connection_or.c 91 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2017, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file connection_or.c
  8. * \brief Functions to handle OR connections, TLS handshaking, and
  9. * cells on the network.
  10. *
  11. * An or_connection_t is a subtype of connection_t (as implemented in
  12. * connection.c) that uses a TLS connection to send and receive cells on the
  13. * Tor network. (By sending and receiving cells connection_or.c, it cooperates
  14. * with channeltls.c to implement a the channel interface of channel.c.)
  15. *
  16. * Every OR connection has an underlying tortls_t object (as implemented in
  17. * tortls.c) which it uses as its TLS stream. It is responsible for
  18. * sending and receiving cells over that TLS.
  19. *
  20. * This module also implements the client side of the v3 Tor link handshake,
  21. **/
  22. #include "or.h"
  23. #include "bridges.h"
  24. #include "buffers.h"
  25. /*
  26. * Define this so we get channel internal functions, since we're implementing
  27. * part of a subclass (channel_tls_t).
  28. */
  29. #define TOR_CHANNEL_INTERNAL_
  30. #include "channel.h"
  31. #include "channeltls.h"
  32. #include "circuitbuild.h"
  33. #include "circuitlist.h"
  34. #include "circuitstats.h"
  35. #include "command.h"
  36. #include "config.h"
  37. #include "connection.h"
  38. #include "connection_or.h"
  39. #include "control.h"
  40. #include "dirserv.h"
  41. #include "entrynodes.h"
  42. #include "geoip.h"
  43. #include "main.h"
  44. #include "link_handshake.h"
  45. #include "microdesc.h"
  46. #include "networkstatus.h"
  47. #include "nodelist.h"
  48. #include "proto_cell.h"
  49. #include "reasons.h"
  50. #include "relay.h"
  51. #include "rephist.h"
  52. #include "router.h"
  53. #include "routerkeys.h"
  54. #include "routerlist.h"
  55. #include "ext_orport.h"
  56. #include "scheduler.h"
  57. #include "torcert.h"
  58. #include "channelpadding.h"
  59. static int connection_tls_finish_handshake(or_connection_t *conn);
  60. static int connection_or_launch_v3_or_handshake(or_connection_t *conn);
  61. static int connection_or_process_cells_from_inbuf(or_connection_t *conn);
  62. static int connection_or_check_valid_tls_handshake(or_connection_t *conn,
  63. int started_here,
  64. char *digest_rcvd_out);
  65. static void connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn);
  66. static unsigned int
  67. connection_or_is_bad_for_new_circs(or_connection_t *or_conn);
  68. static void connection_or_mark_bad_for_new_circs(or_connection_t *or_conn);
  69. /*
  70. * Call this when changing connection state, so notifications to the owning
  71. * channel can be handled.
  72. */
  73. static void connection_or_change_state(or_connection_t *conn, uint8_t state);
  74. static void connection_or_check_canonicity(or_connection_t *conn,
  75. int started_here);
  76. /**************************************************************/
  77. /** Global map between Extended ORPort identifiers and OR
  78. * connections. */
  79. static digestmap_t *orconn_ext_or_id_map = NULL;
  80. /** Clear clear conn->identity_digest and update other data
  81. * structures as appropriate.*/
  82. void
  83. connection_or_clear_identity(or_connection_t *conn)
  84. {
  85. tor_assert(conn);
  86. memset(conn->identity_digest, 0, DIGEST_LEN);
  87. }
  88. /** Clear all identities in OR conns.*/
  89. void
  90. connection_or_clear_identity_map(void)
  91. {
  92. smartlist_t *conns = get_connection_array();
  93. SMARTLIST_FOREACH(conns, connection_t *, conn,
  94. {
  95. if (conn->type == CONN_TYPE_OR) {
  96. connection_or_clear_identity(TO_OR_CONN(conn));
  97. }
  98. });
  99. }
  100. /** Change conn->identity_digest to digest, and add conn into
  101. * the appropriate digest maps.
  102. *
  103. * NOTE that this function only allows two kinds of transitions: from
  104. * unset identity to set identity, and from idempotent re-settings
  105. * of the same identity. It's not allowed to clear an identity or to
  106. * change an identity. Return 0 on success, and -1 if the transition
  107. * is not allowed.
  108. **/
  109. static void
  110. connection_or_set_identity_digest(or_connection_t *conn,
  111. const char *rsa_digest,
  112. const ed25519_public_key_t *ed_id)
  113. {
  114. channel_t *chan = NULL;
  115. tor_assert(conn);
  116. tor_assert(rsa_digest);
  117. if (conn->chan)
  118. chan = TLS_CHAN_TO_BASE(conn->chan);
  119. log_info(LD_HANDSHAKE, "Set identity digest for %p (%s): %s %s.",
  120. conn,
  121. escaped_safe_str(conn->base_.address),
  122. hex_str(rsa_digest, DIGEST_LEN),
  123. ed25519_fmt(ed_id));
  124. log_info(LD_HANDSHAKE, " (Previously: %s %s)",
  125. hex_str(conn->identity_digest, DIGEST_LEN),
  126. chan ? ed25519_fmt(&chan->ed25519_identity) : "<null>");
  127. const int rsa_id_was_set = ! tor_digest_is_zero(conn->identity_digest);
  128. const int ed_id_was_set =
  129. chan && !ed25519_public_key_is_zero(&chan->ed25519_identity);
  130. const int rsa_changed =
  131. tor_memneq(conn->identity_digest, rsa_digest, DIGEST_LEN);
  132. const int ed_changed = ed_id_was_set &&
  133. (!ed_id || !ed25519_pubkey_eq(ed_id, &chan->ed25519_identity));
  134. tor_assert(!rsa_changed || !rsa_id_was_set);
  135. tor_assert(!ed_changed || !ed_id_was_set);
  136. if (!rsa_changed && !ed_changed)
  137. return;
  138. /* If the identity was set previously, remove the old mapping. */
  139. if (rsa_id_was_set) {
  140. connection_or_clear_identity(conn);
  141. if (chan)
  142. channel_clear_identity_digest(chan);
  143. }
  144. memcpy(conn->identity_digest, rsa_digest, DIGEST_LEN);
  145. /* If we're initializing the IDs to zero, don't add a mapping yet. */
  146. if (tor_digest_is_zero(rsa_digest) &&
  147. (!ed_id || ed25519_public_key_is_zero(ed_id)))
  148. return;
  149. /* Deal with channels */
  150. if (chan)
  151. channel_set_identity_digest(chan, rsa_digest, ed_id);
  152. }
  153. /** Remove the Extended ORPort identifier of <b>conn</b> from the
  154. * global identifier list. Also, clear the identifier from the
  155. * connection itself. */
  156. void
  157. connection_or_remove_from_ext_or_id_map(or_connection_t *conn)
  158. {
  159. or_connection_t *tmp;
  160. if (!orconn_ext_or_id_map)
  161. return;
  162. if (!conn->ext_or_conn_id)
  163. return;
  164. tmp = digestmap_remove(orconn_ext_or_id_map, conn->ext_or_conn_id);
  165. if (!tor_digest_is_zero(conn->ext_or_conn_id))
  166. tor_assert(tmp == conn);
  167. memset(conn->ext_or_conn_id, 0, EXT_OR_CONN_ID_LEN);
  168. }
  169. /** Return the connection whose ext_or_id is <b>id</b>. Return NULL if no such
  170. * connection is found. */
  171. or_connection_t *
  172. connection_or_get_by_ext_or_id(const char *id)
  173. {
  174. if (!orconn_ext_or_id_map)
  175. return NULL;
  176. return digestmap_get(orconn_ext_or_id_map, id);
  177. }
  178. /** Deallocate the global Extended ORPort identifier list */
  179. void
  180. connection_or_clear_ext_or_id_map(void)
  181. {
  182. digestmap_free(orconn_ext_or_id_map, NULL);
  183. orconn_ext_or_id_map = NULL;
  184. }
  185. /** Creates an Extended ORPort identifier for <b>conn</b> and deposits
  186. * it into the global list of identifiers. */
  187. void
  188. connection_or_set_ext_or_identifier(or_connection_t *conn)
  189. {
  190. char random_id[EXT_OR_CONN_ID_LEN];
  191. or_connection_t *tmp;
  192. if (!orconn_ext_or_id_map)
  193. orconn_ext_or_id_map = digestmap_new();
  194. /* Remove any previous identifiers: */
  195. if (conn->ext_or_conn_id && !tor_digest_is_zero(conn->ext_or_conn_id))
  196. connection_or_remove_from_ext_or_id_map(conn);
  197. do {
  198. crypto_rand(random_id, sizeof(random_id));
  199. } while (digestmap_get(orconn_ext_or_id_map, random_id));
  200. if (!conn->ext_or_conn_id)
  201. conn->ext_or_conn_id = tor_malloc_zero(EXT_OR_CONN_ID_LEN);
  202. memcpy(conn->ext_or_conn_id, random_id, EXT_OR_CONN_ID_LEN);
  203. tmp = digestmap_set(orconn_ext_or_id_map, random_id, conn);
  204. tor_assert(!tmp);
  205. }
  206. /**************************************************************/
  207. /** Map from a string describing what a non-open OR connection was doing when
  208. * failed, to an intptr_t describing the count of connections that failed that
  209. * way. Note that the count is stored _as_ the pointer.
  210. */
  211. static strmap_t *broken_connection_counts;
  212. /** If true, do not record information in <b>broken_connection_counts</b>. */
  213. static int disable_broken_connection_counts = 0;
  214. /** Record that an OR connection failed in <b>state</b>. */
  215. static void
  216. note_broken_connection(const char *state)
  217. {
  218. void *ptr;
  219. intptr_t val;
  220. if (disable_broken_connection_counts)
  221. return;
  222. if (!broken_connection_counts)
  223. broken_connection_counts = strmap_new();
  224. ptr = strmap_get(broken_connection_counts, state);
  225. val = (intptr_t)ptr;
  226. val++;
  227. ptr = (void*)val;
  228. strmap_set(broken_connection_counts, state, ptr);
  229. }
  230. /** Forget all recorded states for failed connections. If
  231. * <b>stop_recording</b> is true, don't record any more. */
  232. void
  233. clear_broken_connection_map(int stop_recording)
  234. {
  235. if (broken_connection_counts)
  236. strmap_free(broken_connection_counts, NULL);
  237. broken_connection_counts = NULL;
  238. if (stop_recording)
  239. disable_broken_connection_counts = 1;
  240. }
  241. /** Write a detailed description the state of <b>orconn</b> into the
  242. * <b>buflen</b>-byte buffer at <b>buf</b>. This description includes not
  243. * only the OR-conn level state but also the TLS state. It's useful for
  244. * diagnosing broken handshakes. */
  245. static void
  246. connection_or_get_state_description(or_connection_t *orconn,
  247. char *buf, size_t buflen)
  248. {
  249. connection_t *conn = TO_CONN(orconn);
  250. const char *conn_state;
  251. char tls_state[256];
  252. tor_assert(conn->type == CONN_TYPE_OR || conn->type == CONN_TYPE_EXT_OR);
  253. conn_state = conn_state_to_string(conn->type, conn->state);
  254. tor_tls_get_state_description(orconn->tls, tls_state, sizeof(tls_state));
  255. tor_snprintf(buf, buflen, "%s with SSL state %s", conn_state, tls_state);
  256. }
  257. /** Record the current state of <b>orconn</b> as the state of a broken
  258. * connection. */
  259. static void
  260. connection_or_note_state_when_broken(or_connection_t *orconn)
  261. {
  262. char buf[256];
  263. if (disable_broken_connection_counts)
  264. return;
  265. connection_or_get_state_description(orconn, buf, sizeof(buf));
  266. log_info(LD_HANDSHAKE,"Connection died in state '%s'", buf);
  267. note_broken_connection(buf);
  268. }
  269. /** Helper type used to sort connection states and find the most frequent. */
  270. typedef struct broken_state_count_t {
  271. intptr_t count;
  272. const char *state;
  273. } broken_state_count_t;
  274. /** Helper function used to sort broken_state_count_t by frequency. */
  275. static int
  276. broken_state_count_compare(const void **a_ptr, const void **b_ptr)
  277. {
  278. const broken_state_count_t *a = *a_ptr, *b = *b_ptr;
  279. if (b->count < a->count)
  280. return -1;
  281. else if (b->count == a->count)
  282. return 0;
  283. else
  284. return 1;
  285. }
  286. /** Upper limit on the number of different states to report for connection
  287. * failure. */
  288. #define MAX_REASONS_TO_REPORT 10
  289. /** Report a list of the top states for failed OR connections at log level
  290. * <b>severity</b>, in log domain <b>domain</b>. */
  291. void
  292. connection_or_report_broken_states(int severity, int domain)
  293. {
  294. int total = 0;
  295. smartlist_t *items;
  296. if (!broken_connection_counts || disable_broken_connection_counts)
  297. return;
  298. items = smartlist_new();
  299. STRMAP_FOREACH(broken_connection_counts, state, void *, countptr) {
  300. broken_state_count_t *c = tor_malloc(sizeof(broken_state_count_t));
  301. c->count = (intptr_t)countptr;
  302. total += (int)c->count;
  303. c->state = state;
  304. smartlist_add(items, c);
  305. } STRMAP_FOREACH_END;
  306. smartlist_sort(items, broken_state_count_compare);
  307. tor_log(severity, domain, "%d connections have failed%s", total,
  308. smartlist_len(items) > MAX_REASONS_TO_REPORT ? ". Top reasons:" : ":");
  309. SMARTLIST_FOREACH_BEGIN(items, const broken_state_count_t *, c) {
  310. if (c_sl_idx > MAX_REASONS_TO_REPORT)
  311. break;
  312. tor_log(severity, domain,
  313. " %d connections died in state %s", (int)c->count, c->state);
  314. } SMARTLIST_FOREACH_END(c);
  315. SMARTLIST_FOREACH(items, broken_state_count_t *, c, tor_free(c));
  316. smartlist_free(items);
  317. }
  318. /** Call this to change or_connection_t states, so the owning channel_tls_t can
  319. * be notified.
  320. */
  321. static void
  322. connection_or_change_state(or_connection_t *conn, uint8_t state)
  323. {
  324. uint8_t old_state;
  325. tor_assert(conn);
  326. old_state = conn->base_.state;
  327. conn->base_.state = state;
  328. if (conn->chan)
  329. channel_tls_handle_state_change_on_orconn(conn->chan, conn,
  330. old_state, state);
  331. }
  332. /** Return the number of circuits using an or_connection_t; this used to
  333. * be an or_connection_t field, but it got moved to channel_t and we
  334. * shouldn't maintain two copies. */
  335. MOCK_IMPL(int,
  336. connection_or_get_num_circuits, (or_connection_t *conn))
  337. {
  338. tor_assert(conn);
  339. if (conn->chan) {
  340. return channel_num_circuits(TLS_CHAN_TO_BASE(conn->chan));
  341. } else return 0;
  342. }
  343. /**************************************************************/
  344. /** Pack the cell_t host-order structure <b>src</b> into network-order
  345. * in the buffer <b>dest</b>. See tor-spec.txt for details about the
  346. * wire format.
  347. *
  348. * Note that this function doesn't touch <b>dst</b>-\>next: the caller
  349. * should set it or clear it as appropriate.
  350. */
  351. void
  352. cell_pack(packed_cell_t *dst, const cell_t *src, int wide_circ_ids)
  353. {
  354. char *dest = dst->body;
  355. if (wide_circ_ids) {
  356. set_uint32(dest, htonl(src->circ_id));
  357. dest += 4;
  358. } else {
  359. /* Clear the last two bytes of dest, in case we can accidentally
  360. * send them to the network somehow. */
  361. memset(dest+CELL_MAX_NETWORK_SIZE-2, 0, 2);
  362. set_uint16(dest, htons(src->circ_id));
  363. dest += 2;
  364. }
  365. set_uint8(dest, src->command);
  366. memcpy(dest+1, src->payload, CELL_PAYLOAD_SIZE);
  367. }
  368. /** Unpack the network-order buffer <b>src</b> into a host-order
  369. * cell_t structure <b>dest</b>.
  370. */
  371. static void
  372. cell_unpack(cell_t *dest, const char *src, int wide_circ_ids)
  373. {
  374. if (wide_circ_ids) {
  375. dest->circ_id = ntohl(get_uint32(src));
  376. src += 4;
  377. } else {
  378. dest->circ_id = ntohs(get_uint16(src));
  379. src += 2;
  380. }
  381. dest->command = get_uint8(src);
  382. memcpy(dest->payload, src+1, CELL_PAYLOAD_SIZE);
  383. }
  384. /** Write the header of <b>cell</b> into the first VAR_CELL_MAX_HEADER_SIZE
  385. * bytes of <b>hdr_out</b>. Returns number of bytes used. */
  386. int
  387. var_cell_pack_header(const var_cell_t *cell, char *hdr_out, int wide_circ_ids)
  388. {
  389. int r;
  390. if (wide_circ_ids) {
  391. set_uint32(hdr_out, htonl(cell->circ_id));
  392. hdr_out += 4;
  393. r = VAR_CELL_MAX_HEADER_SIZE;
  394. } else {
  395. set_uint16(hdr_out, htons(cell->circ_id));
  396. hdr_out += 2;
  397. r = VAR_CELL_MAX_HEADER_SIZE - 2;
  398. }
  399. set_uint8(hdr_out, cell->command);
  400. set_uint16(hdr_out+1, htons(cell->payload_len));
  401. return r;
  402. }
  403. /** Allocate and return a new var_cell_t with <b>payload_len</b> bytes of
  404. * payload space. */
  405. var_cell_t *
  406. var_cell_new(uint16_t payload_len)
  407. {
  408. size_t size = offsetof(var_cell_t, payload) + payload_len;
  409. var_cell_t *cell = tor_malloc_zero(size);
  410. cell->payload_len = payload_len;
  411. cell->command = 0;
  412. cell->circ_id = 0;
  413. return cell;
  414. }
  415. /**
  416. * Copy a var_cell_t
  417. */
  418. var_cell_t *
  419. var_cell_copy(const var_cell_t *src)
  420. {
  421. var_cell_t *copy = NULL;
  422. size_t size = 0;
  423. if (src != NULL) {
  424. size = offsetof(var_cell_t, payload) + src->payload_len;
  425. copy = tor_malloc_zero(size);
  426. copy->payload_len = src->payload_len;
  427. copy->command = src->command;
  428. copy->circ_id = src->circ_id;
  429. memcpy(copy->payload, src->payload, copy->payload_len);
  430. }
  431. return copy;
  432. }
  433. /** Release all space held by <b>cell</b>. */
  434. void
  435. var_cell_free(var_cell_t *cell)
  436. {
  437. tor_free(cell);
  438. }
  439. /** We've received an EOF from <b>conn</b>. Mark it for close and return. */
  440. int
  441. connection_or_reached_eof(or_connection_t *conn)
  442. {
  443. tor_assert(conn);
  444. log_info(LD_OR,"OR connection reached EOF. Closing.");
  445. connection_or_close_normally(conn, 1);
  446. return 0;
  447. }
  448. /** Handle any new bytes that have come in on connection <b>conn</b>.
  449. * If conn is in 'open' state, hand it to
  450. * connection_or_process_cells_from_inbuf()
  451. * (else do nothing).
  452. */
  453. int
  454. connection_or_process_inbuf(or_connection_t *conn)
  455. {
  456. /** Don't let the inbuf of a nonopen OR connection grow beyond this many
  457. * bytes: it's either a broken client, a non-Tor client, or a DOS
  458. * attempt. */
  459. #define MAX_OR_INBUF_WHEN_NONOPEN 0
  460. int ret = 0;
  461. tor_assert(conn);
  462. switch (conn->base_.state) {
  463. case OR_CONN_STATE_PROXY_HANDSHAKING:
  464. ret = connection_read_proxy_handshake(TO_CONN(conn));
  465. /* start TLS after handshake completion, or deal with error */
  466. if (ret == 1) {
  467. tor_assert(TO_CONN(conn)->proxy_state == PROXY_CONNECTED);
  468. if (connection_tls_start_handshake(conn, 0) < 0)
  469. ret = -1;
  470. /* Touch the channel's active timestamp if there is one */
  471. if (conn->chan)
  472. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  473. }
  474. if (ret < 0) {
  475. connection_or_close_for_error(conn, 0);
  476. }
  477. return ret;
  478. case OR_CONN_STATE_TLS_SERVER_RENEGOTIATING:
  479. case OR_CONN_STATE_OPEN:
  480. case OR_CONN_STATE_OR_HANDSHAKING_V2:
  481. case OR_CONN_STATE_OR_HANDSHAKING_V3:
  482. return connection_or_process_cells_from_inbuf(conn);
  483. default:
  484. break; /* don't do anything */
  485. }
  486. /* This check was necessary with 0.2.2, when the TLS_SERVER_RENEGOTIATING
  487. * check would otherwise just let data accumulate. It serves no purpose
  488. * in 0.2.3.
  489. *
  490. * XXXX Remove this check once we verify that the above paragraph is
  491. * 100% true. */
  492. if (buf_datalen(conn->base_.inbuf) > MAX_OR_INBUF_WHEN_NONOPEN) {
  493. log_fn(LOG_PROTOCOL_WARN, LD_NET, "Accumulated too much data (%d bytes) "
  494. "on nonopen OR connection %s %s:%u in state %s; closing.",
  495. (int)buf_datalen(conn->base_.inbuf),
  496. connection_or_nonopen_was_started_here(conn) ? "to" : "from",
  497. conn->base_.address, conn->base_.port,
  498. conn_state_to_string(conn->base_.type, conn->base_.state));
  499. connection_or_close_for_error(conn, 0);
  500. ret = -1;
  501. }
  502. return ret;
  503. }
  504. /** Called whenever we have flushed some data on an or_conn: add more data
  505. * from active circuits. */
  506. int
  507. connection_or_flushed_some(or_connection_t *conn)
  508. {
  509. size_t datalen;
  510. /* The channel will want to update its estimated queue size */
  511. channel_update_xmit_queue_size(TLS_CHAN_TO_BASE(conn->chan));
  512. /* If we're under the low water mark, add cells until we're just over the
  513. * high water mark. */
  514. datalen = connection_get_outbuf_len(TO_CONN(conn));
  515. if (datalen < OR_CONN_LOWWATER) {
  516. /* Let the scheduler know */
  517. scheduler_channel_wants_writes(TLS_CHAN_TO_BASE(conn->chan));
  518. }
  519. return 0;
  520. }
  521. /** This is for channeltls.c to ask how many cells we could accept if
  522. * they were available. */
  523. ssize_t
  524. connection_or_num_cells_writeable(or_connection_t *conn)
  525. {
  526. size_t datalen, cell_network_size;
  527. ssize_t n = 0;
  528. tor_assert(conn);
  529. /*
  530. * If we're under the high water mark, we're potentially
  531. * writeable; note this is different from the calculation above
  532. * used to trigger when to start writing after we've stopped.
  533. */
  534. datalen = connection_get_outbuf_len(TO_CONN(conn));
  535. if (datalen < OR_CONN_HIGHWATER) {
  536. cell_network_size = get_cell_network_size(conn->wide_circ_ids);
  537. n = CEIL_DIV(OR_CONN_HIGHWATER - datalen, cell_network_size);
  538. }
  539. return n;
  540. }
  541. /** Connection <b>conn</b> has finished writing and has no bytes left on
  542. * its outbuf.
  543. *
  544. * Otherwise it's in state "open": stop writing and return.
  545. *
  546. * If <b>conn</b> is broken, mark it for close and return -1, else
  547. * return 0.
  548. */
  549. int
  550. connection_or_finished_flushing(or_connection_t *conn)
  551. {
  552. tor_assert(conn);
  553. assert_connection_ok(TO_CONN(conn),0);
  554. switch (conn->base_.state) {
  555. case OR_CONN_STATE_PROXY_HANDSHAKING:
  556. case OR_CONN_STATE_OPEN:
  557. case OR_CONN_STATE_OR_HANDSHAKING_V2:
  558. case OR_CONN_STATE_OR_HANDSHAKING_V3:
  559. break;
  560. default:
  561. log_err(LD_BUG,"Called in unexpected state %d.", conn->base_.state);
  562. tor_fragile_assert();
  563. return -1;
  564. }
  565. return 0;
  566. }
  567. /** Connected handler for OR connections: begin the TLS handshake.
  568. */
  569. int
  570. connection_or_finished_connecting(or_connection_t *or_conn)
  571. {
  572. const int proxy_type = or_conn->proxy_type;
  573. connection_t *conn;
  574. tor_assert(or_conn);
  575. conn = TO_CONN(or_conn);
  576. tor_assert(conn->state == OR_CONN_STATE_CONNECTING);
  577. log_debug(LD_HANDSHAKE,"OR connect() to router at %s:%u finished.",
  578. conn->address,conn->port);
  579. control_event_bootstrap(BOOTSTRAP_STATUS_HANDSHAKE, 0);
  580. if (proxy_type != PROXY_NONE) {
  581. /* start proxy handshake */
  582. if (connection_proxy_connect(conn, proxy_type) < 0) {
  583. connection_or_close_for_error(or_conn, 0);
  584. return -1;
  585. }
  586. connection_start_reading(conn);
  587. connection_or_change_state(or_conn, OR_CONN_STATE_PROXY_HANDSHAKING);
  588. return 0;
  589. }
  590. if (connection_tls_start_handshake(or_conn, 0) < 0) {
  591. /* TLS handshaking error of some kind. */
  592. connection_or_close_for_error(or_conn, 0);
  593. return -1;
  594. }
  595. return 0;
  596. }
  597. /** Called when we're about to finally unlink and free an OR connection:
  598. * perform necessary accounting and cleanup */
  599. void
  600. connection_or_about_to_close(or_connection_t *or_conn)
  601. {
  602. time_t now = time(NULL);
  603. connection_t *conn = TO_CONN(or_conn);
  604. /* Tell the controlling channel we're closed */
  605. if (or_conn->chan) {
  606. channel_closed(TLS_CHAN_TO_BASE(or_conn->chan));
  607. /*
  608. * NULL this out because the channel might hang around a little
  609. * longer before channel_run_cleanup() gets it.
  610. */
  611. or_conn->chan->conn = NULL;
  612. or_conn->chan = NULL;
  613. }
  614. /* Remember why we're closing this connection. */
  615. if (conn->state != OR_CONN_STATE_OPEN) {
  616. /* now mark things down as needed */
  617. if (connection_or_nonopen_was_started_here(or_conn)) {
  618. const or_options_t *options = get_options();
  619. connection_or_note_state_when_broken(or_conn);
  620. rep_hist_note_connect_failed(or_conn->identity_digest, now);
  621. /* Tell the new guard API about the channel failure */
  622. entry_guard_chan_failed(TLS_CHAN_TO_BASE(or_conn->chan));
  623. if (conn->state >= OR_CONN_STATE_TLS_HANDSHAKING) {
  624. int reason = tls_error_to_orconn_end_reason(or_conn->tls_error);
  625. control_event_or_conn_status(or_conn, OR_CONN_EVENT_FAILED,
  626. reason);
  627. if (!authdir_mode_tests_reachability(options))
  628. control_event_bootstrap_prob_or(
  629. orconn_end_reason_to_control_string(reason),
  630. reason, or_conn);
  631. }
  632. }
  633. } else if (conn->hold_open_until_flushed) {
  634. /* We only set hold_open_until_flushed when we're intentionally
  635. * closing a connection. */
  636. rep_hist_note_disconnect(or_conn->identity_digest, now);
  637. control_event_or_conn_status(or_conn, OR_CONN_EVENT_CLOSED,
  638. tls_error_to_orconn_end_reason(or_conn->tls_error));
  639. } else if (!tor_digest_is_zero(or_conn->identity_digest)) {
  640. rep_hist_note_connection_died(or_conn->identity_digest, now);
  641. control_event_or_conn_status(or_conn, OR_CONN_EVENT_CLOSED,
  642. tls_error_to_orconn_end_reason(or_conn->tls_error));
  643. }
  644. }
  645. /** Return 1 if identity digest <b>id_digest</b> is known to be a
  646. * currently or recently running relay. Otherwise return 0. */
  647. int
  648. connection_or_digest_is_known_relay(const char *id_digest)
  649. {
  650. if (router_get_consensus_status_by_id(id_digest))
  651. return 1; /* It's in the consensus: "yes" */
  652. if (router_get_by_id_digest(id_digest))
  653. return 1; /* Not in the consensus, but we have a descriptor for
  654. * it. Probably it was in a recent consensus. "Yes". */
  655. return 0;
  656. }
  657. /** Set the per-conn read and write limits for <b>conn</b>. If it's a known
  658. * relay, we will rely on the global read and write buckets, so give it
  659. * per-conn limits that are big enough they'll never matter. But if it's
  660. * not a known relay, first check if we set PerConnBwRate/Burst, then
  661. * check if the consensus sets them, else default to 'big enough'.
  662. *
  663. * If <b>reset</b> is true, set the bucket to be full. Otherwise, just
  664. * clip the bucket if it happens to be <em>too</em> full.
  665. */
  666. static void
  667. connection_or_update_token_buckets_helper(or_connection_t *conn, int reset,
  668. const or_options_t *options)
  669. {
  670. int rate, burst; /* per-connection rate limiting params */
  671. if (connection_or_digest_is_known_relay(conn->identity_digest)) {
  672. /* It's in the consensus, or we have a descriptor for it meaning it
  673. * was probably in a recent consensus. It's a recognized relay:
  674. * give it full bandwidth. */
  675. rate = (int)options->BandwidthRate;
  676. burst = (int)options->BandwidthBurst;
  677. } else {
  678. /* Not a recognized relay. Squeeze it down based on the suggested
  679. * bandwidth parameters in the consensus, but allow local config
  680. * options to override. */
  681. rate = options->PerConnBWRate ? (int)options->PerConnBWRate :
  682. networkstatus_get_param(NULL, "perconnbwrate",
  683. (int)options->BandwidthRate, 1, INT32_MAX);
  684. burst = options->PerConnBWBurst ? (int)options->PerConnBWBurst :
  685. networkstatus_get_param(NULL, "perconnbwburst",
  686. (int)options->BandwidthBurst, 1, INT32_MAX);
  687. }
  688. conn->bandwidthrate = rate;
  689. conn->bandwidthburst = burst;
  690. if (reset) { /* set up the token buckets to be full */
  691. conn->read_bucket = conn->write_bucket = burst;
  692. return;
  693. }
  694. /* If the new token bucket is smaller, take out the extra tokens.
  695. * (If it's larger, don't -- the buckets can grow to reach the cap.) */
  696. if (conn->read_bucket > burst)
  697. conn->read_bucket = burst;
  698. if (conn->write_bucket > burst)
  699. conn->write_bucket = burst;
  700. }
  701. /** Either our set of relays or our per-conn rate limits have changed.
  702. * Go through all the OR connections and update their token buckets to make
  703. * sure they don't exceed their maximum values. */
  704. void
  705. connection_or_update_token_buckets(smartlist_t *conns,
  706. const or_options_t *options)
  707. {
  708. SMARTLIST_FOREACH(conns, connection_t *, conn,
  709. {
  710. if (connection_speaks_cells(conn))
  711. connection_or_update_token_buckets_helper(TO_OR_CONN(conn), 0, options);
  712. });
  713. }
  714. /* Mark <b>or_conn</b> as canonical if <b>is_canonical</b> is set, and
  715. * non-canonical otherwise. Adjust idle_timeout accordingly.
  716. */
  717. void
  718. connection_or_set_canonical(or_connection_t *or_conn,
  719. int is_canonical)
  720. {
  721. if (bool_eq(is_canonical, or_conn->is_canonical) &&
  722. or_conn->idle_timeout != 0) {
  723. /* Don't recalculate an existing idle_timeout unless the canonical
  724. * status changed. */
  725. return;
  726. }
  727. or_conn->is_canonical = !! is_canonical; /* force to a 1-bit boolean */
  728. or_conn->idle_timeout = channelpadding_get_channel_idle_timeout(
  729. TLS_CHAN_TO_BASE(or_conn->chan), is_canonical);
  730. log_info(LD_CIRC,
  731. "Channel " U64_FORMAT " chose an idle timeout of %d.",
  732. or_conn->chan ?
  733. U64_PRINTF_ARG(TLS_CHAN_TO_BASE(or_conn->chan)->global_identifier):0,
  734. or_conn->idle_timeout);
  735. }
  736. /** If we don't necessarily know the router we're connecting to, but we
  737. * have an addr/port/id_digest, then fill in as much as we can. Start
  738. * by checking to see if this describes a router we know.
  739. * <b>started_here</b> is 1 if we are the initiator of <b>conn</b> and
  740. * 0 if it's an incoming connection. */
  741. void
  742. connection_or_init_conn_from_address(or_connection_t *conn,
  743. const tor_addr_t *addr, uint16_t port,
  744. const char *id_digest,
  745. const ed25519_public_key_t *ed_id,
  746. int started_here)
  747. {
  748. log_debug(LD_HANDSHAKE, "init conn from address %s: %s, %s (%d)",
  749. fmt_addr(addr),
  750. hex_str((const char*)id_digest, DIGEST_LEN),
  751. ed25519_fmt(ed_id),
  752. started_here);
  753. connection_or_set_identity_digest(conn, id_digest, ed_id);
  754. connection_or_update_token_buckets_helper(conn, 1, get_options());
  755. conn->base_.port = port;
  756. tor_addr_copy(&conn->base_.addr, addr);
  757. tor_addr_copy(&conn->real_addr, addr);
  758. connection_or_check_canonicity(conn, started_here);
  759. }
  760. /** Check whether the identity of <b>conn</b> matches a known node. If it
  761. * does, check whether the address of conn matches the expected address, and
  762. * update the connection's is_canonical flag, nickname, and address fields as
  763. * appropriate. */
  764. static void
  765. connection_or_check_canonicity(or_connection_t *conn, int started_here)
  766. {
  767. const char *id_digest = conn->identity_digest;
  768. const ed25519_public_key_t *ed_id = NULL;
  769. const tor_addr_t *addr = &conn->real_addr;
  770. if (conn->chan)
  771. ed_id = & TLS_CHAN_TO_BASE(conn->chan)->ed25519_identity;
  772. const node_t *r = node_get_by_id(id_digest);
  773. if (r &&
  774. node_supports_ed25519_link_authentication(r) &&
  775. ! node_ed25519_id_matches(r, ed_id)) {
  776. /* If this node is capable of proving an ed25519 ID,
  777. * we can't call this a canonical connection unless both IDs match. */
  778. r = NULL;
  779. }
  780. if (r) {
  781. tor_addr_port_t node_ap;
  782. node_get_pref_orport(r, &node_ap);
  783. /* XXXX proposal 186 is making this more complex. For now, a conn
  784. is canonical when it uses the _preferred_ address. */
  785. if (tor_addr_eq(&conn->base_.addr, &node_ap.addr))
  786. connection_or_set_canonical(conn, 1);
  787. if (!started_here) {
  788. /* Override the addr/port, so our log messages will make sense.
  789. * This is dangerous, since if we ever try looking up a conn by
  790. * its actual addr/port, we won't remember. Careful! */
  791. /* XXXX arma: this is stupid, and it's the reason we need real_addr
  792. * to track is_canonical properly. What requires it? */
  793. /* XXXX <arma> i believe the reason we did this, originally, is because
  794. * we wanted to log what OR a connection was to, and if we logged the
  795. * right IP address and port 56244, that wouldn't be as helpful. now we
  796. * log the "right" port too, so we know if it's moria1 or moria2.
  797. */
  798. tor_addr_copy(&conn->base_.addr, &node_ap.addr);
  799. conn->base_.port = node_ap.port;
  800. }
  801. tor_free(conn->nickname);
  802. conn->nickname = tor_strdup(node_get_nickname(r));
  803. tor_free(conn->base_.address);
  804. conn->base_.address = tor_addr_to_str_dup(&node_ap.addr);
  805. } else {
  806. tor_free(conn->nickname);
  807. conn->nickname = tor_malloc(HEX_DIGEST_LEN+2);
  808. conn->nickname[0] = '$';
  809. base16_encode(conn->nickname+1, HEX_DIGEST_LEN+1,
  810. conn->identity_digest, DIGEST_LEN);
  811. tor_free(conn->base_.address);
  812. conn->base_.address = tor_addr_to_str_dup(addr);
  813. }
  814. /*
  815. * We have to tell channeltls.c to update the channel marks (local, in
  816. * particular), since we may have changed the address.
  817. */
  818. if (conn->chan) {
  819. channel_tls_update_marks(conn);
  820. }
  821. }
  822. /** These just pass all the is_bad_for_new_circs manipulation on to
  823. * channel_t */
  824. static unsigned int
  825. connection_or_is_bad_for_new_circs(or_connection_t *or_conn)
  826. {
  827. tor_assert(or_conn);
  828. if (or_conn->chan)
  829. return channel_is_bad_for_new_circs(TLS_CHAN_TO_BASE(or_conn->chan));
  830. else return 0;
  831. }
  832. static void
  833. connection_or_mark_bad_for_new_circs(or_connection_t *or_conn)
  834. {
  835. tor_assert(or_conn);
  836. if (or_conn->chan)
  837. channel_mark_bad_for_new_circs(TLS_CHAN_TO_BASE(or_conn->chan));
  838. }
  839. /** How old do we let a connection to an OR get before deciding it's
  840. * too old for new circuits? */
  841. #define TIME_BEFORE_OR_CONN_IS_TOO_OLD (60*60*24*7)
  842. /** Given a list of all the or_connections with a given
  843. * identity, set elements of that list as is_bad_for_new_circs as
  844. * appropriate. Helper for connection_or_set_bad_connections().
  845. *
  846. * Specifically, we set the is_bad_for_new_circs flag on:
  847. * - all connections if <b>force</b> is true.
  848. * - all connections that are too old.
  849. * - all open non-canonical connections for which a canonical connection
  850. * exists to the same router.
  851. * - all open canonical connections for which a 'better' canonical
  852. * connection exists to the same router.
  853. * - all open non-canonical connections for which a 'better' non-canonical
  854. * connection exists to the same router at the same address.
  855. *
  856. * See channel_is_better() in channel.c for our idea of what makes one OR
  857. * connection better than another.
  858. */
  859. void
  860. connection_or_group_set_badness_(smartlist_t *group, int force)
  861. {
  862. /* XXXX this function should be entirely about channels, not OR
  863. * XXXX connections. */
  864. or_connection_t *best = NULL;
  865. int n_old = 0, n_inprogress = 0, n_canonical = 0, n_other = 0;
  866. time_t now = time(NULL);
  867. /* Pass 1: expire everything that's old, and see what the status of
  868. * everything else is. */
  869. SMARTLIST_FOREACH_BEGIN(group, or_connection_t *, or_conn) {
  870. if (or_conn->base_.marked_for_close ||
  871. connection_or_is_bad_for_new_circs(or_conn))
  872. continue;
  873. if (force ||
  874. or_conn->base_.timestamp_created + TIME_BEFORE_OR_CONN_IS_TOO_OLD
  875. < now) {
  876. log_info(LD_OR,
  877. "Marking OR conn to %s:%d as too old for new circuits "
  878. "(fd "TOR_SOCKET_T_FORMAT", %d secs old).",
  879. or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
  880. (int)(now - or_conn->base_.timestamp_created));
  881. connection_or_mark_bad_for_new_circs(or_conn);
  882. }
  883. if (connection_or_is_bad_for_new_circs(or_conn)) {
  884. ++n_old;
  885. } else if (or_conn->base_.state != OR_CONN_STATE_OPEN) {
  886. ++n_inprogress;
  887. } else if (or_conn->is_canonical) {
  888. ++n_canonical;
  889. } else {
  890. ++n_other;
  891. }
  892. } SMARTLIST_FOREACH_END(or_conn);
  893. /* Pass 2: We know how about how good the best connection is.
  894. * expire everything that's worse, and find the very best if we can. */
  895. SMARTLIST_FOREACH_BEGIN(group, or_connection_t *, or_conn) {
  896. if (or_conn->base_.marked_for_close ||
  897. connection_or_is_bad_for_new_circs(or_conn))
  898. continue; /* This one doesn't need to be marked bad. */
  899. if (or_conn->base_.state != OR_CONN_STATE_OPEN)
  900. continue; /* Don't mark anything bad until we have seen what happens
  901. * when the connection finishes. */
  902. if (n_canonical && !or_conn->is_canonical) {
  903. /* We have at least one open canonical connection to this router,
  904. * and this one is open but not canonical. Mark it bad. */
  905. log_info(LD_OR,
  906. "Marking OR conn to %s:%d as unsuitable for new circuits: "
  907. "(fd "TOR_SOCKET_T_FORMAT", %d secs old). It is not "
  908. "canonical, and we have another connection to that OR that is.",
  909. or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
  910. (int)(now - or_conn->base_.timestamp_created));
  911. connection_or_mark_bad_for_new_circs(or_conn);
  912. continue;
  913. }
  914. if (!best ||
  915. channel_is_better(TLS_CHAN_TO_BASE(or_conn->chan),
  916. TLS_CHAN_TO_BASE(best->chan))) {
  917. best = or_conn;
  918. }
  919. } SMARTLIST_FOREACH_END(or_conn);
  920. if (!best)
  921. return;
  922. /* Pass 3: One connection to OR is best. If it's canonical, mark as bad
  923. * every other open connection. If it's non-canonical, mark as bad
  924. * every other open connection to the same address.
  925. *
  926. * XXXX This isn't optimal; if we have connections to an OR at multiple
  927. * addresses, we'd like to pick the best _for each address_, and mark as
  928. * bad every open connection that isn't best for its address. But this
  929. * can only occur in cases where the other OR is old (so we have no
  930. * canonical connection to it), or where all the connections to the OR are
  931. * at noncanonical addresses and we have no good direct connection (which
  932. * means we aren't at risk of attaching circuits to it anyway). As
  933. * 0.1.2.x dies out, the first case will go away, and the second one is
  934. * "mostly harmless", so a fix can wait until somebody is bored.
  935. */
  936. SMARTLIST_FOREACH_BEGIN(group, or_connection_t *, or_conn) {
  937. if (or_conn->base_.marked_for_close ||
  938. connection_or_is_bad_for_new_circs(or_conn) ||
  939. or_conn->base_.state != OR_CONN_STATE_OPEN)
  940. continue;
  941. if (or_conn != best &&
  942. channel_is_better(TLS_CHAN_TO_BASE(best->chan),
  943. TLS_CHAN_TO_BASE(or_conn->chan))) {
  944. /* This isn't the best conn, _and_ the best conn is better than it */
  945. if (best->is_canonical) {
  946. log_info(LD_OR,
  947. "Marking OR conn to %s:%d as unsuitable for new circuits: "
  948. "(fd "TOR_SOCKET_T_FORMAT", %d secs old). "
  949. "We have a better canonical one "
  950. "(fd "TOR_SOCKET_T_FORMAT"; %d secs old).",
  951. or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
  952. (int)(now - or_conn->base_.timestamp_created),
  953. best->base_.s, (int)(now - best->base_.timestamp_created));
  954. connection_or_mark_bad_for_new_circs(or_conn);
  955. } else if (!tor_addr_compare(&or_conn->real_addr,
  956. &best->real_addr, CMP_EXACT)) {
  957. log_info(LD_OR,
  958. "Marking OR conn to %s:%d as unsuitable for new circuits: "
  959. "(fd "TOR_SOCKET_T_FORMAT", %d secs old). We have a better "
  960. "one with the "
  961. "same address (fd "TOR_SOCKET_T_FORMAT"; %d secs old).",
  962. or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
  963. (int)(now - or_conn->base_.timestamp_created),
  964. best->base_.s, (int)(now - best->base_.timestamp_created));
  965. connection_or_mark_bad_for_new_circs(or_conn);
  966. }
  967. }
  968. } SMARTLIST_FOREACH_END(or_conn);
  969. }
  970. /** <b>conn</b> is in the 'connecting' state, and it failed to complete
  971. * a TCP connection. Send notifications appropriately.
  972. *
  973. * <b>reason</b> specifies the or_conn_end_reason for the failure;
  974. * <b>msg</b> specifies the strerror-style error message.
  975. */
  976. void
  977. connection_or_connect_failed(or_connection_t *conn,
  978. int reason, const char *msg)
  979. {
  980. control_event_or_conn_status(conn, OR_CONN_EVENT_FAILED, reason);
  981. if (!authdir_mode_tests_reachability(get_options()))
  982. control_event_bootstrap_prob_or(msg, reason, conn);
  983. }
  984. /** <b>conn</b> got an error in connection_handle_read_impl() or
  985. * connection_handle_write_impl() and is going to die soon.
  986. *
  987. * <b>reason</b> specifies the or_conn_end_reason for the failure;
  988. * <b>msg</b> specifies the strerror-style error message.
  989. */
  990. void
  991. connection_or_notify_error(or_connection_t *conn,
  992. int reason, const char *msg)
  993. {
  994. channel_t *chan;
  995. tor_assert(conn);
  996. /* If we're connecting, call connect_failed() too */
  997. if (TO_CONN(conn)->state == OR_CONN_STATE_CONNECTING)
  998. connection_or_connect_failed(conn, reason, msg);
  999. /* Tell the controlling channel if we have one */
  1000. if (conn->chan) {
  1001. chan = TLS_CHAN_TO_BASE(conn->chan);
  1002. /* Don't transition if we're already in closing, closed or error */
  1003. if (!CHANNEL_CONDEMNED(chan)) {
  1004. channel_close_for_error(chan);
  1005. }
  1006. }
  1007. /* No need to mark for error because connection.c is about to do that */
  1008. }
  1009. /** Launch a new OR connection to <b>addr</b>:<b>port</b> and expect to
  1010. * handshake with an OR with identity digest <b>id_digest</b>. Optionally,
  1011. * pass in a pointer to a channel using this connection.
  1012. *
  1013. * If <b>id_digest</b> is me, do nothing. If we're already connected to it,
  1014. * return that connection. If the connect() is in progress, set the
  1015. * new conn's state to 'connecting' and return it. If connect() succeeds,
  1016. * call connection_tls_start_handshake() on it.
  1017. *
  1018. * This function is called from router_retry_connections(), for
  1019. * ORs connecting to ORs, and circuit_establish_circuit(), for
  1020. * OPs connecting to ORs.
  1021. *
  1022. * Return the launched conn, or NULL if it failed.
  1023. */
  1024. MOCK_IMPL(or_connection_t *,
  1025. connection_or_connect, (const tor_addr_t *_addr, uint16_t port,
  1026. const char *id_digest,
  1027. const ed25519_public_key_t *ed_id,
  1028. channel_tls_t *chan))
  1029. {
  1030. or_connection_t *conn;
  1031. const or_options_t *options = get_options();
  1032. int socket_error = 0;
  1033. tor_addr_t addr;
  1034. int r;
  1035. tor_addr_t proxy_addr;
  1036. uint16_t proxy_port;
  1037. int proxy_type;
  1038. tor_assert(_addr);
  1039. tor_assert(id_digest);
  1040. tor_addr_copy(&addr, _addr);
  1041. if (server_mode(options) && router_digest_is_me(id_digest)) {
  1042. log_info(LD_PROTOCOL,"Client asked me to connect to myself. Refusing.");
  1043. return NULL;
  1044. }
  1045. if (server_mode(options) && router_ed25519_id_is_me(ed_id)) {
  1046. log_info(LD_PROTOCOL,"Client asked me to connect to myself by Ed25519 "
  1047. "identity. Refusing.");
  1048. return NULL;
  1049. }
  1050. conn = or_connection_new(CONN_TYPE_OR, tor_addr_family(&addr));
  1051. /*
  1052. * Set up conn so it's got all the data we need to remember for channels
  1053. *
  1054. * This stuff needs to happen before connection_or_init_conn_from_address()
  1055. * so connection_or_set_identity_digest() and such know where to look to
  1056. * keep the channel up to date.
  1057. */
  1058. conn->chan = chan;
  1059. chan->conn = conn;
  1060. connection_or_init_conn_from_address(conn, &addr, port, id_digest, ed_id, 1);
  1061. connection_or_change_state(conn, OR_CONN_STATE_CONNECTING);
  1062. control_event_or_conn_status(conn, OR_CONN_EVENT_LAUNCHED, 0);
  1063. conn->is_outgoing = 1;
  1064. /* If we are using a proxy server, find it and use it. */
  1065. r = get_proxy_addrport(&proxy_addr, &proxy_port, &proxy_type, TO_CONN(conn));
  1066. if (r == 0) {
  1067. conn->proxy_type = proxy_type;
  1068. if (proxy_type != PROXY_NONE) {
  1069. tor_addr_copy(&addr, &proxy_addr);
  1070. port = proxy_port;
  1071. conn->base_.proxy_state = PROXY_INFANT;
  1072. }
  1073. } else {
  1074. /* get_proxy_addrport() might fail if we have a Bridge line that
  1075. references a transport, but no ClientTransportPlugin lines
  1076. defining its transport proxy. If this is the case, let's try to
  1077. output a useful log message to the user. */
  1078. const char *transport_name =
  1079. find_transport_name_by_bridge_addrport(&TO_CONN(conn)->addr,
  1080. TO_CONN(conn)->port);
  1081. if (transport_name) {
  1082. log_warn(LD_GENERAL, "We were supposed to connect to bridge '%s' "
  1083. "using pluggable transport '%s', but we can't find a pluggable "
  1084. "transport proxy supporting '%s'. This can happen if you "
  1085. "haven't provided a ClientTransportPlugin line, or if "
  1086. "your pluggable transport proxy stopped running.",
  1087. fmt_addrport(&TO_CONN(conn)->addr, TO_CONN(conn)->port),
  1088. transport_name, transport_name);
  1089. control_event_bootstrap_prob_or(
  1090. "Can't connect to bridge",
  1091. END_OR_CONN_REASON_PT_MISSING,
  1092. conn);
  1093. } else {
  1094. log_warn(LD_GENERAL, "Tried to connect to '%s' through a proxy, but "
  1095. "the proxy address could not be found.",
  1096. fmt_addrport(&TO_CONN(conn)->addr, TO_CONN(conn)->port));
  1097. }
  1098. connection_free(TO_CONN(conn));
  1099. return NULL;
  1100. }
  1101. switch (connection_connect(TO_CONN(conn), conn->base_.address,
  1102. &addr, port, &socket_error)) {
  1103. case -1:
  1104. /* We failed to establish a connection probably because of a local
  1105. * error. No need to blame the guard in this case. Notify the networking
  1106. * system of this failure. */
  1107. connection_or_connect_failed(conn,
  1108. errno_to_orconn_end_reason(socket_error),
  1109. tor_socket_strerror(socket_error));
  1110. connection_free(TO_CONN(conn));
  1111. return NULL;
  1112. case 0:
  1113. connection_watch_events(TO_CONN(conn), READ_EVENT | WRITE_EVENT);
  1114. /* writable indicates finish, readable indicates broken link,
  1115. error indicates broken link on windows */
  1116. return conn;
  1117. /* case 1: fall through */
  1118. }
  1119. if (connection_or_finished_connecting(conn) < 0) {
  1120. /* already marked for close */
  1121. return NULL;
  1122. }
  1123. return conn;
  1124. }
  1125. /** Mark orconn for close and transition the associated channel, if any, to
  1126. * the closing state.
  1127. *
  1128. * It's safe to call this and connection_or_close_for_error() any time, and
  1129. * channel layer will treat it as a connection closing for reasons outside
  1130. * its control, like the remote end closing it. It can also be a local
  1131. * reason that's specific to connection_t/or_connection_t rather than
  1132. * the channel mechanism, such as expiration of old connections in
  1133. * run_connection_housekeeping(). If you want to close a channel_t
  1134. * from somewhere that logically works in terms of generic channels
  1135. * rather than connections, use channel_mark_for_close(); see also
  1136. * the comment on that function in channel.c.
  1137. */
  1138. void
  1139. connection_or_close_normally(or_connection_t *orconn, int flush)
  1140. {
  1141. channel_t *chan = NULL;
  1142. tor_assert(orconn);
  1143. if (flush) connection_mark_and_flush_internal(TO_CONN(orconn));
  1144. else connection_mark_for_close_internal(TO_CONN(orconn));
  1145. if (orconn->chan) {
  1146. chan = TLS_CHAN_TO_BASE(orconn->chan);
  1147. /* Don't transition if we're already in closing, closed or error */
  1148. if (!CHANNEL_CONDEMNED(chan)) {
  1149. channel_close_from_lower_layer(chan);
  1150. }
  1151. }
  1152. }
  1153. /** Mark orconn for close and transition the associated channel, if any, to
  1154. * the error state.
  1155. */
  1156. MOCK_IMPL(void,
  1157. connection_or_close_for_error,(or_connection_t *orconn, int flush))
  1158. {
  1159. channel_t *chan = NULL;
  1160. tor_assert(orconn);
  1161. if (flush) connection_mark_and_flush_internal(TO_CONN(orconn));
  1162. else connection_mark_for_close_internal(TO_CONN(orconn));
  1163. if (orconn->chan) {
  1164. chan = TLS_CHAN_TO_BASE(orconn->chan);
  1165. /* Don't transition if we're already in closing, closed or error */
  1166. if (!CHANNEL_CONDEMNED(chan)) {
  1167. channel_close_for_error(chan);
  1168. }
  1169. }
  1170. }
  1171. /** Begin the tls handshake with <b>conn</b>. <b>receiving</b> is 0 if
  1172. * we initiated the connection, else it's 1.
  1173. *
  1174. * Assign a new tls object to conn->tls, begin reading on <b>conn</b>, and
  1175. * pass <b>conn</b> to connection_tls_continue_handshake().
  1176. *
  1177. * Return -1 if <b>conn</b> is broken, else return 0.
  1178. */
  1179. MOCK_IMPL(int,
  1180. connection_tls_start_handshake,(or_connection_t *conn, int receiving))
  1181. {
  1182. channel_listener_t *chan_listener;
  1183. channel_t *chan;
  1184. /* Incoming connections will need a new channel passed to the
  1185. * channel_tls_listener */
  1186. if (receiving) {
  1187. /* It shouldn't already be set */
  1188. tor_assert(!(conn->chan));
  1189. chan_listener = channel_tls_get_listener();
  1190. if (!chan_listener) {
  1191. chan_listener = channel_tls_start_listener();
  1192. command_setup_listener(chan_listener);
  1193. }
  1194. chan = channel_tls_handle_incoming(conn);
  1195. channel_listener_queue_incoming(chan_listener, chan);
  1196. }
  1197. connection_or_change_state(conn, OR_CONN_STATE_TLS_HANDSHAKING);
  1198. tor_assert(!conn->tls);
  1199. conn->tls = tor_tls_new(conn->base_.s, receiving);
  1200. if (!conn->tls) {
  1201. log_warn(LD_BUG,"tor_tls_new failed. Closing.");
  1202. return -1;
  1203. }
  1204. tor_tls_set_logged_address(conn->tls, // XXX client and relay?
  1205. escaped_safe_str(conn->base_.address));
  1206. connection_start_reading(TO_CONN(conn));
  1207. log_debug(LD_HANDSHAKE,"starting TLS handshake on fd "TOR_SOCKET_T_FORMAT,
  1208. conn->base_.s);
  1209. if (connection_tls_continue_handshake(conn) < 0)
  1210. return -1;
  1211. return 0;
  1212. }
  1213. /** Block all future attempts to renegotiate on 'conn' */
  1214. void
  1215. connection_or_block_renegotiation(or_connection_t *conn)
  1216. {
  1217. tor_tls_t *tls = conn->tls;
  1218. if (!tls)
  1219. return;
  1220. tor_tls_set_renegotiate_callback(tls, NULL, NULL);
  1221. tor_tls_block_renegotiation(tls);
  1222. }
  1223. /** Invoked on the server side from inside tor_tls_read() when the server
  1224. * gets a successful TLS renegotiation from the client. */
  1225. static void
  1226. connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn)
  1227. {
  1228. or_connection_t *conn = _conn;
  1229. (void)tls;
  1230. /* Don't invoke this again. */
  1231. connection_or_block_renegotiation(conn);
  1232. if (connection_tls_finish_handshake(conn) < 0) {
  1233. /* XXXX_TLS double-check that it's ok to do this from inside read. */
  1234. /* XXXX_TLS double-check that this verifies certificates. */
  1235. connection_or_close_for_error(conn, 0);
  1236. }
  1237. }
  1238. /** Move forward with the tls handshake. If it finishes, hand
  1239. * <b>conn</b> to connection_tls_finish_handshake().
  1240. *
  1241. * Return -1 if <b>conn</b> is broken, else return 0.
  1242. */
  1243. int
  1244. connection_tls_continue_handshake(or_connection_t *conn)
  1245. {
  1246. int result;
  1247. check_no_tls_errors();
  1248. tor_assert(conn->base_.state == OR_CONN_STATE_TLS_HANDSHAKING);
  1249. // log_notice(LD_OR, "Continue handshake with %p", conn->tls);
  1250. result = tor_tls_handshake(conn->tls);
  1251. // log_notice(LD_OR, "Result: %d", result);
  1252. switch (result) {
  1253. CASE_TOR_TLS_ERROR_ANY:
  1254. log_info(LD_OR,"tls error [%s]. breaking connection.",
  1255. tor_tls_err_to_string(result));
  1256. return -1;
  1257. case TOR_TLS_DONE:
  1258. if (! tor_tls_used_v1_handshake(conn->tls)) {
  1259. if (!tor_tls_is_server(conn->tls)) {
  1260. tor_assert(conn->base_.state == OR_CONN_STATE_TLS_HANDSHAKING);
  1261. return connection_or_launch_v3_or_handshake(conn);
  1262. } else {
  1263. /* v2/v3 handshake, but we are not a client. */
  1264. log_debug(LD_OR, "Done with initial SSL handshake (server-side). "
  1265. "Expecting renegotiation or VERSIONS cell");
  1266. tor_tls_set_renegotiate_callback(conn->tls,
  1267. connection_or_tls_renegotiated_cb,
  1268. conn);
  1269. connection_or_change_state(conn,
  1270. OR_CONN_STATE_TLS_SERVER_RENEGOTIATING);
  1271. connection_stop_writing(TO_CONN(conn));
  1272. connection_start_reading(TO_CONN(conn));
  1273. return 0;
  1274. }
  1275. }
  1276. tor_assert(tor_tls_is_server(conn->tls));
  1277. return connection_tls_finish_handshake(conn);
  1278. case TOR_TLS_WANTWRITE:
  1279. connection_start_writing(TO_CONN(conn));
  1280. log_debug(LD_OR,"wanted write");
  1281. return 0;
  1282. case TOR_TLS_WANTREAD: /* handshaking conns are *always* reading */
  1283. log_debug(LD_OR,"wanted read");
  1284. return 0;
  1285. case TOR_TLS_CLOSE:
  1286. log_info(LD_OR,"tls closed. breaking connection.");
  1287. return -1;
  1288. }
  1289. return 0;
  1290. }
  1291. /** Return 1 if we initiated this connection, or 0 if it started
  1292. * out as an incoming connection.
  1293. */
  1294. int
  1295. connection_or_nonopen_was_started_here(or_connection_t *conn)
  1296. {
  1297. tor_assert(conn->base_.type == CONN_TYPE_OR ||
  1298. conn->base_.type == CONN_TYPE_EXT_OR);
  1299. if (!conn->tls)
  1300. return 1; /* it's still in proxy states or something */
  1301. if (conn->handshake_state)
  1302. return conn->handshake_state->started_here;
  1303. return !tor_tls_is_server(conn->tls);
  1304. }
  1305. /** <b>Conn</b> just completed its handshake. Return 0 if all is well, and
  1306. * return -1 if they are lying, broken, or otherwise something is wrong.
  1307. *
  1308. * If we initiated this connection (<b>started_here</b> is true), make sure
  1309. * the other side sent a correctly formed certificate. If I initiated the
  1310. * connection, make sure it's the right relay by checking the certificate.
  1311. *
  1312. * Otherwise (if we _didn't_ initiate this connection), it's okay for
  1313. * the certificate to be weird or absent.
  1314. *
  1315. * If we return 0, and the certificate is as expected, write a hash of the
  1316. * identity key into <b>digest_rcvd_out</b>, which must have DIGEST_LEN
  1317. * space in it.
  1318. * If the certificate is invalid or missing on an incoming connection,
  1319. * we return 0 and set <b>digest_rcvd_out</b> to DIGEST_LEN NUL bytes.
  1320. * (If we return -1, the contents of this buffer are undefined.)
  1321. *
  1322. * As side effects,
  1323. * 1) Set conn->circ_id_type according to tor-spec.txt.
  1324. * 2) If we're an authdirserver and we initiated the connection: drop all
  1325. * descriptors that claim to be on that IP/port but that aren't
  1326. * this relay; and note that this relay is reachable.
  1327. * 3) If this is a bridge and we didn't configure its identity
  1328. * fingerprint, remember the keyid we just learned.
  1329. */
  1330. static int
  1331. connection_or_check_valid_tls_handshake(or_connection_t *conn,
  1332. int started_here,
  1333. char *digest_rcvd_out)
  1334. {
  1335. crypto_pk_t *identity_rcvd=NULL;
  1336. const or_options_t *options = get_options();
  1337. int severity = server_mode(options) ? LOG_PROTOCOL_WARN : LOG_WARN;
  1338. const char *safe_address =
  1339. started_here ? conn->base_.address :
  1340. safe_str_client(conn->base_.address);
  1341. const char *conn_type = started_here ? "outgoing" : "incoming";
  1342. int has_cert = 0;
  1343. check_no_tls_errors();
  1344. has_cert = tor_tls_peer_has_cert(conn->tls);
  1345. if (started_here && !has_cert) {
  1346. log_info(LD_HANDSHAKE,"Tried connecting to router at %s:%d, but it didn't "
  1347. "send a cert! Closing.",
  1348. safe_address, conn->base_.port);
  1349. return -1;
  1350. } else if (!has_cert) {
  1351. log_debug(LD_HANDSHAKE,"Got incoming connection with no certificate. "
  1352. "That's ok.");
  1353. }
  1354. check_no_tls_errors();
  1355. if (has_cert) {
  1356. int v = tor_tls_verify(started_here?severity:LOG_INFO,
  1357. conn->tls, &identity_rcvd);
  1358. if (started_here && v<0) {
  1359. log_fn(severity,LD_HANDSHAKE,"Tried connecting to router at %s:%d: It"
  1360. " has a cert but it's invalid. Closing.",
  1361. safe_address, conn->base_.port);
  1362. return -1;
  1363. } else if (v<0) {
  1364. log_info(LD_HANDSHAKE,"Incoming connection gave us an invalid cert "
  1365. "chain; ignoring.");
  1366. } else {
  1367. log_debug(LD_HANDSHAKE,
  1368. "The certificate seems to be valid on %s connection "
  1369. "with %s:%d", conn_type, safe_address, conn->base_.port);
  1370. }
  1371. check_no_tls_errors();
  1372. }
  1373. if (identity_rcvd) {
  1374. if (crypto_pk_get_digest(identity_rcvd, digest_rcvd_out) < 0) {
  1375. crypto_pk_free(identity_rcvd);
  1376. return -1;
  1377. }
  1378. } else {
  1379. memset(digest_rcvd_out, 0, DIGEST_LEN);
  1380. }
  1381. tor_assert(conn->chan);
  1382. channel_set_circid_type(TLS_CHAN_TO_BASE(conn->chan), identity_rcvd, 1);
  1383. crypto_pk_free(identity_rcvd);
  1384. if (started_here) {
  1385. /* A TLS handshake can't teach us an Ed25519 ID, so we set it to NULL
  1386. * here. */
  1387. log_debug(LD_HANDSHAKE, "Calling client_learned_peer_id from "
  1388. "check_valid_tls_handshake");
  1389. return connection_or_client_learned_peer_id(conn,
  1390. (const uint8_t*)digest_rcvd_out,
  1391. NULL);
  1392. }
  1393. return 0;
  1394. }
  1395. /** Called when we (as a connection initiator) have definitively,
  1396. * authenticatedly, learned that ID of the Tor instance on the other
  1397. * side of <b>conn</b> is <b>rsa_peer_id</b> and optionally <b>ed_peer_id</b>.
  1398. * For v1 and v2 handshakes,
  1399. * this is right after we get a certificate chain in a TLS handshake
  1400. * or renegotiation. For v3+ handshakes, this is right after we get a
  1401. * certificate chain in a CERTS cell.
  1402. *
  1403. * If we did not know the ID before, record the one we got.
  1404. *
  1405. * If we wanted an ID, but we didn't get the one we expected, log a message
  1406. * and return -1.
  1407. * On relays:
  1408. * - log a protocol warning whenever the fingerprints don't match;
  1409. * On clients:
  1410. * - if a relay's fingerprint doesn't match, log a warning;
  1411. * - if we don't have updated relay fingerprints from a recent consensus, and
  1412. * a fallback directory mirror's hard-coded fingerprint has changed, log an
  1413. * info explaining that we will try another fallback.
  1414. *
  1415. * If we're testing reachability, remember what we learned.
  1416. *
  1417. * Return 0 on success, -1 on failure.
  1418. */
  1419. int
  1420. connection_or_client_learned_peer_id(or_connection_t *conn,
  1421. const uint8_t *rsa_peer_id,
  1422. const ed25519_public_key_t *ed_peer_id)
  1423. {
  1424. const or_options_t *options = get_options();
  1425. channel_tls_t *chan_tls = conn->chan;
  1426. channel_t *chan = channel_tls_to_base(chan_tls);
  1427. int changed_identity = 0;
  1428. tor_assert(chan);
  1429. const int expected_rsa_key =
  1430. ! tor_digest_is_zero(conn->identity_digest);
  1431. const int expected_ed_key =
  1432. ! ed25519_public_key_is_zero(&chan->ed25519_identity);
  1433. log_info(LD_HANDSHAKE, "learned peer id for %p (%s): %s, %s",
  1434. conn,
  1435. safe_str_client(conn->base_.address),
  1436. hex_str((const char*)rsa_peer_id, DIGEST_LEN),
  1437. ed25519_fmt(ed_peer_id));
  1438. if (! expected_rsa_key && ! expected_ed_key) {
  1439. log_info(LD_HANDSHAKE, "(we had no ID in mind when we made this "
  1440. "connection.");
  1441. connection_or_set_identity_digest(conn,
  1442. (const char*)rsa_peer_id, ed_peer_id);
  1443. tor_free(conn->nickname);
  1444. conn->nickname = tor_malloc(HEX_DIGEST_LEN+2);
  1445. conn->nickname[0] = '$';
  1446. base16_encode(conn->nickname+1, HEX_DIGEST_LEN+1,
  1447. conn->identity_digest, DIGEST_LEN);
  1448. log_info(LD_HANDSHAKE, "Connected to router %s at %s:%d without knowing "
  1449. "its key. Hoping for the best.",
  1450. conn->nickname, conn->base_.address, conn->base_.port);
  1451. /* if it's a bridge and we didn't know its identity fingerprint, now
  1452. * we do -- remember it for future attempts. */
  1453. learned_router_identity(&conn->base_.addr, conn->base_.port,
  1454. (const char*)rsa_peer_id, ed_peer_id);
  1455. changed_identity = 1;
  1456. }
  1457. const int rsa_mismatch = expected_rsa_key &&
  1458. tor_memneq(rsa_peer_id, conn->identity_digest, DIGEST_LEN);
  1459. /* It only counts as an ed25519 mismatch if we wanted an ed25519 identity
  1460. * and didn't get it. It's okay if we get one that we didn't ask for. */
  1461. const int ed25519_mismatch =
  1462. expected_ed_key &&
  1463. (ed_peer_id == NULL ||
  1464. ! ed25519_pubkey_eq(&chan->ed25519_identity, ed_peer_id));
  1465. if (rsa_mismatch || ed25519_mismatch) {
  1466. /* I was aiming for a particular digest. I didn't get it! */
  1467. char seen_rsa[HEX_DIGEST_LEN+1];
  1468. char expected_rsa[HEX_DIGEST_LEN+1];
  1469. char seen_ed[ED25519_BASE64_LEN+1];
  1470. char expected_ed[ED25519_BASE64_LEN+1];
  1471. base16_encode(seen_rsa, sizeof(seen_rsa),
  1472. (const char*)rsa_peer_id, DIGEST_LEN);
  1473. base16_encode(expected_rsa, sizeof(expected_rsa), conn->identity_digest,
  1474. DIGEST_LEN);
  1475. if (ed_peer_id) {
  1476. ed25519_public_to_base64(seen_ed, ed_peer_id);
  1477. } else {
  1478. strlcpy(seen_ed, "no ed25519 key", sizeof(seen_ed));
  1479. }
  1480. if (! ed25519_public_key_is_zero(&chan->ed25519_identity)) {
  1481. ed25519_public_to_base64(expected_ed, &chan->ed25519_identity);
  1482. } else {
  1483. strlcpy(expected_ed, "no ed25519 key", sizeof(expected_ed));
  1484. }
  1485. const int using_hardcoded_fingerprints =
  1486. !networkstatus_get_reasonably_live_consensus(time(NULL),
  1487. usable_consensus_flavor());
  1488. const int is_fallback_fingerprint = router_digest_is_fallback_dir(
  1489. conn->identity_digest);
  1490. const int is_authority_fingerprint = router_digest_is_trusted_dir(
  1491. conn->identity_digest);
  1492. int severity;
  1493. const char *extra_log = "";
  1494. if (server_mode(options)) {
  1495. severity = LOG_PROTOCOL_WARN;
  1496. } else {
  1497. if (using_hardcoded_fingerprints) {
  1498. /* We need to do the checks in this order, because the list of
  1499. * fallbacks includes the list of authorities */
  1500. if (is_authority_fingerprint) {
  1501. severity = LOG_WARN;
  1502. } else if (is_fallback_fingerprint) {
  1503. /* we expect a small number of fallbacks to change from their
  1504. * hard-coded fingerprints over the life of a release */
  1505. severity = LOG_INFO;
  1506. extra_log = " Tor will try a different fallback.";
  1507. } else {
  1508. /* it's a bridge, it's either a misconfiguration, or unexpected */
  1509. severity = LOG_WARN;
  1510. }
  1511. } else {
  1512. /* a relay has changed its fingerprint from the one in the consensus */
  1513. severity = LOG_WARN;
  1514. }
  1515. }
  1516. log_fn(severity, LD_HANDSHAKE,
  1517. "Tried connecting to router at %s:%d, but RSA identity key was not "
  1518. "as expected: wanted %s + %s but got %s + %s.%s",
  1519. conn->base_.address, conn->base_.port,
  1520. expected_rsa, expected_ed, seen_rsa, seen_ed, extra_log);
  1521. /* Tell the new guard API about the channel failure */
  1522. entry_guard_chan_failed(TLS_CHAN_TO_BASE(conn->chan));
  1523. control_event_or_conn_status(conn, OR_CONN_EVENT_FAILED,
  1524. END_OR_CONN_REASON_OR_IDENTITY);
  1525. if (!authdir_mode_tests_reachability(options))
  1526. control_event_bootstrap_prob_or(
  1527. "Unexpected identity in router certificate",
  1528. END_OR_CONN_REASON_OR_IDENTITY,
  1529. conn);
  1530. return -1;
  1531. }
  1532. if (!expected_ed_key && ed_peer_id) {
  1533. log_info(LD_HANDSHAKE, "(we had no Ed25519 ID in mind when we made this "
  1534. "connection.");
  1535. connection_or_set_identity_digest(conn,
  1536. (const char*)rsa_peer_id, ed_peer_id);
  1537. changed_identity = 1;
  1538. }
  1539. if (changed_identity) {
  1540. /* If we learned an identity for this connection, then we might have
  1541. * just discovered it to be canonical. */
  1542. connection_or_check_canonicity(conn, conn->handshake_state->started_here);
  1543. }
  1544. if (authdir_mode_tests_reachability(options)) {
  1545. dirserv_orconn_tls_done(&conn->base_.addr, conn->base_.port,
  1546. (const char*)rsa_peer_id, ed_peer_id);
  1547. }
  1548. return 0;
  1549. }
  1550. /** Return when we last used this channel for client activity (origin
  1551. * circuits). This is called from connection.c, since client_used is now one
  1552. * of the timestamps in channel_t */
  1553. time_t
  1554. connection_or_client_used(or_connection_t *conn)
  1555. {
  1556. tor_assert(conn);
  1557. if (conn->chan) {
  1558. return channel_when_last_client(TLS_CHAN_TO_BASE(conn->chan));
  1559. } else return 0;
  1560. }
  1561. /** The v1/v2 TLS handshake is finished.
  1562. *
  1563. * Make sure we are happy with the peer we just handshaked with.
  1564. *
  1565. * If they initiated the connection, make sure they're not already connected,
  1566. * then initialize conn from the information in router.
  1567. *
  1568. * If all is successful, call circuit_n_conn_done() to handle events
  1569. * that have been pending on the <tls handshake completion. Also set the
  1570. * directory to be dirty (only matters if I'm an authdirserver).
  1571. *
  1572. * If this is a v2 TLS handshake, send a versions cell.
  1573. */
  1574. static int
  1575. connection_tls_finish_handshake(or_connection_t *conn)
  1576. {
  1577. char digest_rcvd[DIGEST_LEN];
  1578. int started_here = connection_or_nonopen_was_started_here(conn);
  1579. tor_assert(!started_here);
  1580. log_debug(LD_HANDSHAKE,"%s tls handshake on %p with %s done, using "
  1581. "ciphersuite %s. verifying.",
  1582. started_here?"outgoing":"incoming",
  1583. conn,
  1584. safe_str_client(conn->base_.address),
  1585. tor_tls_get_ciphersuite_name(conn->tls));
  1586. if (connection_or_check_valid_tls_handshake(conn, started_here,
  1587. digest_rcvd) < 0)
  1588. return -1;
  1589. circuit_build_times_network_is_live(get_circuit_build_times_mutable());
  1590. if (tor_tls_used_v1_handshake(conn->tls)) {
  1591. conn->link_proto = 1;
  1592. connection_or_init_conn_from_address(conn, &conn->base_.addr,
  1593. conn->base_.port, digest_rcvd,
  1594. NULL, 0);
  1595. tor_tls_block_renegotiation(conn->tls);
  1596. rep_hist_note_negotiated_link_proto(1, started_here);
  1597. return connection_or_set_state_open(conn);
  1598. } else {
  1599. connection_or_change_state(conn, OR_CONN_STATE_OR_HANDSHAKING_V2);
  1600. if (connection_init_or_handshake_state(conn, started_here) < 0)
  1601. return -1;
  1602. connection_or_init_conn_from_address(conn, &conn->base_.addr,
  1603. conn->base_.port, digest_rcvd,
  1604. NULL, 0);
  1605. return connection_or_send_versions(conn, 0);
  1606. }
  1607. }
  1608. /**
  1609. * Called as client when initial TLS handshake is done, and we notice
  1610. * that we got a v3-handshake signalling certificate from the server.
  1611. * Set up structures, do bookkeeping, and send the versions cell.
  1612. * Return 0 on success and -1 on failure.
  1613. */
  1614. static int
  1615. connection_or_launch_v3_or_handshake(or_connection_t *conn)
  1616. {
  1617. tor_assert(connection_or_nonopen_was_started_here(conn));
  1618. circuit_build_times_network_is_live(get_circuit_build_times_mutable());
  1619. connection_or_change_state(conn, OR_CONN_STATE_OR_HANDSHAKING_V3);
  1620. if (connection_init_or_handshake_state(conn, 1) < 0)
  1621. return -1;
  1622. return connection_or_send_versions(conn, 1);
  1623. }
  1624. /** Allocate a new connection handshake state for the connection
  1625. * <b>conn</b>. Return 0 on success, -1 on failure. */
  1626. int
  1627. connection_init_or_handshake_state(or_connection_t *conn, int started_here)
  1628. {
  1629. or_handshake_state_t *s;
  1630. if (conn->handshake_state) {
  1631. log_warn(LD_BUG, "Duplicate call to connection_init_or_handshake_state!");
  1632. return 0;
  1633. }
  1634. s = conn->handshake_state = tor_malloc_zero(sizeof(or_handshake_state_t));
  1635. s->started_here = started_here ? 1 : 0;
  1636. s->digest_sent_data = 1;
  1637. s->digest_received_data = 1;
  1638. if (! started_here && get_current_link_cert_cert()) {
  1639. s->own_link_cert = tor_cert_dup(get_current_link_cert_cert());
  1640. }
  1641. s->certs = or_handshake_certs_new();
  1642. s->certs->started_here = s->started_here;
  1643. return 0;
  1644. }
  1645. /** Free all storage held by <b>state</b>. */
  1646. void
  1647. or_handshake_state_free(or_handshake_state_t *state)
  1648. {
  1649. if (!state)
  1650. return;
  1651. crypto_digest_free(state->digest_sent);
  1652. crypto_digest_free(state->digest_received);
  1653. or_handshake_certs_free(state->certs);
  1654. tor_cert_free(state->own_link_cert);
  1655. memwipe(state, 0xBE, sizeof(or_handshake_state_t));
  1656. tor_free(state);
  1657. }
  1658. /**
  1659. * Remember that <b>cell</b> has been transmitted (if <b>incoming</b> is
  1660. * false) or received (if <b>incoming</b> is true) during a V3 handshake using
  1661. * <b>state</b>.
  1662. *
  1663. * (We don't record the cell, but we keep a digest of everything sent or
  1664. * received during the v3 handshake, and the client signs it in an
  1665. * authenticate cell.)
  1666. */
  1667. void
  1668. or_handshake_state_record_cell(or_connection_t *conn,
  1669. or_handshake_state_t *state,
  1670. const cell_t *cell,
  1671. int incoming)
  1672. {
  1673. size_t cell_network_size = get_cell_network_size(conn->wide_circ_ids);
  1674. crypto_digest_t *d, **dptr;
  1675. packed_cell_t packed;
  1676. if (incoming) {
  1677. if (!state->digest_received_data)
  1678. return;
  1679. } else {
  1680. if (!state->digest_sent_data)
  1681. return;
  1682. }
  1683. if (!incoming) {
  1684. log_warn(LD_BUG, "We shouldn't be sending any non-variable-length cells "
  1685. "while making a handshake digest. But we think we are sending "
  1686. "one with type %d.", (int)cell->command);
  1687. }
  1688. dptr = incoming ? &state->digest_received : &state->digest_sent;
  1689. if (! *dptr)
  1690. *dptr = crypto_digest256_new(DIGEST_SHA256);
  1691. d = *dptr;
  1692. /* Re-packing like this is a little inefficient, but we don't have to do
  1693. this very often at all. */
  1694. cell_pack(&packed, cell, conn->wide_circ_ids);
  1695. crypto_digest_add_bytes(d, packed.body, cell_network_size);
  1696. memwipe(&packed, 0, sizeof(packed));
  1697. }
  1698. /** Remember that a variable-length <b>cell</b> has been transmitted (if
  1699. * <b>incoming</b> is false) or received (if <b>incoming</b> is true) during a
  1700. * V3 handshake using <b>state</b>.
  1701. *
  1702. * (We don't record the cell, but we keep a digest of everything sent or
  1703. * received during the v3 handshake, and the client signs it in an
  1704. * authenticate cell.)
  1705. */
  1706. void
  1707. or_handshake_state_record_var_cell(or_connection_t *conn,
  1708. or_handshake_state_t *state,
  1709. const var_cell_t *cell,
  1710. int incoming)
  1711. {
  1712. crypto_digest_t *d, **dptr;
  1713. int n;
  1714. char buf[VAR_CELL_MAX_HEADER_SIZE];
  1715. if (incoming) {
  1716. if (!state->digest_received_data)
  1717. return;
  1718. } else {
  1719. if (!state->digest_sent_data)
  1720. return;
  1721. }
  1722. dptr = incoming ? &state->digest_received : &state->digest_sent;
  1723. if (! *dptr)
  1724. *dptr = crypto_digest256_new(DIGEST_SHA256);
  1725. d = *dptr;
  1726. n = var_cell_pack_header(cell, buf, conn->wide_circ_ids);
  1727. crypto_digest_add_bytes(d, buf, n);
  1728. crypto_digest_add_bytes(d, (const char *)cell->payload, cell->payload_len);
  1729. memwipe(buf, 0, sizeof(buf));
  1730. }
  1731. /** Set <b>conn</b>'s state to OR_CONN_STATE_OPEN, and tell other subsystems
  1732. * as appropriate. Called when we are done with all TLS and OR handshaking.
  1733. */
  1734. int
  1735. connection_or_set_state_open(or_connection_t *conn)
  1736. {
  1737. connection_or_change_state(conn, OR_CONN_STATE_OPEN);
  1738. control_event_or_conn_status(conn, OR_CONN_EVENT_CONNECTED, 0);
  1739. or_handshake_state_free(conn->handshake_state);
  1740. conn->handshake_state = NULL;
  1741. connection_start_reading(TO_CONN(conn));
  1742. return 0;
  1743. }
  1744. /** Pack <b>cell</b> into wire-format, and write it onto <b>conn</b>'s outbuf.
  1745. * For cells that use or affect a circuit, this should only be called by
  1746. * connection_or_flush_from_first_active_circuit().
  1747. */
  1748. void
  1749. connection_or_write_cell_to_buf(const cell_t *cell, or_connection_t *conn)
  1750. {
  1751. packed_cell_t networkcell;
  1752. size_t cell_network_size = get_cell_network_size(conn->wide_circ_ids);
  1753. tor_assert(cell);
  1754. tor_assert(conn);
  1755. cell_pack(&networkcell, cell, conn->wide_circ_ids);
  1756. rep_hist_padding_count_write(PADDING_TYPE_TOTAL);
  1757. if (cell->command == CELL_PADDING)
  1758. rep_hist_padding_count_write(PADDING_TYPE_CELL);
  1759. connection_buf_add(networkcell.body, cell_network_size, TO_CONN(conn));
  1760. /* Touch the channel's active timestamp if there is one */
  1761. if (conn->chan) {
  1762. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  1763. if (TLS_CHAN_TO_BASE(conn->chan)->currently_padding) {
  1764. rep_hist_padding_count_write(PADDING_TYPE_ENABLED_TOTAL);
  1765. if (cell->command == CELL_PADDING)
  1766. rep_hist_padding_count_write(PADDING_TYPE_ENABLED_CELL);
  1767. }
  1768. }
  1769. if (conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3)
  1770. or_handshake_state_record_cell(conn, conn->handshake_state, cell, 0);
  1771. }
  1772. /** Pack a variable-length <b>cell</b> into wire-format, and write it onto
  1773. * <b>conn</b>'s outbuf. Right now, this <em>DOES NOT</em> support cells that
  1774. * affect a circuit.
  1775. */
  1776. MOCK_IMPL(void,
  1777. connection_or_write_var_cell_to_buf,(const var_cell_t *cell,
  1778. or_connection_t *conn))
  1779. {
  1780. int n;
  1781. char hdr[VAR_CELL_MAX_HEADER_SIZE];
  1782. tor_assert(cell);
  1783. tor_assert(conn);
  1784. n = var_cell_pack_header(cell, hdr, conn->wide_circ_ids);
  1785. connection_buf_add(hdr, n, TO_CONN(conn));
  1786. connection_buf_add((char*)cell->payload,
  1787. cell->payload_len, TO_CONN(conn));
  1788. if (conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3)
  1789. or_handshake_state_record_var_cell(conn, conn->handshake_state, cell, 0);
  1790. /* Touch the channel's active timestamp if there is one */
  1791. if (conn->chan)
  1792. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  1793. }
  1794. /** See whether there's a variable-length cell waiting on <b>or_conn</b>'s
  1795. * inbuf. Return values as for fetch_var_cell_from_buf(). */
  1796. static int
  1797. connection_fetch_var_cell_from_buf(or_connection_t *or_conn, var_cell_t **out)
  1798. {
  1799. connection_t *conn = TO_CONN(or_conn);
  1800. return fetch_var_cell_from_buf(conn->inbuf, out, or_conn->link_proto);
  1801. }
  1802. /** Process cells from <b>conn</b>'s inbuf.
  1803. *
  1804. * Loop: while inbuf contains a cell, pull it off the inbuf, unpack it,
  1805. * and hand it to command_process_cell().
  1806. *
  1807. * Always return 0.
  1808. */
  1809. static int
  1810. connection_or_process_cells_from_inbuf(or_connection_t *conn)
  1811. {
  1812. var_cell_t *var_cell;
  1813. /*
  1814. * Note on memory management for incoming cells: below the channel layer,
  1815. * we shouldn't need to consider its internal queueing/copying logic. It
  1816. * is safe to pass cells to it on the stack or on the heap, but in the
  1817. * latter case we must be sure we free them later.
  1818. *
  1819. * The incoming cell queue code in channel.c will (in the common case)
  1820. * decide it can pass them to the upper layer immediately, in which case
  1821. * those functions may run directly on the cell pointers we pass here, or
  1822. * it may decide to queue them, in which case it will allocate its own
  1823. * buffer and copy the cell.
  1824. */
  1825. while (1) {
  1826. log_debug(LD_OR,
  1827. TOR_SOCKET_T_FORMAT": starting, inbuf_datalen %d "
  1828. "(%d pending in tls object).",
  1829. conn->base_.s,(int)connection_get_inbuf_len(TO_CONN(conn)),
  1830. tor_tls_get_pending_bytes(conn->tls));
  1831. if (connection_fetch_var_cell_from_buf(conn, &var_cell)) {
  1832. if (!var_cell)
  1833. return 0; /* not yet. */
  1834. /* Touch the channel's active timestamp if there is one */
  1835. if (conn->chan)
  1836. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  1837. circuit_build_times_network_is_live(get_circuit_build_times_mutable());
  1838. channel_tls_handle_var_cell(var_cell, conn);
  1839. var_cell_free(var_cell);
  1840. } else {
  1841. const int wide_circ_ids = conn->wide_circ_ids;
  1842. size_t cell_network_size = get_cell_network_size(conn->wide_circ_ids);
  1843. char buf[CELL_MAX_NETWORK_SIZE];
  1844. cell_t cell;
  1845. if (connection_get_inbuf_len(TO_CONN(conn))
  1846. < cell_network_size) /* whole response available? */
  1847. return 0; /* not yet */
  1848. /* Touch the channel's active timestamp if there is one */
  1849. if (conn->chan)
  1850. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  1851. circuit_build_times_network_is_live(get_circuit_build_times_mutable());
  1852. connection_buf_get_bytes(buf, cell_network_size, TO_CONN(conn));
  1853. /* retrieve cell info from buf (create the host-order struct from the
  1854. * network-order string) */
  1855. cell_unpack(&cell, buf, wide_circ_ids);
  1856. channel_tls_handle_cell(&cell, conn);
  1857. }
  1858. }
  1859. }
  1860. /** Array of recognized link protocol versions. */
  1861. static const uint16_t or_protocol_versions[] = { 1, 2, 3, 4, 5 };
  1862. /** Number of versions in <b>or_protocol_versions</b>. */
  1863. static const int n_or_protocol_versions =
  1864. (int)( sizeof(or_protocol_versions)/sizeof(uint16_t) );
  1865. /** Return true iff <b>v</b> is a link protocol version that this Tor
  1866. * implementation believes it can support. */
  1867. int
  1868. is_or_protocol_version_known(uint16_t v)
  1869. {
  1870. int i;
  1871. for (i = 0; i < n_or_protocol_versions; ++i) {
  1872. if (or_protocol_versions[i] == v)
  1873. return 1;
  1874. }
  1875. return 0;
  1876. }
  1877. /** Send a VERSIONS cell on <b>conn</b>, telling the other host about the
  1878. * link protocol versions that this Tor can support.
  1879. *
  1880. * If <b>v3_plus</b>, this is part of a V3 protocol handshake, so only
  1881. * allow protocol version v3 or later. If not <b>v3_plus</b>, this is
  1882. * not part of a v3 protocol handshake, so don't allow protocol v3 or
  1883. * later.
  1884. **/
  1885. int
  1886. connection_or_send_versions(or_connection_t *conn, int v3_plus)
  1887. {
  1888. var_cell_t *cell;
  1889. int i;
  1890. int n_versions = 0;
  1891. const int min_version = v3_plus ? 3 : 0;
  1892. const int max_version = v3_plus ? UINT16_MAX : 2;
  1893. tor_assert(conn->handshake_state &&
  1894. !conn->handshake_state->sent_versions_at);
  1895. cell = var_cell_new(n_or_protocol_versions * 2);
  1896. cell->command = CELL_VERSIONS;
  1897. for (i = 0; i < n_or_protocol_versions; ++i) {
  1898. uint16_t v = or_protocol_versions[i];
  1899. if (v < min_version || v > max_version)
  1900. continue;
  1901. set_uint16(cell->payload+(2*n_versions), htons(v));
  1902. ++n_versions;
  1903. }
  1904. cell->payload_len = n_versions * 2;
  1905. connection_or_write_var_cell_to_buf(cell, conn);
  1906. conn->handshake_state->sent_versions_at = time(NULL);
  1907. var_cell_free(cell);
  1908. return 0;
  1909. }
  1910. /** Send a NETINFO cell on <b>conn</b>, telling the other server what we know
  1911. * about their address, our address, and the current time. */
  1912. MOCK_IMPL(int,
  1913. connection_or_send_netinfo,(or_connection_t *conn))
  1914. {
  1915. cell_t cell;
  1916. time_t now = time(NULL);
  1917. const routerinfo_t *me;
  1918. int len;
  1919. uint8_t *out;
  1920. tor_assert(conn->handshake_state);
  1921. if (conn->handshake_state->sent_netinfo) {
  1922. log_warn(LD_BUG, "Attempted to send an extra netinfo cell on a connection "
  1923. "where we already sent one.");
  1924. return 0;
  1925. }
  1926. memset(&cell, 0, sizeof(cell_t));
  1927. cell.command = CELL_NETINFO;
  1928. /* Timestamp, if we're a relay. */
  1929. if (public_server_mode(get_options()) || ! conn->is_outgoing)
  1930. set_uint32(cell.payload, htonl((uint32_t)now));
  1931. /* Their address. */
  1932. out = cell.payload + 4;
  1933. /* We use &conn->real_addr below, unless it hasn't yet been set. If it
  1934. * hasn't yet been set, we know that base_.addr hasn't been tampered with
  1935. * yet either. */
  1936. len = append_address_to_payload(out, !tor_addr_is_null(&conn->real_addr)
  1937. ? &conn->real_addr : &conn->base_.addr);
  1938. if (len<0)
  1939. return -1;
  1940. out += len;
  1941. /* My address -- only include it if I'm a public relay, or if I'm a
  1942. * bridge and this is an incoming connection. If I'm a bridge and this
  1943. * is an outgoing connection, act like a normal client and omit it. */
  1944. if ((public_server_mode(get_options()) || !conn->is_outgoing) &&
  1945. (me = router_get_my_routerinfo())) {
  1946. tor_addr_t my_addr;
  1947. *out++ = 1 + !tor_addr_is_null(&me->ipv6_addr);
  1948. tor_addr_from_ipv4h(&my_addr, me->addr);
  1949. len = append_address_to_payload(out, &my_addr);
  1950. if (len < 0)
  1951. return -1;
  1952. out += len;
  1953. if (!tor_addr_is_null(&me->ipv6_addr)) {
  1954. len = append_address_to_payload(out, &me->ipv6_addr);
  1955. if (len < 0)
  1956. return -1;
  1957. }
  1958. } else {
  1959. *out = 0;
  1960. }
  1961. conn->handshake_state->digest_sent_data = 0;
  1962. conn->handshake_state->sent_netinfo = 1;
  1963. connection_or_write_cell_to_buf(&cell, conn);
  1964. return 0;
  1965. }
  1966. /** Helper used to add an encoded certs to a cert cell */
  1967. static void
  1968. add_certs_cell_cert_helper(certs_cell_t *certs_cell,
  1969. uint8_t cert_type,
  1970. const uint8_t *cert_encoded,
  1971. size_t cert_len)
  1972. {
  1973. tor_assert(cert_len <= UINT16_MAX);
  1974. certs_cell_cert_t *ccc = certs_cell_cert_new();
  1975. ccc->cert_type = cert_type;
  1976. ccc->cert_len = cert_len;
  1977. certs_cell_cert_setlen_body(ccc, cert_len);
  1978. memcpy(certs_cell_cert_getarray_body(ccc), cert_encoded, cert_len);
  1979. certs_cell_add_certs(certs_cell, ccc);
  1980. }
  1981. /** Add an encoded X509 cert (stored as <b>cert_len</b> bytes at
  1982. * <b>cert_encoded</b>) to the trunnel certs_cell_t object that we are
  1983. * building in <b>certs_cell</b>. Set its type field to <b>cert_type</b>.
  1984. * (If <b>cert</b> is NULL, take no action.) */
  1985. static void
  1986. add_x509_cert(certs_cell_t *certs_cell,
  1987. uint8_t cert_type,
  1988. const tor_x509_cert_t *cert)
  1989. {
  1990. if (NULL == cert)
  1991. return;
  1992. const uint8_t *cert_encoded = NULL;
  1993. size_t cert_len;
  1994. tor_x509_cert_get_der(cert, &cert_encoded, &cert_len);
  1995. add_certs_cell_cert_helper(certs_cell, cert_type, cert_encoded, cert_len);
  1996. }
  1997. /** Add an Ed25519 cert from <b>cert</b> to the trunnel certs_cell_t object
  1998. * that we are building in <b>certs_cell</b>. Set its type field to
  1999. * <b>cert_type</b>. (If <b>cert</b> is NULL, take no action.) */
  2000. static void
  2001. add_ed25519_cert(certs_cell_t *certs_cell,
  2002. uint8_t cert_type,
  2003. const tor_cert_t *cert)
  2004. {
  2005. if (NULL == cert)
  2006. return;
  2007. add_certs_cell_cert_helper(certs_cell, cert_type,
  2008. cert->encoded, cert->encoded_len);
  2009. }
  2010. #ifdef TOR_UNIT_TESTS
  2011. int certs_cell_ed25519_disabled_for_testing = 0;
  2012. #else
  2013. #define certs_cell_ed25519_disabled_for_testing 0
  2014. #endif
  2015. /** Send a CERTS cell on the connection <b>conn</b>. Return 0 on success, -1
  2016. * on failure. */
  2017. int
  2018. connection_or_send_certs_cell(or_connection_t *conn)
  2019. {
  2020. const tor_x509_cert_t *global_link_cert = NULL, *id_cert = NULL;
  2021. tor_x509_cert_t *own_link_cert = NULL;
  2022. var_cell_t *cell;
  2023. certs_cell_t *certs_cell = NULL;
  2024. tor_assert(conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3);
  2025. if (! conn->handshake_state)
  2026. return -1;
  2027. const int conn_in_server_mode = ! conn->handshake_state->started_here;
  2028. /* Get the encoded values of the X509 certificates */
  2029. if (tor_tls_get_my_certs(conn_in_server_mode,
  2030. &global_link_cert, &id_cert) < 0)
  2031. return -1;
  2032. if (conn_in_server_mode) {
  2033. own_link_cert = tor_tls_get_own_cert(conn->tls);
  2034. }
  2035. tor_assert(id_cert);
  2036. certs_cell = certs_cell_new();
  2037. /* Start adding certs. First the link cert or auth1024 cert. */
  2038. if (conn_in_server_mode) {
  2039. tor_assert_nonfatal(own_link_cert);
  2040. add_x509_cert(certs_cell,
  2041. OR_CERT_TYPE_TLS_LINK, own_link_cert);
  2042. } else {
  2043. tor_assert(global_link_cert);
  2044. add_x509_cert(certs_cell,
  2045. OR_CERT_TYPE_AUTH_1024, global_link_cert);
  2046. }
  2047. /* Next the RSA->RSA ID cert */
  2048. add_x509_cert(certs_cell,
  2049. OR_CERT_TYPE_ID_1024, id_cert);
  2050. /* Next the Ed25519 certs */
  2051. add_ed25519_cert(certs_cell,
  2052. CERTTYPE_ED_ID_SIGN,
  2053. get_master_signing_key_cert());
  2054. if (conn_in_server_mode) {
  2055. tor_assert_nonfatal(conn->handshake_state->own_link_cert ||
  2056. certs_cell_ed25519_disabled_for_testing);
  2057. add_ed25519_cert(certs_cell,
  2058. CERTTYPE_ED_SIGN_LINK,
  2059. conn->handshake_state->own_link_cert);
  2060. } else {
  2061. add_ed25519_cert(certs_cell,
  2062. CERTTYPE_ED_SIGN_AUTH,
  2063. get_current_auth_key_cert());
  2064. }
  2065. /* And finally the crosscert. */
  2066. {
  2067. const uint8_t *crosscert=NULL;
  2068. size_t crosscert_len;
  2069. get_master_rsa_crosscert(&crosscert, &crosscert_len);
  2070. if (crosscert) {
  2071. add_certs_cell_cert_helper(certs_cell,
  2072. CERTTYPE_RSA1024_ID_EDID,
  2073. crosscert, crosscert_len);
  2074. }
  2075. }
  2076. /* We've added all the certs; make the cell. */
  2077. certs_cell->n_certs = certs_cell_getlen_certs(certs_cell);
  2078. ssize_t alloc_len = certs_cell_encoded_len(certs_cell);
  2079. tor_assert(alloc_len >= 0 && alloc_len <= UINT16_MAX);
  2080. cell = var_cell_new(alloc_len);
  2081. cell->command = CELL_CERTS;
  2082. ssize_t enc_len = certs_cell_encode(cell->payload, alloc_len, certs_cell);
  2083. tor_assert(enc_len > 0 && enc_len <= alloc_len);
  2084. cell->payload_len = enc_len;
  2085. connection_or_write_var_cell_to_buf(cell, conn);
  2086. var_cell_free(cell);
  2087. certs_cell_free(certs_cell);
  2088. tor_x509_cert_free(own_link_cert);
  2089. return 0;
  2090. }
  2091. /** Return true iff <b>challenge_type</b> is an AUTHCHALLENGE type that
  2092. * we can send and receive. */
  2093. int
  2094. authchallenge_type_is_supported(uint16_t challenge_type)
  2095. {
  2096. switch (challenge_type) {
  2097. case AUTHTYPE_RSA_SHA256_TLSSECRET:
  2098. case AUTHTYPE_ED25519_SHA256_RFC5705:
  2099. return 1;
  2100. case AUTHTYPE_RSA_SHA256_RFC5705:
  2101. default:
  2102. return 0;
  2103. }
  2104. }
  2105. /** Return true iff <b>challenge_type_a</b> is one that we would rather
  2106. * use than <b>challenge_type_b</b>. */
  2107. int
  2108. authchallenge_type_is_better(uint16_t challenge_type_a,
  2109. uint16_t challenge_type_b)
  2110. {
  2111. /* Any supported type is better than an unsupported one;
  2112. * all unsupported types are equally bad. */
  2113. if (!authchallenge_type_is_supported(challenge_type_a))
  2114. return 0;
  2115. if (!authchallenge_type_is_supported(challenge_type_b))
  2116. return 1;
  2117. /* It happens that types are superior in numerically ascending order.
  2118. * If that ever changes, this must change too. */
  2119. return (challenge_type_a > challenge_type_b);
  2120. }
  2121. /** Send an AUTH_CHALLENGE cell on the connection <b>conn</b>. Return 0
  2122. * on success, -1 on failure. */
  2123. int
  2124. connection_or_send_auth_challenge_cell(or_connection_t *conn)
  2125. {
  2126. var_cell_t *cell = NULL;
  2127. int r = -1;
  2128. tor_assert(conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3);
  2129. if (! conn->handshake_state)
  2130. return -1;
  2131. auth_challenge_cell_t *ac = auth_challenge_cell_new();
  2132. tor_assert(sizeof(ac->challenge) == 32);
  2133. crypto_rand((char*)ac->challenge, sizeof(ac->challenge));
  2134. auth_challenge_cell_add_methods(ac, AUTHTYPE_RSA_SHA256_TLSSECRET);
  2135. /* Disabled, because everything that supports this method also supports
  2136. * the much-superior ED25519_SHA256_RFC5705 */
  2137. /* auth_challenge_cell_add_methods(ac, AUTHTYPE_RSA_SHA256_RFC5705); */
  2138. auth_challenge_cell_add_methods(ac, AUTHTYPE_ED25519_SHA256_RFC5705);
  2139. auth_challenge_cell_set_n_methods(ac,
  2140. auth_challenge_cell_getlen_methods(ac));
  2141. cell = var_cell_new(auth_challenge_cell_encoded_len(ac));
  2142. ssize_t len = auth_challenge_cell_encode(cell->payload, cell->payload_len,
  2143. ac);
  2144. if (len != cell->payload_len) {
  2145. /* LCOV_EXCL_START */
  2146. log_warn(LD_BUG, "Encoded auth challenge cell length not as expected");
  2147. goto done;
  2148. /* LCOV_EXCL_STOP */
  2149. }
  2150. cell->command = CELL_AUTH_CHALLENGE;
  2151. connection_or_write_var_cell_to_buf(cell, conn);
  2152. r = 0;
  2153. done:
  2154. var_cell_free(cell);
  2155. auth_challenge_cell_free(ac);
  2156. return r;
  2157. }
  2158. /** Compute the main body of an AUTHENTICATE cell that a client can use
  2159. * to authenticate itself on a v3 handshake for <b>conn</b>. Return it
  2160. * in a var_cell_t.
  2161. *
  2162. * If <b>server</b> is true, only calculate the first
  2163. * V3_AUTH_FIXED_PART_LEN bytes -- the part of the authenticator that's
  2164. * determined by the rest of the handshake, and which match the provided value
  2165. * exactly.
  2166. *
  2167. * If <b>server</b> is false and <b>signing_key</b> is NULL, calculate the
  2168. * first V3_AUTH_BODY_LEN bytes of the authenticator (that is, everything
  2169. * that should be signed), but don't actually sign it.
  2170. *
  2171. * If <b>server</b> is false and <b>signing_key</b> is provided, calculate the
  2172. * entire authenticator, signed with <b>signing_key</b>.
  2173. *
  2174. * Return the length of the cell body on success, and -1 on failure.
  2175. */
  2176. var_cell_t *
  2177. connection_or_compute_authenticate_cell_body(or_connection_t *conn,
  2178. const int authtype,
  2179. crypto_pk_t *signing_key,
  2180. const ed25519_keypair_t *ed_signing_key,
  2181. int server)
  2182. {
  2183. auth1_t *auth = NULL;
  2184. auth_ctx_t *ctx = auth_ctx_new();
  2185. var_cell_t *result = NULL;
  2186. int old_tlssecrets_algorithm = 0;
  2187. const char *authtype_str = NULL;
  2188. int is_ed = 0;
  2189. /* assert state is reasonable XXXX */
  2190. switch (authtype) {
  2191. case AUTHTYPE_RSA_SHA256_TLSSECRET:
  2192. authtype_str = "AUTH0001";
  2193. old_tlssecrets_algorithm = 1;
  2194. break;
  2195. case AUTHTYPE_RSA_SHA256_RFC5705:
  2196. authtype_str = "AUTH0002";
  2197. break;
  2198. case AUTHTYPE_ED25519_SHA256_RFC5705:
  2199. authtype_str = "AUTH0003";
  2200. is_ed = 1;
  2201. break;
  2202. default:
  2203. tor_assert(0);
  2204. break;
  2205. }
  2206. auth = auth1_new();
  2207. ctx->is_ed = is_ed;
  2208. /* Type: 8 bytes. */
  2209. memcpy(auth1_getarray_type(auth), authtype_str, 8);
  2210. {
  2211. const tor_x509_cert_t *id_cert=NULL;
  2212. const common_digests_t *my_digests, *their_digests;
  2213. const uint8_t *my_id, *their_id, *client_id, *server_id;
  2214. if (tor_tls_get_my_certs(server, NULL, &id_cert))
  2215. goto err;
  2216. my_digests = tor_x509_cert_get_id_digests(id_cert);
  2217. their_digests =
  2218. tor_x509_cert_get_id_digests(conn->handshake_state->certs->id_cert);
  2219. tor_assert(my_digests);
  2220. tor_assert(their_digests);
  2221. my_id = (uint8_t*)my_digests->d[DIGEST_SHA256];
  2222. their_id = (uint8_t*)their_digests->d[DIGEST_SHA256];
  2223. client_id = server ? their_id : my_id;
  2224. server_id = server ? my_id : their_id;
  2225. /* Client ID digest: 32 octets. */
  2226. memcpy(auth->cid, client_id, 32);
  2227. /* Server ID digest: 32 octets. */
  2228. memcpy(auth->sid, server_id, 32);
  2229. }
  2230. if (is_ed) {
  2231. const ed25519_public_key_t *my_ed_id, *their_ed_id;
  2232. if (!conn->handshake_state->certs->ed_id_sign) {
  2233. log_warn(LD_OR, "Ed authenticate without Ed ID cert from peer.");
  2234. goto err;
  2235. }
  2236. my_ed_id = get_master_identity_key();
  2237. their_ed_id = &conn->handshake_state->certs->ed_id_sign->signing_key;
  2238. const uint8_t *cid_ed = (server ? their_ed_id : my_ed_id)->pubkey;
  2239. const uint8_t *sid_ed = (server ? my_ed_id : their_ed_id)->pubkey;
  2240. memcpy(auth->u1_cid_ed, cid_ed, ED25519_PUBKEY_LEN);
  2241. memcpy(auth->u1_sid_ed, sid_ed, ED25519_PUBKEY_LEN);
  2242. }
  2243. {
  2244. crypto_digest_t *server_d, *client_d;
  2245. if (server) {
  2246. server_d = conn->handshake_state->digest_sent;
  2247. client_d = conn->handshake_state->digest_received;
  2248. } else {
  2249. client_d = conn->handshake_state->digest_sent;
  2250. server_d = conn->handshake_state->digest_received;
  2251. }
  2252. /* Server log digest : 32 octets */
  2253. crypto_digest_get_digest(server_d, (char*)auth->slog, 32);
  2254. /* Client log digest : 32 octets */
  2255. crypto_digest_get_digest(client_d, (char*)auth->clog, 32);
  2256. }
  2257. {
  2258. /* Digest of cert used on TLS link : 32 octets. */
  2259. tor_x509_cert_t *cert = NULL;
  2260. if (server) {
  2261. cert = tor_tls_get_own_cert(conn->tls);
  2262. } else {
  2263. cert = tor_tls_get_peer_cert(conn->tls);
  2264. }
  2265. if (!cert) {
  2266. log_warn(LD_OR, "Unable to find cert when making %s data.",
  2267. authtype_str);
  2268. goto err;
  2269. }
  2270. memcpy(auth->scert,
  2271. tor_x509_cert_get_cert_digests(cert)->d[DIGEST_SHA256], 32);
  2272. tor_x509_cert_free(cert);
  2273. }
  2274. /* HMAC of clientrandom and serverrandom using master key : 32 octets */
  2275. if (old_tlssecrets_algorithm) {
  2276. tor_tls_get_tlssecrets(conn->tls, auth->tlssecrets);
  2277. } else {
  2278. char label[128];
  2279. tor_snprintf(label, sizeof(label),
  2280. "EXPORTER FOR TOR TLS CLIENT BINDING %s", authtype_str);
  2281. tor_tls_export_key_material(conn->tls, auth->tlssecrets,
  2282. auth->cid, sizeof(auth->cid),
  2283. label);
  2284. }
  2285. /* 8 octets were reserved for the current time, but we're trying to get out
  2286. * of the habit of sending time around willynilly. Fortunately, nothing
  2287. * checks it. That's followed by 16 bytes of nonce. */
  2288. crypto_rand((char*)auth->rand, 24);
  2289. ssize_t maxlen = auth1_encoded_len(auth, ctx);
  2290. if (ed_signing_key && is_ed) {
  2291. maxlen += ED25519_SIG_LEN;
  2292. } else if (signing_key && !is_ed) {
  2293. maxlen += crypto_pk_keysize(signing_key);
  2294. }
  2295. const int AUTH_CELL_HEADER_LEN = 4; /* 2 bytes of type, 2 bytes of length */
  2296. result = var_cell_new(AUTH_CELL_HEADER_LEN + maxlen);
  2297. uint8_t *const out = result->payload + AUTH_CELL_HEADER_LEN;
  2298. const size_t outlen = maxlen;
  2299. ssize_t len;
  2300. result->command = CELL_AUTHENTICATE;
  2301. set_uint16(result->payload, htons(authtype));
  2302. if ((len = auth1_encode(out, outlen, auth, ctx)) < 0) {
  2303. /* LCOV_EXCL_START */
  2304. log_warn(LD_BUG, "Unable to encode signed part of AUTH1 data.");
  2305. goto err;
  2306. /* LCOV_EXCL_STOP */
  2307. }
  2308. if (server) {
  2309. auth1_t *tmp = NULL;
  2310. ssize_t len2 = auth1_parse(&tmp, out, len, ctx);
  2311. if (!tmp) {
  2312. /* LCOV_EXCL_START */
  2313. log_warn(LD_BUG, "Unable to parse signed part of AUTH1 data that "
  2314. "we just encoded");
  2315. goto err;
  2316. /* LCOV_EXCL_STOP */
  2317. }
  2318. result->payload_len = (tmp->end_of_signed - result->payload);
  2319. auth1_free(tmp);
  2320. if (len2 != len) {
  2321. /* LCOV_EXCL_START */
  2322. log_warn(LD_BUG, "Mismatched length when re-parsing AUTH1 data.");
  2323. goto err;
  2324. /* LCOV_EXCL_STOP */
  2325. }
  2326. goto done;
  2327. }
  2328. if (ed_signing_key && is_ed) {
  2329. ed25519_signature_t sig;
  2330. if (ed25519_sign(&sig, out, len, ed_signing_key) < 0) {
  2331. /* LCOV_EXCL_START */
  2332. log_warn(LD_BUG, "Unable to sign ed25519 authentication data");
  2333. goto err;
  2334. /* LCOV_EXCL_STOP */
  2335. }
  2336. auth1_setlen_sig(auth, ED25519_SIG_LEN);
  2337. memcpy(auth1_getarray_sig(auth), sig.sig, ED25519_SIG_LEN);
  2338. } else if (signing_key && !is_ed) {
  2339. auth1_setlen_sig(auth, crypto_pk_keysize(signing_key));
  2340. char d[32];
  2341. crypto_digest256(d, (char*)out, len, DIGEST_SHA256);
  2342. int siglen = crypto_pk_private_sign(signing_key,
  2343. (char*)auth1_getarray_sig(auth),
  2344. auth1_getlen_sig(auth),
  2345. d, 32);
  2346. if (siglen < 0) {
  2347. log_warn(LD_OR, "Unable to sign AUTH1 data.");
  2348. goto err;
  2349. }
  2350. auth1_setlen_sig(auth, siglen);
  2351. }
  2352. len = auth1_encode(out, outlen, auth, ctx);
  2353. if (len < 0) {
  2354. /* LCOV_EXCL_START */
  2355. log_warn(LD_BUG, "Unable to encode signed AUTH1 data.");
  2356. goto err;
  2357. /* LCOV_EXCL_STOP */
  2358. }
  2359. tor_assert(len + AUTH_CELL_HEADER_LEN <= result->payload_len);
  2360. result->payload_len = len + AUTH_CELL_HEADER_LEN;
  2361. set_uint16(result->payload+2, htons(len));
  2362. goto done;
  2363. err:
  2364. var_cell_free(result);
  2365. result = NULL;
  2366. done:
  2367. auth1_free(auth);
  2368. auth_ctx_free(ctx);
  2369. return result;
  2370. }
  2371. /** Send an AUTHENTICATE cell on the connection <b>conn</b>. Return 0 on
  2372. * success, -1 on failure */
  2373. MOCK_IMPL(int,
  2374. connection_or_send_authenticate_cell,(or_connection_t *conn, int authtype))
  2375. {
  2376. var_cell_t *cell;
  2377. crypto_pk_t *pk = tor_tls_get_my_client_auth_key();
  2378. /* XXXX make sure we're actually supposed to send this! */
  2379. if (!pk) {
  2380. log_warn(LD_BUG, "Can't compute authenticate cell: no client auth key");
  2381. return -1;
  2382. }
  2383. if (! authchallenge_type_is_supported(authtype)) {
  2384. log_warn(LD_BUG, "Tried to send authenticate cell with unknown "
  2385. "authentication type %d", authtype);
  2386. return -1;
  2387. }
  2388. cell = connection_or_compute_authenticate_cell_body(conn,
  2389. authtype,
  2390. pk,
  2391. get_current_auth_keypair(),
  2392. 0 /* not server */);
  2393. if (! cell) {
  2394. /* LCOV_EXCL_START */
  2395. log_warn(LD_BUG, "Unable to compute authenticate cell!");
  2396. return -1;
  2397. /* LCOV_EXCL_STOP */
  2398. }
  2399. connection_or_write_var_cell_to_buf(cell, conn);
  2400. var_cell_free(cell);
  2401. return 0;
  2402. }