command.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2018, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file command.c
  8. * \brief Functions for processing incoming cells.
  9. *
  10. * When we receive a cell from a client or a relay, it arrives on some
  11. * channel, and tells us what to do with it. In this module, we dispatch based
  12. * on the cell type using the functions command_process_cell() and
  13. * command_process_var_cell(), and deal with the cell accordingly. (These
  14. * handlers are installed on a channel with the command_setup_channel()
  15. * function.)
  16. *
  17. * Channels have a chance to handle some cell types on their own before they
  18. * are ever passed here --- typically, they do this for cells that are
  19. * specific to a given channel type. For example, in channeltls.c, the cells
  20. * for the initial connection handshake are handled before we get here. (Of
  21. * course, the fact that there _is_ only one channel type for now means that
  22. * we may have gotten the factoring wrong here.)
  23. *
  24. * Handling other cell types is mainly farmed off to other modules, after
  25. * initial sanity-checking. CREATE* cells are handled ultimately in onion.c,
  26. * CREATED* cells trigger circuit creation in circuitbuild.c, DESTROY cells
  27. * are handled here (since they're simple), and RELAY cells, in all their
  28. * complexity, are passed off to relay.c.
  29. **/
  30. /* In-points to command.c:
  31. *
  32. * - command_process_cell(), called from
  33. * incoming cell handlers of channel_t instances;
  34. * callbacks registered in command_setup_channel(),
  35. * called when channels are created in circuitbuild.c
  36. */
  37. #include "or/or.h"
  38. #include "or/channel.h"
  39. #include "or/circuitbuild.h"
  40. #include "or/circuitlist.h"
  41. #include "or/command.h"
  42. #include "or/connection.h"
  43. #include "or/connection_or.h"
  44. #include "or/config.h"
  45. #include "or/control.h"
  46. #include "or/cpuworker.h"
  47. #include "lib/crypt_ops/crypto_util.h"
  48. #include "or/dos.h"
  49. #include "or/hibernate.h"
  50. #include "or/nodelist.h"
  51. #include "or/onion.h"
  52. #include "or/rephist.h"
  53. #include "or/relay.h"
  54. #include "or/router.h"
  55. #include "or/routerlist.h"
  56. #include "or/cell_st.h"
  57. #include "or/or_circuit_st.h"
  58. #include "or/origin_circuit_st.h"
  59. #include "or/var_cell_st.h"
  60. /** How many CELL_CREATE cells have we received, ever? */
  61. uint64_t stats_n_create_cells_processed = 0;
  62. /** How many CELL_CREATED cells have we received, ever? */
  63. uint64_t stats_n_created_cells_processed = 0;
  64. /** How many CELL_RELAY cells have we received, ever? */
  65. uint64_t stats_n_relay_cells_processed = 0;
  66. /** How many CELL_DESTROY cells have we received, ever? */
  67. uint64_t stats_n_destroy_cells_processed = 0;
  68. /* Handle an incoming channel */
  69. static void command_handle_incoming_channel(channel_listener_t *listener,
  70. channel_t *chan);
  71. /* These are the main functions for processing cells */
  72. static void command_process_create_cell(cell_t *cell, channel_t *chan);
  73. static void command_process_created_cell(cell_t *cell, channel_t *chan);
  74. static void command_process_relay_cell(cell_t *cell, channel_t *chan);
  75. static void command_process_destroy_cell(cell_t *cell, channel_t *chan);
  76. /** Convert the cell <b>command</b> into a lower-case, human-readable
  77. * string. */
  78. const char *
  79. cell_command_to_string(uint8_t command)
  80. {
  81. switch (command) {
  82. case CELL_PADDING: return "padding";
  83. case CELL_CREATE: return "create";
  84. case CELL_CREATED: return "created";
  85. case CELL_RELAY: return "relay";
  86. case CELL_DESTROY: return "destroy";
  87. case CELL_CREATE_FAST: return "create_fast";
  88. case CELL_CREATED_FAST: return "created_fast";
  89. case CELL_VERSIONS: return "versions";
  90. case CELL_NETINFO: return "netinfo";
  91. case CELL_RELAY_EARLY: return "relay_early";
  92. case CELL_CREATE2: return "create2";
  93. case CELL_CREATED2: return "created2";
  94. case CELL_VPADDING: return "vpadding";
  95. case CELL_CERTS: return "certs";
  96. case CELL_AUTH_CHALLENGE: return "auth_challenge";
  97. case CELL_AUTHENTICATE: return "authenticate";
  98. case CELL_AUTHORIZE: return "authorize";
  99. default: return "unrecognized";
  100. }
  101. }
  102. #ifdef KEEP_TIMING_STATS
  103. /** This is a wrapper function around the actual function that processes the
  104. * <b>cell</b> that just arrived on <b>conn</b>. Increment <b>*time</b>
  105. * by the number of microseconds used by the call to <b>*func(cell, conn)</b>.
  106. */
  107. static void
  108. command_time_process_cell(cell_t *cell, channel_t *chan, int *time,
  109. void (*func)(cell_t *, channel_t *))
  110. {
  111. struct timeval start, end;
  112. long time_passed;
  113. tor_gettimeofday(&start);
  114. (*func)(cell, chan);
  115. tor_gettimeofday(&end);
  116. time_passed = tv_udiff(&start, &end) ;
  117. if (time_passed > 10000) { /* more than 10ms */
  118. log_debug(LD_OR,"That call just took %ld ms.",time_passed/1000);
  119. }
  120. if (time_passed < 0) {
  121. log_info(LD_GENERAL,"That call took us back in time!");
  122. time_passed = 0;
  123. }
  124. *time += time_passed;
  125. }
  126. #endif /* defined(KEEP_TIMING_STATS) */
  127. /** Process a <b>cell</b> that was just received on <b>chan</b>. Keep internal
  128. * statistics about how many of each cell we've processed so far
  129. * this second, and the total number of microseconds it took to
  130. * process each type of cell.
  131. */
  132. void
  133. command_process_cell(channel_t *chan, cell_t *cell)
  134. {
  135. #ifdef KEEP_TIMING_STATS
  136. /* how many of each cell have we seen so far this second? needs better
  137. * name. */
  138. static int num_create=0, num_created=0, num_relay=0, num_destroy=0;
  139. /* how long has it taken to process each type of cell? */
  140. static int create_time=0, created_time=0, relay_time=0, destroy_time=0;
  141. static time_t current_second = 0; /* from previous calls to time */
  142. time_t now = time(NULL);
  143. if (now > current_second) { /* the second has rolled over */
  144. /* print stats */
  145. log_info(LD_OR,
  146. "At end of second: %d creates (%d ms), %d createds (%d ms), "
  147. "%d relays (%d ms), %d destroys (%d ms)",
  148. num_create, create_time/1000,
  149. num_created, created_time/1000,
  150. num_relay, relay_time/1000,
  151. num_destroy, destroy_time/1000);
  152. /* zero out stats */
  153. num_create = num_created = num_relay = num_destroy = 0;
  154. create_time = created_time = relay_time = destroy_time = 0;
  155. /* remember which second it is, for next time */
  156. current_second = now;
  157. }
  158. #endif /* defined(KEEP_TIMING_STATS) */
  159. #ifdef KEEP_TIMING_STATS
  160. #define PROCESS_CELL(tp, cl, cn) STMT_BEGIN { \
  161. ++num ## tp; \
  162. command_time_process_cell(cl, cn, & tp ## time , \
  163. command_process_ ## tp ## _cell); \
  164. } STMT_END
  165. #else /* !(defined(KEEP_TIMING_STATS)) */
  166. #define PROCESS_CELL(tp, cl, cn) command_process_ ## tp ## _cell(cl, cn)
  167. #endif /* defined(KEEP_TIMING_STATS) */
  168. switch (cell->command) {
  169. case CELL_CREATE:
  170. case CELL_CREATE_FAST:
  171. case CELL_CREATE2:
  172. ++stats_n_create_cells_processed;
  173. PROCESS_CELL(create, cell, chan);
  174. break;
  175. case CELL_CREATED:
  176. case CELL_CREATED_FAST:
  177. case CELL_CREATED2:
  178. ++stats_n_created_cells_processed;
  179. PROCESS_CELL(created, cell, chan);
  180. break;
  181. case CELL_RELAY:
  182. case CELL_RELAY_EARLY:
  183. ++stats_n_relay_cells_processed;
  184. PROCESS_CELL(relay, cell, chan);
  185. break;
  186. case CELL_DESTROY:
  187. ++stats_n_destroy_cells_processed;
  188. PROCESS_CELL(destroy, cell, chan);
  189. break;
  190. default:
  191. log_fn(LOG_INFO, LD_PROTOCOL,
  192. "Cell of unknown or unexpected type (%d) received. "
  193. "Dropping.",
  194. cell->command);
  195. break;
  196. }
  197. }
  198. /** Process an incoming var_cell from a channel; in the current protocol all
  199. * the var_cells are handshake-related and handled below the channel layer,
  200. * so this just logs a warning and drops the cell.
  201. */
  202. void
  203. command_process_var_cell(channel_t *chan, var_cell_t *var_cell)
  204. {
  205. tor_assert(chan);
  206. tor_assert(var_cell);
  207. log_info(LD_PROTOCOL,
  208. "Received unexpected var_cell above the channel layer of type %d"
  209. "; dropping it.",
  210. var_cell->command);
  211. }
  212. /** Process a 'create' <b>cell</b> that just arrived from <b>chan</b>. Make a
  213. * new circuit with the p_circ_id specified in cell. Put the circuit in state
  214. * onionskin_pending, and pass the onionskin to the cpuworker. Circ will get
  215. * picked up again when the cpuworker finishes decrypting it.
  216. */
  217. static void
  218. command_process_create_cell(cell_t *cell, channel_t *chan)
  219. {
  220. or_circuit_t *circ;
  221. const or_options_t *options = get_options();
  222. int id_is_high;
  223. create_cell_t *create_cell;
  224. tor_assert(cell);
  225. tor_assert(chan);
  226. log_debug(LD_OR,
  227. "Got a CREATE cell for circ_id %u on channel %"PRIu64
  228. " (%p)",
  229. (unsigned)cell->circ_id,
  230. (chan->global_identifier), chan);
  231. /* First thing we do, even though the cell might be invalid, is inform the
  232. * DoS mitigation subsystem layer of this event. Validation is done by this
  233. * function. */
  234. dos_cc_new_create_cell(chan);
  235. /* We check for the conditions that would make us drop the cell before
  236. * we check for the conditions that would make us send a DESTROY back,
  237. * since those conditions would make a DESTROY nonsensical. */
  238. if (cell->circ_id == 0) {
  239. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  240. "Received a create cell (type %d) from %s with zero circID; "
  241. " ignoring.", (int)cell->command,
  242. channel_get_actual_remote_descr(chan));
  243. return;
  244. }
  245. if (circuit_id_in_use_on_channel(cell->circ_id, chan)) {
  246. const node_t *node = node_get_by_id(chan->identity_digest);
  247. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  248. "Received CREATE cell (circID %u) for known circ. "
  249. "Dropping (age %d).",
  250. (unsigned)cell->circ_id,
  251. (int)(time(NULL) - channel_when_created(chan)));
  252. if (node) {
  253. char *p = esc_for_log(node_get_platform(node));
  254. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  255. "Details: router %s, platform %s.",
  256. node_describe(node), p);
  257. tor_free(p);
  258. }
  259. return;
  260. }
  261. if (we_are_hibernating()) {
  262. log_info(LD_OR,
  263. "Received create cell but we're shutting down. Sending back "
  264. "destroy.");
  265. channel_send_destroy(cell->circ_id, chan,
  266. END_CIRC_REASON_HIBERNATING);
  267. return;
  268. }
  269. /* Check if we should apply a defense for this channel. */
  270. if (dos_cc_get_defense_type(chan) == DOS_CC_DEFENSE_REFUSE_CELL) {
  271. channel_send_destroy(cell->circ_id, chan,
  272. END_CIRC_REASON_RESOURCELIMIT);
  273. return;
  274. }
  275. if (!server_mode(options) ||
  276. (!public_server_mode(options) && channel_is_outgoing(chan))) {
  277. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  278. "Received create cell (type %d) from %s, but we're connected "
  279. "to it as a client. "
  280. "Sending back a destroy.",
  281. (int)cell->command, channel_get_canonical_remote_descr(chan));
  282. channel_send_destroy(cell->circ_id, chan,
  283. END_CIRC_REASON_TORPROTOCOL);
  284. return;
  285. }
  286. /* If the high bit of the circuit ID is not as expected, close the
  287. * circ. */
  288. if (chan->wide_circ_ids)
  289. id_is_high = cell->circ_id & (1u<<31);
  290. else
  291. id_is_high = cell->circ_id & (1u<<15);
  292. if ((id_is_high &&
  293. chan->circ_id_type == CIRC_ID_TYPE_HIGHER) ||
  294. (!id_is_high &&
  295. chan->circ_id_type == CIRC_ID_TYPE_LOWER)) {
  296. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  297. "Received create cell with unexpected circ_id %u. Closing.",
  298. (unsigned)cell->circ_id);
  299. channel_send_destroy(cell->circ_id, chan,
  300. END_CIRC_REASON_TORPROTOCOL);
  301. return;
  302. }
  303. circ = or_circuit_new(cell->circ_id, chan);
  304. circ->base_.purpose = CIRCUIT_PURPOSE_OR;
  305. circuit_set_state(TO_CIRCUIT(circ), CIRCUIT_STATE_ONIONSKIN_PENDING);
  306. create_cell = tor_malloc_zero(sizeof(create_cell_t));
  307. if (create_cell_parse(create_cell, cell) < 0) {
  308. tor_free(create_cell);
  309. log_fn(LOG_PROTOCOL_WARN, LD_OR,
  310. "Bogus/unrecognized create cell; closing.");
  311. circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL);
  312. return;
  313. }
  314. if (!channel_is_client(chan)) {
  315. /* remember create types we've seen, but don't remember them from
  316. * clients, to be extra conservative about client statistics. */
  317. rep_hist_note_circuit_handshake_requested(create_cell->handshake_type);
  318. }
  319. if (create_cell->handshake_type != ONION_HANDSHAKE_TYPE_FAST) {
  320. /* hand it off to the cpuworkers, and then return. */
  321. if (assign_onionskin_to_cpuworker(circ, create_cell) < 0) {
  322. log_debug(LD_GENERAL,"Failed to hand off onionskin. Closing.");
  323. circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_RESOURCELIMIT);
  324. return;
  325. }
  326. log_debug(LD_OR,"success: handed off onionskin.");
  327. } else {
  328. /* This is a CREATE_FAST cell; we can handle it immediately without using
  329. * a CPU worker. */
  330. uint8_t keys[CPATH_KEY_MATERIAL_LEN];
  331. uint8_t rend_circ_nonce[DIGEST_LEN];
  332. int len;
  333. created_cell_t created_cell;
  334. memset(&created_cell, 0, sizeof(created_cell));
  335. len = onion_skin_server_handshake(ONION_HANDSHAKE_TYPE_FAST,
  336. create_cell->onionskin,
  337. create_cell->handshake_len,
  338. NULL,
  339. created_cell.reply,
  340. keys, CPATH_KEY_MATERIAL_LEN,
  341. rend_circ_nonce);
  342. tor_free(create_cell);
  343. if (len < 0) {
  344. log_warn(LD_OR,"Failed to generate key material. Closing.");
  345. circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
  346. return;
  347. }
  348. created_cell.cell_type = CELL_CREATED_FAST;
  349. created_cell.handshake_len = len;
  350. if (onionskin_answer(circ, &created_cell,
  351. (const char *)keys, sizeof(keys),
  352. rend_circ_nonce)<0) {
  353. log_warn(LD_OR,"Failed to reply to CREATE_FAST cell. Closing.");
  354. circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
  355. return;
  356. }
  357. memwipe(keys, 0, sizeof(keys));
  358. }
  359. }
  360. /** Process a 'created' <b>cell</b> that just arrived from <b>chan</b>.
  361. * Find the circuit
  362. * that it's intended for. If we're not the origin of the circuit, package
  363. * the 'created' cell in an 'extended' relay cell and pass it back. If we
  364. * are the origin of the circuit, send it to circuit_finish_handshake() to
  365. * finish processing keys, and then call circuit_send_next_onion_skin() to
  366. * extend to the next hop in the circuit if necessary.
  367. */
  368. static void
  369. command_process_created_cell(cell_t *cell, channel_t *chan)
  370. {
  371. circuit_t *circ;
  372. extended_cell_t extended_cell;
  373. circ = circuit_get_by_circid_channel(cell->circ_id, chan);
  374. if (!circ) {
  375. log_info(LD_OR,
  376. "(circID %u) unknown circ (probably got a destroy earlier). "
  377. "Dropping.", (unsigned)cell->circ_id);
  378. return;
  379. }
  380. if (circ->n_circ_id != cell->circ_id || circ->n_chan != chan) {
  381. log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,
  382. "got created cell from Tor client? Closing.");
  383. circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
  384. return;
  385. }
  386. if (created_cell_parse(&extended_cell.created_cell, cell) < 0) {
  387. log_fn(LOG_PROTOCOL_WARN, LD_OR, "Unparseable created cell.");
  388. circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
  389. return;
  390. }
  391. if (CIRCUIT_IS_ORIGIN(circ)) { /* we're the OP. Handshake this. */
  392. origin_circuit_t *origin_circ = TO_ORIGIN_CIRCUIT(circ);
  393. int err_reason = 0;
  394. log_debug(LD_OR,"at OP. Finishing handshake.");
  395. if ((err_reason = circuit_finish_handshake(origin_circ,
  396. &extended_cell.created_cell)) < 0) {
  397. circuit_mark_for_close(circ, -err_reason);
  398. return;
  399. }
  400. log_debug(LD_OR,"Moving to next skin.");
  401. if ((err_reason = circuit_send_next_onion_skin(origin_circ)) < 0) {
  402. log_info(LD_OR,"circuit_send_next_onion_skin failed.");
  403. /* XXX push this circuit_close lower */
  404. circuit_mark_for_close(circ, -err_reason);
  405. return;
  406. }
  407. } else { /* pack it into an extended relay cell, and send it. */
  408. uint8_t command=0;
  409. uint16_t len=0;
  410. uint8_t payload[RELAY_PAYLOAD_SIZE];
  411. log_debug(LD_OR,
  412. "Converting created cell to extended relay cell, sending.");
  413. memset(payload, 0, sizeof(payload));
  414. if (extended_cell.created_cell.cell_type == CELL_CREATED2)
  415. extended_cell.cell_type = RELAY_COMMAND_EXTENDED2;
  416. else
  417. extended_cell.cell_type = RELAY_COMMAND_EXTENDED;
  418. if (extended_cell_format(&command, &len, payload, &extended_cell) < 0) {
  419. log_fn(LOG_PROTOCOL_WARN, LD_OR, "Can't format extended cell.");
  420. circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
  421. return;
  422. }
  423. relay_send_command_from_edge(0, circ, command,
  424. (const char*)payload, len, NULL);
  425. }
  426. }
  427. /** Process a 'relay' or 'relay_early' <b>cell</b> that just arrived from
  428. * <b>conn</b>. Make sure it came in with a recognized circ_id. Pass it on to
  429. * circuit_receive_relay_cell() for actual processing.
  430. */
  431. static void
  432. command_process_relay_cell(cell_t *cell, channel_t *chan)
  433. {
  434. const or_options_t *options = get_options();
  435. circuit_t *circ;
  436. int reason, direction;
  437. circ = circuit_get_by_circid_channel(cell->circ_id, chan);
  438. if (!circ) {
  439. log_debug(LD_OR,
  440. "unknown circuit %u on connection from %s. Dropping.",
  441. (unsigned)cell->circ_id,
  442. channel_get_canonical_remote_descr(chan));
  443. return;
  444. }
  445. if (circ->state == CIRCUIT_STATE_ONIONSKIN_PENDING) {
  446. log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,"circuit in create_wait. Closing.");
  447. circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
  448. return;
  449. }
  450. if (CIRCUIT_IS_ORIGIN(circ)) {
  451. /* if we're a relay and treating connections with recent local
  452. * traffic better, then this is one of them. */
  453. channel_timestamp_client(chan);
  454. /* Count all circuit bytes here for control port accuracy. We want
  455. * to count even invalid/dropped relay cells, hence counting
  456. * before the recognized check and the connection_edge_process_relay
  457. * cell checks.
  458. */
  459. origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ);
  460. /* Count the payload bytes only. We don't care about cell headers */
  461. ocirc->n_read_circ_bw = tor_add_u32_nowrap(ocirc->n_read_circ_bw,
  462. CELL_PAYLOAD_SIZE);
  463. }
  464. if (!CIRCUIT_IS_ORIGIN(circ) &&
  465. chan == TO_OR_CIRCUIT(circ)->p_chan &&
  466. cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id)
  467. direction = CELL_DIRECTION_OUT;
  468. else
  469. direction = CELL_DIRECTION_IN;
  470. /* If we have a relay_early cell, make sure that it's outbound, and we've
  471. * gotten no more than MAX_RELAY_EARLY_CELLS_PER_CIRCUIT of them. */
  472. if (cell->command == CELL_RELAY_EARLY) {
  473. if (direction == CELL_DIRECTION_IN) {
  474. /* Inbound early cells could once be encountered as a result of
  475. * bug 1038; but relays running versions before 0.2.1.19 are long
  476. * gone from the network, so any such cells now are surprising. */
  477. log_warn(LD_OR,
  478. "Received an inbound RELAY_EARLY cell on circuit %u."
  479. " Closing circuit. Please report this event,"
  480. " along with the following message.",
  481. (unsigned)cell->circ_id);
  482. if (CIRCUIT_IS_ORIGIN(circ)) {
  483. circuit_log_path(LOG_WARN, LD_OR, TO_ORIGIN_CIRCUIT(circ));
  484. } else if (circ->n_chan) {
  485. log_warn(LD_OR, " upstream=%s",
  486. channel_get_actual_remote_descr(circ->n_chan));
  487. }
  488. circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
  489. return;
  490. } else {
  491. or_circuit_t *or_circ = TO_OR_CIRCUIT(circ);
  492. if (or_circ->remaining_relay_early_cells == 0) {
  493. log_fn(LOG_PROTOCOL_WARN, LD_OR,
  494. "Received too many RELAY_EARLY cells on circ %u from %s."
  495. " Closing circuit.",
  496. (unsigned)cell->circ_id,
  497. safe_str(channel_get_canonical_remote_descr(chan)));
  498. circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
  499. return;
  500. }
  501. --or_circ->remaining_relay_early_cells;
  502. }
  503. }
  504. if ((reason = circuit_receive_relay_cell(cell, circ, direction)) < 0) {
  505. log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,"circuit_receive_relay_cell "
  506. "(%s) failed. Closing.",
  507. direction==CELL_DIRECTION_OUT?"forward":"backward");
  508. circuit_mark_for_close(circ, -reason);
  509. }
  510. /* If this is a cell in an RP circuit, count it as part of the
  511. hidden service stats */
  512. if (options->HiddenServiceStatistics &&
  513. !CIRCUIT_IS_ORIGIN(circ) &&
  514. TO_OR_CIRCUIT(circ)->circuit_carries_hs_traffic_stats) {
  515. rep_hist_seen_new_rp_cell();
  516. }
  517. }
  518. /** Process a 'destroy' <b>cell</b> that just arrived from
  519. * <b>chan</b>. Find the circ that it refers to (if any).
  520. *
  521. * If the circ is in state
  522. * onionskin_pending, then call onion_pending_remove() to remove it
  523. * from the pending onion list (note that if it's already being
  524. * processed by the cpuworker, it won't be in the list anymore; but
  525. * when the cpuworker returns it, the circuit will be gone, and the
  526. * cpuworker response will be dropped).
  527. *
  528. * Then mark the circuit for close (which marks all edges for close,
  529. * and passes the destroy cell onward if necessary).
  530. */
  531. static void
  532. command_process_destroy_cell(cell_t *cell, channel_t *chan)
  533. {
  534. circuit_t *circ;
  535. int reason;
  536. circ = circuit_get_by_circid_channel(cell->circ_id, chan);
  537. if (!circ) {
  538. log_info(LD_OR,"unknown circuit %u on connection from %s. Dropping.",
  539. (unsigned)cell->circ_id,
  540. channel_get_canonical_remote_descr(chan));
  541. return;
  542. }
  543. log_debug(LD_OR,"Received for circID %u.",(unsigned)cell->circ_id);
  544. reason = (uint8_t)cell->payload[0];
  545. circ->received_destroy = 1;
  546. if (!CIRCUIT_IS_ORIGIN(circ) &&
  547. chan == TO_OR_CIRCUIT(circ)->p_chan &&
  548. cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) {
  549. /* the destroy came from behind */
  550. circuit_set_p_circid_chan(TO_OR_CIRCUIT(circ), 0, NULL);
  551. circuit_mark_for_close(circ, reason|END_CIRC_REASON_FLAG_REMOTE);
  552. } else { /* the destroy came from ahead */
  553. circuit_set_n_circid_chan(circ, 0, NULL);
  554. if (CIRCUIT_IS_ORIGIN(circ)) {
  555. circuit_mark_for_close(circ, reason|END_CIRC_REASON_FLAG_REMOTE);
  556. } else {
  557. char payload[1];
  558. log_debug(LD_OR, "Delivering 'truncated' back.");
  559. payload[0] = (char)reason;
  560. relay_send_command_from_edge(0, circ, RELAY_COMMAND_TRUNCATED,
  561. payload, sizeof(payload), NULL);
  562. }
  563. }
  564. }
  565. /** Callback to handle a new channel; call command_setup_channel() to give
  566. * it the right cell handlers.
  567. */
  568. static void
  569. command_handle_incoming_channel(channel_listener_t *listener, channel_t *chan)
  570. {
  571. tor_assert(listener);
  572. tor_assert(chan);
  573. command_setup_channel(chan);
  574. }
  575. /** Given a channel, install the right handlers to process incoming
  576. * cells on it.
  577. */
  578. void
  579. command_setup_channel(channel_t *chan)
  580. {
  581. tor_assert(chan);
  582. channel_set_cell_handlers(chan,
  583. command_process_cell,
  584. command_process_var_cell);
  585. }
  586. /** Given a listener, install the right handler to process incoming
  587. * channels on it.
  588. */
  589. void
  590. command_setup_listener(channel_listener_t *listener)
  591. {
  592. tor_assert(listener);
  593. tor_assert(listener->state == CHANNEL_LISTENER_STATE_LISTENING);
  594. channel_listener_set_listener_fn(listener, command_handle_incoming_channel);
  595. }