tor  0.4.2.1-alpha-dev
Macros | Functions
authcert.h File Reference
#include "lib/testsupport/testsupport.h"

Go to the source code of this file.

Macros

#define TRUSTED_DIRS_CERTS_SRC_SELF   0
 
#define TRUSTED_DIRS_CERTS_SRC_FROM_STORE   1
 
#define TRUSTED_DIRS_CERTS_SRC_DL_BY_ID_DIGEST   2
 
#define TRUSTED_DIRS_CERTS_SRC_DL_BY_ID_SK_DIGEST   3
 
#define TRUSTED_DIRS_CERTS_SRC_FROM_VOTE   4
 
#define authority_cert_free(cert)   FREE_AND_NULL(authority_cert_t, authority_cert_free_, (cert))
 

Functions

int trusted_dirs_reload_certs (void)
 
int trusted_dirs_load_certs_from_string (const char *contents, int source, int flush, const char *source_dir)
 
void trusted_dirs_remove_old_certs (void)
 
void trusted_dirs_flush_certs_to_disk (void)
 
authority_cert_tauthority_cert_get_newest_by_id (const char *id_digest)
 
authority_cert_tauthority_cert_get_by_sk_digest (const char *sk_digest)
 
authority_cert_tauthority_cert_get_by_digests (const char *id_digest, const char *sk_digest)
 
void authority_cert_get_all (smartlist_t *certs_out)
 
void authority_cert_dl_failed (const char *id_digest, const char *signing_key_digest, int status)
 
void authority_certs_fetch_missing (networkstatus_t *status, time_t now, const char *dir_hint)
 
int authority_cert_dl_looks_uncertain (const char *id_digest)
 
int authority_cert_is_blacklisted (const authority_cert_t *cert)
 
void authority_cert_free_ (authority_cert_t *cert)
 
 MOCK_DECL (smartlist_t *, list_authority_ids_with_downloads,(void))
 
 MOCK_DECL (download_status_t *, id_only_download_status_for_authority_id,(const char *digest))
 
 MOCK_DECL (smartlist_t *, list_sk_digests_for_authority_id,(const char *digest))
 
 MOCK_DECL (download_status_t *, download_status_for_authority_id_and_sk,(const char *id_digest, const char *sk_digest))
 
void authcert_free_all (void)
 

Detailed Description

Header file for authcert.c.

Definition in file authcert.h.

Function Documentation

◆ authority_cert_dl_failed()

void authority_cert_dl_failed ( const char *  id_digest,
const char *  signing_key_digest,
int  status 
)

Called when an attempt to download a certificate with the authority with ID id_digest and, if not NULL, signed with key signing_key_digest fails with HTTP response code status: remember the failure, so we don't try again immediately.

Definition at line 683 of file authcert.c.

◆ authority_cert_dl_looks_uncertain()

int authority_cert_dl_looks_uncertain ( const char *  id_digest)

Return true iff when we've been getting enough failures when trying to download the certificate with ID digest id_digest that we're willing to start bugging the user about it.

Definition at line 765 of file authcert.c.

References download_status_get_n_failures(), and trusted_dir_certs.

Referenced by networkstatus_check_consensus_signature().

◆ authority_cert_free_()

void authority_cert_free_ ( authority_cert_t cert)

Free storage held in cert.

Definition at line 1164 of file authcert.c.

References authority_cert_t::cache_info, signed_descriptor_t::signed_descriptor_body, and tor_free.

◆ authority_cert_get_all()

void authority_cert_get_all ( smartlist_t certs_out)

Add every known authority_cert_t to certs_out.

Definition at line 666 of file authcert.c.

References DIGESTMAP_FOREACH, DIGESTMAP_FOREACH_END, smartlist_add(), SMARTLIST_FOREACH, tor_assert(), and trusted_dir_certs.

◆ authority_cert_get_by_digests()

authority_cert_t* authority_cert_get_by_digests ( const char *  id_digest,
const char *  sk_digest 
)

Return the v3 authority certificate with signing key matching sk_digest, for the authority with identity digest id_digest. Return NULL if no such authority is known.

Definition at line 650 of file authcert.c.

References DIGEST_LEN, SMARTLIST_FOREACH, tor_memeq(), and trusted_dir_certs.

Referenced by networkstatus_check_consensus_signature().

◆ authority_cert_get_by_sk_digest()

authority_cert_t* authority_cert_get_by_sk_digest ( const char *  sk_digest)

Return the newest v3 authority certificate whose directory signing key has digest sk_digest. Return NULL if no such certificate is known.

Definition at line 623 of file authcert.c.

References DIGEST_LEN, DIGESTMAP_FOREACH, DIGESTMAP_FOREACH_END, get_my_v3_legacy_cert(), authority_cert_t::signing_key_digest, SMARTLIST_FOREACH, tor_memeq(), and trusted_dir_certs.

◆ authority_cert_get_newest_by_id()

authority_cert_t* authority_cert_get_newest_by_id ( const char *  id_digest)

Return the newest v3 authority certificate whose v3 authority identity key has digest id_digest. Return NULL if no such authority is known, or it has no certificate.

Definition at line 603 of file authcert.c.

References SMARTLIST_FOREACH, and trusted_dir_certs.

◆ authority_cert_is_blacklisted()

int authority_cert_is_blacklisted ( const authority_cert_t cert)

Return true iff cert authenticates some atuhority signing key which, because of the old openssl heartbleed vulnerability, should never be trusted.

Definition at line 746 of file authcert.c.

References base16_encode(), HEX_DIGEST_LEN, and authority_cert_t::signing_key_digest.

◆ authority_certs_fetch_missing()

void authority_certs_fetch_missing ( networkstatus_t status,
time_t  now,
const char *  dir_hint 
)

Try to download any v3 authority certificates that we may be missing. If status is provided, try to get all the ones that were used to sign status. Additionally, try to have a non-expired certificate for every V3 authority in trusted_dir_servers. Don't fetch certificates we already have.

If dir_hint is non-NULL, it's the identity digest for a directory that we've just successfully retrieved a consensus or certificates from, so try it first to fetch any missing certificates.

Definition at line 855 of file authcert.c.

Referenced by update_certificate_downloads().

◆ trusted_dirs_flush_certs_to_disk()

void trusted_dirs_flush_certs_to_disk ( void  )

Save all v3 key certificates to the cached-certs file.

Definition at line 501 of file authcert.c.

References DIGESTMAP_FOREACH, DIGESTMAP_FOREACH_END, SMARTLIST_FOREACH, trusted_dir_certs, and trusted_dir_servers_certs_changed.

◆ trusted_dirs_load_certs_from_string()

int trusted_dirs_load_certs_from_string ( const char *  contents,
int  source,
int  flush,
const char *  source_dir 
)

Load a bunch of new key certificates from the string contents. If source is TRUSTED_DIRS_CERTS_SRC_FROM_STORE, the certificates are from the cache, and we don't need to flush them to disk. If we are a dirauth loading our own cert, source is TRUSTED_DIRS_CERTS_SRC_SELF. Otherwise, source is download type: TRUSTED_DIRS_CERTS_SRC_DL_BY_ID_DIGEST or TRUSTED_DIRS_CERTS_SRC_DL_BY_ID_SK_DIGEST. If flush is true, we need to flush any changed certificates to disk now. Return 0 on success, -1 if any certs fail to parse.

If source_dir is non-NULL, it's the identity digest for a directory that we've just successfully retrieved certificates from, so try it first to fetch any missing certificates.

Definition at line 373 of file authcert.c.

◆ trusted_dirs_reload_certs()

int trusted_dirs_reload_certs ( void  )

Reload the cached v3 key certificates from the cached-certs file in the data directory. Return 0 on success, -1 on failure.

Definition at line 324 of file authcert.c.

◆ trusted_dirs_remove_old_certs()

void trusted_dirs_remove_old_certs ( void  )

Remove all expired v3 authority certificates that have been superseded for more than 48 hours or, if not expired, that were published more than 7 days before being superseded. (If the most recent cert was published more than 48 hours ago, then we aren't going to get any consensuses signed with older keys.)

Definition at line 550 of file authcert.c.

References DIGESTMAP_FOREACH, smartlist_sort(), and trusted_dir_certs.

Referenced by routerlist_remove_old_routers().