Tor  0.4.3.1-alpha-dev
dirclient.c
Go to the documentation of this file.
1 /* Copyright (c) 2001-2004, Roger Dingledine.
2  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
3  * Copyright (c) 2007-2020, The Tor Project, Inc. */
4 /* See LICENSE for licensing information */
5 
6 /**
7  * @file dirclient.c
8  * @brief Download directory information
9  **/
10 
11 #define DIRCLIENT_PRIVATE
12 
13 #include "core/or/or.h"
14 
15 #include "app/config/config.h"
17 #include "core/mainloop/mainloop.h"
19 #include "core/or/policies.h"
20 #include "feature/client/bridges.h"
33 #include "feature/hs/hs_cache.h"
34 #include "feature/hs/hs_client.h"
35 #include "feature/hs/hs_control.h"
47 #include "feature/relay/selftest.h"
48 #include "feature/rend/rendcache.h"
53 
54 #include "lib/compress/compress.h"
57 #include "lib/encoding/confline.h"
58 #include "lib/err/backtrace.h"
59 
68 
69 /** Maximum size, in bytes, for any directory object that we've downloaded. */
70 #define MAX_DIR_DL_SIZE ((1<<24)-1) /* 16 MB - 1 */
71 
72 /** How far in the future do we allow a directory server to tell us it is
73  * before deciding that one of us has the wrong time? */
74 #define ALLOW_DIRECTORY_TIME_SKEW (30*60)
75 
76 static int body_is_plausible(const char *body, size_t body_len, int purpose);
80  dir_connection_t *conn, int status_code);
81 static void connection_dir_retry_bridges(smartlist_t *descs);
83  int status_code,
84  int router_purpose,
85  int was_extrainfo,
86  int was_descriptor_digests);
87 static void dir_microdesc_download_failed(smartlist_t *failed,
88  int status_code,
89  const char *dir_id);
91  const int direct,
92  const directory_request_t *req);
93 static void connection_dir_close_consensus_fetches(
94  dir_connection_t *except_this_one, const char *resource);
95 
96 /** Return a string describing a given directory connection purpose. */
97 STATIC const char *
99 {
100  switch (purpose)
101  {
103  return "server descriptor upload";
105  return "server vote upload";
107  return "consensus signature upload";
109  return "server descriptor fetch";
111  return "extra-info fetch";
113  return "consensus network-status fetch";
115  return "authority cert fetch";
117  return "status vote fetch";
119  return "consensus signature fetch";
121  return "hidden-service v2 descriptor fetch";
123  return "hidden-service v2 descriptor upload";
125  return "hidden-service descriptor fetch";
127  return "hidden-service descriptor upload";
129  return "microdescriptor fetch";
130  }
131 
132  log_warn(LD_BUG, "Called with unknown purpose %d", purpose);
133  return "(unknown)";
134 }
135 
136 /** Return the requisite directory information types. */
138 dir_fetch_type(int dir_purpose, int router_purpose, const char *resource)
139 {
140  dirinfo_type_t type;
141  switch (dir_purpose) {
143  type = EXTRAINFO_DIRINFO;
144  if (router_purpose == ROUTER_PURPOSE_BRIDGE)
145  type |= BRIDGE_DIRINFO;
146  else
147  type |= V3_DIRINFO;
148  break;
150  if (router_purpose == ROUTER_PURPOSE_BRIDGE)
151  type = BRIDGE_DIRINFO;
152  else
153  type = V3_DIRINFO;
154  break;
158  type = V3_DIRINFO;
159  break;
161  type = V3_DIRINFO;
162  if (resource && !strcmp(resource, "microdesc"))
163  type |= MICRODESC_DIRINFO;
164  break;
166  type = MICRODESC_DIRINFO;
167  break;
168  default:
169  log_warn(LD_BUG, "Unexpected purpose %d", (int)dir_purpose);
170  type = NO_DIRINFO;
171  break;
172  }
173  return type;
174 }
175 
176 /** Return true iff <b>identity_digest</b> is the digest of a router which
177  * says that it caches extrainfos. (If <b>is_authority</b> we always
178  * believe that to be true.) */
179 int
180 router_supports_extrainfo(const char *identity_digest, int is_authority)
181 {
182  const node_t *node = node_get_by_id(identity_digest);
183 
184  if (node && node->ri) {
185  if (node->ri->caches_extra_info)
186  return 1;
187  }
188  if (is_authority) {
189  return 1;
190  }
191  return 0;
192 }
193 
194 /** Return true iff any trusted directory authority has accepted our
195  * server descriptor.
196  *
197  * We consider any authority sufficient because waiting for all of
198  * them means it never happens while any authority is down; we don't
199  * go for something more complex in the middle (like >1/3 or >1/2 or
200  * >=1/2) because that doesn't seem necessary yet.
201  */
202 int
204 {
205  const smartlist_t *servers = router_get_trusted_dir_servers();
206  const or_options_t *options = get_options();
207  SMARTLIST_FOREACH(servers, dir_server_t *, d, {
208  if ((d->type & options->PublishServerDescriptor_) &&
209  d->has_accepted_serverdesc) {
210  return 1;
211  }
212  });
213  return 0;
214 }
215 
216 /** Start a connection to every suitable directory authority, using
217  * connection purpose <b>dir_purpose</b> and uploading <b>payload</b>
218  * (of length <b>payload_len</b>). The dir_purpose should be one of
219  * 'DIR_PURPOSE_UPLOAD_{DIR|VOTE|SIGNATURES}'.
220  *
221  * <b>router_purpose</b> describes the type of descriptor we're
222  * publishing, if we're publishing a descriptor -- e.g. general or bridge.
223  *
224  * <b>type</b> specifies what sort of dir authorities (V3,
225  * BRIDGE, etc) we should upload to.
226  *
227  * If <b>extrainfo_len</b> is nonzero, the first <b>payload_len</b> bytes of
228  * <b>payload</b> hold a router descriptor, and the next <b>extrainfo_len</b>
229  * bytes of <b>payload</b> hold an extra-info document. Upload the descriptor
230  * to all authorities, and the extra-info document to all authorities that
231  * support it.
232  */
233 void
234 directory_post_to_dirservers(uint8_t dir_purpose, uint8_t router_purpose,
235  dirinfo_type_t type,
236  const char *payload,
237  size_t payload_len, size_t extrainfo_len)
238 {
239  const or_options_t *options = get_options();
240  dir_indirection_t indirection;
241  const smartlist_t *dirservers = router_get_trusted_dir_servers();
242  int found = 0;
243  const int exclude_self = (dir_purpose == DIR_PURPOSE_UPLOAD_VOTE ||
244  dir_purpose == DIR_PURPOSE_UPLOAD_SIGNATURES);
245  tor_assert(dirservers);
246  /* This tries dirservers which we believe to be down, but ultimately, that's
247  * harmless, and we may as well err on the side of getting things uploaded.
248  */
249  SMARTLIST_FOREACH_BEGIN(dirservers, dir_server_t *, ds) {
250  routerstatus_t *rs = &(ds->fake_status);
251  size_t upload_len = payload_len;
252 
253  if ((type & ds->type) == 0)
254  continue;
255 
256  if (exclude_self && router_digest_is_me(ds->digest)) {
257  /* we don't upload to ourselves, but at least there's now at least
258  * one authority of this type that has what we wanted to upload. */
259  found = 1;
260  continue;
261  }
262 
263  if (options->StrictNodes &&
264  routerset_contains_routerstatus(options->ExcludeNodes, rs, -1)) {
265  log_warn(LD_DIR, "Wanted to contact authority '%s' for %s, but "
266  "it's in our ExcludedNodes list and StrictNodes is set. "
267  "Skipping.",
268  ds->nickname,
269  dir_conn_purpose_to_string(dir_purpose));
270  continue;
271  }
272 
273  found = 1; /* at least one authority of this type was listed */
274  if (dir_purpose == DIR_PURPOSE_UPLOAD_DIR)
275  ds->has_accepted_serverdesc = 0;
276 
277  if (extrainfo_len && router_supports_extrainfo(ds->digest, 1)) {
278  upload_len += extrainfo_len;
279  log_info(LD_DIR, "Uploading an extrainfo too (length %d)",
280  (int) extrainfo_len);
281  }
282  if (purpose_needs_anonymity(dir_purpose, router_purpose, NULL)) {
283  indirection = DIRIND_ANONYMOUS;
284  } else if (!fascist_firewall_allows_dir_server(ds,
285  FIREWALL_DIR_CONNECTION,
286  0)) {
287  if (fascist_firewall_allows_dir_server(ds, FIREWALL_OR_CONNECTION, 0))
288  indirection = DIRIND_ONEHOP;
289  else
290  indirection = DIRIND_ANONYMOUS;
291  } else {
292  indirection = DIRIND_DIRECT_CONN;
293  }
294 
295  directory_request_t *req = directory_request_new(dir_purpose);
297  directory_request_set_router_purpose(req, router_purpose);
298  directory_request_set_indirection(req, indirection);
299  directory_request_set_payload(req, payload, upload_len);
301  directory_request_free(req);
302  } SMARTLIST_FOREACH_END(ds);
303  if (!found) {
304  char *s = authdir_type_to_string(type);
305  log_warn(LD_DIR, "Publishing server descriptor to directory authorities "
306  "of type '%s', but no authorities of that type listed!", s);
307  tor_free(s);
308  }
309 }
310 
311 /** Return true iff, according to the values in <b>options</b>, we should be
312  * using directory guards for direct downloads of directory information. */
313 STATIC int
315 {
316  /* Public (non-bridge) servers never use directory guards. */
317  if (public_server_mode(options))
318  return 0;
319  /* If guards are disabled, we can't use directory guards.
320  */
321  if (!options->UseEntryGuards)
322  return 0;
323  /* If we're configured to fetch directory info aggressively or of a
324  * nonstandard type, don't use directory guards. */
325  if (options->DownloadExtraInfo || options->FetchDirInfoEarly ||
326  options->FetchDirInfoExtraEarly || options->FetchUselessDescriptors)
327  return 0;
328  return 1;
329 }
330 
331 /** Pick an unconstrained directory server from among our guards, the latest
332  * networkstatus, or the fallback dirservers, for use in downloading
333  * information of type <b>type</b>, and return its routerstatus. */
334 static const routerstatus_t *
336  uint8_t dir_purpose,
337  circuit_guard_state_t **guard_state_out)
338 {
339  const routerstatus_t *rs = NULL;
340  const or_options_t *options = get_options();
341 
342  if (options->UseBridges)
343  log_warn(LD_BUG, "Called when we have UseBridges set.");
344 
345  if (should_use_directory_guards(options)) {
346  const node_t *node = guards_choose_dirguard(dir_purpose, guard_state_out);
347  if (node)
348  rs = node->rs;
349  } else {
350  /* anybody with a non-zero dirport will do */
351  rs = router_pick_directory_server(type, pds_flags);
352  }
353  if (!rs) {
354  log_info(LD_DIR, "No router found for %s; falling back to "
355  "dirserver list.", dir_conn_purpose_to_string(dir_purpose));
356  rs = router_pick_fallback_dirserver(type, pds_flags);
357  }
358 
359  return rs;
360 }
361 
362 /**
363  * Set the extra fields in <b>req</b> that are used when requesting a
364  * consensus of type <b>resource</b>.
365  *
366  * Right now, these fields are if-modified-since and x-or-diff-from-consensus.
367  */
368 static void
370  const char *resource)
371 {
372  time_t if_modified_since = 0;
373  uint8_t or_diff_from[DIGEST256_LEN];
374  int or_diff_from_is_set = 0;
375 
376  /* DEFAULT_IF_MODIFIED_SINCE_DELAY is 1/20 of the default consensus
377  * period of 1 hour.
378  */
379  const int DEFAULT_IF_MODIFIED_SINCE_DELAY = 180;
380  const int32_t DEFAULT_TRY_DIFF_FOR_CONSENSUS_NEWER = 72;
381  const int32_t MIN_TRY_DIFF_FOR_CONSENSUS_NEWER = 0;
382  const int32_t MAX_TRY_DIFF_FOR_CONSENSUS_NEWER = 8192;
383  const char TRY_DIFF_FOR_CONSENSUS_NEWER_NAME[] =
384  "try-diff-for-consensus-newer-than";
385 
386  int flav = FLAV_NS;
387  if (resource)
388  flav = networkstatus_parse_flavor_name(resource);
389 
390  int32_t max_age_for_diff = 3600 *
392  TRY_DIFF_FOR_CONSENSUS_NEWER_NAME,
393  DEFAULT_TRY_DIFF_FOR_CONSENSUS_NEWER,
394  MIN_TRY_DIFF_FOR_CONSENSUS_NEWER,
395  MAX_TRY_DIFF_FOR_CONSENSUS_NEWER);
396 
397  if (flav != -1) {
398  /* IF we have a parsed consensus of this type, we can do an
399  * if-modified-time based on it. */
400  networkstatus_t *v;
402  if (v) {
403  /* In networks with particularly short V3AuthVotingIntervals,
404  * ask for the consensus if it's been modified since half the
405  * V3AuthVotingInterval of the most recent consensus. */
406  time_t ims_delay = DEFAULT_IF_MODIFIED_SINCE_DELAY;
407  if (v->fresh_until > v->valid_after
408  && ims_delay > (v->fresh_until - v->valid_after)/2) {
409  ims_delay = (v->fresh_until - v->valid_after)/2;
410  }
411  if_modified_since = v->valid_after + ims_delay;
412  if (v->valid_after >= approx_time() - max_age_for_diff) {
413  memcpy(or_diff_from, v->digest_sha3_as_signed, DIGEST256_LEN);
414  or_diff_from_is_set = 1;
415  }
416  }
417  } else {
418  /* Otherwise it might be a consensus we don't parse, but which we
419  * do cache. Look at the cached copy, perhaps. */
420  cached_dir_t *cd = dirserv_get_consensus(resource);
421  /* We have no method of determining the voting interval from an
422  * unparsed consensus, so we use the default. */
423  if (cd) {
424  if_modified_since = cd->published + DEFAULT_IF_MODIFIED_SINCE_DELAY;
425  if (cd->published >= approx_time() - max_age_for_diff) {
426  memcpy(or_diff_from, cd->digest_sha3_as_signed, DIGEST256_LEN);
427  or_diff_from_is_set = 1;
428  }
429  }
430  }
431 
432  if (if_modified_since > 0)
433  directory_request_set_if_modified_since(req, if_modified_since);
434  if (or_diff_from_is_set) {
435  char hex[HEX_DIGEST256_LEN + 1];
436  base16_encode(hex, sizeof(hex),
437  (const char*)or_diff_from, sizeof(or_diff_from));
438  directory_request_add_header(req, X_OR_DIFF_FROM_CONSENSUS_HEADER, hex);
439  }
440 }
441 /** Start a connection to a random running directory server, using
442  * connection purpose <b>dir_purpose</b>, intending to fetch descriptors
443  * of purpose <b>router_purpose</b>, and requesting <b>resource</b>.
444  * Use <b>pds_flags</b> as arguments to router_pick_directory_server()
445  * or router_pick_trusteddirserver().
446  */
447 MOCK_IMPL(void,
449  uint8_t dir_purpose,
450  uint8_t router_purpose,
451  const char *resource,
452  int pds_flags,
453  download_want_authority_t want_authority))
454 {
455  const routerstatus_t *rs = NULL;
456  const or_options_t *options = get_options();
457  int prefer_authority = (dirclient_fetches_from_authorities(options)
458  || want_authority == DL_WANT_AUTHORITY);
459  int require_authority = 0;
460  int get_via_tor = purpose_needs_anonymity(dir_purpose, router_purpose,
461  resource);
462  dirinfo_type_t type = dir_fetch_type(dir_purpose, router_purpose, resource);
463 
464  if (type == NO_DIRINFO)
465  return;
466 
467  if (!options->FetchServerDescriptors)
468  return;
469 
470  circuit_guard_state_t *guard_state = NULL;
471  if (!get_via_tor) {
472  if (options->UseBridges && !(type & BRIDGE_DIRINFO)) {
473  /* We want to ask a running bridge for which we have a descriptor.
474  *
475  * When we ask choose_random_entry() for a bridge, we specify what
476  * sort of dir fetch we'll be doing, so it won't return a bridge
477  * that can't answer our question.
478  */
479  const node_t *node = guards_choose_dirguard(dir_purpose, &guard_state);
480  if (node && node->ri) {
481  /* every bridge has a routerinfo. */
482  routerinfo_t *ri = node->ri;
483  /* clients always make OR connections to bridges */
484  tor_addr_port_t or_ap;
485  directory_request_t *req = directory_request_new(dir_purpose);
486  /* we are willing to use a non-preferred address if we need to */
487  fascist_firewall_choose_address_node(node, FIREWALL_OR_CONNECTION, 0,
488  &or_ap);
491  ri->cache_info.identity_digest);
492  directory_request_set_router_purpose(req, router_purpose);
493  directory_request_set_resource(req, resource);
494  if (dir_purpose == DIR_PURPOSE_FETCH_CONSENSUS)
496  directory_request_set_guard_state(req, guard_state);
498  directory_request_free(req);
499  } else {
500  if (guard_state) {
501  entry_guard_cancel(&guard_state);
502  }
503  log_notice(LD_DIR, "Ignoring directory request, since no bridge "
504  "nodes are available yet.");
505  }
506 
507  return;
508  } else {
509  if (prefer_authority || (type & BRIDGE_DIRINFO)) {
510  /* only ask authdirservers, and don't ask myself */
511  rs = router_pick_trusteddirserver(type, pds_flags);
512  if (rs == NULL && (pds_flags & (PDS_NO_EXISTING_SERVERDESC_FETCH|
514  /* We don't want to fetch from any authorities that we're currently
515  * fetching server descriptors from, and we got no match. Did we
516  * get no match because all the authorities have connections
517  * fetching server descriptors (in which case we should just
518  * return,) or because all the authorities are down or on fire or
519  * unreachable or something (in which case we should go on with
520  * our fallback code)? */
521  pds_flags &= ~(PDS_NO_EXISTING_SERVERDESC_FETCH|
523  rs = router_pick_trusteddirserver(type, pds_flags);
524  if (rs) {
525  log_debug(LD_DIR, "Deferring serverdesc fetch: all authorities "
526  "are in use.");
527  return;
528  }
529  }
530  if (rs == NULL && require_authority) {
531  log_info(LD_DIR, "No authorities were available for %s: will try "
532  "later.", dir_conn_purpose_to_string(dir_purpose));
533  return;
534  }
535  }
536  if (!rs && !(type & BRIDGE_DIRINFO)) {
537  rs = directory_pick_generic_dirserver(type, pds_flags,
538  dir_purpose,
539  &guard_state);
540  if (!rs)
541  get_via_tor = 1; /* last resort: try routing it via Tor */
542  }
543  }
544  }
545 
546  if (get_via_tor) {
547  /* Never use fascistfirewall; we're going via Tor. */
548  pds_flags |= PDS_IGNORE_FASCISTFIREWALL;
549  rs = router_pick_directory_server(type, pds_flags);
550  }
551 
552  /* If we have any hope of building an indirect conn, we know some router
553  * descriptors. If (rs==NULL), we can't build circuits anyway, so
554  * there's no point in falling back to the authorities in this case. */
555  if (rs) {
556  const dir_indirection_t indirection =
557  get_via_tor ? DIRIND_ANONYMOUS : DIRIND_ONEHOP;
558  directory_request_t *req = directory_request_new(dir_purpose);
560  directory_request_set_router_purpose(req, router_purpose);
561  directory_request_set_indirection(req, indirection);
562  directory_request_set_resource(req, resource);
563  if (dir_purpose == DIR_PURPOSE_FETCH_CONSENSUS)
565  if (guard_state)
566  directory_request_set_guard_state(req, guard_state);
568  directory_request_free(req);
569  } else {
570  log_notice(LD_DIR,
571  "While fetching directory info, "
572  "no running dirservers known. Will try again later. "
573  "(purpose %d)", dir_purpose);
574  if (!purpose_needs_anonymity(dir_purpose, router_purpose, resource)) {
575  /* remember we tried them all and failed. */
576  directory_all_unreachable(time(NULL));
577  }
578  }
579 }
580 
581 /** As directory_get_from_dirserver, but initiates a request to <i>every</i>
582  * directory authority other than ourself. Only for use by authorities when
583  * searching for missing information while voting. */
584 void
586  uint8_t router_purpose,
587  const char *resource)
588 {
589  tor_assert(dir_purpose == DIR_PURPOSE_FETCH_STATUS_VOTE ||
591 
592  SMARTLIST_FOREACH_BEGIN(router_get_trusted_dir_servers(),
593  dir_server_t *, ds) {
594  if (router_digest_is_me(ds->digest))
595  continue;
596  if (!(ds->type & V3_DIRINFO))
597  continue;
598  const routerstatus_t *rs = &ds->fake_status;
599  directory_request_t *req = directory_request_new(dir_purpose);
601  directory_request_set_router_purpose(req, router_purpose);
602  directory_request_set_resource(req, resource);
604  directory_request_free(req);
605  } SMARTLIST_FOREACH_END(ds);
606 }
607 
608 /** Return true iff <b>ind</b> requires a multihop circuit. */
609 static int
611 {
612  return ind == DIRIND_ANON_DIRPORT || ind == DIRIND_ANONYMOUS;
613 }
614 
615 /* Choose reachable OR and Dir addresses and ports from status, copying them
616  * into use_or_ap and use_dir_ap. If indirection is anonymous, then we're
617  * connecting via another relay, so choose the primary IPv4 address and ports.
618  *
619  * status should have at least one reachable address, if we can't choose a
620  * reachable address, warn and return -1. Otherwise, return 0.
621  */
622 static int
623 directory_choose_address_routerstatus(const routerstatus_t *status,
624  dir_indirection_t indirection,
625  tor_addr_port_t *use_or_ap,
626  tor_addr_port_t *use_dir_ap)
627 {
628  tor_assert(status != NULL);
629  tor_assert(use_or_ap != NULL);
630  tor_assert(use_dir_ap != NULL);
631 
632  const or_options_t *options = get_options();
633  int have_or = 0, have_dir = 0;
634 
635  /* We expect status to have at least one reachable address if we're
636  * connecting to it directly.
637  *
638  * Therefore, we can simply use the other address if the one we want isn't
639  * allowed by the firewall.
640  *
641  * (When Tor uploads and downloads a hidden service descriptor, it uses
642  * DIRIND_ANONYMOUS. Even Single Onion Servers (NYI) use DIRIND_ANONYMOUS,
643  * to avoid HSDirs denying service by rejecting descriptors.)
644  */
645 
646  /* Initialise the OR / Dir addresses */
647  tor_addr_make_null(&use_or_ap->addr, AF_UNSPEC);
648  use_or_ap->port = 0;
649  tor_addr_make_null(&use_dir_ap->addr, AF_UNSPEC);
650  use_dir_ap->port = 0;
651 
652  /* ORPort connections */
653  if (indirection == DIRIND_ANONYMOUS) {
654  if (status->addr) {
655  /* Since we're going to build a 3-hop circuit and ask the 2nd relay
656  * to extend to this address, always use the primary (IPv4) OR address */
657  tor_addr_from_ipv4h(&use_or_ap->addr, status->addr);
658  use_or_ap->port = status->or_port;
659  have_or = 1;
660  }
661  } else if (indirection == DIRIND_ONEHOP) {
662  /* We use an IPv6 address if we have one and we prefer it.
663  * Use the preferred address and port if they are reachable, otherwise,
664  * use the alternate address and port (if any).
665  */
666  fascist_firewall_choose_address_rs(status, FIREWALL_OR_CONNECTION, 0,
667  use_or_ap);
668  have_or = tor_addr_port_is_valid_ap(use_or_ap, 0);
669  }
670 
671  /* DirPort connections
672  * DIRIND_ONEHOP uses ORPort, but may fall back to the DirPort on relays */
673  if (indirection == DIRIND_DIRECT_CONN ||
674  indirection == DIRIND_ANON_DIRPORT ||
675  (indirection == DIRIND_ONEHOP
676  && !dirclient_must_use_begindir(options))) {
677  fascist_firewall_choose_address_rs(status, FIREWALL_DIR_CONNECTION, 0,
678  use_dir_ap);
679  have_dir = tor_addr_port_is_valid_ap(use_dir_ap, 0);
680  }
681 
682  /* We rejected all addresses in the relay's status. This means we can't
683  * connect to it. */
684  if (!have_or && !have_dir) {
685  static int logged_backtrace = 0;
686  log_info(LD_BUG, "Rejected all OR and Dir addresses from %s when "
687  "launching an outgoing directory connection to: IPv4 %s OR %d "
688  "Dir %d IPv6 %s OR %d Dir %d", routerstatus_describe(status),
689  fmt_addr32(status->addr), status->or_port,
690  status->dir_port, fmt_addr(&status->ipv6_addr),
691  status->ipv6_orport, status->dir_port);
692  if (!logged_backtrace) {
693  log_backtrace(LOG_INFO, LD_BUG, "Addresses came from");
694  logged_backtrace = 1;
695  }
696  return -1;
697  }
698 
699  return 0;
700 }
701 
702 /** Return true iff <b>conn</b> is the client side of a directory connection
703  * we launched to ourself in order to determine the reachability of our
704  * dir_port. */
705 static int
707 {
708  if (conn->requested_resource &&
709  !strcmpstart(conn->requested_resource,"authority")) {
711  if (me &&
713  tor_addr_eq_ipv4h(&conn->base_.addr, me->addr) && /*XXXX prop 118*/
714  me->dir_port == conn->base_.port)
715  return 1;
716  }
717  return 0;
718 }
719 
720 /** Called when we are unable to complete the client's request to a directory
721  * server due to a network error: Mark the router as down and try again if
722  * possible.
723  */
724 void
726 {
727  if (conn->guard_state) {
728  /* We haven't seen a success on this guard state, so consider it to have
729  * failed. */
731  }
733  return; /* this was a test fetch. don't retry. */
734  }
736  router_set_status(conn->identity_digest, 0); /* don't try this one again */
737  if (conn->base_.purpose == DIR_PURPOSE_FETCH_SERVERDESC ||
738  conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO) {
739  log_info(LD_DIR, "Giving up on serverdesc/extrainfo fetch from "
740  "directory server at '%s'; retrying",
741  conn->base_.address);
745  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_CONSENSUS) {
746  if (conn->requested_resource)
748  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_CERTIFICATE) {
749  log_info(LD_DIR, "Giving up on certificate fetch from directory server "
750  "at '%s'; retrying",
751  conn->base_.address);
753  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_DETACHED_SIGNATURES) {
754  log_info(LD_DIR, "Giving up downloading detached signatures from '%s'",
755  conn->base_.address);
756  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_STATUS_VOTE) {
757  log_info(LD_DIR, "Giving up downloading votes from '%s'",
758  conn->base_.address);
759  } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC) {
760  log_info(LD_DIR, "Giving up on downloading microdescriptors from "
761  "directory server at '%s'; will retry", conn->base_.address);
763  }
764 }
765 
766 /** Helper: Attempt to fetch directly the descriptors of each bridge
767  * listed in <b>failed</b>.
768  */
769 static void
771 {
772  char digest[DIGEST_LEN];
773  SMARTLIST_FOREACH(descs, const char *, cp,
774  {
775  if (base16_decode(digest, DIGEST_LEN, cp, strlen(cp)) != DIGEST_LEN) {
776  log_warn(LD_BUG, "Malformed fingerprint in list: %s",
777  escaped(cp));
778  continue;
779  }
781  });
782 }
783 
784 /** Called when an attempt to download one or more router descriptors
785  * or extra-info documents on connection <b>conn</b> failed.
786  */
787 static void
789 {
790  /* No need to increment the failure count for routerdescs, since
791  * it's not their fault. */
792 
793  /* No need to relaunch descriptor downloads here: we already do it
794  * every 10 or 60 seconds (FOO_DESCRIPTOR_RETRY_INTERVAL) in main.c. */
796  conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO ||
797  conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC);
798 
799  (void) conn;
800 }
801 
802 /** Called when an attempt to download a bridge's routerdesc from
803  * one of the authorities failed due to a network error. If
804  * possible attempt to download descriptors from the bridge directly.
805  */
806 static void
808 {
809  smartlist_t *which = NULL;
810 
811  /* Requests for bridge descriptors are in the form 'fp/', so ignore
812  anything else. */
813  if (!conn->requested_resource || strcmpstart(conn->requested_resource,"fp/"))
814  return;
815 
816  which = smartlist_new();
818  + strlen("fp/"),
819  which, NULL, 0);
820 
822  if (smartlist_len(which)) {
824  SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
825  }
826  smartlist_free(which);
827 }
828 
829 /** Called when an attempt to fetch a certificate fails. */
830 static void
832 {
833  const char *fp_pfx = "fp/";
834  const char *fpsk_pfx = "fp-sk/";
835  smartlist_t *failed;
837 
838  if (!conn->requested_resource)
839  return;
840  failed = smartlist_new();
841  /*
842  * We have two cases download by fingerprint (resource starts
843  * with "fp/") or download by fingerprint/signing key pair
844  * (resource starts with "fp-sk/").
845  */
846  if (!strcmpstart(conn->requested_resource, fp_pfx)) {
847  /* Download by fingerprint case */
849  strlen(fp_pfx),
850  failed, NULL, DSR_HEX);
851  SMARTLIST_FOREACH_BEGIN(failed, char *, cp) {
852  /* Null signing key digest indicates download by fp only */
853  authority_cert_dl_failed(cp, NULL, status);
854  tor_free(cp);
855  } SMARTLIST_FOREACH_END(cp);
856  } else if (!strcmpstart(conn->requested_resource, fpsk_pfx)) {
857  /* Download by (fp,sk) pairs */
859  strlen(fpsk_pfx), failed);
860  SMARTLIST_FOREACH_BEGIN(failed, fp_pair_t *, cp) {
861  authority_cert_dl_failed(cp->first, cp->second, status);
862  tor_free(cp);
863  } SMARTLIST_FOREACH_END(cp);
864  } else {
865  log_warn(LD_DIR,
866  "Don't know what to do with failure for cert fetch %s",
867  conn->requested_resource);
868  }
869 
870  smartlist_free(failed);
871 
872  update_certificate_downloads(time(NULL));
873 }
874 
875 /** Evaluate the situation and decide if we should use an encrypted
876  * "begindir-style" connection for this directory request.
877  * 0) If there is no DirPort, yes.
878  * 1) If or_port is 0, or it's a direct conn and or_port is firewalled
879  * or we're a dir mirror, no.
880  * 2) If we prefer to avoid begindir conns, and we're not fetching or
881  * publishing a bridge relay descriptor, no.
882  * 3) Else yes.
883  * If returning 0, return in *reason why we can't use begindir.
884  * reason must not be NULL.
885  */
886 static int
888  const directory_request_t *req,
889  const char **reason)
890 {
891  const tor_addr_t *or_addr = &req->or_addr_port.addr;
892  //const tor_addr_t *dir_addr = &req->dir_addr_port.addr;
893  const int or_port = req->or_addr_port.port;
894  const int dir_port = req->dir_addr_port.port;
895 
896  const dir_indirection_t indirection = req->indirection;
897 
898  tor_assert(reason);
899  *reason = NULL;
900 
901  /* Reasons why we must use begindir */
902  if (!dir_port) {
903  *reason = "(using begindir - directory with no DirPort)";
904  return 1; /* We don't know a DirPort -- must begindir. */
905  }
906  /* Reasons why we can't possibly use begindir */
907  if (!or_port) {
908  *reason = "directory with unknown ORPort";
909  return 0; /* We don't know an ORPort -- no chance. */
910  }
911  if (indirection == DIRIND_DIRECT_CONN ||
912  indirection == DIRIND_ANON_DIRPORT) {
913  *reason = "DirPort connection";
914  return 0;
915  }
916  if (indirection == DIRIND_ONEHOP) {
917  /* We're firewalled and want a direct OR connection */
918  if (!fascist_firewall_allows_address_addr(or_addr, or_port,
919  FIREWALL_OR_CONNECTION, 0, 0)) {
920  *reason = "ORPort not reachable";
921  return 0;
922  }
923  }
924  /* Reasons why we want to avoid using begindir */
925  if (indirection == DIRIND_ONEHOP) {
926  if (!dirclient_must_use_begindir(options)) {
927  *reason = "in relay mode";
928  return 0;
929  }
930  }
931  /* DIRIND_ONEHOP on a client, or DIRIND_ANONYMOUS
932  */
933  *reason = "(using begindir)";
934  return 1;
935 }
936 
937 /**
938  * Create and return a new directory_request_t with purpose
939  * <b>dir_purpose</b>.
940  */
942 directory_request_new(uint8_t dir_purpose)
943 {
944  tor_assert(dir_purpose >= DIR_PURPOSE_MIN_);
945  tor_assert(dir_purpose <= DIR_PURPOSE_MAX_);
946  tor_assert(dir_purpose != DIR_PURPOSE_SERVER);
949 
950  directory_request_t *result = tor_malloc_zero(sizeof(*result));
951  tor_addr_make_null(&result->or_addr_port.addr, AF_INET);
952  result->or_addr_port.port = 0;
953  tor_addr_make_null(&result->dir_addr_port.addr, AF_INET);
954  result->dir_addr_port.port = 0;
955  result->dir_purpose = dir_purpose;
956  result->router_purpose = ROUTER_PURPOSE_GENERAL;
957  result->indirection = DIRIND_ONEHOP;
958  return result;
959 }
960 /**
961  * Release all resources held by <b>req</b>.
962  */
963 void
965 {
966  if (req == NULL)
967  return;
968  config_free_lines(req->additional_headers);
969  tor_free(req);
970 }
971 /**
972  * Set the address and OR port to use for this directory request. If there is
973  * no OR port, we'll have to connect over the dirport. (If there are both,
974  * the indirection setting determines which to use.)
975  */
976 void
978  const tor_addr_port_t *p)
979 {
980  memcpy(&req->or_addr_port, p, sizeof(*p));
981 }
982 /**
983  * Set the address and dirport to use for this directory request. If there
984  * is no dirport, we'll have to connect over the OR port. (If there are both,
985  * the indirection setting determines which to use.)
986  */
987 void
989  const tor_addr_port_t *p)
990 {
991  memcpy(&req->dir_addr_port, p, sizeof(*p));
992 }
993 /**
994  * Set the RSA identity digest of the directory to use for this directory
995  * request.
996  */
997 void
999  const char *digest)
1000 {
1001  memcpy(req->digest, digest, DIGEST_LEN);
1002 }
1003 /**
1004  * Set the router purpose associated with uploaded and downloaded router
1005  * descriptors and extrainfo documents in this directory request. The purpose
1006  * must be one of ROUTER_PURPOSE_GENERAL (the default) or
1007  * ROUTER_PURPOSE_BRIDGE.
1008  */
1009 void
1011  uint8_t router_purpose)
1012 {
1013  tor_assert(router_purpose == ROUTER_PURPOSE_GENERAL ||
1014  router_purpose == ROUTER_PURPOSE_BRIDGE);
1015  // assert that it actually makes sense to set this purpose, given
1016  // the dir_purpose.
1017  req->router_purpose = router_purpose;
1018 }
1019 /**
1020  * Set the indirection to be used for the directory request. The indirection
1021  * parameter configures whether to connect to a DirPort or ORPort, and whether
1022  * to anonymize the connection. DIRIND_ONEHOP (use ORPort, don't anonymize)
1023  * is the default. See dir_indirection_t for more information.
1024  */
1025 void
1027  dir_indirection_t indirection)
1028 {
1029  req->indirection = indirection;
1030 }
1031 
1032 /**
1033  * Set a pointer to the resource to request from a directory. Different
1034  * request types use resources to indicate different components of their URL.
1035  * Note that only an alias to <b>resource</b> is stored, so the
1036  * <b>resource</b> must outlive the request.
1037  */
1038 void
1040  const char *resource)
1041 {
1042  req->resource = resource;
1043 }
1044 /**
1045  * Set a pointer to the payload to include with this directory request, along
1046  * with its length. Note that only an alias to <b>payload</b> is stored, so
1047  * the <b>payload</b> must outlive the request.
1048  */
1049 void
1051  const char *payload,
1052  size_t payload_len)
1053 {
1054  tor_assert(DIR_PURPOSE_IS_UPLOAD(req->dir_purpose));
1055 
1056  req->payload = payload;
1057  req->payload_len = payload_len;
1058 }
1059 /**
1060  * Set an if-modified-since date to send along with the request. The
1061  * default is 0 (meaning, send no if-modified-since header).
1062  */
1063 void
1065  time_t if_modified_since)
1066 {
1067  req->if_modified_since = if_modified_since;
1068 }
1069 
1070 /** Include a header of name <b>key</b> with content <b>val</b> in the
1071  * request. Neither may include newlines or other odd characters. Their
1072  * ordering is not currently guaranteed.
1073  *
1074  * Note that, as elsewhere in this module, header keys include a trailing
1075  * colon and space.
1076  */
1077 void
1079  const char *key,
1080  const char *val)
1081 {
1082  config_line_prepend(&req->additional_headers, key, val);
1083 }
1084 /**
1085  * Set an object containing HS data to be associated with this request. Note
1086  * that only an alias to <b>query</b> is stored, so the <b>query</b> object
1087  * must outlive the request.
1088  */
1089 void
1091  const rend_data_t *query)
1092 {
1093  if (query) {
1094  tor_assert(req->dir_purpose == DIR_PURPOSE_FETCH_RENDDESC_V2 ||
1095  req->dir_purpose == DIR_PURPOSE_UPLOAD_RENDDESC_V2);
1096  }
1097  req->rend_query = query;
1098 }
1099 /**
1100  * Set an object containing HS connection identifier to be associated with
1101  * this request. Note that only an alias to <b>ident</b> is stored, so the
1102  * <b>ident</b> object must outlive the request.
1103  */
1104 void
1106  const hs_ident_dir_conn_t *ident)
1107 {
1108  if (ident) {
1109  tor_assert(req->dir_purpose == DIR_PURPOSE_UPLOAD_HSDESC);
1110  }
1111  req->hs_ident = ident;
1112 }
1113 /**
1114  * Set an object containing HS connection identifier to be associated with
1115  * this fetch request. Note that only an alias to <b>ident</b> is stored, so
1116  * the <b>ident</b> object must outlive the request.
1117  */
1118 void
1120  const hs_ident_dir_conn_t *ident)
1121 {
1122  if (ident) {
1123  tor_assert(req->dir_purpose == DIR_PURPOSE_FETCH_HSDESC);
1124  }
1125  req->hs_ident = ident;
1126 }
1127 /** Set a static circuit_guard_state_t object to affliate with the request in
1128  * <b>req</b>. This object will receive notification when the attempt to
1129  * connect to the guard either succeeds or fails. */
1130 void
1132  circuit_guard_state_t *state)
1133 {
1134  req->guard_state = state;
1135 }
1136 
1137 /**
1138  * Internal: Return true if any information for contacting the directory in
1139  * <b>req</b> has been set, other than by the routerstatus. */
1140 static int
1142 {
1143  /* We only check for ports here, since we don't use an addr unless the port
1144  * is set */
1145  return (req->or_addr_port.port ||
1146  req->dir_addr_port.port ||
1147  ! tor_digest_is_zero(req->digest));
1148 }
1149 
1150 /**
1151  * Set the routerstatus to use for the directory associated with this
1152  * request. If this option is set, then no other function to set the
1153  * directory's address or identity should be called.
1154  */
1155 void
1157  const routerstatus_t *status)
1158 {
1159  req->routerstatus = status;
1160 }
1161 /**
1162  * Helper: update the addresses, ports, and identities in <b>req</b>
1163  * from the routerstatus object in <b>req</b>. Return 0 on success.
1164  * On failure, warn and return -1.
1165  */
1166 static int
1168 
1169 {
1170  const routerstatus_t *status = req->routerstatus;
1171  if (BUG(status == NULL))
1172  return -1;
1173  const or_options_t *options = get_options();
1174  const node_t *node;
1175  tor_addr_port_t use_or_ap, use_dir_ap;
1176  const int anonymized_connection = dirind_is_anon(req->indirection);
1177 
1178  tor_assert(status != NULL);
1179 
1180  node = node_get_by_id(status->identity_digest);
1181 
1182  /* XXX The below check is wrong: !node means it's not in the consensus,
1183  * but we haven't checked if we have a descriptor for it -- and also,
1184  * we only care about the descriptor if it's a begindir-style anonymized
1185  * connection. */
1186  if (!node && anonymized_connection) {
1187  log_info(LD_DIR, "Not sending anonymized request to directory '%s'; we "
1188  "don't have its router descriptor.",
1189  routerstatus_describe(status));
1190  return -1;
1191  }
1192 
1193  if (options->ExcludeNodes && options->StrictNodes &&
1194  routerset_contains_routerstatus(options->ExcludeNodes, status, -1)) {
1195  log_warn(LD_DIR, "Wanted to contact directory mirror %s for %s, but "
1196  "it's in our ExcludedNodes list and StrictNodes is set. "
1197  "Skipping. This choice might make your Tor not work.",
1198  routerstatus_describe(status),
1199  dir_conn_purpose_to_string(req->dir_purpose));
1200  return -1;
1201  }
1202 
1203  /* At this point, if we are a client making a direct connection to a
1204  * directory server, we have selected a server that has at least one address
1205  * allowed by ClientUseIPv4/6 and Reachable{"",OR,Dir}Addresses. This
1206  * selection uses the preference in ClientPreferIPv6{OR,Dir}Port, if
1207  * possible. (If UseBridges is set, clients always use IPv6, and prefer it
1208  * by default.)
1209  *
1210  * Now choose an address that we can use to connect to the directory server.
1211  */
1212  if (directory_choose_address_routerstatus(status,
1213  req->indirection, &use_or_ap,
1214  &use_dir_ap) < 0) {
1215  return -1;
1216  }
1217 
1218  directory_request_set_or_addr_port(req, &use_or_ap);
1219  directory_request_set_dir_addr_port(req, &use_dir_ap);
1220  directory_request_set_directory_id_digest(req, status->identity_digest);
1221  return 0;
1222 }
1223 
1224 /**
1225  * Launch the provided directory request, configured in <b>request</b>.
1226  * After this function is called, you can free <b>request</b>.
1227  */
1228 MOCK_IMPL(void,
1230 {
1231  tor_assert(request);
1232  if (request->routerstatus) {
1233  tor_assert_nonfatal(
1236  return;
1237  }
1238  }
1239 
1240  const tor_addr_port_t *or_addr_port = &request->or_addr_port;
1241  const tor_addr_port_t *dir_addr_port = &request->dir_addr_port;
1242  const char *digest = request->digest;
1243  const uint8_t dir_purpose = request->dir_purpose;
1244  const uint8_t router_purpose = request->router_purpose;
1245  const dir_indirection_t indirection = request->indirection;
1246  const char *resource = request->resource;
1247  const rend_data_t *rend_query = request->rend_query;
1248  const hs_ident_dir_conn_t *hs_ident = request->hs_ident;
1249  circuit_guard_state_t *guard_state = request->guard_state;
1250 
1251  tor_assert(or_addr_port->port || dir_addr_port->port);
1252  tor_assert(digest);
1253 
1254  dir_connection_t *conn;
1255  const or_options_t *options = get_options();
1256  int socket_error = 0;
1257  const char *begindir_reason = NULL;
1258  /* Should the connection be to a relay's OR port (and inside that we will
1259  * send our directory request)? */
1260  const int use_begindir =
1261  directory_command_should_use_begindir(options, request, &begindir_reason);
1262 
1263  /* Will the connection go via a three-hop Tor circuit? Note that this
1264  * is separate from whether it will use_begindir. */
1265  const int anonymized_connection = dirind_is_anon(indirection);
1266 
1267  /* What is the address we want to make the directory request to? If
1268  * we're making a begindir request this is the ORPort of the relay
1269  * we're contacting; if not a begindir request, this is its DirPort.
1270  * Note that if anonymized_connection is true, we won't be initiating
1271  * a connection directly to this address. */
1272  tor_addr_t addr;
1273  tor_addr_copy(&addr, &(use_begindir ? or_addr_port : dir_addr_port)->addr);
1274  uint16_t port = (use_begindir ? or_addr_port : dir_addr_port)->port;
1275 
1276  log_debug(LD_DIR, "anonymized %d, use_begindir %d.",
1277  anonymized_connection, use_begindir);
1278 
1279  log_debug(LD_DIR, "Initiating %s", dir_conn_purpose_to_string(dir_purpose));
1280 
1281  if (purpose_needs_anonymity(dir_purpose, router_purpose, resource)) {
1282  tor_assert(anonymized_connection ||
1283  rend_non_anonymous_mode_enabled(options));
1284  }
1285 
1286  /* use encrypted begindir connections for everything except relays
1287  * this provides better protection for directory fetches */
1288  if (!use_begindir && dirclient_must_use_begindir(options)) {
1289  log_warn(LD_BUG, "Client could not use begindir connection: %s",
1290  begindir_reason ? begindir_reason : "(NULL)");
1291  return;
1292  }
1293 
1294  /* ensure that we don't make direct connections when a SOCKS server is
1295  * configured. */
1296  if (!anonymized_connection && !use_begindir && !options->HTTPProxy &&
1297  (options->Socks4Proxy || options->Socks5Proxy)) {
1298  log_warn(LD_DIR, "Cannot connect to a directory server through a "
1299  "SOCKS proxy!");
1300  return;
1301  }
1302 
1303  /* Make sure that the destination addr and port we picked is viable. */
1304  if (!port || tor_addr_is_null(&addr)) {
1305  static int logged_backtrace = 0;
1306  log_warn(LD_DIR,
1307  "Cannot make an outgoing %sconnection without a remote %sPort.",
1308  use_begindir ? "begindir " : "",
1309  use_begindir ? "OR" : "Dir");
1310  if (!logged_backtrace) {
1311  log_backtrace(LOG_INFO, LD_BUG, "Address came from");
1312  logged_backtrace = 1;
1313  }
1314  return;
1315  }
1316 
1317  conn = dir_connection_new(tor_addr_family(&addr));
1318 
1319  /* set up conn so it's got all the data we need to remember */
1320  tor_addr_copy(&conn->base_.addr, &addr);
1321  conn->base_.port = port;
1322  conn->base_.address = tor_addr_to_str_dup(&addr);
1323  memcpy(conn->identity_digest, digest, DIGEST_LEN);
1324 
1325  conn->base_.purpose = dir_purpose;
1326  conn->router_purpose = router_purpose;
1327 
1328  /* give it an initial state */
1329  conn->base_.state = DIR_CONN_STATE_CONNECTING;
1330 
1331  /* decide whether we can learn our IP address from this conn */
1332  /* XXXX This is a bad name for this field now. */
1333  conn->dirconn_direct = !anonymized_connection;
1334 
1335  /* copy rendezvous data, if any */
1336  if (rend_query) {
1337  /* We can't have both v2 and v3+ identifier. */
1338  tor_assert_nonfatal(!hs_ident);
1339  conn->rend_data = rend_data_dup(rend_query);
1340  }
1341  if (hs_ident) {
1342  /* We can't have both v2 and v3+ identifier. */
1343  tor_assert_nonfatal(!rend_query);
1344  conn->hs_ident = hs_ident_dir_conn_dup(hs_ident);
1345  }
1346 
1347  if (!anonymized_connection && !use_begindir) {
1348  /* then we want to connect to dirport directly */
1349 
1350  if (options->HTTPProxy) {
1351  tor_addr_copy(&addr, &options->HTTPProxyAddr);
1352  port = options->HTTPProxyPort;
1353  }
1354 
1355  // In this case we should not have picked a directory guard.
1356  if (BUG(guard_state)) {
1357  entry_guard_cancel(&guard_state);
1358  }
1359 
1360  switch (connection_connect(TO_CONN(conn), conn->base_.address, &addr,
1361  port, &socket_error)) {
1362  case -1:
1363  connection_mark_for_close(TO_CONN(conn));
1364  return;
1365  case 1:
1366  /* start flushing conn */
1367  conn->base_.state = DIR_CONN_STATE_CLIENT_SENDING;
1368  /* fall through */
1369  case 0:
1370  /* queue the command on the outbuf */
1371  directory_send_command(conn, 1, request);
1373  /* writable indicates finish, readable indicates broken link,
1374  error indicates broken link in windowsland. */
1375  }
1376  } else {
1377  /* We will use a Tor circuit (maybe 1-hop, maybe 3-hop, maybe with
1378  * begindir, maybe not with begindir) */
1379 
1380  entry_connection_t *linked_conn;
1381 
1382  /* Anonymized tunneled connections can never share a circuit.
1383  * One-hop directory connections can share circuits with each other
1384  * but nothing else. */
1385  int iso_flags = anonymized_connection ? ISO_STREAM : ISO_SESSIONGRP;
1386 
1387  /* If it's an anonymized connection, remember the fact that we
1388  * wanted it for later: maybe we'll want it again soon. */
1389  if (anonymized_connection && use_begindir)
1390  rep_hist_note_used_internal(time(NULL), 0, 1);
1391  else if (anonymized_connection && !use_begindir)
1392  rep_hist_note_used_port(time(NULL), conn->base_.port);
1393 
1394  // In this case we should not have a directory guard; we'll
1395  // get a regular guard later when we build the circuit.
1396  if (BUG(anonymized_connection && guard_state)) {
1397  entry_guard_cancel(&guard_state);
1398  }
1399 
1400  conn->guard_state = guard_state;
1401 
1402  /* make an AP connection
1403  * populate it and add it at the right state
1404  * hook up both sides
1405  */
1406  linked_conn =
1408  conn->base_.address, conn->base_.port,
1409  digest,
1410  SESSION_GROUP_DIRCONN, iso_flags,
1411  use_begindir, !anonymized_connection);
1412  if (!linked_conn) {
1413  log_warn(LD_NET,"Making tunnel to dirserver failed.");
1414  connection_mark_for_close(TO_CONN(conn));
1415  return;
1416  }
1417 
1418  if (connection_add(TO_CONN(conn)) < 0) {
1419  log_warn(LD_NET,"Unable to add connection for link to dirserver.");
1420  connection_mark_for_close(TO_CONN(conn));
1421  return;
1422  }
1423  conn->base_.state = DIR_CONN_STATE_CLIENT_SENDING;
1424  /* queue the command on the outbuf */
1425  directory_send_command(conn, 0, request);
1426 
1429  }
1430 }
1431 
1432 /** Helper for sorting
1433  *
1434  * sort strings alphabetically
1435  *
1436  * XXXX we have a smartlist_sort_strings() function, right?
1437  */
1438 static int
1439 compare_strs_(const void **a, const void **b)
1440 {
1441  const char *s1 = *a, *s2 = *b;
1442  return strcmp(s1, s2);
1443 }
1444 
1445 #define CONDITIONAL_CONSENSUS_FPR_LEN 3
1446 #if (CONDITIONAL_CONSENSUS_FPR_LEN > DIGEST_LEN)
1447 #error "conditional consensus fingerprint length is larger than digest length"
1448 #endif
1449 
1450 /** Return the URL we should use for a consensus download.
1451  *
1452  * Use the "conditional consensus downloading" feature described in
1453  * dir-spec.txt, i.e.
1454  * GET .../consensus/<b>fpr</b>+<b>fpr</b>+<b>fpr</b>
1455  *
1456  * If 'resource' is provided, it is the name of a consensus flavor to request.
1457  */
1458 static char *
1459 directory_get_consensus_url(const char *resource)
1460 {
1461  char *url = NULL;
1462  const char *hyphen, *flavor;
1463  if (resource==NULL || strcmp(resource, "ns")==0) {
1464  flavor = ""; /* Request ns consensuses as "", so older servers will work*/
1465  hyphen = "";
1466  } else {
1467  flavor = resource;
1468  hyphen = "-";
1469  }
1470 
1471  {
1472  char *authority_id_list;
1473  smartlist_t *authority_digests = smartlist_new();
1474 
1475  SMARTLIST_FOREACH_BEGIN(router_get_trusted_dir_servers(),
1476  dir_server_t *, ds) {
1477  char *hex;
1478  if (!(ds->type & V3_DIRINFO))
1479  continue;
1480 
1481  hex = tor_malloc(2*CONDITIONAL_CONSENSUS_FPR_LEN+1);
1482  base16_encode(hex, 2*CONDITIONAL_CONSENSUS_FPR_LEN+1,
1483  ds->v3_identity_digest, CONDITIONAL_CONSENSUS_FPR_LEN);
1484  smartlist_add(authority_digests, hex);
1485  } SMARTLIST_FOREACH_END(ds);
1486  smartlist_sort(authority_digests, compare_strs_);
1487  authority_id_list = smartlist_join_strings(authority_digests,
1488  "+", 0, NULL);
1489 
1490  tor_asprintf(&url, "/tor/status-vote/current/consensus%s%s/%s.z",
1491  hyphen, flavor, authority_id_list);
1492 
1493  SMARTLIST_FOREACH(authority_digests, char *, cp, tor_free(cp));
1494  smartlist_free(authority_digests);
1495  tor_free(authority_id_list);
1496  }
1497  return url;
1498 }
1499 
1500 /**
1501  * Copies the ipv6 from source to destination, subject to buffer size limit
1502  * size. If decorate is true, makes sure the copied address is decorated.
1503  */
1504 static void
1505 copy_ipv6_address(char* destination, const char* source, size_t len,
1506  int decorate) {
1507  tor_assert(destination);
1508  tor_assert(source);
1509 
1510  if (decorate && source[0] != '[') {
1511  tor_snprintf(destination, len, "[%s]", source);
1512  } else {
1513  strlcpy(destination, source, len);
1514  }
1515 }
1516 
1517 /** Queue an appropriate HTTP command for <b>request</b> on
1518  * <b>conn</b>->outbuf. If <b>direct</b> is true, we're making a
1519  * non-anonymized connection to the dirport.
1520  */
1521 static void
1523  const int direct,
1524  const directory_request_t *req)
1525 {
1526  tor_assert(req);
1527  const int purpose = req->dir_purpose;
1528  const char *resource = req->resource;
1529  const char *payload = req->payload;
1530  const size_t payload_len = req->payload_len;
1531  const time_t if_modified_since = req->if_modified_since;
1532  const int anonymized_connection = dirind_is_anon(req->indirection);
1533 
1534  char proxystring[256];
1535  char hoststring[128];
1536  /* NEEDS to be the same size hoststring.
1537  Will be decorated with brackets around it if it is ipv6. */
1538  char decorated_address[128];
1539  smartlist_t *headers = smartlist_new();
1540  char *url;
1541  char *accept_encoding;
1542  size_t url_len;
1543  char request[8192];
1544  size_t request_len, total_request_len = 0;
1545  const char *httpcommand = NULL;
1546 
1547  tor_assert(conn);
1548  tor_assert(conn->base_.type == CONN_TYPE_DIR);
1549 
1551  if (resource)
1552  conn->requested_resource = tor_strdup(resource);
1553 
1554  /* decorate the ip address if it is ipv6 */
1555  if (strchr(conn->base_.address, ':')) {
1556  copy_ipv6_address(decorated_address, conn->base_.address,
1557  sizeof(decorated_address), 1);
1558  } else {
1559  strlcpy(decorated_address, conn->base_.address, sizeof(decorated_address));
1560  }
1561 
1562  /* come up with a string for which Host: we want */
1563  if (conn->base_.port == 80) {
1564  strlcpy(hoststring, decorated_address, sizeof(hoststring));
1565  } else {
1566  tor_snprintf(hoststring, sizeof(hoststring), "%s:%d",
1567  decorated_address, conn->base_.port);
1568  }
1569 
1570  /* Format if-modified-since */
1571  if (if_modified_since) {
1572  char b[RFC1123_TIME_LEN+1];
1573  format_rfc1123_time(b, if_modified_since);
1574  smartlist_add_asprintf(headers, "If-Modified-Since: %s\r\n", b);
1575  }
1576 
1577  /* come up with some proxy lines, if we're using one. */
1578  if (direct && get_options()->HTTPProxy) {
1579  char *base64_authenticator=NULL;
1580  const char *authenticator = get_options()->HTTPProxyAuthenticator;
1581 
1582  tor_snprintf(proxystring, sizeof(proxystring),"http://%s", hoststring);
1583  if (authenticator) {
1584  base64_authenticator = alloc_http_authenticator(authenticator);
1585  if (!base64_authenticator)
1586  log_warn(LD_BUG, "Encoding http authenticator failed");
1587  }
1588  if (base64_authenticator) {
1589  smartlist_add_asprintf(headers,
1590  "Proxy-Authorization: Basic %s\r\n",
1591  base64_authenticator);
1592  tor_free(base64_authenticator);
1593  }
1594  } else {
1595  proxystring[0] = 0;
1596  }
1597 
1598  if (! anonymized_connection) {
1599  /* Add Accept-Encoding. */
1600  accept_encoding = accept_encoding_header();
1601  smartlist_add_asprintf(headers, "Accept-Encoding: %s\r\n",
1602  accept_encoding);
1603  tor_free(accept_encoding);
1604  }
1605 
1606  /* Add additional headers, if any */
1607  {
1608  config_line_t *h;
1609  for (h = req->additional_headers; h; h = h->next) {
1610  smartlist_add_asprintf(headers, "%s%s\r\n", h->key, h->value);
1611  }
1612  }
1613 
1614  switch (purpose) {
1616  /* resource is optional. If present, it's a flavor name */
1617  tor_assert(!payload);
1618  httpcommand = "GET";
1619  url = directory_get_consensus_url(resource);
1620  log_info(LD_DIR, "Downloading consensus from %s using %s",
1621  hoststring, url);
1622  break;
1624  tor_assert(resource);
1625  tor_assert(!payload);
1626  httpcommand = "GET";
1627  tor_asprintf(&url, "/tor/keys/%s", resource);
1628  break;
1630  tor_assert(resource);
1631  tor_assert(!payload);
1632  httpcommand = "GET";
1633  tor_asprintf(&url, "/tor/status-vote/next/%s.z", resource);
1634  break;
1636  tor_assert(!resource);
1637  tor_assert(!payload);
1638  httpcommand = "GET";
1639  url = tor_strdup("/tor/status-vote/next/consensus-signatures.z");
1640  break;
1642  tor_assert(resource);
1643  httpcommand = "GET";
1644  tor_asprintf(&url, "/tor/server/%s", resource);
1645  break;
1647  tor_assert(resource);
1648  httpcommand = "GET";
1649  tor_asprintf(&url, "/tor/extra/%s", resource);
1650  break;
1652  tor_assert(resource);
1653  httpcommand = "GET";
1654  tor_asprintf(&url, "/tor/micro/%s", resource);
1655  break;
1656  case DIR_PURPOSE_UPLOAD_DIR: {
1657  const char *why = router_get_descriptor_gen_reason();
1658  tor_assert(!resource);
1659  tor_assert(payload);
1660  httpcommand = "POST";
1661  url = tor_strdup("/tor/");
1662  if (!why) {
1663  why = "for no reason at all";
1664  }
1665  smartlist_add_asprintf(headers, "X-Desc-Gen-Reason: %s\r\n", why);
1666  break;
1667  }
1669  tor_assert(!resource);
1670  tor_assert(payload);
1671  httpcommand = "POST";
1672  url = tor_strdup("/tor/post/vote");
1673  break;
1675  tor_assert(!resource);
1676  tor_assert(payload);
1677  httpcommand = "POST";
1678  url = tor_strdup("/tor/post/consensus-signature");
1679  break;
1681  tor_assert(resource);
1682  tor_assert(strlen(resource) <= REND_DESC_ID_V2_LEN_BASE32);
1683  tor_assert(!payload);
1684  httpcommand = "GET";
1685  tor_asprintf(&url, "/tor/rendezvous2/%s", resource);
1686  break;
1688  tor_assert(resource);
1689  tor_assert(strlen(resource) <= ED25519_BASE64_LEN);
1690  tor_assert(!payload);
1691  httpcommand = "GET";
1692  tor_asprintf(&url, "/tor/hs/3/%s", resource);
1693  break;
1695  tor_assert(!resource);
1696  tor_assert(payload);
1697  httpcommand = "POST";
1698  url = tor_strdup("/tor/rendezvous2/publish");
1699  break;
1701  tor_assert(resource);
1702  tor_assert(payload);
1703  httpcommand = "POST";
1704  tor_asprintf(&url, "/tor/hs/%s/publish", resource);
1705  break;
1706  default:
1707  tor_assert(0);
1708  return;
1709  }
1710 
1711  /* warn in the non-tunneled case */
1712  if (direct && (strlen(proxystring) + strlen(url) >= 4096)) {
1713  log_warn(LD_BUG,
1714  "Squid does not like URLs longer than 4095 bytes, and this "
1715  "one is %d bytes long: %s%s",
1716  (int)(strlen(proxystring) + strlen(url)), proxystring, url);
1717  }
1718 
1719  tor_snprintf(request, sizeof(request), "%s %s", httpcommand, proxystring);
1720 
1721  request_len = strlen(request);
1722  total_request_len += request_len;
1723  connection_buf_add(request, request_len, TO_CONN(conn));
1724 
1725  url_len = strlen(url);
1726  total_request_len += url_len;
1727  connection_buf_add(url, url_len, TO_CONN(conn));
1728  tor_free(url);
1729 
1730  if (!strcmp(httpcommand, "POST") || payload) {
1731  smartlist_add_asprintf(headers, "Content-Length: %lu\r\n",
1732  payload ? (unsigned long)payload_len : 0);
1733  }
1734 
1735  {
1736  char *header = smartlist_join_strings(headers, "", 0, NULL);
1737  tor_snprintf(request, sizeof(request), " HTTP/1.0\r\nHost: %s\r\n%s\r\n",
1738  hoststring, header);
1739  tor_free(header);
1740  }
1741 
1742  request_len = strlen(request);
1743  total_request_len += request_len;
1744  connection_buf_add(request, request_len, TO_CONN(conn));
1745 
1746  if (payload) {
1747  /* then send the payload afterwards too */
1748  connection_buf_add(payload, payload_len, TO_CONN(conn));
1749  total_request_len += payload_len;
1750  }
1751 
1752  SMARTLIST_FOREACH(headers, char *, h, tor_free(h));
1753  smartlist_free(headers);
1754 
1755  log_debug(LD_DIR,
1756  "Sent request to directory server '%s:%d': "
1757  "(purpose: %d, request size: %"TOR_PRIuSZ", "
1758  "payload size: %"TOR_PRIuSZ")",
1759  conn->base_.address, conn->base_.port,
1760  conn->base_.purpose,
1761  (total_request_len),
1762  (payload ? payload_len : 0));
1763 }
1764 
1765 /** Return true iff <b>body</b> doesn't start with a plausible router or
1766  * network-status or microdescriptor opening. This is a sign of possible
1767  * compression. */
1768 static int
1769 body_is_plausible(const char *body, size_t len, int purpose)
1770 {
1771  int i;
1772  if (len == 0)
1773  return 1; /* empty bodies don't need decompression */
1774  if (len < 32)
1775  return 0;
1776  if (purpose == DIR_PURPOSE_FETCH_MICRODESC) {
1777  return (!strcmpstart(body,"onion-key"));
1778  }
1779 
1780  if (!strcmpstart(body,"router") ||
1781  !strcmpstart(body,"network-status"))
1782  return 1;
1783  for (i=0;i<32;++i) {
1784  if (!TOR_ISPRINT(body[i]) && !TOR_ISSPACE(body[i]))
1785  return 0;
1786  }
1787 
1788  return 1;
1789 }
1790 
1791 /** Called when we've just fetched a bunch of router descriptors in
1792  * <b>body</b>. The list <b>which</b>, if present, holds digests for
1793  * descriptors we requested: descriptor digests if <b>descriptor_digests</b>
1794  * is true, or identity digests otherwise. Parse the descriptors, validate
1795  * them, and annotate them as having purpose <b>purpose</b> and as having been
1796  * downloaded from <b>source</b>.
1797  *
1798  * Return the number of routers actually added. */
1799 static int
1800 load_downloaded_routers(const char *body, smartlist_t *which,
1801  int descriptor_digests,
1802  int router_purpose,
1803  const char *source)
1804 {
1805  char buf[256];
1806  char time_buf[ISO_TIME_LEN+1];
1807  int added = 0;
1808  int general = router_purpose == ROUTER_PURPOSE_GENERAL;
1809  format_iso_time(time_buf, time(NULL));
1810  tor_assert(source);
1811 
1812  if (tor_snprintf(buf, sizeof(buf),
1813  "@downloaded-at %s\n"
1814  "@source %s\n"
1815  "%s%s%s", time_buf, escaped(source),
1816  !general ? "@purpose " : "",
1817  !general ? router_purpose_to_string(router_purpose) : "",
1818  !general ? "\n" : "")<0)
1819  return added;
1820 
1821  added = router_load_routers_from_string(body, NULL, SAVED_NOWHERE, which,
1822  descriptor_digests, buf);
1823  if (added && general)
1824  control_event_boot_dir(BOOTSTRAP_STATUS_LOADING_DESCRIPTORS,
1826  return added;
1827 }
1828 
1830  const response_handler_args_t *);
1832  const response_handler_args_t *);
1834  const response_handler_args_t *);
1836  const response_handler_args_t *);
1838  const response_handler_args_t *);
1840  const response_handler_args_t *);
1842  const response_handler_args_t *);
1844  const response_handler_args_t *);
1846  const response_handler_args_t *);
1848  const response_handler_args_t *);
1849 
1850 static int
1851 dir_client_decompress_response_body(char **bodyp, size_t *bodylenp,
1852  dir_connection_t *conn,
1853  compress_method_t compression,
1854  int anonymized_connection)
1855 {
1856  int rv = 0;
1857  const char *body = *bodyp;
1858  size_t body_len = *bodylenp;
1859  int allow_partial = (conn->base_.purpose == DIR_PURPOSE_FETCH_SERVERDESC ||
1860  conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO ||
1861  conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC);
1862 
1863  int plausible = body_is_plausible(body, body_len, conn->base_.purpose);
1864 
1865  if (plausible && compression == NO_METHOD) {
1866  return 0;
1867  }
1868 
1869  int severity = LOG_DEBUG;
1870  char *new_body = NULL;
1871  size_t new_len = 0;
1872  const char *description1, *description2;
1873  int want_to_try_both = 0;
1874  int tried_both = 0;
1875  compress_method_t guessed = detect_compression_method(body, body_len);
1876 
1877  description1 = compression_method_get_human_name(compression);
1878 
1879  if (BUG(description1 == NULL))
1880  description1 = compression_method_get_human_name(UNKNOWN_METHOD);
1881 
1882  if (guessed == UNKNOWN_METHOD && !plausible)
1883  description2 = "confusing binary junk";
1884  else
1885  description2 = compression_method_get_human_name(guessed);
1886 
1887  /* Tell the user if we don't believe what we're told about compression.*/
1888  want_to_try_both = (compression == UNKNOWN_METHOD ||
1889  guessed != compression);
1890  if (want_to_try_both) {
1891  severity = LOG_PROTOCOL_WARN;
1892  }
1893 
1894  tor_log(severity, LD_HTTP,
1895  "HTTP body from server '%s:%d' was labeled as %s, "
1896  "%s it seems to be %s.%s",
1897  conn->base_.address, conn->base_.port, description1,
1898  guessed != compression?"but":"and",
1899  description2,
1900  (compression>0 && guessed>0 && want_to_try_both)?
1901  " Trying both.":"");
1902 
1903  /* Try declared compression first if we can.
1904  * tor_compress_supports_method() also returns true for NO_METHOD.
1905  * Ensure that the server is not sending us data compressed using a
1906  * compression method that is not allowed for anonymous connections. */
1907  if (anonymized_connection &&
1910  rv = -1;
1911  goto done;
1912  }
1913 
1914  if (tor_compress_supports_method(compression)) {
1915  tor_uncompress(&new_body, &new_len, body, body_len, compression,
1916  !allow_partial, LOG_PROTOCOL_WARN);
1917  if (new_body) {
1918  /* We succeeded with the declared compression method. Great! */
1919  rv = 0;
1920  goto done;
1921  }
1922  }
1923 
1924  /* Okay, if that didn't work, and we think that it was compressed
1925  * differently, try that. */
1926  if (anonymized_connection &&
1929  rv = -1;
1930  goto done;
1931  }
1932 
1933  if (tor_compress_supports_method(guessed) &&
1934  compression != guessed) {
1935  tor_uncompress(&new_body, &new_len, body, body_len, guessed,
1936  !allow_partial, LOG_INFO);
1937  tried_both = 1;
1938  }
1939  /* If we're pretty sure that we have a compressed directory, and
1940  * we didn't manage to uncompress it, then warn and bail. */
1941  if (!plausible && !new_body) {
1942  log_fn(LOG_PROTOCOL_WARN, LD_HTTP,
1943  "Unable to decompress HTTP body (tried %s%s%s, server '%s:%d').",
1944  description1,
1945  tried_both?" and ":"",
1946  tried_both?description2:"",
1947  conn->base_.address, conn->base_.port);
1948  rv = -1;
1949  goto done;
1950  }
1951 
1952  done:
1953  if (new_body) {
1954  if (rv == 0) {
1955  /* success! */
1956  tor_free(*bodyp);
1957  *bodyp = new_body;
1958  *bodylenp = new_len;
1959  } else {
1960  tor_free(new_body);
1961  }
1962  }
1963 
1964  return rv;
1965 }
1966 
1967 /** We are a client, and we've finished reading the server's
1968  * response. Parse it and act appropriately.
1969  *
1970  * If we're still happy with using this directory server in the future, return
1971  * 0. Otherwise return -1; and the caller should consider trying the request
1972  * again.
1973  *
1974  * The caller will take care of marking the connection for close.
1975  */
1976 static int
1978 {
1979  char *body = NULL;
1980  char *headers = NULL;
1981  char *reason = NULL;
1982  size_t body_len = 0;
1983  int status_code;
1984  time_t date_header = 0;
1985  long apparent_skew;
1986  compress_method_t compression;
1987  int skewed = 0;
1988  int rv;
1989  int allow_partial = (conn->base_.purpose == DIR_PURPOSE_FETCH_SERVERDESC ||
1990  conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO ||
1991  conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC);
1992  size_t received_bytes;
1993  const int anonymized_connection =
1994  purpose_needs_anonymity(conn->base_.purpose,
1995  conn->router_purpose,
1996  conn->requested_resource);
1997 
1998  received_bytes = connection_get_inbuf_len(TO_CONN(conn));
1999 
2001  &headers, MAX_HEADERS_SIZE,
2002  &body, &body_len, MAX_DIR_DL_SIZE,
2003  allow_partial)) {
2004  case -1: /* overflow */
2005  log_warn(LD_PROTOCOL,
2006  "'fetch' response too large (server '%s:%d'). Closing.",
2007  conn->base_.address, conn->base_.port);
2008  return -1;
2009  case 0:
2010  log_info(LD_HTTP,
2011  "'fetch' response not all here, but we're at eof. Closing.");
2012  return -1;
2013  /* case 1, fall through */
2014  }
2015 
2016  if (parse_http_response(headers, &status_code, &date_header,
2017  &compression, &reason) < 0) {
2018  log_warn(LD_HTTP,"Unparseable headers (server '%s:%d'). Closing.",
2019  conn->base_.address, conn->base_.port);
2020 
2021  rv = -1;
2022  goto done;
2023  }
2024  if (!reason) reason = tor_strdup("[no reason given]");
2025 
2027  "Received response from directory server '%s:%d': %d %s "
2028  "(purpose: %d, response size: %"TOR_PRIuSZ
2029 #ifdef MEASUREMENTS_21206
2030  ", data cells received: %d, data cells sent: %d"
2031 #endif
2032  ", compression: %d)",
2033  conn->base_.address, conn->base_.port, status_code,
2034  escaped(reason), conn->base_.purpose,
2035  (received_bytes),
2036 #ifdef MEASUREMENTS_21206
2037  conn->data_cells_received, conn->data_cells_sent,
2038 #endif
2039  compression);
2040 
2041  if (conn->guard_state) {
2042  /* we count the connection as successful once we can read from it. We do
2043  * not, however, delay use of the circuit here, since it's just for a
2044  * one-hop directory request. */
2045  /* XXXXprop271 note that this will not do the right thing for other
2046  * waiting circuits that would be triggered by this circuit becoming
2047  * complete/usable. But that's ok, I think.
2048  */
2050  circuit_guard_state_free(conn->guard_state);
2051  conn->guard_state = NULL;
2052  }
2053 
2054  /* now check if it's got any hints for us about our IP address. */
2055  if (conn->dirconn_direct) {
2056  char *guess = http_get_header(headers, X_ADDRESS_HEADER);
2057  if (guess) {
2058  router_new_address_suggestion(guess, conn);
2059  tor_free(guess);
2060  }
2061  }
2062 
2063  if (date_header > 0) {
2064  /* The date header was written very soon after we sent our request,
2065  * so compute the skew as the difference between sending the request
2066  * and the date header. (We used to check now-date_header, but that's
2067  * inaccurate if we spend a lot of time downloading.)
2068  */
2069  apparent_skew = conn->base_.timestamp_last_write_allowed - date_header;
2070  if (labs(apparent_skew)>ALLOW_DIRECTORY_TIME_SKEW) {
2071  int trusted = router_digest_is_trusted_dir(conn->identity_digest);
2072  clock_skew_warning(TO_CONN(conn), apparent_skew, trusted, LD_HTTP,
2073  "directory", "DIRSERV");
2074  skewed = 1; /* don't check the recommended-versions line */
2075  } else {
2076  log_debug(LD_HTTP, "Time on received directory is within tolerance; "
2077  "we are %ld seconds skewed. (That's okay.)", apparent_skew);
2078  }
2079  }
2080  (void) skewed; /* skewed isn't used yet. */
2081 
2082  if (status_code == 503) {
2083  routerstatus_t *rs;
2084  dir_server_t *ds;
2085  const char *id_digest = conn->identity_digest;
2086  log_info(LD_DIR,"Received http status code %d (%s) from server "
2087  "'%s:%d'. I'll try again soon.",
2088  status_code, escaped(reason), conn->base_.address,
2089  conn->base_.port);
2090  time_t now = approx_time();
2091  if ((rs = router_get_mutable_consensus_status_by_id(id_digest)))
2092  rs->last_dir_503_at = now;
2093  if ((ds = router_get_fallback_dirserver_by_digest(id_digest)))
2094  ds->fake_status.last_dir_503_at = now;
2095 
2096  rv = -1;
2097  goto done;
2098  }
2099 
2100  if (dir_client_decompress_response_body(&body, &body_len,
2101  conn, compression, anonymized_connection) < 0) {
2102  rv = -1;
2103  goto done;
2104  }
2105 
2106  response_handler_args_t args;
2107  memset(&args, 0, sizeof(args));
2108  args.status_code = status_code;
2109  args.reason = reason;
2110  args.body = body;
2111  args.body_len = body_len;
2112  args.headers = headers;
2113 
2114  switch (conn->base_.purpose) {
2116  rv = handle_response_fetch_consensus(conn, &args);
2117  break;
2119  rv = handle_response_fetch_certificate(conn, &args);
2120  break;
2122  rv = handle_response_fetch_status_vote(conn, &args);
2123  break;
2126  break;
2129  rv = handle_response_fetch_desc(conn, &args);
2130  break;
2132  rv = handle_response_fetch_microdesc(conn, &args);
2133  break;
2135  rv = handle_response_fetch_renddesc_v2(conn, &args);
2136  break;
2138  rv = handle_response_upload_dir(conn, &args);
2139  break;
2141  rv = handle_response_upload_signatures(conn, &args);
2142  break;
2144  rv = handle_response_upload_vote(conn, &args);
2145  break;
2147  rv = handle_response_upload_renddesc_v2(conn, &args);
2148  break;
2150  rv = handle_response_upload_hsdesc(conn, &args);
2151  break;
2153  rv = handle_response_fetch_hsdesc_v3(conn, &args);
2154  break;
2155  default:
2156  tor_assert_nonfatal_unreached();
2157  rv = -1;
2158  break;
2159  }
2160 
2161  done:
2162  tor_free(body);
2163  tor_free(headers);
2164  tor_free(reason);
2165  return rv;
2166 }
2167 
2168 /**
2169  * Handler function: processes a response to a request for a networkstatus
2170  * consensus document by checking the consensus, storing it, and marking
2171  * router requests as reachable.
2172  **/
2173 STATIC int
2175  const response_handler_args_t *args)
2176 {
2178  const int status_code = args->status_code;
2179  const char *body = args->body;
2180  const size_t body_len = args->body_len;
2181  const char *reason = args->reason;
2182  const time_t now = approx_time();
2183 
2184  const char *consensus;
2185  char *new_consensus = NULL;
2186  const char *sourcename;
2187 
2188  int r;
2189  const char *flavname = conn->requested_resource;
2190  if (status_code != 200) {
2191  int severity = (status_code == 304) ? LOG_INFO : LOG_WARN;
2192  tor_log(severity, LD_DIR,
2193  "Received http status code %d (%s) from server "
2194  "'%s:%d' while fetching consensus directory.",
2195  status_code, escaped(reason), conn->base_.address,
2196  conn->base_.port);
2197  networkstatus_consensus_download_failed(status_code, flavname);
2198  return -1;
2199  }
2200 
2201  if (looks_like_a_consensus_diff(body, body_len)) {
2202  /* First find our previous consensus. Maybe it's in ram, maybe not. */
2203  cached_dir_t *cd = dirserv_get_consensus(flavname);
2204  const char *consensus_body = NULL;
2205  size_t consensus_body_len;
2206  tor_mmap_t *mapped_consensus = NULL;
2207  if (cd) {
2208  consensus_body = cd->dir;
2209  consensus_body_len = cd->dir_len;
2210  } else {
2211  mapped_consensus = networkstatus_map_cached_consensus(flavname);
2212  if (mapped_consensus) {
2213  consensus_body = mapped_consensus->data;
2214  consensus_body_len = mapped_consensus->size;
2215  }
2216  }
2217  if (!consensus_body) {
2218  log_warn(LD_DIR, "Received a consensus diff, but we can't find "
2219  "any %s-flavored consensus in our current cache.",flavname);
2220  tor_munmap_file(mapped_consensus);
2222  // XXXX if this happens too much, see below
2223  return -1;
2224  }
2225 
2226  new_consensus = consensus_diff_apply(consensus_body, consensus_body_len,
2227  body, body_len);
2228  tor_munmap_file(mapped_consensus);
2229  if (new_consensus == NULL) {
2230  log_warn(LD_DIR, "Could not apply consensus diff received from server "
2231  "'%s:%d'", conn->base_.address, conn->base_.port);
2232  // XXXX If this happens too many times, we should maybe not use
2233  // XXXX this directory for diffs any more?
2235  return -1;
2236  }
2237  log_info(LD_DIR, "Applied consensus diff (size %d) from server "
2238  "'%s:%d', resulting in a new consensus document (size %d).",
2239  (int)body_len, conn->base_.address, conn->base_.port,
2240  (int)strlen(new_consensus));
2241  consensus = new_consensus;
2242  sourcename = "generated based on a diff";
2243  } else {
2244  log_info(LD_DIR,"Received consensus directory (body size %d) from server "
2245  "'%s:%d'", (int)body_len, conn->base_.address, conn->base_.port);
2246  consensus = body;
2247  sourcename = "downloaded";
2248  }
2249 
2250  if ((r=networkstatus_set_current_consensus(consensus,
2251  strlen(consensus),
2252  flavname, 0,
2253  conn->identity_digest))<0) {
2255  "Unable to load %s consensus directory %s from "
2256  "server '%s:%d'. I'll try again soon.",
2257  flavname, sourcename, conn->base_.address, conn->base_.port);
2259  tor_free(new_consensus);
2260  return -1;
2261  }
2262 
2263  /* If we launched other fetches for this consensus, cancel them. */
2264  connection_dir_close_consensus_fetches(conn, flavname);
2265 
2266  /* update the list of routers and directory guards */
2269  directory_info_has_arrived(now, 0, 0);
2270 
2271  if (authdir_mode_v3(get_options())) {
2274  }
2275  log_info(LD_DIR, "Successfully loaded consensus.");
2276 
2277  tor_free(new_consensus);
2278  return 0;
2279 }
2280 
2281 /**
2282  * Handler function: processes a response to a request for one or more
2283  * authority certificates
2284  **/
2285 static int
2287  const response_handler_args_t *args)
2288 {
2290  const int status_code = args->status_code;
2291  const char *reason = args->reason;
2292  const char *body = args->body;
2293  const size_t body_len = args->body_len;
2294 
2295  if (status_code != 200) {
2296  log_warn(LD_DIR,
2297  "Received http status code %d (%s) from server "
2298  "'%s:%d' while fetching \"/tor/keys/%s\".",
2299  status_code, escaped(reason), conn->base_.address,
2300  conn->base_.port, conn->requested_resource);
2301  connection_dir_download_cert_failed(conn, status_code);
2302  return -1;
2303  }
2304  log_info(LD_DIR,"Received authority certificates (body size %d) from "
2305  "server '%s:%d'",
2306  (int)body_len, conn->base_.address, conn->base_.port);
2307 
2308  /*
2309  * Tell trusted_dirs_load_certs_from_string() whether it was by fp
2310  * or fp-sk pair.
2311  */
2312  int src_code = -1;
2313  if (!strcmpstart(conn->requested_resource, "fp/")) {
2314  src_code = TRUSTED_DIRS_CERTS_SRC_DL_BY_ID_DIGEST;
2315  } else if (!strcmpstart(conn->requested_resource, "fp-sk/")) {
2316  src_code = TRUSTED_DIRS_CERTS_SRC_DL_BY_ID_SK_DIGEST;
2317  }
2318 
2319  if (src_code != -1) {
2320  if (trusted_dirs_load_certs_from_string(body, src_code, 1,
2321  conn->identity_digest)<0) {
2322  log_warn(LD_DIR, "Unable to parse fetched certificates");
2323  /* if we fetched more than one and only some failed, the successful
2324  * ones got flushed to disk so it's safe to call this on them */
2325  connection_dir_download_cert_failed(conn, status_code);
2326  } else {
2327  time_t now = approx_time();
2328  directory_info_has_arrived(now, 0, 0);
2329  log_info(LD_DIR, "Successfully loaded certificates from fetch.");
2330  }
2331  } else {
2332  log_warn(LD_DIR,
2333  "Couldn't figure out what to do with fetched certificates for "
2334  "unknown resource %s",
2335  conn->requested_resource);
2336  connection_dir_download_cert_failed(conn, status_code);
2337  }
2338  return 0;
2339 }
2340 
2341 /**
2342  * Handler function: processes a response to a request for an authority's
2343  * current networkstatus vote.
2344  **/
2345 static int
2347  const response_handler_args_t *args)
2348 {
2350  const int status_code = args->status_code;
2351  const char *reason = args->reason;
2352  const char *body = args->body;
2353  const size_t body_len = args->body_len;
2354 
2355  const char *msg;
2356  int st;
2357  log_info(LD_DIR,"Got votes (body size %d) from server %s:%d",
2358  (int)body_len, conn->base_.address, conn->base_.port);
2359  if (status_code != 200) {
2360  log_warn(LD_DIR,
2361  "Received http status code %d (%s) from server "
2362  "'%s:%d' while fetching \"/tor/status-vote/next/%s.z\".",
2363  status_code, escaped(reason), conn->base_.address,
2364  conn->base_.port, conn->requested_resource);
2365  return -1;
2366  }
2367  dirvote_add_vote(body, &msg, &st);
2368  if (st > 299) {
2369  log_warn(LD_DIR, "Error adding retrieved vote: %s", msg);
2370  } else {
2371  log_info(LD_DIR, "Added vote(s) successfully [msg: %s]", msg);
2372  }
2373 
2374  return 0;
2375 }
2376 
2377 /**
2378  * Handler function: processes a response to a request for the signatures
2379  * that an authority knows about on a given consensus.
2380  **/
2381 static int
2383  const response_handler_args_t *args)
2384 {
2386  const int status_code = args->status_code;
2387  const char *reason = args->reason;
2388  const char *body = args->body;
2389  const size_t body_len = args->body_len;
2390 
2391  const char *msg = NULL;
2392  log_info(LD_DIR,"Got detached signatures (body size %d) from server %s:%d",
2393  (int)body_len, conn->base_.address, conn->base_.port);
2394  if (status_code != 200) {
2395  log_warn(LD_DIR,
2396  "Received http status code %d (%s) from server '%s:%d' while fetching "
2397  "\"/tor/status-vote/next/consensus-signatures.z\".",
2398  status_code, escaped(reason), conn->base_.address,
2399  conn->base_.port);
2400  return -1;
2401  }
2402  if (dirvote_add_signatures(body, conn->base_.address, &msg)<0) {
2403  log_warn(LD_DIR, "Problem adding detached signatures from %s:%d: %s",
2404  conn->base_.address, conn->base_.port, msg?msg:"???");
2405  }
2406 
2407  return 0;
2408 }
2409 
2410 /**
2411  * Handler function: processes a response to a request for a group of server
2412  * descriptors or an extrainfo documents.
2413  **/
2414 static int
2416  const response_handler_args_t *args)
2417 {
2419  conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO);
2420  const int status_code = args->status_code;
2421  const char *reason = args->reason;
2422  const char *body = args->body;
2423  const size_t body_len = args->body_len;
2424 
2425  int was_ei = conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO;
2426  smartlist_t *which = NULL;
2427  int n_asked_for = 0;
2428  int descriptor_digests = conn->requested_resource &&
2429  !strcmpstart(conn->requested_resource,"d/");
2430  log_info(LD_DIR,"Received %s (body size %d) from server '%s:%d'",
2431  was_ei ? "extra server info" : "server info",
2432  (int)body_len, conn->base_.address, conn->base_.port);
2433  if (conn->requested_resource &&
2434  (!strcmpstart(conn->requested_resource,"d/") ||
2435  !strcmpstart(conn->requested_resource,"fp/"))) {
2436  which = smartlist_new();
2438  (descriptor_digests ? 2 : 3),
2439  which, NULL, 0);
2440  n_asked_for = smartlist_len(which);
2441  }
2442  if (status_code != 200) {
2443  int dir_okay = status_code == 404 ||
2444  (status_code == 400 && !strcmp(reason, "Servers unavailable."));
2445  /* 404 means that it didn't have them; no big deal.
2446  * Older (pre-0.1.1.8) servers said 400 Servers unavailable instead. */
2447  log_fn(dir_okay ? LOG_INFO : LOG_WARN, LD_DIR,
2448  "Received http status code %d (%s) from server '%s:%d' "
2449  "while fetching \"/tor/server/%s\". I'll try again soon.",
2450  status_code, escaped(reason), conn->base_.address,
2451  conn->base_.port, conn->requested_resource);
2452  if (!which) {
2454  } else {
2455  dir_routerdesc_download_failed(which, status_code,
2456  conn->router_purpose,
2457  was_ei, descriptor_digests);
2458  SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
2459  smartlist_free(which);
2460  }
2461  return dir_okay ? 0 : -1;
2462  }
2463  /* Learn the routers, assuming we requested by fingerprint or "all"
2464  * or "authority".
2465  *
2466  * We use "authority" to fetch our own descriptor for
2467  * testing, and to fetch bridge descriptors for bootstrapping. Ignore
2468  * the output of "authority" requests unless we are using bridges,
2469  * since otherwise they'll be the response from reachability tests,
2470  * and we don't really want to add that to our routerlist. */
2471  if (which || (conn->requested_resource &&
2472  (!strcmpstart(conn->requested_resource, "all") ||
2473  (!strcmpstart(conn->requested_resource, "authority") &&
2474  get_options()->UseBridges)))) {
2475  /* as we learn from them, we remove them from 'which' */
2476  if (was_ei) {
2478  descriptor_digests);
2479  } else {
2480  //router_load_routers_from_string(body, NULL, SAVED_NOWHERE, which,
2481  // descriptor_digests, conn->router_purpose);
2482  if (load_downloaded_routers(body, which, descriptor_digests,
2483  conn->router_purpose,
2484  conn->base_.address)) {
2485  time_t now = approx_time();
2486  directory_info_has_arrived(now, 0, 1);
2487  }
2488  }
2489  }
2490  if (which) { /* mark remaining ones as failed */
2491  log_info(LD_DIR, "Received %d/%d %s requested from %s:%d",
2492  n_asked_for-smartlist_len(which), n_asked_for,
2493  was_ei ? "extra-info documents" : "router descriptors",
2494  conn->base_.address, (int)conn->base_.port);
2495  if (smartlist_len(which)) {
2496  dir_routerdesc_download_failed(which, status_code,
2497  conn->router_purpose,
2498  was_ei, descriptor_digests);
2499  }
2500  SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
2501  smartlist_free(which);
2502  }
2505 
2506  return 0;
2507 }
2508 
2509 /**
2510  * Handler function: processes a response to a request for a group of
2511  * microdescriptors
2512  **/
2513 STATIC int
2515  const response_handler_args_t *args)
2516 {
2518  const int status_code = args->status_code;
2519  const char *reason = args->reason;
2520  const char *body = args->body;
2521  const size_t body_len = args->body_len;
2522 
2523  smartlist_t *which = NULL;
2524  log_info(LD_DIR,"Received answer to microdescriptor request (status %d, "
2525  "body size %d) from server '%s:%d'",
2526  status_code, (int)body_len, conn->base_.address,
2527  conn->base_.port);
2529  !strcmpstart(conn->requested_resource, "d/"));
2530  tor_assert_nonfatal(!fast_mem_is_zero(conn->identity_digest, DIGEST_LEN));
2531  which = smartlist_new();
2533  which, NULL,
2534  DSR_DIGEST256|DSR_BASE64);
2535  if (status_code != 200) {
2536  log_info(LD_DIR, "Received status code %d (%s) from server "
2537  "'%s:%d' while fetching \"/tor/micro/%s\". I'll try again "
2538  "soon.",
2539  status_code, escaped(reason), conn->base_.address,
2540  (int)conn->base_.port, conn->requested_resource);
2541  dir_microdesc_download_failed(which, status_code, conn->identity_digest);
2542  SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
2543  smartlist_free(which);
2544  return 0;
2545  } else {
2546  smartlist_t *mds;
2547  time_t now = approx_time();
2549  body, body+body_len, SAVED_NOWHERE, 0,
2550  now, which);
2551  if (smartlist_len(which)) {
2552  /* Mark remaining ones as failed. */
2553  dir_microdesc_download_failed(which, status_code, conn->identity_digest);
2554  }
2555  if (mds && smartlist_len(mds)) {
2556  control_event_boot_dir(BOOTSTRAP_STATUS_LOADING_DESCRIPTORS,
2558  directory_info_has_arrived(now, 0, 1);
2559  }
2560  SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
2561  smartlist_free(which);
2562  smartlist_free(mds);
2563  }
2564 
2565  return 0;
2566 }
2567 
2568 /**
2569  * Handler function: processes a response to a POST request to upload our
2570  * router descriptor.
2571  **/
2572 static int
2574  const response_handler_args_t *args)
2575 {
2576  tor_assert(conn->base_.purpose == DIR_PURPOSE_UPLOAD_DIR);
2577  const int status_code = args->status_code;
2578  const char *reason = args->reason;
2579  const char *headers = args->headers;
2580 
2581  switch (status_code) {
2582  case 200: {
2583  dir_server_t *ds =
2585  char *rejected_hdr = http_get_header(headers,
2586  "X-Descriptor-Not-New: ");
2587  if (rejected_hdr) {
2588  if (!strcmp(rejected_hdr, "Yes")) {
2589  log_info(LD_GENERAL,
2590  "Authority '%s' declined our descriptor (not new)",
2591  ds->nickname);
2592  /* XXXX use this information; be sure to upload next one
2593  * sooner. -NM */
2594  /* XXXX++ On further thought, the task above implies that we're
2595  * basing our regenerate-descriptor time on when we uploaded the
2596  * last descriptor, not on the published time of the last
2597  * descriptor. If those are different, that's a bad thing to
2598  * do. -NM */
2599  }
2600  tor_free(rejected_hdr);
2601  }
2602  log_info(LD_GENERAL,"eof (status 200) after uploading server "
2603  "descriptor: finished.");
2605  LOG_NOTICE, "ACCEPTED_SERVER_DESCRIPTOR DIRAUTH=%s:%d",
2606  conn->base_.address, conn->base_.port);
2607 
2608  ds->has_accepted_serverdesc = 1;
2610  control_event_server_status(LOG_NOTICE, "GOOD_SERVER_DESCRIPTOR");
2611  }
2612  break;
2613  case 400:
2614  log_warn(LD_GENERAL,"http status 400 (%s) response from "
2615  "dirserver '%s:%d'. Please correct.",
2616  escaped(reason), conn->base_.address, conn->base_.port);
2618  "BAD_SERVER_DESCRIPTOR DIRAUTH=%s:%d REASON=\"%s\"",
2619  conn->base_.address, conn->base_.port, escaped(reason));
2620  break;
2621  default:
2622  log_warn(LD_GENERAL,
2623  "HTTP status %d (%s) was unexpected while uploading "
2624  "descriptor to server '%s:%d'. Possibly the server is "
2625  "misconfigured?",
2626  status_code, escaped(reason), conn->base_.address,
2627  conn->base_.port);
2628  break;
2629  }
2630  /* return 0 in all cases, since we don't want to mark any
2631  * dirservers down just because they don't like us. */
2632 
2633  return 0;
2634 }
2635 
2636 /**
2637  * Handler function: processes a response to POST request to upload our
2638  * own networkstatus vote.
2639  **/
2640 static int
2642  const response_handler_args_t *args)
2643 {
2644  tor_assert(conn->base_.purpose == DIR_PURPOSE_UPLOAD_VOTE);
2645  const int status_code = args->status_code;
2646  const char *reason = args->reason;
2647 
2648  switch (status_code) {
2649  case 200: {
2650  log_notice(LD_DIR,"Uploaded a vote to dirserver %s:%d",
2651  conn->base_.address, conn->base_.port);
2652  }
2653  break;
2654  case 400:
2655  log_warn(LD_DIR,"http status 400 (%s) response after uploading "
2656  "vote to dirserver '%s:%d'. Please correct.",
2657  escaped(reason), conn->base_.address, conn->base_.port);
2658  break;
2659  default:
2660  log_warn(LD_GENERAL,
2661  "HTTP status %d (%s) was unexpected while uploading "
2662  "vote to server '%s:%d'.",
2663  status_code, escaped(reason), conn->base_.address,
2664  conn->base_.port);
2665  break;
2666  }
2667  /* return 0 in all cases, since we don't want to mark any
2668  * dirservers down just because they don't like us. */
2669  return 0;
2670 }
2671 
2672 /**
2673  * Handler function: processes a response to POST request to upload our
2674  * view of the signatures on the current consensus.
2675  **/
2676 static int
2678  const response_handler_args_t *args)
2679 {
2681  const int status_code = args->status_code;
2682  const char *reason = args->reason;
2683 
2684  switch (status_code) {
2685  case 200: {
2686  log_notice(LD_DIR,"Uploaded signature(s) to dirserver %s:%d",
2687  conn->base_.address, conn->base_.port);
2688  }
2689  break;
2690  case 400:
2691  log_warn(LD_DIR,"http status 400 (%s) response after uploading "
2692  "signatures to dirserver '%s:%d'. Please correct.",
2693  escaped(reason), conn->base_.address, conn->base_.port);
2694  break;
2695  default:
2696  log_warn(LD_GENERAL,
2697  "HTTP status %d (%s) was unexpected while uploading "
2698  "signatures to server '%s:%d'.",
2699  status_code, escaped(reason), conn->base_.address,
2700  conn->base_.port);
2701  break;
2702  }
2703  /* return 0 in all cases, since we don't want to mark any
2704  * dirservers down just because they don't like us. */
2705 
2706  return 0;
2707 }
2708 
2709 /**
2710  * Handler function: processes a response to a request for a v3 hidden service
2711  * descriptor.
2712  **/
2713 STATIC int
2715  const response_handler_args_t *args)
2716 {
2717  const int status_code = args->status_code;
2718  const char *reason = args->reason;
2719  const char *body = args->body;
2720  const size_t body_len = args->body_len;
2721 
2722  tor_assert(conn->hs_ident);
2723 
2724  log_info(LD_REND,"Received v3 hsdesc (body size %d, status %d (%s))",
2725  (int)body_len, status_code, escaped(reason));
2726 
2727  hs_client_dir_fetch_done(conn, reason, body, status_code);
2728  return 0;
2729 }
2730 
2731 /**
2732  * Handler function: processes a response to a request for a v2 hidden service
2733  * descriptor.
2734  **/
2735 static int
2737  const response_handler_args_t *args)
2738 {
2740  const int status_code = args->status_code;
2741  const char *reason = args->reason;
2742  const char *body = args->body;
2743  const size_t body_len = args->body_len;
2744 
2745 #define SEND_HS_DESC_FAILED_EVENT(reason) \
2746  (control_event_hsv2_descriptor_failed(conn->rend_data, \
2747  conn->identity_digest, \
2748  reason))
2749 #define SEND_HS_DESC_FAILED_CONTENT() \
2750  (control_event_hs_descriptor_content( \
2751  rend_data_get_address(conn->rend_data), \
2752  conn->requested_resource, \
2753  conn->identity_digest, \
2754  NULL))
2755 
2756  tor_assert(conn->rend_data);
2757  log_info(LD_REND,"Received rendezvous descriptor (body size %d, status %d "
2758  "(%s))",
2759  (int)body_len, status_code, escaped(reason));
2760  switch (status_code) {
2761  case 200:
2762  {
2763  rend_cache_entry_t *entry = NULL;
2764 
2766  conn->requested_resource,
2767  conn->rend_data, &entry) < 0) {
2768  log_warn(LD_REND,"Fetching v2 rendezvous descriptor failed. "
2769  "Retrying at another directory.");
2770  /* We'll retry when connection_about_to_close_connection()
2771  * cleans this dir conn up. */
2772  SEND_HS_DESC_FAILED_EVENT("BAD_DESC");
2773  SEND_HS_DESC_FAILED_CONTENT();
2774  } else {
2775  char service_id[REND_SERVICE_ID_LEN_BASE32 + 1];
2776  /* Should never be NULL here if we found the descriptor. */
2777  tor_assert(entry);
2778  rend_get_service_id(entry->parsed->pk, service_id);
2779 
2780  /* success. notify pending connections about this. */
2781  log_info(LD_REND, "Successfully fetched v2 rendezvous "
2782  "descriptor.");
2784  conn->rend_data,
2785  conn->identity_digest);
2787  conn->requested_resource,
2788  conn->identity_digest,
2789  body);
2791  rend_client_desc_trynow(service_id);
2792  memwipe(service_id, 0, sizeof(service_id));
2793  }
2794  break;
2795  }
2796  case 404:
2797  /* Not there. We'll retry when
2798  * connection_about_to_close_connection() cleans this conn up. */
2799  log_info(LD_REND,"Fetching v2 rendezvous descriptor failed: "
2800  "Retrying at another directory.");
2801  SEND_HS_DESC_FAILED_EVENT("NOT_FOUND");
2802  SEND_HS_DESC_FAILED_CONTENT();
2803  break;
2804  case 400:
2805  log_warn(LD_REND, "Fetching v2 rendezvous descriptor failed: "
2806  "http status 400 (%s). Dirserver didn't like our "
2807  "v2 rendezvous query? Retrying at another directory.",
2808  escaped(reason));
2809  SEND_HS_DESC_FAILED_EVENT("QUERY_REJECTED");
2810  SEND_HS_DESC_FAILED_CONTENT();
2811  break;
2812  default:
2813  log_warn(LD_REND, "Fetching v2 rendezvous descriptor failed: "
2814  "http status %d (%s) response unexpected while "
2815  "fetching v2 hidden service descriptor (server '%s:%d'). "
2816  "Retrying at another directory.",
2817  status_code, escaped(reason), conn->base_.address,
2818  conn->base_.port);
2819  SEND_HS_DESC_FAILED_EVENT("UNEXPECTED");
2820  SEND_HS_DESC_FAILED_CONTENT();
2821  break;
2822  }
2823 
2824  return 0;
2825 }
2826 
2827 /**
2828  * Handler function: processes a response to a POST request to upload a v2
2829  * hidden service descriptor.
2830  **/
2831 static int
2833  const response_handler_args_t *args)
2834 {
2836  const int status_code = args->status_code;
2837  const char *reason = args->reason;
2838 
2839 #define SEND_HS_DESC_UPLOAD_FAILED_EVENT(reason) \
2840  (control_event_hs_descriptor_upload_failed( \
2841  conn->identity_digest, \
2842  rend_data_get_address(conn->rend_data), \
2843  reason))
2844 
2845  log_info(LD_REND,"Uploaded rendezvous descriptor (status %d "
2846  "(%s))",
2847  status_code, escaped(reason));
2848  /* Without the rend data, we'll have a problem identifying what has been
2849  * uploaded for which service. */
2850  tor_assert(conn->rend_data);
2851  switch (status_code) {
2852  case 200:
2853  log_info(LD_REND,
2854  "Uploading rendezvous descriptor: finished with status "
2855  "200 (%s)", escaped(reason));
2859  break;
2860  case 400:
2861  log_warn(LD_REND,"http status 400 (%s) response from dirserver "
2862  "'%s:%d'. Malformed rendezvous descriptor?",
2863  escaped(reason), conn->base_.address, conn->base_.port);
2864  SEND_HS_DESC_UPLOAD_FAILED_EVENT("UPLOAD_REJECTED");
2865  break;
2866  default:
2867  log_warn(LD_REND,"http status %d (%s) response unexpected (server "
2868  "'%s:%d').",
2869  status_code, escaped(reason), conn->base_.address,
2870  conn->base_.port);
2871  SEND_HS_DESC_UPLOAD_FAILED_EVENT("UNEXPECTED");
2872  break;
2873  }
2874 
2875  return 0;
2876 }
2877 
2878 /**
2879  * Handler function: processes a response to a POST request to upload an
2880  * hidden service descriptor.
2881  **/
2882 static int
2884  const response_handler_args_t *args)
2885 {
2886  const int status_code = args->status_code;
2887  const char *reason = args->reason;
2888 
2889  tor_assert(conn);
2891 
2892  log_info(LD_REND, "Uploaded hidden service descriptor (status %d "
2893  "(%s))",
2894  status_code, escaped(reason));
2895  /* For this directory response, it MUST have an hidden service identifier on
2896  * this connection. */
2897  tor_assert(conn->hs_ident);
2898  switch (status_code) {
2899  case 200:
2900  log_info(LD_REND, "Uploading hidden service descriptor: "
2901  "finished with status 200 (%s)", escaped(reason));
2902  hs_control_desc_event_uploaded(conn->hs_ident, conn->identity_digest);
2903  break;
2904  case 400:
2905  log_fn(LOG_PROTOCOL_WARN, LD_REND,
2906  "Uploading hidden service descriptor: http "
2907  "status 400 (%s) response from dirserver "
2908  "'%s:%d'. Malformed hidden service descriptor?",
2909  escaped(reason), conn->base_.address, conn->base_.port);
2910  hs_control_desc_event_failed(conn->hs_ident, conn->identity_digest,
2911  "UPLOAD_REJECTED");
2912  break;
2913  default:
2914  log_warn(LD_REND, "Uploading hidden service descriptor: http "
2915  "status %d (%s) response unexpected (server "
2916  "'%s:%d').",
2917  status_code, escaped(reason), conn->base_.address,
2918  conn->base_.port);
2919  hs_control_desc_event_failed(conn->hs_ident, conn->identity_digest,
2920  "UNEXPECTED");
2921  break;
2922  }
2923 
2924  return 0;
2925 }
2926 
2927 /** Called when a directory connection reaches EOF. */
2928 int
2930 {
2931  int retval;
2932  if (conn->base_.state != DIR_CONN_STATE_CLIENT_READING) {
2933  log_info(LD_HTTP,"conn reached eof, not reading. [state=%d] Closing.",
2934  conn->base_.state);
2935  connection_close_immediate(TO_CONN(conn)); /* error: give up on flushing */
2936  connection_mark_for_close(TO_CONN(conn));
2937  return -1;
2938  }
2939 
2940  retval = connection_dir_client_reached_eof(conn);
2941  if (retval == 0) /* success */
2942  conn->base_.state = DIR_CONN_STATE_CLIENT_FINISHED;
2943  connection_mark_for_close(TO_CONN(conn));
2944  return retval;
2945 }
2946 /** We are closing a dir connection: If <b>dir_conn</b> is a dir connection
2947  * that tried to fetch an HS descriptor, check if it successfully fetched it,
2948  * or if we need to try again. */
2949 void
2951 {
2952  connection_t *conn = TO_CONN(dir_conn);
2953 
2954  /* If we were trying to fetch a v2 rend desc and did not succeed, retry as
2955  * needed. (If a fetch is successful, the connection state is changed to
2956  * DIR_PURPOSE_HAS_FETCHED_RENDDESC_V2 or DIR_PURPOSE_HAS_FETCHED_HSDESC to
2957  * mark that refetching is unnecessary.) */
2958  if (conn->purpose == DIR_PURPOSE_FETCH_RENDDESC_V2 &&
2959  dir_conn->rend_data &&
2961  rend_data_get_address(dir_conn->rend_data))) {
2963  }
2964 
2965  /* Check for v3 rend desc fetch */
2966  if (conn->purpose == DIR_PURPOSE_FETCH_HSDESC &&
2967  dir_conn->hs_ident &&
2968  !ed25519_public_key_is_zero(&dir_conn->hs_ident->identity_pk)) {
2969  hs_client_refetch_hsdesc(&dir_conn->hs_ident->identity_pk);
2970  }
2971 }
2972 
2973 /** Array of compression methods to use (if supported) for requesting
2974  * compressed data, ordered from best to worst. */
2976  LZMA_METHOD,
2977  ZSTD_METHOD,
2978  ZLIB_METHOD,
2979  GZIP_METHOD,
2980  NO_METHOD
2981 };
2982 
2983 /** Array of allowed compression methods to use (if supported) when receiving a
2984  * response from a request that was required to be anonymous. */
2986  ZLIB_METHOD,
2987  GZIP_METHOD,
2988  NO_METHOD
2989 };
2990 
2991 /** Return a newly allocated string containing a comma separated list of
2992  * supported encodings. */
2993 STATIC char *
2995 {
2996  smartlist_t *methods = smartlist_new();
2997  char *header = NULL;
2998  compress_method_t method;
2999  unsigned i;
3000 
3001  for (i = 0; i < ARRAY_LENGTH(client_meth_pref); ++i) {
3002  method = client_meth_pref[i];
3003  if (tor_compress_supports_method(method))
3004  smartlist_add(methods, (char *)compression_method_get_name(method));
3005  }
3006 
3007  header = smartlist_join_strings(methods, ", ", 0, NULL);
3008  smartlist_free(methods);
3009 
3010  return header;
3011 }
3012 
3013 /** Check if the given compression method is allowed for a connection that is
3014  * supposed to be anonymous. Returns 1 if the compression method is allowed,
3015  * otherwise 0. */
3016 STATIC int
3018 {
3019  unsigned u;
3020 
3022  ++u) {
3023  compress_method_t allowed_method =
3025 
3026  if (! tor_compress_supports_method(allowed_method))
3027  continue;
3028 
3029  if (method == allowed_method)
3030  return 1;
3031  }
3032 
3033  return 0;
3034 }
3035 
3036 /** Log a warning when a remote server has sent us a document using a
3037  * compression method that is not allowed for anonymous directory requests. */
3038 STATIC void
3040 {
3041  log_fn(LOG_PROTOCOL_WARN, LD_HTTP,
3042  "Received a %s HTTP response, which is not "
3043  "allowed for anonymous directory requests.",
3045 }
3046 
3047 /* We just got a new consensus! If there are other in-progress requests
3048  * for this consensus flavor (for example because we launched several in
3049  * parallel), cancel them.
3050  *
3051  * We do this check here (not just in
3052  * connection_ap_handshake_attach_circuit()) to handle the edge case where
3053  * a consensus fetch begins and ends before some other one tries to attach to
3054  * a circuit, in which case the other one won't know that we're all happy now.
3055  *
3056  * Don't mark the conn that just gave us the consensus -- otherwise we
3057  * would end up double-marking it when it cleans itself up.
3058  */
3059 static void
3060 connection_dir_close_consensus_fetches(dir_connection_t *except_this_one,
3061  const char *resource)
3062 {
3063  smartlist_t *conns_to_close =
3065  resource);
3066  SMARTLIST_FOREACH_BEGIN(conns_to_close, dir_connection_t *, d) {
3067  if (d == except_this_one)
3068  continue;
3069  log_info(LD_DIR, "Closing consensus fetch (to %s) since one "
3070  "has just arrived.", TO_CONN(d)->address);
3071  connection_mark_for_close(TO_CONN(d));
3072  } SMARTLIST_FOREACH_END(d);
3073  smartlist_free(conns_to_close);
3074 }
3075 /** Called when one or more routerdesc (or extrainfo, if <b>was_extrainfo</b>)
3076  * fetches have failed (with uppercase fingerprints listed in <b>failed</b>,
3077  * either as descriptor digests or as identity digests based on
3078  * <b>was_descriptor_digests</b>).
3079  */
3080 static void
3082  int router_purpose,
3083  int was_extrainfo, int was_descriptor_digests)
3084 {
3085  char digest[DIGEST_LEN];
3086  time_t now = time(NULL);
3088  if (!was_descriptor_digests) {
3089  if (router_purpose == ROUTER_PURPOSE_BRIDGE) {
3090  tor_assert(!was_extrainfo);
3092  }
3093  return; /* FFFF should implement for other-than-router-purpose someday */
3094  }
3095  SMARTLIST_FOREACH_BEGIN(failed, const char *, cp) {
3096  download_status_t *dls = NULL;
3097  if (base16_decode(digest, DIGEST_LEN, cp, strlen(cp)) != DIGEST_LEN) {
3098  log_warn(LD_BUG, "Malformed fingerprint in list: %s", escaped(cp));
3099  continue;
3100  }
3101  if (was_extrainfo) {
3102  signed_descriptor_t *sd =
3104  if (sd)
3105  dls = &sd->ei_dl_status;
3106  } else {
3108  }
3109  if (!dls)
3110  continue;
3111  download_status_increment_failure(dls, status_code, cp, server, now);
3112  } SMARTLIST_FOREACH_END(cp);
3113 
3114  /* No need to relaunch descriptor downloads here: we already do it
3115  * every 10 or 60 seconds (FOO_DESCRIPTOR_RETRY_INTERVAL) in main.c. */
3116 }
3117 
3118 /** Called when a connection to download microdescriptors from relay with
3119  * <b>dir_id</b> has failed in whole or in part. <b>failed</b> is a list
3120  * of every microdesc digest we didn't get. <b>status_code</b> is the http
3121  * status code we received. Reschedule the microdesc downloads as
3122  * appropriate. */
3123 static void
3125  int status_code, const char *dir_id)
3126 {
3127  networkstatus_t *consensus
3129  routerstatus_t *rs;
3130  download_status_t *dls;
3131  time_t now = time(NULL);
3133 
3134  if (! consensus)
3135  return;
3136 
3137  /* We failed to fetch a microdescriptor from 'dir_id', note it down
3138  * so that we don't try the same relay next time... */
3139  microdesc_note_outdated_dirserver(dir_id);
3140 
3141  SMARTLIST_FOREACH_BEGIN(failed, const char *, d) {
3143  if (!rs)
3144  continue;
3145  dls = &rs->dl_status;
3146 
3147  { /* Increment the failure count for this md fetch */
3148  char buf[BASE64_DIGEST256_LEN+1];
3149  digest256_to_base64(buf, d);
3150  log_info(LD_DIR, "Failed to download md %s from %s",
3151  buf, hex_str(dir_id, DIGEST_LEN));
3152  download_status_increment_failure(dls, status_code, buf,
3153  server, now);
3154  }
3155  } SMARTLIST_FOREACH_END(d);
3156 }
compress_method_t detect_compression_method(const char *in, size_t in_len)
Definition: compress.c:284
Header file for dirserv.c.
void rep_hist_note_used_internal(time_t now, int need_uptime, int need_capacity)
#define DIR_PURPOSE_UPLOAD_HSDESC
Definition: directory.h:72
#define DIR_PURPOSE_SERVER
Definition: directory.h:62
#define MAX_DIR_DL_SIZE
Definition: dirclient.c:70
Header file for rendcommon.c.
routerstatus_t * router_get_mutable_consensus_status_by_id(const char *digest)
STATIC int should_use_directory_guards(const or_options_t *options)
Definition: dirclient.c:314
char * authdir_type_to_string(dirinfo_type_t auth)
Definition: directory.c:148
Header file for dirclient.c.
uint16_t dir_port
Definition: routerinfo_st.h:26
void rend_service_desc_has_uploaded(const rend_data_t *rend_data)
Definition: rendservice.c:4048
STATIC void warn_disallowed_anonymous_compression_method(compress_method_t method)
Definition: dirclient.c:3039
void directory_all_unreachable(time_t now)
Definition: mainloop.c:1103
Header for confline.c.
static int handle_response_fetch_detached_signatures(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2382
Router descriptor structure.
Header file for circuitbuild.c.
dir_indirection_t
Definition: dirclient.h:32
void directory_request_set_dir_addr_port(directory_request_t *req, const tor_addr_port_t *p)
Definition: dirclient.c:988
Definition: node_st.h:34
#define ISO_STREAM
Definition: or.h:974
STATIC const char * dir_conn_purpose_to_string(int purpose)
Definition: dirclient.c:98
#define SMARTLIST_FOREACH_BEGIN(sl, type, var)
Header for backtrace.c.
#define TO_CONN(c)
Definition: or.h:735
STATIC char * accept_encoding_header(void)
Definition: dirclient.c:2994
static int directory_conn_is_self_reachability_test(dir_connection_t *conn)
Definition: dirclient.c:706
int32_t networkstatus_get_param(const networkstatus_t *ns, const char *param_name, int32_t default_val, int32_t min_val, int32_t max_val)
void entry_guard_cancel(circuit_guard_state_t **guard_state_p)
Definition: entrynodes.c:2459
char * HTTPProxy
#define MOCK_IMPL(rv, funcname, arglist)
Definition: testsupport.h:133
download_want_authority_t
Definition: or.h:778
char * HTTPProxyAuthenticator
Header file containing client data for the HS subsytem.
Header file for node_select.c.
static int directory_request_set_dir_from_routerstatus(directory_request_t *req)
Definition: dirclient.c:1167
static int body_is_plausible(const char *body, size_t body_len, int purpose)
Definition: dirclient.c:1769
routerstatus_t * router_get_mutable_consensus_status_by_descriptor_digest(networkstatus_t *consensus, const char *digest)
unsigned int purpose
Definition: connection_st.h:51
Header file for connection.c.
unsigned int has_accepted_serverdesc
Definition: dir_server_st.h:43
static void connection_dir_download_cert_failed(dir_connection_t *conn, int status_code)
Definition: dirclient.c:831
#define LD_GENERAL
Definition: log.h:62
dir_connection_t * dir_connection_new(int socket_family)
Definition: connection.c:361
unsigned int dirconn_direct
const routerstatus_t * router_pick_trusteddirserver(dirinfo_type_t type, int flags)
Definition: node_select.c:1042
#define DIR_PURPOSE_FETCH_STATUS_VOTE
Definition: directory.h:50
#define PDS_NO_EXISTING_SERVERDESC_FETCH
Definition: node_select.h:61
Headers for compress.c.
void control_event_boot_dir(bootstrap_status_t status, int progress)
static int tor_addr_eq_ipv4h(const tor_addr_t *a, uint32_t u)
Definition: address.h:193
#define LOG_INFO
Definition: log.h:45
Header file for describe.c.
int tor_compress_supports_method(compress_method_t method)
Definition: compress.c:304
Header file for nodelist.c.
void tor_log(int severity, log_domain_mask_t domain, const char *format,...)
Definition: log.c:628
void tor_addr_make_null(tor_addr_t *a, sa_family_t family)
Definition: address.c:235
int dir_split_resource_into_fingerprint_pairs(const char *res, smartlist_t *pairs_out)
Definition: directory.c:569
rend_service_descriptor_t * parsed
Definition: rendcache.h:34
Header file for directory.c.
int FetchServerDescriptors
void smartlist_add(smartlist_t *sl, void *element)
STATIC int allowed_anonymous_connection_compression_method(compress_method_t method)
Definition: dirclient.c:3017
static int load_downloaded_routers(const char *body, smartlist_t *which, int descriptor_digests, int router_purpose, const char *source)
Definition: dirclient.c:1800
time_t published
Definition: cached_dir_st.h:22
#define SESSION_GROUP_DIRCONN
Definition: or.h:983
#define MAX_HEADERS_SIZE
Definition: or.h:122
Node information structure.
static compress_method_t client_meth_allowed_anonymous_compression[]
Definition: dirclient.c:2985
static void dir_routerdesc_download_failed(smartlist_t *failed, int status_code, int router_purpose, int was_extrainfo, int was_descriptor_digests)
Definition: dirclient.c:3081
#define ED25519_BASE64_LEN
Definition: x25519_sizes.h:40
dirinfo_type_t PublishServerDescriptor_
#define REND_DESC_ID_V2_LEN_BASE32
Definition: or.h:354
struct directory_request_t directory_request_t
Definition: dirclient.h:50
Header file for config.c.
Header file for authcert.c.
char identity_digest[DIGEST_LEN]
char * Socks4Proxy
#define DIR_PURPOSE_UPLOAD_DIR
Definition: directory.h:43
#define HEX_DIGEST256_LEN
Definition: crypto_digest.h:37
void router_set_status(const char *digest, int up)
Definition: nodelist.c:2241
char * alloc_http_authenticator(const char *authenticator)
Definition: connection.c:4777
#define DIR_CONN_STATE_CLIENT_READING
Definition: directory.h:23
const or_options_t * get_options(void)
Definition: config.c:926
int fast_mem_is_zero(const char *mem, size_t len)
Definition: util_string.c:74
#define tor_assert(expr)
Definition: util_bug.h:102
smartlist_t * microdescs_add_to_cache(microdesc_cache_t *cache, const char *s, const char *eos, saved_location_t where, int no_save, time_t listed_at, smartlist_t *requested_digests256)
Definition: microdesc.c:292
Parsed v2 HS descriptor structure.
Header file for microdesc.c.
#define LD_HTTP
Definition: log.h:76
void update_certificate_downloads(time_t now)
void routers_update_all_from_networkstatus(time_t now, int dir_version)
networkstatus_t * networkstatus_get_latest_consensus_by_flavor(consensus_flavor_t f)
void directory_request_set_directory_id_digest(directory_request_t *req, const char *digest)
Definition: dirclient.c:998
void networkstatus_consensus_download_failed(int status_code, const char *flavname)
download_status_t * router_get_dl_status_by_descriptor_digest(const char *d)
const routerstatus_t * router_pick_directory_server(dirinfo_type_t type, int flags)
Definition: node_select.c:72
int strcmpstart(const char *s1, const char *s2)
Definition: util_string.c:206
#define tor_free(p)
Definition: malloc.h:52
int connection_fetch_from_buf_http(connection_t *conn, char **headers_out, size_t max_headerlen, char **body_out, size_t *body_used, size_t max_bodylen, int force_complete)
Definition: connection.c:3993
#define DIR_PURPOSE_FETCH_DETACHED_SIGNATURES
Definition: directory.h:53
#define LOG_NOTICE
Definition: log.h:50
void update_microdescs_from_networkstatus(time_t now)
Definition: microdesc.c:1032
int router_supports_extrainfo(const char *identity_digest, int is_authority)
Definition: dirclient.c:180
#define DIR_PURPOSE_FETCH_CONSENSUS
Definition: directory.h:56
Cached large directory object structure.
Header file for mainloop.c.
dirinfo_type_t
Definition: or.h:891
void hs_client_dir_fetch_done(dir_connection_t *dir_conn, const char *reason, const char *body, const int status_code)
Definition: hs_client.c:2223
void memwipe(void *mem, uint8_t byte, size_t sz)
Definition: crypto_util.c:55
hs_ident_dir_conn_t * hs_ident_dir_conn_dup(const hs_ident_dir_conn_t *src)
Definition: hs_ident.c:47
#define DIR_CONN_STATE_CLIENT_SENDING
Definition: directory.h:21
pending_vote_t * dirvote_add_vote(const char *vote_body, const char **msg_out, int *status_out)
Definition: dirvote.c:3128
void directory_request_set_resource(directory_request_t *req, const char *resource)
Definition: dirclient.c:1039
smartlist_t * smartlist_new(void)
static int directory_request_dir_contact_info_specified(const directory_request_t *req)
Definition: dirclient.c:1141
void directory_post_to_dirservers(uint8_t dir_purpose, uint8_t router_purpose, dirinfo_type_t type, const char *payload, size_t payload_len, size_t extrainfo_len)
Definition: dirclient.c:234
struct routerset_t * ExcludeNodes
Definition: or_options_st.h:89
STATIC int handle_response_fetch_consensus(dir_connection_t *conn, const response_handler_args_t *args)
Definition: dirclient.c:2174
int tor_uncompress(char **out, size_t *out_len, const char *in, size_t in_len, compress_method_t method, int complete_only, int protocol_warn_level)
Definition: compress.c:268
#define DIR_PURPOSE_UPLOAD_SIGNATURES
Definition: directory.h:47
dir_server_t * router_get_trusteddirserver_by_digest(const char *digest)
Definition: dirlist.c:112
time_t download_status_increment_failure(download_status_t *dls, int status_code, const char *item, int server, time_t now)
Definition: dlstatus.c:250
#define STATIC
Definition: testsupport.h:32
static void directory_send_command(dir_connection_t *conn, const int direct, const directory_request_t *req)
Definition: dirclient.c:1522
void hs_control_desc_event_failed(const hs_ident_dir_conn_t *ident, const char *hsdir_id_digest, const char *reason)
Definition: hs_control.c:65
#define ENTRY_TO_CONN(c)
Definition: or.h:738
int trusted_dirs_load_certs_from_string(const char *contents, int source, int flush, const char *source_dir)
Definition: authcert.c:373
#define DIR_PURPOSE_FETCH_EXTRAINFO
Definition: directory.h:41
Header file for routerset.c.
Header file for directory authority mode.
int networkstatus_parse_flavor_name(const char *flavname)
static int handle_response_fetch_desc(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2415
#define PDS_IGNORE_FASCISTFIREWALL
Definition: node_select.h:54
directory_request_t * directory_request_new(uint8_t dir_purpose)
Definition: dirclient.c:942
Trusted/fallback directory server structure.
#define DIGEST256_LEN
Definition: digest_sizes.h:23
static char * directory_get_consensus_url(const char *resource)
Definition: dirclient.c:1459
Header file for policies.c.
int count_loading_descriptors_progress(void)
Definition: nodelist.c:2641
Definition: rendcache.h:29
void entry_guard_failed(circuit_guard_state_t **guard_state_p)
Definition: entrynodes.c:2480
void control_event_hs_descriptor_uploaded(const char *id_digest, const char *onion_address)
#define DIR_CONN_STATE_CLIENT_FINISHED
Definition: directory.h:25
size_t dir_len
Definition: cached_dir_st.h:20
static int dirind_is_anon(dir_indirection_t ind)
Definition: dirclient.c:610
Common functions for cryptographic routines.
void directory_info_has_arrived(time_t now, int from_cache, int suppress_logs)
Definition: mainloop.c:1121
static compress_method_t client_meth_pref[]
Definition: dirclient.c:2975
const char * compression_method_get_name(compress_method_t method)
Definition: compress.c:364
#define DIR_PURPOSE_FETCH_SERVERDESC
Definition: directory.h:38
void rend_client_desc_trynow(const char *query)
Definition: rendclient.c:915
#define tor_addr_from_ipv4h(dest, v4addr)
Definition: address.h:287
guard_usable_t entry_guard_succeeded(circuit_guard_state_t **guard_state_p)
Definition: entrynodes.c:2432
#define DIR_PURPOSE_UPLOAD_VOTE
Definition: directory.h:45
Header for crypto_format.c.
void fascist_firewall_choose_address_rs(const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:942
Header file for routermode.c.
void router_new_address_suggestion(const char *suggestion, const dir_connection_t *d_conn)
Definition: router.c:2568
int tor_asprintf(char **strp, const char *fmt,...)
Definition: printf.c:75
void connection_dir_client_request_failed(dir_connection_t *conn)
Definition: dirclient.c:725
static int handle_response_fetch_renddesc_v2(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2736
void directory_get_from_all_authorities(uint8_t dir_purpose, uint8_t router_purpose, const char *resource)
Definition: dirclient.c:585
#define DIGEST_LEN
Definition: digest_sizes.h:20
void smartlist_add_asprintf(struct smartlist_t *sl, const char *pattern,...)
Definition: smartlist.c:36
int ed25519_public_key_is_zero(const ed25519_public_key_t *pubkey)
Header file for rendcache.c.
Header file for circuitbuild.c.
void hs_control_desc_event_uploaded(const hs_ident_dir_conn_t *ident, const char *hsdir_id_digest)
Definition: hs_control.c:159
Master header file for Tor-specific functionality.
signed_descriptor_t * router_get_by_extrainfo_digest(const char *digest)
Definition: routerlist.c:712
Header for consdiff.c.
int purpose_needs_anonymity(uint8_t dir_purpose, uint8_t router_purpose, const char *resource)
Definition: directory.c:98
void connection_close_immediate(connection_t *conn)
Definition: connection.c:841
const char * hex_str(const char *from, size_t fromlen)
Definition: binascii.c:34
void control_event_hs_descriptor_content(const char *onion_address, const char *desc_id, const char *hsdir_id_digest, const char *content)
const char * router_get_descriptor_gen_reason(void)
Definition: router.c:1699
download_status_t ei_dl_status
#define DIR_PURPOSE_FETCH_HSDESC
Definition: directory.h:74
#define DIR_PURPOSE_FETCH_CERTIFICATE
Definition: directory.h:59
#define ALLOW_DIRECTORY_TIME_SKEW
Definition: dirclient.c:74
const char * data
Definition: mmap.h:26
const node_t * node_get_by_id(const char *identity_digest)
Definition: nodelist.c:223
void authority_cert_dl_failed(const char *id_digest, const char *signing_key_digest, int status)
Definition: authcert.c:683
int FetchDirInfoExtraEarly
const char * fmt_addr32(uint32_t addr)
Definition: address.c:1181
#define ROUTER_PURPOSE_BRIDGE
int rend_valid_v2_service_id(const char *query)
Definition: rendcommon.c:719
#define ROUTER_PURPOSE_GENERAL
#define LOG_WARN
Definition: log.h:53
Entry connection structure.
int tor_addr_is_null(const tor_addr_t *addr)
Definition: address.c:770
char * Socks5Proxy
static int handle_response_upload_renddesc_v2(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2832
static void connection_dir_download_routerdesc_failed(dir_connection_t *conn)
Definition: dirclient.c:788
const char * routerstatus_describe(const routerstatus_t *rs)
Definition: describe.c:184
Header for feature/dirclient/dirclient_modes.c.
rend_data_t * rend_data
void base16_encode(char *dest, size_t destlen, const char *src, size_t srclen)
Definition: binascii.c:478
int rend_cache_store_v2_desc_as_client(const char *desc, const char *desc_id_base32, const rend_data_t *rend_query, rend_cache_entry_t **entry)
Definition: rendcache.c:835
int fascist_firewall_allows_address_addr(const tor_addr_t *addr, uint16_t port, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)
Definition: policies.c:557
int parse_http_response(const char *headers, int *code, time_t *date, compress_method_t *compression, char **reason)
Definition: directory.c:348
#define DIR_PURPOSE_IS_UPLOAD(p)
Definition: directory.h:82
int connection_connect(connection_t *conn, const char *address, const tor_addr_t *addr, uint16_t port, int *socket_error)
Definition: connection.c:2184
void directory_request_free_(directory_request_t *req)
Definition: dirclient.c:964
#define LD_REND
Definition: log.h:84
Header file for rendservice.c.
struct circuit_guard_state_t * guard_state
void retry_bridge_descriptor_fetch_directly(const char *digest)
Definition: bridges.c:709
rend_data_t * rend_data_dup(const rend_data_t *data)
Definition: hs_common.c:385
void control_event_hsv2_descriptor_received(const char *onion_address, const rend_data_t *rend_data, const char *hsdir_id_digest)
int tor_digest_is_zero(const char *digest)
Definition: util_string.c:96
void digest256_to_base64(char *d64, const char *digest)
static void connection_dir_retry_bridges(smartlist_t *descs)
Definition: dirclient.c:770
void directory_request_fetch_set_hs_ident(directory_request_t *req, const hs_ident_dir_conn_t *ident)
Definition: dirclient.c:1119
int directories_have_accepted_server_descriptor(void)
Definition: dirclient.c:203
Client/server directory connection structure.
void connection_dir_client_refetch_hsdesc_if_needed(dir_connection_t *dir_conn)
Definition: dirclient.c:2950
unsigned int type
Definition: connection_st.h:50
void directory_get_from_dirserver(uint8_t dir_purpose, uint8_t router_purpose, const char *resource, int pds_flags, download_want_authority_t want_authority)
Definition: dirclient.c:453
void format_rfc1123_time(char *buf, time_t t)
Definition: time_fmt.c:182
#define LD_DIR
Definition: log.h:88
entry_connection_t * connection_ap_make_link(connection_t *partner, char *address, uint16_t port, const char *digest, int session_group, int isolation_flags, int use_begindir, int want_onehop)
char * http_get_header(const char *headers, const char *which)
Definition: directory.c:313
static void dir_consensus_request_set_additional_headers(directory_request_t *req, const char *resource)
Definition: dirclient.c:369
void directory_request_set_guard_state(directory_request_t *req, circuit_guard_state_t *state)
Definition: dirclient.c:1131
void config_line_prepend(config_line_t **lst, const char *key, const char *val)
Definition: confline.c:53
Header file for connection_edge.c.
#define REND_SERVICE_ID_LEN_BASE32
Definition: or.h:331
unsigned int caches_extra_info
Definition: routerinfo_st.h:72
Header file for fp_pair.c.
static int compare_strs_(const void **a, const void **b)
Definition: dirclient.c:1439
static int handle_response_fetch_certificate(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2286
Header file containing control port event related code.
cached_dir_t * dirserv_get_consensus(const char *flavor_name)
Definition: dirserv.c:201
int tor_snprintf(char *str, size_t size, const char *format,...)
Definition: printf.c:27
void sr_act_post_consensus(const networkstatus_t *consensus)
char * tor_addr_to_str_dup(const tor_addr_t *addr)
Definition: address.c:1134
void format_iso_time(char *buf, time_t t)
Definition: time_fmt.c:295
const routerinfo_t * router_get_my_routerinfo(void)
Definition: router.c:1624
char * smartlist_join_strings(smartlist_t *sl, const char *join, int terminate, size_t *len_out)
Definition: smartlist.c:279
static void dir_microdesc_download_failed(smartlist_t *failed, int status_code, const char *dir_id)
Definition: dirclient.c:3124
const char * rend_data_get_address(const rend_data_t *rend_data)
Definition: hs_common.c:527
void router_dirport_found_reachable(void)
Definition: selftest.c:245
microdesc_cache_t * get_microdesc_cache(void)
Definition: microdesc.c:250
int dirclient_fetches_from_authorities(const or_options_t *options)
void clock_skew_warning(const connection_t *conn, long apparent_skew, int trusted, log_domain_mask_t domain, const char *received, const char *source)
Definition: connection.c:5643
Header file for dirvote.c.
#define SMARTLIST_FOREACH(sl, type, var, cmd)
void connection_start_reading(connection_t *conn)
Definition: mainloop.c:632
time_t last_dir_503_at
void directory_request_set_router_purpose(directory_request_t *req, uint8_t router_purpose)
Definition: dirclient.c:1010
dir_server_t * router_get_fallback_dirserver_by_digest(const char *digest)
Definition: dirlist.c:133
int networkstatus_set_current_consensus(const char *consensus, size_t consensus_len, const char *flavor, unsigned flags, const char *source_dir)
const char * escaped(const char *s)
Definition: escape.c:126
uint16_t port
#define DIR_PURPOSE_UPLOAD_RENDDESC_V2
Definition: directory.h:65
static int handle_response_upload_signatures(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2677
static int directory_command_should_use_begindir(const or_options_t *options, const directory_request_t *req, const char **reason)
Definition: dirclient.c:887
int hs_client_refetch_hsdesc(const ed25519_public_key_t *identity_pk)
Definition: hs_client.c:1895
#define ISO_SESSIONGRP
Definition: or.h:970
char identity_digest[DIGEST_LEN]
Header file for dlstatus.c.
#define fmt_addr(a)
Definition: address.h:211
void directory_initiate_request(directory_request_t *request)
Definition: dirclient.c:1229
#define ARRAY_LENGTH(x)
const char * router_purpose_to_string(uint8_t p)
Definition: routerinfo.c:59
#define log_fn(severity, domain, args,...)
Definition: log.h:287
int rend_get_service_id(crypto_pk_t *pk, char *out)
Definition: rendcommon.c:706
int dir_split_resource_into_fingerprints(const char *resource, smartlist_t *fp_out, int *compressed_out, int flags)
Definition: directory.c:628
int router_digest_is_me(const char *digest)
Definition: router.c:1587
#define DIR_PURPOSE_HAS_FETCHED_RENDDESC_V2
Definition: directory.h:35
int fascist_firewall_allows_dir_server(const dir_server_t *ds, firewall_connection_t fw_connection, int pref_only)
Definition: policies.c:771
#define DIR_PURPOSE_FETCH_MICRODESC
Definition: directory.h:70
uint8_t digest_sha3_as_signed[DIGEST256_LEN]
Definition: cached_dir_st.h:25
Definition: or.h:894
time_t approx_time(void)
Definition: approx_time.c:32
static const routerstatus_t * directory_pick_generic_dirserver(dirinfo_type_t type, int pds_flags, uint8_t dir_purpose, circuit_guard_state_t **guard_state_out)
Definition: dirclient.c:335
void fascist_firewall_choose_address_node(const node_t *node, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:1057
#define DIR_PURPOSE_HAS_FETCHED_HSDESC
Definition: directory.h:77
#define LOG_DEBUG
Definition: log.h:42
void directory_request_set_indirection(directory_request_t *req, dir_indirection_t indirection)
Definition: dirclient.c:1026
#define BASE64_DIGEST256_LEN
Definition: crypto_digest.h:29
Header file for dirlist.c.
Header file for hs_cache.c.
#define PDS_NO_EXISTING_MICRODESC_FETCH
Definition: node_select.h:67
char * consensus_diff_apply(const char *consensus, size_t consensus_len, const char *diff, size_t diff_len)
Definition: consdiff.c:1381
void directory_request_add_header(directory_request_t *req, const char *key, const char *val)
Definition: dirclient.c:1078
int connection_dir_reached_eof(dir_connection_t *conn)
Definition: dirclient.c:2929
static int handle_response_upload_dir(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2573
int public_server_mode(const or_options_t *options)
Definition: routermode.c:43
void rep_hist_note_used_port(time_t now, uint16_t port)
int base16_decode(char *dest, size_t destlen, const char *src, size_t srclen)
Definition: binascii.c:506
size_t size
Definition: mmap.h:27
Header file for selftest.c.
tor_addr_t addr
#define CONN_TYPE_DIR
Definition: connection.h:53
uint32_t addr
Definition: routerinfo_st.h:24
routerstatus_t fake_status
Definition: dir_server_st.h:51
static int handle_response_fetch_status_vote(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2346
STATIC dirinfo_type_t dir_fetch_type(int dir_purpose, int router_purpose, const char *resource)
Definition: dirclient.c:138
compress_method_t
Definition: compress.h:21
int entry_list_is_constrained(const or_options_t *options)
Definition: entrynodes.c:3274
int control_event_server_status(int severity, const char *format,...)
smartlist_t * connection_dir_list_by_purpose_and_resource(int purpose, const char *resource)
Definition: connection.c:4650
#define LD_NET
Definition: log.h:66
STATIC int handle_response_fetch_hsdesc_v3(dir_connection_t *conn, const response_handler_args_t *args)
Definition: dirclient.c:2714
void connection_watch_events(connection_t *conn, watchable_events_t events)
Definition: mainloop.c:494
int looks_like_a_consensus_diff(const char *document, size_t len)
Definition: consdiff.c:1416
void directory_request_set_rend_query(directory_request_t *req, const rend_data_t *query)
Definition: dirclient.c:1090
static int handle_response_upload_vote(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2641
int routerset_contains_routerstatus(const routerset_t *set, const routerstatus_t *rs, country_t country)
Definition: routerset.c:322
static int connection_dir_client_reached_eof(dir_connection_t *conn)
Definition: dirclient.c:1977
#define DIR_CONN_STATE_CONNECTING
Definition: directory.h:19
void directory_request_upload_set_hs_ident(directory_request_t *req, const hs_ident_dir_conn_t *ident)
Definition: dirclient.c:1105
int dirvote_add_signatures(const char *detached_signatures_body, const char *source, const char **msg)
Definition: dirvote.c:3631
void tor_addr_copy(tor_addr_t *dest, const tor_addr_t *src)
Definition: address.c:904
void directory_request_set_payload(directory_request_t *req, const char *payload, size_t payload_len)
Definition: dirclient.c:1050
tor_addr_t HTTPProxyAddr
Header file for routerinfo.c.
Header file for rendclient.c.
Header file for control_events.c.
#define LD_PROTOCOL
Definition: log.h:72
void directory_request_set_routerstatus(directory_request_t *req, const routerstatus_t *status)
Definition: dirclient.c:1156
const char * compression_method_get_human_name(compress_method_t method)
Definition: compress.c:390
void smartlist_sort(smartlist_t *sl, int(*compare)(const void **a, const void **b))
Definition: smartlist.c:334
void rend_client_refetch_v2_renddesc(rend_data_t *rend_query)
Definition: rendclient.c:709
STATIC int handle_response_fetch_microdesc(dir_connection_t *conn, const response_handler_args_t *args)
Definition: dirclient.c:2514
ed25519_public_key_t identity_pk
Definition: hs_ident.h:90
#define DIR_PURPOSE_FETCH_RENDDESC_V2
Definition: directory.h:68
static void connection_dir_bridge_routerdesc_failed(dir_connection_t *conn)
Definition: dirclient.c:807
This file contains ABI/API of the shared random protocol defined in proposal #250....
time_t timestamp_last_write_allowed
static void copy_ipv6_address(char *destination, const char *source, size_t len, int decorate)
Definition: dirclient.c:1505
uint8_t state
Definition: connection_st.h:49
const node_t * guards_choose_dirguard(uint8_t dir_purpose, circuit_guard_state_t **guard_state_out)
Definition: entrynodes.c:3689
void directory_request_set_if_modified_since(directory_request_t *req, time_t if_modified_since)
Definition: dirclient.c:1064
Header file for networkstatus.c.
uint16_t HTTPProxyPort
#define LD_BUG
Definition: log.h:86
Header file for predict_ports.c.
void directory_request_set_or_addr_port(directory_request_t *req, const tor_addr_port_t *p)
Definition: dirclient.c:977
Header file for routerlist.c.
int FetchUselessDescriptors
int router_load_routers_from_string(const char *s, const char *eos, saved_location_t saved_location, smartlist_t *requested_fingerprints, int descriptor_digests, const char *prepend_annotations)
Definition: routerlist.c:2025
static sa_family_t tor_addr_family(const tor_addr_t *a)
Definition: address.h:179
const routerstatus_t * router_pick_fallback_dirserver(dirinfo_type_t type, int flags)
Definition: node_select.c:1053
Networkstatus consensus/vote structure.
static int handle_response_upload_hsdesc(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2883
tor_mmap_t * networkstatus_map_cached_consensus(const char *flavorname)
void router_load_extrainfo_from_string(const char *s, const char *eos, saved_location_t saved_location, smartlist_t *requested_fingerprints, int descriptor_digests)
Definition: routerlist.c:2124