",
entry_conn->marked_pending_circ_line);
#endif /* defined(DEBUGGING_17659) */
log_backtrace(LOG_WARN, LD_BUG, "To debug, this may help");
return;
}
#ifdef DEBUGGING_17659
entry_conn->marked_pending_circ_line = (uint16_t) lineno;
entry_conn->marked_pending_circ_file = fname;
#endif
untried_pending_connections = 1;
smartlist_add(pending_entry_connections, entry_conn);
mainloop_event_activate(attach_pending_entry_connections_ev);
}
/** Mark entry_conn as no longer waiting for a circuit. */
void
connection_ap_mark_as_non_pending_circuit(entry_connection_t *entry_conn)
{
if (PREDICT_UNLIKELY(NULL == pending_entry_connections))
return;
UNMARK();
smartlist_remove(pending_entry_connections, entry_conn);
}
/** Mark entry_conn as waiting for a rendezvous descriptor. This
* function will remove the entry connection from the waiting for a circuit
* list (pending_entry_connections).
*
* This pattern is used across the code base because a connection in state
* AP_CONN_STATE_RENDDESC_WAIT must not be in the pending list. */
void
connection_ap_mark_as_waiting_for_renddesc(entry_connection_t *entry_conn)
{
tor_assert(entry_conn);
connection_ap_mark_as_non_pending_circuit(entry_conn);
ENTRY_TO_CONN(entry_conn)->state = AP_CONN_STATE_RENDDESC_WAIT;
}
/* DOCDOC */
void
connection_ap_warn_and_unmark_if_pending_circ(entry_connection_t *entry_conn,
const char *where)
{
if (pending_entry_connections &&
smartlist_contains(pending_entry_connections, entry_conn)) {
log_warn(LD_BUG, "What was %p doing in pending_entry_connections in %s?",
entry_conn, where);
connection_ap_mark_as_non_pending_circuit(entry_conn);
}
}
/** Tell any AP streams that are waiting for a one-hop tunnel to
* failed_digest that they are going to fail. */
/* XXXX We should get rid of this function, and instead attach
* one-hop streams to circ->p_streams so they get marked in
* circuit_mark_for_close like normal p_streams. */
void
connection_ap_fail_onehop(const char *failed_digest,
cpath_build_state_t *build_state)
{
entry_connection_t *entry_conn;
char digest[DIGEST_LEN];
smartlist_t *conns = get_connection_array();
SMARTLIST_FOREACH_BEGIN(conns, connection_t *, conn) {
if (conn->marked_for_close ||
conn->type != CONN_TYPE_AP ||
conn->state != AP_CONN_STATE_CIRCUIT_WAIT)
continue;
entry_conn = TO_ENTRY_CONN(conn);
if (!entry_conn->want_onehop)
continue;
if (hexdigest_to_digest(entry_conn->chosen_exit_name, digest) < 0 ||
tor_memneq(digest, failed_digest, DIGEST_LEN))
continue;
if (tor_digest_is_zero(digest)) {
/* we don't know the digest; have to compare addr:port */
tor_addr_t addr;
if (!build_state || !build_state->chosen_exit ||
!entry_conn->socks_request) {
continue;
}
if (tor_addr_parse(&addr, entry_conn->socks_request->address)<0 ||
!tor_addr_eq(&build_state->chosen_exit->addr, &addr) ||
build_state->chosen_exit->port != entry_conn->socks_request->port)
continue;
}
log_info(LD_APP, "Closing one-hop stream to '%s/%s' because the OR conn "
"just failed.", entry_conn->chosen_exit_name,
entry_conn->socks_request->address);
connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TIMEOUT);
} SMARTLIST_FOREACH_END(conn);
}
/** A circuit failed to finish on its last hop info. If there
* are any streams waiting with this exit node in mind, but they
* don't absolutely require it, make them give up on it.
*/
void
circuit_discard_optional_exit_enclaves(extend_info_t *info)
{
entry_connection_t *entry_conn;
const node_t *r1, *r2;
smartlist_t *conns = get_connection_array();
SMARTLIST_FOREACH_BEGIN(conns, connection_t *, conn) {
if (conn->marked_for_close ||
conn->type != CONN_TYPE_AP ||
conn->state != AP_CONN_STATE_CIRCUIT_WAIT)
continue;
entry_conn = TO_ENTRY_CONN(conn);
if (!entry_conn->chosen_exit_optional &&
!entry_conn->chosen_exit_retries)
continue;
r1 = node_get_by_nickname(entry_conn->chosen_exit_name,
NNF_NO_WARN_UNNAMED);
r2 = node_get_by_id(info->identity_digest);
if (!r1 || !r2 || r1 != r2)
continue;
tor_assert(entry_conn->socks_request);
if (entry_conn->chosen_exit_optional) {
log_info(LD_APP, "Giving up on enclave exit '%s' for destination %s.",
safe_str_client(entry_conn->chosen_exit_name),
escaped_safe_str_client(entry_conn->socks_request->address));
entry_conn->chosen_exit_optional = 0;
tor_free(entry_conn->chosen_exit_name); /* clears it */
/* if this port is dangerous, warn or reject it now that we don't
* think it'll be using an enclave. */
consider_plaintext_ports(entry_conn, entry_conn->socks_request->port);
}
if (entry_conn->chosen_exit_retries) {
if (--entry_conn->chosen_exit_retries == 0) { /* give up! */
clear_trackexithost_mappings(entry_conn->chosen_exit_name);
tor_free(entry_conn->chosen_exit_name); /* clears it */
/* if this port is dangerous, warn or reject it now that we don't
* think it'll be using an enclave. */
consider_plaintext_ports(entry_conn, entry_conn->socks_request->port);
}
}
} SMARTLIST_FOREACH_END(conn);
}
/** The AP connection conn has just failed while attaching or
* sending a BEGIN or resolving on circ, but another circuit
* might work. Detach the circuit, and either reattach it, launch a
* new circuit, tell the controller, or give up as appropriate.
*
* Returns -1 on err, 1 on success, 0 on not-yet-sure.
*/
int
connection_ap_detach_retriable(entry_connection_t *conn,
origin_circuit_t *circ,
int reason)
{
control_event_stream_status(conn, STREAM_EVENT_FAILED_RETRIABLE, reason);
ENTRY_TO_CONN(conn)->timestamp_last_read_allowed = time(NULL);
/* Roll back path bias use state so that we probe the circuit
* if nothing else succeeds on it */
pathbias_mark_use_rollback(circ);
if (conn->pending_optimistic_data) {
buf_set_to_copy(&conn->sending_optimistic_data,
conn->pending_optimistic_data);
}
if (!get_options()->LeaveStreamsUnattached || conn->use_begindir) {
/* If we're attaching streams ourself, or if this connection is
* a tunneled directory connection, then just attach it. */
ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CIRCUIT_WAIT;
circuit_detach_stream(TO_CIRCUIT(circ),ENTRY_TO_EDGE_CONN(conn));
connection_ap_mark_as_pending_circuit(conn);
} else {
CONNECTION_AP_EXPECT_NONPENDING(conn);
ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CONTROLLER_WAIT;
circuit_detach_stream(TO_CIRCUIT(circ),ENTRY_TO_EDGE_CONN(conn));
}
return 0;
}
/** Check if conn is using a dangerous port. Then warn and/or
* reject depending on our config options. */
static int
consider_plaintext_ports(entry_connection_t *conn, uint16_t port)
{
const or_options_t *options = get_options();
int reject = smartlist_contains_int_as_string(
options->RejectPlaintextPorts, port);
if (smartlist_contains_int_as_string(options->WarnPlaintextPorts, port)) {
log_warn(LD_APP, "Application request to port %d: this port is "
"commonly used for unencrypted protocols. Please make sure "
"you don't send anything you would mind the rest of the "
"Internet reading!%s", port, reject ? " Closing." : "");
control_event_client_status(LOG_WARN, "DANGEROUS_PORT PORT=%d RESULT=%s",
port, reject ? "REJECT" : "WARN");
}
if (reject) {
log_info(LD_APP, "Port %d listed in RejectPlaintextPorts. Closing.", port);
connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
return -1;
}
return 0;
}
/** How many times do we try connecting with an exit configured via
* TrackHostExits before concluding that it won't work any more and trying a
* different one? */
#define TRACKHOSTEXITS_RETRIES 5
/** Call connection_ap_handshake_rewrite_and_attach() unless a controller
* asked us to leave streams unattached. Return 0 in that case.
*
* See connection_ap_handshake_rewrite_and_attach()'s
* documentation for arguments and return value.
*/
MOCK_IMPL(int,
connection_ap_rewrite_and_attach_if_allowed,(entry_connection_t *conn,
origin_circuit_t *circ,
crypt_path_t *cpath))
{
const or_options_t *options = get_options();
if (options->LeaveStreamsUnattached) {
CONNECTION_AP_EXPECT_NONPENDING(conn);
ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CONTROLLER_WAIT;
return 0;
}
return connection_ap_handshake_rewrite_and_attach(conn, circ, cpath);
}
/* Try to perform any map-based rewriting of the target address in
* conn, filling in the fields of out as we go, and modifying
* conn->socks_request.address as appropriate.
*/
STATIC void
connection_ap_handshake_rewrite(entry_connection_t *conn,
rewrite_result_t *out)
{
socks_request_t *socks = conn->socks_request;
const or_options_t *options = get_options();
tor_addr_t addr_tmp;
/* Initialize all the fields of 'out' to reasonable defaults */
out->automap = 0;
out->exit_source = ADDRMAPSRC_NONE;
out->map_expires = TIME_MAX;
out->end_reason = 0;
out->should_close = 0;
out->orig_address[0] = 0;
/* We convert all incoming addresses to lowercase. */
tor_strlower(socks->address);
/* Remember the original address. */
strlcpy(out->orig_address, socks->address, sizeof(out->orig_address));
log_debug(LD_APP,"Client asked for %s:%d",
safe_str_client(socks->address),
socks->port);
/* Check for whether this is a .exit address. By default, those are
* disallowed when they're coming straight from the client, but you're
* allowed to have them in MapAddress commands and so forth. */
if (!strcmpend(socks->address, ".exit")) {
static ratelim_t exit_warning_limit = RATELIM_INIT(60*15);
log_fn_ratelim(&exit_warning_limit, LOG_WARN, LD_APP,
"The \".exit\" notation is disabled in Tor due to "
"security risks.");
control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
escaped(socks->address));
out->end_reason = END_STREAM_REASON_TORPROTOCOL;
out->should_close = 1;
return;
}
/* Remember the original address so we can tell the user about what
* they actually said, not just what it turned into. */
/* XXX yes, this is the same as out->orig_address above. One is
* in the output, and one is in the connection. */
if (! conn->original_dest_address) {
/* Is the 'if' necessary here? XXXX */
conn->original_dest_address = tor_strdup(conn->socks_request->address);
}
/* First, apply MapAddress and MAPADDRESS mappings. We need to do
* these only for non-reverse lookups, since they don't exist for those.
* We also need to do this before we consider automapping, since we might
* e.g. resolve irc.oftc.net into irconionaddress.onion, at which point
* we'd need to automap it. */
if (socks->command != SOCKS_COMMAND_RESOLVE_PTR) {
const unsigned rewrite_flags = AMR_FLAG_USE_MAPADDRESS;
if (addressmap_rewrite(socks->address, sizeof(socks->address),
rewrite_flags, &out->map_expires, &out->exit_source)) {
control_event_stream_status(conn, STREAM_EVENT_REMAP,
REMAP_STREAM_SOURCE_CACHE);
}
}
/* Now see if we need to create or return an existing Hostname->IP
* automapping. Automapping happens when we're asked to resolve a
* hostname, and AutomapHostsOnResolve is set, and the hostname has a
* suffix listed in AutomapHostsSuffixes. It's a handy feature
* that lets you have Tor assign e.g. IPv6 addresses for .onion
* names, and return them safely from DNSPort.
*/
if (socks->command == SOCKS_COMMAND_RESOLVE &&
tor_addr_parse(&addr_tmp, socks->address)<0 &&
options->AutomapHostsOnResolve) {
/* Check the suffix... */
out->automap = addressmap_address_should_automap(socks->address, options);
if (out->automap) {
/* If we get here, then we should apply an automapping for this. */
const char *new_addr;
/* We return an IPv4 address by default, or an IPv6 address if we
* are allowed to do so. */
int addr_type = RESOLVED_TYPE_IPV4;
if (conn->socks_request->socks_version != 4) {
if (!conn->entry_cfg.ipv4_traffic ||
(conn->entry_cfg.ipv6_traffic && conn->entry_cfg.prefer_ipv6) ||
conn->entry_cfg.prefer_ipv6_virtaddr)
addr_type = RESOLVED_TYPE_IPV6;
}
/* Okay, register the target address as automapped, and find the new
* address we're supposed to give as a resolve answer. (Return a cached
* value if we've looked up this address before.
*/
new_addr = addressmap_register_virtual_address(
addr_type, tor_strdup(socks->address));
if (! new_addr) {
log_warn(LD_APP, "Unable to automap address %s",
escaped_safe_str(socks->address));
out->end_reason = END_STREAM_REASON_INTERNAL;
out->should_close = 1;
return;
}
log_info(LD_APP, "Automapping %s to %s",
escaped_safe_str_client(socks->address),
safe_str_client(new_addr));
strlcpy(socks->address, new_addr, sizeof(socks->address));
}
}
/* Now handle reverse lookups, if they're in the cache. This doesn't
* happen too often, since client-side DNS caching is off by default,
* and very deprecated. */
if (socks->command == SOCKS_COMMAND_RESOLVE_PTR) {
unsigned rewrite_flags = 0;
if (conn->entry_cfg.use_cached_ipv4_answers)
rewrite_flags |= AMR_FLAG_USE_IPV4_DNS;
if (conn->entry_cfg.use_cached_ipv6_answers)
rewrite_flags |= AMR_FLAG_USE_IPV6_DNS;
if (addressmap_rewrite_reverse(socks->address, sizeof(socks->address),
rewrite_flags, &out->map_expires)) {
char *result = tor_strdup(socks->address);
/* remember _what_ is supposed to have been resolved. */
tor_snprintf(socks->address, sizeof(socks->address), "REVERSE[%s]",
out->orig_address);
connection_ap_handshake_socks_resolved(conn, RESOLVED_TYPE_HOSTNAME,
strlen(result), (uint8_t*)result,
-1,
out->map_expires);
tor_free(result);
out->end_reason = END_STREAM_REASON_DONE |
END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED;
out->should_close = 1;
return;
}
/* Hang on, did we find an answer saying that this is a reverse lookup for
* an internal address? If so, we should reject it if we're configured to
* do so. */
if (options->ClientDNSRejectInternalAddresses) {
/* Don't let clients try to do a reverse lookup on 10.0.0.1. */
tor_addr_t addr;
int ok;
ok = tor_addr_parse_PTR_name(
&addr, socks->address, AF_UNSPEC, 1);
if (ok == 1 && tor_addr_is_internal(&addr, 0)) {
connection_ap_handshake_socks_resolved(conn, RESOLVED_TYPE_ERROR,
0, NULL, -1, TIME_MAX);
out->end_reason = END_STREAM_REASON_SOCKSPROTOCOL |
END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED;
out->should_close = 1;
return;
}
}
}
/* If we didn't automap it before, then this is still the address that
* came straight from the user, mapped according to any
* MapAddress/MAPADDRESS commands. Now apply other mappings,
* including previously registered Automap entries (IP back to
* hostname), TrackHostExits entries, and client-side DNS cache
* entries (if they're turned on).
*/
if (socks->command != SOCKS_COMMAND_RESOLVE_PTR &&
!out->automap) {
unsigned rewrite_flags = AMR_FLAG_USE_AUTOMAP | AMR_FLAG_USE_TRACKEXIT;
addressmap_entry_source_t exit_source2;
if (conn->entry_cfg.use_cached_ipv4_answers)
rewrite_flags |= AMR_FLAG_USE_IPV4_DNS;
if (conn->entry_cfg.use_cached_ipv6_answers)
rewrite_flags |= AMR_FLAG_USE_IPV6_DNS;
if (addressmap_rewrite(socks->address, sizeof(socks->address),
rewrite_flags, &out->map_expires, &exit_source2)) {
control_event_stream_status(conn, STREAM_EVENT_REMAP,
REMAP_STREAM_SOURCE_CACHE);
}
if (out->exit_source == ADDRMAPSRC_NONE) {
/* If it wasn't a .exit before, maybe it turned into a .exit. Remember
* the original source of a .exit. */
out->exit_source = exit_source2;
}
}
/* Check to see whether we're about to use an address in the virtual
* range without actually having gotten it from an Automap. */
if (!out->automap && address_is_in_virtual_range(socks->address)) {
/* This address was probably handed out by
* client_dns_get_unmapped_address, but the mapping was discarded for some
* reason. Or the user typed in a virtual address range manually. We
* *don't* want to send the address through Tor; that's likely to fail,
* and may leak information.
*/
log_warn(LD_APP,"Missing mapping for virtual address '%s'. Refusing.",
safe_str_client(socks->address));
out->end_reason = END_STREAM_REASON_INTERNAL;
out->should_close = 1;
return;
}
}
/** We just received a SOCKS request in conn to an onion address of type
* addresstype. Start connecting to the onion service. */
static int
connection_ap_handle_onion(entry_connection_t *conn,
socks_request_t *socks,
origin_circuit_t *circ,
hostname_type_t addresstype)
{
time_t now = approx_time();
connection_t *base_conn = ENTRY_TO_CONN(conn);
/* If .onion address requests are disabled, refuse the request */
if (!conn->entry_cfg.onion_traffic) {
log_warn(LD_APP, "Onion address %s requested from a port with .onion "
"disabled", safe_str_client(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
return -1;
}
/* Check whether it's RESOLVE or RESOLVE_PTR. We don't handle those
* for hidden service addresses. */
if (SOCKS_COMMAND_IS_RESOLVE(socks->command)) {
/* if it's a resolve request, fail it right now, rather than
* building all the circuits and then realizing it won't work. */
log_warn(LD_APP,
"Resolve requests to hidden services not allowed. Failing.");
connection_ap_handshake_socks_resolved(conn,RESOLVED_TYPE_ERROR,
0,NULL,-1,TIME_MAX);
connection_mark_unattached_ap(conn,
END_STREAM_REASON_SOCKSPROTOCOL |
END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
return -1;
}
/* If we were passed a circuit, then we need to fail. .onion addresses
* only work when we launch our own circuits for now. */
if (circ) {
log_warn(LD_CONTROL, "Attachstream to a circuit is not "
"supported for .onion addresses currently. Failing.");
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
}
/* Interface: Regardless of HS version after the block below we should have
set onion_address, rend_cache_lookup_result, and descriptor_is_usable. */
const char *onion_address = NULL;
int rend_cache_lookup_result = -ENOENT;
int descriptor_is_usable = 0;
if (addresstype == ONION_V2_HOSTNAME) { /* it's a v2 hidden service */
rend_cache_entry_t *entry = NULL;
/* Look up if we have client authorization configured for this hidden
* service. If we do, associate it with the rend_data. */
rend_service_authorization_t *client_auth =
rend_client_lookup_service_authorization(socks->address);
const uint8_t *cookie = NULL;
rend_auth_type_t auth_type = REND_NO_AUTH;
if (client_auth) {
log_info(LD_REND, "Using previously configured client authorization "
"for hidden service request.");
auth_type = client_auth->auth_type;
cookie = client_auth->descriptor_cookie;
}
/* Fill in the rend_data field so we can start doing a connection to
* a hidden service. */
rend_data_t *rend_data = ENTRY_TO_EDGE_CONN(conn)->rend_data =
rend_data_client_create(socks->address, NULL, (char *) cookie,
auth_type);
if (rend_data == NULL) {
return -1;
}
onion_address = rend_data_get_address(rend_data);
log_info(LD_REND,"Got a hidden service request for ID '%s'",
safe_str_client(onion_address));
rend_cache_lookup_result = rend_cache_lookup_entry(onion_address,-1,
&entry);
if (!rend_cache_lookup_result && entry) {
descriptor_is_usable = rend_client_any_intro_points_usable(entry);
}
} else { /* it's a v3 hidden service */
tor_assert(addresstype == ONION_V3_HOSTNAME);
const hs_descriptor_t *cached_desc = NULL;
int retval;
/* Create HS conn identifier with HS pubkey */
hs_ident_edge_conn_t *hs_conn_ident =
tor_malloc_zero(sizeof(hs_ident_edge_conn_t));
retval = hs_parse_address(socks->address, &hs_conn_ident->identity_pk,
NULL, NULL);
if (retval < 0) {
log_warn(LD_GENERAL, "failed to parse hs address");
tor_free(hs_conn_ident);
return -1;
}
ENTRY_TO_EDGE_CONN(conn)->hs_ident = hs_conn_ident;
onion_address = socks->address;
/* Check the v3 desc cache */
cached_desc = hs_cache_lookup_as_client(&hs_conn_ident->identity_pk);
if (cached_desc) {
rend_cache_lookup_result = 0;
descriptor_is_usable =
hs_client_any_intro_points_usable(&hs_conn_ident->identity_pk,
cached_desc);
log_info(LD_GENERAL, "Found %s descriptor in cache for %s. %s.",
(descriptor_is_usable) ? "usable" : "unusable",
safe_str_client(onion_address),
(descriptor_is_usable) ? "Not fetching." : "Refecting.");
} else {
rend_cache_lookup_result = -ENOENT;
}
}
/* Lookup the given onion address. If invalid, stop right now.
* Otherwise, we might have it in the cache or not. */
unsigned int refetch_desc = 0;
if (rend_cache_lookup_result < 0) {
switch (-rend_cache_lookup_result) {
case EINVAL:
/* We should already have rejected this address! */
log_warn(LD_BUG,"Invalid service name '%s'",
safe_str_client(onion_address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
case ENOENT:
/* We didn't have this; we should look it up. */
log_info(LD_REND, "No descriptor found in our cache for %s. Fetching.",
safe_str_client(onion_address));
refetch_desc = 1;
break;
default:
log_warn(LD_BUG, "Unknown cache lookup error %d",
rend_cache_lookup_result);
return -1;
}
}
/* Help predict that we'll want to do hidden service circuits in the
* future. We're not sure if it will need a stable circuit yet, but
* we know we'll need *something*. */
rep_hist_note_used_internal(now, 0, 1);
/* Now we have a descriptor but is it usable or not? If not, refetch.
* Also, a fetch could have been requested if the onion address was not
* found in the cache previously. */
if (refetch_desc || !descriptor_is_usable) {
edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(conn);
connection_ap_mark_as_non_pending_circuit(conn);
base_conn->state = AP_CONN_STATE_RENDDESC_WAIT;
if (addresstype == ONION_V2_HOSTNAME) {
tor_assert(edge_conn->rend_data);
rend_client_refetch_v2_renddesc(edge_conn->rend_data);
/* Whatever the result of the refetch, we don't go further. */
return 0;
} else {
tor_assert(addresstype == ONION_V3_HOSTNAME);
tor_assert(edge_conn->hs_ident);
/* Attempt to fetch the hsv3 descriptor. Check the retval to see how it
* went and act accordingly. */
int ret = hs_client_refetch_hsdesc(&edge_conn->hs_ident->identity_pk);
switch (ret) {
case HS_CLIENT_FETCH_MISSING_INFO:
/* Keeping the connection in descriptor wait state is fine because
* once we get enough dirinfo or a new live consensus, the HS client
* subsystem is notified and every connection in that state will
* trigger a fetch for the service key. */
case HS_CLIENT_FETCH_LAUNCHED:
case HS_CLIENT_FETCH_PENDING:
case HS_CLIENT_FETCH_HAVE_DESC:
return 0;
case HS_CLIENT_FETCH_ERROR:
case HS_CLIENT_FETCH_NO_HSDIRS:
case HS_CLIENT_FETCH_NOT_ALLOWED:
/* Can't proceed further and better close the SOCKS request. */
return -1;
}
}
}
/* We have the descriptor! So launch a connection to the HS. */
log_info(LD_REND, "Descriptor is here. Great.");
base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
/* We'll try to attach it at the next event loop, or whenever
* we call connection_ap_attach_pending() */
connection_ap_mark_as_pending_circuit(conn);
return 0;
}
/** Connection conn just finished its socks handshake, or the
* controller asked us to take care of it. If circ is defined,
* then that's where we'll want to attach it. Otherwise we have to
* figure it out ourselves.
*
* First, parse whether it's a .exit address, remap it, and so on. Then
* if it's for a general circuit, try to attach it to a circuit (or launch
* one as needed), else if it's for a rendezvous circuit, fetch a
* rendezvous descriptor first (or attach/launch a circuit if the
* rendezvous descriptor is already here and fresh enough).
*
* The stream will exit from the hop
* indicated by cpath, or from the last hop in circ's cpath if
* cpath is NULL.
*/
int
connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn,
origin_circuit_t *circ,
crypt_path_t *cpath)
{
socks_request_t *socks = conn->socks_request;
const or_options_t *options = get_options();
connection_t *base_conn = ENTRY_TO_CONN(conn);
time_t now = time(NULL);
rewrite_result_t rr;
/* First we'll do the rewrite part. Let's see if we get a reasonable
* answer.
*/
memset(&rr, 0, sizeof(rr));
connection_ap_handshake_rewrite(conn,&rr);
if (rr.should_close) {
/* connection_ap_handshake_rewrite told us to close the connection:
* either because it sent back an answer, or because it sent back an
* error */
connection_mark_unattached_ap(conn, rr.end_reason);
if (END_STREAM_REASON_DONE == (rr.end_reason & END_STREAM_REASON_MASK))
return 0;
else
return -1;
}
const time_t map_expires = rr.map_expires;
const int automap = rr.automap;
const addressmap_entry_source_t exit_source = rr.exit_source;
/* Now, we parse the address to see if it's an .onion or .exit or
* other special address.
*/
const hostname_type_t addresstype = parse_extended_hostname(socks->address);
/* Now see whether the hostname is bogus. This could happen because of an
* onion hostname whose format we don't recognize. */
if (addresstype == BAD_HOSTNAME) {
control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
escaped(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
}
/* If this is a .exit hostname, strip off the .name.exit part, and
* see whether we're willing to connect there, and and otherwise handle the
* .exit address.
*
* We'll set chosen_exit_name and/or close the connection as appropriate.
*/
if (addresstype == EXIT_HOSTNAME) {
/* If StrictNodes is not set, then .exit overrides ExcludeNodes but
* not ExcludeExitNodes. */
routerset_t *excludeset = options->StrictNodes ?
options->ExcludeExitNodesUnion_ : options->ExcludeExitNodes;
const node_t *node = NULL;
/* If this .exit was added by an AUTOMAP, then it came straight from
* a user. That's not safe. */
if (exit_source == ADDRMAPSRC_AUTOMAP) {
/* Whoops; this one is stale. It must have gotten added earlier?
* (Probably this is not possible, since AllowDotExit no longer
* exists.) */
log_warn(LD_APP,"Stale automapped address for '%s.exit'. Refusing.",
safe_str_client(socks->address));
control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
escaped(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
tor_assert_nonfatal_unreached();
return -1;
}
/* Double-check to make sure there are no .exits coming from
* impossible/weird sources. */
if (exit_source == ADDRMAPSRC_DNS || exit_source == ADDRMAPSRC_NONE) {
/* It shouldn't be possible to get a .exit address from any of these
* sources. */
log_warn(LD_BUG,"Address '%s.exit', with impossible source for the "
".exit part. Refusing.",
safe_str_client(socks->address));
control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
escaped(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
}
tor_assert(!automap);
/* Now, find the character before the .(name) part.
* (The ".exit" part got stripped off by "parse_extended_hostname").
*
* We're going to put the exit name into conn->chosen_exit_name, and
* look up a node correspondingly. */
char *s = strrchr(socks->address,'.');
if (s) {
/* The address was of the form "(stuff).(name).exit */
if (s[1] != '\0') {
/* Looks like a real .exit one. */
conn->chosen_exit_name = tor_strdup(s+1);
node = node_get_by_nickname(conn->chosen_exit_name, 0);
if (exit_source == ADDRMAPSRC_TRACKEXIT) {
/* We 5 tries before it expires the addressmap */
conn->chosen_exit_retries = TRACKHOSTEXITS_RETRIES;
}
*s = 0;
} else {
/* Oops, the address was (stuff)..exit. That's not okay. */
log_warn(LD_APP,"Malformed exit address '%s.exit'. Refusing.",
safe_str_client(socks->address));
control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
escaped(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
}
} else {
/* It looks like they just asked for "foo.exit". That's a special
* form that means (foo's address).foo.exit. */
conn->chosen_exit_name = tor_strdup(socks->address);
node = node_get_by_nickname(conn->chosen_exit_name, 0);
if (node) {
*socks->address = 0;
node_get_address_string(node, socks->address, sizeof(socks->address));
}
}
/* Now make sure that the chosen exit exists... */
if (!node) {
log_warn(LD_APP,
"Unrecognized relay in exit address '%s.exit'. Refusing.",
safe_str_client(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
}
/* ...and make sure that it isn't excluded. */
if (routerset_contains_node(excludeset, node)) {
log_warn(LD_APP,
"Excluded relay in exit address '%s.exit'. Refusing.",
safe_str_client(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
}
/* XXXX-1090 Should we also allow foo.bar.exit if ExitNodes is set and
Bar is not listed in it? I say yes, but our revised manpage branch
implies no. */
}
/* Now, we handle everything that isn't a .onion address. */
if (addresstype != ONION_V2_HOSTNAME && addresstype != ONION_V3_HOSTNAME) {
/* Not a hidden-service request. It's either a hostname or an IP,
* possibly with a .exit that we stripped off. We're going to check
* if we're allowed to connect/resolve there, and then launch the
* appropriate request. */
/* Check for funny characters in the address. */
if (address_is_invalid_destination(socks->address, 1)) {
control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
escaped(socks->address));
log_warn(LD_APP,
"Destination '%s' seems to be an invalid hostname. Failing.",
safe_str_client(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
}
/* socks->address is a non-onion hostname or IP address.
* If we can't do any non-onion requests, refuse the connection.
* If we have a hostname but can't do DNS, refuse the connection.
* If we have an IP address, but we can't use that address family,
* refuse the connection.
*
* If we can do DNS requests, and we can use at least one address family,
* then we have to resolve the address first. Then we'll know if it
* resolves to a usable address family. */
/* First, check if all non-onion traffic is disabled */
if (!conn->entry_cfg.dns_request && !conn->entry_cfg.ipv4_traffic
&& !conn->entry_cfg.ipv6_traffic) {
log_warn(LD_APP, "Refusing to connect to non-hidden-service hostname "
"or IP address %s because Port has OnionTrafficOnly set (or "
"NoDNSRequest, NoIPv4Traffic, and NoIPv6Traffic).",
safe_str_client(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
return -1;
}
/* Then check if we have a hostname or IP address, and whether DNS or
* the IP address family are permitted. Reject if not. */
tor_addr_t dummy_addr;
int socks_family = tor_addr_parse(&dummy_addr, socks->address);
/* family will be -1 for a non-onion hostname that's not an IP */
if (socks_family == -1) {
if (!conn->entry_cfg.dns_request) {
log_warn(LD_APP, "Refusing to connect to hostname %s "
"because Port has NoDNSRequest set.",
safe_str_client(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
return -1;
}
} else if (socks_family == AF_INET) {
if (!conn->entry_cfg.ipv4_traffic) {
log_warn(LD_APP, "Refusing to connect to IPv4 address %s because "
"Port has NoIPv4Traffic set.",
safe_str_client(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
return -1;
}
} else if (socks_family == AF_INET6) {
if (!conn->entry_cfg.ipv6_traffic) {
log_warn(LD_APP, "Refusing to connect to IPv6 address %s because "
"Port has NoIPv6Traffic set.",
safe_str_client(socks->address));
connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
return -1;
}
} else {
tor_assert_nonfatal_unreached_once();
}
/* See if this is a hostname lookup that we can answer immediately.
* (For example, an attempt to look up the IP address for an IP address.)
*/
if (socks->command == SOCKS_COMMAND_RESOLVE) {
tor_addr_t answer;
/* Reply to resolves immediately if we can. */
if (tor_addr_parse(&answer, socks->address) >= 0) {/* is it an IP? */
/* remember _what_ is supposed to have been resolved. */
strlcpy(socks->address, rr.orig_address, sizeof(socks->address));
connection_ap_handshake_socks_resolved_addr(conn, &answer, -1,
map_expires);
connection_mark_unattached_ap(conn,
END_STREAM_REASON_DONE |
END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
return 0;
}
tor_assert(!automap);
rep_hist_note_used_resolve(now); /* help predict this next time */
} else if (socks->command == SOCKS_COMMAND_CONNECT) {
/* Now see if this is a connect request that we can reject immediately */
tor_assert(!automap);
/* Don't allow connections to port 0. */
if (socks->port == 0) {
log_notice(LD_APP,"Application asked to connect to port 0. Refusing.");
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
}
/* You can't make connections to internal addresses, by default.
* Exceptions are begindir requests (where the address is meaningless),
* or cases where you've hand-configured a particular exit, thereby
* making the local address meaningful. */
if (options->ClientRejectInternalAddresses &&
!conn->use_begindir && !conn->chosen_exit_name && !circ) {
/* If we reach this point then we don't want to allow internal
* addresses. Check if we got one. */
tor_addr_t addr;
if (tor_addr_hostname_is_local(socks->address) ||
(tor_addr_parse(&addr, socks->address) >= 0 &&
tor_addr_is_internal(&addr, 0))) {
/* If this is an explicit private address with no chosen exit node,
* then we really don't want to try to connect to it. That's
* probably an error. */
if (conn->is_transparent_ap) {
#define WARN_INTRVL_LOOP 300
static ratelim_t loop_warn_limit = RATELIM_INIT(WARN_INTRVL_LOOP);
char *m;
if ((m = rate_limit_log(&loop_warn_limit, approx_time()))) {
log_warn(LD_NET,
"Rejecting request for anonymous connection to private "
"address %s on a TransPort or NATDPort. Possible loop "
"in your NAT rules?%s", safe_str_client(socks->address),
m);
tor_free(m);
}
} else {
#define WARN_INTRVL_PRIV 300
static ratelim_t priv_warn_limit = RATELIM_INIT(WARN_INTRVL_PRIV);
char *m;
if ((m = rate_limit_log(&priv_warn_limit, approx_time()))) {
log_warn(LD_NET,
"Rejecting SOCKS request for anonymous connection to "
"private address %s.%s",
safe_str_client(socks->address),m);
tor_free(m);
}
}
connection_mark_unattached_ap(conn, END_STREAM_REASON_PRIVATE_ADDR);
return -1;
}
} /* end "if we should check for internal addresses" */
/* Okay. We're still doing a CONNECT, and it wasn't a private
* address. Here we do special handling for literal IP addresses,
* to see if we should reject this preemptively, and to set up
* fields in conn->entry_cfg to tell the exit what AF we want. */
{
tor_addr_t addr;
/* XXX Duplicate call to tor_addr_parse. */
if (tor_addr_parse(&addr, socks->address) >= 0) {
/* If we reach this point, it's an IPv4 or an IPv6 address. */
sa_family_t family = tor_addr_family(&addr);
if ((family == AF_INET && ! conn->entry_cfg.ipv4_traffic) ||
(family == AF_INET6 && ! conn->entry_cfg.ipv6_traffic)) {
/* You can't do an IPv4 address on a v6-only socks listener,
* or vice versa. */
log_warn(LD_NET, "Rejecting SOCKS request for an IP address "
"family that this listener does not support.");
connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
return -1;
} else if (family == AF_INET6 && socks->socks_version == 4) {
/* You can't make a socks4 request to an IPv6 address. Socks4
* doesn't support that. */
log_warn(LD_NET, "Rejecting SOCKS4 request for an IPv6 address.");
connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
return -1;
} else if (socks->socks_version == 4 &&
!conn->entry_cfg.ipv4_traffic) {
/* You can't do any kind of Socks4 request when IPv4 is forbidden.
*
* XXX raise this check outside the enclosing block? */
log_warn(LD_NET, "Rejecting SOCKS4 request on a listener with "
"no IPv4 traffic supported.");
connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY);
return -1;
} else if (family == AF_INET6) {
/* Tell the exit: we won't accept any ipv4 connection to an IPv6
* address. */
conn->entry_cfg.ipv4_traffic = 0;
} else if (family == AF_INET) {
/* Tell the exit: we won't accept any ipv6 connection to an IPv4
* address. */
conn->entry_cfg.ipv6_traffic = 0;
}
}
}
/* we never allow IPv6 answers on socks4. (TODO: Is this smart?) */
if (socks->socks_version == 4)
conn->entry_cfg.ipv6_traffic = 0;
/* Still handling CONNECT. Now, check for exit enclaves. (Which we
* don't do on BEGIN_DIR, or when there is a chosen exit.)
*
* TODO: Should we remove this? Exit enclaves are nutty and don't
* work very well
*/
if (!conn->use_begindir && !conn->chosen_exit_name && !circ) {
/* see if we can find a suitable enclave exit */
const node_t *r =
router_find_exact_exit_enclave(socks->address, socks->port);
if (r) {
log_info(LD_APP,
"Redirecting address %s to exit at enclave router %s",
safe_str_client(socks->address), node_describe(r));
/* use the hex digest, not nickname, in case there are two
routers with this nickname */
conn->chosen_exit_name =
tor_strdup(hex_str(r->identity, DIGEST_LEN));
conn->chosen_exit_optional = 1;
}
}
/* Still handling CONNECT: warn or reject if it's using a dangerous
* port. */
if (!conn->use_begindir && !conn->chosen_exit_name && !circ)
if (consider_plaintext_ports(conn, socks->port) < 0)
return -1;
/* Remember the port so that we will predict that more requests
there will happen in the future. */
if (!conn->use_begindir) {
/* help predict this next time */
rep_hist_note_used_port(now, socks->port);
}
} else if (socks->command == SOCKS_COMMAND_RESOLVE_PTR) {
rep_hist_note_used_resolve(now); /* help predict this next time */
/* no extra processing needed */
} else {
/* We should only be doing CONNECT, RESOLVE, or RESOLVE_PTR! */
tor_fragile_assert();
}
/* Okay. At this point we've set chosen_exit_name if needed, rewritten the
* address, and decided not to reject it for any number of reasons. Now
* mark the connection as waiting for a circuit, and try to attach it!
*/
base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
/* If we were given a circuit to attach to, try to attach. Otherwise,
* try to find a good one and attach to that. */
int rv;
if (circ) {
rv = connection_ap_handshake_attach_chosen_circuit(conn, circ, cpath);
} else {
/* We'll try to attach it at the next event loop, or whenever
* we call connection_ap_attach_pending() */
connection_ap_mark_as_pending_circuit(conn);
rv = 0;
}
/* If the above function returned 0 then we're waiting for a circuit.
* if it returned 1, we're attached. Both are okay. But if it returned
* -1, there was an error, so make sure the connection is marked, and
* return -1. */
if (rv < 0) {
if (!base_conn->marked_for_close)
connection_mark_unattached_ap(conn, END_STREAM_REASON_CANT_ATTACH);
return -1;
}
return 0;
} else {
/* If we get here, it's a request for a .onion address! */
tor_assert(addresstype == ONION_V2_HOSTNAME ||
addresstype == ONION_V3_HOSTNAME);
tor_assert(!automap);
return connection_ap_handle_onion(conn, socks, circ, addresstype);
}
return 0; /* unreached but keeps the compiler happy */
}
#ifdef TRANS_PF
static int pf_socket = -1;
int
get_pf_socket(void)
{
int pf;
/* This should be opened before dropping privileges. */
if (pf_socket >= 0)
return pf_socket;
#if defined(OpenBSD)
/* only works on OpenBSD */
pf = tor_open_cloexec("/dev/pf", O_RDONLY, 0);
#else
/* works on NetBSD and FreeBSD */
pf = tor_open_cloexec("/dev/pf", O_RDWR, 0);
#endif /* defined(OpenBSD) */
if (pf < 0) {
log_warn(LD_NET, "open(\"/dev/pf\") failed: %s", strerror(errno));
return -1;
}
pf_socket = pf;
return pf_socket;
}
#endif /* defined(TRANS_PF) */
#if defined(TRANS_NETFILTER) || defined(TRANS_PF) || \
defined(TRANS_TPROXY)
/** Try fill in the address of req from the socket configured
* with conn. */
static int
destination_from_socket(entry_connection_t *conn, socks_request_t *req)
{
struct sockaddr_storage orig_dst;
socklen_t orig_dst_len = sizeof(orig_dst);
tor_addr_t addr;
#ifdef TRANS_TPROXY
if (get_options()->TransProxyType_parsed == TPT_TPROXY) {
if (getsockname(ENTRY_TO_CONN(conn)->s, (struct sockaddr*)&orig_dst,
&orig_dst_len) < 0) {
int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s);
log_warn(LD_NET, "getsockname() failed: %s", tor_socket_strerror(e));
return -1;
}
goto done;
}
#endif /* defined(TRANS_TPROXY) */
#ifdef TRANS_NETFILTER
int rv = -1;
switch (ENTRY_TO_CONN(conn)->socket_family) {
#ifdef TRANS_NETFILTER_IPV4
case AF_INET:
rv = getsockopt(ENTRY_TO_CONN(conn)->s, SOL_IP, SO_ORIGINAL_DST,
(struct sockaddr*)&orig_dst, &orig_dst_len);
break;
#endif /* defined(TRANS_NETFILTER_IPV4) */
#ifdef TRANS_NETFILTER_IPV6
case AF_INET6:
rv = getsockopt(ENTRY_TO_CONN(conn)->s, SOL_IPV6, IP6T_SO_ORIGINAL_DST,
(struct sockaddr*)&orig_dst, &orig_dst_len);
break;
#endif /* defined(TRANS_NETFILTER_IPV6) */
default:
log_warn(LD_BUG,
"Received transparent data from an unsuported socket family %d",
ENTRY_TO_CONN(conn)->socket_family);
return -1;
}
if (rv < 0) {
int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s);
log_warn(LD_NET, "getsockopt() failed: %s", tor_socket_strerror(e));
return -1;
}
goto done;
#elif defined(TRANS_PF)
if (getsockname(ENTRY_TO_CONN(conn)->s, (struct sockaddr*)&orig_dst,
&orig_dst_len) < 0) {
int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s);
log_warn(LD_NET, "getsockname() failed: %s", tor_socket_strerror(e));
return -1;
}
goto done;
#else
(void)conn;
(void)req;
log_warn(LD_BUG, "Unable to determine destination from socket.");
return -1;
#endif /* defined(TRANS_NETFILTER) || ... */
done:
tor_addr_from_sockaddr(&addr, (struct sockaddr*)&orig_dst, &req->port);
tor_addr_to_str(req->address, &addr, sizeof(req->address), 1);
return 0;
}
#endif /* defined(TRANS_NETFILTER) || defined(TRANS_PF) || ... */
#ifdef TRANS_PF
static int
destination_from_pf(entry_connection_t *conn, socks_request_t *req)
{
struct sockaddr_storage proxy_addr;
socklen_t proxy_addr_len = sizeof(proxy_addr);
struct sockaddr *proxy_sa = (struct sockaddr*) &proxy_addr;
struct pfioc_natlook pnl;
tor_addr_t addr;
int pf = -1;
if (getsockname(ENTRY_TO_CONN(conn)->s, (struct sockaddr*)&proxy_addr,
&proxy_addr_len) < 0) {
int e = tor_socket_errno(ENTRY_TO_CONN(conn)->s);
log_warn(LD_NET, "getsockname() to determine transocks destination "
"failed: %s", tor_socket_strerror(e));
return -1;
}
#ifdef __FreeBSD__
if (get_options()->TransProxyType_parsed == TPT_IPFW) {
/* ipfw(8) is used and in this case getsockname returned the original
destination */
if (tor_addr_from_sockaddr(&addr, proxy_sa, &req->port) < 0) {
tor_fragile_assert();
return -1;
}
tor_addr_to_str(req->address, &addr, sizeof(req->address), 0);
return 0;
}
#endif /* defined(__FreeBSD__) */
memset(&pnl, 0, sizeof(pnl));
pnl.proto = IPPROTO_TCP;
pnl.direction = PF_OUT;
if (proxy_sa->sa_family == AF_INET) {
struct sockaddr_in *sin = (struct sockaddr_in *)proxy_sa;
pnl.af = AF_INET;
pnl.saddr.v4.s_addr = tor_addr_to_ipv4n(&ENTRY_TO_CONN(conn)->addr);
pnl.sport = htons(ENTRY_TO_CONN(conn)->port);
pnl.daddr.v4.s_addr = sin->sin_addr.s_addr;
pnl.dport = sin->sin_port;
} else if (proxy_sa->sa_family == AF_INET6) {
struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)proxy_sa;
pnl.af = AF_INET6;
const struct in6_addr *dest_in6 =
tor_addr_to_in6(&ENTRY_TO_CONN(conn)->addr);
if (BUG(!dest_in6))
return -1;
memcpy(&pnl.saddr.v6, dest_in6, sizeof(struct in6_addr));
pnl.sport = htons(ENTRY_TO_CONN(conn)->port);
memcpy(&pnl.daddr.v6, &sin6->sin6_addr, sizeof(struct in6_addr));
pnl.dport = sin6->sin6_port;
} else {
log_warn(LD_NET, "getsockname() gave an unexpected address family (%d)",
(int)proxy_sa->sa_family);
return -1;
}
pf = get_pf_socket();
if (pf<0)
return -1;
if (ioctl(pf, DIOCNATLOOK, &pnl) < 0) {
log_warn(LD_NET, "ioctl(DIOCNATLOOK) failed: %s", strerror(errno));
return -1;
}
if (pnl.af == AF_INET) {
tor_addr_from_ipv4n(&addr, pnl.rdaddr.v4.s_addr);
} else if (pnl.af == AF_INET6) {
tor_addr_from_in6(&addr, &pnl.rdaddr.v6);
} else {
tor_fragile_assert();
return -1;
}
tor_addr_to_str(req->address, &addr, sizeof(req->address), 1);
req->port = ntohs(pnl.rdport);
return 0;
}
#endif /* defined(TRANS_PF) */
/** Fetch the original destination address and port from a
* system-specific interface and put them into a
* socks_request_t as if they came from a socks request.
*
* Return -1 if an error prevents fetching the destination,
* else return 0.
*/
static int
connection_ap_get_original_destination(entry_connection_t *conn,
socks_request_t *req)
{
#ifdef TRANS_NETFILTER
return destination_from_socket(conn, req);
#elif defined(TRANS_PF)
const or_options_t *options = get_options();
if (options->TransProxyType_parsed == TPT_PF_DIVERT)
return destination_from_socket(conn, req);
if (options->TransProxyType_parsed == TPT_DEFAULT ||
options->TransProxyType_parsed == TPT_IPFW)
return destination_from_pf(conn, req);
(void)conn;
(void)req;
log_warn(LD_BUG, "Proxy destination determination mechanism %s unknown.",
options->TransProxyType);
return -1;
#else
(void)conn;
(void)req;
log_warn(LD_BUG, "Called connection_ap_get_original_destination, but no "
"transparent proxy method was configured.");
return -1;
#endif /* defined(TRANS_NETFILTER) || ... */
}
/** connection_edge_process_inbuf() found a conn in state
* socks_wait. See if conn->inbuf has the right bytes to proceed with
* the socks handshake.
*
* If the handshake is complete, send it to
* connection_ap_handshake_rewrite_and_attach().
*
* Return -1 if an unexpected error with conn occurs (and mark it for close),
* else return 0.
*/
static int
connection_ap_handshake_process_socks(entry_connection_t *conn)
{
socks_request_t *socks;
int sockshere;
const or_options_t *options = get_options();
int had_reply = 0;
connection_t *base_conn = ENTRY_TO_CONN(conn);
tor_assert(conn);
tor_assert(base_conn->type == CONN_TYPE_AP);
tor_assert(base_conn->state == AP_CONN_STATE_SOCKS_WAIT);
tor_assert(conn->socks_request);
socks = conn->socks_request;
log_debug(LD_APP,"entered.");
sockshere = fetch_from_buf_socks(base_conn->inbuf, socks,
options->TestSocks, options->SafeSocks);
if (socks->replylen) {
had_reply = 1;
connection_buf_add((const char*)socks->reply, socks->replylen,
base_conn);
socks->replylen = 0;
if (sockshere == -1) {
/* An invalid request just got a reply, no additional
* one is necessary. */
socks->has_finished = 1;
}
}
if (sockshere == 0) {
log_debug(LD_APP,"socks handshake not all here yet.");
return 0;
} else if (sockshere == -1) {
if (!had_reply) {
log_warn(LD_APP,"Fetching socks handshake failed. Closing.");
connection_ap_handshake_socks_reply(conn, NULL, 0,
END_STREAM_REASON_SOCKSPROTOCOL);
}
connection_mark_unattached_ap(conn,
END_STREAM_REASON_SOCKSPROTOCOL |
END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
return -1;
} /* else socks handshake is done, continue processing */
if (SOCKS_COMMAND_IS_CONNECT(socks->command))
control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
else
control_event_stream_status(conn, STREAM_EVENT_NEW_RESOLVE, 0);
return connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
}
/** connection_init_accepted_conn() found a new trans AP conn.
* Get the original destination and send it to
* connection_ap_handshake_rewrite_and_attach().
*
* Return -1 if an unexpected error with conn (and it should be marked
* for close), else return 0.
*/
int
connection_ap_process_transparent(entry_connection_t *conn)
{
socks_request_t *socks;
tor_assert(conn);
tor_assert(conn->socks_request);
socks = conn->socks_request;
/* pretend that a socks handshake completed so we don't try to
* send a socks reply down a transparent conn */
socks->command = SOCKS_COMMAND_CONNECT;
socks->has_finished = 1;
log_debug(LD_APP,"entered.");
if (connection_ap_get_original_destination(conn, socks) < 0) {
log_warn(LD_APP,"Fetching original destination failed. Closing.");
connection_mark_unattached_ap(conn,
END_STREAM_REASON_CANT_FETCH_ORIG_DEST);
return -1;
}
/* we have the original destination */
control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
return connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
}
/** connection_edge_process_inbuf() found a conn in state natd_wait. See if
* conn-\>inbuf has the right bytes to proceed. See FreeBSD's libalias(3) and
* ProxyEncodeTcpStream() in src/lib/libalias/alias_proxy.c for the encoding
* form of the original destination.
*
* If the original destination is complete, send it to
* connection_ap_handshake_rewrite_and_attach().
*
* Return -1 if an unexpected error with conn (and it should be marked
* for close), else return 0.
*/
static int
connection_ap_process_natd(entry_connection_t *conn)
{
char tmp_buf[36], *tbuf, *daddr;
size_t tlen = 30;
int err, port_ok;
socks_request_t *socks;
tor_assert(conn);
tor_assert(ENTRY_TO_CONN(conn)->state == AP_CONN_STATE_NATD_WAIT);
tor_assert(conn->socks_request);
socks = conn->socks_request;
log_debug(LD_APP,"entered.");
/* look for LF-terminated "[DEST ip_addr port]"
* where ip_addr is a dotted-quad and port is in string form */
err = connection_buf_get_line(ENTRY_TO_CONN(conn), tmp_buf, &tlen);
if (err == 0)
return 0;
if (err < 0) {
log_warn(LD_APP,"NATD handshake failed (DEST too long). Closing");
connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST);
return -1;
}
if (strcmpstart(tmp_buf, "[DEST ")) {
log_warn(LD_APP,"NATD handshake was ill-formed; closing. The client "
"said: %s",
escaped(tmp_buf));
connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST);
return -1;
}
daddr = tbuf = &tmp_buf[0] + 6; /* after end of "[DEST " */
if (!(tbuf = strchr(tbuf, ' '))) {
log_warn(LD_APP,"NATD handshake was ill-formed; closing. The client "
"said: %s",
escaped(tmp_buf));
connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST);
return -1;
}
*tbuf++ = '\0';
/* pretend that a socks handshake completed so we don't try to
* send a socks reply down a natd conn */
strlcpy(socks->address, daddr, sizeof(socks->address));
socks->port = (uint16_t)
tor_parse_long(tbuf, 10, 1, 65535, &port_ok, &daddr);
if (!port_ok) {
log_warn(LD_APP,"NATD handshake failed; port %s is ill-formed or out "
"of range.", escaped(tbuf));
connection_mark_unattached_ap(conn, END_STREAM_REASON_INVALID_NATD_DEST);
return -1;
}
socks->command = SOCKS_COMMAND_CONNECT;
socks->has_finished = 1;
control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
ENTRY_TO_CONN(conn)->state = AP_CONN_STATE_CIRCUIT_WAIT;
return connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
}
static const char HTTP_CONNECT_IS_NOT_AN_HTTP_PROXY_MSG[] =
"HTTP/1.0 405 Method Not Allowed\r\n"
"Content-Type: text/html; charset=iso-8859-1\r\n\r\n"
"\n"
"\n"
"This is an HTTP CONNECT tunnel, not a full HTTP Proxy\n"
"\n"
"\n"
"This is an HTTP CONNECT tunnel, not an HTTP proxy.
\n"
"\n"
"It appears you have configured your web browser to use this Tor port as\n"
"an HTTP proxy.\n"
"
\n"
"This is not correct: This port is configured as a CONNECT tunnel, not\n"
"an HTTP proxy. Please configure your client accordingly. You can also\n"
"use HTTPS; then the client should automatically use HTTP CONNECT."
"
\n"
"\n"
"See "
"https://www.torproject.org/documentation.html for more "
"information.\n"
"
\n"
"\n"
"\n";
/** Called on an HTTP CONNECT entry connection when some bytes have arrived,
* but we have not yet received a full HTTP CONNECT request. Try to parse an
* HTTP CONNECT request from the connection's inbuf. On success, set up the
* connection's socks_request field and try to attach the connection. On
* failure, send an HTTP reply, and mark the connection.
*/
STATIC int
connection_ap_process_http_connect(entry_connection_t *conn)
{
if (BUG(ENTRY_TO_CONN(conn)->state != AP_CONN_STATE_HTTP_CONNECT_WAIT))
return -1;
char *headers = NULL, *body = NULL;
char *command = NULL, *addrport = NULL;
char *addr = NULL;
size_t bodylen = 0;
const char *errmsg = NULL;
int rv = 0;
const int http_status =
fetch_from_buf_http(ENTRY_TO_CONN(conn)->inbuf, &headers, 8192,
&body, &bodylen, 1024, 0);
if (http_status < 0) {
/* Bad http status */
errmsg = "HTTP/1.0 400 Bad Request\r\n\r\n";
goto err;
} else if (http_status == 0) {
/* no HTTP request yet. */
goto done;
}
const int cmd_status = parse_http_command(headers, &command, &addrport);
if (cmd_status < 0) {
errmsg = "HTTP/1.0 400 Bad Request\r\n\r\n";
goto err;
}
tor_assert(command);
tor_assert(addrport);
if (strcasecmp(command, "connect")) {
errmsg = HTTP_CONNECT_IS_NOT_AN_HTTP_PROXY_MSG;
goto err;
}
tor_assert(conn->socks_request);
socks_request_t *socks = conn->socks_request;
uint16_t port;
if (tor_addr_port_split(LOG_WARN, addrport, &addr, &port) < 0) {
errmsg = "HTTP/1.0 400 Bad Request\r\n\r\n";
goto err;
}
if (strlen(addr) >= MAX_SOCKS_ADDR_LEN) {
errmsg = "HTTP/1.0 414 Request-URI Too Long\r\n\r\n";
goto err;
}
/* Abuse the 'username' and 'password' fields here. They are already an
* abuse. */
{
char *authorization = http_get_header(headers, "Proxy-Authorization: ");
if (authorization) {
socks->username = authorization; // steal reference
socks->usernamelen = strlen(authorization);
}
char *isolation = http_get_header(headers, "X-Tor-Stream-Isolation: ");
if (isolation) {
socks->password = isolation; // steal reference
socks->passwordlen = strlen(isolation);
}
}
socks->command = SOCKS_COMMAND_CONNECT;
socks->listener_type = CONN_TYPE_AP_HTTP_CONNECT_LISTENER;
strlcpy(socks->address, addr, sizeof(socks->address));
socks->port = port;
control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
rv = connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
// XXXX send a "100 Continue" message?
goto done;
err:
if (BUG(errmsg == NULL))
errmsg = "HTTP/1.0 400 Bad Request\r\n\r\n";
log_info(LD_EDGE, "HTTP tunnel error: saying %s", escaped(errmsg));
connection_buf_add(errmsg, strlen(errmsg), ENTRY_TO_CONN(conn));
/* Mark it as "has_finished" so that we don't try to send an extra socks
* reply. */
conn->socks_request->has_finished = 1;
connection_mark_unattached_ap(conn,
END_STREAM_REASON_HTTPPROTOCOL|
END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED);
done:
tor_free(headers);
tor_free(body);
tor_free(command);
tor_free(addrport);
tor_free(addr);
return rv;
}
/** Iterate over the two bytes of stream_id until we get one that is not
* already in use; return it. Return 0 if can't get a unique stream_id.
*/
streamid_t
get_unique_stream_id_by_circ(origin_circuit_t *circ)
{
edge_connection_t *tmpconn;
streamid_t test_stream_id;
uint32_t attempts=0;
again:
test_stream_id = circ->next_stream_id++;
if (++attempts > 1<<16) {
/* Make sure we don't loop forever if all stream_id's are used. */
log_warn(LD_APP,"No unused stream IDs. Failing.");
return 0;
}
if (test_stream_id == 0)
goto again;
for (tmpconn = circ->p_streams; tmpconn; tmpconn=tmpconn->next_stream)
if (tmpconn->stream_id == test_stream_id)
goto again;
if (connection_half_edge_find_stream_id(circ->half_streams,
test_stream_id))
goto again;
return test_stream_id;
}
/** Return true iff conn is linked to a circuit and configured to use
* an exit that supports optimistic data. */
static int
connection_ap_supports_optimistic_data(const entry_connection_t *conn)
{
const edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(conn);
/* We can only send optimistic data if we're connected to an open
general circuit. */
if (edge_conn->on_circuit == NULL ||
edge_conn->on_circuit->state != CIRCUIT_STATE_OPEN ||
(edge_conn->on_circuit->purpose != CIRCUIT_PURPOSE_C_GENERAL &&
edge_conn->on_circuit->purpose != CIRCUIT_PURPOSE_C_HSDIR_GET &&
edge_conn->on_circuit->purpose != CIRCUIT_PURPOSE_S_HSDIR_POST &&
edge_conn->on_circuit->purpose != CIRCUIT_PURPOSE_C_REND_JOINED))
return 0;
return conn->may_use_optimistic_data;
}
/** Return a bitmask of BEGIN_FLAG_* flags that we should transmit in the
* RELAY_BEGIN cell for ap_conn. */
static uint32_t
connection_ap_get_begincell_flags(entry_connection_t *ap_conn)
{
edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(ap_conn);
const node_t *exitnode = NULL;
const crypt_path_t *cpath_layer = edge_conn->cpath_layer;
uint32_t flags = 0;
/* No flags for begindir */
if (ap_conn->use_begindir)
return 0;
/* No flags for hidden services. */
if (edge_conn->on_circuit->purpose != CIRCUIT_PURPOSE_C_GENERAL)
return 0;
/* If only IPv4 is supported, no flags */
if (ap_conn->entry_cfg.ipv4_traffic && !ap_conn->entry_cfg.ipv6_traffic)
return 0;
if (! cpath_layer ||
! cpath_layer->extend_info)
return 0;
if (!ap_conn->entry_cfg.ipv4_traffic)
flags |= BEGIN_FLAG_IPV4_NOT_OK;
exitnode = node_get_by_id(cpath_layer->extend_info->identity_digest);
if (ap_conn->entry_cfg.ipv6_traffic && exitnode) {
tor_addr_t a;
tor_addr_make_null(&a, AF_INET6);
if (compare_tor_addr_to_node_policy(&a, ap_conn->socks_request->port,
exitnode)
!= ADDR_POLICY_REJECTED) {
/* Only say "IPv6 OK" if the exit node supports IPv6. Otherwise there's
* no point. */
flags |= BEGIN_FLAG_IPV6_OK;
}
}
if (flags == BEGIN_FLAG_IPV6_OK) {
/* When IPv4 and IPv6 are both allowed, consider whether to say we
* prefer IPv6. Otherwise there's no point in declaring a preference */
if (ap_conn->entry_cfg.prefer_ipv6)
flags |= BEGIN_FLAG_IPV6_PREFERRED;
}
if (flags == BEGIN_FLAG_IPV4_NOT_OK) {
log_warn(LD_EDGE, "I'm about to ask a node for a connection that I "
"am telling it to fulfil with neither IPv4 nor IPv6. That's "
"not going to work. Did you perhaps ask for an IPv6 address "
"on an IPv4Only port, or vice versa?");
}
return flags;
}
/** Write a relay begin cell, using destaddr and destport from ap_conn's
* socks_request field, and send it down circ.
*
* If ap_conn is broken, mark it for close and return -1. Else return 0.
*/
MOCK_IMPL(int,
connection_ap_handshake_send_begin,(entry_connection_t *ap_conn))
{
char payload[CELL_PAYLOAD_SIZE];
int payload_len;
int begin_type;
const or_options_t *options = get_options();
origin_circuit_t *circ;
edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(ap_conn);
connection_t *base_conn = TO_CONN(edge_conn);
tor_assert(edge_conn->on_circuit);
circ = TO_ORIGIN_CIRCUIT(edge_conn->on_circuit);
tor_assert(base_conn->type == CONN_TYPE_AP);
tor_assert(base_conn->state == AP_CONN_STATE_CIRCUIT_WAIT);
tor_assert(ap_conn->socks_request);
tor_assert(SOCKS_COMMAND_IS_CONNECT(ap_conn->socks_request->command));
edge_conn->stream_id = get_unique_stream_id_by_circ(circ);
if (edge_conn->stream_id==0) {
/* XXXX+ Instead of closing this stream, we should make it get
* retried on another circuit. */
connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
/* Mark this circuit "unusable for new streams". */
mark_circuit_unusable_for_new_conns(circ);
return -1;
}
/* Set up begin cell flags. */
edge_conn->begincell_flags = connection_ap_get_begincell_flags(ap_conn);
tor_snprintf(payload,RELAY_PAYLOAD_SIZE, "%s:%d",
(circ->base_.purpose == CIRCUIT_PURPOSE_C_GENERAL) ?
ap_conn->socks_request->address : "",
ap_conn->socks_request->port);
payload_len = (int)strlen(payload)+1;
if (payload_len <= RELAY_PAYLOAD_SIZE - 4 && edge_conn->begincell_flags) {
set_uint32(payload + payload_len, htonl(edge_conn->begincell_flags));
payload_len += 4;
}
log_info(LD_APP,
"Sending relay cell %d on circ %u to begin stream %d.",
(int)ap_conn->use_begindir,
(unsigned)circ->base_.n_circ_id,
edge_conn->stream_id);
begin_type = ap_conn->use_begindir ?
RELAY_COMMAND_BEGIN_DIR : RELAY_COMMAND_BEGIN;
/* Check that circuits are anonymised, based on their type. */
if (begin_type == RELAY_COMMAND_BEGIN) {
/* This connection is a standard OR connection.
* Make sure its path length is anonymous, or that we're in a
* non-anonymous mode. */
assert_circ_anonymity_ok(circ, options);
} else if (begin_type == RELAY_COMMAND_BEGIN_DIR) {
/* This connection is a begindir directory connection.
* Look at the linked directory connection to access the directory purpose.
* If a BEGINDIR connection is ever not linked, that's a bug. */
if (BUG(!base_conn->linked)) {
return -1;
}
connection_t *linked_dir_conn_base = base_conn->linked_conn;
/* If the linked connection has been unlinked by other code, we can't send
* a begin cell on it. */
if (!linked_dir_conn_base) {
return -1;
}
/* Sensitive directory connections must have an anonymous path length.
* Otherwise, directory connections are typically one-hop.
* This matches the earlier check for directory connection path anonymity
* in directory_initiate_request(). */
if (purpose_needs_anonymity(linked_dir_conn_base->purpose,
TO_DIR_CONN(linked_dir_conn_base)->router_purpose,
TO_DIR_CONN(linked_dir_conn_base)->requested_resource)) {
assert_circ_anonymity_ok(circ, options);
}
} else {
/* This code was written for the two connection types BEGIN and BEGIN_DIR
*/
tor_assert_unreached();
}
if (connection_edge_send_command(edge_conn, begin_type,
begin_type == RELAY_COMMAND_BEGIN ? payload : NULL,
begin_type == RELAY_COMMAND_BEGIN ? payload_len : 0) < 0)
return -1; /* circuit is closed, don't continue */
edge_conn->package_window = STREAMWINDOW_START;
edge_conn->deliver_window = STREAMWINDOW_START;
base_conn->state = AP_CONN_STATE_CONNECT_WAIT;
log_info(LD_APP,"Address/port sent, ap socket "TOR_SOCKET_T_FORMAT
", n_circ_id %u",
base_conn->s, (unsigned)circ->base_.n_circ_id);
control_event_stream_status(ap_conn, STREAM_EVENT_SENT_CONNECT, 0);
/* If there's queued-up data, send it now */
if ((connection_get_inbuf_len(base_conn) ||
ap_conn->sending_optimistic_data) &&
connection_ap_supports_optimistic_data(ap_conn)) {
log_info(LD_APP, "Sending up to %ld + %ld bytes of queued-up data",
(long)connection_get_inbuf_len(base_conn),
ap_conn->sending_optimistic_data ?
(long)buf_datalen(ap_conn->sending_optimistic_data) : 0);
if (connection_edge_package_raw_inbuf(edge_conn, 1, NULL) < 0) {
connection_mark_for_close(base_conn);
}
}
return 0;
}
/** Write a relay resolve cell, using destaddr and destport from ap_conn's
* socks_request field, and send it down circ.
*
* If ap_conn is broken, mark it for close and return -1. Else return 0.
*/
int
connection_ap_handshake_send_resolve(entry_connection_t *ap_conn)
{
int payload_len, command;
const char *string_addr;
char inaddr_buf[REVERSE_LOOKUP_NAME_BUF_LEN];
origin_circuit_t *circ;
edge_connection_t *edge_conn = ENTRY_TO_EDGE_CONN(ap_conn);
connection_t *base_conn = TO_CONN(edge_conn);
tor_assert(edge_conn->on_circuit);
circ = TO_ORIGIN_CIRCUIT(edge_conn->on_circuit);
tor_assert(base_conn->type == CONN_TYPE_AP);
tor_assert(base_conn->state == AP_CONN_STATE_CIRCUIT_WAIT);
tor_assert(ap_conn->socks_request);
tor_assert(circ->base_.purpose == CIRCUIT_PURPOSE_C_GENERAL);
command = ap_conn->socks_request->command;
tor_assert(SOCKS_COMMAND_IS_RESOLVE(command));
edge_conn->stream_id = get_unique_stream_id_by_circ(circ);
if (edge_conn->stream_id==0) {
/* XXXX+ Instead of closing this stream, we should make it get
* retried on another circuit. */
connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
/* Mark this circuit "unusable for new streams". */
mark_circuit_unusable_for_new_conns(circ);
return -1;
}
if (command == SOCKS_COMMAND_RESOLVE) {
string_addr = ap_conn->socks_request->address;
payload_len = (int)strlen(string_addr)+1;
} else {
/* command == SOCKS_COMMAND_RESOLVE_PTR */
const char *a = ap_conn->socks_request->address;
tor_addr_t addr;
int r;
/* We're doing a reverse lookup. The input could be an IP address, or
* could be an .in-addr.arpa or .ip6.arpa address */
r = tor_addr_parse_PTR_name(&addr, a, AF_UNSPEC, 1);
if (r <= 0) {
log_warn(LD_APP, "Rejecting ill-formed reverse lookup of %s",
safe_str_client(a));
connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
return -1;
}
r = tor_addr_to_PTR_name(inaddr_buf, sizeof(inaddr_buf), &addr);
if (r < 0) {
log_warn(LD_BUG, "Couldn't generate reverse lookup hostname of %s",
safe_str_client(a));
connection_mark_unattached_ap(ap_conn, END_STREAM_REASON_INTERNAL);
return -1;
}
string_addr = inaddr_buf;
payload_len = (int)strlen(inaddr_buf)+1;
tor_assert(payload_len <= (int)sizeof(inaddr_buf));
}
log_debug(LD_APP,
"Sending relay cell to begin stream %d.", edge_conn->stream_id);
if (connection_edge_send_command(edge_conn,
RELAY_COMMAND_RESOLVE,
string_addr, payload_len) < 0)
return -1; /* circuit is closed, don't continue */
if (!base_conn->address) {
/* This might be unnecessary. XXXX */
base_conn->address = tor_addr_to_str_dup(&base_conn->addr);
}
base_conn->state = AP_CONN_STATE_RESOLVE_WAIT;
log_info(LD_APP,"Address sent for resolve, ap socket "TOR_SOCKET_T_FORMAT
", n_circ_id %u",
base_conn->s, (unsigned)circ->base_.n_circ_id);
control_event_stream_status(ap_conn, STREAM_EVENT_SENT_RESOLVE, 0);
return 0;
}
/** Make an AP connection_t linked to the connection_t partner. make a
* new linked connection pair, and attach one side to the conn, connection_add
* it, initialize it to circuit_wait, and call
* connection_ap_handshake_attach_circuit(conn) on it.
*
* Return the newly created end of the linked connection pair, or -1 if error.
*/
entry_connection_t *
connection_ap_make_link(connection_t *partner,
char *address, uint16_t port,
const char *digest,
int session_group, int isolation_flags,
int use_begindir, int want_onehop)
{
entry_connection_t *conn;
connection_t *base_conn;
log_info(LD_APP,"Making internal %s tunnel to %s:%d ...",
want_onehop ? "direct" : "anonymized",
safe_str_client(address), port);
conn = entry_connection_new(CONN_TYPE_AP, tor_addr_family(&partner->addr));
base_conn = ENTRY_TO_CONN(conn);
base_conn->linked = 1; /* so that we can add it safely below. */
/* populate conn->socks_request */
/* leave version at zero, so the socks_reply is empty */
conn->socks_request->socks_version = 0;
conn->socks_request->has_finished = 0; /* waiting for 'connected' */
strlcpy(conn->socks_request->address, address,
sizeof(conn->socks_request->address));
conn->socks_request->port = port;
conn->socks_request->command = SOCKS_COMMAND_CONNECT;
conn->want_onehop = want_onehop;
conn->use_begindir = use_begindir;
if (use_begindir) {
conn->chosen_exit_name = tor_malloc(HEX_DIGEST_LEN+2);
conn->chosen_exit_name[0] = '$';
tor_assert(digest);
base16_encode(conn->chosen_exit_name+1,HEX_DIGEST_LEN+1,
digest, DIGEST_LEN);
}
/* Populate isolation fields. */
conn->socks_request->listener_type = CONN_TYPE_DIR_LISTENER;
conn->original_dest_address = tor_strdup(address);
conn->entry_cfg.session_group = session_group;
conn->entry_cfg.isolation_flags = isolation_flags;
base_conn->address = tor_strdup("(Tor_internal)");
tor_addr_make_unspec(&base_conn->addr);
base_conn->port = 0;
connection_link_connections(partner, base_conn);
if (connection_add(base_conn) < 0) { /* no space, forget it */
connection_free(base_conn);
return NULL;
}
base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT;
control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
/* attaching to a dirty circuit is fine */
connection_ap_mark_as_pending_circuit(conn);
log_info(LD_APP,"... application connection created and linked.");
return conn;
}
/** Notify any interested controller connections about a new hostname resolve
* or resolve error. Takes the same arguments as does
* connection_ap_handshake_socks_resolved(). */
static void
tell_controller_about_resolved_result(entry_connection_t *conn,
int answer_type,
size_t answer_len,
const char *answer,
int ttl,
time_t expires)
{
expires = time(NULL) + ttl;
if (answer_type == RESOLVED_TYPE_IPV4 && answer_len >= 4) {
char *cp = tor_dup_ip(ntohl(get_uint32(answer)));
control_event_address_mapped(conn->socks_request->address,
cp, expires, NULL, 0);
tor_free(cp);
} else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) {
char *cp = tor_strndup(answer, answer_len);
control_event_address_mapped(conn->socks_request->address,
cp, expires, NULL, 0);
tor_free(cp);
} else {
control_event_address_mapped(conn->socks_request->address,
"", time(NULL)+ttl,
"error=yes", 0);
}
}
/**
* As connection_ap_handshake_socks_resolved, but take a tor_addr_t to send
* as the answer.
*/
void
connection_ap_handshake_socks_resolved_addr(entry_connection_t *conn,
const tor_addr_t *answer,
int ttl,
time_t expires)
{
if (tor_addr_family(answer) == AF_INET) {
uint32_t a = tor_addr_to_ipv4n(answer); /* network order */
connection_ap_handshake_socks_resolved(conn,RESOLVED_TYPE_IPV4,4,
(uint8_t*)&a,
ttl, expires);
} else if (tor_addr_family(answer) == AF_INET6) {
const uint8_t *a = tor_addr_to_in6_addr8(answer);
connection_ap_handshake_socks_resolved(conn,RESOLVED_TYPE_IPV6,16,
a,
ttl, expires);
} else {
log_warn(LD_BUG, "Got called with address of unexpected family %d",
tor_addr_family(answer));
connection_ap_handshake_socks_resolved(conn,
RESOLVED_TYPE_ERROR,0,NULL,-1,-1);
}
}
/** Send an answer to an AP connection that has requested a DNS lookup via
* SOCKS. The type should be one of RESOLVED_TYPE_(IPV4|IPV6|HOSTNAME) or -1
* for unreachable; the answer should be in the format specified in the socks
* extensions document. ttl is the ttl for the answer, or -1 on
* certain errors or for values that didn't come via DNS. expires is
* a time when the answer expires, or -1 or TIME_MAX if there's a good TTL.
**/
/* XXXX the use of the ttl and expires fields is nutty. Let's make this
* interface and those that use it less ugly. */
MOCK_IMPL(void,
connection_ap_handshake_socks_resolved,(entry_connection_t *conn,
int answer_type,
size_t answer_len,
const uint8_t *answer,
int ttl,
time_t expires))
{
char buf[384];
size_t replylen;
if (ttl >= 0) {
if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
tor_addr_t a;
tor_addr_from_ipv4n(&a, get_uint32(answer));
if (! tor_addr_is_null(&a)) {
client_dns_set_addressmap(conn,
conn->socks_request->address, &a,
conn->chosen_exit_name, ttl);
}
} else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) {
tor_addr_t a;
tor_addr_from_ipv6_bytes(&a, (char*)answer);
if (! tor_addr_is_null(&a)) {
client_dns_set_addressmap(conn,
conn->socks_request->address, &a,
conn->chosen_exit_name, ttl);
}
} else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) {
char *cp = tor_strndup((char*)answer, answer_len);
client_dns_set_reverse_addressmap(conn,
conn->socks_request->address,
cp,
conn->chosen_exit_name, ttl);
tor_free(cp);
}
}
if (ENTRY_TO_EDGE_CONN(conn)->is_dns_request) {
if (conn->dns_server_request) {
/* We had a request on our DNS port: answer it. */
dnsserv_resolved(conn, answer_type, answer_len, (char*)answer, ttl);
conn->socks_request->has_finished = 1;
return;
} else {
/* This must be a request from the controller. Since answers to those
* requests are not cached, they do not generate an ADDRMAP event on
* their own. */
tell_controller_about_resolved_result(conn, answer_type, answer_len,
(char*)answer, ttl, expires);
conn->socks_request->has_finished = 1;
return;
}
/* We shouldn't need to free conn here; it gets marked by the caller. */
}
if (conn->socks_request->socks_version == 4) {
buf[0] = 0x00; /* version */
if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
buf[1] = SOCKS4_GRANTED;
set_uint16(buf+2, 0);
memcpy(buf+4, answer, 4); /* address */
replylen = SOCKS4_NETWORK_LEN;
} else { /* "error" */
buf[1] = SOCKS4_REJECT;
memset(buf+2, 0, 6);
replylen = SOCKS4_NETWORK_LEN;
}
} else if (conn->socks_request->socks_version == 5) {
/* SOCKS5 */
buf[0] = 0x05; /* version */
if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) {
buf[1] = SOCKS5_SUCCEEDED;
buf[2] = 0; /* reserved */
buf[3] = 0x01; /* IPv4 address type */
memcpy(buf+4, answer, 4); /* address */
set_uint16(buf+8, 0); /* port == 0. */
replylen = 10;
} else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) {
buf[1] = SOCKS5_SUCCEEDED;
buf[2] = 0; /* reserved */
buf[3] = 0x04; /* IPv6 address type */
memcpy(buf+4, answer, 16); /* address */
set_uint16(buf+20, 0); /* port == 0. */
replylen = 22;
} else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) {
buf[1] = SOCKS5_SUCCEEDED;
buf[2] = 0; /* reserved */
buf[3] = 0x03; /* Domainname address type */
buf[4] = (char)answer_len;
memcpy(buf+5, answer, answer_len); /* address */
set_uint16(buf+5+answer_len, 0); /* port == 0. */
replylen = 5+answer_len+2;
} else {
buf[1] = SOCKS5_HOST_UNREACHABLE;
memset(buf+2, 0, 8);
replylen = 10;
}
} else {
/* no socks version info; don't send anything back */
return;
}
connection_ap_handshake_socks_reply(conn, buf, replylen,
(answer_type == RESOLVED_TYPE_IPV4 ||
answer_type == RESOLVED_TYPE_IPV6 ||
answer_type == RESOLVED_TYPE_HOSTNAME) ?
0 : END_STREAM_REASON_RESOLVEFAILED);
}
/** Send a socks reply to stream conn, using the appropriate
* socks version, etc, and mark conn as completed with SOCKS
* handshaking.
*
* If reply is defined, then write replylen bytes of it to conn
* and return, else reply based on endreason (one of
* END_STREAM_REASON_*). If reply is undefined, endreason can't
* be 0 or REASON_DONE. Send endreason to the controller, if appropriate.
*/
void
connection_ap_handshake_socks_reply(entry_connection_t *conn, char *reply,
size_t replylen, int endreason)
{
char buf[256];
socks5_reply_status_t status =
stream_end_reason_to_socks5_response(endreason);
tor_assert(conn->socks_request); /* make sure it's an AP stream */
if (!SOCKS_COMMAND_IS_RESOLVE(conn->socks_request->command)) {
control_event_stream_status(conn, status==SOCKS5_SUCCEEDED ?
STREAM_EVENT_SUCCEEDED : STREAM_EVENT_FAILED,
endreason);
}
/* Flag this stream's circuit as having completed a stream successfully
* (for path bias) */
if (status == SOCKS5_SUCCEEDED ||
endreason == END_STREAM_REASON_RESOLVEFAILED ||
endreason == END_STREAM_REASON_CONNECTREFUSED ||
endreason == END_STREAM_REASON_CONNRESET ||
endreason == END_STREAM_REASON_NOROUTE ||
endreason == END_STREAM_REASON_RESOURCELIMIT) {
if (!conn->edge_.on_circuit ||
!CIRCUIT_IS_ORIGIN(conn->edge_.on_circuit)) {
if (endreason != END_STREAM_REASON_RESOLVEFAILED) {
log_info(LD_BUG,
"No origin circuit for successful SOCKS stream %"PRIu64
". Reason: %d",
(ENTRY_TO_CONN(conn)->global_identifier),
endreason);
}
/*
* Else DNS remaps and failed hidden service lookups can send us
* here with END_STREAM_REASON_RESOLVEFAILED; ignore it
*
* Perhaps we could make the test more precise; we can tell hidden
* services by conn->edge_.renddata != NULL; anything analogous for
* the DNS remap case?
*/
} else {
// XXX: Hrmm. It looks like optimistic data can't go through this
// codepath, but someone should probably test it and make sure.
// We don't want to mark optimistically opened streams as successful.
pathbias_mark_use_success(TO_ORIGIN_CIRCUIT(conn->edge_.on_circuit));
}
}
if (conn->socks_request->has_finished) {
log_warn(LD_BUG, "(Harmless.) duplicate calls to "
"connection_ap_handshake_socks_reply.");
return;
}
if (replylen) { /* we already have a reply in mind */
connection_buf_add(reply, replylen, ENTRY_TO_CONN(conn));
conn->socks_request->has_finished = 1;
return;
}
if (conn->socks_request->listener_type ==
CONN_TYPE_AP_HTTP_CONNECT_LISTENER) {
const char *response = end_reason_to_http_connect_response_line(endreason);
if (!response) {
response = "HTTP/1.0 400 Bad Request\r\n\r\n";
}
connection_buf_add(response, strlen(response), ENTRY_TO_CONN(conn));
} else if (conn->socks_request->socks_version == 4) {
memset(buf,0,SOCKS4_NETWORK_LEN);
buf[1] = (status==SOCKS5_SUCCEEDED ? SOCKS4_GRANTED : SOCKS4_REJECT);
/* leave version, destport, destip zero */
connection_buf_add(buf, SOCKS4_NETWORK_LEN, ENTRY_TO_CONN(conn));
} else if (conn->socks_request->socks_version == 5) {
size_t buf_len;
memset(buf,0,sizeof(buf));
if (tor_addr_family(&conn->edge_.base_.addr) == AF_INET) {
buf[0] = 5; /* version 5 */
buf[1] = (char)status;
buf[2] = 0;
buf[3] = 1; /* ipv4 addr */
/* 4 bytes for the header, 2 bytes for the port, 4 for the address. */
buf_len = 10;
} else { /* AF_INET6. */
buf[0] = 5; /* version 5 */
buf[1] = (char)status;
buf[2] = 0;
buf[3] = 4; /* ipv6 addr */
/* 4 bytes for the header, 2 bytes for the port, 16 for the address. */
buf_len = 22;
}
connection_buf_add(buf,buf_len,ENTRY_TO_CONN(conn));
}
/* If socks_version isn't 4 or 5, don't send anything.
* This can happen in the case of AP bridges. */
conn->socks_request->has_finished = 1;
return;
}
/** Read a RELAY_BEGIN or RELAY_BEGIN_DIR cell from cell, decode it, and
* place the result in bcell. On success return 0; on failure return
* <0 and set *end_reason_out to the end reason we should send back to
* the client.
*
* Return -1 in the case where we want to send a RELAY_END cell, and < -1 when
* we don't.
**/
STATIC int
begin_cell_parse(const cell_t *cell, begin_cell_t *bcell,
uint8_t *end_reason_out)
{
relay_header_t rh;
const uint8_t *body, *nul;
memset(bcell, 0, sizeof(*bcell));
*end_reason_out = END_STREAM_REASON_MISC;
relay_header_unpack(&rh, cell->payload);
if (rh.length > RELAY_PAYLOAD_SIZE) {
return -2; /*XXXX why not TORPROTOCOL? */
}
bcell->stream_id = rh.stream_id;
if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
bcell->is_begindir = 1;
return 0;
} else if (rh.command != RELAY_COMMAND_BEGIN) {
log_warn(LD_BUG, "Got an unexpected command %d", (int)rh.command);
*end_reason_out = END_STREAM_REASON_INTERNAL;
return -1;
}
body = cell->payload + RELAY_HEADER_SIZE;
nul = memchr(body, 0, rh.length);
if (! nul) {
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
"Relay begin cell has no \\0. Closing.");
*end_reason_out = END_STREAM_REASON_TORPROTOCOL;
return -1;
}
if (tor_addr_port_split(LOG_PROTOCOL_WARN,
(char*)(body),
&bcell->address,&bcell->port)<0) {
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
"Unable to parse addr:port in relay begin cell. Closing.");
*end_reason_out = END_STREAM_REASON_TORPROTOCOL;
return -1;
}
if (bcell->port == 0) {
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
"Missing port in relay begin cell. Closing.");
tor_free(bcell->address);
*end_reason_out = END_STREAM_REASON_TORPROTOCOL;
return -1;
}
if (body + rh.length >= nul + 4)
bcell->flags = ntohl(get_uint32(nul+1));
return 0;
}
/** For the given circ and the edge connection conn, setup the
* connection, attach it to the circ and connect it. Return 0 on success
* or END_CIRC_AT_ORIGIN if we can't find the requested hidden service port
* where the caller should close the circuit. */
static int
handle_hs_exit_conn(circuit_t *circ, edge_connection_t *conn)
{
int ret;
origin_circuit_t *origin_circ;
assert_circuit_ok(circ);
tor_assert(circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED);
tor_assert(conn);
log_debug(LD_REND, "Connecting the hidden service rendezvous circuit "
"to the service destination.");
origin_circ = TO_ORIGIN_CIRCUIT(circ);
conn->base_.address = tor_strdup("(rendezvous)");
conn->base_.state = EXIT_CONN_STATE_CONNECTING;
/* The circuit either has an hs identifier for v3+ or a rend_data for legacy
* service. */
if (origin_circ->rend_data) {
conn->rend_data = rend_data_dup(origin_circ->rend_data);
tor_assert(connection_edge_is_rendezvous_stream(conn));
ret = rend_service_set_connection_addr_port(conn, origin_circ);
} else if (origin_circ->hs_ident) {
/* Setup the identifier to be the one for the circuit service. */
conn->hs_ident =
hs_ident_edge_conn_new(&origin_circ->hs_ident->identity_pk);
tor_assert(connection_edge_is_rendezvous_stream(conn));
ret = hs_service_set_conn_addr_port(origin_circ, conn);
} else {
/* We should never get here if the circuit's purpose is rendezvous. */
tor_assert_nonfatal_unreached();
return -1;
}
if (ret < 0) {
log_info(LD_REND, "Didn't find rendezvous service (addr%s, port %d)",
fmt_addr(&TO_CONN(conn)->addr), TO_CONN(conn)->port);
/* Send back reason DONE because we want to make hidden service port
* scanning harder thus instead of returning that the exit policy
* didn't match, which makes it obvious that the port is closed,
* return DONE and kill the circuit. That way, a user (malicious or
* not) needs one circuit per bad port unless it matches the policy of
* the hidden service. */
relay_send_end_cell_from_edge(conn->stream_id, circ,
END_STREAM_REASON_DONE,
origin_circ->cpath->prev);
connection_free_(TO_CONN(conn));
/* Drop the circuit here since it might be someone deliberately
* scanning the hidden service ports. Note that this mitigates port
* scanning by adding more work on the attacker side to successfully
* scan but does not fully solve it. */
if (ret < -1) {
return END_CIRC_AT_ORIGIN;
} else {
return 0;
}
}
/* Link the circuit and the connection crypt path. */
conn->cpath_layer = origin_circ->cpath->prev;
/* If this is the first stream on this circuit, tell circpad */
if (!origin_circ->p_streams)
circpad_machine_event_circ_has_streams(origin_circ);
/* Add it into the linked list of p_streams on this circuit */
conn->next_stream = origin_circ->p_streams;
origin_circ->p_streams = conn;
conn->on_circuit = circ;
assert_circuit_ok(circ);
hs_inc_rdv_stream_counter(origin_circ);
/* If it's an onion service connection, we might want to include the proxy
* protocol header: */
if (conn->hs_ident) {
hs_circuit_id_protocol_t circuit_id_protocol =
hs_service_exports_circuit_id(&conn->hs_ident->identity_pk);
export_hs_client_circuit_id(conn, circuit_id_protocol);
}
/* Connect tor to the hidden service destination. */
connection_exit_connect(conn);
/* For path bias: This circuit was used successfully */
pathbias_mark_use_success(origin_circ);
return 0;
}
/** A relay 'begin' or 'begin_dir' cell has arrived, and either we are
* an exit hop for the circuit, or we are the origin and it is a
* rendezvous begin.
*
* Launch a new exit connection and initialize things appropriately.
*
* If it's a rendezvous stream, call connection_exit_connect() on
* it.
*
* For general streams, call dns_resolve() on it first, and only call
* connection_exit_connect() if the dns answer is already known.
*
* Note that we don't call connection_add() on the new stream! We wait
* for connection_exit_connect() to do that.
*
* Return -(some circuit end reason) if we want to tear down circ.
* Else return 0.
*/
int
connection_exit_begin_conn(cell_t *cell, circuit_t *circ)
{
edge_connection_t *n_stream;
relay_header_t rh;
char *address = NULL;
uint16_t port = 0;
or_circuit_t *or_circ = NULL;
origin_circuit_t *origin_circ = NULL;
crypt_path_t *layer_hint = NULL;
const or_options_t *options = get_options();
begin_cell_t bcell;
int rv;
uint8_t end_reason=0;
assert_circuit_ok(circ);
if (!CIRCUIT_IS_ORIGIN(circ)) {
or_circ = TO_OR_CIRCUIT(circ);
} else {
tor_assert(circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED);
origin_circ = TO_ORIGIN_CIRCUIT(circ);
layer_hint = origin_circ->cpath->prev;
}
relay_header_unpack(&rh, cell->payload);
if (rh.length > RELAY_PAYLOAD_SIZE)
return -END_CIRC_REASON_TORPROTOCOL;
if (!server_mode(options) &&
circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) {
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
"Relay begin cell at non-server. Closing.");
relay_send_end_cell_from_edge(rh.stream_id, circ,
END_STREAM_REASON_EXITPOLICY, NULL);
return 0;
}
rv = begin_cell_parse(cell, &bcell, &end_reason);
if (rv < -1) {
return -END_CIRC_REASON_TORPROTOCOL;
} else if (rv == -1) {
tor_free(bcell.address);
relay_send_end_cell_from_edge(rh.stream_id, circ, end_reason, layer_hint);
return 0;
}
if (! bcell.is_begindir) {
/* Steal reference */
tor_assert(bcell.address);
address = bcell.address;
port = bcell.port;
if (or_circ && or_circ->p_chan) {
const int client_chan = channel_is_client(or_circ->p_chan);
if ((client_chan ||
(!connection_or_digest_is_known_relay(
or_circ->p_chan->identity_digest) &&
should_refuse_unknown_exits(options)))) {
/* Don't let clients use us as a single-hop proxy. It attracts
* attackers and users who'd be better off with, well, single-hop
* proxies. */
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
"Attempt by %s to open a stream %s. Closing.",
safe_str(channel_get_canonical_remote_descr(or_circ->p_chan)),
client_chan ? "on first hop of circuit" :
"from unknown relay");
relay_send_end_cell_from_edge(rh.stream_id, circ,
client_chan ?
END_STREAM_REASON_TORPROTOCOL :
END_STREAM_REASON_MISC,
NULL);
tor_free(address);
return 0;
}
}
} else if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
if (!directory_permits_begindir_requests(options) ||
circ->purpose != CIRCUIT_PURPOSE_OR) {
relay_send_end_cell_from_edge(rh.stream_id, circ,
END_STREAM_REASON_NOTDIRECTORY, layer_hint);
return 0;
}
/* Make sure to get the 'real' address of the previous hop: the
* caller might want to know whether the remote IP address has changed,
* and we might already have corrected base_.addr[ess] for the relay's
* canonical IP address. */
if (or_circ && or_circ->p_chan)
address = tor_strdup(channel_get_actual_remote_address(or_circ->p_chan));
else
address = tor_strdup("127.0.0.1");
port = 1; /* XXXX This value is never actually used anywhere, and there
* isn't "really" a connection here. But we
* need to set it to something nonzero. */
} else {
log_warn(LD_BUG, "Got an unexpected command %d", (int)rh.command);
relay_send_end_cell_from_edge(rh.stream_id, circ,
END_STREAM_REASON_INTERNAL, layer_hint);
return 0;
}
if (! options->IPv6Exit) {
/* I don't care if you prefer IPv6; I can't give you any. */
bcell.flags &= ~BEGIN_FLAG_IPV6_PREFERRED;
/* If you don't want IPv4, I can't help. */
if (bcell.flags & BEGIN_FLAG_IPV4_NOT_OK) {
tor_free(address);
relay_send_end_cell_from_edge(rh.stream_id, circ,
END_STREAM_REASON_EXITPOLICY, layer_hint);
return 0;
}
}
log_debug(LD_EXIT,"Creating new exit connection.");
/* The 'AF_INET' here is temporary; we might need to change it later in
* connection_exit_connect(). */
n_stream = edge_connection_new(CONN_TYPE_EXIT, AF_INET);
/* Remember the tunneled request ID in the new edge connection, so that
* we can measure download times. */
n_stream->dirreq_id = circ->dirreq_id;
n_stream->base_.purpose = EXIT_PURPOSE_CONNECT;
n_stream->begincell_flags = bcell.flags;
n_stream->stream_id = rh.stream_id;
n_stream->base_.port = port;
/* leave n_stream->s at -1, because it's not yet valid */
n_stream->package_window = STREAMWINDOW_START;
n_stream->deliver_window = STREAMWINDOW_START;
if (circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED) {
int ret;
tor_free(address);
/* We handle this circuit and stream in this function for all supported
* hidden service version. */
ret = handle_hs_exit_conn(circ, n_stream);
if (ret == 0) {
/* This was a valid cell. Count it as delivered + overhead. */
circuit_read_valid_data(origin_circ, rh.length);
}
return ret;
}
tor_strlower(address);
n_stream->base_.address = address;
n_stream->base_.state = EXIT_CONN_STATE_RESOLVEFAILED;
/* default to failed, change in dns_resolve if it turns out not to fail */
/* If we're hibernating or shutting down, we refuse to open new streams. */
if (we_are_hibernating()) {
relay_send_end_cell_from_edge(rh.stream_id, circ,
END_STREAM_REASON_HIBERNATING, NULL);
connection_free_(TO_CONN(n_stream));
return 0;
}
n_stream->on_circuit = circ;
if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
tor_addr_t tmp_addr;
tor_assert(or_circ);
if (or_circ->p_chan &&
channel_get_addr_if_possible(or_circ->p_chan, &tmp_addr)) {
tor_addr_copy(&n_stream->base_.addr, &tmp_addr);
}
return connection_exit_connect_dir(n_stream);
}
log_debug(LD_EXIT,"about to start the dns_resolve().");
/* send it off to the gethostbyname farm */
switch (dns_resolve(n_stream)) {
case 1: /* resolve worked; now n_stream is attached to circ. */
assert_circuit_ok(circ);
log_debug(LD_EXIT,"about to call connection_exit_connect().");
connection_exit_connect(n_stream);
return 0;
case -1: /* resolve failed */
relay_send_end_cell_from_edge(rh.stream_id, circ,
END_STREAM_REASON_RESOLVEFAILED, NULL);
/* n_stream got freed. don't touch it. */
break;
case 0: /* resolve added to pending list */
assert_circuit_ok(circ);
break;
}
return 0;
}
/**
* Called when we receive a RELAY_COMMAND_RESOLVE cell 'cell' along the
* circuit circ;
* begin resolving the hostname, and (eventually) reply with a RESOLVED cell.
*/
int
connection_exit_begin_resolve(cell_t *cell, or_circuit_t *circ)
{
edge_connection_t *dummy_conn;
relay_header_t rh;
assert_circuit_ok(TO_CIRCUIT(circ));
relay_header_unpack(&rh, cell->payload);
if (rh.length > RELAY_PAYLOAD_SIZE)
return -1;
/* This 'dummy_conn' only exists to remember the stream ID
* associated with the resolve request; and to make the
* implementation of dns.c more uniform. (We really only need to
* remember the circuit, the stream ID, and the hostname to be
* resolved; but if we didn't store them in a connection like this,
* the housekeeping in dns.c would get way more complicated.)
*/
dummy_conn = edge_connection_new(CONN_TYPE_EXIT, AF_INET);
dummy_conn->stream_id = rh.stream_id;
dummy_conn->base_.address = tor_strndup(
(char*)cell->payload+RELAY_HEADER_SIZE,
rh.length);
dummy_conn->base_.port = 0;
dummy_conn->base_.state = EXIT_CONN_STATE_RESOLVEFAILED;
dummy_conn->base_.purpose = EXIT_PURPOSE_RESOLVE;
dummy_conn->on_circuit = TO_CIRCUIT(circ);
/* send it off to the gethostbyname farm */
switch (dns_resolve(dummy_conn)) {
case -1: /* Impossible to resolve; a resolved cell was sent. */
/* Connection freed; don't touch it. */
return 0;
case 1: /* The result was cached; a resolved cell was sent. */
if (!dummy_conn->base_.marked_for_close)
connection_free_(TO_CONN(dummy_conn));
return 0;
case 0: /* resolve added to pending list */
assert_circuit_ok(TO_CIRCUIT(circ));
break;
}
return 0;
}
/** Helper: Return true and set *why_rejected to an optional clarifying
* message message iff we do not allow connections to addr:port.
*/
static int
my_exit_policy_rejects(const tor_addr_t *addr,
uint16_t port,
const char **why_rejected)
{
if (router_compare_to_my_exit_policy(addr, port)) {
*why_rejected = "";
return 1;
} else if (tor_addr_family(addr) == AF_INET6 && !get_options()->IPv6Exit) {
*why_rejected = " (IPv6 address without IPv6Exit configured)";
return 1;
}
return 0;
}
/** Connect to conn's specified addr and port. If it worked, conn
* has now been added to the connection_array.
*
* Send back a connected cell. Include the resolved IP of the destination
* address, but only if it's a general exit stream. (Rendezvous
* streams must not reveal what IP they connected to.)
*/
void
connection_exit_connect(edge_connection_t *edge_conn)
{
const tor_addr_t *addr;
uint16_t port;
connection_t *conn = TO_CONN(edge_conn);
int socket_error = 0, result;
const char *why_failed_exit_policy = NULL;
/* Apply exit policy to non-rendezvous connections. */
if (! connection_edge_is_rendezvous_stream(edge_conn) &&
my_exit_policy_rejects(&edge_conn->base_.addr,
edge_conn->base_.port,
&why_failed_exit_policy)) {
if (BUG(!why_failed_exit_policy))
why_failed_exit_policy = "";
log_info(LD_EXIT,"%s:%d failed exit policy%s. Closing.",
escaped_safe_str_client(conn->address), conn->port,
why_failed_exit_policy);
connection_edge_end(edge_conn, END_STREAM_REASON_EXITPOLICY);
circuit_detach_stream(circuit_get_by_edge_conn(edge_conn), edge_conn);
connection_free(conn);
return;
}
#ifdef HAVE_SYS_UN_H
if (conn->socket_family != AF_UNIX) {
#else
{
#endif /* defined(HAVE_SYS_UN_H) */
addr = &conn->addr;
port = conn->port;
if (tor_addr_family(addr) == AF_INET6)
conn->socket_family = AF_INET6;
log_debug(LD_EXIT, "about to try connecting");
result = connection_connect(conn, conn->address,
addr, port, &socket_error);
#ifdef HAVE_SYS_UN_H
} else {
/*
* In the AF_UNIX case, we expect to have already had conn->port = 1,
* tor_addr_make_unspec(conn->addr) (cf. the way we mark in the incoming
* case in connection_handle_listener_read()), and conn->address should
* have the socket path to connect to.
*/
tor_assert(conn->address && strlen(conn->address) > 0);
log_debug(LD_EXIT, "about to try connecting");
result = connection_connect_unix(conn, conn->address, &socket_error);
#endif /* defined(HAVE_SYS_UN_H) */
}
switch (result) {
case -1: {
int reason = errno_to_stream_end_reason(socket_error);
connection_edge_end(edge_conn, reason);
circuit_detach_stream(circuit_get_by_edge_conn(edge_conn), edge_conn);
connection_free(conn);
return;
}
case 0:
conn->state = EXIT_CONN_STATE_CONNECTING;
connection_watch_events(conn, READ_EVENT | WRITE_EVENT);
/* writable indicates finish;
* readable/error indicates broken link in windows-land. */
return;
/* case 1: fall through */
}
conn->state = EXIT_CONN_STATE_OPEN;
if (connection_get_outbuf_len(conn)) {
/* in case there are any queued data cells, from e.g. optimistic data */
connection_watch_events(conn, READ_EVENT|WRITE_EVENT);
} else {
connection_watch_events(conn, READ_EVENT);
}
/* also, deliver a 'connected' cell back through the circuit. */
if (connection_edge_is_rendezvous_stream(edge_conn)) {
/* don't send an address back! */
connection_edge_send_command(edge_conn,
RELAY_COMMAND_CONNECTED,
NULL, 0);
} else { /* normal stream */
uint8_t connected_payload[MAX_CONNECTED_CELL_PAYLOAD_LEN];
int connected_payload_len =
connected_cell_format_payload(connected_payload, &conn->addr,
edge_conn->address_ttl);
if (connected_payload_len < 0) {
connection_edge_end(edge_conn, END_STREAM_REASON_INTERNAL);
circuit_detach_stream(circuit_get_by_edge_conn(edge_conn), edge_conn);
connection_free(conn);
return;
}
connection_edge_send_command(edge_conn,
RELAY_COMMAND_CONNECTED,
(char*)connected_payload,
connected_payload_len);
}
}
/** Given an exit conn that should attach to us as a directory server, open a
* bridge connection with a linked connection pair, create a new directory
* conn, and join them together. Return 0 on success (or if there was an
* error we could send back an end cell for). Return -(some circuit end
* reason) if the circuit needs to be torn down. Either connects
* exitconn, frees it, or marks it, as appropriate.
*/
static int
connection_exit_connect_dir(edge_connection_t *exitconn)
{
dir_connection_t *dirconn = NULL;
or_circuit_t *circ = TO_OR_CIRCUIT(exitconn->on_circuit);
log_info(LD_EXIT, "Opening local connection for anonymized directory exit");
exitconn->base_.state = EXIT_CONN_STATE_OPEN;
dirconn = dir_connection_new(tor_addr_family(&exitconn->base_.addr));
tor_addr_copy(&dirconn->base_.addr, &exitconn->base_.addr);
dirconn->base_.port = 0;
dirconn->base_.address = tor_strdup(exitconn->base_.address);
dirconn->base_.type = CONN_TYPE_DIR;
dirconn->base_.purpose = DIR_PURPOSE_SERVER;
dirconn->base_.state = DIR_CONN_STATE_SERVER_COMMAND_WAIT;
/* Note that the new dir conn belongs to the same tunneled request as
* the edge conn, so that we can measure download times. */
dirconn->dirreq_id = exitconn->dirreq_id;
connection_link_connections(TO_CONN(dirconn), TO_CONN(exitconn));
if (connection_add(TO_CONN(exitconn))<0) {
connection_edge_end(exitconn, END_STREAM_REASON_RESOURCELIMIT);
connection_free_(TO_CONN(exitconn));
connection_free_(TO_CONN(dirconn));
return 0;
}
/* link exitconn to circ, now that we know we can use it. */
exitconn->next_stream = circ->n_streams;
circ->n_streams = exitconn;
if (connection_add(TO_CONN(dirconn))<0) {
connection_edge_end(exitconn, END_STREAM_REASON_RESOURCELIMIT);
connection_close_immediate(TO_CONN(exitconn));
connection_mark_for_close(TO_CONN(exitconn));
connection_free_(TO_CONN(dirconn));
return 0;
}
connection_start_reading(TO_CONN(dirconn));
connection_start_reading(TO_CONN(exitconn));
if (connection_edge_send_command(exitconn,
RELAY_COMMAND_CONNECTED, NULL, 0) < 0) {
connection_mark_for_close(TO_CONN(exitconn));
connection_mark_for_close(TO_CONN(dirconn));
return 0;
}
return 0;
}
/** Return 1 if conn is a rendezvous stream, or 0 if
* it is a general stream.
*/
int
connection_edge_is_rendezvous_stream(const edge_connection_t *conn)
{
tor_assert(conn);
/* It should not be possible to set both of these structs */
tor_assert_nonfatal(!(conn->rend_data && conn->hs_ident));
if (conn->rend_data || conn->hs_ident) {
return 1;
}
return 0;
}
/** Return 1 if router exit_node is likely to allow stream conn
* to exit from it, or 0 if it probably will not allow it.
* (We might be uncertain if conn's destination address has not yet been
* resolved.)
*/
int
connection_ap_can_use_exit(const entry_connection_t *conn,
const node_t *exit_node)
{
const or_options_t *options = get_options();
tor_assert(conn);
tor_assert(conn->socks_request);
tor_assert(exit_node);
/* If a particular exit node has been requested for the new connection,
* make sure the exit node of the existing circuit matches exactly.
*/
if (conn->chosen_exit_name) {
const node_t *chosen_exit =
node_get_by_nickname(conn->chosen_exit_name, 0);
if (!chosen_exit || tor_memneq(chosen_exit->identity,
exit_node->identity, DIGEST_LEN)) {
/* doesn't match */
// log_debug(LD_APP,"Requested node '%s', considering node '%s'. No.",
// conn->chosen_exit_name, exit->nickname);
return 0;
}
}
if (conn->use_begindir) {
/* Internal directory fetches do not count as exiting. */
return 1;
}
if (conn->socks_request->command == SOCKS_COMMAND_CONNECT) {
tor_addr_t addr, *addrp = NULL;
addr_policy_result_t r;
if (0 == tor_addr_parse(&addr, conn->socks_request->address)) {
addrp = &addr;
} else if (!conn->entry_cfg.ipv4_traffic && conn->entry_cfg.ipv6_traffic) {
tor_addr_make_null(&addr, AF_INET6);
addrp = &addr;
} else if (conn->entry_cfg.ipv4_traffic && !conn->entry_cfg.ipv6_traffic) {
tor_addr_make_null(&addr, AF_INET);
addrp = &addr;
}
r = compare_tor_addr_to_node_policy(addrp, conn->socks_request->port,
exit_node);
if (r == ADDR_POLICY_REJECTED)
return 0; /* We know the address, and the exit policy rejects it. */
if (r == ADDR_POLICY_PROBABLY_REJECTED && !conn->chosen_exit_name)
return 0; /* We don't know the addr, but the exit policy rejects most
* addresses with this port. Since the user didn't ask for
* this node, err on the side of caution. */
} else if (SOCKS_COMMAND_IS_RESOLVE(conn->socks_request->command)) {
/* Don't send DNS requests to non-exit servers by default. */
if (!conn->chosen_exit_name && node_exit_policy_rejects_all(exit_node))
return 0;
}
if (routerset_contains_node(options->ExcludeExitNodesUnion_, exit_node)) {
/* Not a suitable exit. Refuse it. */
return 0;
}
return 1;
}
/** If address is of the form "y.onion" with a well-formed handle y:
* Put a NUL after y, lower-case it, and return ONION_V2_HOSTNAME or
* ONION_V3_HOSTNAME depending on the HS version.
*
* If address is of the form "x.y.onion" with a well-formed handle x:
* Drop "x.", put a NUL after y, lower-case it, and return
* ONION_V2_HOSTNAME or ONION_V3_HOSTNAME depending on the HS version.
*
* If address is of the form "y.onion" with a badly-formed handle y:
* Return BAD_HOSTNAME and log a message.
*
* If address is of the form "y.exit":
* Put a NUL after y and return EXIT_HOSTNAME.
*
* Otherwise:
* Return NORMAL_HOSTNAME and change nothing.
*/
hostname_type_t
parse_extended_hostname(char *address)
{
char *s;
char *q;
char query[HS_SERVICE_ADDR_LEN_BASE32+1];
s = strrchr(address,'.');
if (!s)
return NORMAL_HOSTNAME; /* no dot, thus normal */
if (!strcmp(s+1,"exit")) {
*s = 0; /* NUL-terminate it */
return EXIT_HOSTNAME; /* .exit */
}
if (strcmp(s+1,"onion"))
return NORMAL_HOSTNAME; /* neither .exit nor .onion, thus normal */
/* so it is .onion */
*s = 0; /* NUL-terminate it */
/* locate a 'sub-domain' component, in order to remove it */
q = strrchr(address, '.');
if (q == address) {
goto failed; /* reject sub-domain, as DNS does */
}
q = (NULL == q) ? address : q + 1;
if (strlcpy(query, q, HS_SERVICE_ADDR_LEN_BASE32+1) >=
HS_SERVICE_ADDR_LEN_BASE32+1)
goto failed;
if (q != address) {
memmove(address, q, strlen(q) + 1 /* also get \0 */);
}
if (rend_valid_v2_service_id(query)) {
return ONION_V2_HOSTNAME; /* success */
}
if (hs_address_is_valid(query)) {
return ONION_V3_HOSTNAME;
}
failed:
/* otherwise, return to previous state and return 0 */
*s = '.';
log_warn(LD_APP, "Invalid onion hostname %s; rejecting",
safe_str_client(address));
return BAD_HOSTNAME;
}
/** Return true iff the (possibly NULL) alen-byte chunk of memory at
* a is equal to the (possibly NULL) blen-byte chunk of memory
* at b. */
static int
memeq_opt(const char *a, size_t alen, const char *b, size_t blen)
{
if (a == NULL) {
return (b == NULL);
} else if (b == NULL) {
return 0;
} else if (alen != blen) {
return 0;
} else {
return tor_memeq(a, b, alen);
}
}
/**
* Return true iff none of the isolation flags and fields in conn
* should prevent it from being attached to circ.
*/
int
connection_edge_compatible_with_circuit(const entry_connection_t *conn,
const origin_circuit_t *circ)
{
const uint8_t iso = conn->entry_cfg.isolation_flags;
const socks_request_t *sr = conn->socks_request;
/* If circ has never been used for an isolated connection, we can
* totally use it for this one. */
if (!circ->isolation_values_set)
return 1;
/* If circ has been used for connections having more than one value
* for some field f, it will have the corresponding bit set in
* isolation_flags_mixed. If isolation_flags_mixed has any bits
* in common with iso, then conn must be isolated from at least
* one stream that has been attached to circ. */
if ((iso & circ->isolation_flags_mixed) != 0) {
/* For at least one field where conn is isolated, the circuit
* already has mixed streams. */
return 0;
}
if (! conn->original_dest_address) {
log_warn(LD_BUG, "Reached connection_edge_compatible_with_circuit without "
"having set conn->original_dest_address");
((entry_connection_t*)conn)->original_dest_address =
tor_strdup(conn->socks_request->address);
}
if ((iso & ISO_STREAM) &&
(circ->associated_isolated_stream_global_id !=
ENTRY_TO_CONN(conn)->global_identifier))
return 0;
if ((iso & ISO_DESTPORT) && conn->socks_request->port != circ->dest_port)
return 0;
if ((iso & ISO_DESTADDR) &&
strcasecmp(conn->original_dest_address, circ->dest_address))
return 0;
if ((iso & ISO_SOCKSAUTH) &&
(! memeq_opt(sr->username, sr->usernamelen,
circ->socks_username, circ->socks_username_len) ||
! memeq_opt(sr->password, sr->passwordlen,
circ->socks_password, circ->socks_password_len)))
return 0;
if ((iso & ISO_CLIENTPROTO) &&
(conn->socks_request->listener_type != circ->client_proto_type ||
conn->socks_request->socks_version != circ->client_proto_socksver))
return 0;
if ((iso & ISO_CLIENTADDR) &&
!tor_addr_eq(&ENTRY_TO_CONN(conn)->addr, &circ->client_addr))
return 0;
if ((iso & ISO_SESSIONGRP) &&
conn->entry_cfg.session_group != circ->session_group)
return 0;
if ((iso & ISO_NYM_EPOCH) && conn->nym_epoch != circ->nym_epoch)
return 0;
return 1;
}
/**
* If dry_run is false, update circ's isolation flags and fields
* to reflect having had conn attached to it, and return 0. Otherwise,
* if dry_run is true, then make no changes to circ, and return
* a bitfield of isolation flags that we would have to set in
* isolation_flags_mixed to add conn to circ, or -1 if
* circ has had no streams attached to it.
*/
int
connection_edge_update_circuit_isolation(const entry_connection_t *conn,
origin_circuit_t *circ,
int dry_run)
{
const socks_request_t *sr = conn->socks_request;
if (! conn->original_dest_address) {
log_warn(LD_BUG, "Reached connection_update_circuit_isolation without "
"having set conn->original_dest_address");
((entry_connection_t*)conn)->original_dest_address =
tor_strdup(conn->socks_request->address);
}
if (!circ->isolation_values_set) {
if (dry_run)
return -1;
circ->associated_isolated_stream_global_id =
ENTRY_TO_CONN(conn)->global_identifier;
circ->dest_port = conn->socks_request->port;
circ->dest_address = tor_strdup(conn->original_dest_address);
circ->client_proto_type = conn->socks_request->listener_type;
circ->client_proto_socksver = conn->socks_request->socks_version;
tor_addr_copy(&circ->client_addr, &ENTRY_TO_CONN(conn)->addr);
circ->session_group = conn->entry_cfg.session_group;
circ->nym_epoch = conn->nym_epoch;
circ->socks_username = sr->username ?
tor_memdup(sr->username, sr->usernamelen) : NULL;
circ->socks_password = sr->password ?
tor_memdup(sr->password, sr->passwordlen) : NULL;
circ->socks_username_len = sr->usernamelen;
circ->socks_password_len = sr->passwordlen;
circ->isolation_values_set = 1;
return 0;
} else {
uint8_t mixed = 0;
if (conn->socks_request->port != circ->dest_port)
mixed |= ISO_DESTPORT;
if (strcasecmp(conn->original_dest_address, circ->dest_address))
mixed |= ISO_DESTADDR;
if (!memeq_opt(sr->username, sr->usernamelen,
circ->socks_username, circ->socks_username_len) ||
!memeq_opt(sr->password, sr->passwordlen,
circ->socks_password, circ->socks_password_len))
mixed |= ISO_SOCKSAUTH;
if ((conn->socks_request->listener_type != circ->client_proto_type ||
conn->socks_request->socks_version != circ->client_proto_socksver))
mixed |= ISO_CLIENTPROTO;
if (!tor_addr_eq(&ENTRY_TO_CONN(conn)->addr, &circ->client_addr))
mixed |= ISO_CLIENTADDR;
if (conn->entry_cfg.session_group != circ->session_group)
mixed |= ISO_SESSIONGRP;
if (conn->nym_epoch != circ->nym_epoch)
mixed |= ISO_NYM_EPOCH;
if (dry_run)
return mixed;
if ((mixed & conn->entry_cfg.isolation_flags) != 0) {
log_warn(LD_BUG, "Updating a circuit with seemingly incompatible "
"isolation flags.");
}
circ->isolation_flags_mixed |= mixed;
return 0;
}
}
/**
* Clear the isolation settings on circ.
*
* This only works on an open circuit that has never had a stream attached to
* it, and whose isolation settings are hypothetical. (We set hypothetical
* isolation settings on circuits as we're launching them, so that we
* know whether they can handle more streams or whether we need to launch
* even more circuits. Once the circuit is open, if it turns out that
* we no longer have any streams to attach to it, we clear the isolation flags
* and data so that other streams can have a chance.)
*/
void
circuit_clear_isolation(origin_circuit_t *circ)
{
if (circ->isolation_any_streams_attached) {
log_warn(LD_BUG, "Tried to clear the isolation status of a dirty circuit");
return;
}
if (TO_CIRCUIT(circ)->state != CIRCUIT_STATE_OPEN) {
log_warn(LD_BUG, "Tried to clear the isolation status of a non-open "
"circuit");
return;
}
circ->isolation_values_set = 0;
circ->isolation_flags_mixed = 0;
circ->associated_isolated_stream_global_id = 0;
circ->client_proto_type = 0;
circ->client_proto_socksver = 0;
circ->dest_port = 0;
tor_addr_make_unspec(&circ->client_addr);
tor_free(circ->dest_address);
circ->session_group = -1;
circ->nym_epoch = 0;
if (circ->socks_username) {
memwipe(circ->socks_username, 0x11, circ->socks_username_len);
tor_free(circ->socks_username);
}
if (circ->socks_password) {
memwipe(circ->socks_password, 0x05, circ->socks_password_len);
tor_free(circ->socks_password);
}
circ->socks_username_len = circ->socks_password_len = 0;
}
/** Send an END and mark for close the given edge connection conn using the
* given reason that has to be a stream reason.
*
* Note: We don't unattached the AP connection (if applicable) because we
* don't want to flush the remaining data. This function aims at ending
* everything quickly regardless of the connection state.
*
* This function can't fail and does nothing if conn is NULL. */
void
connection_edge_end_close(edge_connection_t *conn, uint8_t reason)
{
if (!conn) {
return;
}
connection_edge_end(conn, reason);
connection_mark_for_close(TO_CONN(conn));
}
/** Free all storage held in module-scoped variables for connection_edge.c */
void
connection_edge_free_all(void)
{
untried_pending_connections = 0;
smartlist_free(pending_entry_connections);
pending_entry_connections = NULL;
mainloop_event_free(attach_pending_entry_connections_ev);
}