connection_edge.c 112 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2013, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file connection_edge.c
  8. * \brief Handle edge streams.
  9. **/
  10. #define CONNECTION_EDGE_PRIVATE
  11. #include "or.h"
  12. #include "addressmap.h"
  13. #include "buffers.h"
  14. #include "channel.h"
  15. #include "circuitlist.h"
  16. #include "circuituse.h"
  17. #include "config.h"
  18. #include "connection.h"
  19. #include "connection_edge.h"
  20. #include "connection_or.h"
  21. #include "control.h"
  22. #include "dns.h"
  23. #include "dnsserv.h"
  24. #include "dirserv.h"
  25. #include "hibernate.h"
  26. #include "main.h"
  27. #include "nodelist.h"
  28. #include "policies.h"
  29. #include "reasons.h"
  30. #include "relay.h"
  31. #include "rendclient.h"
  32. #include "rendcommon.h"
  33. #include "rendservice.h"
  34. #include "rephist.h"
  35. #include "router.h"
  36. #include "routerlist.h"
  37. #include "routerset.h"
  38. #include "circuitbuild.h"
  39. #ifdef HAVE_LINUX_TYPES_H
  40. #include <linux/types.h>
  41. #endif
  42. #ifdef HAVE_LINUX_NETFILTER_IPV4_H
  43. #include <linux/netfilter_ipv4.h>
  44. #define TRANS_NETFILTER
  45. #endif
  46. #if defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H)
  47. #include <net/if.h>
  48. #include <net/pfvar.h>
  49. #define TRANS_PF
  50. #endif
  51. #define SOCKS4_GRANTED 90
  52. #define SOCKS4_REJECT 91
  53. static int connection_ap_handshake_process_socks(entry_connection_t *conn);
  54. static int connection_ap_process_natd(entry_connection_t *conn);
  55. static int connection_exit_connect_dir(edge_connection_t *exitconn);
  56. static int consider_plaintext_ports(entry_connection_t *conn, uint16_t port);
  57. static int connection_ap_supports_optimistic_data(const entry_connection_t *);
  58. /** An AP stream has failed/finished. If it hasn't already sent back
  59. * a socks reply, send one now (based on endreason). Also set
  60. * has_sent_end to 1, and mark the conn.
  61. */
  62. void
  63. connection_mark_unattached_ap_(entry_connection_t *conn, int endreason,
  64. int line, const char *file)
  65. {
  66. connection_t *base_conn = ENTRY_TO_CONN(conn);
  67. edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(conn);
  68. tor_assert(base_conn->type == CONN_TYPE_AP);
  69. ENTRY_TO_EDGE_CONN(conn)->edge_has_sent_end = 1; /* no circ yet */
  70. /* If this is a rendezvous stream and it is failing without ever
  71. * being attached to a circuit, assume that an attempt to connect to
  72. * the destination hidden service has just ended.
  73. *
  74. * XXXX This condition doesn't limit to only streams failing
  75. * without ever being attached. That sloppiness should be harmless,
  76. * but we should fix it someday anyway. */
  77. if ((edge_conn->on_circuit != NULL || edge_conn->edge_has_sent_end) &&
  78. connection_edge_is_rendezvous_stream(edge_conn)) {
  79. rend_client_note_connection_attempt_ended(
  80. edge_conn->rend_data->onion_address);
  81. }
  82. if (base_conn->marked_for_close) {
  83. /* This call will warn as appropriate. */
  84. connection_mark_for_close_(base_conn, line, file);
  85. return;
  86. }
  87. if (!conn->socks_request->has_finished) {
  88. if (endreason & END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED)
  89. log_warn(LD_BUG,
  90. "stream (marked at %s:%d) sending two socks replies?",
  91. file, line);
  92. if (SOCKS_COMMAND_IS_CONNECT(conn->socks_request->command))
  93. connection_ap_handshake_socks_reply(conn, NULL, 0, endreason);
  94. else if (SOCKS_COMMAND_IS_RESOLVE(conn->socks_request->command))
  95. connection_ap_handshake_socks_resolved(conn,
  96. RESOLVED_TYPE_ERROR_TRANSIENT,
  97. 0, NULL, -1, -1);
  98. else /* unknown or no handshake at all. send no response. */
  99. conn->socks_request->has_finished = 1;
  100. }
  101. connection_mark_and_flush_(base_conn, line, file);
  102. ENTRY_TO_EDGE_CONN(conn)->end_reason = endreason;
  103. }
  104. /** There was an EOF. Send an end and mark the connection for close.
  105. */
  106. int
  107. connection_edge_reached_eof(edge_connection_t *conn)
  108. {
  109. if (connection_get_inbuf_len(TO_CONN(conn)) &&
  110. connection_state_is_open(TO_CONN(conn))) {
  111. /* it still has stuff to process. don't let it die yet. */
  112. return 0;
  113. }
  114. log_info(LD_EDGE,"conn (fd "TOR_SOCKET_T_FORMAT") reached eof. Closing.",
  115. conn->base_.s);
  116. if (!conn->base_.marked_for_close) {
  117. /* only mark it if not already marked. it's possible to
  118. * get the 'end' right around when the client hangs up on us. */
  119. connection_edge_end(conn, END_STREAM_REASON_DONE);
  120. if (conn->base_.type == CONN_TYPE_AP) {
  121. /* eof, so don't send a socks reply back */
  122. if (EDGE_TO_ENTRY_CONN(conn)->socks_request)
  123. EDGE_TO_ENTRY_CONN(conn)->socks_request->has_finished = 1;
  124. }
  125. connection_mark_for_close(TO_CONN(conn));
  126. }
  127. return 0;
  128. }
  129. /** Handle new bytes on conn->inbuf based on state:
  130. * - If it's waiting for socks info, try to read another step of the
  131. * socks handshake out of conn->inbuf.
  132. * - If it's waiting for the original destination, fetch it.
  133. * - If it's open, then package more relay cells from the stream.
  134. * - Else, leave the bytes on inbuf alone for now.
  135. *
  136. * Mark and return -1 if there was an unexpected error with the conn,
  137. * else return 0.
  138. */
  139. int
  140. connection_edge_process_inbuf(edge_connection_t *conn, int package_partial)
  141. {
  142. tor_assert(conn);
  143. switch (conn->base_.state) {
  144. case AP_CONN_STATE_SOCKS_WAIT:
  145. if (connection_ap_handshake_process_socks(EDGE_TO_ENTRY_CONN(conn)) <0) {
  146. /* already marked */
  147. return -1;
  148. }
  149. return 0;
  150. case AP_CONN_STATE_NATD_WAIT:
  151. if (connection_ap_process_natd(EDGE_TO_ENTRY_CONN(conn)) < 0) {
  152. /* already marked */
  153. return -1;
  154. }
  155. return 0;
  156. case AP_CONN_STATE_OPEN:
  157. case EXIT_CONN_STATE_OPEN:
  158. if (connection_edge_package_raw_inbuf(conn, package_partial, NULL) < 0) {
  159. /* (We already sent an end cell if possible) */
  160. connection_mark_for_close(TO_CONN(conn));
  161. return -1;
  162. }
  163. return 0;
  164. case AP_CONN_STATE_CONNECT_WAIT:
  165. if (connection_ap_supports_optimistic_data(EDGE_TO_ENTRY_CONN(conn))) {
  166. log_info(LD_EDGE,
  167. "data from edge while in '%s' state. Sending it anyway. "
  168. "package_partial=%d, buflen=%ld",
  169. conn_state_to_string(conn->base_.type, conn->base_.state),
  170. package_partial,
  171. (long)connection_get_inbuf_len(TO_CONN(conn)));
  172. if (connection_edge_package_raw_inbuf(conn, package_partial, NULL)<0) {
  173. /* (We already sent an end cell if possible) */
  174. connection_mark_for_close(TO_CONN(conn));
  175. return -1;
  176. }
  177. return 0;
  178. }
  179. /* Fall through if the connection is on a circuit without optimistic
  180. * data support. */
  181. case EXIT_CONN_STATE_CONNECTING:
  182. case AP_CONN_STATE_RENDDESC_WAIT:
  183. case AP_CONN_STATE_CIRCUIT_WAIT:
  184. case AP_CONN_STATE_RESOLVE_WAIT:
  185. case AP_CONN_STATE_CONTROLLER_WAIT:
  186. log_info(LD_EDGE,
  187. "data from edge while in '%s' state. Leaving it on buffer.",
  188. conn_state_to_string(conn->base_.type, conn->base_.state));
  189. return 0;
  190. }
  191. log_warn(LD_BUG,"Got unexpected state %d. Closing.",conn->base_.state);
  192. tor_fragile_assert();
  193. connection_edge_end(conn, END_STREAM_REASON_INTERNAL);
  194. connection_mark_for_close(TO_CONN(conn));
  195. return -1;
  196. }
  197. /** This edge needs to be closed, because its circuit has closed.
  198. * Mark it for close and return 0.
  199. */
  200. int
  201. connection_edge_destroy(circid_t circ_id, edge_connection_t *conn)
  202. {
  203. if (!conn->base_.marked_for_close) {
  204. log_info(LD_EDGE, "CircID %u: At an edge. Marking connection for close.",
  205. (unsigned) circ_id);
  206. if (conn->base_.type == CONN_TYPE_AP) {
  207. entry_connection_t *entry_conn = EDGE_TO_ENTRY_CONN(conn);
  208. connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_DESTROY);
  209. control_event_stream_bandwidth(conn);
  210. control_event_stream_status(entry_conn, STREAM_EVENT_CLOSED,
  211. END_STREAM_REASON_DESTROY);
  212. conn->end_reason |= END_STREAM_REASON_FLAG_ALREADY_SENT_CLOSED;
  213. } else {
  214. /* closing the circuit, nothing to send an END to */
  215. conn->edge_has_sent_end = 1;
  216. conn->end_reason = END_STREAM_REASON_DESTROY;
  217. conn->end_reason |= END_STREAM_REASON_FLAG_ALREADY_SENT_CLOSED;
  218. connection_mark_and_flush(TO_CONN(conn));
  219. }
  220. }
  221. conn->cpath_layer = NULL;
  222. conn->on_circuit = NULL;
  223. return 0;
  224. }
  225. /** Send a raw end cell to the stream with ID <b>stream_id</b> out over the
  226. * <b>circ</b> towards the hop identified with <b>cpath_layer</b>. If this
  227. * is not a client connection, set the relay end cell's reason for closing
  228. * as <b>reason</b> */
  229. static int
  230. relay_send_end_cell_from_edge(streamid_t stream_id, circuit_t *circ,
  231. uint8_t reason, crypt_path_t *cpath_layer)
  232. {
  233. char payload[1];
  234. if (CIRCUIT_PURPOSE_IS_CLIENT(circ->purpose)) {
  235. /* Never send the server an informative reason code; it doesn't need to
  236. * know why the client stream is failing. */
  237. reason = END_STREAM_REASON_MISC;
  238. }
  239. payload[0] = (char) reason;
  240. return relay_send_command_from_edge(stream_id, circ, RELAY_COMMAND_END,
  241. payload, 1, cpath_layer);
  242. }
  243. /** Send a relay end cell from stream <b>conn</b> down conn's circuit, and
  244. * remember that we've done so. If this is not a client connection, set the
  245. * relay end cell's reason for closing as <b>reason</b>.
  246. *
  247. * Return -1 if this function has already been called on this conn,
  248. * else return 0.
  249. */
  250. int
  251. connection_edge_end(edge_connection_t *conn, uint8_t reason)
  252. {
  253. char payload[RELAY_PAYLOAD_SIZE];
  254. size_t payload_len=1;
  255. circuit_t *circ;
  256. uint8_t control_reason = reason;
  257. if (conn->edge_has_sent_end) {
  258. log_warn(LD_BUG,"(Harmless.) Calling connection_edge_end (reason %d) "
  259. "on an already ended stream?", reason);
  260. tor_fragile_assert();
  261. return -1;
  262. }
  263. if (conn->base_.marked_for_close) {
  264. log_warn(LD_BUG,
  265. "called on conn that's already marked for close at %s:%d.",
  266. conn->base_.marked_for_close_file, conn->base_.marked_for_close);
  267. return 0;
  268. }
  269. circ = circuit_get_by_edge_conn(conn);
  270. if (circ && CIRCUIT_PURPOSE_IS_CLIENT(circ->purpose)) {
  271. /* If this is a client circuit, don't send the server an informative
  272. * reason code; it doesn't need to know why the client stream is
  273. * failing. */
  274. reason = END_STREAM_REASON_MISC;
  275. }
  276. payload[0] = (char)reason;
  277. if (reason == END_STREAM_REASON_EXITPOLICY &&
  278. !connection_edge_is_rendezvous_stream(conn)) {
  279. int addrlen;
  280. if (tor_addr_family(&conn->base_.addr) == AF_INET) {
  281. set_uint32(payload+1, tor_addr_to_ipv4n(&conn->base_.addr));
  282. addrlen = 4;
  283. } else {
  284. memcpy(payload+1, tor_addr_to_in6_addr8(&conn->base_.addr), 16);
  285. addrlen = 16;
  286. }
  287. set_uint32(payload+1+addrlen, htonl(dns_clip_ttl(conn->address_ttl)));
  288. payload_len += 4+addrlen;
  289. }
  290. if (circ && !circ->marked_for_close) {
  291. log_debug(LD_EDGE,"Sending end on conn (fd "TOR_SOCKET_T_FORMAT").",
  292. conn->base_.s);
  293. connection_edge_send_command(conn, RELAY_COMMAND_END,
  294. payload, payload_len);
  295. } else {
  296. log_debug(LD_EDGE,"No circ to send end on conn "
  297. "(fd "TOR_SOCKET_T_FORMAT").",
  298. conn->base_.s);
  299. }
  300. conn->edge_has_sent_end = 1;
  301. conn->end_reason = control_reason;
  302. return 0;
  303. }
  304. /** An error has just occurred on an operation on an edge connection
  305. * <b>conn</b>. Extract the errno; convert it to an end reason, and send an
  306. * appropriate relay end cell to the other end of the connection's circuit.
  307. **/
  308. int
  309. connection_edge_end_errno(edge_connection_t *conn)
  310. {
  311. uint8_t reason;
  312. tor_assert(conn);
  313. reason = errno_to_stream_end_reason(tor_socket_errno(conn->base_.s));
  314. return connection_edge_end(conn, reason);
  315. }
  316. /** We just wrote some data to <b>conn</b>; act appropriately.
  317. *
  318. * (That is, if it's open, consider sending a stream-level sendme cell if we
  319. * have just flushed enough.)
  320. */
  321. int
  322. connection_edge_flushed_some(edge_connection_t *conn)
  323. {
  324. switch (conn->base_.state) {
  325. case AP_CONN_STATE_OPEN:
  326. case EXIT_CONN_STATE_OPEN:
  327. connection_edge_consider_sending_sendme(conn);
  328. break;
  329. }
  330. return 0;
  331. }
  332. /** Connection <b>conn</b> has finished writing and has no bytes left on
  333. * its outbuf.
  334. *
  335. * If it's in state 'open', stop writing, consider responding with a
  336. * sendme, and return.
  337. * Otherwise, stop writing and return.
  338. *
  339. * If <b>conn</b> is broken, mark it for close and return -1, else
  340. * return 0.
  341. */
  342. int
  343. connection_edge_finished_flushing(edge_connection_t *conn)
  344. {
  345. tor_assert(conn);
  346. switch (conn->base_.state) {
  347. case AP_CONN_STATE_OPEN:
  348. case EXIT_CONN_STATE_OPEN:
  349. connection_edge_consider_sending_sendme(conn);
  350. return 0;
  351. case AP_CONN_STATE_SOCKS_WAIT:
  352. case AP_CONN_STATE_NATD_WAIT:
  353. case AP_CONN_STATE_RENDDESC_WAIT:
  354. case AP_CONN_STATE_CIRCUIT_WAIT:
  355. case AP_CONN_STATE_CONNECT_WAIT:
  356. case AP_CONN_STATE_CONTROLLER_WAIT:
  357. case AP_CONN_STATE_RESOLVE_WAIT:
  358. return 0;
  359. default:
  360. log_warn(LD_BUG, "Called in unexpected state %d.",conn->base_.state);
  361. tor_fragile_assert();
  362. return -1;
  363. }
  364. return 0;
  365. }
  366. /** Longest size for the relay payload of a RELAY_CONNECTED cell that we're
  367. * able to generate. */
  368. /* 4 zero bytes; 1 type byte; 16 byte IPv6 address; 4 byte TTL. */
  369. #define MAX_CONNECTED_CELL_PAYLOAD_LEN 25
  370. /** Set the buffer at <b>payload_out</b> -- which must have at least
  371. * MAX_CONNECTED_CELL_PAYLOAD_LEN bytes available -- to the body of a
  372. * RELAY_CONNECTED cell indicating that we have connected to <b>addr</b>, and
  373. * that the name resolution that led us to <b>addr</b> will be valid for
  374. * <b>ttl</b> seconds. Return -1 on error, or the number of bytes used on
  375. * success. */
  376. STATIC int
  377. connected_cell_format_payload(uint8_t *payload_out,
  378. const tor_addr_t *addr,
  379. uint32_t ttl)
  380. {
  381. const sa_family_t family = tor_addr_family(addr);
  382. int connected_payload_len;
  383. /* should be needless */
  384. memset(payload_out, 0, MAX_CONNECTED_CELL_PAYLOAD_LEN);
  385. if (family == AF_INET) {
  386. set_uint32(payload_out, tor_addr_to_ipv4n(addr));
  387. connected_payload_len = 4;
  388. } else if (family == AF_INET6) {
  389. set_uint32(payload_out, 0);
  390. set_uint8(payload_out + 4, 6);
  391. memcpy(payload_out + 5, tor_addr_to_in6_addr8(addr), 16);
  392. connected_payload_len = 21;
  393. } else {
  394. return -1;
  395. }
  396. set_uint32(payload_out + connected_payload_len, htonl(dns_clip_ttl(ttl)));
  397. connected_payload_len += 4;
  398. tor_assert(connected_payload_len <= MAX_CONNECTED_CELL_PAYLOAD_LEN);
  399. return connected_payload_len;
  400. }
  401. /** Connected handler for exit connections: start writing pending
  402. * data, deliver 'CONNECTED' relay cells as appropriate, and check
  403. * any pending data that may have been received. */
  404. int
  405. connection_edge_finished_connecting(edge_connection_t *edge_conn)
  406. {
  407. connection_t *conn;
  408. tor_assert(edge_conn);
  409. tor_assert(edge_conn->base_.type == CONN_TYPE_EXIT);
  410. conn = TO_CONN(edge_conn);
  411. tor_assert(conn->state == EXIT_CONN_STATE_CONNECTING);
  412. log_info(LD_EXIT,"Exit connection to %s:%u (%s) established.",
  413. escaped_safe_str(conn->address), conn->port,
  414. safe_str(fmt_and_decorate_addr(&conn->addr)));
  415. rep_hist_note_exit_stream_opened(conn->port);
  416. conn->state = EXIT_CONN_STATE_OPEN;
  417. IF_HAS_NO_BUFFEREVENT(conn)
  418. connection_watch_events(conn, READ_EVENT); /* stop writing, keep reading */
  419. if (connection_get_outbuf_len(conn)) /* in case there are any queued relay
  420. * cells */
  421. connection_start_writing(conn);
  422. /* deliver a 'connected' relay cell back through the circuit. */
  423. if (connection_edge_is_rendezvous_stream(edge_conn)) {
  424. if (connection_edge_send_command(edge_conn,
  425. RELAY_COMMAND_CONNECTED, NULL, 0) < 0)
  426. return 0; /* circuit is closed, don't continue */
  427. } else {
  428. uint8_t connected_payload[MAX_CONNECTED_CELL_PAYLOAD_LEN];
  429. int connected_payload_len =
  430. connected_cell_format_payload(connected_payload, &conn->addr,
  431. edge_conn->address_ttl);
  432. if (connected_payload_len < 0)
  433. return -1;
  434. if (connection_edge_send_command(edge_conn,
  435. RELAY_COMMAND_CONNECTED,
  436. (char*)connected_payload, connected_payload_len) < 0)
  437. return 0; /* circuit is closed, don't continue */
  438. }
  439. tor_assert(edge_conn->package_window > 0);
  440. /* in case the server has written anything */
  441. return connection_edge_process_inbuf(edge_conn, 1);
  442. }
  443. /** Common code to connection_(ap|exit)_about_to_close. */
  444. static void
  445. connection_edge_about_to_close(edge_connection_t *edge_conn)
  446. {
  447. if (!edge_conn->edge_has_sent_end) {
  448. connection_t *conn = TO_CONN(edge_conn);
  449. log_warn(LD_BUG, "(Harmless.) Edge connection (marked at %s:%d) "
  450. "hasn't sent end yet?",
  451. conn->marked_for_close_file, conn->marked_for_close);
  452. tor_fragile_assert();
  453. }
  454. }
  455. /** Called when we're about to finally unlink and free an AP (client)
  456. * connection: perform necessary accounting and cleanup */
  457. void
  458. connection_ap_about_to_close(entry_connection_t *entry_conn)
  459. {
  460. circuit_t *circ;
  461. edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(entry_conn);
  462. connection_t *conn = ENTRY_TO_CONN(entry_conn);
  463. if (entry_conn->socks_request->has_finished == 0) {
  464. /* since conn gets removed right after this function finishes,
  465. * there's no point trying to send back a reply at this point. */
  466. log_warn(LD_BUG,"Closing stream (marked at %s:%d) without sending"
  467. " back a socks reply.",
  468. conn->marked_for_close_file, conn->marked_for_close);
  469. }
  470. if (!edge_conn->end_reason) {
  471. log_warn(LD_BUG,"Closing stream (marked at %s:%d) without having"
  472. " set end_reason.",
  473. conn->marked_for_close_file, conn->marked_for_close);
  474. }
  475. if (entry_conn->dns_server_request) {
  476. log_warn(LD_BUG,"Closing stream (marked at %s:%d) without having"
  477. " replied to DNS request.",
  478. conn->marked_for_close_file, conn->marked_for_close);
  479. dnsserv_reject_request(entry_conn);
  480. }
  481. control_event_stream_bandwidth(edge_conn);
  482. control_event_stream_status(entry_conn, STREAM_EVENT_CLOSED,
  483. edge_conn->end_reason);
  484. circ = circuit_get_by_edge_conn(edge_conn);
  485. if (circ)
  486. circuit_detach_stream(circ, edge_conn);
  487. }
  488. /** Called when we're about to finally unlink and free an exit
  489. * connection: perform necessary accounting and cleanup */
  490. void
  491. connection_exit_about_to_close(edge_connection_t *edge_conn)
  492. {
  493. circuit_t *circ;
  494. connection_t *conn = TO_CONN(edge_conn);
  495. connection_edge_about_to_close(edge_conn);
  496. circ = circuit_get_by_edge_conn(edge_conn);
  497. if (circ)
  498. circuit_detach_stream(circ, edge_conn);
  499. if (conn->state == EXIT_CONN_STATE_RESOLVING) {
  500. connection_dns_remove(edge_conn);
  501. }
  502. }
  503. /** Define a schedule for how long to wait between retrying
  504. * application connections. Rather than waiting a fixed amount of
  505. * time between each retry, we wait 10 seconds each for the first
  506. * two tries, and 15 seconds for each retry after
  507. * that. Hopefully this will improve the expected user experience. */
  508. static int
  509. compute_retry_timeout(entry_connection_t *conn)
  510. {
  511. int timeout = get_options()->CircuitStreamTimeout;
  512. if (timeout) /* if our config options override the default, use them */
  513. return timeout;
  514. if (conn->num_socks_retries < 2) /* try 0 and try 1 */
  515. return 10;
  516. return 15;
  517. }
  518. /** Find all general-purpose AP streams waiting for a response that sent their
  519. * begin/resolve cell too long ago. Detach from their current circuit, and
  520. * mark their current circuit as unsuitable for new streams. Then call
  521. * connection_ap_handshake_attach_circuit() to attach to a new circuit (if
  522. * available) or launch a new one.
  523. *
  524. * For rendezvous streams, simply give up after SocksTimeout seconds (with no
  525. * retry attempt).
  526. */
  527. void
  528. connection_ap_expire_beginning(void)
  529. {
  530. edge_connection_t *conn;
  531. entry_connection_t *entry_conn;
  532. circuit_t *circ;
  533. time_t now = time(NULL);
  534. const or_options_t *options = get_options();
  535. int severity;
  536. int cutoff;
  537. int seconds_idle, seconds_since_born;
  538. smartlist_t *conns = get_connection_array();
  539. SMARTLIST_FOREACH_BEGIN(conns, connection_t *, base_conn) {
  540. if (base_conn->type != CONN_TYPE_AP || base_conn->marked_for_close)
  541. continue;
  542. entry_conn = TO_ENTRY_CONN(base_conn);
  543. conn = ENTRY_TO_EDGE_CONN(entry_conn);
  544. /* if it's an internal linked connection, don't yell its status. */
  545. severity = (tor_addr_is_null(&base_conn->addr) && !base_conn->port)
  546. ? LOG_INFO : LOG_NOTICE;
  547. seconds_idle = (int)( now - base_conn->timestamp_lastread );
  548. seconds_since_born = (int)( now - base_conn->timestamp_created );
  549. if (base_conn->state == AP_CONN_STATE_OPEN)
  550. continue;
  551. /* We already consider SocksTimeout in
  552. * connection_ap_handshake_attach_circuit(), but we need to consider
  553. * it here too because controllers that put streams in controller_wait
  554. * state never ask Tor to attach the circuit. */
  555. if (AP_CONN_STATE_IS_UNATTACHED(base_conn->state)) {
  556. if (seconds_since_born >= options->SocksTimeout) {
  557. log_fn(severity, LD_APP,
  558. "Tried for %d seconds to get a connection to %s:%d. "
  559. "Giving up. (%s)",
  560. seconds_since_born,
  561. safe_str_client(entry_conn->socks_request->address),
  562. entry_conn->socks_request->port,
  563. conn_state_to_string(CONN_TYPE_AP, base_conn->state));
  564. connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
  565. }
  566. continue;
  567. }
  568. /* We're in state connect_wait or resolve_wait now -- waiting for a
  569. * reply to our relay cell. See if we want to retry/give up. */
  570. cutoff = compute_retry_timeout(entry_conn);
  571. if (seconds_idle < cutoff)
  572. continue;
  573. circ = circuit_get_by_edge_conn(conn);
  574. if (!circ) { /* it's vanished? */
  575. log_info(LD_APP,"Conn is waiting (address %s), but lost its circ.",
  576. safe_str_client(entry_conn->socks_request->address));
  577. connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
  578. continue;
  579. }
  580. if (circ->purpose == CIRCUIT_PURPOSE_C_REND_JOINED) {
  581. if (seconds_idle >= options->SocksTimeout) {
  582. log_fn(severity, LD_REND,
  583. "Rend stream is %d seconds late. Giving up on address"
  584. " '%s.onion'.",
  585. seconds_idle,
  586. safe_str_client(entry_conn->socks_request->address));
  587. /* Roll back path bias use state so that we probe the circuit
  588. * if nothing else succeeds on it */
  589. pathbias_mark_use_rollback(TO_ORIGIN_CIRCUIT(circ));
  590. connection_edge_end(conn, END_STREAM_REASON_TIMEOUT);
  591. connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
  592. }
  593. continue;
  594. }
  595. if (circ->purpose != CIRCUIT_PURPOSE_C_GENERAL &&
  596. circ->purpose != CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT &&
  597. circ->purpose != CIRCUIT_PURPOSE_PATH_BIAS_TESTING) {
  598. log_warn(LD_BUG, "circuit->purpose == CIRCUIT_PURPOSE_C_GENERAL failed. "
  599. "The purpose on the circuit was %s; it was in state %s, "
  600. "path_state %s.",
  601. circuit_purpose_to_string(circ->purpose),
  602. circuit_state_to_string(circ->state),
  603. CIRCUIT_IS_ORIGIN(circ) ?
  604. pathbias_state_to_string(TO_ORIGIN_CIRCUIT(circ)->path_state) :
  605. "none");
  606. }
  607. log_fn(cutoff < 15 ? LOG_INFO : severity, LD_APP,
  608. "We tried for %d seconds to connect to '%s' using exit %s."
  609. " Retrying on a new circuit.",
  610. seconds_idle,
  611. safe_str_client(entry_conn->socks_request->address),
  612. conn->cpath_layer ?
  613. extend_info_describe(conn->cpath_layer->extend_info):
  614. "*unnamed*");
  615. /* send an end down the circuit */
  616. connection_edge_end(conn, END_STREAM_REASON_TIMEOUT);
  617. /* un-mark it as ending, since we're going to reuse it */
  618. conn->edge_has_sent_end = 0;
  619. conn->end_reason = 0;
  620. /* make us not try this circuit again, but allow
  621. * current streams on it to survive if they can */
  622. mark_circuit_unusable_for_new_conns(TO_ORIGIN_CIRCUIT(circ));
  623. /* give our stream another 'cutoff' seconds to try */
  624. conn->base_.timestamp_lastread += cutoff;
  625. if (entry_conn->num_socks_retries < 250) /* avoid overflow */
  626. entry_conn->num_socks_retries++;
  627. /* move it back into 'pending' state, and try to attach. */
  628. if (connection_ap_detach_retriable(entry_conn, TO_ORIGIN_CIRCUIT(circ),
  629. END_STREAM_REASON_TIMEOUT)<0) {
  630. if (!base_conn->marked_for_close)
  631. connection_mark_unattached_ap(entry_conn,
  632. END_STREAM_REASON_CANT_ATTACH);
  633. }
  634. } SMARTLIST_FOREACH_END(base_conn);
  635. }
  636. /** Tell any AP streams that are waiting for a new circuit to try again,
  637. * either attaching to an available circ or launching a new one.
  638. */
  639. void
  640. connection_ap_attach_pending(void)
  641. {
  642. entry_connection_t *entry_conn;
  643. smartlist_t *conns = get_connection_array();
  644. SMARTLIST_FOREACH_BEGIN(conns, connection_t *, conn) {
  645. if (conn->marked_for_close ||
  646. conn->type != CONN_TYPE_AP ||
  647. conn->state != AP_CONN_STATE_CIRCUIT_WAIT)
  648. continue;
  649. entry_conn = TO_ENTRY_CONN(conn);
  650. if (connection_ap_handshake_attach_circuit(entry_conn) < 0) {
  651. if (!conn->marked_for_close)
  652. connection_mark_unattached_ap(entry_conn,
  653. END_STREAM_REASON_CANT_ATTACH);
  654. }
  655. } SMARTLIST_FOREACH_END(conn);
  656. }
  657. /** Tell any AP streams that are waiting for a one-hop tunnel to
  658. * <b>failed_digest</b> that they are going to fail. */
  659. /* XXX024 We should get rid of this function, and instead attach
  660. * one-hop streams to circ->p_streams so they get marked in
  661. * circuit_mark_for_close like normal p_streams. */
  662. void
  663. connection_ap_fail_onehop(const char *failed_digest,
  664. cpath_build_state_t *build_state)
  665. {
  666. entry_connection_t *entry_conn;
  667. char digest[DIGEST_LEN];
  668. smartlist_t *conns = get_connection_array();
  669. SMARTLIST_FOREACH_BEGIN(conns, connection_t *, conn) {
  670. if (conn->marked_for_close ||
  671. conn->type != CONN_TYPE_AP ||
  672. conn->state != AP_CONN_STATE_CIRCUIT_WAIT)
  673. continue;
  674. entry_conn = TO_ENTRY_CONN(conn);
  675. if (!entry_conn->want_onehop)
  676. continue;
  677. if (hexdigest_to_digest(entry_conn->chosen_exit_name, digest) < 0 ||
  678. tor_memneq(digest, failed_digest, DIGEST_LEN))
  679. continue;
  680. if (tor_digest_is_zero(digest)) {
  681. /* we don't know the digest; have to compare addr:port */
  682. tor_addr_t addr;
  683. if (!build_state || !build_state->chosen_exit ||
  684. !entry_conn->socks_request || !entry_conn->socks_request->address)
  685. continue;
  686. if (tor_addr_parse(&addr, entry_conn->socks_request->address)<0 ||
  687. !tor_addr_eq(&build_state->chosen_exit->addr, &addr) ||
  688. build_state->chosen_exit->port != entry_conn->socks_request->port)
  689. continue;
  690. }
  691. log_info(LD_APP, "Closing one-hop stream to '%s/%s' because the OR conn "
  692. "just failed.", entry_conn->chosen_exit_name,
  693. entry_conn->socks_request->address);
  694. connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
  695. } SMARTLIST_FOREACH_END(conn);
  696. }
  697. /** A circuit failed to finish on its last hop <b>info</b>. If there
  698. * are any streams waiting with this exit node in mind, but they
  699. * don't absolutely require it, make them give up on it.
  700. */
  701. void
  702. circuit_discard_optional_exit_enclaves(extend_info_t *info)
  703. {
  704. entry_connection_t *entry_conn;
  705. const node_t *r1, *r2;
  706. smartlist_t *conns = get_connection_array();
  707. SMARTLIST_FOREACH_BEGIN(conns, connection_t *, conn) {
  708. if (conn->marked_for_close ||
  709. conn->type != CONN_TYPE_AP ||
  710. conn->state != AP_CONN_STATE_CIRCUIT_WAIT)
  711. continue;
  712. entry_conn = TO_ENTRY_CONN(conn);
  713. if (!entry_conn->chosen_exit_optional &&
  714. !entry_conn->chosen_exit_retries)
  715. continue;
  716. r1 = node_get_by_nickname(entry_conn->chosen_exit_name, 0);
  717. r2 = node_get_by_id(info->identity_digest);
  718. if (!r1 || !r2 || r1 != r2)
  719. continue;
  720. tor_assert(entry_conn->socks_request);
  721. if (entry_conn->chosen_exit_optional) {
  722. log_info(LD_APP, "Giving up on enclave exit '%s' for destination %s.",
  723. safe_str_client(entry_conn->chosen_exit_name),
  724. escaped_safe_str_client(entry_conn->socks_request->address));
  725. entry_conn->chosen_exit_optional = 0;
  726. tor_free(entry_conn->chosen_exit_name); /* clears it */
  727. /* if this port is dangerous, warn or reject it now that we don't
  728. * think it'll be using an enclave. */
  729. consider_plaintext_ports(entry_conn, entry_conn->socks_request->port);
  730. }
  731. if (entry_conn->chosen_exit_retries) {
  732. if (--entry_conn->chosen_exit_retries == 0) { /* give up! */
  733. clear_trackexithost_mappings(entry_conn->chosen_exit_name);
  734. tor_free(entry_conn->chosen_exit_name); /* clears it */
  735. /* if this port is dangerous, warn or reject it now that we don't
  736. * think it'll be using an enclave. */
  737. consider_plaintext_ports(entry_conn, entry_conn->socks_request->port);
  738. }
  739. }
  740. } SMARTLIST_FOREACH_END(conn);
  741. }
  742. /** The AP connection <b>conn</b> has just failed while attaching or
  743. * sending a BEGIN or resolving on <b>circ</b>, but another circuit
  744. * might work. Detach the circuit, and either reattach it, launch a
  745. * new circuit, tell the controller, or give up as appropriate.
  746. *
  747. * Returns -1 on err, 1 on success, 0 on not-yet-sure.
  748. */
  749. int
  750. connection_ap_detach_retriable(entry_connection_t *conn,
  751. origin_circuit_t *circ,
  752. int reason)
  753. {
  754. control_event_stream_status(conn, STREAM_EVENT_FAILED_RETRIABLE, reason);
  755. ENTRY_TO_CONN(conn)->timestamp_lastread = time(NULL);
  756. /* Roll back path bias use state so that we probe the circuit
  757. * if nothing else succeeds on it */
  758. pathbias_mark_use_rollback(circ);
  759. if (conn->pending_optimistic_data) {
  760. generic_buffer_set_to_copy(&conn->sending_optimistic_data,
  761. conn->pending_optimistic_data);
  762. }
  763. if (!get_options()->LeaveStreamsUnattached || conn->use_begindir) {
  764. /* If we're attaching streams ourself, or if this connection is
  765. * a tunneled directory connection, then just attach it. */
  766. ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CIRCUIT_WAIT;
  767. circuit_detach_stream(TO_CIRCUIT(circ),ENTRY_TO_EDGE_CONN(conn));
  768. return connection_ap_handshake_attach_circuit(conn);
  769. } else {
  770. ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CONTROLLER_WAIT;
  771. circuit_detach_stream(TO_CIRCUIT(circ),ENTRY_TO_EDGE_CONN(conn));
  772. return 0;
  773. }
  774. }
  775. /** Check if <b>conn</b> is using a dangerous port. Then warn and/or
  776. * reject depending on our config options. */
  777. static int
  778. consider_plaintext_ports(entry_connection_t *conn, uint16_t port)
  779. {
  780. const or_options_t *options = get_options();
  781. int reject = smartlist_contains_int_as_string(
  782. options->RejectPlaintextPorts, port);
  783. if (smartlist_contains_int_as_string(options->WarnPlaintextPorts, port)) {
  784. log_warn(LD_APP, "Application request to port %d: this port is "
  785. "commonly used for unencrypted protocols. Please make sure "
  786. "you don't send anything you would mind the rest of the "
  787. "Internet reading!%s", port, reject ? " Closing." : "");
  788. control_event_client_status(LOG_WARN, "DANGEROUS_PORT PORT=%d RESULT=%s",
  789. port, reject ? "REJECT" : "WARN");
  790. }
  791. if (reject) {
  792. log_info(LD_APP, "Port %d listed in RejectPlaintextPorts. Closing.", port);
  793. connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
  794. return -1;
  795. }
  796. return 0;
  797. }
  798. /** How many times do we try connecting with an exit configured via
  799. * TrackHostExits before concluding that it won't work any more and trying a
  800. * different one? */
  801. #define TRACKHOSTEXITS_RETRIES 5
  802. /** Call connection_ap_handshake_rewrite_and_attach() unless a controller
  803. * asked us to leave streams unattached. Return 0 in that case.
  804. *
  805. * See connection_ap_handshake_rewrite_and_attach()'s
  806. * documentation for arguments and return value.
  807. */
  808. int
  809. connection_ap_rewrite_and_attach_if_allowed(entry_connection_t *conn,
  810. origin_circuit_t *circ,
  811. crypt_path_t *cpath)
  812. {
  813. const or_options_t *options = get_options();
  814. if (options->LeaveStreamsUnattached) {
  815. ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CONTROLLER_WAIT;
  816. return 0;
  817. }
  818. return connection_ap_handshake_rewrite_and_attach(conn, circ, cpath);
  819. }
  820. /** Connection <b>conn</b> just finished its socks handshake, or the
  821. * controller asked us to take care of it. If <b>circ</b> is defined,
  822. * then that's where we'll want to attach it. Otherwise we have to
  823. * figure it out ourselves.
  824. *
  825. * First, parse whether it's a .exit address, remap it, and so on. Then
  826. * if it's for a general circuit, try to attach it to a circuit (or launch
  827. * one as needed), else if it's for a rendezvous circuit, fetch a
  828. * rendezvous descriptor first (or attach/launch a circuit if the
  829. * rendezvous descriptor is already here and fresh enough).
  830. *
  831. * The stream will exit from the hop
  832. * indicated by <b>cpath</b>, or from the last hop in circ's cpath if
  833. * <b>cpath</b> is NULL.
  834. */
  835. int
  836. connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn,
  837. origin_circuit_t *circ,
  838. crypt_path_t *cpath)
  839. {
  840. socks_request_t *socks = conn->socks_request;
  841. hostname_type_t addresstype;
  842. const or_options_t *options = get_options();
  843. tor_addr_t addr_tmp;
  844. /* We set this to true if this is an address we should automatically
  845. * remap to a local address in VirtualAddrNetwork */
  846. int automap = 0;
  847. char orig_address[MAX_SOCKS_ADDR_LEN];
  848. time_t map_expires = TIME_MAX;
  849. time_t now = time(NULL);
  850. connection_t *base_conn = ENTRY_TO_CONN(conn);
  851. addressmap_entry_source_t exit_source = ADDRMAPSRC_NONE;
  852. tor_strlower(socks->address); /* normalize it */
  853. strlcpy(orig_address, socks->address, sizeof(orig_address));
  854. log_debug(LD_APP,"Client asked for %s:%d",
  855. safe_str_client(socks->address),
  856. socks->port);
  857. if (!strcmpend(socks->address, ".exit") && !options->AllowDotExit) {
  858. log_warn(LD_APP, "The \".exit\" notation is disabled in Tor due to "
  859. "security risks. Set AllowDotExit in your torrc to enable "
  860. "it (at your own risk).");
  861. control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
  862. escaped(socks->address));
  863. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  864. return -1;
  865. }
  866. if (! conn->original_dest_address)
  867. conn->original_dest_address = tor_strdup(conn->socks_request->address);
  868. if (socks->command == SOCKS_COMMAND_RESOLVE &&
  869. tor_addr_parse(&addr_tmp, socks->address)<0 &&
  870. options->AutomapHostsOnResolve) {
  871. automap = addressmap_address_should_automap(socks->address, options);
  872. if (automap) {
  873. const char *new_addr;
  874. int addr_type = RESOLVED_TYPE_IPV4;
  875. if (conn->socks_request->socks_version != 4) {
  876. if (!conn->ipv4_traffic_ok ||
  877. (conn->ipv6_traffic_ok && conn->prefer_ipv6_traffic) ||
  878. conn->prefer_ipv6_virtaddr)
  879. addr_type = RESOLVED_TYPE_IPV6;
  880. }
  881. new_addr = addressmap_register_virtual_address(
  882. addr_type, tor_strdup(socks->address));
  883. if (! new_addr) {
  884. log_warn(LD_APP, "Unable to automap address %s",
  885. escaped_safe_str(socks->address));
  886. connection_mark_unattached_ap(conn, END_STREAM_REASON_INTERNAL);
  887. return -1;
  888. }
  889. log_info(LD_APP, "Automapping %s to %s",
  890. escaped_safe_str_client(socks->address),
  891. safe_str_client(new_addr));
  892. strlcpy(socks->address, new_addr, sizeof(socks->address));
  893. }
  894. }
  895. if (socks->command == SOCKS_COMMAND_RESOLVE_PTR) {
  896. unsigned rewrite_flags = 0;
  897. if (conn->use_cached_ipv4_answers)
  898. rewrite_flags |= AMR_FLAG_USE_IPV4_DNS;
  899. if (conn->use_cached_ipv6_answers)
  900. rewrite_flags |= AMR_FLAG_USE_IPV6_DNS;
  901. if (addressmap_rewrite_reverse(socks->address, sizeof(socks->address),
  902. rewrite_flags, &map_expires)) {
  903. char *result = tor_strdup(socks->address);
  904. /* remember _what_ is supposed to have been resolved. */
  905. tor_snprintf(socks->address, sizeof(socks->address), "REVERSE[%s]",
  906. orig_address);
  907. connection_ap_handshake_socks_resolved(conn, RESOLVED_TYPE_HOSTNAME,
  908. strlen(result), (uint8_t*)result,
  909. -1,
  910. map_expires);
  911. connection_mark_unattached_ap(conn,
  912. END_STREAM_REASON_DONE |
  913. END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
  914. return 0;
  915. }
  916. if (options->ClientDNSRejectInternalAddresses) {
  917. /* Don't let people try to do a reverse lookup on 10.0.0.1. */
  918. tor_addr_t addr;
  919. int ok;
  920. ok = tor_addr_parse_PTR_name(
  921. &addr, socks->address, AF_UNSPEC, 1);
  922. if (ok == 1 && tor_addr_is_internal(&addr, 0)) {
  923. connection_ap_handshake_socks_resolved(conn, RESOLVED_TYPE_ERROR,
  924. 0, NULL, -1, TIME_MAX);
  925. connection_mark_unattached_ap(conn,
  926. END_STREAM_REASON_SOCKSPROTOCOL |
  927. END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
  928. return -1;
  929. }
  930. }
  931. } else if (!automap) {
  932. /* For address map controls, remap the address. */
  933. unsigned rewrite_flags = 0;
  934. if (conn->use_cached_ipv4_answers)
  935. rewrite_flags |= AMR_FLAG_USE_IPV4_DNS;
  936. if (conn->use_cached_ipv6_answers)
  937. rewrite_flags |= AMR_FLAG_USE_IPV6_DNS;
  938. if (addressmap_rewrite(socks->address, sizeof(socks->address),
  939. rewrite_flags, &map_expires, &exit_source)) {
  940. control_event_stream_status(conn, STREAM_EVENT_REMAP,
  941. REMAP_STREAM_SOURCE_CACHE);
  942. }
  943. }
  944. if (!automap && address_is_in_virtual_range(socks->address)) {
  945. /* This address was probably handed out by client_dns_get_unmapped_address,
  946. * but the mapping was discarded for some reason. We *don't* want to send
  947. * the address through Tor; that's likely to fail, and may leak
  948. * information.
  949. */
  950. log_warn(LD_APP,"Missing mapping for virtual address '%s'. Refusing.",
  951. safe_str_client(socks->address));
  952. connection_mark_unattached_ap(conn, END_STREAM_REASON_INTERNAL);
  953. return -1;
  954. }
  955. /* Parse the address provided by SOCKS. Modify it in-place if it
  956. * specifies a hidden-service (.onion) or particular exit node (.exit).
  957. */
  958. addresstype = parse_extended_hostname(socks->address);
  959. if (addresstype == BAD_HOSTNAME) {
  960. control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
  961. escaped(socks->address));
  962. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  963. return -1;
  964. }
  965. if (addresstype == EXIT_HOSTNAME) {
  966. /* foo.exit -- modify conn->chosen_exit_node to specify the exit
  967. * node, and conn->address to hold only the address portion. */
  968. char *s = strrchr(socks->address,'.');
  969. /* If StrictNodes is not set, then .exit overrides ExcludeNodes. */
  970. routerset_t *excludeset = options->StrictNodes ?
  971. options->ExcludeExitNodesUnion_ : options->ExcludeExitNodes;
  972. const node_t *node;
  973. if (exit_source == ADDRMAPSRC_AUTOMAP && !options->AllowDotExit) {
  974. /* Whoops; this one is stale. It must have gotten added earlier,
  975. * when AllowDotExit was on. */
  976. log_warn(LD_APP,"Stale automapped address for '%s.exit', with "
  977. "AllowDotExit disabled. Refusing.",
  978. safe_str_client(socks->address));
  979. control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
  980. escaped(socks->address));
  981. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  982. return -1;
  983. }
  984. if (exit_source == ADDRMAPSRC_DNS ||
  985. (exit_source == ADDRMAPSRC_NONE && !options->AllowDotExit)) {
  986. /* It shouldn't be possible to get a .exit address from any of these
  987. * sources. */
  988. log_warn(LD_BUG,"Address '%s.exit', with impossible source for the "
  989. ".exit part. Refusing.",
  990. safe_str_client(socks->address));
  991. control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
  992. escaped(socks->address));
  993. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  994. return -1;
  995. }
  996. tor_assert(!automap);
  997. if (s) {
  998. /* The address was of the form "(stuff).(name).exit */
  999. if (s[1] != '\0') {
  1000. conn->chosen_exit_name = tor_strdup(s+1);
  1001. node = node_get_by_nickname(conn->chosen_exit_name, 1);
  1002. if (exit_source == ADDRMAPSRC_TRACKEXIT) {
  1003. /* We 5 tries before it expires the addressmap */
  1004. conn->chosen_exit_retries = TRACKHOSTEXITS_RETRIES;
  1005. }
  1006. *s = 0;
  1007. } else {
  1008. /* Oops, the address was (stuff)..exit. That's not okay. */
  1009. log_warn(LD_APP,"Malformed exit address '%s.exit'. Refusing.",
  1010. safe_str_client(socks->address));
  1011. control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
  1012. escaped(socks->address));
  1013. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  1014. return -1;
  1015. }
  1016. } else {
  1017. /* It looks like they just asked for "foo.exit". */
  1018. conn->chosen_exit_name = tor_strdup(socks->address);
  1019. node = node_get_by_nickname(conn->chosen_exit_name, 1);
  1020. if (node) {
  1021. *socks->address = 0;
  1022. node_get_address_string(node, socks->address, sizeof(socks->address));
  1023. }
  1024. }
  1025. /* Now make sure that the chosen exit exists... */
  1026. if (!node) {
  1027. log_warn(LD_APP,
  1028. "Unrecognized relay in exit address '%s.exit'. Refusing.",
  1029. safe_str_client(socks->address));
  1030. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  1031. return -1;
  1032. }
  1033. /* ...and make sure that it isn't excluded. */
  1034. if (routerset_contains_node(excludeset, node)) {
  1035. log_warn(LD_APP,
  1036. "Excluded relay in exit address '%s.exit'. Refusing.",
  1037. safe_str_client(socks->address));
  1038. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  1039. return -1;
  1040. }
  1041. /* XXXX024-1090 Should we also allow foo.bar.exit if ExitNodes is set and
  1042. Bar is not listed in it? I say yes, but our revised manpage branch
  1043. implies no. */
  1044. }
  1045. if (addresstype != ONION_HOSTNAME) {
  1046. /* not a hidden-service request (i.e. normal or .exit) */
  1047. if (address_is_invalid_destination(socks->address, 1)) {
  1048. control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
  1049. escaped(socks->address));
  1050. log_warn(LD_APP,
  1051. "Destination '%s' seems to be an invalid hostname. Failing.",
  1052. safe_str_client(socks->address));
  1053. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  1054. return -1;
  1055. }
  1056. if (options->Tor2webMode) {
  1057. log_warn(LD_APP, "Refusing to connect to non-hidden-service hostname %s "
  1058. "because tor2web mode is enabled.",
  1059. safe_str_client(socks->address));
  1060. connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
  1061. return -1;
  1062. }
  1063. if (socks->command == SOCKS_COMMAND_RESOLVE) {
  1064. uint32_t answer;
  1065. struct in_addr in;
  1066. /* Reply to resolves immediately if we can. */
  1067. if (tor_inet_aton(socks->address, &in)) { /* see if it's an IP already */
  1068. /* leave it in network order */
  1069. answer = in.s_addr;
  1070. /* remember _what_ is supposed to have been resolved. */
  1071. strlcpy(socks->address, orig_address, sizeof(socks->address));
  1072. connection_ap_handshake_socks_resolved(conn,RESOLVED_TYPE_IPV4,4,
  1073. (uint8_t*)&answer,
  1074. -1,map_expires);
  1075. connection_mark_unattached_ap(conn,
  1076. END_STREAM_REASON_DONE |
  1077. END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
  1078. return 0;
  1079. }
  1080. tor_assert(!automap);
  1081. rep_hist_note_used_resolve(now); /* help predict this next time */
  1082. } else if (socks->command == SOCKS_COMMAND_CONNECT) {
  1083. tor_assert(!automap);
  1084. if (socks->port == 0) {
  1085. log_notice(LD_APP,"Application asked to connect to port 0. Refusing.");
  1086. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  1087. return -1;
  1088. }
  1089. if (options->ClientRejectInternalAddresses &&
  1090. !conn->use_begindir && !conn->chosen_exit_name && !circ) {
  1091. tor_addr_t addr;
  1092. if (tor_addr_hostname_is_local(socks->address) ||
  1093. (tor_addr_parse(&addr, socks->address) >= 0 &&
  1094. tor_addr_is_internal(&addr, 0))) {
  1095. /* If this is an explicit private address with no chosen exit node,
  1096. * then we really don't want to try to connect to it. That's
  1097. * probably an error. */
  1098. if (conn->is_transparent_ap) {
  1099. #define WARN_INTRVL_LOOP 300
  1100. static ratelim_t loop_warn_limit = RATELIM_INIT(WARN_INTRVL_LOOP);
  1101. char *m;
  1102. if ((m = rate_limit_log(&loop_warn_limit, approx_time()))) {
  1103. log_warn(LD_NET,
  1104. "Rejecting request for anonymous connection to private "
  1105. "address %s on a TransPort or NATDPort. Possible loop "
  1106. "in your NAT rules?%s", safe_str_client(socks->address),
  1107. m);
  1108. tor_free(m);
  1109. }
  1110. } else {
  1111. #define WARN_INTRVL_PRIV 300
  1112. static ratelim_t priv_warn_limit = RATELIM_INIT(WARN_INTRVL_PRIV);
  1113. char *m;
  1114. if ((m = rate_limit_log(&priv_warn_limit, approx_time()))) {
  1115. log_warn(LD_NET,
  1116. "Rejecting SOCKS request for anonymous connection to "
  1117. "private address %s.%s",
  1118. safe_str_client(socks->address),m);
  1119. tor_free(m);
  1120. }
  1121. }
  1122. connection_mark_unattached_ap(conn, END_STREAM_REASON_PRIVATE_ADDR);
  1123. return -1;
  1124. }
  1125. }
  1126. {
  1127. tor_addr_t addr;
  1128. /* XXX Duplicate call to tor_addr_parse. */
  1129. if (tor_addr_parse(&addr, socks->address) >= 0) {
  1130. sa_family_t family = tor_addr_family(&addr);
  1131. if ((family == AF_INET && ! conn->ipv4_traffic_ok) ||
  1132. (family == AF_INET6 && ! conn->ipv4_traffic_ok)) {
  1133. log_warn(LD_NET, "Rejecting SOCKS request for an IP address "
  1134. "family that this listener does not support.");
  1135. connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
  1136. return -1;
  1137. } else if (family == AF_INET6 && socks->socks_version == 4) {
  1138. log_warn(LD_NET, "Rejecting SOCKS4 request for an IPv6 address.");
  1139. connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
  1140. return -1;
  1141. } else if (socks->socks_version == 4 && !conn->ipv4_traffic_ok) {
  1142. log_warn(LD_NET, "Rejecting SOCKS4 request on a listener with "
  1143. "no IPv4 traffic supported.");
  1144. connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
  1145. return -1;
  1146. } else if (family == AF_INET6) {
  1147. conn->ipv4_traffic_ok = 0;
  1148. } else if (family == AF_INET) {
  1149. conn->ipv6_traffic_ok = 0;
  1150. }
  1151. }
  1152. }
  1153. if (socks->socks_version == 4)
  1154. conn->ipv6_traffic_ok = 0;
  1155. if (!conn->use_begindir && !conn->chosen_exit_name && !circ) {
  1156. /* see if we can find a suitable enclave exit */
  1157. const node_t *r =
  1158. router_find_exact_exit_enclave(socks->address, socks->port);
  1159. if (r) {
  1160. log_info(LD_APP,
  1161. "Redirecting address %s to exit at enclave router %s",
  1162. safe_str_client(socks->address), node_describe(r));
  1163. /* use the hex digest, not nickname, in case there are two
  1164. routers with this nickname */
  1165. conn->chosen_exit_name =
  1166. tor_strdup(hex_str(r->identity, DIGEST_LEN));
  1167. conn->chosen_exit_optional = 1;
  1168. }
  1169. }
  1170. /* warn or reject if it's using a dangerous port */
  1171. if (!conn->use_begindir && !conn->chosen_exit_name && !circ)
  1172. if (consider_plaintext_ports(conn, socks->port) < 0)
  1173. return -1;
  1174. if (!conn->use_begindir) {
  1175. /* help predict this next time */
  1176. rep_hist_note_used_port(now, socks->port);
  1177. }
  1178. } else if (socks->command == SOCKS_COMMAND_RESOLVE_PTR) {
  1179. rep_hist_note_used_resolve(now); /* help predict this next time */
  1180. /* no extra processing needed */
  1181. } else {
  1182. tor_fragile_assert();
  1183. }
  1184. base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
  1185. if ((circ && connection_ap_handshake_attach_chosen_circuit(
  1186. conn, circ, cpath) < 0) ||
  1187. (!circ &&
  1188. connection_ap_handshake_attach_circuit(conn) < 0)) {
  1189. if (!base_conn->marked_for_close)
  1190. connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
  1191. return -1;
  1192. }
  1193. return 0;
  1194. } else {
  1195. /* it's a hidden-service request */
  1196. rend_cache_entry_t *entry;
  1197. int r;
  1198. rend_service_authorization_t *client_auth;
  1199. rend_data_t *rend_data;
  1200. tor_assert(!automap);
  1201. if (SOCKS_COMMAND_IS_RESOLVE(socks->command)) {
  1202. /* if it's a resolve request, fail it right now, rather than
  1203. * building all the circuits and then realizing it won't work. */
  1204. log_warn(LD_APP,
  1205. "Resolve requests to hidden services not allowed. Failing.");
  1206. connection_ap_handshake_socks_resolved(conn,RESOLVED_TYPE_ERROR,
  1207. 0,NULL,-1,TIME_MAX);
  1208. connection_mark_unattached_ap(conn,
  1209. END_STREAM_REASON_SOCKSPROTOCOL |
  1210. END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
  1211. return -1;
  1212. }
  1213. if (circ) {
  1214. log_warn(LD_CONTROL, "Attachstream to a circuit is not "
  1215. "supported for .onion addresses currently. Failing.");
  1216. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  1217. return -1;
  1218. }
  1219. ENTRY_TO_EDGE_CONN(conn)->rend_data = rend_data =
  1220. tor_malloc_zero(sizeof(rend_data_t));
  1221. strlcpy(rend_data->onion_address, socks->address,
  1222. sizeof(rend_data->onion_address));
  1223. log_info(LD_REND,"Got a hidden service request for ID '%s'",
  1224. safe_str_client(rend_data->onion_address));
  1225. /* see if we already have it cached */
  1226. r = rend_cache_lookup_entry(rend_data->onion_address, -1, &entry);
  1227. if (r<0) {
  1228. log_warn(LD_BUG,"Invalid service name '%s'",
  1229. safe_str_client(rend_data->onion_address));
  1230. connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
  1231. return -1;
  1232. }
  1233. /* Help predict this next time. We're not sure if it will need
  1234. * a stable circuit yet, but we know we'll need *something*. */
  1235. rep_hist_note_used_internal(now, 0, 1);
  1236. /* Look up if we have client authorization for it. */
  1237. client_auth = rend_client_lookup_service_authorization(
  1238. rend_data->onion_address);
  1239. if (client_auth) {
  1240. log_info(LD_REND, "Using previously configured client authorization "
  1241. "for hidden service request.");
  1242. memcpy(rend_data->descriptor_cookie,
  1243. client_auth->descriptor_cookie, REND_DESC_COOKIE_LEN);
  1244. rend_data->auth_type = client_auth->auth_type;
  1245. }
  1246. if (r==0) {
  1247. base_conn->state = AP_CONN_STATE_RENDDESC_WAIT;
  1248. log_info(LD_REND, "Unknown descriptor %s. Fetching.",
  1249. safe_str_client(rend_data->onion_address));
  1250. rend_client_refetch_v2_renddesc(rend_data);
  1251. } else { /* r > 0 */
  1252. base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
  1253. log_info(LD_REND, "Descriptor is here. Great.");
  1254. if (connection_ap_handshake_attach_circuit(conn) < 0) {
  1255. if (!base_conn->marked_for_close)
  1256. connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
  1257. return -1;
  1258. }
  1259. }
  1260. return 0;
  1261. }
  1262. return 0; /* unreached but keeps the compiler happy */
  1263. }
  1264. #ifdef TRANS_PF
  1265. static int pf_socket = -1;
  1266. int
  1267. get_pf_socket(void)
  1268. {
  1269. int pf;
  1270. /* This should be opened before dropping privileges. */
  1271. if (pf_socket >= 0)
  1272. return pf_socket;
  1273. #ifdef OPENBSD
  1274. /* only works on OpenBSD */
  1275. pf = tor_open_cloexec("/dev/pf", O_RDONLY, 0);
  1276. #else
  1277. /* works on NetBSD and FreeBSD */
  1278. pf = tor_open_cloexec("/dev/pf", O_RDWR, 0);
  1279. #endif
  1280. if (pf < 0) {
  1281. log_warn(LD_NET, "open(\"/dev/pf\") failed: %s", strerror(errno));
  1282. return -1;
  1283. }
  1284. pf_socket = pf;
  1285. return pf_socket;
  1286. }
  1287. #endif
  1288. /** Fetch the original destination address and port from a
  1289. * system-specific interface and put them into a
  1290. * socks_request_t as if they came from a socks request.
  1291. *
  1292. * Return -1 if an error prevents fetching the destination,
  1293. * else return 0.
  1294. */
  1295. static int
  1296. connection_ap_get_original_destination(entry_connection_t *conn,
  1297. socks_request_t *req)
  1298. {
  1299. #ifdef TRANS_NETFILTER
  1300. /* Linux 2.4+ */
  1301. struct sockaddr_storage orig_dst;
  1302. socklen_t orig_dst_len = sizeof(orig_dst);
  1303. tor_addr_t addr;
  1304. if (getsockopt(ENTRY_TO_CONN(conn)->s, SOL_IP, SO_ORIGINAL_DST,
  1305. (struct sockaddr*)&orig_dst, &orig_dst_len) < 0) {
  1306. int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s);
  1307. log_warn(LD_NET, "getsockopt() failed: %s", tor_socket_strerror(e));
  1308. return -1;
  1309. }
  1310. tor_addr_from_sockaddr(&addr, (struct sockaddr*)&orig_dst, &req->port);
  1311. tor_addr_to_str(req->address, &addr, sizeof(req->address), 1);
  1312. return 0;
  1313. #elif defined(TRANS_PF)
  1314. struct sockaddr_storage proxy_addr;
  1315. socklen_t proxy_addr_len = sizeof(proxy_addr);
  1316. struct sockaddr *proxy_sa = (struct sockaddr*) &proxy_addr;
  1317. struct pfioc_natlook pnl;
  1318. tor_addr_t addr;
  1319. int pf = -1;
  1320. if (getsockname(ENTRY_TO_CONN(conn)->s, (struct sockaddr*)&proxy_addr,
  1321. &proxy_addr_len) < 0) {
  1322. int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s);
  1323. log_warn(LD_NET, "getsockname() to determine transocks destination "
  1324. "failed: %s", tor_socket_strerror(e));
  1325. return -1;
  1326. }
  1327. memset(&pnl, 0, sizeof(pnl));
  1328. pnl.proto = IPPROTO_TCP;
  1329. pnl.direction = PF_OUT;
  1330. if (proxy_sa->sa_family == AF_INET) {
  1331. struct sockaddr_in *sin = (struct sockaddr_in *)proxy_sa;
  1332. pnl.af = AF_INET;
  1333. pnl.saddr.v4.s_addr = tor_addr_to_ipv4n(&ENTRY_TO_CONN(conn)->addr);
  1334. pnl.sport = htons(ENTRY_TO_CONN(conn)->port);
  1335. pnl.daddr.v4.s_addr = sin->sin_addr.s_addr;
  1336. pnl.dport = sin->sin_port;
  1337. } else if (proxy_sa->sa_family == AF_INET6) {
  1338. struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)proxy_sa;
  1339. pnl.af = AF_INET6;
  1340. memcpy(&pnl.saddr.v6, tor_addr_to_in6(&ENTRY_TO_CONN(conn)->addr),
  1341. sizeof(struct in6_addr));
  1342. pnl.sport = htons(ENTRY_TO_CONN(conn)->port);
  1343. memcpy(&pnl.daddr.v6, &sin6->sin6_addr, sizeof(struct in6_addr));
  1344. pnl.dport = sin6->sin6_port;
  1345. } else {
  1346. log_warn(LD_NET, "getsockname() gave an unexpected address family (%d)",
  1347. (int)proxy_sa->sa_family);
  1348. return -1;
  1349. }
  1350. pf = get_pf_socket();
  1351. if (pf<0)
  1352. return -1;
  1353. if (ioctl(pf, DIOCNATLOOK, &pnl) < 0) {
  1354. log_warn(LD_NET, "ioctl(DIOCNATLOOK) failed: %s", strerror(errno));
  1355. return -1;
  1356. }
  1357. if (pnl.af == AF_INET) {
  1358. tor_addr_from_ipv4n(&addr, pnl.rdaddr.v4.s_addr);
  1359. } else if (pnl.af == AF_INET6) {
  1360. tor_addr_from_in6(&addr, &pnl.rdaddr.v6);
  1361. } else {
  1362. tor_fragile_assert();
  1363. return -1;
  1364. }
  1365. tor_addr_to_str(req->address, &addr, sizeof(req->address), 1);
  1366. req->port = ntohs(pnl.rdport);
  1367. return 0;
  1368. #else
  1369. (void)conn;
  1370. (void)req;
  1371. log_warn(LD_BUG, "Called connection_ap_get_original_destination, but no "
  1372. "transparent proxy method was configured.");
  1373. return -1;
  1374. #endif
  1375. }
  1376. /** connection_edge_process_inbuf() found a conn in state
  1377. * socks_wait. See if conn->inbuf has the right bytes to proceed with
  1378. * the socks handshake.
  1379. *
  1380. * If the handshake is complete, send it to
  1381. * connection_ap_handshake_rewrite_and_attach().
  1382. *
  1383. * Return -1 if an unexpected error with conn occurs (and mark it for close),
  1384. * else return 0.
  1385. */
  1386. static int
  1387. connection_ap_handshake_process_socks(entry_connection_t *conn)
  1388. {
  1389. socks_request_t *socks;
  1390. int sockshere;
  1391. const or_options_t *options = get_options();
  1392. int had_reply = 0;
  1393. connection_t *base_conn = ENTRY_TO_CONN(conn);
  1394. tor_assert(conn);
  1395. tor_assert(base_conn->type == CONN_TYPE_AP);
  1396. tor_assert(base_conn->state == AP_CONN_STATE_SOCKS_WAIT);
  1397. tor_assert(conn->socks_request);
  1398. socks = conn->socks_request;
  1399. log_debug(LD_APP,"entered.");
  1400. IF_HAS_BUFFEREVENT(base_conn, {
  1401. struct evbuffer *input = bufferevent_get_input(base_conn->bufev);
  1402. sockshere = fetch_from_evbuffer_socks(input, socks,
  1403. options->TestSocks, options->SafeSocks);
  1404. }) ELSE_IF_NO_BUFFEREVENT {
  1405. sockshere = fetch_from_buf_socks(base_conn->inbuf, socks,
  1406. options->TestSocks, options->SafeSocks);
  1407. };
  1408. if (socks->replylen) {
  1409. had_reply = 1;
  1410. connection_write_to_buf((const char*)socks->reply, socks->replylen,
  1411. base_conn);
  1412. socks->replylen = 0;
  1413. if (sockshere == -1) {
  1414. /* An invalid request just got a reply, no additional
  1415. * one is necessary. */
  1416. socks->has_finished = 1;
  1417. }
  1418. }
  1419. if (sockshere == 0) {
  1420. log_debug(LD_APP,"socks handshake not all here yet.");
  1421. return 0;
  1422. } else if (sockshere == -1) {
  1423. if (!had_reply) {
  1424. log_warn(LD_APP,"Fetching socks handshake failed. Closing.");
  1425. connection_ap_handshake_socks_reply(conn, NULL, 0,
  1426. END_STREAM_REASON_SOCKSPROTOCOL);
  1427. }
  1428. connection_mark_unattached_ap(conn,
  1429. END_STREAM_REASON_SOCKSPROTOCOL |
  1430. END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
  1431. return -1;
  1432. } /* else socks handshake is done, continue processing */
  1433. if (SOCKS_COMMAND_IS_CONNECT(socks->command))
  1434. control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
  1435. else
  1436. control_event_stream_status(conn, STREAM_EVENT_NEW_RESOLVE, 0);
  1437. return connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
  1438. }
  1439. /** connection_init_accepted_conn() found a new trans AP conn.
  1440. * Get the original destination and send it to
  1441. * connection_ap_handshake_rewrite_and_attach().
  1442. *
  1443. * Return -1 if an unexpected error with conn (and it should be marked
  1444. * for close), else return 0.
  1445. */
  1446. int
  1447. connection_ap_process_transparent(entry_connection_t *conn)
  1448. {
  1449. socks_request_t *socks;
  1450. tor_assert(conn);
  1451. tor_assert(conn->socks_request);
  1452. socks = conn->socks_request;
  1453. /* pretend that a socks handshake completed so we don't try to
  1454. * send a socks reply down a transparent conn */
  1455. socks->command = SOCKS_COMMAND_CONNECT;
  1456. socks->has_finished = 1;
  1457. log_debug(LD_APP,"entered.");
  1458. if (connection_ap_get_original_destination(conn, socks) < 0) {
  1459. log_warn(LD_APP,"Fetching original destination failed. Closing.");
  1460. connection_mark_unattached_ap(conn,
  1461. END_STREAM_REASON_CANT_FETCH_ORIG_DEST);
  1462. return -1;
  1463. }
  1464. /* we have the original destination */
  1465. control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
  1466. return connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
  1467. }
  1468. /** connection_edge_process_inbuf() found a conn in state natd_wait. See if
  1469. * conn-\>inbuf has the right bytes to proceed. See FreeBSD's libalias(3) and
  1470. * ProxyEncodeTcpStream() in src/lib/libalias/alias_proxy.c for the encoding
  1471. * form of the original destination.
  1472. *
  1473. * If the original destination is complete, send it to
  1474. * connection_ap_handshake_rewrite_and_attach().
  1475. *
  1476. * Return -1 if an unexpected error with conn (and it should be marked
  1477. * for close), else return 0.
  1478. */
  1479. static int
  1480. connection_ap_process_natd(entry_connection_t *conn)
  1481. {
  1482. char tmp_buf[36], *tbuf, *daddr;
  1483. size_t tlen = 30;
  1484. int err, port_ok;
  1485. socks_request_t *socks;
  1486. tor_assert(conn);
  1487. tor_assert(ENTRY_TO_CONN(conn)->state == AP_CONN_STATE_NATD_WAIT);
  1488. tor_assert(conn->socks_request);
  1489. socks = conn->socks_request;
  1490. log_debug(LD_APP,"entered.");
  1491. /* look for LF-terminated "[DEST ip_addr port]"
  1492. * where ip_addr is a dotted-quad and port is in string form */
  1493. err = connection_fetch_from_buf_line(ENTRY_TO_CONN(conn), tmp_buf, &tlen);
  1494. if (err == 0)
  1495. return 0;
  1496. if (err < 0) {
  1497. log_warn(LD_APP,"NATD handshake failed (DEST too long). Closing");
  1498. connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST);
  1499. return -1;
  1500. }
  1501. if (strcmpstart(tmp_buf, "[DEST ")) {
  1502. log_warn(LD_APP,"NATD handshake was ill-formed; closing. The client "
  1503. "said: %s",
  1504. escaped(tmp_buf));
  1505. connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST);
  1506. return -1;
  1507. }
  1508. daddr = tbuf = &tmp_buf[0] + 6; /* after end of "[DEST " */
  1509. if (!(tbuf = strchr(tbuf, ' '))) {
  1510. log_warn(LD_APP,"NATD handshake was ill-formed; closing. The client "
  1511. "said: %s",
  1512. escaped(tmp_buf));
  1513. connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST);
  1514. return -1;
  1515. }
  1516. *tbuf++ = '\0';
  1517. /* pretend that a socks handshake completed so we don't try to
  1518. * send a socks reply down a natd conn */
  1519. strlcpy(socks->address, daddr, sizeof(socks->address));
  1520. socks->port = (uint16_t)
  1521. tor_parse_long(tbuf, 10, 1, 65535, &port_ok, &daddr);
  1522. if (!port_ok) {
  1523. log_warn(LD_APP,"NATD handshake failed; port %s is ill-formed or out "
  1524. "of range.", escaped(tbuf));
  1525. connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST);
  1526. return -1;
  1527. }
  1528. socks->command = SOCKS_COMMAND_CONNECT;
  1529. socks->has_finished = 1;
  1530. control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
  1531. ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CIRCUIT_WAIT;
  1532. return connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
  1533. }
  1534. /** Iterate over the two bytes of stream_id until we get one that is not
  1535. * already in use; return it. Return 0 if can't get a unique stream_id.
  1536. */
  1537. streamid_t
  1538. get_unique_stream_id_by_circ(origin_circuit_t *circ)
  1539. {
  1540. edge_connection_t *tmpconn;
  1541. streamid_t test_stream_id;
  1542. uint32_t attempts=0;
  1543. again:
  1544. test_stream_id = circ->next_stream_id++;
  1545. if (++attempts > 1<<16) {
  1546. /* Make sure we don't loop forever if all stream_id's are used. */
  1547. log_warn(LD_APP,"No unused stream IDs. Failing.");
  1548. return 0;
  1549. }
  1550. if (test_stream_id == 0)
  1551. goto again;
  1552. for (tmpconn = circ->p_streams; tmpconn; tmpconn=tmpconn->next_stream)
  1553. if (tmpconn->stream_id == test_stream_id)
  1554. goto again;
  1555. return test_stream_id;
  1556. }
  1557. /** Return true iff <b>conn</b> is linked to a circuit and configured to use
  1558. * an exit that supports optimistic data. */
  1559. static int
  1560. connection_ap_supports_optimistic_data(const entry_connection_t *conn)
  1561. {
  1562. const edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(conn);
  1563. /* We can only send optimistic data if we're connected to an open
  1564. general circuit. */
  1565. if (edge_conn->on_circuit == NULL ||
  1566. edge_conn->on_circuit->state != CIRCUIT_STATE_OPEN ||
  1567. edge_conn->on_circuit->purpose != CIRCUIT_PURPOSE_C_GENERAL)
  1568. return 0;
  1569. return conn->may_use_optimistic_data;
  1570. }
  1571. /** Return a bitmask of BEGIN_FLAG_* flags that we should transmit in the
  1572. * RELAY_BEGIN cell for <b>ap_conn</b>. */
  1573. static uint32_t
  1574. connection_ap_get_begincell_flags(entry_connection_t *ap_conn)
  1575. {
  1576. edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(ap_conn);
  1577. const node_t *exitnode = NULL;
  1578. const crypt_path_t *cpath_layer = edge_conn->cpath_layer;
  1579. uint32_t flags = 0;
  1580. /* No flags for begindir */
  1581. if (ap_conn->use_begindir)
  1582. return 0;
  1583. /* No flags for hidden services. */
  1584. if (edge_conn->on_circuit->purpose != CIRCUIT_PURPOSE_C_GENERAL)
  1585. return 0;
  1586. /* If only IPv4 is supported, no flags */
  1587. if (ap_conn->ipv4_traffic_ok && !ap_conn->ipv6_traffic_ok)
  1588. return 0;
  1589. if (! cpath_layer ||
  1590. ! cpath_layer->extend_info)
  1591. return 0;
  1592. if (!ap_conn->ipv4_traffic_ok)
  1593. flags |= BEGIN_FLAG_IPV4_NOT_OK;
  1594. exitnode = node_get_by_id(cpath_layer->extend_info->identity_digest);
  1595. if (ap_conn->ipv6_traffic_ok && exitnode) {
  1596. tor_addr_t a;
  1597. tor_addr_make_null(&a, AF_INET6);
  1598. if (compare_tor_addr_to_node_policy(&a, ap_conn->socks_request->port,
  1599. exitnode)
  1600. != ADDR_POLICY_REJECTED) {
  1601. /* Only say "IPv6 OK" if the exit node supports IPv6. Otherwise there's
  1602. * no point. */
  1603. flags |= BEGIN_FLAG_IPV6_OK;
  1604. }
  1605. }
  1606. if (flags == BEGIN_FLAG_IPV6_OK) {
  1607. /* When IPv4 and IPv6 are both allowed, consider whether to say we
  1608. * prefer IPv6. Otherwise there's no point in declaring a preference */
  1609. if (ap_conn->prefer_ipv6_traffic)
  1610. flags |= BEGIN_FLAG_IPV6_PREFERRED;
  1611. }
  1612. if (flags == BEGIN_FLAG_IPV4_NOT_OK) {
  1613. log_warn(LD_EDGE, "I'm about to ask a node for a connection that I "
  1614. "am telling it to fulfil with neither IPv4 nor IPv6. That's "
  1615. "not going to work. Did you perhaps ask for an IPv6 address "
  1616. "on an IPv4Only port, or vice versa?");
  1617. }
  1618. return flags;
  1619. }
  1620. /** Write a relay begin cell, using destaddr and destport from ap_conn's
  1621. * socks_request field, and send it down circ.
  1622. *
  1623. * If ap_conn is broken, mark it for close and return -1. Else return 0.
  1624. */
  1625. int
  1626. connection_ap_handshake_send_begin(entry_connection_t *ap_conn)
  1627. {
  1628. char payload[CELL_PAYLOAD_SIZE];
  1629. int payload_len;
  1630. int begin_type;
  1631. origin_circuit_t *circ;
  1632. edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(ap_conn);
  1633. connection_t *base_conn = TO_CONN(edge_conn);
  1634. tor_assert(edge_conn->on_circuit);
  1635. circ = TO_ORIGIN_CIRCUIT(edge_conn->on_circuit);
  1636. tor_assert(base_conn->type == CONN_TYPE_AP);
  1637. tor_assert(base_conn->state == AP_CONN_STATE_CIRCUIT_WAIT);
  1638. tor_assert(ap_conn->socks_request);
  1639. tor_assert(SOCKS_COMMAND_IS_CONNECT(ap_conn->socks_request->command));
  1640. edge_conn->stream_id = get_unique_stream_id_by_circ(circ);
  1641. if (edge_conn->stream_id==0) {
  1642. /* XXXX024 Instead of closing this stream, we should make it get
  1643. * retried on another circuit. */
  1644. connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
  1645. /* Mark this circuit "unusable for new streams". */
  1646. mark_circuit_unusable_for_new_conns(circ);
  1647. return -1;
  1648. }
  1649. /* Set up begin cell flags. */
  1650. edge_conn->begincell_flags = connection_ap_get_begincell_flags(ap_conn);
  1651. tor_snprintf(payload,RELAY_PAYLOAD_SIZE, "%s:%d",
  1652. (circ->base_.purpose == CIRCUIT_PURPOSE_C_GENERAL) ?
  1653. ap_conn->socks_request->address : "",
  1654. ap_conn->socks_request->port);
  1655. payload_len = (int)strlen(payload)+1;
  1656. if (payload_len <= RELAY_PAYLOAD_SIZE - 4 && edge_conn->begincell_flags) {
  1657. set_uint32(payload + payload_len, htonl(edge_conn->begincell_flags));
  1658. payload_len += 4;
  1659. }
  1660. log_info(LD_APP,
  1661. "Sending relay cell %d to begin stream %d.",
  1662. (int)ap_conn->use_begindir,
  1663. edge_conn->stream_id);
  1664. begin_type = ap_conn->use_begindir ?
  1665. RELAY_COMMAND_BEGIN_DIR : RELAY_COMMAND_BEGIN;
  1666. if (begin_type == RELAY_COMMAND_BEGIN) {
  1667. #ifndef NON_ANONYMOUS_MODE_ENABLED
  1668. tor_assert(circ->build_state->onehop_tunnel == 0);
  1669. #endif
  1670. }
  1671. if (connection_edge_send_command(edge_conn, begin_type,
  1672. begin_type == RELAY_COMMAND_BEGIN ? payload : NULL,
  1673. begin_type == RELAY_COMMAND_BEGIN ? payload_len : 0) < 0)
  1674. return -1; /* circuit is closed, don't continue */
  1675. edge_conn->package_window = STREAMWINDOW_START;
  1676. edge_conn->deliver_window = STREAMWINDOW_START;
  1677. base_conn->state = AP_CONN_STATE_CONNECT_WAIT;
  1678. log_info(LD_APP,"Address/port sent, ap socket "TOR_SOCKET_T_FORMAT
  1679. ", n_circ_id %u",
  1680. base_conn->s, (unsigned)circ->base_.n_circ_id);
  1681. control_event_stream_status(ap_conn, STREAM_EVENT_SENT_CONNECT, 0);
  1682. /* If there's queued-up data, send it now */
  1683. if ((connection_get_inbuf_len(base_conn) ||
  1684. ap_conn->sending_optimistic_data) &&
  1685. connection_ap_supports_optimistic_data(ap_conn)) {
  1686. log_info(LD_APP, "Sending up to %ld + %ld bytes of queued-up data",
  1687. (long)connection_get_inbuf_len(base_conn),
  1688. ap_conn->sending_optimistic_data ?
  1689. (long)generic_buffer_len(ap_conn->sending_optimistic_data) : 0);
  1690. if (connection_edge_package_raw_inbuf(edge_conn, 1, NULL) < 0) {
  1691. connection_mark_for_close(base_conn);
  1692. }
  1693. }
  1694. return 0;
  1695. }
  1696. /** Write a relay resolve cell, using destaddr and destport from ap_conn's
  1697. * socks_request field, and send it down circ.
  1698. *
  1699. * If ap_conn is broken, mark it for close and return -1. Else return 0.
  1700. */
  1701. int
  1702. connection_ap_handshake_send_resolve(entry_connection_t *ap_conn)
  1703. {
  1704. int payload_len, command;
  1705. const char *string_addr;
  1706. char inaddr_buf[REVERSE_LOOKUP_NAME_BUF_LEN];
  1707. origin_circuit_t *circ;
  1708. edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(ap_conn);
  1709. connection_t *base_conn = TO_CONN(edge_conn);
  1710. tor_assert(edge_conn->on_circuit);
  1711. circ = TO_ORIGIN_CIRCUIT(edge_conn->on_circuit);
  1712. tor_assert(base_conn->type == CONN_TYPE_AP);
  1713. tor_assert(base_conn->state == AP_CONN_STATE_CIRCUIT_WAIT);
  1714. tor_assert(ap_conn->socks_request);
  1715. tor_assert(circ->base_.purpose == CIRCUIT_PURPOSE_C_GENERAL);
  1716. command = ap_conn->socks_request->command;
  1717. tor_assert(SOCKS_COMMAND_IS_RESOLVE(command));
  1718. edge_conn->stream_id = get_unique_stream_id_by_circ(circ);
  1719. if (edge_conn->stream_id==0) {
  1720. /* XXXX024 Instead of closing this stream, we should make it get
  1721. * retried on another circuit. */
  1722. connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
  1723. /* Mark this circuit "unusable for new streams". */
  1724. mark_circuit_unusable_for_new_conns(circ);
  1725. return -1;
  1726. }
  1727. if (command == SOCKS_COMMAND_RESOLVE) {
  1728. string_addr = ap_conn->socks_request->address;
  1729. payload_len = (int)strlen(string_addr)+1;
  1730. } else {
  1731. /* command == SOCKS_COMMAND_RESOLVE_PTR */
  1732. const char *a = ap_conn->socks_request->address;
  1733. tor_addr_t addr;
  1734. int r;
  1735. /* We're doing a reverse lookup. The input could be an IP address, or
  1736. * could be an .in-addr.arpa or .ip6.arpa address */
  1737. r = tor_addr_parse_PTR_name(&addr, a, AF_UNSPEC, 1);
  1738. if (r <= 0) {
  1739. log_warn(LD_APP, "Rejecting ill-formed reverse lookup of %s",
  1740. safe_str_client(a));
  1741. connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
  1742. return -1;
  1743. }
  1744. r = tor_addr_to_PTR_name(inaddr_buf, sizeof(inaddr_buf), &addr);
  1745. if (r < 0) {
  1746. log_warn(LD_BUG, "Couldn't generate reverse lookup hostname of %s",
  1747. safe_str_client(a));
  1748. connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
  1749. return -1;
  1750. }
  1751. string_addr = inaddr_buf;
  1752. payload_len = (int)strlen(inaddr_buf)+1;
  1753. tor_assert(payload_len <= (int)sizeof(inaddr_buf));
  1754. }
  1755. log_debug(LD_APP,
  1756. "Sending relay cell to begin stream %d.", edge_conn->stream_id);
  1757. if (connection_edge_send_command(edge_conn,
  1758. RELAY_COMMAND_RESOLVE,
  1759. string_addr, payload_len) < 0)
  1760. return -1; /* circuit is closed, don't continue */
  1761. if (!base_conn->address) {
  1762. /* This might be unnecessary. XXXX */
  1763. base_conn->address = tor_dup_addr(&base_conn->addr);
  1764. }
  1765. base_conn->state = AP_CONN_STATE_RESOLVE_WAIT;
  1766. log_info(LD_APP,"Address sent for resolve, ap socket "TOR_SOCKET_T_FORMAT
  1767. ", n_circ_id %u",
  1768. base_conn->s, (unsigned)circ->base_.n_circ_id);
  1769. control_event_stream_status(ap_conn, STREAM_EVENT_SENT_RESOLVE, 0);
  1770. return 0;
  1771. }
  1772. /** Make an AP connection_t linked to the connection_t <b>partner</b>. make a
  1773. * new linked connection pair, and attach one side to the conn, connection_add
  1774. * it, initialize it to circuit_wait, and call
  1775. * connection_ap_handshake_attach_circuit(conn) on it.
  1776. *
  1777. * Return the newly created end of the linked connection pair, or -1 if error.
  1778. */
  1779. entry_connection_t *
  1780. connection_ap_make_link(connection_t *partner,
  1781. char *address, uint16_t port,
  1782. const char *digest,
  1783. int session_group, int isolation_flags,
  1784. int use_begindir, int want_onehop)
  1785. {
  1786. entry_connection_t *conn;
  1787. connection_t *base_conn;
  1788. log_info(LD_APP,"Making internal %s tunnel to %s:%d ...",
  1789. want_onehop ? "direct" : "anonymized",
  1790. safe_str_client(address), port);
  1791. conn = entry_connection_new(CONN_TYPE_AP, tor_addr_family(&partner->addr));
  1792. base_conn = ENTRY_TO_CONN(conn);
  1793. base_conn->linked = 1; /* so that we can add it safely below. */
  1794. /* populate conn->socks_request */
  1795. /* leave version at zero, so the socks_reply is empty */
  1796. conn->socks_request->socks_version = 0;
  1797. conn->socks_request->has_finished = 0; /* waiting for 'connected' */
  1798. strlcpy(conn->socks_request->address, address,
  1799. sizeof(conn->socks_request->address));
  1800. conn->socks_request->port = port;
  1801. conn->socks_request->command = SOCKS_COMMAND_CONNECT;
  1802. conn->want_onehop = want_onehop;
  1803. conn->use_begindir = use_begindir;
  1804. if (use_begindir) {
  1805. conn->chosen_exit_name = tor_malloc(HEX_DIGEST_LEN+2);
  1806. conn->chosen_exit_name[0] = '$';
  1807. tor_assert(digest);
  1808. base16_encode(conn->chosen_exit_name+1,HEX_DIGEST_LEN+1,
  1809. digest, DIGEST_LEN);
  1810. }
  1811. /* Populate isolation fields. */
  1812. conn->socks_request->listener_type = CONN_TYPE_DIR_LISTENER;
  1813. conn->original_dest_address = tor_strdup(address);
  1814. conn->session_group = session_group;
  1815. conn->isolation_flags = isolation_flags;
  1816. base_conn->address = tor_strdup("(Tor_internal)");
  1817. tor_addr_make_unspec(&base_conn->addr);
  1818. base_conn->port = 0;
  1819. connection_link_connections(partner, base_conn);
  1820. if (connection_add(base_conn) < 0) { /* no space, forget it */
  1821. connection_free(base_conn);
  1822. return NULL;
  1823. }
  1824. base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
  1825. control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
  1826. /* attaching to a dirty circuit is fine */
  1827. if (connection_ap_handshake_attach_circuit(conn) < 0) {
  1828. if (!base_conn->marked_for_close)
  1829. connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
  1830. return NULL;
  1831. }
  1832. log_info(LD_APP,"... application connection created and linked.");
  1833. return conn;
  1834. }
  1835. /** Notify any interested controller connections about a new hostname resolve
  1836. * or resolve error. Takes the same arguments as does
  1837. * connection_ap_handshake_socks_resolved(). */
  1838. static void
  1839. tell_controller_about_resolved_result(entry_connection_t *conn,
  1840. int answer_type,
  1841. size_t answer_len,
  1842. const char *answer,
  1843. int ttl,
  1844. time_t expires)
  1845. {
  1846. expires = time(NULL) + ttl;
  1847. if (answer_type == RESOLVED_TYPE_IPV4 && answer_len >= 4) {
  1848. char *cp = tor_dup_ip(ntohl(get_uint32(answer)));
  1849. control_event_address_mapped(conn->socks_request->address,
  1850. cp, expires, NULL, 0);
  1851. tor_free(cp);
  1852. } else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) {
  1853. char *cp = tor_strndup(answer, answer_len);
  1854. control_event_address_mapped(conn->socks_request->address,
  1855. cp, expires, NULL, 0);
  1856. tor_free(cp);
  1857. } else {
  1858. control_event_address_mapped(conn->socks_request->address,
  1859. "<error>", time(NULL)+ttl,
  1860. "error=yes", 0);
  1861. }
  1862. }
  1863. /** Send an answer to an AP connection that has requested a DNS lookup via
  1864. * SOCKS. The type should be one of RESOLVED_TYPE_(IPV4|IPV6|HOSTNAME) or -1
  1865. * for unreachable; the answer should be in the format specified in the socks
  1866. * extensions document. <b>ttl</b> is the ttl for the answer, or -1 on
  1867. * certain errors or for values that didn't come via DNS. <b>expires</b> is
  1868. * a time when the answer expires, or -1 or TIME_MAX if there's a good TTL.
  1869. **/
  1870. /* XXXX the use of the ttl and expires fields is nutty. Let's make this
  1871. * interface and those that use it less ugly. */
  1872. void
  1873. connection_ap_handshake_socks_resolved(entry_connection_t *conn,
  1874. int answer_type,
  1875. size_t answer_len,
  1876. const uint8_t *answer,
  1877. int ttl,
  1878. time_t expires)
  1879. {
  1880. char buf[384];
  1881. size_t replylen;
  1882. if (ttl >= 0) {
  1883. if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
  1884. tor_addr_t a;
  1885. tor_addr_from_ipv4n(&a, get_uint32(answer));
  1886. if (! tor_addr_is_null(&a)) {
  1887. client_dns_set_addressmap(conn,
  1888. conn->socks_request->address, &a,
  1889. conn->chosen_exit_name, ttl);
  1890. }
  1891. } else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) {
  1892. tor_addr_t a;
  1893. tor_addr_from_ipv6_bytes(&a, (char*)answer);
  1894. if (! tor_addr_is_null(&a)) {
  1895. client_dns_set_addressmap(conn,
  1896. conn->socks_request->address, &a,
  1897. conn->chosen_exit_name, ttl);
  1898. }
  1899. } else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) {
  1900. char *cp = tor_strndup((char*)answer, answer_len);
  1901. client_dns_set_reverse_addressmap(conn,
  1902. conn->socks_request->address,
  1903. cp,
  1904. conn->chosen_exit_name, ttl);
  1905. tor_free(cp);
  1906. }
  1907. }
  1908. if (ENTRY_TO_EDGE_CONN(conn)->is_dns_request) {
  1909. if (conn->dns_server_request) {
  1910. /* We had a request on our DNS port: answer it. */
  1911. dnsserv_resolved(conn, answer_type, answer_len, (char*)answer, ttl);
  1912. conn->socks_request->has_finished = 1;
  1913. return;
  1914. } else {
  1915. /* This must be a request from the controller. Since answers to those
  1916. * requests are not cached, they do not generate an ADDRMAP event on
  1917. * their own. */
  1918. tell_controller_about_resolved_result(conn, answer_type, answer_len,
  1919. (char*)answer, ttl, expires);
  1920. conn->socks_request->has_finished = 1;
  1921. return;
  1922. }
  1923. /* We shouldn't need to free conn here; it gets marked by the caller. */
  1924. }
  1925. if (conn->socks_request->socks_version == 4) {
  1926. buf[0] = 0x00; /* version */
  1927. if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
  1928. buf[1] = SOCKS4_GRANTED;
  1929. set_uint16(buf+2, 0);
  1930. memcpy(buf+4, answer, 4); /* address */
  1931. replylen = SOCKS4_NETWORK_LEN;
  1932. } else { /* "error" */
  1933. buf[1] = SOCKS4_REJECT;
  1934. memset(buf+2, 0, 6);
  1935. replylen = SOCKS4_NETWORK_LEN;
  1936. }
  1937. } else if (conn->socks_request->socks_version == 5) {
  1938. /* SOCKS5 */
  1939. buf[0] = 0x05; /* version */
  1940. if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
  1941. buf[1] = SOCKS5_SUCCEEDED;
  1942. buf[2] = 0; /* reserved */
  1943. buf[3] = 0x01; /* IPv4 address type */
  1944. memcpy(buf+4, answer, 4); /* address */
  1945. set_uint16(buf+8, 0); /* port == 0. */
  1946. replylen = 10;
  1947. } else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) {
  1948. buf[1] = SOCKS5_SUCCEEDED;
  1949. buf[2] = 0; /* reserved */
  1950. buf[3] = 0x04; /* IPv6 address type */
  1951. memcpy(buf+4, answer, 16); /* address */
  1952. set_uint16(buf+20, 0); /* port == 0. */
  1953. replylen = 22;
  1954. } else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) {
  1955. buf[1] = SOCKS5_SUCCEEDED;
  1956. buf[2] = 0; /* reserved */
  1957. buf[3] = 0x03; /* Domainname address type */
  1958. buf[4] = (char)answer_len;
  1959. memcpy(buf+5, answer, answer_len); /* address */
  1960. set_uint16(buf+5+answer_len, 0); /* port == 0. */
  1961. replylen = 5+answer_len+2;
  1962. } else {
  1963. buf[1] = SOCKS5_HOST_UNREACHABLE;
  1964. memset(buf+2, 0, 8);
  1965. replylen = 10;
  1966. }
  1967. } else {
  1968. /* no socks version info; don't send anything back */
  1969. return;
  1970. }
  1971. connection_ap_handshake_socks_reply(conn, buf, replylen,
  1972. (answer_type == RESOLVED_TYPE_IPV4 ||
  1973. answer_type == RESOLVED_TYPE_IPV6 ||
  1974. answer_type == RESOLVED_TYPE_HOSTNAME) ?
  1975. 0 : END_STREAM_REASON_RESOLVEFAILED);
  1976. }
  1977. /** Send a socks reply to stream <b>conn</b>, using the appropriate
  1978. * socks version, etc, and mark <b>conn</b> as completed with SOCKS
  1979. * handshaking.
  1980. *
  1981. * If <b>reply</b> is defined, then write <b>replylen</b> bytes of it to conn
  1982. * and return, else reply based on <b>endreason</b> (one of
  1983. * END_STREAM_REASON_*). If <b>reply</b> is undefined, <b>endreason</b> can't
  1984. * be 0 or REASON_DONE. Send endreason to the controller, if appropriate.
  1985. */
  1986. void
  1987. connection_ap_handshake_socks_reply(entry_connection_t *conn, char *reply,
  1988. size_t replylen, int endreason)
  1989. {
  1990. char buf[256];
  1991. socks5_reply_status_t status =
  1992. stream_end_reason_to_socks5_response(endreason);
  1993. tor_assert(conn->socks_request); /* make sure it's an AP stream */
  1994. if (!SOCKS_COMMAND_IS_RESOLVE(conn->socks_request->command)) {
  1995. control_event_stream_status(conn, status==SOCKS5_SUCCEEDED ?
  1996. STREAM_EVENT_SUCCEEDED : STREAM_EVENT_FAILED,
  1997. endreason);
  1998. }
  1999. /* Flag this stream's circuit as having completed a stream successfully
  2000. * (for path bias) */
  2001. if (status == SOCKS5_SUCCEEDED ||
  2002. endreason == END_STREAM_REASON_RESOLVEFAILED ||
  2003. endreason == END_STREAM_REASON_CONNECTREFUSED ||
  2004. endreason == END_STREAM_REASON_CONNRESET ||
  2005. endreason == END_STREAM_REASON_NOROUTE ||
  2006. endreason == END_STREAM_REASON_RESOURCELIMIT) {
  2007. if (!conn->edge_.on_circuit ||
  2008. !CIRCUIT_IS_ORIGIN(conn->edge_.on_circuit)) {
  2009. // DNS remaps can trigger this. So can failed hidden service
  2010. // lookups.
  2011. log_info(LD_BUG,
  2012. "No origin circuit for successful SOCKS stream "U64_FORMAT
  2013. ". Reason: %d",
  2014. U64_PRINTF_ARG(ENTRY_TO_CONN(conn)->global_identifier),
  2015. endreason);
  2016. } else {
  2017. // XXX: Hrmm. It looks like optimistic data can't go through this
  2018. // codepath, but someone should probably test it and make sure.
  2019. // We don't want to mark optimistically opened streams as successful.
  2020. pathbias_mark_use_success(TO_ORIGIN_CIRCUIT(conn->edge_.on_circuit));
  2021. }
  2022. }
  2023. if (conn->socks_request->has_finished) {
  2024. log_warn(LD_BUG, "(Harmless.) duplicate calls to "
  2025. "connection_ap_handshake_socks_reply.");
  2026. return;
  2027. }
  2028. if (replylen) { /* we already have a reply in mind */
  2029. connection_write_to_buf(reply, replylen, ENTRY_TO_CONN(conn));
  2030. conn->socks_request->has_finished = 1;
  2031. return;
  2032. }
  2033. if (conn->socks_request->socks_version == 4) {
  2034. memset(buf,0,SOCKS4_NETWORK_LEN);
  2035. buf[1] = (status==SOCKS5_SUCCEEDED ? SOCKS4_GRANTED : SOCKS4_REJECT);
  2036. /* leave version, destport, destip zero */
  2037. connection_write_to_buf(buf, SOCKS4_NETWORK_LEN, ENTRY_TO_CONN(conn));
  2038. } else if (conn->socks_request->socks_version == 5) {
  2039. buf[0] = 5; /* version 5 */
  2040. buf[1] = (char)status;
  2041. buf[2] = 0;
  2042. buf[3] = 1; /* ipv4 addr */
  2043. memset(buf+4,0,6); /* Set external addr/port to 0.
  2044. The spec doesn't seem to say what to do here. -RD */
  2045. connection_write_to_buf(buf,10,ENTRY_TO_CONN(conn));
  2046. }
  2047. /* If socks_version isn't 4 or 5, don't send anything.
  2048. * This can happen in the case of AP bridges. */
  2049. conn->socks_request->has_finished = 1;
  2050. return;
  2051. }
  2052. /** Read a RELAY_BEGIN or RELAY_BEGINDIR cell from <b>cell</b>, decode it, and
  2053. * place the result in <b>bcell</b>. On success return 0; on failure return
  2054. * <0 and set *<b>end_reason_out</b> to the end reason we should send back to
  2055. * the client.
  2056. *
  2057. * Return -1 in the case where want to send a RELAY_END cell, and < -1 when
  2058. * we don't.
  2059. **/
  2060. STATIC int
  2061. begin_cell_parse(const cell_t *cell, begin_cell_t *bcell,
  2062. uint8_t *end_reason_out)
  2063. {
  2064. relay_header_t rh;
  2065. const uint8_t *body, *nul;
  2066. memset(bcell, 0, sizeof(*bcell));
  2067. *end_reason_out = END_STREAM_REASON_MISC;
  2068. relay_header_unpack(&rh, cell->payload);
  2069. if (rh.length > RELAY_PAYLOAD_SIZE) {
  2070. return -2; /*XXXX why not TORPROTOCOL? */
  2071. }
  2072. bcell->stream_id = rh.stream_id;
  2073. if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
  2074. bcell->is_begindir = 1;
  2075. return 0;
  2076. } else if (rh.command != RELAY_COMMAND_BEGIN) {
  2077. log_warn(LD_BUG, "Got an unexpected command %d", (int)rh.command);
  2078. *end_reason_out = END_STREAM_REASON_INTERNAL;
  2079. return -1;
  2080. }
  2081. body = cell->payload + RELAY_HEADER_SIZE;
  2082. nul = memchr(body, 0, rh.length);
  2083. if (! nul) {
  2084. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  2085. "Relay begin cell has no \\0. Closing.");
  2086. *end_reason_out = END_STREAM_REASON_TORPROTOCOL;
  2087. return -1;
  2088. }
  2089. if (tor_addr_port_split(LOG_PROTOCOL_WARN,
  2090. (char*)(body),
  2091. &bcell->address,&bcell->port)<0) {
  2092. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  2093. "Unable to parse addr:port in relay begin cell. Closing.");
  2094. *end_reason_out = END_STREAM_REASON_TORPROTOCOL;
  2095. return -1;
  2096. }
  2097. if (bcell->port == 0) {
  2098. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  2099. "Missing port in relay begin cell. Closing.");
  2100. tor_free(bcell->address);
  2101. *end_reason_out = END_STREAM_REASON_TORPROTOCOL;
  2102. return -1;
  2103. }
  2104. if (body + rh.length >= nul + 4)
  2105. bcell->flags = ntohl(get_uint32(nul+1));
  2106. return 0;
  2107. }
  2108. /** A relay 'begin' or 'begin_dir' cell has arrived, and either we are
  2109. * an exit hop for the circuit, or we are the origin and it is a
  2110. * rendezvous begin.
  2111. *
  2112. * Launch a new exit connection and initialize things appropriately.
  2113. *
  2114. * If it's a rendezvous stream, call connection_exit_connect() on
  2115. * it.
  2116. *
  2117. * For general streams, call dns_resolve() on it first, and only call
  2118. * connection_exit_connect() if the dns answer is already known.
  2119. *
  2120. * Note that we don't call connection_add() on the new stream! We wait
  2121. * for connection_exit_connect() to do that.
  2122. *
  2123. * Return -(some circuit end reason) if we want to tear down <b>circ</b>.
  2124. * Else return 0.
  2125. */
  2126. int
  2127. connection_exit_begin_conn(cell_t *cell, circuit_t *circ)
  2128. {
  2129. edge_connection_t *n_stream;
  2130. relay_header_t rh;
  2131. char *address = NULL;
  2132. uint16_t port = 0;
  2133. or_circuit_t *or_circ = NULL;
  2134. const or_options_t *options = get_options();
  2135. begin_cell_t bcell;
  2136. int r;
  2137. uint8_t end_reason=0;
  2138. assert_circuit_ok(circ);
  2139. if (!CIRCUIT_IS_ORIGIN(circ))
  2140. or_circ = TO_OR_CIRCUIT(circ);
  2141. relay_header_unpack(&rh, cell->payload);
  2142. if (rh.length > RELAY_PAYLOAD_SIZE)
  2143. return -1;
  2144. /* Note: we have to use relay_send_command_from_edge here, not
  2145. * connection_edge_end or connection_edge_send_command, since those require
  2146. * that we have a stream connected to a circuit, and we don't connect to a
  2147. * circuit until we have a pending/successful resolve. */
  2148. if (!server_mode(options) &&
  2149. circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) {
  2150. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  2151. "Relay begin cell at non-server. Closing.");
  2152. relay_send_end_cell_from_edge(rh.stream_id, circ,
  2153. END_STREAM_REASON_EXITPOLICY, NULL);
  2154. return 0;
  2155. }
  2156. r = begin_cell_parse(cell, &bcell, &end_reason);
  2157. if (r < -1) {
  2158. return -1;
  2159. } else if (r == -1) {
  2160. tor_free(bcell.address);
  2161. relay_send_end_cell_from_edge(rh.stream_id, circ, end_reason, NULL);
  2162. return 0;
  2163. }
  2164. if (! bcell.is_begindir) {
  2165. /* Steal reference */
  2166. address = bcell.address;
  2167. port = bcell.port;
  2168. if (or_circ && or_circ->p_chan) {
  2169. if (!options->AllowSingleHopExits &&
  2170. (or_circ->is_first_hop ||
  2171. (!connection_or_digest_is_known_relay(
  2172. or_circ->p_chan->identity_digest) &&
  2173. should_refuse_unknown_exits(options)))) {
  2174. /* Don't let clients use us as a single-hop proxy, unless the user
  2175. * has explicitly allowed that in the config. It attracts attackers
  2176. * and users who'd be better off with, well, single-hop proxies.
  2177. */
  2178. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  2179. "Attempt by %s to open a stream %s. Closing.",
  2180. safe_str(channel_get_canonical_remote_descr(or_circ->p_chan)),
  2181. or_circ->is_first_hop ? "on first hop of circuit" :
  2182. "from unknown relay");
  2183. relay_send_end_cell_from_edge(rh.stream_id, circ,
  2184. or_circ->is_first_hop ?
  2185. END_STREAM_REASON_TORPROTOCOL :
  2186. END_STREAM_REASON_MISC,
  2187. NULL);
  2188. tor_free(address);
  2189. return 0;
  2190. }
  2191. }
  2192. } else if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
  2193. if (!directory_permits_begindir_requests(options) ||
  2194. circ->purpose != CIRCUIT_PURPOSE_OR) {
  2195. relay_send_end_cell_from_edge(rh.stream_id, circ,
  2196. END_STREAM_REASON_NOTDIRECTORY, NULL);
  2197. return 0;
  2198. }
  2199. /* Make sure to get the 'real' address of the previous hop: the
  2200. * caller might want to know whether his IP address has changed, and
  2201. * we might already have corrected base_.addr[ess] for the relay's
  2202. * canonical IP address. */
  2203. if (or_circ && or_circ->p_chan)
  2204. address = tor_strdup(channel_get_actual_remote_address(or_circ->p_chan));
  2205. else
  2206. address = tor_strdup("127.0.0.1");
  2207. port = 1; /* XXXX This value is never actually used anywhere, and there
  2208. * isn't "really" a connection here. But we
  2209. * need to set it to something nonzero. */
  2210. } else {
  2211. log_warn(LD_BUG, "Got an unexpected command %d", (int)rh.command);
  2212. relay_send_end_cell_from_edge(rh.stream_id, circ,
  2213. END_STREAM_REASON_INTERNAL, NULL);
  2214. return 0;
  2215. }
  2216. if (! options->IPv6Exit) {
  2217. /* I don't care if you prefer IPv6; I can't give you any. */
  2218. bcell.flags &= ~BEGIN_FLAG_IPV6_PREFERRED;
  2219. /* If you don't want IPv4, I can't help. */
  2220. if (bcell.flags & BEGIN_FLAG_IPV4_NOT_OK) {
  2221. tor_free(address);
  2222. relay_send_end_cell_from_edge(rh.stream_id, circ,
  2223. END_STREAM_REASON_EXITPOLICY, NULL);
  2224. return 0;
  2225. }
  2226. }
  2227. log_debug(LD_EXIT,"Creating new exit connection.");
  2228. /* The 'AF_INET' here is temporary; we might need to change it later in
  2229. * connection_exit_connect(). */
  2230. n_stream = edge_connection_new(CONN_TYPE_EXIT, AF_INET);
  2231. /* Remember the tunneled request ID in the new edge connection, so that
  2232. * we can measure download times. */
  2233. n_stream->dirreq_id = circ->dirreq_id;
  2234. n_stream->base_.purpose = EXIT_PURPOSE_CONNECT;
  2235. n_stream->begincell_flags = bcell.flags;
  2236. n_stream->stream_id = rh.stream_id;
  2237. n_stream->base_.port = port;
  2238. /* leave n_stream->s at -1, because it's not yet valid */
  2239. n_stream->package_window = STREAMWINDOW_START;
  2240. n_stream->deliver_window = STREAMWINDOW_START;
  2241. if (circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED) {
  2242. origin_circuit_t *origin_circ = TO_ORIGIN_CIRCUIT(circ);
  2243. log_info(LD_REND,"begin is for rendezvous. configuring stream.");
  2244. n_stream->base_.address = tor_strdup("(rendezvous)");
  2245. n_stream->base_.state = EXIT_CONN_STATE_CONNECTING;
  2246. n_stream->rend_data = rend_data_dup(origin_circ->rend_data);
  2247. tor_assert(connection_edge_is_rendezvous_stream(n_stream));
  2248. assert_circuit_ok(circ);
  2249. if (rend_service_set_connection_addr_port(n_stream, origin_circ) < 0) {
  2250. log_info(LD_REND,"Didn't find rendezvous service (port %d)",
  2251. n_stream->base_.port);
  2252. relay_send_end_cell_from_edge(rh.stream_id, circ,
  2253. END_STREAM_REASON_EXITPOLICY,
  2254. origin_circ->cpath->prev);
  2255. connection_free(TO_CONN(n_stream));
  2256. tor_free(address);
  2257. return 0;
  2258. }
  2259. assert_circuit_ok(circ);
  2260. log_debug(LD_REND,"Finished assigning addr/port");
  2261. n_stream->cpath_layer = origin_circ->cpath->prev; /* link it */
  2262. /* add it into the linked list of p_streams on this circuit */
  2263. n_stream->next_stream = origin_circ->p_streams;
  2264. n_stream->on_circuit = circ;
  2265. origin_circ->p_streams = n_stream;
  2266. assert_circuit_ok(circ);
  2267. connection_exit_connect(n_stream);
  2268. /* For path bias: This circuit was used successfully */
  2269. pathbias_mark_use_success(origin_circ);
  2270. tor_free(address);
  2271. return 0;
  2272. }
  2273. tor_strlower(address);
  2274. n_stream->base_.address = address;
  2275. n_stream->base_.state = EXIT_CONN_STATE_RESOLVEFAILED;
  2276. /* default to failed, change in dns_resolve if it turns out not to fail */
  2277. if (we_are_hibernating()) {
  2278. relay_send_end_cell_from_edge(rh.stream_id, circ,
  2279. END_STREAM_REASON_HIBERNATING, NULL);
  2280. connection_free(TO_CONN(n_stream));
  2281. return 0;
  2282. }
  2283. n_stream->on_circuit = circ;
  2284. if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
  2285. tor_addr_t tmp_addr;
  2286. tor_assert(or_circ);
  2287. if (or_circ->p_chan &&
  2288. channel_get_addr_if_possible(or_circ->p_chan, &tmp_addr)) {
  2289. tor_addr_copy(&n_stream->base_.addr, &tmp_addr);
  2290. }
  2291. return connection_exit_connect_dir(n_stream);
  2292. }
  2293. log_debug(LD_EXIT,"about to start the dns_resolve().");
  2294. /* send it off to the gethostbyname farm */
  2295. switch (dns_resolve(n_stream)) {
  2296. case 1: /* resolve worked; now n_stream is attached to circ. */
  2297. assert_circuit_ok(circ);
  2298. log_debug(LD_EXIT,"about to call connection_exit_connect().");
  2299. connection_exit_connect(n_stream);
  2300. return 0;
  2301. case -1: /* resolve failed */
  2302. relay_send_end_cell_from_edge(rh.stream_id, circ,
  2303. END_STREAM_REASON_RESOLVEFAILED, NULL);
  2304. /* n_stream got freed. don't touch it. */
  2305. break;
  2306. case 0: /* resolve added to pending list */
  2307. assert_circuit_ok(circ);
  2308. break;
  2309. }
  2310. return 0;
  2311. }
  2312. /**
  2313. * Called when we receive a RELAY_COMMAND_RESOLVE cell 'cell' along the
  2314. * circuit <b>circ</b>;
  2315. * begin resolving the hostname, and (eventually) reply with a RESOLVED cell.
  2316. */
  2317. int
  2318. connection_exit_begin_resolve(cell_t *cell, or_circuit_t *circ)
  2319. {
  2320. edge_connection_t *dummy_conn;
  2321. relay_header_t rh;
  2322. assert_circuit_ok(TO_CIRCUIT(circ));
  2323. relay_header_unpack(&rh, cell->payload);
  2324. if (rh.length > RELAY_PAYLOAD_SIZE)
  2325. return -1;
  2326. /* This 'dummy_conn' only exists to remember the stream ID
  2327. * associated with the resolve request; and to make the
  2328. * implementation of dns.c more uniform. (We really only need to
  2329. * remember the circuit, the stream ID, and the hostname to be
  2330. * resolved; but if we didn't store them in a connection like this,
  2331. * the housekeeping in dns.c would get way more complicated.)
  2332. */
  2333. dummy_conn = edge_connection_new(CONN_TYPE_EXIT, AF_INET);
  2334. dummy_conn->stream_id = rh.stream_id;
  2335. dummy_conn->base_.address = tor_strndup(
  2336. (char*)cell->payload+RELAY_HEADER_SIZE,
  2337. rh.length);
  2338. dummy_conn->base_.port = 0;
  2339. dummy_conn->base_.state = EXIT_CONN_STATE_RESOLVEFAILED;
  2340. dummy_conn->base_.purpose = EXIT_PURPOSE_RESOLVE;
  2341. dummy_conn->on_circuit = TO_CIRCUIT(circ);
  2342. /* send it off to the gethostbyname farm */
  2343. switch (dns_resolve(dummy_conn)) {
  2344. case -1: /* Impossible to resolve; a resolved cell was sent. */
  2345. /* Connection freed; don't touch it. */
  2346. return 0;
  2347. case 1: /* The result was cached; a resolved cell was sent. */
  2348. if (!dummy_conn->base_.marked_for_close)
  2349. connection_free(TO_CONN(dummy_conn));
  2350. return 0;
  2351. case 0: /* resolve added to pending list */
  2352. assert_circuit_ok(TO_CIRCUIT(circ));
  2353. break;
  2354. }
  2355. return 0;
  2356. }
  2357. /** Connect to conn's specified addr and port. If it worked, conn
  2358. * has now been added to the connection_array.
  2359. *
  2360. * Send back a connected cell. Include the resolved IP of the destination
  2361. * address, but <em>only</em> if it's a general exit stream. (Rendezvous
  2362. * streams must not reveal what IP they connected to.)
  2363. */
  2364. void
  2365. connection_exit_connect(edge_connection_t *edge_conn)
  2366. {
  2367. const tor_addr_t *addr;
  2368. uint16_t port;
  2369. connection_t *conn = TO_CONN(edge_conn);
  2370. int socket_error = 0;
  2371. if ( (!connection_edge_is_rendezvous_stream(edge_conn) &&
  2372. router_compare_to_my_exit_policy(&edge_conn->base_.addr,
  2373. edge_conn->base_.port)) ||
  2374. (tor_addr_family(&conn->addr) == AF_INET6 &&
  2375. ! get_options()->IPv6Exit)) {
  2376. log_info(LD_EXIT,"%s:%d failed exit policy. Closing.",
  2377. escaped_safe_str_client(conn->address), conn->port);
  2378. connection_edge_end(edge_conn, END_STREAM_REASON_EXITPOLICY);
  2379. circuit_detach_stream(circuit_get_by_edge_conn(edge_conn), edge_conn);
  2380. connection_free(conn);
  2381. return;
  2382. }
  2383. addr = &conn->addr;
  2384. port = conn->port;
  2385. if (tor_addr_family(addr) == AF_INET6)
  2386. conn->socket_family = AF_INET6;
  2387. log_debug(LD_EXIT,"about to try connecting");
  2388. switch (connection_connect(conn, conn->address, addr, port, &socket_error)) {
  2389. case -1: {
  2390. int reason = errno_to_stream_end_reason(socket_error);
  2391. connection_edge_end(edge_conn, reason);
  2392. circuit_detach_stream(circuit_get_by_edge_conn(edge_conn), edge_conn);
  2393. connection_free(conn);
  2394. return;
  2395. }
  2396. case 0:
  2397. conn->state = EXIT_CONN_STATE_CONNECTING;
  2398. connection_watch_events(conn, READ_EVENT | WRITE_EVENT);
  2399. /* writable indicates finish;
  2400. * readable/error indicates broken link in windows-land. */
  2401. return;
  2402. /* case 1: fall through */
  2403. }
  2404. conn->state = EXIT_CONN_STATE_OPEN;
  2405. if (connection_get_outbuf_len(conn)) {
  2406. /* in case there are any queued data cells, from e.g. optimistic data */
  2407. IF_HAS_NO_BUFFEREVENT(conn)
  2408. connection_watch_events(conn, READ_EVENT|WRITE_EVENT);
  2409. } else {
  2410. IF_HAS_NO_BUFFEREVENT(conn)
  2411. connection_watch_events(conn, READ_EVENT);
  2412. }
  2413. /* also, deliver a 'connected' cell back through the circuit. */
  2414. if (connection_edge_is_rendezvous_stream(edge_conn)) {
  2415. /* rendezvous stream */
  2416. /* don't send an address back! */
  2417. connection_edge_send_command(edge_conn,
  2418. RELAY_COMMAND_CONNECTED,
  2419. NULL, 0);
  2420. } else { /* normal stream */
  2421. uint8_t connected_payload[MAX_CONNECTED_CELL_PAYLOAD_LEN];
  2422. int connected_payload_len =
  2423. connected_cell_format_payload(connected_payload, &conn->addr,
  2424. edge_conn->address_ttl);
  2425. if (connected_payload_len < 0) {
  2426. connection_edge_end(edge_conn, END_STREAM_REASON_INTERNAL);
  2427. circuit_detach_stream(circuit_get_by_edge_conn(edge_conn), edge_conn);
  2428. connection_free(conn);
  2429. return;
  2430. }
  2431. connection_edge_send_command(edge_conn,
  2432. RELAY_COMMAND_CONNECTED,
  2433. (char*)connected_payload,
  2434. connected_payload_len);
  2435. }
  2436. }
  2437. /** Given an exit conn that should attach to us as a directory server, open a
  2438. * bridge connection with a linked connection pair, create a new directory
  2439. * conn, and join them together. Return 0 on success (or if there was an
  2440. * error we could send back an end cell for). Return -(some circuit end
  2441. * reason) if the circuit needs to be torn down. Either connects
  2442. * <b>exitconn</b>, frees it, or marks it, as appropriate.
  2443. */
  2444. static int
  2445. connection_exit_connect_dir(edge_connection_t *exitconn)
  2446. {
  2447. dir_connection_t *dirconn = NULL;
  2448. or_circuit_t *circ = TO_OR_CIRCUIT(exitconn->on_circuit);
  2449. log_info(LD_EXIT, "Opening local connection for anonymized directory exit");
  2450. exitconn->base_.state = EXIT_CONN_STATE_OPEN;
  2451. dirconn = dir_connection_new(tor_addr_family(&exitconn->base_.addr));
  2452. tor_addr_copy(&dirconn->base_.addr, &exitconn->base_.addr);
  2453. dirconn->base_.port = 0;
  2454. dirconn->base_.address = tor_strdup(exitconn->base_.address);
  2455. dirconn->base_.type = CONN_TYPE_DIR;
  2456. dirconn->base_.purpose = DIR_PURPOSE_SERVER;
  2457. dirconn->base_.state = DIR_CONN_STATE_SERVER_COMMAND_WAIT;
  2458. /* Note that the new dir conn belongs to the same tunneled request as
  2459. * the edge conn, so that we can measure download times. */
  2460. dirconn->dirreq_id = exitconn->dirreq_id;
  2461. connection_link_connections(TO_CONN(dirconn), TO_CONN(exitconn));
  2462. if (connection_add(TO_CONN(exitconn))<0) {
  2463. connection_edge_end(exitconn, END_STREAM_REASON_RESOURCELIMIT);
  2464. connection_free(TO_CONN(exitconn));
  2465. connection_free(TO_CONN(dirconn));
  2466. return 0;
  2467. }
  2468. /* link exitconn to circ, now that we know we can use it. */
  2469. exitconn->next_stream = circ->n_streams;
  2470. circ->n_streams = exitconn;
  2471. if (connection_add(TO_CONN(dirconn))<0) {
  2472. connection_edge_end(exitconn, END_STREAM_REASON_RESOURCELIMIT);
  2473. connection_close_immediate(TO_CONN(exitconn));
  2474. connection_mark_for_close(TO_CONN(exitconn));
  2475. connection_free(TO_CONN(dirconn));
  2476. return 0;
  2477. }
  2478. connection_start_reading(TO_CONN(dirconn));
  2479. connection_start_reading(TO_CONN(exitconn));
  2480. if (connection_edge_send_command(exitconn,
  2481. RELAY_COMMAND_CONNECTED, NULL, 0) < 0) {
  2482. connection_mark_for_close(TO_CONN(exitconn));
  2483. connection_mark_for_close(TO_CONN(dirconn));
  2484. return 0;
  2485. }
  2486. return 0;
  2487. }
  2488. /** Return 1 if <b>conn</b> is a rendezvous stream, or 0 if
  2489. * it is a general stream.
  2490. */
  2491. int
  2492. connection_edge_is_rendezvous_stream(edge_connection_t *conn)
  2493. {
  2494. tor_assert(conn);
  2495. if (conn->rend_data)
  2496. return 1;
  2497. return 0;
  2498. }
  2499. /** Return 1 if router <b>exit</b> is likely to allow stream <b>conn</b>
  2500. * to exit from it, or 0 if it probably will not allow it.
  2501. * (We might be uncertain if conn's destination address has not yet been
  2502. * resolved.)
  2503. */
  2504. int
  2505. connection_ap_can_use_exit(const entry_connection_t *conn, const node_t *exit)
  2506. {
  2507. const or_options_t *options = get_options();
  2508. tor_assert(conn);
  2509. tor_assert(conn->socks_request);
  2510. tor_assert(exit);
  2511. /* If a particular exit node has been requested for the new connection,
  2512. * make sure the exit node of the existing circuit matches exactly.
  2513. */
  2514. if (conn->chosen_exit_name) {
  2515. const node_t *chosen_exit =
  2516. node_get_by_nickname(conn->chosen_exit_name, 1);
  2517. if (!chosen_exit || tor_memneq(chosen_exit->identity,
  2518. exit->identity, DIGEST_LEN)) {
  2519. /* doesn't match */
  2520. // log_debug(LD_APP,"Requested node '%s', considering node '%s'. No.",
  2521. // conn->chosen_exit_name, exit->nickname);
  2522. return 0;
  2523. }
  2524. }
  2525. if (conn->use_begindir) {
  2526. /* Internal directory fetches do not count as exiting. */
  2527. return 1;
  2528. }
  2529. if (conn->socks_request->command == SOCKS_COMMAND_CONNECT) {
  2530. tor_addr_t addr, *addrp = NULL;
  2531. addr_policy_result_t r;
  2532. if (0 == tor_addr_parse(&addr, conn->socks_request->address)) {
  2533. addrp = &addr;
  2534. } else if (!conn->ipv4_traffic_ok && conn->ipv6_traffic_ok) {
  2535. tor_addr_make_null(&addr, AF_INET6);
  2536. addrp = &addr;
  2537. } else if (conn->ipv4_traffic_ok && !conn->ipv6_traffic_ok) {
  2538. tor_addr_make_null(&addr, AF_INET);
  2539. addrp = &addr;
  2540. }
  2541. r = compare_tor_addr_to_node_policy(addrp, conn->socks_request->port,exit);
  2542. if (r == ADDR_POLICY_REJECTED)
  2543. return 0; /* We know the address, and the exit policy rejects it. */
  2544. if (r == ADDR_POLICY_PROBABLY_REJECTED && !conn->chosen_exit_name)
  2545. return 0; /* We don't know the addr, but the exit policy rejects most
  2546. * addresses with this port. Since the user didn't ask for
  2547. * this node, err on the side of caution. */
  2548. } else if (SOCKS_COMMAND_IS_RESOLVE(conn->socks_request->command)) {
  2549. /* Don't send DNS requests to non-exit servers by default. */
  2550. if (!conn->chosen_exit_name && node_exit_policy_rejects_all(exit))
  2551. return 0;
  2552. }
  2553. if (routerset_contains_node(options->ExcludeExitNodesUnion_, exit)) {
  2554. /* Not a suitable exit. Refuse it. */
  2555. return 0;
  2556. }
  2557. return 1;
  2558. }
  2559. /** If address is of the form "y.onion" with a well-formed handle y:
  2560. * Put a NUL after y, lower-case it, and return ONION_HOSTNAME.
  2561. *
  2562. * If address is of the form "x.y.onion" with a well-formed handle x:
  2563. * Drop "x.", put a NUL after y, lower-case it, and return ONION_HOSTNAME.
  2564. *
  2565. * If address is of the form "y.onion" with a badly-formed handle y:
  2566. * Return BAD_HOSTNAME and log a message.
  2567. *
  2568. * If address is of the form "y.exit":
  2569. * Put a NUL after y and return EXIT_HOSTNAME.
  2570. *
  2571. * Otherwise:
  2572. * Return NORMAL_HOSTNAME and change nothing.
  2573. */
  2574. hostname_type_t
  2575. parse_extended_hostname(char *address)
  2576. {
  2577. char *s;
  2578. char *q;
  2579. char query[REND_SERVICE_ID_LEN_BASE32+1];
  2580. s = strrchr(address,'.');
  2581. if (!s)
  2582. return NORMAL_HOSTNAME; /* no dot, thus normal */
  2583. if (!strcmp(s+1,"exit")) {
  2584. *s = 0; /* NUL-terminate it */
  2585. return EXIT_HOSTNAME; /* .exit */
  2586. }
  2587. if (strcmp(s+1,"onion"))
  2588. return NORMAL_HOSTNAME; /* neither .exit nor .onion, thus normal */
  2589. /* so it is .onion */
  2590. *s = 0; /* NUL-terminate it */
  2591. /* locate a 'sub-domain' component, in order to remove it */
  2592. q = strrchr(address, '.');
  2593. if (q == address) {
  2594. goto failed; /* reject sub-domain, as DNS does */
  2595. }
  2596. q = (NULL == q) ? address : q + 1;
  2597. if (strlcpy(query, q, REND_SERVICE_ID_LEN_BASE32+1) >=
  2598. REND_SERVICE_ID_LEN_BASE32+1)
  2599. goto failed;
  2600. if (q != address) {
  2601. memmove(address, q, strlen(q) + 1 /* also get \0 */);
  2602. }
  2603. if (rend_valid_service_id(query)) {
  2604. return ONION_HOSTNAME; /* success */
  2605. }
  2606. failed:
  2607. /* otherwise, return to previous state and return 0 */
  2608. *s = '.';
  2609. log_warn(LD_APP, "Invalid onion hostname %s; rejecting",
  2610. safe_str_client(address));
  2611. return BAD_HOSTNAME;
  2612. }
  2613. /** Return true iff the (possibly NULL) <b>alen</b>-byte chunk of memory at
  2614. * <b>a</b> is equal to the (possibly NULL) <b>blen</b>-byte chunk of memory
  2615. * at <b>b</b>. */
  2616. static int
  2617. memeq_opt(const char *a, size_t alen, const char *b, size_t blen)
  2618. {
  2619. if (a == NULL) {
  2620. return (b == NULL);
  2621. } else if (b == NULL) {
  2622. return 0;
  2623. } else if (alen != blen) {
  2624. return 0;
  2625. } else {
  2626. return tor_memeq(a, b, alen);
  2627. }
  2628. }
  2629. /**
  2630. * Return true iff none of the isolation flags and fields in <b>conn</b>
  2631. * should prevent it from being attached to <b>circ</b>.
  2632. */
  2633. int
  2634. connection_edge_compatible_with_circuit(const entry_connection_t *conn,
  2635. const origin_circuit_t *circ)
  2636. {
  2637. const uint8_t iso = conn->isolation_flags;
  2638. const socks_request_t *sr = conn->socks_request;
  2639. /* If circ has never been used for an isolated connection, we can
  2640. * totally use it for this one. */
  2641. if (!circ->isolation_values_set)
  2642. return 1;
  2643. /* If circ has been used for connections having more than one value
  2644. * for some field f, it will have the corresponding bit set in
  2645. * isolation_flags_mixed. If isolation_flags_mixed has any bits
  2646. * in common with iso, then conn must be isolated from at least
  2647. * one stream that has been attached to circ. */
  2648. if ((iso & circ->isolation_flags_mixed) != 0) {
  2649. /* For at least one field where conn is isolated, the circuit
  2650. * already has mixed streams. */
  2651. return 0;
  2652. }
  2653. if (! conn->original_dest_address) {
  2654. log_warn(LD_BUG, "Reached connection_edge_compatible_with_circuit without "
  2655. "having set conn->original_dest_address");
  2656. ((entry_connection_t*)conn)->original_dest_address =
  2657. tor_strdup(conn->socks_request->address);
  2658. }
  2659. if ((iso & ISO_STREAM) &&
  2660. (circ->associated_isolated_stream_global_id !=
  2661. ENTRY_TO_CONN(conn)->global_identifier))
  2662. return 0;
  2663. if ((iso & ISO_DESTPORT) && conn->socks_request->port != circ->dest_port)
  2664. return 0;
  2665. if ((iso & ISO_DESTADDR) &&
  2666. strcasecmp(conn->original_dest_address, circ->dest_address))
  2667. return 0;
  2668. if ((iso & ISO_SOCKSAUTH) &&
  2669. (! memeq_opt(sr->username, sr->usernamelen,
  2670. circ->socks_username, circ->socks_username_len) ||
  2671. ! memeq_opt(sr->password, sr->passwordlen,
  2672. circ->socks_password, circ->socks_password_len)))
  2673. return 0;
  2674. if ((iso & ISO_CLIENTPROTO) &&
  2675. (conn->socks_request->listener_type != circ->client_proto_type ||
  2676. conn->socks_request->socks_version != circ->client_proto_socksver))
  2677. return 0;
  2678. if ((iso & ISO_CLIENTADDR) &&
  2679. !tor_addr_eq(&ENTRY_TO_CONN(conn)->addr, &circ->client_addr))
  2680. return 0;
  2681. if ((iso & ISO_SESSIONGRP) && conn->session_group != circ->session_group)
  2682. return 0;
  2683. if ((iso & ISO_NYM_EPOCH) && conn->nym_epoch != circ->nym_epoch)
  2684. return 0;
  2685. return 1;
  2686. }
  2687. /**
  2688. * If <b>dry_run</b> is false, update <b>circ</b>'s isolation flags and fields
  2689. * to reflect having had <b>conn</b> attached to it, and return 0. Otherwise,
  2690. * if <b>dry_run</b> is true, then make no changes to <b>circ</b>, and return
  2691. * a bitfield of isolation flags that we would have to set in
  2692. * isolation_flags_mixed to add <b>conn</b> to <b>circ</b>, or -1 if
  2693. * <b>circ</b> has had no streams attached to it.
  2694. */
  2695. int
  2696. connection_edge_update_circuit_isolation(const entry_connection_t *conn,
  2697. origin_circuit_t *circ,
  2698. int dry_run)
  2699. {
  2700. const socks_request_t *sr = conn->socks_request;
  2701. if (! conn->original_dest_address) {
  2702. log_warn(LD_BUG, "Reached connection_update_circuit_isolation without "
  2703. "having set conn->original_dest_address");
  2704. ((entry_connection_t*)conn)->original_dest_address =
  2705. tor_strdup(conn->socks_request->address);
  2706. }
  2707. if (!circ->isolation_values_set) {
  2708. if (dry_run)
  2709. return -1;
  2710. circ->associated_isolated_stream_global_id =
  2711. ENTRY_TO_CONN(conn)->global_identifier;
  2712. circ->dest_port = conn->socks_request->port;
  2713. circ->dest_address = tor_strdup(conn->original_dest_address);
  2714. circ->client_proto_type = conn->socks_request->listener_type;
  2715. circ->client_proto_socksver = conn->socks_request->socks_version;
  2716. tor_addr_copy(&circ->client_addr, &ENTRY_TO_CONN(conn)->addr);
  2717. circ->session_group = conn->session_group;
  2718. circ->nym_epoch = conn->nym_epoch;
  2719. circ->socks_username = sr->username ?
  2720. tor_memdup(sr->username, sr->usernamelen) : NULL;
  2721. circ->socks_password = sr->password ?
  2722. tor_memdup(sr->password, sr->passwordlen) : NULL;
  2723. circ->socks_username_len = sr->usernamelen;
  2724. circ->socks_password_len = sr->passwordlen;
  2725. circ->isolation_values_set = 1;
  2726. return 0;
  2727. } else {
  2728. uint8_t mixed = 0;
  2729. if (conn->socks_request->port != circ->dest_port)
  2730. mixed |= ISO_DESTPORT;
  2731. if (strcasecmp(conn->original_dest_address, circ->dest_address))
  2732. mixed |= ISO_DESTADDR;
  2733. if (!memeq_opt(sr->username, sr->usernamelen,
  2734. circ->socks_username, circ->socks_username_len) ||
  2735. !memeq_opt(sr->password, sr->passwordlen,
  2736. circ->socks_password, circ->socks_password_len))
  2737. mixed |= ISO_SOCKSAUTH;
  2738. if ((conn->socks_request->listener_type != circ->client_proto_type ||
  2739. conn->socks_request->socks_version != circ->client_proto_socksver))
  2740. mixed |= ISO_CLIENTPROTO;
  2741. if (!tor_addr_eq(&ENTRY_TO_CONN(conn)->addr, &circ->client_addr))
  2742. mixed |= ISO_CLIENTADDR;
  2743. if (conn->session_group != circ->session_group)
  2744. mixed |= ISO_SESSIONGRP;
  2745. if (conn->nym_epoch != circ->nym_epoch)
  2746. mixed |= ISO_NYM_EPOCH;
  2747. if (dry_run)
  2748. return mixed;
  2749. if ((mixed & conn->isolation_flags) != 0) {
  2750. log_warn(LD_BUG, "Updating a circuit with seemingly incompatible "
  2751. "isolation flags.");
  2752. }
  2753. circ->isolation_flags_mixed |= mixed;
  2754. return 0;
  2755. }
  2756. }
  2757. /**
  2758. * Clear the isolation settings on <b>circ</b>.
  2759. *
  2760. * This only works on an open circuit that has never had a stream attached to
  2761. * it, and whose isolation settings are hypothetical. (We set hypothetical
  2762. * isolation settings on circuits as we're launching them, so that we
  2763. * know whether they can handle more streams or whether we need to launch
  2764. * even more circuits. Once the circuit is open, if it turns out that
  2765. * we no longer have any streams to attach to it, we clear the isolation flags
  2766. * and data so that other streams can have a chance.)
  2767. */
  2768. void
  2769. circuit_clear_isolation(origin_circuit_t *circ)
  2770. {
  2771. if (circ->isolation_any_streams_attached) {
  2772. log_warn(LD_BUG, "Tried to clear the isolation status of a dirty circuit");
  2773. return;
  2774. }
  2775. if (TO_CIRCUIT(circ)->state != CIRCUIT_STATE_OPEN) {
  2776. log_warn(LD_BUG, "Tried to clear the isolation status of a non-open "
  2777. "circuit");
  2778. return;
  2779. }
  2780. circ->isolation_values_set = 0;
  2781. circ->isolation_flags_mixed = 0;
  2782. circ->associated_isolated_stream_global_id = 0;
  2783. circ->client_proto_type = 0;
  2784. circ->client_proto_socksver = 0;
  2785. circ->dest_port = 0;
  2786. tor_addr_make_unspec(&circ->client_addr);
  2787. tor_free(circ->dest_address);
  2788. circ->session_group = -1;
  2789. circ->nym_epoch = 0;
  2790. if (circ->socks_username) {
  2791. memwipe(circ->socks_username, 0x11, circ->socks_username_len);
  2792. tor_free(circ->socks_username);
  2793. }
  2794. if (circ->socks_password) {
  2795. memwipe(circ->socks_password, 0x05, circ->socks_password_len);
  2796. tor_free(circ->socks_password);
  2797. }
  2798. circ->socks_username_len = circ->socks_password_len = 0;
  2799. }