Tor  0.4.7.0-alpha-dev
main.c
Go to the documentation of this file.
1 /* Copyright (c) 2001 Matej Pfajfar.
2  * Copyright (c) 2001-2004, Roger Dingledine.
3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4  * Copyright (c) 2007-2021, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
6 
7 /**
8  * \file main.c
9  * \brief Invocation module. Initializes subsystems and runs the main loop.
10  **/
11 
12 #include "core/or/or.h"
13 
14 #include "app/config/config.h"
15 #include "app/config/statefile.h"
16 #include "app/config/quiet_level.h"
17 #include "app/main/main.h"
18 #include "app/main/ntmain.h"
19 #include "app/main/risky_options.h"
20 #include "app/main/shutdown.h"
21 #include "app/main/subsysmgr.h"
24 #include "core/mainloop/mainloop.h"
27 #include "core/or/channel.h"
28 #include "core/or/channelpadding.h"
29 #include "core/or/circuitpadding.h"
30 #include "core/or/circuitlist.h"
31 #include "core/or/command.h"
32 #include "core/or/connection_or.h"
33 #include "core/or/relay.h"
34 #include "core/or/status.h"
35 #include "feature/api/tor_api.h"
41 #include "feature/dirauth/keypin.h"
46 #include "feature/hs/hs_dos.h"
47 #include "feature/hs/hs_service.h"
51 #include "feature/relay/dns.h"
56 #include "feature/stats/bwhist.h"
57 #include "feature/stats/rephist.h"
58 #include "lib/compress/compress.h"
59 #include "lib/buf/buffers.h"
63 #include "lib/net/resolve.h"
64 #include "lib/trace/trace.h"
65 
66 #include "lib/process/waitpid.h"
68 
69 #include "lib/meminfo/meminfo.h"
70 #include "lib/osinfo/uname.h"
71 #include "lib/osinfo/libc.h"
72 #include "lib/sandbox/sandbox.h"
73 #include "lib/fs/lockfile.h"
74 #include "lib/tls/tortls.h"
76 #include "lib/encoding/confline.h"
77 #include "lib/evloop/timers.h"
79 #include "lib/version/torversion.h"
80 
81 #include <event2/event.h>
82 
85 
87 #include "core/or/port_cfg_st.h"
88 
89 #ifdef HAVE_UNISTD_H
90 #include <unistd.h>
91 #endif
92 
93 #ifdef HAVE_SYSTEMD
94 # if defined(__COVERITY__) && !defined(__INCLUDE_LEVEL__)
95 /* Systemd's use of gcc's __INCLUDE_LEVEL__ extension macro appears to confuse
96  * Coverity. Here's a kludge to unconfuse it.
97  */
98 # define __INCLUDE_LEVEL__ 2
99 #endif /* defined(__COVERITY__) && !defined(__INCLUDE_LEVEL__) */
100 #include <systemd/sd-daemon.h>
101 #endif /* defined(HAVE_SYSTEMD) */
102 
103 #ifdef HAVE_RUST
104 // helper function defined in Rust to output a log message indicating if tor is
105 // running with Rust enabled. See src/rust/tor_util
106 void rust_log_welcome_string(void);
107 #endif
108 
109 /********* PROTOTYPES **********/
110 
111 static void dumpmemusage(int severity);
112 static void dumpstats(int severity); /* log stats */
113 static void process_signal(int sig);
114 
115 /** Called when we get a SIGHUP: reload configuration files and keys,
116  * retry all connections, and so on. */
117 static int
118 do_hup(void)
119 {
120  const or_options_t *options = get_options();
121 
122  log_notice(LD_GENERAL,"Received reload signal (hup). Reloading config and "
123  "resetting internal state.");
124  if (accounting_is_enabled(options))
126 
129  /* first, reload config variables, in case they've changed */
130  if (options->ReloadTorrcOnSIGHUP) {
131  /* no need to provide argc/v, they've been cached in init_from_config */
132  int init_rv = options_init_from_torrc(0, NULL);
133  if (init_rv < 0) {
134  log_err(LD_CONFIG,"Reading config failed--see warnings above. "
135  "For usage, try -h.");
136  return -1;
137  } else if (BUG(init_rv > 0)) {
138  // LCOV_EXCL_START
139  /* This should be impossible: the only "return 1" cases in
140  * options_init_from_torrc are ones caused by command-line arguments;
141  * but they can't change while Tor is running. */
142  return -1;
143  // LCOV_EXCL_STOP
144  }
145  options = get_options(); /* they have changed now */
146  /* Logs are only truncated the first time they are opened, but were
147  probably intended to be cleaned up on signal. */
148  if (options->TruncateLogFile)
149  truncate_logs();
150  } else {
151  char *msg = NULL;
152  log_notice(LD_GENERAL, "Not reloading config file: the controller told "
153  "us not to.");
154  /* Make stuff get rescanned, reloaded, etc. */
155  if (set_options((or_options_t*)options, &msg) < 0) {
156  if (!msg)
157  msg = tor_strdup("Unknown error");
158  log_warn(LD_GENERAL, "Unable to re-set previous options: %s", msg);
159  tor_free(msg);
160  }
161  }
162  if (authdir_mode(options)) {
163  /* reload the approved-routers file */
164  if (dirserv_load_fingerprint_file() < 0) {
165  /* warnings are logged from dirserv_load_fingerprint_file() directly */
166  log_info(LD_GENERAL, "Error reloading fingerprints. "
167  "Continuing with old list.");
168  }
169  }
170 
171  /* Rotate away from the old dirty circuits. This has to be done
172  * after we've read the new options, but before we start using
173  * circuits for directory fetches. */
175 
176  /* retry appropriate downloads */
179  if (!net_is_disabled())
180  update_networkstatus_downloads(time(NULL));
181 
182  /* We'll retry routerstatus downloads in about 10 seconds; no need to
183  * force a retry there. */
184 
185  if (server_mode(options)) {
186  /* Maybe we've been given a new ed25519 key or certificate?
187  */
188  time_t now = approx_time();
189  int new_signing_key = load_ed_keys(options, now);
190  if (new_signing_key < 0 ||
191  generate_ed_link_cert(options, now, new_signing_key > 0)) {
192  log_warn(LD_OR, "Problem reloading Ed25519 keys; still using old keys.");
193  }
194 
195  /* Update cpuworker and dnsworker processes, so they get up-to-date
196  * configuration options. */
198  dns_reset();
199  }
200  return 0;
201 }
202 
203 /** Libevent callback: invoked when we get a signal.
204  */
205 static void
206 signal_callback(evutil_socket_t fd, short events, void *arg)
207 {
208  const int *sigptr = arg;
209  const int sig = *sigptr;
210  (void)fd;
211  (void)events;
212 
213  update_current_time(time(NULL));
214  process_signal(sig);
215 }
216 
217 /** Do the work of acting on a signal received in <b>sig</b> */
218 static void
220 {
221  switch (sig)
222  {
223  case SIGTERM:
224  log_notice(LD_GENERAL,"Catching signal TERM, exiting cleanly.");
226  break;
227  case SIGINT:
228  if (!server_mode(get_options())) { /* do it now */
229  log_notice(LD_GENERAL,"Interrupt: exiting cleanly.");
231  return;
232  }
233 #ifdef HAVE_SYSTEMD
234  sd_notify(0, "STOPPING=1");
235 #endif
237  break;
238 #ifdef SIGPIPE
239  case SIGPIPE:
240  log_debug(LD_GENERAL,"Caught SIGPIPE. Ignoring.");
241  break;
242 #endif
243  case SIGUSR1:
244  /* prefer to log it at INFO, but make sure we always see it */
247  break;
248  case SIGUSR2:
250  log_debug(LD_GENERAL,"Caught USR2, going to loglevel debug. "
251  "Send HUP to change back.");
253  break;
254  case SIGHUP:
255 #ifdef HAVE_SYSTEMD
256  sd_notify(0, "RELOADING=1");
257 #endif
258  if (do_hup() < 0) {
259  log_warn(LD_CONFIG,"Restart failed (config error?). Exiting.");
261  return;
262  }
263 #ifdef HAVE_SYSTEMD
264  sd_notify(0, "READY=1");
265 #endif
267  break;
268 #ifdef SIGCHLD
269  case SIGCHLD:
271  break;
272 #endif
273  case SIGNEWNYM: {
274  do_signewnym(time(NULL));
275  break;
276  }
277  case SIGCLEARDNSCACHE:
280  break;
281  case SIGHEARTBEAT:
282  log_heartbeat(time(NULL));
284  break;
285  case SIGACTIVE:
286  /* "SIGACTIVE" counts as ersatz user activity. */
289  break;
290  case SIGDORMANT:
291  /* "SIGDORMANT" means to ignore past user activity */
292  log_notice(LD_GENERAL, "Going dormant because of controller request.");
297  break;
298  }
299 }
300 
301 #ifdef _WIN32
302 /** Activate SIGINT on receiving a control signal in console. */
303 static BOOL WINAPI
304 process_win32_console_ctrl(DWORD ctrl_type)
305 {
306  /* Ignore type of the ctrl signal */
307  (void) ctrl_type;
308 
309  activate_signal(SIGINT);
310  return TRUE;
311 }
312 #endif /* defined(_WIN32) */
313 
314 /**
315  * Write current memory usage information to the log.
316  */
317 static void
318 dumpmemusage(int severity)
319 {
321  tor_log(severity, LD_GENERAL, "In rephist: %"PRIu64" used by %d Tors.",
323  dump_routerlist_mem_usage(severity);
324  dump_cell_pool_usage(severity);
325  dump_dns_mem_usage(severity);
326 }
327 
328 /** Write all statistics to the log, with log level <b>severity</b>. Called
329  * in response to a SIGUSR1. */
330 static void
331 dumpstats(int severity)
332 {
333  time_t now = time(NULL);
334  time_t elapsed;
335  size_t rbuf_cap, wbuf_cap, rbuf_len, wbuf_len;
336 
337  tor_log(severity, LD_GENERAL, "Dumping stats:");
338 
340  int i = conn_sl_idx;
341  tor_log(severity, LD_GENERAL,
342  "Conn %d (socket %d) is a %s, created %d secs ago",
343  i, (int)conn->s,
344  connection_describe(conn),
345  (int)(now - conn->timestamp_created));
346  if (!connection_is_listener(conn)) {
347  tor_log(severity,LD_GENERAL,
348  "Conn %d: %d bytes waiting on inbuf (len %d, last read %d secs ago)",
349  i,
350  (int)connection_get_inbuf_len(conn),
351  (int)buf_allocation(conn->inbuf),
352  (int)(now - conn->timestamp_last_read_allowed));
353  tor_log(severity,LD_GENERAL,
354  "Conn %d: %d bytes waiting on outbuf "
355  "(len %d, last written %d secs ago)",i,
356  (int)connection_get_outbuf_len(conn),
357  (int)buf_allocation(conn->outbuf),
358  (int)(now - conn->timestamp_last_write_allowed));
359  if (conn->type == CONN_TYPE_OR) {
360  or_connection_t *or_conn = TO_OR_CONN(conn);
361  if (or_conn->tls) {
362  if (tor_tls_get_buffer_sizes(or_conn->tls, &rbuf_cap, &rbuf_len,
363  &wbuf_cap, &wbuf_len) == 0) {
364  tor_log(severity, LD_GENERAL,
365  "Conn %d: %d/%d bytes used on OpenSSL read buffer; "
366  "%d/%d bytes used on write buffer.",
367  i, (int)rbuf_len, (int)rbuf_cap, (int)wbuf_len, (int)wbuf_cap);
368  }
369  }
370  }
371  }
372  circuit_dump_by_conn(conn, severity); /* dump info about all the circuits
373  * using this conn */
374  } SMARTLIST_FOREACH_END(conn);
375 
376  channel_dumpstats(severity);
377  channel_listener_dumpstats(severity);
378 
379  tor_log(severity, LD_NET,
380  "Cells processed: %"PRIu64" padding\n"
381  " %"PRIu64" create\n"
382  " %"PRIu64" created\n"
383  " %"PRIu64" relay\n"
384  " (%"PRIu64" relayed)\n"
385  " (%"PRIu64" delivered)\n"
386  " %"PRIu64" destroy",
395  tor_log(severity,LD_NET,"Average packaged cell fullness: %2.3f%%",
396  100*(((double)stats_n_data_bytes_packaged) /
399  tor_log(severity,LD_NET,"Average delivered cell fullness: %2.3f%%",
400  100*(((double)stats_n_data_bytes_received) /
402 
403  cpuworker_log_onionskin_overhead(severity, ONION_HANDSHAKE_TYPE_TAP, "TAP");
404  cpuworker_log_onionskin_overhead(severity, ONION_HANDSHAKE_TYPE_NTOR,"ntor");
405 
406  if (now - time_of_process_start >= 0)
407  elapsed = now - time_of_process_start;
408  else
409  elapsed = 0;
410 
411  if (elapsed) {
412  tor_log(severity, LD_NET,
413  "Average bandwidth: %"PRIu64"/%d = %d bytes/sec reading",
414  (get_bytes_read()),
415  (int)elapsed,
416  (int) (get_bytes_read()/elapsed));
417  tor_log(severity, LD_NET,
418  "Average bandwidth: %"PRIu64"/%d = %d bytes/sec writing",
419  (get_bytes_written()),
420  (int)elapsed,
421  (int) (get_bytes_written()/elapsed));
422  }
423 
424  tor_log(severity, LD_NET, "--------------- Dumping memory information:");
425  dumpmemusage(severity);
426 
427  rep_hist_dump_stats(now,severity);
428  hs_service_dump_stats(severity);
429 }
430 
431 #ifdef _WIN32
432 #define UNIX_ONLY 0
433 #else
434 #define UNIX_ONLY 1
435 #endif
436 
437 static struct {
438  /** A numeric code for this signal. Must match the signal value if
439  * try_to_register is true. */
441  /** True if we should try to register this signal with libevent and catch
442  * corresponding posix signals. False otherwise. */
444  /** Pointer to hold the event object constructed for this signal. */
445  struct event *signal_event;
446 } signal_handlers[] = {
447 #ifdef SIGINT
448  { SIGINT, UNIX_ONLY, NULL }, /* do a controlled slow shutdown */
449 #endif
450 #ifdef SIGTERM
451  { SIGTERM, UNIX_ONLY, NULL }, /* to terminate now */
452 #endif
453 #ifdef SIGPIPE
454  { SIGPIPE, UNIX_ONLY, NULL }, /* otherwise SIGPIPE kills us */
455 #endif
456 #ifdef SIGUSR1
457  { SIGUSR1, UNIX_ONLY, NULL }, /* dump stats */
458 #endif
459 #ifdef SIGUSR2
460  { SIGUSR2, UNIX_ONLY, NULL }, /* go to loglevel debug */
461 #endif
462 #ifdef SIGHUP
463  { SIGHUP, UNIX_ONLY, NULL }, /* to reload config, retry conns, etc */
464 #endif
465 #ifdef SIGXFSZ
466  { SIGXFSZ, UNIX_ONLY, NULL }, /* handle file-too-big resource exhaustion */
467 #endif
468 #ifdef SIGCHLD
469  { SIGCHLD, UNIX_ONLY, NULL }, /* handle dns/cpu workers that exit */
470 #endif
471  /* These are controller-only */
472  { SIGNEWNYM, 0, NULL },
473  { SIGCLEARDNSCACHE, 0, NULL },
474  { SIGHEARTBEAT, 0, NULL },
475  { SIGACTIVE, 0, NULL },
476  { SIGDORMANT, 0, NULL },
477  { -1, -1, NULL }
478 };
479 
480 /** Set up the signal handler events for this process, and register them
481  * with libevent if appropriate. */
482 void
484 {
485  int i;
486  const int enabled = !get_options()->DisableSignalHandlers;
487 
488  for (i = 0; signal_handlers[i].signal_value >= 0; ++i) {
489  /* Signal handlers are only registered with libevent if they need to catch
490  * real POSIX signals. We construct these signal handler events in either
491  * case, though, so that controllers can activate them with the SIGNAL
492  * command.
493  */
494  if (enabled && signal_handlers[i].try_to_register) {
495  signal_handlers[i].signal_event =
496  tor_evsignal_new(tor_libevent_get_base(),
497  signal_handlers[i].signal_value,
499  &signal_handlers[i].signal_value);
500  if (event_add(signal_handlers[i].signal_event, NULL))
501  log_warn(LD_BUG, "Error from libevent when adding "
502  "event for signal %d",
503  signal_handlers[i].signal_value);
504  } else {
505  signal_handlers[i].signal_event =
506  tor_event_new(tor_libevent_get_base(), -1,
507  EV_SIGNAL, signal_callback,
508  &signal_handlers[i].signal_value);
509  }
510  }
511 
512 #ifdef _WIN32
513  /* Windows lacks traditional POSIX signals but WinAPI provides a function
514  * to handle control signals like Ctrl+C in the console, we can use this to
515  * simulate the SIGINT signal */
516  if (enabled) SetConsoleCtrlHandler(process_win32_console_ctrl, TRUE);
517 #endif /* defined(_WIN32) */
518 }
519 
520 /* Cause the signal handler for signal_num to be called in the event loop. */
521 void
522 activate_signal(int signal_num)
523 {
524  int i;
525  for (i = 0; signal_handlers[i].signal_value >= 0; ++i) {
526  if (signal_handlers[i].signal_value == signal_num) {
527  event_active(signal_handlers[i].signal_event, EV_SIGNAL, 1);
528  return;
529  }
530  }
531 }
532 
533 /** Main entry point for the Tor command-line client. Return 0 on "success",
534  * negative on "failure", and positive on "success and exit".
535  */
536 int
537 tor_init(int argc, char *argv[])
538 {
539  char progname[256];
541  bool running_tor = false;
542 
543  time_of_process_start = time(NULL);
545  /* Have the log set up with our application name. */
546  tor_snprintf(progname, sizeof(progname), "Tor %s", get_version());
547  log_set_application_name(progname);
548 
549  /* Initialize the history structures. */
550  rep_hist_init();
551  bwhist_init();
552  /* Initialize the service cache. */
553  addressmap_init(); /* Init the client dns cache. Do it always, since it's
554  * cheap. */
555 
556  /* Initialize the HS subsystem. */
557  hs_init();
558 
559  {
560  /* We check for the "quiet"/"hush" settings first, since they decide
561  whether we log anything at all to stdout. */
562  parsed_cmdline_t *cmdline;
563  cmdline = config_parse_commandline(argc, argv, 1);
564  if (cmdline) {
565  quiet = cmdline->quiet_level;
566  running_tor = (cmdline->command == CMD_RUN_TOR);
567  }
568  parsed_cmdline_free(cmdline);
569  }
570 
571  /* give it somewhere to log to initially */
573  quiet_level = quiet;
574 
575  {
576  const char *version = get_version();
577 
578  log_notice(LD_GENERAL, "Tor %s running on %s with Libevent %s, "
579  "%s %s, Zlib %s, Liblzma %s, Libzstd %s and %s %s as libc.",
580  version,
581  get_uname(),
585  tor_compress_supports_method(ZLIB_METHOD) ?
586  tor_compress_version_str(ZLIB_METHOD) : "N/A",
587  tor_compress_supports_method(LZMA_METHOD) ?
588  tor_compress_version_str(LZMA_METHOD) : "N/A",
589  tor_compress_supports_method(ZSTD_METHOD) ?
590  tor_compress_version_str(ZSTD_METHOD) : "N/A",
592  tor_libc_get_name() : "Unknown",
594 
595  log_notice(LD_GENERAL, "Tor can't help you if you use it wrong! "
596  "Learn how to be safe at "
597  "https://www.torproject.org/download/download#warning");
598 
599  if (strstr(version, "alpha") || strstr(version, "beta"))
600  log_notice(LD_GENERAL, "This version is not a stable Tor release. "
601  "Expect more bugs than usual.");
602 
603  if (strlen(risky_option_list) && running_tor) {
604  log_warn(LD_GENERAL, "This build of Tor has been compiled with one "
605  "or more options that might make it less reliable or secure! "
606  "They are:%s", risky_option_list);
607  }
608 
610  }
611 
612 #ifdef HAVE_RUST
613  rust_log_welcome_string();
614 #endif /* defined(HAVE_RUST) */
615 
616  /* Warn _if_ the tracing subsystem is built in. */
617  tracing_log_warning();
618 
619  int init_rv = options_init_from_torrc(argc,argv);
620  if (init_rv < 0) {
621  log_err(LD_CONFIG,"Reading config failed--see warnings above.");
622  return -1;
623  } else if (init_rv > 0) {
624  // We succeeded, and should exit anyway -- probably the user just said
625  // "--version" or something like that.
626  return 1;
627  }
628 
629  /* Initialize channelpadding and circpad parameters to defaults
630  * until we get a consensus */
633 
634  /* Initialize circuit padding to defaults+torrc until we get a consensus */
636 
637  /* Initialize hidden service DoS subsystem. We need to do this once the
638  * configuration object has been set because it can be accessed. */
639  hs_dos_init();
640 
641  /* Initialize predicted ports list after loading options */
642  predicted_ports_init();
643 
644 #ifndef _WIN32
645  if (geteuid()==0)
646  log_warn(LD_GENERAL,"You are running Tor as root. You don't need to, "
647  "and you probably shouldn't.");
648 #endif
649 
650  /* Scan/clean unparseable descriptors; after reading config */
652 
653  return 0;
654 }
655 
656 /** A lockfile structure, used to prevent two Tors from messing with the
657  * data directory at once. If this variable is non-NULL, we're holding
658  * the lockfile. */
659 static tor_lockfile_t *lockfile = NULL;
660 
661 /** Try to grab the lock file described in <b>options</b>, if we do not
662  * already have it. If <b>err_if_locked</b> is true, warn if somebody else is
663  * holding the lock, and exit if we can't get it after waiting. Otherwise,
664  * return -1 if we can't get the lockfile. Return 0 on success.
665  */
666 int
667 try_locking(const or_options_t *options, int err_if_locked)
668 {
669  if (lockfile)
670  return 0;
671  else {
672  char *fname = options_get_datadir_fname(options, "lock");
673  int already_locked = 0;
674  tor_lockfile_t *lf = tor_lockfile_lock(fname, 0, &already_locked);
675  tor_free(fname);
676  if (!lf) {
677  if (err_if_locked && already_locked) {
678  int r;
679  log_warn(LD_GENERAL, "It looks like another Tor process is running "
680  "with the same data directory. Waiting 5 seconds to see "
681  "if it goes away.");
682 #ifndef _WIN32
683  sleep(5);
684 #else
685  Sleep(5000);
686 #endif
687  r = try_locking(options, 0);
688  if (r<0) {
689  log_err(LD_GENERAL, "No, it's still there. Exiting.");
690  return -1;
691  }
692  return r;
693  }
694  return -1;
695  }
696  lockfile = lf;
697  return 0;
698  }
699 }
700 
701 /** Return true iff we've successfully acquired the lock file. */
702 int
704 {
705  return lockfile != NULL;
706 }
707 
708 /** If we have successfully acquired the lock file, release it. */
709 void
711 {
712  if (lockfile) {
714  lockfile = NULL;
715  }
716 }
717 
718 /**
719  * Remove the specified file, and log a warning if the operation fails for
720  * any reason other than the file not existing. Ignores NULL filenames.
721  */
722 void
723 tor_remove_file(const char *filename)
724 {
725  if (filename && tor_unlink(filename) != 0 && errno != ENOENT) {
726  log_warn(LD_FS, "Couldn't unlink %s: %s",
727  filename, strerror(errno));
728  }
729 }
730 
731 /** Read/create keys as needed, and echo our fingerprint to stdout. */
732 static int
734 {
735  const or_options_t *options = get_options();
736  const char *arg = options->command_arg;
737  char rsa[FINGERPRINT_LEN + 1];
738  crypto_pk_t *k;
739  const ed25519_public_key_t *edkey;
740  const char *nickname = options->Nickname;
741  sandbox_disable_getaddrinfo_cache();
742 
743  bool show_rsa = !strcmp(arg, "") || !strcmp(arg, "rsa");
744  bool show_ed25519 = !strcmp(arg, "ed25519");
745  if (!show_rsa && !show_ed25519) {
746  log_err(LD_GENERAL,
747  "If you give a key type, you must specify 'rsa' or 'ed25519'. Exiting.");
748  return -1;
749  }
750 
751  if (!server_mode(options)) {
752  log_err(LD_GENERAL,
753  "Clients don't have long-term identity keys. Exiting.");
754  return -1;
755  }
756  tor_assert(nickname);
757  if (init_keys() < 0) {
758  log_err(LD_GENERAL, "Error initializing keys; exiting.");
759  return -1;
760  }
761  if (!(k = get_server_identity_key())) {
762  log_err(LD_GENERAL, "Error: missing RSA identity key.");
763  return -1;
764  }
765  if (crypto_pk_get_fingerprint(k, rsa, 1) < 0) {
766  log_err(LD_BUG, "Error computing RSA fingerprint");
767  return -1;
768  }
769  if (!(edkey = get_master_identity_key())) {
770  log_err(LD_GENERAL,"Error: missing ed25519 identity key.");
771  return -1;
772  }
773  if (show_rsa) {
774  printf("%s %s\n", nickname, rsa);
775  }
776  if (show_ed25519) {
777  char ed25519[ED25519_BASE64_LEN + 1];
778  digest256_to_base64(ed25519, (const char *) edkey->pubkey);
779  printf("%s %s\n", nickname, ed25519);
780  }
781  return 0;
782 }
783 
784 /** Entry point for password hashing: take the desired password from
785  * the command line, and print its salted hash to stdout. **/
786 static void
788 {
789 
790  char output[256];
792 
794  key[S2K_RFC2440_SPECIFIER_LEN-1] = (uint8_t)96; /* Hash 64 K of data. */
796  get_options()->command_arg, strlen(get_options()->command_arg),
797  key);
798  base16_encode(output, sizeof(output), key, sizeof(key));
799  printf("16:%s\n",output);
800 }
801 
802 /** Entry point for configuration dumping: write the configuration to
803  * stdout. */
804 static int
806 {
807  const or_options_t *options = get_options();
808  const char *arg = options->command_arg;
809  int how;
810  char *opts;
811 
812  if (!strcmp(arg, "short")) {
813  how = OPTIONS_DUMP_MINIMAL;
814  } else if (!strcmp(arg, "non-builtin")) {
815  // Deprecated since 0.4.5.1-alpha.
816  fprintf(stderr, "'non-builtin' is deprecated; use 'short' instead.\n");
817  how = OPTIONS_DUMP_MINIMAL;
818  } else if (!strcmp(arg, "full")) {
819  how = OPTIONS_DUMP_ALL;
820  } else {
821  fprintf(stderr, "No valid argument to --dump-config found!\n");
822  fprintf(stderr, "Please select 'short' or 'full'.\n");
823 
824  return -1;
825  }
826 
827  opts = options_dump(options, how);
828  printf("%s", opts);
829  tor_free(opts);
830 
831  return 0;
832 }
833 
834 static void
835 init_addrinfo(void)
836 {
837  if (! server_mode(get_options()) || get_options()->Address) {
838  /* We don't need to seed our own hostname, because we won't be calling
839  * resolve_my_address on it.
840  */
841  return;
842  }
843  char hname[256];
844 
845  // host name to sandbox
846  gethostname(hname, sizeof(hname));
847  tor_add_addrinfo(hname);
848 }
849 
850 static sandbox_cfg_t*
851 sandbox_init_filter(void)
852 {
853  const or_options_t *options = get_options();
855 
857  get_cachedir_fname("cached-status"));
858 
859 #define OPEN(name) \
860  sandbox_cfg_allow_open_filename(&cfg, tor_strdup(name))
861 
862 #define OPENDIR(dir) \
863  sandbox_cfg_allow_opendir_dirname(&cfg, tor_strdup(dir))
864 
865 #define OPEN_DATADIR(name) \
866  sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname(name))
867 
868 #define OPEN_DATADIR2(name, name2) \
869  sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname2((name), (name2)))
870 
871 #define OPEN_DATADIR_SUFFIX(name, suffix) do { \
872  OPEN_DATADIR(name); \
873  OPEN_DATADIR(name suffix); \
874  } while (0)
875 
876 #define OPEN_DATADIR2_SUFFIX(name, name2, suffix) do { \
877  OPEN_DATADIR2(name, name2); \
878  OPEN_DATADIR2(name, name2 suffix); \
879  } while (0)
880 
881 // KeyDirectory is a directory, but it is only opened in check_private_dir
882 // which calls open instead of opendir
883 #define OPEN_KEY_DIRECTORY() \
884  OPEN(options->KeyDirectory)
885 #define OPEN_CACHEDIR(name) \
886  sandbox_cfg_allow_open_filename(&cfg, get_cachedir_fname(name))
887 #define OPEN_CACHEDIR_SUFFIX(name, suffix) do { \
888  OPEN_CACHEDIR(name); \
889  OPEN_CACHEDIR(name suffix); \
890  } while (0)
891 #define OPEN_KEYDIR(name) \
892  sandbox_cfg_allow_open_filename(&cfg, get_keydir_fname(name))
893 #define OPEN_KEYDIR_SUFFIX(name, suffix) do { \
894  OPEN_KEYDIR(name); \
895  OPEN_KEYDIR(name suffix); \
896  } while (0)
897 
898  // DataDirectory is a directory, but it is only opened in check_private_dir
899  // which calls open instead of opendir
900  OPEN(options->DataDirectory);
901  OPEN_KEY_DIRECTORY();
902 
903  OPEN_CACHEDIR_SUFFIX("cached-certs", ".tmp");
904  OPEN_CACHEDIR_SUFFIX("cached-consensus", ".tmp");
905  OPEN_CACHEDIR_SUFFIX("unverified-consensus", ".tmp");
906  OPEN_CACHEDIR_SUFFIX("unverified-microdesc-consensus", ".tmp");
907  OPEN_CACHEDIR_SUFFIX("cached-microdesc-consensus", ".tmp");
908  OPEN_CACHEDIR_SUFFIX("cached-microdescs", ".tmp");
909  OPEN_CACHEDIR_SUFFIX("cached-microdescs.new", ".tmp");
910  OPEN_CACHEDIR_SUFFIX("cached-descriptors", ".tmp");
911  OPEN_CACHEDIR_SUFFIX("cached-descriptors.new", ".tmp");
912  OPEN_CACHEDIR("cached-descriptors.tmp.tmp");
913  OPEN_CACHEDIR_SUFFIX("cached-extrainfo", ".tmp");
914  OPEN_CACHEDIR_SUFFIX("cached-extrainfo.new", ".tmp");
915  OPEN_CACHEDIR("cached-extrainfo.tmp.tmp");
916 
917  OPEN_DATADIR_SUFFIX("state", ".tmp");
918  OPEN_DATADIR_SUFFIX("sr-state", ".tmp");
919  OPEN_DATADIR_SUFFIX("unparseable-desc", ".tmp");
920  OPEN_DATADIR_SUFFIX("v3-status-votes", ".tmp");
921  OPEN_DATADIR("key-pinning-journal");
922  OPEN("/dev/srandom");
923  OPEN("/dev/urandom");
924  OPEN("/dev/random");
925  OPEN("/etc/hosts");
926  OPEN("/proc/meminfo");
927 
928  if (options->BridgeAuthoritativeDir)
929  OPEN_DATADIR_SUFFIX("networkstatus-bridges", ".tmp");
930 
931  if (authdir_mode(options))
932  OPEN_DATADIR("approved-routers");
933 
934  if (options->ServerDNSResolvConfFile)
936  tor_strdup(options->ServerDNSResolvConfFile));
937  else
938  sandbox_cfg_allow_open_filename(&cfg, tor_strdup("/etc/resolv.conf"));
939 
940  const char *torrc_defaults_fname = get_torrc_fname(1);
941  if (torrc_defaults_fname) {
943  }
944  const char *torrc_fname = get_torrc_fname(0);
945  if (torrc_fname) {
946  sandbox_cfg_allow_open_filename(&cfg, tor_strdup(torrc_fname));
947  // allow torrc backup and torrc.tmp to make SAVECONF work
948  char *torrc_bck = NULL;
950  sandbox_cfg_allow_rename(&cfg, tor_strdup(torrc_fname), torrc_bck);
951  char *torrc_tmp = NULL;
952  tor_asprintf(&torrc_tmp, "%s.tmp", torrc_fname);
953  sandbox_cfg_allow_rename(&cfg, torrc_tmp, tor_strdup(torrc_fname));
954  sandbox_cfg_allow_open_filename(&cfg, tor_strdup(torrc_tmp));
955  // we need to stat the existing backup file
956  sandbox_cfg_allow_stat_filename(&cfg, tor_strdup(torrc_bck));
957  }
958 
959  SMARTLIST_FOREACH(options->FilesOpenedByIncludes, char *, f, {
960  if (file_status(f) == FN_DIR) {
961  OPENDIR(f);
962  } else {
963  OPEN(f);
964  }
965  });
966 
967 #define RENAME_SUFFIX(name, suffix) \
968  sandbox_cfg_allow_rename(&cfg, \
969  get_datadir_fname(name suffix), \
970  get_datadir_fname(name))
971 
972 #define RENAME_SUFFIX2(prefix, name, suffix) \
973  sandbox_cfg_allow_rename(&cfg, \
974  get_datadir_fname2(prefix, name suffix), \
975  get_datadir_fname2(prefix, name))
976 
977 #define RENAME_CACHEDIR_SUFFIX(name, suffix) \
978  sandbox_cfg_allow_rename(&cfg, \
979  get_cachedir_fname(name suffix), \
980  get_cachedir_fname(name))
981 
982 #define RENAME_KEYDIR_SUFFIX(name, suffix) \
983  sandbox_cfg_allow_rename(&cfg, \
984  get_keydir_fname(name suffix), \
985  get_keydir_fname(name))
986 
987  RENAME_CACHEDIR_SUFFIX("cached-certs", ".tmp");
988  RENAME_CACHEDIR_SUFFIX("cached-consensus", ".tmp");
989  RENAME_CACHEDIR_SUFFIX("unverified-consensus", ".tmp");
990  RENAME_CACHEDIR_SUFFIX("unverified-microdesc-consensus", ".tmp");
991  RENAME_CACHEDIR_SUFFIX("cached-microdesc-consensus", ".tmp");
992  RENAME_CACHEDIR_SUFFIX("cached-microdescs", ".tmp");
993  RENAME_CACHEDIR_SUFFIX("cached-microdescs", ".new");
994  RENAME_CACHEDIR_SUFFIX("cached-microdescs.new", ".tmp");
995  RENAME_CACHEDIR_SUFFIX("cached-descriptors", ".tmp");
996  RENAME_CACHEDIR_SUFFIX("cached-descriptors", ".new");
997  RENAME_CACHEDIR_SUFFIX("cached-descriptors.new", ".tmp");
998  RENAME_CACHEDIR_SUFFIX("cached-extrainfo", ".tmp");
999  RENAME_CACHEDIR_SUFFIX("cached-extrainfo", ".new");
1000  RENAME_CACHEDIR_SUFFIX("cached-extrainfo.new", ".tmp");
1001 
1002  RENAME_SUFFIX("state", ".tmp");
1003  RENAME_SUFFIX("sr-state", ".tmp");
1004  RENAME_SUFFIX("unparseable-desc", ".tmp");
1005  RENAME_SUFFIX("v3-status-votes", ".tmp");
1006 
1007  if (options->BridgeAuthoritativeDir)
1008  RENAME_SUFFIX("networkstatus-bridges", ".tmp");
1009 
1010 #define STAT_DATADIR(name) \
1011  sandbox_cfg_allow_stat_filename(&cfg, get_datadir_fname(name))
1012 
1013 #define STAT_CACHEDIR(name) \
1014  sandbox_cfg_allow_stat_filename(&cfg, get_cachedir_fname(name))
1015 
1016 #define STAT_DATADIR2(name, name2) \
1017  sandbox_cfg_allow_stat_filename(&cfg, get_datadir_fname2((name), (name2)))
1018 
1019 #define STAT_KEY_DIRECTORY() \
1020  sandbox_cfg_allow_stat_filename(&cfg, tor_strdup(options->KeyDirectory))
1021 
1022  STAT_DATADIR(NULL);
1023  STAT_DATADIR("lock");
1024  STAT_DATADIR("state");
1025  STAT_DATADIR("router-stability");
1026 
1027  STAT_CACHEDIR("cached-extrainfo.new");
1028 
1029  {
1030  smartlist_t *files = smartlist_new();
1032  SMARTLIST_FOREACH(files, char *, file_name, {
1033  /* steals reference */
1034  sandbox_cfg_allow_open_filename(&cfg, file_name);
1035  });
1036  smartlist_free(files);
1037  }
1038 
1039  {
1040  smartlist_t *files = smartlist_new();
1041  smartlist_t *dirs = smartlist_new();
1043  SMARTLIST_FOREACH(files, char *, file_name, {
1044  char *tmp_name = NULL;
1045  tor_asprintf(&tmp_name, "%s.tmp", file_name);
1046  sandbox_cfg_allow_rename(&cfg,
1047  tor_strdup(tmp_name), tor_strdup(file_name));
1048  /* steals references */
1049  sandbox_cfg_allow_open_filename(&cfg, file_name);
1050  sandbox_cfg_allow_open_filename(&cfg, tmp_name);
1051  });
1052  SMARTLIST_FOREACH(dirs, char *, dir, {
1053  /* steals reference */
1055  });
1056  smartlist_free(files);
1057  smartlist_free(dirs);
1058  }
1059 
1060  {
1061  char *fname;
1062  if ((fname = get_controller_cookie_file_name())) {
1063  sandbox_cfg_allow_open_filename(&cfg, fname);
1064  }
1065  if ((fname = get_ext_or_auth_cookie_file_name())) {
1066  sandbox_cfg_allow_open_filename(&cfg, fname);
1067  }
1068  }
1069 
1071  if (!port->is_unix_addr)
1072  continue;
1073  /* When we open an AF_UNIX address, we want permission to open the
1074  * directory that holds it. */
1075  char *dirname = tor_strdup(port->unix_addr);
1076  if (get_parent_directory(dirname) == 0) {
1077  OPENDIR(dirname);
1078  }
1079  tor_free(dirname);
1080  sandbox_cfg_allow_chmod_filename(&cfg, tor_strdup(port->unix_addr));
1081  sandbox_cfg_allow_chown_filename(&cfg, tor_strdup(port->unix_addr));
1082  } SMARTLIST_FOREACH_END(port);
1083 
1084  if (options->DirPortFrontPage) {
1086  tor_strdup(options->DirPortFrontPage));
1087  }
1088 
1089  // orport
1090  if (server_mode(get_options())) {
1091 
1092  OPEN_KEYDIR_SUFFIX("secret_id_key", ".tmp");
1093  OPEN_KEYDIR_SUFFIX("secret_onion_key", ".tmp");
1094  OPEN_KEYDIR_SUFFIX("secret_onion_key_ntor", ".tmp");
1095  OPEN_KEYDIR("secret_id_key.old");
1096  OPEN_KEYDIR("secret_onion_key.old");
1097  OPEN_KEYDIR("secret_onion_key_ntor.old");
1098 
1099  OPEN_KEYDIR_SUFFIX("ed25519_master_id_secret_key", ".tmp");
1100  OPEN_KEYDIR_SUFFIX("ed25519_master_id_secret_key_encrypted", ".tmp");
1101  OPEN_KEYDIR_SUFFIX("ed25519_master_id_public_key", ".tmp");
1102  OPEN_KEYDIR_SUFFIX("ed25519_signing_secret_key", ".tmp");
1103  OPEN_KEYDIR_SUFFIX("ed25519_signing_secret_key_encrypted", ".tmp");
1104  OPEN_KEYDIR_SUFFIX("ed25519_signing_public_key", ".tmp");
1105  OPEN_KEYDIR_SUFFIX("ed25519_signing_cert", ".tmp");
1106 
1107  OPEN_DATADIR2_SUFFIX("stats", "bridge-stats", ".tmp");
1108  OPEN_DATADIR2_SUFFIX("stats", "dirreq-stats", ".tmp");
1109 
1110  OPEN_DATADIR2_SUFFIX("stats", "entry-stats", ".tmp");
1111  OPEN_DATADIR2_SUFFIX("stats", "exit-stats", ".tmp");
1112  OPEN_DATADIR2_SUFFIX("stats", "buffer-stats", ".tmp");
1113  OPEN_DATADIR2_SUFFIX("stats", "conn-stats", ".tmp");
1114  OPEN_DATADIR2_SUFFIX("stats", "hidserv-stats", ".tmp");
1115  OPEN_DATADIR2_SUFFIX("stats", "hidserv-v3-stats", ".tmp");
1116 
1117  OPEN_DATADIR("approved-routers");
1118  OPEN_DATADIR_SUFFIX("fingerprint", ".tmp");
1119  OPEN_DATADIR_SUFFIX("fingerprint-ed25519", ".tmp");
1120  OPEN_DATADIR_SUFFIX("hashed-fingerprint", ".tmp");
1121  OPEN_DATADIR_SUFFIX("router-stability", ".tmp");
1122 
1123  OPEN("/etc/resolv.conf");
1124 
1125  RENAME_SUFFIX("fingerprint", ".tmp");
1126  RENAME_SUFFIX("fingerprint-ed25519", ".tmp");
1127  RENAME_KEYDIR_SUFFIX("secret_onion_key_ntor", ".tmp");
1128 
1129  RENAME_KEYDIR_SUFFIX("secret_id_key", ".tmp");
1130  RENAME_KEYDIR_SUFFIX("secret_id_key.old", ".tmp");
1131  RENAME_KEYDIR_SUFFIX("secret_onion_key", ".tmp");
1132  RENAME_KEYDIR_SUFFIX("secret_onion_key.old", ".tmp");
1133 
1134  RENAME_SUFFIX2("stats", "bridge-stats", ".tmp");
1135  RENAME_SUFFIX2("stats", "dirreq-stats", ".tmp");
1136  RENAME_SUFFIX2("stats", "entry-stats", ".tmp");
1137  RENAME_SUFFIX2("stats", "exit-stats", ".tmp");
1138  RENAME_SUFFIX2("stats", "buffer-stats", ".tmp");
1139  RENAME_SUFFIX2("stats", "conn-stats", ".tmp");
1140  RENAME_SUFFIX2("stats", "hidserv-stats", ".tmp");
1141  RENAME_SUFFIX2("stats", "hidserv-v3-stats", ".tmp");
1142  RENAME_SUFFIX("hashed-fingerprint", ".tmp");
1143  RENAME_SUFFIX("router-stability", ".tmp");
1144 
1145  RENAME_KEYDIR_SUFFIX("ed25519_master_id_secret_key", ".tmp");
1146  RENAME_KEYDIR_SUFFIX("ed25519_master_id_secret_key_encrypted", ".tmp");
1147  RENAME_KEYDIR_SUFFIX("ed25519_master_id_public_key", ".tmp");
1148  RENAME_KEYDIR_SUFFIX("ed25519_signing_secret_key", ".tmp");
1149  RENAME_KEYDIR_SUFFIX("ed25519_signing_cert", ".tmp");
1150 
1151  sandbox_cfg_allow_rename(&cfg,
1152  get_keydir_fname("secret_onion_key"),
1153  get_keydir_fname("secret_onion_key.old"));
1154  sandbox_cfg_allow_rename(&cfg,
1155  get_keydir_fname("secret_onion_key_ntor"),
1156  get_keydir_fname("secret_onion_key_ntor.old"));
1157 
1158  STAT_KEY_DIRECTORY();
1159  OPEN_DATADIR("stats");
1160  STAT_DATADIR("stats");
1161  STAT_DATADIR2("stats", "dirreq-stats");
1162 
1164  }
1165 
1166  init_addrinfo();
1167 
1168  return cfg;
1169 }
1170 
1171 int
1172 run_tor_main_loop(void)
1173 {
1174  handle_signals();
1177 
1178  /* load the private keys, if we're supposed to have them, and set up the
1179  * TLS context. */
1180  if (! client_identity_key_is_set()) {
1181  if (init_keys() < 0) {
1182  log_err(LD_OR, "Error initializing keys; exiting");
1183  return -1;
1184  }
1185  }
1186 
1187  /* Set up our buckets */
1189 
1190  /* initialize the bootstrap status events to know we're starting up */
1191  control_event_bootstrap(BOOTSTRAP_STATUS_STARTING, 0);
1192 
1193  /* Initialize the keypinning log. */
1194  if (authdir_mode_v3(get_options())) {
1195  char *fname = get_datadir_fname("key-pinning-journal");
1196  int r = 0;
1197  if (keypin_load_journal(fname)<0) {
1198  log_err(LD_DIR, "Error loading key-pinning journal: %s",strerror(errno));
1199  r = -1;
1200  }
1201  if (keypin_open_journal(fname)<0) {
1202  log_err(LD_DIR, "Error opening key-pinning journal: %s",strerror(errno));
1203  r = -1;
1204  }
1205  tor_free(fname);
1206  if (r)
1207  return r;
1208  }
1209  {
1210  /* This is the old name for key-pinning-journal. These got corrupted
1211  * in a couple of cases by #16530, so we started over. See #16580 for
1212  * the rationale and for other options we didn't take. We can remove
1213  * this code once all the authorities that ran 0.2.7.1-alpha-dev are
1214  * upgraded.
1215  */
1216  char *fname = get_datadir_fname("key-pinning-entries");
1217  unlink(fname);
1218  tor_free(fname);
1219  }
1220 
1221  if (trusted_dirs_reload_certs()) {
1222  log_warn(LD_DIR,
1223  "Couldn't load all cached v3 certificates. Starting anyway.");
1224  }
1226  return -1;
1227  }
1228  /* load the routers file, or assign the defaults. */
1229  if (router_reload_router_list()) {
1230  return -1;
1231  }
1232  /* load the networkstatuses. (This launches a download for new routers as
1233  * appropriate.)
1234  */
1235  const time_t now = time(NULL);
1236  directory_info_has_arrived(now, 1, 0);
1237 
1239  /* launch cpuworkers. Need to do this *after* we've read the onion key. */
1240  cpu_init();
1241  }
1243 
1244  /* Setup shared random protocol subsystem. */
1245  if (authdir_mode_v3(get_options())) {
1246  if (sr_init(1) < 0) {
1247  return -1;
1248  }
1249  }
1250 
1251  /* initialize dns resolve map, spawn workers if needed */
1252  if (dns_init() < 0) {
1253  if (get_options()->ServerDNSAllowBrokenConfig)
1254  log_warn(LD_GENERAL, "Couldn't set up any working nameservers. "
1255  "Network not up yet? Will try again soon.");
1256  else {
1257  log_err(LD_GENERAL,"Error initializing dns subsystem; exiting. To "
1258  "retry instead, set the ServerDNSAllowBrokenResolvConf option.");
1259  }
1260  }
1261 
1262 #ifdef HAVE_SYSTEMD
1263  {
1264  const int r = sd_notify(0, "READY=1");
1265  if (r < 0) {
1266  log_warn(LD_GENERAL, "Unable to send readiness to systemd: %s",
1267  strerror(r));
1268  } else if (r > 0) {
1269  log_notice(LD_GENERAL, "Signaled readiness to systemd");
1270  } else {
1271  log_info(LD_GENERAL, "Systemd NOTIFY_SOCKET not present.");
1272  }
1273  }
1274 #endif /* defined(HAVE_SYSTEMD) */
1275 
1276  return do_main_loop();
1277 }
1278 
1279 /** Install the publish/subscribe relationships for all the subsystems. */
1280 void
1282 {
1283  pubsub_builder_t *builder = pubsub_builder_new();
1284  int r = subsystems_add_pubsub(builder);
1285  tor_assert(r == 0);
1286  r = tor_mainloop_connect_pubsub(builder); // consumes builder
1287  tor_assert(r == 0);
1288 }
1289 
1290 /** Connect the mainloop to its publish/subscribe message delivery events if
1291  * appropriate, and configure the global channels appropriately. */
1292 void
1294 {
1295  if (get_options()->command == CMD_RUN_TOR) {
1297  /* XXXX For each pubsub channel, its delivery strategy should be set at
1298  * this XXXX point, using tor_mainloop_set_delivery_strategy().
1299  */
1302  }
1303 }
1304 
1305 /* Main entry point for the Tor process. Called from tor_main(), and by
1306  * anybody embedding Tor. */
1307 int
1309 {
1310  int result = 0;
1311 
1312 #ifdef EVENT_SET_MEM_FUNCTIONS_IMPLEMENTED
1313  event_set_mem_functions(tor_malloc_, tor_realloc_, tor_free_);
1314 #endif
1315 
1316  subsystems_init();
1317 
1319 
1320  int argc = tor_cfg->argc + tor_cfg->argc_owned;
1321  char **argv = tor_calloc(argc, sizeof(char*));
1322  memcpy(argv, tor_cfg->argv, tor_cfg->argc*sizeof(char*));
1323  if (tor_cfg->argc_owned)
1324  memcpy(argv + tor_cfg->argc, tor_cfg->argv_owned,
1325  tor_cfg->argc_owned*sizeof(char*));
1326 
1327  int done = 0;
1328  result = nt_service_parse_options(argc, argv, &done);
1329  if (POSSIBLE(done))
1330  goto done;
1331 
1332  pubsub_install();
1333 
1334  {
1335  int init_rv = tor_init(argc, argv);
1336  if (init_rv) {
1337  tor_free_all(0);
1338  result = (init_rv < 0) ? -1 : 0;
1339  goto done;
1340  }
1341  }
1342 
1343  pubsub_connect();
1344 
1345  if (get_options()->Sandbox && get_options()->command == CMD_RUN_TOR) {
1346  sandbox_cfg_t* cfg = sandbox_init_filter();
1347 
1348  if (sandbox_init(cfg)) {
1349  tor_free(argv);
1350  log_err(LD_BUG,"Failed to create syscall sandbox filter");
1351  tor_free_all(0);
1352  return -1;
1353  }
1354  tor_make_getaddrinfo_cache_active();
1355 
1356  // registering libevent rng
1357 #ifdef HAVE_EVUTIL_SECURE_RNG_SET_URANDOM_DEVICE_FILE
1358  evutil_secure_rng_set_urandom_device_file(
1359  (char*) sandbox_intern_string("/dev/urandom"));
1360 #endif
1361  }
1362 
1363  switch (get_options()->command) {
1364  case CMD_RUN_TOR:
1365  nt_service_set_state(SERVICE_RUNNING);
1366  result = run_tor_main_loop();
1367  break;
1368  case CMD_KEYGEN:
1369  result = load_ed_keys(get_options(), time(NULL)) < 0;
1370  break;
1371  case CMD_KEY_EXPIRATION:
1372  init_keys();
1373  result = log_cert_expiration();
1374  break;
1375  case CMD_LIST_FINGERPRINT:
1376  result = do_list_fingerprint();
1377  break;
1378  case CMD_HASH_PASSWORD:
1379  do_hash_password();
1380  result = 0;
1381  break;
1382  case CMD_VERIFY_CONFIG:
1383  if (quiet_level == QUIET_NONE)
1384  printf("Configuration was valid\n");
1385  result = 0;
1386  break;
1387  case CMD_DUMP_CONFIG:
1388  result = do_dump_config();
1389  break;
1390  case CMD_RUN_UNITTESTS: /* only set by test.c */
1391  case CMD_IMMEDIATE: /* Handled in config.c */
1392  default:
1393  log_warn(LD_BUG,"Illegal command number %d: internal error.",
1394  get_options()->command);
1395  result = -1;
1396  }
1397  tor_cleanup();
1398  done:
1399  tor_free(argv);
1400  return result;
1401 }
void addressmap_init(void)
Definition: addressmap.c:90
void addressmap_clear_transient(void)
Definition: addressmap.c:311
Header for addressmap.c.
time_t approx_time(void)
Definition: approx_time.c:32
int trusted_dirs_reload_certs(void)
Definition: authcert.c:324
Header file for authcert.c.
int authdir_mode(const or_options_t *options)
Definition: authmode.c:25
Header file for directory authority mode.
void base16_encode(char *dest, size_t destlen, const char *src, size_t srclen)
Definition: binascii.c:478
size_t buf_allocation(const buf_t *buf)
Definition: buffers.c:401
Header file for buffers.c.
void bwhist_init(void)
Definition: bwhist.c:139
Header for feature/stats/bwhist.c.
void channel_dumpstats(int severity)
Definition: channel.c:2071
void channel_listener_dumpstats(int severity)
Definition: channel.c:2102
Header file for channel.c.
void channelpadding_new_consensus_params(const networkstatus_t *ns)
uint64_t stats_n_padding_cells_processed
Definition: channeltls.c:81
void circuit_mark_all_dirty_circs_as_unusable(void)
Definition: circuitlist.c:2064
void circuit_dump_by_conn(connection_t *conn, int severity)
Definition: circuitlist.c:1377
Header file for circuitlist.c.
void circpad_machines_init(void)
void circpad_new_consensus_params(const networkstatus_t *ns)
Header file for circuitpadding.c.
uint64_t stats_n_created_cells_processed
Definition: command.c:70
uint64_t stats_n_destroy_cells_processed
Definition: command.c:74
uint64_t stats_n_relay_cells_processed
Definition: command.c:72
uint64_t stats_n_create_cells_processed
Definition: command.c:68
Header file for command.c.
#define POSSIBLE(expr)
struct event_base * tor_libevent_get_base(void)
const char * tor_libevent_get_version_str(void)
Header for compat_libevent.c.
int tor_compress_supports_method(compress_method_t method)
Definition: compress.c:304
void tor_compress_log_init_warnings(void)
Definition: compress.c:682
const char * tor_compress_version_str(compress_method_t method)
Definition: compress.c:417
Headers for compress.c.
const smartlist_t * get_configured_ports(void)
Definition: config.c:6687
parsed_cmdline_t * config_parse_commandline(int argc, char **argv, int ignore_errors)
Definition: config.c:2513
int options_init_from_torrc(int argc, char **argv)
Definition: config.c:4448
int quiet
Definition: config.c:2442
const or_options_t * get_options(void)
Definition: config.c:919
static char * torrc_defaults_fname
Definition: config.c:877
void init_protocol_warning_severity_level(void)
Definition: config.c:1161
static char * torrc_fname
Definition: config.c:875
char * options_dump(const or_options_t *options, int how_to_dump)
Definition: config.c:2902
const char * get_torrc_fname(int defaults_fname)
Definition: config.c:4738
int set_options(or_options_t *new_val, char **msg)
Definition: config.c:955
tor_cmdline_mode_t command
Definition: config.c:2440
Header file for config.c.
#define CONFIG_BACKUP_PATTERN
Definition: config.h:48
Header for confline.c.
int connection_is_listener(connection_t *conn)
Definition: connection.c:4936
void connection_dump_buffer_mem_stats(int severity)
Definition: connection.c:5522
void connection_bucket_init(void)
Definition: connection.c:3755
const char * connection_describe(const connection_t *conn)
Definition: connection.c:543
Header file for connection.c.
#define CONN_TYPE_OR
Definition: connection.h:44
or_connection_t * TO_OR_CONN(connection_t *c)
Header file for connection_or.c.
void consdiffmgr_enable_background_compression(void)
Definition: consdiffmgr.c:1918
int consdiffmgr_register_with_sandbox(struct sandbox_cfg_elem_t **cfg)
Definition: consdiffmgr.c:857
Header for consdiffmgr.c.
Header file for control.c.
char * get_controller_cookie_file_name(void)
Definition: control_auth.c:48
Header file for control_auth.c.
void control_event_bootstrap(bootstrap_status_t status, int progress)
int control_event_signal(uintptr_t signal_num)
Header file for control_events.c.
void cpu_init(void)
Definition: cpuworker.c:83
void cpuworker_log_onionskin_overhead(int severity, int onionskin_type, const char *onionskin_type_name)
Definition: cpuworker.c:292
void cpuworkers_rotate_keyinfo(void)
Definition: cpuworker.c:188
Header file for cpuworker.c.
void digest256_to_base64(char *d64, const char *digest)
Header for crypto_format.c.
const char * crypto_get_library_name(void)
Definition: crypto_init.c:178
const char * crypto_get_library_version_string(void)
Definition: crypto_init.c:191
Headers for crypto_init.c.
void crypto_rand(char *to, size_t n)
Definition: crypto_rand.c:477
Common functions for using (pseudo-)random number generators.
int crypto_pk_get_fingerprint(crypto_pk_t *pk, char *fp_out, int add_space)
Definition: crypto_rsa.c:229
#define FINGERPRINT_LEN
Definition: crypto_rsa.h:34
void secret_to_key_rfc2440(char *key_out, size_t key_out_len, const char *secret, size_t secret_len, const char *s2k_specifier)
Definition: crypto_s2k.c:203
Header for crypto_s2k.c.
#define S2K_RFC2440_SPECIFIER_LEN
Definition: crypto_s2k.h:21
#define DIGEST_LEN
Definition: digest_sizes.h:20
void router_reset_status_download_failures(void)
Definition: dirlist.c:151
int dns_init(void)
Definition: dns.c:217
void dump_dns_mem_usage(int severity)
Definition: dns.c:2138
int dns_reset(void)
Definition: dns.c:230
Header file for dns.c.
char * get_ext_or_auth_cookie_file_name(void)
Definition: ext_orport.c:127
Header for ext_orport.c.
int tor_unlink(const char *pathname)
Definition: files.c:154
int accounting_record_bandwidth_usage(time_t now, or_state_t *state)
Definition: hibernate.c:705
int accounting_is_enabled(const or_options_t *options)
Definition: hibernate.c:305
void hibernate_begin_shutdown(void)
Definition: hibernate.c:927
Header file for hibernate.c.
void hs_init(void)
Definition: hs_common.c:1700
void hs_dos_init(void)
Definition: hs_dos.c:225
Header file containing denial of service defenses for the HS subsystem for all versions.
void hs_service_lists_fnames_for_sandbox(smartlist_t *file_list, smartlist_t *dir_list)
Definition: hs_service.c:4028
void hs_service_dump_stats(int severity)
Definition: hs_service.c:4205
Header file containing service data for the HS subsystem.
int keypin_load_journal(const char *fname)
Definition: keypin.c:448
int keypin_open_journal(const char *fname)
Definition: keypin.c:301
Header for keypin.c.
const char * tor_libc_get_name(void)
Definition: libc.c:32
const char * tor_libc_get_version_str(void)
Definition: libc.c:44
Header for lib/osinfo/libc.c.
tor_lockfile_t * tor_lockfile_lock(const char *filename, int blocking, int *locked_out)
Definition: lockfile.c:63
void tor_lockfile_unlock(tor_lockfile_t *lockfile)
Definition: lockfile.c:121
Header for lockfile.c.
void tor_log(int severity, log_domain_mask_t domain, const char *format,...)
Definition: log.c:590
void truncate_logs(void)
Definition: log.c:1456
void switch_logs_debug(void)
Definition: log.c:1441
int get_min_log_level(void)
Definition: log.c:1426
void log_set_application_name(const char *name)
Definition: log.c:211
void tor_log_get_logfile_names(smartlist_t *out)
Definition: log.c:683
#define LD_OR
Definition: log.h:92
#define LD_FS
Definition: log.h:70
#define LD_BUG
Definition: log.h:86
#define LD_NET
Definition: log.h:66
#define LD_GENERAL
Definition: log.h:62
#define LD_DIR
Definition: log.h:88
#define LD_CONFIG
Definition: log.h:68
#define LOG_INFO
Definition: log.h:45
static tor_lockfile_t * lockfile
Definition: main.c:659
int tor_run_main(const tor_main_configuration_t *tor_cfg)
Definition: main.c:1308
static int do_dump_config(void)
Definition: main.c:805
static int do_list_fingerprint(void)
Definition: main.c:733
struct event * signal_event
Definition: main.c:445
void release_lockfile(void)
Definition: main.c:710
static void do_hash_password(void)
Definition: main.c:787
int tor_init(int argc, char *argv[])
Definition: main.c:537
int try_locking(const or_options_t *options, int err_if_locked)
Definition: main.c:667
static void process_signal(int sig)
Definition: main.c:219
static void dumpstats(int severity)
Definition: main.c:331
int have_lockfile(void)
Definition: main.c:703
static void dumpmemusage(int severity)
Definition: main.c:318
int signal_value
Definition: main.c:440
int try_to_register
Definition: main.c:443
static void signal_callback(evutil_socket_t fd, short events, void *arg)
Definition: main.c:206
void tor_remove_file(const char *filename)
Definition: main.c:723
static int do_hup(void)
Definition: main.c:118
void handle_signals(void)
Definition: main.c:483
void pubsub_install(void)
Definition: main.c:1281
void pubsub_connect(void)
Definition: main.c:1293
Header file for main.c.
uint64_t get_bytes_read(void)
Definition: mainloop.c:463
void update_current_time(time_t now)
Definition: mainloop.c:2197
void do_signewnym(time_t now)
Definition: mainloop.c:1316
void initialize_mainloop_events(void)
Definition: mainloop.c:2332
int do_main_loop(void)
Definition: mainloop.c:2346
void schedule_rescan_periodic_events(void)
Definition: mainloop.c:1571
void tor_shutdown_event_loop_and_exit(int exitcode)
Definition: mainloop.c:764
void tor_init_connection_lists(void)
Definition: mainloop.c:412
smartlist_t * get_connection_array(void)
Definition: mainloop.c:451
void directory_info_has_arrived(time_t now, int from_cache, int suppress_logs)
Definition: mainloop.c:1115
uint64_t get_bytes_written(void)
Definition: mainloop.c:473
time_t time_of_process_start
Definition: mainloop.c:142
Header file for mainloop.c.
int tor_mainloop_connect_pubsub(struct pubsub_builder_t *builder)
void tor_mainloop_connect_pubsub_events(void)
int tor_mainloop_set_delivery_strategy(const char *msg_channel_name, deliv_strategy_t strategy)
Header for mainloop_pubsub.c.
@ DELIV_IMMEDIATE
void tor_free_(void *mem)
Definition: malloc.c:227
void * tor_realloc_(void *ptr, size_t size)
Definition: malloc.c:118
void * tor_malloc_(size_t size)
Definition: malloc.c:32
#define tor_free(p)
Definition: malloc.h:52
Header for meminfo.c.
int net_is_disabled(void)
Definition: netstatus.c:25
void set_network_participation(bool participation)
Definition: netstatus.c:101
void reset_user_activity(time_t now)
Definition: netstatus.c:82
void note_user_activity(time_t now)
Definition: netstatus.c:63
Header for netstatus.c.
void update_networkstatus_downloads(time_t now)
int router_reload_consensus_networkstatus(void)
Header file for networkstatus.c.
Header file for ntmain.c.
Master header file for Tor-specific functionality.
#define RELAY_PAYLOAD_SIZE
Definition: or.h:486
OR connection structure.
int get_parent_directory(char *fname)
Definition: path.c:195
Listener port configuration structure.
Header file for predict_ports.c.
int tor_asprintf(char **strp, const char *fmt,...)
Definition: printf.c:75
int tor_snprintf(char *str, size_t size, const char *format,...)
Definition: printf.c:27
int dirserv_load_fingerprint_file(void)
Header file for process_descs.c.
pubsub_builder_t * pubsub_builder_new(void)
Definition: pubsub_build.c:56
Header used for constructing the OO publish-subscribe facility.
struct pubsub_builder_t pubsub_builder_t
Definition: pubsub_build.h:28
quiet_level_t quiet_level
Definition: quiet_level.c:20
void add_default_log_for_quiet_level(quiet_level_t quiet)
Definition: quiet_level.c:24
Declare the quiet_level enumeration and global.
quiet_level_t
Definition: quiet_level.h:16
@ QUIET_NONE
Definition: quiet_level.h:18
uint64_t stats_n_data_cells_received
Definition: relay.c:2058
void dump_cell_pool_usage(int severity)
Definition: relay.c:2531
uint64_t stats_n_relay_cells_relayed
Definition: relay.c:128
uint64_t stats_n_data_cells_packaged
Definition: relay.c:2052
uint64_t stats_n_data_bytes_received
Definition: relay.c:2062
uint64_t stats_n_relay_cells_delivered
Definition: relay.c:132
uint64_t stats_n_data_bytes_packaged
Definition: relay.c:2056
Header file for relay.c.
uint64_t rephist_total_alloc
Definition: rephist.c:94
void rep_hist_init(void)
Definition: rephist.c:569
void rep_hist_dump_stats(time_t now, int severity)
Definition: rephist.c:890
uint32_t rephist_total_num
Definition: rephist.c:96
Header file for rephist.c.
Header for resolve.c.
const char risky_option_list[]
Definition: risky_options.c:18
Header for risky_options.c.
void router_reset_warnings(void)
Definition: router.c:3587
int init_keys(void)
Definition: router.c:962
int client_identity_key_is_set(void)
Definition: router.c:441
int load_ed_keys(const or_options_t *options, time_t now)
Definition: routerkeys.c:55
int log_cert_expiration(void)
Definition: routerkeys.c:606
int generate_ed_link_cert(const or_options_t *options, time_t now, int force)
Definition: routerkeys.c:365
Header for routerkeys.c.
void dump_routerlist_mem_usage(int severity)
Definition: routerlist.c:1060
int router_reload_router_list(void)
Definition: routerlist.c:460
void routerlist_reset_warnings(void)
Definition: routerlist.c:1533
void router_reset_descriptor_download_failures(void)
Definition: routerlist.c:2890
Header file for routerlist.c.
int dir_server_mode(const or_options_t *options)
Definition: routermode.c:23
int server_mode(const or_options_t *options)
Definition: routermode.c:34
Header file for routermode.c.
void routerparse_init(void)
Definition: routerparse.c:1246
Header file for routerparse.c.
int sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file)
Definition: sandbox.c:1904
int sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file)
Definition: sandbox.c:1925
int sandbox_init(sandbox_cfg_t *cfg)
Definition: sandbox.c:1880
sandbox_cfg_t * sandbox_cfg_new(void)
Definition: sandbox.c:1874
int sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file)
Definition: sandbox.c:1911
Header file for sandbox.c.
struct sandbox_cfg_elem_t sandbox_cfg_t
Definition: sandbox.h:35
#define sandbox_intern_string(s)
Definition: sandbox.h:110
int sr_init(int save_to_disk)
This file contains ABI/API of the shared random protocol defined in proposal #250....
void tor_free_all(int postfork)
Definition: shutdown.c:109
void tor_cleanup(void)
Definition: shutdown.c:58
Header file for shutdown.c.
smartlist_t * smartlist_new(void)
#define SMARTLIST_FOREACH_BEGIN(sl, type, var)
#define SMARTLIST_FOREACH(sl, type, var, cmd)
or_state_t * get_or_state(void)
Definition: statefile.c:220
Header for statefile.c.
int log_heartbeat(time_t now)
Definition: status.c:154
Header for status.c.
struct tor_tls_t * tls
char * command_arg
Definition: or_options_st.h:69
int DisableSignalHandlers
char * ServerDNSResolvConfFile
struct smartlist_t * FilesOpenedByIncludes
char * Nickname
Definition: or_options_st.h:97
int ReloadTorrcOnSIGHUP
char * DirPortFrontPage
char * DataDirectory
Definition: or_options_st.h:84
int BridgeAuthoritativeDir
quiet_level_t quiet_level
Definition: config.h:203
tor_cmdline_mode_t command
Definition: config.h:199
int subsystems_add_pubsub(pubsub_builder_t *builder)
Definition: subsysmgr.c:195
int subsystems_init(void)
Definition: subsysmgr.c:114
Header for subsysmgr.c.
void timers_initialize(void)
Definition: timers.c:205
Header for timers.c.
Public C API for the Tor network service.
Internal declarations for in-process Tor API.
@ CMD_HASH_PASSWORD
@ CMD_LIST_FINGERPRINT
@ CMD_VERIFY_CONFIG
@ CMD_RUN_TOR
@ CMD_KEY_EXPIRATION
@ CMD_KEYGEN
@ CMD_DUMP_CONFIG
@ CMD_IMMEDIATE
@ CMD_RUN_UNITTESTS
Headers for tortls.c.
int tor_tls_get_buffer_sizes(tor_tls_t *tls, size_t *rbuf_capacity, size_t *rbuf_bytes, size_t *wbuf_capacity, size_t *wbuf_bytes)
Definition: tortls_nss.c:697
Header for version.c.
const char * get_version(void)
Definition: version.c:38
Header for trace.c.
const char * get_uname(void)
Definition: uname.c:67
Header for uname.c.
#define tor_assert(expr)
Definition: util_bug.h:102
void notify_pending_waitpid_callbacks(void)
Definition: waitpid.c:141
Headers for waitpid.c.
#define ED25519_BASE64_LEN
Definition: x25519_sizes.h:43