policies.h 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2016, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file policies.h
  8. * \brief Header file for policies.c.
  9. **/
  10. #ifndef TOR_POLICIES_H
  11. #define TOR_POLICIES_H
  12. /* (length of
  13. * "accept6 [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]/128:65535-65535\n"
  14. * plus a terminating NUL, rounded up to a nice number.)
  15. */
  16. #define POLICY_BUF_LEN 72
  17. #define EXIT_POLICY_IPV6_ENABLED (1 << 0)
  18. #define EXIT_POLICY_REJECT_PRIVATE (1 << 1)
  19. #define EXIT_POLICY_ADD_DEFAULT (1 << 2)
  20. #define EXIT_POLICY_REJECT_LOCAL_INTERFACES (1 << 3)
  21. typedef enum firewall_connection_t {
  22. FIREWALL_OR_CONNECTION = 0,
  23. FIREWALL_DIR_CONNECTION = 1
  24. } firewall_connection_t;
  25. typedef int exit_policy_parser_cfg_t;
  26. int firewall_is_fascist_or(void);
  27. int firewall_is_fascist_dir(void);
  28. int fascist_firewall_use_ipv6(const or_options_t *options);
  29. int fascist_firewall_prefer_ipv6_orport(const or_options_t *options);
  30. int fascist_firewall_prefer_ipv6_dirport(const or_options_t *options);
  31. int fascist_firewall_allows_address_addr(const tor_addr_t *addr,
  32. uint16_t port,
  33. firewall_connection_t fw_connection,
  34. int pref_only, int pref_ipv6);
  35. int fascist_firewall_allows_rs(const routerstatus_t *rs,
  36. firewall_connection_t fw_connection,
  37. int pref_only);
  38. int fascist_firewall_allows_node(const node_t *node,
  39. firewall_connection_t fw_connection,
  40. int pref_only);
  41. int fascist_firewall_allows_dir_server(const dir_server_t *ds,
  42. firewall_connection_t fw_connection,
  43. int pref_only);
  44. int fascist_firewall_choose_address_rs(const routerstatus_t *rs,
  45. firewall_connection_t fw_connection,
  46. int pref_only, tor_addr_port_t* ap);
  47. int fascist_firewall_choose_address_node(const node_t *node,
  48. firewall_connection_t fw_connection,
  49. int pref_only, tor_addr_port_t* ap);
  50. int fascist_firewall_choose_address_dir_server(const dir_server_t *ds,
  51. firewall_connection_t fw_connection,
  52. int pref_only, tor_addr_port_t* ap);
  53. int dir_policy_permits_address(const tor_addr_t *addr);
  54. int socks_policy_permits_address(const tor_addr_t *addr);
  55. int authdir_policy_permits_address(uint32_t addr, uint16_t port);
  56. int authdir_policy_valid_address(uint32_t addr, uint16_t port);
  57. int authdir_policy_badexit_address(uint32_t addr, uint16_t port);
  58. int validate_addr_policies(const or_options_t *options, char **msg);
  59. void policy_expand_private(smartlist_t **policy);
  60. void policy_expand_unspec(smartlist_t **policy);
  61. int policies_parse_from_options(const or_options_t *options);
  62. addr_policy_t *addr_policy_get_canonical_entry(addr_policy_t *ent);
  63. int cmp_addr_policies(smartlist_t *a, smartlist_t *b);
  64. MOCK_DECL(addr_policy_result_t, compare_tor_addr_to_addr_policy,
  65. (const tor_addr_t *addr, uint16_t port, const smartlist_t *policy));
  66. addr_policy_result_t compare_tor_addr_to_node_policy(const tor_addr_t *addr,
  67. uint16_t port, const node_t *node);
  68. int policies_parse_exit_policy_from_options(
  69. const or_options_t *or_options,
  70. uint32_t local_address,
  71. const tor_addr_t *ipv6_local_address,
  72. smartlist_t **result);
  73. int policies_parse_exit_policy(config_line_t *cfg, smartlist_t **dest,
  74. exit_policy_parser_cfg_t options,
  75. const smartlist_t *configured_addresses);
  76. void policies_parse_exit_policy_reject_private(
  77. smartlist_t **dest,
  78. int ipv6_exit,
  79. const smartlist_t *configured_addresses,
  80. int reject_interface_addresses,
  81. int reject_configured_port_addresses);
  82. void policies_exit_policy_append_reject_star(smartlist_t **dest);
  83. void addr_policy_append_reject_addr(smartlist_t **dest,
  84. const tor_addr_t *addr);
  85. void addr_policy_append_reject_addr_list(smartlist_t **dest,
  86. const smartlist_t *addrs);
  87. void policies_set_node_exitpolicy_to_reject_all(node_t *exitrouter);
  88. int exit_policy_is_general_exit(smartlist_t *policy);
  89. int policy_is_reject_star(const smartlist_t *policy, sa_family_t family,
  90. int reject_by_default);
  91. char * policy_dump_to_string(const smartlist_t *policy_list,
  92. int include_ipv4,
  93. int include_ipv6);
  94. int getinfo_helper_policies(control_connection_t *conn,
  95. const char *question, char **answer,
  96. const char **errmsg);
  97. int policy_write_item(char *buf, size_t buflen, const addr_policy_t *item,
  98. int format_for_desc);
  99. void addr_policy_list_free(smartlist_t *p);
  100. void addr_policy_free(addr_policy_t *p);
  101. void policies_free_all(void);
  102. char *policy_summarize(smartlist_t *policy, sa_family_t family);
  103. short_policy_t *parse_short_policy(const char *summary);
  104. char *write_short_policy(const short_policy_t *policy);
  105. void short_policy_free(short_policy_t *policy);
  106. int short_policy_is_reject_star(const short_policy_t *policy);
  107. addr_policy_result_t compare_tor_addr_to_short_policy(
  108. const tor_addr_t *addr, uint16_t port,
  109. const short_policy_t *policy);
  110. #ifdef POLICIES_PRIVATE
  111. STATIC void append_exit_policy_string(smartlist_t **policy, const char *more);
  112. STATIC int fascist_firewall_allows_address(const tor_addr_t *addr,
  113. uint16_t port,
  114. smartlist_t *firewall_policy,
  115. int pref_only, int pref_ipv6);
  116. STATIC const tor_addr_port_t * fascist_firewall_choose_address(
  117. const tor_addr_port_t *a,
  118. const tor_addr_port_t *b,
  119. int want_a,
  120. firewall_connection_t fw_connection,
  121. int pref_only, int pref_ipv6);
  122. #endif
  123. #endif