Tor  0.4.7.0-alpha-dev
command.c
Go to the documentation of this file.
1 /* Copyright (c) 2001 Matej Pfajfar.
2  * Copyright (c) 2001-2004, Roger Dingledine.
3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4  * Copyright (c) 2007-2021, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
6 
7 /**
8  * \file command.c
9  * \brief Functions for processing incoming cells.
10  *
11  * When we receive a cell from a client or a relay, it arrives on some
12  * channel, and tells us what to do with it. In this module, we dispatch based
13  * on the cell type using the functions command_process_cell() and
14  * command_process_var_cell(), and deal with the cell accordingly. (These
15  * handlers are installed on a channel with the command_setup_channel()
16  * function.)
17  *
18  * Channels have a chance to handle some cell types on their own before they
19  * are ever passed here --- typically, they do this for cells that are
20  * specific to a given channel type. For example, in channeltls.c, the cells
21  * for the initial connection handshake are handled before we get here. (Of
22  * course, the fact that there _is_ only one channel type for now means that
23  * we may have gotten the factoring wrong here.)
24  *
25  * Handling other cell types is mainly farmed off to other modules, after
26  * initial sanity-checking. CREATE* cells are handled ultimately in onion.c,
27  * CREATED* cells trigger circuit creation in circuitbuild.c, DESTROY cells
28  * are handled here (since they're simple), and RELAY cells, in all their
29  * complexity, are passed off to relay.c.
30  **/
31 
32 /* In-points to command.c:
33  *
34  * - command_process_cell(), called from
35  * incoming cell handlers of channel_t instances;
36  * callbacks registered in command_setup_channel(),
37  * called when channels are created in circuitbuild.c
38  */
39 #include "core/or/or.h"
40 #include "app/config/config.h"
44 #include "core/or/channel.h"
45 #include "core/or/circuitbuild.h"
46 #include "core/or/circuitlist.h"
47 #include "core/or/command.h"
48 #include "core/or/connection_or.h"
49 #include "core/or/dos.h"
50 #include "core/or/onion.h"
51 #include "core/or/relay.h"
59 #include "feature/stats/rephist.h"
61 
62 #include "core/or/cell_st.h"
63 #include "core/or/or_circuit_st.h"
65 #include "core/or/var_cell_st.h"
66 
67 /** How many CELL_CREATE cells have we received, ever? */
69 /** How many CELL_CREATED cells have we received, ever? */
71 /** How many CELL_RELAY cells have we received, ever? */
73 /** How many CELL_DESTROY cells have we received, ever? */
75 
76 /* Handle an incoming channel */
78  channel_t *chan);
79 
80 /* These are the main functions for processing cells */
81 static void command_process_create_cell(cell_t *cell, channel_t *chan);
82 static void command_process_created_cell(cell_t *cell, channel_t *chan);
83 static void command_process_relay_cell(cell_t *cell, channel_t *chan);
84 static void command_process_destroy_cell(cell_t *cell, channel_t *chan);
85 
86 /** Convert the cell <b>command</b> into a lower-case, human-readable
87  * string. */
88 const char *
90 {
91  switch (command) {
92  case CELL_PADDING: return "padding";
93  case CELL_CREATE: return "create";
94  case CELL_CREATED: return "created";
95  case CELL_RELAY: return "relay";
96  case CELL_DESTROY: return "destroy";
97  case CELL_CREATE_FAST: return "create_fast";
98  case CELL_CREATED_FAST: return "created_fast";
99  case CELL_VERSIONS: return "versions";
100  case CELL_NETINFO: return "netinfo";
101  case CELL_RELAY_EARLY: return "relay_early";
102  case CELL_CREATE2: return "create2";
103  case CELL_CREATED2: return "created2";
104  case CELL_VPADDING: return "vpadding";
105  case CELL_CERTS: return "certs";
106  case CELL_AUTH_CHALLENGE: return "auth_challenge";
107  case CELL_AUTHENTICATE: return "authenticate";
108  case CELL_AUTHORIZE: return "authorize";
109  default: return "unrecognized";
110  }
111 }
112 
113 #ifdef KEEP_TIMING_STATS
114 /** This is a wrapper function around the actual function that processes the
115  * <b>cell</b> that just arrived on <b>conn</b>. Increment <b>*time</b>
116  * by the number of microseconds used by the call to <b>*func(cell, conn)</b>.
117  */
118 static void
119 command_time_process_cell(cell_t *cell, channel_t *chan, int *time,
120  void (*func)(cell_t *, channel_t *))
121 {
122  struct timeval start, end;
123  long time_passed;
124 
125  tor_gettimeofday(&start);
126 
127  (*func)(cell, chan);
128 
129  tor_gettimeofday(&end);
130  time_passed = tv_udiff(&start, &end) ;
131 
132  if (time_passed > 10000) { /* more than 10ms */
133  log_debug(LD_OR,"That call just took %ld ms.",time_passed/1000);
134  }
135  if (time_passed < 0) {
136  log_info(LD_GENERAL,"That call took us back in time!");
137  time_passed = 0;
138  }
139  *time += time_passed;
140 }
141 #endif /* defined(KEEP_TIMING_STATS) */
142 
143 /** Process a <b>cell</b> that was just received on <b>chan</b>. Keep internal
144  * statistics about how many of each cell we've processed so far
145  * this second, and the total number of microseconds it took to
146  * process each type of cell.
147  */
148 void
150 {
151 #ifdef KEEP_TIMING_STATS
152  /* how many of each cell have we seen so far this second? needs better
153  * name. */
154  static int num_create=0, num_created=0, num_relay=0, num_destroy=0;
155  /* how long has it taken to process each type of cell? */
156  static int create_time=0, created_time=0, relay_time=0, destroy_time=0;
157  static time_t current_second = 0; /* from previous calls to time */
158 
159  time_t now = time(NULL);
160 
161  if (now > current_second) { /* the second has rolled over */
162  /* print stats */
163  log_info(LD_OR,
164  "At end of second: %d creates (%d ms), %d createds (%d ms), "
165  "%d relays (%d ms), %d destroys (%d ms)",
166  num_create, create_time/1000,
167  num_created, created_time/1000,
168  num_relay, relay_time/1000,
169  num_destroy, destroy_time/1000);
170 
171  /* zero out stats */
172  num_create = num_created = num_relay = num_destroy = 0;
173  create_time = created_time = relay_time = destroy_time = 0;
174 
175  /* remember which second it is, for next time */
176  current_second = now;
177  }
178 #endif /* defined(KEEP_TIMING_STATS) */
179 
180 #ifdef KEEP_TIMING_STATS
181 #define PROCESS_CELL(tp, cl, cn) STMT_BEGIN { \
182  ++num ## tp; \
183  command_time_process_cell(cl, cn, & tp ## time , \
184  command_process_ ## tp ## _cell); \
185  } STMT_END
186 #else /* !defined(KEEP_TIMING_STATS) */
187 #define PROCESS_CELL(tp, cl, cn) command_process_ ## tp ## _cell(cl, cn)
188 #endif /* defined(KEEP_TIMING_STATS) */
189 
190  switch (cell->command) {
191  case CELL_CREATE:
192  case CELL_CREATE_FAST:
193  case CELL_CREATE2:
195  PROCESS_CELL(create, cell, chan);
196  break;
197  case CELL_CREATED:
198  case CELL_CREATED_FAST:
199  case CELL_CREATED2:
201  PROCESS_CELL(created, cell, chan);
202  break;
203  case CELL_RELAY:
204  case CELL_RELAY_EARLY:
206  PROCESS_CELL(relay, cell, chan);
207  break;
208  case CELL_DESTROY:
210  PROCESS_CELL(destroy, cell, chan);
211  break;
212  default:
214  "Cell of unknown or unexpected type (%d) received. "
215  "Dropping.",
216  cell->command);
217  break;
218  }
219 }
220 
221 /** Process a 'create' <b>cell</b> that just arrived from <b>chan</b>. Make a
222  * new circuit with the p_circ_id specified in cell. Put the circuit in state
223  * onionskin_pending, and pass the onionskin to the cpuworker. Circ will get
224  * picked up again when the cpuworker finishes decrypting it.
225  */
226 static void
228 {
229  or_circuit_t *circ;
230  const or_options_t *options = get_options();
231  int id_is_high;
232  create_cell_t *create_cell;
233 
234  tor_assert(cell);
235  tor_assert(chan);
236 
237  log_debug(LD_OR,
238  "Got a CREATE cell for circ_id %u on channel %"PRIu64
239  " (%p)",
240  (unsigned)cell->circ_id,
241  (chan->global_identifier), chan);
242 
243  /* First thing we do, even though the cell might be invalid, is inform the
244  * DoS mitigation subsystem layer of this event. Validation is done by this
245  * function. */
246  dos_cc_new_create_cell(chan);
247 
248  /* We check for the conditions that would make us drop the cell before
249  * we check for the conditions that would make us send a DESTROY back,
250  * since those conditions would make a DESTROY nonsensical. */
251  if (cell->circ_id == 0) {
252  log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
253  "Received a create cell (type %d) from %s with zero circID; "
254  " ignoring.", (int)cell->command,
255  channel_describe_peer(chan));
256  return;
257  }
258 
259  if (circuit_id_in_use_on_channel(cell->circ_id, chan)) {
260  const node_t *node = node_get_by_id(chan->identity_digest);
261  log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
262  "Received CREATE cell (circID %u) for known circ. "
263  "Dropping (age %d).",
264  (unsigned)cell->circ_id,
265  (int)(time(NULL) - channel_when_created(chan)));
266  if (node) {
267  char *p = esc_for_log(node_get_platform(node));
268  log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
269  "Details: router %s, platform %s.",
270  node_describe(node), p);
271  tor_free(p);
272  }
273  return;
274  }
275 
276  if (we_are_hibernating()) {
277  log_info(LD_OR,
278  "Received create cell but we're shutting down. Sending back "
279  "destroy.");
280  channel_send_destroy(cell->circ_id, chan,
281  END_CIRC_REASON_HIBERNATING);
282  return;
283  }
284 
285  /* Check if we should apply a defense for this channel. */
286  if (dos_cc_get_defense_type(chan) == DOS_CC_DEFENSE_REFUSE_CELL) {
287  channel_send_destroy(cell->circ_id, chan,
288  END_CIRC_REASON_RESOURCELIMIT);
289  return;
290  }
291 
292  if (!server_mode(options) ||
293  (!public_server_mode(options) && channel_is_outgoing(chan))) {
294  log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
295  "Received create cell (type %d) from %s, but we're connected "
296  "to it as a client. "
297  "Sending back a destroy.",
298  (int)cell->command, channel_describe_peer(chan));
299  channel_send_destroy(cell->circ_id, chan,
300  END_CIRC_REASON_TORPROTOCOL);
301  return;
302  }
303 
304  /* If the high bit of the circuit ID is not as expected, close the
305  * circ. */
306  if (chan->wide_circ_ids)
307  id_is_high = cell->circ_id & (1u<<31);
308  else
309  id_is_high = cell->circ_id & (1u<<15);
310  if ((id_is_high &&
311  chan->circ_id_type == CIRC_ID_TYPE_HIGHER) ||
312  (!id_is_high &&
313  chan->circ_id_type == CIRC_ID_TYPE_LOWER)) {
314  log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
315  "Received create cell with unexpected circ_id %u. Closing.",
316  (unsigned)cell->circ_id);
317  channel_send_destroy(cell->circ_id, chan,
318  END_CIRC_REASON_TORPROTOCOL);
319  return;
320  }
321 
322  circ = or_circuit_new(cell->circ_id, chan);
323  circ->base_.purpose = CIRCUIT_PURPOSE_OR;
325  create_cell = tor_malloc_zero(sizeof(create_cell_t));
326  if (create_cell_parse(create_cell, cell) < 0) {
327  tor_free(create_cell);
328  log_fn(LOG_PROTOCOL_WARN, LD_OR,
329  "Bogus/unrecognized create cell; closing.");
330  circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL);
331  return;
332  }
333 
334  /* Mark whether this circuit used TAP in case we need to use this
335  * information for onion service statistics later on. */
336  if (create_cell->handshake_type == ONION_HANDSHAKE_TYPE_FAST ||
337  create_cell->handshake_type == ONION_HANDSHAKE_TYPE_TAP) {
338  circ->used_legacy_circuit_handshake = true;
339  }
340 
341  if (!channel_is_client(chan)) {
342  /* remember create types we've seen, but don't remember them from
343  * clients, to be extra conservative about client statistics. */
345  }
346 
347  if (create_cell->handshake_type != ONION_HANDSHAKE_TYPE_FAST) {
348  /* hand it off to the cpuworkers, and then return. */
349 
350  if (assign_onionskin_to_cpuworker(circ, create_cell) < 0) {
351  log_debug(LD_GENERAL,"Failed to hand off onionskin. Closing.");
352  circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_RESOURCELIMIT);
353  return;
354  }
355  log_debug(LD_OR,"success: handed off onionskin.");
356  } else {
357  /* This is a CREATE_FAST cell; we can handle it immediately without using
358  * a CPU worker. */
359  uint8_t keys[CPATH_KEY_MATERIAL_LEN];
360  uint8_t rend_circ_nonce[DIGEST_LEN];
361  int len;
362  created_cell_t created_cell;
363 
364  memset(&created_cell, 0, sizeof(created_cell));
365  len = onion_skin_server_handshake(ONION_HANDSHAKE_TYPE_FAST,
366  create_cell->onionskin,
367  create_cell->handshake_len,
368  NULL,
369  created_cell.reply,
370  keys, CPATH_KEY_MATERIAL_LEN,
371  rend_circ_nonce);
372  tor_free(create_cell);
373  if (len < 0) {
374  log_warn(LD_OR,"Failed to generate key material. Closing.");
375  circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
376  return;
377  }
378  created_cell.cell_type = CELL_CREATED_FAST;
379  created_cell.handshake_len = len;
380 
381  if (onionskin_answer(circ, &created_cell,
382  (const char *)keys, sizeof(keys),
383  rend_circ_nonce)<0) {
384  log_warn(LD_OR,"Failed to reply to CREATE_FAST cell. Closing.");
385  circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
386  return;
387  }
388  memwipe(keys, 0, sizeof(keys));
389  }
390 }
391 
392 /** Process a 'created' <b>cell</b> that just arrived from <b>chan</b>.
393  * Find the circuit
394  * that it's intended for. If we're not the origin of the circuit, package
395  * the 'created' cell in an 'extended' relay cell and pass it back. If we
396  * are the origin of the circuit, send it to circuit_finish_handshake() to
397  * finish processing keys, and then call circuit_send_next_onion_skin() to
398  * extend to the next hop in the circuit if necessary.
399  */
400 static void
402 {
403  circuit_t *circ;
404  extended_cell_t extended_cell;
405 
406  circ = circuit_get_by_circid_channel(cell->circ_id, chan);
407 
408  if (!circ) {
409  log_info(LD_OR,
410  "(circID %u) unknown circ (probably got a destroy earlier). "
411  "Dropping.", (unsigned)cell->circ_id);
412  return;
413  }
414 
415  if (circ->n_circ_id != cell->circ_id || circ->n_chan != chan) {
416  log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,
417  "got created cell from Tor client? Closing.");
418  circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
419  return;
420  }
421 
422  if (created_cell_parse(&extended_cell.created_cell, cell) < 0) {
423  log_fn(LOG_PROTOCOL_WARN, LD_OR, "Unparseable created cell.");
424  circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
425  return;
426  }
427 
428  if (CIRCUIT_IS_ORIGIN(circ)) { /* we're the OP. Handshake this. */
429  origin_circuit_t *origin_circ = TO_ORIGIN_CIRCUIT(circ);
430  int err_reason = 0;
431  log_debug(LD_OR,"at OP. Finishing handshake.");
432  if ((err_reason = circuit_finish_handshake(origin_circ,
433  &extended_cell.created_cell)) < 0) {
434  circuit_mark_for_close(circ, -err_reason);
435  return;
436  }
437  log_debug(LD_OR,"Moving to next skin.");
438  if ((err_reason = circuit_send_next_onion_skin(origin_circ)) < 0) {
439  log_info(LD_OR,"circuit_send_next_onion_skin failed.");
440  /* XXX push this circuit_close lower */
441  circuit_mark_for_close(circ, -err_reason);
442  return;
443  }
444  } else { /* pack it into an extended relay cell, and send it. */
445  uint8_t command=0;
446  uint16_t len=0;
447  uint8_t payload[RELAY_PAYLOAD_SIZE];
448  log_debug(LD_OR,
449  "Converting created cell to extended relay cell, sending.");
450  memset(payload, 0, sizeof(payload));
451  if (extended_cell.created_cell.cell_type == CELL_CREATED2)
452  extended_cell.cell_type = RELAY_COMMAND_EXTENDED2;
453  else
454  extended_cell.cell_type = RELAY_COMMAND_EXTENDED;
455  if (extended_cell_format(&command, &len, payload, &extended_cell) < 0) {
456  log_fn(LOG_PROTOCOL_WARN, LD_OR, "Can't format extended cell.");
457  circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
458  return;
459  }
460 
461  relay_send_command_from_edge(0, circ, command,
462  (const char*)payload, len, NULL);
463  }
464 }
465 
466 /** Process a 'relay' or 'relay_early' <b>cell</b> that just arrived from
467  * <b>conn</b>. Make sure it came in with a recognized circ_id. Pass it on to
468  * circuit_receive_relay_cell() for actual processing.
469  */
470 static void
472 {
473  const or_options_t *options = get_options();
474  circuit_t *circ;
475  int reason, direction;
476  uint32_t orig_delivered_bw = 0;
477  uint32_t orig_overhead_bw = 0;
478 
479  circ = circuit_get_by_circid_channel(cell->circ_id, chan);
480 
481  if (!circ) {
482  log_debug(LD_OR,
483  "unknown circuit %u on connection from %s. Dropping.",
484  (unsigned)cell->circ_id,
485  channel_describe_peer(chan));
486  return;
487  }
488 
489  if (circ->state == CIRCUIT_STATE_ONIONSKIN_PENDING) {
490  log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,"circuit in create_wait. Closing.");
491  circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
492  return;
493  }
494 
495  if (CIRCUIT_IS_ORIGIN(circ)) {
496  /* if we're a relay and treating connections with recent local
497  * traffic better, then this is one of them. */
499 
500  /* Count all circuit bytes here for control port accuracy. We want
501  * to count even invalid/dropped relay cells, hence counting
502  * before the recognized check and the connection_edge_process_relay
503  * cell checks.
504  */
505  origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ);
506 
507  /* Count the payload bytes only. We don't care about cell headers */
508  ocirc->n_read_circ_bw = tor_add_u32_nowrap(ocirc->n_read_circ_bw,
510 
511  /* Stash the original delivered and overhead values. These values are
512  * updated by circuit_read_valid_data() during cell processing by
513  * connection_edge_process_relay_cell(), called from
514  * circuit_receive_relay_cell() below. If they do not change, we inform
515  * the control port about dropped cells immediately after the call
516  * to circuit_receive_relay_cell() below. */
517  orig_delivered_bw = ocirc->n_delivered_read_circ_bw;
518  orig_overhead_bw = ocirc->n_overhead_read_circ_bw;
519  }
520 
521  if (!CIRCUIT_IS_ORIGIN(circ) &&
522  chan == TO_OR_CIRCUIT(circ)->p_chan &&
523  cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id)
524  direction = CELL_DIRECTION_OUT;
525  else
526  direction = CELL_DIRECTION_IN;
527 
528  /* If we have a relay_early cell, make sure that it's outbound, and we've
529  * gotten no more than MAX_RELAY_EARLY_CELLS_PER_CIRCUIT of them. */
530  if (cell->command == CELL_RELAY_EARLY) {
531  if (direction == CELL_DIRECTION_IN) {
532  /* Inbound early cells could once be encountered as a result of
533  * bug 1038; but relays running versions before 0.2.1.19 are long
534  * gone from the network, so any such cells now are surprising. */
535  log_warn(LD_OR,
536  "Received an inbound RELAY_EARLY cell on circuit %u."
537  " Closing circuit. Please report this event,"
538  " along with the following message.",
539  (unsigned)cell->circ_id);
540  if (CIRCUIT_IS_ORIGIN(circ)) {
542  /* Always emit a bandwidth event for closed circs */
544  } else if (circ->n_chan) {
545  log_warn(LD_OR, " upstream=%s",
547  }
548  circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
549  return;
550  } else {
551  or_circuit_t *or_circ = TO_OR_CIRCUIT(circ);
552  if (or_circ->remaining_relay_early_cells == 0) {
553  log_fn(LOG_PROTOCOL_WARN, LD_OR,
554  "Received too many RELAY_EARLY cells on circ %u from %s."
555  " Closing circuit.",
556  (unsigned)cell->circ_id,
557  safe_str(channel_describe_peer(chan)));
558  circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
559  return;
560  }
561  --or_circ->remaining_relay_early_cells;
562  }
563  }
564 
565  if ((reason = circuit_receive_relay_cell(cell, circ, direction)) < 0) {
566  log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,"circuit_receive_relay_cell "
567  "(%s) failed. Closing.",
568  direction==CELL_DIRECTION_OUT?"forward":"backward");
569  /* Always emit a bandwidth event for closed circs */
570  if (CIRCUIT_IS_ORIGIN(circ)) {
572  }
573  circuit_mark_for_close(circ, -reason);
574  }
575 
576  if (CIRCUIT_IS_ORIGIN(circ)) {
577  origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ);
578 
579  /* If neither the delivered nor overhead values changed, this cell
580  * was dropped due to being invalid by one of the error codepaths in
581  * connection_edge_process_relay_cell(), called by
582  * circuit_receive_relay_cell().
583  *
584  * Valid cells, on the other hand, call circuit_read_valid_data()
585  * to update these values upon processing them.
586  *
587  * So, if the values are the same as those stored above,
588  * emit a control port event for CIRC_BW, so the controller can
589  * react quickly to invalid cells. */
590  if (orig_delivered_bw == ocirc->n_delivered_read_circ_bw &&
591  orig_overhead_bw == ocirc->n_overhead_read_circ_bw) {
593  }
594  }
595 
596  /* If this is a cell in an RP circuit, count it as part of the
597  onion service stats */
598  if (options->HiddenServiceStatistics &&
599  !CIRCUIT_IS_ORIGIN(circ) &&
600  CONST_TO_OR_CIRCUIT(circ)->circuit_carries_hs_traffic_stats) {
601  /** We need to figure out of this is a v2 or v3 RP circuit to count it
602  * appropriately. v2 services always use the TAP legacy handshake to
603  * connect to the RP; we use this feature to distinguish between v2/v3. */
604  bool is_v2 = false;
605  if (CONST_TO_OR_CIRCUIT(circ)->used_legacy_circuit_handshake) {
606  is_v2 = true;
607  } else if (CONST_TO_OR_CIRCUIT(circ)->rend_splice) {
608  /* If this is a client->RP circuit we need to check the spliced circuit
609  * (which is the service->RP circuit) to see if it was using TAP and
610  * hence if it's a v2 circuit. That's because client->RP circuits can
611  * still use ntor even on v2; but service->RP will always use TAP. */
612  const or_circuit_t *splice = CONST_TO_OR_CIRCUIT(circ)->rend_splice;
613  if (splice->used_legacy_circuit_handshake) {
614  is_v2 = true;
615  }
616  }
618  }
619 }
620 
621 /** Process a 'destroy' <b>cell</b> that just arrived from
622  * <b>chan</b>. Find the circ that it refers to (if any).
623  *
624  * If the circ is in state
625  * onionskin_pending, then call onion_pending_remove() to remove it
626  * from the pending onion list (note that if it's already being
627  * processed by the cpuworker, it won't be in the list anymore; but
628  * when the cpuworker returns it, the circuit will be gone, and the
629  * cpuworker response will be dropped).
630  *
631  * Then mark the circuit for close (which marks all edges for close,
632  * and passes the destroy cell onward if necessary).
633  */
634 static void
636 {
637  circuit_t *circ;
638  int reason;
639 
640  circ = circuit_get_by_circid_channel(cell->circ_id, chan);
641  if (!circ) {
642  log_info(LD_OR,"unknown circuit %u on connection from %s. Dropping.",
643  (unsigned)cell->circ_id,
644  channel_describe_peer(chan));
645  return;
646  }
647  log_debug(LD_OR,"Received for circID %u.",(unsigned)cell->circ_id);
648 
649  reason = (uint8_t)cell->payload[0];
650  circ->received_destroy = 1;
651 
652  if (!CIRCUIT_IS_ORIGIN(circ) &&
653  chan == TO_OR_CIRCUIT(circ)->p_chan &&
654  cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) {
655  /* the destroy came from behind */
657  circuit_mark_for_close(circ, reason|END_CIRC_REASON_FLAG_REMOTE);
658  } else { /* the destroy came from ahead */
659  circuit_set_n_circid_chan(circ, 0, NULL);
660  if (CIRCUIT_IS_ORIGIN(circ)) {
661  circuit_mark_for_close(circ, reason|END_CIRC_REASON_FLAG_REMOTE);
662  } else {
663  char payload[1];
664  log_debug(LD_OR, "Delivering 'truncated' back.");
665  payload[0] = (char)reason;
666  relay_send_command_from_edge(0, circ, RELAY_COMMAND_TRUNCATED,
667  payload, sizeof(payload), NULL);
668  }
669  }
670 }
671 
672 /** Callback to handle a new channel; call command_setup_channel() to give
673  * it the right cell handlers.
674  */
675 
676 static void
678 {
679  tor_assert(listener);
680  tor_assert(chan);
681 
682  command_setup_channel(chan);
683 }
684 
685 /** Given a channel, install the right handlers to process incoming
686  * cells on it.
687  */
688 
689 void
691 {
692  tor_assert(chan);
693 
696 }
697 
698 /** Given a listener, install the right handler to process incoming
699  * channels on it.
700  */
701 
702 void
704 {
705  tor_assert(listener);
707 
709 }
Fixed-size cell structure.
int channel_is_outgoing(channel_t *chan)
Definition: channel.c:3025
void channel_timestamp_client(channel_t *chan)
Definition: channel.c:3173
void channel_set_cell_handlers(channel_t *chan, channel_cell_handler_fn_ptr cell_handler)
Definition: channel.c:1102
void channel_listener_set_listener_fn(channel_listener_t *chan_l, channel_listener_fn_ptr listener)
Definition: channel.c:1062
int channel_send_destroy(circid_t circ_id, channel_t *chan, int reason)
Definition: channel.c:2031
int channel_is_client(const channel_t *chan)
Definition: channel.c:2893
const char * channel_describe_peer(channel_t *chan)
Definition: channel.c:2815
time_t channel_when_created(channel_t *chan)
Definition: channel.c:3231
Header file for channel.c.
@ CIRC_ID_TYPE_LOWER
Definition: channel.h:40
@ CIRC_ID_TYPE_HIGHER
Definition: channel.h:41
@ CHANNEL_LISTENER_STATE_LISTENING
Definition: channel.h:146
void circuit_log_path(int severity, unsigned int domain, origin_circuit_t *circ)
Definition: circuitbuild.c:351
int circuit_send_next_onion_skin(origin_circuit_t *circ)
Definition: circuitbuild.c:925
int circuit_finish_handshake(origin_circuit_t *circ, const created_cell_t *reply)
Header file for circuitbuild.c.
int onionskin_answer(struct or_circuit_t *circ, const created_cell_t *created_cell, const char *keys, size_t keys_len, const uint8_t *rend_circ_nonce)
Header for feature/relay/circuitbuild_relay.c.
void circuit_set_p_circid_chan(or_circuit_t *or_circ, circid_t id, channel_t *chan)
Definition: circuitlist.c:451
int circuit_id_in_use_on_channel(circid_t circ_id, channel_t *chan)
Definition: circuitlist.c:1539
void circuit_set_n_circid_chan(circuit_t *circ, circid_t id, channel_t *chan)
Definition: circuitlist.c:474
circuit_t * circuit_get_by_circid_channel(circid_t circ_id, channel_t *chan)
Definition: circuitlist.c:1510
void circuit_set_state(circuit_t *circ, uint8_t state)
Definition: circuitlist.c:543
origin_circuit_t * TO_ORIGIN_CIRCUIT(circuit_t *x)
Definition: circuitlist.c:166
or_circuit_t * TO_OR_CIRCUIT(circuit_t *x)
Definition: circuitlist.c:154
or_circuit_t * or_circuit_new(circid_t p_circ_id, channel_t *p_chan)
Definition: circuitlist.c:1091
Header file for circuitlist.c.
#define CIRCUIT_STATE_ONIONSKIN_PENDING
Definition: circuitlist.h:23
#define CIRCUIT_IS_ORIGIN(c)
Definition: circuitlist.h:147
#define CIRCUIT_PURPOSE_OR
Definition: circuitlist.h:39
void command_process_cell(channel_t *chan, cell_t *cell)
Definition: command.c:149
const char * cell_command_to_string(uint8_t command)
Definition: command.c:89
static void command_process_create_cell(cell_t *cell, channel_t *chan)
Definition: command.c:227
uint64_t stats_n_created_cells_processed
Definition: command.c:70
static void command_handle_incoming_channel(channel_listener_t *listener, channel_t *chan)
Definition: command.c:677
static void command_process_destroy_cell(cell_t *cell, channel_t *chan)
Definition: command.c:635
static void command_process_created_cell(cell_t *cell, channel_t *chan)
Definition: command.c:401
uint64_t stats_n_destroy_cells_processed
Definition: command.c:74
uint64_t stats_n_relay_cells_processed
Definition: command.c:72
void command_setup_listener(channel_listener_t *listener)
Definition: command.c:703
static void command_process_relay_cell(cell_t *cell, channel_t *chan)
Definition: command.c:471
void command_setup_channel(channel_t *chan)
Definition: command.c:690
uint64_t stats_n_create_cells_processed
Definition: command.c:68
Header file for command.c.
const or_options_t * get_options(void)
Definition: config.c:919
tor_cmdline_mode_t command
Definition: config.c:2440
Header file for config.c.
Header file for connection.c.
Header file for connection_or.c.
int control_event_circ_bandwidth_used_for_circ(origin_circuit_t *ocirc)
Header file for control_events.c.
int assign_onionskin_to_cpuworker(or_circuit_t *circ, create_cell_t *onionskin)
Definition: cpuworker.c:513
Header file for cpuworker.c.
void memwipe(void *mem, uint8_t byte, size_t sz)
Definition: crypto_util.c:55
Common functions for cryptographic routines.
const char * node_describe(const node_t *node)
Definition: describe.c:160
Header file for describe.c.
#define DIGEST_LEN
Definition: digest_sizes.h:20
char * esc_for_log(const char *s)
Definition: escape.c:30
int we_are_hibernating(void)
Definition: hibernate.c:937
Header file for hibernate.c.
#define log_fn(severity, domain, args,...)
Definition: log.h:283
#define LD_PROTOCOL
Definition: log.h:72
#define LD_OR
Definition: log.h:92
#define LD_GENERAL
Definition: log.h:62
#define LOG_WARN
Definition: log.h:53
#define LOG_INFO
Definition: log.h:45
static time_t current_second
Definition: mainloop.c:2187
#define tor_free(p)
Definition: malloc.h:52
const char * node_get_platform(const node_t *node)
Definition: nodelist.c:1722
const node_t * node_get_by_id(const char *identity_digest)
Definition: nodelist.c:226
Header file for nodelist.c.
int created_cell_parse(created_cell_t *cell_out, const cell_t *cell_in)
Definition: onion.c:209
int create_cell_parse(create_cell_t *cell_out, const cell_t *cell_in)
Definition: onion.c:155
int extended_cell_format(uint8_t *command_out, uint16_t *len_out, uint8_t *payload_out, const extended_cell_t *cell_in)
Definition: onion.c:714
Header file for onion.c.
int onion_skin_server_handshake(int type, const uint8_t *onion_skin, size_t onionskin_len, const server_onion_keys_t *keys, uint8_t *reply_out, uint8_t *keys_out, size_t keys_out_len, uint8_t *rend_nonce_out)
Definition: onion_crypto.c:174
Header file for onion_crypto.c.
Master header file for Tor-specific functionality.
#define CELL_PAYLOAD_SIZE
Definition: or.h:457
#define TO_CIRCUIT(x)
Definition: or.h:845
#define RELAY_PAYLOAD_SIZE
Definition: or.h:486
#define END_CIRC_REASON_FLAG_REMOTE
Definition: or.h:329
@ CELL_DIRECTION_OUT
Definition: or.h:365
@ CELL_DIRECTION_IN
Definition: or.h:364
Origin circuit structure.
int circuit_receive_relay_cell(cell_t *cell, circuit_t *circ, cell_direction_t cell_direction)
Definition: relay.c:226
Header file for relay.c.
void rep_hist_seen_new_rp_cell(bool is_v2)
Definition: rephist.c:2247
void rep_hist_note_circuit_handshake_requested(uint16_t type)
Definition: rephist.c:2009
Header file for rephist.c.
Header file for routerlist.c.
int public_server_mode(const or_options_t *options)
Definition: routermode.c:43
int server_mode(const or_options_t *options)
Definition: routermode.c:34
Header file for routermode.c.
Definition: cell_st.h:17
uint8_t payload[CELL_PAYLOAD_SIZE]
Definition: cell_st.h:21
uint8_t command
Definition: cell_st.h:19
circid_t circ_id
Definition: cell_st.h:18
channel_listener_state_t state
Definition: channel.h:463
circ_id_type_bitfield_t circ_id_type
Definition: channel.h:405
char identity_digest[DIGEST_LEN]
Definition: channel.h:378
uint64_t global_identifier
Definition: channel.h:197
uint8_t state
Definition: circuit_st.h:110
unsigned int received_destroy
Definition: circuit_st.h:104
uint8_t purpose
Definition: circuit_st.h:111
channel_t * n_chan
Definition: circuit_st.h:69
circid_t n_circ_id
Definition: circuit_st.h:78
uint16_t handshake_len
Definition: onion.h:30
uint16_t handshake_type
Definition: onion.h:28
uint8_t onionskin[CELL_PAYLOAD_SIZE - 4]
Definition: onion.h:32
uint16_t handshake_len
Definition: onion.h:40
uint8_t reply[CELL_PAYLOAD_SIZE - 2]
Definition: onion.h:42
uint8_t cell_type
Definition: onion.h:38
created_cell_t created_cell
Definition: onion.h:68
uint8_t cell_type
Definition: onion.h:66
Definition: node_st.h:34
channel_t * p_chan
Definition: or_circuit_st.h:37
unsigned int remaining_relay_early_cells
Definition: or_circuit_st.h:57
circid_t p_circ_id
Definition: or_circuit_st.h:33
bool used_legacy_circuit_handshake
Definition: or_circuit_st.h:70
struct or_circuit_t * rend_splice
Definition: or_circuit_st.h:50
int HiddenServiceStatistics
uint32_t n_delivered_read_circ_bw
uint32_t n_overhead_read_circ_bw
void tor_gettimeofday(struct timeval *timeval)
long tv_udiff(const struct timeval *start, const struct timeval *end)
Definition: tvdiff.c:53
#define tor_assert(expr)
Definition: util_bug.h:102
Variable-length cell structure.