116#define ENTRYNODES_PRIVATE
132#include "feature/client/circpathbias.h"
168 guard_selection_t *gs,
169 entry_guard_t *guard);
176 const uint8_t *rsa_id_digest,
177 const char *nickname,
182 const entry_guard_restriction_t *rst);
221STATIC guard_selection_type_t
225 if (type == GS_TYPE_INFER) {
226 if (!strcmp(
name,
"bridges"))
227 type = GS_TYPE_BRIDGE;
228 else if (!strcmp(
name,
"restricted"))
229 type = GS_TYPE_RESTRICTED;
231 type = GS_TYPE_NORMAL;
241 guard_selection_type_t type)
243 guard_selection_t *gs;
247 gs = tor_malloc_zero(
sizeof(*gs));
248 gs->name = tor_strdup(
name);
264 guard_selection_type_t type,
265 int create_if_absent)
271 if (!strcmp(gs->name,
name))
273 } SMARTLIST_FOREACH_END(gs);
275 if (! create_if_absent)
278 log_debug(
LD_GUARD,
"Creating a guard selection called %s",
name);
282 return new_selection;
296 guard_selection_type_t type = GS_TYPE_INFER;
306 log_notice(
LD_GUARD,
"Starting with guard context \"%s\"",
name);
326 static char buf[256];
329 strlen(guard->nickname) ? guard->nickname :
"[bridge]",
338 return guard->identity;
348HANDLE_IMPL(entry_guard, entry_guard_t, ATTR_UNUSED
STATIC)
359 time_t earliest = now - max_backdate;
363 if (latest <= earliest)
364 latest = earliest + 1;
385 DFLT_MAX_SAMPLE_THRESHOLD_PERCENT,
396 DFLT_MAX_SAMPLE_SIZE,
406 DFLT_MIN_FILTERED_SAMPLE_SIZE,
416 "guard-remove-unlisted-guards-after-days",
417 DFLT_REMOVE_UNLISTED_GUARDS_AFTER_DAYS,
442 "guard-lifetime-days",
443 DFLT_GUARD_LIFETIME_DAYS, 1, 365*10);
457 DFLT_GUARD_CONFIRMED_MIN_LIFETIME_DAYS,
470 if (configured_primaries) {
471 return configured_primaries;
477 "guard-n-primary-guards",
478 DFLT_N_PRIMARY_GUARDS, 1, INT32_MAX);
488 const char *param_name;
493 if (usage == GUARD_USAGE_DIRGUARD) {
495 param_name =
"guard-n-primary-dir-guards-to-use";
496 param_default = DFLT_N_PRIMARY_DIR_GUARDS_TO_USE;
499 param_name =
"guard-n-primary-guards-to-use";
500 param_default = DFLT_N_PRIMARY_GUARDS_TO_USE;
502 if (configured >= 1) {
506 param_name, param_default, 1, INT32_MAX);
516 DFLT_INTERNET_LIKELY_DOWN_INTERVAL,
528 "guard-nonprimary-guard-connect-timeout",
529 DFLT_NONPRIMARY_GUARD_CONNECT_TIMEOUT,
540 "guard-nonprimary-guard-idle-timeout",
541 DFLT_NONPRIMARY_GUARD_IDLE_TIMEOUT,
552 "guard-meaningful-restriction-percent",
553 DFLT_MEANINGFUL_RESTRICTION_PERCENT,
565 "guard-extreme-restriction-percent",
566 DFLT_EXTREME_RESTRICTION_PERCENT,
573mark_guard_maybe_reachable(entry_guard_t *guard)
575 if (guard->is_reachable != GUARD_REACHABLE_NO) {
581 guard->is_reachable = GUARD_REACHABLE_MAYBE;
582 if (guard->is_filtered_guard)
583 guard->is_usable_filtered_guard = 1;
608 if (!gs->primary_guards_up_to_date)
612 mark_guard_maybe_reachable(guard);
613 } SMARTLIST_FOREACH_END(guard);
619mark_all_guards_maybe_reachable(guard_selection_t *gs)
624 mark_guard_maybe_reachable(guard);
625 } SMARTLIST_FOREACH_END(guard);
638 const guard_selection_t *old_selection,
639 guard_selection_type_t *type_out)
645 *type_out = GS_TYPE_BRIDGE;
651 *type_out = GS_TYPE_NORMAL;
656 int n_guards = 0, n_passing_filter = 0;
664 } SMARTLIST_FOREACH_END(node);
668 const int meaningful_threshold_high =
670 const int meaningful_threshold_mid =
672 const int meaningful_threshold_low =
674 const int extreme_threshold =
691 static int have_warned_extreme_threshold = 0;
693 n_passing_filter < extreme_threshold &&
694 ! have_warned_extreme_threshold) {
695 have_warned_extreme_threshold = 1;
696 const double exclude_frac =
697 (n_guards - n_passing_filter) / (
double)n_guards;
698 log_warn(
LD_GUARD,
"Your configuration excludes %d%% of all possible "
699 "guards. That's likely to make you stand out from the "
700 "rest of the world.", (
int)(exclude_frac * 100));
705 if (old_selection == NULL) {
706 if (n_passing_filter >= meaningful_threshold_mid) {
707 *type_out = GS_TYPE_NORMAL;
710 *type_out = GS_TYPE_RESTRICTED;
720 if (n_passing_filter >= meaningful_threshold_high) {
721 *type_out = GS_TYPE_NORMAL;
723 }
else if (n_passing_filter < meaningful_threshold_low) {
724 *type_out = GS_TYPE_RESTRICTED;
728 *type_out = old_selection->type;
729 return old_selection->name;
749 guard_selection_type_t type = GS_TYPE_INFER;
761 if (! strcmp(cur_name, new_name)) {
763 "Staying with guard context \"%s\" (no change)", new_name);
767 log_notice(
LD_GUARD,
"Switching to guard context \"%s\" (was using \"%s\")",
769 guard_selection_t *new_guard_context;
802 const uint8_t *rsa_id)
809 } SMARTLIST_FOREACH_END(guard);
815static entry_guard_t *
821 entry_guard_t *guard;
836 const uint8_t *identity = NULL;
838 identity = (
const uint8_t *)guard->
identity;
840 if (BUG(guard->bridge_addr == NULL))
844 &guard->bridge_addr->addr,
845 guard->bridge_addr->port,
846 (
const char*)identity);
867 log_info(
LD_GUARD,
"Adding %s to the entry guard sample set.",
886static entry_guard_t *
888 const uint8_t *rsa_id_digest,
889 const char *nickname,
898 if (BUG(!rsa_id_digest && !bridge_addrport))
901 entry_guard_t *guard = tor_malloc_zero(
sizeof(entry_guard_t));
904 guard->is_persistent = (rsa_id_digest != NULL);
905 guard->selection_name = tor_strdup(gs->name);
907 memcpy(guard->identity, rsa_id_digest,
DIGEST_LEN);
909 strlcpy(guard->nickname, nickname,
sizeof(guard->nickname));
911 tor_free(guard->sampled_by_version);
912 guard->sampled_by_version = tor_strdup(VERSION);
913 guard->currently_listed = 1;
914 guard->sampled_idx = gs->next_sampled_idx++;
915 guard->confirmed_idx = -1;
918 guard->is_reachable = GUARD_REACHABLE_MAYBE;
920 guard->bridge_addr = tor_memdup(bridge_addrport,
sizeof(*bridge_addrport));
923 guard->in_selection = gs;
938static entry_guard_t *
958static entry_guard_t *
969 } SMARTLIST_FOREACH_END(g);
978 const uint8_t *rsa_id_digest)
990 int make_persistent = 0;
993 memcpy(g->identity, rsa_id_digest,
DIGEST_LEN);
997 if (BUG(! g->is_persistent))
1001 base16_encode(old_id,
sizeof(old_id), g->identity,
sizeof(g->identity));
1002 log_warn(
LD_BUG,
"We 'learned' an identity %s for a bridge at %s:%d, but "
1003 "we already knew a different one (%s). Ignoring the new info as "
1011 if (make_persistent) {
1012 g->is_persistent = 1;
1027 const entry_guard_restriction_t *rst)
1029 int n_reachable_filtered_guards = 0;
1034 if (guard->is_usable_filtered_guard)
1035 ++n_reachable_filtered_guards;
1036 } SMARTLIST_FOREACH_END(guard);
1037 return n_reachable_filtered_guards;
1046 const int using_bridges = (gs->type == GS_TYPE_BRIDGE);
1057 const int max_sample = MIN(max_sample_by_pct, max_sample_absolute);
1058 if (max_sample < min_sample)
1074 guard_selection_t *gs,
1081 if (gs->type == GS_TYPE_BRIDGE) {
1089 } SMARTLIST_FOREACH_END(bridge);
1092 const int n_sampled = smartlist_len(gs->sampled_entry_guards);
1099 } SMARTLIST_FOREACH_END(guard);
1104 if (gs->type == GS_TYPE_RESTRICTED) {
1116 } SMARTLIST_FOREACH_END(node);
1119 digestset_free(sampled_guard_ids);
1122 *n_guards_out = n_guards;
1123 return eligible_guards;
1130static entry_guard_t *
1134 entry_guard_t *added_guard;
1135 if (gs->type == GS_TYPE_BRIDGE) {
1162 if (gs->type == GS_TYPE_BRIDGE) {
1184 log_info(
LD_GUARD,
"Not expanding the sample guard set; we have "
1185 "no reasonably live consensus.");
1189 int n_sampled = smartlist_len(gs->sampled_entry_guards);
1190 entry_guard_t *added_guard = NULL;
1198 log_info(
LD_GUARD,
"Expanding the sample guard set. We have %d guards "
1199 "in the sample, and %d eligible guards to extend it with.",
1200 n_sampled, smartlist_len(eligible_guards));
1202 while (n_usable_filtered_guards < min_filtered_sample) {
1204 if (n_sampled >= max_sample) {
1205 log_info(
LD_GUARD,
"Not expanding the guard sample any further; "
1206 "just hit the maximum sample threshold of %d",
1212 if (smartlist_len(eligible_guards) == 0) {
1217 log_info(
LD_GUARD,
"Not expanding the guard sample any further; "
1218 "just ran out of eligible guards");
1230 if (added_guard->is_usable_filtered_guard)
1231 ++n_usable_filtered_guards;
1235 smartlist_free(eligible_guards);
1244 entry_guard_t *guard)
1246 if (guard->is_primary) {
1247 guard->is_primary = 0;
1255 if (guard->confirmed_idx >= 0) {
1257 guard->confirmed_idx = -1;
1258 guard->confirmed_on_date = 0;
1274 if (gs->type == GS_TYPE_BRIDGE) {
1299 size_t n_changes = 0;
1303 const time_t unlisted_since_slop =
1310 if (is_listed && ! guard->currently_listed) {
1312 guard->currently_listed = 1;
1313 guard->unlisted_since_date = 0;
1314 log_info(
LD_GUARD,
"Sampled guard %s is now listed again.",
1316 }
else if (!is_listed && guard->currently_listed) {
1318 guard->currently_listed = 0;
1320 unlisted_since_slop);
1321 log_info(
LD_GUARD,
"Sampled guard %s is now unlisted.",
1323 }
else if (is_listed && guard->currently_listed) {
1324 log_debug(
LD_GUARD,
"Sampled guard %s is still listed.",
1327 tor_assert(! is_listed && ! guard->currently_listed);
1328 log_debug(
LD_GUARD,
"Sampled guard %s is still unlisted.",
1333 if (guard->currently_listed && guard->unlisted_since_date) {
1335 guard->unlisted_since_date = 0;
1336 log_warn(
LD_BUG,
"Sampled guard %s was listed, but with "
1337 "unlisted_since_date set. Fixing.",
1339 }
else if (!guard->currently_listed && ! guard->unlisted_since_date) {
1342 unlisted_since_slop);
1343 log_warn(
LD_BUG,
"Sampled guard %s was unlisted, but with "
1344 "unlisted_since_date unset. Fixing.",
1347 } SMARTLIST_FOREACH_END(guard);
1368 const time_t remove_if_unlisted_since,
1369 const time_t maybe_remove_if_sampled_before,
1370 const time_t remove_if_confirmed_before)
1372 size_t n_changes = 0;
1379 if (guard->currently_listed == 0 &&
1380 guard->unlisted_since_date < remove_if_unlisted_since) {
1386 log_info(
LD_GUARD,
"Removing sampled guard %s: it has been unlisted "
1390 }
else if (guard->sampled_on_date < maybe_remove_if_sampled_before) {
1395 if (guard->confirmed_on_date == 0) {
1397 log_info(
LD_GUARD,
"Removing sampled guard %s: it was sampled "
1398 "over %d days ago, but never confirmed.",
1401 }
else if (guard->confirmed_on_date < remove_if_confirmed_before) {
1403 log_info(
LD_GUARD,
"Removing sampled guard %s: it was sampled "
1404 "over %d days ago, and confirmed over %d days ago.",
1415 entry_guard_free(guard);
1417 } SMARTLIST_FOREACH_END(guard);
1435 log_info(
LD_GUARD,
"Not updating the sample guard set; we have "
1436 "no reasonably live consensus.");
1439 log_info(
LD_GUARD,
"Updating sampled guard status based on received "
1445 const time_t remove_if_unlisted_since =
1447 const time_t maybe_remove_if_sampled_before =
1449 const time_t remove_if_confirmed_before =
1455 remove_if_unlisted_since,
1456 maybe_remove_if_sampled_before,
1457 remove_if_confirmed_before);
1460 gs->primary_guards_up_to_date = 0;
1514 FIREWALL_OR_CONNECTION,
1527 entry_guard_t *guard)
1529 if (guard->currently_listed == 0)
1531 if (guard->pb.path_bias_disabled)
1534 if (gs->type == GS_TYPE_BRIDGE) {
1571 if (
get_options()->EnforceDistinctSubnets && guard->bridge_addr) {
1575 &guard->bridge_addr->addr)) {
1585STATIC entry_guard_restriction_t *
1586guard_create_exit_restriction(
const uint8_t *exit_id)
1588 entry_guard_restriction_t *rst = NULL;
1589 rst = tor_malloc_zero(
sizeof(entry_guard_restriction_t));
1590 rst->type = RST_EXIT_NODE;
1591 memcpy(rst->exclude_id, exit_id,
DIGEST_LEN);
1597STATIC entry_guard_restriction_t *
1599 const uint8_t *exit_id)
1601 entry_guard_restriction_t *rst = NULL;
1602 rst = tor_malloc_zero(
sizeof(entry_guard_restriction_t));
1603 rst->type = RST_EXCL_LIST;
1606 memcpy(rst->exclude_id, exit_id,
DIGEST_LEN);
1612#define MIN_GUARDS_FOR_MD_RESTRICTION 10
1625 log_info(
LD_GUARD,
"Not setting md restriction: only %d"
1626 " usable guards.", num_usable_guards);
1636STATIC entry_guard_restriction_t *
1639 entry_guard_restriction_t *rst = NULL;
1642 log_debug(
LD_GUARD,
"Not setting md restriction: too few "
1643 "filtered guards.");
1647 rst = tor_malloc_zero(
sizeof(entry_guard_restriction_t));
1648 rst->type = RST_OUTDATED_MD_DIRSERVER;
1655guard_obeys_exit_restriction(
const entry_guard_t *guard,
1656 const entry_guard_restriction_t *rst)
1659 rst->type == RST_EXCL_LIST);
1676 log_info(
LD_GENERAL,
"Skipping %s dirserver: outdated",
1681 log_debug(
LD_GENERAL,
"%s dirserver obeys md restrictions",
1695 return (rst->type == RST_OUTDATED_MD_DIRSERVER);
1704 const entry_guard_restriction_t *rst)
1710 if (rst->type == RST_EXIT_NODE) {
1711 return guard_obeys_exit_restriction(guard, rst);
1712 }
else if (rst->type == RST_OUTDATED_MD_DIRSERVER) {
1714 }
else if (rst->type == RST_EXCL_LIST) {
1715 return guard_obeys_exit_restriction(guard, rst) &&
1728 guard_selection_t *gs,
1729 entry_guard_t *guard)
1731 unsigned was_filtered = guard->is_filtered_guard;
1732 guard->is_filtered_guard = 0;
1733 guard->is_usable_filtered_guard = 0;
1736 guard->is_filtered_guard = 1;
1738 if (guard->is_reachable != GUARD_REACHABLE_NO)
1739 guard->is_usable_filtered_guard = 1;
1743 log_debug(
LD_GUARD,
"Updated sampled guard %s: filtered=%d; "
1745 guard->is_filtered_guard, guard->is_usable_filtered_guard);
1747 if (!
bool_eq(was_filtered, guard->is_filtered_guard)) {
1749 gs->primary_guards_up_to_date = 0;
1763 } SMARTLIST_FOREACH_END(guard);
1779 const entry_guard_restriction_t *rst,
1783 entry_guard_t *result = NULL;
1784 const unsigned exclude_confirmed = flags & SAMPLE_EXCLUDE_CONFIRMED;
1785 const unsigned exclude_primary = flags & SAMPLE_EXCLUDE_PRIMARY;
1786 const unsigned exclude_pending = flags & SAMPLE_EXCLUDE_PENDING;
1787 const unsigned no_update_primary = flags & SAMPLE_NO_UPDATE_PRIMARY;
1788 const unsigned need_descriptor = flags & SAMPLE_EXCLUDE_NO_DESCRIPTOR;
1792 } SMARTLIST_FOREACH_END(guard);
1796 log_info(
LD_GUARD,
"Trying to sample a reachable guard: We know of %d "
1797 "in the USABLE_FILTERED set.", n_reachable_filtered);
1800 if (n_reachable_filtered < min_filtered_sample) {
1801 log_info(
LD_GUARD,
" (That isn't enough. Trying to expand the sample.)");
1805 if (exclude_primary && !gs->primary_guards_up_to_date && !no_update_primary)
1814 if (! guard->is_usable_filtered_guard)
1816 if (exclude_confirmed && guard->confirmed_idx >= 0)
1818 if (exclude_primary && guard->is_primary)
1820 if (exclude_pending && guard->is_pending)
1825 } SMARTLIST_FOREACH_END(guard);
1827 log_info(
LD_GUARD,
" (After filters [%x], we have %d guards to consider.)",
1828 flags, smartlist_len(reachable_filtered_sample));
1830 if (smartlist_len(reachable_filtered_sample)) {
1841 result = smartlist_get(reachable_filtered_sample, 0);
1842 log_info(
LD_GUARD,
" (Selected %s.)",
1845 smartlist_free(reachable_filtered_sample);
1851compare_guards_by_confirmed_idx(
const void **a_,
const void **b_)
1853 const entry_guard_t *a = *a_, *b = *b_;
1854 if (a->confirmed_idx < b->confirmed_idx)
1856 else if (a->confirmed_idx > b->confirmed_idx)
1868 const entry_guard_t *a = *a_, *b = *b_;
1869 if (a->sampled_idx < b->sampled_idx)
1871 else if (a->sampled_idx > b->sampled_idx)
1887 if (guard->confirmed_idx >= 0)
1889 } SMARTLIST_FOREACH_END(guard);
1891 smartlist_sort(gs->confirmed_entry_guards, compare_guards_by_confirmed_idx);
1893 int any_changed = 0;
1895 if (guard->confirmed_idx != guard_sl_idx) {
1897 guard->confirmed_idx = guard_sl_idx;
1899 } SMARTLIST_FOREACH_END(guard);
1901 gs->next_confirmed_idx = smartlist_len(gs->confirmed_entry_guards);
1917 if (BUG(guard->confirmed_on_date && guard->confirmed_idx >= 0))
1926 log_info(
LD_GUARD,
"Marking %s as a confirmed guard (index %d)",
1928 gs->next_confirmed_idx);
1930 guard->confirmed_idx = gs->next_confirmed_idx++;
1938 gs->primary_guards_up_to_date = 0;
1953 static int running = 0;
1964 gs->primary_guards_up_to_date = 1;
1968 if (smartlist_len(new_primary_guards) >= N_PRIMARY_GUARDS)
1970 if (! guard->is_filtered_guard)
1972 guard->is_primary = 1;
1974 } SMARTLIST_FOREACH_END(guard);
1985 if (smartlist_len(new_primary_guards) < N_PRIMARY_GUARDS &&
1986 guard->is_filtered_guard) {
1987 guard->is_primary = 1;
1992 guard->is_primary = 0;
1994 } SMARTLIST_FOREACH_END(guard);
1997 while (smartlist_len(new_primary_guards) < N_PRIMARY_GUARDS) {
1999 SAMPLE_EXCLUDE_CONFIRMED|
2000 SAMPLE_EXCLUDE_PRIMARY|
2001 SAMPLE_NO_UPDATE_PRIMARY);
2004 guard->is_primary = 1;
2011 tor_assert_nonfatal(
2012 bool_eq(guard->is_primary,
2013 smartlist_contains(new_primary_guards, guard)));
2018 new_primary_guards);
2020 log_info(
LD_GUARD,
"Primary entry guards have changed. "
2021 "New primary guard list is: ");
2022 int n = smartlist_len(new_primary_guards);
2024 log_info(
LD_GUARD,
" %d/%d: %s%s%s",
2026 g->confirmed_idx >= 0 ?
" (confirmed)" :
"",
2027 g->is_filtered_guard ?
"" :
" (excluded by filter)");
2028 } SMARTLIST_FOREACH_END(g);
2032 smartlist_free(old_primary_guards);
2033 smartlist_free(gs->primary_entry_guards);
2034 gs->primary_entry_guards = new_primary_guards;
2035 gs->primary_guards_up_to_date = 1;
2047 const unsigned SIX_HOURS = 6 * 3600;
2048 const unsigned FOUR_DAYS = 4 * 86400;
2049 const unsigned SEVEN_DAYS = 7 * 86400;
2052 if (now > failing_since) {
2053 tdiff = now - failing_since;
2059 time_t maximum;
int primary_delay;
int nonprimary_delay;
2062 { SIX_HOURS, 10*60, 1*60*60 },
2063 { FOUR_DAYS, 90*60, 4*60*60 },
2064 { SEVEN_DAYS, 4*60*60, 18*60*60 },
2065 { TIME_MAX, 9*60*60, 36*60*60 }
2071 if (tdiff <= delays[i].maximum) {
2072 return is_primary ? delays[i].primary_delay : delays[i].nonprimary_delay;
2088 if (guard->is_reachable != GUARD_REACHABLE_NO)
2094 const time_t last_attempt = guard->last_tried_to_connect;
2104 if (BUG(last_attempt == 0) ||
2105 now >= last_attempt + delay) {
2107 char tbuf[ISO_TIME_LEN+1];
2109 log_info(
LD_GUARD,
"Marked %s%sguard %s for possible retry, since we "
2110 "haven't tried to use it since %s.",
2111 guard->is_primary?
"primary ":
"",
2112 guard->confirmed_idx>=0?
"confirmed ":
"",
2116 guard->is_reachable = GUARD_REACHABLE_MAYBE;
2117 if (guard->is_filtered_guard)
2118 guard->is_usable_filtered_guard = 1;
2136static entry_guard_t *
2139 const entry_guard_restriction_t *rst,
2140 unsigned *state_out)
2142 const int need_descriptor = (usage == GUARD_USAGE_TRAFFIC);
2143 entry_guard_t *chosen_guard = NULL;
2147 int num_entry_guards_considered = 0;
2152 log_info(
LD_GUARD,
"Entry guard %s doesn't obey restriction, we test the"
2156 "Skipping guard %s due to circuit path restriction. "
2157 "Have %d, considered: %d, to consider: %d",
2159 smartlist_len(usable_primary_guards),
2160 num_entry_guards_considered,
2161 num_entry_guards_to_consider);
2164 num_entry_guards_considered++;
2168 if (num_entry_guards_considered >= num_entry_guards_to_consider) {
2172 if (smartlist_len(usable_primary_guards) == 0) {
2173 static ratelim_t guardlog = RATELIM_INIT(60);
2175 "All current guards excluded by path restriction "
2176 "type %d; using an additional guard.",
2185 if (guard->is_reachable != GUARD_REACHABLE_NO) {
2187 log_info(
LD_GUARD,
"Guard %s does not have a descriptor",
2191 *state_out = GUARD_CIRC_STATE_USABLE_ON_COMPLETION;
2194 num_entry_guards_considered++;
2198 if (num_entry_guards_considered >= num_entry_guards_to_consider) {
2202 log_info(
LD_GUARD,
"Guard %s is not reachable",
2205 } SMARTLIST_FOREACH_END(guard);
2207 if (smartlist_len(usable_primary_guards)) {
2210 "Selected primary guard %s for circuit from a list size of %d.",
2212 smartlist_len(usable_primary_guards));
2216 } SMARTLIST_FOREACH_END(guard);
2217 smartlist_free(usable_primary_guards);
2220 smartlist_free(usable_primary_guards);
2221 return chosen_guard;
2230static entry_guard_t *
2233 const entry_guard_restriction_t *rst,
2234 unsigned *state_out)
2236 const int need_descriptor = (usage == GUARD_USAGE_TRAFFIC);
2239 if (guard->is_primary)
2244 if (guard->is_usable_filtered_guard && ! guard->is_pending) {
2247 guard->is_pending = 1;
2249 *state_out = GUARD_CIRC_STATE_USABLE_IF_NO_BETTER_GUARD;
2250 log_info(
LD_GUARD,
"No primary guards available. Selected confirmed "
2251 "guard %s for circuit. Will try other guards before using "
2256 } SMARTLIST_FOREACH_END(guard);
2267static entry_guard_t *
2270 const entry_guard_restriction_t *rst,
2271 unsigned *state_out)
2273 const int need_descriptor = (usage == GUARD_USAGE_TRAFFIC);
2274 entry_guard_t *chosen_guard = NULL;
2276 if (need_descriptor)
2277 flags |= SAMPLE_EXCLUDE_NO_DESCRIPTOR;
2280 SAMPLE_EXCLUDE_CONFIRMED |
2281 SAMPLE_EXCLUDE_PRIMARY |
2282 SAMPLE_EXCLUDE_PENDING |
2284 if (!chosen_guard) {
2288 chosen_guard->is_pending = 1;
2289 chosen_guard->last_tried_to_connect =
approx_time();
2290 *state_out = GUARD_CIRC_STATE_USABLE_IF_NO_BETTER_GUARD;
2291 log_info(
LD_GUARD,
"No primary or confirmed guards available. Selected "
2292 "guard %s for circuit. Will try other guards before "
2293 "using this circuit.",
2295 return chosen_guard;
2309 const entry_guard_restriction_t *rst,
2310 unsigned *state_out)
2312 entry_guard_t *chosen_guard = NULL;
2316 if (!gs->primary_guards_up_to_date)
2323 log_info(
LD_GUARD,
"Selected primary guard %s for circuit.",
2325 return chosen_guard;
2334 log_info(
LD_GUARD,
"Selected confirmed guard %s for circuit.",
2336 return chosen_guard;
2343 if (chosen_guard == NULL) {
2344 log_info(
LD_GUARD,
"Absolutely no sampled guards were available. "
2345 "Marking all guards for retry and starting from top again.");
2346 mark_all_guards_maybe_reachable(gs);
2350 log_info(
LD_GUARD,
"Selected filtered guard %s for circuit.",
2352 return chosen_guard;
2361 entry_guard_t *guard)
2365 guard->is_reachable = GUARD_REACHABLE_NO;
2366 guard->is_usable_filtered_guard = 0;
2368 guard->is_pending = 0;
2369 if (guard->failing_since == 0)
2375 log_info(
LD_GUARD,
"Recorded failure for %s%sguard %s",
2376 guard->is_primary?
"primary ":
"",
2377 guard->confirmed_idx>=0?
"confirmed ":
"",
2398 entry_guard_t *guard,
2404 const time_t last_time_on_internet = gs->last_time_on_internet;
2408 if (guard->is_reachable != GUARD_REACHABLE_YES) {
2418 guard->is_reachable = GUARD_REACHABLE_YES;
2419 guard->failing_since = 0;
2420 guard->is_pending = 0;
2421 if (guard->is_filtered_guard)
2422 guard->is_usable_filtered_guard = 1;
2424 if (guard->confirmed_idx < 0) {
2426 if (!gs->primary_guards_up_to_date)
2431 switch (old_state) {
2432 case GUARD_CIRC_STATE_COMPLETE:
2433 case GUARD_CIRC_STATE_USABLE_ON_COMPLETION:
2434 new_state = GUARD_CIRC_STATE_COMPLETE;
2439 case GUARD_CIRC_STATE_USABLE_IF_NO_BETTER_GUARD:
2440 if (guard->is_primary) {
2448 new_state = GUARD_CIRC_STATE_COMPLETE;
2450 new_state = GUARD_CIRC_STATE_WAITING_FOR_BETTER_GUARD;
2455 if (! guard->is_primary) {
2462 log_info(
LD_GUARD,
"Recorded success for %s%sguard %s",
2463 guard->is_primary?
"primary ":
"",
2464 guard->confirmed_idx>=0?
"confirmed ":
"",
2482 if (a->confirmed_idx < 0) {
2483 if (b->confirmed_idx >= 0)
2486 if (b->confirmed_idx < 0)
2490 return (a->confirmed_idx < b->confirmed_idx);
2495 if (a->is_pending) {
2496 if (! b->is_pending)
2500 return a->last_tried_to_connect < b->last_tried_to_connect;
2514 if (rst && rst->excluded) {
2517 smartlist_free(rst->excluded);
2530 entry_guard_restriction_free(state->restrictions);
2531 entry_guard_handle_free(state->guard);
2539 entry_guard_restriction_t *rst))
2541 circuit_guard_state_t *result;
2543 result = tor_malloc_zero(
sizeof(circuit_guard_state_t));
2544 result->guard = entry_guard_handle_new(guard);
2545 result->state = state;
2547 result->restrictions = rst;
2565 entry_guard_restriction_t *rst,
2566 const node_t **chosen_node_out,
2567 circuit_guard_state_t **guard_state_out)
2572 *chosen_node_out = NULL;
2573 *guard_state_out = NULL;
2576 entry_guard_t *guard =
2580 if (BUG(state == 0))
2586 if (BUG(usage != GUARD_USAGE_DIRGUARD &&
2590 *chosen_node_out = node;
2595 entry_guard_restriction_free(rst);
2611 if (BUG(*guard_state_p == NULL))
2612 return GUARD_USABLE_NEVER;
2614 entry_guard_t *guard = entry_guard_handle_get((*guard_state_p)->guard);
2615 if (! guard || BUG(guard->in_selection == NULL))
2616 return GUARD_USABLE_NEVER;
2620 (*guard_state_p)->state);
2622 (*guard_state_p)->state = newstate;
2625 if (newstate == GUARD_CIRC_STATE_COMPLETE) {
2626 return GUARD_USABLE_NOW;
2628 return GUARD_MAYBE_USABLE_LATER;
2638 if (BUG(*guard_state_p == NULL))
2640 entry_guard_t *guard = entry_guard_handle_get((*guard_state_p)->guard);
2646 guard->is_pending = 0;
2647 circuit_guard_state_free(*guard_state_p);
2648 *guard_state_p = NULL;
2659 if (BUG(*guard_state_p == NULL))
2662 entry_guard_t *guard = entry_guard_handle_get((*guard_state_p)->guard);
2663 if (! guard || BUG(guard->in_selection == NULL))
2668 (*guard_state_p)->state = GUARD_CIRC_STATE_DEAD;
2694 } SMARTLIST_FOREACH_END(circ);
2695 smartlist_free(pending);
2706 if (!gs->primary_guards_up_to_date)
2710 if (guard->is_reachable != GUARD_REACHABLE_NO)
2712 } SMARTLIST_FOREACH_END(guard);
2725 const entry_guard_restriction_t *rst,
2734 entry_guard_t *guard_a = entry_guard_handle_get(state_a->guard);
2735 entry_guard_t *guard_b = entry_guard_handle_get(state_b->guard);
2740 }
else if (! guard_b) {
2772 log_debug(
LD_GUARD,
"Considered upgrading guard-stalled circuits, "
2773 "but not all primary guards were definitely down.");
2779 int n_complete_blocking = 0;
2788 entry_guard_t *guard = entry_guard_handle_get(state->guard);
2789 if (!guard || guard->in_selection != gs)
2797 } SMARTLIST_FOREACH_END(circ);
2801 if (BUG(state == NULL))
2804 if (state->state == GUARD_CIRC_STATE_WAITING_FOR_BETTER_GUARD) {
2806 if (! best_waiting_circuit ||
2808 best_waiting_circuit = circ;
2811 } SMARTLIST_FOREACH_END(circ);
2813 if (! best_waiting_circuit) {
2814 log_debug(
LD_GUARD,
"Considered upgrading guard-stalled circuits, "
2815 "but didn't find any.");
2822 const entry_guard_restriction_t *rst_on_best_waiting =
2835 if (BUG(state == NULL))
2837 if (state->state != GUARD_CIRC_STATE_COMPLETE)
2841 best_waiting_circuit))
2842 ++n_complete_blocking;
2843 } SMARTLIST_FOREACH_END(circ);
2845 if (n_complete_blocking) {
2846 log_debug(
LD_GUARD,
"Considered upgrading guard-stalled circuits: found "
2847 "%d complete and %d guard-stalled. At least one complete "
2848 "circuit had higher priority, so not upgrading.",
2849 n_complete, n_waiting);
2858 int n_blockers_found = 0;
2859 const time_t state_set_at_cutoff =
2863 if (BUG(state == NULL))
2865 if (state->state != GUARD_CIRC_STATE_USABLE_IF_NO_BETTER_GUARD)
2867 if (state->state_set_at <= state_set_at_cutoff)
2870 best_waiting_circuit))
2872 } SMARTLIST_FOREACH_END(circ);
2874 if (n_blockers_found) {
2875 log_debug(
LD_GUARD,
"Considered upgrading guard-stalled circuits: found "
2876 "%d guard-stalled, but %d pending circuit(s) had higher "
2877 "guard priority, so not upgrading.",
2878 n_waiting, n_blockers_found);
2885 int n_succeeded = 0;
2888 if (BUG(state == NULL))
2890 if (circ != best_waiting_circuit && rst_on_best_waiting) {
2895 if (state->state != GUARD_CIRC_STATE_WAITING_FOR_BETTER_GUARD)
2900 state->state = GUARD_CIRC_STATE_COMPLETE;
2904 } SMARTLIST_FOREACH_END(circ);
2906 log_info(
LD_GUARD,
"Considered upgrading guard-stalled circuits: found "
2907 "%d guard-stalled, %d complete. %d of the guard-stalled "
2908 "circuit(s) had high enough priority to upgrade.",
2909 n_waiting, n_complete, n_succeeded);
2911 tor_assert_nonfatal(n_succeeded >= 1);
2912 smartlist_free(all_circuits);
2916 smartlist_free(all_circuits);
2927 if (guard_state == NULL)
2929 const time_t expire_if_waiting_since =
2931 return (guard_state->state == GUARD_CIRC_STATE_WAITING_FOR_BETTER_GUARD
2932 && guard_state->state_set_at < expire_if_waiting_since);
2967 char tbuf[ISO_TIME_LEN+1];
2974 if (guard->bridge_addr) {
2977 guard->bridge_addr->port);
2987 if (guard->sampled_by_version) {
2989 guard->sampled_by_version);
2992 if (guard->unlisted_since_date > 0) {
2998 (
int)guard->currently_listed);
3000 if (guard->confirmed_idx >= 0) {
3007 const double EPSILON = 1.0e-6;
3015 #define PB_FIELD(field) do { \
3016 if (pb->field >= EPSILON) { \
3017 smartlist_add_asprintf(result, "pb_" #field "=%f", pb->field); \
3020 PB_FIELD(use_attempts);
3021 PB_FIELD(use_successes);
3022 PB_FIELD(circ_attempts);
3023 PB_FIELD(circ_successes);
3024 PB_FIELD(successful_circuits_closed);
3025 PB_FIELD(collapsed_circuits);
3026 PB_FIELD(unusable_circuits);
3031 if (guard->extra_state_fields)
3036 smartlist_free(result);
3047 *extra, strmap_t *vals)
3050 SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0);
3053 const char *eq = strchr(entry,
'=');
3058 char *key = tor_strndup(entry, eq-entry);
3059 char **target = strmap_get(vals, key);
3060 if (target == NULL || *target != NULL) {
3067 *target = tor_strdup(eq+1);
3070 } SMARTLIST_FOREACH_END(entry);
3078 *unlisted_since,
char *confirmed_on)
3080#define HANDLE_TIME(field) do { \
3082 int r = parse_iso_time_nospace(field, &field ## _time); \
3084 log_warn(LD_CIRC, "Unable to parse %s %s from guard", \
3085 #field, escaped(field)); \
3086 field##_time = -1; \
3091 time_t sampled_on_time = 0;
3092 time_t unlisted_since_time = 0;
3093 time_t confirmed_on_time = 0;
3095 HANDLE_TIME(sampled_on);
3096 HANDLE_TIME(unlisted_since);
3097 HANDLE_TIME(confirmed_on);
3099 if (sampled_on_time <= 0)
3101 if (unlisted_since_time < 0)
3102 unlisted_since_time = 0;
3103 if (confirmed_on_time < 0)
3104 confirmed_on_time = 0;
3108 guard->sampled_on_date = sampled_on_time;
3109 guard->unlisted_since_date = unlisted_since_time;
3110 guard->confirmed_on_date = confirmed_on_time;
3126 char *rsa_id = NULL;
3127 char *nickname = NULL;
3128 char *sampled_on = NULL;
3129 char *sampled_idx = NULL;
3130 char *sampled_by = NULL;
3131 char *unlisted_since = NULL;
3132 char *listed = NULL;
3133 char *confirmed_on = NULL;
3134 char *confirmed_idx = NULL;
3135 char *bridge_addr = NULL;
3138 char *pb_use_attempts = NULL;
3139 char *pb_use_successes = NULL;
3140 char *pb_circ_attempts = NULL;
3141 char *pb_circ_successes = NULL;
3142 char *pb_successful_circuits_closed = NULL;
3143 char *pb_collapsed_circuits = NULL;
3144 char *pb_unusable_circuits = NULL;
3145 char *pb_timeouts = NULL;
3153 strmap_t *vals = strmap_new();
3155 strmap_set(vals, #f, &f);
3162 FIELD(unlisted_since);
3164 FIELD(confirmed_on);
3165 FIELD(confirmed_idx);
3167 FIELD(pb_use_attempts);
3168 FIELD(pb_use_successes);
3169 FIELD(pb_circ_attempts);
3170 FIELD(pb_circ_successes);
3171 FIELD(pb_successful_circuits_closed);
3172 FIELD(pb_collapsed_circuits);
3173 FIELD(pb_unusable_circuits);
3179 smartlist_free(entries);
3180 strmap_free(vals, NULL);
3183 entry_guard_t *guard = tor_malloc_zero(
sizeof(entry_guard_t));
3184 guard->is_persistent = 1;
3187 log_warn(
LD_CIRC,
"Guard missing 'in' field");
3191 guard->selection_name = in;
3194 if (rsa_id == NULL) {
3195 log_warn(
LD_CIRC,
"Guard missing RSA ID field");
3202 log_warn(
LD_CIRC,
"Unable to decode guard identity %s",
escaped(rsa_id));
3207 strlcpy(guard->nickname, nickname,
sizeof(guard->nickname));
3209 guard->nickname[0]=
'$';
3216 memset(&res, 0,
sizeof(res));
3218 &res.addr, &res.port, -1);
3220 guard->bridge_addr = tor_memdup(&res,
sizeof(res));
3229 guard->sampled_by_version = sampled_by;
3232 if (listed && strcmp(listed,
"0"))
3233 guard->currently_listed = 1;
3236 guard->confirmed_idx = -1;
3237 if (confirmed_idx) {
3239 long idx =
tor_parse_long(confirmed_idx, 10, 0, INT_MAX, &ok, NULL);
3241 log_warn(
LD_GUARD,
"Guard has invalid confirmed_idx %s",
3244 guard->confirmed_idx = (int)idx;
3250 long idx =
tor_parse_long(sampled_idx, 10, 0, INT_MAX, &ok, NULL);
3252 log_warn(
LD_GUARD,
"Guard has invalid sampled_idx %s",
3255 guard->sampled_idx = invalid_sampled_idx++;
3257 guard->sampled_idx = (int)idx;
3259 }
else if (confirmed_idx) {
3263 guard->sampled_idx = guard->confirmed_idx;
3265 log_info(
LD_GUARD,
"The state file seems to be into a status that could"
3266 " yield to weird entry node selection: we're missing both a"
3267 " sampled_idx and a confirmed_idx.");
3268 guard->sampled_idx = invalid_sampled_idx++;
3272 if (smartlist_len(extra) > 0) {
3277 guard->is_reachable = GUARD_REACHABLE_MAYBE;
3279#define PB_FIELD(field) \
3281 if (pb_ ## field) { \
3283 double r = tor_parse_double(pb_ ## field, 0.0, 1e9, &ok, NULL); \
3285 log_warn(LD_CIRC, "Guard has invalid pb_%s %s", \
3286 #field, pb_ ## field); \
3288 guard->pb.field = r; \
3292 PB_FIELD(use_attempts);
3293 PB_FIELD(use_successes);
3294 PB_FIELD(circ_attempts);
3295 PB_FIELD(circ_successes);
3296 PB_FIELD(successful_circuits_closed);
3297 PB_FIELD(collapsed_circuits);
3298 PB_FIELD(unusable_circuits);
3312 entry_guard_free(guard);
3331 tor_free(pb_successful_circuits_closed);
3337 smartlist_free(extra);
3357 if (guard->is_persistent == 0)
3360 (*nextline)->key = tor_strdup(
"Guard");
3362 nextline = &(*nextline)->next;
3364 } SMARTLIST_FOREACH_END(guard);
3365 } SMARTLIST_FOREACH_END(gs);
3367 config_free_lines(state->
Guard);
3368 state->
Guard = lines;
3389 guard_selection_free(gs);
3393 } SMARTLIST_FOREACH_END(gs);
3396 for ( ; line != NULL; line = line->next) {
3398 if (guard == NULL) {
3403 if (!strcmp(guard->selection_name,
"legacy")) {
3405 entry_guard_free(guard);
3410 guard_selection_t *gs;
3415 guard->in_selection = gs;
3420 if (gs->next_sampled_idx <= guard->sampled_idx) {
3421 gs->next_sampled_idx = guard->sampled_idx + 1;
3425 entry_guard_free(guard);
3436 } SMARTLIST_FOREACH_END(gs);
3438 return n_errors ? -1 : 0;
3472circuit_guard_state_t *
3475 circuit_guard_state_t *guard_state = NULL;
3476 entry_guard_t *guard = NULL;
3490 GUARD_CIRC_STATE_USABLE_ON_COMPLETION,
3502 entry_guard_handles_clear(e);
3543 if (BUG(gs->type != GS_TYPE_BRIDGE)) {
3549 if (! guard->is_filtered_guard)
3552 if (guard->is_reachable == GUARD_REACHABLE_NO)
3555 if (!use_maybe_reachable && guard->is_reachable == GUARD_REACHABLE_MAYBE)
3560 if (node && node->ri)
3562 } SMARTLIST_FOREACH_END(guard);
3573 const double EPSILON = 1.0e-9;
3578 if (node->pb.use_attempts >
EPSILON &&
3582 node->pb.path_bias_disabled = 1;
3584 "Path use bias is too high (%f/%f); disabling node %s",
3585 node->pb.circ_successes, node->pb.circ_attempts,
3596 const double EPSILON = 1.0e-9;
3601 if (node->pb.circ_attempts >
EPSILON &&
3605 node->pb.path_bias_disabled = 1;
3607 "Path bias is too high (%f/%f); disabling node %s",
3608 node->pb.circ_successes, node->pb.circ_attempts,
3627 if (msg && *msg == NULL) {
3628 *msg = tor_strdup(
"parsing error");
3637#define SLOW_GUARD_STATE_FLUSH_TIME 600
3640#define FAST_GUARD_STATE_FLUSH_TIME 30
3715 entry_guard_t *guard = entry_guard_handle_get(guard_state->guard);
3716 if (!guard || BUG(guard->in_selection == NULL)) {
3730 const char *status = NULL;
3733 char tbuf[ISO_TIME_LEN+1];
3741 if (e->confirmed_idx < 0) {
3742 status =
"never-connected";
3743 }
else if (! e->currently_listed) {
3744 when = e->unlisted_since_date;
3745 status =
"unusable";
3746 }
else if (! e->is_filtered_guard) {
3747 status =
"unusable";
3748 }
else if (e->is_reachable == GUARD_REACHABLE_NO) {
3749 when = e->failing_since;
3765 char *result = NULL;
3768 tor_asprintf(&result,
"%s %s %s\n", nbuf, status, tbuf);
3786 const char *question,
char **answer,
3787 const char **errmsg)
3796 if (!strcmp(question,
"entry-guards") ||
3797 !strcmp(question,
"helper-nodes")) {
3799 guards = gs->sampled_entry_guards;
3806 } SMARTLIST_FOREACH_END(e);
3833 uint32_t guardfraction_percentage)
3835 double guardfraction_fraction;
3839 guardfraction_fraction = guardfraction_percentage / 100.0;
3841 long guard_bw =
tor_lround(guardfraction_fraction * orig_bandwidth);
3844 guardfraction_bw->
guard_bw = (int) guard_bw;
3846 guardfraction_bw->
non_guard_bw = orig_bandwidth - (int) guard_bw;
3857 int mark_circuits = 0;
3866 return mark_circuits;
3875 circuit_guard_state_t **guard_state_out)
3878 const uint8_t *exit_id = NULL;
3879 entry_guard_restriction_t *rst = NULL;
3882 if (CIRCUIT_IS_CONFLUX(
TO_CIRCUIT(circ)) && state
3884 rst = guard_create_conflux_restriction(circ, exit_id);
3894 rst = guard_create_exit_restriction(exit_id);
3898 GUARD_USAGE_TRAFFIC,
3901 guard_state_out) < 0) {
3915 char *old_name = tor_strdup(gs->name);
3916 guard_selection_type_t old_type = gs->type;
3919 control_event_guard(entry->nickname, entry->identity,
"DROPPED");
3927 guard_selection_free(gs);
3948 circuit_guard_state_t **guard_state_out)
3951 entry_guard_restriction_t *rst = NULL;
3959 GUARD_USAGE_DIRGUARD,
3962 guard_state_out) < 0) {
3992 int num_present,
int num_usable)
3994 if (!gs->primary_guards_up_to_date)
3997 char *ret_str = NULL;
3998 int n_missing_descriptors = 0;
3999 int n_considered = 0;
4000 int num_primary_to_check;
4006 num_primary_to_check++;
4010 if (guard->is_reachable == GUARD_REACHABLE_NO)
4014 n_missing_descriptors++;
4015 if (n_considered >= num_primary_to_check)
4017 } SMARTLIST_FOREACH_END(guard);
4020 if (!n_missing_descriptors) {
4025 tor_asprintf(&ret_str,
"We're missing descriptors for %d/%d of our "
4026 "primary entry guards (total %sdescriptors: %d/%d). "
4027 "That's ok. We will try to fetch missing descriptors soon.",
4028 n_missing_descriptors, num_primary_to_check,
4029 using_mds?
"micro":
"", num_present, num_usable);
4038 int num_present,
int num_usable)
4043 num_present, num_usable);
4054 if (gs->sampled_entry_guards) {
4056 entry_guard_free(e));
4057 smartlist_free(gs->sampled_entry_guards);
4058 gs->sampled_entry_guards = NULL;
4061 smartlist_free(gs->confirmed_entry_guards);
4062 smartlist_free(gs->primary_entry_guards);
4081#define layer2_guard_free(val) \
4082 FREE_AND_NULL(layer2_guard_t, layer2_guard_free_, (val))
4123static routerset_t *layer2_routerset = NULL;
4126#define NUMBER_SECOND_GUARDS 4
4133#define MIN_SECOND_GUARD_LIFETIME (3600*24)
4134#define MAX_SECOND_GUARD_LIFETIME (3600*24*12)
4141 "guard-hs-l2-number",
4151 "guard-hs-l2-lifetime-min",
4161 "guard-hs-l2-lifetime-max",
4162 MAX_SECOND_GUARD_LIFETIME,
4177 if (BUG(min >= max)) {
4203 log_info(
LD_GENERAL,
"Removing expired Layer2 guard %s",
4207 layer2_guard_free(g);
4215 log_info(
LD_GENERAL,
"Removing %s Layer2 guard %s",
4216 rs ?
"unsuitable" :
"missing",
4220 layer2_guard_free(g);
4224 } SMARTLIST_FOREACH_END(g);
4227 int new_guards_needed_n =
4229 if (new_guards_needed_n <= 0) {
4233 log_info(
LD_GENERAL,
"Adding %d guards to Layer2 routerset",
4234 new_guards_needed_n);
4244 } SMARTLIST_FOREACH_END(g);
4247 for (
int i = 0; i < new_guards_needed_n; i++) {
4248 const node_t *choice = NULL;
4263 log_info(
LD_GENERAL,
"Adding Layer2 guard %s",
4274 smartlist_free(excluded);
4277 routerset_free(layer2_routerset);
4284 } SMARTLIST_FOREACH_END(g);
4300 layer2_guard_free(g);
4301 } SMARTLIST_FOREACH_END(g);
4321 return layer2_routerset;
4336 guard_selection_free(gs);
4337 } SMARTLIST_FOREACH_END(gs);
4348 layer2_guard_free(g);
4349 } SMARTLIST_FOREACH_END(g);
4352 routerset_free(layer2_routerset);
int tor_addr_port_parse(int severity, const char *addrport, tor_addr_t *address_out, uint16_t *port_out, int default_port)
int tor_addr_port_eq(const tor_addr_port_t *a, const tor_addr_port_t *b)
#define fmt_and_decorate_addr(a)
const char * hex_str(const char *from, size_t fromlen)
int base16_decode(char *dest, size_t destlen, const char *src, size_t srclen)
void base16_encode(char *dest, size_t destlen, const char *src, size_t srclen)
download_status_t * get_bridge_dl_status_by_id(const char *digest)
const uint8_t * bridge_get_rsa_id_digest(const bridge_info_t *bridge)
int node_is_a_configured_bridge(const node_t *node)
const tor_addr_port_t * bridge_get_addr_port(const bridge_info_t *bridge)
const smartlist_t * bridge_list_get(void)
bridge_info_t * get_configured_bridge_by_exact_addr_port_digest(const tor_addr_t *addr, uint16_t port, const char *digest)
Header file for circuitbuild.c.
Header file for channel.c.
double pathbias_get_extreme_use_rate(const or_options_t *options)
double pathbias_get_extreme_rate(const or_options_t *options)
double pathbias_get_use_success_count(entry_guard_t *guard)
int pathbias_get_dropguards(const or_options_t *options)
double pathbias_get_close_success_count(entry_guard_t *guard)
circuit_guard_state_t * origin_circuit_get_guard_state(origin_circuit_t *circ)
const uint8_t * build_state_get_exit_rsa_id(cpath_build_state_t *state)
Header file for circuitbuild.c.
origin_circuit_t * TO_ORIGIN_CIRCUIT(circuit_t *x)
void circuit_get_all_pending_on_channel(smartlist_t *out, channel_t *chan)
Header file for circuitlist.c.
#define CIRCUIT_IS_ORIGIN(c)
void circuit_build_times_free_timeouts(circuit_build_times_t *cbt)
circuit_build_times_t * get_circuit_build_times_mutable(void)
Header file for circuitstats.c.
int circuit_should_use_vanguards(uint8_t purpose)
Header file for circuituse.c.
const or_options_t * get_options(void)
Header file for config.c.
void conflux_add_guards_to_exclude_list(const origin_circuit_t *orig_circ, smartlist_t *excluded)
Header file for conflux_pool.c.
Header file for conflux_util.c.
Header file for connection.c.
int control_event_guard(const char *nickname, const char *digest, const char *status)
Header file for control_events.c.
void * smartlist_choose(const smartlist_t *sl)
Common functions for using (pseudo-)random number generators.
time_t crypto_rand_time_range(time_t min, time_t max)
int crypto_rand_int_range(unsigned int min, unsigned int max)
const char * node_describe(const node_t *node)
Header file for describe.c.
int tor_memeq(const void *a, const void *b, size_t sz)
#define tor_memneq(a, b, sz)
void digestset_add(digestset_t *set, const char *digest)
digestset_t * digestset_new(int max_guess)
int digestset_probably_contains(const digestset_t *set, const char *digest)
Types to handle sets of digests, based on bloom filters.
Header file for directory.c.
#define DIR_PURPOSE_FETCH_MICRODESC
void download_status_reset(download_status_t *dls)
Header file for dlstatus.c.
void entry_guard_failed(circuit_guard_state_t **guard_state_p)
char * guard_selection_get_err_str_if_dir_info_missing(guard_selection_t *gs, int using_mds, int num_present, int num_usable)
STATIC int get_n_primary_guards(void)
const node_t * entry_guard_find_node(const entry_guard_t *guard)
void entry_guard_learned_bridge_identity(const tor_addr_port_t *addrport, const uint8_t *rsa_id_digest)
STATIC void entry_guards_update_primary(guard_selection_t *gs)
static entry_guard_t * entry_guard_add_to_sample_impl(guard_selection_t *gs, const uint8_t *rsa_id_digest, const char *nickname, const tor_addr_port_t *bridge_addrport)
void entry_guard_chan_failed(channel_t *chan)
static void entry_guards_update_guards_in_state(or_state_t *state)
const routerset_t * get_layer2_guards(void)
void entry_guards_changed(void)
static int guard_obeys_md_dirserver_restriction(const entry_guard_t *guard)
STATIC void entry_guards_note_guard_failure(guard_selection_t *gs, entry_guard_t *guard)
STATIC void guard_selection_free_(guard_selection_t *gs)
STATIC guard_selection_t * guard_selection_new(const char *name, guard_selection_type_t type)
void remove_all_entry_guards(void)
STATIC guard_selection_t * get_guard_selection_by_name(const char *name, guard_selection_type_t type, int create_if_absent)
void purge_vanguards_lite(void)
static int reasonably_live_consensus_is_missing(const guard_selection_t *gs)
static void entry_guard_set_filtered_flags(const or_options_t *options, guard_selection_t *gs, entry_guard_t *guard)
STATIC double get_meaningful_restriction_threshold(void)
STATIC guard_selection_type_t guard_selection_infer_type(guard_selection_type_t type, const char *name)
void entry_guard_cancel(circuit_guard_state_t **guard_state_p)
static entry_guard_t * select_and_add_guard_item_for_sample(guard_selection_t *gs, smartlist_t *eligible_guards)
STATIC int get_nonprimary_guard_idle_timeout(void)
static entry_guard_t * select_primary_guard_for_circuit(guard_selection_t *gs, guard_usage_t usage, const entry_guard_restriction_t *rst, unsigned *state_out)
entry_guard_t * entry_guard_get_by_id_digest(const char *digest)
STATIC void mark_primary_guards_maybe_reachable(guard_selection_t *gs)
int entry_guards_upgrade_waiting_circuits(guard_selection_t *gs, const smartlist_t *all_circuits_in, smartlist_t *newly_complete_out)
#define NUMBER_SECOND_GUARDS
static guard_selection_t * curr_guard_context
static void remove_guard_from_confirmed_and_primary_lists(guard_selection_t *gs, entry_guard_t *guard)
void remove_all_entry_guards_for_guard_selection(guard_selection_t *gs)
int num_bridges_usable(int use_maybe_reachable)
#define MIN_GUARDS_FOR_MD_RESTRICTION
static int guard_has_descriptor(const entry_guard_t *guard)
STATIC double get_extreme_restriction_threshold(void)
int entry_guards_update_all(guard_selection_t *gs)
static smartlist_t * layer2_guards
STATIC circuit_guard_state_t * circuit_guard_state_new(entry_guard_t *guard, unsigned state, entry_guard_restriction_t *rst)
STATIC entry_guard_t * first_reachable_filtered_entry_guard(guard_selection_t *gs, const entry_guard_restriction_t *rst, unsigned flags)
static entry_guard_t * get_sampled_guard_for_bridge(guard_selection_t *gs, const bridge_info_t *bridge)
STATIC int get_min_filtered_sample_size(void)
static int get_number_of_layer2_hs_guards(void)
static int guard_in_node_family(const entry_guard_t *guard, const node_t *node)
static size_t sampled_guards_update_consensus_presence(guard_selection_t *gs)
static int should_set_md_dirserver_restriction(void)
STATIC void entry_guard_free_(entry_guard_t *e)
STATIC void entry_guard_restriction_free_(entry_guard_restriction_t *rst)
int entry_list_is_constrained(const or_options_t *options)
STATIC int get_guard_confirmed_min_lifetime(void)
guard_usable_t entry_guard_succeeded(circuit_guard_state_t **guard_state_p)
circuit_guard_state_t * get_guard_state_for_bridge_desc_fetch(const char *digest)
static entry_guard_t * select_confirmed_guard_for_circuit(guard_selection_t *gs, guard_usage_t usage, const entry_guard_restriction_t *rst, unsigned *state_out)
static size_t sampled_guards_prune_obsolete_entries(guard_selection_t *gs, const time_t remove_if_unlisted_since, const time_t maybe_remove_if_sampled_before, const time_t remove_if_confirmed_before)
STATIC int entry_guard_has_higher_priority(entry_guard_t *a, entry_guard_t *b)
void entry_guards_note_internet_connectivity(guard_selection_t *gs)
const char * entry_guard_get_rsa_id_digest(const entry_guard_t *guard)
char * entry_guards_get_err_str_if_dir_info_missing(int using_mds, int num_present, int num_usable)
STATIC void entry_guards_update_confirmed(guard_selection_t *gs)
STATIC char * entry_guard_encode_for_state(entry_guard_t *guard, int dense_sampled_idx)
STATIC void entry_guards_update_filtered_sets(guard_selection_t *gs)
void entry_guards_update_state(or_state_t *state)
bool vanguards_lite_is_enabled(void)
static void pathbias_check_close_success_count(entry_guard_t *guard)
static int get_layer2_hs_guard_lifetime(void)
int update_guard_selection_choice(const or_options_t *options)
STATIC entry_guard_restriction_t * guard_create_dirserver_md_restriction(void)
static bool entry_guard_restriction_is_reachability(const entry_guard_restriction_t *rst)
static int compare_guards_by_sampled_idx(const void **a_, const void **b_)
void circuit_guard_state_free_(circuit_guard_state_t *state)
int entry_guard_pick_for_circuit(guard_selection_t *gs, guard_usage_t usage, entry_guard_restriction_t *rst, const node_t **chosen_node_out, circuit_guard_state_t **guard_state_out)
STATIC int get_remove_unlisted_guards_after_days(void)
static void create_initial_guard_context(void)
STATIC int get_max_sample_size_absolute(void)
STATIC int get_nonprimary_guard_connect_timeout(void)
void maintain_layer2_guards(void)
static void parse_from_state_handle_time(entry_guard_t *guard, char *sampled_on, char *unlisted_since, char *confirmed_on)
STATIC entry_guard_t * get_sampled_guard_with_id(guard_selection_t *gs, const uint8_t *rsa_id)
int entry_guards_parse_state(or_state_t *state, int set, char **msg)
STATIC unsigned entry_guards_note_guard_success(guard_selection_t *gs, entry_guard_t *guard, unsigned old_state)
static int entry_guard_obeys_restriction(const entry_guard_t *guard, const entry_guard_restriction_t *rst)
int entry_guard_state_should_expire(circuit_guard_state_t *guard_state)
guard_pathbias_t * entry_guard_get_pathbias_state(entry_guard_t *guard)
const node_t * guards_choose_guard(const origin_circuit_t *circ, cpath_build_state_t *state, uint8_t purpose, circuit_guard_state_t **guard_state_out)
int entry_guard_could_succeed(const circuit_guard_state_t *guard_state)
static entry_guard_t * entry_guard_add_bridge_to_sample(guard_selection_t *gs, const bridge_info_t *bridge)
static void pathbias_check_use_success_count(entry_guard_t *guard)
int guards_retry_optimistic(const or_options_t *options)
STATIC int entry_guard_is_listed(guard_selection_t *gs, const entry_guard_t *guard)
const node_t * guards_choose_dirguard(uint8_t dir_purpose, circuit_guard_state_t **guard_state_out)
static entry_guard_t * select_filtered_guard_for_circuit(guard_selection_t *gs, guard_usage_t usage, const entry_guard_restriction_t *rst, unsigned *state_out)
static smartlist_t * get_eligible_guards(const or_options_t *options, guard_selection_t *gs, int *n_guards_out)
STATIC void entry_guard_consider_retry(entry_guard_t *guard)
static int entry_guard_passes_filter(const or_options_t *options, guard_selection_t *gs, entry_guard_t *guard)
#define SLOW_GUARD_STATE_FLUSH_TIME
STATIC double get_max_sample_threshold(void)
int should_apply_guardfraction(const networkstatus_t *ns)
void entry_guards_changed_for_guard_selection(guard_selection_t *gs)
STATIC entry_guard_t * entry_guard_add_to_sample(guard_selection_t *gs, const node_t *node)
static int get_min_lifetime_of_layer2_hs_guards(void)
static int bridge_passes_guard_filter(const or_options_t *options, const bridge_info_t *bridge)
static entry_guard_t * get_sampled_guard_by_bridge_addr(guard_selection_t *gs, const tor_addr_port_t *addrport)
static smartlist_t * guard_contexts
STATIC int num_reachable_filtered_guards(const guard_selection_t *gs, const entry_guard_restriction_t *rst)
static int have_sampled_guard_with_id(guard_selection_t *gs, const uint8_t *rsa_id)
STATIC int entry_guards_all_primary_guards_are_down(guard_selection_t *gs)
STATIC time_t randomize_time(time_t now, time_t max_backdate)
static time_t get_remove_unlisted_guards_after_seconds(void)
STATIC int get_n_primary_guards_to_use(guard_usage_t usage)
STATIC const char * choose_guard_selection(const or_options_t *options, const networkstatus_t *live_ns, const guard_selection_t *old_selection, guard_selection_type_t *type_out)
static int get_retry_schedule(time_t failing_since, time_t now, int is_primary)
static int entry_guards_load_guards_from_state(or_state_t *state, int set)
STATIC char * getinfo_helper_format_single_entry_guard(const entry_guard_t *e)
#define FAST_GUARD_STATE_FLUSH_TIME
static int node_is_possible_guard(const node_t *node)
#define MIN_SECOND_GUARD_LIFETIME
STATIC void make_guard_confirmed(guard_selection_t *gs, entry_guard_t *guard)
static int circ_state_has_higher_priority(origin_circuit_t *a, const entry_guard_restriction_t *rst, origin_circuit_t *b)
int getinfo_helper_entry_guards(control_connection_t *conn, const char *question, char **answer, const char **errmsg)
guard_selection_t * get_guard_selection_info(void)
STATIC entry_guard_t * entry_guard_parse_from_state(const char *s)
STATIC entry_guard_t * select_entry_guard_for_circuit(guard_selection_t *gs, guard_usage_t usage, const entry_guard_restriction_t *rst, unsigned *state_out)
STATIC int get_guard_lifetime(void)
static int get_max_lifetime_of_layer2_hs_guards(void)
static void parse_from_state_set_vals(const char *s, smartlist_t *entries, smartlist_t *extra, strmap_t *vals)
static int get_max_sample_size(guard_selection_t *gs, int n_guards)
int guards_update_all(void)
CTASSERT(NUMBER_SECOND_GUARDS< 20)
STATIC void sampled_guards_update_from_consensus(guard_selection_t *gs)
entry_guard_t * entry_guard_get_by_id_digest_for_guard_selection(guard_selection_t *gs, const char *digest)
static bridge_info_t * get_bridge_info_for_guard(const entry_guard_t *guard)
static int entry_guards_dirty
const char * entry_guard_describe(const entry_guard_t *guard)
STATIC entry_guard_t * entry_guards_expand_sample(guard_selection_t *gs)
static int node_passes_guard_filter(const or_options_t *options, const node_t *node)
void entry_guards_free_all(void)
STATIC int get_internet_likely_down_interval(void)
Header file for circuitbuild.c.
const char * escaped(const char *s)
long tor_lround(double d)
#define log_fn_ratelim(ratelim, severity, domain, args,...)
Header file for mainloop.c.
int usable_consensus_flavor(void)
int microdesc_relay_is_outdated_dirserver(const char *relay_digest)
Header file for microdesc.c.
networkstatus_t * networkstatus_get_reasonably_live_consensus(time_t now, int flavor)
const routerstatus_t * router_get_consensus_status_by_id(const char *digest)
int32_t networkstatus_get_param(const networkstatus_t *ns, const char *param_name, int32_t default_val, int32_t min_val, int32_t max_val)
Header file for networkstatus.c.
int is_legal_nickname(const char *s)
Header file for nickname.c.
const node_t * router_choose_random_node(smartlist_t *excludedsmartlist, routerset_t *excludedset, router_crn_flags_t flags)
const node_t * node_sl_choose_by_bandwidth(const smartlist_t *sl, bandwidth_weight_rule_t rule)
Header file for node_select.c.
Node information structure.
const node_t * node_get_by_id(const char *identity_digest)
void router_dir_info_changed(void)
const smartlist_t * nodelist_get_list(void)
int router_addrs_in_same_network(const tor_addr_t *a1, const tor_addr_t *a2)
int node_has_preferred_descriptor(const node_t *node, int for_direct_connect)
const char * node_get_nickname(const node_t *node)
int node_is_dir(const node_t *node)
void node_get_addr(const node_t *node, tor_addr_t *addr_out)
void node_get_verbose_nickname(const node_t *node, char *verbose_name_out)
int nodes_in_same_family(const node_t *node1, const node_t *node2)
int router_have_minimum_dir_info(void)
Header file for nodelist.c.
Master header file for Tor-specific functionality.
#define MAX_VERBOSE_NICKNAME_LEN
The or_state_t structure, which represents Tor's state file.
Origin circuit structure.
long tor_parse_long(const char *s, int base, long min, long max, int *ok, char **next)
int reachable_addr_allows_addr(const tor_addr_t *addr, uint16_t port, firewall_connection_t fw_connection, int pref_only, int pref_ipv6)
int reachable_addr_allows_node(const node_t *node, firewall_connection_t fw_connection, int pref_only)
Header file for policies.c.
int tor_asprintf(char **strp, const char *fmt,...)
int tor_snprintf(char *str, size_t size, const char *format,...)
int router_digest_is_me(const char *digest)
Header file for router.c.
routerset_t * routerset_new(void)
int routerset_contains_node(const routerset_t *set, const node_t *node)
int routerset_parse(routerset_t *target, const char *s, const char *description)
int routerset_contains_bridge(const routerset_t *set, const bridge_info_t *bridge)
Header file for routerset.c.
Routerstatus (consensus entry) structure.
int smartlist_ptrs_eq(const smartlist_t *s1, const smartlist_t *s2)
int smartlist_contains_digest(const smartlist_t *sl, const char *element)
void smartlist_add_asprintf(struct smartlist_t *sl, const char *pattern,...)
char * smartlist_join_strings(smartlist_t *sl, const char *join, int terminate, size_t *len_out)
void smartlist_sort(smartlist_t *sl, int(*compare)(const void **a, const void **b))
void smartlist_remove_keeporder(smartlist_t *sl, const void *element)
void smartlist_add_all(smartlist_t *s1, const smartlist_t *s2)
void smartlist_add_strdup(struct smartlist_t *sl, const char *string)
int smartlist_contains(const smartlist_t *sl, const void *element)
smartlist_t * smartlist_new(void)
void smartlist_add(smartlist_t *sl, void *element)
void smartlist_clear(smartlist_t *sl)
void smartlist_remove(smartlist_t *sl, const void *element)
#define SMARTLIST_FOREACH_BEGIN(sl, type, var)
#define SMARTLIST_FOREACH(sl, type, var, cmd)
#define SMARTLIST_DEL_CURRENT(sl, var)
#define SMARTLIST_DEL_CURRENT_KEEPORDER(sl, var)
int smartlist_split_string(smartlist_t *sl, const char *str, const char *sep, int flags, int max)
void or_state_mark_dirty(or_state_t *state, time_t when)
or_state_t * get_or_state(void)
char identity[DIGEST_LEN]
double successful_circuits_closed
char identity[DIGEST_LEN]
char identity[DIGEST_LEN]
unsigned int is_possible_guard
struct routerset_t * EntryNodes
struct routerset_t * ExcludeNodes
struct config_line_t * Guard
struct circuit_guard_state_t * guard_state
#define MOCK_IMPL(rv, funcname, arglist)
void format_iso_time_nospace(char *buf, time_t t)
void format_iso_time(char *buf, time_t t)
void format_local_iso_time(char *buf, time_t t)
Headers for transports.c.
#define tor_assert_nonfatal_unreached()
#define FALLTHROUGH_UNLESS_ALL_BUGS_ARE_FATAL
int tor_digest_is_zero(const char *digest)