1 /* Copyright (c) 2001 Matej Pfajfar.
2 * Copyright (c) 2001-2004, Roger Dingledine.
3 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4 * Copyright (c) 2007-2021, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
8 * \file connection_edge.h
9 * \brief Header file for connection_edge.c.
12 #ifndef TOR_CONNECTION_EDGE_H
13 #define TOR_CONNECTION_EDGE_H
15 #include "lib/testsupport/testsupport.h"
17 #include "feature/hs/hs_service.h"
19 edge_connection_t
*TO_EDGE_CONN(connection_t
*);
20 entry_connection_t
*TO_ENTRY_CONN(connection_t
*);
21 entry_connection_t
*EDGE_TO_ENTRY_CONN(edge_connection_t
*);
23 const edge_connection_t
*CONST_TO_EDGE_CONN(const connection_t
*);
24 const entry_connection_t
*CONST_TO_ENTRY_CONN(const connection_t
*);
25 const entry_connection_t
*CONST_EDGE_TO_ENTRY_CONN(const edge_connection_t
*);
27 #define EXIT_CONN_STATE_MIN_ 1
28 /** State for an exit connection: waiting for response from DNS farm. */
29 #define EXIT_CONN_STATE_RESOLVING 1
30 /** State for an exit connection: waiting for connect() to finish. */
31 #define EXIT_CONN_STATE_CONNECTING 2
32 /** State for an exit connection: open and ready to transmit data. */
33 #define EXIT_CONN_STATE_OPEN 3
34 /** State for an exit connection: waiting to be removed. */
35 #define EXIT_CONN_STATE_RESOLVEFAILED 4
36 #define EXIT_CONN_STATE_MAX_ 4
38 /* The AP state values must be disjoint from the EXIT state values. */
39 #define AP_CONN_STATE_MIN_ 5
40 /** State for a SOCKS connection: waiting for SOCKS request. */
41 #define AP_CONN_STATE_SOCKS_WAIT 5
42 /** State for a SOCKS connection: got a y.onion URL; waiting to receive
43 * rendezvous descriptor. */
44 #define AP_CONN_STATE_RENDDESC_WAIT 6
45 /** The controller will attach this connection to a circuit; it isn't our
47 #define AP_CONN_STATE_CONTROLLER_WAIT 7
48 /** State for a SOCKS connection: waiting for a completed circuit. */
49 #define AP_CONN_STATE_CIRCUIT_WAIT 8
50 /** State for a SOCKS connection: sent BEGIN, waiting for CONNECTED. */
51 #define AP_CONN_STATE_CONNECT_WAIT 9
52 /** State for a SOCKS connection: sent RESOLVE, waiting for RESOLVED. */
53 #define AP_CONN_STATE_RESOLVE_WAIT 10
54 /** State for a SOCKS connection: ready to send and receive. */
55 #define AP_CONN_STATE_OPEN 11
56 /** State for a transparent natd connection: waiting for original
58 #define AP_CONN_STATE_NATD_WAIT 12
59 /** State for an HTTP tunnel: waiting for an HTTP CONNECT command. */
60 #define AP_CONN_STATE_HTTP_CONNECT_WAIT 13
61 #define AP_CONN_STATE_MAX_ 13
63 #define EXIT_PURPOSE_MIN_ 1
64 /** This exit stream wants to do an ordinary connect. */
65 #define EXIT_PURPOSE_CONNECT 1
66 /** This exit stream wants to do a resolve (either normal or reverse). */
67 #define EXIT_PURPOSE_RESOLVE 2
68 #define EXIT_PURPOSE_MAX_ 2
70 /** True iff the AP_CONN_STATE_* value <b>s</b> means that the corresponding
71 * edge connection is not attached to any circuit. */
72 #define AP_CONN_STATE_IS_UNATTACHED(s) \
73 ((s) <= AP_CONN_STATE_CIRCUIT_WAIT || (s) == AP_CONN_STATE_NATD_WAIT)
75 #define connection_mark_unattached_ap(conn, endreason) \
76 connection_mark_unattached_ap_((conn), (endreason), __LINE__, SHORT_FILE__)
78 /** Possible return values for parse_extended_hostname. */
79 typedef enum hostname_type_t
{
86 MOCK_DECL(void,connection_mark_unattached_ap_
,
87 (entry_connection_t
*conn
, int endreason
,
88 int line
, const char *file
));
89 int connection_edge_reached_eof(edge_connection_t
*conn
);
90 int connection_edge_process_inbuf(edge_connection_t
*conn
,
92 int connection_edge_destroy(circid_t circ_id
, edge_connection_t
*conn
);
93 int connection_edge_end(edge_connection_t
*conn
, uint8_t reason
);
94 int connection_edge_end_errno(edge_connection_t
*conn
);
95 void connection_edge_end_close(edge_connection_t
*conn
, uint8_t reason
);
96 int connection_edge_flushed_some(edge_connection_t
*conn
);
97 int connection_edge_finished_flushing(edge_connection_t
*conn
);
98 int connection_edge_finished_connecting(edge_connection_t
*conn
);
100 void connection_entry_set_controller_wait(entry_connection_t
*conn
);
102 void connection_ap_about_to_close(entry_connection_t
*edge_conn
);
103 void connection_exit_about_to_close(edge_connection_t
*edge_conn
);
106 connection_ap_handshake_send_begin
,(entry_connection_t
*ap_conn
));
107 int connection_ap_handshake_send_resolve(entry_connection_t
*ap_conn
);
109 entry_connection_t
*connection_ap_make_link(connection_t
*partner
,
110 char *address
, uint16_t port
,
114 int use_begindir
, int want_onehop
);
115 void connection_ap_handshake_socks_reply(entry_connection_t
*conn
, char *reply
,
118 MOCK_DECL(void,connection_ap_handshake_socks_resolved
,
119 (entry_connection_t
*conn
,
122 const uint8_t *answer
,
125 void connection_ap_handshake_socks_resolved_addr(entry_connection_t
*conn
,
126 const tor_addr_t
*answer
,
130 int connection_exit_begin_conn(cell_t
*cell
, circuit_t
*circ
);
131 int connection_exit_begin_resolve(cell_t
*cell
, or_circuit_t
*circ
);
132 void connection_exit_connect(edge_connection_t
*conn
);
133 int connection_edge_is_rendezvous_stream(const edge_connection_t
*conn
);
134 int connection_ap_can_use_exit(const entry_connection_t
*conn
,
136 void connection_ap_expire_beginning(void);
137 void connection_ap_rescan_and_attach_pending(void);
138 void connection_ap_attach_pending(int retry
);
139 void connection_ap_mark_as_pending_circuit_(entry_connection_t
*entry_conn
,
140 const char *file
, int line
);
141 #define connection_ap_mark_as_pending_circuit(c) \
142 connection_ap_mark_as_pending_circuit_((c), __FILE__, __LINE__)
143 void connection_ap_mark_as_non_pending_circuit(entry_connection_t
*entry_conn
);
144 void connection_ap_mark_as_waiting_for_renddesc(
145 entry_connection_t
*entry_conn
);
147 #define CONNECTION_AP_EXPECT_NONPENDING(c) do { \
148 if (ENTRY_TO_CONN(c)->state == AP_CONN_STATE_CIRCUIT_WAIT) { \
149 log_warn(LD_BUG, "At %s:%d: %p was unexpectedly in circuit_wait.", \
150 __FILE__, __LINE__, (c)); \
151 connection_ap_mark_as_non_pending_circuit(c); \
154 void connection_ap_fail_onehop(const char *failed_digest
,
155 cpath_build_state_t
*build_state
);
156 void circuit_discard_optional_exit_enclaves(extend_info_t
*info
);
157 int connection_ap_detach_retriable(entry_connection_t
*conn
,
158 origin_circuit_t
*circ
,
160 int connection_ap_process_transparent(entry_connection_t
*conn
);
162 int address_is_invalid_destination(const char *address
, int client
);
164 MOCK_DECL(int, connection_ap_rewrite_and_attach_if_allowed
,
165 (entry_connection_t
*conn
,
166 origin_circuit_t
*circ
,
167 crypt_path_t
*cpath
));
168 int connection_ap_handshake_rewrite_and_attach(entry_connection_t
*conn
,
169 origin_circuit_t
*circ
,
170 crypt_path_t
*cpath
);
172 #if defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H)
173 int get_pf_socket(void);
176 int connection_edge_compatible_with_circuit(const entry_connection_t
*conn
,
177 const origin_circuit_t
*circ
);
178 int connection_edge_update_circuit_isolation(const entry_connection_t
*conn
,
179 origin_circuit_t
*circ
,
181 void circuit_clear_isolation(origin_circuit_t
*circ
);
182 streamid_t
get_unique_stream_id_by_circ(origin_circuit_t
*circ
);
184 void connection_edge_free_all(void);
186 void connection_ap_warn_and_unmark_if_pending_circ(
187 entry_connection_t
*entry_conn
,
190 /** Lowest value for DNS ttl clipping excluding the random addition. */
191 #define MIN_DNS_TTL (5*60)
192 /** Highest value for DNS ttl clipping excluding the random addition. */
193 #define MAX_DNS_TTL (60*60)
194 /** How long do we keep DNS cache entries before purging them (regardless of
196 #define MAX_DNS_ENTRY_AGE (3*60*60)
197 /** How long do we cache/tell clients to cache DNS records when no TTL is
199 #define DEFAULT_DNS_TTL (30*60)
200 /** How much should we +- each TTL to make it fuzzy with uniform sampling at
201 * exits? The value 4 minutes was chosen so that the lowest possible clip is
202 * 60s. Such low clips were used in the past for all TTLs due to a bug in Tor,
203 * see "The effect of DNS on Tor's Anonymity" by Greschbach et al. In other
204 * words, sampling such low clips is unlikely to cause any breakage at exits.
206 #define FUZZY_DNS_TTL (4*60)
208 uint32_t clip_dns_ttl(uint32_t ttl
);
209 uint32_t clip_dns_fuzzy_ttl(uint32_t ttl
);
211 int connection_half_edge_is_valid_data(const smartlist_t
*half_conns
,
212 streamid_t stream_id
);
213 int connection_half_edge_is_valid_sendme(const smartlist_t
*half_conns
,
214 streamid_t stream_id
);
215 int connection_half_edge_is_valid_connected(const smartlist_t
*half_conns
,
216 streamid_t stream_id
);
217 int connection_half_edge_is_valid_end(smartlist_t
*half_conns
,
218 streamid_t stream_id
);
219 int connection_half_edge_is_valid_resolved(smartlist_t
*half_conns
,
220 streamid_t stream_id
);
221 bool connection_half_edges_waiting(const origin_circuit_t
*circ
);
223 size_t half_streams_get_total_allocation(void);
225 void half_edge_free_(struct half_edge_t
*he
);
226 #define half_edge_free(he) \
227 FREE_AND_NULL(half_edge_t, half_edge_free_, (he))
229 /** @name Begin-cell flags
231 * These flags are used in RELAY_BEGIN cells to change the default behavior
236 /** When this flag is set, the client is willing to get connected to IPv6
238 #define BEGIN_FLAG_IPV6_OK (1u<<0)
239 /** When this flag is set, the client DOES NOT support connecting to IPv4
240 * addresses. (The sense of this flag is inverted from IPV6_OK, so that the
241 * old default behavior of Tor is equivalent to having all flags set to 0.)
243 #define BEGIN_FLAG_IPV4_NOT_OK (1u<<1)
244 /** When this flag is set, if we find both an IPv4 and an IPv6 address,
245 * we use the IPv6 address. Otherwise we use the IPv4 address. */
246 #define BEGIN_FLAG_IPV6_PREFERRED (1u<<2)
249 #ifdef CONNECTION_EDGE_PRIVATE
251 STATIC
bool parse_extended_hostname(char *address
, hostname_type_t
*type_out
);
253 /** A parsed BEGIN or BEGIN_DIR cell */
254 typedef struct begin_cell_t
{
255 /** The address the client has asked us to connect to, or NULL if this is
258 /** The flags specified in the BEGIN cell's body. One or more of
261 /** The client's requested port. */
263 /** The client's requested Stream ID */
265 /** True iff this is a BEGIN_DIR cell. */
266 unsigned is_begindir
: 1;
269 STATIC
int begin_cell_parse(const cell_t
*cell
, begin_cell_t
*bcell
,
270 uint8_t *end_reason_out
);
271 STATIC
int connected_cell_format_payload(uint8_t *payload_out
,
272 const tor_addr_t
*addr
,
276 /** Original address, after we lowercased it but before we started
279 char orig_address
[MAX_SOCKS_ADDR_LEN
];
280 /** True iff the address has been automatically remapped to a local
281 * address in VirtualAddrNetwork. (Only set true when we do a resolve
282 * and get a virtual address; not when we connect to the address.) */
284 /** If this connection has a .exit address, who put it there? */
285 addressmap_entry_source_t exit_source
;
286 /** If we've rewritten the address, when does this map expire? */
288 /** If we should close the connection, this is the end_reason to pass
289 * to connection_mark_unattached_ap */
291 /** True iff we should close the connection, either because of error or
292 * because of successful early RESOLVED reply. */
296 STATIC
void connection_ap_handshake_rewrite(entry_connection_t
*conn
,
297 rewrite_result_t
*out
);
299 STATIC
int connection_ap_process_http_connect(entry_connection_t
*conn
);
300 STATIC
void export_hs_client_circuit_id(edge_connection_t
*edge_conn
,
301 hs_circuit_id_protocol_t protocol
);
304 STATIC
void connection_half_edge_add(const edge_connection_t
*conn
,
305 origin_circuit_t
*circ
);
306 STATIC
struct half_edge_t
*connection_half_edge_find_stream_id(
307 const smartlist_t
*half_conns
,
308 streamid_t stream_id
);
309 #endif /* defined(CONNECTION_EDGE_PRIVATE) */
311 #endif /* !defined(TOR_CONNECTION_EDGE_H) */