits, so policies_parse_exit_policy_reject_private doesn't
  1071. * need to do anything) */
  1072. policies_parse_exit_policy_reject_private(&policy, 0, ipv6_list, 0, 0);
  1073. tt_ptr_op(policy, OP_EQ, NULL);
  1074. /* test that only IPv4 addresses are rejected on an IPv4-only exit */
  1075. policies_parse_exit_policy_reject_private(&policy, 0, both_list, 0, 0);
  1076. tt_assert(policy);
  1077. tt_int_op(smartlist_len(policy), OP_EQ, 1);
  1078. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  1079. addr_policy_list_free(policy);
  1080. policy = NULL;
  1081. /* Test that lists with duplicate entries produce the same results */
  1082. policies_parse_exit_policy_reject_private(&policy, 0, dupl_list, 0, 0);
  1083. tt_assert(policy);
  1084. tt_int_op(smartlist_len(policy), OP_EQ, 1);
  1085. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  1086. addr_policy_list_free(policy);
  1087. policy = NULL;
  1088. /* IPv4/IPv6 Exits */
  1089. /* test that IPv4 addresses are rejected on an IPv4/IPv6 exit */
  1090. policies_parse_exit_policy_reject_private(&policy, 1, ipv4_list, 0, 0);
  1091. tt_assert(policy);
  1092. tt_int_op(smartlist_len(policy), OP_EQ, 1);
  1093. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  1094. addr_policy_list_free(policy);
  1095. policy = NULL;
  1096. /* test that IPv6 addresses are rejected on an IPv4/IPv6 exit */
  1097. policies_parse_exit_policy_reject_private(&policy, 1, ipv6_list, 0, 0);
  1098. tt_assert(policy);
  1099. tt_int_op(smartlist_len(policy), OP_EQ, 1);
  1100. tt_assert(test_policy_has_address_helper(policy, &ipv6_addr));
  1101. addr_policy_list_free(policy);
  1102. policy = NULL;
  1103. /* test that IPv4 and IPv6 addresses are rejected on an IPv4/IPv6 exit */
  1104. policies_parse_exit_policy_reject_private(&policy, 1, both_list, 0, 0);
  1105. tt_assert(policy);
  1106. tt_int_op(smartlist_len(policy), OP_EQ, 2);
  1107. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  1108. tt_assert(test_policy_has_address_helper(policy, &ipv6_addr));
  1109. addr_policy_list_free(policy);
  1110. policy = NULL;
  1111. /* Test that lists with duplicate entries produce the same results */
  1112. policies_parse_exit_policy_reject_private(&policy, 1, dupl_list, 0, 0);
  1113. tt_assert(policy);
  1114. tt_int_op(smartlist_len(policy), OP_EQ, 2);
  1115. tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
  1116. tt_assert(test_policy_has_address_helper(policy, &ipv6_addr));
  1117. addr_policy_list_free(policy);
  1118. policy = NULL;
  1119. done:
  1120. addr_policy_list_free(policy);
  1121. smartlist_free(ipv4_list);
  1122. smartlist_free(ipv6_list);
  1123. smartlist_free(both_list);
  1124. smartlist_free(dupl_list);
  1125. }
  1126. static smartlist_t *test_configured_ports = NULL;
  1127. /** Returns test_configured_ports */
  1128. static const smartlist_t *
  1129. mock_get_configured_ports(void)
  1130. {
  1131. return test_configured_ports;
  1132. }
  1133. /** Run unit tests for rejecting publicly routable configured port addresses
  1134. * on this exit relay using policies_parse_exit_policy_reject_private */
  1135. static void
  1136. test_policies_reject_port_address(void *arg)
  1137. {
  1138. smartlist_t *policy = NULL;
  1139. port_cfg_t *ipv4_port = NULL;
  1140. port_cfg_t *ipv6_port = NULL;
  1141. (void)arg;
  1142. test_configured_ports = smartlist_new();
  1143. ipv4_port = port_cfg_new(0);
  1144. tor_addr_from_ipv4h(&ipv4_port->addr, TEST_IPV4_ADDR);
  1145. smartlist_add(test_configured_ports, ipv4_port);
  1146. ipv6_port = port_cfg_new(0);
  1147. tor_addr_parse(&ipv6_port->addr, TEST_IPV6_ADDR);
  1148. smartlist_add(test_configured_ports, ipv6_port);
  1149. MOCK(get_configured_ports, mock_get_configured_ports);
  1150. /* test that an IPv4 port is rejected on an IPv4-only exit, but an IPv6 port
  1151. * is NOT rejected (all IPv6 addresses are rejected by
  1152. * policies_parse_exit_policy_internal on IPv4-only exits, so
  1153. * policies_parse_exit_policy_reject_private doesn't need to do anything
  1154. * with IPv6 addresses on IPv4-only exits) */
  1155. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 0, 1);
  1156. tt_assert(policy);
  1157. tt_int_op(smartlist_len(policy), OP_EQ, 1);
  1158. tt_assert(test_policy_has_address_helper(policy, &ipv4_port->addr));
  1159. addr_policy_list_free(policy);
  1160. policy = NULL;
  1161. /* test that IPv4 and IPv6 ports are rejected on an IPv4/IPv6 exit */
  1162. policies_parse_exit_policy_reject_private(&policy, 1, NULL, 0, 1);
  1163. tt_assert(policy);
  1164. tt_int_op(smartlist_len(policy), OP_EQ, 2);
  1165. tt_assert(test_policy_has_address_helper(policy, &ipv4_port->addr));
  1166. tt_assert(test_policy_has_address_helper(policy, &ipv6_port->addr));
  1167. addr_policy_list_free(policy);
  1168. policy = NULL;
  1169. done:
  1170. addr_policy_list_free(policy);
  1171. if (test_configured_ports) {
  1172. SMARTLIST_FOREACH(test_configured_ports,
  1173. port_cfg_t *, p, port_cfg_free(p));
  1174. smartlist_free(test_configured_ports);
  1175. test_configured_ports = NULL;
  1176. }
  1177. UNMOCK(get_configured_ports);
  1178. }
  1179. static smartlist_t *mock_ipv4_addrs = NULL;
  1180. static smartlist_t *mock_ipv6_addrs = NULL;
  1181. /* mock get_interface_address6_list, returning a deep copy of the template
  1182. * address list ipv4_interface_address_list or ipv6_interface_address_list */
  1183. static smartlist_t *
  1184. mock_get_interface_address6_list(int severity,
  1185. sa_family_t family,
  1186. int include_internal)
  1187. {
  1188. (void)severity;
  1189. (void)include_internal;
  1190. smartlist_t *clone_list = smartlist_new();
  1191. smartlist_t *template_list = NULL;
  1192. if (family == AF_INET) {
  1193. template_list = mock_ipv4_addrs;
  1194. } else if (family == AF_INET6) {
  1195. template_list = mock_ipv6_addrs;
  1196. } else {
  1197. return NULL;
  1198. }
  1199. tt_assert(template_list);
  1200. SMARTLIST_FOREACH_BEGIN(template_list, tor_addr_t *, src_addr) {
  1201. tor_addr_t *dest_addr = tor_malloc(sizeof(tor_addr_t));
  1202. memset(dest_addr, 0, sizeof(*dest_addr));
  1203. tor_addr_copy_tight(dest_addr, src_addr);
  1204. smartlist_add(clone_list, dest_addr);
  1205. } SMARTLIST_FOREACH_END(src_addr);
  1206. return clone_list;
  1207. done:
  1208. interface_address6_list_free(clone_list);
  1209. return NULL;
  1210. }
  1211. /** Run unit tests for rejecting publicly routable interface addresses on this
  1212. * exit relay using policies_parse_exit_policy_reject_private */
  1213. static void
  1214. test_policies_reject_interface_address(void *arg)
  1215. {
  1216. smartlist_t *policy = NULL;
  1217. smartlist_t *public_ipv4_addrs =
  1218. get_interface_address6_list(LOG_INFO, AF_INET, 0);
  1219. smartlist_t *public_ipv6_addrs =
  1220. get_interface_address6_list(LOG_INFO, AF_INET6, 0);
  1221. tor_addr_t ipv4_addr, ipv6_addr;
  1222. (void)arg;
  1223. /* test that no addresses are rejected when none are supplied/requested */
  1224. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 0, 0);
  1225. tt_ptr_op(policy, OP_EQ, NULL);
  1226. /* test that only IPv4 interface addresses are rejected on an IPv4-only exit
  1227. * (and allow for duplicates)
  1228. */
  1229. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 1, 0);
  1230. if (policy) {
  1231. tt_assert(smartlist_len(policy) <= smartlist_len(public_ipv4_addrs));
  1232. addr_policy_list_free(policy);
  1233. policy = NULL;
  1234. }
  1235. /* test that IPv4 and IPv6 interface addresses are rejected on an IPv4/IPv6
  1236. * exit (and allow for duplicates) */
  1237. policies_parse_exit_policy_reject_private(&policy, 1, NULL, 1, 0);
  1238. if (policy) {
  1239. tt_assert(smartlist_len(policy) <= (smartlist_len(public_ipv4_addrs)
  1240. + smartlist_len(public_ipv6_addrs)));
  1241. addr_policy_list_free(policy);
  1242. policy = NULL;
  1243. }
  1244. /* Now do it all again, but mocked */
  1245. tor_addr_from_ipv4h(&ipv4_addr, TEST_IPV4_ADDR);
  1246. mock_ipv4_addrs = smartlist_new();
  1247. smartlist_add(mock_ipv4_addrs, (void *)&ipv4_addr);
  1248. tor_addr_parse(&ipv6_addr, TEST_IPV6_ADDR);
  1249. mock_ipv6_addrs = smartlist_new();
  1250. smartlist_add(mock_ipv6_addrs, (void *)&ipv6_addr);
  1251. MOCK(get_interface_address6_list, mock_get_interface_address6_list);
  1252. /* test that no addresses are rejected when none are supplied/requested */
  1253. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 0, 0);
  1254. tt_ptr_op(policy, OP_EQ, NULL);
  1255. /* test that only IPv4 interface addresses are rejected on an IPv4-only exit
  1256. */
  1257. policies_parse_exit_policy_reject_private(&policy, 0, NULL, 1, 0);
  1258. tt_assert(policy);
  1259. tt_assert(smartlist_len(policy) == smartlist_len(mock_ipv4_addrs));
  1260. addr_policy_list_free(policy);
  1261. policy = NULL;
  1262. /* test that IPv4 and IPv6 interface addresses are rejected on an IPv4/IPv6
  1263. * exit */
  1264. policies_parse_exit_policy_reject_private(&policy, 1, NULL, 1, 0);
  1265. tt_assert(policy);
  1266. tt_assert(smartlist_len(policy) == (smartlist_len(mock_ipv4_addrs)
  1267. + smartlist_len(mock_ipv6_addrs)));
  1268. addr_policy_list_free(policy);
  1269. policy = NULL;
  1270. done:
  1271. addr_policy_list_free(policy);
  1272. interface_address6_list_free(public_ipv4_addrs);
  1273. interface_address6_list_free(public_ipv6_addrs);
  1274. UNMOCK(get_interface_address6_list);
  1275. /* we don't use interface_address6_list_free on these lists because their
  1276. * address pointers are stack-based */
  1277. smartlist_free(mock_ipv4_addrs);
  1278. smartlist_free(mock_ipv6_addrs);
  1279. }
  1280. #undef TEST_IPV4_ADDR
  1281. #undef TEST_IPV6_ADDR
  1282. static void
  1283. test_dump_exit_policy_to_string(void *arg)
  1284. {
  1285. char *ep;
  1286. addr_policy_t *policy_entry;
  1287. int malformed_list = -1;
  1288. routerinfo_t *ri = tor_malloc_zero(sizeof(routerinfo_t));
  1289. (void)arg;
  1290. ri->policy_is_reject_star = 1;
  1291. ri->exit_policy = NULL; // expecting "reject *:*"
  1292. ep = router_dump_exit_policy_to_string(ri,1,1);
  1293. tt_str_op("reject *:*",OP_EQ, ep);
  1294. tor_free(ep);
  1295. ri->exit_policy = smartlist_new();
  1296. ri->policy_is_reject_star = 0;
  1297. policy_entry = router_parse_addr_policy_item_from_string("accept *:*", -1,
  1298. &malformed_list);
  1299. smartlist_add(ri->exit_policy,policy_entry);
  1300. ep = router_dump_exit_policy_to_string(ri,1,1);
  1301. tt_str_op("accept *:*",OP_EQ, ep);
  1302. tor_free(ep);
  1303. policy_entry = router_parse_addr_policy_item_from_string("reject *:25", -1,
  1304. &malformed_list);
  1305. smartlist_add(ri->exit_policy,policy_entry);
  1306. ep = router_dump_exit_policy_to_string(ri,1,1);
  1307. tt_str_op("accept *:*\nreject *:25",OP_EQ, ep);
  1308. tor_free(ep);
  1309. policy_entry =
  1310. router_parse_addr_policy_item_from_string("reject 8.8.8.8:*", -1,
  1311. &malformed_list);
  1312. smartlist_add(ri->exit_policy,policy_entry);
  1313. ep = router_dump_exit_policy_to_string(ri,1,1);
  1314. tt_str_op("accept *:*\nreject *:25\nreject 8.8.8.8:*",OP_EQ, ep);
  1315. tor_free(ep);
  1316. policy_entry =
  1317. router_parse_addr_policy_item_from_string("reject6 [FC00::]/7:*", -1,
  1318. &malformed_list);
  1319. smartlist_add(ri->exit_policy,policy_entry);
  1320. ep = router_dump_exit_policy_to_string(ri,1,1);
  1321. tt_str_op("accept *:*\nreject *:25\nreject 8.8.8.8:*\n"
  1322. "reject6 [fc00::]/7:*",OP_EQ, ep);
  1323. tor_free(ep);
  1324. policy_entry =
  1325. router_parse_addr_policy_item_from_string("accept6 [c000::]/3:*", -1,
  1326. &malformed_list);
  1327. smartlist_add(ri->exit_policy,policy_entry);
  1328. ep = router_dump_exit_policy_to_string(ri,1,1);
  1329. tt_str_op("accept *:*\nreject *:25\nreject 8.8.8.8:*\n"
  1330. "reject6 [fc00::]/7:*\naccept6 [c000::]/3:*",OP_EQ, ep);
  1331. done:
  1332. if (ri->exit_policy) {
  1333. SMARTLIST_FOREACH(ri->exit_policy, addr_policy_t *,
  1334. entry, addr_policy_free(entry));
  1335. smartlist_free(ri->exit_policy);
  1336. }
  1337. tor_free(ri);
  1338. tor_free(ep);
  1339. }
  1340. static routerinfo_t *mock_desc_routerinfo = NULL;
  1341. static const routerinfo_t *
  1342. mock_router_get_my_routerinfo(void)
  1343. {
  1344. return mock_desc_routerinfo;
  1345. }
  1346. #define DEFAULT_POLICY_STRING "reject *:*"
  1347. #define TEST_IPV4_ADDR (0x02040608)
  1348. #define TEST_IPV6_ADDR ("2003::ef01")
  1349. static or_options_t mock_options;
  1350. static const or_options_t *
  1351. mock_get_options(void)
  1352. {
  1353. return &mock_options;
  1354. }
  1355. /** Run unit tests for generating summary lines of exit policies */
  1356. static void
  1357. test_policies_getinfo_helper_policies(void *arg)
  1358. {
  1359. (void)arg;
  1360. int rv = 0;
  1361. size_t ipv4_len = 0, ipv6_len = 0;
  1362. char *answer = NULL;
  1363. const char *errmsg = NULL;
  1364. routerinfo_t mock_my_routerinfo;
  1365. memset(&mock_my_routerinfo, 0, sizeof(mock_my_routerinfo));
  1366. rv = getinfo_helper_policies(NULL, "exit-policy/default", &answer, &errmsg);
  1367. tt_int_op(rv, OP_EQ, 0);
  1368. tt_ptr_op(answer, OP_NE, NULL);
  1369. tt_assert(strlen(answer) > 0);
  1370. tor_free(answer);
  1371. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/default",
  1372. &answer, &errmsg);
  1373. tt_int_op(rv, OP_EQ, 0);
  1374. tt_ptr_op(answer, OP_NE, NULL);
  1375. tt_assert(strlen(answer) > 0);
  1376. tor_free(answer);
  1377. memset(&mock_my_routerinfo, 0, sizeof(routerinfo_t));
  1378. MOCK(router_get_my_routerinfo, mock_router_get_my_routerinfo);
  1379. mock_my_routerinfo.exit_policy = smartlist_new();
  1380. mock_desc_routerinfo = &mock_my_routerinfo;
  1381. memset(&mock_options, 0, sizeof(or_options_t));
  1382. MOCK(get_options, mock_get_options);
  1383. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  1384. &answer, &errmsg);
  1385. tt_int_op(rv, OP_EQ, 0);
  1386. tt_ptr_op(answer, OP_NE, NULL);
  1387. tt_assert(strlen(answer) == 0);
  1388. tor_free(answer);
  1389. rv = getinfo_helper_policies(NULL, "exit-policy/ipv4", &answer,
  1390. &errmsg);
  1391. tt_int_op(rv, OP_EQ, 0);
  1392. tt_ptr_op(answer, OP_NE, NULL);
  1393. ipv4_len = strlen(answer);
  1394. tt_assert(ipv4_len == 0 || ipv4_len == strlen(DEFAULT_POLICY_STRING));
  1395. tt_assert(ipv4_len == 0 || !strcasecmp(answer, DEFAULT_POLICY_STRING));
  1396. tor_free(answer);
  1397. rv = getinfo_helper_policies(NULL, "exit-policy/ipv6", &answer,
  1398. &errmsg);
  1399. tt_int_op(rv, OP_EQ, 0);
  1400. tt_ptr_op(answer, OP_NE, NULL);
  1401. ipv6_len = strlen(answer);
  1402. tt_assert(ipv6_len == 0 || ipv6_len == strlen(DEFAULT_POLICY_STRING));
  1403. tt_assert(ipv6_len == 0 || !strcasecmp(answer, DEFAULT_POLICY_STRING));
  1404. tor_free(answer);
  1405. rv = getinfo_helper_policies(NULL, "exit-policy/full", &answer,
  1406. &errmsg);
  1407. tt_int_op(rv, OP_EQ, 0);
  1408. tt_ptr_op(answer, OP_NE, NULL);
  1409. /* It's either empty or it's the default */
  1410. tt_assert(strlen(answer) == 0 || !strcasecmp(answer, DEFAULT_POLICY_STRING));
  1411. tor_free(answer);
  1412. mock_my_routerinfo.addr = TEST_IPV4_ADDR;
  1413. tor_addr_parse(&mock_my_routerinfo.ipv6_addr, TEST_IPV6_ADDR);
  1414. append_exit_policy_string(&mock_my_routerinfo.exit_policy, "accept *4:*");
  1415. append_exit_policy_string(&mock_my_routerinfo.exit_policy, "reject *6:*");
  1416. mock_options.IPv6Exit = 1;
  1417. tor_addr_from_ipv4h(
  1418. &mock_options.OutboundBindAddresses[OUTBOUND_ADDR_EXIT][0],
  1419. TEST_IPV4_ADDR);
  1420. tor_addr_parse(
  1421. &mock_options.OutboundBindAddresses[OUTBOUND_ADDR_EXIT][1],
  1422. TEST_IPV6_ADDR);
  1423. mock_options.ExitPolicyRejectPrivate = 1;
  1424. mock_options.ExitPolicyRejectLocalInterfaces = 1;
  1425. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  1426. &answer, &errmsg);
  1427. tt_int_op(rv, OP_EQ, 0);
  1428. tt_ptr_op(answer, OP_NE, NULL);
  1429. tt_assert(strlen(answer) > 0);
  1430. tor_free(answer);
  1431. mock_options.ExitPolicyRejectPrivate = 1;
  1432. mock_options.ExitPolicyRejectLocalInterfaces = 0;
  1433. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  1434. &answer, &errmsg);
  1435. tt_int_op(rv, OP_EQ, 0);
  1436. tt_ptr_op(answer, OP_NE, NULL);
  1437. tt_assert(strlen(answer) > 0);
  1438. tor_free(answer);
  1439. mock_options.ExitPolicyRejectPrivate = 0;
  1440. mock_options.ExitPolicyRejectLocalInterfaces = 1;
  1441. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  1442. &answer, &errmsg);
  1443. tt_int_op(rv, OP_EQ, 0);
  1444. tt_ptr_op(answer, OP_NE, NULL);
  1445. tt_assert(strlen(answer) > 0);
  1446. tor_free(answer);
  1447. mock_options.ExitPolicyRejectPrivate = 0;
  1448. mock_options.ExitPolicyRejectLocalInterfaces = 0;
  1449. rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
  1450. &answer, &errmsg);
  1451. tt_int_op(rv, OP_EQ, 0);
  1452. tt_ptr_op(answer, OP_NE, NULL);
  1453. tt_assert(strlen(answer) == 0);
  1454. tor_free(answer);
  1455. rv = getinfo_helper_policies(NULL, "exit-policy/ipv4", &answer,
  1456. &errmsg);
  1457. tt_int_op(rv, OP_EQ, 0);
  1458. tt_ptr_op(answer, OP_NE, NULL);
  1459. ipv4_len = strlen(answer);
  1460. tt_assert(ipv4_len > 0);
  1461. tor_free(answer);
  1462. rv = getinfo_helper_policies(NULL, "exit-policy/ipv6", &answer,
  1463. &errmsg);
  1464. tt_int_op(rv, OP_EQ, 0);
  1465. tt_ptr_op(answer, OP_NE, NULL);
  1466. ipv6_len = strlen(answer);
  1467. tt_assert(ipv6_len > 0);
  1468. tor_free(answer);
  1469. rv = getinfo_helper_policies(NULL, "exit-policy/full", &answer,
  1470. &errmsg);
  1471. tt_int_op(rv, OP_EQ, 0);
  1472. tt_ptr_op(answer, OP_NE, NULL);
  1473. tt_assert(strlen(answer) > 0);
  1474. tt_assert(strlen(answer) == ipv4_len + ipv6_len + 1);
  1475. tor_free(answer);
  1476. done:
  1477. tor_free(answer);
  1478. UNMOCK(get_options);
  1479. UNMOCK(router_get_my_routerinfo);
  1480. addr_policy_list_free(mock_my_routerinfo.exit_policy);
  1481. }
  1482. #undef DEFAULT_POLICY_STRING
  1483. #undef TEST_IPV4_ADDR
  1484. #undef TEST_IPV6_ADDR
  1485. #define TEST_IPV4_ADDR_STR "1.2.3.4"
  1486. #define TEST_IPV6_ADDR_STR "[1002::4567]"
  1487. #define REJECT_IPv4_FINAL_STR "reject 0.0.0.0/0:*"
  1488. #define REJECT_IPv6_FINAL_STR "reject [::]/0:*"
  1489. #define OTHER_IPV4_ADDR_STR "6.7.8.9"
  1490. #define OTHER_IPV6_ADDR_STR "[afff::]"
  1491. /** Run unit tests for fascist_firewall_allows_address */
  1492. static void
  1493. test_policies_fascist_firewall_allows_address(void *arg)
  1494. {
  1495. (void)arg;
  1496. tor_addr_t ipv4_addr, ipv6_addr, r_ipv4_addr, r_ipv6_addr;
  1497. tor_addr_t n_ipv4_addr, n_ipv6_addr;
  1498. const uint16_t port = 1234;
  1499. smartlist_t *policy = NULL;
  1500. smartlist_t *e_policy = NULL;
  1501. addr_policy_t *item = NULL;
  1502. int malformed_list = 0;
  1503. /* Setup the options and the items in the policies */
  1504. memset(&mock_options, 0, sizeof(or_options_t));
  1505. MOCK(get_options, mock_get_options);
  1506. policy = smartlist_new();
  1507. item = router_parse_addr_policy_item_from_string("accept "
  1508. TEST_IPV4_ADDR_STR ":*",
  1509. ADDR_POLICY_ACCEPT,
  1510. &malformed_list);
  1511. tt_assert(item);
  1512. tt_assert(!malformed_list);
  1513. smartlist_add(policy, item);
  1514. item = router_parse_addr_policy_item_from_string("accept "
  1515. TEST_IPV6_ADDR_STR,
  1516. ADDR_POLICY_ACCEPT,
  1517. &malformed_list);
  1518. tt_assert(item);
  1519. tt_assert(!malformed_list);
  1520. smartlist_add(policy, item);
  1521. /* Normally, policy_expand_unspec would do this for us */
  1522. item = router_parse_addr_policy_item_from_string(REJECT_IPv4_FINAL_STR,
  1523. ADDR_POLICY_ACCEPT,
  1524. &malformed_list);
  1525. tt_assert(item);
  1526. tt_assert(!malformed_list);
  1527. smartlist_add(policy, item);
  1528. item = router_parse_addr_policy_item_from_string(REJECT_IPv6_FINAL_STR,
  1529. ADDR_POLICY_ACCEPT,
  1530. &malformed_list);
  1531. tt_assert(item);
  1532. tt_assert(!malformed_list);
  1533. smartlist_add(policy, item);
  1534. item = NULL;
  1535. e_policy = smartlist_new();
  1536. /*
  1537. char *polstr = policy_dump_to_string(policy, 1, 1);
  1538. printf("%s\n", polstr);
  1539. tor_free(polstr);
  1540. */
  1541. /* Parse the addresses */
  1542. tor_addr_parse(&ipv4_addr, TEST_IPV4_ADDR_STR);
  1543. tor_addr_parse(&ipv6_addr, TEST_IPV6_ADDR_STR);
  1544. tor_addr_parse(&r_ipv4_addr, OTHER_IPV4_ADDR_STR);
  1545. tor_addr_parse(&r_ipv6_addr, OTHER_IPV6_ADDR_STR);
  1546. tor_addr_make_null(&n_ipv4_addr, AF_INET);
  1547. tor_addr_make_null(&n_ipv6_addr, AF_INET6);
  1548. /* Test the function's address matching with IPv4 and IPv6 on */
  1549. memset(&mock_options, 0, sizeof(or_options_t));
  1550. mock_options.ClientUseIPv4 = 1;
  1551. mock_options.ClientUseIPv6 = 1;
  1552. mock_options.UseBridges = 0;
  1553. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0),
  1554. OP_EQ, 1);
  1555. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0),
  1556. OP_EQ, 1);
  1557. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0),
  1558. OP_EQ, 0);
  1559. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0),
  1560. OP_EQ, 0);
  1561. /* Preferring IPv4 */
  1562. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 1, 0),
  1563. OP_EQ, 1);
  1564. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 1, 0),
  1565. OP_EQ, 0);
  1566. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 1, 0),
  1567. OP_EQ, 0);
  1568. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 1, 0),
  1569. OP_EQ, 0);
  1570. /* Preferring IPv6 */
  1571. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 1, 1),
  1572. OP_EQ, 0);
  1573. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 1, 1),
  1574. OP_EQ, 1);
  1575. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 1, 1),
  1576. OP_EQ, 0);
  1577. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 1, 1),
  1578. OP_EQ, 0);
  1579. /* Test the function's address matching with UseBridges on */
  1580. memset(&mock_options, 0, sizeof(or_options_t));
  1581. mock_options.ClientUseIPv4 = 1;
  1582. mock_options.ClientUseIPv6 = 1;
  1583. mock_options.UseBridges = 1;
  1584. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0),
  1585. OP_EQ, 1);
  1586. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0),
  1587. OP_EQ, 1);
  1588. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0),
  1589. OP_EQ, 0);
  1590. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0),
  1591. OP_EQ, 0);
  1592. /* Preferring IPv4 */
  1593. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 1, 0),
  1594. OP_EQ, 1);
  1595. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 1, 0),
  1596. OP_EQ, 0);
  1597. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 1, 0),
  1598. OP_EQ, 0);
  1599. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 1, 0),
  1600. OP_EQ, 0);
  1601. /* Preferring IPv6 */
  1602. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 1, 1),
  1603. OP_EQ, 0);
  1604. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 1, 1),
  1605. OP_EQ, 1);
  1606. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 1, 1),
  1607. OP_EQ, 0);
  1608. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 1, 1),
  1609. OP_EQ, 0);
  1610. /* bridge clients always use IPv6, regardless of ClientUseIPv6 */
  1611. mock_options.ClientUseIPv4 = 1;
  1612. mock_options.ClientUseIPv6 = 0;
  1613. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0),
  1614. OP_EQ, 1);
  1615. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0),
  1616. OP_EQ, 1);
  1617. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0),
  1618. OP_EQ, 0);
  1619. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0),
  1620. OP_EQ, 0);
  1621. /* Test the function's address matching with IPv4 on */
  1622. memset(&mock_options, 0, sizeof(or_options_t));
  1623. mock_options.ClientUseIPv4 = 1;
  1624. mock_options.ClientUseIPv6 = 0;
  1625. mock_options.UseBridges = 0;
  1626. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0),
  1627. OP_EQ, 1);
  1628. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0),
  1629. OP_EQ, 0);
  1630. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0),
  1631. OP_EQ, 0);
  1632. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0),
  1633. OP_EQ, 0);
  1634. /* Test the function's address matching with IPv6 on */
  1635. memset(&mock_options, 0, sizeof(or_options_t));
  1636. mock_options.ClientUseIPv4 = 0;
  1637. mock_options.ClientUseIPv6 = 1;
  1638. mock_options.UseBridges = 0;
  1639. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0),
  1640. OP_EQ, 0);
  1641. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0),
  1642. OP_EQ, 1);
  1643. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0),
  1644. OP_EQ, 0);
  1645. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0),
  1646. OP_EQ, 0);
  1647. /* Test the function's address matching with ClientUseIPv4 0.
  1648. * This means "use IPv6" regardless of the other settings. */
  1649. memset(&mock_options, 0, sizeof(or_options_t));
  1650. mock_options.ClientUseIPv4 = 0;
  1651. mock_options.ClientUseIPv6 = 0;
  1652. mock_options.UseBridges = 0;
  1653. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, policy, 0, 0),
  1654. OP_EQ, 0);
  1655. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, policy, 0, 0),
  1656. OP_EQ, 1);
  1657. tt_int_op(fascist_firewall_allows_address(&r_ipv4_addr, port, policy, 0, 0),
  1658. OP_EQ, 0);
  1659. tt_int_op(fascist_firewall_allows_address(&r_ipv6_addr, port, policy, 0, 0),
  1660. OP_EQ, 0);
  1661. /* Test the function's address matching for unusual inputs */
  1662. memset(&mock_options, 0, sizeof(or_options_t));
  1663. mock_options.ClientUseIPv4 = 1;
  1664. mock_options.ClientUseIPv6 = 1;
  1665. mock_options.UseBridges = 1;
  1666. /* NULL and tor_addr_is_null addresses are rejected */
  1667. tt_int_op(fascist_firewall_allows_address(NULL, port, policy, 0, 0), OP_EQ,
  1668. 0);
  1669. tt_int_op(fascist_firewall_allows_address(&n_ipv4_addr, port, policy, 0, 0),
  1670. OP_EQ, 0);
  1671. tt_int_op(fascist_firewall_allows_address(&n_ipv6_addr, port, policy, 0, 0),
  1672. OP_EQ, 0);
  1673. /* zero ports are rejected */
  1674. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, 0, policy, 0, 0),
  1675. OP_EQ, 0);
  1676. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, 0, policy, 0, 0),
  1677. OP_EQ, 0);
  1678. /* NULL and empty policies accept everything */
  1679. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, NULL, 0, 0),
  1680. OP_EQ, 1);
  1681. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, NULL, 0, 0),
  1682. OP_EQ, 1);
  1683. tt_int_op(fascist_firewall_allows_address(&ipv4_addr, port, e_policy, 0, 0),
  1684. OP_EQ, 1);
  1685. tt_int_op(fascist_firewall_allows_address(&ipv6_addr, port, e_policy, 0, 0),
  1686. OP_EQ, 1);
  1687. done:
  1688. addr_policy_free(item);
  1689. addr_policy_list_free(policy);
  1690. addr_policy_list_free(e_policy);
  1691. UNMOCK(get_options);
  1692. }
  1693. #undef REJECT_IPv4_FINAL_STR
  1694. #undef REJECT_IPv6_FINAL_STR
  1695. #undef OTHER_IPV4_ADDR_STR
  1696. #undef OTHER_IPV6_ADDR_STR
  1697. #define TEST_IPV4_OR_PORT 1234
  1698. #define TEST_IPV4_DIR_PORT 2345
  1699. #define TEST_IPV6_OR_PORT 61234
  1700. #define TEST_IPV6_DIR_PORT 62345
  1701. /* Check that fascist_firewall_choose_address_rs() returns the expected
  1702. * results. */
  1703. #define CHECK_CHOSEN_ADDR_RS(fake_rs, fw_connection, pref_only, expect_rv, \
  1704. expect_ap) \
  1705. STMT_BEGIN \
  1706. tor_addr_port_t chosen_rs_ap; \
  1707. tor_addr_make_null(&chosen_rs_ap.addr, AF_INET); \
  1708. chosen_rs_ap.port = 0; \
  1709. tt_int_op(fascist_firewall_choose_address_rs(&(fake_rs), \
  1710. (fw_connection), \
  1711. (pref_only), \
  1712. &chosen_rs_ap), \
  1713. OP_EQ, (expect_rv)); \
  1714. tt_assert(tor_addr_eq(&(expect_ap).addr, &chosen_rs_ap.addr)); \
  1715. tt_int_op((expect_ap).port, OP_EQ, chosen_rs_ap.port); \
  1716. STMT_END
  1717. /* Check that fascist_firewall_choose_address_node() returns the expected
  1718. * results. */
  1719. #define CHECK_CHOSEN_ADDR_NODE(fake_node, fw_connection, pref_only, \
  1720. expect_rv, expect_ap) \
  1721. STMT_BEGIN \
  1722. tor_addr_port_t chosen_node_ap; \
  1723. tor_addr_make_null(&chosen_node_ap.addr, AF_INET); \
  1724. chosen_node_ap.port = 0; \
  1725. tt_int_op(fascist_firewall_choose_address_node(&(fake_node), \
  1726. (fw_connection), \
  1727. (pref_only), \
  1728. &chosen_node_ap), \
  1729. OP_EQ, (expect_rv)); \
  1730. tt_assert(tor_addr_eq(&(expect_ap).addr, &chosen_node_ap.addr)); \
  1731. tt_int_op((expect_ap).port, OP_EQ, chosen_node_ap.port); \
  1732. STMT_END
  1733. /* Check that fascist_firewall_choose_address_rs and
  1734. * fascist_firewall_choose_address_node() both return the expected results. */
  1735. #define CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, fw_connection, pref_only, \
  1736. expect_rv, expect_ap) \
  1737. STMT_BEGIN \
  1738. CHECK_CHOSEN_ADDR_RS(fake_rs, fw_connection, pref_only, expect_rv, \
  1739. expect_ap); \
  1740. CHECK_CHOSEN_ADDR_NODE(fake_node, fw_connection, pref_only, expect_rv, \
  1741. expect_ap); \
  1742. STMT_END
  1743. /** Run unit tests for fascist_firewall_choose_address */
  1744. static void
  1745. test_policies_fascist_firewall_choose_address(void *arg)
  1746. {
  1747. (void)arg;
  1748. tor_addr_port_t ipv4_or_ap, ipv4_dir_ap, ipv6_or_ap, ipv6_dir_ap;
  1749. tor_addr_port_t n_ipv4_ap, n_ipv6_ap;
  1750. /* Setup the options */
  1751. memset(&mock_options, 0, sizeof(or_options_t));
  1752. MOCK(get_options, mock_get_options);
  1753. /* Parse the addresses */
  1754. tor_addr_parse(&ipv4_or_ap.addr, TEST_IPV4_ADDR_STR);
  1755. ipv4_or_ap.port = TEST_IPV4_OR_PORT;
  1756. tor_addr_parse(&ipv4_dir_ap.addr, TEST_IPV4_ADDR_STR);
  1757. ipv4_dir_ap.port = TEST_IPV4_DIR_PORT;
  1758. tor_addr_parse(&ipv6_or_ap.addr, TEST_IPV6_ADDR_STR);
  1759. ipv6_or_ap.port = TEST_IPV6_OR_PORT;
  1760. tor_addr_parse(&ipv6_dir_ap.addr, TEST_IPV6_ADDR_STR);
  1761. ipv6_dir_ap.port = TEST_IPV6_DIR_PORT;
  1762. tor_addr_make_null(&n_ipv4_ap.addr, AF_INET);
  1763. n_ipv4_ap.port = 0;
  1764. tor_addr_make_null(&n_ipv6_ap.addr, AF_INET6);
  1765. n_ipv6_ap.port = 0;
  1766. /* Sanity check fascist_firewall_choose_address with IPv4 and IPv6 on */
  1767. memset(&mock_options, 0, sizeof(or_options_t));
  1768. mock_options.ClientUseIPv4 = 1;
  1769. mock_options.ClientUseIPv6 = 1;
  1770. mock_options.UseBridges = 0;
  1771. /* Prefer IPv4 */
  1772. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 1,
  1773. FIREWALL_OR_CONNECTION, 0, 0)
  1774. == &ipv4_or_ap);
  1775. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 1,
  1776. FIREWALL_OR_CONNECTION, 1, 0)
  1777. == &ipv4_or_ap);
  1778. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &ipv6_dir_ap, 1,
  1779. FIREWALL_DIR_CONNECTION, 0, 0)
  1780. == &ipv4_dir_ap);
  1781. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &ipv6_dir_ap, 1,
  1782. FIREWALL_DIR_CONNECTION, 1, 0)
  1783. == &ipv4_dir_ap);
  1784. /* Prefer IPv6 */
  1785. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 0,
  1786. FIREWALL_OR_CONNECTION, 0, 1)
  1787. == &ipv6_or_ap);
  1788. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 0,
  1789. FIREWALL_OR_CONNECTION, 1, 1)
  1790. == &ipv6_or_ap);
  1791. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &ipv6_dir_ap, 0,
  1792. FIREWALL_DIR_CONNECTION, 0, 1)
  1793. == &ipv6_dir_ap);
  1794. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &ipv6_dir_ap, 0,
  1795. FIREWALL_DIR_CONNECTION, 1, 1)
  1796. == &ipv6_dir_ap);
  1797. /* Unusual inputs */
  1798. /* null preferred OR addresses */
  1799. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &n_ipv6_ap, 0,
  1800. FIREWALL_OR_CONNECTION, 0, 1)
  1801. == &ipv4_or_ap);
  1802. tt_assert(fascist_firewall_choose_address(&n_ipv4_ap, &ipv6_or_ap, 1,
  1803. FIREWALL_OR_CONNECTION, 0, 0)
  1804. == &ipv6_or_ap);
  1805. /* null both OR addresses */
  1806. tt_ptr_op(fascist_firewall_choose_address(&n_ipv4_ap, &n_ipv6_ap, 0,
  1807. FIREWALL_OR_CONNECTION, 0, 1),
  1808. OP_EQ, NULL);
  1809. tt_ptr_op(fascist_firewall_choose_address(&n_ipv4_ap, &n_ipv6_ap, 1,
  1810. FIREWALL_OR_CONNECTION, 0, 0),
  1811. OP_EQ, NULL);
  1812. /* null preferred Dir addresses */
  1813. tt_assert(fascist_firewall_choose_address(&ipv4_dir_ap, &n_ipv6_ap, 0,
  1814. FIREWALL_DIR_CONNECTION, 0, 1)
  1815. == &ipv4_dir_ap);
  1816. tt_assert(fascist_firewall_choose_address(&n_ipv4_ap, &ipv6_dir_ap, 1,
  1817. FIREWALL_DIR_CONNECTION, 0, 0)
  1818. == &ipv6_dir_ap);
  1819. /* null both Dir addresses */
  1820. tt_ptr_op(fascist_firewall_choose_address(&n_ipv4_ap, &n_ipv6_ap, 0,
  1821. FIREWALL_DIR_CONNECTION, 0, 1),
  1822. OP_EQ, NULL);
  1823. tt_ptr_op(fascist_firewall_choose_address(&n_ipv4_ap, &n_ipv6_ap, 1,
  1824. FIREWALL_DIR_CONNECTION, 0, 0),
  1825. OP_EQ, NULL);
  1826. /* Prefer IPv4 but want IPv6 (contradictory) */
  1827. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 0,
  1828. FIREWALL_OR_CONNECTION, 0, 0)
  1829. == &ipv4_or_ap);
  1830. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 0,
  1831. FIREWALL_OR_CONNECTION, 1, 0)
  1832. == &ipv4_or_ap);
  1833. /* Prefer IPv6 but want IPv4 (contradictory) */
  1834. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 1,
  1835. FIREWALL_OR_CONNECTION, 0, 1)
  1836. == &ipv6_or_ap);
  1837. tt_assert(fascist_firewall_choose_address(&ipv4_or_ap, &ipv6_or_ap, 1,
  1838. FIREWALL_OR_CONNECTION, 1, 1)
  1839. == &ipv6_or_ap);
  1840. /* Make a fake rs. There will be no corresponding node.
  1841. * This is what happens when there's no consensus and we're bootstrapping
  1842. * from authorities / fallbacks. */
  1843. routerstatus_t fake_rs;
  1844. memset(&fake_rs, 0, sizeof(routerstatus_t));
  1845. /* In a routerstatus, the OR and Dir addresses are the same */
  1846. fake_rs.addr = tor_addr_to_ipv4h(&ipv4_or_ap.addr);
  1847. fake_rs.or_port = ipv4_or_ap.port;
  1848. fake_rs.dir_port = ipv4_dir_ap.port;
  1849. tor_addr_copy(&fake_rs.ipv6_addr, &ipv6_or_ap.addr);
  1850. fake_rs.ipv6_orport = ipv6_or_ap.port;
  1851. /* In a routerstatus, the IPv4 and IPv6 DirPorts are the same.*/
  1852. ipv6_dir_ap.port = TEST_IPV4_DIR_PORT;
  1853. /* Make a fake node. Even though it contains the fake_rs, a lookup won't
  1854. * find the node from the rs, because they're not in the hash table. */
  1855. node_t fake_node;
  1856. memset(&fake_node, 0, sizeof(node_t));
  1857. fake_node.rs = &fake_rs;
  1858. /* Choose an address with IPv4 and IPv6 on */
  1859. memset(&mock_options, 0, sizeof(or_options_t));
  1860. mock_options.ClientUseIPv4 = 1;
  1861. mock_options.ClientUseIPv6 = 1;
  1862. mock_options.UseBridges = 0;
  1863. /* Preferring IPv4 */
  1864. mock_options.ClientPreferIPv6ORPort = 0;
  1865. mock_options.ClientPreferIPv6DirPort = 0;
  1866. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1867. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1868. &mock_options);
  1869. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1870. ipv4_or_ap);
  1871. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1872. ipv4_or_ap);
  1873. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1874. ipv4_dir_ap);
  1875. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1876. ipv4_dir_ap);
  1877. /* Auto (Preferring IPv4) */
  1878. mock_options.ClientPreferIPv6ORPort = -1;
  1879. mock_options.ClientPreferIPv6DirPort = -1;
  1880. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1881. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1882. &mock_options);
  1883. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1884. ipv4_or_ap);
  1885. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1886. ipv4_or_ap);
  1887. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1888. ipv4_dir_ap);
  1889. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1890. ipv4_dir_ap);
  1891. /* Preferring IPv6 */
  1892. mock_options.ClientPreferIPv6ORPort = 1;
  1893. mock_options.ClientPreferIPv6DirPort = 1;
  1894. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1895. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1896. &mock_options);
  1897. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1898. ipv6_or_ap);
  1899. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1900. ipv6_or_ap);
  1901. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1902. ipv6_dir_ap);
  1903. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1904. ipv6_dir_ap);
  1905. /* Preferring IPv4 OR / IPv6 Dir */
  1906. mock_options.ClientPreferIPv6ORPort = 0;
  1907. mock_options.ClientPreferIPv6DirPort = 1;
  1908. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1909. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1910. &mock_options);
  1911. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1912. ipv4_or_ap);
  1913. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1914. ipv4_or_ap);
  1915. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1916. ipv6_dir_ap);
  1917. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1918. ipv6_dir_ap);
  1919. /* Preferring IPv6 OR / IPv4 Dir */
  1920. mock_options.ClientPreferIPv6ORPort = 1;
  1921. mock_options.ClientPreferIPv6DirPort = 0;
  1922. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1923. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1924. &mock_options);
  1925. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1926. ipv6_or_ap);
  1927. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1928. ipv6_or_ap);
  1929. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1930. ipv4_dir_ap);
  1931. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1932. ipv4_dir_ap);
  1933. /* Choose an address with UseBridges on */
  1934. memset(&mock_options, 0, sizeof(or_options_t));
  1935. mock_options.UseBridges = 1;
  1936. mock_options.ClientUseIPv4 = 1;
  1937. mock_options.ClientUseIPv6 = 1;
  1938. /* Preferring IPv4 */
  1939. mock_options.ClientPreferIPv6ORPort = 0;
  1940. mock_options.ClientPreferIPv6DirPort = 0;
  1941. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1942. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1943. &mock_options);
  1944. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1945. ipv4_or_ap);
  1946. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1947. ipv4_or_ap);
  1948. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1949. ipv4_dir_ap);
  1950. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1951. ipv4_dir_ap);
  1952. /* Auto:
  1953. * - bridge clients prefer the configured bridge OR address from the node,
  1954. * (the configured address family sets node.ipv6_preferred)
  1955. * - other clients prefer IPv4 OR by default (see above),
  1956. * - all clients, including bridge clients, prefer IPv4 Dir by default.
  1957. */
  1958. mock_options.ClientPreferIPv6ORPort = -1;
  1959. mock_options.ClientPreferIPv6DirPort = -1;
  1960. /* Simulate the initialisation of fake_node.ipv6_preferred with a bridge
  1961. * configured with an IPv4 address */
  1962. fake_node.ipv6_preferred = 0;
  1963. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 0, 1, ipv4_or_ap);
  1964. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 1, 1, ipv4_or_ap);
  1965. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1966. ipv4_dir_ap);
  1967. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1968. ipv4_dir_ap);
  1969. /* Simulate the initialisation of fake_node.ipv6_preferred with a bridge
  1970. * configured with an IPv6 address */
  1971. fake_node.ipv6_preferred = 1;
  1972. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 0, 1, ipv6_or_ap);
  1973. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 1, 1, ipv6_or_ap);
  1974. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1975. ipv4_dir_ap);
  1976. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1977. ipv4_dir_ap);
  1978. /* When a rs has no node, it defaults to IPv4 under auto. */
  1979. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_OR_CONNECTION, 0, 1, ipv4_or_ap);
  1980. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_OR_CONNECTION, 1, 1, ipv4_or_ap);
  1981. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_DIR_CONNECTION, 0, 1, ipv4_dir_ap);
  1982. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_DIR_CONNECTION, 1, 1, ipv4_dir_ap);
  1983. /* Preferring IPv6 */
  1984. mock_options.ClientPreferIPv6ORPort = 1;
  1985. mock_options.ClientPreferIPv6DirPort = 1;
  1986. /* Simulate the initialisation of fake_node.ipv6_preferred */
  1987. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  1988. &mock_options);
  1989. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  1990. ipv6_or_ap);
  1991. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  1992. ipv6_or_ap);
  1993. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  1994. ipv6_dir_ap);
  1995. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  1996. ipv6_dir_ap);
  1997. /* In the default configuration (Auto / IPv6 off), bridge clients should
  1998. * use both IPv4 and IPv6, but only prefer IPv6 for bridges configured with
  1999. * an IPv6 address, regardless of ClientUseIPv6. (See above.) */
  2000. mock_options.ClientUseIPv6 = 0;
  2001. mock_options.ClientPreferIPv6ORPort = -1;
  2002. mock_options.ClientPreferIPv6DirPort = -1;
  2003. /* Simulate the initialisation of fake_node.ipv6_preferred with a bridge
  2004. * configured with an IPv4 address */
  2005. fake_node.ipv6_preferred = 0;
  2006. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 0, 1, ipv4_or_ap);
  2007. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 1, 1, ipv4_or_ap);
  2008. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  2009. ipv4_dir_ap);
  2010. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  2011. ipv4_dir_ap);
  2012. /* Simulate the initialisation of fake_node.ipv6_preferred with a bridge
  2013. * configured with an IPv6 address */
  2014. fake_node.ipv6_preferred = 1;
  2015. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 0, 1, ipv6_or_ap);
  2016. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_OR_CONNECTION, 1, 1, ipv6_or_ap);
  2017. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  2018. ipv4_dir_ap);
  2019. CHECK_CHOSEN_ADDR_NODE(fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  2020. ipv4_dir_ap);
  2021. /* When a rs has no node, it defaults to IPv4 under auto. */
  2022. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_OR_CONNECTION, 0, 1, ipv4_or_ap);
  2023. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_OR_CONNECTION, 1, 1, ipv4_or_ap);
  2024. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_DIR_CONNECTION, 0, 1, ipv4_dir_ap);
  2025. CHECK_CHOSEN_ADDR_RS(fake_rs, FIREWALL_DIR_CONNECTION, 1, 1, ipv4_dir_ap);
  2026. /* Choose an address with IPv4 on */
  2027. memset(&mock_options, 0, sizeof(or_options_t));
  2028. mock_options.ClientUseIPv4 = 1;
  2029. mock_options.ClientUseIPv6 = 0;
  2030. /* Simulate the initialisation of fake_node.ipv6_preferred */
  2031. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  2032. &mock_options);
  2033. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  2034. ipv4_or_ap);
  2035. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  2036. ipv4_or_ap);
  2037. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  2038. ipv4_dir_ap);
  2039. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  2040. ipv4_dir_ap);
  2041. /* Choose an address with IPv6 on */
  2042. memset(&mock_options, 0, sizeof(or_options_t));
  2043. mock_options.ClientUseIPv4 = 0;
  2044. mock_options.ClientUseIPv6 = 1;
  2045. /* Simulate the initialisation of fake_node.ipv6_preferred */
  2046. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  2047. &mock_options);
  2048. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  2049. ipv6_or_ap);
  2050. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  2051. ipv6_or_ap);
  2052. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  2053. ipv6_dir_ap);
  2054. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  2055. ipv6_dir_ap);
  2056. /* Choose an address with ClientUseIPv4 0.
  2057. * This means "use IPv6" regardless of the other settings. */
  2058. memset(&mock_options, 0, sizeof(or_options_t));
  2059. mock_options.ClientUseIPv4 = 0;
  2060. mock_options.ClientUseIPv6 = 0;
  2061. /* Simulate the initialisation of fake_node.ipv6_preferred */
  2062. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  2063. &mock_options);
  2064. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  2065. ipv6_or_ap);
  2066. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  2067. ipv6_or_ap);
  2068. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  2069. ipv6_dir_ap);
  2070. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  2071. ipv6_dir_ap);
  2072. /* Choose an address with ORPort_set 1 (server mode).
  2073. * This means "use IPv4" regardless of the other settings. */
  2074. memset(&mock_options, 0, sizeof(or_options_t));
  2075. mock_options.ORPort_set = 1;
  2076. mock_options.ClientUseIPv4 = 0;
  2077. mock_options.ClientUseIPv6 = 1;
  2078. mock_options.ClientPreferIPv6ORPort = 1;
  2079. mock_options.ClientPreferIPv6DirPort = 1;
  2080. /* Simulate the initialisation of fake_node.ipv6_preferred */
  2081. fake_node.ipv6_preferred = fascist_firewall_prefer_ipv6_orport(
  2082. &mock_options);
  2083. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 0, 1,
  2084. ipv4_or_ap);
  2085. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_OR_CONNECTION, 1, 1,
  2086. ipv4_or_ap);
  2087. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 0, 1,
  2088. ipv4_dir_ap);
  2089. CHECK_CHOSEN_ADDR_RN(fake_rs, fake_node, FIREWALL_DIR_CONNECTION, 1, 1,
  2090. ipv4_dir_ap);
  2091. done:
  2092. UNMOCK(get_options);
  2093. }
  2094. #undef TEST_IPV4_ADDR_STR
  2095. #undef TEST_IPV6_ADDR_STR
  2096. #undef TEST_IPV4_OR_PORT
  2097. #undef TEST_IPV4_DIR_PORT
  2098. #undef TEST_IPV6_OR_PORT
  2099. #undef TEST_IPV6_DIR_PORT
  2100. #undef CHECK_CHOSEN_ADDR_RS
  2101. #undef CHECK_CHOSEN_ADDR_NODE
  2102. #undef CHECK_CHOSEN_ADDR_RN
  2103. struct testcase_t policy_tests[] = {
  2104. { "router_dump_exit_policy_to_string", test_dump_exit_policy_to_string, 0,
  2105. NULL, NULL },
  2106. { "general", test_policies_general, 0, NULL, NULL },
  2107. { "getinfo_helper_policies", test_policies_getinfo_helper_policies, 0, NULL,
  2108. NULL },
  2109. { "reject_exit_address", test_policies_reject_exit_address, 0, NULL, NULL },
  2110. { "reject_interface_address", test_policies_reject_interface_address, 0,
  2111. NULL, NULL },
  2112. { "reject_port_address", test_policies_reject_port_address, 0, NULL, NULL },
  2113. { "fascist_firewall_allows_address",
  2114. test_policies_fascist_firewall_allows_address, 0, NULL, NULL },
  2115. { "fascist_firewall_choose_address",
  2116. test_policies_fascist_firewall_choose_address, 0, NULL, NULL },
  2117. END_OF_TESTCASES
  2118. };