1 /* Copyright (c) 2001 Matej Pfajfar.
2 * Copyright (c) 2001-2004, Roger Dingledine.
3 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4 * Copyright (c) 2007-2017, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
9 * \brief Master header file for Tor-specific functionality.
26 #ifdef HAVE_SYS_PARAM_H
27 #include <sys/param.h> /* FreeBSD needs this to know what version it is */
30 #ifdef HAVE_SYS_FCNTL_H
31 #include <sys/fcntl.h>
36 #ifdef HAVE_SYS_IOCTL_H
37 #include <sys/ioctl.h>
42 #ifdef HAVE_SYS_STAT_H
45 #ifdef HAVE_NETINET_IN_H
46 #include <netinet/in.h>
48 #ifdef HAVE_ARPA_INET_H
49 #include <arpa/inet.h>
67 #endif /* defined(_WIN32) */
70 #include "crypto_format.h"
73 #include "container.h"
76 #include "compat_libevent.h"
79 #include "replaycache.h"
80 #include "crypto_curve25519.h"
81 #include "crypto_ed25519.h"
82 #include "tor_queue.h"
83 #include "util_format.h"
84 #include "hs_circuitmap.h"
86 /* These signals are defined to help handle_control_signal work.
103 /* Controller signals start at a high number so we don't
104 * conflict with system-defined signals. */
105 #define SIGNEWNYM 129
106 #define SIGCLEARDNSCACHE 130
107 #define SIGHEARTBEAT 131
109 #if (SIZEOF_CELL_T != 0)
110 /* On Irix, stdlib.h defines a cell_t type, so we need to make sure
111 * that our stuff always calls cell_t something different. */
112 #define cell_t tor_cell_t
115 #ifdef ENABLE_TOR2WEB_MODE
116 #define NON_ANONYMOUS_MODE_ENABLED 1
119 /** Helper macro: Given a pointer to to.base_, of type from*, return &to. */
120 #define DOWNCAST(to, ptr) ((to*)SUBTYPE_P(ptr, to, base_))
122 /** Length of longest allowable configured nickname. */
123 #define MAX_NICKNAME_LEN 19
124 /** Length of a router identity encoded as a hexadecimal digest, plus
125 * possible dollar sign. */
126 #define MAX_HEX_NICKNAME_LEN (HEX_DIGEST_LEN+1)
127 /** Maximum length of verbose router identifier: dollar sign, hex ID digest,
128 * equal sign or tilde, nickname. */
129 #define MAX_VERBOSE_NICKNAME_LEN (1+HEX_DIGEST_LEN+1+MAX_NICKNAME_LEN)
131 /** Maximum size, in bytes, for resized buffers. */
132 #define MAX_BUF_SIZE ((1<<24)-1) /* 16MB-1 */
133 /** Maximum size, in bytes, for any directory object that we've downloaded. */
134 #define MAX_DIR_DL_SIZE MAX_BUF_SIZE
136 /** For HTTP parsing: Maximum number of bytes we'll accept in the headers
137 * of an HTTP request or response. */
138 #define MAX_HEADERS_SIZE 50000
139 /** Maximum size, in bytes, for any directory object that we're accepting
141 #define MAX_DIR_UL_SIZE MAX_BUF_SIZE
143 /** Maximum size, in bytes, of a single router descriptor uploaded to us
144 * as a directory authority. Caches and clients fetch whatever descriptors
145 * the authorities tell them to fetch, and don't care about size. */
146 #define MAX_DESCRIPTOR_UPLOAD_SIZE 20000
148 /** Maximum size of a single extrainfo document, as above. */
149 #define MAX_EXTRAINFO_UPLOAD_SIZE 50000
151 /** Minimum lifetime for an onion key in days. */
152 #define MIN_ONION_KEY_LIFETIME_DAYS (1)
154 /** Maximum lifetime for an onion key in days. */
155 #define MAX_ONION_KEY_LIFETIME_DAYS (90)
157 /** Default lifetime for an onion key in days. */
158 #define DEFAULT_ONION_KEY_LIFETIME_DAYS (28)
160 /** Minimum grace period for acceptance of an onion key in days.
161 * The maximum value is defined in proposal #274 as being the current network
162 * consensus parameter for "onion-key-rotation-days". */
163 #define MIN_ONION_KEY_GRACE_PERIOD_DAYS (1)
165 /** Default grace period for acceptance of an onion key in days. */
166 #define DEFAULT_ONION_KEY_GRACE_PERIOD_DAYS (7)
168 /** How often we should check the network consensus if it is time to rotate or
169 * expire onion keys. */
170 #define ONION_KEY_CONSENSUS_CHECK_INTERVAL (60*60)
172 /** How often do we rotate TLS contexts? */
173 #define MAX_SSL_KEY_LIFETIME_INTERNAL (2*60*60)
175 /** How old do we allow a router to get before removing it
176 * from the router list? In seconds. */
177 #define ROUTER_MAX_AGE (60*60*48)
178 /** How old can a router get before we (as a server) will no longer
179 * consider it live? In seconds. */
180 #define ROUTER_MAX_AGE_TO_PUBLISH (60*60*24)
181 /** How old do we let a saved descriptor get before force-removing it? */
182 #define OLD_ROUTER_DESC_MAX_AGE (60*60*24*5)
184 /** Possible rules for generating circuit IDs on an OR connection. */
186 CIRC_ID_TYPE_LOWER
=0, /**< Pick from 0..1<<15-1. */
187 CIRC_ID_TYPE_HIGHER
=1, /**< Pick from 1<<15..1<<16-1. */
188 /** The other side of a connection is an OP: never create circuits to it,
189 * and let it use any circuit ID it wants. */
190 CIRC_ID_TYPE_NEITHER
=2
192 #define circ_id_type_bitfield_t ENUM_BF(circ_id_type_t)
194 #define CONN_TYPE_MIN_ 3
195 /** Type for sockets listening for OR connections. */
196 #define CONN_TYPE_OR_LISTENER 3
197 /** A bidirectional TLS connection transmitting a sequence of cells.
198 * May be from an OR to an OR, or from an OP to an OR. */
199 #define CONN_TYPE_OR 4
200 /** A TCP connection from an onion router to a stream's destination. */
201 #define CONN_TYPE_EXIT 5
202 /** Type for sockets listening for SOCKS connections. */
203 #define CONN_TYPE_AP_LISTENER 6
204 /** A SOCKS proxy connection from the user application to the onion
206 #define CONN_TYPE_AP 7
207 /** Type for sockets listening for HTTP connections to the directory server. */
208 #define CONN_TYPE_DIR_LISTENER 8
209 /** Type for HTTP connections to the directory server. */
210 #define CONN_TYPE_DIR 9
211 /* Type 10 is unused. */
212 /** Type for listening for connections from user interface process. */
213 #define CONN_TYPE_CONTROL_LISTENER 11
214 /** Type for connections from user interface process. */
215 #define CONN_TYPE_CONTROL 12
216 /** Type for sockets listening for transparent connections redirected by pf or
218 #define CONN_TYPE_AP_TRANS_LISTENER 13
219 /** Type for sockets listening for transparent connections redirected by
221 #define CONN_TYPE_AP_NATD_LISTENER 14
222 /** Type for sockets listening for DNS requests. */
223 #define CONN_TYPE_AP_DNS_LISTENER 15
225 /** Type for connections from the Extended ORPort. */
226 #define CONN_TYPE_EXT_OR 16
227 /** Type for sockets listening for Extended ORPort connections. */
228 #define CONN_TYPE_EXT_OR_LISTENER 17
229 /** Type for sockets listening for HTTP CONNECT tunnel connections. */
230 #define CONN_TYPE_AP_HTTP_CONNECT_LISTENER 18
232 #define CONN_TYPE_MAX_ 19
233 /* !!!! If _CONN_TYPE_MAX is ever over 31, we must grow the type field in
236 /* Proxy client types */
238 #define PROXY_CONNECT 1
239 #define PROXY_SOCKS4 2
240 #define PROXY_SOCKS5 3
241 /* !!!! If there is ever a PROXY_* type over 3, we must grow the proxy_type
242 * field in or_connection_t */
244 /* Pluggable transport proxy type. Don't use this in or_connection_t,
245 * instead use the actual underlying proxy type (see above). */
246 #define PROXY_PLUGGABLE 4
248 /* Proxy client handshake states */
249 /* We use a proxy but we haven't even connected to it yet. */
250 #define PROXY_INFANT 1
251 /* We use an HTTP proxy and we've sent the CONNECT command. */
252 #define PROXY_HTTPS_WANT_CONNECT_OK 2
253 /* We use a SOCKS4 proxy and we've sent the CONNECT command. */
254 #define PROXY_SOCKS4_WANT_CONNECT_OK 3
255 /* We use a SOCKS5 proxy and we try to negotiate without
256 any authentication . */
257 #define PROXY_SOCKS5_WANT_AUTH_METHOD_NONE 4
258 /* We use a SOCKS5 proxy and we try to negotiate with
259 Username/Password authentication . */
260 #define PROXY_SOCKS5_WANT_AUTH_METHOD_RFC1929 5
261 /* We use a SOCKS5 proxy and we just sent our credentials. */
262 #define PROXY_SOCKS5_WANT_AUTH_RFC1929_OK 6
263 /* We use a SOCKS5 proxy and we just sent our CONNECT command. */
264 #define PROXY_SOCKS5_WANT_CONNECT_OK 7
265 /* We use a proxy and we CONNECTed successfully!. */
266 #define PROXY_CONNECTED 8
268 /** True iff <b>x</b> is an edge connection. */
269 #define CONN_IS_EDGE(x) \
270 ((x)->type == CONN_TYPE_EXIT || (x)->type == CONN_TYPE_AP)
272 /** State for any listener connection. */
273 #define LISTENER_STATE_READY 0
275 #define OR_CONN_STATE_MIN_ 1
276 /** State for a connection to an OR: waiting for connect() to finish. */
277 #define OR_CONN_STATE_CONNECTING 1
278 /** State for a connection to an OR: waiting for proxy handshake to complete */
279 #define OR_CONN_STATE_PROXY_HANDSHAKING 2
280 /** State for an OR connection client: SSL is handshaking, not done
282 #define OR_CONN_STATE_TLS_HANDSHAKING 3
283 /** State for a connection to an OR: We're doing a second SSL handshake for
284 * renegotiation purposes. (V2 handshake only.) */
285 #define OR_CONN_STATE_TLS_CLIENT_RENEGOTIATING 4
286 /** State for a connection at an OR: We're waiting for the client to
287 * renegotiate (to indicate a v2 handshake) or send a versions cell (to
288 * indicate a v3 handshake) */
289 #define OR_CONN_STATE_TLS_SERVER_RENEGOTIATING 5
290 /** State for an OR connection: We're done with our SSL handshake, we've done
291 * renegotiation, but we haven't yet negotiated link protocol versions and
292 * sent a netinfo cell. */
293 #define OR_CONN_STATE_OR_HANDSHAKING_V2 6
294 /** State for an OR connection: We're done with our SSL handshake, but we
295 * haven't yet negotiated link protocol versions, done a V3 handshake, and
296 * sent a netinfo cell. */
297 #define OR_CONN_STATE_OR_HANDSHAKING_V3 7
298 /** State for an OR connection: Ready to send/receive cells. */
299 #define OR_CONN_STATE_OPEN 8
300 #define OR_CONN_STATE_MAX_ 8
302 /** States of the Extended ORPort protocol. Be careful before changing
303 * the numbers: they matter. */
304 #define EXT_OR_CONN_STATE_MIN_ 1
305 /** Extended ORPort authentication is waiting for the authentication
306 * type selected by the client. */
307 #define EXT_OR_CONN_STATE_AUTH_WAIT_AUTH_TYPE 1
308 /** Extended ORPort authentication is waiting for the client nonce. */
309 #define EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_NONCE 2
310 /** Extended ORPort authentication is waiting for the client hash. */
311 #define EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_HASH 3
312 #define EXT_OR_CONN_STATE_AUTH_MAX 3
313 /** Authentication finished and the Extended ORPort is now accepting
315 #define EXT_OR_CONN_STATE_OPEN 4
316 /** Extended ORPort is flushing its last messages and preparing to
317 * start accepting OR connections. */
318 #define EXT_OR_CONN_STATE_FLUSHING 5
319 #define EXT_OR_CONN_STATE_MAX_ 5
321 #define EXIT_CONN_STATE_MIN_ 1
322 /** State for an exit connection: waiting for response from DNS farm. */
323 #define EXIT_CONN_STATE_RESOLVING 1
324 /** State for an exit connection: waiting for connect() to finish. */
325 #define EXIT_CONN_STATE_CONNECTING 2
326 /** State for an exit connection: open and ready to transmit data. */
327 #define EXIT_CONN_STATE_OPEN 3
328 /** State for an exit connection: waiting to be removed. */
329 #define EXIT_CONN_STATE_RESOLVEFAILED 4
330 #define EXIT_CONN_STATE_MAX_ 4
332 /* The AP state values must be disjoint from the EXIT state values. */
333 #define AP_CONN_STATE_MIN_ 5
334 /** State for a SOCKS connection: waiting for SOCKS request. */
335 #define AP_CONN_STATE_SOCKS_WAIT 5
336 /** State for a SOCKS connection: got a y.onion URL; waiting to receive
337 * rendezvous descriptor. */
338 #define AP_CONN_STATE_RENDDESC_WAIT 6
339 /** The controller will attach this connection to a circuit; it isn't our
341 #define AP_CONN_STATE_CONTROLLER_WAIT 7
342 /** State for a SOCKS connection: waiting for a completed circuit. */
343 #define AP_CONN_STATE_CIRCUIT_WAIT 8
344 /** State for a SOCKS connection: sent BEGIN, waiting for CONNECTED. */
345 #define AP_CONN_STATE_CONNECT_WAIT 9
346 /** State for a SOCKS connection: sent RESOLVE, waiting for RESOLVED. */
347 #define AP_CONN_STATE_RESOLVE_WAIT 10
348 /** State for a SOCKS connection: ready to send and receive. */
349 #define AP_CONN_STATE_OPEN 11
350 /** State for a transparent natd connection: waiting for original
352 #define AP_CONN_STATE_NATD_WAIT 12
353 /** State for an HTTP tunnel: waiting for an HTTP CONNECT command. */
354 #define AP_CONN_STATE_HTTP_CONNECT_WAIT 13
355 #define AP_CONN_STATE_MAX_ 13
357 /** True iff the AP_CONN_STATE_* value <b>s</b> means that the corresponding
358 * edge connection is not attached to any circuit. */
359 #define AP_CONN_STATE_IS_UNATTACHED(s) \
360 ((s) <= AP_CONN_STATE_CIRCUIT_WAIT || (s) == AP_CONN_STATE_NATD_WAIT)
362 #define DIR_CONN_STATE_MIN_ 1
363 /** State for connection to directory server: waiting for connect(). */
364 #define DIR_CONN_STATE_CONNECTING 1
365 /** State for connection to directory server: sending HTTP request. */
366 #define DIR_CONN_STATE_CLIENT_SENDING 2
367 /** State for connection to directory server: reading HTTP response. */
368 #define DIR_CONN_STATE_CLIENT_READING 3
369 /** State for connection to directory server: happy and finished. */
370 #define DIR_CONN_STATE_CLIENT_FINISHED 4
371 /** State for connection at directory server: waiting for HTTP request. */
372 #define DIR_CONN_STATE_SERVER_COMMAND_WAIT 5
373 /** State for connection at directory server: sending HTTP response. */
374 #define DIR_CONN_STATE_SERVER_WRITING 6
375 #define DIR_CONN_STATE_MAX_ 6
377 /** True iff the purpose of <b>conn</b> means that it's a server-side
378 * directory connection. */
379 #define DIR_CONN_IS_SERVER(conn) ((conn)->purpose == DIR_PURPOSE_SERVER)
381 #define CONTROL_CONN_STATE_MIN_ 1
382 /** State for a control connection: Authenticated and accepting v1 commands. */
383 #define CONTROL_CONN_STATE_OPEN 1
384 /** State for a control connection: Waiting for authentication; speaking
386 #define CONTROL_CONN_STATE_NEEDAUTH 2
387 #define CONTROL_CONN_STATE_MAX_ 2
389 #define DIR_PURPOSE_MIN_ 4
390 /** A connection to a directory server: set after a v2 rendezvous
391 * descriptor is downloaded. */
392 #define DIR_PURPOSE_HAS_FETCHED_RENDDESC_V2 4
393 /** A connection to a directory server: download one or more server
395 #define DIR_PURPOSE_FETCH_SERVERDESC 6
396 /** A connection to a directory server: download one or more extra-info
398 #define DIR_PURPOSE_FETCH_EXTRAINFO 7
399 /** A connection to a directory server: upload a server descriptor. */
400 #define DIR_PURPOSE_UPLOAD_DIR 8
401 /** A connection to a directory server: upload a v3 networkstatus vote. */
402 #define DIR_PURPOSE_UPLOAD_VOTE 10
403 /** A connection to a directory server: upload a v3 consensus signature */
404 #define DIR_PURPOSE_UPLOAD_SIGNATURES 11
405 /** A connection to a directory server: download one or more v3 networkstatus
407 #define DIR_PURPOSE_FETCH_STATUS_VOTE 12
408 /** A connection to a directory server: download a v3 detached signatures
409 * object for a consensus. */
410 #define DIR_PURPOSE_FETCH_DETACHED_SIGNATURES 13
411 /** A connection to a directory server: download a v3 networkstatus
413 #define DIR_PURPOSE_FETCH_CONSENSUS 14
414 /** A connection to a directory server: download one or more directory
415 * authority certificates. */
416 #define DIR_PURPOSE_FETCH_CERTIFICATE 15
418 /** Purpose for connection at a directory server. */
419 #define DIR_PURPOSE_SERVER 16
420 /** A connection to a hidden service directory server: upload a v2 rendezvous
422 #define DIR_PURPOSE_UPLOAD_RENDDESC_V2 17
423 /** A connection to a hidden service directory server: download a v2 rendezvous
425 #define DIR_PURPOSE_FETCH_RENDDESC_V2 18
426 /** A connection to a directory server: download a microdescriptor. */
427 #define DIR_PURPOSE_FETCH_MICRODESC 19
428 /** A connection to a hidden service directory: upload a v3 descriptor. */
429 #define DIR_PURPOSE_UPLOAD_HSDESC 20
430 /** A connection to a hidden service directory: fetch a v3 descriptor. */
431 #define DIR_PURPOSE_FETCH_HSDESC 21
432 /** A connection to a directory server: set after a hidden service descriptor
434 #define DIR_PURPOSE_HAS_FETCHED_HSDESC 22
435 #define DIR_PURPOSE_MAX_ 22
437 /** True iff <b>p</b> is a purpose corresponding to uploading
438 * data to a directory server. */
439 #define DIR_PURPOSE_IS_UPLOAD(p) \
440 ((p)==DIR_PURPOSE_UPLOAD_DIR || \
441 (p)==DIR_PURPOSE_UPLOAD_VOTE || \
442 (p)==DIR_PURPOSE_UPLOAD_SIGNATURES || \
443 (p)==DIR_PURPOSE_UPLOAD_RENDDESC_V2 || \
444 (p)==DIR_PURPOSE_UPLOAD_HSDESC)
446 #define EXIT_PURPOSE_MIN_ 1
447 /** This exit stream wants to do an ordinary connect. */
448 #define EXIT_PURPOSE_CONNECT 1
449 /** This exit stream wants to do a resolve (either normal or reverse). */
450 #define EXIT_PURPOSE_RESOLVE 2
451 #define EXIT_PURPOSE_MAX_ 2
453 /* !!!! If any connection purpose is ever over 31, we must grow the type
454 * field in connection_t. */
456 /** Circuit state: I'm the origin, still haven't done all my handshakes. */
457 #define CIRCUIT_STATE_BUILDING 0
458 /** Circuit state: Waiting to process the onionskin. */
459 #define CIRCUIT_STATE_ONIONSKIN_PENDING 1
460 /** Circuit state: I'd like to deliver a create, but my n_chan is still
462 #define CIRCUIT_STATE_CHAN_WAIT 2
463 /** Circuit state: the circuit is open but we don't want to actually use it
464 * until we find out if a better guard will be available.
466 #define CIRCUIT_STATE_GUARD_WAIT 3
467 /** Circuit state: onionskin(s) processed, ready to send/receive cells. */
468 #define CIRCUIT_STATE_OPEN 4
470 #define CIRCUIT_PURPOSE_MIN_ 1
472 /* these circuits were initiated elsewhere */
473 #define CIRCUIT_PURPOSE_OR_MIN_ 1
474 /** OR-side circuit purpose: normal circuit, at OR. */
475 #define CIRCUIT_PURPOSE_OR 1
476 /** OR-side circuit purpose: At OR, from the service, waiting for intro from
478 #define CIRCUIT_PURPOSE_INTRO_POINT 2
479 /** OR-side circuit purpose: At OR, from the client, waiting for the service.
481 #define CIRCUIT_PURPOSE_REND_POINT_WAITING 3
482 /** OR-side circuit purpose: At OR, both circuits have this purpose. */
483 #define CIRCUIT_PURPOSE_REND_ESTABLISHED 4
484 #define CIRCUIT_PURPOSE_OR_MAX_ 4
486 /* these circuits originate at this node */
488 /* here's how circ client-side purposes work:
489 * normal circuits are C_GENERAL.
490 * circuits that are c_introducing are either on their way to
491 * becoming open, or they are open and waiting for a
492 * suitable rendcirc before they send the intro.
493 * circuits that are c_introduce_ack_wait have sent the intro,
494 * but haven't gotten a response yet.
495 * circuits that are c_establish_rend are either on their way
496 * to becoming open, or they are open and have sent the
497 * establish_rendezvous cell but haven't received an ack.
498 * circuits that are c_rend_ready are open and have received a
499 * rend ack, but haven't heard from the service yet. if they have a
500 * buildstate->pending_final_cpath then they're expecting a
501 * cell from the service, else they're not.
502 * circuits that are c_rend_ready_intro_acked are open, and
503 * some intro circ has sent its intro and received an ack.
504 * circuits that are c_rend_joined are open, have heard from
505 * the service, and are talking to it.
507 /** Client-side circuit purpose: Normal circuit, with cpath. */
508 #define CIRCUIT_PURPOSE_C_GENERAL 5
509 #define CIRCUIT_PURPOSE_C_HS_MIN_ 6
510 /** Client-side circuit purpose: at the client, connecting to intro point. */
511 #define CIRCUIT_PURPOSE_C_INTRODUCING 6
512 /** Client-side circuit purpose: at the client, sent INTRODUCE1 to intro point,
513 * waiting for ACK/NAK. */
514 #define CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT 7
515 /** Client-side circuit purpose: at the client, introduced and acked, closing.
517 #define CIRCUIT_PURPOSE_C_INTRODUCE_ACKED 8
518 /** Client-side circuit purpose: at the client, waiting for ack. */
519 #define CIRCUIT_PURPOSE_C_ESTABLISH_REND 9
520 /** Client-side circuit purpose: at the client, waiting for the service. */
521 #define CIRCUIT_PURPOSE_C_REND_READY 10
522 /** Client-side circuit purpose: at the client, waiting for the service,
523 * INTRODUCE has been acknowledged. */
524 #define CIRCUIT_PURPOSE_C_REND_READY_INTRO_ACKED 11
525 /** Client-side circuit purpose: at the client, rendezvous established. */
526 #define CIRCUIT_PURPOSE_C_REND_JOINED 12
527 /** This circuit is used for getting hsdirs */
528 #define CIRCUIT_PURPOSE_C_HSDIR_GET 13
529 #define CIRCUIT_PURPOSE_C_HS_MAX_ 13
530 /** This circuit is used for build time measurement only */
531 #define CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT 14
532 #define CIRCUIT_PURPOSE_C_MAX_ 14
534 #define CIRCUIT_PURPOSE_S_HS_MIN_ 15
535 /** Hidden-service-side circuit purpose: at the service, waiting for
537 #define CIRCUIT_PURPOSE_S_ESTABLISH_INTRO 15
538 /** Hidden-service-side circuit purpose: at the service, successfully
539 * established intro. */
540 #define CIRCUIT_PURPOSE_S_INTRO 16
541 /** Hidden-service-side circuit purpose: at the service, connecting to rend
543 #define CIRCUIT_PURPOSE_S_CONNECT_REND 17
544 /** Hidden-service-side circuit purpose: at the service, rendezvous
546 #define CIRCUIT_PURPOSE_S_REND_JOINED 18
547 /** This circuit is used for uploading hsdirs */
548 #define CIRCUIT_PURPOSE_S_HSDIR_POST 19
549 #define CIRCUIT_PURPOSE_S_HS_MAX_ 19
551 /** A testing circuit; not meant to be used for actual traffic. */
552 #define CIRCUIT_PURPOSE_TESTING 20
553 /** A controller made this circuit and Tor should not use it. */
554 #define CIRCUIT_PURPOSE_CONTROLLER 21
555 /** This circuit is used for path bias probing only */
556 #define CIRCUIT_PURPOSE_PATH_BIAS_TESTING 22
558 /** This circuit is used for vanguards/restricted paths.
560 * This type of circuit is *only* created preemptively and never
561 * on-demand. When an HS operation needs to take place (e.g. connect to an
562 * intro point), these circuits are then cannibalized and repurposed to the
563 * actual needed HS purpose. */
564 #define CIRCUIT_PURPOSE_HS_VANGUARDS 23
566 #define CIRCUIT_PURPOSE_MAX_ 23
567 /** A catch-all for unrecognized purposes. Currently we don't expect
568 * to make or see any circuits with this purpose. */
569 #define CIRCUIT_PURPOSE_UNKNOWN 255
571 /** True iff the circuit purpose <b>p</b> is for a circuit that
572 * originated at this node. */
573 #define CIRCUIT_PURPOSE_IS_ORIGIN(p) ((p)>CIRCUIT_PURPOSE_OR_MAX_)
574 /** True iff the circuit purpose <b>p</b> is for a circuit that originated
575 * here to serve as a client. (Hidden services don't count here.) */
576 #define CIRCUIT_PURPOSE_IS_CLIENT(p) \
577 ((p)> CIRCUIT_PURPOSE_OR_MAX_ && \
578 (p)<=CIRCUIT_PURPOSE_C_MAX_)
579 /** True iff the circuit_t <b>c</b> is actually an origin_circuit_t. */
580 #define CIRCUIT_IS_ORIGIN(c) (CIRCUIT_PURPOSE_IS_ORIGIN((c)->purpose))
581 /** True iff the circuit purpose <b>p</b> is for an established rendezvous
583 #define CIRCUIT_PURPOSE_IS_ESTABLISHED_REND(p) \
584 ((p) == CIRCUIT_PURPOSE_C_REND_JOINED || \
585 (p) == CIRCUIT_PURPOSE_S_REND_JOINED)
586 /** True iff the circuit_t c is actually an or_circuit_t */
587 #define CIRCUIT_IS_ORCIRC(c) (((circuit_t *)(c))->magic == OR_CIRCUIT_MAGIC)
589 /** How many circuits do we want simultaneously in-progress to handle
591 #define MIN_CIRCUITS_HANDLING_STREAM 2
593 /* These RELAY_COMMAND constants define values for relay cell commands, and
594 * must match those defined in tor-spec.txt. */
595 #define RELAY_COMMAND_BEGIN 1
596 #define RELAY_COMMAND_DATA 2
597 #define RELAY_COMMAND_END 3
598 #define RELAY_COMMAND_CONNECTED 4
599 #define RELAY_COMMAND_SENDME 5
600 #define RELAY_COMMAND_EXTEND 6
601 #define RELAY_COMMAND_EXTENDED 7
602 #define RELAY_COMMAND_TRUNCATE 8
603 #define RELAY_COMMAND_TRUNCATED 9
604 #define RELAY_COMMAND_DROP 10
605 #define RELAY_COMMAND_RESOLVE 11
606 #define RELAY_COMMAND_RESOLVED 12
607 #define RELAY_COMMAND_BEGIN_DIR 13
608 #define RELAY_COMMAND_EXTEND2 14
609 #define RELAY_COMMAND_EXTENDED2 15
611 #define RELAY_COMMAND_ESTABLISH_INTRO 32
612 #define RELAY_COMMAND_ESTABLISH_RENDEZVOUS 33
613 #define RELAY_COMMAND_INTRODUCE1 34
614 #define RELAY_COMMAND_INTRODUCE2 35
615 #define RELAY_COMMAND_RENDEZVOUS1 36
616 #define RELAY_COMMAND_RENDEZVOUS2 37
617 #define RELAY_COMMAND_INTRO_ESTABLISHED 38
618 #define RELAY_COMMAND_RENDEZVOUS_ESTABLISHED 39
619 #define RELAY_COMMAND_INTRODUCE_ACK 40
621 /* Reasons why an OR connection is closed. */
622 #define END_OR_CONN_REASON_DONE 1
623 #define END_OR_CONN_REASON_REFUSED 2 /* connection refused */
624 #define END_OR_CONN_REASON_OR_IDENTITY 3
625 #define END_OR_CONN_REASON_CONNRESET 4 /* connection reset by peer */
626 #define END_OR_CONN_REASON_TIMEOUT 5
627 #define END_OR_CONN_REASON_NO_ROUTE 6 /* no route to host/net */
628 #define END_OR_CONN_REASON_IO_ERROR 7 /* read/write error */
629 #define END_OR_CONN_REASON_RESOURCE_LIMIT 8 /* sockets, buffers, etc */
630 #define END_OR_CONN_REASON_PT_MISSING 9 /* PT failed or not available */
631 #define END_OR_CONN_REASON_MISC 10
633 /* Reasons why we (or a remote OR) might close a stream. See tor-spec.txt for
634 * documentation of these. The values must match. */
635 #define END_STREAM_REASON_MISC 1
636 #define END_STREAM_REASON_RESOLVEFAILED 2
637 #define END_STREAM_REASON_CONNECTREFUSED 3
638 #define END_STREAM_REASON_EXITPOLICY 4
639 #define END_STREAM_REASON_DESTROY 5
640 #define END_STREAM_REASON_DONE 6
641 #define END_STREAM_REASON_TIMEOUT 7
642 #define END_STREAM_REASON_NOROUTE 8
643 #define END_STREAM_REASON_HIBERNATING 9
644 #define END_STREAM_REASON_INTERNAL 10
645 #define END_STREAM_REASON_RESOURCELIMIT 11
646 #define END_STREAM_REASON_CONNRESET 12
647 #define END_STREAM_REASON_TORPROTOCOL 13
648 #define END_STREAM_REASON_NOTDIRECTORY 14
649 #define END_STREAM_REASON_ENTRYPOLICY 15
651 /* These high-numbered end reasons are not part of the official spec,
652 * and are not intended to be put in relay end cells. They are here
653 * to be more informative when sending back socks replies to the
655 /* XXXX 256 is no longer used; feel free to reuse it. */
656 /** We were unable to attach the connection to any circuit at all. */
657 /* XXXX the ways we use this one don't make a lot of sense. */
658 #define END_STREAM_REASON_CANT_ATTACH 257
659 /** We can't connect to any directories at all, so we killed our streams
660 * before they can time out. */
661 #define END_STREAM_REASON_NET_UNREACHABLE 258
662 /** This is a SOCKS connection, and the client used (or misused) the SOCKS
663 * protocol in a way we couldn't handle. */
664 #define END_STREAM_REASON_SOCKSPROTOCOL 259
665 /** This is a transparent proxy connection, but we can't extract the original
666 * target address:port. */
667 #define END_STREAM_REASON_CANT_FETCH_ORIG_DEST 260
668 /** This is a connection on the NATD port, and the destination IP:Port was
669 * either ill-formed or out-of-range. */
670 #define END_STREAM_REASON_INVALID_NATD_DEST 261
671 /** The target address is in a private network (like 127.0.0.1 or 10.0.0.1);
672 * you don't want to do that over a randomly chosen exit */
673 #define END_STREAM_REASON_PRIVATE_ADDR 262
674 /** This is an HTTP tunnel connection and the client used or misused HTTP in a
675 * way we can't handle.
677 #define END_STREAM_REASON_HTTPPROTOCOL 263
679 /** Bitwise-and this value with endreason to mask out all flags. */
680 #define END_STREAM_REASON_MASK 511
682 /** Bitwise-or this with the argument to control_event_stream_status
683 * to indicate that the reason came from an END cell. */
684 #define END_STREAM_REASON_FLAG_REMOTE 512
685 /** Bitwise-or this with the argument to control_event_stream_status
686 * to indicate that we already sent a CLOSED stream event. */
687 #define END_STREAM_REASON_FLAG_ALREADY_SENT_CLOSED 1024
688 /** Bitwise-or this with endreason to indicate that we already sent
689 * a socks reply, and no further reply needs to be sent from
690 * connection_mark_unattached_ap(). */
691 #define END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED 2048
693 /** Reason for remapping an AP connection's address: we have a cached
695 #define REMAP_STREAM_SOURCE_CACHE 1
696 /** Reason for remapping an AP connection's address: the exit node told us an
698 #define REMAP_STREAM_SOURCE_EXIT 2
700 /* 'type' values to use in RESOLVED cells. Specified in tor-spec.txt. */
701 #define RESOLVED_TYPE_HOSTNAME 0
702 #define RESOLVED_TYPE_IPV4 4
703 #define RESOLVED_TYPE_IPV6 6
704 #define RESOLVED_TYPE_ERROR_TRANSIENT 0xF0
705 #define RESOLVED_TYPE_ERROR 0xF1
707 /* Negative reasons are internal: we never send them in a DESTROY or TRUNCATE
708 * call; they only go to the controller for tracking */
710 /* Closing introduction point that were opened in parallel. */
711 #define END_CIRC_REASON_IP_NOW_REDUNDANT -4
713 /** Our post-timeout circuit time measurement period expired.
714 * We must give up now */
715 #define END_CIRC_REASON_MEASUREMENT_EXPIRED -3
717 /** We couldn't build a path for this circuit. */
718 #define END_CIRC_REASON_NOPATH -2
719 /** Catch-all "other" reason for closing origin circuits. */
720 #define END_CIRC_AT_ORIGIN -1
722 /* Reasons why we (or a remote OR) might close a circuit. See tor-spec.txt for
723 * documentation of these. */
724 #define END_CIRC_REASON_MIN_ 0
725 #define END_CIRC_REASON_NONE 0
726 #define END_CIRC_REASON_TORPROTOCOL 1
727 #define END_CIRC_REASON_INTERNAL 2
728 #define END_CIRC_REASON_REQUESTED 3
729 #define END_CIRC_REASON_HIBERNATING 4
730 #define END_CIRC_REASON_RESOURCELIMIT 5
731 #define END_CIRC_REASON_CONNECTFAILED 6
732 #define END_CIRC_REASON_OR_IDENTITY 7
733 #define END_CIRC_REASON_CHANNEL_CLOSED 8
734 #define END_CIRC_REASON_FINISHED 9
735 #define END_CIRC_REASON_TIMEOUT 10
736 #define END_CIRC_REASON_DESTROYED 11
737 #define END_CIRC_REASON_NOSUCHSERVICE 12
738 #define END_CIRC_REASON_MAX_ 12
740 /** Bitwise-OR this with the argument to circuit_mark_for_close() or
741 * control_event_circuit_status() to indicate that the reason was
742 * passed through from a destroy or truncate cell. */
743 #define END_CIRC_REASON_FLAG_REMOTE 512
745 /** Length of 'y' portion of 'y.onion' URL. */
746 #define REND_SERVICE_ID_LEN_BASE32 16
748 /** Length of 'y.onion' including '.onion' URL. */
749 #define REND_SERVICE_ADDRESS_LEN (16+1+5)
751 /** Length of a binary-encoded rendezvous service ID. */
752 #define REND_SERVICE_ID_LEN 10
754 /** Time period for which a v2 descriptor will be valid. */
755 #define REND_TIME_PERIOD_V2_DESC_VALIDITY (24*60*60)
757 /** Time period within which two sets of v2 descriptors will be uploaded in
759 #define REND_TIME_PERIOD_OVERLAPPING_V2_DESCS (60*60)
761 /** Number of non-consecutive replicas (i.e. distributed somewhere
762 * in the ring) for a descriptor. */
763 #define REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS 2
765 /** Number of consecutive replicas for a descriptor. */
766 #define REND_NUMBER_OF_CONSECUTIVE_REPLICAS 3
768 /** Length of v2 descriptor ID (32 base32 chars = 160 bits). */
769 #define REND_DESC_ID_V2_LEN_BASE32 BASE32_DIGEST_LEN
771 /** Length of the base32-encoded secret ID part of versioned hidden service
773 #define REND_SECRET_ID_PART_LEN_BASE32 BASE32_DIGEST_LEN
775 /** Length of the base32-encoded hash of an introduction point's
777 #define REND_INTRO_POINT_ID_LEN_BASE32 BASE32_DIGEST_LEN
779 /** Length of the descriptor cookie that is used for client authorization
780 * to hidden services. */
781 #define REND_DESC_COOKIE_LEN 16
783 /** Length of the base64-encoded descriptor cookie that is used for
784 * exchanging client authorization between hidden service and client. */
785 #define REND_DESC_COOKIE_LEN_BASE64 22
787 /** Length of client identifier in encrypted introduction points for hidden
788 * service authorization type 'basic'. */
789 #define REND_BASIC_AUTH_CLIENT_ID_LEN 4
791 /** Multiple of the number of clients to which the real number of clients
792 * is padded with fake clients for hidden service authorization type
794 #define REND_BASIC_AUTH_CLIENT_MULTIPLE 16
796 /** Length of client entry consisting of client identifier and encrypted
797 * session key for hidden service authorization type 'basic'. */
798 #define REND_BASIC_AUTH_CLIENT_ENTRY_LEN (REND_BASIC_AUTH_CLIENT_ID_LEN \
801 /** Maximum size of v2 hidden service descriptors. */
802 #define REND_DESC_MAX_SIZE (20 * 1024)
804 /** Legal characters for use in authorized client names for a hidden
806 #define REND_LEGAL_CLIENTNAME_CHARACTERS \
807 "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-_"
809 /** Maximum length of authorized client names for a hidden service. */
810 #define REND_CLIENTNAME_MAX_LEN 16
812 /** Length of the rendezvous cookie that is used to connect circuits at the
813 * rendezvous point. */
814 #define REND_COOKIE_LEN DIGEST_LEN
816 /** Client authorization type that a hidden service performs. */
817 typedef enum rend_auth_type_t
{
820 REND_STEALTH_AUTH
= 2,
823 /** Client-side configuration of authorization for a hidden service. */
824 typedef struct rend_service_authorization_t
{
825 uint8_t descriptor_cookie
[REND_DESC_COOKIE_LEN
];
826 char onion_address
[REND_SERVICE_ADDRESS_LEN
+1];
827 rend_auth_type_t auth_type
;
828 } rend_service_authorization_t
;
830 /** Client- and server-side data that is used for hidden service connection
831 * establishment. Not all fields contain data depending on where this struct
833 typedef struct rend_data_t
{
834 /* Hidden service protocol version of this base object. */
837 /** List of HSDir fingerprints on which this request has been sent to. This
838 * contains binary identity digest of the directory of size DIGEST_LEN. */
839 smartlist_t
*hsdirs_fp
;
841 /** Rendezvous cookie used by both, client and service. */
842 char rend_cookie
[REND_COOKIE_LEN
];
844 /** Number of streams associated with this rendezvous circuit. */
848 typedef struct rend_data_v2_t
{
849 /* Rendezvous base data. */
852 /** Onion address (without the .onion part) that a client requests. */
853 char onion_address
[REND_SERVICE_ID_LEN_BASE32
+1];
855 /** Descriptor ID for each replicas computed from the onion address. If
856 * the onion address is empty, this array MUST be empty. We keep them so
857 * we know when to purge our entry in the last hsdir request table. */
858 char descriptor_id
[REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS
][DIGEST_LEN
];
860 /** (Optional) descriptor cookie that is used by a client. */
861 char descriptor_cookie
[REND_DESC_COOKIE_LEN
];
863 /** Authorization type for accessing a service used by a client. */
864 rend_auth_type_t auth_type
;
866 /** Descriptor ID for a client request. The control port command HSFETCH
867 * uses this. It's set if the descriptor query should only use this
869 char desc_id_fetch
[DIGEST_LEN
];
871 /** Hash of the hidden service's PK used by a service. */
872 char rend_pk_digest
[DIGEST_LEN
];
875 /* From a base rend_data_t object <b>d</d>, return the v2 object. */
877 rend_data_v2_t
*TO_REND_DATA_V2(const rend_data_t
*d
)
880 tor_assert(d
->version
== 2);
881 return DOWNCAST(rend_data_v2_t
, d
);
884 /* Stub because we can't include hs_ident.h. */
885 struct hs_ident_edge_conn_t
;
886 struct hs_ident_dir_conn_t
;
887 struct hs_ident_circuit_t
;
888 /* Stub because we can't include hs_common.h. */
889 struct hsdir_index_t
;
891 /** Time interval for tracking replays of DH public keys received in
892 * INTRODUCE2 cells. Used only to avoid launching multiple
893 * simultaneous attempts to connect to the same rendezvous point. */
894 #define REND_REPLAY_TIME_INTERVAL (5 * 60)
896 /** Used to indicate which way a cell is going on a circuit. */
898 CELL_DIRECTION_IN
=1, /**< The cell is moving towards the origin. */
899 CELL_DIRECTION_OUT
=2, /**< The cell is moving away from the origin. */
902 /** Initial value for both sides of a circuit transmission window when the
903 * circuit is initialized. Measured in cells. */
904 #define CIRCWINDOW_START 1000
905 #define CIRCWINDOW_START_MIN 100
906 #define CIRCWINDOW_START_MAX 1000
907 /** Amount to increment a circuit window when we get a circuit SENDME. */
908 #define CIRCWINDOW_INCREMENT 100
909 /** Initial value on both sides of a stream transmission window when the
910 * stream is initialized. Measured in cells. */
911 #define STREAMWINDOW_START 500
912 /** Amount to increment a stream window when we get a stream SENDME. */
913 #define STREAMWINDOW_INCREMENT 50
915 /** Maximum number of queued cells on a circuit for which we are the
916 * midpoint before we give up and kill it. This must be >= circwindow
917 * to avoid killing innocent circuits, and >= circwindow*2 to give
918 * leaky-pipe a chance of working someday. The ORCIRC_MAX_MIDDLE_KILL_THRESH
919 * ratio controls the margin of error between emitting a warning and
920 * killing the circuit.
922 #define ORCIRC_MAX_MIDDLE_CELLS (CIRCWINDOW_START_MAX*2)
923 /** Ratio of hard (circuit kill) to soft (warning) thresholds for the
924 * ORCIRC_MAX_MIDDLE_CELLS tests.
926 #define ORCIRC_MAX_MIDDLE_KILL_THRESH (1.1f)
928 /* Cell commands. These values are defined in tor-spec.txt. */
929 #define CELL_PADDING 0
930 #define CELL_CREATE 1
931 #define CELL_CREATED 2
933 #define CELL_DESTROY 4
934 #define CELL_CREATE_FAST 5
935 #define CELL_CREATED_FAST 6
936 #define CELL_VERSIONS 7
937 #define CELL_NETINFO 8
938 #define CELL_RELAY_EARLY 9
939 #define CELL_CREATE2 10
940 #define CELL_CREATED2 11
941 #define CELL_PADDING_NEGOTIATE 12
943 #define CELL_VPADDING 128
944 #define CELL_CERTS 129
945 #define CELL_AUTH_CHALLENGE 130
946 #define CELL_AUTHENTICATE 131
947 #define CELL_AUTHORIZE 132
948 #define CELL_COMMAND_MAX_ 132
950 /** How long to test reachability before complaining to the user. */
951 #define TIMEOUT_UNTIL_UNREACHABILITY_COMPLAINT (20*60)
953 /** Legal characters in a nickname. */
954 #define LEGAL_NICKNAME_CHARACTERS \
955 "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
957 /** Name to use in client TLS certificates if no nickname is given. Once
958 * Tor 0.1.2.x is obsolete, we can remove this. */
959 #define DEFAULT_CLIENT_NICKNAME "client"
961 /** Name chosen by routers that don't configure nicknames */
962 #define UNNAMED_ROUTER_NICKNAME "Unnamed"
964 /** Number of bytes in a SOCKS4 header. */
965 #define SOCKS4_NETWORK_LEN 8
969 * Relay command [1 byte]
970 * Recognized [2 bytes]
971 * Stream ID [2 bytes]
972 * Partial SHA-1 [4 bytes]
974 * Relay payload [498 bytes]
977 /** Number of bytes in a cell, minus cell header. */
978 #define CELL_PAYLOAD_SIZE 509
979 /** Number of bytes in a cell transmitted over the network, in the longest
981 #define CELL_MAX_NETWORK_SIZE 514
983 /** Maximum length of a header on a variable-length cell. */
984 #define VAR_CELL_MAX_HEADER_SIZE 7
986 static int get_cell_network_size(int wide_circ_ids
);
987 static inline int get_cell_network_size(int wide_circ_ids
)
989 return wide_circ_ids
? CELL_MAX_NETWORK_SIZE
: CELL_MAX_NETWORK_SIZE
- 2;
991 static int get_var_cell_header_size(int wide_circ_ids
);
992 static inline int get_var_cell_header_size(int wide_circ_ids
)
994 return wide_circ_ids
? VAR_CELL_MAX_HEADER_SIZE
:
995 VAR_CELL_MAX_HEADER_SIZE
- 2;
997 static int get_circ_id_size(int wide_circ_ids
);
998 static inline int get_circ_id_size(int wide_circ_ids
)
1000 return wide_circ_ids
? 4 : 2;
1003 /** Number of bytes in a relay cell's header (not including general cell
1005 #define RELAY_HEADER_SIZE (1+2+2+4+2)
1006 /** Largest number of bytes that can fit in a relay cell payload. */
1007 #define RELAY_PAYLOAD_SIZE (CELL_PAYLOAD_SIZE-RELAY_HEADER_SIZE)
1009 /** Identifies a circuit on an or_connection */
1010 typedef uint32_t circid_t
;
1011 /** Identifies a stream on a circuit */
1012 typedef uint16_t streamid_t
;
1014 /* channel_t typedef; struct channel_s is in channel.h */
1016 typedef struct channel_s channel_t
;
1018 /* channel_listener_t typedef; struct channel_listener_s is in channel.h */
1020 typedef struct channel_listener_s channel_listener_t
;
1022 /* channel states for channel_t */
1026 * Closed state - channel is inactive
1028 * Permitted transitions from:
1029 * - CHANNEL_STATE_CLOSING
1030 * Permitted transitions to:
1031 * - CHANNEL_STATE_OPENING
1033 CHANNEL_STATE_CLOSED
= 0,
1035 * Opening state - channel is trying to connect
1037 * Permitted transitions from:
1038 * - CHANNEL_STATE_CLOSED
1039 * Permitted transitions to:
1040 * - CHANNEL_STATE_CLOSING
1041 * - CHANNEL_STATE_ERROR
1042 * - CHANNEL_STATE_OPEN
1044 CHANNEL_STATE_OPENING
,
1046 * Open state - channel is active and ready for use
1048 * Permitted transitions from:
1049 * - CHANNEL_STATE_MAINT
1050 * - CHANNEL_STATE_OPENING
1051 * Permitted transitions to:
1052 * - CHANNEL_STATE_CLOSING
1053 * - CHANNEL_STATE_ERROR
1054 * - CHANNEL_STATE_MAINT
1058 * Maintenance state - channel is temporarily offline for subclass specific
1059 * maintenance activities such as TLS renegotiation.
1061 * Permitted transitions from:
1062 * - CHANNEL_STATE_OPEN
1063 * Permitted transitions to:
1064 * - CHANNEL_STATE_CLOSING
1065 * - CHANNEL_STATE_ERROR
1066 * - CHANNEL_STATE_OPEN
1068 CHANNEL_STATE_MAINT
,
1070 * Closing state - channel is shutting down
1072 * Permitted transitions from:
1073 * - CHANNEL_STATE_MAINT
1074 * - CHANNEL_STATE_OPEN
1075 * Permitted transitions to:
1076 * - CHANNEL_STATE_CLOSED,
1077 * - CHANNEL_STATE_ERROR
1079 CHANNEL_STATE_CLOSING
,
1081 * Error state - channel has experienced a permanent error
1083 * Permitted transitions from:
1084 * - CHANNEL_STATE_CLOSING
1085 * - CHANNEL_STATE_MAINT
1086 * - CHANNEL_STATE_OPENING
1087 * - CHANNEL_STATE_OPEN
1088 * Permitted transitions to:
1091 CHANNEL_STATE_ERROR
,
1093 * Placeholder for maximum state value
1098 /* channel listener states for channel_listener_t */
1102 * Closed state - channel listener is inactive
1104 * Permitted transitions from:
1105 * - CHANNEL_LISTENER_STATE_CLOSING
1106 * Permitted transitions to:
1107 * - CHANNEL_LISTENER_STATE_LISTENING
1109 CHANNEL_LISTENER_STATE_CLOSED
= 0,
1111 * Listening state - channel listener is listening for incoming
1114 * Permitted transitions from:
1115 * - CHANNEL_LISTENER_STATE_CLOSED
1116 * Permitted transitions to:
1117 * - CHANNEL_LISTENER_STATE_CLOSING
1118 * - CHANNEL_LISTENER_STATE_ERROR
1120 CHANNEL_LISTENER_STATE_LISTENING
,
1122 * Closing state - channel listener is shutting down
1124 * Permitted transitions from:
1125 * - CHANNEL_LISTENER_STATE_LISTENING
1126 * Permitted transitions to:
1127 * - CHANNEL_LISTENER_STATE_CLOSED,
1128 * - CHANNEL_LISTENER_STATE_ERROR
1130 CHANNEL_LISTENER_STATE_CLOSING
,
1132 * Error state - channel listener has experienced a permanent error
1134 * Permitted transitions from:
1135 * - CHANNEL_STATE_CLOSING
1136 * - CHANNEL_STATE_LISTENING
1137 * Permitted transitions to:
1140 CHANNEL_LISTENER_STATE_ERROR
,
1142 * Placeholder for maximum state value
1144 CHANNEL_LISTENER_STATE_LAST
1145 } channel_listener_state_t
;
1147 /* TLS channel stuff */
1149 typedef struct channel_tls_s channel_tls_t
;
1151 /* circuitmux_t typedef; struct circuitmux_s is in circuitmux.h */
1153 typedef struct circuitmux_s circuitmux_t
;
1155 /** Parsed onion routing cell. All communication between nodes
1157 typedef struct cell_t
{
1158 circid_t circ_id
; /**< Circuit which received the cell. */
1159 uint8_t command
; /**< Type of the cell: one of CELL_PADDING, CELL_CREATE,
1160 * CELL_DESTROY, etc */
1161 uint8_t payload
[CELL_PAYLOAD_SIZE
]; /**< Cell body. */
1164 /** Parsed variable-length onion routing cell. */
1165 typedef struct var_cell_t
{
1166 /** Type of the cell: CELL_VERSIONS, etc. */
1168 /** Circuit thich received the cell */
1170 /** Number of bytes actually stored in <b>payload</b> */
1171 uint16_t payload_len
;
1172 /** Payload of this cell */
1173 uint8_t payload
[FLEXIBLE_ARRAY_MEMBER
];
1176 /** A parsed Extended ORPort message. */
1177 typedef struct ext_or_cmd_t
{
1178 uint16_t cmd
; /** Command type */
1179 uint16_t len
; /** Body length */
1180 char body
[FLEXIBLE_ARRAY_MEMBER
]; /** Message body */
1183 /** A cell as packed for writing to the network. */
1184 typedef struct packed_cell_t
{
1185 /** Next cell queued on this circuit. */
1186 TOR_SIMPLEQ_ENTRY(packed_cell_t
) next
;
1187 char body
[CELL_MAX_NETWORK_SIZE
]; /**< Cell as packed for network. */
1188 uint32_t inserted_timestamp
; /**< Time (in timestamp units) when this cell
1192 /** A queue of cells on a circuit, waiting to be added to the
1193 * or_connection_t's outbuf. */
1194 typedef struct cell_queue_t
{
1195 /** Linked list of packed_cell_t*/
1196 TOR_SIMPLEQ_HEAD(cell_simpleq
, packed_cell_t
) head
;
1197 int n
; /**< The number of cells in the queue. */
1200 /** A single queued destroy cell. */
1201 typedef struct destroy_cell_t
{
1202 TOR_SIMPLEQ_ENTRY(destroy_cell_t
) next
;
1204 uint32_t inserted_timestamp
; /**< Time (in timestamp units) when this cell
1209 /** A queue of destroy cells on a channel. */
1210 typedef struct destroy_cell_queue_t
{
1211 /** Linked list of packed_cell_t */
1212 TOR_SIMPLEQ_HEAD(dcell_simpleq
, destroy_cell_t
) head
;
1213 int n
; /**< The number of cells in the queue. */
1214 } destroy_cell_queue_t
;
1216 /** Beginning of a RELAY cell payload. */
1218 uint8_t command
; /**< The end-to-end relay command. */
1219 uint16_t recognized
; /**< Used to tell whether cell is for us. */
1220 streamid_t stream_id
; /**< Which stream is this cell associated with? */
1221 char integrity
[4]; /**< Used to tell whether cell is corrupted. */
1222 uint16_t length
; /**< How long is the payload body? */
1225 typedef struct socks_request_t socks_request_t
;
1227 typedef struct entry_port_cfg_t
{
1228 /* Client port types (socks, dns, trans, natd) only: */
1229 uint8_t isolation_flags
; /**< Zero or more isolation flags */
1230 int session_group
; /**< A session group, or -1 if this port is not in a
1234 /** When both no-auth and user/pass are advertised by a SOCKS client, select
1236 unsigned int socks_prefer_no_auth
: 1;
1237 /** When ISO_SOCKSAUTH is in use, Keep-Alive circuits indefinitely. */
1238 unsigned int socks_iso_keep_alive
: 1;
1240 /* Client port types only: */
1241 unsigned int ipv4_traffic
: 1;
1242 unsigned int ipv6_traffic
: 1;
1243 unsigned int prefer_ipv6
: 1;
1244 unsigned int dns_request
: 1;
1245 unsigned int onion_traffic
: 1;
1247 /** For a socks listener: should we cache IPv4/IPv6 DNS information that
1248 * exit nodes tell us?
1251 unsigned int cache_ipv4_answers
: 1;
1252 unsigned int cache_ipv6_answers
: 1;
1254 /** For a socks listeners: if we find an answer in our client-side DNS cache,
1258 unsigned int use_cached_ipv4_answers
: 1;
1259 unsigned int use_cached_ipv6_answers
: 1;
1261 /** For socks listeners: When we can automap an address to IPv4 or IPv6,
1262 * do we prefer IPv6? */
1263 unsigned int prefer_ipv6_virtaddr
: 1;
1267 typedef struct server_port_cfg_t
{
1268 /* Server port types (or, dir) only: */
1269 unsigned int no_advertise
: 1;
1270 unsigned int no_listen
: 1;
1271 unsigned int all_addrs
: 1;
1272 unsigned int bind_ipv4_only
: 1;
1273 unsigned int bind_ipv6_only
: 1;
1274 } server_port_cfg_t
;
1276 /* Values for connection_t.magic: used to make sure that downcasts (casts from
1277 * connection_t to foo_connection_t) are safe. */
1278 #define BASE_CONNECTION_MAGIC 0x7C3C304Eu
1279 #define OR_CONNECTION_MAGIC 0x7D31FF03u
1280 #define EDGE_CONNECTION_MAGIC 0xF0374013u
1281 #define ENTRY_CONNECTION_MAGIC 0xbb4a5703
1282 #define DIR_CONNECTION_MAGIC 0x9988ffeeu
1283 #define CONTROL_CONNECTION_MAGIC 0x8abc765du
1284 #define LISTENER_CONNECTION_MAGIC 0x1a1ac741u
1288 /** Description of a connection to another host or process, and associated
1291 * A connection is named based on what it's connected to -- an "OR
1292 * connection" has a Tor node on the other end, an "exit
1293 * connection" has a website or other server on the other end, and an
1294 * "AP connection" has an application proxy (and thus a user) on the
1297 * Every connection has a type and a state. Connections never change
1298 * their type, but can go through many state changes in their lifetime.
1300 * Every connection has two associated input and output buffers.
1301 * Listeners don't use them. For non-listener connections, incoming
1302 * data is appended to conn->inbuf, and outgoing data is taken from
1303 * conn->outbuf. Connections differ primarily in the functions called
1304 * to fill and drain these buffers.
1306 typedef struct connection_t
{
1307 uint32_t magic
; /**< For memory debugging: must equal one of
1308 * *_CONNECTION_MAGIC. */
1310 uint8_t state
; /**< Current state of this connection. */
1311 unsigned int type
:5; /**< What kind of connection is this? */
1312 unsigned int purpose
:5; /**< Only used for DIR and EXIT types currently. */
1314 /* The next fields are all one-bit booleans. Some are only applicable to
1315 * connection subtypes, but we hold them here anyway, to save space.
1317 unsigned int read_blocked_on_bw
:1; /**< Boolean: should we start reading
1318 * again once the bandwidth throttler allows it? */
1319 unsigned int write_blocked_on_bw
:1; /**< Boolean: should we start writing
1320 * again once the bandwidth throttler allows
1322 unsigned int hold_open_until_flushed
:1; /**< Despite this connection's being
1323 * marked for close, do we flush it
1324 * before closing it? */
1325 unsigned int inbuf_reached_eof
:1; /**< Boolean: did read() return 0 on this
1327 /** Set to 1 when we're inside connection_flushed_some to keep us from
1328 * calling connection_handle_write() recursively. */
1329 unsigned int in_flushed_some
:1;
1330 /** True if connection_handle_write is currently running on this connection.
1332 unsigned int in_connection_handle_write
:1;
1334 /* For linked connections:
1336 unsigned int linked
:1; /**< True if there is, or has been, a linked_conn. */
1337 /** True iff we'd like to be notified about read events from the
1339 unsigned int reading_from_linked_conn
:1;
1340 /** True iff we're willing to write to the linked conn. */
1341 unsigned int writing_to_linked_conn
:1;
1342 /** True iff we're currently able to read on the linked conn, and our
1343 * read_event should be made active with libevent. */
1344 unsigned int active_on_link
:1;
1345 /** True iff we've called connection_close_immediate() on this linked
1347 unsigned int linked_conn_is_closed
:1;
1349 /** CONNECT/SOCKS proxy client handshake state (for outgoing connections). */
1350 unsigned int proxy_state
:4;
1352 /** Our socket; set to TOR_INVALID_SOCKET if this connection is closed,
1353 * or has no socket. */
1355 int conn_array_index
; /**< Index into the global connection array. */
1357 struct event
*read_event
; /**< Libevent event structure. */
1358 struct event
*write_event
; /**< Libevent event structure. */
1359 struct buf_t
*inbuf
; /**< Buffer holding data read over this connection. */
1360 struct buf_t
*outbuf
; /**< Buffer holding data to write over this
1362 size_t outbuf_flushlen
; /**< How much data should we try to flush from the
1364 time_t timestamp_lastread
; /**< When was the last time libevent said we could
1366 time_t timestamp_lastwritten
; /**< When was the last time libevent said we
1369 time_t timestamp_created
; /**< When was this connection_t created? */
1371 int socket_family
; /**< Address family of this connection's socket. Usually
1372 * AF_INET, but it can also be AF_UNIX, or AF_INET6 */
1373 tor_addr_t addr
; /**< IP that socket "s" is directly connected to;
1374 * may be the IP address for a proxy or pluggable transport,
1375 * see "address" for the address of the final destination.
1377 uint16_t port
; /**< If non-zero, port that socket "s" is directly connected
1378 * to; may be the port for a proxy or pluggable transport,
1379 * see "address" for the port at the final destination. */
1380 uint16_t marked_for_close
; /**< Should we close this conn on the next
1381 * iteration of the main loop? (If true, holds
1382 * the line number where this connection was
1384 const char *marked_for_close_file
; /**< For debugging: in which file were
1385 * we marked for close? */
1386 char *address
; /**< FQDN (or IP) and port of the final destination for this
1387 * connection; this is always the remote address, it is
1388 * passed to a proxy or pluggable transport if one in use.
1389 * See "addr" and "port" for the address that socket "s" is
1390 * directly connected to.
1391 * strdup into this, because free_connection() frees it. */
1392 /** Another connection that's connected to this one in lieu of a socket. */
1393 struct connection_t
*linked_conn
;
1395 /** Unique identifier for this connection on this Tor instance. */
1396 uint64_t global_identifier
;
1398 /** Bytes read since last call to control_event_conn_bandwidth_used().
1399 * Only used if we're configured to emit CONN_BW events. */
1400 uint32_t n_read_conn_bw
;
1402 /** Bytes written since last call to control_event_conn_bandwidth_used().
1403 * Only used if we're configured to emit CONN_BW events. */
1404 uint32_t n_written_conn_bw
;
1407 /** Subtype of connection_t; used for a listener socket. */
1408 typedef struct listener_connection_t
{
1411 /** If the connection is a CONN_TYPE_AP_DNS_LISTENER, this field points
1412 * to the evdns_server_port it uses to listen to and answer connections. */
1413 struct evdns_server_port
*dns_server_port
;
1415 entry_port_cfg_t entry_cfg
;
1417 } listener_connection_t
;
1419 /** Minimum length of the random part of an AUTH_CHALLENGE cell. */
1420 #define OR_AUTH_CHALLENGE_LEN 32
1423 * @name Certificate types for CERTS cells.
1425 * These values are defined by the protocol, and affect how an X509
1426 * certificate in a CERTS cell is interpreted and used.
1429 /** A certificate that authenticates a TLS link key. The subject key
1430 * must match the key used in the TLS handshake; it must be signed by
1431 * the identity key. */
1432 #define OR_CERT_TYPE_TLS_LINK 1
1433 /** A self-signed identity certificate. The subject key must be a
1434 * 1024-bit RSA key. */
1435 #define OR_CERT_TYPE_ID_1024 2
1436 /** A certificate that authenticates a key used in an AUTHENTICATE cell
1437 * in the v3 handshake. The subject key must be a 1024-bit RSA key; it
1438 * must be signed by the identity key */
1439 #define OR_CERT_TYPE_AUTH_1024 3
1441 #define OR_CERT_TYPE_RSA_ED_CROSSCERT 7
1444 /** The first supported type of AUTHENTICATE cell. It contains
1445 * a bunch of structures signed with an RSA1024 key. The signed
1446 * structures include a HMAC using negotiated TLS secrets, and a digest
1447 * of all cells sent or received before the AUTHENTICATE cell (including
1448 * the random server-generated AUTH_CHALLENGE cell).
1450 #define AUTHTYPE_RSA_SHA256_TLSSECRET 1
1451 /** As AUTHTYPE_RSA_SHA256_TLSSECRET, but instead of using the
1452 * negotiated TLS secrets, uses exported keying material from the TLS
1453 * session as described in RFC 5705.
1455 * Not used by today's tors, since everything that supports this
1456 * also supports ED25519_SHA256_5705, which is better.
1458 #define AUTHTYPE_RSA_SHA256_RFC5705 2
1459 /** As AUTHTYPE_RSA_SHA256_RFC5705, but uses an Ed25519 identity key to
1461 #define AUTHTYPE_ED25519_SHA256_RFC5705 3
1463 * NOTE: authchallenge_type_is_better() relies on these AUTHTYPE codes
1464 * being sorted in order of preference. If we someday add one with
1465 * a higher numerical value that we don't like as much, we should revise
1466 * authchallenge_type_is_better().
1469 /** The length of the part of the AUTHENTICATE cell body that the client and
1470 * server can generate independently (when using RSA_SHA256_TLSSECRET). It
1471 * contains everything except the client's timestamp, the client's randomly
1472 * generated nonce, and the signature. */
1473 #define V3_AUTH_FIXED_PART_LEN (8+(32*6))
1474 /** The length of the part of the AUTHENTICATE cell body that the client
1476 #define V3_AUTH_BODY_LEN (V3_AUTH_FIXED_PART_LEN + 8 + 16)
1478 /** Structure to hold all the certificates we've received on an OR connection
1480 typedef struct or_handshake_certs_t
{
1481 /** True iff we originated this connection. */
1483 /** The cert for the 'auth' RSA key that's supposed to sign the AUTHENTICATE
1484 * cell. Signed with the RSA identity key. */
1485 tor_x509_cert_t
*auth_cert
;
1486 /** The cert for the 'link' RSA key that was used to negotiate the TLS
1487 * connection. Signed with the RSA identity key. */
1488 tor_x509_cert_t
*link_cert
;
1489 /** A self-signed identity certificate: the RSA identity key signed
1491 tor_x509_cert_t
*id_cert
;
1492 /** The Ed25519 signing key, signed with the Ed25519 identity key. */
1493 struct tor_cert_st
*ed_id_sign
;
1494 /** A digest of the X509 link certificate for the TLS connection, signed
1495 * with the Ed25519 siging key. */
1496 struct tor_cert_st
*ed_sign_link
;
1497 /** The Ed25519 authentication key (that's supposed to sign an AUTHENTICATE
1498 * cell) , signed with the Ed25519 siging key. */
1499 struct tor_cert_st
*ed_sign_auth
;
1500 /** The Ed25519 identity key, crosssigned with the RSA identity key. */
1501 uint8_t *ed_rsa_crosscert
;
1502 /** The length of <b>ed_rsa_crosscert</b> in bytes */
1503 size_t ed_rsa_crosscert_len
;
1504 } or_handshake_certs_t
;
1506 /** Stores flags and information related to the portion of a v2/v3 Tor OR
1507 * connection handshake that happens after the TLS handshake is finished.
1509 typedef struct or_handshake_state_t
{
1510 /** When was the VERSIONS cell sent on this connection? Used to get
1511 * an estimate of the skew in the returning NETINFO reply. */
1512 time_t sent_versions_at
;
1513 /** True iff we originated this connection */
1514 unsigned int started_here
: 1;
1515 /** True iff we have received and processed a VERSIONS cell. */
1516 unsigned int received_versions
: 1;
1517 /** True iff we have received and processed an AUTH_CHALLENGE cell */
1518 unsigned int received_auth_challenge
: 1;
1519 /** True iff we have received and processed a CERTS cell. */
1520 unsigned int received_certs_cell
: 1;
1521 /** True iff we have received and processed an AUTHENTICATE cell */
1522 unsigned int received_authenticate
: 1;
1524 /* True iff we've received valid authentication to some identity. */
1525 unsigned int authenticated
: 1;
1526 unsigned int authenticated_rsa
: 1;
1527 unsigned int authenticated_ed25519
: 1;
1529 /* True iff we have sent a netinfo cell */
1530 unsigned int sent_netinfo
: 1;
1532 /** The signing->ed25519 link certificate corresponding to the x509
1533 * certificate we used on the TLS connection (if this is a server-side
1534 * connection). We make a copy of this here to prevent a race condition
1535 * caused by TLS context rotation. */
1536 struct tor_cert_st
*own_link_cert
;
1538 /** True iff we should feed outgoing cells into digest_sent and
1539 * digest_received respectively.
1541 * From the server's side of the v3 handshake, we want to capture everything
1542 * from the VERSIONS cell through and including the AUTH_CHALLENGE cell.
1543 * From the client's, we want to capture everything from the VERSIONS cell
1544 * through but *not* including the AUTHENTICATE cell.
1547 unsigned int digest_sent_data
: 1;
1548 unsigned int digest_received_data
: 1;
1551 /** Identity RSA digest that we have received and authenticated for our peer
1552 * on this connection. */
1553 uint8_t authenticated_rsa_peer_id
[DIGEST_LEN
];
1554 /** Identity Ed25519 public key that we have received and authenticated for
1555 * our peer on this connection. */
1556 ed25519_public_key_t authenticated_ed25519_peer_id
;
1558 /** Digests of the cells that we have sent or received as part of a V3
1559 * handshake. Used for making and checking AUTHENTICATE cells.
1563 crypto_digest_t
*digest_sent
;
1564 crypto_digest_t
*digest_received
;
1567 /** Certificates that a connection initiator sent us in a CERTS cell; we're
1568 * holding on to them until we get an AUTHENTICATE cell.
1570 or_handshake_certs_t
*certs
;
1571 } or_handshake_state_t
;
1573 /** Length of Extended ORPort connection identifier. */
1574 #define EXT_OR_CONN_ID_LEN DIGEST_LEN /* 20 */
1576 * OR_CONN_HIGHWATER and OR_CONN_LOWWATER moved from connection_or.c so
1577 * channeltls.c can see them too.
1580 /** When adding cells to an OR connection's outbuf, keep adding until the
1581 * outbuf is at least this long, or we run out of cells. */
1582 #define OR_CONN_HIGHWATER (32*1024)
1584 /** Add cells to an OR connection's outbuf whenever the outbuf's data length
1585 * drops below this size. */
1586 #define OR_CONN_LOWWATER (16*1024)
1588 /** Subtype of connection_t for an "OR connection" -- that is, one that speaks
1589 * cells over TLS. */
1590 typedef struct or_connection_t
{
1593 /** Hash of the public RSA key for the other side's identity key, or zeroes
1594 * if the other side hasn't shown us a valid identity key. */
1595 char identity_digest
[DIGEST_LEN
];
1597 /** Extended ORPort connection identifier. */
1598 char *ext_or_conn_id
;
1599 /** This is the ClientHash value we expect to receive from the
1600 * client during the Extended ORPort authentication protocol. We
1601 * compute it upon receiving the ClientNoce from the client, and we
1602 * compare it with the acual ClientHash value sent by the
1604 char *ext_or_auth_correct_client_hash
;
1605 /** String carrying the name of the pluggable transport
1606 * (e.g. "obfs2") that is obfuscating this connection. If no
1607 * pluggable transports are used, it's NULL. */
1608 char *ext_or_transport
;
1610 char *nickname
; /**< Nickname of OR on other side (if any). */
1612 tor_tls_t
*tls
; /**< TLS connection state. */
1613 int tls_error
; /**< Last tor_tls error code. */
1614 /** When we last used this conn for any client traffic. If not
1615 * recent, we can rate limit it further. */
1617 /* Channel using this connection */
1618 channel_tls_t
*chan
;
1620 tor_addr_t real_addr
; /**< The actual address that this connection came from
1621 * or went to. The <b>addr</b> field is prone to
1622 * getting overridden by the address from the router
1623 * descriptor matching <b>identity_digest</b>. */
1625 /** Should this connection be used for extending circuits to the server
1626 * matching the <b>identity_digest</b> field? Set to true if we're pretty
1627 * sure we aren't getting MITMed, either because we're connected to an
1628 * address listed in a server descriptor, or because an authenticated
1629 * NETINFO cell listed the address we're connected to as recognized. */
1630 unsigned int is_canonical
:1;
1632 /** True iff this is an outgoing connection. */
1633 unsigned int is_outgoing
:1;
1634 unsigned int proxy_type
:2; /**< One of PROXY_NONE...PROXY_SOCKS5 */
1635 unsigned int wide_circ_ids
:1;
1636 /** True iff this connection has had its bootstrap failure logged with
1637 * control_event_bootstrap_problem. */
1638 unsigned int have_noted_bootstrap_problem
:1;
1640 uint16_t link_proto
; /**< What protocol version are we using? 0 for
1641 * "none negotiated yet." */
1642 uint16_t idle_timeout
; /**< How long can this connection sit with no
1643 * circuits on it before we close it? Based on
1644 * IDLE_CIRCUIT_TIMEOUT_{NON,}CANONICAL and
1645 * on is_canonical, randomized. */
1646 or_handshake_state_t
*handshake_state
; /**< If we are setting this connection
1647 * up, state information to do so. */
1649 time_t timestamp_lastempty
; /**< When was the outbuf last completely empty?*/
1651 /* bandwidth* and *_bucket only used by ORs in OPEN state: */
1652 int bandwidthrate
; /**< Bytes/s added to the bucket. (OPEN ORs only.) */
1653 int bandwidthburst
; /**< Max bucket size for this conn. (OPEN ORs only.) */
1654 int read_bucket
; /**< When this hits 0, stop receiving. Every second we
1655 * add 'bandwidthrate' to this, capping it at
1656 * bandwidthburst. (OPEN ORs only) */
1657 int write_bucket
; /**< When this hits 0, stop writing. Like read_bucket. */
1659 /** Last emptied read token bucket in msec since midnight; only used if
1660 * TB_EMPTY events are enabled. */
1661 uint32_t read_emptied_time
;
1662 /** Last emptied write token bucket in msec since midnight; only used if
1663 * TB_EMPTY events are enabled. */
1664 uint32_t write_emptied_time
;
1667 * Count the number of bytes flushed out on this orconn, and the number of
1668 * bytes TLS actually sent - used for overhead estimation for scheduling.
1670 uint64_t bytes_xmitted
, bytes_xmitted_by_tls
;
1673 /** Subtype of connection_t for an "edge connection" -- that is, an entry (ap)
1674 * connection, or an exit. */
1675 typedef struct edge_connection_t
{
1678 struct edge_connection_t
*next_stream
; /**< Points to the next stream at this
1680 int package_window
; /**< How many more relay cells can I send into the
1682 int deliver_window
; /**< How many more relay cells can end at me? */
1684 struct circuit_t
*on_circuit
; /**< The circuit (if any) that this edge
1685 * connection is using. */
1687 /** A pointer to which node in the circ this conn exits at. Set for AP
1688 * connections and for hidden service exit connections. */
1689 struct crypt_path_t
*cpath_layer
;
1690 /** What rendezvous service are we querying for (if an AP) or providing (if
1692 rend_data_t
*rend_data
;
1694 /* Hidden service connection identifier for edge connections. Used by the HS
1695 * client-side code to identify client SOCKS connections and by the
1696 * service-side code to match HS circuits with their streams. */
1697 struct hs_ident_edge_conn_t
*hs_ident
;
1699 uint32_t address_ttl
; /**< TTL for address-to-addr mapping on exit
1700 * connection. Exit connections only. */
1701 uint32_t begincell_flags
; /** Flags sent or received in the BEGIN cell
1702 * for this connection */
1704 streamid_t stream_id
; /**< The stream ID used for this edge connection on its
1707 /** The reason why this connection is closing; passed to the controller. */
1708 uint16_t end_reason
;
1710 /** Bytes read since last call to control_event_stream_bandwidth_used() */
1713 /** Bytes written since last call to control_event_stream_bandwidth_used() */
1716 /** True iff this connection is for a DNS request only. */
1717 unsigned int is_dns_request
:1;
1718 /** True iff this connection is for a PTR DNS request. (exit only) */
1719 unsigned int is_reverse_dns_lookup
:1;
1721 unsigned int edge_has_sent_end
:1; /**< For debugging; only used on edge
1722 * connections. Set once we've set the stream end,
1723 * and check in connection_about_to_close_connection().
1725 /** True iff we've blocked reading until the circuit has fewer queued
1727 unsigned int edge_blocked_on_circ
:1;
1729 /** Unique ID for directory requests; this used to be in connection_t, but
1730 * that's going away and being used on channels instead. We still tag
1731 * edge connections with dirreq_id from circuits, so it's copied here. */
1733 } edge_connection_t
;
1735 /** Subtype of edge_connection_t for an "entry connection" -- that is, a SOCKS
1736 * connection, a DNS request, a TransPort connection or a NATD connection */
1737 typedef struct entry_connection_t
{
1738 edge_connection_t edge_
;
1740 /** Nickname of planned exit node -- used with .exit support. */
1741 /* XXX prop220: we need to make chosen_exit_name able to encode Ed IDs too.
1742 * That's logically part of the UI parts for prop220 though. */
1743 char *chosen_exit_name
;
1745 socks_request_t
*socks_request
; /**< SOCKS structure describing request (AP
1748 /* === Isolation related, AP only. === */
1749 entry_port_cfg_t entry_cfg
;
1750 /** AP only: The newnym epoch in which we created this connection. */
1753 /** AP only: The original requested address before we rewrote it. */
1754 char *original_dest_address
;
1755 /* Other fields to isolate on already exist. The ClientAddr is addr. The
1756 ClientProtocol is a combination of type and socks_request->
1757 socks_version. SocksAuth is socks_request->username/password.
1758 DestAddr is in socks_request->address. */
1760 /** Number of times we've reassigned this application connection to
1761 * a new circuit. We keep track because the timeout is longer if we've
1762 * already retried several times. */
1763 uint8_t num_socks_retries
;
1765 /** For AP connections only: buffer for data that we have sent
1766 * optimistically, which we might need to re-send if we have to
1767 * retry this connection. */
1768 struct buf_t
*pending_optimistic_data
;
1769 /* For AP connections only: buffer for data that we previously sent
1770 * optimistically which we are currently re-sending as we retry this
1772 struct buf_t
*sending_optimistic_data
;
1774 /** If this is a DNSPort connection, this field holds the pending DNS
1775 * request that we're going to try to answer. */
1776 struct evdns_server_request
*dns_server_request
;
1778 #define DEBUGGING_17659
1780 #ifdef DEBUGGING_17659
1781 uint16_t marked_pending_circ_line
;
1782 const char *marked_pending_circ_file
;
1785 #define NUM_CIRCUITS_LAUNCHED_THRESHOLD 10
1786 /** Number of times we've launched a circuit to handle this stream. If
1787 * it gets too high, that could indicate an inconsistency between our
1788 * "launch a circuit to handle this stream" logic and our "attach our
1789 * stream to one of the available circuits" logic. */
1790 unsigned int num_circuits_launched
:4;
1792 /** True iff this stream must attach to a one-hop circuit (e.g. for
1794 unsigned int want_onehop
:1;
1795 /** True iff this stream should use a BEGIN_DIR relay command to establish
1796 * itself rather than BEGIN (either via onehop or via a whole circuit). */
1797 unsigned int use_begindir
:1;
1799 /** For AP connections only. If 1, and we fail to reach the chosen exit,
1800 * stop requiring it. */
1801 unsigned int chosen_exit_optional
:1;
1802 /** For AP connections only. If non-zero, this exit node was picked as
1803 * a result of the TrackHostExit, and the value decrements every time
1804 * we fail to complete a circuit to our chosen exit -- if it reaches
1805 * zero, abandon the associated mapaddress. */
1806 unsigned int chosen_exit_retries
:3;
1808 /** True iff this is an AP connection that came from a transparent or
1809 * NATd connection */
1810 unsigned int is_transparent_ap
:1;
1812 /** For AP connections only: Set if this connection's target exit node
1813 * allows optimistic data (that is, data sent on this stream before
1814 * the exit has sent a CONNECTED cell) and we have chosen to use it.
1816 unsigned int may_use_optimistic_data
: 1;
1818 /** Are we a socks SocksSocket listener? */
1819 unsigned int is_socks_socket
:1;
1820 } entry_connection_t
;
1822 /** Subtype of connection_t for an "directory connection" -- that is, an HTTP
1823 * connection to retrieve or serve directory material. */
1824 typedef struct dir_connection_t
{
1827 /** Which 'resource' did we ask the directory for? This is typically the part
1828 * of the URL string that defines, relative to the directory conn purpose,
1829 * what thing we want. For example, in router descriptor downloads by
1830 * descriptor digest, it contains "d/", then one or more +-separated
1833 char *requested_resource
;
1834 unsigned int dirconn_direct
:1; /**< Is this dirconn direct, or via Tor? */
1836 /** If we're fetching descriptors, what router purpose shall we assign
1838 uint8_t router_purpose
;
1840 /** List of spooled_resource_t for objects that we're spooling. We use
1841 * it from back to front. */
1843 /** The compression object doing on-the-fly compression for spooled data. */
1844 tor_compress_state_t
*compress_state
;
1846 /** What rendezvous service are we querying for? */
1847 rend_data_t
*rend_data
;
1849 /* Hidden service connection identifier for dir connections: Used by HS
1850 client-side code to fetch HS descriptors, and by the service-side code to
1851 upload descriptors. */
1852 struct hs_ident_dir_conn_t
*hs_ident
;
1854 /** If this is a one-hop connection, tracks the state of the directory guard
1855 * for this connection (if any). */
1856 struct circuit_guard_state_t
*guard_state
;
1858 char identity_digest
[DIGEST_LEN
]; /**< Hash of the public RSA key for
1859 * the directory server's signing key. */
1861 /** Unique ID for directory requests; this used to be in connection_t, but
1862 * that's going away and being used on channels instead. The dirserver still
1863 * needs this for the incoming side, so it's moved here. */
1866 #ifdef MEASUREMENTS_21206
1867 /** Number of RELAY_DATA cells received. */
1868 uint32_t data_cells_received
;
1870 /** Number of RELAY_DATA cells sent. */
1871 uint32_t data_cells_sent
;
1872 #endif /* defined(MEASUREMENTS_21206) */
1875 /** Subtype of connection_t for an connection to a controller. */
1876 typedef struct control_connection_t
{
1879 uint64_t event_mask
; /**< Bitfield: which events does this controller
1881 * EVENT_MAX_ is >31, so we need a 64 bit mask */
1883 /** True if we have sent a protocolinfo reply on this connection. */
1884 unsigned int have_sent_protocolinfo
:1;
1885 /** True if we have received a takeownership command on this
1887 unsigned int is_owning_control_connection
:1;
1889 /** List of ephemeral onion services belonging to this connection. */
1890 smartlist_t
*ephemeral_onion_services
;
1892 /** If we have sent an AUTHCHALLENGE reply on this connection and
1893 * have not received a successful AUTHENTICATE command, points to
1894 * the value which the client must send to authenticate itself;
1895 * otherwise, NULL. */
1896 char *safecookie_client_hash
;
1898 /** Amount of space allocated in incoming_cmd. */
1899 uint32_t incoming_cmd_len
;
1900 /** Number of bytes currently stored in incoming_cmd. */
1901 uint32_t incoming_cmd_cur_len
;
1902 /** A control command that we're reading from the inbuf, but which has not
1903 * yet arrived completely. */
1905 } control_connection_t
;
1907 /** Cast a connection_t subtype pointer to a connection_t **/
1908 #define TO_CONN(c) (&(((c)->base_)))
1910 /** Cast a entry_connection_t subtype pointer to a edge_connection_t **/
1911 #define ENTRY_TO_EDGE_CONN(c) (&(((c))->edge_))
1912 /** Cast a entry_connection_t subtype pointer to a connection_t **/
1913 #define ENTRY_TO_CONN(c) (TO_CONN(ENTRY_TO_EDGE_CONN(c)))
1915 /** Convert a connection_t* to an or_connection_t*; assert if the cast is
1917 static or_connection_t
*TO_OR_CONN(connection_t
*);
1918 /** Convert a connection_t* to a dir_connection_t*; assert if the cast is
1920 static dir_connection_t
*TO_DIR_CONN(connection_t
*);
1921 /** Convert a connection_t* to an edge_connection_t*; assert if the cast is
1923 static edge_connection_t
*TO_EDGE_CONN(connection_t
*);
1924 /** Convert a connection_t* to an entry_connection_t*; assert if the cast is
1926 static entry_connection_t
*TO_ENTRY_CONN(connection_t
*);
1927 /** Convert a edge_connection_t* to an entry_connection_t*; assert if the cast
1929 static entry_connection_t
*EDGE_TO_ENTRY_CONN(edge_connection_t
*);
1930 /** Convert a connection_t* to an control_connection_t*; assert if the cast is
1932 static control_connection_t
*TO_CONTROL_CONN(connection_t
*);
1933 /** Convert a connection_t* to an listener_connection_t*; assert if the cast is
1935 static listener_connection_t
*TO_LISTENER_CONN(connection_t
*);
1937 static inline or_connection_t
*TO_OR_CONN(connection_t
*c
)
1939 tor_assert(c
->magic
== OR_CONNECTION_MAGIC
);
1940 return DOWNCAST(or_connection_t
, c
);
1942 static inline dir_connection_t
*TO_DIR_CONN(connection_t
*c
)
1944 tor_assert(c
->magic
== DIR_CONNECTION_MAGIC
);
1945 return DOWNCAST(dir_connection_t
, c
);
1947 static inline edge_connection_t
*TO_EDGE_CONN(connection_t
*c
)
1949 tor_assert(c
->magic
== EDGE_CONNECTION_MAGIC
||
1950 c
->magic
== ENTRY_CONNECTION_MAGIC
);
1951 return DOWNCAST(edge_connection_t
, c
);
1953 static inline entry_connection_t
*TO_ENTRY_CONN(connection_t
*c
)
1955 tor_assert(c
->magic
== ENTRY_CONNECTION_MAGIC
);
1956 return (entry_connection_t
*) SUBTYPE_P(c
, entry_connection_t
, edge_
.base_
);
1958 static inline entry_connection_t
*EDGE_TO_ENTRY_CONN(edge_connection_t
*c
)
1960 tor_assert(c
->base_
.magic
== ENTRY_CONNECTION_MAGIC
);
1961 return (entry_connection_t
*) SUBTYPE_P(c
, entry_connection_t
, edge_
);
1963 static inline control_connection_t
*TO_CONTROL_CONN(connection_t
*c
)
1965 tor_assert(c
->magic
== CONTROL_CONNECTION_MAGIC
);
1966 return DOWNCAST(control_connection_t
, c
);
1968 static inline listener_connection_t
*TO_LISTENER_CONN(connection_t
*c
)
1970 tor_assert(c
->magic
== LISTENER_CONNECTION_MAGIC
);
1971 return DOWNCAST(listener_connection_t
, c
);
1974 /** What action type does an address policy indicate: accept or reject? */
1976 ADDR_POLICY_ACCEPT
=1,
1977 ADDR_POLICY_REJECT
=2,
1978 } addr_policy_action_t
;
1979 #define addr_policy_action_bitfield_t ENUM_BF(addr_policy_action_t)
1981 /** A reference-counted address policy rule. */
1982 typedef struct addr_policy_t
{
1983 int refcnt
; /**< Reference count */
1984 /** What to do when the policy matches.*/
1985 addr_policy_action_bitfield_t policy_type
:2;
1986 unsigned int is_private
:1; /**< True iff this is the pseudo-address,
1988 unsigned int is_canonical
:1; /**< True iff this policy is the canonical
1989 * copy (stored in a hash table to avoid
1990 * duplication of common policies) */
1991 maskbits_t maskbits
; /**< Accept/reject all addresses <b>a</b> such that the
1992 * first <b>maskbits</b> bits of <b>a</b> match
1994 /** Base address to accept or reject.
1996 * Note that wildcards are treated
1997 * differntly depending on address family. An AF_UNSPEC address means
1998 * "All addresses, IPv4 or IPv6." An AF_INET address with maskbits==0 means
1999 * "All IPv4 addresses" and an AF_INET6 address with maskbits == 0 means
2000 * "All IPv6 addresses".
2003 uint16_t prt_min
; /**< Lowest port number to accept/reject. */
2004 uint16_t prt_max
; /**< Highest port number to accept/reject. */
2007 /** A cached_dir_t represents a cacheable directory object, along with its
2008 * compressed form. */
2009 typedef struct cached_dir_t
{
2010 char *dir
; /**< Contents of this object, NUL-terminated. */
2011 char *dir_compressed
; /**< Compressed contents of this object. */
2012 size_t dir_len
; /**< Length of <b>dir</b> (not counting its NUL). */
2013 size_t dir_compressed_len
; /**< Length of <b>dir_compressed</b>. */
2014 time_t published
; /**< When was this object published. */
2015 common_digests_t digests
; /**< Digests of this object (networkstatus only) */
2016 /** Sha3 digest (also ns only) */
2017 uint8_t digest_sha3_as_signed
[DIGEST256_LEN
];
2018 int refcnt
; /**< Reference count for this cached_dir_t. */
2021 /** Enum used to remember where a signed_descriptor_t is stored and how to
2022 * manage the memory for signed_descriptor_body. */
2024 /** The descriptor isn't stored on disk at all: the copy in memory is
2025 * canonical; the saved_offset field is meaningless. */
2027 /** The descriptor is stored in the cached_routers file: the
2028 * signed_descriptor_body is meaningless; the signed_descriptor_len and
2029 * saved_offset are used to index into the mmaped cache file. */
2031 /** The descriptor is stored in the cached_routers.new file: the
2032 * signed_descriptor_body and saved_offset fields are both set. */
2033 /* FFFF (We could also mmap the file and grow the mmap as needed, or
2034 * lazy-load the descriptor text by using seek and read. We don't, for
2039 #define saved_location_bitfield_t ENUM_BF(saved_location_t)
2041 /** Enumeration: what directory object is being downloaded?
2042 * This determines which schedule is selected to perform the download. */
2044 DL_SCHED_GENERIC
= 0,
2045 DL_SCHED_CONSENSUS
= 1,
2046 DL_SCHED_BRIDGE
= 2,
2047 } download_schedule_t
;
2048 #define download_schedule_bitfield_t ENUM_BF(download_schedule_t)
2050 /** Enumeration: is the download schedule for downloading from an authority,
2051 * or from any available directory mirror?
2052 * During bootstrap, "any" means a fallback (or an authority, if there
2053 * are no fallbacks).
2054 * When we have a valid consensus, "any" means any directory server. */
2056 DL_WANT_ANY_DIRSERVER
= 0,
2057 DL_WANT_AUTHORITY
= 1,
2058 } download_want_authority_t
;
2059 #define download_want_authority_bitfield_t \
2060 ENUM_BF(download_want_authority_t)
2062 /** Enumeration: do we want to increment the schedule position each time a
2063 * connection is attempted (these attempts can be concurrent), or do we want
2064 * to increment the schedule position after a connection fails? */
2066 DL_SCHED_INCREMENT_FAILURE
= 0,
2067 DL_SCHED_INCREMENT_ATTEMPT
= 1,
2068 } download_schedule_increment_t
;
2069 #define download_schedule_increment_bitfield_t \
2070 ENUM_BF(download_schedule_increment_t)
2072 /** Enumeration: do we want to use the random exponential backoff
2075 DL_SCHED_DETERMINISTIC
= 0,
2076 DL_SCHED_RANDOM_EXPONENTIAL
= 1,
2077 } download_schedule_backoff_t
;
2078 #define download_schedule_backoff_bitfield_t \
2079 ENUM_BF(download_schedule_backoff_t)
2081 /** Information about our plans for retrying downloads for a downloadable
2083 * Each type of downloadable directory object has a corresponding retry
2084 * <b>schedule</b>, which can be different depending on whether the object is
2085 * being downloaded from an authority or a mirror (<b>want_authority</b>).
2086 * <b>next_attempt_at</b> contains the next time we will attempt to download
2088 * For schedules that <b>increment_on</b> failure, <b>n_download_failures</b>
2089 * is used to determine the position in the schedule. (Each schedule is a
2090 * smartlist of integer delays, parsed from a CSV option.) Every time a
2091 * connection attempt fails, <b>n_download_failures</b> is incremented,
2092 * the new delay value is looked up from the schedule, and
2093 * <b>next_attempt_at</b> is set delay seconds from the time the previous
2094 * connection failed. Therefore, at most one failure-based connection can be
2095 * in progress for each download_status_t.
2096 * For schedules that <b>increment_on</b> attempt, <b>n_download_attempts</b>
2097 * is used to determine the position in the schedule. Every time a
2098 * connection attempt is made, <b>n_download_attempts</b> is incremented,
2099 * the new delay value is looked up from the schedule, and
2100 * <b>next_attempt_at</b> is set delay seconds from the time the previous
2101 * connection was attempted. Therefore, multiple concurrent attempted-based
2102 * connections can be in progress for each download_status_t.
2103 * After an object is successfully downloaded, any other concurrent connections
2104 * are terminated. A new schedule which starts at position 0 is used for
2105 * subsequent downloads of the same object.
2107 typedef struct download_status_t
{
2108 time_t next_attempt_at
; /**< When should we try downloading this object
2110 uint8_t n_download_failures
; /**< Number of failed downloads of the most
2111 * recent object, since the last success. */
2112 uint8_t n_download_attempts
; /**< Number of (potentially concurrent) attempts
2113 * to download the most recent object, since
2114 * the last success. */
2115 download_schedule_bitfield_t schedule
: 8; /**< What kind of object is being
2116 * downloaded? This determines the
2117 * schedule used for the download.
2119 download_want_authority_bitfield_t want_authority
: 1; /**< Is the download
2120 * happening from an authority
2121 * or a mirror? This determines
2122 * the schedule used for the
2124 download_schedule_increment_bitfield_t increment_on
: 1; /**< does this
2125 * schedule increment on each attempt,
2126 * or after each failure? */
2127 download_schedule_backoff_bitfield_t backoff
: 1; /**< do we use the
2128 * deterministic schedule, or random
2129 * exponential backoffs?
2130 * Increment on failure schedules
2131 * always use exponential backoff. */
2132 uint8_t last_backoff_position
; /**< number of attempts/failures, depending
2133 * on increment_on, when we last recalculated
2134 * the delay. Only updated if backoff
2136 int last_delay_used
; /**< last delay used for random exponential backoff;
2137 * only updated if backoff == 1 */
2138 } download_status_t
;
2140 /** If n_download_failures is this high, the download can never happen. */
2141 #define IMPOSSIBLE_TO_DOWNLOAD 255
2143 /** The max size we expect router descriptor annotations we create to
2144 * be. We'll accept larger ones if we see them on disk, but we won't
2145 * create any that are larger than this. */
2146 #define ROUTER_ANNOTATION_BUF_LEN 256
2148 /** Information need to cache an onion router's descriptor. */
2149 typedef struct signed_descriptor_t
{
2150 /** Pointer to the raw server descriptor, preceded by annotations. Not
2151 * necessarily NUL-terminated. If saved_location is SAVED_IN_CACHE, this
2152 * pointer is null. */
2153 char *signed_descriptor_body
;
2154 /** Length of the annotations preceding the server descriptor. */
2155 size_t annotations_len
;
2156 /** Length of the server descriptor. */
2157 size_t signed_descriptor_len
;
2158 /** Digest of the server descriptor, computed as specified in
2160 char signed_descriptor_digest
[DIGEST_LEN
];
2161 /** Identity digest of the router. */
2162 char identity_digest
[DIGEST_LEN
];
2163 /** Declared publication time of the descriptor. */
2164 time_t published_on
;
2165 /** For routerdescs only: digest of the corresponding extrainfo. */
2166 char extra_info_digest
[DIGEST_LEN
];
2167 /** For routerdescs only: A SHA256-digest of the extrainfo (if any) */
2168 char extra_info_digest256
[DIGEST256_LEN
];
2169 /** Certificate for ed25519 signing key. */
2170 struct tor_cert_st
*signing_key_cert
;
2171 /** For routerdescs only: Status of downloading the corresponding
2173 download_status_t ei_dl_status
;
2174 /** Where is the descriptor saved? */
2175 saved_location_t saved_location
;
2176 /** If saved_location is SAVED_IN_CACHE or SAVED_IN_JOURNAL, the offset of
2177 * this descriptor in the corresponding file. */
2179 /** What position is this descriptor within routerlist->routers or
2180 * routerlist->old_routers? -1 for none. */
2181 int routerlist_index
;
2182 /** The valid-until time of the most recent consensus that listed this
2183 * descriptor. 0 for "never listed in a consensus, so far as we know." */
2184 time_t last_listed_as_valid_until
;
2185 /* If true, we do not ever try to save this object in the cache. */
2186 unsigned int do_not_cache
: 1;
2187 /* If true, this item is meant to represent an extrainfo. */
2188 unsigned int is_extrainfo
: 1;
2189 /* If true, we got an extrainfo for this item, and the digest was right,
2190 * but it was incompatible. */
2191 unsigned int extrainfo_is_bogus
: 1;
2192 /* If true, we are willing to transmit this item unencrypted. */
2193 unsigned int send_unencrypted
: 1;
2194 } signed_descriptor_t
;
2196 /** A signed integer representing a country code. */
2197 typedef int16_t country_t
;
2199 /** Information about another onion router in the network. */
2201 signed_descriptor_t cache_info
;
2202 char *nickname
; /**< Human-readable OR name. */
2204 uint32_t addr
; /**< IPv4 address of OR, in host order. */
2205 uint16_t or_port
; /**< Port for TLS connections. */
2206 uint16_t dir_port
; /**< Port for HTTP directory connections. */
2208 /** A router's IPv6 address, if it has one. */
2209 /* XXXXX187 Actually these should probably be part of a list of addresses,
2210 * not just a special case. Use abstractions to access these; don't do it
2212 tor_addr_t ipv6_addr
;
2213 uint16_t ipv6_orport
;
2215 crypto_pk_t
*onion_pkey
; /**< Public RSA key for onions. */
2216 crypto_pk_t
*identity_pkey
; /**< Public RSA key for signing. */
2217 /** Public curve25519 key for onions */
2218 curve25519_public_key_t
*onion_curve25519_pkey
;
2219 /** What's the earliest expiration time on all the certs in this
2221 time_t cert_expiration_time
;
2223 char *platform
; /**< What software/operating system is this OR using? */
2225 char *protocol_list
; /**< Encoded list of subprotocol versions supported
2229 uint32_t bandwidthrate
; /**< How many bytes does this OR add to its token
2230 * bucket per second? */
2231 uint32_t bandwidthburst
; /**< How large is this OR's token bucket? */
2232 /** How many bytes/s is this router known to handle? */
2233 uint32_t bandwidthcapacity
;
2234 smartlist_t
*exit_policy
; /**< What streams will this OR permit
2235 * to exit on IPv4? NULL for 'reject *:*'. */
2236 /** What streams will this OR permit to exit on IPv6?
2237 * NULL for 'reject *:*' */
2238 struct short_policy_t
*ipv6_exit_policy
;
2239 long uptime
; /**< How many seconds the router claims to have been up */
2240 smartlist_t
*declared_family
; /**< Nicknames of router which this router
2241 * claims are its family. */
2242 char *contact_info
; /**< Declared contact info for this router. */
2243 unsigned int is_hibernating
:1; /**< Whether the router claims to be
2245 unsigned int caches_extra_info
:1; /**< Whether the router says it caches and
2246 * serves extrainfo documents. */
2247 unsigned int allow_single_hop_exits
:1; /**< Whether the router says
2248 * it allows single hop exits. */
2250 unsigned int wants_to_be_hs_dir
:1; /**< True iff this router claims to be
2251 * a hidden service directory. */
2252 unsigned int policy_is_reject_star
:1; /**< True iff the exit policy for this
2253 * router rejects everything. */
2254 /** True if, after we have added this router, we should re-launch
2256 unsigned int needs_retest_if_added
:1;
2258 /** True iff this router included "tunnelled-dir-server" in its descriptor,
2259 * implying it accepts tunnelled directory requests, or it advertised
2261 unsigned int supports_tunnelled_dir_requests
:1;
2263 /** Used during voting to indicate that we should not include an entry for
2264 * this routerinfo. Used only during voting. */
2265 unsigned int omit_from_vote
:1;
2267 /** Tor can use this router for general positions in circuits; we got it
2268 * from a directory server as usual, or we're an authority and a server
2270 #define ROUTER_PURPOSE_GENERAL 0
2271 /** Tor should avoid using this router for circuit-building: we got it
2272 * from a controller. If the controller wants to use it, it'll have to
2273 * ask for it by identity. */
2274 #define ROUTER_PURPOSE_CONTROLLER 1
2275 /** Tor should use this router only for bridge positions in circuits: we got
2276 * it via a directory request from the bridge itself, or a bridge
2278 #define ROUTER_PURPOSE_BRIDGE 2
2279 /** Tor should not use this router; it was marked in cached-descriptors with
2280 * a purpose we didn't recognize. */
2281 #define ROUTER_PURPOSE_UNKNOWN 255
2283 /** In what way did we find out about this router? One of ROUTER_PURPOSE_*.
2284 * Routers of different purposes are kept segregated and used for different
2285 * things; see notes on ROUTER_PURPOSE_* macros above.
2290 /** Information needed to keep and cache a signed extra-info document. */
2291 typedef struct extrainfo_t
{
2292 signed_descriptor_t cache_info
;
2293 /** SHA256 digest of this document */
2294 uint8_t digest256
[DIGEST256_LEN
];
2295 /** The router's nickname. */
2296 char nickname
[MAX_NICKNAME_LEN
+1];
2297 /** True iff we found the right key for this extra-info, verified the
2298 * signature, and found it to be bad. */
2299 unsigned int bad_sig
: 1;
2300 /** If present, we didn't have the right key to verify this extra-info,
2301 * so this is a copy of the signature in the document. */
2303 /** Length of pending_sig. */
2304 size_t pending_sig_len
;
2307 /** Contents of a single router entry in a network status object.
2309 typedef struct routerstatus_t
{
2310 time_t published_on
; /**< When was this router published? */
2311 char nickname
[MAX_NICKNAME_LEN
+1]; /**< The nickname this router says it
2313 char identity_digest
[DIGEST_LEN
]; /**< Digest of the router's identity
2315 /** Digest of the router's most recent descriptor or microdescriptor.
2316 * If it's a descriptor, we only use the first DIGEST_LEN bytes. */
2317 char descriptor_digest
[DIGEST256_LEN
];
2318 uint32_t addr
; /**< IPv4 address for this router, in host order. */
2319 uint16_t or_port
; /**< OR port for this router. */
2320 uint16_t dir_port
; /**< Directory port for this router. */
2321 tor_addr_t ipv6_addr
; /**< IPv6 address for this router. */
2322 uint16_t ipv6_orport
; /**<IPV6 OR port for this router. */
2323 unsigned int is_authority
:1; /**< True iff this router is an authority. */
2324 unsigned int is_exit
:1; /**< True iff this router is a good exit. */
2325 unsigned int is_stable
:1; /**< True iff this router stays up a long time. */
2326 unsigned int is_fast
:1; /**< True iff this router has good bandwidth. */
2327 /** True iff this router is called 'running' in the consensus. We give it
2328 * this funny name so that we don't accidentally use this bit as a view of
2329 * whether we think the router is *currently* running. If that's what you
2330 * want to know, look at is_running in node_t. */
2331 unsigned int is_flagged_running
:1;
2332 unsigned int is_named
:1; /**< True iff "nickname" belongs to this router. */
2333 unsigned int is_unnamed
:1; /**< True iff "nickname" belongs to another
2335 unsigned int is_valid
:1; /**< True iff this router isn't invalid. */
2336 unsigned int is_possible_guard
:1; /**< True iff this router would be a good
2337 * choice as an entry guard. */
2338 unsigned int is_bad_exit
:1; /**< True iff this node is a bad choice for
2340 unsigned int is_hs_dir
:1; /**< True iff this router is a v2-or-later hidden
2341 * service directory. */
2342 unsigned int is_v2_dir
:1; /** True iff this router publishes an open DirPort
2343 * or it claims to accept tunnelled dir requests.
2345 /** True iff we have a proto line for this router, or a versions line
2346 * from which we could infer the protocols. */
2347 unsigned int protocols_known
:1;
2349 /** True iff this router has a version or protocol list that allows it to
2350 * accept EXTEND2 cells */
2351 unsigned int supports_extend2_cells
:1;
2353 /** True iff this router has a protocol list that allows it to negotiate
2354 * ed25519 identity keys on a link handshake with us. */
2355 unsigned int supports_ed25519_link_handshake_compat
:1;
2357 /** True iff this router has a protocol list that allows it to negotiate
2358 * ed25519 identity keys on a link handshake, at all. */
2359 unsigned int supports_ed25519_link_handshake_any
:1;
2361 /** True iff this router has a protocol list that allows it to be an
2362 * introduction point supporting ed25519 authentication key which is part of
2363 * the v3 protocol detailed in proposal 224. This requires HSIntro=4. */
2364 unsigned int supports_ed25519_hs_intro
: 1;
2366 /** True iff this router has a protocol list that allows it to be an hidden
2367 * service directory supporting version 3 as seen in proposal 224. This
2368 * requires HSDir=2. */
2369 unsigned int supports_v3_hsdir
: 1;
2371 /** True iff this router has a protocol list that allows it to be an hidden
2372 * service rendezvous point supporting version 3 as seen in proposal 224.
2373 * This requires HSRend=2. */
2374 unsigned int supports_v3_rendezvous_point
: 1;
2376 unsigned int has_bandwidth
:1; /**< The vote/consensus had bw info */
2377 unsigned int has_exitsummary
:1; /**< The vote/consensus had exit summaries */
2378 unsigned int bw_is_unmeasured
:1; /**< This is a consensus entry, with
2379 * the Unmeasured flag set. */
2381 uint32_t bandwidth_kb
; /**< Bandwidth (capacity) of the router as reported in
2382 * the vote/consensus, in kilobytes/sec. */
2384 /** The consensus has guardfraction information for this router. */
2385 unsigned int has_guardfraction
:1;
2386 /** The guardfraction value of this router. */
2387 uint32_t guardfraction_percentage
;
2389 char *exitsummary
; /**< exit policy summary -
2390 * XXX weasel: this probably should not stay a string. */
2392 /* ---- The fields below aren't derived from the networkstatus; they
2393 * hold local information only. */
2395 time_t last_dir_503_at
; /**< When did this router last tell us that it
2396 * was too busy to serve directory info? */
2397 download_status_t dl_status
;
2401 /** A single entry in a parsed policy summary, describing a range of ports. */
2402 typedef struct short_policy_entry_t
{
2403 uint16_t min_port
, max_port
;
2404 } short_policy_entry_t
;
2406 /** A short_poliy_t is the parsed version of a policy summary. */
2407 typedef struct short_policy_t
{
2408 /** True if the members of 'entries' are port ranges to accept; false if
2409 * they are port ranges to reject */
2410 unsigned int is_accept
: 1;
2411 /** The actual number of values in 'entries'. */
2412 unsigned int n_entries
: 31;
2413 /** An array of 0 or more short_policy_entry_t values, each describing a
2414 * range of ports that this policy accepts or rejects (depending on the
2415 * value of is_accept).
2417 short_policy_entry_t entries
[FLEXIBLE_ARRAY_MEMBER
];
2420 /** A microdescriptor is the smallest amount of information needed to build a
2421 * circuit through a router. They are generated by the directory authorities,
2422 * using information from the uploaded routerinfo documents. They are not
2423 * self-signed, but are rather authenticated by having their hash in a signed
2424 * networkstatus document. */
2425 typedef struct microdesc_t
{
2426 /** Hashtable node, used to look up the microdesc by its digest. */
2427 HT_ENTRY(microdesc_t
) node
;
2429 /* Cache information */
2431 /** When was this microdescriptor last listed in a consensus document?
2432 * Once a microdesc has been unlisted long enough, we can drop it.
2435 /** Where is this microdescriptor currently stored? */
2436 saved_location_bitfield_t saved_location
: 3;
2437 /** If true, do not attempt to cache this microdescriptor on disk. */
2438 unsigned int no_save
: 1;
2439 /** If true, this microdesc has an entry in the microdesc_map */
2440 unsigned int held_in_map
: 1;
2441 /** Reference count: how many node_ts have a reference to this microdesc? */
2442 unsigned int held_by_nodes
;
2444 /** If saved_location == SAVED_IN_CACHE, this field holds the offset of the
2445 * microdescriptor in the cache. */
2448 /* The string containing the microdesc. */
2450 /** A pointer to the encoded body of the microdescriptor. If the
2451 * saved_location is SAVED_IN_CACHE, then the body is a pointer into an
2452 * mmap'd region. Otherwise, it is a malloc'd string. The string might not
2453 * be NUL-terminated; take the length from <b>bodylen</b>. */
2455 /** The length of the microdescriptor in <b>body</b>. */
2457 /** A SHA256-digest of the microdescriptor. */
2458 char digest
[DIGEST256_LEN
];
2460 /* Fields in the microdescriptor. */
2462 /** As routerinfo_t.onion_pkey */
2463 crypto_pk_t
*onion_pkey
;
2464 /** As routerinfo_t.onion_curve25519_pkey */
2465 curve25519_public_key_t
*onion_curve25519_pkey
;
2466 /** Ed25519 identity key, if included. */
2467 ed25519_public_key_t
*ed25519_identity_pkey
;
2468 /** As routerinfo_t.ipv6_addr */
2469 tor_addr_t ipv6_addr
;
2470 /** As routerinfo_t.ipv6_orport */
2471 uint16_t ipv6_orport
;
2472 /** As routerinfo_t.family */
2473 smartlist_t
*family
;
2474 /** IPv4 exit policy summary */
2475 short_policy_t
*exit_policy
;
2476 /** IPv6 exit policy summary */
2477 short_policy_t
*ipv6_exit_policy
;
2481 /** A node_t represents a Tor router.
2483 * Specifically, a node_t is a Tor router as we are using it: a router that
2484 * we are considering for circuits, connections, and so on. A node_t is a
2485 * thin wrapper around the routerstatus, routerinfo, and microdesc for a
2486 * single router, and provides a consistent interface for all of them.
2488 * Also, a node_t has mutable state. While a routerinfo, a routerstatus,
2489 * and a microdesc have[*] only the information read from a router
2490 * descriptor, a consensus entry, and a microdescriptor (respectively)...
2491 * a node_t has flags based on *our own current opinion* of the node.
2493 * [*] Actually, there is some leftover information in each that is mutable.
2494 * We should try to excise that.
2496 typedef struct node_t
{
2497 /* Indexing information */
2499 /** Used to look up the node_t by its identity digest. */
2500 HT_ENTRY(node_t
) ht_ent
;
2501 /** Used to look up the node_t by its ed25519 identity digest. */
2502 HT_ENTRY(node_t
) ed_ht_ent
;
2503 /** Position of the node within the list of nodes */
2506 /** The identity digest of this node_t. No more than one node_t per
2507 * identity may exist at a time. */
2508 char identity
[DIGEST_LEN
];
2510 /** The ed25519 identity of this node_t. This field is nonzero iff we
2511 * currently have an ed25519 identity for this node in either md or ri,
2512 * _and_ this node has been inserted to the ed25519-to-node map in the
2515 ed25519_public_key_t ed25519_id
;
2521 /* local info: copied from routerstatus, then possibly frobbed based
2522 * on experience. Authorities set this stuff directly. Note that
2523 * these reflect knowledge of the primary (IPv4) OR port only. */
2525 unsigned int is_running
:1; /**< As far as we know, is this OR currently
2527 unsigned int is_valid
:1; /**< Has a trusted dirserver validated this OR?
2528 * (For Authdir: Have we validated this OR?) */
2529 unsigned int is_fast
:1; /** Do we think this is a fast OR? */
2530 unsigned int is_stable
:1; /** Do we think this is a stable OR? */
2531 unsigned int is_possible_guard
:1; /**< Do we think this is an OK guard? */
2532 unsigned int is_exit
:1; /**< Do we think this is an OK exit? */
2533 unsigned int is_bad_exit
:1; /**< Do we think this exit is censored, borked,
2534 * or otherwise nasty? */
2535 unsigned int is_hs_dir
:1; /**< True iff this router is a hidden service
2536 * directory according to the authorities. */
2538 /* Local info: warning state. */
2540 unsigned int name_lookup_warned
:1; /**< Have we warned the user for referring
2541 * to this (unnamed) router by nickname?
2544 /** Local info: we treat this node as if it rejects everything */
2545 unsigned int rejects_all
:1;
2547 /* Local info: derived. */
2549 /** True if the IPv6 OR port is preferred over the IPv4 OR port.
2550 * XX/teor - can this become out of date if the torrc changes? */
2551 unsigned int ipv6_preferred
:1;
2553 /** According to the geoip db what country is this router in? */
2554 /* XXXprop186 what is this suppose to mean with multiple OR ports? */
2557 /* The below items are used only by authdirservers for
2558 * reachability testing. */
2560 /** When was the last time we could reach this OR? */
2561 time_t last_reachable
; /* IPv4. */
2562 time_t last_reachable6
; /* IPv6. */
2564 /* Hidden service directory index data. This is used by a service or client
2565 * in order to know what's the hs directory index for this node at the time
2566 * the consensus is set. */
2567 struct hsdir_index_t
*hsdir_index
;
2570 /** Linked list of microdesc hash lines for a single router in a directory
2573 typedef struct vote_microdesc_hash_t
{
2574 /** Next element in the list, or NULL. */
2575 struct vote_microdesc_hash_t
*next
;
2576 /** The raw contents of the microdesc hash line, from the "m" through the
2578 char *microdesc_hash_line
;
2579 } vote_microdesc_hash_t
;
2581 /** The claim about a single router, made in a vote. */
2582 typedef struct vote_routerstatus_t
{
2583 routerstatus_t status
; /**< Underlying 'status' object for this router.
2584 * Flags are redundant. */
2585 /** How many known-flags are allowed in a vote? This is the width of
2586 * the flags field of vote_routerstatus_t */
2587 #define MAX_KNOWN_FLAGS_IN_VOTE 64
2588 uint64_t flags
; /**< Bit-field for all recognized flags; index into
2589 * networkstatus_t.known_flags. */
2590 char *version
; /**< The version that the authority says this router is
2592 char *protocols
; /**< The protocols that this authority says this router
2594 unsigned int has_measured_bw
:1; /**< The vote had a measured bw */
2595 /** True iff the vote included an entry for ed25519 ID, or included
2596 * "id ed25519 none" to indicate that there was no ed25519 ID. */
2597 unsigned int has_ed25519_listing
:1;
2598 /** True if the Ed25519 listing here is the consensus-opinion for the
2599 * Ed25519 listing; false if there was no consensus on Ed25519 key status,
2600 * or if this VRS doesn't reflect it. */
2601 unsigned int ed25519_reflects_consensus
:1;
2602 uint32_t measured_bw_kb
; /**< Measured bandwidth (capacity) of the router */
2603 /** The hash or hashes that the authority claims this microdesc has. */
2604 vote_microdesc_hash_t
*microdesc
;
2605 /** Ed25519 identity for this router, or zero if it has none. */
2606 uint8_t ed25519_id
[ED25519_PUBKEY_LEN
];
2607 } vote_routerstatus_t
;
2609 /** A signature of some document by an authority. */
2610 typedef struct document_signature_t
{
2611 /** Declared SHA-1 digest of this voter's identity key */
2612 char identity_digest
[DIGEST_LEN
];
2613 /** Declared SHA-1 digest of signing key used by this voter. */
2614 char signing_key_digest
[DIGEST_LEN
];
2615 /** Algorithm used to compute the digest of the document. */
2616 digest_algorithm_t alg
;
2617 /** Signature of the signed thing. */
2619 /** Length of <b>signature</b> */
2621 unsigned int bad_signature
: 1; /**< Set to true if we've tried to verify
2622 * the sig, and we know it's bad. */
2623 unsigned int good_signature
: 1; /**< Set to true if we've verified the sig
2625 } document_signature_t
;
2627 /** Information about a single voter in a vote or a consensus. */
2628 typedef struct networkstatus_voter_info_t
{
2629 /** Declared SHA-1 digest of this voter's identity key */
2630 char identity_digest
[DIGEST_LEN
];
2631 char *nickname
; /**< Nickname of this voter */
2632 /** Digest of this voter's "legacy" identity key, if any. In vote only; for
2633 * consensuses, we treat legacy keys as additional signers. */
2634 char legacy_id_digest
[DIGEST_LEN
];
2635 char *address
; /**< Address of this voter, in string format. */
2636 uint32_t addr
; /**< Address of this voter, in IPv4, in host order. */
2637 uint16_t dir_port
; /**< Directory port of this voter */
2638 uint16_t or_port
; /**< OR port of this voter */
2639 char *contact
; /**< Contact information for this voter. */
2640 char vote_digest
[DIGEST_LEN
]; /**< Digest of this voter's vote, as signed. */
2642 /* Nothing from here on is signed. */
2643 /** The signature of the document and the signature's status. */
2645 } networkstatus_voter_info_t
;
2647 typedef struct networkstatus_sr_info_t
{
2648 /* Indicate if the dirauth partitipates in the SR protocol with its vote.
2649 * This is tied to the SR flag in the vote. */
2650 unsigned int participate
:1;
2651 /* Both vote and consensus: Current and previous SRV. If list is empty,
2652 * this means none were found in either the consensus or vote. */
2653 struct sr_srv_t
*previous_srv
;
2654 struct sr_srv_t
*current_srv
;
2655 /* Vote only: List of commitments. */
2656 smartlist_t
*commits
;
2657 } networkstatus_sr_info_t
;
2659 /** Enumerates the possible seriousness values of a networkstatus document. */
2664 } networkstatus_type_t
;
2666 /** Enumerates recognized flavors of a consensus networkstatus document. All
2667 * flavors of a consensus are generated from the same set of votes, but they
2668 * present different types information to different versions of Tor. */
2672 } consensus_flavor_t
;
2674 /** How many different consensus flavors are there? */
2675 #define N_CONSENSUS_FLAVORS ((int)(FLAV_MICRODESC)+1)
2677 /** A common structure to hold a v3 network status vote, or a v3 network
2678 * status consensus. */
2679 typedef struct networkstatus_t
{
2680 networkstatus_type_t type
; /**< Vote, consensus, or opinion? */
2681 consensus_flavor_t flavor
; /**< If a consensus, what kind? */
2682 unsigned int has_measured_bws
: 1;/**< True iff this networkstatus contains
2683 * measured= bandwidth values. */
2685 time_t published
; /**< Vote only: Time when vote was written. */
2686 time_t valid_after
; /**< Time after which this vote or consensus applies. */
2687 time_t fresh_until
; /**< Time before which this is the most recent vote or
2689 time_t valid_until
; /**< Time after which this vote or consensus should not
2692 /** Consensus only: what method was used to produce this consensus? */
2693 int consensus_method
;
2694 /** Vote only: what methods is this voter willing to use? */
2695 smartlist_t
*supported_methods
;
2697 /** List of 'package' lines describing hashes of downloadable packages */
2698 smartlist_t
*package_lines
;
2700 /** How long does this vote/consensus claim that authorities take to
2701 * distribute their votes to one another? */
2703 /** How long does this vote/consensus claim that authorities take to
2704 * distribute their consensus signatures to one another? */
2707 /** Comma-separated list of recommended client software, or NULL if this
2708 * voter has no opinion. */
2709 char *client_versions
;
2710 char *server_versions
;
2712 /** Lists of subprotocol versions which are _recommended_ for relays and
2713 * clients, or which are _require_ for relays and clients. Tor shouldn't
2714 * make any more network connections if a required protocol is missing.
2716 char *recommended_relay_protocols
;
2717 char *recommended_client_protocols
;
2718 char *required_relay_protocols
;
2719 char *required_client_protocols
;
2721 /** List of flags that this vote/consensus applies to routers. If a flag is
2722 * not listed here, the voter has no opinion on what its value should be. */
2723 smartlist_t
*known_flags
;
2725 /** List of key=value strings for the parameters in this vote or
2726 * consensus, sorted by key. */
2727 smartlist_t
*net_params
;
2729 /** List of key=value strings for the bw weight parameters in the
2731 smartlist_t
*weight_params
;
2733 /** List of networkstatus_voter_info_t. For a vote, only one element
2734 * is included. For a consensus, one element is included for every voter
2735 * whose vote contributed to the consensus. */
2736 smartlist_t
*voters
;
2738 struct authority_cert_t
*cert
; /**< Vote only: the voter's certificate. */
2740 /** Digests of this document, as signed. */
2741 common_digests_t digests
;
2742 /** A SHA3-256 digest of the document, not including signatures: used for
2743 * consensus diffs */
2744 uint8_t digest_sha3_as_signed
[DIGEST256_LEN
];
2746 /** List of router statuses, sorted by identity digest. For a vote,
2747 * the elements are vote_routerstatus_t; for a consensus, the elements
2748 * are routerstatus_t. */
2749 smartlist_t
*routerstatus_list
;
2751 /** If present, a map from descriptor digest to elements of
2752 * routerstatus_list. */
2753 digestmap_t
*desc_digest_map
;
2755 /** Contains the shared random protocol data from a vote or consensus. */
2756 networkstatus_sr_info_t sr_info
;
2759 /** A set of signatures for a networkstatus consensus. Unless otherwise
2760 * noted, all fields are as for networkstatus_t. */
2761 typedef struct ns_detached_signatures_t
{
2765 strmap_t
*digests
; /**< Map from flavor name to digestset_t */
2766 strmap_t
*signatures
; /**< Map from flavor name to list of
2767 * document_signature_t */
2768 } ns_detached_signatures_t
;
2770 /** Allowable types of desc_store_t. */
2771 typedef enum store_type_t
{
2776 /** A 'store' is a set of descriptors saved on disk, with accompanying
2777 * journal, mmaped as needed, rebuilt as needed. */
2778 typedef struct desc_store_t
{
2779 /** Filename (within DataDir) for the store. We append .tmp to this
2780 * filename for a temporary file when rebuilding the store, and .new to this
2781 * filename for the journal. */
2782 const char *fname_base
;
2783 /** Human-readable description of what this store contains. */
2784 const char *description
;
2786 tor_mmap_t
*mmap
; /**< A mmap for the main file in the store. */
2788 store_type_t type
; /**< What's stored in this store? */
2790 /** The size of the router log, in bytes. */
2792 /** The size of the router store, in bytes. */
2794 /** Total bytes dropped since last rebuild: this is space currently
2795 * used in the cache and the journal that could be freed by a rebuild. */
2796 size_t bytes_dropped
;
2799 /** Contents of a directory of onion routers. */
2801 /** Map from server identity digest to a member of routers. */
2802 struct digest_ri_map_t
*identity_map
;
2803 /** Map from server descriptor digest to a signed_descriptor_t from
2804 * routers or old_routers. */
2805 struct digest_sd_map_t
*desc_digest_map
;
2806 /** Map from extra-info digest to an extrainfo_t. Only exists for
2807 * routers in routers or old_routers. */
2808 struct digest_ei_map_t
*extra_info_map
;
2809 /** Map from extra-info digests to a signed_descriptor_t for a router
2810 * descriptor having that extra-info digest. Only exists for
2811 * routers in routers or old_routers. */
2812 struct digest_sd_map_t
*desc_by_eid_map
;
2813 /** List of routerinfo_t for all currently live routers we know. */
2814 smartlist_t
*routers
;
2815 /** List of signed_descriptor_t for older router descriptors we're
2817 smartlist_t
*old_routers
;
2818 /** Store holding server descriptors. If present, any router whose
2819 * cache_info.saved_location == SAVED_IN_CACHE is stored in this file
2820 * starting at cache_info.saved_offset */
2821 desc_store_t desc_store
;
2822 /** Store holding extra-info documents. */
2823 desc_store_t extrainfo_store
;
2826 /** Information on router used when extending a circuit. We don't need a
2827 * full routerinfo_t to extend: we only need addr:port:keyid to build an OR
2828 * connection, and onion_key to create the onionskin. Note that for onehop
2829 * general-purpose tunnels, the onion_key is NULL. */
2830 typedef struct extend_info_t
{
2831 char nickname
[MAX_HEX_NICKNAME_LEN
+1]; /**< This router's nickname for
2833 /** Hash of this router's RSA identity key. */
2834 char identity_digest
[DIGEST_LEN
];
2835 /** Ed25519 identity for this router, if any. */
2836 ed25519_public_key_t ed_identity
;
2837 uint16_t port
; /**< OR port. */
2838 tor_addr_t addr
; /**< IP address. */
2839 crypto_pk_t
*onion_key
; /**< Current onionskin key. */
2840 curve25519_public_key_t curve25519_onion_key
;
2843 /** Certificate for v3 directory protocol: binds long-term authority identity
2844 * keys to medium-term authority signing keys. */
2845 typedef struct authority_cert_t
{
2846 /** Information relating to caching this cert on disk and looking it up. */
2847 signed_descriptor_t cache_info
;
2848 /** This authority's long-term authority identity key. */
2849 crypto_pk_t
*identity_key
;
2850 /** This authority's medium-term signing key. */
2851 crypto_pk_t
*signing_key
;
2852 /** The digest of <b>signing_key</b> */
2853 char signing_key_digest
[DIGEST_LEN
];
2854 /** The listed expiration time of this certificate. */
2856 /** This authority's IPv4 address, in host order. */
2858 /** This authority's directory port. */
2862 /** Bitfield enum type listing types of information that directory authorities
2863 * can be authoritative about, and that directory caches may or may not cache.
2865 * Note that the granularity here is based on authority granularity and on
2866 * cache capabilities. Thus, one particular bit may correspond in practice to
2867 * a few types of directory info, so long as every authority that pronounces
2868 * officially about one of the types prounounces officially about all of them,
2869 * and so long as every cache that caches one of them caches all of them.
2873 /** Serves/signs v3 directory information: votes, consensuses, certs */
2874 V3_DIRINFO
= 1 << 2,
2875 /** Serves bridge descriptors. */
2876 BRIDGE_DIRINFO
= 1 << 4,
2877 /** Serves extrainfo documents. */
2878 EXTRAINFO_DIRINFO
=1 << 5,
2879 /** Serves microdescriptors. */
2880 MICRODESC_DIRINFO
=1 << 6,
2883 #define ALL_DIRINFO ((dirinfo_type_t)((1<<7)-1))
2885 #define CRYPT_PATH_MAGIC 0x70127012u
2887 struct fast_handshake_state_t
;
2888 struct ntor_handshake_state_t
;
2889 #define ONION_HANDSHAKE_TYPE_TAP 0x0000
2890 #define ONION_HANDSHAKE_TYPE_FAST 0x0001
2891 #define ONION_HANDSHAKE_TYPE_NTOR 0x0002
2892 #define MAX_ONION_HANDSHAKE_TYPE 0x0002
2896 struct fast_handshake_state_t
*fast
;
2898 struct ntor_handshake_state_t
*ntor
;
2900 } onion_handshake_state_t
;
2902 /** Holds accounting information for a single step in the layered encryption
2903 * performed by a circuit. Used only at the client edge of a circuit. */
2904 typedef struct crypt_path_t
{
2907 /* crypto environments */
2908 /** Encryption key and counter for cells heading towards the OR at this
2910 crypto_cipher_t
*f_crypto
;
2911 /** Encryption key and counter for cells heading back from the OR at this
2913 crypto_cipher_t
*b_crypto
;
2915 /** Digest state for cells heading towards the OR at this step. */
2916 crypto_digest_t
*f_digest
; /* for integrity checking */
2917 /** Digest state for cells heading away from the OR at this step. */
2918 crypto_digest_t
*b_digest
;
2920 /** Current state of the handshake as performed with the OR at this
2922 onion_handshake_state_t handshake_state
;
2923 /** Diffie-hellman handshake state for performing an introduction
2925 crypto_dh_t
*rend_dh_handshake_state
;
2927 /** Negotiated key material shared with the OR at this step. */
2928 char rend_circ_nonce
[DIGEST_LEN
];/* KH in tor-spec.txt */
2930 /** Information to extend to the OR at this step. */
2931 extend_info_t
*extend_info
;
2933 /** Is the circuit built to this step? Must be one of:
2934 * - CPATH_STATE_CLOSED (The circuit has not been extended to this step)
2935 * - CPATH_STATE_AWAITING_KEYS (We have sent an EXTEND/CREATE to this step
2936 * and not received an EXTENDED/CREATED)
2937 * - CPATH_STATE_OPEN (The circuit has been extended to this step) */
2939 #define CPATH_STATE_CLOSED 0
2940 #define CPATH_STATE_AWAITING_KEYS 1
2941 #define CPATH_STATE_OPEN 2
2942 struct crypt_path_t
*next
; /**< Link to next crypt_path_t in the circuit.
2943 * (The list is circular, so the last node
2944 * links to the first.) */
2945 struct crypt_path_t
*prev
; /**< Link to previous crypt_path_t in the
2948 int package_window
; /**< How many cells are we allowed to originate ending
2950 int deliver_window
; /**< How many cells are we willing to deliver originating
2954 /** A reference-counted pointer to a crypt_path_t, used only to share
2955 * the final rendezvous cpath to be used on a service-side rendezvous
2956 * circuit among multiple circuits built in parallel to the same
2957 * destination rendezvous point. */
2959 /** The reference count. */
2960 unsigned int refcount
;
2961 /** The pointer. Set to NULL when the crypt_path_t is put into use
2962 * on an opened rendezvous circuit. */
2963 crypt_path_t
*cpath
;
2964 } crypt_path_reference_t
;
2966 #define CPATH_KEY_MATERIAL_LEN (20*2+16*2)
2968 #define DH_KEY_LEN DH_BYTES
2970 /** Information used to build a circuit. */
2972 /** Intended length of the final circuit. */
2973 int desired_path_len
;
2974 /** How to extend to the planned exit node. */
2975 extend_info_t
*chosen_exit
;
2976 /** Whether every node in the circ must have adequate uptime. */
2977 unsigned int need_uptime
: 1;
2978 /** Whether every node in the circ must have adequate capacity. */
2979 unsigned int need_capacity
: 1;
2980 /** Whether the last hop was picked with exiting in mind. */
2981 unsigned int is_internal
: 1;
2982 /** Did we pick this as a one-hop tunnel (not safe for other streams)?
2983 * These are for encrypted dir conns that exit to this router, not
2984 * for arbitrary exits from the circuit. */
2985 unsigned int onehop_tunnel
: 1;
2986 /** The crypt_path_t to append after rendezvous: used for rendezvous. */
2987 crypt_path_t
*pending_final_cpath
;
2988 /** A ref-counted reference to the crypt_path_t to append after
2989 * rendezvous; used on the service side. */
2990 crypt_path_reference_t
*service_pending_final_cpath_ref
;
2991 /** How many times has building a circuit for this task failed? */
2993 /** At what time should we give up on this task? */
2995 } cpath_build_state_t
;
2997 /** "magic" value for an origin_circuit_t */
2998 #define ORIGIN_CIRCUIT_MAGIC 0x35315243u
2999 /** "magic" value for an or_circuit_t */
3000 #define OR_CIRCUIT_MAGIC 0x98ABC04Fu
3001 /** "magic" value for a circuit that would have been freed by circuit_free,
3002 * but which we're keeping around until a cpuworker reply arrives. See
3003 * circuit_free() for more documentation. */
3004 #define DEAD_CIRCUIT_MAGIC 0xdeadc14c
3006 struct create_cell_t
;
3008 /** Entry in the cell stats list of a circuit; used only if CELL_STATS
3009 * events are enabled. */
3010 typedef struct testing_cell_stats_entry_t
{
3011 uint8_t command
; /**< cell command number. */
3012 /** Waiting time in centiseconds if this event is for a removed cell,
3013 * or 0 if this event is for adding a cell to the queue. 22 bits can
3014 * store more than 11 hours, enough to assume that a circuit with this
3015 * delay would long have been closed. */
3016 unsigned int waiting_time
:22;
3017 unsigned int removed
:1; /**< 0 for added to, 1 for removed from queue. */
3018 unsigned int exitward
:1; /**< 0 for app-ward, 1 for exit-ward. */
3019 } testing_cell_stats_entry_t
;
3022 * A circuit is a path over the onion routing
3023 * network. Applications can connect to one end of the circuit, and can
3024 * create exit connections at the other end of the circuit. AP and exit
3025 * connections have only one circuit associated with them (and thus these
3026 * connection types are closed when the circuit is closed), whereas
3027 * OR connections multiplex many circuits at once, and stay standing even
3028 * when there are no circuits running over them.
3030 * A circuit_t structure can fill one of two roles. First, a or_circuit_t
3031 * links two connections together: either an edge connection and an OR
3032 * connection, or two OR connections. (When joined to an OR connection, a
3033 * circuit_t affects only cells sent to a particular circID on that
3034 * connection. When joined to an edge connection, a circuit_t affects all
3037 * Second, an origin_circuit_t holds the cipher keys and state for sending data
3038 * along a given circuit. At the OP, it has a sequence of ciphers, each
3039 * of which is shared with a single OR along the circuit. Separate
3040 * ciphers are used for data going "forward" (away from the OP) and
3041 * "backward" (towards the OP). At the OR, a circuit has only two stream
3042 * ciphers: one for data going forward, and one for data going backward.
3044 typedef struct circuit_t
{
3045 uint32_t magic
; /**< For memory and type debugging: must equal
3046 * ORIGIN_CIRCUIT_MAGIC or OR_CIRCUIT_MAGIC. */
3048 /** The channel that is next in this circuit. */
3052 * The circuit_id used in the next (forward) hop of this circuit;
3053 * this is unique to n_chan, but this ordered pair is globally
3056 * (n_chan->global_identifier, n_circ_id)
3061 * Circuit mux associated with n_chan to which this circuit is attached;
3062 * NULL if we have no n_chan.
3064 circuitmux_t
*n_mux
;
3066 /** Queue of cells waiting to be transmitted on n_chan */
3067 cell_queue_t n_chan_cells
;
3070 * The hop to which we want to extend this circuit. Should be NULL if
3071 * the circuit has attached to a channel.
3073 extend_info_t
*n_hop
;
3075 /** True iff we are waiting for n_chan_cells to become less full before
3076 * allowing p_streams to add any more cells. (Origin circuit only.) */
3077 unsigned int streams_blocked_on_n_chan
: 1;
3078 /** True iff we are waiting for p_chan_cells to become less full before
3079 * allowing n_streams to add any more cells. (OR circuit only.) */
3080 unsigned int streams_blocked_on_p_chan
: 1;
3082 /** True iff we have queued a delete backwards on this circuit, but not put
3083 * it on the output buffer. */
3084 unsigned int p_delete_pending
: 1;
3085 /** True iff we have queued a delete forwards on this circuit, but not put
3086 * it on the output buffer. */
3087 unsigned int n_delete_pending
: 1;
3089 /** True iff this circuit has received a DESTROY cell in either direction */
3090 unsigned int received_destroy
: 1;
3092 uint8_t state
; /**< Current status of this circuit. */
3093 uint8_t purpose
; /**< Why are we creating this circuit? */
3095 /** How many relay data cells can we package (read from edge streams)
3096 * on this circuit before we receive a circuit-level sendme cell asking
3099 /** How many relay data cells will we deliver (write to edge streams)
3100 * on this circuit? When deliver_window gets low, we send some
3101 * circuit-level sendme cells to indicate that we're willing to accept
3105 /** Temporary field used during circuits_handle_oom. */
3108 /** For storage while n_chan is pending (state CIRCUIT_STATE_CHAN_WAIT). */
3109 struct create_cell_t
*n_chan_create_cell
;
3111 /** When did circuit construction actually begin (ie send the
3112 * CREATE cell or begin cannibalization).
3114 * Note: This timer will get reset if we decide to cannibalize
3115 * a circuit. It may also get reset during certain phases of hidden
3116 * service circuit use.
3118 * We keep this timestamp with a higher resolution than most so that the
3119 * circuit-build-time tracking code can get millisecond resolution.
3121 struct timeval timestamp_began
;
3123 /** This timestamp marks when the init_circuit_base constructor ran. */
3124 struct timeval timestamp_created
;
3126 /** When the circuit was first used, or 0 if the circuit is clean.
3128 * XXXX Note that some code will artifically adjust this value backward
3129 * in time in order to indicate that a circuit shouldn't be used for new
3130 * streams, but that it can stay alive as long as it has streams on it.
3131 * That's a kludge we should fix.
3133 * XXX The CBT code uses this field to record when HS-related
3134 * circuits entered certain states. This usage probably won't
3135 * interfere with this field's primary purpose, but we should
3136 * document it more thoroughly to make sure of that.
3138 * XXX The SocksPort option KeepaliveIsolateSOCKSAuth will artificially
3139 * adjust this value forward each time a suitable stream is attached to an
3140 * already constructed circuit, potentially keeping the circuit alive
3143 time_t timestamp_dirty
;
3145 uint16_t marked_for_close
; /**< Should we close this circuit at the end of
3146 * the main loop? (If true, holds the line number
3147 * where this circuit was marked.) */
3148 const char *marked_for_close_file
; /**< For debugging: in which file was this
3149 * circuit marked for close? */
3150 /** For what reason (See END_CIRC_REASON...) is this circuit being closed?
3151 * This field is set in circuit_mark_for_close and used later in
3152 * circuit_about_to_free. */
3153 int marked_for_close_reason
;
3154 /** As marked_for_close_reason, but reflects the underlying reason for
3155 * closing this circuit.
3157 int marked_for_close_orig_reason
;
3159 /** Unique ID for measuring tunneled network status requests. */
3162 /** Index in smartlist of all circuits (global_circuitlist). */
3163 int global_circuitlist_idx
;
3165 /** Next circuit in the doubly-linked ring of circuits waiting to add
3166 * cells to n_conn. NULL if we have no cells pending, or if we're not
3167 * linked to an OR connection. */
3168 struct circuit_t
*next_active_on_n_chan
;
3169 /** Previous circuit in the doubly-linked ring of circuits waiting to add
3170 * cells to n_conn. NULL if we have no cells pending, or if we're not
3171 * linked to an OR connection. */
3172 struct circuit_t
*prev_active_on_n_chan
;
3174 /** Various statistics about cells being added to or removed from this
3175 * circuit's queues; used only if CELL_STATS events are enabled and
3176 * cleared after being sent to control port. */
3177 smartlist_t
*testing_cell_stats
;
3179 /** If set, points to an HS token that this circuit might be carrying.
3180 * Used by the HS circuitmap. */
3181 hs_token_t
*hs_token
;
3182 /** Hashtable node: used to look up the circuit by its HS token using the HS
3184 HT_ENTRY(circuit_t
) hs_circuitmap_node
;
3187 /** Largest number of relay_early cells that we can send on a given
3189 #define MAX_RELAY_EARLY_CELLS_PER_CIRCUIT 8
3192 * Describes the circuit building process in simplified terms based
3193 * on the path bias accounting state for a circuit.
3195 * NOTE: These state values are enumerated in the order for which we
3196 * expect circuits to transition through them. If you add states,
3197 * you need to preserve this overall ordering. The various pathbias
3198 * state transition and accounting functions (pathbias_mark_* and
3199 * pathbias_count_*) contain ordinal comparisons to enforce proper
3200 * state transitions for corrections.
3202 * This state machine and the associated logic was created to prevent
3203 * miscounting due to unknown cases of circuit reuse. See also tickets
3207 /** This circuit is "new". It has not yet completed a first hop
3208 * or been counted by the path bias code. */
3209 PATH_STATE_NEW_CIRC
= 0,
3210 /** This circuit has completed one/two hops, and has been counted by
3211 * the path bias logic. */
3212 PATH_STATE_BUILD_ATTEMPTED
= 1,
3213 /** This circuit has been completely built */
3214 PATH_STATE_BUILD_SUCCEEDED
= 2,
3215 /** Did we try to attach any SOCKS streams or hidserv introductions to
3218 * Note: If we ever implement end-to-end stream timing through test
3219 * stream probes (#5707), we must *not* set this for those probes
3220 * (or any other automatic streams) because the adversary could
3221 * just tag at a later point.
3223 PATH_STATE_USE_ATTEMPTED
= 3,
3224 /** Did any SOCKS streams or hidserv introductions actually succeed on
3227 * If any streams detatch/fail from this circuit, the code transitions
3228 * the circuit back to PATH_STATE_USE_ATTEMPTED to ensure we probe. See
3229 * pathbias_mark_use_rollback() for that.
3231 PATH_STATE_USE_SUCCEEDED
= 4,
3234 * This is a special state to indicate that we got a corrupted
3235 * relay cell on a circuit and we don't intend to probe it.
3237 PATH_STATE_USE_FAILED
= 5,
3240 * This is a special state to indicate that we already counted
3241 * the circuit. Used to guard against potential state machine
3244 PATH_STATE_ALREADY_COUNTED
= 6,
3246 #define path_state_bitfield_t ENUM_BF(path_state_t)
3248 /** An origin_circuit_t holds data necessary to build and use a circuit.
3250 typedef struct origin_circuit_t
{
3253 /** Linked list of AP streams (or EXIT streams if hidden service)
3254 * associated with this circuit. */
3255 edge_connection_t
*p_streams
;
3257 /** Bytes read from any attached stream since last call to
3258 * control_event_circ_bandwidth_used(). Only used if we're configured
3259 * to emit CIRC_BW events. */
3260 uint32_t n_read_circ_bw
;
3262 /** Bytes written to any attached stream since last call to
3263 * control_event_circ_bandwidth_used(). Only used if we're configured
3264 * to emit CIRC_BW events. */
3265 uint32_t n_written_circ_bw
;
3267 /** Build state for this circuit. It includes the intended path
3268 * length, the chosen exit router, rendezvous information, etc.
3270 cpath_build_state_t
*build_state
;
3271 /** The doubly-linked list of crypt_path_t entries, one per hop,
3272 * for this circuit. This includes ciphers for each hop,
3273 * integrity-checking digests for each hop, and package/delivery
3274 * windows for each hop.
3276 crypt_path_t
*cpath
;
3278 /** Holds all rendezvous data on either client or service side. */
3279 rend_data_t
*rend_data
;
3281 /** Holds hidden service identifier on either client or service side. This
3282 * is for both introduction and rendezvous circuit. */
3283 struct hs_ident_circuit_t
*hs_ident
;
3285 /** Holds the data that the entry guard system uses to track the
3286 * status of the guard this circuit is using, and thereby to determine
3287 * whether this circuit can be used. */
3288 struct circuit_guard_state_t
*guard_state
;
3290 /** Index into global_origin_circuit_list for this circuit. -1 if not
3292 int global_origin_circuit_list_idx
;
3294 /** How many more relay_early cells can we send on this circuit, according
3295 * to the specification? */
3296 unsigned int remaining_relay_early_cells
: 4;
3298 /** Set if this circuit is insanely old and we already informed the user */
3299 unsigned int is_ancient
: 1;
3301 /** Set if this circuit has already been opened. Used to detect
3302 * cannibalized circuits. */
3303 unsigned int has_opened
: 1;
3306 * Path bias state machine. Used to ensure integrity of our
3307 * circuit building and usage accounting. See path_state_t
3310 path_state_bitfield_t path_state
: 3;
3312 /* If this flag is set, we should not consider attaching any more
3313 * connections to this circuit. */
3314 unsigned int unusable_for_new_conns
: 1;
3317 * Tristate variable to guard against pathbias miscounting
3318 * due to circuit purpose transitions changing the decision
3319 * of pathbias_should_count(). This variable is informational
3320 * only. The current results of pathbias_should_count() are
3321 * the official decision for pathbias accounting.
3323 uint8_t pathbias_shouldcount
;
3324 #define PATHBIAS_SHOULDCOUNT_UNDECIDED 0
3325 #define PATHBIAS_SHOULDCOUNT_IGNORED 1
3326 #define PATHBIAS_SHOULDCOUNT_COUNTED 2
3328 /** For path probing. Store the temporary probe stream ID
3329 * for response comparison */
3330 streamid_t pathbias_probe_id
;
3332 /** For path probing. Store the temporary probe address nonce
3333 * (in host byte order) for response comparison. */
3334 uint32_t pathbias_probe_nonce
;
3336 /** Set iff this is a hidden-service circuit which has timed out
3337 * according to our current circuit-build timeout, but which has
3338 * been kept around because it might still succeed in connecting to
3339 * its destination, and which is not a fully-connected rendezvous
3342 * (We clear this flag for client-side rendezvous circuits when they
3343 * are 'joined' to the other side's rendezvous circuit, so that
3344 * connection_ap_handshake_attach_circuit can put client streams on
3345 * the circuit. We also clear this flag for service-side rendezvous
3346 * circuits when they are 'joined' to a client's rend circ, but only
3347 * for symmetry with the client case. Client-side introduction
3348 * circuits are closed when we get a joined rend circ, and
3349 * service-side introduction circuits never have this flag set.) */
3350 unsigned int hs_circ_has_timed_out
: 1;
3352 /** Set iff this circuit has been given a relaxed timeout because
3353 * no circuits have opened. Used to prevent spamming logs. */
3354 unsigned int relaxed_timeout
: 1;
3356 /** Set iff this is a service-side rendezvous circuit for which a
3357 * new connection attempt has been launched. We consider launching
3358 * a new service-side rend circ to a client when the previous one
3359 * fails; now that we don't necessarily close a service-side rend
3360 * circ when we launch a new one to the same client, this flag keeps
3361 * us from launching two retries for the same failed rend circ. */
3362 unsigned int hs_service_side_rend_circ_has_been_relaunched
: 1;
3364 /** What commands were sent over this circuit that decremented the
3365 * RELAY_EARLY counter? This is for debugging task 878. */
3366 uint8_t relay_early_commands
[MAX_RELAY_EARLY_CELLS_PER_CIRCUIT
];
3368 /** How many RELAY_EARLY cells have been sent over this circuit? This is
3369 * for debugging task 878, too. */
3370 int relay_early_cells_sent
;
3372 /** The next stream_id that will be tried when we're attempting to
3373 * construct a new AP stream originating at this circuit. */
3374 streamid_t next_stream_id
;
3376 /* The intro key replaces the hidden service's public key if purpose is
3377 * S_ESTABLISH_INTRO or S_INTRO, provided that no unversioned rendezvous
3378 * descriptor is used. */
3379 crypto_pk_t
*intro_key
;
3381 /** Quasi-global identifier for this circuit; used for control.c */
3382 /* XXXX NM This can get re-used after 2**32 circuits. */
3383 uint32_t global_identifier
;
3385 /** True if we have associated one stream to this circuit, thereby setting
3386 * the isolation paramaters for this circuit. Note that this doesn't
3387 * necessarily mean that we've <em>attached</em> any streams to the circuit:
3388 * we may only have marked up this circuit during the launch process.
3390 unsigned int isolation_values_set
: 1;
3391 /** True iff any stream has <em>ever</em> been attached to this circuit.
3393 * In a better world we could use timestamp_dirty for this, but
3394 * timestamp_dirty is far too overloaded at the moment.
3396 unsigned int isolation_any_streams_attached
: 1;
3398 /** A bitfield of ISO_* flags for every isolation field such that this
3399 * circuit has had streams with more than one value for that field
3400 * attached to it. */
3401 uint8_t isolation_flags_mixed
;
3403 /** @name Isolation parameters
3405 * If any streams have been associated with this circ (isolation_values_set
3406 * == 1), and all streams associated with the circuit have had the same
3407 * value for some field ((isolation_flags_mixed & ISO_FOO) == 0), then these
3408 * elements hold the value for that field.
3410 * Note again that "associated" is not the same as "attached": we
3411 * preliminarily associate streams with a circuit while the circuit is being
3412 * launched, so that we can tell whether we need to launch more circuits.
3416 uint8_t client_proto_type
;
3417 uint8_t client_proto_socksver
;
3419 tor_addr_t client_addr
;
3423 size_t socks_username_len
;
3424 uint8_t socks_password_len
;
3425 /* Note that the next two values are NOT NUL-terminated; see
3426 socks_username_len and socks_password_len for their lengths. */
3427 char *socks_username
;
3428 char *socks_password
;
3429 /** Global identifier for the first stream attached here; used by
3431 uint64_t associated_isolated_stream_global_id
;
3433 /** A list of addr_policy_t for this circuit in particular. Used by
3434 * adjust_exit_policy_from_exitpolicy_failure.
3436 smartlist_t
*prepend_policy
;
3438 /** How long do we wait before closing this circuit if it remains
3439 * completely idle after it was built, in seconds? This value
3440 * is randomized on a per-circuit basis from CircuitsAvailableTimoeut
3441 * to 2*CircuitsAvailableTimoeut. */
3442 int circuit_idle_timeout
;
3446 struct onion_queue_t
;
3448 /** An or_circuit_t holds information needed to implement a circuit at an
3450 typedef struct or_circuit_t
{
3453 /** Next circuit in the doubly-linked ring of circuits waiting to add
3454 * cells to p_chan. NULL if we have no cells pending, or if we're not
3455 * linked to an OR connection. */
3456 struct circuit_t
*next_active_on_p_chan
;
3457 /** Previous circuit in the doubly-linked ring of circuits waiting to add
3458 * cells to p_chan. NULL if we have no cells pending, or if we're not
3459 * linked to an OR connection. */
3460 struct circuit_t
*prev_active_on_p_chan
;
3461 /** Pointer to an entry on the onion queue, if this circuit is waiting for a
3462 * chance to give an onionskin to a cpuworker. Used only in onion.c */
3463 struct onion_queue_t
*onionqueue_entry
;
3464 /** Pointer to a workqueue entry, if this circuit has given an onionskin to
3465 * a cpuworker and is waiting for a response. Used to decide whether it is
3466 * safe to free a circuit or if it is still in use by a cpuworker. */
3467 struct workqueue_entry_s
*workqueue_entry
;
3469 /** The circuit_id used in the previous (backward) hop of this circuit. */
3471 /** Queue of cells waiting to be transmitted on p_conn. */
3472 cell_queue_t p_chan_cells
;
3473 /** The channel that is previous in this circuit. */
3476 * Circuit mux associated with p_chan to which this circuit is attached;
3477 * NULL if we have no p_chan.
3479 circuitmux_t
*p_mux
;
3480 /** Linked list of Exit streams associated with this circuit. */
3481 edge_connection_t
*n_streams
;
3482 /** Linked list of Exit streams associated with this circuit that are
3483 * still being resolved. */
3484 edge_connection_t
*resolving_streams
;
3485 /** The cipher used by intermediate hops for cells heading toward the
3487 crypto_cipher_t
*p_crypto
;
3488 /** The cipher used by intermediate hops for cells heading away from
3490 crypto_cipher_t
*n_crypto
;
3492 /** The integrity-checking digest used by intermediate hops, for
3493 * cells packaged here and heading towards the OP.
3495 crypto_digest_t
*p_digest
;
3496 /** The integrity-checking digest used by intermediate hops, for
3497 * cells packaged at the OP and arriving here.
3499 crypto_digest_t
*n_digest
;
3501 /** Points to spliced circuit if purpose is REND_ESTABLISHED, and circuit
3502 * is not marked for close. */
3503 struct or_circuit_t
*rend_splice
;
3505 /** Stores KH for the handshake. */
3506 char rend_circ_nonce
[DIGEST_LEN
];/* KH in tor-spec.txt */
3508 /** How many more relay_early cells can we send on this circuit, according
3509 * to the specification? */
3510 unsigned int remaining_relay_early_cells
: 4;
3512 /* We have already received an INTRODUCE1 cell on this circuit. */
3513 unsigned int already_received_introduce1
: 1;
3515 /** If set, this circuit carries HS traffic. Consider it in any HS
3517 unsigned int circuit_carries_hs_traffic_stats
: 1;
3519 /** Number of cells that were removed from circuit queue; reset every
3520 * time when writing buffer stats to disk. */
3521 uint32_t processed_cells
;
3523 /** Total time in milliseconds that cells spent in both app-ward and
3524 * exit-ward queues of this circuit; reset every time when writing
3525 * buffer stats to disk. */
3526 uint64_t total_cell_waiting_time
;
3528 /** Maximum cell queue size for a middle relay; this is stored per circuit
3529 * so append_cell_to_circuit_queue() can adjust it if it changes. If set
3530 * to zero, it is initialized to the default value.
3532 uint32_t max_middle_cells
;
3535 #if REND_COOKIE_LEN != DIGEST_LEN
3536 #error "The REND_TOKEN_LEN macro assumes REND_COOKIE_LEN == DIGEST_LEN"
3538 #define REND_TOKEN_LEN DIGEST_LEN
3540 /** Convert a circuit subtype to a circuit_t. */
3541 #define TO_CIRCUIT(x) (&((x)->base_))
3543 /** Convert a circuit_t* to a pointer to the enclosing or_circuit_t. Assert
3544 * if the cast is impossible. */
3545 static or_circuit_t
*TO_OR_CIRCUIT(circuit_t
*);
3546 static const or_circuit_t
*CONST_TO_OR_CIRCUIT(const circuit_t
*);
3547 /** Convert a circuit_t* to a pointer to the enclosing origin_circuit_t.
3548 * Assert if the cast is impossible. */
3549 static origin_circuit_t
*TO_ORIGIN_CIRCUIT(circuit_t
*);
3550 static const origin_circuit_t
*CONST_TO_ORIGIN_CIRCUIT(const circuit_t
*);
3552 /** Return 1 iff <b>node</b> has Exit flag and no BadExit flag.
3553 * Otherwise, return 0.
3555 static inline int node_is_good_exit(const node_t
*node
)
3557 return node
->is_exit
&& ! node
->is_bad_exit
;
3560 static inline or_circuit_t
*TO_OR_CIRCUIT(circuit_t
*x
)
3562 tor_assert(x
->magic
== OR_CIRCUIT_MAGIC
);
3563 return DOWNCAST(or_circuit_t
, x
);
3565 static inline const or_circuit_t
*CONST_TO_OR_CIRCUIT(const circuit_t
*x
)
3567 tor_assert(x
->magic
== OR_CIRCUIT_MAGIC
);
3568 return DOWNCAST(or_circuit_t
, x
);
3570 static inline origin_circuit_t
*TO_ORIGIN_CIRCUIT(circuit_t
*x
)
3572 tor_assert(x
->magic
== ORIGIN_CIRCUIT_MAGIC
);
3573 return DOWNCAST(origin_circuit_t
, x
);
3575 static inline const origin_circuit_t
*CONST_TO_ORIGIN_CIRCUIT(
3578 tor_assert(x
->magic
== ORIGIN_CIRCUIT_MAGIC
);
3579 return DOWNCAST(origin_circuit_t
, x
);
3582 /* limits for TCP send and recv buffer size used for constrained sockets */
3583 #define MIN_CONSTRAINED_TCP_BUFFER 2048
3584 #define MAX_CONSTRAINED_TCP_BUFFER 262144 /* 256k */
3586 /** @name Isolation flags
3588 Ways to isolate client streams
3592 /** Isolate based on destination port */
3593 #define ISO_DESTPORT (1u<<0)
3594 /** Isolate based on destination address */
3595 #define ISO_DESTADDR (1u<<1)
3596 /** Isolate based on SOCKS authentication */
3597 #define ISO_SOCKSAUTH (1u<<2)
3598 /** Isolate based on client protocol choice */
3599 #define ISO_CLIENTPROTO (1u<<3)
3600 /** Isolate based on client address */
3601 #define ISO_CLIENTADDR (1u<<4)
3602 /** Isolate based on session group (always on). */
3603 #define ISO_SESSIONGRP (1u<<5)
3604 /** Isolate based on newnym epoch (always on). */
3605 #define ISO_NYM_EPOCH (1u<<6)
3606 /** Isolate all streams (Internal only). */
3607 #define ISO_STREAM (1u<<7)
3610 /** Default isolation level for ports. */
3611 #define ISO_DEFAULT (ISO_CLIENTADDR|ISO_SOCKSAUTH|ISO_SESSIONGRP|ISO_NYM_EPOCH)
3613 /** Indicates that we haven't yet set a session group on a port_cfg_t. */
3614 #define SESSION_GROUP_UNSET -1
3615 /** Session group reserved for directory connections */
3616 #define SESSION_GROUP_DIRCONN -2
3617 /** Session group reserved for resolve requests launched by a controller */
3618 #define SESSION_GROUP_CONTROL_RESOLVE -3
3619 /** First automatically allocated session group number */
3620 #define SESSION_GROUP_FIRST_AUTO -4
3622 /** Configuration for a single port that we're listening on. */
3623 typedef struct port_cfg_t
{
3624 tor_addr_t addr
; /**< The actual IP to listen on, if !is_unix_addr. */
3625 int port
; /**< The configured port, or CFG_AUTO_PORT to tell Tor to pick its
3627 uint8_t type
; /**< One of CONN_TYPE_*_LISTENER */
3628 unsigned is_unix_addr
: 1; /**< True iff this is an AF_UNIX address. */
3630 unsigned is_group_writable
: 1;
3631 unsigned is_world_writable
: 1;
3632 unsigned relax_dirmode_check
: 1;
3634 entry_port_cfg_t entry_cfg
;
3636 server_port_cfg_t server_cfg
;
3638 /* Unix sockets only: */
3639 /** Path for an AF_UNIX address */
3640 char unix_addr
[FLEXIBLE_ARRAY_MEMBER
];
3643 typedef struct routerset_t routerset_t
;
3645 /** A magic value for the (Socks|OR|...)Port options below, telling Tor
3646 * to pick its own port. */
3647 #define CFG_AUTO_PORT 0xc4005e
3649 /** Enumeration of outbound address configuration types:
3650 * Exit-only, OR-only, or both */
3651 typedef enum {OUTBOUND_ADDR_EXIT
, OUTBOUND_ADDR_OR
,
3652 OUTBOUND_ADDR_EXIT_AND_OR
,
3653 OUTBOUND_ADDR_MAX
} outbound_addr_t
;
3655 /** Configuration options for a Tor process. */
3659 /** What should the tor process actually do? */
3661 CMD_RUN_TOR
=0, CMD_LIST_FINGERPRINT
, CMD_HASH_PASSWORD
,
3662 CMD_VERIFY_CONFIG
, CMD_RUN_UNITTESTS
, CMD_DUMP_CONFIG
,
3666 char *command_arg
; /**< Argument for command-line option. */
3668 config_line_t
*Logs
; /**< New-style list of configuration lines
3670 int LogTimeGranularity
; /**< Log resolution in milliseconds. */
3672 int LogMessageDomains
; /**< Boolean: Should we log the domain(s) in which
3673 * each log message occurs? */
3674 int TruncateLogFile
; /**< Boolean: Should we truncate the log file
3675 before we start writing? */
3676 char *SyslogIdentityTag
; /**< Identity tag to add for syslog logging. */
3677 char *AndroidIdentityTag
; /**< Identity tag to add for Android logging. */
3679 char *DebugLogFile
; /**< Where to send verbose log messages. */
3680 char *DataDirectory_option
; /**< Where to store long-term data, as
3681 * configured by the user. */
3682 char *DataDirectory
; /**< Where to store long-term data, as modified. */
3683 int DataDirectoryGroupReadable
; /**< Boolean: Is the DataDirectory g+r? */
3685 char *KeyDirectory_option
; /**< Where to store keys, as
3686 * configured by the user. */
3687 char *KeyDirectory
; /**< Where to store keys data, as modified. */
3688 int KeyDirectoryGroupReadable
; /**< Boolean: Is the KeyDirectory g+r? */
3690 char *CacheDirectory_option
; /**< Where to store cached data, as
3691 * configured by the user. */
3692 char *CacheDirectory
; /**< Where to store cached data, as modified. */
3693 int CacheDirectoryGroupReadable
; /**< Boolean: Is the CacheDirectory g+r? */
3695 char *Nickname
; /**< OR only: nickname of this onion router. */
3696 char *Address
; /**< OR only: configured address for this onion router. */
3697 char *PidFile
; /**< Where to store PID of Tor process. */
3699 routerset_t
*ExitNodes
; /**< Structure containing nicknames, digests,
3700 * country codes and IP address patterns of ORs to
3701 * consider as exits. */
3702 routerset_t
*EntryNodes
;/**< Structure containing nicknames, digests,
3703 * country codes and IP address patterns of ORs to
3704 * consider as entry points. */
3705 int StrictNodes
; /**< Boolean: When none of our EntryNodes or ExitNodes
3706 * are up, or we need to access a node in ExcludeNodes,
3707 * do we just fail instead? */
3708 routerset_t
*ExcludeNodes
;/**< Structure containing nicknames, digests,
3709 * country codes and IP address patterns of ORs
3710 * not to use in circuits. But see StrictNodes
3712 routerset_t
*ExcludeExitNodes
;/**< Structure containing nicknames, digests,
3713 * country codes and IP address patterns of
3714 * ORs not to consider as exits. */
3716 /** Union of ExcludeNodes and ExcludeExitNodes */
3717 routerset_t
*ExcludeExitNodesUnion_
;
3719 int DisableAllSwap
; /**< Boolean: Attempt to call mlockall() on our
3720 * process for all current and future memory. */
3722 config_line_t
*ExitPolicy
; /**< Lists of exit policy components. */
3723 int ExitPolicyRejectPrivate
; /**< Should we not exit to reserved private
3724 * addresses, and our own published addresses?
3726 int ExitPolicyRejectLocalInterfaces
; /**< Should we not exit to local
3727 * interface addresses?
3728 * Includes OutboundBindAddresses and
3729 * configured ports. */
3730 int ReducedExitPolicy
; /**<Should we use the Reduced Exit Policy? */
3731 config_line_t
*SocksPolicy
; /**< Lists of socks policy components */
3732 config_line_t
*DirPolicy
; /**< Lists of dir policy components */
3733 /** Local address to bind outbound sockets */
3734 config_line_t
*OutboundBindAddress
;
3735 /** Local address to bind outbound relay sockets */
3736 config_line_t
*OutboundBindAddressOR
;
3737 /** Local address to bind outbound exit sockets */
3738 config_line_t
*OutboundBindAddressExit
;
3739 /** Addresses derived from the various OutboundBindAddress lines.
3740 * [][0] is IPv4, [][1] is IPv6
3742 tor_addr_t OutboundBindAddresses
[OUTBOUND_ADDR_MAX
][2];
3743 /** Directory server only: which versions of
3744 * Tor should we tell users to run? */
3745 config_line_t
*RecommendedVersions
;
3746 config_line_t
*RecommendedClientVersions
;
3747 config_line_t
*RecommendedServerVersions
;
3748 config_line_t
*RecommendedPackages
;
3749 /** Whether dirservers allow router descriptors with private IPs. */
3750 int DirAllowPrivateAddresses
;
3751 /** Whether routers accept EXTEND cells to routers with private IPs. */
3752 int ExtendAllowPrivateAddresses
;
3753 char *User
; /**< Name of user to run Tor as. */
3754 config_line_t
*ORPort_lines
; /**< Ports to listen on for OR connections. */
3755 /** Ports to listen on for extended OR connections. */
3756 config_line_t
*ExtORPort_lines
;
3757 /** Ports to listen on for SOCKS connections. */
3758 config_line_t
*SocksPort_lines
;
3759 /** Ports to listen on for transparent pf/netfilter connections. */
3760 config_line_t
*TransPort_lines
;
3761 char *TransProxyType
; /**< What kind of transparent proxy
3762 * implementation are we using? */
3763 /** Parsed value of TransProxyType. */
3769 } TransProxyType_parsed
;
3770 config_line_t
*NATDPort_lines
; /**< Ports to listen on for transparent natd
3772 /** Ports to listen on for HTTP Tunnel connections. */
3773 config_line_t
*HTTPTunnelPort_lines
;
3774 config_line_t
*ControlPort_lines
; /**< Ports to listen on for control
3776 config_line_t
*ControlSocket
; /**< List of Unix Domain Sockets to listen on
3777 * for control connections. */
3779 int ControlSocketsGroupWritable
; /**< Boolean: Are control sockets g+rw? */
3780 int SocksSocketsGroupWritable
; /**< Boolean: Are SOCKS sockets g+rw? */
3781 /** Ports to listen on for directory connections. */
3782 config_line_t
*DirPort_lines
;
3783 config_line_t
*DNSPort_lines
; /**< Ports to listen on for DNS requests. */
3785 /* MaxMemInQueues value as input by the user. We clean this up to be
3786 * MaxMemInQueues. */
3787 uint64_t MaxMemInQueues_raw
;
3788 uint64_t MaxMemInQueues
;/**< If we have more memory than this allocated
3789 * for queues and buffers, run the OOM handler */
3790 /** Above this value, consider ourselves low on RAM. */
3791 uint64_t MaxMemInQueues_low_threshold
;
3793 /** @name port booleans
3795 * Derived booleans: For server ports and ControlPort, true iff there is a
3796 * non-listener port on an AF_INET or AF_INET6 address of the given type
3797 * configured in one of the _lines options above.
3798 * For client ports, also true if there is a unix socket configured.
3799 * If you are checking for client ports, you may want to use:
3800 * SocksPort_set || TransPort_set || NATDPort_set || DNSPort_set ||
3801 * HTTPTunnelPort_set
3802 * rather than SocksPort_set.
3806 unsigned int ORPort_set
: 1;
3807 unsigned int SocksPort_set
: 1;
3808 unsigned int TransPort_set
: 1;
3809 unsigned int NATDPort_set
: 1;
3810 unsigned int ControlPort_set
: 1;
3811 unsigned int DirPort_set
: 1;
3812 unsigned int DNSPort_set
: 1;
3813 unsigned int ExtORPort_set
: 1;
3814 unsigned int HTTPTunnelPort_set
: 1;
3817 int AssumeReachable
; /**< Whether to publish our descriptor regardless. */
3818 int AuthoritativeDir
; /**< Boolean: is this an authoritative directory? */
3819 int V3AuthoritativeDir
; /**< Boolean: is this an authoritative directory
3820 * for version 3 directories? */
3821 int VersioningAuthoritativeDir
; /**< Boolean: is this an authoritative
3822 * directory that's willing to recommend
3824 int BridgeAuthoritativeDir
; /**< Boolean: is this an authoritative directory
3825 * that aggregates bridge descriptors? */
3827 /** If set on a bridge relay, it will include this value on a new
3828 * "bridge-distribution-request" line in its bridge descriptor. */
3829 char *BridgeDistribution
;
3831 /** If set on a bridge authority, it will answer requests on its dirport
3832 * for bridge statuses -- but only if the requests use this password. */
3833 char *BridgePassword
;
3834 /** If BridgePassword is set, this is a SHA256 digest of the basic http
3835 * authenticator for it. Used so we can do a time-independent comparison. */
3836 char *BridgePassword_AuthDigest_
;
3838 int UseBridges
; /**< Boolean: should we start all circuits with a bridge? */
3839 config_line_t
*Bridges
; /**< List of bootstrap bridge addresses. */
3841 config_line_t
*ClientTransportPlugin
; /**< List of client
3842 transport plugins. */
3844 config_line_t
*ServerTransportPlugin
; /**< List of client
3845 transport plugins. */
3847 /** List of TCP/IP addresses that transports should listen at. */
3848 config_line_t
*ServerTransportListenAddr
;
3850 /** List of options that must be passed to pluggable transports. */
3851 config_line_t
*ServerTransportOptions
;
3853 int BridgeRelay
; /**< Boolean: are we acting as a bridge relay? We make
3854 * this explicit so we can change how we behave in the
3857 /** Boolean: if we know the bridge's digest, should we get new
3858 * descriptors from the bridge authorities or from the bridge itself? */
3859 int UpdateBridgesFromAuthority
;
3861 int AvoidDiskWrites
; /**< Boolean: should we never cache things to disk?
3863 int ClientOnly
; /**< Boolean: should we never evolve into a server role? */
3865 int ReducedConnectionPadding
; /**< Boolean: Should we try to keep connections
3866 open shorter and pad them less against
3867 connection-level traffic analysis? */
3868 /** Autobool: if auto, then connection padding will be negotiated by client
3869 * and server. If 0, it will be fully disabled. If 1, the client will still
3870 * pad to the server regardless of server support. */
3871 int ConnectionPadding
;
3873 /** To what authority types do we publish our descriptor? Choices are
3874 * "v1", "v2", "v3", "bridge", or "". */
3875 smartlist_t
*PublishServerDescriptor
;
3876 /** A bitfield of authority types, derived from PublishServerDescriptor. */
3877 dirinfo_type_t PublishServerDescriptor_
;
3878 /** Boolean: do we publish hidden service descriptors to the HS auths? */
3879 int PublishHidServDescriptors
;
3880 int FetchServerDescriptors
; /**< Do we fetch server descriptors as normal? */
3881 int FetchHidServDescriptors
; /**< and hidden service descriptors? */
3883 int MinUptimeHidServDirectoryV2
; /**< As directory authority, accept hidden
3884 * service directories after what time? */
3886 int FetchUselessDescriptors
; /**< Do we fetch non-running descriptors too? */
3887 int AllDirActionsPrivate
; /**< Should every directory action be sent
3888 * through a Tor circuit? */
3890 /** Run in 'tor2web mode'? (I.e. only make client connections to hidden
3891 * services, and use a single hop for all hidden-service-related
3895 /** A routerset that should be used when picking RPs for HS circuits. */
3896 routerset_t
*Tor2webRendezvousPoints
;
3898 /** A routerset that should be used when picking middle nodes for HS
3900 routerset_t
*HSLayer2Nodes
;
3902 /** A routerset that should be used when picking third-hop nodes for HS
3904 routerset_t
*HSLayer3Nodes
;
3906 /** Onion Services in HiddenServiceSingleHopMode make one-hop (direct)
3907 * circuits between the onion service server, and the introduction and
3908 * rendezvous points. (Onion service descriptors are still posted using
3909 * 3-hop paths, to avoid onion service directories blocking the service.)
3910 * This option makes every hidden service instance hosted by
3911 * this tor instance a Single Onion Service.
3912 * HiddenServiceSingleHopMode requires HiddenServiceNonAnonymousMode to be
3914 * Use rend_service_allow_non_anonymous_connection() or
3915 * rend_service_reveal_startup_time() instead of using this option directly.
3917 int HiddenServiceSingleHopMode
;
3918 /* Makes hidden service clients and servers non-anonymous on this tor
3919 * instance. Allows the non-anonymous HiddenServiceSingleHopMode. Enables
3920 * non-anonymous behaviour in the hidden service protocol.
3921 * Use rend_service_non_anonymous_mode_enabled() instead of using this option
3924 int HiddenServiceNonAnonymousMode
;
3926 int ConnLimit
; /**< Demanded minimum number of simultaneous connections. */
3927 int ConnLimit_
; /**< Maximum allowed number of simultaneous connections. */
3928 int ConnLimit_high_thresh
; /**< start trying to lower socket usage if we
3929 * have this many. */
3930 int ConnLimit_low_thresh
; /**< try to get down to here after socket
3932 int RunAsDaemon
; /**< If true, run in the background. (Unix only) */
3933 int FascistFirewall
; /**< Whether to prefer ORs reachable on open ports. */
3934 smartlist_t
*FirewallPorts
; /**< Which ports our firewall allows
3936 config_line_t
*ReachableAddresses
; /**< IP:ports our firewall allows. */
3937 config_line_t
*ReachableORAddresses
; /**< IP:ports for OR conns. */
3938 config_line_t
*ReachableDirAddresses
; /**< IP:ports for Dir conns. */
3940 int ConstrainedSockets
; /**< Shrink xmit and recv socket buffers. */
3941 uint64_t ConstrainedSockSize
; /**< Size of constrained buffers. */
3943 /** Whether we should drop exit streams from Tors that we don't know are
3944 * relays. One of "0" (never refuse), "1" (always refuse), or "-1" (do
3945 * what the consensus says, defaulting to 'refuse' if the consensus says
3947 int RefuseUnknownExits
;
3949 /** Application ports that require all nodes in circ to have sufficient
3951 smartlist_t
*LongLivedPorts
;
3952 /** Application ports that are likely to be unencrypted and
3953 * unauthenticated; we reject requests for them to prevent the
3954 * user from screwing up and leaking plaintext secrets to an
3955 * observer somewhere on the Internet. */
3956 smartlist_t
*RejectPlaintextPorts
;
3957 /** Related to RejectPlaintextPorts above, except this config option
3958 * controls whether we warn (in the log and via a controller status
3959 * event) every time a risky connection is attempted. */
3960 smartlist_t
*WarnPlaintextPorts
;
3961 /** Should we try to reuse the same exit node for a given host */
3962 smartlist_t
*TrackHostExits
;
3963 int TrackHostExitsExpire
; /**< Number of seconds until we expire an
3965 config_line_t
*AddressMap
; /**< List of address map directives. */
3966 int AutomapHostsOnResolve
; /**< If true, when we get a resolve request for a
3967 * hostname ending with one of the suffixes in
3968 * <b>AutomapHostsSuffixes</b>, map it to a
3969 * virtual address. */
3970 /** List of suffixes for <b>AutomapHostsOnResolve</b>. The special value
3971 * "." means "match everything." */
3972 smartlist_t
*AutomapHostsSuffixes
;
3973 int RendPostPeriod
; /**< How often do we post each rendezvous service
3974 * descriptor? Remember to publish them independently. */
3975 int KeepalivePeriod
; /**< How often do we send padding cells to keep
3976 * connections alive? */
3977 int SocksTimeout
; /**< How long do we let a socks connection wait
3978 * unattached before we fail it? */
3979 int LearnCircuitBuildTimeout
; /**< If non-zero, we attempt to learn a value
3980 * for CircuitBuildTimeout based on timeout
3981 * history. Use circuit_build_times_disabled()
3982 * rather than checking this value directly. */
3983 int CircuitBuildTimeout
; /**< Cull non-open circuits that were born at
3984 * least this many seconds ago. Used until
3985 * adaptive algorithm learns a new value. */
3986 int CircuitsAvailableTimeout
; /**< Try to have an open circuit for at
3987 least this long after last activity */
3988 int CircuitStreamTimeout
; /**< If non-zero, detach streams from circuits
3989 * and try a new circuit if the stream has been
3990 * waiting for this many seconds. If zero, use
3991 * our default internal timeout schedule. */
3992 int MaxOnionQueueDelay
; /*< DOCDOC */
3993 int NewCircuitPeriod
; /**< How long do we use a circuit before building
3995 int MaxCircuitDirtiness
; /**< Never use circs that were first used more than
3996 this interval ago. */
3997 uint64_t BandwidthRate
; /**< How much bandwidth, on average, are we willing
3998 * to use in a second? */
3999 uint64_t BandwidthBurst
; /**< How much bandwidth, at maximum, are we willing
4000 * to use in a second? */
4001 uint64_t MaxAdvertisedBandwidth
; /**< How much bandwidth are we willing to
4002 * tell other nodes we have? */
4003 uint64_t RelayBandwidthRate
; /**< How much bandwidth, on average, are we
4004 * willing to use for all relayed conns? */
4005 uint64_t RelayBandwidthBurst
; /**< How much bandwidth, at maximum, will we
4006 * use in a second for all relayed conns? */
4007 uint64_t PerConnBWRate
; /**< Long-term bw on a single TLS conn, if set. */
4008 uint64_t PerConnBWBurst
; /**< Allowed burst on a single TLS conn, if set. */
4009 int NumCPUs
; /**< How many CPUs should we try to use? */
4010 config_line_t
*RendConfigLines
; /**< List of configuration lines
4011 * for rendezvous services. */
4012 config_line_t
*HidServAuth
; /**< List of configuration lines for client-side
4013 * authorizations for hidden services */
4014 char *ContactInfo
; /**< Contact info to be published in the directory. */
4016 int HeartbeatPeriod
; /**< Log heartbeat messages after this many seconds
4018 int MainloopStats
; /**< Log main loop statistics as part of the
4019 * heartbeat messages. */
4021 char *HTTPProxy
; /**< hostname[:port] to use as http proxy, if any. */
4022 tor_addr_t HTTPProxyAddr
; /**< Parsed IPv4 addr for http proxy, if any. */
4023 uint16_t HTTPProxyPort
; /**< Parsed port for http proxy, if any. */
4024 char *HTTPProxyAuthenticator
; /**< username:password string, if any. */
4026 char *HTTPSProxy
; /**< hostname[:port] to use as https proxy, if any. */
4027 tor_addr_t HTTPSProxyAddr
; /**< Parsed addr for https proxy, if any. */
4028 uint16_t HTTPSProxyPort
; /**< Parsed port for https proxy, if any. */
4029 char *HTTPSProxyAuthenticator
; /**< username:password string, if any. */
4031 char *Socks4Proxy
; /**< hostname:port to use as a SOCKS4 proxy, if any. */
4032 tor_addr_t Socks4ProxyAddr
; /**< Derived from Socks4Proxy. */
4033 uint16_t Socks4ProxyPort
; /**< Derived from Socks4Proxy. */
4035 char *Socks5Proxy
; /**< hostname:port to use as a SOCKS5 proxy, if any. */
4036 tor_addr_t Socks5ProxyAddr
; /**< Derived from Sock5Proxy. */
4037 uint16_t Socks5ProxyPort
; /**< Derived from Socks5Proxy. */
4038 char *Socks5ProxyUsername
; /**< Username for SOCKS5 authentication, if any */
4039 char *Socks5ProxyPassword
; /**< Password for SOCKS5 authentication, if any */
4041 /** List of configuration lines for replacement directory authorities.
4042 * If you just want to replace one class of authority at a time,
4043 * use the "Alternate*Authority" options below instead. */
4044 config_line_t
*DirAuthorities
;
4046 /** List of fallback directory servers */
4047 config_line_t
*FallbackDir
;
4048 /** Whether to use the default hard-coded FallbackDirs */
4049 int UseDefaultFallbackDirs
;
4051 /** Weight to apply to all directory authority rates if considering them
4052 * along with fallbackdirs */
4053 double DirAuthorityFallbackRate
;
4055 /** If set, use these main (currently v3) directory authorities and
4056 * not the default ones. */
4057 config_line_t
*AlternateDirAuthority
;
4059 /** If set, use these bridge authorities and not the default one. */
4060 config_line_t
*AlternateBridgeAuthority
;
4062 config_line_t
*MyFamily_lines
; /**< Declared family for this OR. */
4063 config_line_t
*MyFamily
; /**< Declared family for this OR, normalized */
4064 config_line_t
*NodeFamilies
; /**< List of config lines for
4066 smartlist_t
*NodeFamilySets
; /**< List of parsed NodeFamilies values. */
4067 config_line_t
*AuthDirBadExit
; /**< Address policy for descriptors to
4068 * mark as bad exits. */
4069 config_line_t
*AuthDirReject
; /**< Address policy for descriptors to
4071 config_line_t
*AuthDirInvalid
; /**< Address policy for descriptors to
4072 * never mark as valid. */
4073 /** @name AuthDir...CC
4075 * Lists of country codes to mark as BadExit, or Invalid, or to
4080 smartlist_t
*AuthDirBadExitCCs
;
4081 smartlist_t
*AuthDirInvalidCCs
;
4082 smartlist_t
*AuthDirRejectCCs
;
4085 int AuthDirListBadExits
; /**< True iff we should list bad exits,
4086 * and vote for all other exits as good. */
4087 int AuthDirMaxServersPerAddr
; /**< Do not permit more than this
4088 * number of servers per IP address. */
4089 int AuthDirHasIPv6Connectivity
; /**< Boolean: are we on IPv6? */
4090 int AuthDirPinKeys
; /**< Boolean: Do we enforce key-pinning? */
4092 /** If non-zero, always vote the Fast flag for any relay advertising
4093 * this amount of capacity or more. */
4094 uint64_t AuthDirFastGuarantee
;
4096 /** If non-zero, this advertised capacity or more is always sufficient
4097 * to satisfy the bandwidth requirement for the Guard flag. */
4098 uint64_t AuthDirGuardBWGuarantee
;
4100 char *AccountingStart
; /**< How long is the accounting interval, and when
4102 uint64_t AccountingMax
; /**< How many bytes do we allow per accounting
4103 * interval before hibernation? 0 for "never
4105 /** How do we determine when our AccountingMax has been reached?
4106 * "max" for when in or out reaches AccountingMax
4107 * "sum" for when in plus out reaches AccountingMax
4108 * "in" for when in reaches AccountingMax
4109 * "out" for when out reaches AccountingMax */
4110 char *AccountingRule_option
;
4111 enum { ACCT_MAX
, ACCT_SUM
, ACCT_IN
, ACCT_OUT
} AccountingRule
;
4113 /** Base64-encoded hash of accepted passwords for the control system. */
4114 config_line_t
*HashedControlPassword
;
4115 /** As HashedControlPassword, but not saved. */
4116 config_line_t
*HashedControlSessionPassword
;
4118 int CookieAuthentication
; /**< Boolean: do we enable cookie-based auth for
4119 * the control system? */
4120 char *CookieAuthFile
; /**< Filesystem location of a ControlPort
4121 * authentication cookie. */
4122 char *ExtORPortCookieAuthFile
; /**< Filesystem location of Extended
4123 * ORPort authentication cookie. */
4124 int CookieAuthFileGroupReadable
; /**< Boolean: Is the CookieAuthFile g+r? */
4125 int ExtORPortCookieAuthFileGroupReadable
; /**< Boolean: Is the
4126 * ExtORPortCookieAuthFile g+r? */
4127 int LeaveStreamsUnattached
; /**< Boolean: Does Tor attach new streams to
4128 * circuits itself (0), or does it expect a controller
4130 int DisablePredictedCircuits
; /**< Boolean: does Tor preemptively
4131 * make circuits in the background (0),
4134 /** Process specifier for a controller that ‘owns’ this Tor
4135 * instance. Tor will terminate if its owning controller does. */
4136 char *OwningControllerProcess
;
4137 /** FD specifier for a controller that owns this Tor instance. */
4138 int OwningControllerFD
;
4140 int ShutdownWaitLength
; /**< When we get a SIGINT and we're a server, how
4141 * long do we wait before exiting? */
4142 char *SafeLogging
; /**< Contains "relay", "1", "0" (meaning no scrubbing). */
4144 /* Derived from SafeLogging */
4146 SAFELOG_SCRUB_ALL
, SAFELOG_SCRUB_RELAY
, SAFELOG_SCRUB_NONE
4149 int Sandbox
; /**< Boolean: should sandboxing be enabled? */
4150 int SafeSocks
; /**< Boolean: should we outright refuse application
4151 * connections that use socks4 or socks5-with-local-dns? */
4152 int ProtocolWarnings
; /**< Boolean: when other parties screw up the Tor
4153 * protocol, is it a warn or an info in our logs? */
4154 int TestSocks
; /**< Boolean: when we get a socks connection, do we loudly
4155 * log whether it was DNS-leaking or not? */
4156 int HardwareAccel
; /**< Boolean: Should we enable OpenSSL hardware
4157 * acceleration where available? */
4158 /** Token Bucket Refill resolution in milliseconds. */
4159 int TokenBucketRefillInterval
;
4160 char *AccelName
; /**< Optional hardware acceleration engine name. */
4161 char *AccelDir
; /**< Optional hardware acceleration engine search dir. */
4163 /** Boolean: Do we try to enter from a smallish number
4164 * of fixed nodes? */
4165 int UseEntryGuards_option
;
4166 /** Internal variable to remember whether we're actually acting on
4167 * UseEntryGuards_option -- when we're a non-anonymous Tor2web client or
4168 * Single Onion Service, it is alwasy false, otherwise we use the value of
4169 * UseEntryGuards_option. */
4172 int NumEntryGuards
; /**< How many entry guards do we try to establish? */
4174 /** If 1, we use any guardfraction information we see in the
4175 * consensus. If 0, we don't. If -1, let the consensus parameter
4177 int UseGuardFraction
;
4179 int NumDirectoryGuards
; /**< How many dir guards do we try to establish?
4180 * If 0, use value from NumEntryGuards. */
4181 int RephistTrackTime
; /**< How many seconds do we keep rephist info? */
4182 /** Should we always fetch our dir info on the mirror schedule (which
4183 * means directly from the authorities) no matter our other config? */
4184 int FetchDirInfoEarly
;
4186 /** Should we fetch our dir info at the start of the consensus period? */
4187 int FetchDirInfoExtraEarly
;
4189 int DirCache
; /**< Cache all directory documents and accept requests via
4190 * tunnelled dir conns from clients. If 1, enabled (default);
4191 * If 0, disabled. */
4193 char *VirtualAddrNetworkIPv4
; /**< Address and mask to hand out for virtual
4194 * MAPADDRESS requests for IPv4 addresses */
4195 char *VirtualAddrNetworkIPv6
; /**< Address and mask to hand out for virtual
4196 * MAPADDRESS requests for IPv6 addresses */
4197 int ServerDNSSearchDomains
; /**< Boolean: If set, we don't force exit
4198 * addresses to be FQDNs, but rather search for them in
4199 * the local domains. */
4200 int ServerDNSDetectHijacking
; /**< Boolean: If true, check for DNS failure
4202 int ServerDNSRandomizeCase
; /**< Boolean: Use the 0x20-hack to prevent
4203 * DNS poisoning attacks. */
4204 char *ServerDNSResolvConfFile
; /**< If provided, we configure our internal
4205 * resolver from the file here rather than from
4206 * /etc/resolv.conf (Unix) or the registry (Windows). */
4207 char *DirPortFrontPage
; /**< This is a full path to a file with an html
4208 disclaimer. This allows a server administrator to show
4209 that they're running Tor and anyone visiting their server
4210 will know this without any specialized knowledge. */
4211 int DisableDebuggerAttachment
; /**< Currently Linux only specific attempt to
4212 disable ptrace; needs BSD testing. */
4213 /** Boolean: if set, we start even if our resolv.conf file is missing
4215 int ServerDNSAllowBrokenConfig
;
4216 /** Boolean: if set, then even connections to private addresses will get
4218 int CountPrivateBandwidth
;
4219 smartlist_t
*ServerDNSTestAddresses
; /**< A list of addresses that definitely
4220 * should be resolvable. Used for
4221 * testing our DNS server. */
4222 int EnforceDistinctSubnets
; /**< If true, don't allow multiple routers in the
4223 * same network zone in the same circuit. */
4224 int PortForwarding
; /**< If true, use NAT-PMP or UPnP to automatically
4225 * forward the DirPort and ORPort on the NAT device */
4226 char *PortForwardingHelper
; /** < Filename or full path of the port
4227 forwarding helper executable */
4228 int AllowNonRFC953Hostnames
; /**< If true, we allow connections to hostnames
4229 * with weird characters. */
4230 /** If true, we try resolving hostnames with weird characters. */
4231 int ServerDNSAllowNonRFC953Hostnames
;
4233 /** If true, we try to download extra-info documents (and we serve them,
4234 * if we are a cache). For authorities, this is always true. */
4235 int DownloadExtraInfo
;
4237 /** If true, we're configured to collect statistics on clients
4238 * requesting network statuses from us as directory. */
4239 int DirReqStatistics_option
;
4240 /** Internal variable to remember whether we're actually acting on
4241 * DirReqStatistics_option -- yes if it's set and we're a server, else no. */
4242 int DirReqStatistics
;
4244 /** If true, the user wants us to collect statistics on port usage. */
4245 int ExitPortStatistics
;
4247 /** If true, the user wants us to collect connection statistics. */
4248 int ConnDirectionStatistics
;
4250 /** If true, the user wants us to collect cell statistics. */
4253 /** If true, the user wants us to collect padding statistics. */
4254 int PaddingStatistics
;
4256 /** If true, the user wants us to collect statistics as entry node. */
4257 int EntryStatistics
;
4259 /** If true, the user wants us to collect statistics as hidden service
4260 * directory, introduction point, or rendezvous point. */
4261 int HiddenServiceStatistics_option
;
4262 /** Internal variable to remember whether we're actually acting on
4263 * HiddenServiceStatistics_option -- yes if it's set and we're a server,
4265 int HiddenServiceStatistics
;
4267 /** If true, include statistics file contents in extra-info documents. */
4268 int ExtraInfoStatistics
;
4270 /** If true, do not believe anybody who tells us that a domain resolves
4271 * to an internal address, or that an internal address has a PTR mapping.
4272 * Helps avoid some cross-site attacks. */
4273 int ClientDNSRejectInternalAddresses
;
4275 /** If true, do not accept any requests to connect to internal addresses
4276 * over randomly chosen exits. */
4277 int ClientRejectInternalAddresses
;
4279 /** If true, clients may connect over IPv4. If false, they will avoid
4280 * connecting over IPv4. We enforce this for OR and Dir connections. */
4282 /** If true, clients may connect over IPv6. If false, they will avoid
4283 * connecting over IPv4. We enforce this for OR and Dir connections.
4284 * Use fascist_firewall_use_ipv6() instead of accessing this value
4287 /** If true, prefer an IPv6 OR port over an IPv4 one for entry node
4288 * connections. If auto, bridge clients prefer IPv6, and other clients
4289 * prefer IPv4. Use node_ipv6_or_preferred() instead of accessing this value
4291 int ClientPreferIPv6ORPort
;
4292 /** If true, prefer an IPv6 directory port over an IPv4 one for direct
4293 * directory connections. If auto, bridge clients prefer IPv6, and other
4294 * clients prefer IPv4. Use fascist_firewall_prefer_ipv6_dirport() instead of
4295 * accessing this value directly. */
4296 int ClientPreferIPv6DirPort
;
4298 /** The length of time that we think a consensus should be fresh. */
4299 int V3AuthVotingInterval
;
4300 /** The length of time we think it will take to distribute votes. */
4301 int V3AuthVoteDelay
;
4302 /** The length of time we think it will take to distribute signatures. */
4303 int V3AuthDistDelay
;
4304 /** The number of intervals we think a consensus should be valid. */
4305 int V3AuthNIntervalsValid
;
4307 /** Should advertise and sign consensuses with a legacy key, for key
4308 * migration purposes? */
4309 int V3AuthUseLegacyKey
;
4311 /** Location of bandwidth measurement file */
4312 char *V3BandwidthsFile
;
4314 /** Location of guardfraction file */
4315 char *GuardfractionFile
;
4317 /** Authority only: key=value pairs that we add to our networkstatus
4318 * consensus vote on the 'params' line. */
4319 char *ConsensusParams
;
4321 /** Authority only: minimum number of measured bandwidths we must see
4322 * before we only believe measured bandwidths to assign flags. */
4323 int MinMeasuredBWsForAuthToIgnoreAdvertised
;
4325 /** The length of time that we think an initial consensus should be fresh.
4326 * Only altered on testing networks. */
4327 int TestingV3AuthInitialVotingInterval
;
4329 /** The length of time we think it will take to distribute initial votes.
4330 * Only altered on testing networks. */
4331 int TestingV3AuthInitialVoteDelay
;
4333 /** The length of time we think it will take to distribute initial
4334 * signatures. Only altered on testing networks.*/
4335 int TestingV3AuthInitialDistDelay
;
4337 /** Offset in seconds added to the starting time for consensus
4338 voting. Only altered on testing networks. */
4339 int TestingV3AuthVotingStartOffset
;
4341 /** If an authority has been around for less than this amount of time, it
4342 * does not believe its reachability information is accurate. Only
4343 * altered on testing networks. */
4344 int TestingAuthDirTimeToLearnReachability
;
4346 /** Clients don't download any descriptor this recent, since it will
4347 * probably not have propagated to enough caches. Only altered on testing
4349 int TestingEstimatedDescriptorPropagationTime
;
4351 /** Schedule for when servers should download things in general. Only
4352 * altered on testing networks. */
4353 smartlist_t
*TestingServerDownloadSchedule
;
4355 /** Schedule for when clients should download things in general. Only
4356 * altered on testing networks. */
4357 smartlist_t
*TestingClientDownloadSchedule
;
4359 /** Schedule for when servers should download consensuses. Only altered
4360 * on testing networks. */
4361 smartlist_t
*TestingServerConsensusDownloadSchedule
;
4363 /** Schedule for when clients should download consensuses. Only altered
4364 * on testing networks. */
4365 smartlist_t
*TestingClientConsensusDownloadSchedule
;
4367 /** Schedule for when clients should download consensuses from authorities
4368 * if they are bootstrapping (that is, they don't have a usable, reasonably
4369 * live consensus). Only used by clients fetching from a list of fallback
4370 * directory mirrors.
4372 * This schedule is incremented by (potentially concurrent) connection
4373 * attempts, unlike other schedules, which are incremented by connection
4374 * failures. Only altered on testing networks. */
4375 smartlist_t
*ClientBootstrapConsensusAuthorityDownloadSchedule
;
4377 /** Schedule for when clients should download consensuses from fallback
4378 * directory mirrors if they are bootstrapping (that is, they don't have a
4379 * usable, reasonably live consensus). Only used by clients fetching from a
4380 * list of fallback directory mirrors.
4382 * This schedule is incremented by (potentially concurrent) connection
4383 * attempts, unlike other schedules, which are incremented by connection
4384 * failures. Only altered on testing networks. */
4385 smartlist_t
*ClientBootstrapConsensusFallbackDownloadSchedule
;
4387 /** Schedule for when clients should download consensuses from authorities
4388 * if they are bootstrapping (that is, they don't have a usable, reasonably
4389 * live consensus). Only used by clients which don't have or won't fetch
4390 * from a list of fallback directory mirrors.
4392 * This schedule is incremented by (potentially concurrent) connection
4393 * attempts, unlike other schedules, which are incremented by connection
4394 * failures. Only altered on testing networks. */
4395 smartlist_t
*ClientBootstrapConsensusAuthorityOnlyDownloadSchedule
;
4397 /** Schedule for when clients should download bridge descriptors. Only
4398 * altered on testing networks. */
4399 smartlist_t
*TestingBridgeDownloadSchedule
;
4401 /** Schedule for when clients should download bridge descriptors when they
4402 * have no running bridges. Only altered on testing networks. */
4403 smartlist_t
*TestingBridgeBootstrapDownloadSchedule
;
4405 /** When directory clients have only a few descriptors to request, they
4406 * batch them until they have more, or until this amount of time has
4407 * passed. Only altered on testing networks. */
4408 int TestingClientMaxIntervalWithoutRequest
;
4410 /** How long do we let a directory connection stall before expiring
4411 * it? Only altered on testing networks. */
4412 int TestingDirConnectionMaxStall
;
4414 /** How many times will we try to fetch a consensus before we give
4415 * up? Only altered on testing networks. */
4416 int TestingConsensusMaxDownloadTries
;
4418 /** How many times will a client try to fetch a consensus while
4419 * bootstrapping using a list of fallback directories, before it gives up?
4420 * Only altered on testing networks. */
4421 int ClientBootstrapConsensusMaxDownloadTries
;
4423 /** How many times will a client try to fetch a consensus while
4424 * bootstrapping using only a list of authorities, before it gives up?
4425 * Only altered on testing networks. */
4426 int ClientBootstrapConsensusAuthorityOnlyMaxDownloadTries
;
4428 /** How many simultaneous in-progress connections will we make when trying
4429 * to fetch a consensus before we wait for one to complete, timeout, or
4430 * error out? Only altered on testing networks. */
4431 int ClientBootstrapConsensusMaxInProgressTries
;
4433 /** How many times will we try to download a router's descriptor before
4434 * giving up? Only altered on testing networks. */
4435 int TestingDescriptorMaxDownloadTries
;
4437 /** How many times will we try to download a microdescriptor before
4438 * giving up? Only altered on testing networks. */
4439 int TestingMicrodescMaxDownloadTries
;
4441 /** How many times will we try to fetch a certificate before giving
4442 * up? Only altered on testing networks. */
4443 int TestingCertMaxDownloadTries
;
4445 /** If true, we take part in a testing network. Change the defaults of a
4446 * couple of other configuration options and allow to change the values
4447 * of certain configuration options. */
4448 int TestingTorNetwork
;
4450 /** Minimum value for the Exit flag threshold on testing networks. */
4451 uint64_t TestingMinExitFlagThreshold
;
4453 /** Minimum value for the Fast flag threshold on testing networks. */
4454 uint64_t TestingMinFastFlagThreshold
;
4456 /** Relays in a testing network which should be voted Exit
4457 * regardless of exit policy. */
4458 routerset_t
*TestingDirAuthVoteExit
;
4459 int TestingDirAuthVoteExitIsStrict
;
4461 /** Relays in a testing network which should be voted Guard
4462 * regardless of uptime and bandwidth. */
4463 routerset_t
*TestingDirAuthVoteGuard
;
4464 int TestingDirAuthVoteGuardIsStrict
;
4466 /** Relays in a testing network which should be voted HSDir
4467 * regardless of uptime and DirPort. */
4468 routerset_t
*TestingDirAuthVoteHSDir
;
4469 int TestingDirAuthVoteHSDirIsStrict
;
4471 /** Enable CONN_BW events. Only altered on testing networks. */
4472 int TestingEnableConnBwEvent
;
4474 /** Enable CELL_STATS events. Only altered on testing networks. */
4475 int TestingEnableCellStatsEvent
;
4477 /** Enable TB_EMPTY events. Only altered on testing networks. */
4478 int TestingEnableTbEmptyEvent
;
4480 /** If true, and we have GeoIP data, and we're a bridge, keep a per-country
4481 * count of how many client addresses have contacted us so that we can help
4482 * the bridge authority guess which countries have blocked access to us. */
4483 int BridgeRecordUsageByCountry
;
4485 /** Optionally, IPv4 and IPv6 GeoIP data. */
4489 /** Autobool: if auto, then any attempt to Exclude{Exit,}Nodes a particular
4490 * country code will exclude all nodes in ?? and A1. If true, all nodes in
4491 * ?? and A1 are excluded. Has no effect if we don't know any GeoIP data. */
4492 int GeoIPExcludeUnknown
;
4494 /** If true, SIGHUP should reload the torrc. Sometimes controllers want
4495 * to make this false. */
4496 int ReloadTorrcOnSIGHUP
;
4498 /* The main parameter for picking circuits within a connection.
4500 * If this value is positive, when picking a cell to relay on a connection,
4501 * we always relay from the circuit whose weighted cell count is lowest.
4502 * Cells are weighted exponentially such that if one cell is sent
4503 * 'CircuitPriorityHalflife' seconds before another, it counts for half as
4506 * If this value is zero, we're disabling the cell-EWMA algorithm.
4508 * If this value is negative, we're using the default approach
4509 * according to either Tor or a parameter set in the consensus.
4511 double CircuitPriorityHalflife
;
4513 /** Set to true if the TestingTorNetwork configuration option is set.
4514 * This is used so that options_validate() has a chance to realize that
4515 * the defaults have changed. */
4516 int UsingTestNetworkDefaults_
;
4518 /** If 1, we try to use microdescriptors to build circuits. If 0, we don't.
4519 * If -1, Tor decides. */
4520 int UseMicrodescriptors
;
4522 /** File where we should write the ControlPort. */
4523 char *ControlPortWriteToFile
;
4524 /** Should that file be group-readable? */
4525 int ControlPortFileGroupReadable
;
4527 #define MAX_MAX_CLIENT_CIRCUITS_PENDING 1024
4528 /** Maximum number of non-open general-purpose origin circuits to allow at
4530 int MaxClientCircuitsPending
;
4532 /** If 1, we always send optimistic data when it's supported. If 0, we
4533 * never use it. If -1, we do what the consensus says. */
4536 /** If 1, we accept and launch no external network connections, except on
4541 * Parameters for path-bias detection.
4543 * These options override the default behavior of Tor's (**currently
4544 * experimental**) path bias detection algorithm. To try to find broken or
4545 * misbehaving guard nodes, Tor looks for nodes where more than a certain
4546 * fraction of circuits through that guard fail to get built.
4548 * The PathBiasCircThreshold option controls how many circuits we need to
4549 * build through a guard before we make these checks. The
4550 * PathBiasNoticeRate, PathBiasWarnRate and PathBiasExtremeRate options
4551 * control what fraction of circuits must succeed through a guard so we
4552 * won't write log messages. If less than PathBiasExtremeRate circuits
4553 * succeed *and* PathBiasDropGuards is set to 1, we disable use of that
4556 * When we have seen more than PathBiasScaleThreshold circuits through a
4557 * guard, we scale our observations by 0.5 (governed by the consensus) so
4558 * that new observations don't get swamped by old ones.
4560 * By default, or if a negative value is provided for one of these options,
4561 * Tor uses reasonable defaults from the networkstatus consensus document.
4562 * If no defaults are available there, these options default to 150, .70,
4563 * .50, .30, 0, and 300 respectively.
4565 int PathBiasCircThreshold
;
4566 double PathBiasNoticeRate
;
4567 double PathBiasWarnRate
;
4568 double PathBiasExtremeRate
;
4569 int PathBiasDropGuards
;
4570 int PathBiasScaleThreshold
;
4574 * Parameters for path-bias use detection
4576 * Similar to the above options, these options override the default behavior
4577 * of Tor's (**currently experimental**) path use bias detection algorithm.
4579 * Where as the path bias parameters govern thresholds for successfully
4580 * building circuits, these four path use bias parameters govern thresholds
4581 * only for circuit usage. Circuits which receive no stream usage are not
4582 * counted by this detection algorithm. A used circuit is considered
4583 * successful if it is capable of carrying streams or otherwise receiving
4584 * well-formed responses to RELAY cells.
4586 * By default, or if a negative value is provided for one of these options,
4587 * Tor uses reasonable defaults from the networkstatus consensus document.
4588 * If no defaults are available there, these options default to 20, .80,
4589 * .60, and 100, respectively.
4591 int PathBiasUseThreshold
;
4592 double PathBiasNoticeUseRate
;
4593 double PathBiasExtremeUseRate
;
4594 int PathBiasScaleUseThreshold
;
4597 int IPv6Exit
; /**< Do we support exiting to IPv6 addresses? */
4600 double PathsNeededToBuildCircuits
;
4602 /** What expiry time shall we place on our SSL certs? "0" means we
4603 * should guess a suitable value. */
4606 /** How long (seconds) do we keep a guard before picking a new one? */
4609 /** Is this an exit node? This is a tristate, where "1" means "yes, and use
4610 * the default exit policy if none is given" and "0" means "no; exit policy
4611 * is 'reject *'" and "auto" (-1) means "same as 1, but warn the user."
4613 * XXXX Eventually, the default will be 0. */
4616 /** For how long (seconds) do we declare our signing keys to be valid? */
4617 int SigningKeyLifetime
;
4618 /** For how long (seconds) do we declare our link keys to be valid? */
4619 int TestingLinkCertLifetime
;
4620 /** For how long (seconds) do we declare our auth keys to be valid? */
4621 int TestingAuthKeyLifetime
;
4623 /** How long before signing keys expire will we try to make a new one? */
4624 int TestingSigningKeySlop
;
4625 /** How long before link keys expire will we try to make a new one? */
4626 int TestingLinkKeySlop
;
4627 /** How long before auth keys expire will we try to make a new one? */
4628 int TestingAuthKeySlop
;
4630 /** Force use of offline master key features: never generate a master
4631 * ed25519 identity key except from tor --keygen */
4632 int OfflineMasterKey
;
4635 FORCE_PASSPHRASE_AUTO
=0,
4636 FORCE_PASSPHRASE_ON
,
4637 FORCE_PASSPHRASE_OFF
4638 } keygen_force_passphrase
;
4639 int use_keygen_passphrase_fd
;
4640 int keygen_passphrase_fd
;
4641 int change_key_passphrase
;
4642 char *master_key_fname
;
4644 /** Autobool: Do we try to retain capabilities if we can? */
4645 int KeepBindCapabilities
;
4647 /** Maximum total size of unparseable descriptors to log during the
4648 * lifetime of this Tor process.
4650 uint64_t MaxUnparseableDescSizeToLog
;
4652 /** Bool (default: 1): Switch for the shared random protocol. Only
4653 * relevant to a directory authority. If off, the authority won't
4654 * participate in the protocol. If on (default), a flag is added to the
4655 * vote indicating participation. */
4656 int AuthDirSharedRandomness
;
4658 /** If 1, we skip all OOS checks. */
4659 int DisableOOSCheck
;
4661 /** Autobool: Should we include Ed25519 identities in extend2 cells?
4662 * If -1, we should do whatever the consensus parameter says. */
4663 int ExtendByEd25519ID
;
4665 /** Bool (default: 1): When testing routerinfos as a directory authority,
4666 * do we enforce Ed25519 identity match? */
4667 /* NOTE: remove this option someday. */
4668 int AuthDirTestEd25519LinkKeys
;
4670 /** Bool (default: 0): Tells if a %include was used on torrc */
4673 /** The seconds after expiration which we as a relay should keep old
4674 * consensuses around so that we can generate diffs from them. If 0,
4675 * use the default. */
4676 int MaxConsensusAgeForDiffs
;
4678 /** Bool (default: 0). Tells Tor to never try to exec another program.
4682 /** Have the KIST scheduler run every X milliseconds. If less than zero, do
4683 * not use the KIST scheduler but use the old vanilla scheduler instead. If
4684 * zero, do what the consensus says and fall back to using KIST as if this is
4685 * set to "10 msec" if the consensus doesn't say anything. */
4686 int KISTSchedRunInterval
;
4688 /** A multiplier for the KIST per-socket limit calculation. */
4689 double KISTSockBufSizeFactor
;
4691 /** The list of scheduler type string ordered by priority that is first one
4692 * has to be tried first. Default: KIST,KISTLite,Vanilla */
4693 smartlist_t
*Schedulers
;
4694 /* An ordered list of scheduler_types mapped from Schedulers. */
4695 smartlist_t
*SchedulerTypes_
;
4697 /** List of files that were opened by %include in torrc and torrc-defaults */
4698 smartlist_t
*FilesOpenedByIncludes
;
4701 #define LOG_PROTOCOL_WARN (get_protocol_warning_severity_level())
4703 /** Persistent state for an onion router, as saved to disk. */
4706 /** The time at which we next plan to write the state to the disk. Equal to
4707 * TIME_MAX if there are no savable changes, 0 if there are changes that
4708 * should be saved right away. */
4711 /** When was the state last written to disk? */
4714 /** Fields for accounting bandwidth use. */
4715 time_t AccountingIntervalStart
;
4716 uint64_t AccountingBytesReadInInterval
;
4717 uint64_t AccountingBytesWrittenInInterval
;
4718 int AccountingSecondsActive
;
4719 int AccountingSecondsToReachSoftLimit
;
4720 time_t AccountingSoftLimitHitAt
;
4721 uint64_t AccountingBytesAtSoftLimit
;
4722 uint64_t AccountingExpectedUsage
;
4724 /** A list of Entry Guard-related configuration lines. (pre-prop271) */
4725 config_line_t
*EntryGuards
;
4727 /** A list of guard-related configuration lines. (post-prop271) */
4728 config_line_t
*Guard
;
4730 config_line_t
*TransportProxies
;
4732 /** Cached revision counters for active hidden services on this host */
4733 config_line_t
*HidServRevCounter
;
4735 /** These fields hold information on the history of bandwidth usage for
4736 * servers. The "Ends" fields hold the time when we last updated the
4737 * bandwidth usage. The "Interval" fields hold the granularity, in seconds,
4738 * of the entries of Values. The "Values" lists hold decimal string
4739 * representations of the number of bytes read or written in each
4740 * interval. The "Maxima" list holds decimal strings describing the highest
4741 * rate achieved during the interval.
4743 time_t BWHistoryReadEnds
;
4744 int BWHistoryReadInterval
;
4745 smartlist_t
*BWHistoryReadValues
;
4746 smartlist_t
*BWHistoryReadMaxima
;
4747 time_t BWHistoryWriteEnds
;
4748 int BWHistoryWriteInterval
;
4749 smartlist_t
*BWHistoryWriteValues
;
4750 smartlist_t
*BWHistoryWriteMaxima
;
4751 time_t BWHistoryDirReadEnds
;
4752 int BWHistoryDirReadInterval
;
4753 smartlist_t
*BWHistoryDirReadValues
;
4754 smartlist_t
*BWHistoryDirReadMaxima
;
4755 time_t BWHistoryDirWriteEnds
;
4756 int BWHistoryDirWriteInterval
;
4757 smartlist_t
*BWHistoryDirWriteValues
;
4758 smartlist_t
*BWHistoryDirWriteMaxima
;
4760 /** Build time histogram */
4761 config_line_t
* BuildtimeHistogram
;
4762 int TotalBuildTimes
;
4763 int CircuitBuildAbandonedCount
;
4765 /** What version of Tor wrote this state file? */
4768 /** Holds any unrecognized values we found in the state file, in the order
4769 * in which we found them. */
4770 config_line_t
*ExtraLines
;
4772 /** When did we last rotate our onion key? "0" for 'no idea'. */
4773 time_t LastRotatedOnionKey
;
4776 /** Change the next_write time of <b>state</b> to <b>when</b>, unless the
4777 * state is already scheduled to be written to disk earlier than <b>when</b>.
4779 static inline void or_state_mark_dirty(or_state_t
*state
, time_t when
)
4781 if (state
->next_write
> when
)
4782 state
->next_write
= when
;
4785 #define MAX_SOCKS_REPLY_LEN 1024
4786 #define MAX_SOCKS_ADDR_LEN 256
4787 #define SOCKS_NO_AUTH 0x00
4788 #define SOCKS_USER_PASS 0x02
4790 /** Please open a TCP connection to this addr:port. */
4791 #define SOCKS_COMMAND_CONNECT 0x01
4792 /** Please turn this FQDN into an IP address, privately. */
4793 #define SOCKS_COMMAND_RESOLVE 0xF0
4794 /** Please turn this IP address into an FQDN, privately. */
4795 #define SOCKS_COMMAND_RESOLVE_PTR 0xF1
4797 /* || 0 is for -Wparentheses-equality (-Wall?) appeasement under clang */
4798 #define SOCKS_COMMAND_IS_CONNECT(c) (((c)==SOCKS_COMMAND_CONNECT) || 0)
4799 #define SOCKS_COMMAND_IS_RESOLVE(c) ((c)==SOCKS_COMMAND_RESOLVE || \
4800 (c)==SOCKS_COMMAND_RESOLVE_PTR)
4802 /** State of a SOCKS request from a user to an OP. Also used to encode other
4803 * information for non-socks user request (such as those on TransPort and
4805 struct socks_request_t
{
4806 /** Which version of SOCKS did the client use? One of "0, 4, 5" -- where
4807 * 0 means that no socks handshake ever took place, and this is just a
4808 * stub connection (e.g. see connection_ap_make_link()). */
4809 uint8_t socks_version
;
4810 /** If using socks5 authentication, which authentication type did we
4811 * negotiate? currently we support 0 (no authentication) and 2
4812 * (username/password). */
4814 /** What is this stream's goal? One of the SOCKS_COMMAND_* values */
4816 /** Which kind of listener created this stream? */
4817 uint8_t listener_type
;
4818 size_t replylen
; /**< Length of <b>reply</b>. */
4819 uint8_t reply
[MAX_SOCKS_REPLY_LEN
]; /**< Write an entry into this string if
4820 * we want to specify our own socks reply,
4821 * rather than using the default socks4 or
4822 * socks5 socks reply. We use this for the
4823 * two-stage socks5 handshake.
4825 char address
[MAX_SOCKS_ADDR_LEN
]; /**< What address did the client ask to
4826 connect to/resolve? */
4827 uint16_t port
; /**< What port did the client ask to connect to? */
4828 unsigned int has_finished
: 1; /**< Has the SOCKS handshake finished? Used to
4829 * make sure we send back a socks reply for
4830 * every connection. */
4831 unsigned int got_auth
: 1; /**< Have we received any authentication data? */
4832 /** If this is set, we will choose "no authentication" instead of
4833 * "username/password" authentication if both are offered. Used as input to
4835 unsigned int socks_prefer_no_auth
: 1;
4837 /** Number of bytes in username; 0 if username is NULL */
4839 /** Number of bytes in password; 0 if password is NULL */
4840 uint8_t passwordlen
;
4841 /** The negotiated username value if any (for socks5), or the entire
4842 * authentication string (for socks4). This value is NOT nul-terminated;
4843 * see usernamelen for its length. */
4845 /** The negotiated password value if any (for socks5). This value is NOT
4846 * nul-terminated; see passwordlen for its length. */
4850 /********************************* circuitbuild.c **********************/
4852 /** How many hops does a general-purpose circuit have by default? */
4853 #define DEFAULT_ROUTE_LEN 3
4855 /* Circuit Build Timeout "public" structures. */
4857 /** Precision multiplier for the Bw weights */
4858 #define BW_WEIGHT_SCALE 10000
4859 #define BW_MIN_WEIGHT_SCALE 1
4860 #define BW_MAX_WEIGHT_SCALE INT32_MAX
4862 /** Total size of the circuit timeout history to accumulate.
4863 * 1000 is approx 2.5 days worth of continual-use circuits. */
4864 #define CBT_NCIRCUITS_TO_OBSERVE 1000
4866 /** Width of the histogram bins in milliseconds */
4867 #define CBT_BIN_WIDTH ((build_time_t)50)
4869 /** Number of modes to use in the weighted-avg computation of Xm */
4870 #define CBT_DEFAULT_NUM_XM_MODES 3
4871 #define CBT_MIN_NUM_XM_MODES 1
4872 #define CBT_MAX_NUM_XM_MODES 20
4874 /** A build_time_t is milliseconds */
4875 typedef uint32_t build_time_t
;
4878 * CBT_BUILD_ABANDONED is our flag value to represent a force-closed
4879 * circuit (Aka a 'right-censored' pareto value).
4881 #define CBT_BUILD_ABANDONED ((build_time_t)(INT32_MAX-1))
4882 #define CBT_BUILD_TIME_MAX ((build_time_t)(INT32_MAX))
4884 /** Save state every 10 circuits */
4885 #define CBT_SAVE_STATE_EVERY 10
4887 /* Circuit build times consensus parameters */
4890 * How long to wait before actually closing circuits that take too long to
4891 * build in terms of CDF quantile.
4893 #define CBT_DEFAULT_CLOSE_QUANTILE 95
4894 #define CBT_MIN_CLOSE_QUANTILE CBT_MIN_QUANTILE_CUTOFF
4895 #define CBT_MAX_CLOSE_QUANTILE CBT_MAX_QUANTILE_CUTOFF
4898 * How many circuits count as recent when considering if the
4899 * connection has gone gimpy or changed.
4901 #define CBT_DEFAULT_RECENT_CIRCUITS 20
4902 #define CBT_MIN_RECENT_CIRCUITS 3
4903 #define CBT_MAX_RECENT_CIRCUITS 1000
4906 * Maximum count of timeouts that finish the first hop in the past
4907 * RECENT_CIRCUITS before calculating a new timeout.
4909 * This tells us whether to abandon timeout history and set
4910 * the timeout back to whatever circuit_build_times_get_initial_timeout()
4913 #define CBT_DEFAULT_MAX_RECENT_TIMEOUT_COUNT (CBT_DEFAULT_RECENT_CIRCUITS*9/10)
4914 #define CBT_MIN_MAX_RECENT_TIMEOUT_COUNT 3
4915 #define CBT_MAX_MAX_RECENT_TIMEOUT_COUNT 10000
4917 /** Minimum circuits before estimating a timeout */
4918 #define CBT_DEFAULT_MIN_CIRCUITS_TO_OBSERVE 100
4919 #define CBT_MIN_MIN_CIRCUITS_TO_OBSERVE 1
4920 #define CBT_MAX_MIN_CIRCUITS_TO_OBSERVE 10000
4922 /** Cutoff percentile on the CDF for our timeout estimation. */
4923 #define CBT_DEFAULT_QUANTILE_CUTOFF 80
4924 #define CBT_MIN_QUANTILE_CUTOFF 10
4925 #define CBT_MAX_QUANTILE_CUTOFF 99
4926 double circuit_build_times_quantile_cutoff(void);
4928 /** How often in seconds should we build a test circuit */
4929 #define CBT_DEFAULT_TEST_FREQUENCY 10
4930 #define CBT_MIN_TEST_FREQUENCY 1
4931 #define CBT_MAX_TEST_FREQUENCY INT32_MAX
4933 /** Lowest allowable value for CircuitBuildTimeout in milliseconds */
4934 #define CBT_DEFAULT_TIMEOUT_MIN_VALUE (1500)
4935 #define CBT_MIN_TIMEOUT_MIN_VALUE 500
4936 #define CBT_MAX_TIMEOUT_MIN_VALUE INT32_MAX
4938 /** Initial circuit build timeout in milliseconds */
4939 #define CBT_DEFAULT_TIMEOUT_INITIAL_VALUE (60*1000)
4940 #define CBT_MIN_TIMEOUT_INITIAL_VALUE CBT_MIN_TIMEOUT_MIN_VALUE
4941 #define CBT_MAX_TIMEOUT_INITIAL_VALUE INT32_MAX
4942 int32_t circuit_build_times_initial_timeout(void);
4944 #if CBT_DEFAULT_MAX_RECENT_TIMEOUT_COUNT < CBT_MIN_MAX_RECENT_TIMEOUT_COUNT
4945 #error "RECENT_CIRCUITS is set too low."
4948 /** Information about the state of our local network connection */
4950 /** The timestamp we last completed a TLS handshake or received a cell */
4951 time_t network_last_live
;
4952 /** If the network is not live, how many timeouts has this caused? */
4953 int nonlive_timeouts
;
4954 /** Circular array of circuits that have made it to the first hop. Slot is
4955 * 1 if circuit timed out, 0 if circuit succeeded */
4956 int8_t *timeouts_after_firsthop
;
4957 /** Number of elements allocated for the above array */
4958 int num_recent_circs
;
4959 /** Index into circular array. */
4960 int after_firsthop_idx
;
4961 } network_liveness_t
;
4963 typedef struct circuit_build_times_s circuit_build_times_t
;
4965 /********************************* config.c ***************************/
4967 /** An error from options_trial_assign() or options_init_from_string(). */
4968 typedef enum setopt_err_t
{
4970 SETOPT_ERR_MISC
= -1,
4971 SETOPT_ERR_PARSE
= -2,
4972 SETOPT_ERR_TRANSITION
= -3,
4973 SETOPT_ERR_SETTING
= -4,
4976 /********************************* connection_edge.c *************************/
4978 /** Enumerates possible origins of a client-side address mapping. */
4980 /** We're remapping this address because the controller told us to. */
4981 ADDRMAPSRC_CONTROLLER
,
4982 /** We're remapping this address because of an AutomapHostsOnResolve
4985 /** We're remapping this address because our configuration (via torrc, the
4986 * command line, or a SETCONF command) told us to. */
4988 /** We're remapping this address because we have TrackHostExit configured,
4989 * and we want to remember to use the same exit next time. */
4990 ADDRMAPSRC_TRACKEXIT
,
4991 /** We're remapping this address because we got a DNS resolution from a
4992 * Tor server that told us what its value was. */
4995 /** No remapping has occurred. This isn't a possible value for an
4996 * addrmap_entry_t; it's used as a null value when we need to answer "Why
4997 * did this remapping happen." */
4999 } addressmap_entry_source_t
;
5000 #define addressmap_entry_source_bitfield_t ENUM_BF(addressmap_entry_source_t)
5002 /********************************* control.c ***************************/
5004 /** Used to indicate the type of a circuit event passed to the controller.
5005 * The various types are defined in control-spec.txt */
5006 typedef enum circuit_status_event_t
{
5007 CIRC_EVENT_LAUNCHED
= 0,
5008 CIRC_EVENT_BUILT
= 1,
5009 CIRC_EVENT_EXTENDED
= 2,
5010 CIRC_EVENT_FAILED
= 3,
5011 CIRC_EVENT_CLOSED
= 4,
5012 } circuit_status_event_t
;
5014 /** Used to indicate the type of a CIRC_MINOR event passed to the controller.
5015 * The various types are defined in control-spec.txt . */
5016 typedef enum circuit_status_minor_event_t
{
5017 CIRC_MINOR_EVENT_PURPOSE_CHANGED
,
5018 CIRC_MINOR_EVENT_CANNIBALIZED
,
5019 } circuit_status_minor_event_t
;
5021 /** Used to indicate the type of a stream event passed to the controller.
5022 * The various types are defined in control-spec.txt */
5023 typedef enum stream_status_event_t
{
5024 STREAM_EVENT_SENT_CONNECT
= 0,
5025 STREAM_EVENT_SENT_RESOLVE
= 1,
5026 STREAM_EVENT_SUCCEEDED
= 2,
5027 STREAM_EVENT_FAILED
= 3,
5028 STREAM_EVENT_CLOSED
= 4,
5029 STREAM_EVENT_NEW
= 5,
5030 STREAM_EVENT_NEW_RESOLVE
= 6,
5031 STREAM_EVENT_FAILED_RETRIABLE
= 7,
5032 STREAM_EVENT_REMAP
= 8
5033 } stream_status_event_t
;
5035 /** Used to indicate the type of an OR connection event passed to the
5036 * controller. The various types are defined in control-spec.txt */
5037 typedef enum or_conn_status_event_t
{
5038 OR_CONN_EVENT_LAUNCHED
= 0,
5039 OR_CONN_EVENT_CONNECTED
= 1,
5040 OR_CONN_EVENT_FAILED
= 2,
5041 OR_CONN_EVENT_CLOSED
= 3,
5042 OR_CONN_EVENT_NEW
= 4,
5043 } or_conn_status_event_t
;
5045 /** Used to indicate the type of a buildtime event */
5046 typedef enum buildtimeout_set_event_t
{
5047 BUILDTIMEOUT_SET_EVENT_COMPUTED
= 0,
5048 BUILDTIMEOUT_SET_EVENT_RESET
= 1,
5049 BUILDTIMEOUT_SET_EVENT_SUSPENDED
= 2,
5050 BUILDTIMEOUT_SET_EVENT_DISCARD
= 3,
5051 BUILDTIMEOUT_SET_EVENT_RESUME
= 4
5052 } buildtimeout_set_event_t
;
5054 /** Execute the statement <b>stmt</b>, which may log events concerning the
5055 * connection <b>conn</b>. To prevent infinite loops, disable log messages
5056 * being sent to controllers if <b>conn</b> is a control connection.
5058 * Stmt must not contain any return or goto statements.
5060 #define CONN_LOG_PROTECT(conn, stmt) \
5062 int _log_conn_is_control; \
5064 _log_conn_is_control = (conn->type == CONN_TYPE_CONTROL); \
5065 if (_log_conn_is_control) \
5066 disable_control_logging(); \
5067 STMT_BEGIN stmt; STMT_END; \
5068 if (_log_conn_is_control) \
5069 enable_control_logging(); \
5072 /** Enum describing various stages of bootstrapping, for use with controller
5073 * bootstrap status events. The values range from 0 to 100. */
5075 BOOTSTRAP_STATUS_UNDEF
=-1,
5076 BOOTSTRAP_STATUS_STARTING
=0,
5077 BOOTSTRAP_STATUS_CONN_DIR
=5,
5078 BOOTSTRAP_STATUS_HANDSHAKE
=-2,
5079 BOOTSTRAP_STATUS_HANDSHAKE_DIR
=10,
5080 BOOTSTRAP_STATUS_ONEHOP_CREATE
=15,
5081 BOOTSTRAP_STATUS_REQUESTING_STATUS
=20,
5082 BOOTSTRAP_STATUS_LOADING_STATUS
=25,
5083 BOOTSTRAP_STATUS_LOADING_KEYS
=40,
5084 BOOTSTRAP_STATUS_REQUESTING_DESCRIPTORS
=45,
5085 BOOTSTRAP_STATUS_LOADING_DESCRIPTORS
=50,
5086 BOOTSTRAP_STATUS_CONN_OR
=80,
5087 BOOTSTRAP_STATUS_HANDSHAKE_OR
=85,
5088 BOOTSTRAP_STATUS_CIRCUIT_CREATE
=90,
5089 BOOTSTRAP_STATUS_DONE
=100
5090 } bootstrap_status_t
;
5092 /********************************* directory.c ***************************/
5094 /** A pair of digests created by dir_split_resource_info_fingerprint_pairs() */
5096 char first
[DIGEST_LEN
];
5097 char second
[DIGEST_LEN
];
5100 /********************************* dirserv.c ***************************/
5102 /** An enum to describe what format we're generating a routerstatus line in.
5105 /** For use in a v2 opinion */
5107 /** For use in a consensus networkstatus document (ns flavor) */
5109 /** For use in a vote networkstatus document */
5111 /** For passing to the controlport in response to a GETINFO request */
5113 /** For use in a consensus networkstatus document (microdesc flavor) */
5114 NS_V3_CONSENSUS_MICRODESC
5115 } routerstatus_format_type_t
;
5117 #ifdef DIRSERV_PRIVATE
5118 typedef struct measured_bw_line_t
{
5119 char node_id
[DIGEST_LEN
];
5120 char node_hex
[MAX_HEX_NICKNAME_LEN
+1];
5122 } measured_bw_line_t
;
5124 #endif /* defined(DIRSERV_PRIVATE) */
5126 /********************************* dirvote.c ************************/
5128 /** Describes the schedule by which votes should be generated. */
5129 typedef struct vote_timing_t
{
5130 /** Length in seconds between one consensus becoming valid and the next
5131 * becoming valid. */
5133 /** For how many intervals is a consensus valid? */
5134 int n_intervals_valid
;
5135 /** Time in seconds allowed to propagate votes */
5137 /** Time in seconds allowed to propagate signatures */
5141 /********************************* geoip.c **************************/
5143 /** Indicates an action that we might be noting geoip statistics on.
5144 * Note that if we're noticing CONNECT, we're a bridge, and if we're noticing
5145 * the others, we're not.
5148 /** We've noticed a connection as a bridge relay or entry guard. */
5149 GEOIP_CLIENT_CONNECT
= 0,
5150 /** We've served a networkstatus consensus as a directory server. */
5151 GEOIP_CLIENT_NETWORKSTATUS
= 1,
5152 } geoip_client_action_t
;
5153 /** Indicates either a positive reply or a reason for rejectng a network
5154 * status request that will be included in geoip statistics. */
5156 /** Request is answered successfully. */
5158 /** V3 network status is not signed by a sufficient number of requested
5160 GEOIP_REJECT_NOT_ENOUGH_SIGS
= 1,
5161 /** Requested network status object is unavailable. */
5162 GEOIP_REJECT_UNAVAILABLE
= 2,
5163 /** Requested network status not found. */
5164 GEOIP_REJECT_NOT_FOUND
= 3,
5165 /** Network status has not been modified since If-Modified-Since time. */
5166 GEOIP_REJECT_NOT_MODIFIED
= 4,
5167 /** Directory is busy. */
5168 GEOIP_REJECT_BUSY
= 5,
5169 } geoip_ns_response_t
;
5170 #define GEOIP_NS_RESPONSE_NUM 6
5172 /** Directory requests that we are measuring can be either direct or
5176 DIRREQ_TUNNELED
= 1,
5179 /** Possible states for either direct or tunneled directory requests that
5180 * are relevant for determining network status download times. */
5182 /** Found that the client requests a network status; applies to both
5183 * direct and tunneled requests; initial state of a request that we are
5185 DIRREQ_IS_FOR_NETWORK_STATUS
= 0,
5186 /** Finished writing a network status to the directory connection;
5187 * applies to both direct and tunneled requests; completes a direct
5189 DIRREQ_FLUSHING_DIR_CONN_FINISHED
= 1,
5190 /** END cell sent to circuit that initiated a tunneled request. */
5191 DIRREQ_END_CELL_SENT
= 2,
5192 /** Flushed last cell from queue of the circuit that initiated a
5193 * tunneled request to the outbuf of the OR connection. */
5194 DIRREQ_CIRC_QUEUE_FLUSHED
= 3,
5195 /** Flushed last byte from buffer of the channel belonging to the
5196 * circuit that initiated a tunneled request; completes a tunneled
5198 DIRREQ_CHANNEL_BUFFER_FLUSHED
= 4
5201 #define WRITE_STATS_INTERVAL (24*60*60)
5203 /********************************* microdesc.c *************************/
5205 typedef struct microdesc_cache_t microdesc_cache_t
;
5207 /********************************* networkstatus.c *********************/
5209 /** Possible statuses of a version of Tor, given opinions from the directory
5211 typedef enum version_status_t
{
5212 VS_RECOMMENDED
=0, /**< This version is listed as recommended. */
5213 VS_OLD
=1, /**< This version is older than any recommended version. */
5214 VS_NEW
=2, /**< This version is newer than any recommended version. */
5215 VS_NEW_IN_SERIES
=3, /**< This version is newer than any recommended version
5216 * in its series, but later recommended versions exist.
5218 VS_UNRECOMMENDED
=4, /**< This version is not recommended (general case). */
5219 VS_EMPTY
=5, /**< The version list was empty; no agreed-on versions. */
5220 VS_UNKNOWN
, /**< We have no idea. */
5223 /********************************* policies.c ************************/
5225 /** Outcome of applying an address policy to an address. */
5227 /** The address was accepted */
5228 ADDR_POLICY_ACCEPTED
=0,
5229 /** The address was rejected */
5230 ADDR_POLICY_REJECTED
=-1,
5231 /** Part of the address was unknown, but as far as we can tell, it was
5233 ADDR_POLICY_PROBABLY_ACCEPTED
=1,
5234 /** Part of the address was unknown, but as far as we can tell, it was
5236 ADDR_POLICY_PROBABLY_REJECTED
=2,
5237 } addr_policy_result_t
;
5239 /********************************* rephist.c ***************************/
5241 /** Possible public/private key operations in Tor: used to keep track of where
5242 * we're spending our time. */
5245 VERIFY_DIR
, VERIFY_RTR
,
5246 ENC_ONIONSKIN
, DEC_ONIONSKIN
,
5247 TLS_HANDSHAKE_C
, TLS_HANDSHAKE_S
,
5248 REND_CLIENT
, REND_MID
, REND_SERVER
,
5251 /********************************* rendcommon.c ***************************/
5253 /** Hidden-service side configuration of client authorization. */
5254 typedef struct rend_authorized_client_t
{
5256 uint8_t descriptor_cookie
[REND_DESC_COOKIE_LEN
];
5257 crypto_pk_t
*client_key
;
5258 } rend_authorized_client_t
;
5260 /** ASCII-encoded v2 hidden service descriptor. */
5261 typedef struct rend_encoded_v2_service_descriptor_t
{
5262 char desc_id
[DIGEST_LEN
]; /**< Descriptor ID. */
5263 char *desc_str
; /**< Descriptor string. */
5264 } rend_encoded_v2_service_descriptor_t
;
5266 /** The maximum number of non-circuit-build-timeout failures a hidden
5267 * service client will tolerate while trying to build a circuit to an
5268 * introduction point. See also rend_intro_point_t.unreachable_count. */
5269 #define MAX_INTRO_POINT_REACHABILITY_FAILURES 5
5271 /** The minimum and maximum number of distinct INTRODUCE2 cells which a
5272 * hidden service's introduction point will receive before it begins to
5274 #define INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS 16384
5275 /* Double the minimum value so the interval is [min, min * 2]. */
5276 #define INTRO_POINT_MAX_LIFETIME_INTRODUCTIONS \
5277 (INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS * 2)
5279 /** The minimum number of seconds that an introduction point will last
5280 * before expiring due to old age. (If it receives
5281 * INTRO_POINT_LIFETIME_INTRODUCTIONS INTRODUCE2 cells, it may expire
5284 * XXX Should this be configurable? */
5285 #define INTRO_POINT_LIFETIME_MIN_SECONDS (18*60*60)
5286 /** The maximum number of seconds that an introduction point will last
5287 * before expiring due to old age.
5289 * XXX Should this be configurable? */
5290 #define INTRO_POINT_LIFETIME_MAX_SECONDS (24*60*60)
5292 /** The maximum number of circuit creation retry we do to an intro point
5293 * before giving up. We try to reuse intro point that fails during their
5294 * lifetime so this is a hard limit on the amount of time we do that. */
5295 #define MAX_INTRO_POINT_CIRCUIT_RETRIES 3
5297 /** Introduction point information. Used both in rend_service_t (on
5298 * the service side) and in rend_service_descriptor_t (on both the
5299 * client and service side). */
5300 typedef struct rend_intro_point_t
{
5301 extend_info_t
*extend_info
; /**< Extend info for connecting to this
5302 * introduction point via a multi-hop path. */
5303 crypto_pk_t
*intro_key
; /**< Introduction key that replaces the service
5304 * key, if this descriptor is V2. */
5306 /** (Client side only) Flag indicating that a timeout has occurred
5307 * after sending an INTRODUCE cell to this intro point. After a
5308 * timeout, an intro point should not be tried again during the same
5309 * hidden service connection attempt, but it may be tried again
5310 * during a future connection attempt. */
5311 unsigned int timed_out
: 1;
5313 /** (Client side only) The number of times we have failed to build a
5314 * circuit to this intro point for some reason other than our
5315 * circuit-build timeout. See also MAX_INTRO_POINT_REACHABILITY_FAILURES. */
5316 unsigned int unreachable_count
: 3;
5318 /** (Service side only) Flag indicating that this intro point was
5319 * included in the last HS descriptor we generated. */
5320 unsigned int listed_in_last_desc
: 1;
5322 /** (Service side only) A replay cache recording the RSA-encrypted parts
5323 * of INTRODUCE2 cells this intro point's circuit has received. This is
5324 * used to prevent replay attacks. */
5325 replaycache_t
*accepted_intro_rsa_parts
;
5327 /** (Service side only) Count of INTRODUCE2 cells accepted from this
5330 int accepted_introduce2_count
;
5332 /** (Service side only) Number of maximum INTRODUCE2 cells that this IP
5333 * will accept. This is a random value between
5334 * INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS and
5335 * INTRO_POINT_MAX_LIFETIME_INTRODUCTIONS. */
5336 int max_introductions
;
5338 /** (Service side only) The time at which this intro point was first
5339 * published, or -1 if this intro point has not yet been
5341 time_t time_published
;
5343 /** (Service side only) The time at which this intro point should
5344 * (start to) expire, or -1 if we haven't decided when this intro
5345 * point should expire. */
5346 time_t time_to_expire
;
5348 /** (Service side only) The amount of circuit creation we've made to this
5349 * intro point. This is incremented every time we do a circuit relaunch on
5350 * this object which is triggered when the circuit dies but the node is
5351 * still in the consensus. After MAX_INTRO_POINT_CIRCUIT_RETRIES, we give
5353 unsigned int circuit_retries
;
5355 /** (Service side only) Set if this intro point has an established circuit
5356 * and unset if it doesn't. */
5357 unsigned int circuit_established
:1;
5358 } rend_intro_point_t
;
5360 #define REND_PROTOCOL_VERSION_BITMASK_WIDTH 16
5362 /** Information used to connect to a hidden service. Used on both the
5363 * service side and the client side. */
5364 typedef struct rend_service_descriptor_t
{
5365 crypto_pk_t
*pk
; /**< This service's public key. */
5366 int version
; /**< Version of the descriptor format: 0 or 2. */
5367 time_t timestamp
; /**< Time when the descriptor was generated. */
5368 /** Bitmask: which introduce/rendezvous protocols are supported?
5369 * (We allow bits '0', '1', '2' and '3' to be set.) */
5370 unsigned protocols
: REND_PROTOCOL_VERSION_BITMASK_WIDTH
;
5371 /** List of the service's introduction points. Elements are removed if
5372 * introduction attempts fail. */
5373 smartlist_t
*intro_nodes
;
5374 /** Has descriptor been uploaded to all hidden service directories? */
5375 int all_uploads_performed
;
5376 /** List of hidden service directories to which an upload request for
5377 * this descriptor could be sent. Smartlist exists only when at least one
5378 * of the previous upload requests failed (otherwise it's not important
5379 * to know which uploads succeeded and which not). */
5380 smartlist_t
*successful_uploads
;
5381 } rend_service_descriptor_t
;
5383 /********************************* routerlist.c ***************************/
5385 /** Represents information about a single trusted or fallback directory
5387 typedef struct dir_server_t
{
5390 char *address
; /**< Hostname. */
5391 /* XX/teor - why do we duplicate the address and port fields here and in
5392 * fake_status? Surely we could just use fake_status (#17867). */
5393 tor_addr_t ipv6_addr
; /**< IPv6 address if present; AF_UNSPEC if not */
5394 uint32_t addr
; /**< IPv4 address. */
5395 uint16_t dir_port
; /**< Directory port. */
5396 uint16_t or_port
; /**< OR port: Used for tunneling connections. */
5397 uint16_t ipv6_orport
; /**< OR port corresponding to ipv6_addr. */
5398 double weight
; /** Weight used when selecting this node at random */
5399 char digest
[DIGEST_LEN
]; /**< Digest of identity key. */
5400 char v3_identity_digest
[DIGEST_LEN
]; /**< Digest of v3 (authority only,
5401 * high-security) identity key. */
5403 unsigned int is_running
:1; /**< True iff we think this server is running. */
5404 unsigned int is_authority
:1; /**< True iff this is a directory authority
5407 /** True iff this server has accepted the most recent server descriptor
5408 * we tried to upload to it. */
5409 unsigned int has_accepted_serverdesc
:1;
5411 /** What kind of authority is this? (Bitfield.) */
5412 dirinfo_type_t type
;
5414 time_t addr_current_at
; /**< When was the document that we derived the
5415 * address information from published? */
5417 routerstatus_t fake_status
; /**< Used when we need to pass this trusted
5419 * directory_request_set_routerstatus.
5420 * as a routerstatus_t. Not updated by the
5421 * router-status management code!
5425 #define RELAY_REQUIRED_MIN_BANDWIDTH (75*1024)
5426 #define BRIDGE_REQUIRED_MIN_BANDWIDTH (50*1024)
5428 #define ROUTER_MAX_DECLARED_BANDWIDTH INT32_MAX
5430 /* Flags for pick_directory_server() and pick_trusteddirserver(). */
5431 /** Flag to indicate that we should not automatically be willing to use
5432 * ourself to answer a directory request.
5433 * Passed to router_pick_directory_server (et al).*/
5434 #define PDS_ALLOW_SELF (1<<0)
5435 /** Flag to indicate that if no servers seem to be up, we should mark all
5436 * directory servers as up and try again.
5437 * Passed to router_pick_directory_server (et al).*/
5438 #define PDS_RETRY_IF_NO_SERVERS (1<<1)
5439 /** Flag to indicate that we should not exclude directory servers that
5440 * our ReachableAddress settings would exclude. This usually means that
5441 * we're going to connect to the server over Tor, and so we don't need to
5442 * worry about our firewall telling us we can't.
5443 * Passed to router_pick_directory_server (et al).*/
5444 #define PDS_IGNORE_FASCISTFIREWALL (1<<2)
5445 /** Flag to indicate that we should not use any directory authority to which
5446 * we have an existing directory connection for downloading server descriptors
5447 * or extrainfo documents.
5449 * Passed to router_pick_directory_server (et al)
5451 #define PDS_NO_EXISTING_SERVERDESC_FETCH (1<<3)
5452 /** Flag to indicate that we should not use any directory authority to which
5453 * we have an existing directory connection for downloading microdescs.
5455 * Passed to router_pick_directory_server (et al)
5457 #define PDS_NO_EXISTING_MICRODESC_FETCH (1<<4)
5459 /** Possible ways to weight routers when choosing one randomly. See
5460 * routerlist_sl_choose_by_bandwidth() for more information.*/
5461 typedef enum bandwidth_weight_rule_t
{
5462 NO_WEIGHTING
, WEIGHT_FOR_EXIT
, WEIGHT_FOR_MID
, WEIGHT_FOR_GUARD
,
5464 } bandwidth_weight_rule_t
;
5466 /** Flags to be passed to control router_choose_random_node() to indicate what
5467 * kind of nodes to pick according to what algorithm. */
5469 CRN_NEED_UPTIME
= 1<<0,
5470 CRN_NEED_CAPACITY
= 1<<1,
5471 CRN_NEED_GUARD
= 1<<2,
5472 /* XXXX not used, apparently. */
5473 CRN_WEIGHT_AS_EXIT
= 1<<5,
5474 CRN_NEED_DESC
= 1<<6,
5475 /* On clients, only provide nodes that satisfy ClientPreferIPv6OR */
5476 CRN_PREF_ADDR
= 1<<7,
5477 /* On clients, only provide nodes that we can connect to directly, based on
5478 * our firewall rules */
5479 CRN_DIRECT_CONN
= 1<<8,
5480 /* On clients, only provide nodes with HSRend >= 2 protocol version which
5481 * is required for hidden service version >= 3. */
5482 CRN_RENDEZVOUS_V3
= 1<<9,
5483 } router_crn_flags_t
;
5485 /** Return value for router_add_to_routerlist() and dirserv_add_descriptor() */
5486 typedef enum was_router_added_t
{
5487 /* Router was added successfully. */
5488 ROUTER_ADDED_SUCCESSFULLY
= 1,
5489 /* Extrainfo document was rejected because no corresponding router
5490 * descriptor was found OR router descriptor was rejected because
5491 * it was incompatible with its extrainfo document. */
5493 /* Router descriptor was rejected because it is already known. */
5494 ROUTER_IS_ALREADY_KNOWN
= -2,
5495 /* General purpose router was rejected, because it was not listed
5497 ROUTER_NOT_IN_CONSENSUS
= -3,
5498 /* Router was neither in directory consensus nor in any of
5499 * networkstatus documents. Caching it to access later.
5500 * (Applies to fetched descriptors only.) */
5501 ROUTER_NOT_IN_CONSENSUS_OR_NETWORKSTATUS
= -4,
5502 /* Router was rejected by directory authority. */
5503 ROUTER_AUTHDIR_REJECTS
= -5,
5504 /* Bridge descriptor was rejected because such bridge was not one
5505 * of the bridges we have listed in our configuration. */
5506 ROUTER_WAS_NOT_WANTED
= -6,
5507 /* Router descriptor was rejected because it was older than
5508 * OLD_ROUTER_DESC_MAX_AGE. */
5509 ROUTER_WAS_TOO_OLD
= -7, /* note contrast with 'NOT_NEW' */
5511 ROUTER_CERTS_EXPIRED
= -8
5512 } was_router_added_t
;
5514 /********************************* routerparse.c ************************/
5516 #define MAX_STATUS_TAG_LEN 32
5517 /** Structure to hold parsed Tor versions. This is a little messier
5518 * than we would like it to be, because we changed version schemes with 0.1.0.
5520 * See version-spec.txt for the whole business.
5522 typedef struct tor_version_t
{
5526 /** Release status. For version in the post-0.1 format, this is always
5528 enum { VER_PRE
=0, VER_RC
=1, VER_RELEASE
=2, } status
;
5530 char status_tag
[MAX_STATUS_TAG_LEN
];
5534 char git_tag
[DIGEST_LEN
];
5537 #endif /* !defined(TOR_OR_H) */