networkstatus.c 68 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2015, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file networkstatus.c
  8. * \brief Functions and structures for handling network status documents as a
  9. * client or cache.
  10. */
  11. #define NETWORKSTATUS_PRIVATE
  12. #include "or.h"
  13. #include "channel.h"
  14. #include "circuitmux.h"
  15. #include "circuitmux_ewma.h"
  16. #include "circuitstats.h"
  17. #include "config.h"
  18. #include "connection.h"
  19. #include "connection_or.h"
  20. #include "control.h"
  21. #include "directory.h"
  22. #include "dirserv.h"
  23. #include "dirvote.h"
  24. #include "entrynodes.h"
  25. #include "main.h"
  26. #include "microdesc.h"
  27. #include "networkstatus.h"
  28. #include "nodelist.h"
  29. #include "relay.h"
  30. #include "router.h"
  31. #include "routerlist.h"
  32. #include "routerparse.h"
  33. #include "transports.h"
  34. /** Map from lowercase nickname to identity digest of named server, if any. */
  35. static strmap_t *named_server_map = NULL;
  36. /** Map from lowercase nickname to (void*)1 for all names that are listed
  37. * as unnamed for some server in the consensus. */
  38. static strmap_t *unnamed_server_map = NULL;
  39. /** Most recently received and validated v3 consensus network status,
  40. * of whichever type we are using for our own circuits. This will be the same
  41. * as one of current_ns_consensus or current_md_consensus.
  42. */
  43. #define current_consensus \
  44. (we_use_microdescriptors_for_circuits(get_options()) ? \
  45. current_md_consensus : current_ns_consensus)
  46. /** Most recently received and validated v3 "ns"-flavored consensus network
  47. * status. */
  48. static networkstatus_t *current_ns_consensus = NULL;
  49. /** Most recently received and validated v3 "microdec"-flavored consensus
  50. * network status. */
  51. static networkstatus_t *current_md_consensus = NULL;
  52. /** A v3 consensus networkstatus that we've received, but which we don't
  53. * have enough certificates to be happy about. */
  54. typedef struct consensus_waiting_for_certs_t {
  55. /** The consensus itself. */
  56. networkstatus_t *consensus;
  57. /** The encoded version of the consensus, nul-terminated. */
  58. char *body;
  59. /** When did we set the current value of consensus_waiting_for_certs? If
  60. * this is too recent, we shouldn't try to fetch a new consensus for a
  61. * little while, to give ourselves time to get certificates for this one. */
  62. time_t set_at;
  63. /** Set to 1 if we've been holding on to it for so long we should maybe
  64. * treat it as being bad. */
  65. int dl_failed;
  66. } consensus_waiting_for_certs_t;
  67. /** An array, for each flavor of consensus we might want, of consensuses that
  68. * we have downloaded, but which we cannot verify due to having insufficient
  69. * authority certificates. */
  70. static consensus_waiting_for_certs_t
  71. consensus_waiting_for_certs[N_CONSENSUS_FLAVORS];
  72. /** A time before which we shouldn't try to replace the current consensus:
  73. * this will be at some point after the next consensus becomes valid, but
  74. * before the current consensus becomes invalid. */
  75. static time_t time_to_download_next_consensus[N_CONSENSUS_FLAVORS];
  76. /** Download status for the current consensus networkstatus. */
  77. static download_status_t consensus_dl_status[N_CONSENSUS_FLAVORS] =
  78. {
  79. { 0, 0, DL_SCHED_CONSENSUS },
  80. { 0, 0, DL_SCHED_CONSENSUS },
  81. };
  82. /** True iff we have logged a warning about this OR's version being older than
  83. * listed by the authorities. */
  84. static int have_warned_about_old_version = 0;
  85. /** True iff we have logged a warning about this OR's version being newer than
  86. * listed by the authorities. */
  87. static int have_warned_about_new_version = 0;
  88. static void routerstatus_list_update_named_server_map(void);
  89. /** Forget that we've warned about anything networkstatus-related, so we will
  90. * give fresh warnings if the same behavior happens again. */
  91. void
  92. networkstatus_reset_warnings(void)
  93. {
  94. if (current_consensus) {
  95. SMARTLIST_FOREACH(nodelist_get_list(), node_t *, node,
  96. node->name_lookup_warned = 0);
  97. }
  98. have_warned_about_old_version = 0;
  99. have_warned_about_new_version = 0;
  100. }
  101. /** Reset the descriptor download failure count on all networkstatus docs, so
  102. * that we can retry any long-failed documents immediately.
  103. */
  104. void
  105. networkstatus_reset_download_failures(void)
  106. {
  107. int i;
  108. for (i=0; i < N_CONSENSUS_FLAVORS; ++i)
  109. download_status_reset(&consensus_dl_status[i]);
  110. }
  111. /** Read every cached v3 consensus networkstatus from the disk. */
  112. int
  113. router_reload_consensus_networkstatus(void)
  114. {
  115. char *filename;
  116. char *s;
  117. const unsigned int flags = NSSET_FROM_CACHE | NSSET_DONT_DOWNLOAD_CERTS;
  118. int flav;
  119. /* FFFF Suppress warnings if cached consensus is bad? */
  120. for (flav = 0; flav < N_CONSENSUS_FLAVORS; ++flav) {
  121. char buf[128];
  122. const char *flavor = networkstatus_get_flavor_name(flav);
  123. if (flav == FLAV_NS) {
  124. filename = get_datadir_fname("cached-consensus");
  125. } else {
  126. tor_snprintf(buf, sizeof(buf), "cached-%s-consensus", flavor);
  127. filename = get_datadir_fname(buf);
  128. }
  129. s = read_file_to_str(filename, RFTS_IGNORE_MISSING, NULL);
  130. if (s) {
  131. if (networkstatus_set_current_consensus(s, flavor, flags) < -1) {
  132. log_warn(LD_FS, "Couldn't load consensus %s networkstatus from \"%s\"",
  133. flavor, filename);
  134. }
  135. tor_free(s);
  136. }
  137. tor_free(filename);
  138. if (flav == FLAV_NS) {
  139. filename = get_datadir_fname("unverified-consensus");
  140. } else {
  141. tor_snprintf(buf, sizeof(buf), "unverified-%s-consensus", flavor);
  142. filename = get_datadir_fname(buf);
  143. }
  144. s = read_file_to_str(filename, RFTS_IGNORE_MISSING, NULL);
  145. if (s) {
  146. if (networkstatus_set_current_consensus(s, flavor,
  147. flags|NSSET_WAS_WAITING_FOR_CERTS)) {
  148. log_info(LD_FS, "Couldn't load consensus %s networkstatus from \"%s\"",
  149. flavor, filename);
  150. }
  151. tor_free(s);
  152. }
  153. tor_free(filename);
  154. }
  155. if (!current_consensus) {
  156. if (!named_server_map)
  157. named_server_map = strmap_new();
  158. if (!unnamed_server_map)
  159. unnamed_server_map = strmap_new();
  160. }
  161. update_certificate_downloads(time(NULL));
  162. routers_update_all_from_networkstatus(time(NULL), 3);
  163. update_microdescs_from_networkstatus(time(NULL));
  164. return 0;
  165. }
  166. /** Free all storage held by the vote_routerstatus object <b>rs</b>. */
  167. STATIC void
  168. vote_routerstatus_free(vote_routerstatus_t *rs)
  169. {
  170. vote_microdesc_hash_t *h, *next;
  171. if (!rs)
  172. return;
  173. tor_free(rs->version);
  174. tor_free(rs->status.exitsummary);
  175. for (h = rs->microdesc; h; h = next) {
  176. tor_free(h->microdesc_hash_line);
  177. next = h->next;
  178. tor_free(h);
  179. }
  180. tor_free(rs);
  181. }
  182. /** Free all storage held by the routerstatus object <b>rs</b>. */
  183. void
  184. routerstatus_free(routerstatus_t *rs)
  185. {
  186. if (!rs)
  187. return;
  188. tor_free(rs->exitsummary);
  189. tor_free(rs);
  190. }
  191. /** Free all storage held in <b>sig</b> */
  192. void
  193. document_signature_free(document_signature_t *sig)
  194. {
  195. tor_free(sig->signature);
  196. tor_free(sig);
  197. }
  198. /** Return a newly allocated copy of <b>sig</b> */
  199. document_signature_t *
  200. document_signature_dup(const document_signature_t *sig)
  201. {
  202. document_signature_t *r = tor_memdup(sig, sizeof(document_signature_t));
  203. if (r->signature)
  204. r->signature = tor_memdup(sig->signature, sig->signature_len);
  205. return r;
  206. }
  207. /** Free all storage held in <b>ns</b>. */
  208. void
  209. networkstatus_vote_free(networkstatus_t *ns)
  210. {
  211. if (!ns)
  212. return;
  213. tor_free(ns->client_versions);
  214. tor_free(ns->server_versions);
  215. if (ns->known_flags) {
  216. SMARTLIST_FOREACH(ns->known_flags, char *, c, tor_free(c));
  217. smartlist_free(ns->known_flags);
  218. }
  219. if (ns->weight_params) {
  220. SMARTLIST_FOREACH(ns->weight_params, char *, c, tor_free(c));
  221. smartlist_free(ns->weight_params);
  222. }
  223. if (ns->net_params) {
  224. SMARTLIST_FOREACH(ns->net_params, char *, c, tor_free(c));
  225. smartlist_free(ns->net_params);
  226. }
  227. if (ns->supported_methods) {
  228. SMARTLIST_FOREACH(ns->supported_methods, char *, c, tor_free(c));
  229. smartlist_free(ns->supported_methods);
  230. }
  231. if (ns->package_lines) {
  232. SMARTLIST_FOREACH(ns->package_lines, char *, c, tor_free(c));
  233. smartlist_free(ns->package_lines);
  234. }
  235. if (ns->voters) {
  236. SMARTLIST_FOREACH_BEGIN(ns->voters, networkstatus_voter_info_t *, voter) {
  237. tor_free(voter->nickname);
  238. tor_free(voter->address);
  239. tor_free(voter->contact);
  240. if (voter->sigs) {
  241. SMARTLIST_FOREACH(voter->sigs, document_signature_t *, sig,
  242. document_signature_free(sig));
  243. smartlist_free(voter->sigs);
  244. }
  245. tor_free(voter);
  246. } SMARTLIST_FOREACH_END(voter);
  247. smartlist_free(ns->voters);
  248. }
  249. authority_cert_free(ns->cert);
  250. if (ns->routerstatus_list) {
  251. if (ns->type == NS_TYPE_VOTE || ns->type == NS_TYPE_OPINION) {
  252. SMARTLIST_FOREACH(ns->routerstatus_list, vote_routerstatus_t *, rs,
  253. vote_routerstatus_free(rs));
  254. } else {
  255. SMARTLIST_FOREACH(ns->routerstatus_list, routerstatus_t *, rs,
  256. routerstatus_free(rs));
  257. }
  258. smartlist_free(ns->routerstatus_list);
  259. }
  260. digestmap_free(ns->desc_digest_map, NULL);
  261. memwipe(ns, 11, sizeof(*ns));
  262. tor_free(ns);
  263. }
  264. /** Return the voter info from <b>vote</b> for the voter whose identity digest
  265. * is <b>identity</b>, or NULL if no such voter is associated with
  266. * <b>vote</b>. */
  267. networkstatus_voter_info_t *
  268. networkstatus_get_voter_by_id(networkstatus_t *vote,
  269. const char *identity)
  270. {
  271. if (!vote || !vote->voters)
  272. return NULL;
  273. SMARTLIST_FOREACH(vote->voters, networkstatus_voter_info_t *, voter,
  274. if (fast_memeq(voter->identity_digest, identity, DIGEST_LEN))
  275. return voter);
  276. return NULL;
  277. }
  278. /** Check whether the signature <b>sig</b> is correctly signed with the
  279. * signing key in <b>cert</b>. Return -1 if <b>cert</b> doesn't match the
  280. * signing key; otherwise set the good_signature or bad_signature flag on
  281. * <b>voter</b>, and return 0. */
  282. int
  283. networkstatus_check_document_signature(const networkstatus_t *consensus,
  284. document_signature_t *sig,
  285. const authority_cert_t *cert)
  286. {
  287. char key_digest[DIGEST_LEN];
  288. const int dlen = sig->alg == DIGEST_SHA1 ? DIGEST_LEN : DIGEST256_LEN;
  289. char *signed_digest;
  290. size_t signed_digest_len;
  291. if (crypto_pk_get_digest(cert->signing_key, key_digest)<0)
  292. return -1;
  293. if (tor_memneq(sig->signing_key_digest, key_digest, DIGEST_LEN) ||
  294. tor_memneq(sig->identity_digest, cert->cache_info.identity_digest,
  295. DIGEST_LEN))
  296. return -1;
  297. if (authority_cert_is_blacklisted(cert)) {
  298. /* We implement blacklisting for authority signing keys by treating
  299. * all their signatures as always bad. That way we don't get into
  300. * crazy loops of dropping and re-fetching signatures. */
  301. log_warn(LD_DIR, "Ignoring a consensus signature made with deprecated"
  302. " signing key %s",
  303. hex_str(cert->signing_key_digest, DIGEST_LEN));
  304. sig->bad_signature = 1;
  305. return 0;
  306. }
  307. signed_digest_len = crypto_pk_keysize(cert->signing_key);
  308. signed_digest = tor_malloc(signed_digest_len);
  309. if (crypto_pk_public_checksig(cert->signing_key,
  310. signed_digest,
  311. signed_digest_len,
  312. sig->signature,
  313. sig->signature_len) < dlen ||
  314. tor_memneq(signed_digest, consensus->digests.d[sig->alg], dlen)) {
  315. log_warn(LD_DIR, "Got a bad signature on a networkstatus vote");
  316. sig->bad_signature = 1;
  317. } else {
  318. sig->good_signature = 1;
  319. }
  320. tor_free(signed_digest);
  321. return 0;
  322. }
  323. /** Given a v3 networkstatus consensus in <b>consensus</b>, check every
  324. * as-yet-unchecked signature on <b>consensus</b>. Return 1 if there is a
  325. * signature from every recognized authority on it, 0 if there are
  326. * enough good signatures from recognized authorities on it, -1 if we might
  327. * get enough good signatures by fetching missing certificates, and -2
  328. * otherwise. Log messages at INFO or WARN: if <b>warn</b> is over 1, warn
  329. * about every problem; if warn is at least 1, warn only if we can't get
  330. * enough signatures; if warn is negative, log nothing at all. */
  331. int
  332. networkstatus_check_consensus_signature(networkstatus_t *consensus,
  333. int warn)
  334. {
  335. int n_good = 0;
  336. int n_missing_key = 0, n_dl_failed_key = 0;
  337. int n_bad = 0;
  338. int n_unknown = 0;
  339. int n_no_signature = 0;
  340. int n_v3_authorities = get_n_authorities(V3_DIRINFO);
  341. int n_required = n_v3_authorities/2 + 1;
  342. smartlist_t *list_good = smartlist_new();
  343. smartlist_t *list_no_signature = smartlist_new();
  344. smartlist_t *need_certs_from = smartlist_new();
  345. smartlist_t *unrecognized = smartlist_new();
  346. smartlist_t *missing_authorities = smartlist_new();
  347. int severity;
  348. time_t now = time(NULL);
  349. tor_assert(consensus->type == NS_TYPE_CONSENSUS);
  350. SMARTLIST_FOREACH_BEGIN(consensus->voters, networkstatus_voter_info_t *,
  351. voter) {
  352. int good_here = 0;
  353. int bad_here = 0;
  354. int unknown_here = 0;
  355. int missing_key_here = 0, dl_failed_key_here = 0;
  356. SMARTLIST_FOREACH_BEGIN(voter->sigs, document_signature_t *, sig) {
  357. if (!sig->good_signature && !sig->bad_signature &&
  358. sig->signature) {
  359. /* we can try to check the signature. */
  360. int is_v3_auth = trusteddirserver_get_by_v3_auth_digest(
  361. sig->identity_digest) != NULL;
  362. authority_cert_t *cert =
  363. authority_cert_get_by_digests(sig->identity_digest,
  364. sig->signing_key_digest);
  365. tor_assert(tor_memeq(sig->identity_digest, voter->identity_digest,
  366. DIGEST_LEN));
  367. if (!is_v3_auth) {
  368. smartlist_add(unrecognized, voter);
  369. ++unknown_here;
  370. continue;
  371. } else if (!cert || cert->expires < now) {
  372. smartlist_add(need_certs_from, voter);
  373. ++missing_key_here;
  374. if (authority_cert_dl_looks_uncertain(sig->identity_digest))
  375. ++dl_failed_key_here;
  376. continue;
  377. }
  378. if (networkstatus_check_document_signature(consensus, sig, cert) < 0) {
  379. smartlist_add(need_certs_from, voter);
  380. ++missing_key_here;
  381. if (authority_cert_dl_looks_uncertain(sig->identity_digest))
  382. ++dl_failed_key_here;
  383. continue;
  384. }
  385. }
  386. if (sig->good_signature)
  387. ++good_here;
  388. else if (sig->bad_signature)
  389. ++bad_here;
  390. } SMARTLIST_FOREACH_END(sig);
  391. if (good_here) {
  392. ++n_good;
  393. smartlist_add(list_good, voter->nickname);
  394. } else if (bad_here) {
  395. ++n_bad;
  396. } else if (missing_key_here) {
  397. ++n_missing_key;
  398. if (dl_failed_key_here)
  399. ++n_dl_failed_key;
  400. } else if (unknown_here) {
  401. ++n_unknown;
  402. } else {
  403. ++n_no_signature;
  404. smartlist_add(list_no_signature, voter->nickname);
  405. }
  406. } SMARTLIST_FOREACH_END(voter);
  407. /* Now see whether we're missing any voters entirely. */
  408. SMARTLIST_FOREACH(router_get_trusted_dir_servers(),
  409. dir_server_t *, ds,
  410. {
  411. if ((ds->type & V3_DIRINFO) &&
  412. !networkstatus_get_voter_by_id(consensus, ds->v3_identity_digest))
  413. smartlist_add(missing_authorities, ds);
  414. });
  415. if (warn > 1 || (warn >= 0 &&
  416. (n_good + n_missing_key - n_dl_failed_key < n_required))) {
  417. severity = LOG_WARN;
  418. } else {
  419. severity = LOG_INFO;
  420. }
  421. if (warn >= 0) {
  422. SMARTLIST_FOREACH(unrecognized, networkstatus_voter_info_t *, voter,
  423. {
  424. tor_log(severity, LD_DIR, "Consensus includes unrecognized authority "
  425. "'%s' at %s:%d (contact %s; identity %s)",
  426. voter->nickname, voter->address, (int)voter->dir_port,
  427. voter->contact?voter->contact:"n/a",
  428. hex_str(voter->identity_digest, DIGEST_LEN));
  429. });
  430. SMARTLIST_FOREACH(need_certs_from, networkstatus_voter_info_t *, voter,
  431. {
  432. tor_log(severity, LD_DIR, "Looks like we need to download a new "
  433. "certificate from authority '%s' at %s:%d (contact %s; "
  434. "identity %s)",
  435. voter->nickname, voter->address, (int)voter->dir_port,
  436. voter->contact?voter->contact:"n/a",
  437. hex_str(voter->identity_digest, DIGEST_LEN));
  438. });
  439. SMARTLIST_FOREACH(missing_authorities, dir_server_t *, ds,
  440. {
  441. tor_log(severity, LD_DIR, "Consensus does not include configured "
  442. "authority '%s' at %s:%d (identity %s)",
  443. ds->nickname, ds->address, (int)ds->dir_port,
  444. hex_str(ds->v3_identity_digest, DIGEST_LEN));
  445. });
  446. {
  447. char *joined;
  448. smartlist_t *sl = smartlist_new();
  449. char *tmp = smartlist_join_strings(list_good, " ", 0, NULL);
  450. smartlist_add_asprintf(sl,
  451. "A consensus needs %d good signatures from recognized "
  452. "authorities for us to accept it. This one has %d (%s).",
  453. n_required, n_good, tmp);
  454. tor_free(tmp);
  455. if (n_no_signature) {
  456. tmp = smartlist_join_strings(list_no_signature, " ", 0, NULL);
  457. smartlist_add_asprintf(sl,
  458. "%d (%s) of the authorities we know didn't sign it.",
  459. n_no_signature, tmp);
  460. tor_free(tmp);
  461. }
  462. if (n_unknown) {
  463. smartlist_add_asprintf(sl,
  464. "It has %d signatures from authorities we don't "
  465. "recognize.", n_unknown);
  466. }
  467. if (n_bad) {
  468. smartlist_add_asprintf(sl, "%d of the signatures on it didn't verify "
  469. "correctly.", n_bad);
  470. }
  471. if (n_missing_key) {
  472. smartlist_add_asprintf(sl,
  473. "We were unable to check %d of the signatures, "
  474. "because we were missing the keys.", n_missing_key);
  475. }
  476. joined = smartlist_join_strings(sl, " ", 0, NULL);
  477. tor_log(severity, LD_DIR, "%s", joined);
  478. tor_free(joined);
  479. SMARTLIST_FOREACH(sl, char *, c, tor_free(c));
  480. smartlist_free(sl);
  481. }
  482. }
  483. smartlist_free(list_good);
  484. smartlist_free(list_no_signature);
  485. smartlist_free(unrecognized);
  486. smartlist_free(need_certs_from);
  487. smartlist_free(missing_authorities);
  488. if (n_good == n_v3_authorities)
  489. return 1;
  490. else if (n_good >= n_required)
  491. return 0;
  492. else if (n_good + n_missing_key >= n_required)
  493. return -1;
  494. else
  495. return -2;
  496. }
  497. /** How far in the future do we allow a network-status to get before removing
  498. * it? (seconds) */
  499. #define NETWORKSTATUS_ALLOW_SKEW (24*60*60)
  500. /** Helper for bsearching a list of routerstatus_t pointers: compare a
  501. * digest in the key to the identity digest of a routerstatus_t. */
  502. int
  503. compare_digest_to_routerstatus_entry(const void *_key, const void **_member)
  504. {
  505. const char *key = _key;
  506. const routerstatus_t *rs = *_member;
  507. return tor_memcmp(key, rs->identity_digest, DIGEST_LEN);
  508. }
  509. /** Helper for bsearching a list of routerstatus_t pointers: compare a
  510. * digest in the key to the identity digest of a routerstatus_t. */
  511. int
  512. compare_digest_to_vote_routerstatus_entry(const void *_key,
  513. const void **_member)
  514. {
  515. const char *key = _key;
  516. const vote_routerstatus_t *vrs = *_member;
  517. return tor_memcmp(key, vrs->status.identity_digest, DIGEST_LEN);
  518. }
  519. /** As networkstatus_find_entry, but do not return a const pointer */
  520. routerstatus_t *
  521. networkstatus_vote_find_mutable_entry(networkstatus_t *ns, const char *digest)
  522. {
  523. return smartlist_bsearch(ns->routerstatus_list, digest,
  524. compare_digest_to_routerstatus_entry);
  525. }
  526. /** Return the entry in <b>ns</b> for the identity digest <b>digest</b>, or
  527. * NULL if none was found. */
  528. const routerstatus_t *
  529. networkstatus_vote_find_entry(networkstatus_t *ns, const char *digest)
  530. {
  531. return networkstatus_vote_find_mutable_entry(ns, digest);
  532. }
  533. /*XXXX MOVE make this static once functions are moved into this file. */
  534. /** Search the routerstatuses in <b>ns</b> for one whose identity digest is
  535. * <b>digest</b>. Return value and set *<b>found_out</b> as for
  536. * smartlist_bsearch_idx(). */
  537. int
  538. networkstatus_vote_find_entry_idx(networkstatus_t *ns,
  539. const char *digest, int *found_out)
  540. {
  541. return smartlist_bsearch_idx(ns->routerstatus_list, digest,
  542. compare_digest_to_routerstatus_entry,
  543. found_out);
  544. }
  545. /** As router_get_consensus_status_by_descriptor_digest, but does not return
  546. * a const pointer. */
  547. MOCK_IMPL(routerstatus_t *,
  548. router_get_mutable_consensus_status_by_descriptor_digest,(
  549. networkstatus_t *consensus,
  550. const char *digest))
  551. {
  552. if (!consensus)
  553. consensus = current_consensus;
  554. if (!consensus)
  555. return NULL;
  556. if (!consensus->desc_digest_map) {
  557. digestmap_t *m = consensus->desc_digest_map = digestmap_new();
  558. SMARTLIST_FOREACH(consensus->routerstatus_list,
  559. routerstatus_t *, rs,
  560. {
  561. digestmap_set(m, rs->descriptor_digest, rs);
  562. });
  563. }
  564. return digestmap_get(consensus->desc_digest_map, digest);
  565. }
  566. /** Return the consensus view of the status of the router whose current
  567. * <i>descriptor</i> digest in <b>consensus</b> is <b>digest</b>, or NULL if
  568. * no such router is known. */
  569. const routerstatus_t *
  570. router_get_consensus_status_by_descriptor_digest(networkstatus_t *consensus,
  571. const char *digest)
  572. {
  573. return router_get_mutable_consensus_status_by_descriptor_digest(
  574. consensus, digest);
  575. }
  576. /** Given the digest of a router descriptor, return its current download
  577. * status, or NULL if the digest is unrecognized. */
  578. MOCK_IMPL(download_status_t *,
  579. router_get_dl_status_by_descriptor_digest,(const char *d))
  580. {
  581. routerstatus_t *rs;
  582. if (!current_ns_consensus)
  583. return NULL;
  584. if ((rs = router_get_mutable_consensus_status_by_descriptor_digest(
  585. current_ns_consensus, d)))
  586. return &rs->dl_status;
  587. return NULL;
  588. }
  589. /** As router_get_consensus_status_by_id, but do not return a const pointer */
  590. routerstatus_t *
  591. router_get_mutable_consensus_status_by_id(const char *digest)
  592. {
  593. if (!current_consensus)
  594. return NULL;
  595. return smartlist_bsearch(current_consensus->routerstatus_list, digest,
  596. compare_digest_to_routerstatus_entry);
  597. }
  598. /** Return the consensus view of the status of the router whose identity
  599. * digest is <b>digest</b>, or NULL if we don't know about any such router. */
  600. const routerstatus_t *
  601. router_get_consensus_status_by_id(const char *digest)
  602. {
  603. return router_get_mutable_consensus_status_by_id(digest);
  604. }
  605. /** Given a nickname (possibly verbose, possibly a hexadecimal digest), return
  606. * the corresponding routerstatus_t, or NULL if none exists. Warn the
  607. * user if <b>warn_if_unnamed</b> is set, and they have specified a router by
  608. * nickname, but the Named flag isn't set for that router. */
  609. const routerstatus_t *
  610. router_get_consensus_status_by_nickname(const char *nickname,
  611. int warn_if_unnamed)
  612. {
  613. const node_t *node = node_get_by_nickname(nickname, warn_if_unnamed);
  614. if (node)
  615. return node->rs;
  616. else
  617. return NULL;
  618. }
  619. /** Return the identity digest that's mapped to officially by
  620. * <b>nickname</b>. */
  621. const char *
  622. networkstatus_get_router_digest_by_nickname(const char *nickname)
  623. {
  624. if (!named_server_map)
  625. return NULL;
  626. return strmap_get_lc(named_server_map, nickname);
  627. }
  628. /** Return true iff <b>nickname</b> is disallowed from being the nickname
  629. * of any server. */
  630. int
  631. networkstatus_nickname_is_unnamed(const char *nickname)
  632. {
  633. if (!unnamed_server_map)
  634. return 0;
  635. return strmap_get_lc(unnamed_server_map, nickname) != NULL;
  636. }
  637. /** How frequently do directory authorities re-download fresh networkstatus
  638. * documents? */
  639. #define AUTHORITY_NS_CACHE_INTERVAL (10*60)
  640. /** How frequently do non-authority directory caches re-download fresh
  641. * networkstatus documents? */
  642. #define NONAUTHORITY_NS_CACHE_INTERVAL (60*60)
  643. /** Return true iff, given the options listed in <b>options</b>, <b>flavor</b>
  644. * is the flavor of a consensus networkstatus that we would like to fetch. */
  645. static int
  646. we_want_to_fetch_flavor(const or_options_t *options, int flavor)
  647. {
  648. if (flavor < 0 || flavor > N_CONSENSUS_FLAVORS) {
  649. /* This flavor is crazy; we don't want it */
  650. /*XXXX handle unrecognized flavors later */
  651. return 0;
  652. }
  653. if (authdir_mode_v3(options) || directory_caches_dir_info(options)) {
  654. /* We want to serve all flavors to others, regardless if we would use
  655. * it ourselves. */
  656. return 1;
  657. }
  658. if (options->FetchUselessDescriptors) {
  659. /* In order to get all descriptors, we need to fetch all consensuses. */
  660. return 1;
  661. }
  662. /* Otherwise, we want the flavor only if we want to use it to build
  663. * circuits. */
  664. return flavor == usable_consensus_flavor();
  665. }
  666. /** How long will we hang onto a possibly live consensus for which we're
  667. * fetching certs before we check whether there is a better one? */
  668. #define DELAY_WHILE_FETCHING_CERTS (20*60)
  669. /** If we want to download a fresh consensus, launch a new download as
  670. * appropriate. */
  671. static void
  672. update_consensus_networkstatus_downloads(time_t now)
  673. {
  674. int i;
  675. const or_options_t *options = get_options();
  676. for (i=0; i < N_CONSENSUS_FLAVORS; ++i) {
  677. /* XXXX need some way to download unknown flavors if we are caching. */
  678. const char *resource;
  679. consensus_waiting_for_certs_t *waiting;
  680. networkstatus_t *c;
  681. if (! we_want_to_fetch_flavor(options, i))
  682. continue;
  683. c = networkstatus_get_latest_consensus_by_flavor(i);
  684. if (! (c && c->valid_after <= now && now <= c->valid_until)) {
  685. /* No live consensus? Get one now!*/
  686. time_to_download_next_consensus[i] = now;
  687. }
  688. if (time_to_download_next_consensus[i] > now)
  689. continue; /* Wait until the current consensus is older. */
  690. resource = networkstatus_get_flavor_name(i);
  691. /* Let's make sure we remembered to update consensus_dl_status */
  692. tor_assert(consensus_dl_status[i].schedule == DL_SCHED_CONSENSUS);
  693. if (!download_status_is_ready(&consensus_dl_status[i], now,
  694. options->TestingConsensusMaxDownloadTries))
  695. continue; /* We failed downloading a consensus too recently. */
  696. if (connection_dir_get_by_purpose_and_resource(
  697. DIR_PURPOSE_FETCH_CONSENSUS, resource))
  698. continue; /* There's an in-progress download.*/
  699. waiting = &consensus_waiting_for_certs[i];
  700. if (waiting->consensus) {
  701. /* XXXX make sure this doesn't delay sane downloads. */
  702. if (waiting->set_at + DELAY_WHILE_FETCHING_CERTS > now) {
  703. continue; /* We're still getting certs for this one. */
  704. } else {
  705. if (!waiting->dl_failed) {
  706. download_status_failed(&consensus_dl_status[i], 0);
  707. waiting->dl_failed=1;
  708. }
  709. }
  710. }
  711. log_info(LD_DIR, "Launching %s networkstatus consensus download.",
  712. networkstatus_get_flavor_name(i));
  713. directory_get_from_dirserver(DIR_PURPOSE_FETCH_CONSENSUS,
  714. ROUTER_PURPOSE_GENERAL, resource,
  715. PDS_RETRY_IF_NO_SERVERS);
  716. }
  717. }
  718. /** Called when an attempt to download a consensus fails: note that the
  719. * failure occurred, and possibly retry. */
  720. void
  721. networkstatus_consensus_download_failed(int status_code, const char *flavname)
  722. {
  723. int flav = networkstatus_parse_flavor_name(flavname);
  724. if (flav >= 0) {
  725. tor_assert(flav < N_CONSENSUS_FLAVORS);
  726. /* XXXX handle unrecognized flavors */
  727. download_status_failed(&consensus_dl_status[flav], status_code);
  728. /* Retry immediately, if appropriate. */
  729. update_consensus_networkstatus_downloads(time(NULL));
  730. }
  731. }
  732. /** How long do we (as a cache) wait after a consensus becomes non-fresh
  733. * before trying to fetch another? */
  734. #define CONSENSUS_MIN_SECONDS_BEFORE_CACHING 120
  735. /** Update the time at which we'll consider replacing the current
  736. * consensus of flavor <b>flav</b> */
  737. static void
  738. update_consensus_networkstatus_fetch_time_impl(time_t now, int flav)
  739. {
  740. const or_options_t *options = get_options();
  741. networkstatus_t *c = networkstatus_get_latest_consensus_by_flavor(flav);
  742. const char *flavor = networkstatus_get_flavor_name(flav);
  743. if (! we_want_to_fetch_flavor(get_options(), flav))
  744. return;
  745. if (c && c->valid_after <= now && now <= c->valid_until) {
  746. long dl_interval;
  747. long interval = c->fresh_until - c->valid_after;
  748. long min_sec_before_caching = CONSENSUS_MIN_SECONDS_BEFORE_CACHING;
  749. time_t start;
  750. if (min_sec_before_caching > interval/16) {
  751. /* Usually we allow 2-minutes slop factor in case clocks get
  752. desynchronized a little. If we're on a private network with
  753. a crazy-fast voting interval, though, 2 minutes may be too
  754. much. */
  755. min_sec_before_caching = interval/16;
  756. /* make sure we always delay by at least a second before caching */
  757. if (min_sec_before_caching == 0) {
  758. min_sec_before_caching = 1;
  759. }
  760. }
  761. if (directory_fetches_dir_info_early(options)) {
  762. /* We want to cache the next one at some point after this one
  763. * is no longer fresh... */
  764. start = (time_t)(c->fresh_until + min_sec_before_caching);
  765. /* Some clients may need the consensus sooner than others. */
  766. if (options->FetchDirInfoExtraEarly || authdir_mode_v3(options)) {
  767. dl_interval = 60;
  768. if (min_sec_before_caching + dl_interval > interval)
  769. dl_interval = interval/2;
  770. } else {
  771. /* But only in the first half-interval after that. */
  772. dl_interval = interval/2;
  773. }
  774. } else {
  775. /* We're an ordinary client, a bridge, or a hidden service.
  776. * Give all the caches enough time to download the consensus. */
  777. start = (time_t)(c->fresh_until + (interval*3)/4);
  778. /* But download the next one well before this one is expired. */
  779. dl_interval = ((c->valid_until - start) * 7 )/ 8;
  780. /* If we're a bridge user, make use of the numbers we just computed
  781. * to choose the rest of the interval *after* them. */
  782. if (directory_fetches_dir_info_later(options)) {
  783. /* Give all the *clients* enough time to download the consensus. */
  784. start = (time_t)(start + dl_interval + min_sec_before_caching);
  785. /* But try to get it before ours actually expires. */
  786. dl_interval = (c->valid_until - start) - min_sec_before_caching;
  787. }
  788. }
  789. /* catch low dl_interval in crazy-fast networks */
  790. if (dl_interval < 1)
  791. dl_interval = 1;
  792. /* catch late start in crazy-fast networks */
  793. if (start+dl_interval >= c->valid_until)
  794. start = c->valid_until - dl_interval - 1;
  795. log_debug(LD_DIR,
  796. "fresh_until: %ld start: %ld "
  797. "dl_interval: %ld valid_until: %ld ",
  798. (long)c->fresh_until, (long)start, dl_interval,
  799. (long)c->valid_until);
  800. /* We must not try to replace c while it's still fresh: */
  801. tor_assert(c->fresh_until < start);
  802. /* We must download the next one before c is invalid: */
  803. tor_assert(start+dl_interval < c->valid_until);
  804. time_to_download_next_consensus[flav] =
  805. start + crypto_rand_int((int)dl_interval);
  806. {
  807. char tbuf1[ISO_TIME_LEN+1];
  808. char tbuf2[ISO_TIME_LEN+1];
  809. char tbuf3[ISO_TIME_LEN+1];
  810. format_local_iso_time(tbuf1, c->fresh_until);
  811. format_local_iso_time(tbuf2, c->valid_until);
  812. format_local_iso_time(tbuf3, time_to_download_next_consensus[flav]);
  813. log_info(LD_DIR, "Live %s consensus %s the most recent until %s and "
  814. "will expire at %s; fetching the next one at %s.",
  815. flavor, (c->fresh_until > now) ? "will be" : "was",
  816. tbuf1, tbuf2, tbuf3);
  817. }
  818. } else {
  819. time_to_download_next_consensus[flav] = now;
  820. log_info(LD_DIR, "No live %s consensus; we should fetch one immediately.",
  821. flavor);
  822. }
  823. }
  824. /** Update the time at which we'll consider replacing the current
  825. * consensus of flavor 'flavor' */
  826. void
  827. update_consensus_networkstatus_fetch_time(time_t now)
  828. {
  829. int i;
  830. for (i = 0; i < N_CONSENSUS_FLAVORS; ++i) {
  831. if (we_want_to_fetch_flavor(get_options(), i))
  832. update_consensus_networkstatus_fetch_time_impl(now, i);
  833. }
  834. }
  835. /** Return 1 if there's a reason we shouldn't try any directory
  836. * fetches yet (e.g. we demand bridges and none are yet known).
  837. * Else return 0.
  838. * If we return 1 and <b>msg_out</b> is provided, set <b>msg_out</b>
  839. * to an explanation of why directory fetches are delayed. (If we
  840. * return 0, we set msg_out to NULL.)
  841. */
  842. int
  843. should_delay_dir_fetches(const or_options_t *options, const char **msg_out)
  844. {
  845. if (msg_out) {
  846. *msg_out = NULL;
  847. }
  848. if (options->DisableNetwork) {
  849. if (msg_out) {
  850. *msg_out = "DisableNetwork is set.";
  851. }
  852. log_info(LD_DIR, "Delaying dir fetches (DisableNetwork is set)");
  853. return 1;
  854. }
  855. if (options->UseBridges) {
  856. if (!any_bridge_descriptors_known()) {
  857. if (msg_out) {
  858. *msg_out = "No running bridges";
  859. }
  860. log_info(LD_DIR, "Delaying dir fetches (no running bridges known)");
  861. return 1;
  862. }
  863. if (pt_proxies_configuration_pending()) {
  864. if (msg_out) {
  865. *msg_out = "Pluggable transport proxies still configuring";
  866. }
  867. log_info(LD_DIR, "Delaying dir fetches (pt proxies still configuring)");
  868. return 1;
  869. }
  870. }
  871. return 0;
  872. }
  873. /** Launch requests for networkstatus documents and authority certificates as
  874. * appropriate. */
  875. void
  876. update_networkstatus_downloads(time_t now)
  877. {
  878. const or_options_t *options = get_options();
  879. if (should_delay_dir_fetches(options, NULL))
  880. return;
  881. update_consensus_networkstatus_downloads(now);
  882. update_certificate_downloads(now);
  883. }
  884. /** Launch requests as appropriate for missing directory authority
  885. * certificates. */
  886. void
  887. update_certificate_downloads(time_t now)
  888. {
  889. int i;
  890. for (i = 0; i < N_CONSENSUS_FLAVORS; ++i) {
  891. if (consensus_waiting_for_certs[i].consensus)
  892. authority_certs_fetch_missing(consensus_waiting_for_certs[i].consensus,
  893. now);
  894. }
  895. if (current_ns_consensus)
  896. authority_certs_fetch_missing(current_ns_consensus, now);
  897. if (current_md_consensus)
  898. authority_certs_fetch_missing(current_md_consensus, now);
  899. }
  900. /** Return 1 if we have a consensus but we don't have enough certificates
  901. * to start using it yet. */
  902. int
  903. consensus_is_waiting_for_certs(void)
  904. {
  905. return consensus_waiting_for_certs[usable_consensus_flavor()].consensus
  906. ? 1 : 0;
  907. }
  908. /** Return the most recent consensus that we have downloaded, or NULL if we
  909. * don't have one. */
  910. networkstatus_t *
  911. networkstatus_get_latest_consensus(void)
  912. {
  913. return current_consensus;
  914. }
  915. /** Return the latest consensus we have whose flavor matches <b>f</b>, or NULL
  916. * if we don't have one. */
  917. MOCK_IMPL(networkstatus_t *,
  918. networkstatus_get_latest_consensus_by_flavor,(consensus_flavor_t f))
  919. {
  920. if (f == FLAV_NS)
  921. return current_ns_consensus;
  922. else if (f == FLAV_MICRODESC)
  923. return current_md_consensus;
  924. else {
  925. tor_assert(0);
  926. return NULL;
  927. }
  928. }
  929. /** Return the most recent consensus that we have downloaded, or NULL if it is
  930. * no longer live. */
  931. networkstatus_t *
  932. networkstatus_get_live_consensus(time_t now)
  933. {
  934. if (current_consensus &&
  935. current_consensus->valid_after <= now &&
  936. now <= current_consensus->valid_until)
  937. return current_consensus;
  938. else
  939. return NULL;
  940. }
  941. /* XXXX remove this in favor of get_live_consensus. But actually,
  942. * leave something like it for bridge users, who need to not totally
  943. * lose if they spend a while fetching a new consensus. */
  944. /** As networkstatus_get_live_consensus(), but is way more tolerant of expired
  945. * consensuses. */
  946. networkstatus_t *
  947. networkstatus_get_reasonably_live_consensus(time_t now, int flavor)
  948. {
  949. #define REASONABLY_LIVE_TIME (24*60*60)
  950. networkstatus_t *consensus =
  951. networkstatus_get_latest_consensus_by_flavor(flavor);
  952. if (consensus &&
  953. consensus->valid_after <= now &&
  954. now <= consensus->valid_until+REASONABLY_LIVE_TIME)
  955. return consensus;
  956. else
  957. return NULL;
  958. }
  959. /** Given two router status entries for the same router identity, return 1 if
  960. * if the contents have changed between them. Otherwise, return 0. */
  961. static int
  962. routerstatus_has_changed(const routerstatus_t *a, const routerstatus_t *b)
  963. {
  964. tor_assert(tor_memeq(a->identity_digest, b->identity_digest, DIGEST_LEN));
  965. return strcmp(a->nickname, b->nickname) ||
  966. fast_memneq(a->descriptor_digest, b->descriptor_digest, DIGEST_LEN) ||
  967. a->addr != b->addr ||
  968. a->or_port != b->or_port ||
  969. a->dir_port != b->dir_port ||
  970. a->is_authority != b->is_authority ||
  971. a->is_exit != b->is_exit ||
  972. a->is_stable != b->is_stable ||
  973. a->is_fast != b->is_fast ||
  974. a->is_flagged_running != b->is_flagged_running ||
  975. a->is_named != b->is_named ||
  976. a->is_unnamed != b->is_unnamed ||
  977. a->is_valid != b->is_valid ||
  978. a->is_possible_guard != b->is_possible_guard ||
  979. a->is_bad_exit != b->is_bad_exit ||
  980. a->is_hs_dir != b->is_hs_dir ||
  981. a->version_known != b->version_known;
  982. }
  983. /** Notify controllers of any router status entries that changed between
  984. * <b>old_c</b> and <b>new_c</b>. */
  985. static void
  986. notify_control_networkstatus_changed(const networkstatus_t *old_c,
  987. const networkstatus_t *new_c)
  988. {
  989. smartlist_t *changed;
  990. if (old_c == new_c)
  991. return;
  992. /* tell the controller exactly which relays are still listed, as well
  993. * as what they're listed as */
  994. control_event_newconsensus(new_c);
  995. if (!control_event_is_interesting(EVENT_NS))
  996. return;
  997. if (!old_c) {
  998. control_event_networkstatus_changed(new_c->routerstatus_list);
  999. return;
  1000. }
  1001. changed = smartlist_new();
  1002. SMARTLIST_FOREACH_JOIN(
  1003. old_c->routerstatus_list, const routerstatus_t *, rs_old,
  1004. new_c->routerstatus_list, const routerstatus_t *, rs_new,
  1005. tor_memcmp(rs_old->identity_digest,
  1006. rs_new->identity_digest, DIGEST_LEN),
  1007. smartlist_add(changed, (void*) rs_new)) {
  1008. if (routerstatus_has_changed(rs_old, rs_new))
  1009. smartlist_add(changed, (void*)rs_new);
  1010. } SMARTLIST_FOREACH_JOIN_END(rs_old, rs_new);
  1011. control_event_networkstatus_changed(changed);
  1012. smartlist_free(changed);
  1013. }
  1014. /** Copy all the ancillary information (like router download status and so on)
  1015. * from <b>old_c</b> to <b>new_c</b>. */
  1016. static void
  1017. networkstatus_copy_old_consensus_info(networkstatus_t *new_c,
  1018. const networkstatus_t *old_c)
  1019. {
  1020. if (old_c == new_c)
  1021. return;
  1022. if (!old_c || !smartlist_len(old_c->routerstatus_list))
  1023. return;
  1024. SMARTLIST_FOREACH_JOIN(old_c->routerstatus_list, routerstatus_t *, rs_old,
  1025. new_c->routerstatus_list, routerstatus_t *, rs_new,
  1026. tor_memcmp(rs_old->identity_digest,
  1027. rs_new->identity_digest, DIGEST_LEN),
  1028. STMT_NIL) {
  1029. /* Okay, so we're looking at the same identity. */
  1030. rs_new->last_dir_503_at = rs_old->last_dir_503_at;
  1031. if (tor_memeq(rs_old->descriptor_digest, rs_new->descriptor_digest,
  1032. DIGEST256_LEN)) {
  1033. /* And the same descriptor too! */
  1034. memcpy(&rs_new->dl_status, &rs_old->dl_status,sizeof(download_status_t));
  1035. }
  1036. } SMARTLIST_FOREACH_JOIN_END(rs_old, rs_new);
  1037. }
  1038. /** Try to replace the current cached v3 networkstatus with the one in
  1039. * <b>consensus</b>. If we don't have enough certificates to validate it,
  1040. * store it in consensus_waiting_for_certs and launch a certificate fetch.
  1041. *
  1042. * If flags & NSSET_FROM_CACHE, this networkstatus has come from the disk
  1043. * cache. If flags & NSSET_WAS_WAITING_FOR_CERTS, this networkstatus was
  1044. * already received, but we were waiting for certificates on it. If flags &
  1045. * NSSET_DONT_DOWNLOAD_CERTS, do not launch certificate downloads as needed.
  1046. * If flags & NSSET_ACCEPT_OBSOLETE, then we should be willing to take this
  1047. * consensus, even if it comes from many days in the past.
  1048. *
  1049. * Return 0 on success, <0 on failure. On failure, caller should increment
  1050. * the failure count as appropriate.
  1051. *
  1052. * We return -1 for mild failures that don't need to be reported to the
  1053. * user, and -2 for more serious problems.
  1054. */
  1055. int
  1056. networkstatus_set_current_consensus(const char *consensus,
  1057. const char *flavor,
  1058. unsigned flags)
  1059. {
  1060. networkstatus_t *c=NULL;
  1061. int r, result = -1;
  1062. time_t now = time(NULL);
  1063. const or_options_t *options = get_options();
  1064. char *unverified_fname = NULL, *consensus_fname = NULL;
  1065. int flav = networkstatus_parse_flavor_name(flavor);
  1066. const unsigned from_cache = flags & NSSET_FROM_CACHE;
  1067. const unsigned was_waiting_for_certs = flags & NSSET_WAS_WAITING_FOR_CERTS;
  1068. const unsigned dl_certs = !(flags & NSSET_DONT_DOWNLOAD_CERTS);
  1069. const unsigned accept_obsolete = flags & NSSET_ACCEPT_OBSOLETE;
  1070. const unsigned require_flavor = flags & NSSET_REQUIRE_FLAVOR;
  1071. const digests_t *current_digests = NULL;
  1072. consensus_waiting_for_certs_t *waiting = NULL;
  1073. time_t current_valid_after = 0;
  1074. int free_consensus = 1; /* Free 'c' at the end of the function */
  1075. int old_ewma_enabled;
  1076. if (flav < 0) {
  1077. /* XXXX we don't handle unrecognized flavors yet. */
  1078. log_warn(LD_BUG, "Unrecognized consensus flavor %s", flavor);
  1079. return -2;
  1080. }
  1081. /* Make sure it's parseable. */
  1082. c = networkstatus_parse_vote_from_string(consensus, NULL, NS_TYPE_CONSENSUS);
  1083. if (!c) {
  1084. log_warn(LD_DIR, "Unable to parse networkstatus consensus");
  1085. result = -2;
  1086. goto done;
  1087. }
  1088. if ((int)c->flavor != flav) {
  1089. /* This wasn't the flavor we thought we were getting. */
  1090. if (require_flavor) {
  1091. log_warn(LD_DIR, "Got consensus with unexpected flavor %s (wanted %s)",
  1092. networkstatus_get_flavor_name(c->flavor), flavor);
  1093. goto done;
  1094. }
  1095. flav = c->flavor;
  1096. flavor = networkstatus_get_flavor_name(flav);
  1097. }
  1098. if (flav != usable_consensus_flavor() &&
  1099. !directory_caches_dir_info(options)) {
  1100. /* This consensus is totally boring to us: we won't use it, and we won't
  1101. * serve it. Drop it. */
  1102. goto done;
  1103. }
  1104. if (from_cache && !accept_obsolete &&
  1105. c->valid_until < now-OLD_ROUTER_DESC_MAX_AGE) {
  1106. log_info(LD_DIR, "Loaded an expired consensus. Discarding.");
  1107. goto done;
  1108. }
  1109. if (!strcmp(flavor, "ns")) {
  1110. consensus_fname = get_datadir_fname("cached-consensus");
  1111. unverified_fname = get_datadir_fname("unverified-consensus");
  1112. if (current_ns_consensus) {
  1113. current_digests = &current_ns_consensus->digests;
  1114. current_valid_after = current_ns_consensus->valid_after;
  1115. }
  1116. } else if (!strcmp(flavor, "microdesc")) {
  1117. consensus_fname = get_datadir_fname("cached-microdesc-consensus");
  1118. unverified_fname = get_datadir_fname("unverified-microdesc-consensus");
  1119. if (current_md_consensus) {
  1120. current_digests = &current_md_consensus->digests;
  1121. current_valid_after = current_md_consensus->valid_after;
  1122. }
  1123. } else {
  1124. cached_dir_t *cur;
  1125. char buf[128];
  1126. tor_snprintf(buf, sizeof(buf), "cached-%s-consensus", flavor);
  1127. consensus_fname = get_datadir_fname(buf);
  1128. tor_snprintf(buf, sizeof(buf), "unverified-%s-consensus", flavor);
  1129. unverified_fname = get_datadir_fname(buf);
  1130. cur = dirserv_get_consensus(flavor);
  1131. if (cur) {
  1132. current_digests = &cur->digests;
  1133. current_valid_after = cur->published;
  1134. }
  1135. }
  1136. if (current_digests &&
  1137. tor_memeq(&c->digests, current_digests, sizeof(c->digests))) {
  1138. /* We already have this one. That's a failure. */
  1139. log_info(LD_DIR, "Got a %s consensus we already have", flavor);
  1140. goto done;
  1141. }
  1142. if (current_valid_after && c->valid_after <= current_valid_after) {
  1143. /* We have a newer one. There's no point in accepting this one,
  1144. * even if it's great. */
  1145. log_info(LD_DIR, "Got a %s consensus at least as old as the one we have",
  1146. flavor);
  1147. goto done;
  1148. }
  1149. /* Make sure it's signed enough. */
  1150. if ((r=networkstatus_check_consensus_signature(c, 1))<0) {
  1151. if (r == -1) {
  1152. /* Okay, so it _might_ be signed enough if we get more certificates. */
  1153. if (!was_waiting_for_certs) {
  1154. log_info(LD_DIR,
  1155. "Not enough certificates to check networkstatus consensus");
  1156. }
  1157. if (!current_valid_after ||
  1158. c->valid_after > current_valid_after) {
  1159. waiting = &consensus_waiting_for_certs[flav];
  1160. networkstatus_vote_free(waiting->consensus);
  1161. tor_free(waiting->body);
  1162. waiting->consensus = c;
  1163. free_consensus = 0;
  1164. waiting->body = tor_strdup(consensus);
  1165. waiting->set_at = now;
  1166. waiting->dl_failed = 0;
  1167. if (!from_cache) {
  1168. write_str_to_file(unverified_fname, consensus, 0);
  1169. }
  1170. if (dl_certs)
  1171. authority_certs_fetch_missing(c, now);
  1172. /* This case is not a success or a failure until we get the certs
  1173. * or fail to get the certs. */
  1174. result = 0;
  1175. } else {
  1176. /* Even if we had enough signatures, we'd never use this as the
  1177. * latest consensus. */
  1178. if (was_waiting_for_certs && from_cache)
  1179. if (unlink(unverified_fname) != 0) {
  1180. log_warn(LD_FS,
  1181. "Failed to unlink %s: %s",
  1182. unverified_fname, strerror(errno));
  1183. }
  1184. }
  1185. goto done;
  1186. } else {
  1187. /* This can never be signed enough: Kill it. */
  1188. if (!was_waiting_for_certs) {
  1189. log_warn(LD_DIR, "Not enough good signatures on networkstatus "
  1190. "consensus");
  1191. result = -2;
  1192. }
  1193. if (was_waiting_for_certs && (r < -1) && from_cache) {
  1194. if (unlink(unverified_fname) != 0) {
  1195. log_warn(LD_FS,
  1196. "Failed to unlink %s: %s",
  1197. unverified_fname, strerror(errno));
  1198. }
  1199. }
  1200. goto done;
  1201. }
  1202. }
  1203. if (!from_cache && flav == usable_consensus_flavor())
  1204. control_event_client_status(LOG_NOTICE, "CONSENSUS_ARRIVED");
  1205. /* Are we missing any certificates at all? */
  1206. if (r != 1 && dl_certs)
  1207. authority_certs_fetch_missing(c, now);
  1208. if (flav == usable_consensus_flavor()) {
  1209. notify_control_networkstatus_changed(current_consensus, c);
  1210. }
  1211. if (flav == FLAV_NS) {
  1212. if (current_ns_consensus) {
  1213. networkstatus_copy_old_consensus_info(c, current_ns_consensus);
  1214. networkstatus_vote_free(current_ns_consensus);
  1215. /* Defensive programming : we should set current_consensus very soon,
  1216. * but we're about to call some stuff in the meantime, and leaving this
  1217. * dangling pointer around has proven to be trouble. */
  1218. current_ns_consensus = NULL;
  1219. }
  1220. current_ns_consensus = c;
  1221. free_consensus = 0; /* avoid free */
  1222. } else if (flav == FLAV_MICRODESC) {
  1223. if (current_md_consensus) {
  1224. networkstatus_copy_old_consensus_info(c, current_md_consensus);
  1225. networkstatus_vote_free(current_md_consensus);
  1226. /* more defensive programming */
  1227. current_md_consensus = NULL;
  1228. }
  1229. current_md_consensus = c;
  1230. free_consensus = 0; /* avoid free */
  1231. }
  1232. waiting = &consensus_waiting_for_certs[flav];
  1233. if (waiting->consensus &&
  1234. waiting->consensus->valid_after <= c->valid_after) {
  1235. networkstatus_vote_free(waiting->consensus);
  1236. waiting->consensus = NULL;
  1237. if (consensus != waiting->body)
  1238. tor_free(waiting->body);
  1239. else
  1240. waiting->body = NULL;
  1241. waiting->set_at = 0;
  1242. waiting->dl_failed = 0;
  1243. if (unlink(unverified_fname) != 0) {
  1244. log_warn(LD_FS,
  1245. "Failed to unlink %s: %s",
  1246. unverified_fname, strerror(errno));
  1247. }
  1248. }
  1249. /* Reset the failure count only if this consensus is actually valid. */
  1250. if (c->valid_after <= now && now <= c->valid_until) {
  1251. download_status_reset(&consensus_dl_status[flav]);
  1252. } else {
  1253. if (!from_cache)
  1254. download_status_failed(&consensus_dl_status[flav], 0);
  1255. }
  1256. if (flav == usable_consensus_flavor()) {
  1257. /* XXXXNM Microdescs: needs a non-ns variant. ???? NM*/
  1258. update_consensus_networkstatus_fetch_time(now);
  1259. nodelist_set_consensus(current_consensus);
  1260. dirvote_recalculate_timing(options, now);
  1261. routerstatus_list_update_named_server_map();
  1262. /* Update ewma and adjust policy if needed; first cache the old value */
  1263. old_ewma_enabled = cell_ewma_enabled();
  1264. /* Change the cell EWMA settings */
  1265. cell_ewma_set_scale_factor(options, networkstatus_get_latest_consensus());
  1266. /* If we just enabled ewma, set the cmux policy on all active channels */
  1267. if (cell_ewma_enabled() && !old_ewma_enabled) {
  1268. channel_set_cmux_policy_everywhere(&ewma_policy);
  1269. } else if (!cell_ewma_enabled() && old_ewma_enabled) {
  1270. /* Turn it off everywhere */
  1271. channel_set_cmux_policy_everywhere(NULL);
  1272. }
  1273. /* XXXX024 this call might be unnecessary here: can changing the
  1274. * current consensus really alter our view of any OR's rate limits? */
  1275. connection_or_update_token_buckets(get_connection_array(), options);
  1276. circuit_build_times_new_consensus_params(get_circuit_build_times_mutable(),
  1277. current_consensus);
  1278. }
  1279. if (directory_caches_dir_info(options)) {
  1280. dirserv_set_cached_consensus_networkstatus(consensus,
  1281. flavor,
  1282. &c->digests,
  1283. c->valid_after);
  1284. }
  1285. if (!from_cache) {
  1286. write_str_to_file(consensus_fname, consensus, 0);
  1287. }
  1288. /** If a consensus appears more than this many seconds before its declared
  1289. * valid-after time, declare that our clock is skewed. */
  1290. #define EARLY_CONSENSUS_NOTICE_SKEW 60
  1291. if (now < c->valid_after - EARLY_CONSENSUS_NOTICE_SKEW) {
  1292. char tbuf[ISO_TIME_LEN+1];
  1293. char dbuf[64];
  1294. long delta = now - c->valid_after;
  1295. format_iso_time(tbuf, c->valid_after);
  1296. format_time_interval(dbuf, sizeof(dbuf), delta);
  1297. log_warn(LD_GENERAL, "Our clock is %s behind the time published in the "
  1298. "consensus network status document (%s UTC). Tor needs an "
  1299. "accurate clock to work correctly. Please check your time and "
  1300. "date settings!", dbuf, tbuf);
  1301. control_event_general_status(LOG_WARN,
  1302. "CLOCK_SKEW MIN_SKEW=%ld SOURCE=CONSENSUS", delta);
  1303. }
  1304. router_dir_info_changed();
  1305. result = 0;
  1306. done:
  1307. if (free_consensus)
  1308. networkstatus_vote_free(c);
  1309. tor_free(consensus_fname);
  1310. tor_free(unverified_fname);
  1311. return result;
  1312. }
  1313. /** Called when we have gotten more certificates: see whether we can
  1314. * now verify a pending consensus. */
  1315. void
  1316. networkstatus_note_certs_arrived(void)
  1317. {
  1318. int i;
  1319. for (i=0; i<N_CONSENSUS_FLAVORS; ++i) {
  1320. consensus_waiting_for_certs_t *waiting = &consensus_waiting_for_certs[i];
  1321. if (!waiting->consensus)
  1322. continue;
  1323. if (networkstatus_check_consensus_signature(waiting->consensus, 0)>=0) {
  1324. char *waiting_body = waiting->body;
  1325. if (!networkstatus_set_current_consensus(
  1326. waiting_body,
  1327. networkstatus_get_flavor_name(i),
  1328. NSSET_WAS_WAITING_FOR_CERTS)) {
  1329. tor_free(waiting_body);
  1330. }
  1331. }
  1332. }
  1333. }
  1334. /** If the network-status list has changed since the last time we called this
  1335. * function, update the status of every routerinfo from the network-status
  1336. * list. If <b>dir_version</b> is 2, it's a v2 networkstatus that changed.
  1337. * If <b>dir_version</b> is 3, it's a v3 consensus that changed.
  1338. */
  1339. void
  1340. routers_update_all_from_networkstatus(time_t now, int dir_version)
  1341. {
  1342. routerlist_t *rl = router_get_routerlist();
  1343. networkstatus_t *consensus = networkstatus_get_reasonably_live_consensus(now,
  1344. FLAV_NS);
  1345. if (!consensus || dir_version < 3) /* nothing more we should do */
  1346. return;
  1347. /* calls router_dir_info_changed() when it's done -- more routers
  1348. * might be up or down now, which might affect whether there's enough
  1349. * directory info. */
  1350. routers_update_status_from_consensus_networkstatus(rl->routers, 0);
  1351. SMARTLIST_FOREACH(rl->routers, routerinfo_t *, ri,
  1352. ri->cache_info.routerlist_index = ri_sl_idx);
  1353. if (rl->old_routers)
  1354. signed_descs_update_status_from_consensus_networkstatus(rl->old_routers);
  1355. if (!have_warned_about_old_version) {
  1356. int is_server = server_mode(get_options());
  1357. version_status_t status;
  1358. const char *recommended = is_server ?
  1359. consensus->server_versions : consensus->client_versions;
  1360. status = tor_version_is_obsolete(VERSION, recommended);
  1361. if (status == VS_RECOMMENDED) {
  1362. log_info(LD_GENERAL, "The directory authorities say my version is ok.");
  1363. } else if (status == VS_EMPTY) {
  1364. log_info(LD_GENERAL,
  1365. "The directory authorities don't recommend any versions.");
  1366. } else if (status == VS_NEW || status == VS_NEW_IN_SERIES) {
  1367. if (!have_warned_about_new_version) {
  1368. log_notice(LD_GENERAL, "This version of Tor (%s) is newer than any "
  1369. "recommended version%s, according to the directory "
  1370. "authorities. Recommended versions are: %s",
  1371. VERSION,
  1372. status == VS_NEW_IN_SERIES ? " in its series" : "",
  1373. recommended);
  1374. have_warned_about_new_version = 1;
  1375. control_event_general_status(LOG_WARN, "DANGEROUS_VERSION "
  1376. "CURRENT=%s REASON=%s RECOMMENDED=\"%s\"",
  1377. VERSION, "NEW", recommended);
  1378. }
  1379. } else {
  1380. log_warn(LD_GENERAL, "Please upgrade! "
  1381. "This version of Tor (%s) is %s, according to the directory "
  1382. "authorities. Recommended versions are: %s",
  1383. VERSION,
  1384. status == VS_OLD ? "obsolete" : "not recommended",
  1385. recommended);
  1386. have_warned_about_old_version = 1;
  1387. control_event_general_status(LOG_WARN, "DANGEROUS_VERSION "
  1388. "CURRENT=%s REASON=%s RECOMMENDED=\"%s\"",
  1389. VERSION, status == VS_OLD ? "OBSOLETE" : "UNRECOMMENDED",
  1390. recommended);
  1391. }
  1392. }
  1393. }
  1394. /** Update our view of the list of named servers from the most recently
  1395. * retrieved networkstatus consensus. */
  1396. static void
  1397. routerstatus_list_update_named_server_map(void)
  1398. {
  1399. if (!current_consensus)
  1400. return;
  1401. strmap_free(named_server_map, tor_free_);
  1402. named_server_map = strmap_new();
  1403. strmap_free(unnamed_server_map, NULL);
  1404. unnamed_server_map = strmap_new();
  1405. SMARTLIST_FOREACH_BEGIN(current_consensus->routerstatus_list,
  1406. const routerstatus_t *, rs) {
  1407. if (rs->is_named) {
  1408. strmap_set_lc(named_server_map, rs->nickname,
  1409. tor_memdup(rs->identity_digest, DIGEST_LEN));
  1410. }
  1411. if (rs->is_unnamed) {
  1412. strmap_set_lc(unnamed_server_map, rs->nickname, (void*)1);
  1413. }
  1414. } SMARTLIST_FOREACH_END(rs);
  1415. }
  1416. /** Given a list <b>routers</b> of routerinfo_t *, update each status field
  1417. * according to our current consensus networkstatus. May re-order
  1418. * <b>routers</b>. */
  1419. void
  1420. routers_update_status_from_consensus_networkstatus(smartlist_t *routers,
  1421. int reset_failures)
  1422. {
  1423. const or_options_t *options = get_options();
  1424. int authdir = authdir_mode_v3(options);
  1425. networkstatus_t *ns = current_consensus;
  1426. if (!ns || !smartlist_len(ns->routerstatus_list))
  1427. return;
  1428. routers_sort_by_identity(routers);
  1429. SMARTLIST_FOREACH_JOIN(ns->routerstatus_list, routerstatus_t *, rs,
  1430. routers, routerinfo_t *, router,
  1431. tor_memcmp(rs->identity_digest,
  1432. router->cache_info.identity_digest, DIGEST_LEN),
  1433. {
  1434. }) {
  1435. /* Is it the same descriptor, or only the same identity? */
  1436. if (tor_memeq(router->cache_info.signed_descriptor_digest,
  1437. rs->descriptor_digest, DIGEST_LEN)) {
  1438. if (ns->valid_until > router->cache_info.last_listed_as_valid_until)
  1439. router->cache_info.last_listed_as_valid_until = ns->valid_until;
  1440. }
  1441. if (authdir) {
  1442. /* If we _are_ an authority, we should check whether this router
  1443. * is one that will cause us to need a reachability test. */
  1444. routerinfo_t *old_router =
  1445. router_get_mutable_by_digest(router->cache_info.identity_digest);
  1446. if (old_router != router) {
  1447. router->needs_retest_if_added =
  1448. dirserv_should_launch_reachability_test(router, old_router);
  1449. }
  1450. }
  1451. if (reset_failures) {
  1452. download_status_reset(&rs->dl_status);
  1453. }
  1454. } SMARTLIST_FOREACH_JOIN_END(rs, router);
  1455. router_dir_info_changed();
  1456. }
  1457. /** Given a list of signed_descriptor_t, update their fields (mainly, when
  1458. * they were last listed) from the most recent consensus. */
  1459. void
  1460. signed_descs_update_status_from_consensus_networkstatus(smartlist_t *descs)
  1461. {
  1462. networkstatus_t *ns = current_ns_consensus;
  1463. if (!ns)
  1464. return;
  1465. if (!ns->desc_digest_map) {
  1466. char dummy[DIGEST_LEN];
  1467. /* instantiates the digest map. */
  1468. memset(dummy, 0, sizeof(dummy));
  1469. router_get_consensus_status_by_descriptor_digest(ns, dummy);
  1470. }
  1471. SMARTLIST_FOREACH(descs, signed_descriptor_t *, d,
  1472. {
  1473. const routerstatus_t *rs = digestmap_get(ns->desc_digest_map,
  1474. d->signed_descriptor_digest);
  1475. if (rs) {
  1476. if (ns->valid_until > d->last_listed_as_valid_until)
  1477. d->last_listed_as_valid_until = ns->valid_until;
  1478. }
  1479. });
  1480. }
  1481. /** Generate networkstatus lines for a single routerstatus_t object, and
  1482. * return the result in a newly allocated string. Used only by controller
  1483. * interface (for now.) */
  1484. char *
  1485. networkstatus_getinfo_helper_single(const routerstatus_t *rs)
  1486. {
  1487. return routerstatus_format_entry(rs, NULL, NS_CONTROL_PORT, NULL);
  1488. }
  1489. /** Alloc and return a string describing routerstatuses for the most
  1490. * recent info of each router we know about that is of purpose
  1491. * <b>purpose_string</b>. Return NULL if unrecognized purpose.
  1492. *
  1493. * Right now this function is oriented toward listing bridges (you
  1494. * shouldn't use this for general-purpose routers, since those
  1495. * should be listed from the consensus, not from the routers list). */
  1496. char *
  1497. networkstatus_getinfo_by_purpose(const char *purpose_string, time_t now)
  1498. {
  1499. time_t cutoff = now - ROUTER_MAX_AGE_TO_PUBLISH;
  1500. char *answer;
  1501. routerlist_t *rl = router_get_routerlist();
  1502. smartlist_t *statuses;
  1503. uint8_t purpose = router_purpose_from_string(purpose_string);
  1504. routerstatus_t rs;
  1505. int bridge_auth = authdir_mode_bridge(get_options());
  1506. if (purpose == ROUTER_PURPOSE_UNKNOWN) {
  1507. log_info(LD_DIR, "Unrecognized purpose '%s' when listing router statuses.",
  1508. purpose_string);
  1509. return NULL;
  1510. }
  1511. statuses = smartlist_new();
  1512. SMARTLIST_FOREACH_BEGIN(rl->routers, routerinfo_t *, ri) {
  1513. node_t *node = node_get_mutable_by_id(ri->cache_info.identity_digest);
  1514. if (!node)
  1515. continue;
  1516. if (ri->cache_info.published_on < cutoff)
  1517. continue;
  1518. if (ri->purpose != purpose)
  1519. continue;
  1520. if (bridge_auth && ri->purpose == ROUTER_PURPOSE_BRIDGE)
  1521. dirserv_set_router_is_running(ri, now);
  1522. /* then generate and write out status lines for each of them */
  1523. set_routerstatus_from_routerinfo(&rs, node, ri, now, 0);
  1524. smartlist_add(statuses, networkstatus_getinfo_helper_single(&rs));
  1525. } SMARTLIST_FOREACH_END(ri);
  1526. answer = smartlist_join_strings(statuses, "", 0, NULL);
  1527. SMARTLIST_FOREACH(statuses, char *, cp, tor_free(cp));
  1528. smartlist_free(statuses);
  1529. return answer;
  1530. }
  1531. /** Write out router status entries for all our bridge descriptors. */
  1532. void
  1533. networkstatus_dump_bridge_status_to_file(time_t now)
  1534. {
  1535. char *status = networkstatus_getinfo_by_purpose("bridge", now);
  1536. const or_options_t *options = get_options();
  1537. char *fname = NULL;
  1538. char *thresholds = NULL;
  1539. char *published_thresholds_and_status = NULL;
  1540. routerlist_t *rl = router_get_routerlist();
  1541. char published[ISO_TIME_LEN+1];
  1542. format_iso_time(published, now);
  1543. dirserv_compute_bridge_flag_thresholds(rl);
  1544. thresholds = dirserv_get_flag_thresholds_line();
  1545. tor_asprintf(&published_thresholds_and_status,
  1546. "published %s\nflag-thresholds %s\n%s",
  1547. published, thresholds, status);
  1548. tor_asprintf(&fname, "%s"PATH_SEPARATOR"networkstatus-bridges",
  1549. options->DataDirectory);
  1550. write_str_to_file(fname,published_thresholds_and_status,0);
  1551. tor_free(thresholds);
  1552. tor_free(published_thresholds_and_status);
  1553. tor_free(fname);
  1554. tor_free(status);
  1555. }
  1556. /* DOCDOC get_net_param_from_list */
  1557. static int32_t
  1558. get_net_param_from_list(smartlist_t *net_params, const char *param_name,
  1559. int32_t default_val, int32_t min_val, int32_t max_val)
  1560. {
  1561. int32_t res = default_val;
  1562. size_t name_len = strlen(param_name);
  1563. tor_assert(max_val > min_val);
  1564. tor_assert(min_val <= default_val);
  1565. tor_assert(max_val >= default_val);
  1566. SMARTLIST_FOREACH_BEGIN(net_params, const char *, p) {
  1567. if (!strcmpstart(p, param_name) && p[name_len] == '=') {
  1568. int ok=0;
  1569. long v = tor_parse_long(p+name_len+1, 10, INT32_MIN,
  1570. INT32_MAX, &ok, NULL);
  1571. if (ok) {
  1572. res = (int32_t) v;
  1573. break;
  1574. }
  1575. }
  1576. } SMARTLIST_FOREACH_END(p);
  1577. if (res < min_val) {
  1578. log_warn(LD_DIR, "Consensus parameter %s is too small. Got %d, raising to "
  1579. "%d.", param_name, res, min_val);
  1580. res = min_val;
  1581. } else if (res > max_val) {
  1582. log_warn(LD_DIR, "Consensus parameter %s is too large. Got %d, capping to "
  1583. "%d.", param_name, res, max_val);
  1584. res = max_val;
  1585. }
  1586. return res;
  1587. }
  1588. /** Return the value of a integer parameter from the networkstatus <b>ns</b>
  1589. * whose name is <b>param_name</b>. If <b>ns</b> is NULL, try loading the
  1590. * latest consensus ourselves. Return <b>default_val</b> if no latest
  1591. * consensus, or if it has no parameter called <b>param_name</b>.
  1592. * Make sure the value parsed from the consensus is at least
  1593. * <b>min_val</b> and at most <b>max_val</b> and raise/cap the parsed value
  1594. * if necessary. */
  1595. int32_t
  1596. networkstatus_get_param(const networkstatus_t *ns, const char *param_name,
  1597. int32_t default_val, int32_t min_val, int32_t max_val)
  1598. {
  1599. if (!ns) /* if they pass in null, go find it ourselves */
  1600. ns = networkstatus_get_latest_consensus();
  1601. if (!ns || !ns->net_params)
  1602. return default_val;
  1603. return get_net_param_from_list(ns->net_params, param_name,
  1604. default_val, min_val, max_val);
  1605. }
  1606. /**
  1607. * Retrieve the consensus parameter that governs the
  1608. * fixed-point precision of our network balancing 'bandwidth-weights'
  1609. * (which are themselves integer consensus values). We divide them
  1610. * by this value and ensure they never exceed this value.
  1611. */
  1612. int
  1613. networkstatus_get_weight_scale_param(networkstatus_t *ns)
  1614. {
  1615. return networkstatus_get_param(ns, "bwweightscale",
  1616. BW_WEIGHT_SCALE,
  1617. BW_MIN_WEIGHT_SCALE,
  1618. BW_MAX_WEIGHT_SCALE);
  1619. }
  1620. /** Return the value of a integer bw weight parameter from the networkstatus
  1621. * <b>ns</b> whose name is <b>weight_name</b>. If <b>ns</b> is NULL, try
  1622. * loading the latest consensus ourselves. Return <b>default_val</b> if no
  1623. * latest consensus, or if it has no parameter called <b>weight_name</b>. */
  1624. int32_t
  1625. networkstatus_get_bw_weight(networkstatus_t *ns, const char *weight_name,
  1626. int32_t default_val)
  1627. {
  1628. int32_t param;
  1629. int max;
  1630. if (!ns) /* if they pass in null, go find it ourselves */
  1631. ns = networkstatus_get_latest_consensus();
  1632. if (!ns || !ns->weight_params)
  1633. return default_val;
  1634. max = networkstatus_get_weight_scale_param(ns);
  1635. param = get_net_param_from_list(ns->weight_params, weight_name,
  1636. default_val, -1,
  1637. BW_MAX_WEIGHT_SCALE);
  1638. if (param > max) {
  1639. log_warn(LD_DIR, "Value of consensus weight %s was too large, capping "
  1640. "to %d", weight_name, max);
  1641. param = max;
  1642. }
  1643. return param;
  1644. }
  1645. /** Return the name of the consensus flavor <b>flav</b> as used to identify
  1646. * the flavor in directory documents. */
  1647. const char *
  1648. networkstatus_get_flavor_name(consensus_flavor_t flav)
  1649. {
  1650. switch (flav) {
  1651. case FLAV_NS:
  1652. return "ns";
  1653. case FLAV_MICRODESC:
  1654. return "microdesc";
  1655. default:
  1656. tor_fragile_assert();
  1657. return "??";
  1658. }
  1659. }
  1660. /** Return the consensus_flavor_t value for the flavor called <b>flavname</b>,
  1661. * or -1 if the flavor is not recognized. */
  1662. int
  1663. networkstatus_parse_flavor_name(const char *flavname)
  1664. {
  1665. if (!strcmp(flavname, "ns"))
  1666. return FLAV_NS;
  1667. else if (!strcmp(flavname, "microdesc"))
  1668. return FLAV_MICRODESC;
  1669. else
  1670. return -1;
  1671. }
  1672. /** Return 0 if this routerstatus is obsolete, too new, isn't
  1673. * running, or otherwise not a descriptor that we would make any
  1674. * use of even if we had it. Else return 1. */
  1675. int
  1676. client_would_use_router(const routerstatus_t *rs, time_t now,
  1677. const or_options_t *options)
  1678. {
  1679. if (!rs->is_flagged_running && !options->FetchUselessDescriptors) {
  1680. /* If we had this router descriptor, we wouldn't even bother using it.
  1681. * But, if we want to have a complete list, fetch it anyway. */
  1682. return 0;
  1683. }
  1684. if (rs->published_on + options->TestingEstimatedDescriptorPropagationTime
  1685. > now) {
  1686. /* Most caches probably don't have this descriptor yet. */
  1687. return 0;
  1688. }
  1689. if (rs->published_on + OLD_ROUTER_DESC_MAX_AGE < now) {
  1690. /* We'd drop it immediately for being too old. */
  1691. return 0;
  1692. }
  1693. return 1;
  1694. }
  1695. /** If <b>question</b> is a string beginning with "ns/" in a format the
  1696. * control interface expects for a GETINFO question, set *<b>answer</b> to a
  1697. * newly-allocated string containing networkstatus lines for the appropriate
  1698. * ORs. Return 0 on success, -1 on unrecognized question format. */
  1699. int
  1700. getinfo_helper_networkstatus(control_connection_t *conn,
  1701. const char *question, char **answer,
  1702. const char **errmsg)
  1703. {
  1704. const routerstatus_t *status;
  1705. (void) conn;
  1706. if (!current_consensus) {
  1707. *answer = tor_strdup("");
  1708. return 0;
  1709. }
  1710. if (!strcmp(question, "ns/all")) {
  1711. smartlist_t *statuses = smartlist_new();
  1712. SMARTLIST_FOREACH(current_consensus->routerstatus_list,
  1713. const routerstatus_t *, rs,
  1714. {
  1715. smartlist_add(statuses, networkstatus_getinfo_helper_single(rs));
  1716. });
  1717. *answer = smartlist_join_strings(statuses, "", 0, NULL);
  1718. SMARTLIST_FOREACH(statuses, char *, cp, tor_free(cp));
  1719. smartlist_free(statuses);
  1720. return 0;
  1721. } else if (!strcmpstart(question, "ns/id/")) {
  1722. char d[DIGEST_LEN];
  1723. const char *q = question + 6;
  1724. if (*q == '$')
  1725. ++q;
  1726. if (base16_decode(d, DIGEST_LEN, q, strlen(q))) {
  1727. *errmsg = "Data not decodeable as hex";
  1728. return -1;
  1729. }
  1730. status = router_get_consensus_status_by_id(d);
  1731. } else if (!strcmpstart(question, "ns/name/")) {
  1732. status = router_get_consensus_status_by_nickname(question+8, 0);
  1733. } else if (!strcmpstart(question, "ns/purpose/")) {
  1734. *answer = networkstatus_getinfo_by_purpose(question+11, time(NULL));
  1735. return *answer ? 0 : -1;
  1736. } else if (!strcmp(question, "consensus/packages")) {
  1737. const networkstatus_t *ns = networkstatus_get_latest_consensus();
  1738. if (ns && ns->package_lines)
  1739. *answer = smartlist_join_strings(ns->package_lines, "\n", 0, NULL);
  1740. else
  1741. *errmsg = "No consensus available";
  1742. return *answer ? 0 : -1;
  1743. } else if (!strcmp(question, "consensus/valid-after") ||
  1744. !strcmp(question, "consensus/fresh-until") ||
  1745. !strcmp(question, "consensus/valid-until")) {
  1746. const networkstatus_t *ns = networkstatus_get_latest_consensus();
  1747. if (ns) {
  1748. time_t t;
  1749. if (!strcmp(question, "consensus/valid-after"))
  1750. t = ns->valid_after;
  1751. else if (!strcmp(question, "consensus/fresh-until"))
  1752. t = ns->fresh_until;
  1753. else
  1754. t = ns->valid_until;
  1755. char tbuf[ISO_TIME_LEN+1];
  1756. format_iso_time(tbuf, t);
  1757. *answer = tor_strdup(tbuf);
  1758. } else {
  1759. *errmsg = "No consensus available";
  1760. }
  1761. return *answer ? 0 : -1;
  1762. } else {
  1763. return 0;
  1764. }
  1765. if (status)
  1766. *answer = networkstatus_getinfo_helper_single(status);
  1767. return 0;
  1768. }
  1769. /** Free all storage held locally in this module. */
  1770. void
  1771. networkstatus_free_all(void)
  1772. {
  1773. int i;
  1774. networkstatus_vote_free(current_ns_consensus);
  1775. networkstatus_vote_free(current_md_consensus);
  1776. current_md_consensus = current_ns_consensus = NULL;
  1777. for (i=0; i < N_CONSENSUS_FLAVORS; ++i) {
  1778. consensus_waiting_for_certs_t *waiting = &consensus_waiting_for_certs[i];
  1779. if (waiting->consensus) {
  1780. networkstatus_vote_free(waiting->consensus);
  1781. waiting->consensus = NULL;
  1782. }
  1783. tor_free(waiting->body);
  1784. }
  1785. strmap_free(named_server_map, tor_free_);
  1786. strmap_free(unnamed_server_map, NULL);
  1787. }