Tor  0.4.3.0-alpha-dev
entrynodes.h
Go to the documentation of this file.
1 /* Copyright (c) 2001 Matej Pfajfar.
2  * Copyright (c) 2001-2004, Roger Dingledine.
3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4  * Copyright (c) 2007-2019, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
6 
7 /**
8  * \file entrynodes.h
9  * \brief Header file for circuitbuild.c.
10  **/
11 
12 #ifndef TOR_ENTRYNODES_H
13 #define TOR_ENTRYNODES_H
14 
15 #include "lib/container/handles.h"
16 
17 /* Forward declare for guard_selection_t; entrynodes.c has the real struct */
18 typedef struct guard_selection_s guard_selection_t;
19 
20 /* Forward declare for entry_guard_t; the real declaration is private. */
21 typedef struct entry_guard_t entry_guard_t;
22 
23 /* Forward declaration for circuit_guard_state_t; the real declaration is
24  private. */
25 typedef struct circuit_guard_state_t circuit_guard_state_t;
26 
27 /* Forward declaration for entry_guard_restriction_t; the real declaration is
28  private. */
29 typedef struct entry_guard_restriction_t entry_guard_restriction_t;
30 
31 /** Information about a guard's pathbias status.
32  * These fields are used in circpathbias.c to try to detect entry
33  * nodes that are failing circuits at a suspicious frequency.
34  */
35 typedef struct guard_pathbias_t {
36  unsigned int path_bias_noticed : 1; /**< Did we alert the user about path
37  * bias for this node already? */
38  unsigned int path_bias_warned : 1; /**< Did we alert the user about path bias
39  * for this node already? */
40  unsigned int path_bias_extreme : 1; /**< Did we alert the user about path
41  * bias for this node already? */
42  unsigned int path_bias_disabled : 1; /**< Have we disabled this node because
43  * of path bias issues? */
44  unsigned int path_bias_use_noticed : 1; /**< Did we alert the user about path
45  * use bias for this node already? */
46  unsigned int path_bias_use_extreme : 1; /**< Did we alert the user about path
47  * use bias for this node already? */
48 
49  double circ_attempts; /**< Number of circuits this guard has "attempted" */
50  double circ_successes; /**< Number of successfully built circuits using
51  * this guard as first hop. */
52  double successful_circuits_closed; /**< Number of circuits that carried
53  * streams successfully. */
54  double collapsed_circuits; /**< Number of fully built circuits that were
55  * remotely closed before any streams were
56  * attempted. */
57  double unusable_circuits; /**< Number of circuits for which streams were
58  * attempted, but none succeeded. */
59  double timeouts; /**< Number of 'right-censored' circuit timeouts for this
60  * guard. */
61  double use_attempts; /**< Number of circuits we tried to use with streams */
62  double use_successes; /**< Number of successfully used circuits using
63  * this guard as first hop. */
65 
66 #if defined(ENTRYNODES_PRIVATE)
68 
69 /**
70  * @name values for entry_guard_t.is_reachable.
71  *
72  * See entry_guard_t.is_reachable for more information.
73  */
74 /**@{*/
75 #define GUARD_REACHABLE_NO 0
76 #define GUARD_REACHABLE_YES 1
77 #define GUARD_REACHABLE_MAYBE 2
78 /**@}*/
79 
80 /** An entry_guard_t represents our information about a chosen long-term
81  * first hop, known as a "helper" node in the literature. We can't just
82  * use a node_t, since we want to remember these even when we
83  * don't have any directory info. */
84 struct entry_guard_t {
85  HANDLE_ENTRY(entry_guard, entry_guard_t);
86 
87  char nickname[MAX_HEX_NICKNAME_LEN+1];
88  char identity[DIGEST_LEN];
90 
91  /**
92  * @name new guard selection algorithm fields.
93  *
94  * Only the new (prop271) algorithm uses these. For a more full
95  * description of the algorithm, see the module documentation for
96  * entrynodes.c
97  */
98  /**@{*/
99 
100  /* == Persistent fields, present for all sampled guards. */
101  /** When was this guard added to the sample? */
102  time_t sampled_on_date;
103  /** Since what date has this guard been "unlisted"? A guard counts as
104  * unlisted if we have a live consensus that does not include it, or
105  * if we have a live consensus that does not include it as a usable
106  * guard. This field is zero when the guard is listed. */
107  time_t unlisted_since_date; // can be zero
108  /** What version of Tor added this guard to the sample? */
109  char *sampled_by_version;
110  /** Is this guard listed right now? If this is set, then
111  * unlisted_since_date should be set too. */
112  unsigned currently_listed : 1;
113 
114  /* == Persistent fields, for confirmed guards only */
115  /** When was this guard confirmed? (That is, when did we first use it
116  * successfully and decide to keep it?) This field is zero if this is not a
117  * confirmed guard. */
118  time_t confirmed_on_date; /* 0 if not confirmed */
119  /**
120  * In what order was this guard confirmed? Guards with lower indices
121  * appear earlier on the confirmed list. If the confirmed list is compacted,
122  * this field corresponds to the index of this guard on the confirmed list.
123  *
124  * This field is set to -1 if this guard is not confirmed.
125  */
126  int confirmed_idx; /* -1 if not confirmed; otherwise the order that this
127  * item should occur in the CONFIRMED_GUARDS ordered
128  * list */
129 
130  /**
131  * Which selection does this guard belong to?
132  */
133  char *selection_name;
134 
135  /** Bridges only: address of the bridge. */
136  tor_addr_port_t *bridge_addr;
137 
138  /* ==== Non-persistent fields. */
139  /* == These are used by sampled guards */
140  /** When did we last decide to try using this guard for a circuit? 0 for
141  * "not since we started up." */
142  time_t last_tried_to_connect;
143  /** How reachable do we consider this guard to be? One of
144  * GUARD_REACHABLE_NO, GUARD_REACHABLE_YES, or GUARD_REACHABLE_MAYBE. */
145  unsigned is_reachable : 2;
146  /** Boolean: true iff this guard is pending. A pending guard is one
147  * that we have an in-progress circuit through, and which we do not plan
148  * to try again until it either succeeds or fails. Primary guards can
149  * never be pending. */
150  unsigned is_pending : 1;
151  /** If true, don't write this guard to disk. (Used for bridges with unknown
152  * identities) */
153  unsigned is_persistent : 1;
154  /** When did we get the earliest connection failure for this guard?
155  * We clear this field on a successful connect. We do _not_ clear it
156  * when we mark the guard as "MAYBE" reachable.
157  */
158  time_t failing_since;
159 
160  /* == Set inclusion flags. */
161  /** If true, this guard is in the filtered set. The filtered set includes
162  * all sampled guards that our configuration allows us to use. */
163  unsigned is_filtered_guard : 1;
164  /** If true, this guard is in the usable filtered set. The usable filtered
165  * set includes all filtered guards that are not believed to be
166  * unreachable. (That is, those for which is_reachable is not
167  * GUARD_REACHABLE_NO) */
168  unsigned is_usable_filtered_guard : 1;
169  unsigned is_primary:1;
170 
171  /** This string holds any fields that we are maintaining because
172  * we saw them in the state, even if we don't understand them. */
173  char *extra_state_fields;
174 
175  /** Backpointer to the guard selection that this guard belongs to.
176  * The entry_guard_t must never outlive its guard_selection. */
177  guard_selection_t *in_selection;
178  /**@}*/
179 
180  /** Path bias information for this guard. */
181  guard_pathbias_t pb;
182 };
183 
184 /**
185  * Possible rules for a guard selection to follow
186  */
187 typedef enum guard_selection_type_t {
188  /** Infer the type of this selection from its name. */
189  GS_TYPE_INFER=0,
190  /** Use the normal guard selection algorithm, taking our sample from the
191  * complete list of guards in the consensus. */
192  GS_TYPE_NORMAL=1,
193  /** Use the normal guard selection algorithm, taking our sample from the
194  * configured bridges, and allowing it to grow as large as all the configured
195  * bridges */
196  GS_TYPE_BRIDGE,
197  /** Use the normal guard selection algorithm, taking our sample from the
198  * set of filtered nodes. */
199  GS_TYPE_RESTRICTED,
200 } guard_selection_type_t;
201 
202 /**
203  * All of the the context for guard selection on a particular client.
204  *
205  * We maintain multiple guard selection contexts for a client, depending
206  * aspects on its current configuration -- whether an extremely
207  * restrictive EntryNodes is used, whether UseBridges is enabled, and so
208  * on.)
209  *
210  * See the module documentation for entrynodes.c for more information
211  * about guard selection algorithms.
212  */
213 struct guard_selection_s {
214  /**
215  * The name for this guard-selection object. (Must not contain spaces).
216  */
217  char *name;
218 
219  /**
220  * What rules does this guard-selection object follow?
221  */
222  guard_selection_type_t type;
223 
224  /**
225  * A value of 1 means that primary_entry_guards is up-to-date with respect to
226  * the consensus and status info that we currently have; 0 means we need to
227  * recalculate it before using primary_entry_guards or the is_primary flag on
228  * any guard.
229  */
230  int primary_guards_up_to_date;
231 
232  /**
233  * A list of the sampled entry guards, as entry_guard_t structures.
234  * Not in any particular order. When we 'sample' a guard, we are
235  * noting it as a possible guard to pick in the future. The use of
236  * sampling here prevents us from being forced by an attacker to try
237  * every guard on the network. This list is persistent.
238  */
239  smartlist_t *sampled_entry_guards;
240 
241  /**
242  * Ordered list (from highest to lowest priority) of guards that we
243  * have successfully contacted and decided to use. Every member of
244  * this list is a member of sampled_entry_guards. Every member should
245  * have confirmed_on_date set, and have confirmed_idx greater than
246  * any earlier member of the list.
247  *
248  * This list is persistent. It is a subset of the elements in
249  * sampled_entry_guards, and its pointers point to elements of
250  * sampled_entry_guards.
251  */
252  smartlist_t *confirmed_entry_guards;
253 
254  /**
255  * Ordered list (from highest to lowest priority) of guards that we
256  * are willing to use the most happily. These guards may or may not
257  * yet be confirmed yet. If we can use one of these guards, we are
258  * probably not on a network that is trying to restrict our guard
259  * choices.
260  *
261  * This list is a subset of the elements in
262  * sampled_entry_guards, and its pointers point to elements of
263  * sampled_entry_guards.
264  */
265  smartlist_t *primary_entry_guards;
266 
267  /** When did we last successfully build a circuit or use a circuit? */
268  time_t last_time_on_internet;
269 
270  /** What confirmed_idx value should the next-added member of
271  * confirmed_entry_guards receive? */
272  int next_confirmed_idx;
273 
274 };
275 
276 struct entry_guard_handle_t;
277 
278 /** Types of restrictions we impose when picking guard nodes */
279 typedef enum guard_restriction_type_t {
280  /* Don't pick the same guard node as our exit node (or its family) */
281  RST_EXIT_NODE = 0,
282  /* Don't pick dirguards that have previously shown to be outdated */
283  RST_OUTDATED_MD_DIRSERVER = 1
284 } guard_restriction_type_t;
285 
286 /**
287  * A restriction to remember which entry guards are off-limits for a given
288  * circuit.
289  *
290  * Note: This mechanism is NOT for recording which guards are never to be
291  * used: only which guards cannot be used on <em>one particular circuit</em>.
292  */
293 struct entry_guard_restriction_t {
294  /* What type of restriction are we imposing? */
295  guard_restriction_type_t type;
296 
297  /* In case of restriction type RST_EXIT_NODE, the guard's RSA identity
298  * digest must not equal this; and it must not be in the same family as any
299  * node with this digest. */
300  uint8_t exclude_id[DIGEST_LEN];
301 };
302 
303 /**
304  * Per-circuit state to track whether we'll be able to use the circuit.
305  */
306 struct circuit_guard_state_t {
307  /** Handle to the entry guard object for this circuit. */
308  struct entry_guard_handle_t *guard;
309  /** The time at which <b>state</b> last changed. */
310  time_t state_set_at;
311  /** One of GUARD_CIRC_STATE_* */
312  uint8_t state;
313 
314  /**
315  * A set of restrictions that were placed on this guard when we selected it
316  * for this particular circuit. We need to remember the restrictions here,
317  * since any guard that breaks these restrictions will not block this
318  * circuit from becoming COMPLETE.
319  */
320  entry_guard_restriction_t *restrictions;
321 };
322 #endif /* defined(ENTRYNODES_PRIVATE) */
323 
324 /* Common entry points for old and new guard code */
325 int guards_update_all(void);
327  uint8_t purpose,
328  circuit_guard_state_t **guard_state_out);
329 const node_t *guards_choose_dirguard(uint8_t dir_purpose,
330  circuit_guard_state_t **guard_state_out);
331 
332 #if 1
333 /* XXXX NM I would prefer that all of this stuff be private to
334  * entrynodes.c. */
336  guard_selection_t *gs, const char *digest);
337 entry_guard_t *entry_guard_get_by_id_digest(const char *digest);
338 
339 circuit_guard_state_t *
340 get_guard_state_for_bridge_desc_fetch(const char *digest);
341 
342 void entry_guards_changed_for_guard_selection(guard_selection_t *gs);
343 void entry_guards_changed(void);
344 guard_selection_t * get_guard_selection_info(void);
345 int num_live_entry_guards_for_guard_selection(
346  guard_selection_t *gs,
347  int for_directory);
348 int num_live_entry_guards(int for_directory);
349 #endif /* 1 */
350 
351 const node_t *entry_guard_find_node(const entry_guard_t *guard);
352 const char *entry_guard_get_rsa_id_digest(const entry_guard_t *guard);
353 const char *entry_guard_describe(const entry_guard_t *guard);
354 guard_pathbias_t *entry_guard_get_pathbias_state(entry_guard_t *guard);
355 
356 /** Enum to specify how we're going to use a given guard, when we're picking
357  * one for immediate use. */
358 typedef enum {
359  GUARD_USAGE_TRAFFIC = 0,
360  GUARD_USAGE_DIRGUARD = 1
361 } guard_usage_t;
362 
363 #define circuit_guard_state_free(val) \
364  FREE_AND_NULL(circuit_guard_state_t, circuit_guard_state_free_, (val))
365 
366 void circuit_guard_state_free_(circuit_guard_state_t *state);
367 int entry_guard_pick_for_circuit(guard_selection_t *gs,
368  guard_usage_t usage,
369  entry_guard_restriction_t *rst,
370  const node_t **chosen_node_out,
371  circuit_guard_state_t **guard_state_out);
372 
373 /* We just connected to an entry guard. What should we do with the circuit? */
374 typedef enum {
375  GUARD_USABLE_NEVER = -1, /* Never use the circuit */
376  GUARD_MAYBE_USABLE_LATER = 0, /* Keep it. We might use it in the future */
377  GUARD_USABLE_NOW = 1, /* Use it right now */
378 } guard_usable_t;
379 
380 guard_usable_t entry_guard_succeeded(circuit_guard_state_t **guard_state_p);
381 void entry_guard_failed(circuit_guard_state_t **guard_state_p);
382 void entry_guard_cancel(circuit_guard_state_t **guard_state_p);
383 void entry_guard_chan_failed(channel_t *chan);
384 int entry_guards_update_all(guard_selection_t *gs);
385 int entry_guards_upgrade_waiting_circuits(guard_selection_t *gs,
386  const smartlist_t *all_circuits,
387  smartlist_t *newly_complete_out);
388 int entry_guard_state_should_expire(circuit_guard_state_t *guard_state);
389 void entry_guards_note_internet_connectivity(guard_selection_t *gs);
390 
391 int update_guard_selection_choice(const or_options_t *options);
392 
393 int entry_guard_could_succeed(const circuit_guard_state_t *guard_state);
394 
395 MOCK_DECL(int,num_bridges_usable,(int use_maybe_reachable));
396 
397 #ifdef ENTRYNODES_PRIVATE
398 /**
399  * @name Default values for the parameters for the new (prop271) entry guard
400  * algorithm.
401  */
402 /**@{*/
403 /**
404  * We never let our sampled guard set grow larger than this percentage
405  * of the guards on the network.
406  */
407 #define DFLT_MAX_SAMPLE_THRESHOLD_PERCENT 20
408 /**
409  * We never let our sampled guard set grow larger than this number of
410  * guards.
411  */
412 #define DFLT_MAX_SAMPLE_SIZE 60
413 /**
414  * We always try to make our sample contain at least this many guards.
415  */
416 #define DFLT_MIN_FILTERED_SAMPLE_SIZE 20
417 /**
418  * If a guard is unlisted for this many days in a row, we remove it.
419  */
420 #define DFLT_REMOVE_UNLISTED_GUARDS_AFTER_DAYS 20
421 /**
422  * We remove unconfirmed guards from the sample after this many days,
423  * regardless of whether they are listed or unlisted.
424  */
425 #define DFLT_GUARD_LIFETIME_DAYS 120
426 /**
427  * We remove confirmed guards from the sample if they were sampled
428  * GUARD_LIFETIME_DAYS ago and confirmed this many days ago.
429  */
430 #define DFLT_GUARD_CONFIRMED_MIN_LIFETIME_DAYS 60
431 /**
432  * How many guards do we try to keep on our primary guard list?
433  */
434 #define DFLT_N_PRIMARY_GUARDS 3
435 /**
436  * Of the live guards on the primary guard list, how many do we consider when
437  * choosing a guard to use?
438  */
439 #define DFLT_N_PRIMARY_GUARDS_TO_USE 1
440 /**
441  * As DFLT_N_PRIMARY_GUARDS, but for choosing which directory guard to use.
442  */
443 #define DFLT_N_PRIMARY_DIR_GUARDS_TO_USE 3
444 /**
445  * If we haven't successfully built or used a circuit in this long, then
446  * consider that the internet is probably down.
447  */
448 #define DFLT_INTERNET_LIKELY_DOWN_INTERVAL (10*60)
449 /**
450  * If we're trying to connect to a nonprimary guard for at least this
451  * many seconds, and we haven't gotten the connection to work, we will treat
452  * lower-priority guards as usable.
453  */
454 #define DFLT_NONPRIMARY_GUARD_CONNECT_TIMEOUT 15
455 /**
456  * If a circuit has been sitting around in 'waiting for better guard' state
457  * for at least this long, we'll expire it.
458  */
459 #define DFLT_NONPRIMARY_GUARD_IDLE_TIMEOUT (10*60)
460 /**
461  * If our configuration retains fewer than this fraction of guards from the
462  * torrc, we are in a restricted setting.
463  */
464 #define DFLT_MEANINGFUL_RESTRICTION_PERCENT 20
465 /**
466  * If our configuration retains fewer than this fraction of guards from the
467  * torrc, we are in an extremely restricted setting, and should warn.
468  */
469 #define DFLT_EXTREME_RESTRICTION_PERCENT 1
470 /**@}*/
471 
472 STATIC double get_max_sample_threshold(void);
476 STATIC int get_guard_lifetime(void);
478 STATIC int get_n_primary_guards(void);
485 
486 HANDLE_DECL(entry_guard, entry_guard_t, STATIC)
487 #define entry_guard_handle_free(h) \
488  FREE_AND_NULL(entry_guard_handle_t, entry_guard_handle_free_, (h))
489 
490 STATIC guard_selection_type_t guard_selection_infer_type(
491  guard_selection_type_t type_in,
492  const char *name);
493 STATIC guard_selection_t *guard_selection_new(const char *name,
494  guard_selection_type_t type);
495 STATIC guard_selection_t *get_guard_selection_by_name(
496  const char *name, guard_selection_type_t type, int create_if_absent);
497 STATIC void guard_selection_free_(guard_selection_t *gs);
498 #define guard_selection_free(gs) \
499  FREE_AND_NULL(guard_selection_t, guard_selection_free_, (gs))
501  (guard_selection_t *gs, const entry_guard_t *guard));
502 STATIC const char *choose_guard_selection(const or_options_t *options,
503  const networkstatus_t *ns,
504  const guard_selection_t *old_selection,
505  guard_selection_type_t *type_out);
506 STATIC entry_guard_t *get_sampled_guard_with_id(guard_selection_t *gs,
507  const uint8_t *rsa_id);
508 
509 MOCK_DECL(STATIC time_t, randomize_time, (time_t now, time_t max_backdate));
510 
511 MOCK_DECL(STATIC circuit_guard_state_t *,
512  circuit_guard_state_new,(entry_guard_t *guard, unsigned state,
513  entry_guard_restriction_t *rst));
514 
515 STATIC entry_guard_t *entry_guard_add_to_sample(guard_selection_t *gs,
516  const node_t *node);
517 STATIC entry_guard_t *entry_guards_expand_sample(guard_selection_t *gs);
518 STATIC char *entry_guard_encode_for_state(entry_guard_t *guard);
519 STATIC entry_guard_t *entry_guard_parse_from_state(const char *s);
520 #define entry_guard_free(e) \
521  FREE_AND_NULL(entry_guard_t, entry_guard_free_, (e))
522 STATIC void entry_guard_free_(entry_guard_t *e);
523 STATIC void entry_guards_update_filtered_sets(guard_selection_t *gs);
524 STATIC int entry_guards_all_primary_guards_are_down(guard_selection_t *gs);
525 /**
526  * @name Flags for sample_reachable_filtered_entry_guards()
527  */
528 /**@{*/
529 #define SAMPLE_EXCLUDE_CONFIRMED (1u<<0)
530 #define SAMPLE_EXCLUDE_PRIMARY (1u<<1)
531 #define SAMPLE_EXCLUDE_PENDING (1u<<2)
532 #define SAMPLE_NO_UPDATE_PRIMARY (1u<<3)
533 #define SAMPLE_EXCLUDE_NO_DESCRIPTOR (1u<<4)
534 /**@}*/
536  guard_selection_t *gs,
537  const entry_guard_restriction_t *rst,
538  unsigned flags);
539 STATIC void entry_guard_consider_retry(entry_guard_t *guard);
540 STATIC void make_guard_confirmed(guard_selection_t *gs, entry_guard_t *guard);
541 STATIC void entry_guards_update_confirmed(guard_selection_t *gs);
542 STATIC void entry_guards_update_primary(guard_selection_t *gs);
543 STATIC int num_reachable_filtered_guards(const guard_selection_t *gs,
544  const entry_guard_restriction_t *rst);
545 STATIC void sampled_guards_update_from_consensus(guard_selection_t *gs);
546 /**
547  * @name Possible guard-states for a circuit.
548  */
549 /**@{*/
550 /** State for a circuit that can (so far as the guard subsystem is
551  * concerned) be used for actual traffic as soon as it is successfully
552  * opened. */
553 #define GUARD_CIRC_STATE_USABLE_ON_COMPLETION 1
554 /** State for an non-open circuit that we shouldn't use for actual
555  * traffic, when it completes, unless other circuits to preferable
556  * guards fail. */
557 #define GUARD_CIRC_STATE_USABLE_IF_NO_BETTER_GUARD 2
558 /** State for an open circuit that we shouldn't use for actual traffic
559  * unless other circuits to preferable guards fail. */
560 #define GUARD_CIRC_STATE_WAITING_FOR_BETTER_GUARD 3
561 /** State for a circuit that can (so far as the guard subsystem is
562  * concerned) be used for actual traffic. */
563 #define GUARD_CIRC_STATE_COMPLETE 4
564 /** State for a circuit that is unusable, and will not become usable. */
565 #define GUARD_CIRC_STATE_DEAD 5
566 /**@}*/
567 STATIC void entry_guards_note_guard_failure(guard_selection_t *gs,
568  entry_guard_t *guard);
569 STATIC entry_guard_t *select_entry_guard_for_circuit(guard_selection_t *gs,
570  guard_usage_t usage,
571  const entry_guard_restriction_t *rst,
572  unsigned *state_out);
573 STATIC void mark_primary_guards_maybe_reachable(guard_selection_t *gs);
574 STATIC unsigned entry_guards_note_guard_success(guard_selection_t *gs,
575  entry_guard_t *guard,
576  unsigned old_state);
577 STATIC int entry_guard_has_higher_priority(entry_guard_t *a, entry_guard_t *b);
578 STATIC char *getinfo_helper_format_single_entry_guard(const entry_guard_t *e);
579 
580 STATIC entry_guard_restriction_t *guard_create_exit_restriction(
581  const uint8_t *exit_id);
582 
583 STATIC entry_guard_restriction_t *guard_create_dirserver_md_restriction(void);
584 
585 STATIC void entry_guard_restriction_free_(entry_guard_restriction_t *rst);
586 #define entry_guard_restriction_free(rst) \
587  FREE_AND_NULL(entry_guard_restriction_t, \
588  entry_guard_restriction_free_, (rst))
589 
590 #endif /* defined(ENTRYNODES_PRIVATE) */
591 
592 void remove_all_entry_guards_for_guard_selection(guard_selection_t *gs);
593 void remove_all_entry_guards(void);
594 
595 struct bridge_info_t;
597  const uint8_t *rsa_id_digest);
598 
599 int entry_list_is_constrained(const or_options_t *options);
600 int guards_retry_optimistic(const or_options_t *options);
601 int entry_guards_parse_state_for_guard_selection(
602  guard_selection_t *gs, or_state_t *state, int set, char **msg);
603 int entry_guards_parse_state(or_state_t *state, int set, char **msg);
606  const char *question, char **answer,
607  const char **errmsg);
608 
609 int entries_known_but_down(const or_options_t *options);
610 void entries_retry_all(const or_options_t *options);
611 
613  int num_present, int num_usable);
614 char *guard_selection_get_err_str_if_dir_info_missing(guard_selection_t *gs,
615  int using_mds,
616  int num_present, int num_usable);
617 
618 void entry_guards_free_all(void);
619 
620 double pathbias_get_close_success_count(entry_guard_t *guard);
621 double pathbias_get_use_success_count(entry_guard_t *guard);
622 
623 /** Contains the bandwidth of a relay as a guard and as a non-guard
624  * after the guardfraction has been considered. */
626  /** Bandwidth as a guard after guardfraction has been considered. */
627  int guard_bw;
628  /** Bandwidth as a non-guard after guardfraction has been considered. */
631 
633 
634 void
635 guard_get_guardfraction_bandwidth(guardfraction_bandwidth_t *guardfraction_bw,
636  int orig_bandwidth,
637  uint32_t guardfraction_percentage);
638 
639 #endif /* !defined(TOR_ENTRYNODES_H) */
int should_apply_guardfraction(const networkstatus_t *ns)
Definition: entrynodes.c:180
void entry_guard_learned_bridge_identity(const tor_addr_port_t *addrport, const uint8_t *rsa_id_digest)
Definition: entrynodes.c:950
STATIC int get_guard_lifetime(void)
Definition: entrynodes.c:427
STATIC double get_max_sample_threshold(void)
Definition: entrynodes.c:372
STATIC guard_selection_type_t guard_selection_infer_type(guard_selection_type_t type, const char *name)
Definition: entrynodes.c:213
#define MAX_HEX_NICKNAME_LEN
Definition: or.h:116
void entry_guards_update_state(or_state_t *state)
Definition: entrynodes.c:3441
double pathbias_get_use_success_count(entry_guard_t *guard)
const node_t * guards_choose_guard(cpath_build_state_t *state, uint8_t purpose, circuit_guard_state_t **guard_state_out)
Definition: entrynodes.c:3620
Definition: node_st.h:33
double use_attempts
Definition: entrynodes.h:61
int entry_guards_upgrade_waiting_circuits(guard_selection_t *gs, const smartlist_t *all_circuits, smartlist_t *newly_complete_out)
Definition: entrynodes.c:2584
const node_t * guards_choose_dirguard(uint8_t dir_purpose, circuit_guard_state_t **guard_state_out)
Definition: entrynodes.c:3689
STATIC void make_guard_confirmed(guard_selection_t *gs, entry_guard_t *guard)
Definition: entrynodes.c:1835
void entry_guard_chan_failed(channel_t *chan)
Definition: entrynodes.c:2500
STATIC void entry_guard_consider_retry(entry_guard_t *guard)
Definition: entrynodes.c:2000
STATIC guard_selection_t * get_guard_selection_by_name(const char *name, guard_selection_type_t type, int create_if_absent)
Definition: entrynodes.c:254
STATIC void entry_guards_update_primary(guard_selection_t *gs)
Definition: entrynodes.c:1865
int getinfo_helper_entry_guards(control_connection_t *conn, const char *question, char **answer, const char **errmsg)
Definition: entrynodes.c:3533
guard_pathbias_t * entry_guard_get_pathbias_state(entry_guard_t *guard)
Definition: entrynodes.c:334
STATIC guard_selection_t * guard_selection_new(const char *name, guard_selection_type_t type)
Definition: entrynodes.c:231
int entry_guards_parse_state(or_state_t *state, int set, char **msg)
Definition: entrynodes.c:3379
double unusable_circuits
Definition: entrynodes.h:57
double circ_attempts
Definition: entrynodes.h:49
unsigned int path_bias_extreme
Definition: entrynodes.h:40
STATIC int get_guard_confirmed_min_lifetime(void)
Definition: entrynodes.c:442
Macros for C weak-handle implementation.
STATIC time_t randomize_time(time_t now, time_t max_backdate)
Definition: entrynodes.c:346
void remove_all_entry_guards_for_guard_selection(guard_selection_t *gs)
Definition: entrynodes.c:3653
int num_bridges_usable(int use_maybe_reachable)
Definition: entrynodes.c:3294
STATIC void entry_guards_note_guard_failure(guard_selection_t *gs, entry_guard_t *guard)
Definition: entrynodes.c:2209
unsigned int path_bias_warned
Definition: entrynodes.h:38
const char * name
Definition: config.c:2211
STATIC int num_reachable_filtered_guards(const guard_selection_t *gs, const entry_guard_restriction_t *rst)
Definition: entrynodes.c:999
STATIC int entry_guards_all_primary_guards_are_down(guard_selection_t *gs)
Definition: entrynodes.c:2526
double successful_circuits_closed
Definition: entrynodes.h:52
#define STATIC
Definition: testsupport.h:32
unsigned int path_bias_use_noticed
Definition: entrynodes.h:44
STATIC unsigned entry_guards_note_guard_success(guard_selection_t *gs, entry_guard_t *guard, unsigned old_state)
Definition: entrynodes.c:2236
int guards_update_all(void)
Definition: entrynodes.c:3603
STATIC void mark_primary_guards_maybe_reachable(guard_selection_t *gs)
Definition: entrynodes.c:583
guard_usable_t entry_guard_succeeded(circuit_guard_state_t **guard_state_p)
Definition: entrynodes.c:2432
STATIC entry_guard_restriction_t * guard_create_dirserver_md_restriction(void)
Definition: entrynodes.c:1595
unsigned int path_bias_noticed
Definition: entrynodes.h:36
STATIC void entry_guard_free_(entry_guard_t *e)
Definition: entrynodes.c:3257
STATIC void entry_guards_update_filtered_sets(guard_selection_t *gs)
Definition: entrynodes.c:1700
STATIC char * entry_guard_encode_for_state(entry_guard_t *guard)
Definition: entrynodes.c:2777
STATIC int get_max_sample_size_absolute(void)
Definition: entrynodes.c:384
#define DIGEST_LEN
Definition: digest_sizes.h:20
STATIC entry_guard_t * select_entry_guard_for_circuit(guard_selection_t *gs, guard_usage_t usage, const entry_guard_restriction_t *rst, unsigned *state_out)
Definition: entrynodes.c:2164
const char * entry_guard_describe(const entry_guard_t *guard)
Definition: entrynodes.c:315
entry_guard_t * entry_guard_get_by_id_digest_for_guard_selection(guard_selection_t *gs, const char *digest)
Definition: entrynodes.c:3204
STATIC int entry_guard_is_listed(guard_selection_t *gs, const entry_guard_t *guard)
Definition: entrynodes.c:1245
STATIC int get_n_primary_guards_to_use(guard_usage_t usage)
Definition: entrynodes.c:476
STATIC const char * choose_guard_selection(const or_options_t *options, const networkstatus_t *live_ns, const guard_selection_t *old_selection, guard_selection_type_t *type_out)
Definition: entrynodes.c:615
void entry_guards_changed(void)
Definition: entrynodes.c:3430
STATIC entry_guard_t * entry_guard_add_to_sample(guard_selection_t *gs, const node_t *node)
Definition: entrynodes.c:843
Header for crypto_ed25519.c.
STATIC int get_remove_unlisted_guards_after_days(void)
Definition: entrynodes.c:404
unsigned int path_bias_disabled
Definition: entrynodes.h:42
STATIC int get_n_primary_guards(void)
Definition: entrynodes.c:456
void circuit_guard_state_free_(circuit_guard_state_t *state)
Definition: entrynodes.c:2349
void entry_guard_failed(circuit_guard_state_t **guard_state_p)
Definition: entrynodes.c:2480
STATIC char * getinfo_helper_format_single_entry_guard(const entry_guard_t *e)
Definition: entrynodes.c:3476
STATIC entry_guard_t * entry_guard_parse_from_state(const char *s)
Definition: entrynodes.c:2867
const node_t * entry_guard_find_node(const entry_guard_t *guard)
Definition: entrynodes.c:3213
char * guard_selection_get_err_str_if_dir_info_missing(guard_selection_t *gs, int using_mds, int num_present, int num_usable)
Definition: entrynodes.c:3732
void entry_guards_free_all(void)
Definition: entrynodes.c:3812
STATIC double get_extreme_restriction_threshold(void)
Definition: entrynodes.c:553
double circ_successes
Definition: entrynodes.h:50
STATIC int get_min_filtered_sample_size(void)
Definition: entrynodes.c:394
int entry_guard_could_succeed(const circuit_guard_state_t *guard_state)
Definition: entrynodes.c:3457
int entry_guard_pick_for_circuit(guard_selection_t *gs, guard_usage_t usage, entry_guard_restriction_t *rst, const node_t **chosen_node_out, circuit_guard_state_t **guard_state_out)
Definition: entrynodes.c:2386
int entry_guard_state_should_expire(circuit_guard_state_t *guard_state)
Definition: entrynodes.c:2748
STATIC void entry_guards_update_confirmed(guard_selection_t *gs)
Definition: entrynodes.c:1805
double pathbias_get_close_success_count(entry_guard_t *guard)
STATIC int entry_guard_has_higher_priority(entry_guard_t *a, entry_guard_t *b)
Definition: entrynodes.c:2302
STATIC int get_internet_likely_down_interval(void)
Definition: entrynodes.c:504
STATIC int get_nonprimary_guard_idle_timeout(void)
Definition: entrynodes.c:528
circuit_guard_state_t * get_guard_state_for_bridge_desc_fetch(const char *digest)
Definition: entrynodes.c:3232
STATIC void guard_selection_free_(guard_selection_t *gs)
Definition: entrynodes.c:3790
int guards_retry_optimistic(const or_options_t *options)
Definition: entrynodes.c:3715
STATIC entry_guard_t * get_sampled_guard_with_id(guard_selection_t *gs, const uint8_t *rsa_id)
Definition: entrynodes.c:780
int entry_list_is_constrained(const or_options_t *options)
Definition: entrynodes.c:3274
void remove_all_entry_guards(void)
Definition: entrynodes.c:3682
void entry_guards_note_internet_connectivity(guard_selection_t *gs)
Definition: entrynodes.c:2031
#define MOCK_DECL(rv, funcname, arglist)
Definition: testsupport.h:127
int update_guard_selection_choice(const or_options_t *options)
Definition: entrynodes.c:721
STATIC double get_meaningful_restriction_threshold(void)
Definition: entrynodes.c:540
guard_selection_t * get_guard_selection_info(void)
Definition: entrynodes.c:303
int entry_guards_update_all(guard_selection_t *gs)
Definition: entrynodes.c:2763
STATIC void sampled_guards_update_from_consensus(guard_selection_t *gs)
Definition: entrynodes.c:1400
STATIC circuit_guard_state_t * circuit_guard_state_new(entry_guard_t *guard, unsigned state, entry_guard_restriction_t *rst)
Definition: entrynodes.c:2362
char * entry_guards_get_err_str_if_dir_info_missing(int using_mds, int num_present, int num_usable)
Definition: entrynodes.c:3779
unsigned int path_bias_use_extreme
Definition: entrynodes.h:46
guard_usage_t
Definition: entrynodes.h:358
const char * entry_guard_get_rsa_id_digest(const entry_guard_t *guard)
Definition: entrynodes.c:327
void entry_guard_cancel(circuit_guard_state_t **guard_state_p)
Definition: entrynodes.c:2459
STATIC entry_guard_t * entry_guards_expand_sample(guard_selection_t *gs)
Definition: entrynodes.c:1151
entry_guard_t * entry_guard_get_by_id_digest(const char *digest)
Definition: entrynodes.c:3223
STATIC void entry_guard_restriction_free_(entry_guard_restriction_t *rst)
Definition: entrynodes.c:2340
double collapsed_circuits
Definition: entrynodes.h:54
STATIC int get_nonprimary_guard_connect_timeout(void)
Definition: entrynodes.c:516
STATIC entry_guard_t * sample_reachable_filtered_entry_guards(guard_selection_t *gs, const entry_guard_restriction_t *rst, unsigned flags)
Definition: entrynodes.c:1721
void entry_guards_changed_for_guard_selection(guard_selection_t *gs)
Definition: entrynodes.c:3406
double use_successes
Definition: entrynodes.h:62