connection_or.c 92 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2017, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file connection_or.c
  8. * \brief Functions to handle OR connections, TLS handshaking, and
  9. * cells on the network.
  10. *
  11. * An or_connection_t is a subtype of connection_t (as implemented in
  12. * connection.c) that uses a TLS connection to send and receive cells on the
  13. * Tor network. (By sending and receiving cells connection_or.c, it cooperates
  14. * with channeltls.c to implement a the channel interface of channel.c.)
  15. *
  16. * Every OR connection has an underlying tortls_t object (as implemented in
  17. * tortls.c) which it uses as its TLS stream. It is responsible for
  18. * sending and receiving cells over that TLS.
  19. *
  20. * This module also implements the client side of the v3 Tor link handshake,
  21. **/
  22. #include "or.h"
  23. #include "bridges.h"
  24. #include "buffers.h"
  25. /*
  26. * Define this so we get channel internal functions, since we're implementing
  27. * part of a subclass (channel_tls_t).
  28. */
  29. #define TOR_CHANNEL_INTERNAL_
  30. #include "channel.h"
  31. #include "channeltls.h"
  32. #include "circuitbuild.h"
  33. #include "circuitlist.h"
  34. #include "circuitstats.h"
  35. #include "command.h"
  36. #include "config.h"
  37. #include "connection.h"
  38. #include "connection_or.h"
  39. #include "control.h"
  40. #include "dirserv.h"
  41. #include "entrynodes.h"
  42. #include "geoip.h"
  43. #include "main.h"
  44. #include "link_handshake.h"
  45. #include "microdesc.h"
  46. #include "networkstatus.h"
  47. #include "nodelist.h"
  48. #include "proto_cell.h"
  49. #include "reasons.h"
  50. #include "relay.h"
  51. #include "rephist.h"
  52. #include "router.h"
  53. #include "routerkeys.h"
  54. #include "routerlist.h"
  55. #include "ext_orport.h"
  56. #include "scheduler.h"
  57. #include "torcert.h"
  58. #include "channelpadding.h"
  59. static int connection_tls_finish_handshake(or_connection_t *conn);
  60. static int connection_or_launch_v3_or_handshake(or_connection_t *conn);
  61. static int connection_or_process_cells_from_inbuf(or_connection_t *conn);
  62. static int connection_or_check_valid_tls_handshake(or_connection_t *conn,
  63. int started_here,
  64. char *digest_rcvd_out);
  65. static void connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn);
  66. static unsigned int
  67. connection_or_is_bad_for_new_circs(or_connection_t *or_conn);
  68. static void connection_or_mark_bad_for_new_circs(or_connection_t *or_conn);
  69. /*
  70. * Call this when changing connection state, so notifications to the owning
  71. * channel can be handled.
  72. */
  73. static void connection_or_change_state(or_connection_t *conn, uint8_t state);
  74. static void connection_or_check_canonicity(or_connection_t *conn,
  75. int started_here);
  76. /**************************************************************/
  77. /** Global map between Extended ORPort identifiers and OR
  78. * connections. */
  79. static digestmap_t *orconn_ext_or_id_map = NULL;
  80. /** Clear clear conn->identity_digest and update other data
  81. * structures as appropriate.*/
  82. void
  83. connection_or_clear_identity(or_connection_t *conn)
  84. {
  85. tor_assert(conn);
  86. memset(conn->identity_digest, 0, DIGEST_LEN);
  87. }
  88. /** Clear all identities in OR conns.*/
  89. void
  90. connection_or_clear_identity_map(void)
  91. {
  92. smartlist_t *conns = get_connection_array();
  93. SMARTLIST_FOREACH(conns, connection_t *, conn,
  94. {
  95. if (conn->type == CONN_TYPE_OR) {
  96. connection_or_clear_identity(TO_OR_CONN(conn));
  97. }
  98. });
  99. }
  100. /** Change conn->identity_digest to digest, and add conn into
  101. * the appropriate digest maps.
  102. *
  103. * NOTE that this function only allows two kinds of transitions: from
  104. * unset identity to set identity, and from idempotent re-settings
  105. * of the same identity. It's not allowed to clear an identity or to
  106. * change an identity. Return 0 on success, and -1 if the transition
  107. * is not allowed.
  108. **/
  109. static void
  110. connection_or_set_identity_digest(or_connection_t *conn,
  111. const char *rsa_digest,
  112. const ed25519_public_key_t *ed_id)
  113. {
  114. channel_t *chan = NULL;
  115. tor_assert(conn);
  116. tor_assert(rsa_digest);
  117. if (conn->chan)
  118. chan = TLS_CHAN_TO_BASE(conn->chan);
  119. log_info(LD_HANDSHAKE, "Set identity digest for %p (%s): %s %s.",
  120. conn,
  121. escaped_safe_str(conn->base_.address),
  122. hex_str(rsa_digest, DIGEST_LEN),
  123. ed25519_fmt(ed_id));
  124. log_info(LD_HANDSHAKE, " (Previously: %s %s)",
  125. hex_str(conn->identity_digest, DIGEST_LEN),
  126. chan ? ed25519_fmt(&chan->ed25519_identity) : "<null>");
  127. const int rsa_id_was_set = ! tor_digest_is_zero(conn->identity_digest);
  128. const int ed_id_was_set =
  129. chan && !ed25519_public_key_is_zero(&chan->ed25519_identity);
  130. const int rsa_changed =
  131. tor_memneq(conn->identity_digest, rsa_digest, DIGEST_LEN);
  132. const int ed_changed = ed_id_was_set &&
  133. (!ed_id || !ed25519_pubkey_eq(ed_id, &chan->ed25519_identity));
  134. tor_assert(!rsa_changed || !rsa_id_was_set);
  135. tor_assert(!ed_changed || !ed_id_was_set);
  136. if (!rsa_changed && !ed_changed)
  137. return;
  138. /* If the identity was set previously, remove the old mapping. */
  139. if (rsa_id_was_set) {
  140. connection_or_clear_identity(conn);
  141. if (chan)
  142. channel_clear_identity_digest(chan);
  143. }
  144. memcpy(conn->identity_digest, rsa_digest, DIGEST_LEN);
  145. /* If we're initializing the IDs to zero, don't add a mapping yet. */
  146. if (tor_digest_is_zero(rsa_digest) &&
  147. (!ed_id || ed25519_public_key_is_zero(ed_id)))
  148. return;
  149. /* Deal with channels */
  150. if (chan)
  151. channel_set_identity_digest(chan, rsa_digest, ed_id);
  152. }
  153. /** Remove the Extended ORPort identifier of <b>conn</b> from the
  154. * global identifier list. Also, clear the identifier from the
  155. * connection itself. */
  156. void
  157. connection_or_remove_from_ext_or_id_map(or_connection_t *conn)
  158. {
  159. or_connection_t *tmp;
  160. if (!orconn_ext_or_id_map)
  161. return;
  162. if (!conn->ext_or_conn_id)
  163. return;
  164. tmp = digestmap_remove(orconn_ext_or_id_map, conn->ext_or_conn_id);
  165. if (!tor_digest_is_zero(conn->ext_or_conn_id))
  166. tor_assert(tmp == conn);
  167. memset(conn->ext_or_conn_id, 0, EXT_OR_CONN_ID_LEN);
  168. }
  169. /** Return the connection whose ext_or_id is <b>id</b>. Return NULL if no such
  170. * connection is found. */
  171. or_connection_t *
  172. connection_or_get_by_ext_or_id(const char *id)
  173. {
  174. if (!orconn_ext_or_id_map)
  175. return NULL;
  176. return digestmap_get(orconn_ext_or_id_map, id);
  177. }
  178. /** Deallocate the global Extended ORPort identifier list */
  179. void
  180. connection_or_clear_ext_or_id_map(void)
  181. {
  182. digestmap_free(orconn_ext_or_id_map, NULL);
  183. orconn_ext_or_id_map = NULL;
  184. }
  185. /** Creates an Extended ORPort identifier for <b>conn</b> and deposits
  186. * it into the global list of identifiers. */
  187. void
  188. connection_or_set_ext_or_identifier(or_connection_t *conn)
  189. {
  190. char random_id[EXT_OR_CONN_ID_LEN];
  191. or_connection_t *tmp;
  192. if (!orconn_ext_or_id_map)
  193. orconn_ext_or_id_map = digestmap_new();
  194. /* Remove any previous identifiers: */
  195. if (conn->ext_or_conn_id && !tor_digest_is_zero(conn->ext_or_conn_id))
  196. connection_or_remove_from_ext_or_id_map(conn);
  197. do {
  198. crypto_rand(random_id, sizeof(random_id));
  199. } while (digestmap_get(orconn_ext_or_id_map, random_id));
  200. if (!conn->ext_or_conn_id)
  201. conn->ext_or_conn_id = tor_malloc_zero(EXT_OR_CONN_ID_LEN);
  202. memcpy(conn->ext_or_conn_id, random_id, EXT_OR_CONN_ID_LEN);
  203. tmp = digestmap_set(orconn_ext_or_id_map, random_id, conn);
  204. tor_assert(!tmp);
  205. }
  206. /**************************************************************/
  207. /** Map from a string describing what a non-open OR connection was doing when
  208. * failed, to an intptr_t describing the count of connections that failed that
  209. * way. Note that the count is stored _as_ the pointer.
  210. */
  211. static strmap_t *broken_connection_counts;
  212. /** If true, do not record information in <b>broken_connection_counts</b>. */
  213. static int disable_broken_connection_counts = 0;
  214. /** Record that an OR connection failed in <b>state</b>. */
  215. static void
  216. note_broken_connection(const char *state)
  217. {
  218. void *ptr;
  219. intptr_t val;
  220. if (disable_broken_connection_counts)
  221. return;
  222. if (!broken_connection_counts)
  223. broken_connection_counts = strmap_new();
  224. ptr = strmap_get(broken_connection_counts, state);
  225. val = (intptr_t)ptr;
  226. val++;
  227. ptr = (void*)val;
  228. strmap_set(broken_connection_counts, state, ptr);
  229. }
  230. /** Forget all recorded states for failed connections. If
  231. * <b>stop_recording</b> is true, don't record any more. */
  232. void
  233. clear_broken_connection_map(int stop_recording)
  234. {
  235. if (broken_connection_counts)
  236. strmap_free(broken_connection_counts, NULL);
  237. broken_connection_counts = NULL;
  238. if (stop_recording)
  239. disable_broken_connection_counts = 1;
  240. }
  241. /** Write a detailed description the state of <b>orconn</b> into the
  242. * <b>buflen</b>-byte buffer at <b>buf</b>. This description includes not
  243. * only the OR-conn level state but also the TLS state. It's useful for
  244. * diagnosing broken handshakes. */
  245. static void
  246. connection_or_get_state_description(or_connection_t *orconn,
  247. char *buf, size_t buflen)
  248. {
  249. connection_t *conn = TO_CONN(orconn);
  250. const char *conn_state;
  251. char tls_state[256];
  252. tor_assert(conn->type == CONN_TYPE_OR || conn->type == CONN_TYPE_EXT_OR);
  253. conn_state = conn_state_to_string(conn->type, conn->state);
  254. tor_tls_get_state_description(orconn->tls, tls_state, sizeof(tls_state));
  255. tor_snprintf(buf, buflen, "%s with SSL state %s", conn_state, tls_state);
  256. }
  257. /** Record the current state of <b>orconn</b> as the state of a broken
  258. * connection. */
  259. static void
  260. connection_or_note_state_when_broken(or_connection_t *orconn)
  261. {
  262. char buf[256];
  263. if (disable_broken_connection_counts)
  264. return;
  265. connection_or_get_state_description(orconn, buf, sizeof(buf));
  266. log_info(LD_HANDSHAKE,"Connection died in state '%s'", buf);
  267. note_broken_connection(buf);
  268. }
  269. /** Helper type used to sort connection states and find the most frequent. */
  270. typedef struct broken_state_count_t {
  271. intptr_t count;
  272. const char *state;
  273. } broken_state_count_t;
  274. /** Helper function used to sort broken_state_count_t by frequency. */
  275. static int
  276. broken_state_count_compare(const void **a_ptr, const void **b_ptr)
  277. {
  278. const broken_state_count_t *a = *a_ptr, *b = *b_ptr;
  279. if (b->count < a->count)
  280. return -1;
  281. else if (b->count == a->count)
  282. return 0;
  283. else
  284. return 1;
  285. }
  286. /** Upper limit on the number of different states to report for connection
  287. * failure. */
  288. #define MAX_REASONS_TO_REPORT 10
  289. /** Report a list of the top states for failed OR connections at log level
  290. * <b>severity</b>, in log domain <b>domain</b>. */
  291. void
  292. connection_or_report_broken_states(int severity, int domain)
  293. {
  294. int total = 0;
  295. smartlist_t *items;
  296. if (!broken_connection_counts || disable_broken_connection_counts)
  297. return;
  298. items = smartlist_new();
  299. STRMAP_FOREACH(broken_connection_counts, state, void *, countptr) {
  300. broken_state_count_t *c = tor_malloc(sizeof(broken_state_count_t));
  301. c->count = (intptr_t)countptr;
  302. total += (int)c->count;
  303. c->state = state;
  304. smartlist_add(items, c);
  305. } STRMAP_FOREACH_END;
  306. smartlist_sort(items, broken_state_count_compare);
  307. tor_log(severity, domain, "%d connections have failed%s", total,
  308. smartlist_len(items) > MAX_REASONS_TO_REPORT ? ". Top reasons:" : ":");
  309. SMARTLIST_FOREACH_BEGIN(items, const broken_state_count_t *, c) {
  310. if (c_sl_idx > MAX_REASONS_TO_REPORT)
  311. break;
  312. tor_log(severity, domain,
  313. " %d connections died in state %s", (int)c->count, c->state);
  314. } SMARTLIST_FOREACH_END(c);
  315. SMARTLIST_FOREACH(items, broken_state_count_t *, c, tor_free(c));
  316. smartlist_free(items);
  317. }
  318. /** Call this to change or_connection_t states, so the owning channel_tls_t can
  319. * be notified.
  320. */
  321. static void
  322. connection_or_change_state(or_connection_t *conn, uint8_t state)
  323. {
  324. uint8_t old_state;
  325. tor_assert(conn);
  326. old_state = conn->base_.state;
  327. conn->base_.state = state;
  328. if (conn->chan)
  329. channel_tls_handle_state_change_on_orconn(conn->chan, conn,
  330. old_state, state);
  331. }
  332. /** Return the number of circuits using an or_connection_t; this used to
  333. * be an or_connection_t field, but it got moved to channel_t and we
  334. * shouldn't maintain two copies. */
  335. MOCK_IMPL(int,
  336. connection_or_get_num_circuits, (or_connection_t *conn))
  337. {
  338. tor_assert(conn);
  339. if (conn->chan) {
  340. return channel_num_circuits(TLS_CHAN_TO_BASE(conn->chan));
  341. } else return 0;
  342. }
  343. /**************************************************************/
  344. /** Pack the cell_t host-order structure <b>src</b> into network-order
  345. * in the buffer <b>dest</b>. See tor-spec.txt for details about the
  346. * wire format.
  347. *
  348. * Note that this function doesn't touch <b>dst</b>-\>next: the caller
  349. * should set it or clear it as appropriate.
  350. */
  351. void
  352. cell_pack(packed_cell_t *dst, const cell_t *src, int wide_circ_ids)
  353. {
  354. char *dest = dst->body;
  355. if (wide_circ_ids) {
  356. set_uint32(dest, htonl(src->circ_id));
  357. dest += 4;
  358. } else {
  359. /* Clear the last two bytes of dest, in case we can accidentally
  360. * send them to the network somehow. */
  361. memset(dest+CELL_MAX_NETWORK_SIZE-2, 0, 2);
  362. set_uint16(dest, htons(src->circ_id));
  363. dest += 2;
  364. }
  365. set_uint8(dest, src->command);
  366. memcpy(dest+1, src->payload, CELL_PAYLOAD_SIZE);
  367. }
  368. /** Unpack the network-order buffer <b>src</b> into a host-order
  369. * cell_t structure <b>dest</b>.
  370. */
  371. static void
  372. cell_unpack(cell_t *dest, const char *src, int wide_circ_ids)
  373. {
  374. if (wide_circ_ids) {
  375. dest->circ_id = ntohl(get_uint32(src));
  376. src += 4;
  377. } else {
  378. dest->circ_id = ntohs(get_uint16(src));
  379. src += 2;
  380. }
  381. dest->command = get_uint8(src);
  382. memcpy(dest->payload, src+1, CELL_PAYLOAD_SIZE);
  383. }
  384. /** Write the header of <b>cell</b> into the first VAR_CELL_MAX_HEADER_SIZE
  385. * bytes of <b>hdr_out</b>. Returns number of bytes used. */
  386. int
  387. var_cell_pack_header(const var_cell_t *cell, char *hdr_out, int wide_circ_ids)
  388. {
  389. int r;
  390. if (wide_circ_ids) {
  391. set_uint32(hdr_out, htonl(cell->circ_id));
  392. hdr_out += 4;
  393. r = VAR_CELL_MAX_HEADER_SIZE;
  394. } else {
  395. set_uint16(hdr_out, htons(cell->circ_id));
  396. hdr_out += 2;
  397. r = VAR_CELL_MAX_HEADER_SIZE - 2;
  398. }
  399. set_uint8(hdr_out, cell->command);
  400. set_uint16(hdr_out+1, htons(cell->payload_len));
  401. return r;
  402. }
  403. /** Allocate and return a new var_cell_t with <b>payload_len</b> bytes of
  404. * payload space. */
  405. var_cell_t *
  406. var_cell_new(uint16_t payload_len)
  407. {
  408. size_t size = offsetof(var_cell_t, payload) + payload_len;
  409. var_cell_t *cell = tor_malloc_zero(size);
  410. cell->payload_len = payload_len;
  411. cell->command = 0;
  412. cell->circ_id = 0;
  413. return cell;
  414. }
  415. /**
  416. * Copy a var_cell_t
  417. */
  418. var_cell_t *
  419. var_cell_copy(const var_cell_t *src)
  420. {
  421. var_cell_t *copy = NULL;
  422. size_t size = 0;
  423. if (src != NULL) {
  424. size = offsetof(var_cell_t, payload) + src->payload_len;
  425. copy = tor_malloc_zero(size);
  426. copy->payload_len = src->payload_len;
  427. copy->command = src->command;
  428. copy->circ_id = src->circ_id;
  429. memcpy(copy->payload, src->payload, copy->payload_len);
  430. }
  431. return copy;
  432. }
  433. /** Release all space held by <b>cell</b>. */
  434. void
  435. var_cell_free_(var_cell_t *cell)
  436. {
  437. tor_free(cell);
  438. }
  439. /** We've received an EOF from <b>conn</b>. Mark it for close and return. */
  440. int
  441. connection_or_reached_eof(or_connection_t *conn)
  442. {
  443. tor_assert(conn);
  444. log_info(LD_OR,"OR connection reached EOF. Closing.");
  445. connection_or_close_normally(conn, 1);
  446. return 0;
  447. }
  448. /** Handle any new bytes that have come in on connection <b>conn</b>.
  449. * If conn is in 'open' state, hand it to
  450. * connection_or_process_cells_from_inbuf()
  451. * (else do nothing).
  452. */
  453. int
  454. connection_or_process_inbuf(or_connection_t *conn)
  455. {
  456. /** Don't let the inbuf of a nonopen OR connection grow beyond this many
  457. * bytes: it's either a broken client, a non-Tor client, or a DOS
  458. * attempt. */
  459. #define MAX_OR_INBUF_WHEN_NONOPEN 0
  460. int ret = 0;
  461. tor_assert(conn);
  462. switch (conn->base_.state) {
  463. case OR_CONN_STATE_PROXY_HANDSHAKING:
  464. ret = connection_read_proxy_handshake(TO_CONN(conn));
  465. /* start TLS after handshake completion, or deal with error */
  466. if (ret == 1) {
  467. tor_assert(TO_CONN(conn)->proxy_state == PROXY_CONNECTED);
  468. if (connection_tls_start_handshake(conn, 0) < 0)
  469. ret = -1;
  470. /* Touch the channel's active timestamp if there is one */
  471. if (conn->chan)
  472. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  473. }
  474. if (ret < 0) {
  475. connection_or_close_for_error(conn, 0);
  476. }
  477. return ret;
  478. case OR_CONN_STATE_TLS_SERVER_RENEGOTIATING:
  479. case OR_CONN_STATE_OPEN:
  480. case OR_CONN_STATE_OR_HANDSHAKING_V2:
  481. case OR_CONN_STATE_OR_HANDSHAKING_V3:
  482. return connection_or_process_cells_from_inbuf(conn);
  483. default:
  484. break; /* don't do anything */
  485. }
  486. /* This check was necessary with 0.2.2, when the TLS_SERVER_RENEGOTIATING
  487. * check would otherwise just let data accumulate. It serves no purpose
  488. * in 0.2.3.
  489. *
  490. * XXXX Remove this check once we verify that the above paragraph is
  491. * 100% true. */
  492. if (buf_datalen(conn->base_.inbuf) > MAX_OR_INBUF_WHEN_NONOPEN) {
  493. log_fn(LOG_PROTOCOL_WARN, LD_NET, "Accumulated too much data (%d bytes) "
  494. "on nonopen OR connection %s %s:%u in state %s; closing.",
  495. (int)buf_datalen(conn->base_.inbuf),
  496. connection_or_nonopen_was_started_here(conn) ? "to" : "from",
  497. conn->base_.address, conn->base_.port,
  498. conn_state_to_string(conn->base_.type, conn->base_.state));
  499. connection_or_close_for_error(conn, 0);
  500. ret = -1;
  501. }
  502. return ret;
  503. }
  504. /** Called whenever we have flushed some data on an or_conn: add more data
  505. * from active circuits. */
  506. int
  507. connection_or_flushed_some(or_connection_t *conn)
  508. {
  509. size_t datalen;
  510. /* Update the channel's active timestamp if there is one */
  511. if (conn->chan)
  512. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  513. /* If we're under the low water mark, add cells until we're just over the
  514. * high water mark. */
  515. datalen = connection_get_outbuf_len(TO_CONN(conn));
  516. if (datalen < OR_CONN_LOWWATER) {
  517. /* Let the scheduler know */
  518. scheduler_channel_wants_writes(TLS_CHAN_TO_BASE(conn->chan));
  519. }
  520. return 0;
  521. }
  522. /** This is for channeltls.c to ask how many cells we could accept if
  523. * they were available. */
  524. ssize_t
  525. connection_or_num_cells_writeable(or_connection_t *conn)
  526. {
  527. size_t datalen, cell_network_size;
  528. ssize_t n = 0;
  529. tor_assert(conn);
  530. /*
  531. * If we're under the high water mark, we're potentially
  532. * writeable; note this is different from the calculation above
  533. * used to trigger when to start writing after we've stopped.
  534. */
  535. datalen = connection_get_outbuf_len(TO_CONN(conn));
  536. if (datalen < OR_CONN_HIGHWATER) {
  537. cell_network_size = get_cell_network_size(conn->wide_circ_ids);
  538. n = CEIL_DIV(OR_CONN_HIGHWATER - datalen, cell_network_size);
  539. }
  540. return n;
  541. }
  542. /** Connection <b>conn</b> has finished writing and has no bytes left on
  543. * its outbuf.
  544. *
  545. * Otherwise it's in state "open": stop writing and return.
  546. *
  547. * If <b>conn</b> is broken, mark it for close and return -1, else
  548. * return 0.
  549. */
  550. int
  551. connection_or_finished_flushing(or_connection_t *conn)
  552. {
  553. tor_assert(conn);
  554. assert_connection_ok(TO_CONN(conn),0);
  555. switch (conn->base_.state) {
  556. case OR_CONN_STATE_PROXY_HANDSHAKING:
  557. case OR_CONN_STATE_OPEN:
  558. case OR_CONN_STATE_OR_HANDSHAKING_V2:
  559. case OR_CONN_STATE_OR_HANDSHAKING_V3:
  560. break;
  561. default:
  562. log_err(LD_BUG,"Called in unexpected state %d.", conn->base_.state);
  563. tor_fragile_assert();
  564. return -1;
  565. }
  566. /* Update the channel's active timestamp if there is one */
  567. if (conn->chan)
  568. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  569. return 0;
  570. }
  571. /** Connected handler for OR connections: begin the TLS handshake.
  572. */
  573. int
  574. connection_or_finished_connecting(or_connection_t *or_conn)
  575. {
  576. const int proxy_type = or_conn->proxy_type;
  577. connection_t *conn;
  578. tor_assert(or_conn);
  579. conn = TO_CONN(or_conn);
  580. tor_assert(conn->state == OR_CONN_STATE_CONNECTING);
  581. log_debug(LD_HANDSHAKE,"OR connect() to router at %s:%u finished.",
  582. conn->address,conn->port);
  583. control_event_bootstrap(BOOTSTRAP_STATUS_HANDSHAKE, 0);
  584. if (proxy_type != PROXY_NONE) {
  585. /* start proxy handshake */
  586. if (connection_proxy_connect(conn, proxy_type) < 0) {
  587. connection_or_close_for_error(or_conn, 0);
  588. return -1;
  589. }
  590. connection_start_reading(conn);
  591. connection_or_change_state(or_conn, OR_CONN_STATE_PROXY_HANDSHAKING);
  592. return 0;
  593. }
  594. if (connection_tls_start_handshake(or_conn, 0) < 0) {
  595. /* TLS handshaking error of some kind. */
  596. connection_or_close_for_error(or_conn, 0);
  597. return -1;
  598. }
  599. return 0;
  600. }
  601. /** Called when we're about to finally unlink and free an OR connection:
  602. * perform necessary accounting and cleanup */
  603. void
  604. connection_or_about_to_close(or_connection_t *or_conn)
  605. {
  606. time_t now = time(NULL);
  607. connection_t *conn = TO_CONN(or_conn);
  608. /* Tell the controlling channel we're closed */
  609. if (or_conn->chan) {
  610. channel_closed(TLS_CHAN_TO_BASE(or_conn->chan));
  611. /*
  612. * NULL this out because the channel might hang around a little
  613. * longer before channel_run_cleanup() gets it.
  614. */
  615. or_conn->chan->conn = NULL;
  616. or_conn->chan = NULL;
  617. }
  618. /* Remember why we're closing this connection. */
  619. if (conn->state != OR_CONN_STATE_OPEN) {
  620. /* now mark things down as needed */
  621. if (connection_or_nonopen_was_started_here(or_conn)) {
  622. const or_options_t *options = get_options();
  623. connection_or_note_state_when_broken(or_conn);
  624. rep_hist_note_connect_failed(or_conn->identity_digest, now);
  625. /* Tell the new guard API about the channel failure */
  626. entry_guard_chan_failed(TLS_CHAN_TO_BASE(or_conn->chan));
  627. if (conn->state >= OR_CONN_STATE_TLS_HANDSHAKING) {
  628. int reason = tls_error_to_orconn_end_reason(or_conn->tls_error);
  629. control_event_or_conn_status(or_conn, OR_CONN_EVENT_FAILED,
  630. reason);
  631. if (!authdir_mode_tests_reachability(options))
  632. control_event_bootstrap_prob_or(
  633. orconn_end_reason_to_control_string(reason),
  634. reason, or_conn);
  635. }
  636. }
  637. } else if (conn->hold_open_until_flushed) {
  638. /* We only set hold_open_until_flushed when we're intentionally
  639. * closing a connection. */
  640. rep_hist_note_disconnect(or_conn->identity_digest, now);
  641. control_event_or_conn_status(or_conn, OR_CONN_EVENT_CLOSED,
  642. tls_error_to_orconn_end_reason(or_conn->tls_error));
  643. } else if (!tor_digest_is_zero(or_conn->identity_digest)) {
  644. rep_hist_note_connection_died(or_conn->identity_digest, now);
  645. control_event_or_conn_status(or_conn, OR_CONN_EVENT_CLOSED,
  646. tls_error_to_orconn_end_reason(or_conn->tls_error));
  647. }
  648. }
  649. /** Return 1 if identity digest <b>id_digest</b> is known to be a
  650. * currently or recently running relay. Otherwise return 0. */
  651. int
  652. connection_or_digest_is_known_relay(const char *id_digest)
  653. {
  654. if (router_get_consensus_status_by_id(id_digest))
  655. return 1; /* It's in the consensus: "yes" */
  656. if (router_get_by_id_digest(id_digest))
  657. return 1; /* Not in the consensus, but we have a descriptor for
  658. * it. Probably it was in a recent consensus. "Yes". */
  659. return 0;
  660. }
  661. /** Set the per-conn read and write limits for <b>conn</b>. If it's a known
  662. * relay, we will rely on the global read and write buckets, so give it
  663. * per-conn limits that are big enough they'll never matter. But if it's
  664. * not a known relay, first check if we set PerConnBwRate/Burst, then
  665. * check if the consensus sets them, else default to 'big enough'.
  666. *
  667. * If <b>reset</b> is true, set the bucket to be full. Otherwise, just
  668. * clip the bucket if it happens to be <em>too</em> full.
  669. */
  670. static void
  671. connection_or_update_token_buckets_helper(or_connection_t *conn, int reset,
  672. const or_options_t *options)
  673. {
  674. int rate, burst; /* per-connection rate limiting params */
  675. if (connection_or_digest_is_known_relay(conn->identity_digest)) {
  676. /* It's in the consensus, or we have a descriptor for it meaning it
  677. * was probably in a recent consensus. It's a recognized relay:
  678. * give it full bandwidth. */
  679. rate = (int)options->BandwidthRate;
  680. burst = (int)options->BandwidthBurst;
  681. } else {
  682. /* Not a recognized relay. Squeeze it down based on the suggested
  683. * bandwidth parameters in the consensus, but allow local config
  684. * options to override. */
  685. rate = options->PerConnBWRate ? (int)options->PerConnBWRate :
  686. networkstatus_get_param(NULL, "perconnbwrate",
  687. (int)options->BandwidthRate, 1, INT32_MAX);
  688. burst = options->PerConnBWBurst ? (int)options->PerConnBWBurst :
  689. networkstatus_get_param(NULL, "perconnbwburst",
  690. (int)options->BandwidthBurst, 1, INT32_MAX);
  691. }
  692. conn->bandwidthrate = rate;
  693. conn->bandwidthburst = burst;
  694. if (reset) { /* set up the token buckets to be full */
  695. conn->read_bucket = conn->write_bucket = burst;
  696. return;
  697. }
  698. /* If the new token bucket is smaller, take out the extra tokens.
  699. * (If it's larger, don't -- the buckets can grow to reach the cap.) */
  700. if (conn->read_bucket > burst)
  701. conn->read_bucket = burst;
  702. if (conn->write_bucket > burst)
  703. conn->write_bucket = burst;
  704. }
  705. /** Either our set of relays or our per-conn rate limits have changed.
  706. * Go through all the OR connections and update their token buckets to make
  707. * sure they don't exceed their maximum values. */
  708. void
  709. connection_or_update_token_buckets(smartlist_t *conns,
  710. const or_options_t *options)
  711. {
  712. SMARTLIST_FOREACH(conns, connection_t *, conn,
  713. {
  714. if (connection_speaks_cells(conn))
  715. connection_or_update_token_buckets_helper(TO_OR_CONN(conn), 0, options);
  716. });
  717. }
  718. /* Mark <b>or_conn</b> as canonical if <b>is_canonical</b> is set, and
  719. * non-canonical otherwise. Adjust idle_timeout accordingly.
  720. */
  721. void
  722. connection_or_set_canonical(or_connection_t *or_conn,
  723. int is_canonical)
  724. {
  725. if (bool_eq(is_canonical, or_conn->is_canonical) &&
  726. or_conn->idle_timeout != 0) {
  727. /* Don't recalculate an existing idle_timeout unless the canonical
  728. * status changed. */
  729. return;
  730. }
  731. or_conn->is_canonical = !! is_canonical; /* force to a 1-bit boolean */
  732. or_conn->idle_timeout = channelpadding_get_channel_idle_timeout(
  733. TLS_CHAN_TO_BASE(or_conn->chan), is_canonical);
  734. log_info(LD_CIRC,
  735. "Channel " U64_FORMAT " chose an idle timeout of %d.",
  736. or_conn->chan ?
  737. U64_PRINTF_ARG(TLS_CHAN_TO_BASE(or_conn->chan)->global_identifier):0,
  738. or_conn->idle_timeout);
  739. }
  740. /** If we don't necessarily know the router we're connecting to, but we
  741. * have an addr/port/id_digest, then fill in as much as we can. Start
  742. * by checking to see if this describes a router we know.
  743. * <b>started_here</b> is 1 if we are the initiator of <b>conn</b> and
  744. * 0 if it's an incoming connection. */
  745. void
  746. connection_or_init_conn_from_address(or_connection_t *conn,
  747. const tor_addr_t *addr, uint16_t port,
  748. const char *id_digest,
  749. const ed25519_public_key_t *ed_id,
  750. int started_here)
  751. {
  752. log_debug(LD_HANDSHAKE, "init conn from address %s: %s, %s (%d)",
  753. fmt_addr(addr),
  754. hex_str((const char*)id_digest, DIGEST_LEN),
  755. ed25519_fmt(ed_id),
  756. started_here);
  757. connection_or_set_identity_digest(conn, id_digest, ed_id);
  758. connection_or_update_token_buckets_helper(conn, 1, get_options());
  759. conn->base_.port = port;
  760. tor_addr_copy(&conn->base_.addr, addr);
  761. tor_addr_copy(&conn->real_addr, addr);
  762. connection_or_check_canonicity(conn, started_here);
  763. }
  764. /** Check whether the identity of <b>conn</b> matches a known node. If it
  765. * does, check whether the address of conn matches the expected address, and
  766. * update the connection's is_canonical flag, nickname, and address fields as
  767. * appropriate. */
  768. static void
  769. connection_or_check_canonicity(or_connection_t *conn, int started_here)
  770. {
  771. const char *id_digest = conn->identity_digest;
  772. const ed25519_public_key_t *ed_id = NULL;
  773. const tor_addr_t *addr = &conn->real_addr;
  774. if (conn->chan)
  775. ed_id = & TLS_CHAN_TO_BASE(conn->chan)->ed25519_identity;
  776. const node_t *r = node_get_by_id(id_digest);
  777. if (r &&
  778. node_supports_ed25519_link_authentication(r, 1) &&
  779. ! node_ed25519_id_matches(r, ed_id)) {
  780. /* If this node is capable of proving an ed25519 ID,
  781. * we can't call this a canonical connection unless both IDs match. */
  782. r = NULL;
  783. }
  784. if (r) {
  785. tor_addr_port_t node_ap;
  786. node_get_pref_orport(r, &node_ap);
  787. /* XXXX proposal 186 is making this more complex. For now, a conn
  788. is canonical when it uses the _preferred_ address. */
  789. if (tor_addr_eq(&conn->base_.addr, &node_ap.addr))
  790. connection_or_set_canonical(conn, 1);
  791. if (!started_here) {
  792. /* Override the addr/port, so our log messages will make sense.
  793. * This is dangerous, since if we ever try looking up a conn by
  794. * its actual addr/port, we won't remember. Careful! */
  795. /* XXXX arma: this is stupid, and it's the reason we need real_addr
  796. * to track is_canonical properly. What requires it? */
  797. /* XXXX <arma> i believe the reason we did this, originally, is because
  798. * we wanted to log what OR a connection was to, and if we logged the
  799. * right IP address and port 56244, that wouldn't be as helpful. now we
  800. * log the "right" port too, so we know if it's moria1 or moria2.
  801. */
  802. tor_addr_copy(&conn->base_.addr, &node_ap.addr);
  803. conn->base_.port = node_ap.port;
  804. }
  805. tor_free(conn->nickname);
  806. conn->nickname = tor_strdup(node_get_nickname(r));
  807. tor_free(conn->base_.address);
  808. conn->base_.address = tor_addr_to_str_dup(&node_ap.addr);
  809. } else {
  810. tor_free(conn->nickname);
  811. conn->nickname = tor_malloc(HEX_DIGEST_LEN+2);
  812. conn->nickname[0] = '$';
  813. base16_encode(conn->nickname+1, HEX_DIGEST_LEN+1,
  814. conn->identity_digest, DIGEST_LEN);
  815. tor_free(conn->base_.address);
  816. conn->base_.address = tor_addr_to_str_dup(addr);
  817. }
  818. /*
  819. * We have to tell channeltls.c to update the channel marks (local, in
  820. * particular), since we may have changed the address.
  821. */
  822. if (conn->chan) {
  823. channel_tls_update_marks(conn);
  824. }
  825. }
  826. /** These just pass all the is_bad_for_new_circs manipulation on to
  827. * channel_t */
  828. static unsigned int
  829. connection_or_is_bad_for_new_circs(or_connection_t *or_conn)
  830. {
  831. tor_assert(or_conn);
  832. if (or_conn->chan)
  833. return channel_is_bad_for_new_circs(TLS_CHAN_TO_BASE(or_conn->chan));
  834. else return 0;
  835. }
  836. static void
  837. connection_or_mark_bad_for_new_circs(or_connection_t *or_conn)
  838. {
  839. tor_assert(or_conn);
  840. if (or_conn->chan)
  841. channel_mark_bad_for_new_circs(TLS_CHAN_TO_BASE(or_conn->chan));
  842. }
  843. /** How old do we let a connection to an OR get before deciding it's
  844. * too old for new circuits? */
  845. #define TIME_BEFORE_OR_CONN_IS_TOO_OLD (60*60*24*7)
  846. /** Expire an or_connection if it is too old. Helper for
  847. * connection_or_group_set_badness_ and fast path for
  848. * channel_rsa_id_group_set_badness.
  849. *
  850. * Returns 1 if the connection was already expired, else 0.
  851. */
  852. int
  853. connection_or_single_set_badness_(time_t now,
  854. or_connection_t *or_conn,
  855. int force)
  856. {
  857. /* XXXX this function should also be about channels? */
  858. if (or_conn->base_.marked_for_close ||
  859. connection_or_is_bad_for_new_circs(or_conn))
  860. return 1;
  861. if (force ||
  862. or_conn->base_.timestamp_created + TIME_BEFORE_OR_CONN_IS_TOO_OLD
  863. < now) {
  864. log_info(LD_OR,
  865. "Marking OR conn to %s:%d as too old for new circuits "
  866. "(fd "TOR_SOCKET_T_FORMAT", %d secs old).",
  867. or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
  868. (int)(now - or_conn->base_.timestamp_created));
  869. connection_or_mark_bad_for_new_circs(or_conn);
  870. }
  871. return 0;
  872. }
  873. /** Given a list of all the or_connections with a given
  874. * identity, set elements of that list as is_bad_for_new_circs as
  875. * appropriate. Helper for connection_or_set_bad_connections().
  876. *
  877. * Specifically, we set the is_bad_for_new_circs flag on:
  878. * - all connections if <b>force</b> is true.
  879. * - all connections that are too old.
  880. * - all open non-canonical connections for which a canonical connection
  881. * exists to the same router.
  882. * - all open canonical connections for which a 'better' canonical
  883. * connection exists to the same router.
  884. * - all open non-canonical connections for which a 'better' non-canonical
  885. * connection exists to the same router at the same address.
  886. *
  887. * See channel_is_better() in channel.c for our idea of what makes one OR
  888. * connection better than another.
  889. */
  890. void
  891. connection_or_group_set_badness_(smartlist_t *group, int force)
  892. {
  893. /* XXXX this function should be entirely about channels, not OR
  894. * XXXX connections. */
  895. or_connection_t *best = NULL;
  896. int n_old = 0, n_inprogress = 0, n_canonical = 0, n_other = 0;
  897. time_t now = time(NULL);
  898. /* Pass 1: expire everything that's old, and see what the status of
  899. * everything else is. */
  900. SMARTLIST_FOREACH_BEGIN(group, or_connection_t *, or_conn) {
  901. if (connection_or_single_set_badness_(now, or_conn, force))
  902. continue;
  903. if (connection_or_is_bad_for_new_circs(or_conn)) {
  904. ++n_old;
  905. } else if (or_conn->base_.state != OR_CONN_STATE_OPEN) {
  906. ++n_inprogress;
  907. } else if (or_conn->is_canonical) {
  908. ++n_canonical;
  909. } else {
  910. ++n_other;
  911. }
  912. } SMARTLIST_FOREACH_END(or_conn);
  913. /* Pass 2: We know how about how good the best connection is.
  914. * expire everything that's worse, and find the very best if we can. */
  915. SMARTLIST_FOREACH_BEGIN(group, or_connection_t *, or_conn) {
  916. if (or_conn->base_.marked_for_close ||
  917. connection_or_is_bad_for_new_circs(or_conn))
  918. continue; /* This one doesn't need to be marked bad. */
  919. if (or_conn->base_.state != OR_CONN_STATE_OPEN)
  920. continue; /* Don't mark anything bad until we have seen what happens
  921. * when the connection finishes. */
  922. if (n_canonical && !or_conn->is_canonical) {
  923. /* We have at least one open canonical connection to this router,
  924. * and this one is open but not canonical. Mark it bad. */
  925. log_info(LD_OR,
  926. "Marking OR conn to %s:%d as unsuitable for new circuits: "
  927. "(fd "TOR_SOCKET_T_FORMAT", %d secs old). It is not "
  928. "canonical, and we have another connection to that OR that is.",
  929. or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
  930. (int)(now - or_conn->base_.timestamp_created));
  931. connection_or_mark_bad_for_new_circs(or_conn);
  932. continue;
  933. }
  934. if (!best ||
  935. channel_is_better(TLS_CHAN_TO_BASE(or_conn->chan),
  936. TLS_CHAN_TO_BASE(best->chan))) {
  937. best = or_conn;
  938. }
  939. } SMARTLIST_FOREACH_END(or_conn);
  940. if (!best)
  941. return;
  942. /* Pass 3: One connection to OR is best. If it's canonical, mark as bad
  943. * every other open connection. If it's non-canonical, mark as bad
  944. * every other open connection to the same address.
  945. *
  946. * XXXX This isn't optimal; if we have connections to an OR at multiple
  947. * addresses, we'd like to pick the best _for each address_, and mark as
  948. * bad every open connection that isn't best for its address. But this
  949. * can only occur in cases where the other OR is old (so we have no
  950. * canonical connection to it), or where all the connections to the OR are
  951. * at noncanonical addresses and we have no good direct connection (which
  952. * means we aren't at risk of attaching circuits to it anyway). As
  953. * 0.1.2.x dies out, the first case will go away, and the second one is
  954. * "mostly harmless", so a fix can wait until somebody is bored.
  955. */
  956. SMARTLIST_FOREACH_BEGIN(group, or_connection_t *, or_conn) {
  957. if (or_conn->base_.marked_for_close ||
  958. connection_or_is_bad_for_new_circs(or_conn) ||
  959. or_conn->base_.state != OR_CONN_STATE_OPEN)
  960. continue;
  961. if (or_conn != best &&
  962. channel_is_better(TLS_CHAN_TO_BASE(best->chan),
  963. TLS_CHAN_TO_BASE(or_conn->chan))) {
  964. /* This isn't the best conn, _and_ the best conn is better than it */
  965. if (best->is_canonical) {
  966. log_info(LD_OR,
  967. "Marking OR conn to %s:%d as unsuitable for new circuits: "
  968. "(fd "TOR_SOCKET_T_FORMAT", %d secs old). "
  969. "We have a better canonical one "
  970. "(fd "TOR_SOCKET_T_FORMAT"; %d secs old).",
  971. or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
  972. (int)(now - or_conn->base_.timestamp_created),
  973. best->base_.s, (int)(now - best->base_.timestamp_created));
  974. connection_or_mark_bad_for_new_circs(or_conn);
  975. } else if (!tor_addr_compare(&or_conn->real_addr,
  976. &best->real_addr, CMP_EXACT)) {
  977. log_info(LD_OR,
  978. "Marking OR conn to %s:%d as unsuitable for new circuits: "
  979. "(fd "TOR_SOCKET_T_FORMAT", %d secs old). We have a better "
  980. "one with the "
  981. "same address (fd "TOR_SOCKET_T_FORMAT"; %d secs old).",
  982. or_conn->base_.address, or_conn->base_.port, or_conn->base_.s,
  983. (int)(now - or_conn->base_.timestamp_created),
  984. best->base_.s, (int)(now - best->base_.timestamp_created));
  985. connection_or_mark_bad_for_new_circs(or_conn);
  986. }
  987. }
  988. } SMARTLIST_FOREACH_END(or_conn);
  989. }
  990. /** <b>conn</b> is in the 'connecting' state, and it failed to complete
  991. * a TCP connection. Send notifications appropriately.
  992. *
  993. * <b>reason</b> specifies the or_conn_end_reason for the failure;
  994. * <b>msg</b> specifies the strerror-style error message.
  995. */
  996. void
  997. connection_or_connect_failed(or_connection_t *conn,
  998. int reason, const char *msg)
  999. {
  1000. control_event_or_conn_status(conn, OR_CONN_EVENT_FAILED, reason);
  1001. if (!authdir_mode_tests_reachability(get_options()))
  1002. control_event_bootstrap_prob_or(msg, reason, conn);
  1003. }
  1004. /** <b>conn</b> got an error in connection_handle_read_impl() or
  1005. * connection_handle_write_impl() and is going to die soon.
  1006. *
  1007. * <b>reason</b> specifies the or_conn_end_reason for the failure;
  1008. * <b>msg</b> specifies the strerror-style error message.
  1009. */
  1010. void
  1011. connection_or_notify_error(or_connection_t *conn,
  1012. int reason, const char *msg)
  1013. {
  1014. channel_t *chan;
  1015. tor_assert(conn);
  1016. /* If we're connecting, call connect_failed() too */
  1017. if (TO_CONN(conn)->state == OR_CONN_STATE_CONNECTING)
  1018. connection_or_connect_failed(conn, reason, msg);
  1019. /* Tell the controlling channel if we have one */
  1020. if (conn->chan) {
  1021. chan = TLS_CHAN_TO_BASE(conn->chan);
  1022. /* Don't transition if we're already in closing, closed or error */
  1023. if (!CHANNEL_CONDEMNED(chan)) {
  1024. channel_close_for_error(chan);
  1025. }
  1026. }
  1027. /* No need to mark for error because connection.c is about to do that */
  1028. }
  1029. /** Launch a new OR connection to <b>addr</b>:<b>port</b> and expect to
  1030. * handshake with an OR with identity digest <b>id_digest</b>. Optionally,
  1031. * pass in a pointer to a channel using this connection.
  1032. *
  1033. * If <b>id_digest</b> is me, do nothing. If we're already connected to it,
  1034. * return that connection. If the connect() is in progress, set the
  1035. * new conn's state to 'connecting' and return it. If connect() succeeds,
  1036. * call connection_tls_start_handshake() on it.
  1037. *
  1038. * This function is called from router_retry_connections(), for
  1039. * ORs connecting to ORs, and circuit_establish_circuit(), for
  1040. * OPs connecting to ORs.
  1041. *
  1042. * Return the launched conn, or NULL if it failed.
  1043. */
  1044. MOCK_IMPL(or_connection_t *,
  1045. connection_or_connect, (const tor_addr_t *_addr, uint16_t port,
  1046. const char *id_digest,
  1047. const ed25519_public_key_t *ed_id,
  1048. channel_tls_t *chan))
  1049. {
  1050. or_connection_t *conn;
  1051. const or_options_t *options = get_options();
  1052. int socket_error = 0;
  1053. tor_addr_t addr;
  1054. int r;
  1055. tor_addr_t proxy_addr;
  1056. uint16_t proxy_port;
  1057. int proxy_type;
  1058. tor_assert(_addr);
  1059. tor_assert(id_digest);
  1060. tor_addr_copy(&addr, _addr);
  1061. if (server_mode(options) && router_digest_is_me(id_digest)) {
  1062. log_info(LD_PROTOCOL,"Client asked me to connect to myself. Refusing.");
  1063. return NULL;
  1064. }
  1065. if (server_mode(options) && router_ed25519_id_is_me(ed_id)) {
  1066. log_info(LD_PROTOCOL,"Client asked me to connect to myself by Ed25519 "
  1067. "identity. Refusing.");
  1068. return NULL;
  1069. }
  1070. conn = or_connection_new(CONN_TYPE_OR, tor_addr_family(&addr));
  1071. /*
  1072. * Set up conn so it's got all the data we need to remember for channels
  1073. *
  1074. * This stuff needs to happen before connection_or_init_conn_from_address()
  1075. * so connection_or_set_identity_digest() and such know where to look to
  1076. * keep the channel up to date.
  1077. */
  1078. conn->chan = chan;
  1079. chan->conn = conn;
  1080. connection_or_init_conn_from_address(conn, &addr, port, id_digest, ed_id, 1);
  1081. connection_or_change_state(conn, OR_CONN_STATE_CONNECTING);
  1082. control_event_or_conn_status(conn, OR_CONN_EVENT_LAUNCHED, 0);
  1083. conn->is_outgoing = 1;
  1084. /* If we are using a proxy server, find it and use it. */
  1085. r = get_proxy_addrport(&proxy_addr, &proxy_port, &proxy_type, TO_CONN(conn));
  1086. if (r == 0) {
  1087. conn->proxy_type = proxy_type;
  1088. if (proxy_type != PROXY_NONE) {
  1089. tor_addr_copy(&addr, &proxy_addr);
  1090. port = proxy_port;
  1091. conn->base_.proxy_state = PROXY_INFANT;
  1092. }
  1093. } else {
  1094. /* get_proxy_addrport() might fail if we have a Bridge line that
  1095. references a transport, but no ClientTransportPlugin lines
  1096. defining its transport proxy. If this is the case, let's try to
  1097. output a useful log message to the user. */
  1098. const char *transport_name =
  1099. find_transport_name_by_bridge_addrport(&TO_CONN(conn)->addr,
  1100. TO_CONN(conn)->port);
  1101. if (transport_name) {
  1102. log_warn(LD_GENERAL, "We were supposed to connect to bridge '%s' "
  1103. "using pluggable transport '%s', but we can't find a pluggable "
  1104. "transport proxy supporting '%s'. This can happen if you "
  1105. "haven't provided a ClientTransportPlugin line, or if "
  1106. "your pluggable transport proxy stopped running.",
  1107. fmt_addrport(&TO_CONN(conn)->addr, TO_CONN(conn)->port),
  1108. transport_name, transport_name);
  1109. control_event_bootstrap_prob_or(
  1110. "Can't connect to bridge",
  1111. END_OR_CONN_REASON_PT_MISSING,
  1112. conn);
  1113. } else {
  1114. log_warn(LD_GENERAL, "Tried to connect to '%s' through a proxy, but "
  1115. "the proxy address could not be found.",
  1116. fmt_addrport(&TO_CONN(conn)->addr, TO_CONN(conn)->port));
  1117. }
  1118. connection_free_(TO_CONN(conn));
  1119. return NULL;
  1120. }
  1121. switch (connection_connect(TO_CONN(conn), conn->base_.address,
  1122. &addr, port, &socket_error)) {
  1123. case -1:
  1124. /* We failed to establish a connection probably because of a local
  1125. * error. No need to blame the guard in this case. Notify the networking
  1126. * system of this failure. */
  1127. connection_or_connect_failed(conn,
  1128. errno_to_orconn_end_reason(socket_error),
  1129. tor_socket_strerror(socket_error));
  1130. connection_free_(TO_CONN(conn));
  1131. return NULL;
  1132. case 0:
  1133. connection_watch_events(TO_CONN(conn), READ_EVENT | WRITE_EVENT);
  1134. /* writable indicates finish, readable indicates broken link,
  1135. error indicates broken link on windows */
  1136. return conn;
  1137. /* case 1: fall through */
  1138. }
  1139. if (connection_or_finished_connecting(conn) < 0) {
  1140. /* already marked for close */
  1141. return NULL;
  1142. }
  1143. return conn;
  1144. }
  1145. /** Mark orconn for close and transition the associated channel, if any, to
  1146. * the closing state.
  1147. *
  1148. * It's safe to call this and connection_or_close_for_error() any time, and
  1149. * channel layer will treat it as a connection closing for reasons outside
  1150. * its control, like the remote end closing it. It can also be a local
  1151. * reason that's specific to connection_t/or_connection_t rather than
  1152. * the channel mechanism, such as expiration of old connections in
  1153. * run_connection_housekeeping(). If you want to close a channel_t
  1154. * from somewhere that logically works in terms of generic channels
  1155. * rather than connections, use channel_mark_for_close(); see also
  1156. * the comment on that function in channel.c.
  1157. */
  1158. void
  1159. connection_or_close_normally(or_connection_t *orconn, int flush)
  1160. {
  1161. channel_t *chan = NULL;
  1162. tor_assert(orconn);
  1163. if (flush) connection_mark_and_flush_internal(TO_CONN(orconn));
  1164. else connection_mark_for_close_internal(TO_CONN(orconn));
  1165. if (orconn->chan) {
  1166. chan = TLS_CHAN_TO_BASE(orconn->chan);
  1167. /* Don't transition if we're already in closing, closed or error */
  1168. if (!CHANNEL_CONDEMNED(chan)) {
  1169. channel_close_from_lower_layer(chan);
  1170. }
  1171. }
  1172. }
  1173. /** Mark orconn for close and transition the associated channel, if any, to
  1174. * the error state.
  1175. */
  1176. MOCK_IMPL(void,
  1177. connection_or_close_for_error,(or_connection_t *orconn, int flush))
  1178. {
  1179. channel_t *chan = NULL;
  1180. tor_assert(orconn);
  1181. if (flush) connection_mark_and_flush_internal(TO_CONN(orconn));
  1182. else connection_mark_for_close_internal(TO_CONN(orconn));
  1183. if (orconn->chan) {
  1184. chan = TLS_CHAN_TO_BASE(orconn->chan);
  1185. /* Don't transition if we're already in closing, closed or error */
  1186. if (!CHANNEL_CONDEMNED(chan)) {
  1187. channel_close_for_error(chan);
  1188. }
  1189. }
  1190. }
  1191. /** Begin the tls handshake with <b>conn</b>. <b>receiving</b> is 0 if
  1192. * we initiated the connection, else it's 1.
  1193. *
  1194. * Assign a new tls object to conn->tls, begin reading on <b>conn</b>, and
  1195. * pass <b>conn</b> to connection_tls_continue_handshake().
  1196. *
  1197. * Return -1 if <b>conn</b> is broken, else return 0.
  1198. */
  1199. MOCK_IMPL(int,
  1200. connection_tls_start_handshake,(or_connection_t *conn, int receiving))
  1201. {
  1202. channel_listener_t *chan_listener;
  1203. channel_t *chan;
  1204. /* Incoming connections will need a new channel passed to the
  1205. * channel_tls_listener */
  1206. if (receiving) {
  1207. /* It shouldn't already be set */
  1208. tor_assert(!(conn->chan));
  1209. chan_listener = channel_tls_get_listener();
  1210. if (!chan_listener) {
  1211. chan_listener = channel_tls_start_listener();
  1212. command_setup_listener(chan_listener);
  1213. }
  1214. chan = channel_tls_handle_incoming(conn);
  1215. channel_listener_queue_incoming(chan_listener, chan);
  1216. }
  1217. connection_or_change_state(conn, OR_CONN_STATE_TLS_HANDSHAKING);
  1218. tor_assert(!conn->tls);
  1219. conn->tls = tor_tls_new(conn->base_.s, receiving);
  1220. if (!conn->tls) {
  1221. log_warn(LD_BUG,"tor_tls_new failed. Closing.");
  1222. return -1;
  1223. }
  1224. tor_tls_set_logged_address(conn->tls, // XXX client and relay?
  1225. escaped_safe_str(conn->base_.address));
  1226. connection_start_reading(TO_CONN(conn));
  1227. log_debug(LD_HANDSHAKE,"starting TLS handshake on fd "TOR_SOCKET_T_FORMAT,
  1228. conn->base_.s);
  1229. if (connection_tls_continue_handshake(conn) < 0)
  1230. return -1;
  1231. return 0;
  1232. }
  1233. /** Block all future attempts to renegotiate on 'conn' */
  1234. void
  1235. connection_or_block_renegotiation(or_connection_t *conn)
  1236. {
  1237. tor_tls_t *tls = conn->tls;
  1238. if (!tls)
  1239. return;
  1240. tor_tls_set_renegotiate_callback(tls, NULL, NULL);
  1241. tor_tls_block_renegotiation(tls);
  1242. }
  1243. /** Invoked on the server side from inside tor_tls_read() when the server
  1244. * gets a successful TLS renegotiation from the client. */
  1245. static void
  1246. connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn)
  1247. {
  1248. or_connection_t *conn = _conn;
  1249. (void)tls;
  1250. /* Don't invoke this again. */
  1251. connection_or_block_renegotiation(conn);
  1252. if (connection_tls_finish_handshake(conn) < 0) {
  1253. /* XXXX_TLS double-check that it's ok to do this from inside read. */
  1254. /* XXXX_TLS double-check that this verifies certificates. */
  1255. connection_or_close_for_error(conn, 0);
  1256. }
  1257. }
  1258. /** Move forward with the tls handshake. If it finishes, hand
  1259. * <b>conn</b> to connection_tls_finish_handshake().
  1260. *
  1261. * Return -1 if <b>conn</b> is broken, else return 0.
  1262. */
  1263. int
  1264. connection_tls_continue_handshake(or_connection_t *conn)
  1265. {
  1266. int result;
  1267. check_no_tls_errors();
  1268. tor_assert(conn->base_.state == OR_CONN_STATE_TLS_HANDSHAKING);
  1269. // log_notice(LD_OR, "Continue handshake with %p", conn->tls);
  1270. result = tor_tls_handshake(conn->tls);
  1271. // log_notice(LD_OR, "Result: %d", result);
  1272. switch (result) {
  1273. CASE_TOR_TLS_ERROR_ANY:
  1274. log_info(LD_OR,"tls error [%s]. breaking connection.",
  1275. tor_tls_err_to_string(result));
  1276. return -1;
  1277. case TOR_TLS_DONE:
  1278. if (! tor_tls_used_v1_handshake(conn->tls)) {
  1279. if (!tor_tls_is_server(conn->tls)) {
  1280. tor_assert(conn->base_.state == OR_CONN_STATE_TLS_HANDSHAKING);
  1281. return connection_or_launch_v3_or_handshake(conn);
  1282. } else {
  1283. /* v2/v3 handshake, but we are not a client. */
  1284. log_debug(LD_OR, "Done with initial SSL handshake (server-side). "
  1285. "Expecting renegotiation or VERSIONS cell");
  1286. tor_tls_set_renegotiate_callback(conn->tls,
  1287. connection_or_tls_renegotiated_cb,
  1288. conn);
  1289. connection_or_change_state(conn,
  1290. OR_CONN_STATE_TLS_SERVER_RENEGOTIATING);
  1291. connection_stop_writing(TO_CONN(conn));
  1292. connection_start_reading(TO_CONN(conn));
  1293. return 0;
  1294. }
  1295. }
  1296. tor_assert(tor_tls_is_server(conn->tls));
  1297. return connection_tls_finish_handshake(conn);
  1298. case TOR_TLS_WANTWRITE:
  1299. connection_start_writing(TO_CONN(conn));
  1300. log_debug(LD_OR,"wanted write");
  1301. return 0;
  1302. case TOR_TLS_WANTREAD: /* handshaking conns are *always* reading */
  1303. log_debug(LD_OR,"wanted read");
  1304. return 0;
  1305. case TOR_TLS_CLOSE:
  1306. log_info(LD_OR,"tls closed. breaking connection.");
  1307. return -1;
  1308. }
  1309. return 0;
  1310. }
  1311. /** Return 1 if we initiated this connection, or 0 if it started
  1312. * out as an incoming connection.
  1313. */
  1314. int
  1315. connection_or_nonopen_was_started_here(or_connection_t *conn)
  1316. {
  1317. tor_assert(conn->base_.type == CONN_TYPE_OR ||
  1318. conn->base_.type == CONN_TYPE_EXT_OR);
  1319. if (!conn->tls)
  1320. return 1; /* it's still in proxy states or something */
  1321. if (conn->handshake_state)
  1322. return conn->handshake_state->started_here;
  1323. return !tor_tls_is_server(conn->tls);
  1324. }
  1325. /** <b>Conn</b> just completed its handshake. Return 0 if all is well, and
  1326. * return -1 if they are lying, broken, or otherwise something is wrong.
  1327. *
  1328. * If we initiated this connection (<b>started_here</b> is true), make sure
  1329. * the other side sent a correctly formed certificate. If I initiated the
  1330. * connection, make sure it's the right relay by checking the certificate.
  1331. *
  1332. * Otherwise (if we _didn't_ initiate this connection), it's okay for
  1333. * the certificate to be weird or absent.
  1334. *
  1335. * If we return 0, and the certificate is as expected, write a hash of the
  1336. * identity key into <b>digest_rcvd_out</b>, which must have DIGEST_LEN
  1337. * space in it.
  1338. * If the certificate is invalid or missing on an incoming connection,
  1339. * we return 0 and set <b>digest_rcvd_out</b> to DIGEST_LEN NUL bytes.
  1340. * (If we return -1, the contents of this buffer are undefined.)
  1341. *
  1342. * As side effects,
  1343. * 1) Set conn->circ_id_type according to tor-spec.txt.
  1344. * 2) If we're an authdirserver and we initiated the connection: drop all
  1345. * descriptors that claim to be on that IP/port but that aren't
  1346. * this relay; and note that this relay is reachable.
  1347. * 3) If this is a bridge and we didn't configure its identity
  1348. * fingerprint, remember the keyid we just learned.
  1349. */
  1350. static int
  1351. connection_or_check_valid_tls_handshake(or_connection_t *conn,
  1352. int started_here,
  1353. char *digest_rcvd_out)
  1354. {
  1355. crypto_pk_t *identity_rcvd=NULL;
  1356. const or_options_t *options = get_options();
  1357. int severity = server_mode(options) ? LOG_PROTOCOL_WARN : LOG_WARN;
  1358. const char *safe_address =
  1359. started_here ? conn->base_.address :
  1360. safe_str_client(conn->base_.address);
  1361. const char *conn_type = started_here ? "outgoing" : "incoming";
  1362. int has_cert = 0;
  1363. check_no_tls_errors();
  1364. has_cert = tor_tls_peer_has_cert(conn->tls);
  1365. if (started_here && !has_cert) {
  1366. log_info(LD_HANDSHAKE,"Tried connecting to router at %s:%d, but it didn't "
  1367. "send a cert! Closing.",
  1368. safe_address, conn->base_.port);
  1369. return -1;
  1370. } else if (!has_cert) {
  1371. log_debug(LD_HANDSHAKE,"Got incoming connection with no certificate. "
  1372. "That's ok.");
  1373. }
  1374. check_no_tls_errors();
  1375. if (has_cert) {
  1376. int v = tor_tls_verify(started_here?severity:LOG_INFO,
  1377. conn->tls, &identity_rcvd);
  1378. if (started_here && v<0) {
  1379. log_fn(severity,LD_HANDSHAKE,"Tried connecting to router at %s:%d: It"
  1380. " has a cert but it's invalid. Closing.",
  1381. safe_address, conn->base_.port);
  1382. return -1;
  1383. } else if (v<0) {
  1384. log_info(LD_HANDSHAKE,"Incoming connection gave us an invalid cert "
  1385. "chain; ignoring.");
  1386. } else {
  1387. log_debug(LD_HANDSHAKE,
  1388. "The certificate seems to be valid on %s connection "
  1389. "with %s:%d", conn_type, safe_address, conn->base_.port);
  1390. }
  1391. check_no_tls_errors();
  1392. }
  1393. if (identity_rcvd) {
  1394. if (crypto_pk_get_digest(identity_rcvd, digest_rcvd_out) < 0) {
  1395. crypto_pk_free(identity_rcvd);
  1396. return -1;
  1397. }
  1398. } else {
  1399. memset(digest_rcvd_out, 0, DIGEST_LEN);
  1400. }
  1401. tor_assert(conn->chan);
  1402. channel_set_circid_type(TLS_CHAN_TO_BASE(conn->chan), identity_rcvd, 1);
  1403. crypto_pk_free(identity_rcvd);
  1404. if (started_here) {
  1405. /* A TLS handshake can't teach us an Ed25519 ID, so we set it to NULL
  1406. * here. */
  1407. log_debug(LD_HANDSHAKE, "Calling client_learned_peer_id from "
  1408. "check_valid_tls_handshake");
  1409. return connection_or_client_learned_peer_id(conn,
  1410. (const uint8_t*)digest_rcvd_out,
  1411. NULL);
  1412. }
  1413. return 0;
  1414. }
  1415. /** Called when we (as a connection initiator) have definitively,
  1416. * authenticatedly, learned that ID of the Tor instance on the other
  1417. * side of <b>conn</b> is <b>rsa_peer_id</b> and optionally <b>ed_peer_id</b>.
  1418. * For v1 and v2 handshakes,
  1419. * this is right after we get a certificate chain in a TLS handshake
  1420. * or renegotiation. For v3+ handshakes, this is right after we get a
  1421. * certificate chain in a CERTS cell.
  1422. *
  1423. * If we did not know the ID before, record the one we got.
  1424. *
  1425. * If we wanted an ID, but we didn't get the one we expected, log a message
  1426. * and return -1.
  1427. * On relays:
  1428. * - log a protocol warning whenever the fingerprints don't match;
  1429. * On clients:
  1430. * - if a relay's fingerprint doesn't match, log a warning;
  1431. * - if we don't have updated relay fingerprints from a recent consensus, and
  1432. * a fallback directory mirror's hard-coded fingerprint has changed, log an
  1433. * info explaining that we will try another fallback.
  1434. *
  1435. * If we're testing reachability, remember what we learned.
  1436. *
  1437. * Return 0 on success, -1 on failure.
  1438. */
  1439. int
  1440. connection_or_client_learned_peer_id(or_connection_t *conn,
  1441. const uint8_t *rsa_peer_id,
  1442. const ed25519_public_key_t *ed_peer_id)
  1443. {
  1444. const or_options_t *options = get_options();
  1445. channel_tls_t *chan_tls = conn->chan;
  1446. channel_t *chan = channel_tls_to_base(chan_tls);
  1447. int changed_identity = 0;
  1448. tor_assert(chan);
  1449. const int expected_rsa_key =
  1450. ! tor_digest_is_zero(conn->identity_digest);
  1451. const int expected_ed_key =
  1452. ! ed25519_public_key_is_zero(&chan->ed25519_identity);
  1453. log_info(LD_HANDSHAKE, "learned peer id for %p (%s): %s, %s",
  1454. conn,
  1455. safe_str_client(conn->base_.address),
  1456. hex_str((const char*)rsa_peer_id, DIGEST_LEN),
  1457. ed25519_fmt(ed_peer_id));
  1458. if (! expected_rsa_key && ! expected_ed_key) {
  1459. log_info(LD_HANDSHAKE, "(we had no ID in mind when we made this "
  1460. "connection.");
  1461. connection_or_set_identity_digest(conn,
  1462. (const char*)rsa_peer_id, ed_peer_id);
  1463. tor_free(conn->nickname);
  1464. conn->nickname = tor_malloc(HEX_DIGEST_LEN+2);
  1465. conn->nickname[0] = '$';
  1466. base16_encode(conn->nickname+1, HEX_DIGEST_LEN+1,
  1467. conn->identity_digest, DIGEST_LEN);
  1468. log_info(LD_HANDSHAKE, "Connected to router %s at %s:%d without knowing "
  1469. "its key. Hoping for the best.",
  1470. conn->nickname, conn->base_.address, conn->base_.port);
  1471. /* if it's a bridge and we didn't know its identity fingerprint, now
  1472. * we do -- remember it for future attempts. */
  1473. learned_router_identity(&conn->base_.addr, conn->base_.port,
  1474. (const char*)rsa_peer_id, ed_peer_id);
  1475. changed_identity = 1;
  1476. }
  1477. const int rsa_mismatch = expected_rsa_key &&
  1478. tor_memneq(rsa_peer_id, conn->identity_digest, DIGEST_LEN);
  1479. /* It only counts as an ed25519 mismatch if we wanted an ed25519 identity
  1480. * and didn't get it. It's okay if we get one that we didn't ask for. */
  1481. const int ed25519_mismatch =
  1482. expected_ed_key &&
  1483. (ed_peer_id == NULL ||
  1484. ! ed25519_pubkey_eq(&chan->ed25519_identity, ed_peer_id));
  1485. if (rsa_mismatch || ed25519_mismatch) {
  1486. /* I was aiming for a particular digest. I didn't get it! */
  1487. char seen_rsa[HEX_DIGEST_LEN+1];
  1488. char expected_rsa[HEX_DIGEST_LEN+1];
  1489. char seen_ed[ED25519_BASE64_LEN+1];
  1490. char expected_ed[ED25519_BASE64_LEN+1];
  1491. base16_encode(seen_rsa, sizeof(seen_rsa),
  1492. (const char*)rsa_peer_id, DIGEST_LEN);
  1493. base16_encode(expected_rsa, sizeof(expected_rsa), conn->identity_digest,
  1494. DIGEST_LEN);
  1495. if (ed_peer_id) {
  1496. ed25519_public_to_base64(seen_ed, ed_peer_id);
  1497. } else {
  1498. strlcpy(seen_ed, "no ed25519 key", sizeof(seen_ed));
  1499. }
  1500. if (! ed25519_public_key_is_zero(&chan->ed25519_identity)) {
  1501. ed25519_public_to_base64(expected_ed, &chan->ed25519_identity);
  1502. } else {
  1503. strlcpy(expected_ed, "no ed25519 key", sizeof(expected_ed));
  1504. }
  1505. const int using_hardcoded_fingerprints =
  1506. !networkstatus_get_reasonably_live_consensus(time(NULL),
  1507. usable_consensus_flavor());
  1508. const int is_fallback_fingerprint = router_digest_is_fallback_dir(
  1509. conn->identity_digest);
  1510. const int is_authority_fingerprint = router_digest_is_trusted_dir(
  1511. conn->identity_digest);
  1512. int severity;
  1513. const char *extra_log = "";
  1514. if (server_mode(options)) {
  1515. severity = LOG_PROTOCOL_WARN;
  1516. } else {
  1517. if (using_hardcoded_fingerprints) {
  1518. /* We need to do the checks in this order, because the list of
  1519. * fallbacks includes the list of authorities */
  1520. if (is_authority_fingerprint) {
  1521. severity = LOG_WARN;
  1522. } else if (is_fallback_fingerprint) {
  1523. /* we expect a small number of fallbacks to change from their
  1524. * hard-coded fingerprints over the life of a release */
  1525. severity = LOG_INFO;
  1526. extra_log = " Tor will try a different fallback.";
  1527. } else {
  1528. /* it's a bridge, it's either a misconfiguration, or unexpected */
  1529. severity = LOG_WARN;
  1530. }
  1531. } else {
  1532. /* a relay has changed its fingerprint from the one in the consensus */
  1533. severity = LOG_WARN;
  1534. }
  1535. }
  1536. log_fn(severity, LD_HANDSHAKE,
  1537. "Tried connecting to router at %s:%d, but RSA identity key was not "
  1538. "as expected: wanted %s + %s but got %s + %s.%s",
  1539. conn->base_.address, conn->base_.port,
  1540. expected_rsa, expected_ed, seen_rsa, seen_ed, extra_log);
  1541. /* Tell the new guard API about the channel failure */
  1542. entry_guard_chan_failed(TLS_CHAN_TO_BASE(conn->chan));
  1543. control_event_or_conn_status(conn, OR_CONN_EVENT_FAILED,
  1544. END_OR_CONN_REASON_OR_IDENTITY);
  1545. if (!authdir_mode_tests_reachability(options))
  1546. control_event_bootstrap_prob_or(
  1547. "Unexpected identity in router certificate",
  1548. END_OR_CONN_REASON_OR_IDENTITY,
  1549. conn);
  1550. return -1;
  1551. }
  1552. if (!expected_ed_key && ed_peer_id) {
  1553. log_info(LD_HANDSHAKE, "(we had no Ed25519 ID in mind when we made this "
  1554. "connection.");
  1555. connection_or_set_identity_digest(conn,
  1556. (const char*)rsa_peer_id, ed_peer_id);
  1557. changed_identity = 1;
  1558. }
  1559. if (changed_identity) {
  1560. /* If we learned an identity for this connection, then we might have
  1561. * just discovered it to be canonical. */
  1562. connection_or_check_canonicity(conn, conn->handshake_state->started_here);
  1563. }
  1564. if (authdir_mode_tests_reachability(options)) {
  1565. dirserv_orconn_tls_done(&conn->base_.addr, conn->base_.port,
  1566. (const char*)rsa_peer_id, ed_peer_id);
  1567. }
  1568. return 0;
  1569. }
  1570. /** Return when we last used this channel for client activity (origin
  1571. * circuits). This is called from connection.c, since client_used is now one
  1572. * of the timestamps in channel_t */
  1573. time_t
  1574. connection_or_client_used(or_connection_t *conn)
  1575. {
  1576. tor_assert(conn);
  1577. if (conn->chan) {
  1578. return channel_when_last_client(TLS_CHAN_TO_BASE(conn->chan));
  1579. } else return 0;
  1580. }
  1581. /** The v1/v2 TLS handshake is finished.
  1582. *
  1583. * Make sure we are happy with the peer we just handshaked with.
  1584. *
  1585. * If they initiated the connection, make sure they're not already connected,
  1586. * then initialize conn from the information in router.
  1587. *
  1588. * If all is successful, call circuit_n_conn_done() to handle events
  1589. * that have been pending on the <tls handshake completion. Also set the
  1590. * directory to be dirty (only matters if I'm an authdirserver).
  1591. *
  1592. * If this is a v2 TLS handshake, send a versions cell.
  1593. */
  1594. static int
  1595. connection_tls_finish_handshake(or_connection_t *conn)
  1596. {
  1597. char digest_rcvd[DIGEST_LEN];
  1598. int started_here = connection_or_nonopen_was_started_here(conn);
  1599. tor_assert(!started_here);
  1600. log_debug(LD_HANDSHAKE,"%s tls handshake on %p with %s done, using "
  1601. "ciphersuite %s. verifying.",
  1602. started_here?"outgoing":"incoming",
  1603. conn,
  1604. safe_str_client(conn->base_.address),
  1605. tor_tls_get_ciphersuite_name(conn->tls));
  1606. if (connection_or_check_valid_tls_handshake(conn, started_here,
  1607. digest_rcvd) < 0)
  1608. return -1;
  1609. circuit_build_times_network_is_live(get_circuit_build_times_mutable());
  1610. if (tor_tls_used_v1_handshake(conn->tls)) {
  1611. conn->link_proto = 1;
  1612. connection_or_init_conn_from_address(conn, &conn->base_.addr,
  1613. conn->base_.port, digest_rcvd,
  1614. NULL, 0);
  1615. tor_tls_block_renegotiation(conn->tls);
  1616. rep_hist_note_negotiated_link_proto(1, started_here);
  1617. return connection_or_set_state_open(conn);
  1618. } else {
  1619. connection_or_change_state(conn, OR_CONN_STATE_OR_HANDSHAKING_V2);
  1620. if (connection_init_or_handshake_state(conn, started_here) < 0)
  1621. return -1;
  1622. connection_or_init_conn_from_address(conn, &conn->base_.addr,
  1623. conn->base_.port, digest_rcvd,
  1624. NULL, 0);
  1625. return connection_or_send_versions(conn, 0);
  1626. }
  1627. }
  1628. /**
  1629. * Called as client when initial TLS handshake is done, and we notice
  1630. * that we got a v3-handshake signalling certificate from the server.
  1631. * Set up structures, do bookkeeping, and send the versions cell.
  1632. * Return 0 on success and -1 on failure.
  1633. */
  1634. static int
  1635. connection_or_launch_v3_or_handshake(or_connection_t *conn)
  1636. {
  1637. tor_assert(connection_or_nonopen_was_started_here(conn));
  1638. circuit_build_times_network_is_live(get_circuit_build_times_mutable());
  1639. connection_or_change_state(conn, OR_CONN_STATE_OR_HANDSHAKING_V3);
  1640. if (connection_init_or_handshake_state(conn, 1) < 0)
  1641. return -1;
  1642. return connection_or_send_versions(conn, 1);
  1643. }
  1644. /** Allocate a new connection handshake state for the connection
  1645. * <b>conn</b>. Return 0 on success, -1 on failure. */
  1646. int
  1647. connection_init_or_handshake_state(or_connection_t *conn, int started_here)
  1648. {
  1649. or_handshake_state_t *s;
  1650. if (conn->handshake_state) {
  1651. log_warn(LD_BUG, "Duplicate call to connection_init_or_handshake_state!");
  1652. return 0;
  1653. }
  1654. s = conn->handshake_state = tor_malloc_zero(sizeof(or_handshake_state_t));
  1655. s->started_here = started_here ? 1 : 0;
  1656. s->digest_sent_data = 1;
  1657. s->digest_received_data = 1;
  1658. if (! started_here && get_current_link_cert_cert()) {
  1659. s->own_link_cert = tor_cert_dup(get_current_link_cert_cert());
  1660. }
  1661. s->certs = or_handshake_certs_new();
  1662. s->certs->started_here = s->started_here;
  1663. return 0;
  1664. }
  1665. /** Free all storage held by <b>state</b>. */
  1666. void
  1667. or_handshake_state_free_(or_handshake_state_t *state)
  1668. {
  1669. if (!state)
  1670. return;
  1671. crypto_digest_free(state->digest_sent);
  1672. crypto_digest_free(state->digest_received);
  1673. or_handshake_certs_free(state->certs);
  1674. tor_cert_free(state->own_link_cert);
  1675. memwipe(state, 0xBE, sizeof(or_handshake_state_t));
  1676. tor_free(state);
  1677. }
  1678. /**
  1679. * Remember that <b>cell</b> has been transmitted (if <b>incoming</b> is
  1680. * false) or received (if <b>incoming</b> is true) during a V3 handshake using
  1681. * <b>state</b>.
  1682. *
  1683. * (We don't record the cell, but we keep a digest of everything sent or
  1684. * received during the v3 handshake, and the client signs it in an
  1685. * authenticate cell.)
  1686. */
  1687. void
  1688. or_handshake_state_record_cell(or_connection_t *conn,
  1689. or_handshake_state_t *state,
  1690. const cell_t *cell,
  1691. int incoming)
  1692. {
  1693. size_t cell_network_size = get_cell_network_size(conn->wide_circ_ids);
  1694. crypto_digest_t *d, **dptr;
  1695. packed_cell_t packed;
  1696. if (incoming) {
  1697. if (!state->digest_received_data)
  1698. return;
  1699. } else {
  1700. if (!state->digest_sent_data)
  1701. return;
  1702. }
  1703. if (!incoming) {
  1704. log_warn(LD_BUG, "We shouldn't be sending any non-variable-length cells "
  1705. "while making a handshake digest. But we think we are sending "
  1706. "one with type %d.", (int)cell->command);
  1707. }
  1708. dptr = incoming ? &state->digest_received : &state->digest_sent;
  1709. if (! *dptr)
  1710. *dptr = crypto_digest256_new(DIGEST_SHA256);
  1711. d = *dptr;
  1712. /* Re-packing like this is a little inefficient, but we don't have to do
  1713. this very often at all. */
  1714. cell_pack(&packed, cell, conn->wide_circ_ids);
  1715. crypto_digest_add_bytes(d, packed.body, cell_network_size);
  1716. memwipe(&packed, 0, sizeof(packed));
  1717. }
  1718. /** Remember that a variable-length <b>cell</b> has been transmitted (if
  1719. * <b>incoming</b> is false) or received (if <b>incoming</b> is true) during a
  1720. * V3 handshake using <b>state</b>.
  1721. *
  1722. * (We don't record the cell, but we keep a digest of everything sent or
  1723. * received during the v3 handshake, and the client signs it in an
  1724. * authenticate cell.)
  1725. */
  1726. void
  1727. or_handshake_state_record_var_cell(or_connection_t *conn,
  1728. or_handshake_state_t *state,
  1729. const var_cell_t *cell,
  1730. int incoming)
  1731. {
  1732. crypto_digest_t *d, **dptr;
  1733. int n;
  1734. char buf[VAR_CELL_MAX_HEADER_SIZE];
  1735. if (incoming) {
  1736. if (!state->digest_received_data)
  1737. return;
  1738. } else {
  1739. if (!state->digest_sent_data)
  1740. return;
  1741. }
  1742. dptr = incoming ? &state->digest_received : &state->digest_sent;
  1743. if (! *dptr)
  1744. *dptr = crypto_digest256_new(DIGEST_SHA256);
  1745. d = *dptr;
  1746. n = var_cell_pack_header(cell, buf, conn->wide_circ_ids);
  1747. crypto_digest_add_bytes(d, buf, n);
  1748. crypto_digest_add_bytes(d, (const char *)cell->payload, cell->payload_len);
  1749. memwipe(buf, 0, sizeof(buf));
  1750. }
  1751. /** Set <b>conn</b>'s state to OR_CONN_STATE_OPEN, and tell other subsystems
  1752. * as appropriate. Called when we are done with all TLS and OR handshaking.
  1753. */
  1754. int
  1755. connection_or_set_state_open(or_connection_t *conn)
  1756. {
  1757. connection_or_change_state(conn, OR_CONN_STATE_OPEN);
  1758. control_event_or_conn_status(conn, OR_CONN_EVENT_CONNECTED, 0);
  1759. /* Link protocol 3 appeared in Tor 0.2.3.6-alpha, so any connection
  1760. * that uses an earlier link protocol should not be treated as a relay. */
  1761. if (conn->link_proto < 3) {
  1762. channel_mark_client(TLS_CHAN_TO_BASE(conn->chan));
  1763. }
  1764. or_handshake_state_free(conn->handshake_state);
  1765. conn->handshake_state = NULL;
  1766. connection_start_reading(TO_CONN(conn));
  1767. return 0;
  1768. }
  1769. /** Pack <b>cell</b> into wire-format, and write it onto <b>conn</b>'s outbuf.
  1770. * For cells that use or affect a circuit, this should only be called by
  1771. * connection_or_flush_from_first_active_circuit().
  1772. */
  1773. void
  1774. connection_or_write_cell_to_buf(const cell_t *cell, or_connection_t *conn)
  1775. {
  1776. packed_cell_t networkcell;
  1777. size_t cell_network_size = get_cell_network_size(conn->wide_circ_ids);
  1778. tor_assert(cell);
  1779. tor_assert(conn);
  1780. cell_pack(&networkcell, cell, conn->wide_circ_ids);
  1781. rep_hist_padding_count_write(PADDING_TYPE_TOTAL);
  1782. if (cell->command == CELL_PADDING)
  1783. rep_hist_padding_count_write(PADDING_TYPE_CELL);
  1784. connection_buf_add(networkcell.body, cell_network_size, TO_CONN(conn));
  1785. /* Touch the channel's active timestamp if there is one */
  1786. if (conn->chan) {
  1787. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  1788. if (TLS_CHAN_TO_BASE(conn->chan)->currently_padding) {
  1789. rep_hist_padding_count_write(PADDING_TYPE_ENABLED_TOTAL);
  1790. if (cell->command == CELL_PADDING)
  1791. rep_hist_padding_count_write(PADDING_TYPE_ENABLED_CELL);
  1792. }
  1793. }
  1794. if (conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3)
  1795. or_handshake_state_record_cell(conn, conn->handshake_state, cell, 0);
  1796. }
  1797. /** Pack a variable-length <b>cell</b> into wire-format, and write it onto
  1798. * <b>conn</b>'s outbuf. Right now, this <em>DOES NOT</em> support cells that
  1799. * affect a circuit.
  1800. */
  1801. MOCK_IMPL(void,
  1802. connection_or_write_var_cell_to_buf,(const var_cell_t *cell,
  1803. or_connection_t *conn))
  1804. {
  1805. int n;
  1806. char hdr[VAR_CELL_MAX_HEADER_SIZE];
  1807. tor_assert(cell);
  1808. tor_assert(conn);
  1809. n = var_cell_pack_header(cell, hdr, conn->wide_circ_ids);
  1810. connection_buf_add(hdr, n, TO_CONN(conn));
  1811. connection_buf_add((char*)cell->payload,
  1812. cell->payload_len, TO_CONN(conn));
  1813. if (conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3)
  1814. or_handshake_state_record_var_cell(conn, conn->handshake_state, cell, 0);
  1815. /* Touch the channel's active timestamp if there is one */
  1816. if (conn->chan)
  1817. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  1818. }
  1819. /** See whether there's a variable-length cell waiting on <b>or_conn</b>'s
  1820. * inbuf. Return values as for fetch_var_cell_from_buf(). */
  1821. static int
  1822. connection_fetch_var_cell_from_buf(or_connection_t *or_conn, var_cell_t **out)
  1823. {
  1824. connection_t *conn = TO_CONN(or_conn);
  1825. return fetch_var_cell_from_buf(conn->inbuf, out, or_conn->link_proto);
  1826. }
  1827. /** Process cells from <b>conn</b>'s inbuf.
  1828. *
  1829. * Loop: while inbuf contains a cell, pull it off the inbuf, unpack it,
  1830. * and hand it to command_process_cell().
  1831. *
  1832. * Always return 0.
  1833. */
  1834. static int
  1835. connection_or_process_cells_from_inbuf(or_connection_t *conn)
  1836. {
  1837. var_cell_t *var_cell;
  1838. /*
  1839. * Note on memory management for incoming cells: below the channel layer,
  1840. * we shouldn't need to consider its internal queueing/copying logic. It
  1841. * is safe to pass cells to it on the stack or on the heap, but in the
  1842. * latter case we must be sure we free them later.
  1843. *
  1844. * The incoming cell queue code in channel.c will (in the common case)
  1845. * decide it can pass them to the upper layer immediately, in which case
  1846. * those functions may run directly on the cell pointers we pass here, or
  1847. * it may decide to queue them, in which case it will allocate its own
  1848. * buffer and copy the cell.
  1849. */
  1850. while (1) {
  1851. log_debug(LD_OR,
  1852. TOR_SOCKET_T_FORMAT": starting, inbuf_datalen %d "
  1853. "(%d pending in tls object).",
  1854. conn->base_.s,(int)connection_get_inbuf_len(TO_CONN(conn)),
  1855. tor_tls_get_pending_bytes(conn->tls));
  1856. if (connection_fetch_var_cell_from_buf(conn, &var_cell)) {
  1857. if (!var_cell)
  1858. return 0; /* not yet. */
  1859. /* Touch the channel's active timestamp if there is one */
  1860. if (conn->chan)
  1861. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  1862. circuit_build_times_network_is_live(get_circuit_build_times_mutable());
  1863. channel_tls_handle_var_cell(var_cell, conn);
  1864. var_cell_free(var_cell);
  1865. } else {
  1866. const int wide_circ_ids = conn->wide_circ_ids;
  1867. size_t cell_network_size = get_cell_network_size(conn->wide_circ_ids);
  1868. char buf[CELL_MAX_NETWORK_SIZE];
  1869. cell_t cell;
  1870. if (connection_get_inbuf_len(TO_CONN(conn))
  1871. < cell_network_size) /* whole response available? */
  1872. return 0; /* not yet */
  1873. /* Touch the channel's active timestamp if there is one */
  1874. if (conn->chan)
  1875. channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan));
  1876. circuit_build_times_network_is_live(get_circuit_build_times_mutable());
  1877. connection_buf_get_bytes(buf, cell_network_size, TO_CONN(conn));
  1878. /* retrieve cell info from buf (create the host-order struct from the
  1879. * network-order string) */
  1880. cell_unpack(&cell, buf, wide_circ_ids);
  1881. channel_tls_handle_cell(&cell, conn);
  1882. }
  1883. }
  1884. }
  1885. /** Array of recognized link protocol versions. */
  1886. static const uint16_t or_protocol_versions[] = { 1, 2, 3, 4, 5 };
  1887. /** Number of versions in <b>or_protocol_versions</b>. */
  1888. static const int n_or_protocol_versions =
  1889. (int)( sizeof(or_protocol_versions)/sizeof(uint16_t) );
  1890. /** Return true iff <b>v</b> is a link protocol version that this Tor
  1891. * implementation believes it can support. */
  1892. int
  1893. is_or_protocol_version_known(uint16_t v)
  1894. {
  1895. int i;
  1896. for (i = 0; i < n_or_protocol_versions; ++i) {
  1897. if (or_protocol_versions[i] == v)
  1898. return 1;
  1899. }
  1900. return 0;
  1901. }
  1902. /** Send a VERSIONS cell on <b>conn</b>, telling the other host about the
  1903. * link protocol versions that this Tor can support.
  1904. *
  1905. * If <b>v3_plus</b>, this is part of a V3 protocol handshake, so only
  1906. * allow protocol version v3 or later. If not <b>v3_plus</b>, this is
  1907. * not part of a v3 protocol handshake, so don't allow protocol v3 or
  1908. * later.
  1909. **/
  1910. int
  1911. connection_or_send_versions(or_connection_t *conn, int v3_plus)
  1912. {
  1913. var_cell_t *cell;
  1914. int i;
  1915. int n_versions = 0;
  1916. const int min_version = v3_plus ? 3 : 0;
  1917. const int max_version = v3_plus ? UINT16_MAX : 2;
  1918. tor_assert(conn->handshake_state &&
  1919. !conn->handshake_state->sent_versions_at);
  1920. cell = var_cell_new(n_or_protocol_versions * 2);
  1921. cell->command = CELL_VERSIONS;
  1922. for (i = 0; i < n_or_protocol_versions; ++i) {
  1923. uint16_t v = or_protocol_versions[i];
  1924. if (v < min_version || v > max_version)
  1925. continue;
  1926. set_uint16(cell->payload+(2*n_versions), htons(v));
  1927. ++n_versions;
  1928. }
  1929. cell->payload_len = n_versions * 2;
  1930. connection_or_write_var_cell_to_buf(cell, conn);
  1931. conn->handshake_state->sent_versions_at = time(NULL);
  1932. var_cell_free(cell);
  1933. return 0;
  1934. }
  1935. /** Send a NETINFO cell on <b>conn</b>, telling the other server what we know
  1936. * about their address, our address, and the current time. */
  1937. MOCK_IMPL(int,
  1938. connection_or_send_netinfo,(or_connection_t *conn))
  1939. {
  1940. cell_t cell;
  1941. time_t now = time(NULL);
  1942. const routerinfo_t *me;
  1943. int len;
  1944. uint8_t *out;
  1945. tor_assert(conn->handshake_state);
  1946. if (conn->handshake_state->sent_netinfo) {
  1947. log_warn(LD_BUG, "Attempted to send an extra netinfo cell on a connection "
  1948. "where we already sent one.");
  1949. return 0;
  1950. }
  1951. memset(&cell, 0, sizeof(cell_t));
  1952. cell.command = CELL_NETINFO;
  1953. /* Timestamp, if we're a relay. */
  1954. if (public_server_mode(get_options()) || ! conn->is_outgoing)
  1955. set_uint32(cell.payload, htonl((uint32_t)now));
  1956. /* Their address. */
  1957. out = cell.payload + 4;
  1958. /* We use &conn->real_addr below, unless it hasn't yet been set. If it
  1959. * hasn't yet been set, we know that base_.addr hasn't been tampered with
  1960. * yet either. */
  1961. len = append_address_to_payload(out, !tor_addr_is_null(&conn->real_addr)
  1962. ? &conn->real_addr : &conn->base_.addr);
  1963. if (len<0)
  1964. return -1;
  1965. out += len;
  1966. /* My address -- only include it if I'm a public relay, or if I'm a
  1967. * bridge and this is an incoming connection. If I'm a bridge and this
  1968. * is an outgoing connection, act like a normal client and omit it. */
  1969. if ((public_server_mode(get_options()) || !conn->is_outgoing) &&
  1970. (me = router_get_my_routerinfo())) {
  1971. tor_addr_t my_addr;
  1972. *out++ = 1 + !tor_addr_is_null(&me->ipv6_addr);
  1973. tor_addr_from_ipv4h(&my_addr, me->addr);
  1974. len = append_address_to_payload(out, &my_addr);
  1975. if (len < 0)
  1976. return -1;
  1977. out += len;
  1978. if (!tor_addr_is_null(&me->ipv6_addr)) {
  1979. len = append_address_to_payload(out, &me->ipv6_addr);
  1980. if (len < 0)
  1981. return -1;
  1982. }
  1983. } else {
  1984. *out = 0;
  1985. }
  1986. conn->handshake_state->digest_sent_data = 0;
  1987. conn->handshake_state->sent_netinfo = 1;
  1988. connection_or_write_cell_to_buf(&cell, conn);
  1989. return 0;
  1990. }
  1991. /** Helper used to add an encoded certs to a cert cell */
  1992. static void
  1993. add_certs_cell_cert_helper(certs_cell_t *certs_cell,
  1994. uint8_t cert_type,
  1995. const uint8_t *cert_encoded,
  1996. size_t cert_len)
  1997. {
  1998. tor_assert(cert_len <= UINT16_MAX);
  1999. certs_cell_cert_t *ccc = certs_cell_cert_new();
  2000. ccc->cert_type = cert_type;
  2001. ccc->cert_len = cert_len;
  2002. certs_cell_cert_setlen_body(ccc, cert_len);
  2003. memcpy(certs_cell_cert_getarray_body(ccc), cert_encoded, cert_len);
  2004. certs_cell_add_certs(certs_cell, ccc);
  2005. }
  2006. /** Add an encoded X509 cert (stored as <b>cert_len</b> bytes at
  2007. * <b>cert_encoded</b>) to the trunnel certs_cell_t object that we are
  2008. * building in <b>certs_cell</b>. Set its type field to <b>cert_type</b>.
  2009. * (If <b>cert</b> is NULL, take no action.) */
  2010. static void
  2011. add_x509_cert(certs_cell_t *certs_cell,
  2012. uint8_t cert_type,
  2013. const tor_x509_cert_t *cert)
  2014. {
  2015. if (NULL == cert)
  2016. return;
  2017. const uint8_t *cert_encoded = NULL;
  2018. size_t cert_len;
  2019. tor_x509_cert_get_der(cert, &cert_encoded, &cert_len);
  2020. add_certs_cell_cert_helper(certs_cell, cert_type, cert_encoded, cert_len);
  2021. }
  2022. /** Add an Ed25519 cert from <b>cert</b> to the trunnel certs_cell_t object
  2023. * that we are building in <b>certs_cell</b>. Set its type field to
  2024. * <b>cert_type</b>. (If <b>cert</b> is NULL, take no action.) */
  2025. static void
  2026. add_ed25519_cert(certs_cell_t *certs_cell,
  2027. uint8_t cert_type,
  2028. const tor_cert_t *cert)
  2029. {
  2030. if (NULL == cert)
  2031. return;
  2032. add_certs_cell_cert_helper(certs_cell, cert_type,
  2033. cert->encoded, cert->encoded_len);
  2034. }
  2035. #ifdef TOR_UNIT_TESTS
  2036. int certs_cell_ed25519_disabled_for_testing = 0;
  2037. #else
  2038. #define certs_cell_ed25519_disabled_for_testing 0
  2039. #endif
  2040. /** Send a CERTS cell on the connection <b>conn</b>. Return 0 on success, -1
  2041. * on failure. */
  2042. int
  2043. connection_or_send_certs_cell(or_connection_t *conn)
  2044. {
  2045. const tor_x509_cert_t *global_link_cert = NULL, *id_cert = NULL;
  2046. tor_x509_cert_t *own_link_cert = NULL;
  2047. var_cell_t *cell;
  2048. certs_cell_t *certs_cell = NULL;
  2049. tor_assert(conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3);
  2050. if (! conn->handshake_state)
  2051. return -1;
  2052. const int conn_in_server_mode = ! conn->handshake_state->started_here;
  2053. /* Get the encoded values of the X509 certificates */
  2054. if (tor_tls_get_my_certs(conn_in_server_mode,
  2055. &global_link_cert, &id_cert) < 0)
  2056. return -1;
  2057. if (conn_in_server_mode) {
  2058. own_link_cert = tor_tls_get_own_cert(conn->tls);
  2059. }
  2060. tor_assert(id_cert);
  2061. certs_cell = certs_cell_new();
  2062. /* Start adding certs. First the link cert or auth1024 cert. */
  2063. if (conn_in_server_mode) {
  2064. tor_assert_nonfatal(own_link_cert);
  2065. add_x509_cert(certs_cell,
  2066. OR_CERT_TYPE_TLS_LINK, own_link_cert);
  2067. } else {
  2068. tor_assert(global_link_cert);
  2069. add_x509_cert(certs_cell,
  2070. OR_CERT_TYPE_AUTH_1024, global_link_cert);
  2071. }
  2072. /* Next the RSA->RSA ID cert */
  2073. add_x509_cert(certs_cell,
  2074. OR_CERT_TYPE_ID_1024, id_cert);
  2075. /* Next the Ed25519 certs */
  2076. add_ed25519_cert(certs_cell,
  2077. CERTTYPE_ED_ID_SIGN,
  2078. get_master_signing_key_cert());
  2079. if (conn_in_server_mode) {
  2080. tor_assert_nonfatal(conn->handshake_state->own_link_cert ||
  2081. certs_cell_ed25519_disabled_for_testing);
  2082. add_ed25519_cert(certs_cell,
  2083. CERTTYPE_ED_SIGN_LINK,
  2084. conn->handshake_state->own_link_cert);
  2085. } else {
  2086. add_ed25519_cert(certs_cell,
  2087. CERTTYPE_ED_SIGN_AUTH,
  2088. get_current_auth_key_cert());
  2089. }
  2090. /* And finally the crosscert. */
  2091. {
  2092. const uint8_t *crosscert=NULL;
  2093. size_t crosscert_len;
  2094. get_master_rsa_crosscert(&crosscert, &crosscert_len);
  2095. if (crosscert) {
  2096. add_certs_cell_cert_helper(certs_cell,
  2097. CERTTYPE_RSA1024_ID_EDID,
  2098. crosscert, crosscert_len);
  2099. }
  2100. }
  2101. /* We've added all the certs; make the cell. */
  2102. certs_cell->n_certs = certs_cell_getlen_certs(certs_cell);
  2103. ssize_t alloc_len = certs_cell_encoded_len(certs_cell);
  2104. tor_assert(alloc_len >= 0 && alloc_len <= UINT16_MAX);
  2105. cell = var_cell_new(alloc_len);
  2106. cell->command = CELL_CERTS;
  2107. ssize_t enc_len = certs_cell_encode(cell->payload, alloc_len, certs_cell);
  2108. tor_assert(enc_len > 0 && enc_len <= alloc_len);
  2109. cell->payload_len = enc_len;
  2110. connection_or_write_var_cell_to_buf(cell, conn);
  2111. var_cell_free(cell);
  2112. certs_cell_free(certs_cell);
  2113. tor_x509_cert_free(own_link_cert);
  2114. return 0;
  2115. }
  2116. /** Return true iff <b>challenge_type</b> is an AUTHCHALLENGE type that
  2117. * we can send and receive. */
  2118. int
  2119. authchallenge_type_is_supported(uint16_t challenge_type)
  2120. {
  2121. switch (challenge_type) {
  2122. case AUTHTYPE_RSA_SHA256_TLSSECRET:
  2123. case AUTHTYPE_ED25519_SHA256_RFC5705:
  2124. return 1;
  2125. case AUTHTYPE_RSA_SHA256_RFC5705:
  2126. default:
  2127. return 0;
  2128. }
  2129. }
  2130. /** Return true iff <b>challenge_type_a</b> is one that we would rather
  2131. * use than <b>challenge_type_b</b>. */
  2132. int
  2133. authchallenge_type_is_better(uint16_t challenge_type_a,
  2134. uint16_t challenge_type_b)
  2135. {
  2136. /* Any supported type is better than an unsupported one;
  2137. * all unsupported types are equally bad. */
  2138. if (!authchallenge_type_is_supported(challenge_type_a))
  2139. return 0;
  2140. if (!authchallenge_type_is_supported(challenge_type_b))
  2141. return 1;
  2142. /* It happens that types are superior in numerically ascending order.
  2143. * If that ever changes, this must change too. */
  2144. return (challenge_type_a > challenge_type_b);
  2145. }
  2146. /** Send an AUTH_CHALLENGE cell on the connection <b>conn</b>. Return 0
  2147. * on success, -1 on failure. */
  2148. int
  2149. connection_or_send_auth_challenge_cell(or_connection_t *conn)
  2150. {
  2151. var_cell_t *cell = NULL;
  2152. int r = -1;
  2153. tor_assert(conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3);
  2154. if (! conn->handshake_state)
  2155. return -1;
  2156. auth_challenge_cell_t *ac = auth_challenge_cell_new();
  2157. tor_assert(sizeof(ac->challenge) == 32);
  2158. crypto_rand((char*)ac->challenge, sizeof(ac->challenge));
  2159. auth_challenge_cell_add_methods(ac, AUTHTYPE_RSA_SHA256_TLSSECRET);
  2160. /* Disabled, because everything that supports this method also supports
  2161. * the much-superior ED25519_SHA256_RFC5705 */
  2162. /* auth_challenge_cell_add_methods(ac, AUTHTYPE_RSA_SHA256_RFC5705); */
  2163. auth_challenge_cell_add_methods(ac, AUTHTYPE_ED25519_SHA256_RFC5705);
  2164. auth_challenge_cell_set_n_methods(ac,
  2165. auth_challenge_cell_getlen_methods(ac));
  2166. cell = var_cell_new(auth_challenge_cell_encoded_len(ac));
  2167. ssize_t len = auth_challenge_cell_encode(cell->payload, cell->payload_len,
  2168. ac);
  2169. if (len != cell->payload_len) {
  2170. /* LCOV_EXCL_START */
  2171. log_warn(LD_BUG, "Encoded auth challenge cell length not as expected");
  2172. goto done;
  2173. /* LCOV_EXCL_STOP */
  2174. }
  2175. cell->command = CELL_AUTH_CHALLENGE;
  2176. connection_or_write_var_cell_to_buf(cell, conn);
  2177. r = 0;
  2178. done:
  2179. var_cell_free(cell);
  2180. auth_challenge_cell_free(ac);
  2181. return r;
  2182. }
  2183. /** Compute the main body of an AUTHENTICATE cell that a client can use
  2184. * to authenticate itself on a v3 handshake for <b>conn</b>. Return it
  2185. * in a var_cell_t.
  2186. *
  2187. * If <b>server</b> is true, only calculate the first
  2188. * V3_AUTH_FIXED_PART_LEN bytes -- the part of the authenticator that's
  2189. * determined by the rest of the handshake, and which match the provided value
  2190. * exactly.
  2191. *
  2192. * If <b>server</b> is false and <b>signing_key</b> is NULL, calculate the
  2193. * first V3_AUTH_BODY_LEN bytes of the authenticator (that is, everything
  2194. * that should be signed), but don't actually sign it.
  2195. *
  2196. * If <b>server</b> is false and <b>signing_key</b> is provided, calculate the
  2197. * entire authenticator, signed with <b>signing_key</b>.
  2198. *
  2199. * Return the length of the cell body on success, and -1 on failure.
  2200. */
  2201. var_cell_t *
  2202. connection_or_compute_authenticate_cell_body(or_connection_t *conn,
  2203. const int authtype,
  2204. crypto_pk_t *signing_key,
  2205. const ed25519_keypair_t *ed_signing_key,
  2206. int server)
  2207. {
  2208. auth1_t *auth = NULL;
  2209. auth_ctx_t *ctx = auth_ctx_new();
  2210. var_cell_t *result = NULL;
  2211. int old_tlssecrets_algorithm = 0;
  2212. const char *authtype_str = NULL;
  2213. int is_ed = 0;
  2214. /* assert state is reasonable XXXX */
  2215. switch (authtype) {
  2216. case AUTHTYPE_RSA_SHA256_TLSSECRET:
  2217. authtype_str = "AUTH0001";
  2218. old_tlssecrets_algorithm = 1;
  2219. break;
  2220. case AUTHTYPE_RSA_SHA256_RFC5705:
  2221. authtype_str = "AUTH0002";
  2222. break;
  2223. case AUTHTYPE_ED25519_SHA256_RFC5705:
  2224. authtype_str = "AUTH0003";
  2225. is_ed = 1;
  2226. break;
  2227. default:
  2228. tor_assert(0);
  2229. break;
  2230. }
  2231. auth = auth1_new();
  2232. ctx->is_ed = is_ed;
  2233. /* Type: 8 bytes. */
  2234. memcpy(auth1_getarray_type(auth), authtype_str, 8);
  2235. {
  2236. const tor_x509_cert_t *id_cert=NULL;
  2237. const common_digests_t *my_digests, *their_digests;
  2238. const uint8_t *my_id, *their_id, *client_id, *server_id;
  2239. if (tor_tls_get_my_certs(server, NULL, &id_cert))
  2240. goto err;
  2241. my_digests = tor_x509_cert_get_id_digests(id_cert);
  2242. their_digests =
  2243. tor_x509_cert_get_id_digests(conn->handshake_state->certs->id_cert);
  2244. tor_assert(my_digests);
  2245. tor_assert(their_digests);
  2246. my_id = (uint8_t*)my_digests->d[DIGEST_SHA256];
  2247. their_id = (uint8_t*)their_digests->d[DIGEST_SHA256];
  2248. client_id = server ? their_id : my_id;
  2249. server_id = server ? my_id : their_id;
  2250. /* Client ID digest: 32 octets. */
  2251. memcpy(auth->cid, client_id, 32);
  2252. /* Server ID digest: 32 octets. */
  2253. memcpy(auth->sid, server_id, 32);
  2254. }
  2255. if (is_ed) {
  2256. const ed25519_public_key_t *my_ed_id, *their_ed_id;
  2257. if (!conn->handshake_state->certs->ed_id_sign) {
  2258. log_warn(LD_OR, "Ed authenticate without Ed ID cert from peer.");
  2259. goto err;
  2260. }
  2261. my_ed_id = get_master_identity_key();
  2262. their_ed_id = &conn->handshake_state->certs->ed_id_sign->signing_key;
  2263. const uint8_t *cid_ed = (server ? their_ed_id : my_ed_id)->pubkey;
  2264. const uint8_t *sid_ed = (server ? my_ed_id : their_ed_id)->pubkey;
  2265. memcpy(auth->u1_cid_ed, cid_ed, ED25519_PUBKEY_LEN);
  2266. memcpy(auth->u1_sid_ed, sid_ed, ED25519_PUBKEY_LEN);
  2267. }
  2268. {
  2269. crypto_digest_t *server_d, *client_d;
  2270. if (server) {
  2271. server_d = conn->handshake_state->digest_sent;
  2272. client_d = conn->handshake_state->digest_received;
  2273. } else {
  2274. client_d = conn->handshake_state->digest_sent;
  2275. server_d = conn->handshake_state->digest_received;
  2276. }
  2277. /* Server log digest : 32 octets */
  2278. crypto_digest_get_digest(server_d, (char*)auth->slog, 32);
  2279. /* Client log digest : 32 octets */
  2280. crypto_digest_get_digest(client_d, (char*)auth->clog, 32);
  2281. }
  2282. {
  2283. /* Digest of cert used on TLS link : 32 octets. */
  2284. tor_x509_cert_t *cert = NULL;
  2285. if (server) {
  2286. cert = tor_tls_get_own_cert(conn->tls);
  2287. } else {
  2288. cert = tor_tls_get_peer_cert(conn->tls);
  2289. }
  2290. if (!cert) {
  2291. log_warn(LD_OR, "Unable to find cert when making %s data.",
  2292. authtype_str);
  2293. goto err;
  2294. }
  2295. memcpy(auth->scert,
  2296. tor_x509_cert_get_cert_digests(cert)->d[DIGEST_SHA256], 32);
  2297. tor_x509_cert_free(cert);
  2298. }
  2299. /* HMAC of clientrandom and serverrandom using master key : 32 octets */
  2300. if (old_tlssecrets_algorithm) {
  2301. tor_tls_get_tlssecrets(conn->tls, auth->tlssecrets);
  2302. } else {
  2303. char label[128];
  2304. tor_snprintf(label, sizeof(label),
  2305. "EXPORTER FOR TOR TLS CLIENT BINDING %s", authtype_str);
  2306. tor_tls_export_key_material(conn->tls, auth->tlssecrets,
  2307. auth->cid, sizeof(auth->cid),
  2308. label);
  2309. }
  2310. /* 8 octets were reserved for the current time, but we're trying to get out
  2311. * of the habit of sending time around willynilly. Fortunately, nothing
  2312. * checks it. That's followed by 16 bytes of nonce. */
  2313. crypto_rand((char*)auth->rand, 24);
  2314. ssize_t maxlen = auth1_encoded_len(auth, ctx);
  2315. if (ed_signing_key && is_ed) {
  2316. maxlen += ED25519_SIG_LEN;
  2317. } else if (signing_key && !is_ed) {
  2318. maxlen += crypto_pk_keysize(signing_key);
  2319. }
  2320. const int AUTH_CELL_HEADER_LEN = 4; /* 2 bytes of type, 2 bytes of length */
  2321. result = var_cell_new(AUTH_CELL_HEADER_LEN + maxlen);
  2322. uint8_t *const out = result->payload + AUTH_CELL_HEADER_LEN;
  2323. const size_t outlen = maxlen;
  2324. ssize_t len;
  2325. result->command = CELL_AUTHENTICATE;
  2326. set_uint16(result->payload, htons(authtype));
  2327. if ((len = auth1_encode(out, outlen, auth, ctx)) < 0) {
  2328. /* LCOV_EXCL_START */
  2329. log_warn(LD_BUG, "Unable to encode signed part of AUTH1 data.");
  2330. goto err;
  2331. /* LCOV_EXCL_STOP */
  2332. }
  2333. if (server) {
  2334. auth1_t *tmp = NULL;
  2335. ssize_t len2 = auth1_parse(&tmp, out, len, ctx);
  2336. if (!tmp) {
  2337. /* LCOV_EXCL_START */
  2338. log_warn(LD_BUG, "Unable to parse signed part of AUTH1 data that "
  2339. "we just encoded");
  2340. goto err;
  2341. /* LCOV_EXCL_STOP */
  2342. }
  2343. result->payload_len = (tmp->end_of_signed - result->payload);
  2344. auth1_free(tmp);
  2345. if (len2 != len) {
  2346. /* LCOV_EXCL_START */
  2347. log_warn(LD_BUG, "Mismatched length when re-parsing AUTH1 data.");
  2348. goto err;
  2349. /* LCOV_EXCL_STOP */
  2350. }
  2351. goto done;
  2352. }
  2353. if (ed_signing_key && is_ed) {
  2354. ed25519_signature_t sig;
  2355. if (ed25519_sign(&sig, out, len, ed_signing_key) < 0) {
  2356. /* LCOV_EXCL_START */
  2357. log_warn(LD_BUG, "Unable to sign ed25519 authentication data");
  2358. goto err;
  2359. /* LCOV_EXCL_STOP */
  2360. }
  2361. auth1_setlen_sig(auth, ED25519_SIG_LEN);
  2362. memcpy(auth1_getarray_sig(auth), sig.sig, ED25519_SIG_LEN);
  2363. } else if (signing_key && !is_ed) {
  2364. auth1_setlen_sig(auth, crypto_pk_keysize(signing_key));
  2365. char d[32];
  2366. crypto_digest256(d, (char*)out, len, DIGEST_SHA256);
  2367. int siglen = crypto_pk_private_sign(signing_key,
  2368. (char*)auth1_getarray_sig(auth),
  2369. auth1_getlen_sig(auth),
  2370. d, 32);
  2371. if (siglen < 0) {
  2372. log_warn(LD_OR, "Unable to sign AUTH1 data.");
  2373. goto err;
  2374. }
  2375. auth1_setlen_sig(auth, siglen);
  2376. }
  2377. len = auth1_encode(out, outlen, auth, ctx);
  2378. if (len < 0) {
  2379. /* LCOV_EXCL_START */
  2380. log_warn(LD_BUG, "Unable to encode signed AUTH1 data.");
  2381. goto err;
  2382. /* LCOV_EXCL_STOP */
  2383. }
  2384. tor_assert(len + AUTH_CELL_HEADER_LEN <= result->payload_len);
  2385. result->payload_len = len + AUTH_CELL_HEADER_LEN;
  2386. set_uint16(result->payload+2, htons(len));
  2387. goto done;
  2388. err:
  2389. var_cell_free(result);
  2390. result = NULL;
  2391. done:
  2392. auth1_free(auth);
  2393. auth_ctx_free(ctx);
  2394. return result;
  2395. }
  2396. /** Send an AUTHENTICATE cell on the connection <b>conn</b>. Return 0 on
  2397. * success, -1 on failure */
  2398. MOCK_IMPL(int,
  2399. connection_or_send_authenticate_cell,(or_connection_t *conn, int authtype))
  2400. {
  2401. var_cell_t *cell;
  2402. crypto_pk_t *pk = tor_tls_get_my_client_auth_key();
  2403. /* XXXX make sure we're actually supposed to send this! */
  2404. if (!pk) {
  2405. log_warn(LD_BUG, "Can't compute authenticate cell: no client auth key");
  2406. return -1;
  2407. }
  2408. if (! authchallenge_type_is_supported(authtype)) {
  2409. log_warn(LD_BUG, "Tried to send authenticate cell with unknown "
  2410. "authentication type %d", authtype);
  2411. return -1;
  2412. }
  2413. cell = connection_or_compute_authenticate_cell_body(conn,
  2414. authtype,
  2415. pk,
  2416. get_current_auth_keypair(),
  2417. 0 /* not server */);
  2418. if (! cell) {
  2419. /* LCOV_EXCL_START */
  2420. log_warn(LD_BUG, "Unable to compute authenticate cell!");
  2421. return -1;
  2422. /* LCOV_EXCL_STOP */
  2423. }
  2424. connection_or_write_var_cell_to_buf(cell, conn);
  2425. var_cell_free(cell);
  2426. return 0;
  2427. }