src/core/or/origin_circuit_st.h

   1 /* Copyright (c) 2001 Matej Pfajfar.
   2  * Copyright (c) 2001-2004, Roger Dingledine.
   3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
   4  * Copyright (c) 2007-2019, The Tor Project, Inc. */
   5 /* See LICENSE for licensing information */
   6
   7 #ifndef ORIGIN_CIRCUIT_ST_H
   8 #define ORIGIN_CIRCUIT_ST_H
   9
  10 #include "core/or/or.h"
  11
  12 #include "core/or/circuit_st.h"
  13
  14 struct onion_queue_t;
  15
  16 /**
  17  * Describes the circuit building process in simplified terms based
  18  * on the path bias accounting state for a circuit.
  19  *
  20  * NOTE: These state values are enumerated in the order for which we
  21  * expect circuits to transition through them. If you add states,
  22  * you need to preserve this overall ordering. The various pathbias
  23  * state transition and accounting functions (pathbias_mark_* and
  24  * pathbias_count_*) contain ordinal comparisons to enforce proper
  25  * state transitions for corrections.
  26  *
  27  * This state machine and the associated logic was created to prevent
  28  * miscounting due to unknown cases of circuit reuse. See also tickets
  29  * #6475 and #7802.
  30  */
  31 enum path_state_t {
  32     /** This circuit is "new". It has not yet completed a first hop
  33      * or been counted by the path bias code. */
  34     PATH_STATE_NEW_CIRC = 0,
  35     /** This circuit has completed one/two hops, and has been counted by
  36      * the path bias logic. */
  37     PATH_STATE_BUILD_ATTEMPTED = 1,
  38     /** This circuit has been completely built */
  39     PATH_STATE_BUILD_SUCCEEDED = 2,
  40     /** Did we try to attach any SOCKS streams or hidserv introductions to
  41       * this circuit?
  42       *
  43       * Note: If we ever implement end-to-end stream timing through test
  44       * stream probes (#5707), we must *not* set this for those probes
  45       * (or any other automatic streams) because the adversary could
  46       * just tag at a later point.
  47       */
  48     PATH_STATE_USE_ATTEMPTED = 3,
  49     /** Did any SOCKS streams or hidserv introductions actually succeed on
  50       * this circuit?
  51       *
  52       * If any streams detatch/fail from this circuit, the code transitions
  53       * the circuit back to PATH_STATE_USE_ATTEMPTED to ensure we probe. See
  54       * pathbias_mark_use_rollback() for that.
  55       */
  56     PATH_STATE_USE_SUCCEEDED = 4,
  57
  58     /**
  59      * This is a special state to indicate that we got a corrupted
  60      * relay cell on a circuit and we don't intend to probe it.
  61      */
  62     PATH_STATE_USE_FAILED = 5,
  63
  64     /**
  65      * This is a special state to indicate that we already counted
  66      * the circuit. Used to guard against potential state machine
  67      * violations.
  68      */
  69     PATH_STATE_ALREADY_COUNTED = 6,
  70 };
  71
  72 /** An origin_circuit_t holds data necessary to build and use a circuit.
  73  */
  74 struct origin_circuit_t {
  75   circuit_t base_;
  76
  77   /** Linked list of AP streams (or EXIT streams if hidden service)
  78    * associated with this circuit. */
  79   edge_connection_t *p_streams;
  80
  81   /** Smartlist of half-closed streams (half_edge_t*) that still
  82    * have pending activity */
  83   smartlist_t *half_streams;
  84
  85   /** Bytes read on this circuit since last call to
  86    * control_event_circ_bandwidth_used().  Only used if we're configured
  87    * to emit CIRC_BW events. */
  88   uint32_t n_read_circ_bw;
  89
  90   /** Bytes written to on this circuit since last call to
  91    * control_event_circ_bandwidth_used().  Only used if we're configured
  92    * to emit CIRC_BW events. */
  93   uint32_t n_written_circ_bw;
  94
  95   /** Total known-valid relay cell bytes since last call to
  96    * control_event_circ_bandwidth_used().  Only used if we're configured
  97    * to emit CIRC_BW events. */
  98   uint32_t n_delivered_read_circ_bw;
  99
 100   /** Total written relay cell bytes since last call to
 101    * control_event_circ_bandwidth_used().  Only used if we're configured
 102    * to emit CIRC_BW events. */
 103   uint32_t n_delivered_written_circ_bw;
 104
 105   /** Total overhead data in all known-valid relay data cells since last
 106    * call to control_event_circ_bandwidth_used().  Only used if we're
 107    * configured to emit CIRC_BW events. */
 108   uint32_t n_overhead_read_circ_bw;
 109
 110   /** Total written overhead data in all relay data cells since last call to
 111    * control_event_circ_bandwidth_used().  Only used if we're configured
 112    * to emit CIRC_BW events. */
 113   uint32_t n_overhead_written_circ_bw;
 114
 115   /** Build state for this circuit. It includes the intended path
 116    * length, the chosen exit router, rendezvous information, etc.
 117    */
 118   cpath_build_state_t *build_state;
 119   /** The doubly-linked list of crypt_path_t entries, one per hop,
 120    * for this circuit. This includes ciphers for each hop,
 121    * integrity-checking digests for each hop, and package/delivery
 122    * windows for each hop.
 123    */
 124   crypt_path_t *cpath;
 125
 126   /** Holds all rendezvous data on either client or service side. */
 127   rend_data_t *rend_data;
 128
 129   /** Holds hidden service identifier on either client or service side. This
 130    * is for both introduction and rendezvous circuit. */
 131   struct hs_ident_circuit_t *hs_ident;
 132
 133   /** Holds the data that the entry guard system uses to track the
 134    * status of the guard this circuit is using, and thereby to determine
 135    * whether this circuit can be used. */
 136   struct circuit_guard_state_t *guard_state;
 137
 138   /** Index into global_origin_circuit_list for this circuit. -1 if not
 139    * present. */
 140   int global_origin_circuit_list_idx;
 141
 142   /** How many more relay_early cells can we send on this circuit, according
 143    * to the specification? */
 144   unsigned int remaining_relay_early_cells : 4;
 145
 146   /** Set if this circuit is insanely old and we already informed the user */
 147   unsigned int is_ancient : 1;
 148
 149   /** Set if this circuit has already been opened. Used to detect
 150    * cannibalized circuits. */
 151   unsigned int has_opened : 1;
 152
 153   /**
 154    * Path bias state machine. Used to ensure integrity of our
 155    * circuit building and usage accounting. See path_state_t
 156    * for more details.
 157    */
 158   path_state_bitfield_t path_state : 3;
 159
 160   /* If this flag is set, we should not consider attaching any more
 161    * connections to this circuit. */
 162   unsigned int unusable_for_new_conns : 1;
 163
 164   /* If this flag is set (due to padding negotiation failure), we should
 165    * not try to negotiate further circuit padding. */
 166   unsigned padding_negotiation_failed : 1;
 167
 168   /**
 169    * Tristate variable to guard against pathbias miscounting
 170    * due to circuit purpose transitions changing the decision
 171    * of pathbias_should_count(). This variable is informational
 172    * only. The current results of pathbias_should_count() are
 173    * the official decision for pathbias accounting.
 174    */
 175   uint8_t pathbias_shouldcount;
 176 #define PATHBIAS_SHOULDCOUNT_UNDECIDED 0
 177 #define PATHBIAS_SHOULDCOUNT_IGNORED   1
 178 #define PATHBIAS_SHOULDCOUNT_COUNTED   2
 179
 180   /** For path probing. Store the temporary probe stream ID
 181    * for response comparison */
 182   streamid_t pathbias_probe_id;
 183
 184   /** For path probing. Store the temporary probe address nonce
 185    * (in host byte order) for response comparison. */
 186   uint32_t pathbias_probe_nonce;
 187
 188   /** Set iff this is a hidden-service circuit which has timed out
 189    * according to our current circuit-build timeout, but which has
 190    * been kept around because it might still succeed in connecting to
 191    * its destination, and which is not a fully-connected rendezvous
 192    * circuit.
 193    *
 194    * (We clear this flag for client-side rendezvous circuits when they
 195    * are 'joined' to the other side's rendezvous circuit, so that
 196    * connection_ap_handshake_attach_circuit can put client streams on
 197    * the circuit.  We also clear this flag for service-side rendezvous
 198    * circuits when they are 'joined' to a client's rend circ, but only
 199    * for symmetry with the client case.  Client-side introduction
 200    * circuits are closed when we get a joined rend circ, and
 201    * service-side introduction circuits never have this flag set.) */
 202   unsigned int hs_circ_has_timed_out : 1;
 203
 204   /** Set iff this circuit has been given a relaxed timeout because
 205    * no circuits have opened. Used to prevent spamming logs. */
 206   unsigned int relaxed_timeout : 1;
 207
 208   /** Set iff this is a service-side rendezvous circuit for which a
 209    * new connection attempt has been launched.  We consider launching
 210    * a new service-side rend circ to a client when the previous one
 211    * fails; now that we don't necessarily close a service-side rend
 212    * circ when we launch a new one to the same client, this flag keeps
 213    * us from launching two retries for the same failed rend circ. */
 214   unsigned int hs_service_side_rend_circ_has_been_relaunched : 1;
 215
 216   /** What commands were sent over this circuit that decremented the
 217    * RELAY_EARLY counter? This is for debugging task 878. */
 218   uint8_t relay_early_commands[MAX_RELAY_EARLY_CELLS_PER_CIRCUIT];
 219
 220   /** How many RELAY_EARLY cells have been sent over this circuit? This is
 221    * for debugging task 878, too. */
 222   int relay_early_cells_sent;
 223
 224   /** The next stream_id that will be tried when we're attempting to
 225    * construct a new AP stream originating at this circuit. */
 226   streamid_t next_stream_id;
 227
 228   /* The intro key replaces the hidden service's public key if purpose is
 229    * S_ESTABLISH_INTRO or S_INTRO, provided that no unversioned rendezvous
 230    * descriptor is used. */
 231   crypto_pk_t *intro_key;
 232
 233   /** Quasi-global identifier for this circuit; used for control.c */
 234   /* XXXX NM This can get re-used after 2**32 circuits. */
 235   uint32_t global_identifier;
 236
 237   /** True if we have associated one stream to this circuit, thereby setting
 238    * the isolation parameters for this circuit.  Note that this doesn't
 239    * necessarily mean that we've <em>attached</em> any streams to the circuit:
 240    * we may only have marked up this circuit during the launch process.
 241    */
 242   unsigned int isolation_values_set : 1;
 243   /** True iff any stream has <em>ever</em> been attached to this circuit.
 244    *
 245    * In a better world we could use timestamp_dirty for this, but
 246    * timestamp_dirty is far too overloaded at the moment.
 247    */
 248   unsigned int isolation_any_streams_attached : 1;
 249
 250   /** A bitfield of ISO_* flags for every isolation field such that this
 251    * circuit has had streams with more than one value for that field
 252    * attached to it. */
 253   uint8_t isolation_flags_mixed;
 254
 255   /** @name Isolation parameters
 256    *
 257    * If any streams have been associated with this circ (isolation_values_set
 258    * == 1), and all streams associated with the circuit have had the same
 259    * value for some field ((isolation_flags_mixed & ISO_FOO) == 0), then these
 260    * elements hold the value for that field.
 261    *
 262    * Note again that "associated" is not the same as "attached": we
 263    * preliminarily associate streams with a circuit while the circuit is being
 264    * launched, so that we can tell whether we need to launch more circuits.
 265    *
 266    * @{
 267    */
 268   uint8_t client_proto_type;
 269   uint8_t client_proto_socksver;
 270   uint16_t dest_port;
 271   tor_addr_t client_addr;
 272   char *dest_address;
 273   int session_group;
 274   unsigned nym_epoch;
 275   size_t socks_username_len;
 276   uint8_t socks_password_len;
 277   /* Note that the next two values are NOT NUL-terminated; see
 278      socks_username_len and socks_password_len for their lengths. */
 279   char *socks_username;
 280   char *socks_password;
 281   /** Global identifier for the first stream attached here; used by
 282    * ISO_STREAM. */
 283   uint64_t associated_isolated_stream_global_id;
 284   /**@}*/
 285   /** A list of addr_policy_t for this circuit in particular. Used by
 286    * adjust_exit_policy_from_exitpolicy_failure.
 287    */
 288   smartlist_t *prepend_policy;
 289
 290   /** How long do we wait before closing this circuit if it remains
 291    * completely idle after it was built, in seconds? This value
 292    * is randomized on a per-circuit basis from CircuitsAvailableTimoeut
 293    * to 2*CircuitsAvailableTimoeut. */
 294   int circuit_idle_timeout;
 295
 296 };
 297
 298 #endif