Line data Source code
1 : /* Copyright (c) 2001 Matej Pfajfar.
2 : * Copyright (c) 2001-2004, Roger Dingledine.
3 : * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4 : * Copyright (c) 2007-2021, The Tor Project, Inc. */
5 : /* See LICENSE for licensing information */
6 :
7 : /**
8 : * \file command.c
9 : * \brief Functions for processing incoming cells.
10 : *
11 : * When we receive a cell from a client or a relay, it arrives on some
12 : * channel, and tells us what to do with it. In this module, we dispatch based
13 : * on the cell type using the functions command_process_cell() and
14 : * command_process_var_cell(), and deal with the cell accordingly. (These
15 : * handlers are installed on a channel with the command_setup_channel()
16 : * function.)
17 : *
18 : * Channels have a chance to handle some cell types on their own before they
19 : * are ever passed here --- typically, they do this for cells that are
20 : * specific to a given channel type. For example, in channeltls.c, the cells
21 : * for the initial connection handshake are handled before we get here. (Of
22 : * course, the fact that there _is_ only one channel type for now means that
23 : * we may have gotten the factoring wrong here.)
24 : *
25 : * Handling other cell types is mainly farmed off to other modules, after
26 : * initial sanity-checking. CREATE* cells are handled ultimately in onion.c,
27 : * CREATED* cells trigger circuit creation in circuitbuild.c, DESTROY cells
28 : * are handled here (since they're simple), and RELAY cells, in all their
29 : * complexity, are passed off to relay.c.
30 : **/
31 :
32 : /* In-points to command.c:
33 : *
34 : * - command_process_cell(), called from
35 : * incoming cell handlers of channel_t instances;
36 : * callbacks registered in command_setup_channel(),
37 : * called when channels are created in circuitbuild.c
38 : */
39 : #include "core/or/or.h"
40 : #include "app/config/config.h"
41 : #include "core/crypto/onion_crypto.h"
42 : #include "core/mainloop/connection.h"
43 : #include "core/mainloop/cpuworker.h"
44 : #include "core/or/channel.h"
45 : #include "core/or/circuitbuild.h"
46 : #include "core/or/circuitlist.h"
47 : #include "core/or/command.h"
48 : #include "core/or/connection_or.h"
49 : #include "core/or/dos.h"
50 : #include "core/or/onion.h"
51 : #include "core/or/relay.h"
52 : #include "feature/control/control_events.h"
53 : #include "feature/hibernate/hibernate.h"
54 : #include "feature/nodelist/describe.h"
55 : #include "feature/nodelist/nodelist.h"
56 : #include "feature/nodelist/routerlist.h"
57 : #include "feature/relay/circuitbuild_relay.h"
58 : #include "feature/relay/routermode.h"
59 : #include "feature/stats/rephist.h"
60 : #include "lib/crypt_ops/crypto_util.h"
61 :
62 : #include "core/or/cell_st.h"
63 : #include "core/or/or_circuit_st.h"
64 : #include "core/or/origin_circuit_st.h"
65 : #include "core/or/var_cell_st.h"
66 :
67 : /** How many CELL_CREATE cells have we received, ever? */
68 : uint64_t stats_n_create_cells_processed = 0;
69 : /** How many CELL_CREATED cells have we received, ever? */
70 : uint64_t stats_n_created_cells_processed = 0;
71 : /** How many CELL_RELAY cells have we received, ever? */
72 : uint64_t stats_n_relay_cells_processed = 0;
73 : /** How many CELL_DESTROY cells have we received, ever? */
74 : uint64_t stats_n_destroy_cells_processed = 0;
75 :
76 : /* Handle an incoming channel */
77 : static void command_handle_incoming_channel(channel_listener_t *listener,
78 : channel_t *chan);
79 :
80 : /* These are the main functions for processing cells */
81 : static void command_process_create_cell(cell_t *cell, channel_t *chan);
82 : static void command_process_created_cell(cell_t *cell, channel_t *chan);
83 : static void command_process_relay_cell(cell_t *cell, channel_t *chan);
84 : static void command_process_destroy_cell(cell_t *cell, channel_t *chan);
85 :
86 : /** Convert the cell <b>command</b> into a lower-case, human-readable
87 : * string. */
88 : const char *
89 14 : cell_command_to_string(uint8_t command)
90 : {
91 14 : switch (command) {
92 : case CELL_PADDING: return "padding";
93 1 : case CELL_CREATE: return "create";
94 0 : case CELL_CREATED: return "created";
95 11 : case CELL_RELAY: return "relay";
96 0 : case CELL_DESTROY: return "destroy";
97 0 : case CELL_CREATE_FAST: return "create_fast";
98 0 : case CELL_CREATED_FAST: return "created_fast";
99 0 : case CELL_VERSIONS: return "versions";
100 0 : case CELL_NETINFO: return "netinfo";
101 0 : case CELL_RELAY_EARLY: return "relay_early";
102 2 : case CELL_CREATE2: return "create2";
103 0 : case CELL_CREATED2: return "created2";
104 0 : case CELL_VPADDING: return "vpadding";
105 0 : case CELL_CERTS: return "certs";
106 0 : case CELL_AUTH_CHALLENGE: return "auth_challenge";
107 0 : case CELL_AUTHENTICATE: return "authenticate";
108 0 : case CELL_AUTHORIZE: return "authorize";
109 0 : default: return "unrecognized";
110 : }
111 : }
112 :
113 : #ifdef KEEP_TIMING_STATS
114 : /** This is a wrapper function around the actual function that processes the
115 : * <b>cell</b> that just arrived on <b>conn</b>. Increment <b>*time</b>
116 : * by the number of microseconds used by the call to <b>*func(cell, conn)</b>.
117 : */
118 : static void
119 : command_time_process_cell(cell_t *cell, channel_t *chan, int *time,
120 : void (*func)(cell_t *, channel_t *))
121 : {
122 : struct timeval start, end;
123 : long time_passed;
124 :
125 : tor_gettimeofday(&start);
126 :
127 : (*func)(cell, chan);
128 :
129 : tor_gettimeofday(&end);
130 : time_passed = tv_udiff(&start, &end) ;
131 :
132 : if (time_passed > 10000) { /* more than 10ms */
133 : log_debug(LD_OR,"That call just took %ld ms.",time_passed/1000);
134 : }
135 : if (time_passed < 0) {
136 : log_info(LD_GENERAL,"That call took us back in time!");
137 : time_passed = 0;
138 : }
139 : *time += time_passed;
140 : }
141 : #endif /* defined(KEEP_TIMING_STATS) */
142 :
143 : /** Process a <b>cell</b> that was just received on <b>chan</b>. Keep internal
144 : * statistics about how many of each cell we've processed so far
145 : * this second, and the total number of microseconds it took to
146 : * process each type of cell.
147 : */
148 : void
149 0 : command_process_cell(channel_t *chan, cell_t *cell)
150 : {
151 : #ifdef KEEP_TIMING_STATS
152 : /* how many of each cell have we seen so far this second? needs better
153 : * name. */
154 : static int num_create=0, num_created=0, num_relay=0, num_destroy=0;
155 : /* how long has it taken to process each type of cell? */
156 : static int create_time=0, created_time=0, relay_time=0, destroy_time=0;
157 : static time_t current_second = 0; /* from previous calls to time */
158 :
159 : time_t now = time(NULL);
160 :
161 : if (now > current_second) { /* the second has rolled over */
162 : /* print stats */
163 : log_info(LD_OR,
164 : "At end of second: %d creates (%d ms), %d createds (%d ms), "
165 : "%d relays (%d ms), %d destroys (%d ms)",
166 : num_create, create_time/1000,
167 : num_created, created_time/1000,
168 : num_relay, relay_time/1000,
169 : num_destroy, destroy_time/1000);
170 :
171 : /* zero out stats */
172 : num_create = num_created = num_relay = num_destroy = 0;
173 : create_time = created_time = relay_time = destroy_time = 0;
174 :
175 : /* remember which second it is, for next time */
176 : current_second = now;
177 : }
178 : #endif /* defined(KEEP_TIMING_STATS) */
179 :
180 : #ifdef KEEP_TIMING_STATS
181 : #define PROCESS_CELL(tp, cl, cn) STMT_BEGIN { \
182 : ++num ## tp; \
183 : command_time_process_cell(cl, cn, & tp ## time , \
184 : command_process_ ## tp ## _cell); \
185 : } STMT_END
186 : #else /* !defined(KEEP_TIMING_STATS) */
187 : #define PROCESS_CELL(tp, cl, cn) command_process_ ## tp ## _cell(cl, cn)
188 : #endif /* defined(KEEP_TIMING_STATS) */
189 :
190 0 : switch (cell->command) {
191 0 : case CELL_CREATE:
192 : case CELL_CREATE_FAST:
193 : case CELL_CREATE2:
194 0 : ++stats_n_create_cells_processed;
195 0 : PROCESS_CELL(create, cell, chan);
196 0 : break;
197 0 : case CELL_CREATED:
198 : case CELL_CREATED_FAST:
199 : case CELL_CREATED2:
200 0 : ++stats_n_created_cells_processed;
201 0 : PROCESS_CELL(created, cell, chan);
202 0 : break;
203 0 : case CELL_RELAY:
204 : case CELL_RELAY_EARLY:
205 0 : ++stats_n_relay_cells_processed;
206 0 : PROCESS_CELL(relay, cell, chan);
207 0 : break;
208 0 : case CELL_DESTROY:
209 0 : ++stats_n_destroy_cells_processed;
210 0 : PROCESS_CELL(destroy, cell, chan);
211 0 : break;
212 0 : default:
213 0 : log_fn(LOG_INFO, LD_PROTOCOL,
214 : "Cell of unknown or unexpected type (%d) received. "
215 : "Dropping.",
216 : cell->command);
217 0 : break;
218 : }
219 0 : }
220 :
221 : /** Process a 'create' <b>cell</b> that just arrived from <b>chan</b>. Make a
222 : * new circuit with the p_circ_id specified in cell. Put the circuit in state
223 : * onionskin_pending, and pass the onionskin to the cpuworker. Circ will get
224 : * picked up again when the cpuworker finishes decrypting it.
225 : */
226 : static void
227 0 : command_process_create_cell(cell_t *cell, channel_t *chan)
228 : {
229 0 : or_circuit_t *circ;
230 0 : const or_options_t *options = get_options();
231 0 : int id_is_high;
232 0 : create_cell_t *create_cell;
233 :
234 0 : tor_assert(cell);
235 0 : tor_assert(chan);
236 :
237 0 : log_debug(LD_OR,
238 : "Got a CREATE cell for circ_id %u on channel %"PRIu64
239 : " (%p)",
240 : (unsigned)cell->circ_id,
241 : (chan->global_identifier), chan);
242 :
243 : /* First thing we do, even though the cell might be invalid, is inform the
244 : * DoS mitigation subsystem layer of this event. Validation is done by this
245 : * function. */
246 0 : dos_cc_new_create_cell(chan);
247 :
248 : /* We check for the conditions that would make us drop the cell before
249 : * we check for the conditions that would make us send a DESTROY back,
250 : * since those conditions would make a DESTROY nonsensical. */
251 0 : if (cell->circ_id == 0) {
252 0 : log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
253 : "Received a create cell (type %d) from %s with zero circID; "
254 : " ignoring.", (int)cell->command,
255 : channel_describe_peer(chan));
256 0 : return;
257 : }
258 :
259 0 : if (circuit_id_in_use_on_channel(cell->circ_id, chan)) {
260 0 : const node_t *node = node_get_by_id(chan->identity_digest);
261 0 : log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
262 : "Received CREATE cell (circID %u) for known circ. "
263 : "Dropping (age %d).",
264 : (unsigned)cell->circ_id,
265 : (int)(time(NULL) - channel_when_created(chan)));
266 0 : if (node) {
267 0 : char *p = esc_for_log(node_get_platform(node));
268 0 : log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
269 : "Details: router %s, platform %s.",
270 : node_describe(node), p);
271 0 : tor_free(p);
272 : }
273 0 : return;
274 : }
275 :
276 0 : if (we_are_hibernating()) {
277 0 : log_info(LD_OR,
278 : "Received create cell but we're shutting down. Sending back "
279 : "destroy.");
280 0 : channel_send_destroy(cell->circ_id, chan,
281 : END_CIRC_REASON_HIBERNATING);
282 0 : return;
283 : }
284 :
285 : /* Check if we should apply a defense for this channel. */
286 0 : if (dos_cc_get_defense_type(chan) == DOS_CC_DEFENSE_REFUSE_CELL) {
287 0 : channel_send_destroy(cell->circ_id, chan,
288 : END_CIRC_REASON_RESOURCELIMIT);
289 0 : return;
290 : }
291 :
292 0 : if (!server_mode(options) ||
293 0 : (!public_server_mode(options) && channel_is_outgoing(chan))) {
294 0 : log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
295 : "Received create cell (type %d) from %s, but we're connected "
296 : "to it as a client. "
297 : "Sending back a destroy.",
298 : (int)cell->command, channel_describe_peer(chan));
299 0 : channel_send_destroy(cell->circ_id, chan,
300 : END_CIRC_REASON_TORPROTOCOL);
301 0 : return;
302 : }
303 :
304 : /* If the high bit of the circuit ID is not as expected, close the
305 : * circ. */
306 0 : if (chan->wide_circ_ids)
307 0 : id_is_high = cell->circ_id & (1u<<31);
308 : else
309 0 : id_is_high = cell->circ_id & (1u<<15);
310 0 : if ((id_is_high &&
311 0 : chan->circ_id_type == CIRC_ID_TYPE_HIGHER) ||
312 0 : (!id_is_high &&
313 0 : chan->circ_id_type == CIRC_ID_TYPE_LOWER)) {
314 0 : log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
315 : "Received create cell with unexpected circ_id %u. Closing.",
316 : (unsigned)cell->circ_id);
317 0 : channel_send_destroy(cell->circ_id, chan,
318 : END_CIRC_REASON_TORPROTOCOL);
319 0 : return;
320 : }
321 :
322 0 : circ = or_circuit_new(cell->circ_id, chan);
323 0 : circ->base_.purpose = CIRCUIT_PURPOSE_OR;
324 0 : circuit_set_state(TO_CIRCUIT(circ), CIRCUIT_STATE_ONIONSKIN_PENDING);
325 0 : create_cell = tor_malloc_zero(sizeof(create_cell_t));
326 0 : if (create_cell_parse(create_cell, cell) < 0) {
327 0 : tor_free(create_cell);
328 0 : log_fn(LOG_PROTOCOL_WARN, LD_OR,
329 : "Bogus/unrecognized create cell; closing.");
330 0 : circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL);
331 0 : return;
332 : }
333 :
334 : /* Mark whether this circuit used TAP in case we need to use this
335 : * information for onion service statistics later on. */
336 0 : if (create_cell->handshake_type == ONION_HANDSHAKE_TYPE_FAST ||
337 : create_cell->handshake_type == ONION_HANDSHAKE_TYPE_TAP) {
338 0 : circ->used_legacy_circuit_handshake = true;
339 : }
340 :
341 0 : if (!channel_is_client(chan)) {
342 : /* remember create types we've seen, but don't remember them from
343 : * clients, to be extra conservative about client statistics. */
344 0 : rep_hist_note_circuit_handshake_requested(create_cell->handshake_type);
345 : }
346 :
347 0 : if (create_cell->handshake_type != ONION_HANDSHAKE_TYPE_FAST) {
348 : /* hand it off to the cpuworkers, and then return. */
349 :
350 0 : if (assign_onionskin_to_cpuworker(circ, create_cell) < 0) {
351 0 : log_debug(LD_GENERAL,"Failed to hand off onionskin. Closing.");
352 0 : circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_RESOURCELIMIT);
353 0 : return;
354 : }
355 0 : log_debug(LD_OR,"success: handed off onionskin.");
356 : } else {
357 : /* This is a CREATE_FAST cell; we can handle it immediately without using
358 : * a CPU worker. */
359 0 : uint8_t keys[CPATH_KEY_MATERIAL_LEN];
360 0 : uint8_t rend_circ_nonce[DIGEST_LEN];
361 0 : int len;
362 0 : created_cell_t created_cell;
363 :
364 0 : memset(&created_cell, 0, sizeof(created_cell));
365 0 : len = onion_skin_server_handshake(ONION_HANDSHAKE_TYPE_FAST,
366 0 : create_cell->onionskin,
367 0 : create_cell->handshake_len,
368 : NULL,
369 : created_cell.reply,
370 : keys, CPATH_KEY_MATERIAL_LEN,
371 : rend_circ_nonce);
372 0 : tor_free(create_cell);
373 0 : if (len < 0) {
374 0 : log_warn(LD_OR,"Failed to generate key material. Closing.");
375 0 : circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
376 0 : return;
377 : }
378 0 : created_cell.cell_type = CELL_CREATED_FAST;
379 0 : created_cell.handshake_len = len;
380 :
381 0 : if (onionskin_answer(circ, &created_cell,
382 : (const char *)keys, sizeof(keys),
383 : rend_circ_nonce)<0) {
384 0 : log_warn(LD_OR,"Failed to reply to CREATE_FAST cell. Closing.");
385 0 : circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
386 0 : return;
387 : }
388 0 : memwipe(keys, 0, sizeof(keys));
389 : }
390 : }
391 :
392 : /** Process a 'created' <b>cell</b> that just arrived from <b>chan</b>.
393 : * Find the circuit
394 : * that it's intended for. If we're not the origin of the circuit, package
395 : * the 'created' cell in an 'extended' relay cell and pass it back. If we
396 : * are the origin of the circuit, send it to circuit_finish_handshake() to
397 : * finish processing keys, and then call circuit_send_next_onion_skin() to
398 : * extend to the next hop in the circuit if necessary.
399 : */
400 : static void
401 0 : command_process_created_cell(cell_t *cell, channel_t *chan)
402 : {
403 0 : circuit_t *circ;
404 0 : extended_cell_t extended_cell;
405 :
406 0 : circ = circuit_get_by_circid_channel(cell->circ_id, chan);
407 :
408 0 : if (!circ) {
409 0 : log_info(LD_OR,
410 : "(circID %u) unknown circ (probably got a destroy earlier). "
411 : "Dropping.", (unsigned)cell->circ_id);
412 0 : return;
413 : }
414 :
415 0 : if (circ->n_circ_id != cell->circ_id || circ->n_chan != chan) {
416 0 : log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,
417 : "got created cell from Tor client? Closing.");
418 0 : circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
419 0 : return;
420 : }
421 :
422 0 : if (created_cell_parse(&extended_cell.created_cell, cell) < 0) {
423 0 : log_fn(LOG_PROTOCOL_WARN, LD_OR, "Unparseable created cell.");
424 0 : circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
425 0 : return;
426 : }
427 :
428 0 : if (CIRCUIT_IS_ORIGIN(circ)) { /* we're the OP. Handshake this. */
429 0 : origin_circuit_t *origin_circ = TO_ORIGIN_CIRCUIT(circ);
430 0 : int err_reason = 0;
431 0 : log_debug(LD_OR,"at OP. Finishing handshake.");
432 0 : if ((err_reason = circuit_finish_handshake(origin_circ,
433 : &extended_cell.created_cell)) < 0) {
434 0 : circuit_mark_for_close(circ, -err_reason);
435 0 : return;
436 : }
437 0 : log_debug(LD_OR,"Moving to next skin.");
438 0 : if ((err_reason = circuit_send_next_onion_skin(origin_circ)) < 0) {
439 0 : log_info(LD_OR,"circuit_send_next_onion_skin failed.");
440 : /* XXX push this circuit_close lower */
441 0 : circuit_mark_for_close(circ, -err_reason);
442 0 : return;
443 : }
444 : } else { /* pack it into an extended relay cell, and send it. */
445 0 : uint8_t command=0;
446 0 : uint16_t len=0;
447 0 : uint8_t payload[RELAY_PAYLOAD_SIZE];
448 0 : log_debug(LD_OR,
449 : "Converting created cell to extended relay cell, sending.");
450 0 : memset(payload, 0, sizeof(payload));
451 0 : if (extended_cell.created_cell.cell_type == CELL_CREATED2)
452 0 : extended_cell.cell_type = RELAY_COMMAND_EXTENDED2;
453 : else
454 0 : extended_cell.cell_type = RELAY_COMMAND_EXTENDED;
455 0 : if (extended_cell_format(&command, &len, payload, &extended_cell) < 0) {
456 0 : log_fn(LOG_PROTOCOL_WARN, LD_OR, "Can't format extended cell.");
457 0 : circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
458 0 : return;
459 : }
460 :
461 0 : relay_send_command_from_edge(0, circ, command,
462 : (const char*)payload, len, NULL);
463 : }
464 : }
465 :
466 : /** Process a 'relay' or 'relay_early' <b>cell</b> that just arrived from
467 : * <b>conn</b>. Make sure it came in with a recognized circ_id. Pass it on to
468 : * circuit_receive_relay_cell() for actual processing.
469 : */
470 : static void
471 0 : command_process_relay_cell(cell_t *cell, channel_t *chan)
472 : {
473 0 : const or_options_t *options = get_options();
474 0 : circuit_t *circ;
475 0 : int reason, direction;
476 0 : uint32_t orig_delivered_bw = 0;
477 0 : uint32_t orig_overhead_bw = 0;
478 :
479 0 : circ = circuit_get_by_circid_channel(cell->circ_id, chan);
480 :
481 0 : if (!circ) {
482 0 : log_debug(LD_OR,
483 : "unknown circuit %u on connection from %s. Dropping.",
484 : (unsigned)cell->circ_id,
485 : channel_describe_peer(chan));
486 0 : return;
487 : }
488 :
489 0 : if (circ->state == CIRCUIT_STATE_ONIONSKIN_PENDING) {
490 0 : log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,"circuit in create_wait. Closing.");
491 0 : circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
492 0 : return;
493 : }
494 :
495 0 : if (CIRCUIT_IS_ORIGIN(circ)) {
496 : /* if we're a relay and treating connections with recent local
497 : * traffic better, then this is one of them. */
498 0 : channel_timestamp_client(chan);
499 :
500 : /* Count all circuit bytes here for control port accuracy. We want
501 : * to count even invalid/dropped relay cells, hence counting
502 : * before the recognized check and the connection_edge_process_relay
503 : * cell checks.
504 : */
505 0 : origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ);
506 :
507 : /* Count the payload bytes only. We don't care about cell headers */
508 0 : ocirc->n_read_circ_bw = tor_add_u32_nowrap(ocirc->n_read_circ_bw,
509 : CELL_PAYLOAD_SIZE);
510 :
511 : /* Stash the original delivered and overhead values. These values are
512 : * updated by circuit_read_valid_data() during cell processing by
513 : * connection_edge_process_relay_cell(), called from
514 : * circuit_receive_relay_cell() below. If they do not change, we inform
515 : * the control port about dropped cells immediately after the call
516 : * to circuit_receive_relay_cell() below. */
517 0 : orig_delivered_bw = ocirc->n_delivered_read_circ_bw;
518 0 : orig_overhead_bw = ocirc->n_overhead_read_circ_bw;
519 : }
520 :
521 0 : if (!CIRCUIT_IS_ORIGIN(circ) &&
522 0 : chan == TO_OR_CIRCUIT(circ)->p_chan &&
523 0 : cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id)
524 : direction = CELL_DIRECTION_OUT;
525 : else
526 : direction = CELL_DIRECTION_IN;
527 :
528 : /* If we have a relay_early cell, make sure that it's outbound, and we've
529 : * gotten no more than MAX_RELAY_EARLY_CELLS_PER_CIRCUIT of them. */
530 0 : if (cell->command == CELL_RELAY_EARLY) {
531 0 : if (direction == CELL_DIRECTION_IN) {
532 : /* Inbound early cells could once be encountered as a result of
533 : * bug 1038; but relays running versions before 0.2.1.19 are long
534 : * gone from the network, so any such cells now are surprising. */
535 0 : log_warn(LD_OR,
536 : "Received an inbound RELAY_EARLY cell on circuit %u."
537 : " Closing circuit. Please report this event,"
538 : " along with the following message.",
539 : (unsigned)cell->circ_id);
540 0 : if (CIRCUIT_IS_ORIGIN(circ)) {
541 0 : circuit_log_path(LOG_WARN, LD_OR, TO_ORIGIN_CIRCUIT(circ));
542 : /* Always emit a bandwidth event for closed circs */
543 0 : control_event_circ_bandwidth_used_for_circ(TO_ORIGIN_CIRCUIT(circ));
544 0 : } else if (circ->n_chan) {
545 0 : log_warn(LD_OR, " upstream=%s",
546 : channel_describe_peer(circ->n_chan));
547 : }
548 0 : circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
549 0 : return;
550 : } else {
551 0 : or_circuit_t *or_circ = TO_OR_CIRCUIT(circ);
552 0 : if (or_circ->remaining_relay_early_cells == 0) {
553 0 : log_fn(LOG_PROTOCOL_WARN, LD_OR,
554 : "Received too many RELAY_EARLY cells on circ %u from %s."
555 : " Closing circuit.",
556 : (unsigned)cell->circ_id,
557 : safe_str(channel_describe_peer(chan)));
558 0 : circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
559 0 : return;
560 : }
561 0 : --or_circ->remaining_relay_early_cells;
562 : }
563 : }
564 :
565 0 : if ((reason = circuit_receive_relay_cell(cell, circ, direction)) < 0) {
566 0 : log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,"circuit_receive_relay_cell "
567 : "(%s) failed. Closing.",
568 : direction==CELL_DIRECTION_OUT?"forward":"backward");
569 : /* Always emit a bandwidth event for closed circs */
570 0 : if (CIRCUIT_IS_ORIGIN(circ)) {
571 0 : control_event_circ_bandwidth_used_for_circ(TO_ORIGIN_CIRCUIT(circ));
572 : }
573 0 : circuit_mark_for_close(circ, -reason);
574 : }
575 :
576 0 : if (CIRCUIT_IS_ORIGIN(circ)) {
577 0 : origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ);
578 :
579 : /* If neither the delivered nor overhead values changed, this cell
580 : * was dropped due to being invalid by one of the error codepaths in
581 : * connection_edge_process_relay_cell(), called by
582 : * circuit_receive_relay_cell().
583 : *
584 : * Valid cells, on the other hand, call circuit_read_valid_data()
585 : * to update these values upon processing them.
586 : *
587 : * So, if the values are the same as those stored above,
588 : * emit a control port event for CIRC_BW, so the controller can
589 : * react quickly to invalid cells. */
590 0 : if (orig_delivered_bw == ocirc->n_delivered_read_circ_bw &&
591 0 : orig_overhead_bw == ocirc->n_overhead_read_circ_bw) {
592 0 : control_event_circ_bandwidth_used_for_circ(ocirc);
593 : }
594 : }
595 :
596 : /* If this is a cell in an RP circuit, count it as part of the
597 : onion service stats */
598 0 : if (options->HiddenServiceStatistics &&
599 0 : !CIRCUIT_IS_ORIGIN(circ) &&
600 0 : CONST_TO_OR_CIRCUIT(circ)->circuit_carries_hs_traffic_stats) {
601 : /** We need to figure out of this is a v2 or v3 RP circuit to count it
602 : * appropriately. v2 services always use the TAP legacy handshake to
603 : * connect to the RP; we use this feature to distinguish between v2/v3. */
604 0 : bool is_v2 = false;
605 0 : if (CONST_TO_OR_CIRCUIT(circ)->used_legacy_circuit_handshake) {
606 : is_v2 = true;
607 0 : } else if (CONST_TO_OR_CIRCUIT(circ)->rend_splice) {
608 : /* If this is a client->RP circuit we need to check the spliced circuit
609 : * (which is the service->RP circuit) to see if it was using TAP and
610 : * hence if it's a v2 circuit. That's because client->RP circuits can
611 : * still use ntor even on v2; but service->RP will always use TAP. */
612 0 : const or_circuit_t *splice = CONST_TO_OR_CIRCUIT(circ)->rend_splice;
613 0 : if (splice->used_legacy_circuit_handshake) {
614 0 : is_v2 = true;
615 : }
616 : }
617 0 : rep_hist_seen_new_rp_cell(is_v2);
618 : }
619 : }
620 :
621 : /** Process a 'destroy' <b>cell</b> that just arrived from
622 : * <b>chan</b>. Find the circ that it refers to (if any).
623 : *
624 : * If the circ is in state
625 : * onionskin_pending, then call onion_pending_remove() to remove it
626 : * from the pending onion list (note that if it's already being
627 : * processed by the cpuworker, it won't be in the list anymore; but
628 : * when the cpuworker returns it, the circuit will be gone, and the
629 : * cpuworker response will be dropped).
630 : *
631 : * Then mark the circuit for close (which marks all edges for close,
632 : * and passes the destroy cell onward if necessary).
633 : */
634 : static void
635 0 : command_process_destroy_cell(cell_t *cell, channel_t *chan)
636 : {
637 0 : circuit_t *circ;
638 0 : int reason;
639 :
640 0 : circ = circuit_get_by_circid_channel(cell->circ_id, chan);
641 0 : if (!circ) {
642 0 : log_info(LD_OR,"unknown circuit %u on connection from %s. Dropping.",
643 : (unsigned)cell->circ_id,
644 : channel_describe_peer(chan));
645 0 : return;
646 : }
647 0 : log_debug(LD_OR,"Received for circID %u.",(unsigned)cell->circ_id);
648 :
649 0 : reason = (uint8_t)cell->payload[0];
650 0 : circ->received_destroy = 1;
651 :
652 0 : if (!CIRCUIT_IS_ORIGIN(circ) &&
653 0 : chan == TO_OR_CIRCUIT(circ)->p_chan &&
654 0 : cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) {
655 : /* the destroy came from behind */
656 0 : circuit_set_p_circid_chan(TO_OR_CIRCUIT(circ), 0, NULL);
657 0 : circuit_mark_for_close(circ, reason|END_CIRC_REASON_FLAG_REMOTE);
658 : } else { /* the destroy came from ahead */
659 0 : circuit_set_n_circid_chan(circ, 0, NULL);
660 0 : if (CIRCUIT_IS_ORIGIN(circ)) {
661 0 : circuit_mark_for_close(circ, reason|END_CIRC_REASON_FLAG_REMOTE);
662 : } else {
663 0 : char payload[1];
664 0 : log_debug(LD_OR, "Delivering 'truncated' back.");
665 0 : payload[0] = (char)reason;
666 0 : relay_send_command_from_edge(0, circ, RELAY_COMMAND_TRUNCATED,
667 : payload, sizeof(payload), NULL);
668 : }
669 : }
670 : }
671 :
672 : /** Callback to handle a new channel; call command_setup_channel() to give
673 : * it the right cell handlers.
674 : */
675 :
676 : static void
677 0 : command_handle_incoming_channel(channel_listener_t *listener, channel_t *chan)
678 : {
679 0 : tor_assert(listener);
680 0 : tor_assert(chan);
681 :
682 0 : command_setup_channel(chan);
683 0 : }
684 :
685 : /** Given a channel, install the right handlers to process incoming
686 : * cells on it.
687 : */
688 :
689 : void
690 0 : command_setup_channel(channel_t *chan)
691 : {
692 0 : tor_assert(chan);
693 :
694 0 : channel_set_cell_handlers(chan,
695 : command_process_cell);
696 0 : }
697 :
698 : /** Given a listener, install the right handler to process incoming
699 : * channels on it.
700 : */
701 :
702 : void
703 0 : command_setup_listener(channel_listener_t *listener)
704 : {
705 0 : tor_assert(listener);
706 0 : tor_assert(listener->state == CHANNEL_LISTENER_STATE_LISTENING);
707 :
708 0 : channel_listener_set_listener_fn(listener, command_handle_incoming_channel);
709 0 : }
|
