policies.c 55.4 KB
Newer Older
1
/* Copyright (c) 2001-2004, Roger Dingledine.
2
 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
3
 * Copyright (c) 2007-2013, The Tor Project, Inc. */
4
5
6
7
8
9
10
11
/* See LICENSE for licensing information */

/**
 * \file policies.c
 * \brief Code to parse and use address policies and exit policies.
 **/

#include "or.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
12
#include "config.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
13
#include "dirserv.h"
14
#include "nodelist.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
15
#include "policies.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
16
#include "routerparse.h"
17
#include "geoip.h"
18
#include "ht.h"
19

20
/** Policy that addresses for incoming SOCKS connections must match. */
21
static smartlist_t *socks_policy = NULL;
22
/** Policy that addresses for incoming directory connections must match. */
23
static smartlist_t *dir_policy = NULL;
24
25
/** Policy that addresses for incoming router descriptors must match in order
 * to be published by us. */
26
static smartlist_t *authdir_reject_policy = NULL;
27
28
/** Policy that addresses for incoming router descriptors must match in order
 * to be marked as valid in our networkstatus. */
29
static smartlist_t *authdir_invalid_policy = NULL;
30
31
/** Policy that addresses for incoming router descriptors must <b>not</b>
 * match in order to not be marked as BadDirectory. */
32
static smartlist_t *authdir_baddir_policy = NULL;
33
34
/** Policy that addresses for incoming router descriptors must <b>not</b>
 * match in order to not be marked as BadExit. */
35
static smartlist_t *authdir_badexit_policy = NULL;
36
37
38

/** Parsed addr_policy_t describing which addresses we believe we can start
 * circuits at. */
39
static smartlist_t *reachable_or_addr_policy = NULL;
40
41
/** Parsed addr_policy_t describing which addresses we believe we can connect
 * to directories at. */
42
43
static smartlist_t *reachable_dir_addr_policy = NULL;

44
45
46
47
48
/** Element of an exit policy summary */
typedef struct policy_summary_item_t {
    uint16_t prt_min; /**< Lowest port number to accept/reject. */
    uint16_t prt_max; /**< Highest port number to accept/reject. */
    uint64_t reject_count; /**< Number of IP-Addresses that are rejected to
Nick Mathewson's avatar
Nick Mathewson committed
49
                                this port range. */
50
    unsigned int accepted:1; /** Has this port already been accepted */
51
52
} policy_summary_item_t;

53
54
55
56
57
58
59
60
61
/** Private networks.  This list is used in two places, once to expand the
 *  "private" keyword when parsing our own exit policy, secondly to ignore
 *  just such networks when building exit policy summaries.  It is important
 *  that all authorities agree on that list when creating summaries, so don't
 *  just change this without a proper migration plan and a proposal and stuff.
 */
static const char *private_nets[] = {
  "0.0.0.0/8", "169.254.0.0/16",
  "127.0.0.0/8", "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12",
62
63
64
65
  "[::]/8",
  "[fc00::]/7", "[fe80::]/10", "[fec0::]/10", "[ff00::]/8", "[::]/127",
  NULL
};
66

67
68
69
70
71
72
73
74
75
76
/** Replace all "private" entries in *<b>policy</b> with their expanded
 * equivalents. */
void
policy_expand_private(smartlist_t **policy)
{
  uint16_t port_min, port_max;

  int i;
  smartlist_t *tmp;

77
  if (!*policy) /*XXXX disallow NULL policies? */
78
79
    return;

80
  tmp = smartlist_new();
81

82
  SMARTLIST_FOREACH_BEGIN(*policy, addr_policy_t *, p) {
83
84
85
86
87
     if (! p->is_private) {
       smartlist_add(tmp, p);
       continue;
     }
     for (i = 0; private_nets[i]; ++i) {
88
89
90
91
       addr_policy_t newpolicy;
       memcpy(&newpolicy, p, sizeof(addr_policy_t));
       newpolicy.is_private = 0;
       newpolicy.is_canonical = 0;
92
93
       if (tor_addr_parse_mask_ports(private_nets[i], 0,
                               &newpolicy.addr,
94
                               &newpolicy.maskbits, &port_min, &port_max)<0) {
95
96
         tor_assert(0);
       }
97
       smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy));
98
99
     }
     addr_policy_free(p);
100
  } SMARTLIST_FOREACH_END(p);
101
102
103
104

  smartlist_free(*policy);
  *policy = tmp;
}
105

106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
/** Expand each of the AF_UNSPEC elements in *<b>policy</b> (which indicate
 * protocol-neutral wildcards) into a pair of wildcard elements: one IPv4-
 * specific and one IPv6-specific. */
void
policy_expand_unspec(smartlist_t **policy)
{
  smartlist_t *tmp;
  if (!*policy)
    return;

  tmp = smartlist_new();
  SMARTLIST_FOREACH_BEGIN(*policy, addr_policy_t *, p) {
    sa_family_t family = tor_addr_family(&p->addr);
    if (family == AF_INET6 || family == AF_INET || p->is_private) {
      smartlist_add(tmp, p);
    } else if (family == AF_UNSPEC) {
      addr_policy_t newpolicy_ipv4;
      addr_policy_t newpolicy_ipv6;
      memcpy(&newpolicy_ipv4, p, sizeof(addr_policy_t));
      memcpy(&newpolicy_ipv6, p, sizeof(addr_policy_t));
      newpolicy_ipv4.is_canonical = 0;
      newpolicy_ipv6.is_canonical = 0;
      if (p->maskbits != 0) {
        log_warn(LD_BUG, "AF_UNSPEC policy with maskbits==%d", p->maskbits);
        newpolicy_ipv4.maskbits = 0;
        newpolicy_ipv6.maskbits = 0;
      }
      tor_addr_from_ipv4h(&newpolicy_ipv4.addr, 0);
      tor_addr_from_ipv6_bytes(&newpolicy_ipv6.addr,
                               "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0");
      smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv4));
      smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv6));
      addr_policy_free(p);
    } else {
      log_warn(LD_BUG, "Funny-looking address policy with family %d", family);
      smartlist_add(tmp, p);
    }
  } SMARTLIST_FOREACH_END(p);

  smartlist_free(*policy);
  *policy = tmp;
}

149
150
151
/**
 * Given a linked list of config lines containing "allow" and "deny"
 * tokens, parse them and append the result to <b>dest</b>. Return -1
152
 * if any tokens are malformed (and don't append any), else return 0.
153
154
155
156
 *
 * If <b>assume_action</b> is nonnegative, then insert its action
 * (ADDR_POLICY_ACCEPT or ADDR_POLICY_REJECT) for items that specify no
 * action.
157
158
 */
static int
159
parse_addr_policy(config_line_t *cfg, smartlist_t **dest,
160
161
                  int assume_action)
{
162
  smartlist_t *result;
163
  smartlist_t *entries;
164
  addr_policy_t *item;
165
166
167
168
169
  int r = 0;

  if (!cfg)
    return 0;

170
171
  result = smartlist_new();
  entries = smartlist_new();
172
173
174
  for (; cfg; cfg = cfg->next) {
    smartlist_split_string(entries, cfg->value, ",",
                           SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0);
175
    SMARTLIST_FOREACH_BEGIN(entries, const char *, ent) {
176
      log_debug(LD_CONFIG,"Adding new entry '%s'",ent);
177
178
179
      item = router_parse_addr_policy_item_from_string(ent, assume_action);
      if (item) {
        smartlist_add(result, item);
180
181
182
183
      } else {
        log_warn(LD_CONFIG,"Malformed policy '%s'.", ent);
        r = -1;
      }
184
    } SMARTLIST_FOREACH_END(ent);
185
186
187
188
    SMARTLIST_FOREACH(entries, char *, ent, tor_free(ent));
    smartlist_clear(entries);
  }
  smartlist_free(entries);
189
190
191
192
  if (r == -1) {
    addr_policy_list_free(result);
  } else {
    policy_expand_private(&result);
193
    policy_expand_unspec(&result);
194
195
196
197
198
199
200
201
202

    if (*dest) {
      smartlist_add_all(*dest, result);
      smartlist_free(result);
    } else {
      *dest = result;
    }
  }

203
204
205
206
  return r;
}

/** Helper: parse the Reachable(Dir|OR)?Addresses fields into
207
208
209
210
 * reachable_(or|dir)_addr_policy.  The options should already have
 * been validated by validate_addr_policies.
 */
static int
211
212
parse_reachable_addresses(void)
{
213
  const or_options_t *options = get_options();
214
  int ret = 0;
215
216
217
218
219
220
221
222

  if (options->ReachableDirAddresses &&
      options->ReachableORAddresses &&
      options->ReachableAddresses) {
    log_warn(LD_CONFIG,
             "Both ReachableDirAddresses and ReachableORAddresses are set. "
             "ReachableAddresses setting will be ignored.");
  }
223
  addr_policy_list_free(reachable_or_addr_policy);
224
225
226
227
228
229
230
231
232
233
234
  reachable_or_addr_policy = NULL;
  if (!options->ReachableORAddresses && options->ReachableAddresses)
    log_info(LD_CONFIG,
             "Using ReachableAddresses as ReachableORAddresses.");
  if (parse_addr_policy(options->ReachableORAddresses ?
                          options->ReachableORAddresses :
                          options->ReachableAddresses,
                        &reachable_or_addr_policy, ADDR_POLICY_ACCEPT)) {
    log_warn(LD_CONFIG,
             "Error parsing Reachable%sAddresses entry; ignoring.",
             options->ReachableORAddresses ? "OR" : "");
235
    ret = -1;
236
237
  }

238
  addr_policy_list_free(reachable_dir_addr_policy);
239
240
241
242
243
244
245
246
247
248
249
  reachable_dir_addr_policy = NULL;
  if (!options->ReachableDirAddresses && options->ReachableAddresses)
    log_info(LD_CONFIG,
             "Using ReachableAddresses as ReachableDirAddresses");
  if (parse_addr_policy(options->ReachableDirAddresses ?
                          options->ReachableDirAddresses :
                          options->ReachableAddresses,
                        &reachable_dir_addr_policy, ADDR_POLICY_ACCEPT)) {
    if (options->ReachableDirAddresses)
      log_warn(LD_CONFIG,
               "Error parsing ReachableDirAddresses entry; ignoring.");
250
    ret = -1;
251
  }
252
  return ret;
253
254
255
256
257
258
259
260
}

/** Return true iff the firewall options might block any address:port
 * combination.
 */
int
firewall_is_fascist_or(void)
{
261
  return reachable_or_addr_policy != NULL;
262
263
264
265
266
267
}

/** Return true iff <b>policy</b> (possibly NULL) will allow a
 * connection to <b>addr</b>:<b>port</b>.
 */
static int
268
addr_policy_permits_tor_addr(const tor_addr_t *addr, uint16_t port,
269
                            smartlist_t *policy)
270
271
{
  addr_policy_result_t p;
272
  p = compare_tor_addr_to_addr_policy(addr, port, policy);
273
274
275
276
277
278
279
280
281
282
283
284
285
  switch (p) {
    case ADDR_POLICY_PROBABLY_ACCEPTED:
    case ADDR_POLICY_ACCEPTED:
      return 1;
    case ADDR_POLICY_PROBABLY_REJECTED:
    case ADDR_POLICY_REJECTED:
      return 0;
    default:
      log_warn(LD_BUG, "Unexpected result: %d", (int)p);
      return 0;
  }
}

286
287
288
289
/** Return true iff <b> policy</b> (possibly NULL) will allow a connection to
 * <b>addr</b>:<b>port</b>.  <b>addr</b> is an IPv4 address given in host
 * order. */
/* XXXX deprecate when possible. */
290
291
292
293
294
295
296
297
298
static int
addr_policy_permits_address(uint32_t addr, uint16_t port,
                            smartlist_t *policy)
{
  tor_addr_t a;
  tor_addr_from_ipv4h(&a, addr);
  return addr_policy_permits_tor_addr(&a, port, policy);
}

299
300
/** Return true iff we think our firewall will let us make an OR connection to
 * addr:port. */
301
int
302
fascist_firewall_allows_address_or(const tor_addr_t *addr, uint16_t port)
303
{
304
  return addr_policy_permits_tor_addr(addr, port,
305
306
307
                                     reachable_or_addr_policy);
}

308
309
/** Return true iff we think our firewall will let us make an OR connection to
 * <b>ri</b>. */
310
int
311
fascist_firewall_allows_or(const routerinfo_t *ri)
312
{
313
  /* XXXX proposal 118 */
314
315
316
317
318
  tor_addr_t addr;
  tor_addr_from_ipv4h(&addr, ri->addr);
  return fascist_firewall_allows_address_or(&addr, ri->or_port);
}

319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
/** Return true iff we think our firewall will let us make an OR connection to
 * <b>node</b>. */
int
fascist_firewall_allows_node(const node_t *node)
{
  if (node->ri) {
    return fascist_firewall_allows_or(node->ri);
  } else if (node->rs) {
    tor_addr_t addr;
    tor_addr_from_ipv4h(&addr, node->rs->addr);
    return fascist_firewall_allows_address_or(&addr, node->rs->or_port);
  } else {
    return 1;
  }
}

335
336
/** Return true iff we think our firewall will let us make a directory
 * connection to addr:port. */
337
int
338
fascist_firewall_allows_address_dir(const tor_addr_t *addr, uint16_t port)
339
{
340
341
  return addr_policy_permits_tor_addr(addr, port,
                                      reachable_dir_addr_policy);
342
343
344
345
346
347
}

/** Return 1 if <b>addr</b> is permitted to connect to our dir port,
 * based on <b>dir_policy</b>. Else return 0.
 */
int
348
dir_policy_permits_address(const tor_addr_t *addr)
349
{
350
  return addr_policy_permits_tor_addr(addr, 1, dir_policy);
351
352
353
354
355
356
}

/** Return 1 if <b>addr</b> is permitted to connect to our socks port,
 * based on <b>socks_policy</b>. Else return 0.
 */
int
357
socks_policy_permits_address(const tor_addr_t *addr)
358
{
359
  return addr_policy_permits_tor_addr(addr, 1, socks_policy);
360
361
}

362
/** Return true iff the address <b>addr</b> is in a country listed in the
363
 * case-insensitive list of country codes <b>cc_list</b>. */
364
365
366
367
368
static int
addr_is_in_cc_list(uint32_t addr, const smartlist_t *cc_list)
{
  country_t country;
  const char *name;
nils's avatar
nils committed
369
370
  tor_addr_t tar;

371
372
  if (!cc_list)
    return 0;
373
  /* XXXXipv6 */
nils's avatar
nils committed
374
375
  tor_addr_from_ipv4h(&tar, addr);
  country = geoip_get_country_by_addr(&tar);
376
  name = geoip_get_country_name(country);
Nick Mathewson's avatar
Nick Mathewson committed
377
  return smartlist_contains_string_case(cc_list, name);
378
379
}

380
381
382
383
384
385
/** Return 1 if <b>addr</b>:<b>port</b> is permitted to publish to our
 * directory, based on <b>authdir_reject_policy</b>. Else return 0.
 */
int
authdir_policy_permits_address(uint32_t addr, uint16_t port)
{
386
387
  if (! addr_policy_permits_address(addr, port, authdir_reject_policy))
    return 0;
388
  return !addr_is_in_cc_list(addr, get_options()->AuthDirRejectCCs);
389
390
391
392
393
394
395
396
}

/** Return 1 if <b>addr</b>:<b>port</b> is considered valid in our
 * directory, based on <b>authdir_invalid_policy</b>. Else return 0.
 */
int
authdir_policy_valid_address(uint32_t addr, uint16_t port)
{
397
398
  if (! addr_policy_permits_address(addr, port, authdir_invalid_policy))
    return 0;
399
  return !addr_is_in_cc_list(addr, get_options()->AuthDirInvalidCCs);
400
401
}

402
403
404
405
406
407
/** Return 1 if <b>addr</b>:<b>port</b> should be marked as a bad dir,
 * based on <b>authdir_baddir_policy</b>. Else return 0.
 */
int
authdir_policy_baddir_address(uint32_t addr, uint16_t port)
{
408
409
  if (! addr_policy_permits_address(addr, port, authdir_baddir_policy))
    return 1;
410
  return addr_is_in_cc_list(addr, get_options()->AuthDirBadDirCCs);
411
412
}

413
414
415
416
417
418
/** Return 1 if <b>addr</b>:<b>port</b> should be marked as a bad exit,
 * based on <b>authdir_badexit_policy</b>. Else return 0.
 */
int
authdir_policy_badexit_address(uint32_t addr, uint16_t port)
{
419
420
  if (! addr_policy_permits_address(addr, port, authdir_badexit_policy))
    return 1;
421
  return addr_is_in_cc_list(addr, get_options()->AuthDirBadExitCCs);
422
423
}

424
#define REJECT(arg) \
425
  STMT_BEGIN *msg = tor_strdup(arg); goto err; STMT_END
426

427
428
429
/** Config helper: If there's any problem with the policy configuration
 * options in <b>options</b>, return -1 and set <b>msg</b> to a newly
 * allocated description of the error. Else return 0. */
430
int
431
validate_addr_policies(const or_options_t *options, char **msg)
432
{
433
434
435
  /* XXXX Maybe merge this into parse_policies_from_options, to make sure
   * that the two can't go out of sync. */

436
  smartlist_t *addr_policy=NULL;
437
438
439
  *msg = NULL;

  if (policies_parse_exit_policy(options->ExitPolicy, &addr_policy,
440
                                 options->IPv6Exit,
Karsten Loesing's avatar
Karsten Loesing committed
441
442
                                 options->ExitPolicyRejectPrivate, NULL,
                                 !options->BridgeRelay))
443
444
445
446
447
448
449
450
    REJECT("Error in ExitPolicy entry.");

  /* The rest of these calls *append* to addr_policy. So don't actually
   * use the results for anything other than checking if they parse! */
  if (parse_addr_policy(options->DirPolicy, &addr_policy, -1))
    REJECT("Error in DirPolicy entry.");
  if (parse_addr_policy(options->SocksPolicy, &addr_policy, -1))
    REJECT("Error in SocksPolicy entry.");
451
452
453
454
455
456
457
458
459
460
461
462
463
  if (parse_addr_policy(options->AuthDirReject, &addr_policy,
                        ADDR_POLICY_REJECT))
    REJECT("Error in AuthDirReject entry.");
  if (parse_addr_policy(options->AuthDirInvalid, &addr_policy,
                        ADDR_POLICY_REJECT))
    REJECT("Error in AuthDirInvalid entry.");
  if (parse_addr_policy(options->AuthDirBadDir, &addr_policy,
                        ADDR_POLICY_REJECT))
    REJECT("Error in AuthDirBadDir entry.");
  if (parse_addr_policy(options->AuthDirBadExit, &addr_policy,
                        ADDR_POLICY_REJECT))
    REJECT("Error in AuthDirBadExit entry.");

464
465
466
467
468
469
470
471
472
473
  if (parse_addr_policy(options->ReachableAddresses, &addr_policy,
                        ADDR_POLICY_ACCEPT))
    REJECT("Error in ReachableAddresses entry.");
  if (parse_addr_policy(options->ReachableORAddresses, &addr_policy,
                        ADDR_POLICY_ACCEPT))
    REJECT("Error in ReachableORAddresses entry.");
  if (parse_addr_policy(options->ReachableDirAddresses, &addr_policy,
                        ADDR_POLICY_ACCEPT))
    REJECT("Error in ReachableDirAddresses entry.");

Sebastian Hahn's avatar
Sebastian Hahn committed
474
 err:
475
  addr_policy_list_free(addr_policy);
476
477
478
479
  return *msg ? -1 : 0;
#undef REJECT
}

480
/** Parse <b>string</b> in the same way that the exit policy
481
482
483
 * is parsed, and put the processed version in *<b>policy</b>.
 * Ignore port specifiers.
 */
484
static int
485
load_policy_from_option(config_line_t *config, smartlist_t **policy,
486
487
                        int assume_action)
{
488
  int r;
489
  addr_policy_list_free(*policy);
490
  *policy = NULL;
491
  r = parse_addr_policy(config, policy, assume_action);
492
493
  if (r < 0) {
    return -1;
494
  }
495
  if (*policy) {
496
497
498
499
500
501
502
    SMARTLIST_FOREACH_BEGIN(*policy, addr_policy_t *, n) {
      /* ports aren't used in these. */
      if (n->prt_min > 1 || n->prt_max != 65535) {
        addr_policy_t newp, *c;
        memcpy(&newp, n, sizeof(newp));
        newp.prt_min = 1;
        newp.prt_max = 65535;
503
        newp.is_canonical = 0;
504
505
506
507
508
        c = addr_policy_get_canonical_entry(&newp);
        SMARTLIST_REPLACE_CURRENT(*policy, n, c);
        addr_policy_free(n);
      }
    } SMARTLIST_FOREACH_END(n);
509
510
  }
  return 0;
511
512
}

513
/** Set all policies based on <b>options</b>, which should have been validated
514
515
 * first by validate_addr_policies. */
int
516
policies_parse_from_options(const or_options_t *options)
517
{
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
  int ret = 0;
  if (load_policy_from_option(options->SocksPolicy, &socks_policy, -1) < 0)
    ret = -1;
  if (load_policy_from_option(options->DirPolicy, &dir_policy, -1) < 0)
    ret = -1;
  if (load_policy_from_option(options->AuthDirReject,
                              &authdir_reject_policy, ADDR_POLICY_REJECT) < 0)
    ret = -1;
  if (load_policy_from_option(options->AuthDirInvalid,
                              &authdir_invalid_policy, ADDR_POLICY_REJECT) < 0)
    ret = -1;
  if (load_policy_from_option(options->AuthDirBadDir,
                              &authdir_baddir_policy, ADDR_POLICY_REJECT) < 0)
    ret = -1;
  if (load_policy_from_option(options->AuthDirBadExit,
                              &authdir_badexit_policy, ADDR_POLICY_REJECT) < 0)
    ret = -1;
  if (parse_reachable_addresses() < 0)
    ret = -1;
  return ret;
538
539
540
541
542
543
544
545
546
547
}

/** Compare two provided address policy items, and return -1, 0, or 1
 * if the first is less than, equal to, or greater than the second. */
static int
cmp_single_addr_policy(addr_policy_t *a, addr_policy_t *b)
{
  int r;
  if ((r=((int)a->policy_type - (int)b->policy_type)))
    return r;
548
549
  if ((r=((int)a->is_private - (int)b->is_private)))
    return r;
550
  if ((r=tor_addr_compare(&a->addr, &b->addr, CMP_EXACT)))
551
    return r;
552
  if ((r=((int)a->maskbits - (int)b->maskbits)))
553
554
555
556
557
558
559
560
561
562
563
    return r;
  if ((r=((int)a->prt_min - (int)b->prt_min)))
    return r;
  if ((r=((int)a->prt_max - (int)b->prt_max)))
    return r;
  return 0;
}

/** Like cmp_single_addr_policy() above, but looks at the
 * whole set of policies in each case. */
int
564
cmp_addr_policies(smartlist_t *a, smartlist_t *b)
565
{
566
567
568
569
570
571
  int r, i;
  int len_a = a ? smartlist_len(a) : 0;
  int len_b = b ? smartlist_len(b) : 0;

  for (i = 0; i < len_a && i < len_b; ++i) {
    if ((r = cmp_single_addr_policy(smartlist_get(a, i), smartlist_get(b, i))))
572
573
      return r;
  }
574
  if (i == len_a && i == len_b)
575
    return 0;
576
  if (i < len_a)
577
578
579
580
581
    return -1;
  else
    return 1;
}

582
583
584
585
586
587
/** Node in hashtable used to store address policy entries. */
typedef struct policy_map_ent_t {
  HT_ENTRY(policy_map_ent_t) node;
  addr_policy_t *policy;
} policy_map_ent_t;

588
/* DOCDOC policy_root */
589
static HT_HEAD(policy_map, policy_map_ent_t) policy_root = HT_INITIALIZER();
590
591
592
593
594
595
596
597
598
599

/** Return true iff a and b are equal. */
static INLINE int
policy_eq(policy_map_ent_t *a, policy_map_ent_t *b)
{
  return cmp_single_addr_policy(a->policy, b->policy) == 0;
}

/** Return a hashcode for <b>ent</b> */
static unsigned int
600
policy_hash(const policy_map_ent_t *ent)
601
{
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
  const addr_policy_t *a = ent->policy;
  addr_policy_t aa;
  memset(&aa, 0, sizeof(aa));

  aa.prt_min = a->prt_min;
  aa.prt_max = a->prt_max;
  aa.maskbits = a->maskbits;
  aa.policy_type = a->policy_type;
  aa.is_private = a->is_private;

  if (a->is_private) {
    aa.is_private = 1;
  } else {
    tor_addr_copy_tight(&aa.addr, &a->addr);
  }
617

618
  return (unsigned) siphash24g(&aa, sizeof(aa));
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
}

HT_PROTOTYPE(policy_map, policy_map_ent_t, node, policy_hash,
             policy_eq)
HT_GENERATE(policy_map, policy_map_ent_t, node, policy_hash,
            policy_eq, 0.6, malloc, realloc, free)

/** Given a pointer to an addr_policy_t, return a copy of the pointer to the
 * "canonical" copy of that addr_policy_t; the canonical copy is a single
 * reference-counted object. */
addr_policy_t *
addr_policy_get_canonical_entry(addr_policy_t *e)
{
  policy_map_ent_t search, *found;
  if (e->is_canonical)
    return e;

  search.policy = e;
  found = HT_FIND(policy_map, &policy_root, &search);
  if (!found) {
    found = tor_malloc_zero(sizeof(policy_map_ent_t));
    found->policy = tor_memdup(e, sizeof(addr_policy_t));
    found->policy->is_canonical = 1;
642
    found->policy->refcnt = 0;
643
644
645
646
647
648
649
650
    HT_INSERT(policy_map, &policy_root, found);
  }

  tor_assert(!cmp_single_addr_policy(found->policy, e));
  ++found->policy->refcnt;
  return found->policy;
}

651
652
653
654
655
656
657
658
659
660
661
/** Helper for compare_tor_addr_to_addr_policy.  Implements the case where
 * addr and port are both known. */
static addr_policy_result_t
compare_known_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port,
                                      const smartlist_t *policy)
{
  /* We know the address and port, and we know the policy, so we can just
   * compute an exact match. */
  SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, tmpe) {
    /* Address is known */
    if (!tor_addr_compare_masked(addr, &tmpe->addr, tmpe->maskbits,
662
                                 CMP_EXACT)) {
663
664
665
666
      if (port >= tmpe->prt_min && port <= tmpe->prt_max) {
        /* Exact match for the policy */
        return tmpe->policy_type == ADDR_POLICY_ACCEPT ?
          ADDR_POLICY_ACCEPTED : ADDR_POLICY_REJECTED;
667
      }
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
    }
  } SMARTLIST_FOREACH_END(tmpe);

  /* accept all by default. */
  return ADDR_POLICY_ACCEPTED;
}

/** Helper for compare_tor_addr_to_addr_policy.  Implements the case where
 * addr is known but port is not. */
static addr_policy_result_t
compare_known_tor_addr_to_addr_policy_noport(const tor_addr_t *addr,
                                             const smartlist_t *policy)
{
  /* We look to see if there's a definite match.  If so, we return that
     match's value, unless there's an intervening possible match that says
     something different. */
  int maybe_accept = 0, maybe_reject = 0;

  SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, tmpe) {
    if (!tor_addr_compare_masked(addr, &tmpe->addr, tmpe->maskbits,
688
                                 CMP_EXACT)) {
689
690
691
692
693
694
695
696
697
698
      if (tmpe->prt_min <= 1 && tmpe->prt_max >= 65535) {
        /* Definitely matches, since it covers all ports. */
        if (tmpe->policy_type == ADDR_POLICY_ACCEPT) {
          /* If we already hit a clause that might trigger a 'reject', than we
           * can't be sure of this certain 'accept'.*/
          return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED :
            ADDR_POLICY_ACCEPTED;
        } else {
          return maybe_accept ? ADDR_POLICY_PROBABLY_REJECTED :
            ADDR_POLICY_REJECTED;
699
        }
700
701
702
703
704
705
      } else {
        /* Might match. */
        if (tmpe->policy_type == ADDR_POLICY_REJECT)
          maybe_reject = 1;
        else
          maybe_accept = 1;
706
707
      }
    }
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
  } SMARTLIST_FOREACH_END(tmpe);

  /* accept all by default. */
  return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED : ADDR_POLICY_ACCEPTED;
}

/** Helper for compare_tor_addr_to_addr_policy.  Implements the case where
 * port is known but address is not. */
static addr_policy_result_t
compare_unknown_tor_addr_to_addr_policy(uint16_t port,
                                        const smartlist_t *policy)
{
  /* We look to see if there's a definite match.  If so, we return that
     match's value, unless there's an intervening possible match that says
     something different. */
  int maybe_accept = 0, maybe_reject = 0;

  SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, tmpe) {
    if (tmpe->prt_min <= port && port <= tmpe->prt_max) {
Roger Dingledine's avatar
Roger Dingledine committed
727
      if (tmpe->maskbits == 0) {
728
729
730
731
732
733
734
735
736
737
        /* Definitely matches, since it covers all addresses. */
        if (tmpe->policy_type == ADDR_POLICY_ACCEPT) {
          /* If we already hit a clause that might trigger a 'reject', than we
           * can't be sure of this certain 'accept'.*/
          return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED :
            ADDR_POLICY_ACCEPTED;
        } else {
          return maybe_accept ? ADDR_POLICY_PROBABLY_REJECTED :
            ADDR_POLICY_REJECTED;
        }
738
      } else {
739
740
741
742
743
        /* Might match. */
        if (tmpe->policy_type == ADDR_POLICY_REJECT)
          maybe_reject = 1;
        else
          maybe_accept = 1;
744
745
      }
    }
746
  } SMARTLIST_FOREACH_END(tmpe);
747

748
749
750
751
  /* accept all by default. */
  return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED : ADDR_POLICY_ACCEPTED;
}

752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
/** Decide whether a given addr:port is definitely accepted,
 * definitely rejected, probably accepted, or probably rejected by a
 * given policy.  If <b>addr</b> is 0, we don't know the IP of the
 * target address.  If <b>port</b> is 0, we don't know the port of the
 * target address.  (At least one of <b>addr</b> and <b>port</b> must be
 * provided.  If you want to know whether a policy would definitely reject
 * an unknown address:port, use policy_is_reject_star().)
 *
 * We could do better by assuming that some ranges never match typical
 * addresses (127.0.0.1, and so on).  But we'll try this for now.
 */
addr_policy_result_t
compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port,
                                const smartlist_t *policy)
{
  if (!policy) {
    /* no policy? accept all. */
    return ADDR_POLICY_ACCEPTED;
770
  } else if (addr == NULL || tor_addr_is_null(addr)) {
771
772
773
774
775
    if (port == 0) {
      log_info(LD_BUG, "Rejecting null address with 0 port (family %d)",
               addr ? tor_addr_family(addr) : -1);
      return ADDR_POLICY_REJECTED;
    }
776
777
778
779
780
781
782
783
    return compare_unknown_tor_addr_to_addr_policy(port, policy);
  } else if (port == 0) {
    return compare_known_tor_addr_to_addr_policy_noport(addr, policy);
  } else {
    return compare_known_tor_addr_to_addr_policy(addr, port, policy);
  }
}

784
785
786
787
788
/** Return true iff the address policy <b>a</b> covers every case that
 * would be covered by <b>b</b>, so that a,b is redundant. */
static int
addr_policy_covers(addr_policy_t *a, addr_policy_t *b)
{
789
790
791
792
  if (tor_addr_family(&a->addr) != tor_addr_family(&b->addr)) {
    /* You can't cover a different family. */
    return 0;
  }
793
794
  /* We can ignore accept/reject, since "accept *:80, reject *:80" reduces
   * to "accept *:80". */
795
796
  if (a->maskbits > b->maskbits) {
    /* a has more fixed bits than b; it can't possibly cover b. */
797
798
    return 0;
  }
799
  if (tor_addr_compare_masked(&a->addr, &b->addr, a->maskbits, CMP_EXACT)) {
800
801
802
803
804
805
806
807
808
809
810
811
812
    /* There's a fixed bit in a that's set differently in b. */
    return 0;
  }
  return (a->prt_min <= b->prt_min && a->prt_max >= b->prt_max);
}

/** Return true iff the address policies <b>a</b> and <b>b</b> intersect,
 * that is, there exists an address/port that is covered by <b>a</b> that
 * is also covered by <b>b</b>.
 */
static int
addr_policy_intersects(addr_policy_t *a, addr_policy_t *b)
{
813
  maskbits_t minbits;
814
815
816
817
  /* All the bits we care about are those that are set in both
   * netmasks.  If they are equal in a and b's networkaddresses
   * then the networks intersect.  If there is a difference,
   * then they do not. */
818
819
820
821
  if (a->maskbits < b->maskbits)
    minbits = a->maskbits;
  else
    minbits = b->maskbits;
822
  if (tor_addr_compare_masked(&a->addr, &b->addr, minbits, CMP_EXACT))
823
824
825
826
827
828
829
830
831
    return 0;
  if (a->prt_max < b->prt_min || b->prt_max < a->prt_min)
    return 0;
  return 1;
}

/** Add the exit policy described by <b>more</b> to <b>policy</b>.
 */
static void
832
append_exit_policy_string(smartlist_t **policy, const char *more)
833
834
835
836
837
838
{
  config_line_t tmp;

  tmp.key = NULL;
  tmp.value = (char*) more;
  tmp.next = NULL;
839
840
841
  if (parse_addr_policy(&tmp, policy, -1)<0) {
    log_warn(LD_BUG, "Unable to parse internally generated policy %s",more);
  }
842
843
}

844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
/** Add "reject <b>addr</b>:*" to <b>dest</b>, creating the list as needed. */
void
addr_policy_append_reject_addr(smartlist_t **dest, const tor_addr_t *addr)
{
  addr_policy_t p, *add;
  memset(&p, 0, sizeof(p));
  p.policy_type = ADDR_POLICY_REJECT;
  p.maskbits = tor_addr_family(addr) == AF_INET6 ? 128 : 32;
  tor_addr_copy(&p.addr, addr);
  p.prt_min = 1;
  p.prt_max = 65535;

  add = addr_policy_get_canonical_entry(&p);
  if (!*dest)
    *dest = smartlist_new();
  smartlist_add(*dest, add);
}

862
863
/** Detect and excise "dead code" from the policy *<b>dest</b>. */
static void
864
exit_policy_remove_redundancies(smartlist_t *dest)
865
{
866
  addr_policy_t *ap, *tmp;
867
  int i, j;
868

869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
  /* Step one: kill every ipv4 thing after *4:*, every IPv6 thing after *6:*
   */
  {
    int kill_v4=0, kill_v6=0;
    for (i = 0; i < smartlist_len(dest); ++i) {
      sa_family_t family;
      ap = smartlist_get(dest, i);
      family = tor_addr_family(&ap->addr);
      if ((family == AF_INET && kill_v4) ||
          (family == AF_INET6 && kill_v6)) {
        smartlist_del_keeporder(dest, i--);
        addr_policy_free(ap);
        continue;
      }

      if (ap->maskbits == 0 && ap->prt_min <= 1 && ap->prt_max >= 65535) {
        /* This is a catch-all line -- later lines are unreachable. */
        if (family == AF_INET) {
          kill_v4 = 1;
        } else if (family == AF_INET6) {
          kill_v6 = 1;
        }
891
892
893
894
895
896
      }
    }
  }

  /* Step two: for every entry, see if there's a redundant entry
   * later on, and remove it. */
897
898
899
900
901
902
  for (i = 0; i < smartlist_len(dest)-1; ++i) {
    ap = smartlist_get(dest, i);
    for (j = i+1; j < smartlist_len(dest); ++j) {
      tmp = smartlist_get(dest, j);
      tor_assert(j > i);
      if (addr_policy_covers(ap, tmp)) {
903
        char p1[POLICY_BUF_LEN], p2[POLICY_BUF_LEN];
904
905
        policy_write_item(p1, sizeof(p1), tmp, 0);
        policy_write_item(p2, sizeof(p2), ap, 0);
906
        log_debug(LD_CONFIG, "Removing exit policy %s (%d).  It is made "
907
908
909
            "redundant by %s (%d).", p1, j, p2, i);
        smartlist_del_keeporder(dest, j--);
        addr_policy_free(tmp);
910
911
912
913
914
915
916
917
918
      }
    }
  }

  /* Step three: for every entry A, see if there's an entry B making this one
   * redundant later on.  This is the case if A and B are of the same type
   * (accept/reject), A is a subset of B, and there is no other entry of
   * different type in between those two that intersects with A.
   *
Nick Mathewson's avatar
Nick Mathewson committed
919
   * Anybody want to double-check the logic here? XXX
920
   */
921
922
923
  for (i = 0; i < smartlist_len(dest)-1; ++i) {
    ap = smartlist_get(dest, i);
    for (j = i+1; j < smartlist_len(dest); ++j) {
924
925
      // tor_assert(j > i); // j starts out at i+1; j only increases; i only
      //                    // decreases.
926
      tmp = smartlist_get(dest, j);
927
      if (ap->policy_type != tmp->policy_type) {
928
        if (addr_policy_intersects(ap, tmp))
929
930
931
          break;
      } else { /* policy_types are equal. */
        if (addr_policy_covers(tmp, ap)) {
932
          char p1[POLICY_BUF_LEN], p2[POLICY_BUF_LEN];
933
934
          policy_write_item(p1, sizeof(p1), ap, 0);
          policy_write_item(p2, sizeof(p2), tmp, 0);
935
          log_debug(LD_CONFIG, "Removing exit policy %s.  It is already "
Roger Dingledine's avatar
Roger Dingledine committed
936
              "covered by %s.", p1, p2);
937
938
          smartlist_del_keeporder(dest, i--);
          addr_policy_free(ap);
939
          break;
940
941
942
943
944
945
946
947
        }
      }
    }
  }
}

#define DEFAULT_EXIT_POLICY                                         \
  "reject *:25,reject *:119,reject *:135-139,reject *:445,"         \
948
  "reject *:563,reject *:1214,reject *:4661-4666,"                  \
949
950
951
  "reject *:6346-6429,reject *:6699,reject *:6881-6999,accept *:*"

/** Parse the exit policy <b>cfg</b> into the linked list *<b>dest</b>. If
Karsten Loesing's avatar
Karsten Loesing committed
952
953
 * cfg doesn't end in an absolute accept or reject and if
 * <b>add_default_policy</b> is true, add the default exit
954
955
956
 * policy afterwards. If <b>rejectprivate</b> is true, prepend
 * "reject private:*" to the policy. Return -1 if we can't parse cfg,
 * else return 0.
957
958
959
960
 *
 * This function is used to parse the exit policy from our torrc. For
 * the functions used to parse the exit policy from a router descriptor,
 * see router_add_exit_policy.
961
962
 */
int
963
policies_parse_exit_policy(config_line_t *cfg, smartlist_t **dest,
964
                           int ipv6_exit,
Karsten Loesing's avatar
Karsten Loesing committed
965
966
                           int rejectprivate, const char *local_address,
                           int add_default_policy)
967
{
968
969
970
  if (!ipv6_exit) {
    append_exit_policy_string(dest, "reject *6:*");
  }
971
  if (rejectprivate) {
972
    append_exit_policy_string(dest, "reject private:*");
973
974
975
976
977
978
    if (local_address) {
      char buf[POLICY_BUF_LEN];
      tor_snprintf(buf, sizeof(buf), "reject %s:*", local_address);
      append_exit_policy_string(dest, buf);
    }
  }
979
980
  if (parse_addr_policy(cfg, dest, -1))
    return -1;
981
  if (add_default_policy) {
Karsten Loesing's avatar
Karsten Loesing committed
982
    append_exit_policy_string(dest, DEFAULT_EXIT_POLICY);
983
984
985
986
  } else {
    append_exit_policy_string(dest, "reject *4:*");
    append_exit_policy_string(dest, "reject *6:*");
  }
987
988
  exit_policy_remove_redundancies(*dest);

989
990
991
  return 0;
}

992
993
994
995
996
/** Add "reject *:*" to the end of the policy in *<b>dest</b>, allocating
 * *<b>dest</b> as needed. */
void
policies_exit_policy_append_reject_star(smartlist_t **dest)
{
997
998
  append_exit_policy_string(dest, "reject *4:*");
  append_exit_policy_string(dest, "reject *6:*");
999
1000
}