policies.c 54.8 KB
Newer Older
1
/* Copyright (c) 2001-2004, Roger Dingledine.
2
 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
3
 * Copyright (c) 2007-2012, The Tor Project, Inc. */
4
5
6
7
8
9
10
11
/* See LICENSE for licensing information */

/**
 * \file policies.c
 * \brief Code to parse and use address policies and exit policies.
 **/

#include "or.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
12
#include "config.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
13
#include "dirserv.h"
14
#include "nodelist.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
15
#include "policies.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
16
#include "routerparse.h"
17
#include "geoip.h"
18
#include "ht.h"
19

20
/** Policy that addresses for incoming SOCKS connections must match. */
21
static smartlist_t *socks_policy = NULL;
22
/** Policy that addresses for incoming directory connections must match. */
23
static smartlist_t *dir_policy = NULL;
24
25
/** Policy that addresses for incoming router descriptors must match in order
 * to be published by us. */
26
static smartlist_t *authdir_reject_policy = NULL;
27
28
/** Policy that addresses for incoming router descriptors must match in order
 * to be marked as valid in our networkstatus. */
29
static smartlist_t *authdir_invalid_policy = NULL;
30
31
/** Policy that addresses for incoming router descriptors must <b>not</b>
 * match in order to not be marked as BadDirectory. */
32
static smartlist_t *authdir_baddir_policy = NULL;
33
34
/** Policy that addresses for incoming router descriptors must <b>not</b>
 * match in order to not be marked as BadExit. */
35
static smartlist_t *authdir_badexit_policy = NULL;
36
37
38

/** Parsed addr_policy_t describing which addresses we believe we can start
 * circuits at. */
39
static smartlist_t *reachable_or_addr_policy = NULL;
40
41
/** Parsed addr_policy_t describing which addresses we believe we can connect
 * to directories at. */
42
43
static smartlist_t *reachable_dir_addr_policy = NULL;

44
45
46
47
48
/** Element of an exit policy summary */
typedef struct policy_summary_item_t {
    uint16_t prt_min; /**< Lowest port number to accept/reject. */
    uint16_t prt_max; /**< Highest port number to accept/reject. */
    uint64_t reject_count; /**< Number of IP-Addresses that are rejected to
Nick Mathewson's avatar
Nick Mathewson committed
49
                                this port range. */
50
    unsigned int accepted:1; /** Has this port already been accepted */
51
52
} policy_summary_item_t;

53
54
55
56
57
58
59
60
61
/** Private networks.  This list is used in two places, once to expand the
 *  "private" keyword when parsing our own exit policy, secondly to ignore
 *  just such networks when building exit policy summaries.  It is important
 *  that all authorities agree on that list when creating summaries, so don't
 *  just change this without a proper migration plan and a proposal and stuff.
 */
static const char *private_nets[] = {
  "0.0.0.0/8", "169.254.0.0/16",
  "127.0.0.0/8", "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12",
62
63
64
65
  "[::]/8",
  "[fc00::]/7", "[fe80::]/10", "[fec0::]/10", "[ff00::]/8", "[::]/127",
  NULL
};
66

67
68
69
70
71
72
73
74
75
76
/** Replace all "private" entries in *<b>policy</b> with their expanded
 * equivalents. */
void
policy_expand_private(smartlist_t **policy)
{
  uint16_t port_min, port_max;

  int i;
  smartlist_t *tmp;

77
  if (!*policy) /*XXXX disallow NULL policies? */
78
79
    return;

80
  tmp = smartlist_new();
81

82
  SMARTLIST_FOREACH_BEGIN(*policy, addr_policy_t *, p) {
83
84
85
86
87
     if (! p->is_private) {
       smartlist_add(tmp, p);
       continue;
     }
     for (i = 0; private_nets[i]; ++i) {
88
89
90
91
       addr_policy_t newpolicy;
       memcpy(&newpolicy, p, sizeof(addr_policy_t));
       newpolicy.is_private = 0;
       newpolicy.is_canonical = 0;
92
93
       if (tor_addr_parse_mask_ports(private_nets[i], 0,
                               &newpolicy.addr,
94
                               &newpolicy.maskbits, &port_min, &port_max)<0) {
95
96
         tor_assert(0);
       }
97
       smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy));
98
99
     }
     addr_policy_free(p);
100
  } SMARTLIST_FOREACH_END(p);
101
102
103
104

  smartlist_free(*policy);
  *policy = tmp;
}
105

106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
/** Expand each of the AF_UNSPEC elements in *<b>policy</b> (which indicate
 * protocol-neutral wildcards) into a pair of wildcard elements: one IPv4-
 * specific and one IPv6-specific. */
void
policy_expand_unspec(smartlist_t **policy)
{
  smartlist_t *tmp;
  if (!*policy)
    return;

  tmp = smartlist_new();
  SMARTLIST_FOREACH_BEGIN(*policy, addr_policy_t *, p) {
    sa_family_t family = tor_addr_family(&p->addr);
    if (family == AF_INET6 || family == AF_INET || p->is_private) {
      smartlist_add(tmp, p);
    } else if (family == AF_UNSPEC) {
      addr_policy_t newpolicy_ipv4;
      addr_policy_t newpolicy_ipv6;
      memcpy(&newpolicy_ipv4, p, sizeof(addr_policy_t));
      memcpy(&newpolicy_ipv6, p, sizeof(addr_policy_t));
      newpolicy_ipv4.is_canonical = 0;
      newpolicy_ipv6.is_canonical = 0;
      if (p->maskbits != 0) {
        log_warn(LD_BUG, "AF_UNSPEC policy with maskbits==%d", p->maskbits);
        newpolicy_ipv4.maskbits = 0;
        newpolicy_ipv6.maskbits = 0;
      }
      tor_addr_from_ipv4h(&newpolicy_ipv4.addr, 0);
      tor_addr_from_ipv6_bytes(&newpolicy_ipv6.addr,
                               "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0");
      smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv4));
      smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv6));
      addr_policy_free(p);
    } else {
      log_warn(LD_BUG, "Funny-looking address policy with family %d", family);
      smartlist_add(tmp, p);
    }
  } SMARTLIST_FOREACH_END(p);

  smartlist_free(*policy);
  *policy = tmp;
}

149
150
151
/**
 * Given a linked list of config lines containing "allow" and "deny"
 * tokens, parse them and append the result to <b>dest</b>. Return -1
152
 * if any tokens are malformed (and don't append any), else return 0.
153
154
155
156
 *
 * If <b>assume_action</b> is nonnegative, then insert its action
 * (ADDR_POLICY_ACCEPT or ADDR_POLICY_REJECT) for items that specify no
 * action.
157
158
 */
static int
159
parse_addr_policy(config_line_t *cfg, smartlist_t **dest,
160
161
                  int assume_action)
{
162
  smartlist_t *result;
163
  smartlist_t *entries;
164
  addr_policy_t *item;
165
166
167
168
169
  int r = 0;

  if (!cfg)
    return 0;

170
171
  result = smartlist_new();
  entries = smartlist_new();
172
173
174
  for (; cfg; cfg = cfg->next) {
    smartlist_split_string(entries, cfg->value, ",",
                           SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0);
175
    SMARTLIST_FOREACH_BEGIN(entries, const char *, ent) {
176
      log_debug(LD_CONFIG,"Adding new entry '%s'",ent);
177
178
179
      item = router_parse_addr_policy_item_from_string(ent, assume_action);
      if (item) {
        smartlist_add(result, item);
180
181
182
183
      } else {
        log_warn(LD_CONFIG,"Malformed policy '%s'.", ent);
        r = -1;
      }
184
    } SMARTLIST_FOREACH_END(ent);
185
186
187
188
    SMARTLIST_FOREACH(entries, char *, ent, tor_free(ent));
    smartlist_clear(entries);
  }
  smartlist_free(entries);
189
190
191
192
  if (r == -1) {
    addr_policy_list_free(result);
  } else {
    policy_expand_private(&result);
193
    policy_expand_unspec(&result);
194
195
196
197
198
199
200
201
202

    if (*dest) {
      smartlist_add_all(*dest, result);
      smartlist_free(result);
    } else {
      *dest = result;
    }
  }

203
204
205
206
  return r;
}

/** Helper: parse the Reachable(Dir|OR)?Addresses fields into
207
208
209
210
 * reachable_(or|dir)_addr_policy.  The options should already have
 * been validated by validate_addr_policies.
 */
static int
211
212
parse_reachable_addresses(void)
{
213
  const or_options_t *options = get_options();
214
  int ret = 0;
215
216
217
218
219
220
221
222

  if (options->ReachableDirAddresses &&
      options->ReachableORAddresses &&
      options->ReachableAddresses) {
    log_warn(LD_CONFIG,
             "Both ReachableDirAddresses and ReachableORAddresses are set. "
             "ReachableAddresses setting will be ignored.");
  }
223
  addr_policy_list_free(reachable_or_addr_policy);
224
225
226
227
228
229
230
231
232
233
234
  reachable_or_addr_policy = NULL;
  if (!options->ReachableORAddresses && options->ReachableAddresses)
    log_info(LD_CONFIG,
             "Using ReachableAddresses as ReachableORAddresses.");
  if (parse_addr_policy(options->ReachableORAddresses ?
                          options->ReachableORAddresses :
                          options->ReachableAddresses,
                        &reachable_or_addr_policy, ADDR_POLICY_ACCEPT)) {
    log_warn(LD_CONFIG,
             "Error parsing Reachable%sAddresses entry; ignoring.",
             options->ReachableORAddresses ? "OR" : "");
235
    ret = -1;
236
237
  }

238
  addr_policy_list_free(reachable_dir_addr_policy);
239
240
241
242
243
244
245
246
247
248
249
  reachable_dir_addr_policy = NULL;
  if (!options->ReachableDirAddresses && options->ReachableAddresses)
    log_info(LD_CONFIG,
             "Using ReachableAddresses as ReachableDirAddresses");
  if (parse_addr_policy(options->ReachableDirAddresses ?
                          options->ReachableDirAddresses :
                          options->ReachableAddresses,
                        &reachable_dir_addr_policy, ADDR_POLICY_ACCEPT)) {
    if (options->ReachableDirAddresses)
      log_warn(LD_CONFIG,
               "Error parsing ReachableDirAddresses entry; ignoring.");
250
    ret = -1;
251
  }
252
  return ret;
253
254
255
256
257
258
259
260
}

/** Return true iff the firewall options might block any address:port
 * combination.
 */
int
firewall_is_fascist_or(void)
{
261
  return reachable_or_addr_policy != NULL;
262
263
264
265
266
267
}

/** Return true iff <b>policy</b> (possibly NULL) will allow a
 * connection to <b>addr</b>:<b>port</b>.
 */
static int
268
addr_policy_permits_tor_addr(const tor_addr_t *addr, uint16_t port,
269
                            smartlist_t *policy)
270
271
{
  addr_policy_result_t p;
272
  p = compare_tor_addr_to_addr_policy(addr, port, policy);
273
274
275
276
277
278
279
280
281
282
283
284
285
  switch (p) {
    case ADDR_POLICY_PROBABLY_ACCEPTED:
    case ADDR_POLICY_ACCEPTED:
      return 1;
    case ADDR_POLICY_PROBABLY_REJECTED:
    case ADDR_POLICY_REJECTED:
      return 0;
    default:
      log_warn(LD_BUG, "Unexpected result: %d", (int)p);
      return 0;
  }
}

286
287
288
289
/** Return true iff <b> policy</b> (possibly NULL) will allow a connection to
 * <b>addr</b>:<b>port</b>.  <b>addr</b> is an IPv4 address given in host
 * order. */
/* XXXX deprecate when possible. */
290
291
292
293
294
295
296
297
298
static int
addr_policy_permits_address(uint32_t addr, uint16_t port,
                            smartlist_t *policy)
{
  tor_addr_t a;
  tor_addr_from_ipv4h(&a, addr);
  return addr_policy_permits_tor_addr(&a, port, policy);
}

299
300
/** Return true iff we think our firewall will let us make an OR connection to
 * addr:port. */
301
int
302
fascist_firewall_allows_address_or(const tor_addr_t *addr, uint16_t port)
303
{
304
  return addr_policy_permits_tor_addr(addr, port,
305
306
307
                                     reachable_or_addr_policy);
}

308
309
/** Return true iff we think our firewall will let us make an OR connection to
 * <b>ri</b>. */
310
int
311
fascist_firewall_allows_or(const routerinfo_t *ri)
312
{
313
  /* XXXX proposal 118 */
314
315
316
317
318
  tor_addr_t addr;
  tor_addr_from_ipv4h(&addr, ri->addr);
  return fascist_firewall_allows_address_or(&addr, ri->or_port);
}

319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
/** Return true iff we think our firewall will let us make an OR connection to
 * <b>node</b>. */
int
fascist_firewall_allows_node(const node_t *node)
{
  if (node->ri) {
    return fascist_firewall_allows_or(node->ri);
  } else if (node->rs) {
    tor_addr_t addr;
    tor_addr_from_ipv4h(&addr, node->rs->addr);
    return fascist_firewall_allows_address_or(&addr, node->rs->or_port);
  } else {
    return 1;
  }
}

335
336
/** Return true iff we think our firewall will let us make a directory
 * connection to addr:port. */
337
int
338
fascist_firewall_allows_address_dir(const tor_addr_t *addr, uint16_t port)
339
{
340
341
  return addr_policy_permits_tor_addr(addr, port,
                                      reachable_dir_addr_policy);
342
343
344
345
346
347
}

/** Return 1 if <b>addr</b> is permitted to connect to our dir port,
 * based on <b>dir_policy</b>. Else return 0.
 */
int
348
dir_policy_permits_address(const tor_addr_t *addr)
349
{
350
  return addr_policy_permits_tor_addr(addr, 1, dir_policy);
351
352
353
354
355
356
}

/** Return 1 if <b>addr</b> is permitted to connect to our socks port,
 * based on <b>socks_policy</b>. Else return 0.
 */
int
357
socks_policy_permits_address(const tor_addr_t *addr)
358
{
359
  return addr_policy_permits_tor_addr(addr, 1, socks_policy);
360
361
}

362
/** Return true iff the address <b>addr</b> is in a country listed in the
363
 * case-insensitive list of country codes <b>cc_list</b>. */
364
365
366
367
368
static int
addr_is_in_cc_list(uint32_t addr, const smartlist_t *cc_list)
{
  country_t country;
  const char *name;
nils's avatar
nils committed
369
370
  tor_addr_t tar;

371
372
  if (!cc_list)
    return 0;
373
  /* XXXXipv6 */
nils's avatar
nils committed
374
375
  tor_addr_from_ipv4h(&tar, addr);
  country = geoip_get_country_by_addr(&tar);
376
377
378
379
  name = geoip_get_country_name(country);
  return smartlist_string_isin_case(cc_list, name);
}

380
381
382
383
384
385
/** Return 1 if <b>addr</b>:<b>port</b> is permitted to publish to our
 * directory, based on <b>authdir_reject_policy</b>. Else return 0.
 */
int
authdir_policy_permits_address(uint32_t addr, uint16_t port)
{
386
387
  if (! addr_policy_permits_address(addr, port, authdir_reject_policy))
    return 0;
388
  return !addr_is_in_cc_list(addr, get_options()->AuthDirRejectCCs);
389
390
391
392
393
394
395
396
}

/** Return 1 if <b>addr</b>:<b>port</b> is considered valid in our
 * directory, based on <b>authdir_invalid_policy</b>. Else return 0.
 */
int
authdir_policy_valid_address(uint32_t addr, uint16_t port)
{
397
398
  if (! addr_policy_permits_address(addr, port, authdir_invalid_policy))
    return 0;
399
  return !addr_is_in_cc_list(addr, get_options()->AuthDirInvalidCCs);
400
401
}

402
403
404
405
406
407
/** Return 1 if <b>addr</b>:<b>port</b> should be marked as a bad dir,
 * based on <b>authdir_baddir_policy</b>. Else return 0.
 */
int
authdir_policy_baddir_address(uint32_t addr, uint16_t port)
{
408
409
  if (! addr_policy_permits_address(addr, port, authdir_baddir_policy))
    return 1;
410
  return addr_is_in_cc_list(addr, get_options()->AuthDirBadDirCCs);
411
412
}

413
414
415
416
417
418
/** Return 1 if <b>addr</b>:<b>port</b> should be marked as a bad exit,
 * based on <b>authdir_badexit_policy</b>. Else return 0.
 */
int
authdir_policy_badexit_address(uint32_t addr, uint16_t port)
{
419
420
  if (! addr_policy_permits_address(addr, port, authdir_badexit_policy))
    return 1;
421
  return addr_is_in_cc_list(addr, get_options()->AuthDirBadExitCCs);
422
423
}

424
#define REJECT(arg) \
425
  STMT_BEGIN *msg = tor_strdup(arg); goto err; STMT_END
426

427
428
429
/** Config helper: If there's any problem with the policy configuration
 * options in <b>options</b>, return -1 and set <b>msg</b> to a newly
 * allocated description of the error. Else return 0. */
430
int
431
validate_addr_policies(const or_options_t *options, char **msg)
432
{
433
434
435
  /* XXXX Maybe merge this into parse_policies_from_options, to make sure
   * that the two can't go out of sync. */

436
  smartlist_t *addr_policy=NULL;
437
438
439
  *msg = NULL;

  if (policies_parse_exit_policy(options->ExitPolicy, &addr_policy,
440
                                 options->IPv6Exit,
Karsten Loesing's avatar
Karsten Loesing committed
441
442
                                 options->ExitPolicyRejectPrivate, NULL,
                                 !options->BridgeRelay))
443
444
445
446
447
448
449
450
    REJECT("Error in ExitPolicy entry.");

  /* The rest of these calls *append* to addr_policy. So don't actually
   * use the results for anything other than checking if they parse! */
  if (parse_addr_policy(options->DirPolicy, &addr_policy, -1))
    REJECT("Error in DirPolicy entry.");
  if (parse_addr_policy(options->SocksPolicy, &addr_policy, -1))
    REJECT("Error in SocksPolicy entry.");
451
452
453
454
455
456
457
458
459
460
461
462
463
  if (parse_addr_policy(options->AuthDirReject, &addr_policy,
                        ADDR_POLICY_REJECT))
    REJECT("Error in AuthDirReject entry.");
  if (parse_addr_policy(options->AuthDirInvalid, &addr_policy,
                        ADDR_POLICY_REJECT))
    REJECT("Error in AuthDirInvalid entry.");
  if (parse_addr_policy(options->AuthDirBadDir, &addr_policy,
                        ADDR_POLICY_REJECT))
    REJECT("Error in AuthDirBadDir entry.");
  if (parse_addr_policy(options->AuthDirBadExit, &addr_policy,
                        ADDR_POLICY_REJECT))
    REJECT("Error in AuthDirBadExit entry.");

464
465
466
467
468
469
470
471
472
473
  if (parse_addr_policy(options->ReachableAddresses, &addr_policy,
                        ADDR_POLICY_ACCEPT))
    REJECT("Error in ReachableAddresses entry.");
  if (parse_addr_policy(options->ReachableORAddresses, &addr_policy,
                        ADDR_POLICY_ACCEPT))
    REJECT("Error in ReachableORAddresses entry.");
  if (parse_addr_policy(options->ReachableDirAddresses, &addr_policy,
                        ADDR_POLICY_ACCEPT))
    REJECT("Error in ReachableDirAddresses entry.");

Sebastian Hahn's avatar
Sebastian Hahn committed
474
 err:
475
  addr_policy_list_free(addr_policy);
476
477
478
479
  return *msg ? -1 : 0;
#undef REJECT
}

480
/** Parse <b>string</b> in the same way that the exit policy
481
482
483
 * is parsed, and put the processed version in *<b>policy</b>.
 * Ignore port specifiers.
 */
484
static int
485
load_policy_from_option(config_line_t *config, smartlist_t **policy,
486
487
                        int assume_action)
{
488
  int r;
489
  addr_policy_list_free(*policy);
490
  *policy = NULL;
491
  r = parse_addr_policy(config, policy, assume_action);
492
493
  if (r < 0) {
    return -1;
494
  }
495
  if (*policy) {
496
497
498
499
500
501
502
    SMARTLIST_FOREACH_BEGIN(*policy, addr_policy_t *, n) {
      /* ports aren't used in these. */
      if (n->prt_min > 1 || n->prt_max != 65535) {
        addr_policy_t newp, *c;
        memcpy(&newp, n, sizeof(newp));
        newp.prt_min = 1;
        newp.prt_max = 65535;
503
        newp.is_canonical = 0;
504
505
506
507
508
        c = addr_policy_get_canonical_entry(&newp);
        SMARTLIST_REPLACE_CURRENT(*policy, n, c);
        addr_policy_free(n);
      }
    } SMARTLIST_FOREACH_END(n);
509
510
  }
  return 0;
511
512
}

513
/** Set all policies based on <b>options</b>, which should have been validated
514
515
 * first by validate_addr_policies. */
int
516
policies_parse_from_options(const or_options_t *options)
517
{
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
  int ret = 0;
  if (load_policy_from_option(options->SocksPolicy, &socks_policy, -1) < 0)
    ret = -1;
  if (load_policy_from_option(options->DirPolicy, &dir_policy, -1) < 0)
    ret = -1;
  if (load_policy_from_option(options->AuthDirReject,
                              &authdir_reject_policy, ADDR_POLICY_REJECT) < 0)
    ret = -1;
  if (load_policy_from_option(options->AuthDirInvalid,
                              &authdir_invalid_policy, ADDR_POLICY_REJECT) < 0)
    ret = -1;
  if (load_policy_from_option(options->AuthDirBadDir,
                              &authdir_baddir_policy, ADDR_POLICY_REJECT) < 0)
    ret = -1;
  if (load_policy_from_option(options->AuthDirBadExit,
                              &authdir_badexit_policy, ADDR_POLICY_REJECT) < 0)
    ret = -1;
  if (parse_reachable_addresses() < 0)
    ret = -1;
  return ret;
538
539
540
541
542
543
544
545
546
547
}

/** Compare two provided address policy items, and return -1, 0, or 1
 * if the first is less than, equal to, or greater than the second. */
static int
cmp_single_addr_policy(addr_policy_t *a, addr_policy_t *b)
{
  int r;
  if ((r=((int)a->policy_type - (int)b->policy_type)))
    return r;
548
549
  if ((r=((int)a->is_private - (int)b->is_private)))
    return r;
550
  if ((r=tor_addr_compare(&a->addr, &b->addr, CMP_EXACT)))
551
    return r;
552
  if ((r=((int)a->maskbits - (int)b->maskbits)))
553
554
555
556
557
558
559
560
561
562
563
    return r;
  if ((r=((int)a->prt_min - (int)b->prt_min)))
    return r;
  if ((r=((int)a->prt_max - (int)b->prt_max)))
    return r;
  return 0;
}

/** Like cmp_single_addr_policy() above, but looks at the
 * whole set of policies in each case. */
int
564
cmp_addr_policies(smartlist_t *a, smartlist_t *b)
565
{
566
567
568
569
570
571
  int r, i;
  int len_a = a ? smartlist_len(a) : 0;
  int len_b = b ? smartlist_len(b) : 0;

  for (i = 0; i < len_a && i < len_b; ++i) {
    if ((r = cmp_single_addr_policy(smartlist_get(a, i), smartlist_get(b, i))))
572
573
      return r;
  }
574
  if (i == len_a && i == len_b)
575
    return 0;
576
  if (i < len_a)
577
578
579
580
581
    return -1;
  else
    return 1;
}

582
583
584
585
586
587
/** Node in hashtable used to store address policy entries. */
typedef struct policy_map_ent_t {
  HT_ENTRY(policy_map_ent_t) node;
  addr_policy_t *policy;
} policy_map_ent_t;

588
/* DOCDOC policy_root */
589
static HT_HEAD(policy_map, policy_map_ent_t) policy_root = HT_INITIALIZER();
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606

/** Return true iff a and b are equal. */
static INLINE int
policy_eq(policy_map_ent_t *a, policy_map_ent_t *b)
{
  return cmp_single_addr_policy(a->policy, b->policy) == 0;
}

/** Return a hashcode for <b>ent</b> */
static unsigned int
policy_hash(policy_map_ent_t *ent)
{
  addr_policy_t *a = ent->policy;
  unsigned int r;
  if (a->is_private)
    r = 0x1234abcd;
  else
607
    r = tor_addr_hash(&a->addr);
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
  r += a->prt_min << 8;
  r += a->prt_max << 16;
  r += a->maskbits;
  if (a->policy_type == ADDR_POLICY_REJECT)
    r ^= 0xffffffff;

  return r;
}

HT_PROTOTYPE(policy_map, policy_map_ent_t, node, policy_hash,
             policy_eq)
HT_GENERATE(policy_map, policy_map_ent_t, node, policy_hash,
            policy_eq, 0.6, malloc, realloc, free)

/** Given a pointer to an addr_policy_t, return a copy of the pointer to the
 * "canonical" copy of that addr_policy_t; the canonical copy is a single
 * reference-counted object. */
addr_policy_t *
addr_policy_get_canonical_entry(addr_policy_t *e)
{
  policy_map_ent_t search, *found;
  if (e->is_canonical)
    return e;

  search.policy = e;
  found = HT_FIND(policy_map, &policy_root, &search);
  if (!found) {
    found = tor_malloc_zero(sizeof(policy_map_ent_t));
    found->policy = tor_memdup(e, sizeof(addr_policy_t));
    found->policy->is_canonical = 1;
638
    found->policy->refcnt = 0;
639
640
641
642
643
644
645
646
    HT_INSERT(policy_map, &policy_root, found);
  }

  tor_assert(!cmp_single_addr_policy(found->policy, e));
  ++found->policy->refcnt;
  return found->policy;
}

647
648
649
650
651
652
653
654
655
656
657
/** Helper for compare_tor_addr_to_addr_policy.  Implements the case where
 * addr and port are both known. */
static addr_policy_result_t
compare_known_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port,
                                      const smartlist_t *policy)
{
  /* We know the address and port, and we know the policy, so we can just
   * compute an exact match. */
  SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, tmpe) {
    /* Address is known */
    if (!tor_addr_compare_masked(addr, &tmpe->addr, tmpe->maskbits,
658
                                 CMP_EXACT)) {
659
660
661
662
      if (port >= tmpe->prt_min && port <= tmpe->prt_max) {
        /* Exact match for the policy */
        return tmpe->policy_type == ADDR_POLICY_ACCEPT ?
          ADDR_POLICY_ACCEPTED : ADDR_POLICY_REJECTED;
663
      }
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
    }
  } SMARTLIST_FOREACH_END(tmpe);

  /* accept all by default. */
  return ADDR_POLICY_ACCEPTED;
}

/** Helper for compare_tor_addr_to_addr_policy.  Implements the case where
 * addr is known but port is not. */
static addr_policy_result_t
compare_known_tor_addr_to_addr_policy_noport(const tor_addr_t *addr,
                                             const smartlist_t *policy)
{
  /* We look to see if there's a definite match.  If so, we return that
     match's value, unless there's an intervening possible match that says
     something different. */
  int maybe_accept = 0, maybe_reject = 0;

  SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, tmpe) {
    if (!tor_addr_compare_masked(addr, &tmpe->addr, tmpe->maskbits,
684
                                 CMP_EXACT)) {
685
686
687
688
689
690
691
692
693
694
      if (tmpe->prt_min <= 1 && tmpe->prt_max >= 65535) {
        /* Definitely matches, since it covers all ports. */
        if (tmpe->policy_type == ADDR_POLICY_ACCEPT) {
          /* If we already hit a clause that might trigger a 'reject', than we
           * can't be sure of this certain 'accept'.*/
          return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED :
            ADDR_POLICY_ACCEPTED;
        } else {
          return maybe_accept ? ADDR_POLICY_PROBABLY_REJECTED :
            ADDR_POLICY_REJECTED;
695
        }
696
697
698
699
700
701
      } else {
        /* Might match. */
        if (tmpe->policy_type == ADDR_POLICY_REJECT)
          maybe_reject = 1;
        else
          maybe_accept = 1;
702
703
      }
    }
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
  } SMARTLIST_FOREACH_END(tmpe);

  /* accept all by default. */
  return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED : ADDR_POLICY_ACCEPTED;
}

/** Helper for compare_tor_addr_to_addr_policy.  Implements the case where
 * port is known but address is not. */
static addr_policy_result_t
compare_unknown_tor_addr_to_addr_policy(uint16_t port,
                                        const smartlist_t *policy)
{
  /* We look to see if there's a definite match.  If so, we return that
     match's value, unless there's an intervening possible match that says
     something different. */
  int maybe_accept = 0, maybe_reject = 0;

  SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, tmpe) {
    if (tmpe->prt_min <= port && port <= tmpe->prt_max) {
Roger Dingledine's avatar
Roger Dingledine committed
723
      if (tmpe->maskbits == 0) {
724
725
726
727
728
729
730
731
732
733
        /* Definitely matches, since it covers all addresses. */
        if (tmpe->policy_type == ADDR_POLICY_ACCEPT) {
          /* If we already hit a clause that might trigger a 'reject', than we
           * can't be sure of this certain 'accept'.*/
          return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED :
            ADDR_POLICY_ACCEPTED;
        } else {
          return maybe_accept ? ADDR_POLICY_PROBABLY_REJECTED :
            ADDR_POLICY_REJECTED;
        }
734
      } else {
735
736
737
738
739
        /* Might match. */
        if (tmpe->policy_type == ADDR_POLICY_REJECT)
          maybe_reject = 1;
        else
          maybe_accept = 1;
740
741
      }
    }
742
  } SMARTLIST_FOREACH_END(tmpe);
743

744
745
746
747
  /* accept all by default. */
  return maybe_reject ? ADDR_POLICY_PROBABLY_ACCEPTED : ADDR_POLICY_ACCEPTED;
}

748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
/** Decide whether a given addr:port is definitely accepted,
 * definitely rejected, probably accepted, or probably rejected by a
 * given policy.  If <b>addr</b> is 0, we don't know the IP of the
 * target address.  If <b>port</b> is 0, we don't know the port of the
 * target address.  (At least one of <b>addr</b> and <b>port</b> must be
 * provided.  If you want to know whether a policy would definitely reject
 * an unknown address:port, use policy_is_reject_star().)
 *
 * We could do better by assuming that some ranges never match typical
 * addresses (127.0.0.1, and so on).  But we'll try this for now.
 */
addr_policy_result_t
compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port,
                                const smartlist_t *policy)
{
  if (!policy) {
    /* no policy? accept all. */
    return ADDR_POLICY_ACCEPTED;
766
  } else if (addr == NULL || tor_addr_is_null(addr)) {
767
768
769
770
771
    if (port == 0) {
      log_info(LD_BUG, "Rejecting null address with 0 port (family %d)",
               addr ? tor_addr_family(addr) : -1);
      return ADDR_POLICY_REJECTED;
    }
772
773
774
775
776
777
778
779
    return compare_unknown_tor_addr_to_addr_policy(port, policy);
  } else if (port == 0) {
    return compare_known_tor_addr_to_addr_policy_noport(addr, policy);
  } else {
    return compare_known_tor_addr_to_addr_policy(addr, port, policy);
  }
}

780
781
782
783
784
/** Return true iff the address policy <b>a</b> covers every case that
 * would be covered by <b>b</b>, so that a,b is redundant. */
static int
addr_policy_covers(addr_policy_t *a, addr_policy_t *b)
{
785
786
787
788
  if (tor_addr_family(&a->addr) != tor_addr_family(&b->addr)) {
    /* You can't cover a different family. */
    return 0;
  }
789
790
  /* We can ignore accept/reject, since "accept *:80, reject *:80" reduces
   * to "accept *:80". */
791
792
  if (a->maskbits > b->maskbits) {
    /* a has more fixed bits than b; it can't possibly cover b. */
793
794
    return 0;
  }
795
  if (tor_addr_compare_masked(&a->addr, &b->addr, a->maskbits, CMP_EXACT)) {
796
797
798
799
800
801
802
803
804
805
806
807
808
    /* There's a fixed bit in a that's set differently in b. */
    return 0;
  }
  return (a->prt_min <= b->prt_min && a->prt_max >= b->prt_max);
}

/** Return true iff the address policies <b>a</b> and <b>b</b> intersect,
 * that is, there exists an address/port that is covered by <b>a</b> that
 * is also covered by <b>b</b>.
 */
static int
addr_policy_intersects(addr_policy_t *a, addr_policy_t *b)
{
809
  maskbits_t minbits;
810
811
812
813
  /* All the bits we care about are those that are set in both
   * netmasks.  If they are equal in a and b's networkaddresses
   * then the networks intersect.  If there is a difference,
   * then they do not. */
814
815
816
817
  if (a->maskbits < b->maskbits)
    minbits = a->maskbits;
  else
    minbits = b->maskbits;
818
  if (tor_addr_compare_masked(&a->addr, &b->addr, minbits, CMP_EXACT))
819
820
821
822
823
824
825
826
827
    return 0;
  if (a->prt_max < b->prt_min || b->prt_max < a->prt_min)
    return 0;
  return 1;
}

/** Add the exit policy described by <b>more</b> to <b>policy</b>.
 */
static void
828
append_exit_policy_string(smartlist_t **policy, const char *more)
829
830
831
832
833
834
{
  config_line_t tmp;

  tmp.key = NULL;
  tmp.value = (char*) more;
  tmp.next = NULL;
835
836
837
  if (parse_addr_policy(&tmp, policy, -1)<0) {
    log_warn(LD_BUG, "Unable to parse internally generated policy %s",more);
  }
838
839
840
841
}

/** Detect and excise "dead code" from the policy *<b>dest</b>. */
static void
842
exit_policy_remove_redundancies(smartlist_t *dest)
843
{
844
  addr_policy_t *ap, *tmp;
845
  int i, j;
846

847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
  /* Step one: kill every ipv4 thing after *4:*, every IPv6 thing after *6:*
   */
  {
    int kill_v4=0, kill_v6=0;
    for (i = 0; i < smartlist_len(dest); ++i) {
      sa_family_t family;
      ap = smartlist_get(dest, i);
      family = tor_addr_family(&ap->addr);
      if ((family == AF_INET && kill_v4) ||
          (family == AF_INET6 && kill_v6)) {
        smartlist_del_keeporder(dest, i--);
        addr_policy_free(ap);
        continue;
      }

      if (ap->maskbits == 0 && ap->prt_min <= 1 && ap->prt_max >= 65535) {
        /* This is a catch-all line -- later lines are unreachable. */
        if (family == AF_INET) {
          kill_v4 = 1;
        } else if (family == AF_INET6) {
          kill_v6 = 1;
        }
869
870
871
872
873
874
      }
    }
  }

  /* Step two: for every entry, see if there's a redundant entry
   * later on, and remove it. */
875
876
877
878
879
880
  for (i = 0; i < smartlist_len(dest)-1; ++i) {
    ap = smartlist_get(dest, i);
    for (j = i+1; j < smartlist_len(dest); ++j) {
      tmp = smartlist_get(dest, j);
      tor_assert(j > i);
      if (addr_policy_covers(ap, tmp)) {
881
        char p1[POLICY_BUF_LEN], p2[POLICY_BUF_LEN];
882
883
        policy_write_item(p1, sizeof(p1), tmp, 0);
        policy_write_item(p2, sizeof(p2), ap, 0);
884
885
886
887
        log(LOG_DEBUG, LD_CONFIG, "Removing exit policy %s (%d).  It is made "
            "redundant by %s (%d).", p1, j, p2, i);
        smartlist_del_keeporder(dest, j--);
        addr_policy_free(tmp);
888
889
890
891
892
893
894
895
896
      }
    }
  }

  /* Step three: for every entry A, see if there's an entry B making this one
   * redundant later on.  This is the case if A and B are of the same type
   * (accept/reject), A is a subset of B, and there is no other entry of
   * different type in between those two that intersects with A.
   *
Nick Mathewson's avatar
Nick Mathewson committed
897
   * Anybody want to double-check the logic here? XXX
898
   */
899
900
901
  for (i = 0; i < smartlist_len(dest)-1; ++i) {
    ap = smartlist_get(dest, i);
    for (j = i+1; j < smartlist_len(dest); ++j) {
902
903
      // tor_assert(j > i); // j starts out at i+1; j only increases; i only
      //                    // decreases.
904
      tmp = smartlist_get(dest, j);
905
      if (ap->policy_type != tmp->policy_type) {
906
        if (addr_policy_intersects(ap, tmp))
907
908
909
          break;
      } else { /* policy_types are equal. */
        if (addr_policy_covers(tmp, ap)) {
910
          char p1[POLICY_BUF_LEN], p2[POLICY_BUF_LEN];
911
912
          policy_write_item(p1, sizeof(p1), ap, 0);
          policy_write_item(p2, sizeof(p2), tmp, 0);
913
          log(LOG_DEBUG, LD_CONFIG, "Removing exit policy %s.  It is already "
Roger Dingledine's avatar
Roger Dingledine committed
914
              "covered by %s.", p1, p2);
915
916
          smartlist_del_keeporder(dest, i--);
          addr_policy_free(ap);
917
          break;
918
919
920
921
922
923
924
925
        }
      }
    }
  }
}

#define DEFAULT_EXIT_POLICY                                         \
  "reject *:25,reject *:119,reject *:135-139,reject *:445,"         \
926
  "reject *:563,reject *:1214,reject *:4661-4666,"                  \
927
928
929
  "reject *:6346-6429,reject *:6699,reject *:6881-6999,accept *:*"

/** Parse the exit policy <b>cfg</b> into the linked list *<b>dest</b>. If
Karsten Loesing's avatar
Karsten Loesing committed
930
931
 * cfg doesn't end in an absolute accept or reject and if
 * <b>add_default_policy</b> is true, add the default exit
932
933
934
 * policy afterwards. If <b>rejectprivate</b> is true, prepend
 * "reject private:*" to the policy. Return -1 if we can't parse cfg,
 * else return 0.
935
936
937
938
 *
 * This function is used to parse the exit policy from our torrc. For
 * the functions used to parse the exit policy from a router descriptor,
 * see router_add_exit_policy.
939
940
 */
int
941
policies_parse_exit_policy(config_line_t *cfg, smartlist_t **dest,
942
                           int ipv6_exit,
Karsten Loesing's avatar
Karsten Loesing committed
943
944
                           int rejectprivate, const char *local_address,
                           int add_default_policy)
945
{
946
947
948
  if (!ipv6_exit) {
    append_exit_policy_string(dest, "reject *6:*");
  }
949
  if (rejectprivate) {
950
    append_exit_policy_string(dest, "reject private:*");
951
952
953
954
955
956
    if (local_address) {
      char buf[POLICY_BUF_LEN];
      tor_snprintf(buf, sizeof(buf), "reject %s:*", local_address);
      append_exit_policy_string(dest, buf);
    }
  }
957
958
  if (parse_addr_policy(cfg, dest, -1))
    return -1;
959
  if (add_default_policy) {
Karsten Loesing's avatar
Karsten Loesing committed
960
    append_exit_policy_string(dest, DEFAULT_EXIT_POLICY);
961
962
963
964
  } else {
    append_exit_policy_string(dest, "reject *4:*");
    append_exit_policy_string(dest, "reject *6:*");
  }
965
966
  exit_policy_remove_redundancies(*dest);

967
968
969
  return 0;
}

970
971
972
973
974
/** Add "reject *:*" to the end of the policy in *<b>dest</b>, allocating
 * *<b>dest</b> as needed. */
void
policies_exit_policy_append_reject_star(smartlist_t **dest)
{
975
976
  append_exit_policy_string(dest, "reject *4:*");
  append_exit_policy_string(dest, "reject *6:*");
977
978
}

979
980
981
982
/** Replace the exit policy of <b>node</b> with reject *:* */
void
policies_set_node_exitpolicy_to_reject_all(node_t *node)
{
983
  node->rejects_all = 1;
984
}
985

986
/** Return 1 if there is at least one /8 subnet in <b>policy</b> that
987
 * allows exiting to <b>port</b>.  Otherwise, return 0. */
988
989
990
static int
exit_policy_is_general_exit_helper(smartlist_t *policy, int port)
{
991
  uint32_t mask, ip, i;
992
993
994
995
  /* Is this /8 rejected (1), or undecided (0)? */
  char subnet_status[256];

  memset(subnet_status, 0, sizeof(subnet_status));
996
  SMARTLIST_FOREACH_BEGIN(policy, addr_policy_t *, p) {
997
998
    if (tor_addr_family(&p->addr) != AF_INET)
      continue; /* IPv4 only for now */
999
1000
    if (p->prt_min > port || p->prt_max < port)
      continue; /* Doesn't cover our port. */