123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975 |
- /* Copyright (c) 2013-2015, The Tor Project, Inc. */
- /* See LICENSE for licensing information */
- #include "or.h"
- #define CONFIG_PRIVATE
- #include "config.h"
- #include "router.h"
- #include "routerparse.h"
- #define POLICIES_PRIVATE
- #include "policies.h"
- #include "test.h"
- /* Helper: assert that short_policy parses and writes back out as itself,
- or as <b>expected</b> if that's provided. */
- static void
- test_short_policy_parse(const char *input,
- const char *expected)
- {
- short_policy_t *short_policy = NULL;
- char *out = NULL;
- if (expected == NULL)
- expected = input;
- short_policy = parse_short_policy(input);
- tt_assert(short_policy);
- out = write_short_policy(short_policy);
- tt_str_op(out, OP_EQ, expected);
- done:
- tor_free(out);
- short_policy_free(short_policy);
- }
- /** Helper: Parse the exit policy string in <b>policy_str</b>, and make sure
- * that policies_summarize() produces the string <b>expected_summary</b> from
- * it. */
- static void
- test_policy_summary_helper(const char *policy_str,
- const char *expected_summary)
- {
- config_line_t line;
- smartlist_t *policy = smartlist_new();
- char *summary = NULL;
- char *summary_after = NULL;
- int r;
- short_policy_t *short_policy = NULL;
- line.key = (char*)"foo";
- line.value = (char *)policy_str;
- line.next = NULL;
- r = policies_parse_exit_policy(&line, &policy,
- EXIT_POLICY_IPV6_ENABLED |
- EXIT_POLICY_ADD_DEFAULT, NULL);
- tt_int_op(r,OP_EQ, 0);
- summary = policy_summarize(policy, AF_INET);
- tt_assert(summary != NULL);
- tt_str_op(summary,OP_EQ, expected_summary);
- short_policy = parse_short_policy(summary);
- tt_assert(short_policy);
- summary_after = write_short_policy(short_policy);
- tt_str_op(summary,OP_EQ, summary_after);
- done:
- tor_free(summary_after);
- tor_free(summary);
- if (policy)
- addr_policy_list_free(policy);
- short_policy_free(short_policy);
- }
- /** Run unit tests for generating summary lines of exit policies */
- static void
- test_policies_general(void *arg)
- {
- int i;
- smartlist_t *policy = NULL, *policy2 = NULL, *policy3 = NULL,
- *policy4 = NULL, *policy5 = NULL, *policy6 = NULL,
- *policy7 = NULL, *policy8 = NULL, *policy9 = NULL,
- *policy10 = NULL, *policy11 = NULL, *policy12 = NULL;
- addr_policy_t *p;
- tor_addr_t tar, tar2;
- smartlist_t *addr_list = NULL;
- config_line_t line;
- smartlist_t *sm = NULL;
- char *policy_str = NULL;
- short_policy_t *short_parsed = NULL;
- int malformed_list = -1;
- (void)arg;
- policy = smartlist_new();
- p = router_parse_addr_policy_item_from_string("reject 192.168.0.0/16:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- tt_int_op(ADDR_POLICY_REJECT,OP_EQ, p->policy_type);
- tor_addr_from_ipv4h(&tar, 0xc0a80000u);
- tt_int_op(0,OP_EQ, tor_addr_compare(&p->addr, &tar, CMP_EXACT));
- tt_int_op(16,OP_EQ, p->maskbits);
- tt_int_op(1,OP_EQ, p->prt_min);
- tt_int_op(65535,OP_EQ, p->prt_max);
- smartlist_add(policy, p);
- tor_addr_from_ipv4h(&tar, 0x01020304u);
- tt_assert(ADDR_POLICY_ACCEPTED ==
- compare_tor_addr_to_addr_policy(&tar, 2, policy));
- tor_addr_make_unspec(&tar);
- tt_assert(ADDR_POLICY_PROBABLY_ACCEPTED ==
- compare_tor_addr_to_addr_policy(&tar, 2, policy));
- tor_addr_from_ipv4h(&tar, 0xc0a80102);
- tt_assert(ADDR_POLICY_REJECTED ==
- compare_tor_addr_to_addr_policy(&tar, 2, policy));
- tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy2,
- EXIT_POLICY_IPV6_ENABLED |
- EXIT_POLICY_REJECT_PRIVATE |
- EXIT_POLICY_ADD_DEFAULT, NULL));
- tt_assert(policy2);
- tor_addr_from_ipv4h(&tar, 0x0306090cu);
- tor_addr_parse(&tar2, "[2000::1234]");
- addr_list = smartlist_new();
- smartlist_add(addr_list, &tar);
- smartlist_add(addr_list, &tar2);
- tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy12,
- EXIT_POLICY_IPV6_ENABLED |
- EXIT_POLICY_REJECT_PRIVATE |
- EXIT_POLICY_ADD_DEFAULT,
- addr_list));
- smartlist_free(addr_list);
- addr_list = NULL;
- tt_assert(policy12);
- policy3 = smartlist_new();
- p = router_parse_addr_policy_item_from_string("reject *:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy3, p);
- p = router_parse_addr_policy_item_from_string("accept *:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy3, p);
- policy4 = smartlist_new();
- p = router_parse_addr_policy_item_from_string("accept *:443", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy4, p);
- p = router_parse_addr_policy_item_from_string("accept *:443", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy4, p);
- policy5 = smartlist_new();
- p = router_parse_addr_policy_item_from_string("reject 0.0.0.0/8:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- p = router_parse_addr_policy_item_from_string("reject 169.254.0.0/16:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- p = router_parse_addr_policy_item_from_string("reject 127.0.0.0/8:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- p = router_parse_addr_policy_item_from_string("reject 192.168.0.0/16:*",
- -1, &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- p = router_parse_addr_policy_item_from_string("reject 10.0.0.0/8:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- p = router_parse_addr_policy_item_from_string("reject 172.16.0.0/12:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- p = router_parse_addr_policy_item_from_string("reject 80.190.250.90:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- p = router_parse_addr_policy_item_from_string("reject *:1-65534", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- p = router_parse_addr_policy_item_from_string("reject *:65535", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- p = router_parse_addr_policy_item_from_string("accept *:1-65535", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy5, p);
- policy6 = smartlist_new();
- p = router_parse_addr_policy_item_from_string("accept 43.3.0.0/9:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy6, p);
- policy7 = smartlist_new();
- p = router_parse_addr_policy_item_from_string("accept 0.0.0.0/8:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy7, p);
- tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy8,
- EXIT_POLICY_IPV6_ENABLED |
- EXIT_POLICY_REJECT_PRIVATE |
- EXIT_POLICY_ADD_DEFAULT,
- NULL));
- tt_assert(policy8);
- tt_int_op(0, OP_EQ, policies_parse_exit_policy(NULL, &policy9,
- EXIT_POLICY_REJECT_PRIVATE |
- EXIT_POLICY_ADD_DEFAULT,
- NULL));
- tt_assert(policy9);
- /* accept6 * and reject6 * produce IPv6 wildcards only */
- policy10 = smartlist_new();
- p = router_parse_addr_policy_item_from_string("accept6 *:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy10, p);
- policy11 = smartlist_new();
- p = router_parse_addr_policy_item_from_string("reject6 *:*", -1,
- &malformed_list);
- tt_assert(p != NULL);
- smartlist_add(policy11, p);
- tt_assert(!exit_policy_is_general_exit(policy));
- tt_assert(exit_policy_is_general_exit(policy2));
- tt_assert(!exit_policy_is_general_exit(NULL));
- tt_assert(!exit_policy_is_general_exit(policy3));
- tt_assert(!exit_policy_is_general_exit(policy4));
- tt_assert(!exit_policy_is_general_exit(policy5));
- tt_assert(!exit_policy_is_general_exit(policy6));
- tt_assert(!exit_policy_is_general_exit(policy7));
- tt_assert(exit_policy_is_general_exit(policy8));
- tt_assert(exit_policy_is_general_exit(policy9));
- tt_assert(!exit_policy_is_general_exit(policy10));
- tt_assert(!exit_policy_is_general_exit(policy11));
- tt_assert(cmp_addr_policies(policy, policy2));
- tt_assert(cmp_addr_policies(policy, NULL));
- tt_assert(!cmp_addr_policies(policy2, policy2));
- tt_assert(!cmp_addr_policies(NULL, NULL));
- tt_assert(!policy_is_reject_star(policy2, AF_INET));
- tt_assert(policy_is_reject_star(policy, AF_INET));
- tt_assert(policy_is_reject_star(policy10, AF_INET));
- tt_assert(!policy_is_reject_star(policy10, AF_INET6));
- tt_assert(policy_is_reject_star(policy11, AF_INET));
- tt_assert(policy_is_reject_star(policy11, AF_INET6));
- tt_assert(policy_is_reject_star(NULL, AF_INET));
- tt_assert(policy_is_reject_star(NULL, AF_INET6));
- addr_policy_list_free(policy);
- policy = NULL;
- /* make sure compacting logic works. */
- policy = NULL;
- line.key = (char*)"foo";
- line.value = (char*)"accept *:80,reject private:*,reject *:*";
- line.next = NULL;
- tt_int_op(0, OP_EQ, policies_parse_exit_policy(&line,&policy,
- EXIT_POLICY_IPV6_ENABLED |
- EXIT_POLICY_ADD_DEFAULT, NULL));
- tt_assert(policy);
- //test_streq(policy->string, "accept *:80");
- //test_streq(policy->next->string, "reject *:*");
- tt_int_op(smartlist_len(policy),OP_EQ, 4);
- /* test policy summaries */
- /* check if we properly ignore private IP addresses */
- test_policy_summary_helper("reject 192.168.0.0/16:*,"
- "reject 0.0.0.0/8:*,"
- "reject 10.0.0.0/8:*,"
- "accept *:10-30,"
- "accept *:90,"
- "reject *:*",
- "accept 10-30,90");
- /* check all accept policies, and proper counting of rejects */
- test_policy_summary_helper("reject 11.0.0.0/9:80,"
- "reject 12.0.0.0/9:80,"
- "reject 13.0.0.0/9:80,"
- "reject 14.0.0.0/9:80,"
- "accept *:*", "accept 1-65535");
- test_policy_summary_helper("reject 11.0.0.0/9:80,"
- "reject 12.0.0.0/9:80,"
- "reject 13.0.0.0/9:80,"
- "reject 14.0.0.0/9:80,"
- "reject 15.0.0.0:81,"
- "accept *:*", "accept 1-65535");
- test_policy_summary_helper("reject 11.0.0.0/9:80,"
- "reject 12.0.0.0/9:80,"
- "reject 13.0.0.0/9:80,"
- "reject 14.0.0.0/9:80,"
- "reject 15.0.0.0:80,"
- "accept *:*",
- "reject 80");
- /* no exits */
- test_policy_summary_helper("accept 11.0.0.0/9:80,"
- "reject *:*",
- "reject 1-65535");
- /* port merging */
- test_policy_summary_helper("accept *:80,"
- "accept *:81,"
- "accept *:100-110,"
- "accept *:111,"
- "reject *:*",
- "accept 80-81,100-111");
- /* border ports */
- test_policy_summary_helper("accept *:1,"
- "accept *:3,"
- "accept *:65535,"
- "reject *:*",
- "accept 1,3,65535");
- /* holes */
- test_policy_summary_helper("accept *:1,"
- "accept *:3,"
- "accept *:5,"
- "accept *:7,"
- "reject *:*",
- "accept 1,3,5,7");
- test_policy_summary_helper("reject *:1,"
- "reject *:3,"
- "reject *:5,"
- "reject *:7,"
- "accept *:*",
- "reject 1,3,5,7");
- /* Short policies with unrecognized formats should get accepted. */
- test_short_policy_parse("accept fred,2,3-5", "accept 2,3-5");
- test_short_policy_parse("accept 2,fred,3", "accept 2,3");
- test_short_policy_parse("accept 2,fred,3,bob", "accept 2,3");
- test_short_policy_parse("accept 2,-3,500-600", "accept 2,500-600");
- /* Short policies with nil entries are accepted too. */
- test_short_policy_parse("accept 1,,3", "accept 1,3");
- test_short_policy_parse("accept 100-200,,", "accept 100-200");
- test_short_policy_parse("reject ,1-10,,,,30-40", "reject 1-10,30-40");
- /* Try parsing various broken short policies */
- #define TT_BAD_SHORT_POLICY(s) \
- do { \
- tt_ptr_op(NULL, OP_EQ, (short_parsed = parse_short_policy((s)))); \
- } while (0)
- TT_BAD_SHORT_POLICY("accept 200-199");
- TT_BAD_SHORT_POLICY("");
- TT_BAD_SHORT_POLICY("rejekt 1,2,3");
- TT_BAD_SHORT_POLICY("reject ");
- TT_BAD_SHORT_POLICY("reject");
- TT_BAD_SHORT_POLICY("rej");
- TT_BAD_SHORT_POLICY("accept 2,3,100000");
- TT_BAD_SHORT_POLICY("accept 2,3x,4");
- TT_BAD_SHORT_POLICY("accept 2,3x,4");
- TT_BAD_SHORT_POLICY("accept 2-");
- TT_BAD_SHORT_POLICY("accept 2-x");
- TT_BAD_SHORT_POLICY("accept 1-,3");
- TT_BAD_SHORT_POLICY("accept 1-,3");
- /* Make sure that IPv4 addresses are ignored in accept6/reject6 lines. */
- p = router_parse_addr_policy_item_from_string("accept6 1.2.3.4:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(!malformed_list);
- p = router_parse_addr_policy_item_from_string("reject6 2.4.6.0/24:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(!malformed_list);
- p = router_parse_addr_policy_item_from_string("accept6 *4:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(!malformed_list);
- /* Make sure malformed policies are detected as such. */
- p = router_parse_addr_policy_item_from_string("bad_token *4:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(malformed_list);
- p = router_parse_addr_policy_item_from_string("accept6 **:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(malformed_list);
- p = router_parse_addr_policy_item_from_string("accept */15:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(malformed_list);
- p = router_parse_addr_policy_item_from_string("reject6 */:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(malformed_list);
- p = router_parse_addr_policy_item_from_string("accept 127.0.0.1/33:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(malformed_list);
- p = router_parse_addr_policy_item_from_string("accept6 [::1]/129:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(malformed_list);
- p = router_parse_addr_policy_item_from_string("reject 8.8.8.8/-1:*", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(malformed_list);
- p = router_parse_addr_policy_item_from_string("reject 8.8.4.4:10-5", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(malformed_list);
- p = router_parse_addr_policy_item_from_string("reject 1.2.3.4:-1", -1,
- &malformed_list);
- tt_assert(p == NULL);
- tt_assert(malformed_list);
- /* Test a too-long policy. */
- {
- int i;
- char *policy = NULL;
- smartlist_t *chunks = smartlist_new();
- smartlist_add(chunks, tor_strdup("accept "));
- for (i=1; i<10000; ++i)
- smartlist_add_asprintf(chunks, "%d,", i);
- smartlist_add(chunks, tor_strdup("20000"));
- policy = smartlist_join_strings(chunks, "", 0, NULL);
- SMARTLIST_FOREACH(chunks, char *, ch, tor_free(ch));
- smartlist_free(chunks);
- short_parsed = parse_short_policy(policy);/* shouldn't be accepted */
- tor_free(policy);
- tt_ptr_op(NULL, OP_EQ, short_parsed);
- }
- /* truncation ports */
- sm = smartlist_new();
- for (i=1; i<2000; i+=2) {
- char buf[POLICY_BUF_LEN];
- tor_snprintf(buf, sizeof(buf), "reject *:%d", i);
- smartlist_add(sm, tor_strdup(buf));
- }
- smartlist_add(sm, tor_strdup("accept *:*"));
- policy_str = smartlist_join_strings(sm, ",", 0, NULL);
- test_policy_summary_helper( policy_str,
- "accept 2,4,6,8,10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40,42,44,"
- "46,48,50,52,54,56,58,60,62,64,66,68,70,72,74,76,78,80,82,84,86,88,90,"
- "92,94,96,98,100,102,104,106,108,110,112,114,116,118,120,122,124,126,128,"
- "130,132,134,136,138,140,142,144,146,148,150,152,154,156,158,160,162,164,"
- "166,168,170,172,174,176,178,180,182,184,186,188,190,192,194,196,198,200,"
- "202,204,206,208,210,212,214,216,218,220,222,224,226,228,230,232,234,236,"
- "238,240,242,244,246,248,250,252,254,256,258,260,262,264,266,268,270,272,"
- "274,276,278,280,282,284,286,288,290,292,294,296,298,300,302,304,306,308,"
- "310,312,314,316,318,320,322,324,326,328,330,332,334,336,338,340,342,344,"
- "346,348,350,352,354,356,358,360,362,364,366,368,370,372,374,376,378,380,"
- "382,384,386,388,390,392,394,396,398,400,402,404,406,408,410,412,414,416,"
- "418,420,422,424,426,428,430,432,434,436,438,440,442,444,446,448,450,452,"
- "454,456,458,460,462,464,466,468,470,472,474,476,478,480,482,484,486,488,"
- "490,492,494,496,498,500,502,504,506,508,510,512,514,516,518,520,522");
- done:
- addr_policy_list_free(policy);
- addr_policy_list_free(policy2);
- addr_policy_list_free(policy3);
- addr_policy_list_free(policy4);
- addr_policy_list_free(policy5);
- addr_policy_list_free(policy6);
- addr_policy_list_free(policy7);
- addr_policy_list_free(policy8);
- addr_policy_list_free(policy9);
- addr_policy_list_free(policy10);
- addr_policy_list_free(policy11);
- addr_policy_list_free(policy12);
- tor_free(policy_str);
- if (sm) {
- SMARTLIST_FOREACH(sm, char *, s, tor_free(s));
- smartlist_free(sm);
- }
- short_policy_free(short_parsed);
- }
- /** Helper: Check that policy_list contains address */
- static int
- test_policy_has_address_helper(const smartlist_t *policy_list,
- const tor_addr_t *addr)
- {
- int found = 0;
- tt_assert(policy_list);
- tt_assert(addr);
- SMARTLIST_FOREACH_BEGIN(policy_list, addr_policy_t*, p) {
- if (tor_addr_eq(&p->addr, addr)) {
- found = 1;
- }
- } SMARTLIST_FOREACH_END(p);
- return found;
- done:
- return 0;
- }
- #define TEST_IPV4_ADDR (0x01020304)
- #define TEST_IPV6_ADDR ("2002::abcd")
- /** Run unit tests for rejecting the configured addresses on this exit relay
- * using policies_parse_exit_policy_reject_private */
- static void
- test_policies_reject_exit_address(void *arg)
- {
- smartlist_t *policy = NULL;
- tor_addr_t ipv4_addr, ipv6_addr;
- smartlist_t *ipv4_list, *ipv6_list, *both_list, *dupl_list;
- (void)arg;
- tor_addr_from_ipv4h(&ipv4_addr, TEST_IPV4_ADDR);
- tor_addr_parse(&ipv6_addr, TEST_IPV6_ADDR);
- ipv4_list = smartlist_new();
- ipv6_list = smartlist_new();
- both_list = smartlist_new();
- dupl_list = smartlist_new();
- smartlist_add(ipv4_list, &ipv4_addr);
- smartlist_add(both_list, &ipv4_addr);
- smartlist_add(dupl_list, &ipv4_addr);
- smartlist_add(dupl_list, &ipv4_addr);
- smartlist_add(dupl_list, &ipv4_addr);
- smartlist_add(ipv6_list, &ipv6_addr);
- smartlist_add(both_list, &ipv6_addr);
- smartlist_add(dupl_list, &ipv6_addr);
- smartlist_add(dupl_list, &ipv6_addr);
- /* IPv4-Only Exits */
- /* test that IPv4 addresses are rejected on an IPv4-only exit */
- policies_parse_exit_policy_reject_private(&policy, 0, ipv4_list, 0, 0);
- tt_assert(policy);
- tt_assert(smartlist_len(policy) == 1);
- tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
- addr_policy_list_free(policy);
- policy = NULL;
- /* test that IPv6 addresses are NOT rejected on an IPv4-only exit
- * (all IPv6 addresses are rejected by policies_parse_exit_policy_internal
- * on IPv4-only exits, so policies_parse_exit_policy_reject_private doesn't
- * need to do anything) */
- policies_parse_exit_policy_reject_private(&policy, 0, ipv6_list, 0, 0);
- tt_assert(policy == NULL);
- /* test that only IPv4 addresses are rejected on an IPv4-only exit */
- policies_parse_exit_policy_reject_private(&policy, 0, both_list, 0, 0);
- tt_assert(policy);
- tt_assert(smartlist_len(policy) == 1);
- tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
- addr_policy_list_free(policy);
- policy = NULL;
- /* Test that lists with duplicate entries produce the same results */
- policies_parse_exit_policy_reject_private(&policy, 0, dupl_list, 0, 0);
- tt_assert(policy);
- tt_assert(smartlist_len(policy) == 1);
- tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
- addr_policy_list_free(policy);
- policy = NULL;
- /* IPv4/IPv6 Exits */
- /* test that IPv4 addresses are rejected on an IPv4/IPv6 exit */
- policies_parse_exit_policy_reject_private(&policy, 1, ipv4_list, 0, 0);
- tt_assert(policy);
- tt_assert(smartlist_len(policy) == 1);
- tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
- addr_policy_list_free(policy);
- policy = NULL;
- /* test that IPv6 addresses are rejected on an IPv4/IPv6 exit */
- policies_parse_exit_policy_reject_private(&policy, 1, ipv6_list, 0, 0);
- tt_assert(policy);
- tt_assert(smartlist_len(policy) == 1);
- tt_assert(test_policy_has_address_helper(policy, &ipv6_addr));
- addr_policy_list_free(policy);
- policy = NULL;
- /* test that IPv4 and IPv6 addresses are rejected on an IPv4/IPv6 exit */
- policies_parse_exit_policy_reject_private(&policy, 1, both_list, 0, 0);
- tt_assert(policy);
- tt_assert(smartlist_len(policy) == 2);
- tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
- tt_assert(test_policy_has_address_helper(policy, &ipv6_addr));
- addr_policy_list_free(policy);
- policy = NULL;
- /* Test that lists with duplicate entries produce the same results */
- policies_parse_exit_policy_reject_private(&policy, 1, dupl_list, 0, 0);
- tt_assert(policy);
- tt_assert(smartlist_len(policy) == 2);
- tt_assert(test_policy_has_address_helper(policy, &ipv4_addr));
- tt_assert(test_policy_has_address_helper(policy, &ipv6_addr));
- addr_policy_list_free(policy);
- policy = NULL;
- done:
- addr_policy_list_free(policy);
- smartlist_free(ipv4_list);
- smartlist_free(ipv6_list);
- smartlist_free(both_list);
- smartlist_free(dupl_list);
- }
- static smartlist_t *test_configured_ports = NULL;
- const smartlist_t *mock_get_configured_ports(void);
- /** Returns test_configured_ports */
- const smartlist_t *
- mock_get_configured_ports(void)
- {
- return test_configured_ports;
- }
- /** Run unit tests for rejecting publicly routable configured port addresses
- * on this exit relay using policies_parse_exit_policy_reject_private */
- static void
- test_policies_reject_port_address(void *arg)
- {
- smartlist_t *policy = NULL;
- port_cfg_t *ipv4_port = NULL;
- port_cfg_t *ipv6_port = NULL;
- (void)arg;
- test_configured_ports = smartlist_new();
- ipv4_port = port_cfg_new(0);
- tor_addr_from_ipv4h(&ipv4_port->addr, TEST_IPV4_ADDR);
- smartlist_add(test_configured_ports, ipv4_port);
- ipv6_port = port_cfg_new(0);
- tor_addr_parse(&ipv6_port->addr, TEST_IPV6_ADDR);
- smartlist_add(test_configured_ports, ipv6_port);
- MOCK(get_configured_ports, mock_get_configured_ports);
- /* test that an IPv4 port is rejected on an IPv4-only exit, but an IPv6 port
- * is NOT rejected (all IPv6 addresses are rejected by
- * policies_parse_exit_policy_internal on IPv4-only exits, so
- * policies_parse_exit_policy_reject_private doesn't need to do anything
- * with IPv6 addresses on IPv4-only exits) */
- policies_parse_exit_policy_reject_private(&policy, 0, NULL, 0, 1);
- tt_assert(policy);
- tt_assert(smartlist_len(policy) == 1);
- tt_assert(test_policy_has_address_helper(policy, &ipv4_port->addr));
- addr_policy_list_free(policy);
- policy = NULL;
- /* test that IPv4 and IPv6 ports are rejected on an IPv4/IPv6 exit */
- policies_parse_exit_policy_reject_private(&policy, 1, NULL, 0, 1);
- tt_assert(policy);
- tt_assert(smartlist_len(policy) == 2);
- tt_assert(test_policy_has_address_helper(policy, &ipv4_port->addr));
- tt_assert(test_policy_has_address_helper(policy, &ipv6_port->addr));
- addr_policy_list_free(policy);
- policy = NULL;
- done:
- addr_policy_list_free(policy);
- if (test_configured_ports) {
- SMARTLIST_FOREACH(test_configured_ports,
- port_cfg_t *, p, port_cfg_free(p));
- smartlist_free(test_configured_ports);
- test_configured_ports = NULL;
- }
- UNMOCK(get_configured_ports);
- }
- #undef TEST_IPV4_ADDR
- #undef TEST_IPV6_ADDR
- /** Run unit tests for rejecting publicly routable interface addresses on this
- * exit relay using policies_parse_exit_policy_reject_private */
- static void
- test_policies_reject_interface_address(void *arg)
- {
- smartlist_t *policy = NULL;
- smartlist_t *public_ipv4_addrs =
- get_interface_address6_list(LOG_INFO, AF_INET, 0);
- smartlist_t *public_ipv6_addrs =
- get_interface_address6_list(LOG_INFO, AF_INET6, 0);
- (void)arg;
- /* test that no addresses are rejected when none are supplied/requested */
- policies_parse_exit_policy_reject_private(&policy, 0, NULL, 0, 0);
- tt_assert(policy == NULL);
- /* test that only IPv4 interface addresses are rejected on an IPv4-only exit
- */
- policies_parse_exit_policy_reject_private(&policy, 0, NULL, 1, 0);
- if (policy) {
- tt_assert(smartlist_len(policy) == smartlist_len(public_ipv4_addrs));
- addr_policy_list_free(policy);
- policy = NULL;
- }
- /* test that IPv4 and IPv6 interface addresses are rejected on an IPv4/IPv6
- * exit */
- policies_parse_exit_policy_reject_private(&policy, 0, NULL, 1, 0);
- if (policy) {
- tt_assert(smartlist_len(policy) == (smartlist_len(public_ipv4_addrs)
- + smartlist_len(public_ipv6_addrs)));
- addr_policy_list_free(policy);
- policy = NULL;
- }
- done:
- addr_policy_list_free(policy);
- free_interface_address6_list(public_ipv4_addrs);
- free_interface_address6_list(public_ipv6_addrs);
- }
- static void
- test_dump_exit_policy_to_string(void *arg)
- {
- char *ep;
- addr_policy_t *policy_entry;
- int malformed_list = -1;
- routerinfo_t *ri = tor_malloc_zero(sizeof(routerinfo_t));
- (void)arg;
- ri->policy_is_reject_star = 1;
- ri->exit_policy = NULL; // expecting "reject *:*"
- ep = router_dump_exit_policy_to_string(ri,1,1);
- tt_str_op("reject *:*",OP_EQ, ep);
- tor_free(ep);
- ri->exit_policy = smartlist_new();
- ri->policy_is_reject_star = 0;
- policy_entry = router_parse_addr_policy_item_from_string("accept *:*", -1,
- &malformed_list);
- smartlist_add(ri->exit_policy,policy_entry);
- ep = router_dump_exit_policy_to_string(ri,1,1);
- tt_str_op("accept *:*",OP_EQ, ep);
- tor_free(ep);
- policy_entry = router_parse_addr_policy_item_from_string("reject *:25", -1,
- &malformed_list);
- smartlist_add(ri->exit_policy,policy_entry);
- ep = router_dump_exit_policy_to_string(ri,1,1);
- tt_str_op("accept *:*\nreject *:25",OP_EQ, ep);
- tor_free(ep);
- policy_entry =
- router_parse_addr_policy_item_from_string("reject 8.8.8.8:*", -1,
- &malformed_list);
- smartlist_add(ri->exit_policy,policy_entry);
- ep = router_dump_exit_policy_to_string(ri,1,1);
- tt_str_op("accept *:*\nreject *:25\nreject 8.8.8.8:*",OP_EQ, ep);
- tor_free(ep);
- policy_entry =
- router_parse_addr_policy_item_from_string("reject6 [FC00::]/7:*", -1,
- &malformed_list);
- smartlist_add(ri->exit_policy,policy_entry);
- ep = router_dump_exit_policy_to_string(ri,1,1);
- tt_str_op("accept *:*\nreject *:25\nreject 8.8.8.8:*\n"
- "reject6 [fc00::]/7:*",OP_EQ, ep);
- tor_free(ep);
- policy_entry =
- router_parse_addr_policy_item_from_string("accept6 [c000::]/3:*", -1,
- &malformed_list);
- smartlist_add(ri->exit_policy,policy_entry);
- ep = router_dump_exit_policy_to_string(ri,1,1);
- tt_str_op("accept *:*\nreject *:25\nreject 8.8.8.8:*\n"
- "reject6 [fc00::]/7:*\naccept6 [c000::]/3:*",OP_EQ, ep);
- done:
- if (ri->exit_policy) {
- SMARTLIST_FOREACH(ri->exit_policy, addr_policy_t *,
- entry, addr_policy_free(entry));
- smartlist_free(ri->exit_policy);
- }
- tor_free(ri);
- tor_free(ep);
- }
- static routerinfo_t *mock_desc_routerinfo = NULL;
- static const routerinfo_t *
- mock_router_get_my_routerinfo(void)
- {
- return mock_desc_routerinfo;
- }
- #define DEFAULT_POLICY_STRING "reject *:*"
- #define TEST_IPV4_ADDR (0x02040608)
- #define TEST_IPV6_ADDR ("2003::ef01")
- static or_options_t mock_options;
- static const or_options_t *
- mock_get_options(void)
- {
- return &mock_options;
- }
- /** Run unit tests for generating summary lines of exit policies */
- static void
- test_policies_getinfo_helper_policies(void *arg)
- {
- (void)arg;
- int rv = 0;
- size_t ipv4_len = 0, ipv6_len = 0;
- char *answer = NULL;
- const char *errmsg = NULL;
- routerinfo_t mock_my_routerinfo;
- rv = getinfo_helper_policies(NULL, "exit-policy/default", &answer, &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- tt_assert(strlen(answer) > 0);
- tor_free(answer);
- rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/default",
- &answer, &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- tt_assert(strlen(answer) > 0);
- tor_free(answer);
- memset(&mock_my_routerinfo, 0, sizeof(routerinfo_t));
- MOCK(router_get_my_routerinfo, mock_router_get_my_routerinfo);
- mock_my_routerinfo.exit_policy = smartlist_new();
- mock_desc_routerinfo = &mock_my_routerinfo;
- memset(&mock_options, 0, sizeof(or_options_t));
- MOCK(get_options, mock_get_options);
- rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
- &answer, &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- tt_assert(strlen(answer) == 0);
- tor_free(answer);
- rv = getinfo_helper_policies(NULL, "exit-policy/ipv4", &answer,
- &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- ipv4_len = strlen(answer);
- tt_assert(ipv4_len == 0 || ipv4_len == strlen(DEFAULT_POLICY_STRING));
- tt_assert(ipv4_len == 0 || !strcasecmp(answer, DEFAULT_POLICY_STRING));
- tor_free(answer);
- rv = getinfo_helper_policies(NULL, "exit-policy/ipv6", &answer,
- &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- ipv6_len = strlen(answer);
- tt_assert(ipv6_len == 0 || ipv6_len == strlen(DEFAULT_POLICY_STRING));
- tt_assert(ipv6_len == 0 || !strcasecmp(answer, DEFAULT_POLICY_STRING));
- tor_free(answer);
- rv = getinfo_helper_policies(NULL, "exit-policy/full", &answer,
- &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- /* It's either empty or it's the default */
- tt_assert(strlen(answer) == 0 || !strcasecmp(answer, DEFAULT_POLICY_STRING));
- tor_free(answer);
- mock_my_routerinfo.addr = TEST_IPV4_ADDR;
- tor_addr_parse(&mock_my_routerinfo.ipv6_addr, TEST_IPV6_ADDR);
- append_exit_policy_string(&mock_my_routerinfo.exit_policy, "accept *4:*");
- append_exit_policy_string(&mock_my_routerinfo.exit_policy, "reject *6:*");
- mock_options.IPv6Exit = 1;
- tor_addr_from_ipv4h(&mock_options.OutboundBindAddressIPv4_, TEST_IPV4_ADDR);
- tor_addr_parse(&mock_options.OutboundBindAddressIPv6_, TEST_IPV6_ADDR);
- rv = getinfo_helper_policies(NULL, "exit-policy/reject-private/relay",
- &answer, &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- tt_assert(strlen(answer) > 0);
- tor_free(answer);
- rv = getinfo_helper_policies(NULL, "exit-policy/ipv4", &answer,
- &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- ipv4_len = strlen(answer);
- tt_assert(ipv4_len > 0);
- tor_free(answer);
- rv = getinfo_helper_policies(NULL, "exit-policy/ipv6", &answer,
- &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- ipv6_len = strlen(answer);
- tt_assert(ipv6_len > 0);
- tor_free(answer);
- rv = getinfo_helper_policies(NULL, "exit-policy/full", &answer,
- &errmsg);
- tt_assert(rv == 0);
- tt_assert(answer != NULL);
- tt_assert(strlen(answer) > 0);
- tt_assert(strlen(answer) == ipv4_len + ipv6_len + 1);
- tor_free(answer);
- done:
- tor_free(answer);
- UNMOCK(get_options);
- UNMOCK(router_get_my_routerinfo);
- smartlist_free(mock_my_routerinfo.exit_policy);
- }
- #undef DEFAULT_POLICY_STRING
- #undef TEST_IPV4_ADDR
- #undef TEST_IPV6_ADDR
- struct testcase_t policy_tests[] = {
- { "router_dump_exit_policy_to_string", test_dump_exit_policy_to_string, 0,
- NULL, NULL },
- { "general", test_policies_general, 0, NULL, NULL },
- { "getinfo_helper_policies", test_policies_getinfo_helper_policies, 0, NULL,
- NULL },
- { "reject_exit_address", test_policies_reject_exit_address, 0, NULL, NULL },
- { "reject_interface_address", test_policies_reject_interface_address, 0,
- NULL, NULL },
- { "reject_port_address", test_policies_reject_port_address, 0, NULL, NULL },
- END_OF_TESTCASES
- };
|