56#define CONNECTION_EDGE_PRIVATE
84#include "feature/client/circpathbias.h"
116#include "core/or/or_circuit_st.h"
122#ifdef HAVE_LINUX_TYPES_H
123#include <linux/types.h>
125#ifdef HAVE_LINUX_NETFILTER_IPV4_H
126#include <linux/netfilter_ipv4.h>
127#define TRANS_NETFILTER
128#define TRANS_NETFILTER_IPV4
131#ifdef HAVE_LINUX_IF_H
135#ifdef HAVE_LINUX_NETFILTER_IPV6_IP6_TABLES_H
136#include <linux/netfilter_ipv6/ip6_tables.h>
137#if defined(IP6T_SO_ORIGINAL_DST)
138#define TRANS_NETFILTER
139#define TRANS_NETFILTER_IPV6
146#ifdef HAVE_SYS_IOCTL_H
147#include <sys/ioctl.h>
149#ifdef HAVE_SYS_PARAM_H
150#include <sys/param.h>
153#if defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H)
155#include <net/pfvar.h>
163#define SOCKS4_GRANTED 90
164#define SOCKS4_REJECT 91
183 c->
magic == ENTRY_CONNECTION_MAGIC);
255 int line,
const char *file))
270 "stream (marked at %s:%d) sending two socks replies?",
277 RESOLVED_TYPE_ERROR_TRANSIENT,
293 if (connection_get_inbuf_len(
TO_CONN(conn)) &&
298 log_info(
LD_EDGE,
"conn (fd "TOR_SOCKET_T_FORMAT
") reached eof. Closing.",
309 connection_mark_for_close(
TO_CONN(conn));
329 switch (conn->base_.
state) {
348 if (! conn->base_.
linked) {
356 connection_mark_for_close(
TO_CONN(conn));
363 "data from edge while in '%s' state. Sending it anyway. "
364 "package_partial=%d, buflen=%ld",
367 (
long)connection_get_inbuf_len(
TO_CONN(conn)));
370 connection_mark_for_close(
TO_CONN(conn));
384 "data from edge while in '%s' state. Leaving it on buffer.",
388 log_warn(
LD_BUG,
"Got unexpected state %d. Closing.",conn->base_.
state);
391 connection_mark_for_close(
TO_CONN(conn));
402 log_info(
LD_EDGE,
"CircID %u: At an edge. Marking connection for close.",
406 connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_DESTROY);
409 END_STREAM_REASON_DESTROY);
416 connection_mark_and_flush(
TO_CONN(conn));
437 reason = END_STREAM_REASON_MISC;
440 payload[0] = (char) reason;
446 return relay_send_command_from_edge(stream_id, circ, RELAY_COMMAND_END,
447 payload, 1, cpath_layer);
461 (reason == END_STREAM_REASON_CONNECTREFUSED ||
462 reason == END_STREAM_REASON_TIMEOUT)) {
463#define WARN_FAILED_HS_CONNECTION 300
464 static ratelim_t warn_limit = RATELIM_INIT(WARN_FAILED_HS_CONNECTION);
467 log_warn(
LD_EDGE,
"Onion service connection to %s failed (%s)",
516 size_t payload_len=1;
518 uint8_t control_reason = reason;
521 log_warn(
LD_BUG,
"(Harmless.) Calling connection_edge_end (reason %d) "
522 "on an already ended stream?", reason);
529 "called on conn that's already marked for close at %s:%d.",
539 reason = END_STREAM_REASON_MISC;
542 payload[0] = (char)reason;
543 if (reason == END_STREAM_REASON_EXITPOLICY &&
554 payload_len += 4+addrlen;
558 log_debug(
LD_EDGE,
"Sending end on conn (fd "TOR_SOCKET_T_FORMAT
").",
567 payload, payload_len);
570 warn_if_hs_unreachable(conn, control_reason);
572 log_debug(
LD_EDGE,
"No circ to send end on conn "
573 "(fd "TOR_SOCKET_T_FORMAT
").",
623 log_warn(
LD_BUG,
"Duplicate stream close for stream %d on circuit %d",
650 if (conn->hs_ident) {
693 } SMARTLIST_FOREACH_END(half_conn);
832 int found, remove_idx;
843 half = smartlist_get(half_conns, remove_idx);
845 half_edge_free(half);
882 switch (conn->base_.
state) {
884 if (! conn->base_.
linked) {
911 switch (conn->base_.
state) {
926 log_warn(
LD_BUG,
"Called in unexpected state %d.",conn->base_.
state);
936#define MAX_CONNECTED_CELL_PAYLOAD_LEN 25
950 int connected_payload_len;
955 if (family == AF_INET) {
957 connected_payload_len = 4;
958 }
else if (family == AF_INET6) {
962 connected_payload_len = 21;
967 set_uint32(payload_out + connected_payload_len, htonl(ttl));
968 connected_payload_len += 4;
972 return connected_payload_len;
986 const char dst_ipv6[] =
"::1";
988 const char src_ipv6_prefix[] =
"fc00:dead:beef:4dad:";
989 uint16_t dst_port = 0;
990 uint16_t src_port = 1;
996 src_port = gid & 0x0000ffff;
1000 if (edge_conn->hs_ident) {
1007 gid >> 16, gid & 0x0000ffff,
1008 dst_ipv6, src_port, dst_port);
1010 connection_buf_add(buf, strlen(buf),
TO_CONN(edge_conn));
1028 log_info(LD_EXIT,
"%s established.",
1036 if (connection_get_outbuf_len(conn))
1042 RELAY_COMMAND_CONNECTED, NULL, 0) < 0)
1046 int connected_payload_len =
1049 if (connected_payload_len < 0)
1053 RELAY_COMMAND_CONNECTED,
1054 (
char*)connected_payload, connected_payload_len) < 0)
1070static int untried_pending_connections = 0;
1084 log_warn(
LD_BUG,
"(Harmless.) Edge connection (marked at %s:%d) "
1085 "hasn't sent end yet?",
1105 log_warn(
LD_BUG,
"Closing stream (marked at %s:%d) without sending"
1106 " back a socks reply.",
1110 log_warn(
LD_BUG,
"Closing stream (marked at %s:%d) without having"
1115 log_warn(
LD_BUG,
"Closing stream (marked at %s:%d) without having"
1116 " replied to DNS request.",
1129 connection_ap_warn_and_unmark_if_pending_circ(entry_conn,
1191 time_t now = time(NULL);
1195 int seconds_idle, seconds_since_born;
1199 if (base_conn->type !=
CONN_TYPE_AP || base_conn->marked_for_close)
1206 seconds_idle = (int)( now - base_conn->timestamp_last_read_allowed );
1207 seconds_since_born = (int)( now - base_conn->timestamp_created );
1222 "Tried for %d seconds to get a connection to %s:%d. "
1228 connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
1237 if (seconds_idle < cutoff)
1241 log_info(
LD_APP,
"Conn is waiting (address %s), but lost its circ.",
1243 connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
1249 "Rend stream is %d seconds late. Giving up on address"
1258 connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
1264 circ->
purpose != CIRCUIT_PURPOSE_CONFLUX_LINKED &&
1270 log_warn(
LD_BUG,
"circuit->purpose == CIRCUIT_PURPOSE_C_GENERAL failed. "
1271 "The purpose on the circuit was %s; it was in state %s, "
1280 "We tried for %d seconds to connect to '%s' using exit %s."
1281 " Retrying on a new circuit.",
1302 END_STREAM_REASON_TIMEOUT)<0) {
1303 if (!base_conn->marked_for_close)
1304 connection_mark_unattached_ap(entry_conn,
1307 } SMARTLIST_FOREACH_END(base_conn);
1324 if (conn->marked_for_close ||
1332 log_warn(
LD_BUG,
"Found a connection %p that was supposed to be "
1333 "in pending_entry_connections, but wasn't. No worries; "
1336 untried_pending_connections = 1;
1337 connection_ap_mark_as_pending_circuit(entry_conn);
1340 } SMARTLIST_FOREACH_END(conn);
1359 if (untried_pending_connections == 0 && !retry)
1375 if (conn->
magic != ENTRY_CONNECTION_MAGIC) {
1376 log_warn(
LD_BUG,
"%p has impossible magic value %u.",
1377 entry_conn, (
unsigned)conn->
magic);
1391 connection_mark_unattached_ap(entry_conn,
1409 } SMARTLIST_FOREACH_END(entry_conn);
1411 smartlist_free(pending);
1412 untried_pending_connections = 0;
1432 const char *fname,
int lineno)
1445 attach_pending_entry_connections_cb, NULL);
1449 log_warn(
LD_BUG,
"What?? pending_entry_connections already contains %p! "
1450 "(Called from %s:%d.)",
1451 entry_conn, fname, lineno);
1452#ifdef DEBUGGING_17659
1453 const char *f2 = entry_conn->marked_pending_circ_file;
1454 log_warn(
LD_BUG,
"(Previously called from %s:%d.)\n",
1456 entry_conn->marked_pending_circ_line);
1462#ifdef DEBUGGING_17659
1463 entry_conn->marked_pending_circ_line = (uint16_t) lineno;
1464 entry_conn->marked_pending_circ_file = fname;
1467 untried_pending_connections = 1;
1504 log_warn(
LD_BUG,
"What was %p doing in pending_entry_connections in %s?",
1523 if (conn->marked_for_close ||
1545 log_info(
LD_APP,
"Closing one-hop stream to '%s/%s' because the OR conn "
1548 connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
1549 } SMARTLIST_FOREACH_END(conn);
1564 if (conn->marked_for_close ||
1573 NNF_NO_WARN_UNNAMED);
1575 if (!r1 || !r2 || r1 != r2)
1579 log_info(
LD_APP,
"Giving up on enclave exit '%s' for destination %s.",
1597 } SMARTLIST_FOREACH_END(conn);
1605 CONNECTION_AP_EXPECT_NONPENDING(conn);
1623 ENTRY_TO_CONN(conn)->timestamp_last_read_allowed = time(NULL);
1639 connection_ap_mark_as_pending_circuit(conn);
1657 log_warn(
LD_APP,
"Application request to port %d: this port is "
1658 "commonly used for unencrypted protocols. Please make sure "
1659 "you don't send anything you would mind the rest of the "
1660 "Internet reading!%s", port, reject ?
" Closing." :
"");
1662 port, reject ?
"REJECT" :
"WARN");
1666 log_info(
LD_APP,
"Port %d listed in RejectPlaintextPorts. Closing.", port);
1667 connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
1705 s = strrchr(address,
'.');
1707 *type_out = NORMAL_HOSTNAME;
1710 if (!strcmp(s+1,
"exit")) {
1712 *type_out = EXIT_HOSTNAME;
1715 if (strcmp(s+1,
"onion")) {
1716 *type_out = NORMAL_HOSTNAME;
1723 q = strrchr(address,
'.');
1725 *type_out = BAD_HOSTNAME;
1728 q = (NULL == q) ? address : q + 1;
1731 *type_out = BAD_HOSTNAME;
1735 memmove(address, q, strlen(q) + 1 );
1740 *type_out = ONION_V3_HOSTNAME;
1748 *type_out = BAD_HOSTNAME;
1756 const bool is_onion = (*type_out == ONION_V3_HOSTNAME);
1757 log_warn(
LD_APP,
"Invalid %shostname %s; rejecting",
1758 is_onion ?
"onion " :
"",
1759 safe_str_client(address));
1760 if (*type_out == ONION_V3_HOSTNAME) {
1761 *type_out = BAD_HOSTNAME;
1769#define TRACKHOSTEXITS_RETRIES 5
1797 rewrite_result_t *out)
1806 out->map_expires = TIME_MAX;
1807 out->end_reason = 0;
1808 out->should_close = 0;
1809 out->orig_address[0] = 0;
1814 strlcpy(out->orig_address, socks->
address,
sizeof(out->orig_address));
1815 log_debug(
LD_APP,
"Client asked for %s:%d",
1816 safe_str_client(socks->
address),
1823 static ratelim_t exit_warning_limit = RATELIM_INIT(60*15);
1825 "The \".exit\" notation is disabled in Tor due to "
1829 out->end_reason = END_STREAM_REASON_TORPROTOCOL;
1830 out->should_close = 1;
1849 const unsigned rewrite_flags = AMR_FLAG_USE_MAPADDRESS;
1851 rewrite_flags, &out->map_expires, &out->exit_source)) {
1871 const char *new_addr;
1874 int addr_type = RESOLVED_TYPE_IPV4;
1876 if (!conn->entry_cfg.ipv4_traffic ||
1877 (conn->entry_cfg.ipv6_traffic && conn->entry_cfg.prefer_ipv6) ||
1879 addr_type = RESOLVED_TYPE_IPV6;
1886 addr_type, tor_strdup(socks->
address));
1888 log_warn(
LD_APP,
"Unable to automap address %s",
1890 out->end_reason = END_STREAM_REASON_INTERNAL;
1891 out->should_close = 1;
1894 log_info(
LD_APP,
"Automapping %s to %s",
1896 safe_str_client(new_addr));
1905 unsigned rewrite_flags = 0;
1907 rewrite_flags |= AMR_FLAG_USE_IPV4_DNS;
1908 if (conn->entry_cfg.use_cached_ipv6_answers)
1909 rewrite_flags |= AMR_FLAG_USE_IPV6_DNS;
1912 rewrite_flags, &out->map_expires)) {
1913 char *result = tor_strdup(socks->
address);
1918 strlen(result), (uint8_t*)result,
1922 out->end_reason = END_STREAM_REASON_DONE |
1924 out->should_close = 1;
1936 &addr, socks->
address, AF_UNSPEC, 1);
1937 if (ok == 1 && tor_addr_is_internal(&addr, 0)) {
1939 0, NULL, -1, TIME_MAX);
1942 out->should_close = 1;
1957 unsigned rewrite_flags = AMR_FLAG_USE_AUTOMAP | AMR_FLAG_USE_TRACKEXIT;
1960 rewrite_flags |= AMR_FLAG_USE_IPV4_DNS;
1961 if (conn->entry_cfg.use_cached_ipv6_answers)
1962 rewrite_flags |= AMR_FLAG_USE_IPV6_DNS;
1964 rewrite_flags, &out->map_expires, &exit_source2)) {
1971 out->exit_source = exit_source2;
1984 log_warn(
LD_APP,
"Missing mapping for virtual address '%s'. Refusing.",
1985 safe_str_client(socks->
address));
1986 out->end_reason = END_STREAM_REASON_INTERNAL;
1987 out->should_close = 1;
2004 if (!conn->entry_cfg.onion_traffic) {
2005 log_warn(
LD_APP,
"Onion address %s requested from a port with .onion "
2006 "disabled", safe_str_client(socks->
address));
2007 connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
2013 if (SOCKS_COMMAND_IS_RESOLVE(socks->
command)) {
2017 "Resolve requests to hidden services not allowed. Failing.");
2019 0,NULL,-1,TIME_MAX);
2020 connection_mark_unattached_ap(conn,
2029 log_warn(
LD_CONTROL,
"Attachstream to a circuit is not "
2030 "supported for .onion addresses currently. Failing.");
2031 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2035 int descriptor_is_usable = 0;
2044 log_warn(
LD_GENERAL,
"failed to parse hs address");
2052 unsigned int refetch_desc = 0;
2055 descriptor_is_usable =
2063 log_info(
LD_REND,
"Descriptor PoW parameters have expired.");
2064 descriptor_is_usable = 0;
2071 log_info(
LD_GENERAL,
"Found %s descriptor in cache for %s. %s.",
2072 (descriptor_is_usable) ?
"usable" :
"unusable",
2073 safe_str_client(socks->
address),
2074 (descriptor_is_usable) ?
"Not fetching." :
"Refetching.");
2077 log_info(
LD_REND,
"No descriptor found in our cache for %s. Fetching.",
2078 safe_str_client(socks->
address));
2090 if (refetch_desc || !descriptor_is_usable) {
2117 log_info(
LD_REND,
"Descriptor is here. Great.");
2122 connection_ap_mark_as_pending_circuit(conn);
2149 time_t now = time(NULL);
2150 rewrite_result_t rr;
2155 memset(&rr, 0,
sizeof(rr));
2156 connection_ap_handshake_rewrite(conn,&rr);
2158 if (rr.should_close) {
2162 connection_mark_unattached_ap(conn, rr.end_reason);
2169 const time_t map_expires = rr.map_expires;
2170 const int automap = rr.automap;
2179 if (addresstype == BAD_HOSTNAME) {
2182 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2192 if (addresstype == EXIT_HOSTNAME) {
2197 const node_t *node = NULL;
2205 log_warn(
LD_APP,
"Stale automapped address for '%s.exit'. Refusing.",
2206 safe_str_client(socks->
address));
2209 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2219 log_warn(
LD_BUG,
"Address '%s.exit', with impossible source for the "
2220 ".exit part. Refusing.",
2221 safe_str_client(socks->
address));
2224 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2235 char *s = strrchr(socks->
address,
'.');
2250 log_warn(
LD_APP,
"Malformed exit address '%s.exit'. Refusing.",
2251 safe_str_client(socks->
address));
2254 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2272 "Unrecognized relay in exit address '%s.exit'. Refusing.",
2273 safe_str_client(socks->
address));
2274 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2280 "Excluded relay in exit address '%s.exit'. Refusing.",
2281 safe_str_client(socks->
address));
2282 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2291 if (addresstype != ONION_V3_HOSTNAME) {
2302 "Destination '%s' seems to be an invalid hostname. Failing.",
2303 safe_str_client(socks->
address));
2304 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2319 if (!conn->entry_cfg.dns_request && !conn->entry_cfg.ipv4_traffic
2320 && !conn->entry_cfg.ipv6_traffic) {
2321 log_warn(
LD_APP,
"Refusing to connect to non-hidden-service hostname "
2322 "or IP address %s because Port has OnionTrafficOnly set (or "
2323 "NoDNSRequest, NoIPv4Traffic, and NoIPv6Traffic).",
2324 safe_str_client(socks->
address));
2325 connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
2334 if (socks_family == -1) {
2335 if (!conn->entry_cfg.dns_request) {
2336 log_warn(
LD_APP,
"Refusing to connect to hostname %s "
2337 "because Port has NoDNSRequest set.",
2338 safe_str_client(socks->
address));
2339 connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
2342 }
else if (socks_family == AF_INET) {
2343 if (!conn->entry_cfg.ipv4_traffic) {
2344 log_warn(
LD_APP,
"Refusing to connect to IPv4 address %s because "
2345 "Port has NoIPv4Traffic set.",
2346 safe_str_client(socks->
address));
2347 connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
2350 }
else if (socks_family == AF_INET6) {
2351 if (!conn->entry_cfg.ipv6_traffic) {
2352 log_warn(
LD_APP,
"Refusing to connect to IPv6 address %s because "
2353 "Port has NoIPv6Traffic set.",
2354 safe_str_client(socks->
address));
2355 connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
2359 tor_assert_nonfatal_unreached_once();
2370 strlcpy(socks->
address, rr.orig_address,
sizeof(socks->
address));
2373 connection_mark_unattached_ap(conn,
2374 END_STREAM_REASON_DONE |
2385 if (socks->
port == 0) {
2386 log_notice(
LD_APP,
"Application asked to connect to port 0. Refusing.");
2387 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2401 tor_addr_is_internal(&addr, 0))) {
2406#define WARN_INTRVL_LOOP 300
2407 static ratelim_t loop_warn_limit = RATELIM_INIT(WARN_INTRVL_LOOP);
2411 "Rejecting request for anonymous connection to private "
2412 "address %s on a TransPort or NATDPort. Possible loop "
2413 "in your NAT rules?%s", safe_str_client(socks->
address),
2418#define WARN_INTRVL_PRIV 300
2419 static ratelim_t priv_warn_limit = RATELIM_INIT(WARN_INTRVL_PRIV);
2423 "Rejecting SOCKS request for anonymous connection to "
2424 "private address %s.%s",
2425 safe_str_client(socks->
address),m);
2445 if ((family == AF_INET && ! conn->entry_cfg.ipv4_traffic) ||
2446 (family == AF_INET6 && ! conn->entry_cfg.ipv6_traffic)) {
2449 log_warn(
LD_NET,
"Rejecting SOCKS request for an IP address "
2450 "family that this listener does not support.");
2451 connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
2453 }
else if (family == AF_INET6 && socks->
socks_version == 4) {
2456 log_warn(
LD_NET,
"Rejecting SOCKS4 request for an IPv6 address.");
2457 connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
2460 !conn->entry_cfg.ipv4_traffic) {
2464 log_warn(
LD_NET,
"Rejecting SOCKS4 request on a listener with "
2465 "no IPv4 traffic supported.");
2466 connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
2468 }
else if (family == AF_INET6) {
2471 conn->entry_cfg.ipv4_traffic = 0;
2472 }
else if (family == AF_INET) {
2475 conn->entry_cfg.ipv6_traffic = 0;
2487 log_warn(
LD_APP,
"Not attempting connection to %s:%d because "
2488 "the network would reject it. Are you trying to send "
2489 "Tor traffic over Tor? This traffic can be harmful to "
2490 "the Tor network. If you really need it, try using "
2491 "a bridge as a workaround.",
2493 connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
2501 conn->entry_cfg.ipv6_traffic = 0;
2515 "Redirecting address %s to exit at enclave router %s",
2559 connection_ap_mark_as_pending_circuit(conn);
2576 tor_assert(addresstype == ONION_V3_HOSTNAME);
2585static int pf_socket = -1;
2603 log_warn(
LD_NET,
"open(\"/dev/pf\") failed: %s", strerror(errno));
2612#if defined(TRANS_NETFILTER) || defined(TRANS_PF) || \
2613 defined(TRANS_TPROXY)
2619 struct sockaddr_storage orig_dst;
2620 socklen_t orig_dst_len =
sizeof(orig_dst);
2625 if (getsockname(
ENTRY_TO_CONN(conn)->s, (
struct sockaddr*)&orig_dst,
2626 &orig_dst_len) < 0) {
2628 log_warn(
LD_NET,
"getsockname() failed: %s", tor_socket_strerror(e));
2635#ifdef TRANS_NETFILTER
2638#ifdef TRANS_NETFILTER_IPV4
2640 rv = getsockopt(
ENTRY_TO_CONN(conn)->s, SOL_IP, SO_ORIGINAL_DST,
2641 (
struct sockaddr*)&orig_dst, &orig_dst_len);
2644#ifdef TRANS_NETFILTER_IPV6
2646 rv = getsockopt(
ENTRY_TO_CONN(conn)->s, SOL_IPV6, IP6T_SO_ORIGINAL_DST,
2647 (
struct sockaddr*)&orig_dst, &orig_dst_len);
2651 log_warn(
LD_BUG,
"Received transparent data from an unsupported "
2658 log_warn(
LD_NET,
"getsockopt() failed: %s", tor_socket_strerror(e));
2662#elif defined(TRANS_PF)
2663 if (getsockname(
ENTRY_TO_CONN(conn)->s, (
struct sockaddr*)&orig_dst,
2664 &orig_dst_len) < 0) {
2666 log_warn(
LD_NET,
"getsockname() failed: %s", tor_socket_strerror(e));
2673 log_warn(
LD_BUG,
"Unable to determine destination from socket.");
2689 struct sockaddr_storage proxy_addr;
2690 socklen_t proxy_addr_len =
sizeof(proxy_addr);
2691 struct sockaddr *proxy_sa = (
struct sockaddr*) &proxy_addr;
2692 struct pfioc_natlook pnl;
2696 if (getsockname(
ENTRY_TO_CONN(conn)->s, (
struct sockaddr*)&proxy_addr,
2697 &proxy_addr_len) < 0) {
2699 log_warn(
LD_NET,
"getsockname() to determine transocks destination "
2700 "failed: %s", tor_socket_strerror(e));
2705 if (
get_options()->TransProxyType_parsed == TPT_IPFW) {
2719 memset(&pnl, 0,
sizeof(pnl));
2720 pnl.proto = IPPROTO_TCP;
2721 pnl.direction = PF_OUT;
2722 if (proxy_sa->sa_family == AF_INET) {
2723 struct sockaddr_in *sin = (
struct sockaddr_in *)proxy_sa;
2727 pnl.daddr.v4.s_addr = sin->sin_addr.s_addr;
2728 pnl.dport = sin->sin_port;
2729 }
else if (proxy_sa->sa_family == AF_INET6) {
2736 memcpy(&pnl.saddr.v6, dest_in6,
sizeof(
struct in6_addr));
2738 memcpy(&pnl.daddr.v6, &sin6->sin6_addr,
sizeof(
struct in6_addr));
2739 pnl.dport = sin6->sin6_port;
2741 log_warn(
LD_NET,
"getsockname() gave an unexpected address family (%d)",
2742 (
int)proxy_sa->sa_family);
2746 pf = get_pf_socket();
2750 if (ioctl(pf, DIOCNATLOOK, &pnl) < 0) {
2751 log_warn(
LD_NET,
"ioctl(DIOCNATLOOK) failed: %s", strerror(errno));
2755 if (pnl.af == AF_INET) {
2757 }
else if (pnl.af == AF_INET6) {
2765 req->
port = ntohs(pnl.rdport);
2782#ifdef TRANS_NETFILTER
2783 return destination_from_socket(conn, req);
2784#elif defined(TRANS_PF)
2788 return destination_from_socket(conn, req);
2792 return destination_from_pf(conn, req);
2796 log_warn(
LD_BUG,
"Proxy destination determination mechanism %s unknown.",
2802 log_warn(
LD_BUG,
"Called connection_ap_get_original_destination, but no "
2803 "transparent proxy method was configured.");
2833 log_debug(
LD_APP,
"entered.");
2840 connection_buf_add((
const char*)socks->
reply, socks->
replylen,
2843 if (sockshere == -1) {
2850 if (sockshere == 0) {
2851 log_debug(
LD_APP,
"socks handshake not all here yet.");
2853 }
else if (sockshere == -1) {
2855 log_warn(
LD_APP,
"Fetching socks handshake failed. Closing.");
2859 connection_mark_unattached_ap(conn,
2865 if (SOCKS_COMMAND_IS_CONNECT(socks->
command))
2894 log_debug(
LD_APP,
"entered.");
2897 log_warn(
LD_APP,
"Fetching original destination failed. Closing.");
2898 connection_mark_unattached_ap(conn,
2923 char tmp_buf[36], *tbuf, *daddr;
2933 log_debug(
LD_APP,
"entered.");
2941 log_warn(
LD_APP,
"NATD handshake failed (DEST too long). Closing");
2947 log_warn(
LD_APP,
"NATD handshake was ill-formed; closing. The client "
2954 daddr = tbuf = &tmp_buf[0] + 6;
2955 if (!(tbuf = strchr(tbuf,
' '))) {
2956 log_warn(
LD_APP,
"NATD handshake was ill-formed; closing. The client "
2967 socks->
port = (uint16_t)
2970 log_warn(
LD_APP,
"NATD handshake failed; port %s is ill-formed or out "
2986static const char HTTP_CONNECT_IS_NOT_AN_HTTP_PROXY_MSG[] =
2987 "HTTP/1.0 405 Method Not Allowed\r\n"
2988 "Content-Type: text/html; charset=iso-8859-1\r\n\r\n"
2991 "<title>This is an HTTP CONNECT tunnel, not a full HTTP Proxy</title>\n"
2994 "<h1>This is an HTTP CONNECT tunnel, not an HTTP proxy.</h1>\n"
2996 "It appears you have configured your web browser to use this Tor port as\n"
2999 "This is not correct: This port is configured as a CONNECT tunnel, not\n"
3000 "an HTTP proxy. Please configure your client accordingly. You can also\n"
3001 "use HTTPS; then the client should automatically use HTTP CONNECT."
3004 "See <a href=\"https://www.torproject.org/documentation.html\">"
3005 "https://www.torproject.org/documentation.html</a> for more "
3023 char *headers = NULL, *body = NULL;
3024 char *
command = NULL, *addrport = NULL;
3028 const char *errmsg = NULL;
3031 const int http_status =
3033 &body, &bodylen, 1024, 0);
3034 if (http_status < 0) {
3036 errmsg =
"HTTP/1.0 400 Bad Request\r\n\r\n";
3038 }
else if (http_status == 0) {
3044 if (cmd_status < 0) {
3045 errmsg =
"HTTP/1.0 400 Bad Request\r\n\r\n";
3050 if (strcasecmp(
command,
"connect")) {
3051 errmsg = HTTP_CONNECT_IS_NOT_AN_HTTP_PROXY_MSG;
3059 errmsg =
"HTTP/1.0 400 Bad Request\r\n\r\n";
3062 if (strlen(addr) >= MAX_SOCKS_ADDR_LEN) {
3063 errmsg =
"HTTP/1.0 414 Request-URI Too Long\r\n\r\n";
3070 char *authorization =
http_get_header(headers,
"Proxy-Authorization: ");
3071 if (authorization) {
3075 char *isolation =
http_get_header(headers,
"X-Tor-Stream-Isolation: ");
3096 if (BUG(errmsg == NULL))
3097 errmsg =
"HTTP/1.0 400 Bad Request\r\n\r\n";
3098 log_info(
LD_EDGE,
"HTTP tunnel error: saying %s",
escaped(errmsg));
3099 connection_buf_add(errmsg, strlen(errmsg),
ENTRY_TO_CONN(conn));
3103 connection_mark_unattached_ap(conn,
3124 uint32_t attempts=0;
3128 if (++attempts > 1<<16) {
3130 log_warn(
LD_APP,
"No unused stream IDs. Failing.");
3133 if (test_stream_id == 0)
3136 if (tmpconn->
stream_id == test_stream_id)
3147 return test_stream_id;
3177 const node_t *exitnode = NULL;
3191 if (ap_conn->entry_cfg.ipv4_traffic && !ap_conn->entry_cfg.ipv6_traffic)
3194 if (! cpath_layer ||
3198 if (!ap_conn->entry_cfg.ipv4_traffic)
3203 if (ap_conn->entry_cfg.ipv6_traffic && exitnode) {
3218 if (ap_conn->entry_cfg.prefer_ipv6)
3223 log_warn(
LD_EDGE,
"I'm about to ask a node for a connection that I "
3224 "am telling it to fulfil with neither IPv4 nor IPv6. That's "
3225 "not going to work. Did you perhaps ask for an IPv6 address "
3226 "on an IPv4Only port, or vice versa?");
3259 connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
3271 circ->base_.
purpose == CIRCUIT_PURPOSE_CONFLUX_LINKED ||
3275 payload_len = (int)strlen(payload)+1;
3276 if (payload_len <= RELAY_PAYLOAD_SIZE - 4 && edge_conn->begincell_flags) {
3277 set_uint32(payload + payload_len, htonl(edge_conn->begincell_flags));
3282 "Sending relay cell %d on circ %u to begin stream %d.",
3288 RELAY_COMMAND_BEGIN_DIR : RELAY_COMMAND_BEGIN;
3291 if (begin_type == RELAY_COMMAND_BEGIN) {
3295 assert_circ_anonymity_ok(circ, options);
3296 }
else if (begin_type == RELAY_COMMAND_BEGIN_DIR) {
3300 if (BUG(!base_conn->
linked)) {
3306 if (!linked_dir_conn_base) {
3314 TO_DIR_CONN(linked_dir_conn_base)->router_purpose,
3315 TO_DIR_CONN(linked_dir_conn_base)->requested_resource)) {
3316 assert_circ_anonymity_ok(circ, options);
3321 tor_assert_unreached();
3325 begin_type == RELAY_COMMAND_BEGIN ? payload : NULL,
3326 begin_type == RELAY_COMMAND_BEGIN ? payload_len : 0) < 0)
3332 log_info(
LD_APP,
"Address/port sent, ap socket "TOR_SOCKET_T_FORMAT
3334 base_conn->
s, (
unsigned)circ->base_.
n_circ_id);
3338 if ((connection_get_inbuf_len(base_conn) ||
3339 ap_conn->sending_optimistic_data) &&
3341 log_info(
LD_APP,
"Sending up to %ld + %ld bytes of queued-up data",
3342 (
long)connection_get_inbuf_len(base_conn),
3343 ap_conn->sending_optimistic_data ?
3344 (
long)
buf_datalen(ap_conn->sending_optimistic_data) : 0);
3346 connection_mark_for_close(base_conn);
3362 const char *string_addr;
3374 circ->base_.
purpose == CIRCUIT_PURPOSE_CONFLUX_LINKED);
3383 connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
3392 payload_len = (int)strlen(string_addr)+1;
3403 log_warn(
LD_APP,
"Rejecting ill-formed reverse lookup of %s",
3404 safe_str_client(a));
3405 connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
3411 log_warn(
LD_BUG,
"Couldn't generate reverse lookup hostname of %s",
3412 safe_str_client(a));
3413 connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
3417 string_addr = inaddr_buf;
3418 payload_len = (int)strlen(inaddr_buf)+1;
3419 tor_assert(payload_len <= (
int)
sizeof(inaddr_buf));
3423 "Sending relay cell to begin stream %d.", edge_conn->
stream_id);
3426 RELAY_COMMAND_RESOLVE,
3427 string_addr, payload_len) < 0)
3435 log_info(
LD_APP,
"Address sent for resolve, ap socket "TOR_SOCKET_T_FORMAT
3437 base_conn->
s, (
unsigned)circ->base_.
n_circ_id);
3451 char *address, uint16_t port,
3453 int session_group,
int isolation_flags,
3454 int use_begindir,
int want_onehop)
3459 log_info(
LD_APP,
"Making internal %s tunnel to %s:%d ...",
3460 want_onehop ?
"direct" :
"anonymized",
3461 safe_str_client(address), port);
3492 base_conn->
address = tor_strdup(
"(Tor_internal)");
3494 base_conn->
port = 0;
3498 if (connection_add(base_conn) < 0) {
3499 connection_free(base_conn);
3508 connection_ap_mark_as_pending_circuit(conn);
3509 log_info(
LD_APP,
"... application connection created and linked.");
3524 uint64_t stream_id = 0;
3532 expires = time(NULL) + ttl;
3533 if (answer_type == RESOLVED_TYPE_IPV4 && answer_len >= 4) {
3537 cp, expires, NULL, 0, stream_id);
3539 }
else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) {
3540 char *cp = tor_strndup(answer, answer_len);
3542 cp, expires, NULL, 0, stream_id);
3546 "<error>", time(NULL)+ttl,
3547 "error=yes", 0, stream_id);
3572 log_warn(
LD_BUG,
"Got called with address of unexpected family %d",
3575 RESOLVED_TYPE_ERROR,0,NULL,-1,-1);
3592 const uint8_t *answer,
3600 if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
3608 }
else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) {
3616 }
else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) {
3617 char *cp = tor_strndup((
char*)answer, answer_len);
3637 (
char*)answer, ttl, expires);
3646 if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
3647 buf[1] = SOCKS4_GRANTED;
3649 memcpy(buf+4, answer, 4);
3652 buf[1] = SOCKS4_REJECT;
3653 memset(buf+2, 0, 6);
3659 if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
3660 buf[1] = SOCKS5_SUCCEEDED;
3663 memcpy(buf+4, answer, 4);
3666 }
else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) {
3667 buf[1] = SOCKS5_SUCCEEDED;
3670 memcpy(buf+4, answer, 16);
3673 }
else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) {
3674 buf[1] = SOCKS5_SUCCEEDED;
3677 buf[4] = (char)answer_len;
3678 memcpy(buf+5, answer, answer_len);
3680 replylen = 5+answer_len+2;
3682 buf[1] = SOCKS5_HOST_UNREACHABLE;
3683 memset(buf+2, 0, 8);
3691 (answer_type == RESOLVED_TYPE_IPV4 ||
3692 answer_type == RESOLVED_TYPE_IPV6 ||
3693 answer_type == RESOLVED_TYPE_HOSTNAME) ?
3694 0 : END_STREAM_REASON_RESOLVEFAILED);
3708 size_t replylen,
int endreason)
3724 STREAM_EVENT_SUCCEEDED : STREAM_EVENT_FAILED,
3730 if (status == SOCKS5_SUCCEEDED ||
3731 endreason == END_STREAM_REASON_RESOLVEFAILED ||
3732 endreason == END_STREAM_REASON_CONNECTREFUSED ||
3733 endreason == END_STREAM_REASON_CONNRESET ||
3734 endreason == END_STREAM_REASON_NOROUTE ||
3735 endreason == END_STREAM_REASON_RESOURCELIMIT) {
3738 if (endreason != END_STREAM_REASON_RESOLVEFAILED) {
3740 "No origin circuit for successful SOCKS stream %"PRIu64
3762 log_warn(
LD_BUG,
"(Harmless.) duplicate calls to "
3763 "connection_ap_handshake_socks_reply.");
3775 response =
"HTTP/1.0 400 Bad Request\r\n\r\n";
3777 connection_buf_add(response, strlen(response),
ENTRY_TO_CONN(conn));
3780 buf[1] = (status==SOCKS5_SUCCEEDED ? SOCKS4_GRANTED : SOCKS4_REJECT);
3785 memset(buf,0,
sizeof(buf));
3788 buf[1] = (char)status;
3795 buf[1] = (char)status;
3819 uint8_t *end_reason_out)
3822 const uint8_t *body, *nul;
3824 memset(bcell, 0,
sizeof(*bcell));
3825 *end_reason_out = END_STREAM_REASON_MISC;
3834 if (rh.
command == RELAY_COMMAND_BEGIN_DIR) {
3835 bcell->is_begindir = 1;
3837 }
else if (rh.
command != RELAY_COMMAND_BEGIN) {
3838 log_warn(
LD_BUG,
"Got an unexpected command %d", (
int)rh.
command);
3839 *end_reason_out = END_STREAM_REASON_INTERNAL;
3844 nul = memchr(body, 0, rh.
length);
3847 "Relay begin cell has no \\0. Closing.");
3848 *end_reason_out = END_STREAM_REASON_TORPROTOCOL;
3854 &bcell->address,&bcell->port)<0) {
3856 "Unable to parse addr:port in relay begin cell. Closing.");
3857 *end_reason_out = END_STREAM_REASON_TORPROTOCOL;
3860 if (bcell->port == 0) {
3862 "Missing port in relay begin cell. Closing.");
3864 *end_reason_out = END_STREAM_REASON_TORPROTOCOL;
3867 if (body + rh.
length >= nul + 4)
3887 log_debug(
LD_REND,
"Connecting the hidden service rendezvous circuit "
3888 "to the service destination.");
3891 conn->base_.
address = tor_strdup(
"(rendezvous)");
3906 log_info(
LD_REND,
"Didn't find rendezvous service at %s",
3915 END_STREAM_REASON_DONE,
3947 if (conn->hs_ident) {
3950 export_hs_client_circuit_id(conn, circuit_id_protocol);
3984 char *address = NULL;
3992 uint8_t end_reason=0;
4005 return -END_CIRC_REASON_TORPROTOCOL;
4010 "Relay begin cell at non-server. Closing.");
4012 END_STREAM_REASON_EXITPOLICY, NULL);
4018 return -END_CIRC_REASON_TORPROTOCOL;
4019 }
else if (rv == -1) {
4025 if (! bcell.is_begindir) {
4028 address = bcell.address;
4031 if (or_circ && or_circ->
p_chan) {
4041 "Attempt by %s to open a stream %s. Closing.",
4043 client_chan ?
"on first hop of circuit" :
4044 "from unknown relay");
4047 END_STREAM_REASON_TORPROTOCOL :
4048 END_STREAM_REASON_MISC,
4054 }
else if (rh.
command == RELAY_COMMAND_BEGIN_DIR) {
4058 END_STREAM_REASON_NOTDIRECTORY, layer_hint);
4066 if (or_circ && or_circ->
p_chan &&
4070 address = tor_strdup(
"127.0.0.1");
4076 log_warn(
LD_BUG,
"Got an unexpected command %d", (
int)rh.
command);
4078 END_STREAM_REASON_INTERNAL, layer_hint);
4084 bcell.flags &= ~BEGIN_FLAG_IPV6_PREFERRED;
4089 END_STREAM_REASON_EXITPOLICY, layer_hint);
4094 log_debug(LD_EXIT,
"Creating new exit connection.");
4104 n_stream->begincell_flags = bcell.flags;
4106 n_stream->base_.
port = port;
4125 n_stream->base_.
address = address;
4132 END_STREAM_REASON_HIBERNATING, NULL);
4139 if (rh.
command == RELAY_COMMAND_BEGIN_DIR) {
4149 log_debug(LD_EXIT,
"about to start the dns_resolve().");
4155 log_debug(LD_EXIT,
"about to call connection_exit_connect().");
4160 END_STREAM_REASON_RESOLVEFAILED, NULL);
4198 dummy_conn->base_.
address = tor_strndup(
4201 dummy_conn->base_.
port = 0;
4229 const char **why_rejected)
4235 *why_rejected =
" (IPv6 address without IPv6Exit configured)";
4248 int marked_for_close = 0;
4251 int config_change_relevant = 0;
4258 line && !config_change_relevant;
4259 line = line->next) {
4260 const char* exit_policy_options[] = {
4263 "ReducedExitPolicy",
4264 "ReevaluateExitPolicy",
4268 for (
unsigned int i = 0; exit_policy_options[i] != NULL; ++i) {
4269 if (strcmp(line->key, exit_policy_options[i]) == 0) {
4270 config_change_relevant = 1;
4276 if (!config_change_relevant) {
4299 connection_mark_for_close(conn);
4302 } SMARTLIST_FOREACH_END(conn);
4304 smartlist_free(conn_list);
4305 smartlist_free(policy);
4307 log_info(
LD_GENERAL,
"Marked %d connections to be closed as no longer "
4308 "allowed per ExitPolicy", marked_for_close);
4333 int socket_error = 0, result;
4334 const char *why_failed_exit_policy = NULL;
4339 edge_conn->base_.
port,
4340 &why_failed_exit_policy)) {
4341 if (BUG(!why_failed_exit_policy))
4342 why_failed_exit_policy =
"";
4343 log_info(LD_EXIT,
"%s failed exit policy%s. Closing.",
4345 why_failed_exit_policy);
4349 connection_free(conn);
4372 log_info(LD_EXIT,
"%s tried to connect back to a known relay address. "
4377 connection_free(conn);
4396 log_debug(LD_EXIT,
"about to try connecting");
4398 addr, port, &socket_error);
4409 log_debug(LD_EXIT,
"about to try connecting");
4410 result = connection_connect_unix(conn, conn->
address, &socket_error);
4419 connection_free(conn);
4433 if (connection_get_outbuf_len(conn)) {
4444 RELAY_COMMAND_CONNECTED,
4448 int connected_payload_len =
4451 if (connected_payload_len < 0) {
4454 connection_free(conn);
4459 RELAY_COMMAND_CONNECTED,
4460 (
char*)connected_payload,
4461 connected_payload_len);
4478 log_info(LD_EXIT,
"Opening local connection for anonymized directory exit");
4488 dirconn->base_.
port = 0;
4500 if (connection_add(
TO_CONN(exitconn))<0) {
4511 if (connection_add(
TO_CONN(dirconn))<0) {
4514 connection_mark_for_close(
TO_CONN(exitconn));
4523 RELAY_COMMAND_CONNECTED, NULL, 0) < 0) {
4524 connection_mark_for_close(
TO_CONN(exitconn));
4525 connection_mark_for_close(
TO_CONN(dirconn));
4540 if (conn->hs_ident) {
4565 const node_t *chosen_exit =
4586 }
else if (!conn->entry_cfg.ipv4_traffic && conn->entry_cfg.ipv6_traffic) {
4589 }
else if (conn->entry_cfg.ipv4_traffic && !conn->entry_cfg.ipv6_traffic) {
4618memeq_opt(
const char *a,
size_t alen,
const char *b,
size_t blen)
4622 }
else if (b == NULL) {
4624 }
else if (alen != blen) {
4659 log_warn(
LD_BUG,
"Reached connection_edge_compatible_with_circuit without "
4660 "having set conn->original_dest_address");
4677 circ->socks_username, circ->socks_username_len) ||
4679 circ->socks_password, circ->socks_password_len)))
4712 log_warn(
LD_BUG,
"Reached connection_update_circuit_isolation without "
4713 "having set conn->original_dest_address");
4730 circ->socks_username = sr->
username ?
4732 circ->socks_password = sr->
password ?
4746 circ->socks_username, circ->socks_username_len) ||
4748 circ->socks_password, circ->socks_password_len))
4764 log_warn(
LD_BUG,
"Updating a circuit with seemingly incompatible "
4765 "isolation flags.");
4787 log_warn(
LD_BUG,
"Tried to clear the isolation status of a dirty circuit");
4791 log_warn(
LD_BUG,
"Tried to clear the isolation status of a non-open "
4799 circ->client_proto_type = 0;
4800 circ->client_proto_socksver = 0;
4801 circ->dest_port = 0;
4804 circ->session_group = -1;
4805 circ->nym_epoch = 0;
4806 if (circ->socks_username) {
4807 memwipe(circ->socks_username, 0x11, circ->socks_username_len);
4810 if (circ->socks_password) {
4811 memwipe(circ->socks_password, 0x05, circ->socks_password_len);
4814 circ->socks_username_len = circ->socks_password_len = 0;
4833 connection_mark_for_close(
TO_CONN(conn));
4840 untried_pending_connections = 0;
void tor_addr_copy(tor_addr_t *dest, const tor_addr_t *src)
void tor_addr_from_ipv4n(tor_addr_t *dest, uint32_t v4addr)
void tor_addr_make_unspec(tor_addr_t *a)
int tor_addr_hostname_is_local(const char *name)
int tor_addr_parse(tor_addr_t *addr, const char *src)
void tor_addr_make_null(tor_addr_t *a, sa_family_t family)
int tor_addr_port_split(int severity, const char *addrport, char **address_out, uint16_t *port_out)
int tor_addr_is_null(const tor_addr_t *addr)
char * tor_addr_to_str_dup(const tor_addr_t *addr)
int tor_addr_parse_PTR_name(tor_addr_t *result, const char *address, int family, int accept_regular)
void tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6)
const char * tor_addr_to_str(char *dest, const tor_addr_t *addr, size_t len, int decorate)
int tor_addr_from_sockaddr(tor_addr_t *a, const struct sockaddr *sa, uint16_t *port_out)
void tor_addr_from_ipv6_bytes(tor_addr_t *dest, const uint8_t *ipv6_bytes)
char * tor_dup_ip(uint32_t addr)
int tor_addr_to_PTR_name(char *out, size_t outlen, const tor_addr_t *addr)
static uint32_t tor_addr_to_ipv4n(const tor_addr_t *a)
#define REVERSE_LOOKUP_NAME_BUF_LEN
static sa_family_t tor_addr_family(const tor_addr_t *a)
static const struct in6_addr * tor_addr_to_in6(const tor_addr_t *a)
#define tor_addr_to_in6_addr8(x)
#define tor_addr_eq(a, b)
void client_dns_set_reverse_addressmap(entry_connection_t *for_conn, const char *address, const char *v, const char *exitname, int ttl)
void clear_trackexithost_mappings(const char *exitname)
int address_is_in_virtual_range(const char *address)
void client_dns_set_addressmap(entry_connection_t *for_conn, const char *address, const tor_addr_t *val, const char *exitname, int ttl)
int addressmap_rewrite(char *address, size_t maxlen, unsigned flags, time_t *expires_out, addressmap_entry_source_t *exit_source_out)
int addressmap_address_should_automap(const char *address, const or_options_t *options)
const char * addressmap_register_virtual_address(int type, char *new_address)
int addressmap_rewrite_reverse(char *address, size_t maxlen, unsigned flags, time_t *expires_out)
const char * hex_str(const char *from, size_t fromlen)
void base16_encode(char *dest, size_t destlen, const char *src, size_t srclen)
size_t buf_datalen(const buf_t *buf)
int buf_set_to_copy(buf_t **output, const buf_t *input)
Header file for buffers.c.
static void set_uint16(void *cp, uint16_t v)
static void set_uint32(void *cp, uint32_t v)
static void set_uint8(void *cp, uint8_t v)
static uint32_t get_uint32(const void *cp)
Fixed-size cell structure.
int channel_is_client(const channel_t *chan)
int channel_get_addr_if_possible(const channel_t *chan, tor_addr_t *addr_out)
const char * channel_describe_peer(channel_t *chan)
Header file for channel.c.
const char * pathbias_state_to_string(path_state_t state)
void pathbias_mark_use_rollback(origin_circuit_t *circ)
void pathbias_mark_use_success(origin_circuit_t *circ)
Header file for circuitbuild.c.
circuit_t * circuit_get_by_edge_conn(edge_connection_t *conn)
origin_circuit_t * TO_ORIGIN_CIRCUIT(circuit_t *x)
void assert_circuit_ok(const circuit_t *c)
const char * circuit_state_to_string(int state)
or_circuit_t * TO_OR_CIRCUIT(circuit_t *x)
const char * circuit_purpose_to_string(uint8_t purpose)
Header file for circuitlist.c.
#define CIRCUIT_PURPOSE_IS_CLIENT(p)
#define CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT
#define CIRCUIT_PURPOSE_PATH_BIAS_TESTING
#define CIRCUIT_STATE_OPEN
#define CIRCUIT_PURPOSE_C_REND_JOINED
#define CIRCUIT_PURPOSE_CONTROLLER
#define CIRCUIT_IS_ORIGIN(c)
#define CIRCUIT_PURPOSE_OR
#define CIRCUIT_PURPOSE_S_REND_JOINED
#define CIRCUIT_PURPOSE_S_HSDIR_POST
#define CIRCUIT_PURPOSE_C_HSDIR_GET
#define CIRCUIT_PURPOSE_C_GENERAL
void circpad_machine_event_circ_has_streams(origin_circuit_t *circ)
Header file for circuitpadding.c.
double get_circuit_build_timeout_ms(void)
Header file for circuitstats.c.
void circuit_detach_stream(circuit_t *circ, edge_connection_t *conn)
void circuit_read_valid_data(origin_circuit_t *circ, uint16_t relay_body_len)
int connection_ap_handshake_attach_circuit(entry_connection_t *conn)
int connection_ap_handshake_attach_chosen_circuit(entry_connection_t *conn, origin_circuit_t *circ, crypt_path_t *cpath)
void mark_circuit_unusable_for_new_conns(origin_circuit_t *circ)
Header file for circuituse.c.
#define SUBTYPE_P(p, subtype, basemember)
mainloop_event_t * mainloop_event_postloop_new(void(*cb)(mainloop_event_t *, void *), void *userdata)
void mainloop_event_activate(mainloop_event_t *event)
Header for compat_libevent.c.
uint64_t monotime_absolute_usec(void)
const char * escaped_safe_str_client(const char *address)
const char * escaped_safe_str(const char *address)
const or_options_t * get_options(void)
tor_cmdline_mode_t command
Header file for config.c.
uint64_t edge_get_max_rtt(const edge_connection_t *stream)
void conflux_sync_circ_fields(conflux_t *cfx, origin_circuit_t *ref_circ)
void conflux_update_half_streams(origin_circuit_t *circ, smartlist_t *half_streams)
Header file for conflux_util.c.
bool edge_uses_flow_control(const edge_connection_t *stream)
APIs for stream flow control on congestion controlled circuits.
edge_connection_t * edge_connection_new(int type, int socket_family)
void connection_link_connections(connection_t *conn_a, connection_t *conn_b)
int connection_buf_get_line(connection_t *conn, char *data, size_t *data_len)
void connection_mark_for_close_(connection_t *conn, int line, const char *file)
void connection_close_immediate(connection_t *conn)
int connection_state_is_open(connection_t *conn)
const char * connection_describe_peer(const connection_t *conn)
entry_connection_t * entry_connection_new(int type, int socket_family)
const char * connection_describe(const connection_t *conn)
dir_connection_t * dir_connection_new(int socket_family)
void connection_free_(connection_t *conn)
int connection_connect(connection_t *conn, const char *address, const tor_addr_t *addr, uint16_t port, int *socket_error)
const char * conn_state_to_string(int type, int state)
Header file for connection.c.
#define CONN_TYPE_AP_HTTP_CONNECT_LISTENER
#define CONN_TYPE_DIR_LISTENER
#define connection_mark_and_flush_(c, line, file)
int connection_edge_compatible_with_circuit(const entry_connection_t *conn, const origin_circuit_t *circ)
int connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, origin_circuit_t *circ, crypt_path_t *cpath)
int connection_half_edge_is_valid_data(const smartlist_t *half_conns, streamid_t stream_id)
void connection_ap_mark_as_waiting_for_renddesc(entry_connection_t *entry_conn)
void connection_mark_unattached_ap_(entry_connection_t *conn, int endreason, int line, const char *file)
static uint32_t connection_ap_get_begincell_flags(entry_connection_t *ap_conn)
void connection_edge_free_all(void)
void connection_ap_mark_as_non_pending_circuit(entry_connection_t *entry_conn)
static int connection_half_edge_compare_bsearch(const void *key, const void **member)
static size_t n_half_conns_allocated
int connection_ap_rewrite_and_attach_if_allowed(entry_connection_t *conn, origin_circuit_t *circ, crypt_path_t *cpath)
uint32_t clip_dns_fuzzy_ttl(uint32_t ttl)
static int connection_ap_supports_optimistic_data(const entry_connection_t *)
STATIC int connection_ap_process_http_connect(entry_connection_t *conn)
const edge_connection_t * CONST_TO_EDGE_CONN(const connection_t *c)
#define MAX_CONNECTED_CELL_PAYLOAD_LEN
entry_connection_t * connection_ap_make_link(connection_t *partner, char *address, uint16_t port, const char *digest, int session_group, int isolation_flags, int use_begindir, int want_onehop)
void connection_ap_expire_beginning(void)
void connection_ap_fail_onehop(const char *failed_digest, cpath_build_state_t *build_state)
static void connection_edge_about_to_close(edge_connection_t *edge_conn)
int connection_ap_detach_retriable(entry_connection_t *conn, origin_circuit_t *circ, int reason)
STATIC int connected_cell_format_payload(uint8_t *payload_out, const tor_addr_t *addr, uint32_t ttl)
void connection_ap_rescan_and_attach_pending(void)
int connection_ap_handshake_send_begin(entry_connection_t *ap_conn)
static int connection_ap_process_natd(entry_connection_t *conn)
static int consider_plaintext_ports(entry_connection_t *conn, uint16_t port)
void connection_ap_handshake_socks_reply(entry_connection_t *conn, char *reply, size_t replylen, int endreason)
static smartlist_t * pending_entry_connections
int connection_half_edge_is_valid_end(smartlist_t *half_conns, streamid_t stream_id)
void connection_exit_connect(edge_connection_t *edge_conn)
uint32_t clip_dns_ttl(uint32_t ttl)
static bool network_reentry_is_allowed(void)
bool connection_half_edges_waiting(const origin_circuit_t *circ)
int connection_ap_process_transparent(entry_connection_t *conn)
void connection_ap_mark_as_pending_circuit_(entry_connection_t *entry_conn, const char *fname, int lineno)
#define TRACKHOSTEXITS_RETRIES
static mainloop_event_t * attach_pending_entry_connections_ev
void connection_edge_end_close(edge_connection_t *conn, uint8_t reason)
int connection_edge_finished_connecting(edge_connection_t *edge_conn)
int connection_edge_destroy(circid_t circ_id, edge_connection_t *conn)
static int connection_exit_connect_dir(edge_connection_t *exitconn)
int connection_edge_finished_flushing(edge_connection_t *conn)
static int my_exit_policy_rejects(const tor_addr_t *addr, uint16_t port, const char **why_rejected)
void circuit_clear_isolation(origin_circuit_t *circ)
int connection_exit_begin_resolve(cell_t *cell, or_circuit_t *circ)
void connection_exit_about_to_close(edge_connection_t *edge_conn)
static int connection_ap_get_original_destination(entry_connection_t *conn, socks_request_t *req)
STATIC bool parse_extended_hostname(char *address, hostname_type_t *type_out)
int connection_half_edge_is_valid_connected(const smartlist_t *half_conns, streamid_t stream_id)
int connection_edge_flushed_some(edge_connection_t *conn)
entry_connection_t * EDGE_TO_ENTRY_CONN(edge_connection_t *c)
int connection_ap_handshake_send_resolve(entry_connection_t *ap_conn)
void connection_ap_handshake_socks_resolved_addr(entry_connection_t *conn, const tor_addr_t *answer, int ttl, time_t expires)
int connection_edge_update_circuit_isolation(const entry_connection_t *conn, origin_circuit_t *circ, int dry_run)
int connection_edge_reached_eof(edge_connection_t *conn)
const entry_connection_t * CONST_TO_ENTRY_CONN(const connection_t *c)
static void tell_controller_about_resolved_result(entry_connection_t *conn, int answer_type, size_t answer_len, const char *answer, int ttl, time_t expires)
int connection_ap_can_use_exit(const entry_connection_t *conn, const node_t *exit_node)
int connection_half_edge_is_valid_resolved(smartlist_t *half_conns, streamid_t stream_id)
int connection_edge_end_errno(edge_connection_t *conn)
int connection_edge_end(edge_connection_t *conn, uint8_t reason)
void connection_ap_attach_pending(int retry)
size_t half_streams_get_total_allocation(void)
int connection_half_edge_is_valid_sendme(const smartlist_t *half_conns, streamid_t stream_id)
int connection_edge_is_rendezvous_stream(const edge_connection_t *conn)
static int connection_ap_handle_onion(entry_connection_t *conn, socks_request_t *socks, origin_circuit_t *circ)
STATIC int begin_cell_parse(const cell_t *cell, begin_cell_t *bcell, uint8_t *end_reason_out)
void connection_ap_about_to_close(entry_connection_t *entry_conn)
static int relay_send_end_cell_from_edge(streamid_t stream_id, circuit_t *circ, uint8_t reason, crypt_path_t *cpath_layer)
const entry_connection_t * CONST_EDGE_TO_ENTRY_CONN(const edge_connection_t *c)
entry_connection_t * TO_ENTRY_CONN(connection_t *c)
STATIC void connection_half_edge_add(const edge_connection_t *conn, origin_circuit_t *circ)
static int handle_hs_exit_conn(circuit_t *circ, edge_connection_t *conn)
void connection_ap_handshake_socks_resolved(entry_connection_t *conn, int answer_type, size_t answer_len, const uint8_t *answer, int ttl, time_t expires)
static int memeq_opt(const char *a, size_t alen, const char *b, size_t blen)
int connection_exit_begin_conn(cell_t *cell, circuit_t *circ)
void connection_entry_set_controller_wait(entry_connection_t *conn)
streamid_t get_unique_stream_id_by_circ(origin_circuit_t *circ)
void half_edge_free_(half_edge_t *he)
void circuit_discard_optional_exit_enclaves(extend_info_t *info)
static int connection_ap_handshake_process_socks(entry_connection_t *conn)
edge_connection_t * TO_EDGE_CONN(connection_t *c)
int connection_edge_process_inbuf(edge_connection_t *conn, int package_partial)
STATIC half_edge_t * connection_half_edge_find_stream_id(const smartlist_t *half_conns, streamid_t stream_id)
static int compute_retry_timeout(entry_connection_t *conn)
Header file for connection_edge.c.
#define AP_CONN_STATE_HTTP_CONNECT_WAIT
#define EXIT_CONN_STATE_CONNECTING
#define AP_CONN_STATE_CONTROLLER_WAIT
#define EXIT_CONN_STATE_OPEN
#define AP_CONN_STATE_SOCKS_WAIT
int address_is_invalid_destination(const char *address, int client)
#define BEGIN_FLAG_IPV6_PREFERRED
#define EXIT_CONN_STATE_RESOLVEFAILED
#define AP_CONN_STATE_IS_UNATTACHED(s)
#define AP_CONN_STATE_CONNECT_WAIT
#define AP_CONN_STATE_OPEN
#define EXIT_PURPOSE_CONNECT
#define AP_CONN_STATE_RESOLVE_WAIT
#define BEGIN_FLAG_IPV4_NOT_OK
#define AP_CONN_STATE_CIRCUIT_WAIT
#define EXIT_CONN_STATE_RESOLVING
#define AP_CONN_STATE_NATD_WAIT
#define AP_CONN_STATE_RENDDESC_WAIT
#define BEGIN_FLAG_IPV6_OK
#define EXIT_PURPOSE_RESOLVE
int connection_or_digest_is_known_relay(const char *id_digest)
Header file for connection_or.c.
int control_event_stream_bandwidth(edge_connection_t *edge_conn)
int control_event_client_status(int severity, const char *format,...)
int control_event_stream_status(entry_connection_t *conn, stream_status_event_t tp, int reason_code)
int control_event_address_mapped(const char *from, const char *to, time_t expires, const char *error, const int cached, uint64_t stream_id)
Header file for control_events.c.
#define REMAP_STREAM_SOURCE_CACHE
Circuit-build-stse structure.
Common functions for using (pseudo-)random number generators.
unsigned crypto_rand_uint(unsigned limit)
void memwipe(void *mem, uint8_t byte, size_t sz)
Common functions for cryptographic routines.
const char * extend_info_describe(const extend_info_t *ei)
const char * node_describe(const node_t *node)
Header file for describe.c.
int tor_memeq(const void *a, const void *b, size_t sz)
#define tor_memneq(a, b, sz)
Client/server directory connection structure.
int purpose_needs_anonymity(uint8_t dir_purpose, uint8_t router_purpose, const char *resource)
dir_connection_t * TO_DIR_CONN(connection_t *c)
char * http_get_header(const char *headers, const char *which)
int parse_http_command(const char *headers, char **command_out, char **url_out)
Header file for directory.c.
#define DIR_CONN_STATE_SERVER_COMMAND_WAIT
#define DIR_PURPOSE_SERVER
int directory_permits_begindir_requests(const or_options_t *options)
Header file for dirserv.c.
void connection_dns_remove(edge_connection_t *conn)
int dns_resolve(edge_connection_t *exitconn)
void dnsserv_reject_request(entry_connection_t *conn)
void dnsserv_resolved(entry_connection_t *conn, int answer_type, size_t answer_len, const char *answer, int ttl)
Header file for dnsserv.c.
Entry connection structure.
#define ENTRY_TO_EDGE_CONN(c)
const char * escaped(const char *s)
bool extend_info_has_orport(const extend_info_t *ei, const tor_addr_t *addr, uint16_t port)
Header for core/or/extendinfo.c.
int tor_open_cloexec(const char *path, int flags, unsigned mode)
Half-open connection structure.
int we_are_hibernating(void)
Header file for hibernate.c.
const hs_descriptor_t * hs_cache_lookup_as_client(const ed25519_public_key_t *key)
Header file for hs_cache.c.
Header file containing circuit data for the whole HS subsystem.
int hs_client_any_intro_points_usable(const ed25519_public_key_t *service_pk, const hs_descriptor_t *desc)
int hs_client_refetch_hsdesc(const ed25519_public_key_t *identity_pk)
Header file containing client data for the HS subsystem.
@ HS_CLIENT_FETCH_PENDING
@ HS_CLIENT_FETCH_MISSING_INFO
@ HS_CLIENT_FETCH_NO_HSDIRS
@ HS_CLIENT_FETCH_HAVE_DESC
@ HS_CLIENT_FETCH_NOT_ALLOWED
@ HS_CLIENT_FETCH_LAUNCHED
int hs_parse_address(const char *address, ed25519_public_key_t *key_out, uint8_t *checksum_out, uint8_t *version_out)
int hs_address_is_valid(const char *address)
void hs_inc_rdv_stream_counter(origin_circuit_t *circ)
Header file containing common data for the whole HS subsystem.
#define HS_SERVICE_ADDR_LEN_BASE32
hs_ident_edge_conn_t * hs_ident_edge_conn_new(const ed25519_public_key_t *identity_pk)
hs_circuit_id_protocol_t hs_service_exports_circuit_id(const ed25519_public_key_t *pk)
int hs_service_set_conn_addr_port(const origin_circuit_t *circ, edge_connection_t *conn)
@ HS_CIRCUIT_ID_PROTOCOL_HAPROXY
#define log_fn(severity, domain, args,...)
#define log_fn_ratelim(ratelim, severity, domain, args,...)
void connection_watch_events(connection_t *conn, watchable_events_t events)
void connection_start_reading(connection_t *conn)
void connection_start_writing(connection_t *conn)
smartlist_t * get_connection_array(void)