1 /* Copyright 2001 Matej Pfajfar.
2 * Copyright 2001-2004 Roger Dingledine.
3 * Copyright 2004 Roger Dingledine, Nick Mathewson. */
4 /* See LICENSE for licensing information */
6 const char router_c_id
[] = "$Id$";
12 * \brief OR functionality, including key maintenance, generating
13 * and uploading server descriptors, retrying OR connections.
16 extern long stats_n_seconds_working
;
18 /** Exposed for test.c. */ void get_platform_str(char *platform
, size_t len
);
20 /************************************************************/
23 * Key management: ORs only.
26 /** Private keys for this OR. There is also an SSL key managed by tortls.c.
28 static tor_mutex_t
*key_lock
=NULL
;
29 static time_t onionkey_set_at
=0; /* When was onionkey last changed? */
30 static crypto_pk_env_t
*onionkey
=NULL
;
31 static crypto_pk_env_t
*lastonionkey
=NULL
;
32 static crypto_pk_env_t
*identitykey
=NULL
;
34 /** Replace the current onion key with <b>k</b>. Does not affect lastonionkey;
35 * to update onionkey correctly, call rotate_onion_key().
37 void set_onion_key(crypto_pk_env_t
*k
) {
38 tor_mutex_acquire(key_lock
);
40 onionkey_set_at
= time(NULL
);
41 tor_mutex_release(key_lock
);
42 mark_my_descriptor_dirty();
45 /** Return the current onion key. Requires that the onion key has been
46 * loaded or generated. */
47 crypto_pk_env_t
*get_onion_key(void) {
52 /** Return the onion key that was current before the most recent onion
53 * key rotation. If no rotation has been performed since this process
54 * started, return NULL.
56 crypto_pk_env_t
*get_previous_onion_key(void) {
60 void dup_onion_keys(crypto_pk_env_t
**key
, crypto_pk_env_t
**last
)
64 tor_mutex_acquire(key_lock
);
65 *key
= crypto_pk_dup_key(onionkey
);
67 *last
= crypto_pk_dup_key(lastonionkey
);
70 tor_mutex_release(key_lock
);
73 /** Return the time when the onion key was last set. This is either the time
74 * when the process launched, or the time of the most recent key rotation since
75 * the process launched.
77 time_t get_onion_key_set_at(void) {
78 return onionkey_set_at
;
81 /** Set the current identity key to k.
83 void set_identity_key(crypto_pk_env_t
*k
) {
87 /** Returns the current identity key; requires that the identity key has been
90 crypto_pk_env_t
*get_identity_key(void) {
91 tor_assert(identitykey
);
95 /** Return true iff the identity key has been set. */
96 int identity_key_is_set(void) {
97 return identitykey
!= NULL
;
100 /** Replace the previous onion key with the current onion key, and generate
101 * a new previous onion key. Immediately after calling this function,
103 * - schedule all previous cpuworkers to shut down _after_ processing
104 * pending work. (This will cause fresh cpuworkers to be generated.)
105 * - generate and upload a fresh routerinfo.
107 void rotate_onion_key(void)
110 char fname_prev
[512];
111 crypto_pk_env_t
*prkey
;
112 tor_snprintf(fname
,sizeof(fname
),
113 "%s/keys/secret_onion_key",get_options()->DataDirectory
);
114 tor_snprintf(fname_prev
,sizeof(fname_prev
),
115 "%s/keys/secret_onion_key.old",get_options()->DataDirectory
);
116 if (!(prkey
= crypto_new_pk_env())) {
117 log(LOG_ERR
, "Error creating crypto environment.");
120 if (crypto_pk_generate_key(prkey
)) {
121 log(LOG_ERR
, "Error generating onion key");
124 if (file_status(fname
) == FN_FILE
) {
125 if (replace_file(fname
, fname_prev
))
128 if (crypto_pk_write_private_key_to_filename(prkey
, fname
)) {
129 log(LOG_ERR
, "Couldn't write generated key to %s.", fname
);
132 tor_mutex_acquire(key_lock
);
134 crypto_free_pk_env(lastonionkey
);
135 log_fn(LOG_INFO
, "Rotating onion key");
136 lastonionkey
= onionkey
;
137 set_onion_key(prkey
);
138 tor_mutex_release(key_lock
);
141 log_fn(LOG_WARN
, "Couldn't rotate onion key.");
144 /** The latest calculated bandwidth usage for our node. */
145 static int bw_capacity
= 0;
146 /** Tuck <b>bw</b> away so we can produce it when somebody
147 * calls router_get_bandwidth_capacity() below.
149 void router_set_bandwidth_capacity(int bw
) {
152 /** Return the value we tucked away above, or zero by default. */
153 int router_get_bandwidth_capacity(void) {
157 /* Read an RSA secret key key from a file that was once named fname_old,
158 * but is now named fname_new. Rename the file from old to new as needed.
160 static crypto_pk_env_t
*
161 init_key_from_file_name_changed(const char *fname_old
,
162 const char *fname_new
)
165 if (file_status(fname_new
) == FN_FILE
|| file_status(fname_old
) != FN_FILE
)
166 /* The new filename is there, or both are, or neither is. */
167 return init_key_from_file(fname_new
);
169 /* The old filename exists, and the new one doesn't. Rename and load. */
170 if (rename(fname_old
, fname_new
) < 0) {
171 log_fn(LOG_ERR
, "Couldn't rename %s to %s: %s", fname_old
, fname_new
,
175 return init_key_from_file(fname_new
);
178 /** Try to read an RSA key from <b>fname</b>. If <b>fname</b> doesn't exist,
179 * create a new RSA key and save it in <b>fname</b>. Return the read/created
180 * key, or NULL on error.
182 crypto_pk_env_t
*init_key_from_file(const char *fname
)
184 crypto_pk_env_t
*prkey
= NULL
;
187 if (!(prkey
= crypto_new_pk_env())) {
188 log(LOG_ERR
, "Error creating crypto environment.");
192 switch (file_status(fname
)) {
195 log(LOG_ERR
, "Can't read key from %s", fname
);
198 log(LOG_INFO
, "No key found in %s; generating fresh key.", fname
);
199 if (crypto_pk_generate_key(prkey
)) {
200 log(LOG_ERR
, "Error generating onion key");
203 if (crypto_pk_check_key(prkey
) <= 0) {
204 log(LOG_ERR
, "Generated key seems invalid");
207 log(LOG_INFO
, "Generated key seems valid");
208 if (crypto_pk_write_private_key_to_filename(prkey
, fname
)) {
209 log(LOG_ERR
, "Couldn't write generated key to %s.", fname
);
214 if (crypto_pk_read_private_key_from_filename(prkey
, fname
)) {
215 log(LOG_ERR
, "Error loading private key.");
225 crypto_free_pk_env(prkey
);
231 /** Initialize all OR private keys, and the TLS context, as necessary.
232 * On OPs, this only initializes the tls context.
234 int init_keys(void) {
235 /* XXX009 Two problems with how this is called:
236 * 1. It should be idempotent for servers, so we can call init_keys
237 * as much as we need to.
238 * 2. Clients should rotate their identity keys at least whenever
243 char fingerprint
[FINGERPRINT_LEN
+1];
244 char fingerprint_line
[FINGERPRINT_LEN
+MAX_NICKNAME_LEN
+3];/*nickname fp\n\0 */
246 const char *tmp
, *mydesc
, *datadir
;
247 crypto_pk_env_t
*prkey
;
249 or_options_t
*options
= get_options();
252 key_lock
= tor_mutex_new();
254 /* OP's don't need persistent keys; just make up an identity and
255 * initialize the TLS context. */
256 if (!server_mode(options
)) {
257 if (!(prkey
= crypto_new_pk_env()))
259 if (crypto_pk_generate_key(prkey
))
261 set_identity_key(prkey
);
262 /* Create a TLS context; default the client nickname to "client". */
263 if (tor_tls_context_new(get_identity_key(), 1,
264 options
->Nickname
? options
->Nickname
: "client",
265 MAX_SSL_KEY_LIFETIME
) < 0) {
266 log_fn(LOG_ERR
, "Error creating TLS context for OP.");
271 /* Make sure DataDirectory exists, and is private. */
272 datadir
= options
->DataDirectory
;
273 if (check_private_dir(datadir
, CPD_CREATE
)) {
276 /* Check the key directory. */
277 tor_snprintf(keydir
,sizeof(keydir
),"%s/keys", datadir
);
278 if (check_private_dir(keydir
, CPD_CREATE
)) {
281 cp
= keydir
+ strlen(keydir
); /* End of string. */
283 /* 1. Read identity key. Make it if none is found. */
284 tor_snprintf(keydir
,sizeof(keydir
),"%s/keys/identity.key",datadir
);
285 tor_snprintf(keydir2
,sizeof(keydir2
),"%s/keys/secret_id_key",datadir
);
286 log_fn(LOG_INFO
,"Reading/making identity key %s...",keydir2
);
287 prkey
= init_key_from_file_name_changed(keydir
,keydir2
);
288 if (!prkey
) return -1;
289 set_identity_key(prkey
);
290 /* 2. Read onion key. Make it if none is found. */
291 tor_snprintf(keydir
,sizeof(keydir
),"%s/keys/onion.key",datadir
);
292 tor_snprintf(keydir2
,sizeof(keydir2
),"%s/keys/secret_onion_key",datadir
);
293 log_fn(LOG_INFO
,"Reading/making onion key %s...",keydir2
);
294 prkey
= init_key_from_file_name_changed(keydir
,keydir2
);
295 if (!prkey
) return -1;
296 set_onion_key(prkey
);
297 tor_snprintf(keydir
,sizeof(keydir
),"%s/keys/secret_onion_key.old",datadir
);
298 if (file_status(keydir
) == FN_FILE
) {
299 prkey
= init_key_from_file(keydir
);
301 lastonionkey
= prkey
;
304 /* 3. Initialize link key and TLS context. */
305 if (tor_tls_context_new(get_identity_key(), 1, options
->Nickname
,
306 MAX_SSL_KEY_LIFETIME
) < 0) {
307 log_fn(LOG_ERR
, "Error initializing TLS context");
310 /* 4. Dump router descriptor to 'router.desc' */
311 /* Must be called after keys are initialized. */
312 tmp
= mydesc
= router_get_my_descriptor();
314 log_fn(LOG_ERR
, "Error initializing descriptor.");
317 if (authdir_mode(options
)) {
319 /* We need to add our own fingerprint so it gets recognized. */
320 if (dirserv_add_own_fingerprint(options
->Nickname
, get_identity_key())) {
321 log_fn(LOG_ERR
, "Error adding own fingerprint to approved set");
324 if (dirserv_add_descriptor(&tmp
, &m
) != 1) {
325 log(LOG_ERR
, "Unable to add own descriptor to directory: %s",
326 m
?m
:"<unknown error>");
331 tor_snprintf(keydir
,sizeof(keydir
),"%s/router.desc", datadir
);
332 log_fn(LOG_INFO
,"Dumping descriptor to %s...",keydir
);
333 if (write_str_to_file(keydir
, mydesc
,0)) {
336 /* 5. Dump fingerprint to 'fingerprint' */
337 tor_snprintf(keydir
,sizeof(keydir
),"%s/fingerprint", datadir
);
338 log_fn(LOG_INFO
,"Dumping fingerprint to %s...",keydir
);
339 if (crypto_pk_get_fingerprint(get_identity_key(), fingerprint
, 1)<0) {
340 log_fn(LOG_ERR
, "Error computing fingerprint");
343 tor_assert(strlen(options
->Nickname
) <= MAX_NICKNAME_LEN
);
344 if (tor_snprintf(fingerprint_line
, sizeof(fingerprint_line
),
345 "%s %s\n",options
->Nickname
, fingerprint
) < 0) {
346 log_fn(LOG_ERR
, "Error writing fingerprint line");
349 if (write_str_to_file(keydir
, fingerprint_line
, 0))
351 if (!authdir_mode(options
))
353 /* 6. [authdirserver only] load approved-routers file */
354 tor_snprintf(keydir
,sizeof(keydir
),"%s/approved-routers", datadir
);
355 log_fn(LOG_INFO
,"Loading approved fingerprints from %s...",keydir
);
356 if (dirserv_parse_fingerprint_file(keydir
) < 0) {
357 log_fn(LOG_ERR
, "Error loading fingerprints");
360 /* 6b. [authdirserver only] add own key to approved directories. */
361 crypto_pk_get_digest(get_identity_key(), digest
);
362 if (!router_digest_is_trusted_dir(digest
)) {
363 add_trusted_dir_server(options
->Address
, (uint16_t)options
->DirPort
, digest
);
365 /* 7. [authdirserver only] load old directory, if it's there */
366 tor_snprintf(keydir
,sizeof(keydir
),"%s/cached-directory", datadir
);
367 log_fn(LOG_INFO
,"Loading cached directory from %s...",keydir
);
368 cp
= read_file_to_str(keydir
,0);
370 log_fn(LOG_INFO
,"Cached directory %s not present. Ok.",keydir
);
372 if (dirserv_load_from_directory_string(cp
) < 0) {
373 log_fn(LOG_WARN
, "Cached directory %s is corrupt, only loaded part of it.", keydir
);
387 /** OR only: if in clique mode, try to open connections to all of the
388 * other ORs we know about. Otherwise, open connections to those we
389 * think are in clique mode.
391 void router_retry_connections(void) {
393 routerinfo_t
*router
;
395 or_options_t
*options
= get_options();
397 tor_assert(server_mode(options
));
399 router_get_routerlist(&rl
);
401 for (i
=0;i
< smartlist_len(rl
->routers
);i
++) {
402 router
= smartlist_get(rl
->routers
, i
);
403 if (router_is_me(router
))
405 if (!clique_mode(options
) && !router_is_clique_mode(router
))
407 if (!connection_get_by_identity_digest(router
->identity_digest
,
409 /* not in the list */
410 log_fn(LOG_DEBUG
,"connecting to OR at %s:%u.",router
->address
,router
->or_port
);
411 connection_or_connect(router
->addr
, router
->or_port
, router
->identity_digest
);
416 int router_is_clique_mode(routerinfo_t
*router
) {
417 if (router_digest_is_trusted_dir(router
->identity_digest
))
423 * OR descriptor generation.
426 /** My routerinfo. */
427 static routerinfo_t
*desc_routerinfo
= NULL
;
428 /** String representation of my descriptor, signed by me. */
429 static char descriptor
[8192];
430 /** Boolean: do we need to regenerate the above? */
431 static int desc_is_dirty
= 1;
432 /** Boolean: do we need to regenerate the above? */
433 static int desc_needs_upload
= 0;
435 /** OR only: try to upload our signed descriptor to all the directory servers
436 * we know about. DOCDOC force
438 void router_upload_dir_desc_to_dirservers(int force
) {
441 s
= router_get_my_descriptor();
443 log_fn(LOG_WARN
, "No descriptor; skipping upload");
446 if (!force
|| !desc_needs_upload
)
448 desc_needs_upload
= 0;
449 directory_post_to_dirservers(DIR_PURPOSE_UPLOAD_DIR
, s
, strlen(s
));
452 #define DEFAULT_EXIT_POLICY "reject 0.0.0.0/8,reject 169.254.0.0/16,reject 127.0.0.0/8,reject 192.168.0.0/16,reject 10.0.0.0/8,reject 172.16.0.0/12,accept *:20-22,accept *:53,accept *:79-81,accept *:110,accept *:143,accept *:389,accept *:443,accept *:636,accept *:706,accept *:873,accept *:993,accept *:995,reject *:1214,reject *:4661-4666,reject *:6346-6347,reject *:6419,reject *:6881-6889,accept *:1024-65535,reject *:*"
454 /** Set the exit policy on <b>router</b> to match the exit policy in the
455 * current configuration file. If the exit policy doesn't have a catch-all
456 * rule, then append the default exit policy as well.
458 static void router_add_exit_policy_from_config(routerinfo_t
*router
) {
460 struct config_line_t default_policy
;
461 config_parse_addr_policy(get_options()->ExitPolicy
, &router
->exit_policy
);
463 for (ep
= router
->exit_policy
; ep
; ep
= ep
->next
) {
464 if (ep
->msk
== 0 && ep
->prt_min
<= 1 && ep
->prt_max
>= 65535) {
465 /* if exitpolicy includes a *:* line, then we're done. */
470 /* Else, append the default exitpolicy. */
471 default_policy
.key
= NULL
;
472 default_policy
.value
= (char*)DEFAULT_EXIT_POLICY
;
473 default_policy
.next
= NULL
;
474 config_parse_addr_policy(&default_policy
, &router
->exit_policy
);
477 /** OR only: Return false if my exit policy says to allow connection to
478 * conn. Else return true.
480 int router_compare_to_my_exit_policy(connection_t
*conn
)
482 tor_assert(desc_routerinfo
);
484 /* make sure it's resolved to something. this way we can't get a
489 return router_compare_addr_to_addr_policy(conn
->addr
, conn
->port
,
490 desc_routerinfo
->exit_policy
);
494 /** Return true iff <b>router</b> has the same nickname as this OR. (For an
495 * OP, always returns false.)
497 int router_is_me(routerinfo_t
*router
)
499 routerinfo_t
*me
= router_get_my_routerinfo();
501 if (!me
|| memcmp(me
->identity_digest
, router
->identity_digest
, DIGEST_LEN
))
506 /** Return a routerinfo for this OR, rebuilding a fresh one if
507 * necessary. Return NULL on error, or if called on an OP. */
508 routerinfo_t
*router_get_my_routerinfo(void)
510 if (!server_mode(get_options()))
513 if (!desc_routerinfo
) {
514 if (router_rebuild_descriptor(1))
517 return desc_routerinfo
;
520 /** OR only: Return a signed server descriptor for this OR, rebuilding a fresh
521 * one if necessary. Return NULL on error.
523 const char *router_get_my_descriptor(void) {
524 if (!desc_routerinfo
) {
525 if (router_rebuild_descriptor(1))
528 log_fn(LOG_DEBUG
,"my desc is '%s'",descriptor
);
532 /** Rebuild a fresh routerinfo and signed server descriptor for this
533 * OR. Return 0 on success, -1 on error. DOCDOC force
535 int router_rebuild_descriptor(int force
) {
540 int hibernating
= we_are_hibernating();
541 or_options_t
*options
= get_options();
543 if (!desc_is_dirty
&& !force
)
546 if (resolve_my_address(options
->Address
, &addr
) < 0) {
547 log_fn(LOG_WARN
,"options->Address didn't resolve into an IP.");
551 ri
= tor_malloc_zero(sizeof(routerinfo_t
));
552 in
.s_addr
= htonl(addr
);
553 ri
->address
= tor_strdup(inet_ntoa(in
));
554 ri
->nickname
= tor_strdup(options
->Nickname
);
556 ri
->or_port
= options
->ORPort
;
557 ri
->dir_port
= hibernating
? 0 : options
->DirPort
;
558 ri
->published_on
= time(NULL
);
559 ri
->onion_pkey
= crypto_pk_dup_key(get_onion_key()); /* must invoke from main thread */
560 ri
->identity_pkey
= crypto_pk_dup_key(get_identity_key());
561 if (crypto_pk_get_digest(ri
->identity_pkey
, ri
->identity_digest
)<0) {
565 get_platform_str(platform
, sizeof(platform
));
566 ri
->platform
= tor_strdup(platform
);
567 ri
->bandwidthrate
= (int)options
->BandwidthRate
;
568 ri
->bandwidthburst
= (int)options
->BandwidthBurst
;
569 ri
->bandwidthcapacity
= hibernating
? 0 : router_get_bandwidth_capacity();
570 router_add_exit_policy_from_config(ri
);
571 if (desc_routerinfo
) /* inherit values */
572 ri
->is_verified
= desc_routerinfo
->is_verified
;
573 if (options
->MyFamily
) {
574 ri
->declared_family
= smartlist_create();
575 smartlist_split_string(ri
->declared_family
, options
->MyFamily
, ",",
576 SPLIT_SKIP_SPACE
|SPLIT_IGNORE_BLANK
, 0);
580 routerinfo_free(desc_routerinfo
);
581 desc_routerinfo
= ri
;
582 if (router_dump_router_to_string(descriptor
, 8192, ri
, get_identity_key())<0) {
583 log_fn(LOG_WARN
, "Couldn't dump router to string.");
587 desc_needs_upload
= 1;
593 mark_my_descriptor_dirty(void)
598 /** Set <b>platform</b> (max length <b>len</b>) to a NUL-terminated short
599 * string describing the version of Tor and the operating system we're
600 * currently running on.
602 void get_platform_str(char *platform
, size_t len
)
604 tor_snprintf(platform
, len
, "Tor %s on %s",
605 VERSION
, get_uname());
609 /* XXX need to audit this thing and count fenceposts. maybe
610 * refactor so we don't have to keep asking if we're
611 * near the end of maxlen?
613 #define DEBUG_ROUTER_DUMP_ROUTER_TO_STRING
615 /** OR only: Given a routerinfo for this router, and an identity key to sign
616 * with, encode the routerinfo as a signed server descriptor and write the
617 * result into <b>s</b>, using at most <b>maxlen</b> bytes. Return -1 on
618 * failure, and the number of bytes used on success.
620 int router_dump_router_to_string(char *s
, size_t maxlen
, routerinfo_t
*router
,
621 crypto_pk_env_t
*ident_key
) {
622 char *onion_pkey
; /* Onion key, PEM-encoded. */
623 char *identity_pkey
; /* Identity key, PEM-encoded. */
627 char fingerprint
[FINGERPRINT_LEN
+1];
629 size_t onion_pkeylen
, identity_pkeylen
;
633 char *bandwidth_usage
;
635 #ifdef DEBUG_ROUTER_DUMP_ROUTER_TO_STRING
638 routerinfo_t
*ri_tmp
;
641 /* Make sure the identity key matches the one in the routerinfo. */
642 if (crypto_pk_cmp_keys(ident_key
, router
->identity_pkey
)) {
643 log_fn(LOG_WARN
,"Tried to sign a router with a private key that didn't match router's public key!");
647 /* record our fingerprint, so we can include it in the descriptor */
648 if (crypto_pk_get_fingerprint(router
->identity_pkey
, fingerprint
, 1)<0) {
649 log_fn(LOG_ERR
, "Error computing fingerprint");
653 /* PEM-encode the onion key */
654 if (crypto_pk_write_public_key_to_string(router
->onion_pkey
,
655 &onion_pkey
,&onion_pkeylen
)<0) {
656 log_fn(LOG_WARN
,"write onion_pkey to string failed!");
660 /* PEM-encode the identity key key */
661 if (crypto_pk_write_public_key_to_string(router
->identity_pkey
,
662 &identity_pkey
,&identity_pkeylen
)<0) {
663 log_fn(LOG_WARN
,"write identity_pkey to string failed!");
664 tor_free(onion_pkey
);
668 /* Encode the publication time. */
669 format_iso_time(published
, router
->published_on
);
671 /* How busy have we been? */
672 bandwidth_usage
= rep_hist_get_bandwidth_lines();
674 if (router
->declared_family
&& smartlist_len(router
->declared_family
)) {
676 char *s
= smartlist_join_strings(router
->declared_family
, " ", 0, &n
);
677 n
+= strlen("opt family ") + 2; /* 1 for \n, 1 for \0. */
678 family_line
= tor_malloc(n
);
679 tor_snprintf(family_line
, n
, "opt family %s\n", s
);
682 family_line
= tor_strdup("");
685 /* Generate the easy portion of the router descriptor. */
686 result
= tor_snprintf(s
, maxlen
,
687 "router %s %s %d 0 %d\n"
690 "opt fingerprint %s\n"
692 "bandwidth %d %d %d\n"
694 "signing-key\n%s%s%s",
702 stats_n_seconds_working
,
703 (int) router
->bandwidthrate
,
704 (int) router
->bandwidthburst
,
705 (int) router
->bandwidthcapacity
,
706 onion_pkey
, identity_pkey
,
707 family_line
, bandwidth_usage
);
708 tor_free(family_line
);
709 tor_free(onion_pkey
);
710 tor_free(identity_pkey
);
711 tor_free(bandwidth_usage
);
715 /* From now on, we use 'written' to remember the current length of 's'. */
718 if (get_options()->ContactInfo
&& strlen(get_options()->ContactInfo
)) {
719 result
= tor_snprintf(s
+written
,maxlen
-written
, "opt contact %s\n",
720 get_options()->ContactInfo
);
726 /* Write the exit policy to the end of 's'. */
727 for (tmpe
=router
->exit_policy
; tmpe
; tmpe
=tmpe
->next
) {
728 in
.s_addr
= htonl(tmpe
->addr
);
729 /* Write: "accept 1.2.3.4" */
730 result
= tor_snprintf(s
+written
, maxlen
-written
, "%s %s",
731 tmpe
->policy_type
== ADDR_POLICY_ACCEPT
? "accept" : "reject",
732 tmpe
->msk
== 0 ? "*" : inet_ntoa(in
));
736 if (tmpe
->msk
!= 0xFFFFFFFFu
&& tmpe
->msk
!= 0) {
737 /* Write "/255.255.0.0" */
738 in
.s_addr
= htonl(tmpe
->msk
);
739 result
= tor_snprintf(s
+written
, maxlen
-written
, "/%s", inet_ntoa(in
));
744 if (tmpe
->prt_min
<= 1 && tmpe
->prt_max
== 65535) {
745 /* There is no port set; write ":*" */
746 if (written
+4 > maxlen
)
748 strlcat(s
+written
, ":*\n", maxlen
-written
);
750 } else if (tmpe
->prt_min
== tmpe
->prt_max
) {
751 /* There is only one port; write ":80". */
752 result
= tor_snprintf(s
+written
, maxlen
-written
, ":%d\n", tmpe
->prt_min
);
757 /* There is a range of ports; write ":79-80". */
758 result
= tor_snprintf(s
+written
, maxlen
-written
, ":%d-%d\n", tmpe
->prt_min
,
764 if (tmpe
->msk
== 0 && tmpe
->prt_min
<= 1 && tmpe
->prt_max
== 65535)
765 /* This was a catch-all rule, so future rules are irrelevant. */
768 if (written
+256 > maxlen
) /* Not enough room for signature. */
771 /* Sign the directory */
772 strlcat(s
+written
, "router-signature\n", maxlen
-written
);
773 written
+= strlen(s
+written
);
775 if (router_get_router_hash(s
, digest
) < 0)
778 if (crypto_pk_private_sign(ident_key
, signature
, digest
, 20) < 0) {
779 log_fn(LOG_WARN
, "Error signing digest");
782 strlcat(s
+written
, "-----BEGIN SIGNATURE-----\n", maxlen
-written
);
783 written
+= strlen(s
+written
);
784 if (base64_encode(s
+written
, maxlen
-written
, signature
, 128) < 0) {
785 log_fn(LOG_WARN
, "Couldn't base64-encode signature");
788 written
+= strlen(s
+written
);
789 strlcat(s
+written
, "-----END SIGNATURE-----\n", maxlen
-written
);
790 written
+= strlen(s
+written
);
792 if (written
+2 > maxlen
)
794 /* include a last '\n' */
798 #ifdef DEBUG_ROUTER_DUMP_ROUTER_TO_STRING
799 cp
= s_tmp
= s_dup
= tor_strdup(s
);
800 ri_tmp
= router_parse_entry_from_string(cp
, NULL
);
802 log_fn(LOG_ERR
, "We just generated a router descriptor we can't parse: <<%s>>",
807 routerinfo_free(ri_tmp
);
813 int is_legal_nickname(const char *s
)
818 return len
> 0 && len
<= MAX_NICKNAME_LEN
&&
819 strspn(s
,LEGAL_NICKNAME_CHARACTERS
)==len
;
821 int is_legal_nickname_or_hexdigest(const char *s
)
826 return is_legal_nickname(s
);
829 return len
== HEX_DIGEST_LEN
+1 && strspn(s
+1,HEX_CHARACTERS
)==len
-1;