tor  0.4.1.0-alpha-dev
router.c
Go to the documentation of this file.
1 /* Copyright (c) 2001 Matej Pfajfar.
2  * Copyright (c) 2001-2004, Roger Dingledine.
3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4  * Copyright (c) 2007-2019, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
6 
7 #define ROUTER_PRIVATE
8 
9 #include "core/or/or.h"
10 #include "app/config/config.h"
11 #include "app/config/statefile.h"
12 #include "app/main/main.h"
14 #include "core/mainloop/mainloop.h"
15 #include "core/mainloop/netstatus.h"
16 #include "core/or/policies.h"
17 #include "core/or/protover.h"
28 #include "feature/keymgt/loadkey.h"
36 #include "feature/nodelist/torcert.h"
37 #include "feature/relay/dns.h"
38 #include "feature/relay/router.h"
39 #include "feature/relay/routerkeys.h"
41 #include "feature/relay/selftest.h"
42 #include "lib/geoip/geoip.h"
44 #include "feature/stats/rephist.h"
50 #include "lib/encoding/confline.h"
51 #include "lib/osinfo/uname.h"
52 #include "lib/tls/tortls.h"
53 #include "lib/version/torversion.h"
54 
56 
57 #include "app/config/or_state_st.h"
58 #include "core/or/port_cfg_st.h"
59 #include "feature/dirclient/dir_server_st.h"
60 #include "feature/dircommon/dir_connection_st.h"
61 #include "feature/nodelist/authority_cert_st.h"
62 #include "feature/nodelist/extrainfo_st.h"
63 #include "feature/nodelist/networkstatus_st.h"
64 #include "feature/nodelist/node_st.h"
65 #include "feature/nodelist/routerinfo_st.h"
66 #include "feature/nodelist/routerstatus_st.h"
67 
89 /************************************************************/
90 
91 /*****
92  * Key management: ORs only.
93  *****/
94 
97 static tor_mutex_t *key_lock=NULL;
98 static time_t onionkey_set_at=0;
100 static crypto_pk_t *onionkey=NULL;
123 
130 
131 /* (Note that v3 authorities also have a separate "authority identity key",
132  * but this key is never actually loaded by the Tor process. Instead, it's
133  * used by tor-gencert to sign new signing keys and make new key
134  * certificates. */
135 
139 const char *
141 {
142  switch (err) {
143  case TOR_ROUTERINFO_ERROR_NO_EXT_ADDR:
144  return "No known exit address yet";
145  case TOR_ROUTERINFO_ERROR_CANNOT_PARSE:
146  return "Cannot parse descriptor";
147  case TOR_ROUTERINFO_ERROR_NOT_A_SERVER:
148  return "Not running in server mode";
149  case TOR_ROUTERINFO_ERROR_DIGEST_FAILED:
150  return "Key digest failed";
151  case TOR_ROUTERINFO_ERROR_CANNOT_GENERATE:
152  return "Cannot generate descriptor";
153  case TOR_ROUTERINFO_ERROR_DESC_REBUILDING:
154  return "Descriptor still rebuilding - not ready yet";
155  case TOR_ROUTERINFO_ERROR_INTERNAL_BUG:
156  return "Internal bug, see logs for details";
157  }
158 
159  log_warn(LD_BUG, "unknown routerinfo error %d - shouldn't happen", err);
160  tor_assert_unreached();
161 
162  return "Unknown error";
163 }
164 
168 int
170 {
176  return err != TOR_ROUTERINFO_ERROR_NOT_A_SERVER;
177 }
178 
182 static void
184 {
185  if (onionkey && crypto_pk_eq_keys(onionkey, k)) {
186  /* k is already our onion key; free it and return */
187  crypto_pk_free(k);
188  return;
189  }
191  crypto_pk_free(onionkey);
192  onionkey = k;
194  mark_my_descriptor_dirty("set onion key");
195 }
196 
200 get_onion_key,(void))
201 {
203  return onionkey;
204 }
205 
210 void
212 {
213  tor_assert(key);
214  tor_assert(last);
216  if (onionkey)
218  else
219  *key = NULL;
220  if (lastonionkey)
222  else
223  *last = NULL;
225 }
226 
234 void
236 {
237  char *fname = NULL;
238 
240 
241  /* Free lastonionkey and set it to NULL. */
242  if (lastonionkey) {
243  crypto_pk_free(lastonionkey);
244  lastonionkey = NULL;
245  }
246 
247  /* We zero out the keypair. See the fast_mem_is_zero() check made in
248  * construct_ntor_key_map() below. */
250 
252 
253  fname = get_keydir_fname("secret_onion_key.old");
254  if (file_status(fname) == FN_FILE) {
255  if (tor_unlink(fname) != 0) {
256  log_warn(LD_FS, "Couldn't unlink old onion key file %s: %s",
257  fname, strerror(errno));
258  }
259  }
260  tor_free(fname);
261 
262  fname = get_keydir_fname("secret_onion_key_ntor.old");
263  if (file_status(fname) == FN_FILE) {
264  if (tor_unlink(fname) != 0) {
265  log_warn(LD_FS, "Couldn't unlink old ntor onion key file %s: %s",
266  fname, strerror(errno));
267  }
268  }
269  tor_free(fname);
270 }
271 
274 MOCK_IMPL(STATIC const struct curve25519_keypair_t *,
275 get_current_curve25519_keypair,(void))
276 {
277  return &curve25519_onion_key;
278 }
279 
284 {
285  di_digest256_map_t *m = NULL;
286 
287  if (!fast_mem_is_zero((const char*)
288  curve25519_onion_key.pubkey.public_key,
290  dimap_add_entry(&m,
291  curve25519_onion_key.pubkey.public_key,
292  tor_memdup(&curve25519_onion_key,
293  sizeof(curve25519_keypair_t)));
294  }
295  if (!fast_mem_is_zero((const char*)
296  last_curve25519_onion_key.pubkey.public_key,
298  dimap_add_entry(&m,
299  last_curve25519_onion_key.pubkey.public_key,
300  tor_memdup(&last_curve25519_onion_key,
301  sizeof(curve25519_keypair_t)));
302  }
303 
304  return m;
305 }
308 static void
310 {
311  curve25519_keypair_t *k = arg;
312  memwipe(k, 0, sizeof(*k));
313  tor_free(k);
314 }
316 void
318 {
319  if (!map)
320  return;
321  dimap_free(map, ntor_key_map_free_helper);
322 }
323 
328 time_t
330 {
331  return onionkey_set_at;
332 }
333 
336 void
338 {
339  crypto_pk_free(server_identitykey);
340  server_identitykey = k;
343  log_err(LD_BUG, "Couldn't compute our own identity key digest.");
344  tor_assert(0);
345  }
346 }
347 
348 #ifdef TOR_UNIT_TESTS
349 
351 void
352 set_server_identity_key_digest_testing(const uint8_t *digest)
353 {
354  memcpy(server_identitykey_digest, digest, DIGEST_LEN);
355 }
356 #endif
357 
360 static void
362 {
363  if (1)
364  return;
366  if (public_server_mode(get_options())) {
367  /* assert that we have set the client and server keys to be equal */
370  } else {
371  /* assert that we have set the client and server keys to be unequal */
372  if (server_identitykey)
374  }
375 }
376 
381 get_server_identity_key,(void))
382 {
384  tor_assert(server_mode(get_options()));
386  return server_identitykey;
387 }
388 
391 int
393 {
394  return server_mode(get_options()) && server_identitykey != NULL;
395 }
396 
399 void
401 {
402  crypto_pk_free(client_identitykey);
403  client_identitykey = k;
404 }
405 
409 crypto_pk_t *
411 {
414  return client_identitykey;
415 }
416 
418 int
420 {
421  return client_identitykey != NULL;
422 }
423 
427 get_my_v3_authority_cert, (void))
428 {
430 }
431 
434 crypto_pk_t *
436 {
437  return authority_signing_key;
438 }
439 
445 {
446  return legacy_key_certificate;
447 }
448 
451 crypto_pk_t *
453 {
454  return legacy_signing_key;
455 }
456 
464 void
466 {
467  char *fname, *fname_prev;
468  crypto_pk_t *prkey = NULL;
469  or_state_t *state = get_or_state();
470  curve25519_keypair_t new_curve25519_keypair;
471  time_t now;
472  fname = get_keydir_fname("secret_onion_key");
473  fname_prev = get_keydir_fname("secret_onion_key.old");
474  /* There isn't much point replacing an old key with an empty file */
475  if (file_status(fname) == FN_FILE) {
476  if (replace_file(fname, fname_prev))
477  goto error;
478  }
479  if (!(prkey = crypto_pk_new())) {
480  log_err(LD_GENERAL,"Error constructing rotated onion key");
481  goto error;
482  }
483  if (crypto_pk_generate_key(prkey)) {
484  log_err(LD_BUG,"Error generating onion key");
485  goto error;
486  }
487  if (crypto_pk_write_private_key_to_filename(prkey, fname)) {
488  log_err(LD_FS,"Couldn't write generated onion key to \"%s\".", fname);
489  goto error;
490  }
491  tor_free(fname);
492  tor_free(fname_prev);
493  fname = get_keydir_fname("secret_onion_key_ntor");
494  fname_prev = get_keydir_fname("secret_onion_key_ntor.old");
495  if (curve25519_keypair_generate(&new_curve25519_keypair, 1) < 0)
496  goto error;
497  /* There isn't much point replacing an old key with an empty file */
498  if (file_status(fname) == FN_FILE) {
499  if (replace_file(fname, fname_prev))
500  goto error;
501  }
502  if (curve25519_keypair_write_to_file(&new_curve25519_keypair, fname,
503  "onion") < 0) {
504  log_err(LD_FS,"Couldn't write curve25519 onion key to \"%s\".",fname);
505  goto error;
506  }
507  log_info(LD_GENERAL, "Rotating onion key");
509  crypto_pk_free(lastonionkey);
511  onionkey = prkey;
513  sizeof(curve25519_keypair_t));
514  memcpy(&curve25519_onion_key, &new_curve25519_keypair,
515  sizeof(curve25519_keypair_t));
516  now = time(NULL);
517  state->LastRotatedOnionKey = onionkey_set_at = now;
519  mark_my_descriptor_dirty("rotated onion key");
520  or_state_mark_dirty(state, get_options()->AvoidDiskWrites ? now+3600 : 0);
521  goto done;
522  error:
523  log_warn(LD_GENERAL, "Couldn't rotate onion key.");
524  if (prkey)
525  crypto_pk_free(prkey);
526  done:
527  memwipe(&new_curve25519_keypair, 0, sizeof(new_curve25519_keypair));
528  tor_free(fname);
529  tor_free(fname_prev);
530 }
531 
535 static void
537 {
538  static int already_logged = 0;
539 
540  if (already_logged)
541  return;
542 
543  tor_log(LOG_NOTICE, LD_GENERAL, "You are running a new relay. "
544  "Thanks for helping the Tor network! If you wish to know "
545  "what will happen in the upcoming weeks regarding its usage, "
546  "have a look at https://blog.torproject.org/blog/lifecycle-of"
547  "-a-new-relay");
548 
549  already_logged = 1;
550 }
551 
557 static int
559  const char *fname,
560  int generate,
561  int severity,
562  const char *tag)
563 {
564  switch (file_status(fname)) {
565  case FN_DIR:
566  case FN_ERROR:
567  tor_log(severity, LD_FS,"Can't read key from \"%s\"", fname);
568  goto error;
569  /* treat empty key files as if the file doesn't exist, and, if generate
570  * is set, replace the empty file in curve25519_keypair_write_to_file() */
571  case FN_NOENT:
572  case FN_EMPTY:
573  if (generate) {
574  if (!have_lockfile()) {
575  if (try_locking(get_options(), 0)<0) {
576  /* Make sure that --list-fingerprint only creates new keys
577  * if there is no possibility for a deadlock. */
578  tor_log(severity, LD_FS, "Another Tor process has locked \"%s\". "
579  "Not writing any new keys.", fname);
580  /*XXXX The 'other process' might make a key in a second or two;
581  * maybe we should wait for it. */
582  goto error;
583  }
584  }
585  log_info(LD_GENERAL, "No key found in \"%s\"; generating fresh key.",
586  fname);
587  if (curve25519_keypair_generate(keys_out, 1) < 0)
588  goto error;
589  if (curve25519_keypair_write_to_file(keys_out, fname, tag)<0) {
590  tor_log(severity, LD_FS,
591  "Couldn't write generated key to \"%s\".", fname);
592  memwipe(keys_out, 0, sizeof(*keys_out));
593  goto error;
594  }
595  } else {
596  log_info(LD_GENERAL, "No key found in \"%s\"", fname);
597  }
598  return 0;
599  case FN_FILE:
600  {
601  char *tag_in=NULL;
602  if (curve25519_keypair_read_from_file(keys_out, &tag_in, fname) < 0) {
603  tor_log(severity, LD_GENERAL,"Error loading private key.");
604  tor_free(tag_in);
605  goto error;
606  }
607  if (!tag_in || strcmp(tag_in, tag)) {
608  tor_log(severity, LD_GENERAL,"Unexpected tag %s on private key.",
609  escaped(tag_in));
610  tor_free(tag_in);
611  goto error;
612  }
613  tor_free(tag_in);
614  return 0;
615  }
616  default:
617  tor_assert(0);
618  }
619 
620  error:
621  return -1;
622 }
623 
629 static int
630 load_authority_keyset(int legacy, crypto_pk_t **key_out,
631  authority_cert_t **cert_out)
632 {
633  int r = -1;
634  char *fname = NULL, *cert = NULL;
635  const char *eos = NULL;
636  crypto_pk_t *signing_key = NULL;
637  authority_cert_t *parsed = NULL;
638 
639  fname = get_keydir_fname(
640  legacy ? "legacy_signing_key" : "authority_signing_key");
641  signing_key = init_key_from_file(fname, 0, LOG_ERR, NULL);
642  if (!signing_key) {
643  log_warn(LD_DIR, "No version 3 directory key found in %s", fname);
644  goto done;
645  }
646  tor_free(fname);
647  fname = get_keydir_fname(
648  legacy ? "legacy_certificate" : "authority_certificate");
649  cert = read_file_to_str(fname, 0, NULL);
650  if (!cert) {
651  log_warn(LD_DIR, "Signing key found, but no certificate found in %s",
652  fname);
653  goto done;
654  }
655  parsed = authority_cert_parse_from_string(cert, strlen(cert), &eos);
656  if (!parsed) {
657  log_warn(LD_DIR, "Unable to parse certificate in %s", fname);
658  goto done;
659  }
660  if (!crypto_pk_eq_keys(signing_key, parsed->signing_key)) {
661  log_warn(LD_DIR, "Stored signing key does not match signing key in "
662  "certificate");
663  goto done;
664  }
665 
666  crypto_pk_free(*key_out);
667  authority_cert_free(*cert_out);
668 
669  *key_out = signing_key;
670  *cert_out = parsed;
671  r = 0;
672  signing_key = NULL;
673  parsed = NULL;
674 
675  done:
676  tor_free(fname);
677  tor_free(cert);
678  crypto_pk_free(signing_key);
679  authority_cert_free(parsed);
680  return r;
681 }
682 
686 static int
688 {
691  return -1;
692 
693  if (get_options()->V3AuthUseLegacyKey &&
696  return -1;
697 
698  return 0;
699 }
700 
703 void
705 {
706  time_t now, expires;
707  static time_t last_warned = 0;
708  int badness, time_left, warn_interval;
709  if (!authdir_mode_v3(get_options()) || !authority_key_certificate)
710  return;
711 
712  now = time(NULL);
714  time_left = (int)( expires - now );
715  if (time_left <= 0) {
716  badness = LOG_ERR;
717  warn_interval = 60*60;
718  } else if (time_left <= 24*60*60) {
719  badness = LOG_WARN;
720  warn_interval = 60*60;
721  } else if (time_left <= 24*60*60*7) {
722  badness = LOG_WARN;
723  warn_interval = 24*60*60;
724  } else if (time_left <= 24*60*60*30) {
725  badness = LOG_WARN;
726  warn_interval = 24*60*60*5;
727  } else {
728  return;
729  }
730 
731  if (last_warned + warn_interval > now)
732  return;
733 
734  if (time_left <= 0) {
735  tor_log(badness, LD_DIR, "Your v3 authority certificate has expired."
736  " Generate a new one NOW.");
737  } else if (time_left <= 24*60*60) {
738  tor_log(badness, LD_DIR, "Your v3 authority certificate expires in %d "
739  "hours; Generate a new one NOW.", time_left/(60*60));
740  } else {
741  tor_log(badness, LD_DIR, "Your v3 authority certificate expires in %d "
742  "days; Generate a new one soon.", time_left/(24*60*60));
743  }
744  last_warned = now;
745 }
746 
752 static int
754 {
755  return networkstatus_get_param(NULL,
756  "onion-key-rotation-days",
760 }
761 
766 int
768 {
769  return get_onion_key_rotation_days_()*24*60*60;
770 }
771 
776 int
778 {
779  int grace_period;
780  grace_period = networkstatus_get_param(NULL,
781  "onion-key-grace-period-days",
785  return grace_period*24*60*60;
786 }
787 
790 int
792 {
793  unsigned int flags = 0;
794  const or_options_t *options = get_options();
795  int lifetime = options->SSLKeyLifetime;
796  if (public_server_mode(options))
797  flags |= TOR_TLS_CTX_IS_PUBLIC_SERVER;
798  if (!lifetime) { /* we should guess a good ssl cert lifetime */
799 
800  /* choose between 5 and 365 days, and round to the day */
801  unsigned int five_days = 5*24*3600;
802  unsigned int one_year = 365*24*3600;
803  lifetime = crypto_rand_int_range(five_days, one_year);
804  lifetime -= lifetime % (24*3600);
805 
806  if (crypto_rand_int(2)) {
807  /* Half the time we expire at midnight, and half the time we expire
808  * one second before midnight. (Some CAs wobble their expiry times a
809  * bit in practice, perhaps to reduce collision attacks; see ticket
810  * 8443 for details about observed certs in the wild.) */
811  lifetime--;
812  }
813  }
814 
815  /* It's ok to pass lifetime in as an unsigned int, since
816  * config_parse_interval() checked it. */
817  return tor_tls_context_init(flags,
819  server_mode(options) ?
820  get_server_identity_key() : NULL,
821  (unsigned int)lifetime);
822 }
823 
828 STATIC int
830 {
831  char *keydir = NULL, *cp = NULL;
832  const char *fname = hashed ? "hashed-fingerprint" :
833  "fingerprint";
834  char fingerprint[FINGERPRINT_LEN+1];
835  const or_options_t *options = get_options();
836  char *fingerprint_line = NULL;
837  int result = -1;
838 
839  keydir = get_datadir_fname(fname);
840  log_info(LD_GENERAL,"Dumping %sfingerprint to \"%s\"...",
841  hashed ? "hashed " : "", keydir);
842  if (!hashed) {
843  if (crypto_pk_get_fingerprint(get_server_identity_key(),
844  fingerprint, 0) < 0) {
845  log_err(LD_GENERAL,"Error computing fingerprint");
846  goto done;
847  }
848  } else {
849  if (crypto_pk_get_hashed_fingerprint(get_server_identity_key(),
850  fingerprint) < 0) {
851  log_err(LD_GENERAL,"Error computing hashed fingerprint");
852  goto done;
853  }
854  }
855 
856  tor_asprintf(&fingerprint_line, "%s %s\n", options->Nickname, fingerprint);
857 
858  /* Check whether we need to write the (hashed-)fingerprint file. */
859 
860  cp = read_file_to_str(keydir, RFTS_IGNORE_MISSING, NULL);
861  if (!cp || strcmp(cp, fingerprint_line)) {
862  if (write_str_to_file(keydir, fingerprint_line, 0)) {
863  log_err(LD_FS, "Error writing %sfingerprint line to file",
864  hashed ? "hashed " : "");
865  goto done;
866  }
867  }
868 
869  log_notice(LD_GENERAL, "Your Tor %s identity key fingerprint is '%s %s'",
870  hashed ? "bridge's hashed" : "server's", options->Nickname,
871  fingerprint);
872 
873  result = 0;
874  done:
875  tor_free(cp);
876  tor_free(keydir);
877  tor_free(fingerprint_line);
878  return result;
879 }
880 
881 static int
882 init_keys_common(void)
883 {
884  if (!key_lock)
886 
887  /* There are a couple of paths that put us here before we've asked
888  * openssl to initialize itself. */
889  if (crypto_global_init(get_options()->HardwareAccel,
890  get_options()->AccelName,
891  get_options()->AccelDir)) {
892  log_err(LD_BUG, "Unable to initialize OpenSSL. Exiting.");
893  return -1;
894  }
895 
896  return 0;
897 }
898 
899 int
900 init_keys_client(void)
901 {
902  crypto_pk_t *prkey;
903  if (init_keys_common() < 0)
904  return -1;
905 
906  if (!(prkey = crypto_pk_new()))
907  return -1;
908  if (crypto_pk_generate_key(prkey)) {
909  crypto_pk_free(prkey);
910  return -1;
911  }
913  /* Create a TLS context. */
914  if (router_initialize_tls_context() < 0) {
915  log_err(LD_GENERAL,"Error creating TLS context for Tor client.");
916  return -1;
917  }
918  return 0;
919 }
920 
925 int
927 {
928  char *keydir;
929  const char *mydesc;
930  crypto_pk_t *prkey;
931  char digest[DIGEST_LEN];
932  char v3_digest[DIGEST_LEN];
933  const or_options_t *options = get_options();
934  dirinfo_type_t type;
935  time_t now = time(NULL);
936  dir_server_t *ds;
937  int v3_digest_set = 0;
938  authority_cert_t *cert = NULL;
939 
940  /* OP's don't need persistent keys; just make up an identity and
941  * initialize the TLS context. */
942  if (!server_mode(options)) {
943  return init_keys_client();
944  }
945  if (init_keys_common() < 0)
946  return -1;
947 
948  if (create_keys_directory(options) < 0)
949  return -1;
950 
951  /* 1a. Read v3 directory authority key/cert information. */
952  memset(v3_digest, 0, sizeof(v3_digest));
953  if (authdir_mode_v3(options)) {
954  if (init_v3_authority_keys()<0) {
955  log_err(LD_GENERAL, "We're configured as a V3 authority, but we "
956  "were unable to load our v3 authority keys and certificate! "
957  "Use tor-gencert to generate them. Dying.");
958  return -1;
959  }
960  cert = get_my_v3_authority_cert();
961  if (cert) {
962  if (crypto_pk_get_digest(get_my_v3_authority_cert()->identity_key,
963  v3_digest) < 0) {
964  log_err(LD_BUG, "Couldn't compute my v3 authority identity key "
965  "digest.");
966  return -1;
967  }
968  v3_digest_set = 1;
969  }
970  }
971 
972  /* 1b. Read identity key. Make it if none is found. */
973  keydir = get_keydir_fname("secret_id_key");
974  log_info(LD_GENERAL,"Reading/making identity key \"%s\"...",keydir);
975  bool created = false;
976  prkey = init_key_from_file(keydir, 1, LOG_ERR, &created);
977  tor_free(keydir);
978  if (!prkey) return -1;
979  if (created)
982 
983  /* 1c. If we are configured as a bridge, generate a client key;
984  * otherwise, set the server identity key as our client identity
985  * key. */
986  if (public_server_mode(options)) {
987  set_client_identity_key(crypto_pk_dup_key(prkey)); /* set above */
988  } else {
989  if (!(prkey = crypto_pk_new()))
990  return -1;
991  if (crypto_pk_generate_key(prkey)) {
992  crypto_pk_free(prkey);
993  return -1;
994  }
996  }
997 
998  /* 1d. Load all ed25519 keys */
999  const int new_signing_key = load_ed_keys(options,now);
1000  if (new_signing_key < 0)
1001  return -1;
1002 
1003  /* 2. Read onion key. Make it if none is found. */
1004  keydir = get_keydir_fname("secret_onion_key");
1005  log_info(LD_GENERAL,"Reading/making onion key \"%s\"...",keydir);
1006  prkey = init_key_from_file(keydir, 1, LOG_ERR, &created);
1007  if (created)
1009  tor_free(keydir);
1010  if (!prkey) return -1;
1011  set_onion_key(prkey);
1012  if (options->command == CMD_RUN_TOR) {
1013  /* only mess with the state file if we're actually running Tor */
1014  or_state_t *state = get_or_state();
1015  if (state->LastRotatedOnionKey > 100 && state->LastRotatedOnionKey < now) {
1016  /* We allow for some parsing slop, but we don't want to risk accepting
1017  * values in the distant future. If we did, we might never rotate the
1018  * onion key. */
1020  } else {
1021  /* We have no LastRotatedOnionKey set; either we just created the key
1022  * or it's a holdover from 0.1.2.4-alpha-dev or earlier. In either case,
1023  * start the clock ticking now so that we will eventually rotate it even
1024  * if we don't stay up for the full lifetime of an onion key. */
1025  state->LastRotatedOnionKey = onionkey_set_at = now;
1026  or_state_mark_dirty(state, options->AvoidDiskWrites ?
1027  time(NULL)+3600 : 0);
1028  }
1029  }
1030 
1031  keydir = get_keydir_fname("secret_onion_key.old");
1032  if (!lastonionkey && file_status(keydir) == FN_FILE) {
1033  /* Load keys from non-empty files only.
1034  * Missing old keys won't be replaced with freshly generated keys. */
1035  prkey = init_key_from_file(keydir, 0, LOG_ERR, 0);
1036  if (prkey)
1037  lastonionkey = prkey;
1038  }
1039  tor_free(keydir);
1040 
1041  {
1042  /* 2b. Load curve25519 onion keys. */
1043  int r;
1044  keydir = get_keydir_fname("secret_onion_key_ntor");
1046  keydir, 1, LOG_ERR, "onion");
1047  tor_free(keydir);
1048  if (r<0)
1049  return -1;
1050 
1051  keydir = get_keydir_fname("secret_onion_key_ntor.old");
1052  if (fast_mem_is_zero((const char *)
1053  last_curve25519_onion_key.pubkey.public_key,
1055  file_status(keydir) == FN_FILE) {
1056  /* Load keys from non-empty files only.
1057  * Missing old keys won't be replaced with freshly generated keys. */
1059  keydir, 0, LOG_ERR, "onion");
1060  }
1061  tor_free(keydir);
1062  }
1063 
1064  /* 3. Initialize link key and TLS context. */
1065  if (router_initialize_tls_context() < 0) {
1066  log_err(LD_GENERAL,"Error initializing TLS context");
1067  return -1;
1068  }
1069 
1070  /* 3b. Get an ed25519 link certificate. Note that we need to do this
1071  * after we set up the TLS context */
1072  if (generate_ed_link_cert(options, now, new_signing_key > 0) < 0) {
1073  log_err(LD_GENERAL,"Couldn't make link cert");
1074  return -1;
1075  }
1076 
1077  /* 4. Build our router descriptor. */
1078  /* Must be called after keys are initialized. */
1079  mydesc = router_get_my_descriptor();
1080  if (authdir_mode_v3(options)) {
1081  const char *m = NULL;
1082  routerinfo_t *ri;
1083  /* We need to add our own fingerprint so it gets recognized. */
1084  if (dirserv_add_own_fingerprint(get_server_identity_key())) {
1085  log_err(LD_GENERAL,"Error adding own fingerprint to set of relays");
1086  return -1;
1087  }
1088  if (mydesc) {
1089  was_router_added_t added;
1090  ri = router_parse_entry_from_string(mydesc, NULL, 1, 0, NULL, NULL);
1091  if (!ri) {
1092  log_err(LD_GENERAL,"Generated a routerinfo we couldn't parse.");
1093  return -1;
1094  }
1095  added = dirserv_add_descriptor(ri, &m, "self");
1096  if (!WRA_WAS_ADDED(added)) {
1097  if (!WRA_WAS_OUTDATED(added)) {
1098  log_err(LD_GENERAL, "Unable to add own descriptor to directory: %s",
1099  m?m:"<unknown error>");
1100  return -1;
1101  } else {
1102  /* If the descriptor was outdated, that's ok. This can happen
1103  * when some config options are toggled that affect workers, but
1104  * we don't really need new keys yet so the descriptor doesn't
1105  * change and the old one is still fresh. */
1106  log_info(LD_GENERAL, "Couldn't add own descriptor to directory "
1107  "after key init: %s This is usually not a problem.",
1108  m?m:"<unknown error>");
1109  }
1110  }
1111  }
1112  }
1113 
1114  /* 5. Dump fingerprint and possibly hashed fingerprint to files. */
1115  if (router_write_fingerprint(0)) {
1116  log_err(LD_FS, "Error writing fingerprint to file");
1117  return -1;
1118  }
1119  if (!public_server_mode(options) && router_write_fingerprint(1)) {
1120  log_err(LD_FS, "Error writing hashed fingerprint to file");
1121  return -1;
1122  }
1123 
1124  if (!authdir_mode(options))
1125  return 0;
1126  /* 6. [authdirserver only] load approved-routers file */
1127  if (dirserv_load_fingerprint_file() < 0) {
1128  log_err(LD_GENERAL,"Error loading fingerprints");
1129  return -1;
1130  }
1131  /* 6b. [authdirserver only] add own key to approved directories. */
1132  crypto_pk_get_digest(get_server_identity_key(), digest);
1133  type = ((options->V3AuthoritativeDir ?
1135  (options->BridgeAuthoritativeDir ? BRIDGE_DIRINFO : NO_DIRINFO));
1136 
1138  if (!ds) {
1139  ds = trusted_dir_server_new(options->Nickname, NULL,
1140  router_get_advertised_dir_port(options, 0),
1142  NULL,
1143  digest,
1144  v3_digest,
1145  type, 0.0);
1146  if (!ds) {
1147  log_err(LD_GENERAL,"We want to be a directory authority, but we "
1148  "couldn't add ourselves to the authority list. Failing.");
1149  return -1;
1150  }
1151  dir_server_add(ds);
1152  }
1153  if (ds->type != type) {
1154  log_warn(LD_DIR, "Configured authority type does not match authority "
1155  "type in DirAuthority list. Adjusting. (%d v %d)",
1156  type, ds->type);
1157  ds->type = type;
1158  }
1159  if (v3_digest_set && (ds->type & V3_DIRINFO) &&
1160  tor_memneq(v3_digest, ds->v3_identity_digest, DIGEST_LEN)) {
1161  log_warn(LD_DIR, "V3 identity key does not match identity declared in "
1162  "DirAuthority line. Adjusting.");
1163  memcpy(ds->v3_identity_digest, v3_digest, DIGEST_LEN);
1164  }
1165 
1166  if (cert) { /* add my own cert to the list of known certs */
1167  log_info(LD_DIR, "adding my own v3 cert");
1170  TRUSTED_DIRS_CERTS_SRC_SELF, 0,
1171  NULL)<0) {
1172  log_warn(LD_DIR, "Unable to parse my own v3 cert! Failing.");
1173  return -1;
1174  }
1175  }
1176 
1177  return 0; /* success */
1178 }
1179 
1182 /* XXX Should this be increased? */
1183 #define MIN_BW_TO_ADVERTISE_DIRSERVER 51200
1184 
1188 int
1190 {
1192  return 0;
1193  }
1194  if (options->RelayBandwidthRate > 0 &&
1196  return 0;
1197  }
1198  return 1;
1199 }
1200 
1208 static int
1209 router_should_be_dirserver(const or_options_t *options, int dir_port)
1210 {
1211  static int advertising=1; /* start out assuming we will advertise */
1212  int new_choice=1;
1213  const char *reason = NULL;
1214 
1215  if (accounting_is_enabled(options) &&
1216  get_options()->AccountingRule != ACCT_IN) {
1217  /* Don't spend bytes for directory traffic if we could end up hibernating,
1218  * but allow DirPort otherwise. Some relay operators set AccountingMax
1219  * because they're confused or to get statistics. Directory traffic has a
1220  * much larger effect on output than input so there is no reason to turn it
1221  * off if using AccountingRule in. */
1222  int interval_length = accounting_get_interval_length();
1223  uint32_t effective_bw = get_effective_bwrate(options);
1224  uint64_t acc_bytes;
1225  if (!interval_length) {
1226  log_warn(LD_BUG, "An accounting interval is not allowed to be zero "
1227  "seconds long. Raising to 1.");
1228  interval_length = 1;
1229  }
1230  log_info(LD_GENERAL, "Calculating whether to advertise %s: effective "
1231  "bwrate: %u, AccountingMax: %"PRIu64", "
1232  "accounting interval length %d",
1233  dir_port ? "dirport" : "begindir",
1234  effective_bw, (options->AccountingMax),
1235  interval_length);
1236 
1237  acc_bytes = options->AccountingMax;
1238  if (get_options()->AccountingRule == ACCT_SUM)
1239  acc_bytes /= 2;
1240  if (effective_bw >=
1241  acc_bytes / interval_length) {
1242  new_choice = 0;
1243  reason = "AccountingMax enabled";
1244  }
1245  } else if (! router_has_bandwidth_to_be_dirserver(options)) {
1246  /* if we're advertising a small amount */
1247  new_choice = 0;
1248  reason = "BandwidthRate under 50KB";
1249  }
1250 
1251  if (advertising != new_choice) {
1252  if (new_choice == 1) {
1253  if (dir_port > 0)
1254  log_notice(LD_DIR, "Advertising DirPort as %d", dir_port);
1255  else
1256  log_notice(LD_DIR, "Advertising directory service support");
1257  } else {
1258  tor_assert(reason);
1259  log_notice(LD_DIR, "Not advertising Dir%s (Reason: %s)",
1260  dir_port ? "Port" : "ectory Service support", reason);
1261  }
1262  advertising = new_choice;
1263  }
1264 
1265  return advertising;
1266 }
1267 
1277 static int
1279  uint16_t dir_port,
1280  int supports_tunnelled_dir_requests)
1281 {
1282  /* Part one: reasons to publish or not publish that aren't
1283  * worth mentioning to the user, either because they're obvious
1284  * or because they're normal behavior. */
1285 
1286  /* short circuit the rest of the function */
1287  if (!dir_port && !supports_tunnelled_dir_requests)
1288  return 0;
1289  if (authdir_mode(options)) /* always publish */
1290  return 1;
1291  if (net_is_disabled())
1292  return 0;
1293  if (dir_port && !router_get_advertised_dir_port(options, dir_port))
1294  return 0;
1295  if (supports_tunnelled_dir_requests &&
1297  return 0;
1298 
1299  /* Part two: consider config options that could make us choose to
1300  * publish or not publish that the user might find surprising. */
1301  return router_should_be_dirserver(options, dir_port);
1302 }
1303 
1308 int
1309 router_should_advertise_dirport(const or_options_t *options, uint16_t dir_port)
1310 {
1311  /* supports_tunnelled_dir_requests is not relevant, pass 0 */
1312  return decide_to_advertise_dir_impl(options, dir_port, 0) ? dir_port : 0;
1313 }
1314 
1318 static int
1320  int supports_tunnelled_dir_requests)
1321 {
1322  /* dir_port is not relevant, pass 0 */
1323  return decide_to_advertise_dir_impl(options, 0,
1324  supports_tunnelled_dir_requests);
1325 }
1326 
1330 int
1332 {
1333  if (options->RefuseUnknownExits != -1) {
1334  return options->RefuseUnknownExits;
1335  } else {
1336  return networkstatus_get_param(NULL, "refuseunknownexits", 1, 0, 1);
1337  }
1338 }
1339 
1353 static int
1355 {
1356  const or_options_t *options = get_options();
1357 
1358  if (options->ClientOnly)
1359  return 0;
1360  if (options->PublishServerDescriptor_ == NO_DIRINFO)
1361  return 0;
1362  if (!server_mode(options))
1363  return 0;
1364  if (authdir_mode(options))
1365  return 1;
1366  if (!router_get_advertised_or_port(options))
1367  return 0;
1368  if (!check_whether_orport_reachable(options))
1369  return 0;
1370  if (router_have_consensus_path() == CONSENSUS_PATH_INTERNAL) {
1371  /* All set: there are no exits in the consensus (maybe this is a tiny
1372  * test network), so we can't check our DirPort reachability. */
1373  return 1;
1374  } else {
1375  return check_whether_dirport_reachable(options);
1376  }
1377 }
1378 
1386 void
1388 {
1389  int rebuilt;
1390 
1391  if (!server_mode(get_options()))
1392  return;
1393 
1394  rebuilt = router_rebuild_descriptor(0);
1397  if (rebuilt == 0)
1399  } else {
1401  }
1402 }
1403 
1408 uint16_t
1410  sa_family_t family)
1411 {
1412  /* Iterate all connections, find one of the right kind and return
1413  the port. Not very sophisticated or fast, but effective. */
1414  smartlist_t *conns = get_connection_array();
1415  SMARTLIST_FOREACH_BEGIN(conns, connection_t *, conn) {
1416  if (conn->type == listener_type && !conn->marked_for_close &&
1417  conn->socket_family == family) {
1418  return conn->port;
1419  }
1420  } SMARTLIST_FOREACH_END(conn);
1421 
1422  return 0;
1423 }
1424 
1429 uint16_t
1431 {
1432  return router_get_advertised_or_port_by_af(options, AF_INET);
1433 }
1434 
1437 uint16_t
1439  sa_family_t family)
1440 {
1442  family);
1443  (void)options;
1444 
1445  /* If the port is in 'auto' mode, we have to use
1446  router_get_listener_port_by_type(). */
1447  if (port == CFG_AUTO_PORT)
1449  family);
1450 
1451  return port;
1452 }
1453 
1459 uint16_t
1460 router_get_advertised_dir_port(const or_options_t *options, uint16_t dirport)
1461 {
1462  int dirport_configured = get_primary_dir_port();
1463  (void)options;
1464 
1465  if (!dirport_configured)
1466  return dirport;
1467 
1468  if (dirport_configured == CFG_AUTO_PORT)
1470  AF_INET);
1471 
1472  return dirport_configured;
1473 }
1474 
1475 /*
1476  * OR descriptor generation.
1477  */
1478 
1485 static const char *desc_gen_reason = "uninitialized reason";
1488 STATIC time_t desc_clean_since = 0;
1490 STATIC const char *desc_dirty_reason = "Tor just started";
1492 static int desc_needs_upload = 0;
1493 
1498 void
1500 {
1501  const routerinfo_t *ri;
1502  extrainfo_t *ei;
1503  char *msg;
1504  size_t desc_len, extra_len = 0, total_len;
1505  dirinfo_type_t auth = get_options()->PublishServerDescriptor_;
1506 
1507  ri = router_get_my_routerinfo();
1508  if (!ri) {
1509  log_info(LD_GENERAL, "No descriptor; skipping upload");
1510  return;
1511  }
1512  ei = router_get_my_extrainfo();
1513  if (auth == NO_DIRINFO)
1514  return;
1515  if (!force && !desc_needs_upload)
1516  return;
1517 
1518  log_info(LD_OR, "Uploading relay descriptor to directory authorities%s",
1519  force ? " (forced)" : "");
1520 
1521  desc_needs_upload = 0;
1522 
1523  desc_len = ri->cache_info.signed_descriptor_len;
1524  extra_len = ei ? ei->cache_info.signed_descriptor_len : 0;
1525  total_len = desc_len + extra_len + 1;
1526  msg = tor_malloc(total_len);
1527  memcpy(msg, ri->cache_info.signed_descriptor_body, desc_len);
1528  if (ei) {
1529  memcpy(msg+desc_len, ei->cache_info.signed_descriptor_body, extra_len);
1530  }
1531  msg[desc_len+extra_len] = 0;
1532 
1534  (auth & BRIDGE_DIRINFO) ?
1535  ROUTER_PURPOSE_BRIDGE :
1536  ROUTER_PURPOSE_GENERAL,
1537  auth, msg, desc_len, extra_len);
1538  tor_free(msg);
1539 }
1540 
1544 int
1546 {
1547  const routerinfo_t *me = router_get_my_routerinfo();
1548  if (!me) /* make sure routerinfo exists */
1549  return -1;
1550 
1551  /* make sure it's resolved to something. this way we can't get a
1552  'maybe' below. */
1553  if (tor_addr_is_null(addr))
1554  return -1;
1555 
1556  /* look at router_get_my_routerinfo()->exit_policy for both the v4 and the
1557  * v6 policies. The exit_policy field in router_get_my_routerinfo() is a
1558  * bit unusual, in that it contains IPv6 and IPv6 entries. We don't want to
1559  * look at router_get_my_routerinfo()->ipv6_exit_policy, since that's a port
1560  * summary. */
1561  if ((tor_addr_family(addr) == AF_INET ||
1562  tor_addr_family(addr) == AF_INET6)) {
1563  return compare_tor_addr_to_addr_policy(addr, port,
1565 #if 0
1566  } else if (tor_addr_family(addr) == AF_INET6) {
1567  return get_options()->IPv6Exit &&
1571 #endif /* 0 */
1572  } else {
1573  return -1;
1574  }
1575 }
1576 
1580 router_my_exit_policy_is_reject_star,(void))
1581 {
1582  const routerinfo_t *me = router_get_my_routerinfo();
1583  if (!me) /* make sure routerinfo exists */
1584  return -1;
1585 
1586  return me->policy_is_reject_star;
1587 }
1588 
1591 int
1592 router_digest_is_me(const char *digest)
1593 {
1594  return (server_identitykey &&
1596 }
1597 
1599 const uint8_t *
1601 {
1602  return (const uint8_t *)server_identitykey_digest;
1603 }
1604 
1607 int
1609 {
1611  if (!ei)
1612  return 0;
1613 
1614  return tor_memeq(digest,
1615  ei->cache_info.signed_descriptor_digest,
1616  DIGEST_LEN);
1617 }
1618 
1620 int
1622 {
1623  return router_digest_is_me(router->cache_info.identity_digest);
1624 }
1625 
1629 router_get_my_routerinfo,(void))
1630 {
1631  return router_get_my_routerinfo_with_err(NULL);
1632 }
1633 
1639 router_get_my_routerinfo_with_err,(int *err))
1640 {
1641  if (!server_mode(get_options())) {
1642  if (err)
1643  *err = TOR_ROUTERINFO_ERROR_NOT_A_SERVER;
1644 
1645  return NULL;
1646  }
1647 
1648  if (!desc_clean_since) {
1649  int rebuild_err = router_rebuild_descriptor(0);
1650  if (rebuild_err < 0) {
1651  if (err)
1652  *err = rebuild_err;
1653 
1654  return NULL;
1655  }
1656  }
1657 
1658  if (!desc_routerinfo) {
1659  if (err)
1660  *err = TOR_ROUTERINFO_ERROR_DESC_REBUILDING;
1661 
1662  return NULL;
1663  }
1664 
1665  if (err)
1666  *err = 0;
1667 
1668  return desc_routerinfo;
1669 }
1670 
1674 const char *
1676 {
1677  const char *body;
1678  const routerinfo_t *me = router_get_my_routerinfo();
1679  if (! me)
1680  return NULL;
1681  tor_assert(me->cache_info.saved_location == SAVED_NOWHERE);
1682  body = signed_descriptor_get_body(&me->cache_info);
1683  /* Make sure this is nul-terminated. */
1684  tor_assert(!body[me->cache_info.signed_descriptor_len]);
1685  log_debug(LD_GENERAL,"my desc is '%s'", body);
1686  return body;
1687 }
1688 
1691 extrainfo_t *
1693 {
1694  if (!server_mode(get_options()))
1695  return NULL;
1697  return NULL;
1698  return desc_extrainfo;
1699 }
1700 
1703 const char *
1705 {
1706  return desc_gen_reason;
1707 }
1708 
1709 static int router_guess_address_from_dir_headers(uint32_t *guess);
1710 
1720 router_pick_published_address,(const or_options_t *options, uint32_t *addr,
1721  int cache_only))
1722 {
1723  /* First, check the cached output from resolve_my_address(). */
1724  *addr = get_last_resolved_addr();
1725  if (*addr)
1726  return 0;
1727 
1728  /* Second, consider doing a resolve attempt right here. */
1729  if (!cache_only) {
1730  if (resolve_my_address(LOG_INFO, options, addr, NULL, NULL) >= 0) {
1731  log_info(LD_CONFIG,"Success: chose address '%s'.", fmt_addr32(*addr));
1732  return 0;
1733  }
1734  }
1735 
1736  /* Third, check the cached output from router_new_address_suggestion(). */
1738  return 0;
1739 
1740  /* We have no useful cached answers. Return failure. */
1741  return -1;
1742 }
1743 
1744 /* Like router_check_descriptor_address_consistency, but specifically for the
1745  * ORPort or DirPort.
1746  * listener_type is either CONN_TYPE_OR_LISTENER or CONN_TYPE_DIR_LISTENER. */
1747 static void
1748 router_check_descriptor_address_port_consistency(uint32_t ipv4h_desc_addr,
1749  int listener_type)
1750 {
1751  tor_assert(listener_type == CONN_TYPE_OR_LISTENER ||
1752  listener_type == CONN_TYPE_DIR_LISTENER);
1753 
1754  /* The first advertised Port may be the magic constant CFG_AUTO_PORT.
1755  */
1756  int port_v4_cfg = get_first_advertised_port_by_type_af(listener_type,
1757  AF_INET);
1758  if (port_v4_cfg != 0 &&
1759  !port_exists_by_type_addr32h_port(listener_type,
1760  ipv4h_desc_addr, port_v4_cfg, 1)) {
1762  listener_type,
1763  AF_INET);
1764  /* If we're building a descriptor with no advertised address,
1765  * something is terribly wrong. */
1766  tor_assert(port_addr);
1767 
1768  tor_addr_t desc_addr;
1769  char port_addr_str[TOR_ADDR_BUF_LEN];
1770  char desc_addr_str[TOR_ADDR_BUF_LEN];
1771 
1772  tor_addr_to_str(port_addr_str, port_addr, TOR_ADDR_BUF_LEN, 0);
1773 
1774  tor_addr_from_ipv4h(&desc_addr, ipv4h_desc_addr);
1775  tor_addr_to_str(desc_addr_str, &desc_addr, TOR_ADDR_BUF_LEN, 0);
1776 
1777  const char *listener_str = (listener_type == CONN_TYPE_OR_LISTENER ?
1778  "OR" : "Dir");
1779  log_warn(LD_CONFIG, "The IPv4 %sPort address %s does not match the "
1780  "descriptor address %s. If you have a static public IPv4 "
1781  "address, use 'Address <IPv4>' and 'OutboundBindAddress "
1782  "<IPv4>'. If you are behind a NAT, use two %sPort lines: "
1783  "'%sPort <PublicPort> NoListen' and '%sPort <InternalPort> "
1784  "NoAdvertise'.",
1785  listener_str, port_addr_str, desc_addr_str, listener_str,
1786  listener_str, listener_str);
1787  }
1788 }
1789 
1790 /* Tor relays only have one IPv4 address in the descriptor, which is derived
1791  * from the Address torrc option, or guessed using various methods in
1792  * router_pick_published_address().
1793  * Warn the operator if there is no ORPort on the descriptor address
1794  * ipv4h_desc_addr.
1795  * Warn the operator if there is no DirPort on the descriptor address.
1796  * This catches a few common config errors:
1797  * - operators who expect ORPorts and DirPorts to be advertised on the
1798  * ports' listen addresses, rather than the torrc Address (or guessed
1799  * addresses in the absence of an Address config). This includes
1800  * operators who attempt to put their ORPort and DirPort on different
1801  * addresses;
1802  * - discrepancies between guessed addresses and configured listen
1803  * addresses (when the Address option isn't set).
1804  * If a listener is listening on all IPv4 addresses, it is assumed that it
1805  * is listening on the configured Address, and no messages are logged.
1806  * If an operators has specified NoAdvertise ORPorts in a NAT setting,
1807  * no messages are logged, unless they have specified other advertised
1808  * addresses.
1809  * The message tells operators to configure an ORPort and DirPort that match
1810  * the Address (using NoListen if needed).
1811  */
1812 static void
1813 router_check_descriptor_address_consistency(uint32_t ipv4h_desc_addr)
1814 {
1815  router_check_descriptor_address_port_consistency(ipv4h_desc_addr,
1817  router_check_descriptor_address_port_consistency(ipv4h_desc_addr,
1819 }
1820 
1824 
1830 STATIC smartlist_t *
1832 {
1833  if (!options->MyFamily)
1834  return NULL;
1835 
1836  if (options->BridgeRelay)
1837  return NULL;
1838 
1839  if (!warned_family)
1840  warned_family = smartlist_new();
1841 
1842  smartlist_t *declared_family = smartlist_new();
1843  config_line_t *family;
1844 
1845  /* First we try to get the whole family in the form of hexdigests. */
1846  for (family = options->MyFamily; family; family = family->next) {
1847  char *name = family->value;
1848  const node_t *member;
1849  if (options->Nickname && !strcasecmp(name, options->Nickname))
1850  continue; /* Don't list ourself by nickname, that's redundant */
1851  else
1852  member = node_get_by_nickname(name, 0);
1853 
1854  if (!member) {
1855  /* This node doesn't seem to exist, so warn about it if it is not
1856  * a hexdigest. */
1857  int is_legal = is_legal_nickname_or_hexdigest(name);
1859  !is_legal_hexdigest(name)) {
1860  if (is_legal)
1861  log_warn(LD_CONFIG,
1862  "There is a router named %s in my declared family, but "
1863  "I have no descriptor for it. I'll use the nickname "
1864  "as is, but this may confuse clients. Please list it "
1865  "by identity digest instead.", escaped(name));
1866  else
1867  log_warn(LD_CONFIG, "There is a router named %s in my declared "
1868  "family, but that isn't a legal digest or nickname. "
1869  "Skipping it.", escaped(name));
1871  }
1872  if (is_legal) {
1873  smartlist_add_strdup(declared_family, name);
1874  }
1875  } else {
1876  /* List the node by digest. */
1877  char *fp = tor_malloc(HEX_DIGEST_LEN+2);
1878  fp[0] = '$';
1880  member->identity, DIGEST_LEN);
1881  smartlist_add(declared_family, fp);
1882 
1883  if (! is_legal_hexdigest(name) &&
1885  /* Warn if this node was not specified by hexdigest. */
1886  log_warn(LD_CONFIG, "There is a router named %s in my declared "
1887  "family, but it wasn't listed by digest. Please consider "
1888  "saying %s instead, if that's what you meant.",
1889  escaped(name), fp);
1891  }
1892  }
1893  }
1894 
1895  /* Now declared_family should have the closest we can come to the
1896  * identities that the user wanted.
1897  *
1898  * Unlike older versions of Tor, we _do_ include our own identity: this
1899  * helps microdescriptor compression, and helps in-memory compression
1900  * on clients. */
1901  nodefamily_t *nf = nodefamily_from_members(declared_family,
1903  NF_WARN_MALFORMED,
1904  NULL);
1905  SMARTLIST_FOREACH(declared_family, char *, s, tor_free(s));
1906  smartlist_free(declared_family);
1907  if (!nf) {
1908  return NULL;
1909  }
1910 
1911  char *s = nodefamily_format(nf);
1912  nodefamily_free(nf);
1913 
1914  smartlist_t *result = smartlist_new();
1915  smartlist_split_string(result, s, NULL,
1916  SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0);
1917  tor_free(s);
1918 
1919  if (smartlist_len(result) == 1) {
1920  /* This is a one-element list containing only ourself; instead return
1921  * nothing */
1922  const char *singleton = smartlist_get(result, 0);
1923  bool is_me = false;
1924  if (singleton[0] == '$') {
1925  char d[DIGEST_LEN];
1926  int n = base16_decode(d, sizeof(d), singleton+1, strlen(singleton+1));
1927  if (n == DIGEST_LEN &&
1928  fast_memeq(d, router_get_my_id_digest(), DIGEST_LEN)) {
1929  is_me = true;
1930  }
1931  }
1932  if (!is_me) {
1933  // LCOV_EXCL_START
1934  log_warn(LD_BUG, "Found a singleton family list with an element "
1935  "that wasn't us! Element was %s", escaped(singleton));
1936  // LCOV_EXCL_STOP
1937  } else {
1938  SMARTLIST_FOREACH(result, char *, cp, tor_free(cp));
1939  smartlist_free(result);
1940  return NULL;
1941  }
1942  }
1943 
1944  return result;
1945 }
1946 
1955 MOCK_IMPL(STATIC int,
1956 router_build_fresh_unsigned_routerinfo,(routerinfo_t **ri_out))
1957 {
1958  routerinfo_t *ri = NULL;
1959  uint32_t addr;
1960  char platform[256];
1961  int hibernating = we_are_hibernating();
1962  const or_options_t *options = get_options();
1963  int result = TOR_ROUTERINFO_ERROR_INTERNAL_BUG;
1964 
1965  if (BUG(!ri_out)) {
1966  result = TOR_ROUTERINFO_ERROR_INTERNAL_BUG;
1967  goto err;
1968  }
1969 
1970  if (router_pick_published_address(options, &addr, 0) < 0) {
1971  log_warn(LD_CONFIG, "Don't know my address while generating descriptor");
1972  result = TOR_ROUTERINFO_ERROR_NO_EXT_ADDR;
1973  goto err;
1974  }
1975 
1976  /* Log a message if the address in the descriptor doesn't match the ORPort
1977  * and DirPort addresses configured by the operator. */
1978  router_check_descriptor_address_consistency(addr);
1979 
1980  ri = tor_malloc_zero(sizeof(routerinfo_t));
1981  ri->cache_info.routerlist_index = -1;
1982  ri->nickname = tor_strdup(options->Nickname);
1983  ri->addr = addr;
1984  ri->or_port = router_get_advertised_or_port(options);
1985  ri->dir_port = router_get_advertised_dir_port(options, 0);
1988  ri->cache_info.published_on = time(NULL);
1989  /* get_onion_key() must invoke from main thread */
1990  router_set_rsa_onion_pkey(get_onion_key(), &ri->onion_pkey,
1991  &ri->onion_pkey_len);
1992 
1993  ri->onion_curve25519_pkey =
1994  tor_memdup(&get_current_curve25519_keypair()->pubkey,
1995  sizeof(curve25519_public_key_t));
1996 
1997  /* For now, at most one IPv6 or-address is being advertised. */
1998  {
1999  const port_cfg_t *ipv6_orport = NULL;
2000  SMARTLIST_FOREACH_BEGIN(get_configured_ports(), const port_cfg_t *, p) {
2001  if (p->type == CONN_TYPE_OR_LISTENER &&
2002  ! p->server_cfg.no_advertise &&
2003  ! p->server_cfg.bind_ipv4_only &&
2004  tor_addr_family(&p->addr) == AF_INET6) {
2005  /* Like IPv4, if the relay is configured using the default
2006  * authorities, disallow internal IPs. Otherwise, allow them. */
2007  const int default_auth = using_default_dir_authorities(options);
2008  if (! tor_addr_is_internal(&p->addr, 0) || ! default_auth) {
2009  ipv6_orport = p;
2010  break;
2011  } else {
2012  char addrbuf[TOR_ADDR_BUF_LEN];
2013  log_warn(LD_CONFIG,
2014  "Unable to use configured IPv6 address \"%s\" in a "
2015  "descriptor. Skipping it. "
2016  "Try specifying a globally reachable address explicitly.",
2017  tor_addr_to_str(addrbuf, &p->addr, sizeof(addrbuf), 1));
2018  }
2019  }
2020  } SMARTLIST_FOREACH_END(p);
2021  if (ipv6_orport) {
2022  tor_addr_copy(&ri->ipv6_addr, &ipv6_orport->addr);
2023  ri->ipv6_orport = ipv6_orport->port;
2024  }
2025  }
2026 
2027  ri->identity_pkey = crypto_pk_dup_key(get_server_identity_key());
2028  if (BUG(crypto_pk_get_digest(ri->identity_pkey,
2029  ri->cache_info.identity_digest) < 0)) {
2030  result = TOR_ROUTERINFO_ERROR_DIGEST_FAILED;
2031  goto err;
2032  }
2033  ri->cache_info.signing_key_cert =
2034  tor_cert_dup(get_master_signing_key_cert());
2035 
2036  get_platform_str(platform, sizeof(platform));
2037  ri->platform = tor_strdup(platform);
2038 
2039  ri->protocol_list = tor_strdup(protover_get_supported_protocols());
2040 
2041  /* compute ri->bandwidthrate as the min of various options */
2042  ri->bandwidthrate = get_effective_bwrate(options);
2043 
2044  /* and compute ri->bandwidthburst similarly */
2045  ri->bandwidthburst = get_effective_bwburst(options);
2046 
2047  /* Report bandwidth, unless we're hibernating or shutting down */
2048  ri->bandwidthcapacity = hibernating ? 0 : rep_hist_bandwidth_assess();
2049 
2051  /* DNS is screwed up; don't claim to be an exit. */
2053  } else {
2055  &ri->exit_policy);
2056  }
2057  ri->policy_is_reject_star =
2058  policy_is_reject_star(ri->exit_policy, AF_INET, 1) &&
2059  policy_is_reject_star(ri->exit_policy, AF_INET6, 1);
2060 
2061  if (options->IPv6Exit) {
2062  char *p_tmp = policy_summarize(ri->exit_policy, AF_INET6);
2063  if (p_tmp)
2064  ri->ipv6_exit_policy = parse_short_policy(p_tmp);
2065  tor_free(p_tmp);
2066  }
2067 
2068  ri->declared_family = get_my_declared_family(options);
2069 
2070  if (options->BridgeRelay) {
2071  ri->purpose = ROUTER_PURPOSE_BRIDGE;
2072  /* Bridges shouldn't be able to send their descriptors unencrypted,
2073  anyway, since they don't have a DirPort, and always connect to the
2074  bridge authority anonymously. But just in case they somehow think of
2075  sending them on an unencrypted connection, don't allow them to try. */
2076  ri->cache_info.send_unencrypted = 0;
2077  } else {
2078  ri->purpose = ROUTER_PURPOSE_GENERAL;
2079  ri->cache_info.send_unencrypted = 1;
2080  }
2081 
2082  goto done;
2083 
2084  err:
2085  routerinfo_free(ri);
2086  *ri_out = NULL;
2087  return result;
2088 
2089  done:
2090  *ri_out = ri;
2091  return 0;
2092 }
2093 
2103 static extrainfo_t *
2105 {
2106  extrainfo_t *ei = NULL;
2107  const or_options_t *options = get_options();
2108 
2109  if (BUG(!ri))
2110  return NULL;
2111 
2112  /* Now generate the extrainfo. */
2113  ei = tor_malloc_zero(sizeof(extrainfo_t));
2114  ei->cache_info.is_extrainfo = 1;
2115  strlcpy(ei->nickname, options->Nickname, sizeof(ei->nickname));
2116  ei->cache_info.published_on = ri->cache_info.published_on;
2117  ei->cache_info.signing_key_cert =
2118  tor_cert_dup(get_master_signing_key_cert());
2119 
2120  memcpy(ei->cache_info.identity_digest, ri->cache_info.identity_digest,
2121  DIGEST_LEN);
2122 
2123  if (options->BridgeRelay) {
2124  /* See note in router_build_fresh_routerinfo(). */
2125  ei->cache_info.send_unencrypted = 0;
2126  } else {
2127  ei->cache_info.send_unencrypted = 1;
2128  }
2129 
2130  return ei;
2131 }
2132 
2142 static int
2144 {
2145  if (BUG(!ei))
2146  return -1;
2147 
2149  ei, get_server_identity_key(),
2150  get_master_signing_keypair()) < 0) {
2151  log_warn(LD_BUG, "Couldn't generate extra-info descriptor.");
2152  return -1;
2153  }
2154 
2155  ei->cache_info.signed_descriptor_len =
2156  strlen(ei->cache_info.signed_descriptor_body);
2157 
2159  ei->cache_info.signed_descriptor_len,
2160  ei->cache_info.signed_descriptor_digest);
2161  crypto_digest256((char*) ei->digest256,
2162  ei->cache_info.signed_descriptor_body,
2163  ei->cache_info.signed_descriptor_len,
2164  DIGEST_SHA256);
2165 
2166  return 0;
2167 }
2168 
2175 STATIC extrainfo_t *
2177 {
2178  int result = -1;
2179  extrainfo_t *ei = NULL;
2180 
2181  if (BUG(!ri))
2182  return NULL;
2183 
2185  /* router_build_fresh_unsigned_extrainfo() should not fail. */
2186  if (BUG(!ei))
2187  goto err;
2188 
2190  if (result < 0)
2191  goto err;
2192 
2193  goto done;
2194 
2195  err:
2196  extrainfo_free(ei);
2197  return NULL;
2198 
2199  done:
2200  return ei;
2201 }
2202 
2207 STATIC void
2209  const extrainfo_t *ei)
2210 {
2211  if (BUG(!ei)) {
2212  /* Just to be safe, zero ri->cache_info.extra_info_digest here. */
2213  memset(ri->cache_info.extra_info_digest, 0, DIGEST_LEN);
2214  memset(ri->cache_info.extra_info_digest256, 0, DIGEST256_LEN);
2215  return;
2216  }
2217 
2218  /* Now finish the router descriptor. */
2219  memcpy(ri->cache_info.extra_info_digest,
2220  ei->cache_info.signed_descriptor_digest,
2221  DIGEST_LEN);
2222  memcpy(ri->cache_info.extra_info_digest256,
2223  ei->digest256,
2224  DIGEST256_LEN);
2225 }
2226 
2235 STATIC int
2237 {
2238  if (BUG(!ri))
2239  return TOR_ROUTERINFO_ERROR_INTERNAL_BUG;
2240 
2241  if (! (ri->cache_info.signed_descriptor_body =
2242  router_dump_router_to_string(ri, get_server_identity_key(),
2243  get_onion_key(),
2244  get_current_curve25519_keypair(),
2245  get_master_signing_keypair())) ) {
2246  log_warn(LD_BUG, "Couldn't generate router descriptor.");
2247  return TOR_ROUTERINFO_ERROR_CANNOT_GENERATE;
2248  }
2249 
2250  ri->cache_info.signed_descriptor_len =
2251  strlen(ri->cache_info.signed_descriptor_body);
2252 
2254  strlen(ri->cache_info.signed_descriptor_body),
2255  ri->cache_info.signed_descriptor_digest);
2256 
2257  return 0;
2258 }
2259 
2269 int
2271 {
2272  int result = TOR_ROUTERINFO_ERROR_INTERNAL_BUG;
2273  routerinfo_t *ri = NULL;
2274  extrainfo_t *ei = NULL;
2275 
2276  if (BUG(!r))
2277  goto err;
2278 
2279  if (BUG(!e))
2280  goto err;
2281 
2282  result = router_build_fresh_unsigned_routerinfo(&ri);
2283  if (result < 0) {
2284  goto err;
2285  }
2286  /* If ri is NULL, then result should be negative. So this check should be
2287  * unreachable. */
2288  if (BUG(!ri)) {
2289  result = TOR_ROUTERINFO_ERROR_INTERNAL_BUG;
2290  goto err;
2291  }
2292 
2294 
2295  /* Failing to create an ei is not an error. */
2296  if (ei) {
2298  }
2299 
2301  if (result < 0)
2302  goto err;
2303 
2304  if (ei) {
2306  &ri->cache_info, NULL))) {
2307  result = TOR_ROUTERINFO_ERROR_INTERNAL_BUG;
2308  goto err;
2309  }
2310  }
2311 
2312  goto done;
2313 
2314  err:
2315  routerinfo_free(ri);
2316  extrainfo_free(ei);
2317  *r = NULL;
2318  *e = NULL;
2319  return result;
2320 
2321  done:
2322  *r = ri;
2323  *e = ei;
2324  return 0;
2325 }
2326 
2331 int
2333 {
2334  int err = 0;
2335  routerinfo_t *ri;
2336  extrainfo_t *ei;
2337  uint32_t addr;
2338  const or_options_t *options = get_options();
2339 
2340  if (desc_clean_since && !force)
2341  return 0;
2342 
2343  if (router_pick_published_address(options, &addr, 0) < 0 ||
2344  router_get_advertised_or_port(options) == 0) {
2345  /* Stop trying to rebuild our descriptor every second. We'll
2346  * learn that it's time to try again when ip_address_changed()
2347  * marks it dirty. */
2348  desc_clean_since = time(NULL);
2349  return TOR_ROUTERINFO_ERROR_DESC_REBUILDING;
2350  }
2351 
2352  log_info(LD_OR, "Rebuilding relay descriptor%s", force ? " (forced)" : "");
2353 
2354  err = router_build_fresh_descriptor(&ri, &ei);
2355  if (err < 0) {
2356  return err;
2357  }
2358 
2359  routerinfo_free(desc_routerinfo);
2360  desc_routerinfo = ri;
2361  extrainfo_free(desc_extrainfo);
2362  desc_extrainfo = ei;
2363 
2364  desc_clean_since = time(NULL);
2365  desc_needs_upload = 1;
2367  if (BUG(desc_gen_reason == NULL)) {
2368  desc_gen_reason = "descriptor was marked dirty earlier, for no reason.";
2369  }
2370  desc_dirty_reason = NULL;
2372  return 0;
2373 }
2374 
2377 #define FORCE_REGENERATE_DESCRIPTOR_INTERVAL (18*60*60)
2378 
2381 #define FAST_RETRY_DESCRIPTOR_INTERVAL (90*60)
2382 
2385 void
2387 {
2388  networkstatus_t *ns;
2389  const routerstatus_t *rs;
2390  const char *retry_fast_reason = NULL; /* Set if we should retry frequently */
2391  const time_t slow_cutoff = now - FORCE_REGENERATE_DESCRIPTOR_INTERVAL;
2392  const time_t fast_cutoff = now - FAST_RETRY_DESCRIPTOR_INTERVAL;
2393 
2394  /* If it's already dirty, don't mark it. */
2395  if (! desc_clean_since)
2396  return;
2397 
2398  /* If it's older than FORCE_REGENERATE_DESCRIPTOR_INTERVAL, it's always
2399  * time to rebuild it. */
2400  if (desc_clean_since < slow_cutoff) {
2401  mark_my_descriptor_dirty("time for new descriptor");
2402  return;
2403  }
2404  /* Now we see whether we want to be retrying frequently or no. The
2405  * rule here is that we'll retry frequently if we aren't listed in the
2406  * live consensus we have, or if the publication time of the
2407  * descriptor listed for us in the consensus is very old, or if the
2408  * consensus lists us as "stale" and we haven't regenerated since the
2409  * consensus was published. */
2410  ns = networkstatus_get_live_consensus(now);
2411  if (ns) {
2412  rs = networkstatus_vote_find_entry(ns, server_identitykey_digest);
2413  if (rs == NULL)
2414  retry_fast_reason = "not listed in consensus";
2415  else if (rs->published_on < slow_cutoff)
2416  retry_fast_reason = "version listed in consensus is quite old";
2417  else if (rs->is_staledesc && ns->valid_after > desc_clean_since)
2418  retry_fast_reason = "listed as stale in consensus";
2419  }
2420 
2421  if (retry_fast_reason && desc_clean_since < fast_cutoff)
2422  mark_my_descriptor_dirty(retry_fast_reason);
2423 }
2424 
2426 void
2427 mark_my_descriptor_dirty(const char *reason)
2428 {
2429  const or_options_t *options = get_options();
2430  if (BUG(reason == NULL)) {
2431  reason = "marked descriptor dirty for unspecified reason";
2432  }
2433  if (server_mode(options) && options->PublishServerDescriptor_)
2434  log_info(LD_OR, "Decided to publish new relay descriptor: %s", reason);
2435  desc_clean_since = 0;
2436  if (!desc_dirty_reason)
2437  desc_dirty_reason = reason;
2438 }
2439 
2443 #define MAX_BANDWIDTH_CHANGE_FREQ (3*60*60)
2444 
2447 #define MAX_UPTIME_BANDWIDTH_CHANGE (24*60*60)
2448 
2450 #define BANDWIDTH_CHANGE_FACTOR 2
2451 
2455 void
2457 {
2458  static time_t last_changed = 0;
2459  uint64_t prev, cur;
2460  const int hibernating = we_are_hibernating();
2461 
2462  /* If the relay uptime is bigger than MAX_UPTIME_BANDWIDTH_CHANGE,
2463  * the next regularly scheduled descriptor update (18h) will be enough */
2464  if (get_uptime() > MAX_UPTIME_BANDWIDTH_CHANGE && !hibernating)
2465  return;
2466 
2467  const routerinfo_t *my_ri = router_get_my_routerinfo();
2468 
2469  if (!my_ri)
2470  return;
2471 
2472  prev = my_ri->bandwidthcapacity;
2473 
2474  /* Consider ourselves to have zero bandwidth if we're hibernating or
2475  * shutting down. */
2476  cur = hibernating ? 0 : rep_hist_bandwidth_assess();
2477 
2478  if ((prev != cur && (!prev || !cur)) ||
2479  cur > (prev * BANDWIDTH_CHANGE_FACTOR) ||
2480  cur < (prev / BANDWIDTH_CHANGE_FACTOR) ) {
2481  if (last_changed+MAX_BANDWIDTH_CHANGE_FREQ < now || !prev) {
2482  log_info(LD_GENERAL,
2483  "Measured bandwidth has changed; rebuilding descriptor.");
2484  mark_my_descriptor_dirty("bandwidth has changed");
2485  last_changed = now;
2486  }
2487  }
2488 }
2489 
2492 static void
2494  const tor_addr_t *prev,
2495  const tor_addr_t *cur,
2496  const char *source)
2497 {
2498  char addrbuf_prev[TOR_ADDR_BUF_LEN];
2499  char addrbuf_cur[TOR_ADDR_BUF_LEN];
2500 
2501  if (BUG(!server_mode(get_options())))
2502  return;
2503 
2504  if (tor_addr_to_str(addrbuf_prev, prev, sizeof(addrbuf_prev), 1) == NULL)
2505  strlcpy(addrbuf_prev, "???", TOR_ADDR_BUF_LEN);
2506  if (tor_addr_to_str(addrbuf_cur, cur, sizeof(addrbuf_cur), 1) == NULL)
2507  strlcpy(addrbuf_cur, "???", TOR_ADDR_BUF_LEN);
2508 
2509  if (!tor_addr_is_null(prev))
2510  log_fn(severity, LD_GENERAL,
2511  "Our IP Address has changed from %s to %s; "
2512  "rebuilding descriptor (source: %s).",
2513  addrbuf_prev, addrbuf_cur, source);
2514  else
2515  log_notice(LD_GENERAL,
2516  "Guessed our IP address as %s (source: %s).",
2517  addrbuf_cur, source);
2518 }
2519 
2523 void
2525 {
2526  uint32_t prev, cur;
2527  const or_options_t *options = get_options();
2528  const char *method = NULL;
2529  char *hostname = NULL;
2530  const routerinfo_t *my_ri = router_get_my_routerinfo();
2531 
2532  (void) now;
2533 
2534  if (my_ri == NULL) /* make sure routerinfo exists */
2535  return;
2536 
2537  /* XXXX ipv6 */
2538  prev = my_ri->addr;
2539  if (resolve_my_address(LOG_INFO, options, &cur, &method, &hostname) < 0) {
2540  log_info(LD_CONFIG,"options->Address didn't resolve into an IP.");
2541  return;
2542  }
2543 
2544  if (prev != cur) {
2545  char *source;
2546  tor_addr_t tmp_prev, tmp_cur;
2547 
2548  tor_addr_from_ipv4h(&tmp_prev, prev);
2549  tor_addr_from_ipv4h(&tmp_cur, cur);
2550 
2551  tor_asprintf(&source, "METHOD=%s%s%s", method,
2552  hostname ? " HOSTNAME=" : "",
2553  hostname ? hostname : "");
2554 
2555  log_addr_has_changed(LOG_NOTICE, &tmp_prev, &tmp_cur, source);
2556  tor_free(source);
2557 
2558  ip_address_changed(0);
2559  }
2560 
2561  tor_free(hostname);
2562 }
2563 
2566 static tor_addr_t last_guessed_ip = TOR_ADDR_NULL;
2567 
2572 void
2573 router_new_address_suggestion(const char *suggestion,
2574  const dir_connection_t *d_conn)
2575 {
2576  tor_addr_t addr;
2577  uint32_t cur = 0; /* Current IPv4 address. */
2578  const or_options_t *options = get_options();
2579 
2580  /* first, learn what the IP address actually is */
2581  if (tor_addr_parse(&addr, suggestion) == -1) {
2582  log_debug(LD_DIR, "Malformed X-Your-Address-Is header %s. Ignoring.",
2583  escaped(suggestion));
2584  return;
2585  }
2586 
2587  log_debug(LD_DIR, "Got X-Your-Address-Is: %s.", suggestion);
2588 
2589  if (!server_mode(options)) {
2590  tor_addr_copy(&last_guessed_ip, &addr);
2591  return;
2592  }
2593 
2594  /* XXXX ipv6 */
2595  cur = get_last_resolved_addr();
2596  if (cur ||
2597  resolve_my_address(LOG_INFO, options, &cur, NULL, NULL) >= 0) {
2598  /* We're all set -- we already know our address. Great. */
2599  tor_addr_from_ipv4h(&last_guessed_ip, cur); /* store it in case we
2600  need it later */
2601  return;
2602  }
2603  if (tor_addr_is_internal(&addr, 0)) {
2604  /* Don't believe anybody who says our IP is, say, 127.0.0.1. */
2605  return;
2606  }
2607  if (tor_addr_eq(&d_conn->base_.addr, &addr)) {
2608  /* Don't believe anybody who says our IP is their IP. */
2609  log_debug(LD_DIR, "A directory server told us our IP address is %s, "
2610  "but they are just reporting their own IP address. Ignoring.",
2611  suggestion);
2612  return;
2613  }
2614 
2615  /* Okay. We can't resolve our own address, and X-Your-Address-Is is giving
2616  * us an answer different from what we had the last time we managed to
2617  * resolve it. */
2618  if (!tor_addr_eq(&last_guessed_ip, &addr)) {
2620  "EXTERNAL_ADDRESS ADDRESS=%s METHOD=DIRSERV",
2621  suggestion);
2623  d_conn->base_.address);
2624  ip_address_changed(0);
2625  tor_addr_copy(&last_guessed_ip, &addr); /* router_rebuild_descriptor()
2626  will fetch it */
2627  }
2628 }
2629 
2634 static int
2636 {
2639  return 0;
2640  }
2641  return -1;
2642 }
2643 
2648 STATIC void
2649 get_platform_str(char *platform, size_t len)
2650 {
2651  tor_snprintf(platform, len, "Tor %s on %s",
2652  get_short_version(), get_uname());
2653 }
2654 
2655 /* XXX need to audit this thing and count fenceposts. maybe
2656  * refactor so we don't have to keep asking if we're
2657  * near the end of maxlen?
2658  */
2659 #define DEBUG_ROUTER_DUMP_ROUTER_TO_STRING
2660 
2669 char *
2671  const crypto_pk_t *ident_key,
2672  const crypto_pk_t *tap_key,
2673  const curve25519_keypair_t *ntor_keypair,
2674  const ed25519_keypair_t *signing_keypair)
2675 {
2676  char *address = NULL;
2677  char *onion_pkey = NULL; /* Onion key, PEM-encoded. */
2678  crypto_pk_t *rsa_pubkey = NULL;
2679  char *identity_pkey = NULL; /* Identity key, PEM-encoded. */
2680  char digest[DIGEST256_LEN];
2681  char published[ISO_TIME_LEN+1];
2682  char fingerprint[FINGERPRINT_LEN+1];
2683  char *extra_info_line = NULL;
2684  size_t onion_pkeylen, identity_pkeylen;
2685  char *family_line = NULL;
2686  char *extra_or_address = NULL;
2687  const or_options_t *options = get_options();
2688  smartlist_t *chunks = NULL;
2689  char *output = NULL;
2690  const int emit_ed_sigs = signing_keypair &&
2691  router->cache_info.signing_key_cert;
2692  char *ed_cert_line = NULL;
2693  char *rsa_tap_cc_line = NULL;
2694  char *ntor_cc_line = NULL;
2695  char *proto_line = NULL;
2696 
2697  /* Make sure the identity key matches the one in the routerinfo. */
2698  if (!crypto_pk_eq_keys(ident_key, router->identity_pkey)) {
2699  log_warn(LD_BUG,"Tried to sign a router with a private key that didn't "
2700  "match router's public key!");
2701  goto err;
2702  }
2703  if (emit_ed_sigs) {
2704  if (!router->cache_info.signing_key_cert->signing_key_included ||
2705  !ed25519_pubkey_eq(&router->cache_info.signing_key_cert->signed_key,
2706  &signing_keypair->pubkey)) {
2707  log_warn(LD_BUG, "Tried to sign a router descriptor with a mismatched "
2708  "ed25519 key chain %d",
2709  router->cache_info.signing_key_cert->signing_key_included);
2710  goto err;
2711  }
2712  }
2713 
2714  /* record our fingerprint, so we can include it in the descriptor */
2715  if (crypto_pk_get_fingerprint(router->identity_pkey, fingerprint, 1)<0) {
2716  log_err(LD_BUG,"Error computing fingerprint");
2717  goto err;
2718  }
2719 
2720  if (emit_ed_sigs) {
2721  /* Encode ed25519 signing cert */
2722  char ed_cert_base64[256];
2723  char ed_fp_base64[ED25519_BASE64_LEN+1];
2724  if (base64_encode(ed_cert_base64, sizeof(ed_cert_base64),
2725  (const char*)router->cache_info.signing_key_cert->encoded,
2726  router->cache_info.signing_key_cert->encoded_len,
2727  BASE64_ENCODE_MULTILINE) < 0) {
2728  log_err(LD_BUG,"Couldn't base64-encode signing key certificate!");
2729  goto err;
2730  }
2731  ed25519_public_to_base64(ed_fp_base64,
2732  &router->cache_info.signing_key_cert->signing_key);
2733  tor_asprintf(&ed_cert_line, "identity-ed25519\n"
2734  "-----BEGIN ED25519 CERT-----\n"
2735  "%s"
2736  "-----END ED25519 CERT-----\n"
2737  "master-key-ed25519 %s\n",
2738  ed_cert_base64, ed_fp_base64);
2739  }
2740 
2741  /* PEM-encode the onion key */
2742  rsa_pubkey = router_get_rsa_onion_pkey(router->onion_pkey,
2743  router->onion_pkey_len);
2744  if (crypto_pk_write_public_key_to_string(rsa_pubkey,
2745  &onion_pkey,&onion_pkeylen)<0) {
2746  log_warn(LD_BUG,"write onion_pkey to string failed!");
2747  goto err;
2748  }
2749 
2750  /* PEM-encode the identity key */
2752  &identity_pkey,&identity_pkeylen)<0) {
2753  log_warn(LD_BUG,"write identity_pkey to string failed!");
2754  goto err;
2755  }
2756 
2757  /* Cross-certify with RSA key */
2758  if (tap_key && router->cache_info.signing_key_cert &&
2759  router->cache_info.signing_key_cert->signing_key_included) {
2760  char buf[256];
2761  int tap_cc_len = 0;
2762  uint8_t *tap_cc =
2764  &router->cache_info.signing_key_cert->signing_key,
2765  router->identity_pkey,
2766  &tap_cc_len);
2767  if (!tap_cc) {
2768  log_warn(LD_BUG,"make_tap_onion_key_crosscert failed!");
2769  goto err;
2770  }
2771 
2772  if (base64_encode(buf, sizeof(buf), (const char*)tap_cc, tap_cc_len,
2773  BASE64_ENCODE_MULTILINE) < 0) {
2774  log_warn(LD_BUG,"base64_encode(rsa_crosscert) failed!");
2775  tor_free(tap_cc);
2776  goto err;
2777  }
2778  tor_free(tap_cc);
2779 
2780  tor_asprintf(&rsa_tap_cc_line,
2781  "onion-key-crosscert\n"
2782  "-----BEGIN CROSSCERT-----\n"
2783  "%s"
2784  "-----END CROSSCERT-----\n", buf);
2785  }
2786 
2787  /* Cross-certify with onion keys */
2788  if (ntor_keypair && router->cache_info.signing_key_cert &&
2789  router->cache_info.signing_key_cert->signing_key_included) {
2790  int sign = 0;
2791  char buf[256];
2792  /* XXXX Base the expiration date on the actual onion key expiration time?*/
2793  tor_cert_t *cert =
2794  make_ntor_onion_key_crosscert(ntor_keypair,
2795  &router->cache_info.signing_key_cert->signing_key,
2796  router->cache_info.published_on,
2797  get_onion_key_lifetime(), &sign);
2798  if (!cert) {
2799  log_warn(LD_BUG,"make_ntor_onion_key_crosscert failed!");
2800  goto err;
2801  }
2802  tor_assert(sign == 0 || sign == 1);
2803 
2804  if (base64_encode(buf, sizeof(buf),
2805  (const char*)cert->encoded, cert->encoded_len,
2806  BASE64_ENCODE_MULTILINE)<0) {
2807  log_warn(LD_BUG,"base64_encode(ntor_crosscert) failed!");
2808  tor_cert_free(cert);
2809  goto err;
2810  }
2811  tor_cert_free(cert);
2812 
2813  tor_asprintf(&ntor_cc_line,
2814  "ntor-onion-key-crosscert %d\n"
2815  "-----BEGIN ED25519 CERT-----\n"
2816  "%s"
2817  "-----END ED25519 CERT-----\n", sign, buf);
2818  }
2819 
2820  /* Encode the publication time. */
2821  format_iso_time(published, router->cache_info.published_on);
2822 
2823  if (router->declared_family && smartlist_len(router->declared_family)) {
2824  char *family = smartlist_join_strings(router->declared_family,
2825  " ", 0, NULL);
2826  tor_asprintf(&family_line, "family %s\n", family);
2827  tor_free(family);
2828  } else {
2829  family_line = tor_strdup("");
2830  }
2831 
2832  if (!tor_digest_is_zero(router->cache_info.extra_info_digest)) {
2833  char extra_info_digest[HEX_DIGEST_LEN+1];
2834  base16_encode(extra_info_digest, sizeof(extra_info_digest),
2835  router->cache_info.extra_info_digest, DIGEST_LEN);
2836  if (!tor_digest256_is_zero(router->cache_info.extra_info_digest256)) {
2837  char d256_64[BASE64_DIGEST256_LEN+1];
2838  digest256_to_base64(d256_64, router->cache_info.extra_info_digest256);
2839  tor_asprintf(&extra_info_line, "extra-info-digest %s %s\n",
2840  extra_info_digest, d256_64);
2841  } else {
2842  tor_asprintf(&extra_info_line, "extra-info-digest %s\n",
2843  extra_info_digest);
2844  }
2845  }
2846 
2847  if (router->ipv6_orport &&
2848  tor_addr_family(&router->ipv6_addr) == AF_INET6) {
2849  char addr[TOR_ADDR_BUF_LEN];
2850  const char *a;
2851  a = tor_addr_to_str(addr, &router->ipv6_addr, sizeof(addr), 1);
2852  if (a) {
2853  tor_asprintf(&extra_or_address,
2854  "or-address %s:%d\n", a, router->ipv6_orport);
2855  log_debug(LD_OR, "My or-address line is <%s>", extra_or_address);
2856  }
2857  }
2858 
2859  if (router->protocol_list) {
2860  tor_asprintf(&proto_line, "proto %s\n", router->protocol_list);
2861  } else {
2862  proto_line = tor_strdup("");
2863  }
2864 
2865  address = tor_dup_ip(router->addr);
2866  chunks = smartlist_new();
2867 
2868  /* Generate the easy portion of the router descriptor. */
2869  smartlist_add_asprintf(chunks,
2870  "router %s %s %d 0 %d\n"
2871  "%s"
2872  "%s"
2873  "platform %s\n"
2874  "%s"
2875  "published %s\n"
2876  "fingerprint %s\n"
2877  "uptime %ld\n"
2878  "bandwidth %d %d %d\n"
2879  "%s%s"
2880  "onion-key\n%s"
2881  "signing-key\n%s"
2882  "%s%s"
2883  "%s%s%s",
2884  router->nickname,
2885  address,
2886  router->or_port,
2887  router_should_advertise_dirport(options, router->dir_port),
2888  ed_cert_line ? ed_cert_line : "",
2889  extra_or_address ? extra_or_address : "",
2890  router->platform,
2891  proto_line,
2892  published,
2893  fingerprint,
2894  get_uptime(),
2895  (int) router->bandwidthrate,
2896  (int) router->bandwidthburst,
2897  (int) router->bandwidthcapacity,
2898  extra_info_line ? extra_info_line : "",
2899  (options->DownloadExtraInfo || options->V3AuthoritativeDir) ?
2900  "caches-extra-info\n" : "",
2901  onion_pkey, identity_pkey,
2902  rsa_tap_cc_line ? rsa_tap_cc_line : "",
2903  ntor_cc_line ? ntor_cc_line : "",
2904  family_line,
2905  we_are_hibernating() ? "hibernating 1\n" : "",
2906  "hidden-service-dir\n");
2907 
2908  if (options->ContactInfo && strlen(options->ContactInfo)) {
2909  const char *ci = options->ContactInfo;
2910  if (strchr(ci, '\n') || strchr(ci, '\r'))
2911  ci = escaped(ci);
2912  smartlist_add_asprintf(chunks, "contact %s\n", ci);
2913  }
2914 
2915  if (options->BridgeRelay) {
2916  const char *bd;
2917  if (options->BridgeDistribution && strlen(options->BridgeDistribution)) {
2918  bd = options->BridgeDistribution;
2919  } else {
2920  bd = "any";
2921  }
2922  if (strchr(bd, '\n') || strchr(bd, '\r'))
2923  bd = escaped(bd);
2924  smartlist_add_asprintf(chunks, "bridge-distribution-request %s\n", bd);
2925  }
2926 
2927  if (router->onion_curve25519_pkey) {
2928  char kbuf[128];
2929  base64_encode(kbuf, sizeof(kbuf),
2930  (const char *)router->onion_curve25519_pkey->public_key,
2931  CURVE25519_PUBKEY_LEN, BASE64_ENCODE_MULTILINE);
2932  smartlist_add_asprintf(chunks, "ntor-onion-key %s", kbuf);
2933  } else {
2934  /* Authorities will start rejecting relays without ntor keys in 0.2.9 */
2935  log_err(LD_BUG, "A relay must have an ntor onion key");
2936  goto err;
2937  }
2938 
2939  /* Write the exit policy to the end of 's'. */
2940  if (!router->exit_policy || !smartlist_len(router->exit_policy)) {
2941  smartlist_add_strdup(chunks, "reject *:*\n");
2942  } else if (router->exit_policy) {
2943  char *exit_policy = router_dump_exit_policy_to_string(router,1,0);
2944 
2945  if (!exit_policy)
2946  goto err;
2947 
2948  smartlist_add_asprintf(chunks, "%s\n", exit_policy);
2949  tor_free(exit_policy);
2950  }
2951 
2952  if (router->ipv6_exit_policy) {
2953  char *p6 = write_short_policy(router->ipv6_exit_policy);
2954  if (p6 && strcmp(p6, "reject 1-65535")) {
2955  smartlist_add_asprintf(chunks,
2956  "ipv6-policy %s\n", p6);
2957  }
2958  tor_free(p6);
2959  }
2960 
2963  smartlist_add_strdup(chunks, "tunnelled-dir-server\n");
2964  }
2965 
2966  /* Sign the descriptor with Ed25519 */
2967  if (emit_ed_sigs) {
2968  smartlist_add_strdup(chunks, "router-sig-ed25519 ");
2969  crypto_digest_smartlist_prefix(digest, DIGEST256_LEN,
2970  ED_DESC_SIGNATURE_PREFIX,
2971  chunks, "", DIGEST_SHA256);
2972  ed25519_signature_t sig;
2973  char buf[ED25519_SIG_BASE64_LEN+1];
2974  if (ed25519_sign(&sig, (const uint8_t*)digest, DIGEST256_LEN,
2975  signing_keypair) < 0)
2976  goto err;
2977  ed25519_signature_to_base64(buf, &sig);
2978 
2979  smartlist_add_asprintf(chunks, "%s\n", buf);
2980  }
2981 
2982  /* Sign the descriptor with RSA */
2983  smartlist_add_strdup(chunks, "router-signature\n");
2984 
2985  crypto_digest_smartlist(digest, DIGEST_LEN, chunks, "", DIGEST_SHA1);
2986 
2987  {
2988  char *sig;
2989  if (!(sig = router_get_dirobj_signature(digest, DIGEST_LEN, ident_key))) {
2990  log_warn(LD_BUG, "Couldn't sign router descriptor");
2991  goto err;
2992  }
2993  smartlist_add(chunks, sig);
2994  }
2995 
2996  /* include a last '\n' */
2997  smartlist_add_strdup(chunks, "\n");
2998 
2999  output = smartlist_join_strings(chunks, "", 0, NULL);
3000 
3001 #ifdef DEBUG_ROUTER_DUMP_ROUTER_TO_STRING
3002  {
3003  char *s_dup;
3004  const char *cp;
3005  routerinfo_t *ri_tmp;
3006  cp = s_dup = tor_strdup(output);
3007  ri_tmp = router_parse_entry_from_string(cp, NULL, 1, 0, NULL, NULL);
3008  if (!ri_tmp) {
3009  log_err(LD_BUG,
3010  "We just generated a router descriptor we can't parse.");
3011  log_err(LD_BUG, "Descriptor was: <<%s>>", output);
3012  goto err;
3013  }
3014  tor_free(s_dup);
3015  routerinfo_free(ri_tmp);
3016  }
3017 #endif /* defined(DEBUG_ROUTER_DUMP_ROUTER_TO_STRING) */
3018 
3019  goto done;
3020 
3021  err:
3022  tor_free(output); /* sets output to NULL */
3023  done:
3024  if (chunks) {
3025  SMARTLIST_FOREACH(chunks, char *, cp, tor_free(cp));
3026  smartlist_free(chunks);
3027  }
3028  crypto_pk_free(rsa_pubkey);
3029  tor_free(address);
3030  tor_free(family_line);
3031  tor_free(onion_pkey);
3032  tor_free(identity_pkey);
3033  tor_free(extra_or_address);
3034  tor_free(ed_cert_line);
3035  tor_free(rsa_tap_cc_line);
3036  tor_free(ntor_cc_line);
3037  tor_free(extra_info_line);
3038  tor_free(proto_line);
3039 
3040  return output;
3041 }
3042 
3048 char *
3050  int include_ipv4,
3051  int include_ipv6)
3052 {
3053  if ((!router->exit_policy) || (router->policy_is_reject_star)) {
3054  return tor_strdup("reject *:*");
3055  }
3056 
3057  return policy_dump_to_string(router->exit_policy,
3058  include_ipv4,
3059  include_ipv6);
3060 }
3061 
3069 static int
3070 load_stats_file(const char *filename, const char *end_line, time_t now,
3071  char **out)
3072 {
3073  int r = -1;
3074  char *fname = get_datadir_fname(filename);
3075  char *contents, *start = NULL, *tmp, timestr[ISO_TIME_LEN+1];
3076  time_t written;
3077  switch (file_status(fname)) {
3078  case FN_FILE:
3079  /* X022 Find an alternative to reading the whole file to memory. */
3080  if ((contents = read_file_to_str(fname, 0, NULL))) {
3081  tmp = strstr(contents, end_line);
3082  /* Find last block starting with end_line */
3083  while (tmp) {
3084  start = tmp;
3085  tmp = strstr(tmp + 1, end_line);
3086  }
3087  if (!start)
3088  goto notfound;
3089  if (strlen(start) < strlen(end_line) + 1 + sizeof(timestr))
3090  goto notfound;
3091  strlcpy(timestr, start + 1 + strlen(end_line), sizeof(timestr));
3092  if (parse_iso_time(timestr, &written) < 0)
3093  goto notfound;
3094  if (written < now - (25*60*60) || written > now + (1*60*60))
3095  goto notfound;
3096  *out = tor_strdup(start);
3097  r = 1;
3098  }
3099  notfound:
3100  tor_free(contents);
3101  break;
3102  /* treat empty stats files as if the file doesn't exist */
3103  case FN_NOENT:
3104  case FN_EMPTY:
3105  r = 0;
3106  break;
3107  case FN_ERROR:
3108  case FN_DIR:
3109  default:
3110  break;
3111  }
3112  tor_free(fname);
3113  return r;
3114 }
3115 
3124 int
3125 extrainfo_dump_to_string(char **s_out, extrainfo_t *extrainfo,
3126  crypto_pk_t *ident_key,
3127  const ed25519_keypair_t *signing_keypair)
3128 {
3129  const or_options_t *options = get_options();
3130  char identity[HEX_DIGEST_LEN+1];
3131  char published[ISO_TIME_LEN+1];
3132  char digest[DIGEST_LEN];
3133  int result;
3134  static int write_stats_to_extrainfo = 1;
3135  char sig[DIROBJ_MAX_SIG_LEN+1];
3136  char *s = NULL, *pre, *contents, *cp, *s_dup = NULL;
3137  time_t now = time(NULL);
3138  smartlist_t *chunks = smartlist_new();
3139  extrainfo_t *ei_tmp = NULL;
3140  const int emit_ed_sigs = signing_keypair &&
3141  extrainfo->cache_info.signing_key_cert;
3142  char *ed_cert_line = NULL;
3143 
3144  base16_encode(identity, sizeof(identity),
3145  extrainfo->cache_info.identity_digest, DIGEST_LEN);
3146  format_iso_time(published, extrainfo->cache_info.published_on);
3147  if (emit_ed_sigs) {
3148  if (!extrainfo->cache_info.signing_key_cert->signing_key_included ||
3149  !ed25519_pubkey_eq(&extrainfo->cache_info.signing_key_cert->signed_key,
3150  &signing_keypair->pubkey)) {
3151  log_warn(LD_BUG, "Tried to sign a extrainfo descriptor with a "
3152  "mismatched ed25519 key chain %d",
3153  extrainfo->cache_info.signing_key_cert->signing_key_included);
3154  goto err;
3155  }
3156  char ed_cert_base64[256];
3157  if (base64_encode(ed_cert_base64, sizeof(ed_cert_base64),
3158  (const char*)extrainfo->cache_info.signing_key_cert->encoded,
3159  extrainfo->cache_info.signing_key_cert->encoded_len,
3160  BASE64_ENCODE_MULTILINE) < 0) {
3161  log_err(LD_BUG,"Couldn't base64-encode signing key certificate!");
3162  goto err;
3163  }
3164  tor_asprintf(&ed_cert_line, "identity-ed25519\n"
3165  "-----BEGIN ED25519 CERT-----\n"
3166  "%s"
3167  "-----END ED25519 CERT-----\n", ed_cert_base64);
3168  } else {
3169  ed_cert_line = tor_strdup("");
3170  }
3171 
3172  tor_asprintf(&pre, "extra-info %s %s\n%spublished %s\n",
3173  extrainfo->nickname, identity,
3174  ed_cert_line,
3175  published);
3176  smartlist_add(chunks, pre);
3177 
3178  if (options->ExtraInfoStatistics && write_stats_to_extrainfo) {
3179  log_info(LD_GENERAL, "Adding stats to extra-info descriptor.");
3180  /* Bandwidth usage stats don't have their own option */
3181  {
3182  contents = rep_hist_get_bandwidth_lines();
3183  smartlist_add(chunks, contents);
3184  }
3185  if (geoip_is_loaded(AF_INET))
3186  smartlist_add_asprintf(chunks, "geoip-db-digest %s\n",
3187  geoip_db_digest(AF_INET));
3188  if (geoip_is_loaded(AF_INET6))
3189  smartlist_add_asprintf(chunks, "geoip6-db-digest %s\n",
3190  geoip_db_digest(AF_INET6));
3191  if (options->DirReqStatistics &&
3192  load_stats_file("stats"PATH_SEPARATOR"dirreq-stats",
3193  "dirreq-stats-end", now, &contents) > 0) {
3194  smartlist_add(chunks, contents);
3195  }
3196  if (options->HiddenServiceStatistics &&
3197  load_stats_file("stats"PATH_SEPARATOR"hidserv-stats",
3198  "hidserv-stats-end", now, &contents) > 0) {
3199  smartlist_add(chunks, contents);
3200  }
3201  if (options->EntryStatistics &&
3202  load_stats_file("stats"PATH_SEPARATOR"entry-stats",
3203  "entry-stats-end", now, &contents) > 0) {
3204  smartlist_add(chunks, contents);
3205  }
3206  if (options->CellStatistics &&
3207  load_stats_file("stats"PATH_SEPARATOR"buffer-stats",
3208  "cell-stats-end", now, &contents) > 0) {
3209  smartlist_add(chunks, contents);
3210  }
3211  if (options->ExitPortStatistics &&
3212  load_stats_file("stats"PATH_SEPARATOR"exit-stats",
3213  "exit-stats-end", now, &contents) > 0) {
3214  smartlist_add(chunks, contents);
3215  }
3216  if (options->ConnDirectionStatistics &&
3217  load_stats_file("stats"PATH_SEPARATOR"conn-stats",
3218  "conn-bi-direct", now, &contents) > 0) {
3219  smartlist_add(chunks, contents);
3220  }
3221  if (options->PaddingStatistics) {
3222  contents = rep_hist_get_padding_count_lines();
3223  if (contents)
3224  smartlist_add(chunks, contents);
3225  }
3226  /* Add information about the pluggable transports we support. */
3227  if (options->ServerTransportPlugin) {
3228  char *pluggable_transports = pt_get_extra_info_descriptor_string();
3229  if (pluggable_transports)
3230  smartlist_add(chunks, pluggable_transports);
3231  }
3232  if (should_record_bridge_info(options)) {
3233  const char *bridge_stats = geoip_get_bridge_stats_extrainfo(now);
3234  if (bridge_stats) {
3235  smartlist_add_strdup(chunks, bridge_stats);
3236  }
3237  }
3238  }
3239 
3240  if (emit_ed_sigs) {
3241  char sha256_digest[DIGEST256_LEN];
3242  smartlist_add_strdup(chunks, "router-sig-ed25519 ");
3243  crypto_digest_smartlist_prefix(sha256_digest, DIGEST256_LEN,
3244  ED_DESC_SIGNATURE_PREFIX,
3245  chunks, "", DIGEST_SHA256);
3246  ed25519_signature_t ed_sig;
3247  char buf[ED25519_SIG_BASE64_LEN+1];
3248  if (ed25519_sign(&ed_sig, (const uint8_t*)sha256_digest, DIGEST256_LEN,
3249  signing_keypair) < 0)
3250  goto err;
3251  ed25519_signature_to_base64(buf, &ed_sig);
3252 
3253  smartlist_add_asprintf(chunks, "%s\n", buf);
3254  }
3255 
3256  smartlist_add_strdup(chunks, "router-signature\n");
3257  s = smartlist_join_strings(chunks, "", 0, NULL);
3258 
3259  while (strlen(s) > MAX_EXTRAINFO_UPLOAD_SIZE - DIROBJ_MAX_SIG_LEN) {
3260  /* So long as there are at least two chunks (one for the initial
3261  * extra-info line and one for the router-signature), we can keep removing
3262  * things. */
3263  if (smartlist_len(chunks) > 2) {
3264  /* We remove the next-to-last element (remember, len-1 is the last
3265  element), since we need to keep the router-signature element. */
3266  int idx = smartlist_len(chunks) - 2;
3267  char *e = smartlist_get(chunks, idx);
3268  smartlist_del_keeporder(chunks, idx);
3269  log_warn(LD_GENERAL, "We just generated an extra-info descriptor "
3270  "with statistics that exceeds the 50 KB "
3271  "upload limit. Removing last added "
3272  "statistics.");
3273  tor_free(e);
3274  tor_free(s);
3275  s = smartlist_join_strings(chunks, "", 0, NULL);
3276  } else {
3277  log_warn(LD_BUG, "We just generated an extra-info descriptors that "
3278  "exceeds the 50 KB upload limit.");
3279  goto err;
3280  }
3281  }
3282 
3283  memset(sig, 0, sizeof(sig));
3284  if (router_get_extrainfo_hash(s, strlen(s), digest) < 0 ||
3285  router_append_dirobj_signature(sig, sizeof(sig), digest, DIGEST_LEN,
3286  ident_key) < 0) {
3287  log_warn(LD_BUG, "Could not append signature to extra-info "
3288  "descriptor.");
3289  goto err;
3290  }
3291  smartlist_add_strdup(chunks, sig);
3292  tor_free(s);
3293  s = smartlist_join_strings(chunks, "", 0, NULL);
3294 
3295  cp = s_dup = tor_strdup(s);
3296  ei_tmp = extrainfo_parse_entry_from_string(cp, NULL, 1, NULL, NULL);
3297  if (!ei_tmp) {
3298  if (write_stats_to_extrainfo) {
3299  log_warn(LD_GENERAL, "We just generated an extra-info descriptor "
3300  "with statistics that we can't parse. Not "
3301  "adding statistics to this or any future "
3302  "extra-info descriptors.");
3303  write_stats_to_extrainfo = 0;
3304  result = extrainfo_dump_to_string(s_out, extrainfo, ident_key,
3305  signing_keypair);
3306  goto done;
3307  } else {
3308  log_warn(LD_BUG, "We just generated an extrainfo descriptor we "
3309  "can't parse.");
3310  goto err;
3311  }
3312  }
3313 
3314  *s_out = s;
3315  s = NULL; /* prevent free */
3316  result = 0;
3317  goto done;
3318 
3319  err:
3320  result = -1;
3321 
3322  done:
3323  tor_free(s);
3324  SMARTLIST_FOREACH(chunks, char *, chunk, tor_free(chunk));
3325  smartlist_free(chunks);
3326  tor_free(s_dup);
3327  tor_free(ed_cert_line);
3328  extrainfo_free(ei_tmp);
3329 
3330  return result;
3331 }
3332 
3335 void
3337 {
3338  if (warned_family) {
3339  SMARTLIST_FOREACH(warned_family, char *, cp, tor_free(cp));
3341  }
3342 }
3343 
3345 void
3347 {
3348  crypto_pk_free(onionkey);
3349  crypto_pk_free(lastonionkey);
3350  crypto_pk_free(server_identitykey);
3351  crypto_pk_free(client_identitykey);
3352 
3353  tor_mutex_free(key_lock);
3354  routerinfo_free(desc_routerinfo);
3355  extrainfo_free(desc_extrainfo);
3356  crypto_pk_free(authority_signing_key);
3357  authority_cert_free(authority_key_certificate);
3358  crypto_pk_free(legacy_signing_key);
3359  authority_cert_free(legacy_key_certificate);
3360 
3363 
3364  if (warned_family) {
3365  SMARTLIST_FOREACH(warned_family, char *, cp, tor_free(cp));
3366  smartlist_free(warned_family);
3367  }
3368 }
3369 
3370 /* From the given RSA key object, convert it to ASN-1 encoded format and set
3371  * the newly allocated object in onion_pkey_out. The length of the key is set
3372  * in onion_pkey_len_out. */
3373 void
3374 router_set_rsa_onion_pkey(const crypto_pk_t *pk, char **onion_pkey_out,
3375  size_t *onion_pkey_len_out)
3376 {
3377  int len;
3378  char buf[1024];
3379 
3380  tor_assert(pk);
3381  tor_assert(onion_pkey_out);
3382  tor_assert(onion_pkey_len_out);
3383 
3384  len = crypto_pk_asn1_encode(pk, buf, sizeof(buf));
3385  if (BUG(len < 0)) {
3386  goto done;
3387  }
3388 
3389  *onion_pkey_out = tor_memdup(buf, len);
3390  *onion_pkey_len_out = len;
3391 
3392  done:
3393  return;
3394 }
3395 
3396 /* From an ASN-1 encoded onion pkey, return a newly allocated RSA key object.
3397  * It is the caller responsability to free the returned object.
3398  *
3399  * Return NULL if the pkey is NULL, malformed or if the length is 0. */
3400 crypto_pk_t *
3401 router_get_rsa_onion_pkey(const char *pkey, size_t pkey_len)
3402 {
3403  if (!pkey || pkey_len == 0) {
3404  return NULL;
3405  }
3406  return crypto_pk_asn1_decode(pkey, pkey_len);
3407 }
extrainfo_t * extrainfo_parse_entry_from_string(const char *s, const char *end, int cache_copy, struct digest_ri_map_t *routermap, int *can_dl_again_out)
Definition: routerparse.c:958
struct curve25519_public_key_t * onion_curve25519_pkey
Definition: routerinfo_st.h:40
int V3AuthoritativeDir
Header file for dirserv.c.
#define CONN_TYPE_DIR_LISTENER
Definition: connection.h:33
Header for statefile.c.
void dir_server_add(dir_server_t *ent)
Definition: dirlist.c:366
int crypto_pk_eq_keys(const crypto_pk_t *a, const crypto_pk_t *b)
Definition: crypto_rsa.c:71
extrainfo_t * router_get_my_extrainfo(void)
Definition: router.c:1692
uint64_t AccountingMax
Header file for dirclient.c.
const char * tor_addr_to_str(char *dest, const tor_addr_t *addr, size_t len, int decorate)
Definition: address.c:328
Header for uname.c.
Header for confline.c.
int router_rebuild_descriptor(int force)
Definition: router.c:2332
ed25519_public_key_t signed_key
Definition: torcert.h:25
static int router_should_be_dirserver(const or_options_t *options, int dir_port)
Definition: router.c:1209
int ExitPortStatistics
addr_policy_result_t compare_tor_addr_to_short_policy(const tor_addr_t *addr, uint16_t port, const short_policy_t *policy)
Definition: policies.c:2939
uint8_t * encoded
Definition: torcert.h:33
char * policy_summarize(smartlist_t *policy, sa_family_t family)
Definition: policies.c:2690
void tor_mutex_release(tor_mutex_t *m)
Header file for signing.c.
#define TOR_ADDR_BUF_LEN
Definition: address.h:205
Common functions for using (pseudo-)random number generators.
Definition: node_st.h:28
int have_lockfile(void)
Definition: main.c:713
saved_location_t saved_location
unsigned int policy_is_reject_star
Definition: routerinfo_st.h:74
static extrainfo_t * desc_extrainfo
Definition: router.c:1482
#define SMARTLIST_FOREACH_BEGIN(sl, type, var)
uint16_t sa_family_t
Definition: inaddr_st.h:77
int router_is_me(const routerinfo_t *router)
Definition: router.c:1621
static const char * desc_gen_reason
Definition: router.c:1485
was_router_added_t
Definition: routerlist.h:17
char * router_get_dirobj_signature(const char *digest, size_t digest_len, const crypto_pk_t *private_key)
Definition: signing.c:22
uint16_t router_get_advertised_or_port(const or_options_t *options)
Definition: router.c:1430
Header file for geoip_stats.c.
char extra_info_digest[DIGEST_LEN]
uint16_t router_get_advertised_or_port_by_af(const or_options_t *options, sa_family_t family)
Definition: router.c:1438
tor_addr_t addr
Definition: port_cfg_st.h:15
tor_addr_t addr
Header file for nodefamily.c.
static extrainfo_t * router_build_fresh_unsigned_extrainfo(const routerinfo_t *ri)
Definition: router.c:2104
int server_identity_key_is_set(void)
Definition: router.c:392
Header file for connection.c.
static int get_onion_key_rotation_days_(void)
Definition: router.c:753
const tor_addr_t * get_first_advertised_addr_by_type_af(int listener_type, int address_family)
Definition: config.c:7744
void smartlist_add_strdup(struct smartlist_t *sl, const char *string)
#define DEFAULT_ONION_KEY_LIFETIME_DAYS
Definition: or.h:140
#define LD_GENERAL
Definition: log.h:59
int should_refuse_unknown_exits(const or_options_t *options)
Definition: router.c:1331
char nickname[MAX_NICKNAME_LEN+1]
Definition: extrainfo_st.h:18
int replace_file(const char *from, const char *to)
Definition: files.c:117
static int router_guess_address_from_dir_headers(uint32_t *guess)
Definition: router.c:2635
time_t LastRotatedOnionKey
Definition: or_state_st.h:89
uint64_t BandwidthRate
char * pt_get_extra_info_descriptor_string(void)
Definition: transports.c:1619
int authdir_mode(const or_options_t *options)
Definition: authmode.c:25
di_digest256_map_t * construct_ntor_key_map(void)
Definition: router.c:283
int tor_tls_context_init(unsigned flags, crypto_pk_t *client_identity, crypto_pk_t *server_identity, unsigned int key_lifetime)
Definition: tortls.c:177
#define LOG_INFO
Definition: log.h:42
Header file for nodelist.c.
STATIC void router_update_routerinfo_from_extrainfo(routerinfo_t *ri, const extrainfo_t *ei)
Definition: router.c:2208
int curve25519_keypair_read_from_file(curve25519_keypair_t *keypair_out, char **tag_out, const char *fname)
static smartlist_t * warned_family
Definition: router.c:1823
void tor_log(int severity, log_domain_mask_t domain, const char *format,...)
Definition: log.c:632
char * rep_hist_get_bandwidth_lines(void)
Definition: rephist.c:1281
Header file for directory.c.
void smartlist_add(smartlist_t *sl, void *element)
static char server_identitykey_digest[DIGEST_LEN]
Definition: router.c:113
static int WRA_WAS_ADDED(was_router_added_t s)
Definition: routerlist.h:101
const char * signed_descriptor_get_body(const signed_descriptor_t *desc)
Definition: routerlist.c:794
void v3_authority_check_key_expiry(void)
Definition: router.c:704
int router_initialize_tls_context(void)
Definition: router.c:791
#define CONN_TYPE_OR_LISTENER
Definition: connection.h:21
int HiddenServiceStatistics
Header file for config.c.
Header file for authcert.c.
static routerinfo_t * desc_routerinfo
Definition: router.c:1480
Header file for nickname.c.
#define DIR_PURPOSE_UPLOAD_DIR
Definition: directory.h:43
int crypto_pk_write_public_key_to_string(crypto_pk_t *env, char **dest, size_t *len)
Definition: crypto_rsa.c:466
int fast_mem_is_zero(const char *mem, size_t len)
Definition: util_string.c:74
ed25519_public_key_t signing_key
Definition: torcert.h:28
#define MIN_ONION_KEY_LIFETIME_DAYS
Definition: or.h:134
#define MAX_UPTIME_BANDWIDTH_CHANGE
Definition: router.c:2447
void set_server_identity_key(crypto_pk_t *k)
Definition: router.c:337
static uint32_t tor_addr_to_ipv4h(const tor_addr_t *a)
Definition: address.h:152
char extra_info_digest256[DIGEST256_LEN]
STATIC time_t desc_clean_since
Definition: router.c:1488
char signed_descriptor_digest[DIGEST_LEN]
int crypto_rand_int_range(unsigned int min, unsigned int max)
static tor_mutex_t * key_lock
Definition: router.c:97
int should_record_bridge_info(const or_options_t *options)
Definition: geoip_stats.c:112
nodefamily_t * nodefamily_from_members(const smartlist_t *members, const uint8_t *rsa_id_self, unsigned flags, smartlist_t *unrecognized_out)
Definition: nodefamily.c:159
void ed25519_public_to_base64(char *output, const ed25519_public_key_t *pkey)
time_t get_onion_key_set_at(void)
Definition: router.c:329
int dirserv_add_own_fingerprint(crypto_pk_t *pk)
unsigned int supports_tunnelled_dir_requests
Definition: routerinfo_st.h:83
void directory_post_to_dirservers(uint8_t dir_purpose, uint8_t router_purpose, dirinfo_type_t type, const char *payload, size_t payload_len, size_t extrainfo_len)
Definition: dirclient.c:228
uint32_t get_last_resolved_addr(void)
Definition: config.c:2686
#define tor_free(p)
Definition: malloc.h:52
int is_legal_nickname_or_hexdigest(const char *s)
Definition: nickname.c:31
uint32_t bandwidthburst
Definition: routerinfo_st.h:53
#define FAST_RETRY_DESCRIPTOR_INTERVAL
Definition: router.c:2381
static void assert_identity_keys_ok(void)
Definition: router.c:361
struct config_line_t * MyFamily
#define LOG_NOTICE
Definition: log.h:47
static int router_dump_and_sign_extrainfo_descriptor_body(extrainfo_t *ei)
Definition: router.c:2143
crypto_pk_t * get_tlsclient_identity_key(void)
Definition: router.c:410
struct tor_cert_st * signing_key_cert
static int desc_needs_upload
Definition: router.c:1492
Header file for mainloop.c.
dirinfo_type_t
Definition: or.h:887
void dimap_add_entry(di_digest256_map_t **map, const uint8_t *key, void *val)
Definition: di_ops.c:173
void memwipe(void *mem, uint8_t byte, size_t sz)
Definition: crypto_util.c:57
const uint8_t * router_get_my_id_digest(void)
Definition: router.c:1600
smartlist_t * declared_family
Definition: routerinfo_st.h:62
static crypto_pk_t * client_identitykey
Definition: router.c:117
dir_server_t * router_get_trusteddirserver_by_digest(const char *digest)
Definition: dirlist.c:112
Header file for geoip.c.
signed_descriptor_t cache_info
void ed25519_signature_to_base64(char *output, const ed25519_signature_t *sig)
Header file for main.c.
char * router_dump_router_to_string(routerinfo_t *router, const crypto_pk_t *ident_key, const crypto_pk_t *tap_key, const curve25519_keypair_t *ntor_keypair, const ed25519_keypair_t *signing_keypair)
Definition: router.c:2670
unsigned signing_key_included
Definition: torcert.h:40
int trusted_dirs_load_certs_from_string(const char *contents, int source, int flush, const char *source_dir)
Definition: authcert.c:373
void smartlist_del_keeporder(smartlist_t *sl, int idx)
short_policy_t * parse_short_policy(const char *summary)
Definition: policies.c:2802
int base64_encode(char *dest, size_t destlen, const char *src, size_t srclen, int flags)
Definition: binascii.c:215
Header file for directory authority mode.
int curve25519_keypair_write_to_file(const curve25519_keypair_t *keypair, const char *fname, const char *tag)
void check_descriptor_ipaddress_changed(time_t now)
Definition: router.c:2524
size_t encoded_len
Definition: torcert.h:35
Header file for loadkey.c.
char * ContactInfo
int try_locking(const or_options_t *options, int err_if_locked)
Definition: main.c:677
const char * routerinfo_err_to_string(int err)
Definition: router.c:140
STATIC void get_platform_str(char *platform, size_t len)
Definition: router.c:2649
#define DIGEST256_LEN
Definition: digest_sizes.h:23
#define FORCE_REGENERATE_DESCRIPTOR_INTERVAL
Definition: router.c:2377
void policies_exit_policy_append_reject_star(smartlist_t **dest)
Definition: policies.c:2283
Header file for hibernate.c.
Header file for policies.c.
int get_first_advertised_port_by_type_af(int listener_type, int address_family)
Definition: config.c:7722
void set_client_identity_key(crypto_pk_t *k)
Definition: router.c:400
int is_legal_hexdigest(const char *s)
Definition: nickname.c:45
int directory_permits_begindir_requests(const or_options_t *options)
Definition: dirserv.c:159
int ed25519_pubkey_eq(const ed25519_public_key_t *key1, const ed25519_public_key_t *key2)
uint32_t bandwidthrate
Definition: routerinfo_st.h:51
int dirserv_load_fingerprint_file(void)
void router_reset_warnings(void)
Definition: router.c:3336
int client_identity_key_is_set(void)
Definition: router.c:419
Common functions for cryptographic routines.
crypto_pk_t * crypto_pk_asn1_decode(const char *str, size_t len)
static int load_authority_keyset(int legacy, crypto_pk_t **key_out, authority_cert_t **cert_out)
Definition: router.c:630
tor_assert(buffer)
#define MAX_BANDWIDTH_CHANGE_FREQ
Definition: router.c:2443
int init_keys(void)
Definition: router.c:926
static time_t onionkey_set_at
Definition: router.c:98
int router_extrainfo_digest_is_me(const char *digest)
Definition: router.c:1608
static int decide_if_publishable_server(void)
Definition: router.c:1354
#define tor_addr_from_ipv4h(dest, v4addr)
Definition: address.h:287
static tor_addr_t last_guessed_ip
Definition: router.c:2566
Header for crypto_format.c.
crypto_pk_t * get_my_v3_legacy_signing_key(void)
Definition: router.c:452
Header file for routermode.c.
was_router_added_t dirserv_add_descriptor(routerinfo_t *ri, const char **msg, const char *source)
int tor_memeq(const void *a, const void *b, size_t sz)
Definition: di_ops.c:107
void router_new_address_suggestion(const char *suggestion, const dir_connection_t *d_conn)
Definition: router.c:2573
int tor_asprintf(char **strp, const char *fmt,...)
Definition: printf.c:75
static crypto_pk_t * lastonionkey
Definition: router.c:103
unsigned int is_staledesc
int has_dns_init_failed(void)
Definition: dns.c:266
#define CFG_AUTO_PORT
Definition: or.h:990
int router_build_fresh_descriptor(routerinfo_t **r, extrainfo_t **e)
Definition: router.c:2270
int router_should_advertise_dirport(const or_options_t *options, uint16_t dir_port)
Definition: router.c:1309
smartlist_t * exit_policy
Definition: routerinfo_st.h:56
uint32_t get_effective_bwrate(const or_options_t *options)
Definition: config.c:1735
#define DIGEST_LEN
Definition: digest_sizes.h:20
void dup_onion_keys(crypto_pk_t **key, crypto_pk_t **last)
Definition: router.c:211
int load_ed_keys(const or_options_t *options, time_t now)
Definition: routerkeys.c:55
void smartlist_add_asprintf(struct smartlist_t *sl, const char *pattern,...)
Definition: smartlist.c:36
#define MAX_ONION_KEY_LIFETIME_DAYS
Definition: or.h:137
char identity[DIGEST_LEN]
Definition: node_st.h:40
void mark_my_descriptor_dirty_if_too_old(time_t now)
Definition: router.c:2386
dir_server_t * trusted_dir_server_new(const char *nickname, const char *address, uint16_t dir_port, uint16_t or_port, const tor_addr_port_t *ipv6_addrport, const char *digest, const char *v3_auth_digest, dirinfo_type_t type, double weight)
Definition: dirlist.c:308
routerinfo_t * router_parse_entry_from_string(const char *s, const char *end, int cache_copy, int allow_annotations, const char *prepend_annotations, int *can_dl_again_out)
Definition: routerparse.c:390
Master header file for Tor-specific functionality.
static int init_v3_authority_keys(void)
Definition: router.c:687
char * Nickname
Definition: or_options_st.h:68
int RefuseUnknownExits
const char * router_get_descriptor_gen_reason(void)
Definition: router.c:1704
size_t onion_pkey_len
Definition: routerinfo_st.h:36
int crypto_rand_int(unsigned int max)
int tor_addr_parse(tor_addr_t *addr, const char *src)
Definition: address.c:1196
static int decide_to_advertise_dir_impl(const or_options_t *options, uint16_t dir_port, int supports_tunnelled_dir_requests)
Definition: router.c:1278
void router_free_all(void)
Definition: router.c:3346
uint16_t router_get_advertised_dir_port(const or_options_t *options, uint16_t dirport)
Definition: router.c:1460
int routerinfo_err_is_transient(int err)
Definition: router.c:169
Header file for rephist.c.
uint8_t * make_tap_onion_key_crosscert(const crypto_pk_t *onion_key, const ed25519_public_key_t *master_id_key, const crypto_pk_t *rsa_id_key, int *len_out)
Definition: routerkeys.c:699
const char * fmt_addr32(uint32_t addr)
Definition: address.c:1180
static void set_onion_key(crypto_pk_t *k)
Definition: router.c:183
crypto_pk_t * signing_key
Header for crypto_ed25519.c.
#define LOG_WARN
Definition: log.h:50
int tor_addr_is_null(const tor_addr_t *addr)
Definition: address.c:769
enum or_options_t::@29 command
static int load_stats_file(const char *filename, const char *end_line, time_t now, char **out)
Definition: router.c:3070
int ConnDirectionStatistics
char * policy_dump_to_string(const smartlist_t *policy_list, int include_ipv4, int include_ipv6)
Definition: policies.c:3042
#define DEFAULT_ONION_KEY_GRACE_PERIOD_DAYS
Definition: or.h:148
void base16_encode(char *dest, size_t destlen, const char *src, size_t srclen)
Definition: binascii.c:478
Header file for authcert_parse.c.
int crypto_pk_get_hashed_fingerprint(crypto_pk_t *pk, char *fp_out)
Definition: crypto_rsa.c:254
static authority_cert_t * legacy_key_certificate
Definition: router.c:129
static void log_addr_has_changed(int severity, const tor_addr_t *prev, const tor_addr_t *cur, const char *source)
Definition: router.c:2493
authority_cert_t * authority_cert_parse_from_string(const char *s, size_t maxlen, const char **end_of_string)
void mark_my_descriptor_dirty(const char *reason)
Definition: router.c:2427
STATIC int router_write_fingerprint(int hashed)
Definition: router.c:829
int policy_is_reject_star(const smartlist_t *policy, sa_family_t family, int default_reject)
Definition: policies.c:2361
#define RFTS_IGNORE_MISSING
Definition: files.h:97
crypto_pk_t * crypto_pk_dup_key(crypto_pk_t *orig)
int BridgeAuthoritativeDir
Header file for process_descs.c.
static int router_should_advertise_begindir(const or_options_t *options, int supports_tunnelled_dir_requests)
Definition: router.c:1319
Headers for transports.c.
char * onion_pkey
Definition: routerinfo_st.h:34
void set_server_advertised(int s)
Definition: routermode.c:77
int router_get_router_hash(const char *s, size_t s_len, char *digest)
Definition: routerparse.c:176
#define LD_OR
Definition: log.h:89
int get_onion_key_grace_period(void)
Definition: router.c:777
int tor_digest_is_zero(const char *digest)
Definition: util_string.c:96
void digest256_to_base64(char *d64, const char *digest)
int dns_seems_to_be_broken(void)
Definition: dns.c:2066
#define MIN_ONION_KEY_GRACE_PERIOD_DAYS
Definition: or.h:145
int resolve_my_address(int warn_severity, const or_options_t *options, uint32_t *addr_out, const char **method_out, char **hostname_out)
Definition: config.c:2755
dirinfo_type_t type
Definition: dir_server_st.h:41
Headers and type declarations for protover.c.
#define LOG_ERR
Definition: log.h:53
static crypto_pk_t * server_identitykey
Definition: router.c:111
#define LD_FS
Definition: log.h:67
#define HEX_DIGEST_LEN
Definition: crypto_digest.h:35
struct short_policy_t * ipv6_exit_policy
Definition: routerinfo_st.h:60
#define LD_DIR
Definition: log.h:85
int generate_ed_link_cert(const or_options_t *options, time_t now, int force)
Definition: routerkeys.c:365
const char * geoip_db_digest(sa_family_t family)
Definition: geoip.c:467
tor_cert_t * make_ntor_onion_key_crosscert(const curve25519_keypair_t *onion_key, const ed25519_public_key_t *master_id_key, time_t now, time_t lifetime, int *sign_out)
Definition: routerkeys.c:676
char * nodefamily_format(const nodefamily_t *family)
Definition: nodefamily.c:374
static void log_new_relay_greeting(void)
Definition: router.c:536
void router_upload_dir_desc_to_dirservers(int force)
Definition: router.c:1499
int smartlist_contains_string(const smartlist_t *sl, const char *element)
Definition: smartlist.c:93
char identity_digest[DIGEST_LEN]
int crypto_pk_get_fingerprint(crypto_pk_t *pk, char *fp_out, int add_space)
Definition: crypto_rsa.c:229
int create_keys_directory(const or_options_t *options)
Definition: config.c:1378
void expire_old_onion_keys(void)
Definition: router.c:235
int tor_snprintf(char *str, size_t size, const char *format,...)
Definition: printf.c:27
void format_iso_time(char *buf, time_t t)
Definition: time_fmt.c:295
char * smartlist_join_strings(smartlist_t *sl, const char *join, int terminate, size_t *len_out)
Definition: smartlist.c:279
int router_compare_to_my_exit_policy(const tor_addr_t *addr, uint16_t port)
Definition: router.c:1545
int crypto_pk_get_digest(const crypto_pk_t *pk, char *digest_out)
Definition: crypto_rsa.c:356
const char * geoip_get_bridge_stats_extrainfo(time_t)
Definition: geoip_stats.c:1300
void rotate_onion_key(void)
Definition: router.c:465
char * rep_hist_get_padding_count_lines(void)
Definition: rephist.c:2829
void ntor_key_map_free_(di_digest256_map_t *map)
Definition: router.c:317
#define SMARTLIST_FOREACH(sl, type, var, cmd)
static curve25519_keypair_t last_curve25519_onion_key
Definition: router.c:108
char * protocol_list
Definition: routerinfo_st.h:47
#define MAX_EXTRAINFO_UPLOAD_SIZE
Definition: or.h:131
Header file for router.c.
STATIC extrainfo_t * router_build_fresh_signed_extrainfo(const routerinfo_t *ri)
Definition: router.c:2176
const char * escaped(const char *s)
Definition: escape.c:126
#define FINGERPRINT_LEN
Definition: crypto_rsa.h:34
void consider_publishable_server(int force)
Definition: router.c:1387
char * nickname
Definition: routerinfo_st.h:17
#define MIN_BW_TO_ADVERTISE_DIRSERVER
Definition: router.c:1183
uint16_t dir_port
Definition: routerinfo_st.h:21
int curve25519_keypair_generate(curve25519_keypair_t *keypair_out, int extra_strong)
#define log_fn(severity, domain, args,...)
Definition: log.h:266
crypto_pk_t * get_my_v3_authority_signing_key(void)
Definition: router.c:435
int router_has_bandwidth_to_be_dirserver(const or_options_t *options)
Definition: router.c:1189
int router_digest_is_me(const char *digest)
Definition: router.c:1592
const char * router_get_my_descriptor(void)
Definition: router.c:1675
crypto_pk_t * init_key_from_file(const char *fname, int generate, int severity, bool *created_out)
Definition: loadkey.c:40
authority_cert_t * get_my_v3_legacy_cert(void)
Definition: router.c:444
Headers for tortls.c.
dirinfo_type_t PublishServerDescriptor_
#define tor_addr_eq(a, b)
Definition: address.h:244
void tor_mutex_acquire(tor_mutex_t *m)
Definition: or.h:890
char v3_identity_digest[DIGEST_LEN]
Definition: dir_server_st.h:29
tor_mutex_t * tor_mutex_new(void)
Definition: compat_mutex.c:17
static int init_curve25519_keypair_from_file(curve25519_keypair_t *keys_out, const char *fname, int generate, int severity, const char *tag)
Definition: router.c:558
int ed25519_sign(ed25519_signature_t *signature_out, const uint8_t *msg, size_t len, const ed25519_keypair_t *keypair)
static int WRA_WAS_OUTDATED(was_router_added_t s)
Definition: routerlist.h:111
uint32_t bandwidthcapacity
Definition: routerinfo_st.h:55
void or_state_mark_dirty(or_state_t *state, time_t when)
Definition: statefile.c:715
MOCK_IMPL(crypto_pk_t *, get_onion_key,(void))
Definition: router.c:199
#define BASE64_DIGEST256_LEN
Definition: crypto_digest.h:29
char * write_short_policy(const short_policy_t *policy)
Definition: policies.c:2903
char * router_dump_exit_policy_to_string(const routerinfo_t *router, int include_ipv4, int include_ipv6)
Definition: router.c:3049
Header file for dirlist.c.
int get_onion_key_lifetime(void)
Definition: router.c:767
uint32_t addr
Definition: routerinfo_st.h:19
crypto_pk_t * crypto_pk_copy_full(crypto_pk_t *orig)
struct config_line_t * ServerTransportPlugin
int base16_decode(char *dest, size_t destlen, const char *src, size_t srclen)
Definition: binascii.c:506
int router_append_dirobj_signature(char *buf, size_t buf_len, const char *digest, size_t digest_len, crypto_pk_t *private_key)
Definition: signing.c:79
int extrainfo_dump_to_string(char **s_out, extrainfo_t *extrainfo, crypto_pk_t *ident_key, const ed25519_keypair_t *signing_keypair)
Definition: router.c:3125
Header file for selftest.c.
char * platform
Definition: routerinfo_st.h:45
static curve25519_keypair_t curve25519_onion_key
Definition: router.c:105
int accounting_get_interval_length(void)
Definition: hibernate.c:315
uint8_t purpose
#define BANDWIDTH_CHANGE_FACTOR
Definition: router.c:2450
int control_event_server_status(int severity, const char *format,...)
STATIC smartlist_t * get_my_declared_family(const or_options_t *options)
Definition: router.c:1831
int tor_digest256_is_zero(const char *digest)
Definition: util_string.c:103
void ip_address_changed(int at_interface)
Definition: mainloop.c:2258
int crypto_digest256(char *digest, const char *m, size_t len, digest_algorithm_t algorithm)
STATIC int router_dump_and_sign_routerinfo_descriptor_body(routerinfo_t *ri)
Definition: router.c:2236
int parse_iso_time(const char *cp, time_t *t)
Definition: time_fmt.c:392
uint8_t digest256[DIGEST256_LEN]
Definition: extrainfo_st.h:16
tor_addr_t ipv6_addr
Definition: routerinfo_st.h:27
char * BridgeDistribution
int crypto_pk_asn1_encode(const crypto_pk_t *pk, char *dest, size_t dest_len)
void tor_addr_copy(tor_addr_t *dest, const tor_addr_t *src)
Definition: address.c:903
uint64_t RelayBandwidthRate
int ExtraInfoStatistics
int crypto_pk_write_private_key_to_filename(crypto_pk_t *env, const char *fname)
Definition: crypto_rsa.c:595
static crypto_pk_t * authority_signing_key
Definition: router.c:119
uint16_t router_get_active_listener_port_by_type_af(int listener_type, sa_family_t family)
Definition: router.c:1409
static authority_cert_t * authority_key_certificate
Definition: router.c:122
int routerinfo_incompatible_with_extrainfo(const crypto_pk_t *identity_pkey, extrainfo_t *ei, signed_descriptor_t *sd, const char **msg)
Definition: routerlist.c:2954
Header file for control_events.c.
void smartlist_clear(smartlist_t *sl)
void check_descriptor_bandwidth_changed(time_t now)
Definition: router.c:2456
static crypto_pk_t * legacy_signing_key
Definition: router.c:126
int router_get_extrainfo_hash(const char *s, size_t s_len, char *digest)
Definition: routerparse.c:186
uint32_t get_effective_bwburst(const or_options_t *options)
Definition: config.c:1749
int check_whether_orport_reachable(const or_options_t *options)
Definition: selftest.c:75
static crypto_pk_t * onionkey
Definition: router.c:100
crypto_pk_t * identity_pkey
Definition: routerinfo_st.h:38
file_status_t file_status(const char *filename)
Definition: files.c:212
Header file for networkstatus.c.
int crypto_global_init(int useAccel, const char *accelName, const char *accelDir)
Definition: crypto_init.c:85
#define LD_BUG
Definition: log.h:83
Header file for dns.c.
Headers for crypto_init.c.
int control_event_my_descriptor_changed(void)
#define LD_CONFIG
Definition: log.h:65
#define CURVE25519_PUBKEY_LEN
Definition: x25519_sizes.h:20
Header file for routerlist.c.
Header file for routerparse.c.
static void ntor_key_map_free_helper(void *arg)
Definition: router.c:309
uint16_t or_port
Definition: routerinfo_st.h:20
const char * protover_get_supported_protocols(void)
C_RUST_COUPLED: src/rust/protover/protover.rs SUPPORTED_PROTOCOLS
Definition: protover.c:388
int policies_parse_exit_policy_from_options(const or_options_t *or_options, uint32_t local_address, const tor_addr_t *ipv6_local_address, smartlist_t **result)
Definition: policies.c:2220
static sa_family_t tor_addr_family(const tor_addr_t *a)
Definition: address.h:179
int check_whether_dirport_reachable(const or_options_t *options)
Definition: selftest.c:92
STATIC const char * desc_dirty_reason
Definition: router.c:1490
int smartlist_split_string(smartlist_t *sl, const char *str, const char *sep, int flags, int max)
char * tor_dup_ip(uint32_t addr)
Definition: address.c:1890