Tor 0.4.9.0-alpha-dev
dirclient.c
Go to the documentation of this file.
1/* Copyright (c) 2001-2004, Roger Dingledine.
2 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
3 * Copyright (c) 2007-2021, The Tor Project, Inc. */
4/* See LICENSE for licensing information */
5
6/**
7 * @file dirclient.c
8 * @brief Download directory information
9 **/
10
11#define DIRCLIENT_PRIVATE
12
13#include "core/or/or.h"
14
15#include "app/config/config.h"
19#include "core/or/policies.h"
34#include "feature/hs/hs_cache.h"
52
53#include "lib/cc/ctassert.h"
58#include "lib/err/backtrace.h"
59
67
68/** Maximum size, in bytes, for any directory object that we've downloaded. */
69#define MAX_DIR_DL_SIZE ((1<<24)-1) /* 16 MB - 1 */
70
71/** How far in the future do we allow a directory server to tell us it is
72 * before deciding that one of us has the wrong time? */
73#define ALLOW_DIRECTORY_TIME_SKEW (30*60)
74
75static int body_is_plausible(const char *body, size_t body_len, int purpose);
79 dir_connection_t *conn, int status_code);
82 int status_code,
83 int router_purpose,
84 int was_extrainfo,
85 int was_descriptor_digests);
87 int status_code,
88 const char *dir_id);
90 const int direct,
91 const directory_request_t *req);
92static void connection_dir_close_consensus_fetches(
93 dir_connection_t *except_this_one, const char *resource);
94
95/** Return a string describing a given directory connection purpose. */
96STATIC const char *
98{
99 switch (purpose)
100 {
102 return "server descriptor upload";
104 return "server vote upload";
106 return "consensus signature upload";
108 return "server descriptor fetch";
110 return "extra-info fetch";
112 return "consensus network-status fetch";
114 return "authority cert fetch";
116 return "status vote fetch";
118 return "consensus signature fetch";
120 return "hidden-service descriptor fetch";
122 return "hidden-service descriptor upload";
124 return "microdescriptor fetch";
125 }
126
127 log_warn(LD_BUG, "Called with unknown purpose %d", purpose);
128 return "(unknown)";
129}
130
131/** Return the requisite directory information types. */
133dir_fetch_type(int dir_purpose, int router_purpose, const char *resource)
134{
135 dirinfo_type_t type;
136 switch (dir_purpose) {
138 type = EXTRAINFO_DIRINFO;
139 if (router_purpose == ROUTER_PURPOSE_BRIDGE)
140 type |= BRIDGE_DIRINFO;
141 else
142 type |= V3_DIRINFO;
143 break;
145 if (router_purpose == ROUTER_PURPOSE_BRIDGE)
146 type = BRIDGE_DIRINFO;
147 else
148 type = V3_DIRINFO;
149 break;
153 type = V3_DIRINFO;
154 break;
156 type = V3_DIRINFO;
157 if (resource && !strcmp(resource, "microdesc"))
158 type |= MICRODESC_DIRINFO;
159 break;
161 type = MICRODESC_DIRINFO;
162 break;
163 default:
164 log_warn(LD_BUG, "Unexpected purpose %d", (int)dir_purpose);
165 type = NO_DIRINFO;
166 break;
167 }
168 return type;
169}
170
171/** Return true iff <b>identity_digest</b> is the digest of a router which
172 * says that it caches extrainfos. (If <b>is_authority</b> we always
173 * believe that to be true.) */
174int
175router_supports_extrainfo(const char *identity_digest, int is_authority)
176{
177 const node_t *node = node_get_by_id(identity_digest);
178
179 if (node && node->ri) {
180 if (node->ri->caches_extra_info)
181 return 1;
182 }
183 if (is_authority) {
184 return 1;
185 }
186 return 0;
187}
188
189/** Return true iff any trusted directory authority has accepted our
190 * server descriptor.
191 *
192 * We consider any authority sufficient because waiting for all of
193 * them means it never happens while any authority is down; we don't
194 * go for something more complex in the middle (like >1/3 or >1/2 or
195 * >=1/2) because that doesn't seem necessary yet.
196 */
197int
199{
200 const smartlist_t *servers = router_get_trusted_dir_servers();
201 const or_options_t *options = get_options();
202 SMARTLIST_FOREACH(servers, dir_server_t *, d, {
203 if ((d->type & options->PublishServerDescriptor_) &&
204 d->has_accepted_serverdesc) {
205 return 1;
206 }
207 });
208 return 0;
209}
210
211/** Start a connection to every suitable directory authority, using
212 * connection purpose <b>dir_purpose</b> and uploading <b>payload</b>
213 * (of length <b>payload_len</b>). The dir_purpose should be one of
214 * 'DIR_PURPOSE_UPLOAD_{DIR|VOTE|SIGNATURES}'.
215 *
216 * <b>router_purpose</b> describes the type of descriptor we're
217 * publishing, if we're publishing a descriptor -- e.g. general or bridge.
218 *
219 * <b>type</b> specifies what sort of dir authorities (V3,
220 * BRIDGE, etc) we should upload to.
221 *
222 * If <b>extrainfo_len</b> is nonzero, the first <b>payload_len</b> bytes of
223 * <b>payload</b> hold a router descriptor, and the next <b>extrainfo_len</b>
224 * bytes of <b>payload</b> hold an extra-info document. Upload the descriptor
225 * to all authorities, and the extra-info document to all authorities that
226 * support it.
227 */
228void
229directory_post_to_dirservers(uint8_t dir_purpose, uint8_t router_purpose,
230 dirinfo_type_t type,
231 const char *payload,
232 size_t payload_len, size_t extrainfo_len)
233{
234 const or_options_t *options = get_options();
235 dir_indirection_t indirection;
236 const smartlist_t *dirservers = router_get_trusted_dir_servers();
237 int found = 0;
238 const int exclude_self = (dir_purpose == DIR_PURPOSE_UPLOAD_VOTE ||
239 dir_purpose == DIR_PURPOSE_UPLOAD_SIGNATURES);
240 tor_assert(dirservers);
241 /* This tries dirservers which we believe to be down, but ultimately, that's
242 * harmless, and we may as well err on the side of getting things uploaded.
243 */
244 SMARTLIST_FOREACH_BEGIN(dirservers, dir_server_t *, ds) {
246 if (!rs) {
247 /* prefer to use the address in the consensus, but fall back to
248 * the hard-coded trusted_dir_server address if we don't have a
249 * consensus or this digest isn't in our consensus. */
250 rs = &ds->fake_status;
251 }
252
253 size_t upload_len = payload_len;
254
255 if ((type & ds->type) == 0)
256 continue;
257
258 if (exclude_self && router_digest_is_me(ds->digest)) {
259 /* we don't upload to ourselves, but there's now at least
260 * one authority of this type that has what we wanted to upload. */
261 found = 1;
262 continue;
263 }
264
265 if (options->StrictNodes &&
267 log_warn(LD_DIR, "Wanted to contact authority '%s' for %s, but "
268 "it's in our ExcludedNodes list and StrictNodes is set. "
269 "Skipping.",
270 ds->nickname,
271 dir_conn_purpose_to_string(dir_purpose));
272 continue;
273 }
274
275 found = 1; /* at least one authority of this type was listed */
276 if (dir_purpose == DIR_PURPOSE_UPLOAD_DIR)
277 ds->has_accepted_serverdesc = 0;
278
279 if (extrainfo_len && router_supports_extrainfo(ds->digest, 1)) {
280 upload_len += extrainfo_len;
281 log_info(LD_DIR, "Uploading an extrainfo too (length %d)",
282 (int) extrainfo_len);
283 }
284 if (purpose_needs_anonymity(dir_purpose, router_purpose, NULL)) {
285 indirection = DIRIND_ANONYMOUS;
286 } else if (!reachable_addr_allows_rs(rs, FIREWALL_DIR_CONNECTION, 0)) {
287 if (reachable_addr_allows_rs(rs, FIREWALL_OR_CONNECTION, 0))
288 indirection = DIRIND_ONEHOP;
289 else
290 indirection = DIRIND_ANONYMOUS;
291 } else {
292 indirection = DIRIND_DIRECT_CONN;
293 }
294
295 directory_request_t *req = directory_request_new(dir_purpose);
297 directory_request_set_router_purpose(req, router_purpose);
298 directory_request_set_indirection(req, indirection);
299 directory_request_set_payload(req, payload, upload_len);
301 directory_request_free(req);
302 } SMARTLIST_FOREACH_END(ds);
303 if (!found) {
304 char *s = authdir_type_to_string(type);
305 log_warn(LD_DIR, "Publishing server descriptor to directory authorities "
306 "of type '%s', but no authorities of that type listed!", s);
307 tor_free(s);
308 }
309}
310
311/** Return true iff, according to the values in <b>options</b>, we should be
312 * using directory guards for direct downloads of directory information. */
313STATIC int
315{
316 /* Public (non-bridge) servers never use directory guards. */
317 if (public_server_mode(options))
318 return 0;
319 /* If guards are disabled, we can't use directory guards.
320 */
321 if (!options->UseEntryGuards)
322 return 0;
323 /* If we're configured to fetch directory info aggressively or of a
324 * nonstandard type, don't use directory guards. */
325 if (options->DownloadExtraInfo || options->FetchDirInfoEarly ||
327 return 0;
328 return 1;
329}
330
331/** Pick an unconstrained directory server from among our guards, the latest
332 * networkstatus, or the fallback dirservers, for use in downloading
333 * information of type <b>type</b>, and return its routerstatus. */
334static const routerstatus_t *
336 uint8_t dir_purpose,
337 circuit_guard_state_t **guard_state_out)
338{
339 const routerstatus_t *rs = NULL;
340 const or_options_t *options = get_options();
341
342 if (options->UseBridges)
343 log_warn(LD_BUG, "Called when we have UseBridges set.");
344
345 if (should_use_directory_guards(options)) {
346 const node_t *node = guards_choose_dirguard(dir_purpose, guard_state_out);
347 if (node)
348 rs = node->rs;
349 } else {
350 /* anybody with a non-zero dirport will do */
351 rs = router_pick_directory_server(type, pds_flags);
352 }
353 if (!rs) {
354 log_info(LD_DIR, "No router found for %s; falling back to "
355 "dirserver list.", dir_conn_purpose_to_string(dir_purpose));
356 rs = router_pick_fallback_dirserver(type, pds_flags);
357 }
358
359 return rs;
360}
361
362/**
363 * Set the extra fields in <b>req</b> that are used when requesting a
364 * consensus of type <b>resource</b>.
365 *
366 * Right now, these fields are if-modified-since and x-or-diff-from-consensus.
367 */
368static void
370 const char *resource)
371{
372 time_t if_modified_since = 0;
373 uint8_t or_diff_from[DIGEST256_LEN];
374 int or_diff_from_is_set = 0;
375
376 /* DEFAULT_IF_MODIFIED_SINCE_DELAY is 1/20 of the default consensus
377 * period of 1 hour.
378 */
379 const int DEFAULT_IF_MODIFIED_SINCE_DELAY = 180;
380 const int32_t DEFAULT_TRY_DIFF_FOR_CONSENSUS_NEWER = 72;
381 const int32_t MIN_TRY_DIFF_FOR_CONSENSUS_NEWER = 0;
382 const int32_t MAX_TRY_DIFF_FOR_CONSENSUS_NEWER = 8192;
383 const char TRY_DIFF_FOR_CONSENSUS_NEWER_NAME[] =
384 "try-diff-for-consensus-newer-than";
385
386 int flav = FLAV_NS;
387 if (resource)
388 flav = networkstatus_parse_flavor_name(resource);
389
390 int32_t max_age_for_diff = 3600 *
392 TRY_DIFF_FOR_CONSENSUS_NEWER_NAME,
393 DEFAULT_TRY_DIFF_FOR_CONSENSUS_NEWER,
394 MIN_TRY_DIFF_FOR_CONSENSUS_NEWER,
395 MAX_TRY_DIFF_FOR_CONSENSUS_NEWER);
396
397 if (flav != -1) {
398 /* IF we have a parsed consensus of this type, we can do an
399 * if-modified-time based on it. */
402 if (v) {
403 /* In networks with particularly short V3AuthVotingIntervals,
404 * ask for the consensus if it's been modified since half the
405 * V3AuthVotingInterval of the most recent consensus. */
406 time_t ims_delay = DEFAULT_IF_MODIFIED_SINCE_DELAY;
407 if (v->fresh_until > v->valid_after
408 && ims_delay > (v->fresh_until - v->valid_after)/2) {
409 ims_delay = (v->fresh_until - v->valid_after)/2;
410 }
411 if_modified_since = v->valid_after + ims_delay;
412 if (v->valid_after >= approx_time() - max_age_for_diff) {
413 memcpy(or_diff_from, v->digest_sha3_as_signed, DIGEST256_LEN);
414 or_diff_from_is_set = 1;
415 }
416 }
417 } else {
418 /* Otherwise it might be a consensus we don't parse, but which we
419 * do cache. Look at the cached copy, perhaps. */
420 cached_dir_t *cd = dirserv_get_consensus(resource);
421 /* We have no method of determining the voting interval from an
422 * unparsed consensus, so we use the default. */
423 if (cd) {
424 if_modified_since = cd->published + DEFAULT_IF_MODIFIED_SINCE_DELAY;
425 if (cd->published >= approx_time() - max_age_for_diff) {
426 memcpy(or_diff_from, cd->digest_sha3_as_signed, DIGEST256_LEN);
427 or_diff_from_is_set = 1;
428 }
429 }
430 }
431
432 if (if_modified_since > 0)
433 directory_request_set_if_modified_since(req, if_modified_since);
434 if (or_diff_from_is_set) {
435 char hex[HEX_DIGEST256_LEN + 1];
436 base16_encode(hex, sizeof(hex),
437 (const char*)or_diff_from, sizeof(or_diff_from));
438 directory_request_add_header(req, X_OR_DIFF_FROM_CONSENSUS_HEADER, hex);
439 }
440}
441/** Start a connection to a random running directory server, using
442 * connection purpose <b>dir_purpose</b>, intending to fetch descriptors
443 * of purpose <b>router_purpose</b>, and requesting <b>resource</b>.
444 * Use <b>pds_flags</b> as arguments to router_pick_directory_server()
445 * or router_pick_trusteddirserver().
446 */
447MOCK_IMPL(void,
449 uint8_t dir_purpose,
450 uint8_t router_purpose,
451 const char *resource,
452 int pds_flags,
454{
455 const routerstatus_t *rs = NULL;
456 const or_options_t *options = get_options();
457 int prefer_authority = (dirclient_fetches_from_authorities(options)
458 || want_authority == DL_WANT_AUTHORITY);
459 int require_authority = 0;
460 int get_via_tor = purpose_needs_anonymity(dir_purpose, router_purpose,
461 resource);
462 dirinfo_type_t type = dir_fetch_type(dir_purpose, router_purpose, resource);
463
464 if (type == NO_DIRINFO)
465 return;
466
467 if (!options->FetchServerDescriptors)
468 return;
469
470 circuit_guard_state_t *guard_state = NULL;
471 if (!get_via_tor) {
472 if (options->UseBridges && !(type & BRIDGE_DIRINFO)) {
473 /* We want to ask a running bridge for which we have a descriptor.
474 *
475 * When we ask choose_random_entry() for a bridge, we specify what
476 * sort of dir fetch we'll be doing, so it won't return a bridge
477 * that can't answer our question.
478 */
479 const node_t *node = guards_choose_dirguard(dir_purpose, &guard_state);
480 if (node && node->ri) {
481 /* every bridge has a routerinfo. */
482 routerinfo_t *ri = node->ri;
483 /* clients always make OR connections to bridges */
484 tor_addr_port_t or_ap;
485 directory_request_t *req = directory_request_new(dir_purpose);
486 /* we are willing to use a non-preferred address if we need to */
487 reachable_addr_choose_from_node(node, FIREWALL_OR_CONNECTION, 0,
488 &or_ap);
491 ri->cache_info.identity_digest);
492 directory_request_set_router_purpose(req, router_purpose);
493 directory_request_set_resource(req, resource);
494 if (dir_purpose == DIR_PURPOSE_FETCH_CONSENSUS)
496 directory_request_set_guard_state(req, guard_state);
498 directory_request_free(req);
499 } else {
500 if (guard_state) {
501 entry_guard_cancel(&guard_state);
502 }
503 log_notice(LD_DIR, "Ignoring directory request, since no bridge "
504 "nodes are available yet.");
505 }
506
507 return;
508 } else {
509 if (prefer_authority || (type & BRIDGE_DIRINFO)) {
510 /* only ask authdirservers, and don't ask myself */
511 rs = router_pick_trusteddirserver(type, pds_flags);
512 if (rs == NULL && (pds_flags & (PDS_NO_EXISTING_SERVERDESC_FETCH|
514 /* We don't want to fetch from any authorities that we're currently
515 * fetching server descriptors from, and we got no match. Did we
516 * get no match because all the authorities have connections
517 * fetching server descriptors (in which case we should just
518 * return,) or because all the authorities are down or on fire or
519 * unreachable or something (in which case we should go on with
520 * our fallback code)? */
523 rs = router_pick_trusteddirserver(type, pds_flags);
524 if (rs) {
525 log_debug(LD_DIR, "Deferring serverdesc fetch: all authorities "
526 "are in use.");
527 return;
528 }
529 }
530 if (rs == NULL && require_authority) {
531 log_info(LD_DIR, "No authorities were available for %s: will try "
532 "later.", dir_conn_purpose_to_string(dir_purpose));
533 return;
534 }
535 }
536 if (!rs && !(type & BRIDGE_DIRINFO)) {
537 rs = directory_pick_generic_dirserver(type, pds_flags,
538 dir_purpose,
539 &guard_state);
540 if (!rs)
541 get_via_tor = 1; /* last resort: try routing it via Tor */
542 }
543 }
544 }
545
546 if (get_via_tor) {
547 /* Never use fascistfirewall; we're going via Tor. */
548 pds_flags |= PDS_IGNORE_FASCISTFIREWALL;
549 rs = router_pick_directory_server(type, pds_flags);
550 }
551
552 /* If we have any hope of building an indirect conn, we know some router
553 * descriptors. If (rs==NULL), we can't build circuits anyway, so
554 * there's no point in falling back to the authorities in this case. */
555 if (rs) {
556 const dir_indirection_t indirection =
557 get_via_tor ? DIRIND_ANONYMOUS : DIRIND_ONEHOP;
558 directory_request_t *req = directory_request_new(dir_purpose);
560 directory_request_set_router_purpose(req, router_purpose);
561 directory_request_set_indirection(req, indirection);
562 directory_request_set_resource(req, resource);
563 if (dir_purpose == DIR_PURPOSE_FETCH_CONSENSUS)
565 if (guard_state)
566 directory_request_set_guard_state(req, guard_state);
568 directory_request_free(req);
569 } else {
570 log_notice(LD_DIR,
571 "While fetching directory info, "
572 "no running dirservers known. Will try again later. "
573 "(purpose %d)", dir_purpose);
574 if (!purpose_needs_anonymity(dir_purpose, router_purpose, resource)) {
575 /* remember we tried them all and failed. */
576 directory_all_unreachable(time(NULL));
577 }
578 }
579}
580
581/** As directory_get_from_dirserver, but initiates a request to <i>every</i>
582 * directory authority other than ourself. Only for use by authorities when
583 * searching for missing information while voting. */
584void
586 uint8_t router_purpose,
587 const char *resource)
588{
591
592 SMARTLIST_FOREACH_BEGIN(router_get_trusted_dir_servers(),
593 dir_server_t *, ds) {
594 if (router_digest_is_me(ds->digest))
595 continue;
596 if (!(ds->type & V3_DIRINFO))
597 continue;
599 if (!rs) {
600 /* prefer to use the address in the consensus, but fall back to
601 * the hard-coded trusted_dir_server address if we don't have a
602 * consensus or this digest isn't in our consensus. */
603 rs = &ds->fake_status;
604 }
605 directory_request_t *req = directory_request_new(dir_purpose);
607 directory_request_set_router_purpose(req, router_purpose);
608 directory_request_set_resource(req, resource);
610 directory_request_free(req);
611 } SMARTLIST_FOREACH_END(ds);
612}
613
614/** Return true iff <b>ind</b> requires a multihop circuit. */
615static int
617{
618 return ind == DIRIND_ANON_DIRPORT || ind == DIRIND_ANONYMOUS;
619}
620
621/* Choose reachable OR and Dir addresses and ports from status, copying them
622 * into use_or_ap and use_dir_ap. If indirection is anonymous, then we're
623 * connecting via another relay, so choose the primary IPv4 address and ports.
624 *
625 * status should have at least one reachable address, if we can't choose a
626 * reachable address, warn and return -1. Otherwise, return 0.
627 */
628static int
629directory_choose_address_routerstatus(const routerstatus_t *status,
630 dir_indirection_t indirection,
631 tor_addr_port_t *use_or_ap,
632 tor_addr_port_t *use_dir_ap)
633{
634 tor_assert(status != NULL);
635 tor_assert(use_or_ap != NULL);
636 tor_assert(use_dir_ap != NULL);
637
638 const or_options_t *options = get_options();
639 int have_or = 0, have_dir = 0;
640
641 /* We expect status to have at least one reachable address if we're
642 * connecting to it directly.
643 *
644 * Therefore, we can simply use the other address if the one we want isn't
645 * allowed by the firewall.
646 *
647 * (When Tor uploads and downloads a hidden service descriptor, it uses
648 * DIRIND_ANONYMOUS. Even Single Onion Servers (NYI) use DIRIND_ANONYMOUS,
649 * to avoid HSDirs denying service by rejecting descriptors.)
650 */
651
652 /* Initialise the OR / Dir addresses */
653 tor_addr_make_null(&use_or_ap->addr, AF_UNSPEC);
654 use_or_ap->port = 0;
655 tor_addr_make_null(&use_dir_ap->addr, AF_UNSPEC);
656 use_dir_ap->port = 0;
657
658 /* ORPort connections */
659 if (indirection == DIRIND_ANONYMOUS) {
660 if (!tor_addr_is_null(&status->ipv4_addr)) {
661 /* Since we're going to build a 3-hop circuit and ask the 2nd relay
662 * to extend to this address, always use the primary (IPv4) OR address */
663 tor_addr_copy(&use_or_ap->addr, &status->ipv4_addr);
664 use_or_ap->port = status->ipv4_orport;
665 have_or = 1;
666 }
667 } else if (indirection == DIRIND_ONEHOP) {
668 /* We use an IPv6 address if we have one and we prefer it.
669 * Use the preferred address and port if they are reachable, otherwise,
670 * use the alternate address and port (if any).
671 */
672 reachable_addr_choose_from_rs(status, FIREWALL_OR_CONNECTION, 0,
673 use_or_ap);
674 have_or = tor_addr_port_is_valid_ap(use_or_ap, 0);
675 }
676
677 /* DirPort connections
678 * DIRIND_ONEHOP uses ORPort, but may fall back to the DirPort on relays */
679 if (indirection == DIRIND_DIRECT_CONN ||
680 indirection == DIRIND_ANON_DIRPORT ||
681 (indirection == DIRIND_ONEHOP
682 && !dirclient_must_use_begindir(options))) {
683 reachable_addr_choose_from_rs(status, FIREWALL_DIR_CONNECTION, 0,
684 use_dir_ap);
685 have_dir = tor_addr_port_is_valid_ap(use_dir_ap, 0);
686 }
687
688 /* We rejected all addresses in the relay's status. This means we can't
689 * connect to it. */
690 if (!have_or && !have_dir) {
691 static int logged_backtrace = 0;
692 char *ipv6_str = tor_addr_to_str_dup(&status->ipv6_addr);
693 log_info(LD_BUG, "Rejected all OR and Dir addresses from %s when "
694 "launching an outgoing directory connection to: IPv4 %s OR %d "
695 "Dir %d IPv6 %s OR %d Dir %d", routerstatus_describe(status),
696 fmt_addr(&status->ipv4_addr), status->ipv4_orport,
697 status->ipv4_dirport, ipv6_str, status->ipv6_orport,
698 status->ipv4_dirport);
699 tor_free(ipv6_str);
700 if (!logged_backtrace) {
701 log_backtrace(LOG_INFO, LD_BUG, "Addresses came from");
702 logged_backtrace = 1;
703 }
704 return -1;
705 }
706
707 return 0;
708}
709
710/** Called when we are unable to complete the client's request to a directory
711 * server due to a network error: Mark the router as down and try again if
712 * possible.
713 */
714void
716{
717 if (conn->guard_state) {
718 /* We haven't seen a success on this guard state, so consider it to have
719 * failed. */
721 }
723 /* We must not set a directory to non-running for HS purposes else we end
724 * up flagging nodes from the hashring has unusable. It doesn't have direct
725 * effect on the HS subsystem because the nodes are selected regardless of
726 * their status but still, we shouldn't flag them as non running.
727 *
728 * One example where this can go bad is if a tor instance gets added a lot
729 * of ephemeral services and with a network with problem then many nodes in
730 * the consenus ends up unusable.
731 *
732 * Furthermore, a service does close any pending directory connections
733 * before uploading a descriptor and thus we can end up here in a natural
734 * way since closing a pending directory connection leads to this code
735 * path. */
736 if (!DIR_PURPOSE_IS_HS(TO_CONN(conn)->purpose)) {
738 }
739 if (conn->base_.purpose == DIR_PURPOSE_FETCH_SERVERDESC ||
740 conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO) {
741 log_info(LD_DIR, "Giving up on serverdesc/extrainfo fetch from "
742 "directory server at %s; retrying",
747 } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_CONSENSUS) {
748 if (conn->requested_resource)
750 } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_CERTIFICATE) {
751 log_info(LD_DIR, "Giving up on certificate fetch from directory server "
752 "at %s; retrying",
755 } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_DETACHED_SIGNATURES) {
756 log_info(LD_DIR, "Giving up downloading detached signatures from %s",
758 } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_STATUS_VOTE) {
759 log_info(LD_DIR, "Giving up downloading votes from %s",
761 } else if (conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC) {
762 log_info(LD_DIR, "Giving up on downloading microdescriptors from "
763 "directory server at %s; will retry",
766 }
767}
768
769/** Helper: Attempt to fetch directly the descriptors of each bridge
770 * listed in <b>failed</b>.
771 */
772static void
774{
775 char digest[DIGEST_LEN];
776 SMARTLIST_FOREACH(descs, const char *, cp,
777 {
778 if (base16_decode(digest, DIGEST_LEN, cp, strlen(cp)) != DIGEST_LEN) {
779 log_warn(LD_BUG, "Malformed fingerprint in list: %s",
780 escaped(cp));
781 continue;
782 }
784 });
785}
786
787/** Called when an attempt to download one or more router descriptors
788 * or extra-info documents on connection <b>conn</b> failed.
789 */
790static void
792{
793 /* No need to increment the failure count for routerdescs, since
794 * it's not their fault. */
795
796 /* No need to relaunch descriptor downloads here: we already do it
797 * every 10 or 60 seconds (FOO_DESCRIPTOR_RETRY_INTERVAL) in main.c. */
799 conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO ||
800 conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC);
801
802 (void) conn;
803}
804
805/** Called when an attempt to download a bridge's routerdesc from
806 * one of the authorities failed due to a network error. If
807 * possible attempt to download descriptors from the bridge directly.
808 */
809static void
811{
812 smartlist_t *which = NULL;
813
814 /* Requests for bridge descriptors are in the form 'fp/', so ignore
815 anything else. */
816 if (!conn->requested_resource || strcmpstart(conn->requested_resource,"fp/"))
817 return;
818
819 which = smartlist_new();
821 + strlen("fp/"),
822 which, NULL, 0);
823
825 if (smartlist_len(which)) {
827 SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
828 }
829 smartlist_free(which);
830}
831
832/** Called when an attempt to fetch a certificate fails. */
833static void
835{
836 const char *fp_pfx = "fp/";
837 const char *fpsk_pfx = "fp-sk/";
838 smartlist_t *failed;
840
841 if (!conn->requested_resource)
842 return;
843 failed = smartlist_new();
844 /*
845 * We have two cases download by fingerprint (resource starts
846 * with "fp/") or download by fingerprint/signing key pair
847 * (resource starts with "fp-sk/").
848 */
849 if (!strcmpstart(conn->requested_resource, fp_pfx)) {
850 /* Download by fingerprint case */
852 strlen(fp_pfx),
853 failed, NULL, DSR_HEX);
854 SMARTLIST_FOREACH_BEGIN(failed, char *, cp) {
855 /* Null signing key digest indicates download by fp only */
856 authority_cert_dl_failed(cp, NULL, status);
857 tor_free(cp);
858 } SMARTLIST_FOREACH_END(cp);
859 } else if (!strcmpstart(conn->requested_resource, fpsk_pfx)) {
860 /* Download by (fp,sk) pairs */
862 strlen(fpsk_pfx), failed);
863 SMARTLIST_FOREACH_BEGIN(failed, fp_pair_t *, cp) {
864 authority_cert_dl_failed(cp->first, cp->second, status);
865 tor_free(cp);
866 } SMARTLIST_FOREACH_END(cp);
867 } else {
868 log_warn(LD_DIR,
869 "Don't know what to do with failure for cert fetch %s",
870 conn->requested_resource);
871 }
872
873 smartlist_free(failed);
874
876}
877
878/** Evaluate the situation and decide if we should use an encrypted
879 * "begindir-style" connection for this directory request.
880 * 0) If there is no DirPort, yes.
881 * 1) If or_port is 0, or it's a direct conn and or_port is firewalled
882 * or we're a dir mirror, no.
883 * 2) If we prefer to avoid begindir conns, and we're not fetching or
884 * publishing a bridge relay descriptor, no.
885 * 3) Else yes.
886 * If returning 0, return in *reason why we can't use begindir.
887 * reason must not be NULL.
888 */
889static int
891 const directory_request_t *req,
892 const char **reason)
893{
894 const tor_addr_t *or_addr = &req->or_addr_port.addr;
895 //const tor_addr_t *dir_addr = &req->dir_addr_port.addr;
896 const int or_port = req->or_addr_port.port;
897 const int dir_port = req->dir_addr_port.port;
898
899 const dir_indirection_t indirection = req->indirection;
900
901 tor_assert(reason);
902 *reason = NULL;
903
904 /* Reasons why we must use begindir */
905 if (!dir_port) {
906 *reason = "(using begindir - directory with no DirPort)";
907 return 1; /* We don't know a DirPort -- must begindir. */
908 }
909 /* Reasons why we can't possibly use begindir */
910 if (!or_port) {
911 *reason = "directory with unknown ORPort";
912 return 0; /* We don't know an ORPort -- no chance. */
913 }
914 if (indirection == DIRIND_DIRECT_CONN ||
915 indirection == DIRIND_ANON_DIRPORT) {
916 *reason = "DirPort connection";
917 return 0;
918 }
919 if (indirection == DIRIND_ONEHOP) {
920 /* We're firewalled and want a direct OR connection */
921 if (!reachable_addr_allows_addr(or_addr, or_port,
922 FIREWALL_OR_CONNECTION, 0, 0)) {
923 *reason = "ORPort not reachable";
924 return 0;
925 }
926 }
927 /* Reasons why we want to avoid using begindir */
928 if (indirection == DIRIND_ONEHOP) {
929 if (!dirclient_must_use_begindir(options)) {
930 *reason = "in relay mode";
931 return 0;
932 }
933 }
934 /* DIRIND_ONEHOP on a client, or DIRIND_ANONYMOUS
935 */
936 *reason = "(using begindir)";
937 return 1;
938}
939
940/**
941 * Create and return a new directory_request_t with purpose
942 * <b>dir_purpose</b>.
943 */
945directory_request_new(uint8_t dir_purpose)
946{
947 tor_assert(dir_purpose >= DIR_PURPOSE_MIN_);
948 tor_assert(dir_purpose <= DIR_PURPOSE_MAX_);
949 tor_assert(dir_purpose != DIR_PURPOSE_SERVER);
951
952 directory_request_t *result = tor_malloc_zero(sizeof(*result));
953 tor_addr_make_null(&result->or_addr_port.addr, AF_INET);
954 result->or_addr_port.port = 0;
955 tor_addr_make_null(&result->dir_addr_port.addr, AF_INET);
956 result->dir_addr_port.port = 0;
957 result->dir_purpose = dir_purpose;
958 result->router_purpose = ROUTER_PURPOSE_GENERAL;
959 result->indirection = DIRIND_ONEHOP;
960 return result;
961}
962/**
963 * Release all resources held by <b>req</b>.
964 */
965void
967{
968 if (req == NULL)
969 return;
970 config_free_lines(req->additional_headers);
971 tor_free(req);
972}
973/**
974 * Set the address and OR port to use for this directory request. If there is
975 * no OR port, we'll have to connect over the dirport. (If there are both,
976 * the indirection setting determines which to use.)
977 */
978void
980 const tor_addr_port_t *p)
981{
982 memcpy(&req->or_addr_port, p, sizeof(*p));
983}
984/**
985 * Set the address and dirport to use for this directory request. If there
986 * is no dirport, we'll have to connect over the OR port. (If there are both,
987 * the indirection setting determines which to use.)
988 */
989void
991 const tor_addr_port_t *p)
992{
993 memcpy(&req->dir_addr_port, p, sizeof(*p));
994}
995/**
996 * Set the RSA identity digest of the directory to use for this directory
997 * request.
998 */
999void
1001 const char *digest)
1002{
1003 memcpy(req->digest, digest, DIGEST_LEN);
1004}
1005/**
1006 * Set the router purpose associated with uploaded and downloaded router
1007 * descriptors and extrainfo documents in this directory request. The purpose
1008 * must be one of ROUTER_PURPOSE_GENERAL (the default) or
1009 * ROUTER_PURPOSE_BRIDGE.
1010 */
1011void
1013 uint8_t router_purpose)
1014{
1015 tor_assert(router_purpose == ROUTER_PURPOSE_GENERAL ||
1016 router_purpose == ROUTER_PURPOSE_BRIDGE);
1017 // assert that it actually makes sense to set this purpose, given
1018 // the dir_purpose.
1019 req->router_purpose = router_purpose;
1020}
1021/**
1022 * Set the indirection to be used for the directory request. The indirection
1023 * parameter configures whether to connect to a DirPort or ORPort, and whether
1024 * to anonymize the connection. DIRIND_ONEHOP (use ORPort, don't anonymize)
1025 * is the default. See dir_indirection_t for more information.
1026 */
1027void
1029 dir_indirection_t indirection)
1030{
1031 req->indirection = indirection;
1032}
1033
1034/**
1035 * Set a pointer to the resource to request from a directory. Different
1036 * request types use resources to indicate different components of their URL.
1037 * Note that only an alias to <b>resource</b> is stored, so the
1038 * <b>resource</b> must outlive the request.
1039 */
1040void
1042 const char *resource)
1043{
1044 req->resource = resource;
1045}
1046/**
1047 * Set a pointer to the payload to include with this directory request, along
1048 * with its length. Note that only an alias to <b>payload</b> is stored, so
1049 * the <b>payload</b> must outlive the request.
1050 */
1051void
1053 const char *payload,
1054 size_t payload_len)
1055{
1056 tor_assert(DIR_PURPOSE_IS_UPLOAD(req->dir_purpose));
1057
1058 req->payload = payload;
1059 req->payload_len = payload_len;
1060}
1061/**
1062 * Set an if-modified-since date to send along with the request. The
1063 * default is 0 (meaning, send no if-modified-since header).
1064 */
1065void
1067 time_t if_modified_since)
1068{
1069 req->if_modified_since = if_modified_since;
1070}
1071
1072/** Include a header of name <b>key</b> with content <b>val</b> in the
1073 * request. Neither may include newlines or other odd characters. Their
1074 * ordering is not currently guaranteed.
1075 *
1076 * Note that, as elsewhere in this module, header keys include a trailing
1077 * colon and space.
1078 */
1079void
1081 const char *key,
1082 const char *val)
1083{
1084 config_line_prepend(&req->additional_headers, key, val);
1085}
1086/**
1087 * Set an object containing HS connection identifier to be associated with
1088 * this request. Note that only an alias to <b>ident</b> is stored, so the
1089 * <b>ident</b> object must outlive the request.
1090 */
1091void
1093 const hs_ident_dir_conn_t *ident)
1094{
1095 if (ident) {
1096 tor_assert(req->dir_purpose == DIR_PURPOSE_UPLOAD_HSDESC);
1097 }
1098 req->hs_ident = ident;
1099}
1100/**
1101 * Set an object containing HS connection identifier to be associated with
1102 * this fetch request. Note that only an alias to <b>ident</b> is stored, so
1103 * the <b>ident</b> object must outlive the request.
1104 */
1105void
1107 const hs_ident_dir_conn_t *ident)
1108{
1109 if (ident) {
1110 tor_assert(req->dir_purpose == DIR_PURPOSE_FETCH_HSDESC);
1111 }
1112 req->hs_ident = ident;
1113}
1114/** Set a static circuit_guard_state_t object to affliate with the request in
1115 * <b>req</b>. This object will receive notification when the attempt to
1116 * connect to the guard either succeeds or fails. */
1117void
1119 circuit_guard_state_t *state)
1120{
1121 req->guard_state = state;
1122}
1123
1124/**
1125 * Internal: Return true if any information for contacting the directory in
1126 * <b>req</b> has been set, other than by the routerstatus. */
1127static int
1129{
1130 /* We only check for ports here, since we don't use an addr unless the port
1131 * is set */
1132 return (req->or_addr_port.port ||
1133 req->dir_addr_port.port ||
1134 ! tor_digest_is_zero(req->digest));
1135}
1136
1137/**
1138 * Set the routerstatus to use for the directory associated with this
1139 * request. If this option is set, then no other function to set the
1140 * directory's address or identity should be called.
1141 */
1142void
1144 const routerstatus_t *status)
1145{
1146 req->routerstatus = status;
1147}
1148
1149/**
1150 * Helper: update the addresses, ports, and identities in <b>req</b>
1151 * from the routerstatus object in <b>req</b>. Return 0 on success.
1152 * On failure, warn and return -1.
1153 */
1154static int
1156
1157{
1158 const routerstatus_t *status = req->routerstatus;
1159 if (BUG(status == NULL))
1160 return -1;
1161 const or_options_t *options = get_options();
1162 const node_t *node;
1163 tor_addr_port_t use_or_ap, use_dir_ap;
1164 const int anonymized_connection = dirind_is_anon(req->indirection);
1165
1166 tor_assert(status != NULL);
1167
1168 node = node_get_by_id(status->identity_digest);
1169
1170 /* XXX The below check is wrong: !node means it's not in the consensus,
1171 * but we haven't checked if we have a descriptor for it -- and also,
1172 * we only care about the descriptor if it's a begindir-style anonymized
1173 * connection. */
1174 if (!node && anonymized_connection) {
1175 log_info(LD_DIR, "Not sending anonymized request to directory '%s'; we "
1176 "don't have its router descriptor.",
1177 routerstatus_describe(status));
1178 return -1;
1179 }
1180
1181 if (options->ExcludeNodes && options->StrictNodes &&
1182 routerset_contains_routerstatus(options->ExcludeNodes, status, -1)) {
1183 log_warn(LD_DIR, "Wanted to contact directory mirror %s for %s, but "
1184 "it's in our ExcludedNodes list and StrictNodes is set. "
1185 "Skipping. This choice might make your Tor not work.",
1186 routerstatus_describe(status),
1187 dir_conn_purpose_to_string(req->dir_purpose));
1188 return -1;
1189 }
1190
1191 /* At this point, if we are a client making a direct connection to a
1192 * directory server, we have selected a server that has at least one address
1193 * allowed by ClientUseIPv4/6 and Reachable{"",OR,Dir}Addresses. This
1194 * selection uses the preference in ClientPreferIPv6{OR,Dir}Port, if
1195 * possible. (If UseBridges is set, clients always use IPv6, and prefer it
1196 * by default.)
1197 *
1198 * Now choose an address that we can use to connect to the directory server.
1199 */
1200 if (directory_choose_address_routerstatus(status,
1201 req->indirection, &use_or_ap,
1202 &use_dir_ap) < 0) {
1203 return -1;
1204 }
1205
1206 /* One last thing: If we're talking to an authority, we might want to use
1207 * a special HTTP port for it based on our purpose.
1208 */
1209 if (req->indirection == DIRIND_DIRECT_CONN && status->is_authority) {
1211 status->identity_digest);
1212 if (ds) {
1213 const tor_addr_port_t *v4 = NULL;
1214 if (authdir_mode_v3(get_options())) {
1215 // An authority connecting to another authority should always
1216 // prefer the VOTING usage, if one is specifically configured.
1218 ds, AUTH_USAGE_VOTING, AF_INET);
1219 }
1220 if (! v4) {
1221 // Everybody else should prefer a usage dependent on their
1222 // the dir_purpose.
1223 auth_dirport_usage_t usage =
1224 auth_dirport_usage_for_purpose(req->dir_purpose);
1225 v4 = trusted_dir_server_get_dirport(ds, usage, AF_INET);
1226 }
1227 tor_assert_nonfatal(v4);
1228 if (v4) {
1229 // XXXX We could, if we wanted, also select a v6 address. But a v4
1230 // address must exist here, and we as a relay are required to support
1231 // ipv4. So we just that.
1232 tor_addr_port_copy(&use_dir_ap, v4);
1233 }
1234 }
1235 }
1236
1237 directory_request_set_or_addr_port(req, &use_or_ap);
1238 directory_request_set_dir_addr_port(req, &use_dir_ap);
1239 directory_request_set_directory_id_digest(req, status->identity_digest);
1240 return 0;
1241}
1242
1243/**
1244 * Launch the provided directory request, configured in <b>request</b>.
1245 * After this function is called, you can free <b>request</b>.
1246 */
1247MOCK_IMPL(void,
1249{
1250 tor_assert(request);
1251 if (request->routerstatus) {
1252 tor_assert_nonfatal(
1255 return; // or here XXXX
1256 }
1257 }
1258
1259 const tor_addr_port_t *or_addr_port = &request->or_addr_port;
1260 const tor_addr_port_t *dir_addr_port = &request->dir_addr_port;
1261 const char *digest = request->digest;
1262 const uint8_t dir_purpose = request->dir_purpose;
1263 const uint8_t router_purpose = request->router_purpose;
1264 const dir_indirection_t indirection = request->indirection;
1265 const char *resource = request->resource;
1266 const hs_ident_dir_conn_t *hs_ident = request->hs_ident;
1267 circuit_guard_state_t *guard_state = request->guard_state;
1268
1269 tor_assert(or_addr_port->port || dir_addr_port->port);
1270 tor_assert(digest);
1271
1272 dir_connection_t *conn;
1273 const or_options_t *options = get_options();
1274 int socket_error = 0;
1275 const char *begindir_reason = NULL;
1276 /* Should the connection be to a relay's OR port (and inside that we will
1277 * send our directory request)? */
1278 const int use_begindir =
1279 directory_command_should_use_begindir(options, request, &begindir_reason);
1280
1281 /* Will the connection go via a three-hop Tor circuit? Note that this
1282 * is separate from whether it will use_begindir. */
1283 const int anonymized_connection = dirind_is_anon(indirection);
1284
1285 /* What is the address we want to make the directory request to? If
1286 * we're making a begindir request this is the ORPort of the relay
1287 * we're contacting; if not a begindir request, this is its DirPort.
1288 * Note that if anonymized_connection is true, we won't be initiating
1289 * a connection directly to this address. */
1290 tor_addr_t addr;
1291 tor_addr_copy(&addr, &(use_begindir ? or_addr_port : dir_addr_port)->addr);
1292 uint16_t port = (use_begindir ? or_addr_port : dir_addr_port)->port;
1293
1294 log_debug(LD_DIR, "anonymized %d, use_begindir %d.",
1295 anonymized_connection, use_begindir);
1296
1297 log_debug(LD_DIR, "Initiating %s", dir_conn_purpose_to_string(dir_purpose));
1298
1299 if (purpose_needs_anonymity(dir_purpose, router_purpose, resource)) {
1300 tor_assert(anonymized_connection ||
1301 hs_service_non_anonymous_mode_enabled(options));
1302 }
1303
1304 /* use encrypted begindir connections for everything except relays
1305 * this provides better protection for directory fetches */
1306 if (!use_begindir && dirclient_must_use_begindir(options)) {
1307 log_warn(LD_BUG, "Client could not use begindir connection: %s",
1308 begindir_reason ? begindir_reason : "(NULL)");
1309 return;
1310 }
1311
1312 /* ensure that we don't make direct connections when a SOCKS server is
1313 * configured. */
1314 if (!anonymized_connection && !use_begindir && !options->HTTPProxy &&
1315 (options->Socks4Proxy || options->Socks5Proxy)) {
1316 log_warn(LD_DIR, "Cannot connect to a directory server through a "
1317 "SOCKS proxy!");
1318 return;
1319 }
1320
1321 /* Make sure that the destination addr and port we picked is viable. */
1322 if (!port || tor_addr_is_null(&addr)) {
1323 static int logged_backtrace = 0;
1324 log_warn(LD_DIR,
1325 "Cannot make an outgoing %sconnection without a remote %sPort.",
1326 use_begindir ? "begindir " : "",
1327 use_begindir ? "OR" : "Dir");
1328 if (!logged_backtrace) {
1329 log_backtrace(LOG_INFO, LD_BUG, "Address came from");
1330 logged_backtrace = 1;
1331 }
1332 return;
1333 }
1334
1335 conn = dir_connection_new(tor_addr_family(&addr));
1336
1337 /* set up conn so it's got all the data we need to remember */
1338 tor_addr_copy(&conn->base_.addr, &addr);
1339 conn->base_.port = port;
1340 conn->base_.address = tor_addr_to_str_dup(&addr);
1341 memcpy(conn->identity_digest, digest, DIGEST_LEN);
1342
1343 conn->base_.purpose = dir_purpose;
1344 conn->router_purpose = router_purpose;
1345
1346 /* give it an initial state */
1347 conn->base_.state = DIR_CONN_STATE_CONNECTING;
1348
1349 /* decide whether we can learn our IP address from this conn */
1350 /* XXXX This is a bad name for this field now. */
1351 conn->dirconn_direct = !anonymized_connection;
1352
1353 if (hs_ident) {
1354 conn->hs_ident = hs_ident_dir_conn_dup(hs_ident);
1355 }
1356
1357 if (!anonymized_connection && !use_begindir) {
1358 /* then we want to connect to dirport directly */
1359
1360 if (options->HTTPProxy) {
1361 tor_addr_copy(&addr, &options->HTTPProxyAddr);
1362 port = options->HTTPProxyPort;
1363 }
1364
1365 // In this case we should not have picked a directory guard.
1366 if (BUG(guard_state)) {
1367 entry_guard_cancel(&guard_state);
1368 }
1369
1370 // XXXX This is the case where we replace.
1371
1372 switch (connection_connect(TO_CONN(conn), conn->base_.address, &addr,
1373 port, &socket_error)) {
1374 case -1:
1375 connection_mark_for_close(TO_CONN(conn));
1376 return;
1377 case 1:
1378 /* start flushing conn */
1380 FALLTHROUGH;
1381 case 0:
1382 /* queue the command on the outbuf */
1383 directory_send_command(conn, 1, request);
1385 /* writable indicates finish, readable indicates broken link,
1386 error indicates broken link in windowsland. */
1387 }
1388 } else {
1389 /* We will use a Tor circuit (maybe 1-hop, maybe 3-hop, maybe with
1390 * begindir, maybe not with begindir) */
1391
1392 entry_connection_t *linked_conn;
1393
1394 /* Anonymized tunneled connections can never share a circuit.
1395 * One-hop directory connections can share circuits with each other
1396 * but nothing else. */
1397 int iso_flags = anonymized_connection ? ISO_STREAM : ISO_SESSIONGRP;
1398
1399 /* If it's an anonymized connection, remember the fact that we
1400 * wanted it for later: maybe we'll want it again soon. */
1401 if (anonymized_connection && use_begindir)
1402 rep_hist_note_used_internal(time(NULL), 0, 1);
1403 else if (anonymized_connection && !use_begindir)
1404 rep_hist_note_used_port(time(NULL), conn->base_.port);
1405
1406 // In this case we should not have a directory guard; we'll
1407 // get a regular guard later when we build the circuit.
1408 if (BUG(anonymized_connection && guard_state)) {
1409 entry_guard_cancel(&guard_state);
1410 }
1411
1412 conn->guard_state = guard_state;
1413
1414 /* make an AP connection
1415 * populate it and add it at the right state
1416 * hook up both sides
1417 */
1418 linked_conn =
1420 conn->base_.address, conn->base_.port,
1421 digest,
1422 SESSION_GROUP_DIRCONN, iso_flags,
1423 use_begindir, !anonymized_connection);
1424 if (!linked_conn) {
1425 log_warn(LD_NET,"Making tunnel to dirserver failed.");
1426 connection_mark_for_close(TO_CONN(conn));
1427 return;
1428 }
1429
1430 if (connection_add(TO_CONN(conn)) < 0) {
1431 log_warn(LD_NET,"Unable to add connection for link to dirserver.");
1432 connection_mark_for_close(TO_CONN(conn));
1433 return;
1434 }
1436 /* queue the command on the outbuf */
1437 directory_send_command(conn, 0, request);
1438
1441 }
1442}
1443
1444/** Helper for sorting
1445 *
1446 * sort strings alphabetically
1447 *
1448 * XXXX we have a smartlist_sort_strings() function, right?
1449 */
1450static int
1451compare_strs_(const void **a, const void **b)
1452{
1453 const char *s1 = *a, *s2 = *b;
1454 return strcmp(s1, s2);
1455}
1456
1457#define CONDITIONAL_CONSENSUS_FPR_LEN 3
1458CTASSERT(CONDITIONAL_CONSENSUS_FPR_LEN <= DIGEST_LEN);
1459
1460/** Return the URL we should use for a consensus download.
1461 *
1462 * Use the "conditional consensus downloading" feature described in
1463 * dir-spec.txt, i.e.
1464 * GET .../consensus/<b>fpr</b>+<b>fpr</b>+<b>fpr</b>
1465 *
1466 * If 'resource' is provided, it is the name of a consensus flavor to request.
1467 */
1468static char *
1469directory_get_consensus_url(const char *resource)
1470{
1471 char *url = NULL;
1472 const char *hyphen, *flavor;
1473 if (resource==NULL || strcmp(resource, "ns")==0) {
1474 flavor = ""; /* Request ns consensuses as "", so older servers will work*/
1475 hyphen = "";
1476 } else {
1477 flavor = resource;
1478 hyphen = "-";
1479 }
1480
1481 {
1482 char *authority_id_list;
1483 smartlist_t *authority_digests = smartlist_new();
1484
1485 SMARTLIST_FOREACH_BEGIN(router_get_trusted_dir_servers(),
1486 dir_server_t *, ds) {
1487 char *hex;
1488 if (!(ds->type & V3_DIRINFO))
1489 continue;
1490
1491 hex = tor_malloc(2*CONDITIONAL_CONSENSUS_FPR_LEN+1);
1492 base16_encode(hex, 2*CONDITIONAL_CONSENSUS_FPR_LEN+1,
1493 ds->v3_identity_digest, CONDITIONAL_CONSENSUS_FPR_LEN);
1494 smartlist_add(authority_digests, hex);
1495 } SMARTLIST_FOREACH_END(ds);
1496 smartlist_sort(authority_digests, compare_strs_);
1497 authority_id_list = smartlist_join_strings(authority_digests,
1498 "+", 0, NULL);
1499
1500 tor_asprintf(&url, "/tor/status-vote/current/consensus%s%s/%s.z",
1501 hyphen, flavor, authority_id_list);
1502
1503 SMARTLIST_FOREACH(authority_digests, char *, cp, tor_free(cp));
1504 smartlist_free(authority_digests);
1505 tor_free(authority_id_list);
1506 }
1507 return url;
1508}
1509
1510/**
1511 * Copies the ipv6 from source to destination, subject to buffer size limit
1512 * size. If decorate is true, makes sure the copied address is decorated.
1513 */
1514static void
1515copy_ipv6_address(char* destination, const char* source, size_t len,
1516 int decorate) {
1517 tor_assert(destination);
1518 tor_assert(source);
1519
1520 if (decorate && source[0] != '[') {
1521 tor_snprintf(destination, len, "[%s]", source);
1522 } else {
1523 strlcpy(destination, source, len);
1524 }
1525}
1526
1527/** Queue an appropriate HTTP command for <b>request</b> on
1528 * <b>conn</b>->outbuf. If <b>direct</b> is true, we're making a
1529 * non-anonymized connection to the dirport.
1530 */
1531static void
1533 const int direct,
1534 const directory_request_t *req)
1535{
1536 tor_assert(req);
1537 const int purpose = req->dir_purpose;
1538 const char *resource = req->resource;
1539 const char *payload = req->payload;
1540 const size_t payload_len = req->payload_len;
1541 const time_t if_modified_since = req->if_modified_since;
1542 const int anonymized_connection = dirind_is_anon(req->indirection);
1543
1544 char proxystring[256];
1545 char hoststring[128];
1546 /* NEEDS to be the same size hoststring.
1547 Will be decorated with brackets around it if it is ipv6. */
1548 char decorated_address[128];
1549 smartlist_t *headers = smartlist_new();
1550 char *url;
1551 char *accept_encoding;
1552 size_t url_len;
1553 char request[8192];
1554 size_t request_len, total_request_len = 0;
1555 const char *httpcommand = NULL;
1556
1557 tor_assert(conn);
1558 tor_assert(conn->base_.type == CONN_TYPE_DIR);
1559
1561 if (resource)
1562 conn->requested_resource = tor_strdup(resource);
1563
1564 /* decorate the ip address if it is ipv6 */
1565 if (strchr(conn->base_.address, ':')) {
1566 copy_ipv6_address(decorated_address, conn->base_.address,
1567 sizeof(decorated_address), 1);
1568 } else {
1569 strlcpy(decorated_address, conn->base_.address, sizeof(decorated_address));
1570 }
1571
1572 /* come up with a string for which Host: we want */
1573 if (conn->base_.port == 80) {
1574 strlcpy(hoststring, decorated_address, sizeof(hoststring));
1575 } else {
1576 tor_snprintf(hoststring, sizeof(hoststring), "%s:%d",
1577 decorated_address, conn->base_.port);
1578 }
1579
1580 /* Format if-modified-since */
1581 if (if_modified_since) {
1582 char b[RFC1123_TIME_LEN+1];
1583 format_rfc1123_time(b, if_modified_since);
1584 smartlist_add_asprintf(headers, "If-Modified-Since: %s\r\n", b);
1585 }
1586
1587 /* come up with some proxy lines, if we're using one. */
1588 if (direct && get_options()->HTTPProxy) {
1589 char *base64_authenticator=NULL;
1590 const char *authenticator = get_options()->HTTPProxyAuthenticator;
1591
1592 tor_snprintf(proxystring, sizeof(proxystring),"http://%s", hoststring);
1593 if (authenticator) {
1594 base64_authenticator = alloc_http_authenticator(authenticator);
1595 if (!base64_authenticator)
1596 log_warn(LD_BUG, "Encoding http authenticator failed");
1597 }
1598 if (base64_authenticator) {
1599 smartlist_add_asprintf(headers,
1600 "Proxy-Authorization: Basic %s\r\n",
1601 base64_authenticator);
1602 tor_free(base64_authenticator);
1603 }
1604 } else {
1605 proxystring[0] = 0;
1606 }
1607
1608 if (! anonymized_connection) {
1609 /* Add Accept-Encoding. */
1610 accept_encoding = accept_encoding_header();
1611 smartlist_add_asprintf(headers, "Accept-Encoding: %s\r\n",
1612 accept_encoding);
1613 tor_free(accept_encoding);
1614 }
1615
1616 /* Add additional headers, if any */
1617 {
1618 config_line_t *h;
1619 for (h = req->additional_headers; h; h = h->next) {
1620 smartlist_add_asprintf(headers, "%s%s\r\n", h->key, h->value);
1621 }
1622 }
1623
1624 switch (purpose) {
1626 /* resource is optional. If present, it's a flavor name */
1627 tor_assert(!payload);
1628 httpcommand = "GET";
1629 url = directory_get_consensus_url(resource);
1630 log_info(LD_DIR, "Downloading consensus from %s using %s",
1631 hoststring, url);
1632 break;
1634 tor_assert(resource);
1635 tor_assert(!payload);
1636 httpcommand = "GET";
1637 tor_asprintf(&url, "/tor/keys/%s", resource);
1638 break;
1640 tor_assert(resource);
1641 tor_assert(!payload);
1642 httpcommand = "GET";
1643 tor_asprintf(&url, "/tor/status-vote/next/%s.z", resource);
1644 break;
1646 tor_assert(!resource);
1647 tor_assert(!payload);
1648 httpcommand = "GET";
1649 url = tor_strdup("/tor/status-vote/next/consensus-signatures.z");
1650 break;
1652 tor_assert(resource);
1653 httpcommand = "GET";
1654 tor_asprintf(&url, "/tor/server/%s", resource);
1655 break;
1657 tor_assert(resource);
1658 httpcommand = "GET";
1659 tor_asprintf(&url, "/tor/extra/%s", resource);
1660 break;
1662 tor_assert(resource);
1663 httpcommand = "GET";
1664 tor_asprintf(&url, "/tor/micro/%s", resource);
1665 break;
1667 const char *why = router_get_descriptor_gen_reason();
1668 tor_assert(!resource);
1669 tor_assert(payload);
1670 httpcommand = "POST";
1671 url = tor_strdup("/tor/");
1672 if (!why) {
1673 why = "for no reason at all";
1674 }
1675 smartlist_add_asprintf(headers, "X-Desc-Gen-Reason: %s\r\n", why);
1676 break;
1677 }
1679 tor_assert(!resource);
1680 tor_assert(payload);
1681 httpcommand = "POST";
1682 url = tor_strdup("/tor/post/vote");
1683 break;
1685 tor_assert(!resource);
1686 tor_assert(payload);
1687 httpcommand = "POST";
1688 url = tor_strdup("/tor/post/consensus-signature");
1689 break;
1691 tor_assert(resource);
1692 tor_assert(strlen(resource) <= ED25519_BASE64_LEN);
1693 tor_assert(!payload);
1694 httpcommand = "GET";
1695 tor_asprintf(&url, "/tor/hs/3/%s", resource);
1696 break;
1698 tor_assert(resource);
1699 tor_assert(payload);
1700 httpcommand = "POST";
1701 tor_asprintf(&url, "/tor/hs/%s/publish", resource);
1702 break;
1703 default:
1704 tor_assert(0);
1705 return;
1706 }
1707
1708 /* warn in the non-tunneled case */
1709 if (direct && (strlen(proxystring) + strlen(url) >= 4096)) {
1710 log_warn(LD_BUG,
1711 "Squid does not like URLs longer than 4095 bytes, and this "
1712 "one is %d bytes long: %s%s",
1713 (int)(strlen(proxystring) + strlen(url)), proxystring, url);
1714 }
1715
1716 tor_snprintf(request, sizeof(request), "%s %s", httpcommand, proxystring);
1717
1718 request_len = strlen(request);
1719 total_request_len += request_len;
1720 connection_buf_add(request, request_len, TO_CONN(conn));
1721
1722 url_len = strlen(url);
1723 total_request_len += url_len;
1724 connection_buf_add(url, url_len, TO_CONN(conn));
1725 tor_free(url);
1726
1727 if (!strcmp(httpcommand, "POST") || payload) {
1728 smartlist_add_asprintf(headers, "Content-Length: %lu\r\n",
1729 payload ? (unsigned long)payload_len : 0);
1730 }
1731
1732 {
1733 char *header = smartlist_join_strings(headers, "", 0, NULL);
1734 tor_snprintf(request, sizeof(request), " HTTP/1.0\r\nHost: %s\r\n%s\r\n",
1735 hoststring, header);
1736 tor_free(header);
1737 }
1738
1739 request_len = strlen(request);
1740 total_request_len += request_len;
1741 connection_buf_add(request, request_len, TO_CONN(conn));
1742
1743 if (payload) {
1744 /* then send the payload afterwards too */
1745 connection_buf_add(payload, payload_len, TO_CONN(conn));
1746 total_request_len += payload_len;
1747 }
1748
1749 SMARTLIST_FOREACH(headers, char *, h, tor_free(h));
1750 smartlist_free(headers);
1751
1752 log_debug(LD_DIR,
1753 "Sent request to directory server %s "
1754 "(purpose: %d, request size: %"TOR_PRIuSZ", "
1755 "payload size: %"TOR_PRIuSZ")",
1757 conn->base_.purpose,
1758 (total_request_len),
1759 (payload ? payload_len : 0));
1760}
1761
1762/** Return true iff <b>body</b> doesn't start with a plausible router or
1763 * network-status or microdescriptor opening. This is a sign of possible
1764 * compression. */
1765static int
1766body_is_plausible(const char *body, size_t len, int purpose)
1767{
1768 int i;
1769 if (len == 0)
1770 return 1; /* empty bodies don't need decompression */
1771 if (len < 32)
1772 return 0;
1773 if (purpose == DIR_PURPOSE_FETCH_MICRODESC) {
1774 return (!strcmpstart(body,"onion-key"));
1775 }
1776
1777 if (!strcmpstart(body,"router") ||
1778 !strcmpstart(body,"network-status"))
1779 return 1;
1780 for (i=0;i<32;++i) {
1781 if (!TOR_ISPRINT(body[i]) && !TOR_ISSPACE(body[i]))
1782 return 0;
1783 }
1784
1785 return 1;
1786}
1787
1788/** Called when we've just fetched a bunch of router descriptors in
1789 * <b>body</b>. The list <b>which</b>, if present, holds digests for
1790 * descriptors we requested: descriptor digests if <b>descriptor_digests</b>
1791 * is true, or identity digests otherwise. Parse the descriptors, validate
1792 * them, and annotate them as having purpose <b>purpose</b> and as having been
1793 * downloaded from <b>source</b>.
1794 *
1795 * Return the number of routers actually added. */
1796static int
1797load_downloaded_routers(const char *body, smartlist_t *which,
1798 int descriptor_digests,
1799 int router_purpose,
1800 const char *source)
1801{
1802 char buf[256];
1803 char time_buf[ISO_TIME_LEN+1];
1804 int added = 0;
1805 int general = router_purpose == ROUTER_PURPOSE_GENERAL;
1806 format_iso_time(time_buf, time(NULL));
1807 tor_assert(source);
1808
1809 if (tor_snprintf(buf, sizeof(buf),
1810 "@downloaded-at %s\n"
1811 "@source %s\n"
1812 "%s%s%s", time_buf, escaped(source),
1813 !general ? "@purpose " : "",
1814 !general ? router_purpose_to_string(router_purpose) : "",
1815 !general ? "\n" : "")<0)
1816 return added;
1817
1818 added = router_load_routers_from_string(body, NULL, SAVED_NOWHERE, which,
1819 descriptor_digests, buf);
1820 if (added && general)
1821 control_event_boot_dir(BOOTSTRAP_STATUS_LOADING_DESCRIPTORS,
1823 return added;
1824}
1825
1827 const response_handler_args_t *);
1829 const response_handler_args_t *);
1831 const response_handler_args_t *);
1833 const response_handler_args_t *);
1835 const response_handler_args_t *);
1837 const response_handler_args_t *);
1839 const response_handler_args_t *);
1841 const response_handler_args_t *);
1842
1843static int
1844dir_client_decompress_response_body(char **bodyp, size_t *bodylenp,
1845 dir_connection_t *conn,
1846 compress_method_t compression,
1847 int anonymized_connection)
1848{
1849 int rv = 0;
1850 const char *body = *bodyp;
1851 size_t body_len = *bodylenp;
1852 int allow_partial = (conn->base_.purpose == DIR_PURPOSE_FETCH_SERVERDESC ||
1853 conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO ||
1854 conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC);
1855
1856 int plausible = body_is_plausible(body, body_len, conn->base_.purpose);
1857
1858 if (plausible && compression == NO_METHOD) {
1859 return 0;
1860 }
1861
1862 int severity = LOG_DEBUG;
1863 char *new_body = NULL;
1864 size_t new_len = 0;
1865 const char *description1, *description2;
1866 int want_to_try_both = 0;
1867 int tried_both = 0;
1868 compress_method_t guessed = detect_compression_method(body, body_len);
1869
1870 description1 = compression_method_get_human_name(compression);
1871
1872 if (BUG(description1 == NULL))
1873 description1 = compression_method_get_human_name(UNKNOWN_METHOD);
1874
1875 if (guessed == UNKNOWN_METHOD && !plausible)
1876 description2 = "confusing binary junk";
1877 else
1878 description2 = compression_method_get_human_name(guessed);
1879
1880 /* Tell the user if we don't believe what we're told about compression.*/
1881 want_to_try_both = (compression == UNKNOWN_METHOD ||
1882 guessed != compression);
1883 if (want_to_try_both) {
1884 severity = LOG_PROTOCOL_WARN;
1885 }
1886
1887 tor_log(severity, LD_HTTP,
1888 "HTTP body from %s was labeled as %s, "
1889 "%s it seems to be %s.%s",
1891 description1,
1892 guessed != compression?"but":"and",
1893 description2,
1894 (compression>0 && guessed>0 && want_to_try_both)?
1895 " Trying both.":"");
1896
1897 /* Try declared compression first if we can.
1898 * tor_compress_supports_method() also returns true for NO_METHOD.
1899 * Ensure that the server is not sending us data compressed using a
1900 * compression method that is not allowed for anonymous connections. */
1901 if (anonymized_connection &&
1904 rv = -1;
1905 goto done;
1906 }
1907
1908 if (tor_compress_supports_method(compression)) {
1909 tor_uncompress(&new_body, &new_len, body, body_len, compression,
1910 !allow_partial, LOG_PROTOCOL_WARN);
1911 if (new_body) {
1912 /* We succeeded with the declared compression method. Great! */
1913 rv = 0;
1914 goto done;
1915 }
1916 }
1917
1918 /* Okay, if that didn't work, and we think that it was compressed
1919 * differently, try that. */
1920 if (anonymized_connection &&
1923 rv = -1;
1924 goto done;
1925 }
1926
1927 if (tor_compress_supports_method(guessed) &&
1928 compression != guessed) {
1929 tor_uncompress(&new_body, &new_len, body, body_len, guessed,
1930 !allow_partial, LOG_INFO);
1931 tried_both = 1;
1932 }
1933 /* If we're pretty sure that we have a compressed directory, and
1934 * we didn't manage to uncompress it, then warn and bail. */
1935 if (!plausible && !new_body) {
1936 static ratelim_t warning_limit = RATELIM_INIT(60 * 60);
1937 log_fn_ratelim(&warning_limit, LOG_WARN, LD_HTTP,
1938 "Unable to decompress HTTP body (tried %s%s%s, on %s).",
1939 description1,
1940 tried_both?" and ":"",
1941 tried_both?description2:"",
1943 rv = -1;
1944 goto done;
1945 }
1946
1947 done:
1948 if (new_body) {
1949 if (rv == 0) {
1950 /* success! */
1951 tor_free(*bodyp);
1952 *bodyp = new_body;
1953 *bodylenp = new_len;
1954 } else {
1955 tor_free(new_body);
1956 }
1957 }
1958
1959 return rv;
1960}
1961
1962/**
1963 * Total number of bytes downloaded of each directory purpose, when
1964 * bootstrapped, and when not bootstrapped.
1965 *
1966 * (For example, the number of bytes downloaded of purpose p while
1967 * not fully bootstrapped is total_dl[p][false].)
1968 **/
1969static uint64_t total_dl[DIR_PURPOSE_MAX_][2];
1970
1971/**
1972 * Heartbeat: dump a summary of how many bytes of which purpose we've
1973 * downloaded, when bootstrapping and when not bootstrapping.
1974 **/
1975void
1977{
1978 const or_options_t *options = get_options();
1979 for (int bootstrapped = 0; bootstrapped < 2; ++bootstrapped) {
1980 smartlist_t *lines = smartlist_new();
1981 for (int i=0; i < DIR_PURPOSE_MAX_; ++i) {
1982 uint64_t n = total_dl[i][bootstrapped];
1983 if (n == 0)
1984 continue;
1985 if (options->SafeLogging_ != SAFELOG_SCRUB_NONE &&
1987 continue;
1988 smartlist_add_asprintf(lines, "%"PRIu64" (%s)",
1990 }
1991
1992 if (smartlist_len(lines) > 0) {
1993 char *log_line = smartlist_join_strings(lines, "; ", 0, NULL);
1994 log_notice(LD_NET, "While %sbootstrapping, fetched this many bytes: %s",
1995 bootstrapped?"not ":"", log_line);
1996 tor_free(log_line);
1997
1998 SMARTLIST_FOREACH(lines, char *, s, tor_free(s));
1999 }
2000 smartlist_free(lines);
2001 }
2002}
2003
2004/** We are a client, and we've finished reading the server's
2005 * response. Parse it and act appropriately.
2006 *
2007 * If we're still happy with using this directory server in the future, return
2008 * 0. Otherwise return -1; and the caller should consider trying the request
2009 * again.
2010 *
2011 * The caller will take care of marking the connection for close.
2012 */
2013static int
2015{
2016 char *body = NULL;
2017 char *headers = NULL;
2018 char *reason = NULL;
2019 size_t body_len = 0;
2020 int status_code;
2021 time_t date_header = 0;
2022 long apparent_skew;
2023 compress_method_t compression;
2024 int skewed = 0;
2025 int rv;
2026 int allow_partial = (conn->base_.purpose == DIR_PURPOSE_FETCH_SERVERDESC ||
2027 conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO ||
2028 conn->base_.purpose == DIR_PURPOSE_FETCH_MICRODESC);
2029 size_t received_bytes;
2030 const int anonymized_connection =
2031 purpose_needs_anonymity(conn->base_.purpose,
2032 conn->router_purpose,
2033 conn->requested_resource);
2034
2035 received_bytes = connection_get_inbuf_len(TO_CONN(conn));
2036
2037 log_debug(LD_DIR, "Downloaded %"TOR_PRIuSZ" bytes on connection of purpose "
2038 "%s; bootstrap %d%%",
2039 received_bytes,
2041 control_get_bootstrap_percent());
2042 {
2043 bool bootstrapped = control_get_bootstrap_percent() == 100;
2044 total_dl[conn->base_.purpose][bootstrapped] += received_bytes;
2045 }
2046
2048 &headers, MAX_HEADERS_SIZE,
2049 &body, &body_len, MAX_DIR_DL_SIZE,
2050 allow_partial)) {
2051 case -1: /* overflow */
2052 log_warn(LD_PROTOCOL,
2053 "'fetch' response too large (%s). Closing.",
2055 return -1;
2056 case 0:
2057 log_info(LD_HTTP,
2058 "'fetch' response not all here, but we're at eof. Closing.");
2059 return -1;
2060 /* case 1, fall through */
2061 }
2062
2063 if (parse_http_response(headers, &status_code, &date_header,
2064 &compression, &reason) < 0) {
2065 log_warn(LD_HTTP,"Unparseable headers (%s). Closing.",
2067 rv = -1;
2068 goto done;
2069 }
2070 if (!reason) reason = tor_strdup("[no reason given]");
2071
2073 "Received response on %s: %d %s "
2074 "(purpose: %d, response size: %"TOR_PRIuSZ
2075#ifdef MEASUREMENTS_21206
2076 ", data cells received: %d, data cells sent: %d"
2077#endif
2078 ", compression: %d)",
2080 status_code,
2081 escaped(reason), conn->base_.purpose,
2082 (received_bytes),
2083#ifdef MEASUREMENTS_21206
2084 conn->data_cells_received, conn->data_cells_sent,
2085#endif
2086 compression);
2087
2088 if (conn->guard_state) {
2089 /* we count the connection as successful once we can read from it. We do
2090 * not, however, delay use of the circuit here, since it's just for a
2091 * one-hop directory request. */
2092 /* XXXXprop271 note that this will not do the right thing for other
2093 * waiting circuits that would be triggered by this circuit becoming
2094 * complete/usable. But that's ok, I think.
2095 */
2097 circuit_guard_state_free(conn->guard_state);
2098 conn->guard_state = NULL;
2099 }
2100
2101 /* now check if it's got any hints for us about our IP address. */
2102 if (conn->dirconn_direct) {
2103 char *guess = http_get_header(headers, X_ADDRESS_HEADER);
2104 if (guess) {
2105 tor_addr_t addr;
2106 if (tor_addr_parse(&addr, guess) < 0) {
2107 log_debug(LD_DIR, "Malformed X-Your-Address-Is header %s. Ignoring.",
2108 escaped(guess));
2109 } else {
2110 relay_address_new_suggestion(&addr, &TO_CONN(conn)->addr, NULL);
2111 }
2112 tor_free(guess);
2113 }
2114 }
2115
2116 if (date_header > 0) {
2117 /* The date header was written very soon after we sent our request,
2118 * so compute the skew as the difference between sending the request
2119 * and the date header. (We used to check now-date_header, but that's
2120 * inaccurate if we spend a lot of time downloading.)
2121 */
2122 apparent_skew = conn->base_.timestamp_last_write_allowed - date_header;
2123 if (labs(apparent_skew)>ALLOW_DIRECTORY_TIME_SKEW) {
2124 int trusted = router_digest_is_trusted_dir(conn->identity_digest);
2125 clock_skew_warning(TO_CONN(conn), apparent_skew, trusted, LD_HTTP,
2126 "directory", "DIRSERV");
2127 skewed = 1; /* don't check the recommended-versions line */
2128 } else {
2129 log_debug(LD_HTTP, "Time on received directory is within tolerance; "
2130 "we are %ld seconds skewed. (That's okay.)", apparent_skew);
2131 }
2132 }
2133 (void) skewed; /* skewed isn't used yet. */
2134
2135 if (status_code == 503) {
2136 routerstatus_t *rs;
2137 dir_server_t *ds;
2138 const char *id_digest = conn->identity_digest;
2139 log_info(LD_DIR,"Received http status code %d (%s) from server "
2140 "%s. I'll try again soon.",
2141 status_code, escaped(reason),
2143 time_t now = approx_time();
2144 if ((rs = router_get_mutable_consensus_status_by_id(id_digest)))
2145 rs->last_dir_503_at = now;
2146 if ((ds = router_get_fallback_dirserver_by_digest(id_digest)))
2147 ds->fake_status.last_dir_503_at = now;
2148
2149 rv = -1;
2150 goto done;
2151 }
2152
2153 if (dir_client_decompress_response_body(&body, &body_len,
2154 conn, compression, anonymized_connection) < 0) {
2155 rv = -1;
2156 goto done;
2157 }
2158
2159 response_handler_args_t args;
2160 memset(&args, 0, sizeof(args));
2161 args.status_code = status_code;
2162 args.reason = reason;
2163 args.body = body;
2164 args.body_len = body_len;
2165 args.headers = headers;
2166
2167 switch (conn->base_.purpose) {
2169 rv = handle_response_fetch_consensus(conn, &args);
2170 break;
2172 rv = handle_response_fetch_certificate(conn, &args);
2173 break;
2175 rv = handle_response_fetch_status_vote(conn, &args);
2176 break;
2179 break;
2182 rv = handle_response_fetch_desc(conn, &args);
2183 break;
2185 rv = handle_response_fetch_microdesc(conn, &args);
2186 break;
2188 rv = handle_response_upload_dir(conn, &args);
2189 break;
2191 rv = handle_response_upload_signatures(conn, &args);
2192 break;
2194 rv = handle_response_upload_vote(conn, &args);
2195 break;
2197 rv = handle_response_upload_hsdesc(conn, &args);
2198 break;
2200 rv = handle_response_fetch_hsdesc_v3(conn, &args);
2201 break;
2202 default:
2204 rv = -1;
2205 break;
2206 }
2207
2208 done:
2209 tor_free(body);
2210 tor_free(headers);
2211 tor_free(reason);
2212 return rv;
2213}
2214
2215/**
2216 * Handler function: processes a response to a request for a networkstatus
2217 * consensus document by checking the consensus, storing it, and marking
2218 * router requests as reachable.
2219 **/
2220STATIC int
2222 const response_handler_args_t *args)
2223{
2225 const int status_code = args->status_code;
2226 const char *body = args->body;
2227 const size_t body_len = args->body_len;
2228 const char *reason = args->reason;
2229 const time_t now = approx_time();
2230
2231 const char *consensus;
2232 char *new_consensus = NULL;
2233 const char *sourcename;
2234
2235 int r;
2236 const char *flavname = conn->requested_resource;
2237 if (status_code != 200) {
2238 int severity = (status_code == 304) ? LOG_INFO : LOG_WARN;
2239 tor_log(severity, LD_DIR,
2240 "Received http status code %d (%s) from server "
2241 "%s while fetching consensus directory.",
2242 status_code, escaped(reason),
2244 networkstatus_consensus_download_failed(status_code, flavname);
2245 return -1;
2246 }
2247
2248 if (looks_like_a_consensus_diff(body, body_len)) {
2249 /* First find our previous consensus. Maybe it's in ram, maybe not. */
2250 cached_dir_t *cd = NULL;
2251 const char *consensus_body = NULL;
2252 size_t consensus_body_len;
2253 tor_mmap_t *mapped_consensus = NULL;
2254
2255 /* We prefer the mmap'd version over the cached_dir_t version,
2256 * since that matches the logic we used when we picked a consensus
2257 * back in dir_consensus_request_set_additional_headers. */
2258 mapped_consensus = networkstatus_map_cached_consensus(flavname);
2259 if (mapped_consensus) {
2260 consensus_body = mapped_consensus->data;
2261 consensus_body_len = mapped_consensus->size;
2262 } else {
2263 cd = dirserv_get_consensus(flavname);
2264 if (cd) {
2265 consensus_body = cd->dir;
2266 consensus_body_len = cd->dir_len;
2267 }
2268 }
2269 if (!consensus_body) {
2270 log_warn(LD_DIR, "Received a consensus diff, but we can't find "
2271 "any %s-flavored consensus in our current cache.",flavname);
2272 tor_munmap_file(mapped_consensus);
2274 // XXXX if this happens too much, see below
2275 return -1;
2276 }
2277
2278 new_consensus = consensus_diff_apply(consensus_body, consensus_body_len,
2279 body, body_len);
2280 tor_munmap_file(mapped_consensus);
2281 if (new_consensus == NULL) {
2282 log_warn(LD_DIR, "Could not apply consensus diff received from server "
2283 "%s", connection_describe_peer(TO_CONN(conn)));
2284 // XXXX If this happens too many times, we should maybe not use
2285 // XXXX this directory for diffs any more?
2287 return -1;
2288 }
2289 log_info(LD_DIR, "Applied consensus diff (size %d) from server "
2290 "%s, resulting in a new consensus document (size %d).",
2291 (int)body_len, connection_describe_peer(TO_CONN(conn)),
2292 (int)strlen(new_consensus));
2293 consensus = new_consensus;
2294 sourcename = "generated based on a diff";
2295 } else {
2296 log_info(LD_DIR,"Received consensus directory (body size %d) from server "
2297 "%s", (int)body_len, connection_describe_peer(TO_CONN(conn)));
2298 consensus = body;
2299 sourcename = "downloaded";
2300 }
2301
2302 if ((r=networkstatus_set_current_consensus(consensus,
2303 strlen(consensus),
2304 flavname, 0,
2305 conn->identity_digest))<0) {
2307 "Unable to load %s consensus directory %s from "
2308 "server %s. I'll try again soon.",
2309 flavname, sourcename,
2312 tor_free(new_consensus);
2313 return -1;
2314 }
2315
2316 /* If we launched other fetches for this consensus, cancel them. */
2317 connection_dir_close_consensus_fetches(conn, flavname);
2318
2319 /* update the list of routers and directory guards */
2322 directory_info_has_arrived(now, 0, 0);
2323
2324 if (authdir_mode_v3(get_options())) {
2327 }
2328 log_info(LD_DIR, "Successfully loaded consensus.");
2329
2330 tor_free(new_consensus);
2331 return 0;
2332}
2333
2334/**
2335 * Handler function: processes a response to a request for one or more
2336 * authority certificates
2337 **/
2338static int
2340 const response_handler_args_t *args)
2341{
2343 const int status_code = args->status_code;
2344 const char *reason = args->reason;
2345 const char *body = args->body;
2346 const size_t body_len = args->body_len;
2347
2348 if (status_code != 200) {
2349 log_warn(LD_DIR,
2350 "Received http status code %d (%s) from server "
2351 "%s while fetching \"/tor/keys/%s\".",
2352 status_code, escaped(reason),
2354 conn->requested_resource);
2355 connection_dir_download_cert_failed(conn, status_code);
2356 return -1;
2357 }
2358 log_info(LD_DIR,"Received authority certificates (body size %d) from "
2359 "server %s",
2360 (int)body_len, connection_describe_peer(TO_CONN(conn)));
2361
2362 /*
2363 * Tell trusted_dirs_load_certs_from_string() whether it was by fp
2364 * or fp-sk pair.
2365 */
2366 int src_code = -1;
2367 if (!strcmpstart(conn->requested_resource, "fp/")) {
2368 src_code = TRUSTED_DIRS_CERTS_SRC_DL_BY_ID_DIGEST;
2369 } else if (!strcmpstart(conn->requested_resource, "fp-sk/")) {
2370 src_code = TRUSTED_DIRS_CERTS_SRC_DL_BY_ID_SK_DIGEST;
2371 }
2372
2373 if (src_code != -1) {
2374 if (trusted_dirs_load_certs_from_string(body, src_code, 1,
2375 conn->identity_digest)<0) {
2376 log_warn(LD_DIR, "Unable to parse fetched certificates");
2377 /* if we fetched more than one and only some failed, the successful
2378 * ones got flushed to disk so it's safe to call this on them */
2379 connection_dir_download_cert_failed(conn, status_code);
2380 } else {
2381 time_t now = approx_time();
2382 directory_info_has_arrived(now, 0, 0);
2383 log_info(LD_DIR, "Successfully loaded certificates from fetch.");
2384 }
2385 } else {
2386 log_warn(LD_DIR,
2387 "Couldn't figure out what to do with fetched certificates for "
2388 "unknown resource %s",
2389 conn->requested_resource);
2390 connection_dir_download_cert_failed(conn, status_code);
2391 }
2392 return 0;
2393}
2394
2395/**
2396 * Handler function: processes a response to a request for an authority's
2397 * current networkstatus vote.
2398 **/
2399static int
2401 const response_handler_args_t *args)
2402{
2404 const int status_code = args->status_code;
2405 const char *reason = args->reason;
2406 const char *body = args->body;
2407 const size_t body_len = args->body_len;
2408
2409 const char *msg;
2410 int st;
2411 log_notice(LD_DIR,"Got votes (body size %d) from server %s",
2412 (int)body_len, connection_describe_peer(TO_CONN(conn)));
2413 if (status_code != 200) {
2414 log_warn(LD_DIR,
2415 "Received http status code %d (%s) from server "
2416 "%s while fetching \"/tor/status-vote/next/%s.z\".",
2417 status_code, escaped(reason),
2419 conn->requested_resource);
2420 return -1;
2421 }
2422 dirvote_add_vote(body, 0, TO_CONN(conn)->address, &msg, &st);
2423 if (st > 299) {
2424 log_warn(LD_DIR, "Error adding retrieved vote: %s", msg);
2425 } else {
2426 log_info(LD_DIR, "Added vote(s) successfully [msg: %s]", msg);
2427 }
2428
2429 return 0;
2430}
2431
2432/**
2433 * Handler function: processes a response to a request for the signatures
2434 * that an authority knows about on a given consensus.
2435 **/
2436static int
2438 const response_handler_args_t *args)
2439{
2441 const int status_code = args->status_code;
2442 const char *reason = args->reason;
2443 const char *body = args->body;
2444 const size_t body_len = args->body_len;
2445
2446 const char *msg = NULL;
2447 log_info(LD_DIR,"Got detached signatures (body size %d) from server %s",
2448 (int)body_len,
2450 if (status_code != 200) {
2451 log_warn(LD_DIR,
2452 "Received http status code %d (%s) from server %s while fetching "
2453 "\"/tor/status-vote/next/consensus-signatures.z\".",
2454 status_code, escaped(reason),
2456 return -1;
2457 }
2458 if (dirvote_add_signatures(body, conn->base_.address, &msg)<0) {
2459 log_warn(LD_DIR, "Problem adding detached signatures from %s: %s",
2461 msg?msg:"???");
2462 }
2463
2464 return 0;
2465}
2466
2467/**
2468 * Handler function: processes a response to a request for a group of server
2469 * descriptors or an extrainfo documents.
2470 **/
2471static int
2473 const response_handler_args_t *args)
2474{
2476 conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO);
2477 const int status_code = args->status_code;
2478 const char *reason = args->reason;
2479 const char *body = args->body;
2480 const size_t body_len = args->body_len;
2481
2482 int was_ei = conn->base_.purpose == DIR_PURPOSE_FETCH_EXTRAINFO;
2483 smartlist_t *which = NULL;
2484 int n_asked_for = 0;
2485 int descriptor_digests = conn->requested_resource &&
2486 !strcmpstart(conn->requested_resource,"d/");
2487 log_info(LD_DIR,"Received %s (body size %d) from server %s",
2488 was_ei ? "extra server info" : "server info",
2489 (int)body_len, connection_describe_peer(TO_CONN(conn)));
2490 if (conn->requested_resource &&
2491 (!strcmpstart(conn->requested_resource,"d/") ||
2492 !strcmpstart(conn->requested_resource,"fp/"))) {
2493 which = smartlist_new();
2495 (descriptor_digests ? 2 : 3),
2496 which, NULL, 0);
2497 n_asked_for = smartlist_len(which);
2498 }
2499 if (status_code != 200) {
2500 int dir_okay = status_code == 404 ||
2501 (status_code == 400 && !strcmp(reason, "Servers unavailable.")) ||
2502 status_code == 301;
2503 /* 404 means that it didn't have them; no big deal.
2504 * Older (pre-0.1.1.8) servers said 400 Servers unavailable instead.
2505 * 301 is considered as an error since Tor does not follow redirects,
2506 * which means we failed to reach the server we wanted. */
2507 log_fn(dir_okay ? LOG_INFO : LOG_WARN, LD_DIR,
2508 "Received http status code %d (%s) from server %s "
2509 "while fetching \"/tor/server/%s\". I'll try again soon.",
2510 status_code, escaped(reason),
2512 conn->requested_resource);
2513 if (!which) {
2515 } else {
2516 dir_routerdesc_download_failed(which, status_code,
2517 conn->router_purpose,
2518 was_ei, descriptor_digests);
2519 SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
2520 smartlist_free(which);
2521 }
2522 return dir_okay ? 0 : -1;
2523 }
2524 /* Learn the routers, assuming we requested by fingerprint or "all"
2525 * or "authority".
2526 *
2527 * We use "authority" to fetch our own descriptor for
2528 * testing, and to fetch bridge descriptors for bootstrapping. Ignore
2529 * the output of "authority" requests unless we are using bridges,
2530 * since otherwise they'll be the response from reachability tests,
2531 * and we don't really want to add that to our routerlist. */
2532 if (which || (conn->requested_resource &&
2533 (!strcmpstart(conn->requested_resource, "all") ||
2534 (!strcmpstart(conn->requested_resource, "authority") &&
2535 get_options()->UseBridges)))) {
2536 /* as we learn from them, we remove them from 'which' */
2537 if (was_ei) {
2539 descriptor_digests);
2540 } else {
2541 //router_load_routers_from_string(body, NULL, SAVED_NOWHERE, which,
2542 // descriptor_digests, conn->router_purpose);
2543 if (load_downloaded_routers(body, which, descriptor_digests,
2544 conn->router_purpose,
2545 conn->base_.address)) {
2546 time_t now = approx_time();
2547 directory_info_has_arrived(now, 0, 1);
2548 }
2549 }
2550 }
2551 if (which) { /* mark remaining ones as failed */
2552 log_info(LD_DIR, "Received %d/%d %s requested from %s",
2553 n_asked_for-smartlist_len(which), n_asked_for,
2554 was_ei ? "extra-info documents" : "router descriptors",
2556 if (smartlist_len(which)) {
2557 dir_routerdesc_download_failed(which, status_code,
2558 conn->router_purpose,
2559 was_ei, descriptor_digests);
2560 }
2561 SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
2562 smartlist_free(which);
2563 }
2564
2565 return 0;
2566}
2567
2568/**
2569 * Handler function: processes a response to a request for a group of
2570 * microdescriptors
2571 **/
2572STATIC int
2574 const response_handler_args_t *args)
2575{
2577 const int status_code = args->status_code;
2578 const char *reason = args->reason;
2579 const char *body = args->body;
2580 const size_t body_len = args->body_len;
2581
2582 smartlist_t *which = NULL;
2583 log_info(LD_DIR,"Received answer to microdescriptor request (status %d, "
2584 "body size %d) from server %s",
2585 status_code, (int)body_len,
2588 !strcmpstart(conn->requested_resource, "d/"));
2589 tor_assert_nonfatal(!fast_mem_is_zero(conn->identity_digest, DIGEST_LEN));
2590 which = smartlist_new();
2592 which, NULL,
2593 DSR_DIGEST256|DSR_BASE64);
2594 if (status_code != 200) {
2595 log_info(LD_DIR, "Received status code %d (%s) from server "
2596 "%s while fetching \"/tor/micro/%s\". I'll try again "
2597 "soon.",
2598 status_code, escaped(reason),
2600 conn->requested_resource);
2601 dir_microdesc_download_failed(which, status_code, conn->identity_digest);
2602 SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
2603 smartlist_free(which);
2604 return 0;
2605 } else {
2606 smartlist_t *mds;
2607 time_t now = approx_time();
2609 body, body+body_len, SAVED_NOWHERE, 0,
2610 now, which);
2611 if (smartlist_len(which)) {
2612 /* Mark remaining ones as failed. */
2613 dir_microdesc_download_failed(which, status_code, conn->identity_digest);
2614 }
2615 if (mds && smartlist_len(mds)) {
2616 control_event_boot_dir(BOOTSTRAP_STATUS_LOADING_DESCRIPTORS,
2618 directory_info_has_arrived(now, 0, 1);
2619 }
2620 SMARTLIST_FOREACH(which, char *, cp, tor_free(cp));
2621 smartlist_free(which);
2622 smartlist_free(mds);
2623 }
2624
2625 return 0;
2626}
2627
2628/**
2629 * Handler function: processes a response to a POST request to upload our
2630 * router descriptor.
2631 **/
2632static int
2634 const response_handler_args_t *args)
2635{
2637 const int status_code = args->status_code;
2638 const char *reason = args->reason;
2639 const char *headers = args->headers;
2640
2641 switch (status_code) {
2642 case 200: {
2643 dir_server_t *ds =
2645 char *rejected_hdr = http_get_header(headers,
2646 "X-Descriptor-Not-New: ");
2647 if (rejected_hdr) {
2648 if (!strcmp(rejected_hdr, "Yes")) {
2649 log_info(LD_GENERAL,
2650 "Authority '%s' declined our descriptor (not new)",
2651 ds->nickname);
2652 /* XXXX use this information; be sure to upload next one
2653 * sooner. -NM */
2654 /* XXXX++ On further thought, the task above implies that we're
2655 * basing our regenerate-descriptor time on when we uploaded the
2656 * last descriptor, not on the published time of the last
2657 * descriptor. If those are different, that's a bad thing to
2658 * do. -NM */
2659 }
2660 tor_free(rejected_hdr);
2661 }
2662 log_info(LD_GENERAL,"eof (status 200) after uploading server "
2663 "descriptor: finished.");
2665 LOG_NOTICE, "ACCEPTED_SERVER_DESCRIPTOR DIRAUTH=%s:%d",
2666 conn->base_.address, conn->base_.port);
2667
2670 control_event_server_status(LOG_NOTICE, "GOOD_SERVER_DESCRIPTOR");
2671 }
2672 break;
2673 case 400:
2674 log_warn(LD_GENERAL,"http status 400 (%s) response from "
2675 "dirserver %s. Please correct.",
2676 escaped(reason), connection_describe_peer(TO_CONN(conn)));
2678 "BAD_SERVER_DESCRIPTOR DIRAUTH=%s:%d REASON=\"%s\"",
2679 conn->base_.address, conn->base_.port, escaped(reason));
2680 break;
2681 default:
2682 log_warn(LD_GENERAL,
2683 "HTTP status %d (%s) was unexpected while uploading "
2684 "descriptor to server %s'. Possibly the server is "
2685 "misconfigured?",
2686 status_code, escaped(reason),
2688 break;
2689 }
2690 /* return 0 in all cases, since we don't want to mark any
2691 * dirservers down just because they don't like us. */
2692
2693 return 0;
2694}
2695
2696/**
2697 * Handler function: processes a response to POST request to upload our
2698 * own networkstatus vote.
2699 **/
2700static int
2702 const response_handler_args_t *args)
2703{
2705 const int status_code = args->status_code;
2706 const char *reason = args->reason;
2707
2708 switch (status_code) {
2709 case 200: {
2710 log_notice(LD_DIR,"Uploaded my vote to dirserver %s",
2712 }
2713 break;
2714 case 400:
2715 log_warn(LD_DIR,"http status 400 (%s) response after uploading "
2716 "vote to dirserver %s. Please correct.",
2717 escaped(reason), connection_describe_peer(TO_CONN(conn)));
2718 break;
2719 default:
2720 log_warn(LD_GENERAL,
2721 "HTTP status %d (%s) was unexpected while uploading "
2722 "vote to server %s.",
2723 status_code, escaped(reason),
2725 break;
2726 }
2727 /* return 0 in all cases, since we don't want to mark any
2728 * dirservers down just because they don't like us. */
2729 return 0;
2730}
2731
2732/**
2733 * Handler function: processes a response to POST request to upload our
2734 * view of the signatures on the current consensus.
2735 **/
2736static int
2738 const response_handler_args_t *args)
2739{
2741 const int status_code = args->status_code;
2742 const char *reason = args->reason;
2743
2744 switch (status_code) {
2745 case 200: {
2746 log_notice(LD_DIR,"Uploaded signature(s) to dirserver %s",
2748 }
2749 break;
2750 case 400:
2751 log_warn(LD_DIR,"http status 400 (%s) response after uploading "
2752 "signatures to dirserver %s. Please correct.",
2753 escaped(reason), connection_describe_peer(TO_CONN(conn)));
2754 break;
2755 default:
2756 log_warn(LD_GENERAL,
2757 "HTTP status %d (%s) was unexpected while uploading "
2758 "signatures to server %s.",
2759 status_code, escaped(reason),
2761 break;
2762 }
2763 /* return 0 in all cases, since we don't want to mark any
2764 * dirservers down just because they don't like us. */
2765
2766 return 0;
2767}
2768
2769/**
2770 * Handler function: processes a response to a request for a v3 hidden service
2771 * descriptor.
2772 **/
2773STATIC int
2775 const response_handler_args_t *args)
2776{
2777 const int status_code = args->status_code;
2778 const char *reason = args->reason;
2779 const char *body = args->body;
2780 const size_t body_len = args->body_len;
2781
2782 tor_assert(conn->hs_ident);
2783
2784 log_info(LD_REND,"Received v3 hsdesc (body size %d, status %d (%s))",
2785 (int)body_len, status_code, escaped(reason));
2786
2787 hs_client_dir_fetch_done(conn, reason, body, status_code);
2788 return 0;
2789}
2790
2791/**
2792 * Handler function: processes a response to a POST request to upload an
2793 * hidden service descriptor.
2794 **/
2795static int
2797 const response_handler_args_t *args)
2798{
2799 const int status_code = args->status_code;
2800 const char *reason = args->reason;
2801
2802 tor_assert(conn);
2804
2805 log_info(LD_REND, "Uploaded hidden service descriptor (status %d "
2806 "(%s))",
2807 status_code, escaped(reason));
2808 /* For this directory response, it MUST have an hidden service identifier on
2809 * this connection. */
2810 tor_assert(conn->hs_ident);
2811 switch (status_code) {
2812 case 200:
2813 log_info(LD_REND, "Uploading hidden service descriptor: "
2814 "finished with status 200 (%s)", escaped(reason));
2815 hs_control_desc_event_uploaded(conn->hs_ident, conn->identity_digest);
2816 break;
2817 case 400:
2818 log_fn(LOG_PROTOCOL_WARN, LD_REND,
2819 "Uploading hidden service descriptor: http "
2820 "status 400 (%s) response from dirserver "
2821 "%s. Malformed hidden service descriptor?",
2822 escaped(reason), connection_describe_peer(TO_CONN(conn)));
2823 hs_control_desc_event_failed(conn->hs_ident, conn->identity_digest,
2824 "UPLOAD_REJECTED");
2825 break;
2826 default:
2827 log_warn(LD_REND, "Uploading hidden service descriptor: http "
2828 "status %d (%s) response unexpected (server "
2829 "%s').",
2830 status_code, escaped(reason),
2832 hs_control_desc_event_failed(conn->hs_ident, conn->identity_digest,
2833 "UNEXPECTED");
2834 break;
2835 }
2836
2837 return 0;
2838}
2839
2840/** Called when a directory connection reaches EOF. */
2841int
2843{
2844 int retval;
2845 if (conn->base_.state != DIR_CONN_STATE_CLIENT_READING) {
2846 log_info(LD_HTTP,"conn reached eof, not reading. [state=%d] Closing.",
2847 conn->base_.state);
2848 connection_close_immediate(TO_CONN(conn)); /* error: give up on flushing */
2849 connection_mark_for_close(TO_CONN(conn));
2850 return -1;
2851 }
2852
2853 retval = connection_dir_client_reached_eof(conn);
2854 if (retval == 0) /* success */
2856 connection_mark_for_close(TO_CONN(conn));
2857 return retval;
2858}
2859/** We are closing a dir connection: If <b>dir_conn</b> is a dir connection
2860 * that tried to fetch an HS descriptor, check if it successfully fetched it,
2861 * or if we need to try again. */
2862void
2864{
2865 connection_t *conn = TO_CONN(dir_conn);
2866
2867 /* Check for v3 rend desc fetch */
2868 if (conn->purpose == DIR_PURPOSE_FETCH_HSDESC &&
2869 dir_conn->hs_ident &&
2870 !ed25519_public_key_is_zero(&dir_conn->hs_ident->identity_pk)) {
2871 hs_client_refetch_hsdesc(&dir_conn->hs_ident->identity_pk);
2872 }
2873}
2874
2875/** Array of compression methods to use (if supported) for requesting
2876 * compressed data, ordered from best to worst. */
2878 LZMA_METHOD,
2879 ZSTD_METHOD,
2880 ZLIB_METHOD,
2881 GZIP_METHOD,
2882 NO_METHOD
2883};
2884
2885/** Array of allowed compression methods to use (if supported) when receiving a
2886 * response from a request that was required to be anonymous. */
2888 ZLIB_METHOD,
2889 GZIP_METHOD,
2890 NO_METHOD
2891};
2892
2893/** Return a newly allocated string containing a comma separated list of
2894 * supported encodings. */
2895STATIC char *
2897{
2898 smartlist_t *methods = smartlist_new();
2899 char *header = NULL;
2900 compress_method_t method;
2901 unsigned i;
2902
2903 for (i = 0; i < ARRAY_LENGTH(client_meth_pref); ++i) {
2904 method = client_meth_pref[i];
2905 if (tor_compress_supports_method(method))
2906 smartlist_add(methods, (char *)compression_method_get_name(method));
2907 }
2908
2909 header = smartlist_join_strings(methods, ", ", 0, NULL);
2910 smartlist_free(methods);
2911
2912 return header;
2913}
2914
2915/** Check if the given compression method is allowed for a connection that is
2916 * supposed to be anonymous. Returns 1 if the compression method is allowed,
2917 * otherwise 0. */
2918STATIC int
2920{
2921 unsigned u;
2922
2924 ++u) {
2925 compress_method_t allowed_method =
2927
2928 if (! tor_compress_supports_method(allowed_method))
2929 continue;
2930
2931 if (method == allowed_method)
2932 return 1;
2933 }
2934
2935 return 0;
2936}
2937
2938/** Log a warning when a remote server has sent us a document using a
2939 * compression method that is not allowed for anonymous directory requests. */
2940STATIC void
2942{
2943 log_fn(LOG_PROTOCOL_WARN, LD_HTTP,
2944 "Received a %s HTTP response, which is not "
2945 "allowed for anonymous directory requests.",
2947}
2948
2949/* We just got a new consensus! If there are other in-progress requests
2950 * for this consensus flavor (for example because we launched several in
2951 * parallel), cancel them.
2952 *
2953 * We do this check here (not just in
2954 * connection_ap_handshake_attach_circuit()) to handle the edge case where
2955 * a consensus fetch begins and ends before some other one tries to attach to
2956 * a circuit, in which case the other one won't know that we're all happy now.
2957 *
2958 * Don't mark the conn that just gave us the consensus -- otherwise we
2959 * would end up double-marking it when it cleans itself up.
2960 */
2961static void
2962connection_dir_close_consensus_fetches(dir_connection_t *except_this_one,
2963 const char *resource)
2964{
2965 smartlist_t *conns_to_close =
2967 resource);
2968 SMARTLIST_FOREACH_BEGIN(conns_to_close, dir_connection_t *, d) {
2969 if (d == except_this_one)
2970 continue;
2971 log_info(LD_DIR, "Closing consensus fetch (to %s) since one "
2972 "has just arrived.", connection_describe_peer(TO_CONN(d)));
2973 connection_mark_for_close(TO_CONN(d));
2974 } SMARTLIST_FOREACH_END(d);
2975 smartlist_free(conns_to_close);
2976}
2977/** Called when one or more routerdesc (or extrainfo, if <b>was_extrainfo</b>)
2978 * fetches have failed (with uppercase fingerprints listed in <b>failed</b>,
2979 * either as descriptor digests or as identity digests based on
2980 * <b>was_descriptor_digests</b>).
2981 */
2982static void
2984 int router_purpose,
2985 int was_extrainfo, int was_descriptor_digests)
2986{
2987 char digest[DIGEST_LEN];
2988 time_t now = time(NULL);
2990 if (!was_descriptor_digests) {
2991 if (router_purpose == ROUTER_PURPOSE_BRIDGE) {
2992 tor_assert(!was_extrainfo);
2994 }
2995 return; /* FFFF should implement for other-than-router-purpose someday */
2996 }
2997 SMARTLIST_FOREACH_BEGIN(failed, const char *, cp) {
2998 download_status_t *dls = NULL;
2999 if (base16_decode(digest, DIGEST_LEN, cp, strlen(cp)) != DIGEST_LEN) {
3000 log_warn(LD_BUG, "Malformed fingerprint in list: %s", escaped(cp));
3001 continue;
3002 }
3003 if (was_extrainfo) {
3006 if (sd)
3007 dls = &sd->ei_dl_status;
3008 } else {
3010 }
3011 if (!dls)
3012 continue;
3013 download_status_increment_failure(dls, status_code, cp, server, now);
3014 } SMARTLIST_FOREACH_END(cp);
3015
3016 /* No need to relaunch descriptor downloads here: we already do it
3017 * every 10 or 60 seconds (FOO_DESCRIPTOR_RETRY_INTERVAL) in main.c. */
3018}
3019
3020/** Called when a connection to download microdescriptors from relay with
3021 * <b>dir_id</b> has failed in whole or in part. <b>failed</b> is a list
3022 * of every microdesc digest we didn't get. <b>status_code</b> is the http
3023 * status code we received. Reschedule the microdesc downloads as
3024 * appropriate. */
3025static void
3027 int status_code, const char *dir_id)
3028{
3029 networkstatus_t *consensus
3031 routerstatus_t *rs;
3032 download_status_t *dls;
3033 time_t now = time(NULL);
3035
3036 if (! consensus)
3037 return;
3038
3039 /* We failed to fetch a microdescriptor from 'dir_id', note it down
3040 * so that we don't try the same relay next time... */
3042
3043 SMARTLIST_FOREACH_BEGIN(failed, const char *, d) {
3045 if (!rs)
3046 continue;
3047 dls = &rs->dl_status;
3048
3049 { /* Increment the failure count for this md fetch */
3050 char buf[BASE64_DIGEST256_LEN+1];
3051 digest256_to_base64(buf, d);
3052 log_info(LD_DIR, "Failed to download md %s from %s",
3053 buf, hex_str(dir_id, DIGEST_LEN));
3054 download_status_increment_failure(dls, status_code, buf,
3055 server, now);
3056 }
3057 } SMARTLIST_FOREACH_END(d);
3058}
void tor_addr_copy(tor_addr_t *dest, const tor_addr_t *src)
Definition: address.c:933
int tor_addr_parse(tor_addr_t *addr, const char *src)
Definition: address.c:1349
void tor_addr_make_null(tor_addr_t *a, sa_family_t family)
Definition: address.c:235
int tor_addr_is_null(const tor_addr_t *addr)
Definition: address.c:780
char * tor_addr_to_str_dup(const tor_addr_t *addr)
Definition: address.c:1164
void tor_addr_port_copy(tor_addr_port_t *dest, const tor_addr_port_t *source)
Definition: address.c:2121
static sa_family_t tor_addr_family(const tor_addr_t *a)
Definition: address.h:187
#define fmt_addr(a)
Definition: address.h:239
time_t approx_time(void)
Definition: approx_time.c:32
void authority_cert_dl_failed(const char *id_digest, const char *signing_key_digest, int status)
Definition: authcert.c:681
int trusted_dirs_load_certs_from_string(const char *contents, int source, int flush, const char *source_dir)
Definition: authcert.c:373
Header file for authcert.c.
Header file for directory authority mode.
Header for backtrace.c.
const char * hex_str(const char *from, size_t fromlen)
Definition: binascii.c:34
int base16_decode(char *dest, size_t destlen, const char *src, size_t srclen)
Definition: binascii.c:506
void base16_encode(char *dest, size_t destlen, const char *src, size_t srclen)
Definition: binascii.c:478
void retry_bridge_descriptor_fetch_directly(const char *digest)
Definition: bridges.c:759
Header file for circuitbuild.c.
Cached large directory object structure.
#define ARRAY_LENGTH(x)
int tor_compress_supports_method(compress_method_t method)
Definition: compress.c:312
compress_method_t detect_compression_method(const char *in, size_t in_len)
Definition: compress.c:292
int tor_uncompress(char **out, size_t *out_len, const char *in, size_t in_len, compress_method_t method, int complete_only, int protocol_warn_level)
Definition: compress.c:276
const char * compression_method_get_name(compress_method_t method)
Definition: compress.c:372
const char * compression_method_get_human_name(compress_method_t method)
Definition: compress.c:398
Headers for compress.c.
compress_method_t
Definition: compress.h:21
const or_options_t * get_options(void)
Definition: config.c:944
Header file for config.c.
void config_line_prepend(config_line_t **lst, const char *key, const char *val)
Definition: confline.c:53
Header for confline.c.
smartlist_t * connection_dir_list_by_purpose_and_resource(int purpose, const char *resource)
Definition: connection.c:4973
void clock_skew_warning(const connection_t *conn, long apparent_skew, int trusted, log_domain_mask_t domain, const char *received, const char *source)
Definition: connection.c:5963
int connection_fetch_from_buf_http(connection_t *conn, char **headers_out, size_t max_headerlen, char **body_out, size_t *body_used, size_t max_bodylen, int force_complete)
Definition: connection.c:4340
void connection_close_immediate(connection_t *conn)
Definition: connection.c:1055
char * alloc_http_authenticator(const char *authenticator)
Definition: connection.c:5101
const char * connection_describe_peer(const connection_t *conn)
Definition: connection.c:530
const char * connection_describe(const connection_t *conn)
Definition: connection.c:545
dir_connection_t * dir_connection_new(int socket_family)
Definition: connection.c:563
int connection_connect(connection_t *conn, const char *address, const tor_addr_t *addr, uint16_t port, int *socket_error)
Definition: connection.c:2446
Header file for connection.c.
#define CONN_TYPE_DIR
Definition: connection.h:55
entry_connection_t * connection_ap_make_link(connection_t *partner, char *address, uint16_t port, const char *digest, int session_group, int isolation_flags, int use_begindir, int want_onehop)
Header file for connection_edge.c.
char * consensus_diff_apply(const char *consensus, size_t consensus_len, const char *diff, size_t diff_len)
Definition: consdiff.c:1381
int looks_like_a_consensus_diff(const char *document, size_t len)
Definition: consdiff.c:1416
Header for consdiff.c.
void control_event_boot_dir(bootstrap_status_t status, int progress)
int control_event_server_status(int severity, const char *format,...)
Header file for control_events.c.
#define BASE64_DIGEST256_LEN
Definition: crypto_digest.h:29
#define HEX_DIGEST256_LEN
Definition: crypto_digest.h:37
int ed25519_public_key_is_zero(const ed25519_public_key_t *pubkey)
void digest256_to_base64(char *d64, const char *digest)
Header for crypto_format.c.
Common functions for cryptographic routines.
Compile-time assertions: CTASSERT(expression).
const char * routerstatus_describe(const routerstatus_t *rs)
Definition: describe.c:203
Header file for describe.c.
#define DIGEST_LEN
Definition: digest_sizes.h:20
#define DIGEST256_LEN
Definition: digest_sizes.h:23
Client/server directory connection structure.
Trusted/fallback directory server structure.
STATIC void warn_disallowed_anonymous_compression_method(compress_method_t method)
Definition: dirclient.c:2941
void directory_request_set_resource(directory_request_t *req, const char *resource)
Definition: dirclient.c:1041
void directory_request_set_or_addr_port(directory_request_t *req, const tor_addr_port_t *p)
Definition: dirclient.c:979
STATIC char * accept_encoding_header(void)
Definition: dirclient.c:2896
static void connection_dir_download_cert_failed(dir_connection_t *conn, int status_code)
Definition: dirclient.c:834
void directory_get_from_all_authorities(uint8_t dir_purpose, uint8_t router_purpose, const char *resource)
Definition: dirclient.c:585
static int handle_response_upload_hsdesc(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2796
static void connection_dir_download_routerdesc_failed(dir_connection_t *conn)
Definition: dirclient.c:791
void directory_request_set_if_modified_since(directory_request_t *req, time_t if_modified_since)
Definition: dirclient.c:1066
#define ALLOW_DIRECTORY_TIME_SKEW
Definition: dirclient.c:73
static void dir_microdesc_download_failed(smartlist_t *failed, int status_code, const char *dir_id)
Definition: dirclient.c:3026
void connection_dir_client_request_failed(dir_connection_t *conn)
Definition: dirclient.c:715
static void connection_dir_retry_bridges(smartlist_t *descs)
Definition: dirclient.c:773
static compress_method_t client_meth_allowed_anonymous_compression[]
Definition: dirclient.c:2887
static int directory_command_should_use_begindir(const or_options_t *options, const directory_request_t *req, const char **reason)
Definition: dirclient.c:890
STATIC int handle_response_fetch_consensus(dir_connection_t *conn, const response_handler_args_t *args)
Definition: dirclient.c:2221
static void connection_dir_bridge_routerdesc_failed(dir_connection_t *conn)
Definition: dirclient.c:810
STATIC int should_use_directory_guards(const or_options_t *options)
Definition: dirclient.c:314
void directory_request_set_dir_addr_port(directory_request_t *req, const tor_addr_port_t *p)
Definition: dirclient.c:990
#define MAX_DIR_DL_SIZE
Definition: dirclient.c:69
void connection_dir_client_refetch_hsdesc_if_needed(dir_connection_t *dir_conn)
Definition: dirclient.c:2863
static int handle_response_fetch_certificate(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2339
void directory_request_set_guard_state(directory_request_t *req, circuit_guard_state_t *state)
Definition: dirclient.c:1118
void dirclient_dump_total_dls(void)
Definition: dirclient.c:1976
STATIC int allowed_anonymous_connection_compression_method(compress_method_t method)
Definition: dirclient.c:2919
void directory_request_set_indirection(directory_request_t *req, dir_indirection_t indirection)
Definition: dirclient.c:1028
void directory_request_free_(directory_request_t *req)
Definition: dirclient.c:966
static int handle_response_upload_vote(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2701
void directory_request_set_routerstatus(directory_request_t *req, const routerstatus_t *status)
Definition: dirclient.c:1143
static int connection_dir_client_reached_eof(dir_connection_t *conn)
Definition: dirclient.c:2014
static int handle_response_fetch_desc(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2472
static int load_downloaded_routers(const char *body, smartlist_t *which, int descriptor_digests, int router_purpose, const char *source)
Definition: dirclient.c:1797
void directory_request_set_router_purpose(directory_request_t *req, uint8_t router_purpose)
Definition: dirclient.c:1012
static int handle_response_fetch_status_vote(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2400
static int body_is_plausible(const char *body, size_t body_len, int purpose)
Definition: dirclient.c:1766
static compress_method_t client_meth_pref[]
Definition: dirclient.c:2877
static void dir_consensus_request_set_additional_headers(directory_request_t *req, const char *resource)
Definition: dirclient.c:369
static int handle_response_fetch_detached_signatures(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2437
void directory_get_from_dirserver(uint8_t dir_purpose, uint8_t router_purpose, const char *resource, int pds_flags, download_want_authority_t want_authority)
Definition: dirclient.c:453
static void copy_ipv6_address(char *destination, const char *source, size_t len, int decorate)
Definition: dirclient.c:1515
void directory_request_set_directory_id_digest(directory_request_t *req, const char *digest)
Definition: dirclient.c:1000
static const routerstatus_t * directory_pick_generic_dirserver(dirinfo_type_t type, int pds_flags, uint8_t dir_purpose, circuit_guard_state_t **guard_state_out)
Definition: dirclient.c:335
void directory_post_to_dirservers(uint8_t dir_purpose, uint8_t router_purpose, dirinfo_type_t type, const char *payload, size_t payload_len, size_t extrainfo_len)
Definition: dirclient.c:229
STATIC const char * dir_conn_purpose_to_string(int purpose)
Definition: dirclient.c:97
static int handle_response_upload_signatures(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2737
static int handle_response_upload_dir(dir_connection_t *, const response_handler_args_t *)
Definition: dirclient.c:2633
STATIC int handle_response_fetch_hsdesc_v3(dir_connection_t *conn, const response_handler_args_t *args)
Definition: dirclient.c:2774
void directory_initiate_request(directory_request_t *request)
Definition: dirclient.c:1248
static int directory_request_set_dir_from_routerstatus(directory_request_t *req)
Definition: dirclient.c:1155
static int directory_request_dir_contact_info_specified(const directory_request_t *req)
Definition: dirclient.c:1128
void directory_request_set_payload(directory_request_t *req, const char *payload, size_t payload_len)
Definition: dirclient.c:1052
static char * directory_get_consensus_url(const char *resource)
Definition: dirclient.c:1469
int connection_dir_reached_eof(dir_connection_t *conn)
Definition: dirclient.c:2842
static void directory_send_command(dir_connection_t *conn, const int direct, const directory_request_t *req)
Definition: dirclient.c:1532
directory_request_t * directory_request_new(uint8_t dir_purpose)
Definition: dirclient.c:945
STATIC dirinfo_type_t dir_fetch_type(int dir_purpose, int router_purpose, const char *resource)
Definition: dirclient.c:133
static int dirind_is_anon(dir_indirection_t ind)
Definition: dirclient.c:616
void directory_request_fetch_set_hs_ident(directory_request_t *req, const hs_ident_dir_conn_t *ident)
Definition: dirclient.c:1106
STATIC int handle_response_fetch_microdesc(dir_connection_t *conn, const response_handler_args_t *args)
Definition: dirclient.c:2573
int router_supports_extrainfo(const char *identity_digest, int is_authority)
Definition: dirclient.c:175
int directories_have_accepted_server_descriptor(void)
Definition: dirclient.c:198
static uint64_t total_dl[DIR_PURPOSE_MAX_][2]
Definition: dirclient.c:1969
static void dir_routerdesc_download_failed(smartlist_t *failed, int status_code, int router_purpose, int was_extrainfo, int was_descriptor_digests)
Definition: dirclient.c:2983
void directory_request_add_header(directory_request_t *req, const char *key, const char *val)
Definition: dirclient.c:1080
static int compare_strs_(const void **a, const void **b)
Definition: dirclient.c:1451
void directory_request_upload_set_hs_ident(directory_request_t *req, const hs_ident_dir_conn_t *ident)
Definition: dirclient.c:1092
Header file for dirclient.c.
dir_indirection_t
Definition: dirclient.h:34
@ DIRIND_ONEHOP
Definition: dirclient.h:37
@ DIRIND_ANON_DIRPORT
Definition: dirclient.h:43
@ DIRIND_ANONYMOUS
Definition: dirclient.h:39
@ DIRIND_DIRECT_CONN
Definition: dirclient.h:41
struct directory_request_t directory_request_t
Definition: dirclient.h:52
int dirclient_fetches_from_authorities(const or_options_t *options)
Header for feature/dirclient/dirclient_modes.c.
int purpose_needs_anonymity(uint8_t dir_purpose, uint8_t router_purpose, const char *resource)
Definition: directory.c:113
int dir_split_resource_into_fingerprint_pairs(const char *res, smartlist_t *pairs_out)
Definition: directory.c:581
int parse_http_response(const char *headers, int *code, time_t *date, compress_method_t *compression, char **reason)
Definition: directory.c:360
char * authdir_type_to_string(dirinfo_type_t auth)
Definition: directory.c:160
int dir_split_resource_into_fingerprints(const char *resource, smartlist_t *fp_out, int *compressed_out, int flags)
Definition: directory.c:640
char * http_get_header(const char *headers, const char *which)
Definition: directory.c:325
Header file for directory.c.
#define DIR_PURPOSE_FETCH_EXTRAINFO
Definition: directory.h:39
#define DIR_PURPOSE_FETCH_CERTIFICATE
Definition: directory.h:57
#define DIR_PURPOSE_UPLOAD_HSDESC
Definition: directory.h:67
#define DIR_PURPOSE_FETCH_MICRODESC
Definition: directory.h:65
#define DIR_CONN_STATE_CONNECTING
Definition: directory.h:20
#define DIR_CONN_STATE_CLIENT_FINISHED
Definition: directory.h:26
#define DIR_CONN_STATE_CLIENT_READING
Definition: directory.h:24
#define DIR_PURPOSE_UPLOAD_VOTE
Definition: directory.h:43
#define DIR_PURPOSE_FETCH_DETACHED_SIGNATURES
Definition: directory.h:51
#define DIR_PURPOSE_IS_UPLOAD(p)
Definition: directory.h:77
#define DIR_PURPOSE_FETCH_CONSENSUS
Definition: directory.h:54
#define DIR_PURPOSE_SERVER
Definition: directory.h:60
#define DIR_PURPOSE_FETCH_SERVERDESC
Definition: directory.h:36
#define DIR_PURPOSE_UPLOAD_SIGNATURES
Definition: directory.h:45
#define DIR_PURPOSE_IS_HS(p)
Definition: directory.h:85
#define DIR_CONN_STATE_CLIENT_SENDING
Definition: directory.h:22
#define DIR_PURPOSE_FETCH_STATUS_VOTE
Definition: directory.h:48
#define DIR_PURPOSE_HAS_FETCHED_HSDESC
Definition: directory.h:72
#define DIR_PURPOSE_UPLOAD_DIR
Definition: directory.h:41
#define DIR_PURPOSE_FETCH_HSDESC
Definition: directory.h:69
dir_server_t * router_get_trusteddirserver_by_digest(const char *digest)
Definition: dirlist.c:160
const tor_addr_port_t * trusted_dir_server_get_dirport(const dir_server_t *ds, auth_dirport_usage_t usage, int addr_family)
Definition: dirlist.c:529
auth_dirport_usage_t auth_dirport_usage_for_purpose(int purpose)
Definition: dirlist.c:304
const tor_addr_port_t * trusted_dir_server_get_dirport_exact(const dir_server_t *ds, auth_dirport_usage_t usage, int addr_family)
Definition: dirlist.c:503
dir_server_t * router_get_fallback_dirserver_by_digest(const char *digest)
Definition: dirlist.c:181
Header file for dirlist.c.
auth_dirport_usage_t
Definition: dirlist.h:22
@ AUTH_USAGE_VOTING
Definition: dirlist.h:30
cached_dir_t * dirserv_get_consensus(const char *flavor_name)
Definition: dirserv.c:201
Header file for dirserv.c.
pending_vote_t * dirvote_add_vote(const char *vote_body, time_t time_posted, const char *where_from, const char **msg_out, int *status_out)
Definition: dirvote.c:3240
int dirvote_add_signatures(const char *detached_signatures_body, const char *source, const char **msg)
Definition: dirvote.c:3776
Header file for dirvote.c.
time_t download_status_increment_failure(download_status_t *dls, int status_code, const char *item, int server, time_t now)
Definition: dlstatus.c:249
Header file for dlstatus.c.
Entry connection structure.
void entry_guard_failed(circuit_guard_state_t **guard_state_p)
Definition: entrynodes.c:2592
void entry_guard_cancel(circuit_guard_state_t **guard_state_p)
Definition: entrynodes.c:2571
int entry_list_is_constrained(const or_options_t *options)
Definition: entrynodes.c:3450
guard_usable_t entry_guard_succeeded(circuit_guard_state_t **guard_state_p)
Definition: entrynodes.c:2544
const node_t * guards_choose_dirguard(uint8_t dir_purpose, circuit_guard_state_t **guard_state_out)
Definition: entrynodes.c:3881
CTASSERT(NUMBER_SECOND_GUARDS< 20)
Header file for circuitbuild.c.
const char * escaped(const char *s)
Definition: escape.c:126
Header file for fp_pair.c.
Header file for hs_cache.c.
int hs_client_refetch_hsdesc(const ed25519_public_key_t *identity_pk)
Definition: hs_client.c:2228
void hs_client_dir_fetch_done(dir_connection_t *dir_conn, const char *reason, const char *body, const int status_code)
Definition: hs_client.c:2557
Header file containing client data for the HS subsystem.
void hs_control_desc_event_uploaded(const hs_ident_dir_conn_t *ident, const char *hsdir_id_digest)
Definition: hs_control.c:159
void hs_control_desc_event_failed(const hs_ident_dir_conn_t *ident, const char *hsdir_id_digest, const char *reason)
Definition: hs_control.c:65
Header file containing control port event related code.
hs_ident_dir_conn_t * hs_ident_dir_conn_dup(const hs_ident_dir_conn_t *src)
Definition: hs_ident.c:47
void tor_log(int severity, log_domain_mask_t domain, const char *format,...)
Definition: log.c:590
#define log_fn(severity, domain, args,...)
Definition: log.h:283
#define LD_HTTP
Definition: log.h:76
#define LD_REND
Definition: log.h:84
#define log_fn_ratelim(ratelim, severity, domain, args,...)
Definition: log.h:288
#define LD_PROTOCOL
Definition: log.h:72
#define LOG_DEBUG
Definition: log.h:42
#define LD_BUG
Definition: log.h:86
#define LD_NET
Definition: log.h:66
#define LD_GENERAL
Definition: log.h:62
#define LD_DIR
Definition: log.h:88
#define LOG_NOTICE
Definition: log.h:50
#define LOG_WARN
Definition: log.h:53
#define LOG_INFO
Definition: log.h:45
void connection_watch_events(connection_t *conn, watchable_events_t events)
Definition: mainloop.c:485
void directory_all_unreachable(time_t now)
Definition: mainloop.c:1106
void connection_start_reading(connection_t *conn)
Definition: mainloop.c:623
void directory_info_has_arrived(time_t now, int from_cache, int suppress_logs)
Definition: mainloop.c:1124
Header file for mainloop.c.
@ WRITE_EVENT
Definition: mainloop.h:38
@ READ_EVENT
Definition: mainloop.h:37
#define tor_free(p)
Definition: malloc.h:56
void microdesc_note_outdated_dirserver(const char *relay_digest)
Definition: microdesc.c:111
smartlist_t * microdescs_add_to_cache(microdesc_cache_t *cache, const char *s, const char *eos, saved_location_t where, int no_save, time_t listed_at, smartlist_t *requested_digests256)
Definition: microdesc.c:293
microdesc_cache_t * get_microdesc_cache(void)
Definition: microdesc.c:251
void update_microdescs_from_networkstatus(time_t now)
Definition: microdesc.c:1033
Header file for microdesc.c.
networkstatus_t * networkstatus_get_latest_consensus_by_flavor(consensus_flavor_t f)
void routers_update_all_from_networkstatus(time_t now, int dir_version)
int networkstatus_parse_flavor_name(const char *flavname)
int networkstatus_set_current_consensus(const char *consensus, size_t consensus_len, const char *flavor, unsigned flags, const char *source_dir)
download_status_t * router_get_dl_status_by_descriptor_digest(const char *d)
routerstatus_t * router_get_mutable_consensus_status_by_descriptor_digest(networkstatus_t *consensus, const char *digest)
tor_mmap_t * networkstatus_map_cached_consensus(const char *flavorname)
void update_certificate_downloads(time_t now)
const routerstatus_t * router_get_consensus_status_by_id(const char *digest)
int32_t networkstatus_get_param(const networkstatus_t *ns, const char *param_name, int32_t default_val, int32_t min_val, int32_t max_val)
routerstatus_t * router_get_mutable_consensus_status_by_id(const char *digest)
void networkstatus_consensus_download_failed(int status_code, const char *flavname)
Header file for networkstatus.c.
Networkstatus consensus/vote structure.
const routerstatus_t * router_pick_directory_server(dirinfo_type_t type, int flags)
Definition: node_select.c:72
const routerstatus_t * router_pick_fallback_dirserver(dirinfo_type_t type, int flags)
Definition: node_select.c:1051
const routerstatus_t * router_pick_trusteddirserver(dirinfo_type_t type, int flags)
Definition: node_select.c:1040
Header file for node_select.c.
#define PDS_NO_EXISTING_SERVERDESC_FETCH
Definition: node_select.h:69
#define PDS_NO_EXISTING_MICRODESC_FETCH
Definition: node_select.h:75
#define PDS_IGNORE_FASCISTFIREWALL
Definition: node_select.h:62
Node information structure.
const node_t * node_get_by_id(const char *identity_digest)
Definition: nodelist.c:226
int count_loading_descriptors_progress(void)
Definition: nodelist.c:2779
void router_set_status(const char *digest, int up)
Definition: nodelist.c:2380
Header file for nodelist.c.
Master header file for Tor-specific functionality.
@ SAVED_NOWHERE
Definition: or.h:626
#define ISO_STREAM
Definition: or.h:871
#define ISO_SESSIONGRP
Definition: or.h:867
#define SESSION_GROUP_DIRCONN
Definition: or.h:880
download_want_authority_t
Definition: or.h:655
#define TO_CONN(c)
Definition: or.h:612
#define MAX_HEADERS_SIZE
Definition: or.h:122
dirinfo_type_t
Definition: or.h:787
@ V3_DIRINFO
Definition: or.h:790
@ BRIDGE_DIRINFO
Definition: or.h:792
@ EXTRAINFO_DIRINFO
Definition: or.h:794
@ MICRODESC_DIRINFO
Definition: or.h:796
#define ENTRY_TO_CONN(c)
Definition: or.h:615
int reachable_addr_allows_rs(const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only)
Definition: policies.c:647
int reachable_addr_allows_addr(const tor_addr_t *addr, uint16_t port, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)
Definition: policies.c:536
void reachable_addr_choose_from_node(const node_t *node, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:988
void reachable_addr_choose_from_rs(const routerstatus_t *rs, firewall_connection_t fw_connection, int pref_only, tor_addr_port_t *ap)
Definition: policies.c:874
Header file for policies.c.
void rep_hist_note_used_port(time_t now, uint16_t port)
void rep_hist_note_used_internal(time_t now, int need_uptime, int need_capacity)
Header file for predict_ports.c.
int tor_asprintf(char **strp, const char *fmt,...)
Definition: printf.c:75
int tor_snprintf(char *str, size_t size, const char *format,...)
Definition: printf.c:27
void relay_address_new_suggestion(const tor_addr_t *suggested_addr, const tor_addr_t *peer_addr, const char *identity_digest)
Header file for relay_find_addr.c.
Header file for rendcommon.c.
const char * router_get_descriptor_gen_reason(void)
Definition: router.c:1871
int router_digest_is_me(const char *digest)
Definition: router.c:1744
const char * router_purpose_to_string(uint8_t p)
Definition: routerinfo.c:98
Header file for routerinfo.c.
Router descriptor structure.
#define ROUTER_PURPOSE_GENERAL
Definition: routerinfo_st.h:98
#define ROUTER_PURPOSE_BRIDGE
void router_load_extrainfo_from_string(const char *s, const char *eos, saved_location_t saved_location, smartlist_t *requested_fingerprints, int descriptor_digests)
Definition: routerlist.c:2245
signed_descriptor_t * router_get_by_extrainfo_digest(const char *digest)
Definition: routerlist.c:800
int router_load_routers_from_string(const char *s, const char *eos, saved_location_t saved_location, smartlist_t *requested_fingerprints, int descriptor_digests, const char *prepend_annotations)
Definition: routerlist.c:2146
Header file for routerlist.c.
int public_server_mode(const or_options_t *options)
Definition: routermode.c:43
Header file for routermode.c.
int routerset_contains_routerstatus(const routerset_t *set, const routerstatus_t *rs, country_t country)
Definition: routerset.c:339
Header file for routerset.c.
Header file for selftest.c.
void sr_act_post_consensus(const networkstatus_t *consensus)
This file contains ABI/API of the shared random protocol defined in proposal #250....
void smartlist_add_asprintf(struct smartlist_t *sl, const char *pattern,...)
Definition: smartlist.c:36
char * smartlist_join_strings(smartlist_t *sl, const char *join, int terminate, size_t *len_out)
Definition: smartlist.c:279
void smartlist_sort(smartlist_t *sl, int(*compare)(const void **a, const void **b))
Definition: smartlist.c:334
smartlist_t * smartlist_new(void)
void smartlist_add(smartlist_t *sl, void *element)
#define SMARTLIST_FOREACH_BEGIN(sl, type, var)
#define SMARTLIST_FOREACH(sl, type, var, cmd)
size_t dir_len
Definition: cached_dir_st.h:20
uint8_t digest_sha3_as_signed[DIGEST256_LEN]
Definition: cached_dir_st.h:25
time_t published
Definition: cached_dir_st.h:22
uint8_t state
Definition: connection_st.h:49
unsigned int type
Definition: connection_st.h:50
uint16_t port
unsigned int purpose
Definition: connection_st.h:51
time_t timestamp_last_write_allowed
tor_addr_t addr
unsigned int dirconn_direct
char identity_digest[DIGEST_LEN]
struct circuit_guard_state_t * guard_state
routerstatus_t fake_status
Definition: dir_server_st.h:57
unsigned int has_accepted_serverdesc
Definition: dir_server_st.h:45
ed25519_public_key_t identity_pk
Definition: hs_ident.h:90
Definition: node_st.h:34
tor_addr_t HTTPProxyAddr
dirinfo_type_t PublishServerDescriptor_
int FetchServerDescriptors
char * HTTPProxy
int FetchDirInfoExtraEarly
char * HTTPProxyAuthenticator
char * Socks5Proxy
char * Socks4Proxy
int FetchUselessDescriptors
struct routerset_t * ExcludeNodes
uint16_t HTTPProxyPort
unsigned int caches_extra_info
Definition: routerinfo_st.h:70
time_t last_dir_503_at
char identity_digest[DIGEST_LEN]
download_status_t ei_dl_status
size_t size
Definition: mmap.h:27
const char * data
Definition: mmap.h:26
#define STATIC
Definition: testsupport.h:32
#define MOCK_IMPL(rv, funcname, arglist)
Definition: testsupport.h:133
void format_rfc1123_time(char *buf, time_t t)
Definition: time_fmt.c:213
void format_iso_time(char *buf, time_t t)
Definition: time_fmt.c:326
#define tor_assert_nonfatal_unreached()
Definition: util_bug.h:176
#define tor_assert(expr)
Definition: util_bug.h:102
int strcmpstart(const char *s1, const char *s2)
Definition: util_string.c:215
int fast_mem_is_zero(const char *mem, size_t len)
Definition: util_string.c:74
int tor_digest_is_zero(const char *digest)
Definition: util_string.c:96
#define ED25519_BASE64_LEN
Definition: x25519_sizes.h:43