Tor  0.4.4.0-alpha-dev
connection_or.c
Go to the documentation of this file.
1 /* Copyright (c) 2001 Matej Pfajfar.
2  * Copyright (c) 2001-2004, Roger Dingledine.
3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4  * Copyright (c) 2007-2020, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
6 
7 /**
8  * \file connection_or.c
9  * \brief Functions to handle OR connections, TLS handshaking, and
10  * cells on the network.
11  *
12  * An or_connection_t is a subtype of connection_t (as implemented in
13  * connection.c) that uses a TLS connection to send and receive cells on the
14  * Tor network. (By sending and receiving cells connection_or.c, it cooperates
15  * with channeltls.c to implement a the channel interface of channel.c.)
16  *
17  * Every OR connection has an underlying tortls_t object (as implemented in
18  * tortls.c) which it uses as its TLS stream. It is responsible for
19  * sending and receiving cells over that TLS.
20  *
21  * This module also implements the client side of the v3 (and greater) Tor
22  * link handshake.
23  **/
24 #include "core/or/or.h"
25 #include "feature/client/bridges.h"
26 #include "lib/buf/buffers.h"
27 /*
28  * Define this so we get channel internal functions, since we're implementing
29  * part of a subclass (channel_tls_t).
30  */
31 #define CHANNEL_OBJECT_PRIVATE
32 #define CONNECTION_OR_PRIVATE
33 #define ORCONN_EVENT_PRIVATE
34 #include "core/or/channel.h"
35 #include "core/or/channeltls.h"
36 #include "core/or/circuitbuild.h"
37 #include "core/or/circuitlist.h"
38 #include "core/or/circuitstats.h"
39 #include "core/or/command.h"
40 #include "app/config/config.h"
42 #include "core/or/connection_or.h"
48 #include "lib/geoip/geoip.h"
49 #include "core/mainloop/mainloop.h"
50 #include "trunnel/netinfo.h"
54 #include "core/proto/proto_cell.h"
55 #include "core/or/reasons.h"
56 #include "core/or/relay.h"
58 #include "feature/stats/rephist.h"
59 #include "feature/relay/router.h"
65 #include "core/or/scheduler.h"
67 #include "core/or/channelpadding.h"
69 
70 #include "core/or/cell_st.h"
71 #include "core/or/cell_queue_st.h"
75 #include "app/config/or_state_st.h"
77 #include "core/or/var_cell_st.h"
79 
80 #include "lib/tls/tortls.h"
81 
82 #include "core/or/orconn_event.h"
83 
88  int started_here,
89  char *digest_rcvd_out);
90 
91 static void connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn);
92 
93 static unsigned int
95 static void connection_or_mark_bad_for_new_circs(or_connection_t *or_conn);
96 
98  int started_here);
99 
100 /**************************************************************/
101 
102 /** Convert a connection_t* to an or_connection_t*; assert if the cast is
103  * invalid. */
106 {
107  tor_assert(c->magic == OR_CONNECTION_MAGIC);
108  return DOWNCAST(or_connection_t, c);
109 }
110 
111 /** Clear clear conn->identity_digest and update other data
112  * structures as appropriate.*/
113 void
115 {
116  tor_assert(conn);
117  memset(conn->identity_digest, 0, DIGEST_LEN);
118 }
119 
120 /** Clear all identities in OR conns.*/
121 void
123 {
125  SMARTLIST_FOREACH(conns, connection_t *, conn,
126  {
127  if (conn->type == CONN_TYPE_OR) {
128  connection_or_clear_identity(TO_OR_CONN(conn));
129  }
130  });
131 }
132 
133 /** Change conn->identity_digest to digest, and add conn into
134  * the appropriate digest maps.
135  *
136  * NOTE that this function only allows two kinds of transitions: from
137  * unset identity to set identity, and from idempotent re-settings
138  * of the same identity. It's not allowed to clear an identity or to
139  * change an identity. Return 0 on success, and -1 if the transition
140  * is not allowed.
141  **/
142 static void
144  const char *rsa_digest,
145  const ed25519_public_key_t *ed_id)
146 {
147  channel_t *chan = NULL;
148  tor_assert(conn);
149  tor_assert(rsa_digest);
150 
151  if (conn->chan)
152  chan = TLS_CHAN_TO_BASE(conn->chan);
153 
154  log_info(LD_HANDSHAKE, "Set identity digest for %p (%s): %s %s.",
155  conn,
156  escaped_safe_str(conn->base_.address),
157  hex_str(rsa_digest, DIGEST_LEN),
158  ed25519_fmt(ed_id));
159  log_info(LD_HANDSHAKE, " (Previously: %s %s)",
161  chan ? ed25519_fmt(&chan->ed25519_identity) : "<null>");
162 
163  const int rsa_id_was_set = ! tor_digest_is_zero(conn->identity_digest);
164  const int ed_id_was_set =
166  const int rsa_changed =
167  tor_memneq(conn->identity_digest, rsa_digest, DIGEST_LEN);
168  const int ed_changed = ed_id_was_set &&
169  (!ed_id || !ed25519_pubkey_eq(ed_id, &chan->ed25519_identity));
170 
171  tor_assert(!rsa_changed || !rsa_id_was_set);
172  tor_assert(!ed_changed || !ed_id_was_set);
173 
174  if (!rsa_changed && !ed_changed)
175  return;
176 
177  /* If the identity was set previously, remove the old mapping. */
178  if (rsa_id_was_set) {
180  if (chan)
182  }
183 
184  memcpy(conn->identity_digest, rsa_digest, DIGEST_LEN);
185 
186  /* If we're initializing the IDs to zero, don't add a mapping yet. */
187  if (tor_digest_is_zero(rsa_digest) &&
188  (!ed_id || ed25519_public_key_is_zero(ed_id)))
189  return;
190 
191  /* Deal with channels */
192  if (chan)
193  channel_set_identity_digest(chan, rsa_digest, ed_id);
194 }
195 
196 /**************************************************************/
197 
198 /** Map from a string describing what a non-open OR connection was doing when
199  * failed, to an intptr_t describing the count of connections that failed that
200  * way. Note that the count is stored _as_ the pointer.
201  */
202 static strmap_t *broken_connection_counts;
203 
204 /** If true, do not record information in <b>broken_connection_counts</b>. */
206 
207 /** Record that an OR connection failed in <b>state</b>. */
208 static void
209 note_broken_connection(const char *state)
210 {
211  void *ptr;
212  intptr_t val;
214  return;
215 
217  broken_connection_counts = strmap_new();
218 
219  ptr = strmap_get(broken_connection_counts, state);
220  val = (intptr_t)ptr;
221  val++;
222  ptr = (void*)val;
223  strmap_set(broken_connection_counts, state, ptr);
224 }
225 
226 /** Forget all recorded states for failed connections. If
227  * <b>stop_recording</b> is true, don't record any more. */
228 void
229 clear_broken_connection_map(int stop_recording)
230 {
232  strmap_free(broken_connection_counts, NULL);
234  if (stop_recording)
236 }
237 
238 /** Write a detailed description the state of <b>orconn</b> into the
239  * <b>buflen</b>-byte buffer at <b>buf</b>. This description includes not
240  * only the OR-conn level state but also the TLS state. It's useful for
241  * diagnosing broken handshakes. */
242 static void
244  char *buf, size_t buflen)
245 {
246  connection_t *conn = TO_CONN(orconn);
247  const char *conn_state;
248  char tls_state[256];
249 
250  tor_assert(conn->type == CONN_TYPE_OR || conn->type == CONN_TYPE_EXT_OR);
251 
252  conn_state = conn_state_to_string(conn->type, conn->state);
253  tor_tls_get_state_description(orconn->tls, tls_state, sizeof(tls_state));
254 
255  tor_snprintf(buf, buflen, "%s with SSL state %s", conn_state, tls_state);
256 }
257 
258 /** Record the current state of <b>orconn</b> as the state of a broken
259  * connection. */
260 static void
262 {
263  char buf[256];
265  return;
266  connection_or_get_state_description(orconn, buf, sizeof(buf));
267  log_info(LD_HANDSHAKE,"Connection died in state '%s'", buf);
269 }
270 
271 /** Helper type used to sort connection states and find the most frequent. */
272 typedef struct broken_state_count_t {
273  intptr_t count;
274  const char *state;
276 
277 /** Helper function used to sort broken_state_count_t by frequency. */
278 static int
279 broken_state_count_compare(const void **a_ptr, const void **b_ptr)
280 {
281  const broken_state_count_t *a = *a_ptr, *b = *b_ptr;
282  if (b->count < a->count)
283  return -1;
284  else if (b->count == a->count)
285  return 0;
286  else
287  return 1;
288 }
289 
290 /** Upper limit on the number of different states to report for connection
291  * failure. */
292 #define MAX_REASONS_TO_REPORT 10
293 
294 /** Report a list of the top states for failed OR connections at log level
295  * <b>severity</b>, in log domain <b>domain</b>. */
296 void
297 connection_or_report_broken_states(int severity, int domain)
298 {
299  int total = 0;
300  smartlist_t *items;
301 
303  return;
304 
305  items = smartlist_new();
306  STRMAP_FOREACH(broken_connection_counts, state, void *, countptr) {
307  broken_state_count_t *c = tor_malloc(sizeof(broken_state_count_t));
308  c->count = (intptr_t)countptr;
309  total += (int)c->count;
310  c->state = state;
311  smartlist_add(items, c);
312  } STRMAP_FOREACH_END;
313 
315 
316  tor_log(severity, domain, "%d connections have failed%s", total,
317  smartlist_len(items) > MAX_REASONS_TO_REPORT ? ". Top reasons:" : ":");
318 
319  SMARTLIST_FOREACH_BEGIN(items, const broken_state_count_t *, c) {
320  if (c_sl_idx > MAX_REASONS_TO_REPORT)
321  break;
322  tor_log(severity, domain,
323  " %d connections died in state %s", (int)c->count, c->state);
324  } SMARTLIST_FOREACH_END(c);
325 
327  smartlist_free(items);
328 }
329 
330 /**
331  * Helper function to publish an OR connection status event
332  *
333  * Publishes a messages to subscribers of ORCONN messages, and sends
334  * the control event.
335  **/
336 void
338  int reason)
339 {
340  orconn_status_msg_t *msg = tor_malloc(sizeof(*msg));
341 
342  msg->gid = conn->base_.global_identifier;
343  msg->status = tp;
344  msg->reason = reason;
345  orconn_status_publish(msg);
346  control_event_or_conn_status(conn, tp, reason);
347 }
348 
349 /**
350  * Helper function to publish a state change message
351  *
352  * connection_or_change_state() calls this to notify subscribers about
353  * a change of an OR connection state.
354  **/
355 static void
356 connection_or_state_publish(const or_connection_t *conn, uint8_t state)
357 {
358  orconn_state_msg_t *msg = tor_malloc(sizeof(*msg));
359 
360  msg->gid = conn->base_.global_identifier;
361  if (conn->is_pt) {
362  /* Do extra decoding because conn->proxy_type indicates the proxy
363  * protocol that tor uses to talk with the transport plugin,
364  * instead of PROXY_PLUGGABLE. */
365  tor_assert_nonfatal(conn->proxy_type != PROXY_NONE);
366  msg->proxy_type = PROXY_PLUGGABLE;
367  } else {
368  msg->proxy_type = conn->proxy_type;
369  }
370  msg->state = state;
371  if (conn->chan) {
372  msg->chan = TLS_CHAN_TO_BASE(conn->chan)->global_identifier;
373  } else {
374  msg->chan = 0;
375  }
376  orconn_state_publish(msg);
377 }
378 
379 /** Call this to change or_connection_t states, so the owning channel_tls_t can
380  * be notified.
381  */
382 
383 MOCK_IMPL(STATIC void,
385 {
386  tor_assert(conn);
387 
388  conn->base_.state = state;
389 
390  connection_or_state_publish(conn, state);
391  if (conn->chan)
393 }
394 
395 /** Return the number of circuits using an or_connection_t; this used to
396  * be an or_connection_t field, but it got moved to channel_t and we
397  * shouldn't maintain two copies. */
398 
399 MOCK_IMPL(int,
401 {
402  tor_assert(conn);
403 
404  if (conn->chan) {
405  return channel_num_circuits(TLS_CHAN_TO_BASE(conn->chan));
406  } else return 0;
407 }
408 
409 /**************************************************************/
410 
411 /** Pack the cell_t host-order structure <b>src</b> into network-order
412  * in the buffer <b>dest</b>. See tor-spec.txt for details about the
413  * wire format.
414  *
415  * Note that this function doesn't touch <b>dst</b>->next: the caller
416  * should set it or clear it as appropriate.
417  */
418 void
419 cell_pack(packed_cell_t *dst, const cell_t *src, int wide_circ_ids)
420 {
421  char *dest = dst->body;
422  if (wide_circ_ids) {
423  set_uint32(dest, htonl(src->circ_id));
424  dest += 4;
425  } else {
426  /* Clear the last two bytes of dest, in case we can accidentally
427  * send them to the network somehow. */
428  memset(dest+CELL_MAX_NETWORK_SIZE-2, 0, 2);
429  set_uint16(dest, htons(src->circ_id));
430  dest += 2;
431  }
432  set_uint8(dest, src->command);
433  memcpy(dest+1, src->payload, CELL_PAYLOAD_SIZE);
434 }
435 
436 /** Unpack the network-order buffer <b>src</b> into a host-order
437  * cell_t structure <b>dest</b>.
438  */
439 static void
440 cell_unpack(cell_t *dest, const char *src, int wide_circ_ids)
441 {
442  if (wide_circ_ids) {
443  dest->circ_id = ntohl(get_uint32(src));
444  src += 4;
445  } else {
446  dest->circ_id = ntohs(get_uint16(src));
447  src += 2;
448  }
449  dest->command = get_uint8(src);
450  memcpy(dest->payload, src+1, CELL_PAYLOAD_SIZE);
451 }
452 
453 /** Write the header of <b>cell</b> into the first VAR_CELL_MAX_HEADER_SIZE
454  * bytes of <b>hdr_out</b>. Returns number of bytes used. */
455 int
456 var_cell_pack_header(const var_cell_t *cell, char *hdr_out, int wide_circ_ids)
457 {
458  int r;
459  if (wide_circ_ids) {
460  set_uint32(hdr_out, htonl(cell->circ_id));
461  hdr_out += 4;
463  } else {
464  set_uint16(hdr_out, htons(cell->circ_id));
465  hdr_out += 2;
466  r = VAR_CELL_MAX_HEADER_SIZE - 2;
467  }
468  set_uint8(hdr_out, cell->command);
469  set_uint16(hdr_out+1, htons(cell->payload_len));
470  return r;
471 }
472 
473 /** Allocate and return a new var_cell_t with <b>payload_len</b> bytes of
474  * payload space. */
475 var_cell_t *
476 var_cell_new(uint16_t payload_len)
477 {
478  size_t size = offsetof(var_cell_t, payload) + payload_len;
479  var_cell_t *cell = tor_malloc_zero(size);
480  cell->payload_len = payload_len;
481  cell->command = 0;
482  cell->circ_id = 0;
483  return cell;
484 }
485 
486 /**
487  * Copy a var_cell_t
488  */
489 
490 var_cell_t *
492 {
493  var_cell_t *copy = NULL;
494  size_t size = 0;
495 
496  if (src != NULL) {
497  size = offsetof(var_cell_t, payload) + src->payload_len;
498  copy = tor_malloc_zero(size);
499  copy->payload_len = src->payload_len;
500  copy->command = src->command;
501  copy->circ_id = src->circ_id;
502  memcpy(copy->payload, src->payload, copy->payload_len);
503  }
504 
505  return copy;
506 }
507 
508 /** Release all space held by <b>cell</b>. */
509 void
511 {
512  tor_free(cell);
513 }
514 
515 /** We've received an EOF from <b>conn</b>. Mark it for close and return. */
516 int
518 {
519  tor_assert(conn);
520 
521  log_info(LD_OR,"OR connection reached EOF. Closing.");
523 
524  return 0;
525 }
526 
527 /** Handle any new bytes that have come in on connection <b>conn</b>.
528  * If conn is in 'open' state, hand it to
529  * connection_or_process_cells_from_inbuf()
530  * (else do nothing).
531  */
532 int
534 {
535  /** Don't let the inbuf of a nonopen OR connection grow beyond this many
536  * bytes: it's either a broken client, a non-Tor client, or a DOS
537  * attempt. */
538 #define MAX_OR_INBUF_WHEN_NONOPEN 0
539 
540  int ret = 0;
541  tor_assert(conn);
542 
543  switch (conn->base_.state) {
546 
547  /* start TLS after handshake completion, or deal with error */
548  if (ret == 1) {
549  tor_assert(TO_CONN(conn)->proxy_state == PROXY_CONNECTED);
550  if (connection_tls_start_handshake(conn, 0) < 0)
551  ret = -1;
552  /* Touch the channel's active timestamp if there is one */
553  if (conn->chan)
554  channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
555  }
556  if (ret < 0) {
558  }
559 
560  return ret;
562  case OR_CONN_STATE_OPEN:
566  default:
567  break; /* don't do anything */
568  }
569 
570  /* This check was necessary with 0.2.2, when the TLS_SERVER_RENEGOTIATING
571  * check would otherwise just let data accumulate. It serves no purpose
572  * in 0.2.3.
573  *
574  * XXXX Remove this check once we verify that the above paragraph is
575  * 100% true. */
576  if (buf_datalen(conn->base_.inbuf) > MAX_OR_INBUF_WHEN_NONOPEN) {
577  log_fn(LOG_PROTOCOL_WARN, LD_NET, "Accumulated too much data (%d bytes) "
578  "on nonopen OR connection %s %s:%u in state %s; closing.",
579  (int)buf_datalen(conn->base_.inbuf),
580  connection_or_nonopen_was_started_here(conn) ? "to" : "from",
581  conn->base_.address, conn->base_.port,
582  conn_state_to_string(conn->base_.type, conn->base_.state));
584  ret = -1;
585  }
586 
587  return ret;
588 }
589 
590 /** Called whenever we have flushed some data on an or_conn: add more data
591  * from active circuits. */
592 int
594 {
595  size_t datalen;
596 
597  /* Update the channel's active timestamp if there is one */
598  if (conn->chan)
599  channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
600 
601  /* If we're under the low water mark, add cells until we're just over the
602  * high water mark. */
603  datalen = connection_get_outbuf_len(TO_CONN(conn));
604  if (datalen < OR_CONN_LOWWATER) {
605  /* Let the scheduler know */
606  scheduler_channel_wants_writes(TLS_CHAN_TO_BASE(conn->chan));
607  }
608 
609  return 0;
610 }
611 
612 /** This is for channeltls.c to ask how many cells we could accept if
613  * they were available. */
614 ssize_t
616 {
617  size_t datalen, cell_network_size;
618  ssize_t n = 0;
619 
620  tor_assert(conn);
621 
622  /*
623  * If we're under the high water mark, we're potentially
624  * writeable; note this is different from the calculation above
625  * used to trigger when to start writing after we've stopped.
626  */
627  datalen = connection_get_outbuf_len(TO_CONN(conn));
628  if (datalen < OR_CONN_HIGHWATER) {
629  cell_network_size = get_cell_network_size(conn->wide_circ_ids);
630  n = CEIL_DIV(OR_CONN_HIGHWATER - datalen, cell_network_size);
631  }
632 
633  return n;
634 }
635 
636 /** Connection <b>conn</b> has finished writing and has no bytes left on
637  * its outbuf.
638  *
639  * Otherwise it's in state "open": stop writing and return.
640  *
641  * If <b>conn</b> is broken, mark it for close and return -1, else
642  * return 0.
643  */
644 int
646 {
647  tor_assert(conn);
648  assert_connection_ok(TO_CONN(conn),0);
649 
650  switch (conn->base_.state) {
652  /* PROXY_HAPROXY gets connected by receiving an ack. */
653  if (conn->proxy_type == PROXY_HAPROXY) {
654  tor_assert(TO_CONN(conn)->proxy_state == PROXY_HAPROXY_WAIT_FOR_FLUSH);
655  TO_CONN(conn)->proxy_state = PROXY_CONNECTED;
656 
657  if (connection_tls_start_handshake(conn, 0) < 0) {
658  /* TLS handshaking error of some kind. */
660  return -1;
661  }
662  break;
663  }
664  break;
665  case OR_CONN_STATE_OPEN:
668  break;
669  default:
670  log_err(LD_BUG,"Called in unexpected state %d.", conn->base_.state);
672  return -1;
673  }
674 
675  /* Update the channel's active timestamp if there is one */
676  if (conn->chan)
677  channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
678 
679  return 0;
680 }
681 
682 /** Connected handler for OR connections: begin the TLS handshake.
683  */
684 int
686 {
687  const int proxy_type = or_conn->proxy_type;
688  connection_t *conn;
689 
690  tor_assert(or_conn);
691  conn = TO_CONN(or_conn);
693 
694  log_debug(LD_HANDSHAKE,"OR connect() to router at %s:%u finished.",
695  conn->address,conn->port);
696 
697  if (proxy_type != PROXY_NONE) {
698  /* start proxy handshake */
699  if (connection_proxy_connect(conn, proxy_type) < 0) {
700  connection_or_close_for_error(or_conn, 0);
701  return -1;
702  }
703 
706 
707  return 0;
708  }
709 
710  if (connection_tls_start_handshake(or_conn, 0) < 0) {
711  /* TLS handshaking error of some kind. */
712  connection_or_close_for_error(or_conn, 0);
713  return -1;
714  }
715  return 0;
716 }
717 
718 /** Called when we're about to finally unlink and free an OR connection:
719  * perform necessary accounting and cleanup */
720 void
722 {
723  connection_t *conn = TO_CONN(or_conn);
724 
725  /* Tell the controlling channel we're closed */
726  if (or_conn->chan) {
727  channel_closed(TLS_CHAN_TO_BASE(or_conn->chan));
728  /*
729  * NULL this out because the channel might hang around a little
730  * longer before channel_run_cleanup() gets it.
731  */
732  or_conn->chan->conn = NULL;
733  or_conn->chan = NULL;
734  }
735 
736  /* Remember why we're closing this connection. */
737  if (conn->state != OR_CONN_STATE_OPEN) {
738  /* now mark things down as needed */
740  const or_options_t *options = get_options();
742  /* Tell the new guard API about the channel failure */
743  entry_guard_chan_failed(TLS_CHAN_TO_BASE(or_conn->chan));
744  if (conn->state >= OR_CONN_STATE_TLS_HANDSHAKING) {
745  int reason = tls_error_to_orconn_end_reason(or_conn->tls_error);
746  connection_or_event_status(or_conn, OR_CONN_EVENT_FAILED,
747  reason);
748  if (!authdir_mode_tests_reachability(options))
751  reason, or_conn);
752  }
753  }
754  } else if (conn->hold_open_until_flushed) {
755  /* We only set hold_open_until_flushed when we're intentionally
756  * closing a connection. */
757  connection_or_event_status(or_conn, OR_CONN_EVENT_CLOSED,
759  } else if (!tor_digest_is_zero(or_conn->identity_digest)) {
760  connection_or_event_status(or_conn, OR_CONN_EVENT_CLOSED,
762  }
763 }
764 
765 /** Return 1 if identity digest <b>id_digest</b> is known to be a
766  * currently or recently running relay. Otherwise return 0. */
767 int
769 {
770  if (router_get_consensus_status_by_id(id_digest))
771  return 1; /* It's in the consensus: "yes" */
772  if (router_get_by_id_digest(id_digest))
773  return 1; /* Not in the consensus, but we have a descriptor for
774  * it. Probably it was in a recent consensus. "Yes". */
775  return 0;
776 }
777 
778 /** Set the per-conn read and write limits for <b>conn</b>. If it's a known
779  * relay, we will rely on the global read and write buckets, so give it
780  * per-conn limits that are big enough they'll never matter. But if it's
781  * not a known relay, first check if we set PerConnBwRate/Burst, then
782  * check if the consensus sets them, else default to 'big enough'.
783  *
784  * If <b>reset</b> is true, set the bucket to be full. Otherwise, just
785  * clip the bucket if it happens to be <em>too</em> full.
786  */
787 static void
789  const or_options_t *options)
790 {
791  int rate, burst; /* per-connection rate limiting params */
793  /* It's in the consensus, or we have a descriptor for it meaning it
794  * was probably in a recent consensus. It's a recognized relay:
795  * give it full bandwidth. */
796  rate = (int)options->BandwidthRate;
797  burst = (int)options->BandwidthBurst;
798  } else {
799  /* Not a recognized relay. Squeeze it down based on the suggested
800  * bandwidth parameters in the consensus, but allow local config
801  * options to override. */
802  rate = options->PerConnBWRate ? (int)options->PerConnBWRate :
803  networkstatus_get_param(NULL, "perconnbwrate",
804  (int)options->BandwidthRate, 1, INT32_MAX);
805  burst = options->PerConnBWBurst ? (int)options->PerConnBWBurst :
806  networkstatus_get_param(NULL, "perconnbwburst",
807  (int)options->BandwidthBurst, 1, INT32_MAX);
808  }
809 
810  token_bucket_rw_adjust(&conn->bucket, rate, burst);
811  if (reset) {
813  }
814 }
815 
816 /** Either our set of relays or our per-conn rate limits have changed.
817  * Go through all the OR connections and update their token buckets to make
818  * sure they don't exceed their maximum values. */
819 void
821  const or_options_t *options)
822 {
823  SMARTLIST_FOREACH(conns, connection_t *, conn,
824  {
825  if (connection_speaks_cells(conn))
827  });
828 }
829 
830 /* Mark <b>or_conn</b> as canonical if <b>is_canonical</b> is set, and
831  * non-canonical otherwise. Adjust idle_timeout accordingly.
832  */
833 void
834 connection_or_set_canonical(or_connection_t *or_conn,
835  int is_canonical)
836 {
837  if (bool_eq(is_canonical, or_conn->is_canonical) &&
838  or_conn->idle_timeout != 0) {
839  /* Don't recalculate an existing idle_timeout unless the canonical
840  * status changed. */
841  return;
842  }
843 
844  or_conn->is_canonical = !! is_canonical; /* force to a 1-bit boolean */
846  TLS_CHAN_TO_BASE(or_conn->chan), is_canonical);
847 
848  log_info(LD_CIRC,
849  "Channel %"PRIu64 " chose an idle timeout of %d.",
850  or_conn->chan ?
851  (TLS_CHAN_TO_BASE(or_conn->chan)->global_identifier):0,
852  or_conn->idle_timeout);
853 }
854 
855 /** If we don't necessarily know the router we're connecting to, but we
856  * have an addr/port/id_digest, then fill in as much as we can. Start
857  * by checking to see if this describes a router we know.
858  * <b>started_here</b> is 1 if we are the initiator of <b>conn</b> and
859  * 0 if it's an incoming connection. */
860 void
862  const tor_addr_t *addr, uint16_t port,
863  const char *id_digest,
864  const ed25519_public_key_t *ed_id,
865  int started_here)
866 {
867  log_debug(LD_HANDSHAKE, "init conn from address %s: %s, %s (%d)",
868  fmt_addr(addr),
869  hex_str((const char*)id_digest, DIGEST_LEN),
870  ed25519_fmt(ed_id),
871  started_here);
872 
873  connection_or_set_identity_digest(conn, id_digest, ed_id);
875 
876  conn->base_.port = port;
877  tor_addr_copy(&conn->base_.addr, addr);
878  tor_addr_copy(&conn->real_addr, addr);
879 
880  connection_or_check_canonicity(conn, started_here);
881 }
882 
883 /** Check whether the identity of <b>conn</b> matches a known node. If it
884  * does, check whether the address of conn matches the expected address, and
885  * update the connection's is_canonical flag, nickname, and address fields as
886  * appropriate. */
887 static void
889 {
890  const char *id_digest = conn->identity_digest;
891  const ed25519_public_key_t *ed_id = NULL;
892  const tor_addr_t *addr = &conn->real_addr;
893  if (conn->chan)
894  ed_id = & TLS_CHAN_TO_BASE(conn->chan)->ed25519_identity;
895 
896  const node_t *r = node_get_by_id(id_digest);
897  if (r &&
899  ! node_ed25519_id_matches(r, ed_id)) {
900  /* If this node is capable of proving an ed25519 ID,
901  * we can't call this a canonical connection unless both IDs match. */
902  r = NULL;
903  }
904 
905  if (r) {
906  tor_addr_port_t node_ipv4_ap;
907  tor_addr_port_t node_ipv6_ap;
908  node_get_prim_orport(r, &node_ipv4_ap);
909  node_get_pref_ipv6_orport(r, &node_ipv6_ap);
910  if (tor_addr_eq(&conn->base_.addr, &node_ipv4_ap.addr) ||
911  tor_addr_eq(&conn->base_.addr, &node_ipv6_ap.addr)) {
912  connection_or_set_canonical(conn, 1);
913  }
914  /* Choose the correct canonical address and port. */
915  tor_addr_port_t *node_ap;
916  if (tor_addr_family(&conn->base_.addr) == AF_INET) {
917  node_ap = &node_ipv4_ap;
918  } else {
919  node_ap = &node_ipv6_ap;
920  }
921  if (!started_here) {
922  /* Override the addr/port, so our log messages will make sense.
923  * This is dangerous, since if we ever try looking up a conn by
924  * its actual addr/port, we won't remember. Careful! */
925  /* XXXX arma: this is stupid, and it's the reason we need real_addr
926  * to track is_canonical properly. What requires it? */
927  /* XXXX <arma> i believe the reason we did this, originally, is because
928  * we wanted to log what OR a connection was to, and if we logged the
929  * right IP address and port 56244, that wouldn't be as helpful. now we
930  * log the "right" port too, so we know if it's moria1 or moria2.
931  */
932  /* See #33898 for a ticket that resolves this technical debt. */
933  tor_addr_copy(&conn->base_.addr, &node_ap->addr);
934  conn->base_.port = node_ap->port;
935  }
936  tor_free(conn->nickname);
937  conn->nickname = tor_strdup(node_get_nickname(r));
938  tor_free(conn->base_.address);
939  conn->base_.address = tor_addr_to_str_dup(&node_ap->addr);
940  } else {
941  tor_free(conn->nickname);
942  conn->nickname = tor_malloc(HEX_DIGEST_LEN+2);
943  conn->nickname[0] = '$';
945  conn->identity_digest, DIGEST_LEN);
946 
947  tor_free(conn->base_.address);
948  conn->base_.address = tor_addr_to_str_dup(addr);
949  }
950 
951  /*
952  * We have to tell channeltls.c to update the channel marks (local, in
953  * particular), since we may have changed the address.
954  */
955 
956  if (conn->chan) {
958  }
959 }
960 
961 /** These just pass all the is_bad_for_new_circs manipulation on to
962  * channel_t */
963 
964 static unsigned int
966 {
967  tor_assert(or_conn);
968 
969  if (or_conn->chan)
970  return channel_is_bad_for_new_circs(TLS_CHAN_TO_BASE(or_conn->chan));
971  else return 0;
972 }
973 
974 static void
975 connection_or_mark_bad_for_new_circs(or_connection_t *or_conn)
976 {
977  tor_assert(or_conn);
978 
979  if (or_conn->chan)
980  channel_mark_bad_for_new_circs(TLS_CHAN_TO_BASE(or_conn->chan));
981 }
982 
983 /** How old do we let a connection to an OR get before deciding it's
984  * too old for new circuits? */
985 #define TIME_BEFORE_OR_CONN_IS_TOO_OLD (60*60*24*7)
986 
987 /** Expire an or_connection if it is too old. Helper for
988  * connection_or_group_set_badness_ and fast path for
989  * channel_rsa_id_group_set_badness.
990  *
991  * Returns 1 if the connection was already expired, else 0.
992  */
993 int
995  or_connection_t *or_conn,
996  int force)
997 {
998  /* XXXX this function should also be about channels? */
999  if (or_conn->base_.marked_for_close ||
1001  return 1;
1002 
1003  if (force ||
1005  < now) {
1006  log_info(LD_OR,
1007  "Marking OR conn to %s:%d as too old for new circuits "
1008  "(fd "TOR_SOCKET_T_FORMAT", %d secs old).",
1009  or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
1010  (int)(now - or_conn->base_.timestamp_created));
1011  connection_or_mark_bad_for_new_circs(or_conn);
1012  }
1013 
1014  return 0;
1015 }
1016 
1017 /** Given a list of all the or_connections with a given
1018  * identity, set elements of that list as is_bad_for_new_circs as
1019  * appropriate. Helper for connection_or_set_bad_connections().
1020  *
1021  * Specifically, we set the is_bad_for_new_circs flag on:
1022  * - all connections if <b>force</b> is true.
1023  * - all connections that are too old.
1024  * - all open non-canonical connections for which a canonical connection
1025  * exists to the same router.
1026  * - all open canonical connections for which a 'better' canonical
1027  * connection exists to the same router.
1028  * - all open non-canonical connections for which a 'better' non-canonical
1029  * connection exists to the same router at the same address.
1030  *
1031  * See channel_is_better() in channel.c for our idea of what makes one OR
1032  * connection better than another.
1033  */
1034 void
1036 {
1037  /* XXXX this function should be entirely about channels, not OR
1038  * XXXX connections. */
1039 
1040  or_connection_t *best = NULL;
1041  int n_old = 0, n_inprogress = 0, n_canonical = 0, n_other = 0;
1042  time_t now = time(NULL);
1043 
1044  /* Pass 1: expire everything that's old, and see what the status of
1045  * everything else is. */
1046  SMARTLIST_FOREACH_BEGIN(group, or_connection_t *, or_conn) {
1047  if (connection_or_single_set_badness_(now, or_conn, force))
1048  continue;
1049 
1050  if (connection_or_is_bad_for_new_circs(or_conn)) {
1051  ++n_old;
1052  } else if (or_conn->base_.state != OR_CONN_STATE_OPEN) {
1053  ++n_inprogress;
1054  } else if (or_conn->is_canonical) {
1055  ++n_canonical;
1056  } else {
1057  ++n_other;
1058  }
1059  } SMARTLIST_FOREACH_END(or_conn);
1060 
1061  /* Pass 2: We know how about how good the best connection is.
1062  * expire everything that's worse, and find the very best if we can. */
1063  SMARTLIST_FOREACH_BEGIN(group, or_connection_t *, or_conn) {
1064  if (or_conn->base_.marked_for_close ||
1066  continue; /* This one doesn't need to be marked bad. */
1067  if (or_conn->base_.state != OR_CONN_STATE_OPEN)
1068  continue; /* Don't mark anything bad until we have seen what happens
1069  * when the connection finishes. */
1070  if (n_canonical && !or_conn->is_canonical) {
1071  /* We have at least one open canonical connection to this router,
1072  * and this one is open but not canonical. Mark it bad. */
1073  log_info(LD_OR,
1074  "Marking OR conn to %s:%d as unsuitable for new circuits: "
1075  "(fd "TOR_SOCKET_T_FORMAT", %d secs old). It is not "
1076  "canonical, and we have another connection to that OR that is.",
1077  or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
1078  (int)(now - or_conn->base_.timestamp_created));
1079  connection_or_mark_bad_for_new_circs(or_conn);
1080  continue;
1081  }
1082 
1083  if (!best ||
1084  channel_is_better(TLS_CHAN_TO_BASE(or_conn->chan),
1085  TLS_CHAN_TO_BASE(best->chan))) {
1086  best = or_conn;
1087  }
1088  } SMARTLIST_FOREACH_END(or_conn);
1089 
1090  if (!best)
1091  return;
1092 
1093  /* Pass 3: One connection to OR is best. If it's canonical, mark as bad
1094  * every other open connection. If it's non-canonical, mark as bad
1095  * every other open connection to the same address.
1096  *
1097  * XXXX This isn't optimal; if we have connections to an OR at multiple
1098  * addresses, we'd like to pick the best _for each address_, and mark as
1099  * bad every open connection that isn't best for its address. But this
1100  * can only occur in cases where the other OR is old (so we have no
1101  * canonical connection to it), or where all the connections to the OR are
1102  * at noncanonical addresses and we have no good direct connection (which
1103  * means we aren't at risk of attaching circuits to it anyway). As
1104  * 0.1.2.x dies out, the first case will go away, and the second one is
1105  * "mostly harmless", so a fix can wait until somebody is bored.
1106  */
1107  SMARTLIST_FOREACH_BEGIN(group, or_connection_t *, or_conn) {
1108  if (or_conn->base_.marked_for_close ||
1110  or_conn->base_.state != OR_CONN_STATE_OPEN)
1111  continue;
1112  if (or_conn != best &&
1113  channel_is_better(TLS_CHAN_TO_BASE(best->chan),
1114  TLS_CHAN_TO_BASE(or_conn->chan))) {
1115  /* This isn't the best conn, _and_ the best conn is better than it */
1116  if (best->is_canonical) {
1117  log_info(LD_OR,
1118  "Marking OR conn to %s:%d as unsuitable for new circuits: "
1119  "(fd "TOR_SOCKET_T_FORMAT", %d secs old). "
1120  "We have a better canonical one "
1121  "(fd "TOR_SOCKET_T_FORMAT"; %d secs old).",
1122  or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
1123  (int)(now - or_conn->base_.timestamp_created),
1124  best->base_.s, (int)(now - best->base_.timestamp_created));
1125  connection_or_mark_bad_for_new_circs(or_conn);
1126  } else if (!tor_addr_compare(&or_conn->real_addr,
1127  &best->real_addr, CMP_EXACT)) {
1128  log_info(LD_OR,
1129  "Marking OR conn to %s:%d as unsuitable for new circuits: "
1130  "(fd "TOR_SOCKET_T_FORMAT", %d secs old). We have a better "
1131  "one with the "
1132  "same address (fd "TOR_SOCKET_T_FORMAT"; %d secs old).",
1133  or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
1134  (int)(now - or_conn->base_.timestamp_created),
1135  best->base_.s, (int)(now - best->base_.timestamp_created));
1136  connection_or_mark_bad_for_new_circs(or_conn);
1137  }
1138  }
1139  } SMARTLIST_FOREACH_END(or_conn);
1140 }
1141 
1142 /* Lifetime of a connection failure. After that, we'll retry. This is in
1143  * seconds. */
1144 #define OR_CONNECT_FAILURE_LIFETIME 60
1145 /* The interval to use with when to clean up the failure cache. */
1146 #define OR_CONNECT_FAILURE_CLEANUP_INTERVAL 60
1147 
1148 /* When is the next time we have to cleanup the failure map. We keep this
1149  * because we clean it opportunistically. */
1150 static time_t or_connect_failure_map_next_cleanup_ts = 0;
1151 
1152 /* OR connection failure entry data structure. It is kept in the connection
1153  * failure map defined below and indexed by OR identity digest, address and
1154  * port.
1155  *
1156  * We need to identify a connection failure with these three values because we
1157  * want to avoid to wrongfully blacklist a relay if someone is trying to
1158  * extend to a known identity digest but with the wrong IP/port. For instance,
1159  * it can happen if a relay changed its port but the client still has an old
1160  * descriptor with the old port. We want to stop connecting to that
1161  * IP/port/identity all together, not only the relay identity. */
1163  HT_ENTRY(or_connect_failure_entry_t) node;
1164  /* Identity digest of the connection where it is connecting to. */
1165  uint8_t identity_digest[DIGEST_LEN];
1166  /* This is the connection address from the base connection_t. After the
1167  * connection is checked for canonicity, the base address should represent
1168  * what we know instead of where we are connecting to. This is what we need
1169  * so we can correlate known relays within the consensus. */
1170  tor_addr_t addr;
1171  uint16_t port;
1172  /* Last time we were unable to connect. */
1173  time_t last_failed_connect_ts;
1175 
1176 /* Map where we keep connection failure entries. They are indexed by addr,
1177  * port and identity digest. */
1178 static HT_HEAD(or_connect_failure_ht, or_connect_failure_entry_t)
1179  or_connect_failures_map = HT_INITIALIZER();
1180 
1181 /* Helper: Hashtable equal function. Return 1 if equal else 0. */
1182 static int
1183 or_connect_failure_ht_eq(const or_connect_failure_entry_t *a,
1184  const or_connect_failure_entry_t *b)
1185 {
1186  return fast_memeq(a->identity_digest, b->identity_digest, DIGEST_LEN) &&
1187  tor_addr_eq(&a->addr, &b->addr) &&
1188  a->port == b->port;
1189 }
1190 
1191 /* Helper: Return the hash for the hashtable of the given entry. For this
1192  * table, it is a combination of address, port and identity digest. */
1193 static unsigned int
1194 or_connect_failure_ht_hash(const or_connect_failure_entry_t *entry)
1195 {
1196  size_t offset = 0, addr_size;
1197  const void *addr_ptr;
1198  /* Largest size is IPv6 and IPv4 is smaller so it is fine. */
1199  uint8_t data[16 + sizeof(uint16_t) + DIGEST_LEN];
1200 
1201  /* Get the right address bytes depending on the family. */
1202  switch (tor_addr_family(&entry->addr)) {
1203  case AF_INET:
1204  addr_size = 4;
1205  addr_ptr = &entry->addr.addr.in_addr.s_addr;
1206  break;
1207  case AF_INET6:
1208  addr_size = 16;
1209  addr_ptr = &entry->addr.addr.in6_addr.s6_addr;
1210  break;
1211  default:
1213  return 0;
1214  }
1215 
1216  memcpy(data, addr_ptr, addr_size);
1217  offset += addr_size;
1218  memcpy(data + offset, entry->identity_digest, DIGEST_LEN);
1219  offset += DIGEST_LEN;
1220  set_uint16(data + offset, entry->port);
1221  offset += sizeof(uint16_t);
1222 
1223  return (unsigned int) siphash24g(data, offset);
1224 }
1225 
1226 HT_PROTOTYPE(or_connect_failure_ht, or_connect_failure_entry_t, node,
1227  or_connect_failure_ht_hash, or_connect_failure_ht_eq);
1228 
1229 HT_GENERATE2(or_connect_failure_ht, or_connect_failure_entry_t, node,
1230  or_connect_failure_ht_hash, or_connect_failure_ht_eq,
1232 
1233 /* Initialize a given connect failure entry with the given identity_digest,
1234  * addr and port. All field are optional except ocf. */
1235 static void
1236 or_connect_failure_init(const char *identity_digest, const tor_addr_t *addr,
1237  uint16_t port, or_connect_failure_entry_t *ocf)
1238 {
1239  tor_assert(ocf);
1240  if (identity_digest) {
1241  memcpy(ocf->identity_digest, identity_digest,
1242  sizeof(ocf->identity_digest));
1243  }
1244  if (addr) {
1245  tor_addr_copy(&ocf->addr, addr);
1246  }
1247  ocf->port = port;
1248 }
1249 
1250 /* Return a newly allocated connection failure entry. It is initialized with
1251  * the given or_conn data. This can't fail. */
1253 or_connect_failure_new(const or_connection_t *or_conn)
1254 {
1255  or_connect_failure_entry_t *ocf = tor_malloc_zero(sizeof(*ocf));
1256  or_connect_failure_init(or_conn->identity_digest, &or_conn->real_addr,
1257  TO_CONN(or_conn)->port, ocf);
1258  return ocf;
1259 }
1260 
1261 /* Return a connection failure entry matching the given or_conn. NULL is
1262  * returned if not found. */
1264 or_connect_failure_find(const or_connection_t *or_conn)
1265 {
1267  tor_assert(or_conn);
1268  or_connect_failure_init(or_conn->identity_digest, &TO_CONN(or_conn)->addr,
1269  TO_CONN(or_conn)->port, &lookup);
1270  return HT_FIND(or_connect_failure_ht, &or_connect_failures_map, &lookup);
1271 }
1272 
1273 /* Note down in the connection failure cache that a failure occurred on the
1274  * given or_conn. */
1275 STATIC void
1276 note_or_connect_failed(const or_connection_t *or_conn)
1277 {
1278  or_connect_failure_entry_t *ocf = NULL;
1279 
1280  tor_assert(or_conn);
1281 
1282  ocf = or_connect_failure_find(or_conn);
1283  if (ocf == NULL) {
1284  ocf = or_connect_failure_new(or_conn);
1285  HT_INSERT(or_connect_failure_ht, &or_connect_failures_map, ocf);
1286  }
1287  ocf->last_failed_connect_ts = approx_time();
1288 }
1289 
1290 /* Cleanup the connection failure cache and remove all entries below the
1291  * given cutoff. */
1292 static void
1293 or_connect_failure_map_cleanup(time_t cutoff)
1294 {
1295  or_connect_failure_entry_t **ptr, **next, *entry;
1296 
1297  for (ptr = HT_START(or_connect_failure_ht, &or_connect_failures_map);
1298  ptr != NULL; ptr = next) {
1299  entry = *ptr;
1300  if (entry->last_failed_connect_ts <= cutoff) {
1301  next = HT_NEXT_RMV(or_connect_failure_ht, &or_connect_failures_map, ptr);
1302  tor_free(entry);
1303  } else {
1304  next = HT_NEXT(or_connect_failure_ht, &or_connect_failures_map, ptr);
1305  }
1306  }
1307 }
1308 
1309 /* Return true iff the given OR connection can connect to its destination that
1310  * is the triplet identity_digest, address and port.
1311  *
1312  * The or_conn MUST have gone through connection_or_check_canonicity() so the
1313  * base address is properly set to what we know or doesn't know. */
1314 STATIC int
1315 should_connect_to_relay(const or_connection_t *or_conn)
1316 {
1317  time_t now, cutoff;
1318  time_t connect_failed_since_ts = 0;
1320 
1321  tor_assert(or_conn);
1322 
1323  now = approx_time();
1324  cutoff = now - OR_CONNECT_FAILURE_LIFETIME;
1325 
1326  /* Opportunistically try to cleanup the failure cache. We do that at regular
1327  * interval so it doesn't grow too big. */
1328  if (or_connect_failure_map_next_cleanup_ts <= now) {
1329  or_connect_failure_map_cleanup(cutoff);
1330  or_connect_failure_map_next_cleanup_ts =
1331  now + OR_CONNECT_FAILURE_CLEANUP_INTERVAL;
1332  }
1333 
1334  /* Look if we have failed previously to the same destination as this
1335  * OR connection. */
1336  ocf = or_connect_failure_find(or_conn);
1337  if (ocf) {
1338  connect_failed_since_ts = ocf->last_failed_connect_ts;
1339  }
1340  /* If we do have an unable to connect timestamp and it is below cutoff, we
1341  * can connect. Or we have never failed before so let it connect. */
1342  if (connect_failed_since_ts > cutoff) {
1343  goto no_connect;
1344  }
1345 
1346  /* Ok we can connect! */
1347  return 1;
1348  no_connect:
1349  return 0;
1350 }
1351 
1352 /** <b>conn</b> is in the 'connecting' state, and it failed to complete
1353  * a TCP connection. Send notifications appropriately.
1354  *
1355  * <b>reason</b> specifies the or_conn_end_reason for the failure;
1356  * <b>msg</b> specifies the strerror-style error message.
1357  */
1358 void
1360  int reason, const char *msg)
1361 {
1362  connection_or_event_status(conn, OR_CONN_EVENT_FAILED, reason);
1364  control_event_bootstrap_prob_or(msg, reason, conn);
1365  note_or_connect_failed(conn);
1366 }
1367 
1368 /** <b>conn</b> got an error in connection_handle_read_impl() or
1369  * connection_handle_write_impl() and is going to die soon.
1370  *
1371  * <b>reason</b> specifies the or_conn_end_reason for the failure;
1372  * <b>msg</b> specifies the strerror-style error message.
1373  */
1374 void
1376  int reason, const char *msg)
1377 {
1378  channel_t *chan;
1379 
1380  tor_assert(conn);
1381 
1382  /* If we're connecting, call connect_failed() too */
1383  if (TO_CONN(conn)->state == OR_CONN_STATE_CONNECTING)
1384  connection_or_connect_failed(conn, reason, msg);
1385 
1386  /* Tell the controlling channel if we have one */
1387  if (conn->chan) {
1388  chan = TLS_CHAN_TO_BASE(conn->chan);
1389  /* Don't transition if we're already in closing, closed or error */
1390  if (!CHANNEL_CONDEMNED(chan)) {
1392  }
1393  }
1394 
1395  /* No need to mark for error because connection.c is about to do that */
1396 }
1397 
1398 /** Launch a new OR connection to <b>addr</b>:<b>port</b> and expect to
1399  * handshake with an OR with identity digest <b>id_digest</b>. Optionally,
1400  * pass in a pointer to a channel using this connection.
1401  *
1402  * If <b>id_digest</b> is me, do nothing. If we're already connected to it,
1403  * return that connection. If the connect() is in progress, set the
1404  * new conn's state to 'connecting' and return it. If connect() succeeds,
1405  * call connection_tls_start_handshake() on it.
1406  *
1407  * This function is called from router_retry_connections(), for
1408  * ORs connecting to ORs, and circuit_establish_circuit(), for
1409  * OPs connecting to ORs.
1410  *
1411  * Return the launched conn, or NULL if it failed.
1412  */
1413 
1415 connection_or_connect, (const tor_addr_t *_addr, uint16_t port,
1416  const char *id_digest,
1417  const ed25519_public_key_t *ed_id,
1418  channel_tls_t *chan))
1419 {
1420  or_connection_t *conn;
1421  const or_options_t *options = get_options();
1422  int socket_error = 0;
1423  tor_addr_t addr;
1424 
1425  int r;
1426  tor_addr_t proxy_addr;
1427  uint16_t proxy_port;
1428  int proxy_type, is_pt = 0;
1429 
1430  tor_assert(_addr);
1431  tor_assert(id_digest);
1432  tor_addr_copy(&addr, _addr);
1433 
1434  if (server_mode(options) && router_digest_is_me(id_digest)) {
1435  log_info(LD_PROTOCOL,"Client asked me to connect to myself. Refusing.");
1436  return NULL;
1437  }
1438  if (server_mode(options) && router_ed25519_id_is_me(ed_id)) {
1439  log_info(LD_PROTOCOL,"Client asked me to connect to myself by Ed25519 "
1440  "identity. Refusing.");
1441  return NULL;
1442  }
1443 
1445 
1446  /*
1447  * Set up conn so it's got all the data we need to remember for channels
1448  *
1449  * This stuff needs to happen before connection_or_init_conn_from_address()
1450  * so connection_or_set_identity_digest() and such know where to look to
1451  * keep the channel up to date.
1452  */
1453  conn->chan = chan;
1454  chan->conn = conn;
1455  connection_or_init_conn_from_address(conn, &addr, port, id_digest, ed_id, 1);
1456 
1457  /* We have a proper OR connection setup, now check if we can connect to it
1458  * that is we haven't had a failure earlier. This is to avoid to try to
1459  * constantly connect to relays that we think are not reachable. */
1460  if (!should_connect_to_relay(conn)) {
1461  log_info(LD_GENERAL, "Can't connect to identity %s at %s:%u because we "
1462  "failed earlier. Refusing.",
1463  hex_str(id_digest, DIGEST_LEN), fmt_addr(&TO_CONN(conn)->addr),
1464  TO_CONN(conn)->port);
1465  connection_free_(TO_CONN(conn));
1466  return NULL;
1467  }
1468 
1469  conn->is_outgoing = 1;
1470 
1471  /* If we are using a proxy server, find it and use it. */
1472  r = get_proxy_addrport(&proxy_addr, &proxy_port, &proxy_type, &is_pt,
1473  TO_CONN(conn));
1474  if (r == 0) {
1475  conn->proxy_type = proxy_type;
1476  if (proxy_type != PROXY_NONE) {
1477  tor_addr_copy(&addr, &proxy_addr);
1478  port = proxy_port;
1479  conn->base_.proxy_state = PROXY_INFANT;
1480  conn->is_pt = is_pt;
1481  }
1483  connection_or_event_status(conn, OR_CONN_EVENT_LAUNCHED, 0);
1484  } else {
1485  /* This duplication of state change calls is necessary in case we
1486  * run into an error condition below */
1488  connection_or_event_status(conn, OR_CONN_EVENT_LAUNCHED, 0);
1489 
1490  /* get_proxy_addrport() might fail if we have a Bridge line that
1491  references a transport, but no ClientTransportPlugin lines
1492  defining its transport proxy. If this is the case, let's try to
1493  output a useful log message to the user. */
1494  const char *transport_name =
1496  TO_CONN(conn)->port);
1497 
1498  if (transport_name) {
1499  log_warn(LD_GENERAL, "We were supposed to connect to bridge '%s' "
1500  "using pluggable transport '%s', but we can't find a pluggable "
1501  "transport proxy supporting '%s'. This can happen if you "
1502  "haven't provided a ClientTransportPlugin line, or if "
1503  "your pluggable transport proxy stopped running.",
1504  fmt_addrport(&TO_CONN(conn)->addr, TO_CONN(conn)->port),
1505  transport_name, transport_name);
1506 
1508  "Can't connect to bridge",
1509  END_OR_CONN_REASON_PT_MISSING,
1510  conn);
1511 
1512  } else {
1513  log_warn(LD_GENERAL, "Tried to connect to '%s' through a proxy, but "
1514  "the proxy address could not be found.",
1515  fmt_addrport(&TO_CONN(conn)->addr, TO_CONN(conn)->port));
1516  }
1517 
1518  connection_free_(TO_CONN(conn));
1519  return NULL;
1520  }
1521 
1522  switch (connection_connect(TO_CONN(conn), conn->base_.address,
1523  &addr, port, &socket_error)) {
1524  case -1:
1525  /* We failed to establish a connection probably because of a local
1526  * error. No need to blame the guard in this case. Notify the networking
1527  * system of this failure. */
1529  errno_to_orconn_end_reason(socket_error),
1530  tor_socket_strerror(socket_error));
1531  connection_free_(TO_CONN(conn));
1532  return NULL;
1533  case 0:
1535  /* writable indicates finish, readable indicates broken link,
1536  error indicates broken link on windows */
1537  return conn;
1538  /* case 1: fall through */
1539  }
1540 
1541  if (connection_or_finished_connecting(conn) < 0) {
1542  /* already marked for close */
1543  return NULL;
1544  }
1545  return conn;
1546 }
1547 
1548 /** Mark orconn for close and transition the associated channel, if any, to
1549  * the closing state.
1550  *
1551  * It's safe to call this and connection_or_close_for_error() any time, and
1552  * channel layer will treat it as a connection closing for reasons outside
1553  * its control, like the remote end closing it. It can also be a local
1554  * reason that's specific to connection_t/or_connection_t rather than
1555  * the channel mechanism, such as expiration of old connections in
1556  * run_connection_housekeeping(). If you want to close a channel_t
1557  * from somewhere that logically works in terms of generic channels
1558  * rather than connections, use channel_mark_for_close(); see also
1559  * the comment on that function in channel.c.
1560  */
1561 
1562 void
1564 {
1565  channel_t *chan = NULL;
1566 
1567  tor_assert(orconn);
1568  if (flush) connection_mark_and_flush_internal(TO_CONN(orconn));
1569  else connection_mark_for_close_internal(TO_CONN(orconn));
1570  if (orconn->chan) {
1571  chan = TLS_CHAN_TO_BASE(orconn->chan);
1572  /* Don't transition if we're already in closing, closed or error */
1573  if (!CHANNEL_CONDEMNED(chan)) {
1575  }
1576  }
1577 }
1578 
1579 /** Mark orconn for close and transition the associated channel, if any, to
1580  * the error state.
1581  */
1582 
1583 MOCK_IMPL(void,
1585 {
1586  channel_t *chan = NULL;
1587 
1588  tor_assert(orconn);
1589  if (flush) connection_mark_and_flush_internal(TO_CONN(orconn));
1590  else connection_mark_for_close_internal(TO_CONN(orconn));
1591  if (orconn->chan) {
1592  chan = TLS_CHAN_TO_BASE(orconn->chan);
1593  /* Don't transition if we're already in closing, closed or error */
1594  if (!CHANNEL_CONDEMNED(chan)) {
1596  }
1597  }
1598 }
1599 
1600 /** Begin the tls handshake with <b>conn</b>. <b>receiving</b> is 0 if
1601  * we initiated the connection, else it's 1.
1602  *
1603  * Assign a new tls object to conn->tls, begin reading on <b>conn</b>, and
1604  * pass <b>conn</b> to connection_tls_continue_handshake().
1605  *
1606  * Return -1 if <b>conn</b> is broken, else return 0.
1607  */
1608 MOCK_IMPL(int,
1610 {
1611  channel_listener_t *chan_listener;
1612  channel_t *chan;
1613 
1614  /* Incoming connections will need a new channel passed to the
1615  * channel_tls_listener */
1616  if (receiving) {
1617  /* It shouldn't already be set */
1618  tor_assert(!(conn->chan));
1619  chan_listener = channel_tls_get_listener();
1620  if (!chan_listener) {
1621  chan_listener = channel_tls_start_listener();
1622  command_setup_listener(chan_listener);
1623  }
1624  chan = channel_tls_handle_incoming(conn);
1625  channel_listener_queue_incoming(chan_listener, chan);
1626  }
1627 
1629  tor_assert(!conn->tls);
1630  conn->tls = tor_tls_new(conn->base_.s, receiving);
1631  if (!conn->tls) {
1632  log_warn(LD_BUG,"tor_tls_new failed. Closing.");
1633  return -1;
1634  }
1635  tor_tls_set_logged_address(conn->tls, // XXX client and relay?
1636  escaped_safe_str(conn->base_.address));
1637 
1639  log_debug(LD_HANDSHAKE,"starting TLS handshake on fd "TOR_SOCKET_T_FORMAT,
1640  conn->base_.s);
1641 
1642  if (connection_tls_continue_handshake(conn) < 0)
1643  return -1;
1644 
1645  return 0;
1646 }
1647 
1648 /** Block all future attempts to renegotiate on 'conn' */
1649 void
1651 {
1652  tor_tls_t *tls = conn->tls;
1653  if (!tls)
1654  return;
1655  tor_tls_set_renegotiate_callback(tls, NULL, NULL);
1657 }
1658 
1659 /** Invoked on the server side from inside tor_tls_read() when the server
1660  * gets a successful TLS renegotiation from the client. */
1661 static void
1663 {
1664  or_connection_t *conn = _conn;
1665  (void)tls;
1666 
1667  /* Don't invoke this again. */
1669 
1670  if (connection_tls_finish_handshake(conn) < 0) {
1671  /* XXXX_TLS double-check that it's ok to do this from inside read. */
1672  /* XXXX_TLS double-check that this verifies certificates. */
1674  }
1675 }
1676 
1677 /** Move forward with the tls handshake. If it finishes, hand
1678  * <b>conn</b> to connection_tls_finish_handshake().
1679  *
1680  * Return -1 if <b>conn</b> is broken, else return 0.
1681  */
1682 int
1684 {
1685  int result;
1686  check_no_tls_errors();
1687 
1689  // log_notice(LD_OR, "Continue handshake with %p", conn->tls);
1690  result = tor_tls_handshake(conn->tls);
1691  // log_notice(LD_OR, "Result: %d", result);
1692 
1693  switch (result) {
1695  log_info(LD_OR,"tls error [%s]. breaking connection.",
1696  tor_tls_err_to_string(result));
1697  return -1;
1698  case TOR_TLS_DONE:
1699  if (! tor_tls_used_v1_handshake(conn->tls)) {
1700  if (!tor_tls_is_server(conn->tls)) {
1703  } else {
1704  /* v2/v3 handshake, but we are not a client. */
1705  log_debug(LD_OR, "Done with initial SSL handshake (server-side). "
1706  "Expecting renegotiation or VERSIONS cell");
1709  conn);
1714  return 0;
1715  }
1716  }
1718  return connection_tls_finish_handshake(conn);
1719  case TOR_TLS_WANTWRITE:
1721  log_debug(LD_OR,"wanted write");
1722  return 0;
1723  case TOR_TLS_WANTREAD: /* handshaking conns are *always* reading */
1724  log_debug(LD_OR,"wanted read");
1725  return 0;
1726  case TOR_TLS_CLOSE:
1727  log_info(LD_OR,"tls closed. breaking connection.");
1728  return -1;
1729  }
1730  return 0;
1731 }
1732 
1733 /** Return 1 if we initiated this connection, or 0 if it started
1734  * out as an incoming connection.
1735  */
1736 int
1738 {
1739  tor_assert(conn->base_.type == CONN_TYPE_OR ||
1740  conn->base_.type == CONN_TYPE_EXT_OR);
1741  if (!conn->tls)
1742  return 1; /* it's still in proxy states or something */
1743  if (conn->handshake_state)
1744  return conn->handshake_state->started_here;
1745  return !tor_tls_is_server(conn->tls);
1746 }
1747 
1748 /** <b>Conn</b> just completed its handshake. Return 0 if all is well, and
1749  * return -1 if they are lying, broken, or otherwise something is wrong.
1750  *
1751  * If we initiated this connection (<b>started_here</b> is true), make sure
1752  * the other side sent a correctly formed certificate. If I initiated the
1753  * connection, make sure it's the right relay by checking the certificate.
1754  *
1755  * Otherwise (if we _didn't_ initiate this connection), it's okay for
1756  * the certificate to be weird or absent.
1757  *
1758  * If we return 0, and the certificate is as expected, write a hash of the
1759  * identity key into <b>digest_rcvd_out</b>, which must have DIGEST_LEN
1760  * space in it.
1761  * If the certificate is invalid or missing on an incoming connection,
1762  * we return 0 and set <b>digest_rcvd_out</b> to DIGEST_LEN NUL bytes.
1763  * (If we return -1, the contents of this buffer are undefined.)
1764  *
1765  * As side effects,
1766  * 1) Set conn->circ_id_type according to tor-spec.txt.
1767  * 2) If we're an authdirserver and we initiated the connection: drop all
1768  * descriptors that claim to be on that IP/port but that aren't
1769  * this relay; and note that this relay is reachable.
1770  * 3) If this is a bridge and we didn't configure its identity
1771  * fingerprint, remember the keyid we just learned.
1772  */
1773 static int
1775  int started_here,
1776  char *digest_rcvd_out)
1777 {
1778  crypto_pk_t *identity_rcvd=NULL;
1779  const or_options_t *options = get_options();
1780  int severity = server_mode(options) ? LOG_PROTOCOL_WARN : LOG_WARN;
1781  const char *safe_address =
1782  started_here ? conn->base_.address :
1783  safe_str_client(conn->base_.address);
1784  const char *conn_type = started_here ? "outgoing" : "incoming";
1785  int has_cert = 0;
1786 
1787  check_no_tls_errors();
1788  has_cert = tor_tls_peer_has_cert(conn->tls);
1789  if (started_here && !has_cert) {
1790  log_info(LD_HANDSHAKE,"Tried connecting to router at %s:%d, but it didn't "
1791  "send a cert! Closing.",
1792  safe_address, conn->base_.port);
1793  return -1;
1794  } else if (!has_cert) {
1795  log_debug(LD_HANDSHAKE,"Got incoming connection with no certificate. "
1796  "That's ok.");
1797  }
1798  check_no_tls_errors();
1799 
1800  if (has_cert) {
1801  int v = tor_tls_verify(started_here?severity:LOG_INFO,
1802  conn->tls, &identity_rcvd);
1803  if (started_here && v<0) {
1804  log_fn(severity,LD_HANDSHAKE,"Tried connecting to router at %s:%d: It"
1805  " has a cert but it's invalid. Closing.",
1806  safe_address, conn->base_.port);
1807  return -1;
1808  } else if (v<0) {
1809  log_info(LD_HANDSHAKE,"Incoming connection gave us an invalid cert "
1810  "chain; ignoring.");
1811  } else {
1812  log_debug(LD_HANDSHAKE,
1813  "The certificate seems to be valid on %s connection "
1814  "with %s:%d", conn_type, safe_address, conn->base_.port);
1815  }
1816  check_no_tls_errors();
1817  }
1818 
1819  if (identity_rcvd) {
1820  if (crypto_pk_get_digest(identity_rcvd, digest_rcvd_out) < 0) {
1821  crypto_pk_free(identity_rcvd);
1822  return -1;
1823  }
1824  } else {
1825  memset(digest_rcvd_out, 0, DIGEST_LEN);
1826  }
1827 
1828  tor_assert(conn->chan);
1829  channel_set_circid_type(TLS_CHAN_TO_BASE(conn->chan), identity_rcvd, 1);
1830 
1831  crypto_pk_free(identity_rcvd);
1832 
1833  if (started_here) {
1834  /* A TLS handshake can't teach us an Ed25519 ID, so we set it to NULL
1835  * here. */
1836  log_debug(LD_HANDSHAKE, "Calling client_learned_peer_id from "
1837  "check_valid_tls_handshake");
1839  (const uint8_t*)digest_rcvd_out,
1840  NULL);
1841  }
1842 
1843  return 0;
1844 }
1845 
1846 /** Called when we (as a connection initiator) have definitively,
1847  * authenticatedly, learned that ID of the Tor instance on the other
1848  * side of <b>conn</b> is <b>rsa_peer_id</b> and optionally <b>ed_peer_id</b>.
1849  * For v1 and v2 handshakes,
1850  * this is right after we get a certificate chain in a TLS handshake
1851  * or renegotiation. For v3+ handshakes, this is right after we get a
1852  * certificate chain in a CERTS cell.
1853  *
1854  * If we did not know the ID before, record the one we got.
1855  *
1856  * If we wanted an ID, but we didn't get the one we expected, log a message
1857  * and return -1.
1858  * On relays:
1859  * - log a protocol warning whenever the fingerprints don't match;
1860  * On clients:
1861  * - if a relay's fingerprint doesn't match, log a warning;
1862  * - if we don't have updated relay fingerprints from a recent consensus, and
1863  * a fallback directory mirror's hard-coded fingerprint has changed, log an
1864  * info explaining that we will try another fallback.
1865  *
1866  * If we're testing reachability, remember what we learned.
1867  *
1868  * Return 0 on success, -1 on failure.
1869  */
1870 int
1872  const uint8_t *rsa_peer_id,
1873  const ed25519_public_key_t *ed_peer_id)
1874 {
1875  const or_options_t *options = get_options();
1876  channel_tls_t *chan_tls = conn->chan;
1877  channel_t *chan = channel_tls_to_base(chan_tls);
1878  int changed_identity = 0;
1879  tor_assert(chan);
1880 
1881  const int expected_rsa_key =
1883  const int expected_ed_key =
1885 
1886  log_info(LD_HANDSHAKE, "learned peer id for %p (%s): %s, %s",
1887  conn,
1888  safe_str_client(conn->base_.address),
1889  hex_str((const char*)rsa_peer_id, DIGEST_LEN),
1890  ed25519_fmt(ed_peer_id));
1891 
1892  if (! expected_rsa_key && ! expected_ed_key) {
1893  log_info(LD_HANDSHAKE, "(we had no ID in mind when we made this "
1894  "connection.");
1896  (const char*)rsa_peer_id, ed_peer_id);
1897  tor_free(conn->nickname);
1898  conn->nickname = tor_malloc(HEX_DIGEST_LEN+2);
1899  conn->nickname[0] = '$';
1901  conn->identity_digest, DIGEST_LEN);
1902  log_info(LD_HANDSHAKE, "Connected to router %s at %s:%d without knowing "
1903  "its key. Hoping for the best.",
1904  conn->nickname, conn->base_.address, conn->base_.port);
1905  /* if it's a bridge and we didn't know its identity fingerprint, now
1906  * we do -- remember it for future attempts. */
1907  learned_router_identity(&conn->base_.addr, conn->base_.port,
1908  (const char*)rsa_peer_id, ed_peer_id);
1909  changed_identity = 1;
1910  }
1911 
1912  const int rsa_mismatch = expected_rsa_key &&
1913  tor_memneq(rsa_peer_id, conn->identity_digest, DIGEST_LEN);
1914  /* It only counts as an ed25519 mismatch if we wanted an ed25519 identity
1915  * and didn't get it. It's okay if we get one that we didn't ask for. */
1916  const int ed25519_mismatch =
1917  expected_ed_key &&
1918  (ed_peer_id == NULL ||
1919  ! ed25519_pubkey_eq(&chan->ed25519_identity, ed_peer_id));
1920 
1921  if (rsa_mismatch || ed25519_mismatch) {
1922  /* I was aiming for a particular digest. I didn't get it! */
1923  char seen_rsa[HEX_DIGEST_LEN+1];
1924  char expected_rsa[HEX_DIGEST_LEN+1];
1925  char seen_ed[ED25519_BASE64_LEN+1];
1926  char expected_ed[ED25519_BASE64_LEN+1];
1927  base16_encode(seen_rsa, sizeof(seen_rsa),
1928  (const char*)rsa_peer_id, DIGEST_LEN);
1929  base16_encode(expected_rsa, sizeof(expected_rsa), conn->identity_digest,
1930  DIGEST_LEN);
1931  if (ed_peer_id) {
1932  ed25519_public_to_base64(seen_ed, ed_peer_id);
1933  } else {
1934  strlcpy(seen_ed, "no ed25519 key", sizeof(seen_ed));
1935  }
1937  ed25519_public_to_base64(expected_ed, &chan->ed25519_identity);
1938  } else {
1939  strlcpy(expected_ed, "no ed25519 key", sizeof(expected_ed));
1940  }
1941  const int using_hardcoded_fingerprints =
1944  const int is_fallback_fingerprint = router_digest_is_fallback_dir(
1945  conn->identity_digest);
1946  const int is_authority_fingerprint = router_digest_is_trusted_dir(
1947  conn->identity_digest);
1948  const int non_anonymous_mode = rend_non_anonymous_mode_enabled(options);
1949  int severity;
1950  const char *extra_log = "";
1951 
1952  /* Relays and Single Onion Services make direct connections using
1953  * untrusted authentication keys. */
1954  if (server_mode(options) || non_anonymous_mode) {
1955  severity = LOG_PROTOCOL_WARN;
1956  } else {
1957  if (using_hardcoded_fingerprints) {
1958  /* We need to do the checks in this order, because the list of
1959  * fallbacks includes the list of authorities */
1960  if (is_authority_fingerprint) {
1961  severity = LOG_WARN;
1962  } else if (is_fallback_fingerprint) {
1963  /* we expect a small number of fallbacks to change from their
1964  * hard-coded fingerprints over the life of a release */
1965  severity = LOG_INFO;
1966  extra_log = " Tor will try a different fallback.";
1967  } else {
1968  /* it's a bridge, it's either a misconfiguration, or unexpected */
1969  severity = LOG_WARN;
1970  }
1971  } else {
1972  /* a relay has changed its fingerprint from the one in the consensus */
1973  severity = LOG_WARN;
1974  }
1975  }
1976 
1977  log_fn(severity, LD_HANDSHAKE,
1978  "Tried connecting to router at %s:%d, but RSA + ed25519 identity "
1979  "keys were not as expected: wanted %s + %s but got %s + %s.%s",
1980  conn->base_.address, conn->base_.port,
1981  expected_rsa, expected_ed, seen_rsa, seen_ed, extra_log);
1982 
1983  /* Tell the new guard API about the channel failure */
1984  entry_guard_chan_failed(TLS_CHAN_TO_BASE(conn->chan));
1985  connection_or_event_status(conn, OR_CONN_EVENT_FAILED,
1986  END_OR_CONN_REASON_OR_IDENTITY);
1987  if (!authdir_mode_tests_reachability(options))
1989  "Unexpected identity in router certificate",
1990  END_OR_CONN_REASON_OR_IDENTITY,
1991  conn);
1992  return -1;
1993  }
1994 
1995  if (!expected_ed_key && ed_peer_id) {
1996  log_info(LD_HANDSHAKE, "(We had no Ed25519 ID in mind when we made this "
1997  "connection.)");
1999  (const char*)rsa_peer_id, ed_peer_id);
2000  changed_identity = 1;
2001  }
2002 
2003  if (changed_identity) {
2004  /* If we learned an identity for this connection, then we might have
2005  * just discovered it to be canonical. */
2007  }
2008 
2009  if (authdir_mode_tests_reachability(options)) {
2010  dirserv_orconn_tls_done(&conn->base_.addr, conn->base_.port,
2011  (const char*)rsa_peer_id, ed_peer_id);
2012  }
2013 
2014  return 0;
2015 }
2016 
2017 /** Return when we last used this channel for client activity (origin
2018  * circuits). This is called from connection.c, since client_used is now one
2019  * of the timestamps in channel_t */
2020 
2021 time_t
2023 {
2024  tor_assert(conn);
2025 
2026  if (conn->chan) {
2027  return channel_when_last_client(TLS_CHAN_TO_BASE(conn->chan));
2028  } else return 0;
2029 }
2030 
2031 /** The v1/v2 TLS handshake is finished.
2032  *
2033  * Make sure we are happy with the peer we just handshaked with.
2034  *
2035  * If they initiated the connection, make sure they're not already connected,
2036  * then initialize conn from the information in router.
2037  *
2038  * If all is successful, call circuit_n_conn_done() to handle events
2039  * that have been pending on the <tls handshake completion. Also set the
2040  * directory to be dirty (only matters if I'm an authdirserver).
2041  *
2042  * If this is a v2 TLS handshake, send a versions cell.
2043  */
2044 static int
2046 {
2047  char digest_rcvd[DIGEST_LEN];
2048  int started_here = connection_or_nonopen_was_started_here(conn);
2049 
2050  tor_assert(!started_here);
2051 
2052  log_debug(LD_HANDSHAKE,"%s tls handshake on %p with %s done, using "
2053  "ciphersuite %s. verifying.",
2054  started_here?"outgoing":"incoming",
2055  conn,
2056  safe_str_client(conn->base_.address),
2057  tor_tls_get_ciphersuite_name(conn->tls));
2058 
2059  if (connection_or_check_valid_tls_handshake(conn, started_here,
2060  digest_rcvd) < 0)
2061  return -1;
2062 
2064 
2065  if (tor_tls_used_v1_handshake(conn->tls)) {
2066  conn->link_proto = 1;
2067  connection_or_init_conn_from_address(conn, &conn->base_.addr,
2068  conn->base_.port, digest_rcvd,
2069  NULL, 0);
2071  rep_hist_note_negotiated_link_proto(1, started_here);
2072  return connection_or_set_state_open(conn);
2073  } else {
2075  if (connection_init_or_handshake_state(conn, started_here) < 0)
2076  return -1;
2077  connection_or_init_conn_from_address(conn, &conn->base_.addr,
2078  conn->base_.port, digest_rcvd,
2079  NULL, 0);
2080  return connection_or_send_versions(conn, 0);
2081  }
2082 }
2083 
2084 /**
2085  * Called as client when initial TLS handshake is done, and we notice
2086  * that we got a v3-handshake signalling certificate from the server.
2087  * Set up structures, do bookkeeping, and send the versions cell.
2088  * Return 0 on success and -1 on failure.
2089  */
2090 static int
2092 {
2094 
2096 
2098  if (connection_init_or_handshake_state(conn, 1) < 0)
2099  return -1;
2100 
2101  return connection_or_send_versions(conn, 1);
2102 }
2103 
2104 /** Allocate a new connection handshake state for the connection
2105  * <b>conn</b>. Return 0 on success, -1 on failure. */
2106 int
2108 {
2110  if (conn->handshake_state) {
2111  log_warn(LD_BUG, "Duplicate call to connection_init_or_handshake_state!");
2112  return 0;
2113  }
2114  s = conn->handshake_state = tor_malloc_zero(sizeof(or_handshake_state_t));
2115  s->started_here = started_here ? 1 : 0;
2116  s->digest_sent_data = 1;
2117  s->digest_received_data = 1;
2118  if (! started_here && get_current_link_cert_cert()) {
2119  s->own_link_cert = tor_cert_dup(get_current_link_cert_cert());
2120  }
2122  s->certs->started_here = s->started_here;
2123  return 0;
2124 }
2125 
2126 /** Free all storage held by <b>state</b>. */
2127 void
2129 {
2130  if (!state)
2131  return;
2133  crypto_digest_free(state->digest_received);
2134  or_handshake_certs_free(state->certs);
2135  tor_cert_free(state->own_link_cert);
2136  memwipe(state, 0xBE, sizeof(or_handshake_state_t));
2137  tor_free(state);
2138 }
2139 
2140 /**
2141  * Remember that <b>cell</b> has been transmitted (if <b>incoming</b> is
2142  * false) or received (if <b>incoming</b> is true) during a V3 handshake using
2143  * <b>state</b>.
2144  *
2145  * (We don't record the cell, but we keep a digest of everything sent or
2146  * received during the v3 handshake, and the client signs it in an
2147  * authenticate cell.)
2148  */
2149 void
2151  or_handshake_state_t *state,
2152  const cell_t *cell,
2153  int incoming)
2154 {
2155  size_t cell_network_size = get_cell_network_size(conn->wide_circ_ids);
2156  crypto_digest_t *d, **dptr;
2157  packed_cell_t packed;
2158  if (incoming) {
2159  if (!state->digest_received_data)
2160  return;
2161  } else {
2162  if (!state->digest_sent_data)
2163  return;
2164  }
2165  if (!incoming) {
2166  log_warn(LD_BUG, "We shouldn't be sending any non-variable-length cells "
2167  "while making a handshake digest. But we think we are sending "
2168  "one with type %d.", (int)cell->command);
2169  }
2170  dptr = incoming ? &state->digest_received : &state->digest_sent;
2171  if (! *dptr)
2172  *dptr = crypto_digest256_new(DIGEST_SHA256);
2173 
2174  d = *dptr;
2175  /* Re-packing like this is a little inefficient, but we don't have to do
2176  this very often at all. */
2177  cell_pack(&packed, cell, conn->wide_circ_ids);
2178  crypto_digest_add_bytes(d, packed.body, cell_network_size);
2179  memwipe(&packed, 0, sizeof(packed));
2180 }
2181 
2182 /** Remember that a variable-length <b>cell</b> has been transmitted (if
2183  * <b>incoming</b> is false) or received (if <b>incoming</b> is true) during a
2184  * V3 handshake using <b>state</b>.
2185  *
2186  * (We don't record the cell, but we keep a digest of everything sent or
2187  * received during the v3 handshake, and the client signs it in an
2188  * authenticate cell.)
2189  */
2190 void
2192  or_handshake_state_t *state,
2193  const var_cell_t *cell,
2194  int incoming)
2195 {
2196  crypto_digest_t *d, **dptr;
2197  int n;
2198  char buf[VAR_CELL_MAX_HEADER_SIZE];
2199  if (incoming) {
2200  if (!state->digest_received_data)
2201  return;
2202  } else {
2203  if (!state->digest_sent_data)
2204  return;
2205  }
2206  dptr = incoming ? &state->digest_received : &state->digest_sent;
2207  if (! *dptr)
2208  *dptr = crypto_digest256_new(DIGEST_SHA256);
2209 
2210  d = *dptr;
2211 
2212  n = var_cell_pack_header(cell, buf, conn->wide_circ_ids);
2213  crypto_digest_add_bytes(d, buf, n);
2214  crypto_digest_add_bytes(d, (const char *)cell->payload, cell->payload_len);
2215 
2216  memwipe(buf, 0, sizeof(buf));
2217 }
2218 
2219 /** Set <b>conn</b>'s state to OR_CONN_STATE_OPEN, and tell other subsystems
2220  * as appropriate. Called when we are done with all TLS and OR handshaking.
2221  */
2222 int
2224 {
2226  connection_or_event_status(conn, OR_CONN_EVENT_CONNECTED, 0);
2227 
2228  /* Link protocol 3 appeared in Tor 0.2.3.6-alpha, so any connection
2229  * that uses an earlier link protocol should not be treated as a relay. */
2230  if (conn->link_proto < 3) {
2231  channel_mark_client(TLS_CHAN_TO_BASE(conn->chan));
2232  }
2233 
2234  or_handshake_state_free(conn->handshake_state);
2235  conn->handshake_state = NULL;
2237 
2238  return 0;
2239 }
2240 
2241 /** Pack <b>cell</b> into wire-format, and write it onto <b>conn</b>'s outbuf.
2242  * For cells that use or affect a circuit, this should only be called by
2243  * connection_or_flush_from_first_active_circuit().
2244  */
2245 void
2247 {
2248  packed_cell_t networkcell;
2249  size_t cell_network_size = get_cell_network_size(conn->wide_circ_ids);
2250 
2251  tor_assert(cell);
2252  tor_assert(conn);
2253 
2254  cell_pack(&networkcell, cell, conn->wide_circ_ids);
2255 
2256  /* We need to count padding cells from this non-packed code path
2257  * since they are sent via chan->write_cell() (which is not packed) */
2259  if (cell->command == CELL_PADDING)
2261 
2262  connection_buf_add(networkcell.body, cell_network_size, TO_CONN(conn));
2263 
2264  /* Touch the channel's active timestamp if there is one */
2265  if (conn->chan) {
2266  channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
2267 
2268  if (TLS_CHAN_TO_BASE(conn->chan)->padding_enabled) {
2270  if (cell->command == CELL_PADDING)
2272  }
2273  }
2274 
2275  if (conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3)
2276  or_handshake_state_record_cell(conn, conn->handshake_state, cell, 0);
2277 }
2278 
2279 /** Pack a variable-length <b>cell</b> into wire-format, and write it onto
2280  * <b>conn</b>'s outbuf. Right now, this <em>DOES NOT</em> support cells that
2281  * affect a circuit.
2282  */
2283 MOCK_IMPL(void,
2286 {
2287  int n;
2288  char hdr[VAR_CELL_MAX_HEADER_SIZE];
2289  tor_assert(cell);
2290  tor_assert(conn);
2291  n = var_cell_pack_header(cell, hdr, conn->wide_circ_ids);
2292  connection_buf_add(hdr, n, TO_CONN(conn));
2293  connection_buf_add((char*)cell->payload,
2294  cell->payload_len, TO_CONN(conn));
2295  if (conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3)
2297 
2299  /* Touch the channel's active timestamp if there is one */
2300  if (conn->chan)
2301  channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
2302 }
2303 
2304 /** See whether there's a variable-length cell waiting on <b>or_conn</b>'s
2305  * inbuf. Return values as for fetch_var_cell_from_buf(). */
2306 static int
2308 {
2309  connection_t *conn = TO_CONN(or_conn);
2310  return fetch_var_cell_from_buf(conn->inbuf, out, or_conn->link_proto);
2311 }
2312 
2313 /** Process cells from <b>conn</b>'s inbuf.
2314  *
2315  * Loop: while inbuf contains a cell, pull it off the inbuf, unpack it,
2316  * and hand it to command_process_cell().
2317  *
2318  * Always return 0.
2319  */
2320 static int
2322 {
2323  var_cell_t *var_cell;
2324 
2325  /*
2326  * Note on memory management for incoming cells: below the channel layer,
2327  * we shouldn't need to consider its internal queueing/copying logic. It
2328  * is safe to pass cells to it on the stack or on the heap, but in the
2329  * latter case we must be sure we free them later.
2330  *
2331  * The incoming cell queue code in channel.c will (in the common case)
2332  * decide it can pass them to the upper layer immediately, in which case
2333  * those functions may run directly on the cell pointers we pass here, or
2334  * it may decide to queue them, in which case it will allocate its own
2335  * buffer and copy the cell.
2336  */
2337 
2338  while (1) {
2339  log_debug(LD_OR,
2340  TOR_SOCKET_T_FORMAT": starting, inbuf_datalen %d "
2341  "(%d pending in tls object).",
2342  conn->base_.s,(int)connection_get_inbuf_len(TO_CONN(conn)),
2344  if (connection_fetch_var_cell_from_buf(conn, &var_cell)) {
2345  if (!var_cell)
2346  return 0; /* not yet. */
2347 
2348  /* Touch the channel's active timestamp if there is one */
2349  if (conn->chan)
2350  channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
2351 
2353  channel_tls_handle_var_cell(var_cell, conn);
2354  var_cell_free(var_cell);
2355  } else {
2356  const int wide_circ_ids = conn->wide_circ_ids;
2357  size_t cell_network_size = get_cell_network_size(conn->wide_circ_ids);
2358  char buf[CELL_MAX_NETWORK_SIZE];
2359  cell_t cell;
2360  if (connection_get_inbuf_len(TO_CONN(conn))
2361  < cell_network_size) /* whole response available? */
2362  return 0; /* not yet */
2363 
2364  /* Touch the channel's active timestamp if there is one */
2365  if (conn->chan)
2366  channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
2367 
2369  connection_buf_get_bytes(buf, cell_network_size, TO_CONN(conn));
2370 
2371  /* retrieve cell info from buf (create the host-order struct from the
2372  * network-order string) */
2373  cell_unpack(&cell, buf, wide_circ_ids);
2374 
2375  channel_tls_handle_cell(&cell, conn);
2376  }
2377  }
2378 }
2379 
2380 /** Array of recognized link protocol versions. */
2381 static const uint16_t or_protocol_versions[] = { 1, 2, 3, 4, 5 };
2382 /** Number of versions in <b>or_protocol_versions</b>. */
2383 static const int n_or_protocol_versions =
2384  (int)( sizeof(or_protocol_versions)/sizeof(uint16_t) );
2385 
2386 /** Return true iff <b>v</b> is a link protocol version that this Tor
2387  * implementation believes it can support. */
2388 int
2390 {
2391  int i;
2392  for (i = 0; i < n_or_protocol_versions; ++i) {
2393  if (or_protocol_versions[i] == v)
2394  return 1;
2395  }
2396  return 0;
2397 }
2398 
2399 /** Send a VERSIONS cell on <b>conn</b>, telling the other host about the
2400  * link protocol versions that this Tor can support.
2401  *
2402  * If <b>v3_plus</b>, this is part of a V3 protocol handshake, so only
2403  * allow protocol version v3 or later. If not <b>v3_plus</b>, this is
2404  * not part of a v3 protocol handshake, so don't allow protocol v3 or
2405  * later.
2406  **/
2407 int
2409 {
2410  var_cell_t *cell;
2411  int i;
2412  int n_versions = 0;
2413  const int min_version = v3_plus ? 3 : 0;
2414  const int max_version = v3_plus ? UINT16_MAX : 2;
2415  tor_assert(conn->handshake_state &&
2418  cell->command = CELL_VERSIONS;
2419  for (i = 0; i < n_or_protocol_versions; ++i) {
2420  uint16_t v = or_protocol_versions[i];
2421  if (v < min_version || v > max_version)
2422  continue;
2423  set_uint16(cell->payload+(2*n_versions), htons(v));
2424  ++n_versions;
2425  }
2426  cell->payload_len = n_versions * 2;
2427 
2429  conn->handshake_state->sent_versions_at = time(NULL);
2430 
2431  var_cell_free(cell);
2432  return 0;
2433 }
2434 
2435 static netinfo_addr_t *
2436 netinfo_addr_from_tor_addr(const tor_addr_t *tor_addr)
2437 {
2438  sa_family_t addr_family = tor_addr_family(tor_addr);
2439 
2440  if (BUG(addr_family != AF_INET && addr_family != AF_INET6))
2441  return NULL;
2442 
2443  netinfo_addr_t *netinfo_addr = netinfo_addr_new();
2444 
2445  if (addr_family == AF_INET) {
2446  netinfo_addr_set_addr_type(netinfo_addr, NETINFO_ADDR_TYPE_IPV4);
2447  netinfo_addr_set_len(netinfo_addr, 4);
2448  netinfo_addr_set_addr_ipv4(netinfo_addr, tor_addr_to_ipv4h(tor_addr));
2449  } else if (addr_family == AF_INET6) {
2450  netinfo_addr_set_addr_type(netinfo_addr, NETINFO_ADDR_TYPE_IPV6);
2451  netinfo_addr_set_len(netinfo_addr, 16);
2452  uint8_t *ipv6_buf = netinfo_addr_getarray_addr_ipv6(netinfo_addr);
2453  const uint8_t *in6_addr = tor_addr_to_in6_addr8(tor_addr);
2454  memcpy(ipv6_buf, in6_addr, 16);
2455  }
2456 
2457  return netinfo_addr;
2458 }
2459 
2460 /** Send a NETINFO cell on <b>conn</b>, telling the other server what we know
2461  * about their address, our address, and the current time. */
2462 MOCK_IMPL(int,
2464 {
2465  cell_t cell;
2466  time_t now = time(NULL);
2467  const routerinfo_t *me;
2468  int r = -1;
2469 
2470  tor_assert(conn->handshake_state);
2471 
2472  if (conn->handshake_state->sent_netinfo) {
2473  log_warn(LD_BUG, "Attempted to send an extra netinfo cell on a connection "
2474  "where we already sent one.");
2475  return 0;
2476  }
2477 
2478  memset(&cell, 0, sizeof(cell_t));
2479  cell.command = CELL_NETINFO;
2480 
2481  netinfo_cell_t *netinfo_cell = netinfo_cell_new();
2482 
2483  /* Timestamp, if we're a relay. */
2484  if (public_server_mode(get_options()) || ! conn->is_outgoing)
2485  netinfo_cell_set_timestamp(netinfo_cell, (uint32_t)now);
2486 
2487  /* Their address. */
2488  const tor_addr_t *remote_tor_addr =
2489  !tor_addr_is_null(&conn->real_addr) ? &conn->real_addr : &conn->base_.addr;
2490  /* We use &conn->real_addr below, unless it hasn't yet been set. If it
2491  * hasn't yet been set, we know that base_.addr hasn't been tampered with
2492  * yet either. */
2493  netinfo_addr_t *their_addr = netinfo_addr_from_tor_addr(remote_tor_addr);
2494 
2495  netinfo_cell_set_other_addr(netinfo_cell, their_addr);
2496 
2497  /* My address -- only include it if I'm a public relay, or if I'm a
2498  * bridge and this is an incoming connection. If I'm a bridge and this
2499  * is an outgoing connection, act like a normal client and omit it. */
2500  if ((public_server_mode(get_options()) || !conn->is_outgoing) &&
2501  (me = router_get_my_routerinfo())) {
2502  tor_addr_t my_addr;
2503  tor_addr_from_ipv4h(&my_addr, me->addr);
2504 
2505  uint8_t n_my_addrs = 1 + !tor_addr_is_null(&me->ipv6_addr);
2506  netinfo_cell_set_n_my_addrs(netinfo_cell, n_my_addrs);
2507 
2508  netinfo_cell_add_my_addrs(netinfo_cell,
2509  netinfo_addr_from_tor_addr(&my_addr));
2510 
2511  if (!tor_addr_is_null(&me->ipv6_addr)) {
2512  netinfo_cell_add_my_addrs(netinfo_cell,
2513  netinfo_addr_from_tor_addr(&me->ipv6_addr));
2514  }
2515  }
2516 
2517  const char *errmsg = NULL;
2518  if ((errmsg = netinfo_cell_check(netinfo_cell))) {
2519  log_warn(LD_OR, "Failed to validate NETINFO cell with error: %s",
2520  errmsg);
2521  goto cleanup;
2522  }
2523 
2524  if (netinfo_cell_encode(cell.payload, CELL_PAYLOAD_SIZE,
2525  netinfo_cell) < 0) {
2526  log_warn(LD_OR, "Failed generating NETINFO cell");
2527  goto cleanup;
2528  }
2529 
2530  conn->handshake_state->digest_sent_data = 0;
2531  conn->handshake_state->sent_netinfo = 1;
2532  connection_or_write_cell_to_buf(&cell, conn);
2533 
2534  r = 0;
2535  cleanup:
2536  netinfo_cell_free(netinfo_cell);
2537 
2538  return r;
2539 }
log_fn
#define log_fn(severity, domain, args,...)
Definition: log.h:287
connection_or_client_used
time_t connection_or_client_used(or_connection_t *conn)
Definition: connection_or.c:2022
CELL_MAX_NETWORK_SIZE
#define CELL_MAX_NETWORK_SIZE
Definition: or.h:579
DOWNCAST
#define DOWNCAST(to, ptr)
Definition: or.h:109
or_connection_t::bucket
token_bucket_rw_t bucket
Definition: or_connection_st.h:89
routermode.h
Header file for routermode.c.
tor_addr_compare
int tor_addr_compare(const tor_addr_t *addr1, const tor_addr_t *addr2, tor_addr_comparison_t how)
Definition: address.c:975
tor_free
#define tor_free(p)
Definition: malloc.h:52
get_circuit_build_times_mutable
circuit_build_times_t * get_circuit_build_times_mutable(void)
Definition: circuitstats.c:89
routerinfo_t
Definition: routerinfo_st.h:20
connection_stop_writing
void connection_stop_writing(connection_t *conn)
Definition: mainloop.c:665
connection_or_send_netinfo
int connection_or_send_netinfo(or_connection_t *conn)
Definition: connection_or.c:2463
fetch_var_cell_from_buf
int fetch_var_cell_from_buf(buf_t *buf, var_cell_t **out, int linkproto)
Definition: proto_cell.c:57
channel_tls_handle_state_change_on_orconn
void channel_tls_handle_state_change_on_orconn(channel_tls_t *chan, or_connection_t *conn, uint8_t state)
Definition: channeltls.c:953
orconn_status_msg_t::status
int status
Definition: orconn_event.h:92
tor_free_
void tor_free_(void *mem)
Definition: malloc.c:227
connection_or_finished_connecting
int connection_or_finished_connecting(or_connection_t *or_conn)
Definition: connection_or.c:685
tor_addr_family
static sa_family_t tor_addr_family(const tor_addr_t *a)
Definition: address.h:186
hex_str
const char * hex_str(const char *from, size_t fromlen)
Definition: binascii.c:34
or_handshake_state_t::digest_sent
crypto_digest_t * digest_sent
Definition: or_handshake_state_st.h:72
connection_or_send_versions
int connection_or_send_versions(or_connection_t *conn, int v3_plus)
Definition: connection_or.c:2408
or_options_t::BandwidthRate
uint64_t BandwidthRate
Definition: or_options_st.h:373
OR_CONN_STATE_CONNECTING
#define OR_CONN_STATE_CONNECTING
Definition: orconn_event.h:31
or_handshake_state_free_
void or_handshake_state_free_(or_handshake_state_t *state)
Definition: connection_or.c:2128
or_connection_t::handshake_state
or_handshake_state_t * handshake_state
Definition: or_connection_st.h:84
memwipe
void memwipe(void *mem, uint8_t byte, size_t sz)
Definition: crypto_util.c:55
tor_tls_get_pending_bytes
int tor_tls_get_pending_bytes(tor_tls_t *tls)
Definition: tortls_nss.c:634
OR_CONN_STATE_TLS_SERVER_RENEGOTIATING
#define OR_CONN_STATE_TLS_SERVER_RENEGOTIATING
Definition: orconn_event.h:43
channel_timestamp_active
void channel_timestamp_active(channel_t *chan)
Definition: channel.c:3156
tor_addr_t
Definition: address.h:68
ED25519_BASE64_LEN
#define ED25519_BASE64_LEN
Definition: x25519_sizes.h:40
orconn_state_msg_t::gid
uint64_t gid
Definition: orconn_event.h:76
approx_time
time_t approx_time(void)
Definition: approx_time.c:32
connection_t::address
char * address
Definition: connection_st.h:125
MOCK_IMPL
#define MOCK_IMPL(rv, funcname, arglist)
Definition: testsupport.h:133
connection_or_check_valid_tls_handshake
static int connection_or_check_valid_tls_handshake(or_connection_t *conn, int started_here, char *digest_rcvd_out)
Definition: connection_or.c:1774
var_cell_pack_header
int var_cell_pack_header(const var_cell_t *cell, char *hdr_out, int wide_circ_ids)
Definition: connection_or.c:456
tor_tls_get_state_description
void tor_tls_get_state_description(tor_tls_t *tls, char *buf, size_t sz)
Definition: tortls_nss.c:346
channel_tls_handle_cell
void channel_tls_handle_cell(cell_t *cell, or_connection_t *conn)
Definition: channeltls.c:1056
connection_or_reached_eof
int connection_or_reached_eof(or_connection_t *conn)
Definition: connection_or.c:517
channel_mark_client
void channel_mark_client(channel_t *chan)
Definition: channel.c:2925
tor_assert
#define tor_assert(expr)
Definition: util_bug.h:102
routerkeys.h
Header for routerkeys.c.
microdesc.h
Header file for microdesc.c.
LD_BUG
#define LD_BUG
Definition: log.h:86
ed25519_pubkey_eq
int ed25519_pubkey_eq(const ed25519_public_key_t *key1, const ed25519_public_key_t *key2)
Definition: crypto_ed25519.c:642
router.h
Header file for router.c.
CONN_TYPE_EXT_OR
#define CONN_TYPE_EXT_OR
Definition: connection.h:69
connection_or_tls_renegotiated_cb
static void connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn)
Definition: connection_or.c:1662
command_setup_listener
void command_setup_listener(channel_listener_t *listener)
Definition: command.c:680
connection_or_state_publish
static void connection_or_state_publish(const or_connection_t *conn, uint8_t state)
Definition: connection_or.c:356
router_digest_is_me
int router_digest_is_me(const char *digest)
Definition: router.c:1651
channel.h
Header file for channel.c.
control_event_or_conn_status
int control_event_or_conn_status(or_connection_t *conn, or_conn_status_event_t tp, int reason)
Definition: control_events.c:862
or_handshake_state_t::started_here
unsigned int started_here
Definition: or_handshake_state_st.h:23
LD_GENERAL
#define LD_GENERAL
Definition: log.h:62
clear_broken_connection_map
void clear_broken_connection_map(int stop_recording)
Definition: connection_or.c:229
PADDING_TYPE_ENABLED_CELL
@ PADDING_TYPE_ENABLED_CELL
Definition: rephist.h:121
connection_or_clear_identity
void connection_or_clear_identity(or_connection_t *conn)
Definition: connection_or.c:114
CASE_TOR_TLS_ERROR_ANY
#define CASE_TOR_TLS_ERROR_ANY
Definition: tortls.h:62
base16_encode
void base16_encode(char *dest, size_t destlen, const char *src, size_t srclen)
Definition: binascii.c:478
conn_state_to_string
const char * conn_state_to_string(int type, int state)
Definition: connection.c:278
tor_fragile_assert
#define tor_fragile_assert()
Definition: util_bug.h:259
channel_is_better
int channel_is_better(channel_t *a, channel_t *b)
Definition: channel.c:2317
connection_init_or_handshake_state
int connection_init_or_handshake_state(or_connection_t *conn, int started_here)
Definition: connection_or.c:2107
learned_router_identity
void learned_router_identity(const tor_addr_t *addr, uint16_t port, const char *digest, const ed25519_public_key_t *ed_id)
Definition: bridges.c:397
channel_when_last_client
time_t channel_when_last_client(channel_t *chan)
Definition: channel.c:3276
router_get_my_routerinfo
const routerinfo_t * router_get_my_routerinfo(void)
Definition: router.c:1688
set_uint8
static void set_uint8(void *cp, uint8_t v)
Definition: bytes.h:31
channel_tls_get_listener
channel_listener_t * channel_tls_get_listener(void)
Definition: channeltls.c:254
cell_unpack
static void cell_unpack(cell_t *dest, const char *src, int wide_circ_ids)
Definition: connection_or.c:440
OR_CONN_STATE_TLS_HANDSHAKING
#define OR_CONN_STATE_TLS_HANDSHAKING
Definition: orconn_event.h:36
reachability.h
Header file for reachability.c.
tor_reallocarray_
void * tor_reallocarray_(void *ptr, size_t sz1, size_t sz2)
Definition: malloc.c:146
or_connection_t::is_canonical
unsigned int is_canonical
Definition: or_connection_st.h:62
connection_or_client_learned_peer_id
int connection_or_client_learned_peer_id(or_connection_t *conn, const uint8_t *rsa_peer_id, const ed25519_public_key_t *ed_peer_id)
Definition: connection_or.c:1871
channel_close_from_lower_layer
void channel_close_from_lower_layer(channel_t *chan)
Definition: channel.c:1196
is_or_protocol_version_known
int is_or_protocol_version_known(uint16_t v)
Definition: connection_or.c:2389
node_get_by_id
const node_t * node_get_by_id(const char *identity_digest)
Definition: nodelist.c:223
smartlist_add
void smartlist_add(smartlist_t *sl, void *element)
Definition: smartlist_core.c:117
router_digest_is_fallback_dir
int router_digest_is_fallback_dir(const char *digest)
Definition: dirlist.c:189
channel_tls_update_marks
void channel_tls_update_marks(or_connection_t *conn)
Definition: channeltls.c:1347
tor_cert_dup
tor_cert_t * tor_cert_dup(const tor_cert_t *cert)
Definition: torcert.c:294
ed25519_public_key_is_zero
int ed25519_public_key_is_zero(const ed25519_public_key_t *pubkey)
Definition: crypto_ed25519.c:227
channel_mark_bad_for_new_circs
void channel_mark_bad_for_new_circs(channel_t *chan)
Definition: channel.c:2897
or_handshake_state_record_cell
void or_handshake_state_record_cell(or_connection_t *conn, or_handshake_state_t *state, const cell_t *cell, int incoming)
Definition: connection_or.c:2150
connection_or_is_bad_for_new_circs
static unsigned int connection_or_is_bad_for_new_circs(or_connection_t *or_conn)
Definition: connection_or.c:965
tor_tls_peer_has_cert
int tor_tls_peer_has_cert(tor_tls_t *tls)
Definition: tortls_nss.c:509
connection_or_update_token_buckets_helper
static void connection_or_update_token_buckets_helper(or_connection_t *conn, int reset, const or_options_t *options)
Definition: connection_or.c:788
or_options_t::PerConnBWRate
uint64_t PerConnBWRate
Definition: or_options_st.h:383
var_cell_copy
var_cell_t * var_cell_copy(const var_cell_t *src)
Definition: connection_or.c:491
connection_or_finished_flushing
int connection_or_finished_flushing(or_connection_t *conn)
Definition: connection_or.c:645
tor_tls_used_v1_handshake
int tor_tls_used_v1_handshake(tor_tls_t *tls)
Definition: tortls_nss.c:697
connection_or_process_inbuf
int connection_or_process_inbuf(or_connection_t *conn)
Definition: connection_or.c:533
or_connection_t::is_pt
unsigned int is_pt
Definition: or_connection_st.h:76
crypto_digest_add_bytes
void crypto_digest_add_bytes(crypto_digest_t *digest, const char *data, size_t len)
Definition: crypto_digest_nss.c:308
connection_or_write_var_cell_to_buf
void connection_or_write_var_cell_to_buf(const var_cell_t *cell, or_connection_t *conn)
Definition: connection_or.c:2285
orconn_status_msg_t::reason
int reason
Definition: orconn_event.h:93
var_cell_free_
void var_cell_free_(var_cell_t *cell)
Definition: connection_or.c:510
smartlist_new
smartlist_t * smartlist_new(void)
Definition: smartlist_core.c:26
reasons.h
Header file for reasons.c.
or_connection_t::link_proto
uint16_t link_proto
Definition: or_connection_st.h:78
note_broken_connection
static void note_broken_connection(const char *state)
Definition: connection_or.c:209
crypto_digest_t
Definition: crypto_digest_nss.c:166
or_connection_t
Definition: or_connection_st.h:22
tor_snprintf
int tor_snprintf(char *str, size_t size, const char *format,...)
Definition: printf.c:27
routerinfo_t::ipv6_addr
tor_addr_t ipv6_addr
Definition: routerinfo_st.h:29
connection_t::port
uint16_t port
Definition: connection_st.h:116
connection_start_reading
void connection_start_reading(connection_t *conn)
Definition: mainloop.c:632
CELL_PAYLOAD_SIZE
#define CELL_PAYLOAD_SIZE
Definition: or.h:576
connection_proxy_connect
int connection_proxy_connect(connection_t *conn, int type)
Definition: connection.c:2541
ed25519_public_to_base64
void ed25519_public_to_base64(char *output, const ed25519_public_key_t *pkey)
Definition: crypto_format.c:218
SMARTLIST_FOREACH
#define SMARTLIST_FOREACH(sl, type, var, cmd)
Definition: smartlist_foreach.h:112
networkstatus.h
Header file for networkstatus.c.
rep_hist_note_negotiated_link_proto
void rep_hist_note_negotiated_link_proto(unsigned link_proto, int started_here)
Definition: rephist.c:2701
scheduler.h
Header file for scheduler*.c.
orconn_status_msg_t
Definition: orconn_event.h:90
connection_or_flushed_some
int connection_or_flushed_some(or_connection_t *conn)
Definition: connection_or.c:593
cell_t
Definition: cell_st.h:17
router_get_by_id_digest
const routerinfo_t * router_get_by_id_digest(const char *digest)
Definition: routerlist.c:691
node_ed25519_id_matches
int node_ed25519_id_matches(const node_t *node, const ed25519_public_key_t *id)
Definition: nodelist.c:1123
or_connection_t::chan
channel_tls_t * chan
Definition: or_connection_st.h:50
ed25519_fmt
const char * ed25519_fmt(const ed25519_public_key_t *pkey)
Definition: crypto_format.c:184
in6_addr
Definition: inaddr_st.h:50
dirlist.h
Header file for dirlist.c.
crypto_util.h
Common functions for cryptographic routines.
connection_or_clear_identity_map
void connection_or_clear_identity_map(void)
Definition: connection_or.c:122
LD_CIRC
#define LD_CIRC
Definition: log.h:82
buf_datalen
size_t buf_datalen(const buf_t *buf)
Definition: buffers.c:394
or_handshake_state_t::digest_sent_data
unsigned int digest_sent_data
Definition: or_handshake_state_st.h:56
connection_tls_continue_handshake
int connection_tls_continue_handshake(or_connection_t *conn)
Definition: connection_or.c:1683
circuitlist.h
Header file for circuitlist.c.
mainloop.h
Header file for mainloop.c.
tor_tls_t
Definition: tortls_st.h:41
DIGEST_LEN
#define DIGEST_LEN
Definition: digest_sizes.h:20
orconn_state_msg_t::state
uint8_t state
Definition: orconn_event.h:79
MAX_REASONS_TO_REPORT
#define MAX_REASONS_TO_REPORT
Definition: connection_or.c:292
OR_CONN_STATE_OPEN
#define OR_CONN_STATE_OPEN
Definition: orconn_event.h:53
connection_or_event_status
void connection_or_event_status(or_connection_t *conn, or_conn_status_event_t tp, int reason)
Definition: connection_or.c:337
errno_to_orconn_end_reason
int errno_to_orconn_end_reason(int e)
Definition: reasons.c:287
crypto_format.h
Header for crypto_format.c.
packed_cell_t
Definition: cell_queue_st.h:18
bridges.h
Header file for circuitbuild.c.
or_connection_new
or_connection_t * or_connection_new(int type, int socket_family)
Definition: connection.c:378
PADDING_TYPE_ENABLED_TOTAL
@ PADDING_TYPE_ENABLED_TOTAL
Definition: rephist.h:119
geoip.h
Header file for geoip.c.
command.h
Header file for command.c.
or_connection_t::idle_timeout
uint16_t idle_timeout
Definition: or_connection_st.h:80
tor_addr_from_ipv4h
#define tor_addr_from_ipv4h(dest, v4addr)
Definition: address.h:314
connection_t::hold_open_until_flushed
unsigned int hold_open_until_flushed
Definition: connection_st.h:61
connection_or_block_renegotiation
void connection_or_block_renegotiation(or_connection_t *conn)
Definition: connection_or.c:1650
tortls.h
Headers for tortls.c.
tor_addr_port_t
Definition: address.h:80
tor_memneq
#define tor_memneq(a, b, sz)
Definition: di_ops.h:21
tor_addr_to_ipv4h
static uint32_t tor_addr_to_ipv4h(const tor_addr_t *a)
Definition: address.h:159
entrynodes.h
Header file for circuitbuild.c.
TIME_BEFORE_OR_CONN_IS_TOO_OLD
#define TIME_BEFORE_OR_CONN_IS_TOO_OLD
Definition: connection_or.c:985
tor_assert_nonfatal_unreached
#define tor_assert_nonfatal_unreached()
Definition: util_bug.h:176
node_t
Definition: node_st.h:34
LD_OR
#define LD_OR
Definition: log.h:92
channelpadding_get_channel_idle_timeout
unsigned int channelpadding_get_channel_idle_timeout(const channel_t *chan, int is_canonical)
Definition: channelpadding.c:595
circuit_build_times_network_is_live
void circuit_build_times_network_is_live(circuit_build_times_t *cbt)
Definition: circuitstats.c:1421
torcert.h
Header for torcert.c.
CONN_TYPE_OR
#define CONN_TYPE_OR
Definition: connection.h:42
crypto_pk_get_digest
int crypto_pk_get_digest(const crypto_pk_t *pk, char *digest_out)
Definition: crypto_rsa.c:356
VAR_CELL_MAX_HEADER_SIZE
#define VAR_CELL_MAX_HEADER_SIZE
Definition: or.h:582
find_transport_name_by_bridge_addrport
const char * find_transport_name_by_bridge_addrport(const tor_addr_t *addr, uint16_t port)
Definition: bridges.c:591
tor_digest_is_zero
int tor_digest_is_zero(const char *digest)
Definition: util_string.c:96
ed25519_public_key_t
Definition: crypto_ed25519.h:23
broken_state_count_compare
static int broken_state_count_compare(const void **a_ptr, const void **b_ptr)
Definition: connection_or.c:279
networkstatus_get_reasonably_live_consensus
networkstatus_t * networkstatus_get_reasonably_live_consensus(time_t now, int flavor)
Definition: networkstatus.c:1477
or_handshake_state_t::sent_versions_at
time_t sent_versions_at
Definition: or_handshake_state_st.h:21
usable_consensus_flavor
int usable_consensus_flavor(void)
Definition: microdesc.c:1085
connection_t::inbuf
struct buf_t * inbuf
Definition: connection_st.h:98
orconn_state_msg_t::proxy_type
int proxy_type
Definition: orconn_event.h:78
routerinfo_t::addr
uint32_t addr
Definition: routerinfo_st.h:24
OR_CONN_STATE_PROXY_HANDSHAKING
#define OR_CONN_STATE_PROXY_HANDSHAKING
Definition: orconn_event.h:33
authmode.h
Header file for directory authority mode.
get_connection_array
smartlist_t * get_connection_array(void)
Definition: mainloop.c:452
tor_tls_err_to_string
const char * tor_tls_err_to_string(int err)
Definition: tortls.c:155
or_connection_t::is_outgoing
unsigned int is_outgoing
Definition: or_connection_st.h:65
or_handshake_certs_t::started_here
int started_here
Definition: or_handshake_certs_st.h:21
connection_or_single_set_badness_
int connection_or_single_set_badness_(time_t now, or_connection_t *or_conn, int force)
Definition: connection_or.c:994
connection_or_nonopen_was_started_here
int connection_or_nonopen_was_started_here(or_connection_t *conn)
Definition: connection_or.c:1737
or_connection_t::tls_error
int tls_error
Definition: or_connection_st.h:45
connection_t::marked_for_close
uint16_t marked_for_close
Definition: connection_st.h:119
connection_or_num_cells_writeable
ssize_t connection_or_num_cells_writeable(or_connection_t *conn)
Definition: connection_or.c:615
connection_tls_start_handshake
int connection_tls_start_handshake(or_connection_t *conn, int receiving)
Definition: connection_or.c:1609
nodelist.h
Header file for nodelist.c.
broken_state_count_t
Definition: connection_or.c:272
connection_or_set_state_open
int connection_or_set_state_open(or_connection_t *conn)
Definition: connection_or.c:2223
routerlist.h
Header file for routerlist.c.
var_cell_t::payload_len
uint16_t payload_len
Definition: var_cell_st.h:22
relay_handshake.h
Header for feature/relay/relay_handshake.c.
or_handshake_certs_new
or_handshake_certs_t * or_handshake_certs_new(void)
Definition: torcert.c:471
router_get_consensus_status_by_id
const routerstatus_t * router_get_consensus_status_by_id(const char *digest)
Definition: networkstatus.c:843
assert_connection_ok
void assert_connection_ok(connection_t *conn, time_t now)
Definition: connection.c:5362
channel_listener_queue_incoming
void channel_listener_queue_incoming(channel_listener_t *listener, channel_t *incoming)
Definition: channel.c:1905
connection_t::addr
tor_addr_t addr
Definition: connection_st.h:112
routerinfo_st.h
Router descriptor structure.
circuitstats.h
Header file for circuitstats.c.
token_bucket_rw_reset
void token_bucket_rw_reset(token_bucket_rw_t *bucket, uint32_t now_ts)
Definition: token_bucket.c:167
connection_start_writing
void connection_start_writing(connection_t *conn)
Definition: mainloop.c:688
connection_or_change_state
STATIC void connection_or_change_state(or_connection_t *conn, uint8_t state)
Definition: connection_or.c:384
tor_addr_to_str_dup
char * tor_addr_to_str_dup(const tor_addr_t *addr)
Definition: address.c:1155
buffers.h
Header file for buffers.c.
connection_or_notify_error
void connection_or_notify_error(or_connection_t *conn, int reason, const char *msg)
Definition: connection_or.c:1375
cell_t::command
uint8_t command
Definition: cell_st.h:19
cell_t::payload
uint8_t payload[CELL_PAYLOAD_SIZE]
Definition: cell_st.h:21
channel_t
Definition: channel.h:181
PADDING_TYPE_TOTAL
@ PADDING_TYPE_TOTAL
Definition: rephist.h:117
HT_HEAD
typedef HT_HEAD(hs_service_ht, hs_service_t) hs_service_ht
tor_tls_is_server
int tor_tls_is_server(tor_tls_t *tls)
Definition: tortls.c:379
OR_CONN_STATE_OR_HANDSHAKING_V2
#define OR_CONN_STATE_OR_HANDSHAKING_V2
Definition: orconn_event.h:47
connection_tls_finish_handshake
static int connection_tls_finish_handshake(or_connection_t *conn)
Definition: connection_or.c:2045
channel_tls_start_listener
channel_listener_t * channel_tls_start_listener(void)
Definition: channeltls.c:266
channel_t::ed25519_identity
struct ed25519_public_key_t ed25519_identity
Definition: channel.h:393
crypto_digest256_new
crypto_digest_t * crypto_digest256_new(digest_algorithm_t algorithm)
Definition: crypto_digest_nss.c:272
connection_t
Definition: connection_st.h:45
connection_t::type
unsigned int type
Definition: connection_st.h:50
rep_hist_padding_count_write
void rep_hist_padding_count_write(padding_type_t type)
Definition: rephist.c:2731
connection_or_launch_v3_or_handshake
static int connection_or_launch_v3_or_handshake(or_connection_t *conn)
Definition: connection_or.c:2091
or_handshake_certs_st.h
OR handshake certs structure.
packed_cell_t::body
char body[CELL_MAX_NETWORK_SIZE]
Definition: cell_queue_st.h:21
or_connection_t::real_addr
tor_addr_t real_addr
Definition: or_connection_st.h:52
ext_orport.h
Header for ext_orport.c.
LOG_INFO
#define LOG_INFO
Definition: log.h:45
dirserv_orconn_tls_done
void dirserv_orconn_tls_done(const tor_addr_t *addr, uint16_t or_port, const char *digest_rcvd, const ed25519_public_key_t *ed_id_rcvd)
Definition: reachability.c:40
fmt_addr
#define fmt_addr(a)
Definition: address.h:229
connection_free_
void connection_free_(connection_t *conn)
Definition: connection.c:760
node_get_pref_ipv6_orport
void node_get_pref_ipv6_orport(const node_t *node, tor_addr_port_t *ap_out)
Definition: nodelist.c:1757
connection_fetch_var_cell_from_buf
static int connection_fetch_var_cell_from_buf(or_connection_t *or_conn, var_cell_t **out)
Definition: connection_or.c:2307
WRITE_EVENT
@ WRITE_EVENT
Definition: mainloop.h:38
control_events.h
Header file for control_events.c.
get_options
const or_options_t * get_options(void)
Definition: config.c:925
bool_eq
#define bool_eq(a, b)
Definition: logic.h:16
or_state_st.h
The or_state_t structure, which represents Tor's state file.
n_or_protocol_versions
static const int n_or_protocol_versions
Definition: connection_or.c:2383
or_options_t::PerConnBWBurst
uint64_t PerConnBWBurst
Definition: or_options_st.h:384
var_cell_st.h
Variable-length cell structure.
circuitbuild.h
Header file for circuitbuild.c.
connection_watch_events
void connection_watch_events(connection_t *conn, watchable_events_t events)
Definition: mainloop.c:494
fmt_addrport
const char * fmt_addrport(const tor_addr_t *addr, uint16_t port)
Definition: address.c:1190
tor_tls_set_logged_address
void tor_tls_set_logged_address(tor_tls_t *tls, const char *address)
Definition: tortls.c:369
connection_or_note_state_when_broken
static void connection_or_note_state_when_broken(or_connection_t *orconn)
Definition: connection_or.c:261
get_uint32
static uint32_t get_uint32(const void *cp)
Definition: bytes.h:54
OR_CONN_STATE_OR_HANDSHAKING_V3
#define OR_CONN_STATE_OR_HANDSHAKING_V3
Definition: orconn_event.h:51
crypto_digest_free
#define crypto_digest_free(d)
Definition: crypto_digest.h:130
connection_or_close_for_error
void connection_or_close_for_error(or_connection_t *orconn, int flush)
Definition: connection_or.c:1584
scheduler_channel_wants_writes
void scheduler_channel_wants_writes(channel_t *chan)
Definition: scheduler.c:673
connection_connect
int connection_connect(connection_t *conn, const char *address, const tor_addr_t *addr, uint16_t port, int *socket_error)
Definition: connection.c:2187
get_proxy_addrport
int get_proxy_addrport(tor_addr_t *addr, uint16_t *port, int *proxy_type, int *is_pt_out, const connection_t *conn)
Definition: connection.c:5516
connection_or_process_cells_from_inbuf
static int connection_or_process_cells_from_inbuf(or_connection_t *conn)
Definition: connection_or.c:2321
channel_clear_identity_digest
void channel_clear_identity_digest(channel_t *chan)
Definition: channel.c:1282
set_uint32
static void set_uint32(void *cp, uint32_t v)
Definition: bytes.h:87
or_connection_t::proxy_type
unsigned int proxy_type
Definition: or_connection_st.h:66
channel_tls_handle_incoming
channel_t * channel_tls_handle_incoming(or_connection_t *orconn)
Definition: channeltls.c:329
or_connect_failure_entry_t
Definition: connection_or.c:1162
OR_CONN_HIGHWATER
#define OR_CONN_HIGHWATER
Definition: or.h:720
connection_or_check_canonicity
static void connection_or_check_canonicity(or_connection_t *conn, int started_here)
Definition: connection_or.c:888
relay.h
Header file for relay.c.
channel_is_bad_for_new_circs
int channel_is_bad_for_new_circs(channel_t *chan)
Definition: channel.c:2884
connection.h
Header file for connection.c.
connection_buf_get_bytes
int connection_buf_get_bytes(char *string, size_t len, connection_t *conn)
Definition: connection.c:3996
channeltls.h
Header file for channeltls.c.
connection_read_proxy_handshake
int connection_read_proxy_handshake(connection_t *conn)
Definition: connection.c:2694
connection_or_write_cell_to_buf
void connection_or_write_cell_to_buf(const cell_t *cell, or_connection_t *conn)
Definition: connection_or.c:2246
READ_EVENT
@ READ_EVENT
Definition: mainloop.h:37
connection_or_report_broken_states
void connection_or_report_broken_states(int severity, int domain)
Definition: connection_or.c:297
connection_or_about_to_close
void connection_or_about_to_close(or_connection_t *or_conn)
Definition: connection_or.c:721
monotime_coarse_get_stamp
uint32_t monotime_coarse_get_stamp(void)
Definition: compat_time.c:844
OR_CONN_LOWWATER
#define OR_CONN_LOWWATER
Definition: or.h:724
or_handshake_state_t
Definition: or_handshake_state_st.h:18
server_mode
int server_mode(const or_options_t *options)
Definition: routermode.c:34
LD_HANDSHAKE
#define LD_HANDSHAKE
Definition: log.h:101
connection_or_init_conn_from_address
void connection_or_init_conn_from_address(or_connection_t *conn, const tor_addr_t *addr, uint16_t port, const char *id_digest, const ed25519_public_key_t *ed_id, int started_here)
Definition: connection_or.c:861
tor_addr_is_null
int tor_addr_is_null(const tor_addr_t *addr)
Definition: address.c:771
or_handshake_state_t::certs
or_handshake_certs_t * certs
Definition: or_handshake_state_st.h:79
connection_or_update_token_buckets
void connection_or_update_token_buckets(smartlist_t *conns, const or_options_t *options)
Definition: connection_or.c:820
var_cell_t::circ_id
circid_t circ_id
Definition: var_cell_st.h:20
channel_listener_t
Definition: channel.h:466
or_connection_st.h
OR connection structure.
tor_tls_new
tor_tls_t * tor_tls_new(tor_socket_t sock, int is_server)
Definition: tortls_nss.c:396
token_bucket_rw_adjust
void token_bucket_rw_adjust(token_bucket_rw_t *bucket, uint32_t rate, uint32_t burst)
Definition: token_bucket.c:152
SMARTLIST_FOREACH_BEGIN
#define SMARTLIST_FOREACH_BEGIN(sl, type, var)
Definition: smartlist_foreach.h:78
node_get_nickname
const char * node_get_nickname(const node_t *node)
Definition: nodelist.c:1328
crypto_pk_t
Definition: crypto_rsa_nss.c:36
node_get_prim_orport
void node_get_prim_orport(const node_t *node, tor_addr_port_t *ap_out)
Definition: nodelist.c:1721
public_server_mode
int public_server_mode(const or_options_t *options)
Definition: routermode.c:43
HEX_DIGEST_LEN
#define HEX_DIGEST_LEN
Definition: crypto_digest.h:35
LOG_WARN
#define LOG_WARN
Definition: log.h:53
connection_or_get_state_description
static void connection_or_get_state_description(or_connection_t *orconn, char *buf, size_t buflen)
Definition: connection_or.c:243
orconn_event.h
Header file for orconn_event.c.
or_handshake_state_t::own_link_cert
struct tor_cert_st * own_link_cert
Definition: or_handshake_state_st.h:45
or_conn_status_event_t
or_conn_status_event_t
Definition: orconn_event.h:59
tls_error_to_orconn_end_reason
int tls_error_to_orconn_end_reason(int e)
Definition: reasons.c:261
tor_tls_verify
int tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_t **identity)
Definition: tortls.c:416
get_uint8
static uint8_t get_uint8(const void *cp)
Definition: bytes.h:23
cell_st.h
Fixed-size cell structure.
channel_tls_handle_var_cell
void channel_tls_handle_var_cell(var_cell_t *var_cell, or_connection_t *conn)
Definition: channeltls.c:1172
var_cell_new
var_cell_t * var_cell_new(uint16_t payload_len)
Definition: connection_or.c:476
connection_t::magic
uint32_t magic
Definition: connection_st.h:46
connection_or_digest_is_known_relay
int connection_or_digest_is_known_relay(const char *id_digest)
Definition: connection_or.c:768
cell_pack
void cell_pack(packed_cell_t *dst, const cell_t *src, int wide_circ_ids)
Definition: connection_or.c:419
HT_PROTOTYPE
HT_PROTOTYPE(hs_circuitmap_ht, circuit_t, hs_circuitmap_node, hs_circuit_hash_token, hs_circuits_have_same_token)
router_ed25519_id_is_me
int router_ed25519_id_is_me(const ed25519_public_key_t *id)
Definition: routerkeys.c:618
tor_tls_handshake
int tor_tls_handshake(tor_tls_t *tls)
Definition: tortls_nss.c:586
config.h
Header file for config.c.
orconn_state_msg_t
Definition: orconn_event.h:75
node_supports_ed25519_link_authentication
int node_supports_ed25519_link_authentication(const node_t *node, int compatible_with_us)
Definition: nodelist.c:1163
connection_t::s
tor_socket_t s
Definition: connection_st.h:93
escaped_safe_str
const char * escaped_safe_str(const char *address)
Definition: config.c:1128
get_uint16
static uint16_t get_uint16(const void *cp)
Definition: bytes.h:42
authdir_mode_tests_reachability
int authdir_mode_tests_reachability(const or_options_t *options)
Definition: authmode.c:68
or_handshake_state_record_var_cell
void or_handshake_state_record_var_cell(or_connection_t *conn, or_handshake_state_t *state, const var_cell_t *cell, int incoming)
Definition: connection_or.c:2191
connection_t::timestamp_created
time_t timestamp_created
Definition: connection_st.h:108
control_event_bootstrap_prob_or
void control_event_bootstrap_prob_or(const char *warn, int reason, or_connection_t *or_conn)
Definition: control_bootstrap.c:347
LD_NET
#define LD_NET
Definition: log.h:66
tor_tls_block_renegotiation
void tor_tls_block_renegotiation(tor_tls_t *tls)
Definition: tortls_nss.c:620
channel_set_circid_type
void channel_set_circid_type(channel_t *chan, crypto_pk_t *identity_rcvd, int consider_identity)
Definition: channel.c:3364
tor_log
void tor_log(int severity, log_domain_mask_t domain, const char *format,...)
Definition: log.c:628
connection_t::state
uint8_t state
Definition: connection_st.h:49
sa_family_t
uint16_t sa_family_t
Definition: inaddr_st.h:77
or_options_t
Definition: or_options_st.h:39
orconn_state_msg_t::chan
uint64_t chan
Definition: orconn_event.h:77
connection_or_close_normally
void connection_or_close_normally(or_connection_t *orconn, int flush)
Definition: connection_or.c:1563
TO_CONN
#define TO_CONN(c)
Definition: or.h:735
set_uint16
static void set_uint16(void *cp, uint16_t v)
Definition: bytes.h:78
var_cell_t::payload
uint8_t payload[FLEXIBLE_ARRAY_MEMBER]
Definition: var_cell_st.h:24
or_handshake_state_st.h
OR handshake state structure.
STATIC
#define STATIC
Definition: testsupport.h:32
cell_queue_st.h
Cell queue structures.
tor_tls_set_renegotiate_callback
void tor_tls_set_renegotiate_callback(tor_tls_t *tls, void(*cb)(tor_tls_t *, void *arg), void *arg)
Definition: tortls_nss.c:445
orconn_end_reason_to_control_string
const char * orconn_end_reason_to_control_string(int r)
Definition: reasons.c:225
var_cell_t::command
uint8_t command
Definition: var_cell_st.h:18
channel_num_circuits
unsigned int channel_num_circuits(channel_t *chan)
Definition: channel.c:3347
entry_guard_chan_failed
void entry_guard_chan_failed(channel_t *chan)
Definition: entrynodes.c:2502
broken_connection_counts
static strmap_t * broken_connection_counts
Definition: connection_or.c:202
networkstatus_get_param
int32_t networkstatus_get_param(const networkstatus_t *ns, const char *param_name, int32_t default_val, int32_t min_val, int32_t max_val)
Definition: networkstatus.c:2490
or_options_t::BandwidthBurst
uint64_t BandwidthBurst
Definition: or_options_st.h:375
connection_or_connect
or_connection_t * connection_or_connect(const tor_addr_t *_addr, uint16_t port, const char *id_digest, const ed25519_public_key_t *ed_id, channel_tls_t *chan)
Definition: connection_or.c:1418
var_cell_t
Definition: var_cell_st.h:16
connection_or_group_set_badness_
void connection_or_group_set_badness_(smartlist_t *group, int force)
Definition: connection_or.c:1035
channel_tls_to_base
channel_t * channel_tls_to_base(channel_tls_t *tlschan)
Definition: channeltls.c:371
proto_cell.h
Header for proto_cell.c.
smartlist_sort
void smartlist_sort(smartlist_t *sl, int(*compare)(const void **a, const void **b))
Definition: smartlist.c:334
cell_t::circ_id
circid_t circ_id
Definition: cell_st.h:18
or_connection_t::tls
struct tor_tls_t * tls
Definition: or_connection_st.h:44
orconn_status_msg_t::gid
uint64_t gid
Definition: orconn_event.h:91
tor_addr_to_in6_addr8
#define tor_addr_to_in6_addr8(x)
Definition: address.h:134
or_protocol_versions
static const uint16_t or_protocol_versions[]
Definition: connection_or.c:2381
PADDING_TYPE_CELL
@ PADDING_TYPE_CELL
Definition: rephist.h:115
or_connection_t::identity_digest
char identity_digest[DIGEST_LEN]
Definition: or_connection_st.h:27
smartlist_t
Definition: smartlist_core.h:26
TO_OR_CONN
or_connection_t * TO_OR_CONN(connection_t *c)
Definition: connection_or.c:105
fast_memeq
#define fast_memeq(a, b, c)
Definition: di_ops.h:35
channel_set_identity_digest
void channel_set_identity_digest(channel_t *chan, const char *identity_digest, const ed25519_public_key_t *ed_identity)
Definition: channel.c:1311
tor_addr_eq
#define tor_addr_eq(a, b)
Definition: address.h:268
connection_t::proxy_state
unsigned int proxy_state
Definition: connection_st.h:89
rendcommon.h
Header file for rendcommon.c.
rephist.h
Header file for rephist.c.
connection_or_set_identity_digest
static void connection_or_set_identity_digest(or_connection_t *conn, const char *rsa_digest, const ed25519_public_key_t *ed_id)
Definition: connection_or.c:143
connection_or.h
Header file for connection_or.c.
disable_broken_connection_counts
static int disable_broken_connection_counts
Definition: connection_or.c:205
tor_addr_copy
void tor_addr_copy(tor_addr_t *dest, const tor_addr_t *src)
Definition: address.c:924
channel_close_for_error
void channel_close_for_error(channel_t *chan)
Definition: channel.c:1224
or_connection_t::nickname
char * nickname
Definition: or_connection_st.h:42
or.h
Master header file for Tor-specific functionality.
connection_t::global_identifier
uint64_t global_identifier
Definition: connection_st.h:135
channel_closed
void channel_closed(channel_t *chan)
Definition: channel.c:1251
connection_or_get_num_circuits
int connection_or_get_num_circuits(or_connection_t *conn)
Definition: connection_or.c:400
connection_or_connect_failed
void connection_or_connect_failed(or_connection_t *conn, int reason, const char *msg)
Definition: connection_or.c:1359
LD_PROTOCOL
#define LD_PROTOCOL
Definition: log.h:72