1 /* Copyright (c) 2001 Matej Pfajfar.
2 * Copyright (c) 2001-2004, Roger Dingledine.
3 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4 * Copyright (c) 2007-2011, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
8 * \file networkstatus.c
9 * \brief Functions and structures for handling network status documents as a
15 /* For tracking v2 networkstatus documents. Only caches do this now. */
17 /** Map from descriptor digest of routers listed in the v2 networkstatus
18 * documents to download_status_t* */
19 static digestmap_t
*v2_download_status_map
= NULL
;
20 /** Global list of all of the current v2 network_status documents that we know
21 * about. This list is kept sorted by published_on. */
22 static smartlist_t
*networkstatus_v2_list
= NULL
;
23 /** True iff any member of networkstatus_v2_list has changed since the last
24 * time we called download_status_map_update_from_v2_networkstatus() */
25 static int networkstatus_v2_list_has_changed
= 0;
27 /** Map from lowercase nickname to identity digest of named server, if any. */
28 static strmap_t
*named_server_map
= NULL
;
29 /** Map from lowercase nickname to (void*)1 for all names that are listed
30 * as unnamed for some server in the consensus. */
31 static strmap_t
*unnamed_server_map
= NULL
;
33 /** Most recently received and validated v3 consensus network status. */
34 static networkstatus_t
*current_consensus
= NULL
;
36 /** A v3 consensus networkstatus that we've received, but which we don't
37 * have enough certificates to be happy about. */
38 static networkstatus_t
*consensus_waiting_for_certs
= NULL
;
39 /** The encoded version of consensus_waiting_for_certs. */
40 static char *consensus_waiting_for_certs_body
= NULL
;
41 /** When did we set the current value of consensus_waiting_for_certs? If this
42 * is too recent, we shouldn't try to fetch a new consensus for a little while,
43 * to give ourselves time to get certificates for this one. */
44 static time_t consensus_waiting_for_certs_set_at
= 0;
45 /** Set to 1 if we've been holding on to consensus_waiting_for_certs so long
46 * that we should treat it as maybe being bad. */
47 static int consensus_waiting_for_certs_dl_failed
= 0;
49 /** The last time we tried to download a networkstatus, or 0 for "never". We
50 * use this to rate-limit download attempts for directory caches (including
51 * mirrors). Clients don't use this now. */
52 static time_t last_networkstatus_download_attempted
= 0;
54 /** A time before which we shouldn't try to replace the current consensus:
55 * this will be at some point after the next consensus becomes valid, but
56 * before the current consensus becomes invalid. */
57 static time_t time_to_download_next_consensus
= 0;
58 /** Download status for the current consensus networkstatus. */
59 static download_status_t consensus_dl_status
= { 0, 0, DL_SCHED_CONSENSUS
};
61 /** True iff we have logged a warning about this OR's version being older than
62 * listed by the authorities. */
63 static int have_warned_about_old_version
= 0;
64 /** True iff we have logged a warning about this OR's version being newer than
65 * listed by the authorities. */
66 static int have_warned_about_new_version
= 0;
68 static void download_status_map_update_from_v2_networkstatus(void);
69 static void routerstatus_list_update_named_server_map(void);
71 /** Forget that we've warned about anything networkstatus-related, so we will
72 * give fresh warnings if the same behavior happens again. */
74 networkstatus_reset_warnings(void)
76 if (current_consensus
) {
77 SMARTLIST_FOREACH(current_consensus
->routerstatus_list
,
79 rs
->name_lookup_warned
= 0);
82 have_warned_about_old_version
= 0;
83 have_warned_about_new_version
= 0;
86 /** Reset the descriptor download failure count on all networkstatus docs, so
87 * that we can retry any long-failed documents immediately.
90 networkstatus_reset_download_failures(void)
92 const smartlist_t
*networkstatus_v2_list
= networkstatus_get_v2_list();
93 SMARTLIST_FOREACH(networkstatus_v2_list
, networkstatus_v2_t
*, ns
,
94 SMARTLIST_FOREACH(ns
->entries
, routerstatus_t
*, rs
,
96 if (!router_get_by_descriptor_digest(rs
->descriptor_digest
))
97 rs
->need_to_mirror
= 1;
100 download_status_reset(&consensus_dl_status
);
101 if (v2_download_status_map
) {
102 digestmap_iter_t
*iter
;
103 digestmap_t
*map
= v2_download_status_map
;
106 download_status_t
*dls
;
107 for (iter
= digestmap_iter_init(map
); !digestmap_iter_done(iter
);
108 iter
= digestmap_iter_next(map
, iter
) ) {
109 digestmap_iter_get(iter
, &key
, &val
);
111 download_status_reset(dls
);
116 /** Repopulate our list of network_status_t objects from the list cached on
117 * disk. Return 0 on success, -1 on failure. */
119 router_reload_v2_networkstatus(void)
121 smartlist_t
*entries
;
124 char *filename
= get_datadir_fname("cached-status");
125 int maybe_delete
= !directory_caches_v2_dir_info(get_options());
126 time_t now
= time(NULL
);
127 if (!networkstatus_v2_list
)
128 networkstatus_v2_list
= smartlist_create();
130 entries
= tor_listdir(filename
);
131 if (!entries
) { /* dir doesn't exist */
134 } else if (!smartlist_len(entries
) && maybe_delete
) {
137 smartlist_free(entries
);
141 SMARTLIST_FOREACH(entries
, const char *, fn
, {
142 char buf
[DIGEST_LEN
];
144 filename
= get_datadir_fname2("cached-status", fn
);
145 remove_file_if_very_old(filename
, now
);
149 if (strlen(fn
) != HEX_DIGEST_LEN
||
150 base16_decode(buf
, sizeof(buf
), fn
, strlen(fn
))) {
152 "Skipping cached-status file with unexpected name \"%s\"",fn
);
155 filename
= get_datadir_fname2("cached-status", fn
);
156 s
= read_file_to_str(filename
, 0, &st
);
158 if (router_set_networkstatus_v2(s
, st
.st_mtime
, NS_FROM_CACHE
,
160 log_warn(LD_FS
, "Couldn't load networkstatus from \"%s\"",filename
);
166 SMARTLIST_FOREACH(entries
, char *, fn
, tor_free(fn
));
167 smartlist_free(entries
);
168 networkstatus_v2_list_clean(time(NULL
));
169 routers_update_all_from_networkstatus(time(NULL
), 2);
173 /** Read the cached v3 consensus networkstatus from the disk. */
175 router_reload_consensus_networkstatus(void)
180 or_options_t
*options
= get_options();
181 const unsigned int flags
= NSSET_FROM_CACHE
| NSSET_DONT_DOWNLOAD_CERTS
;
183 /* FFFF Suppress warnings if cached consensus is bad? */
185 filename
= get_datadir_fname("cached-consensus");
186 s
= read_file_to_str(filename
, RFTS_IGNORE_MISSING
, NULL
);
188 if (networkstatus_set_current_consensus(s
, flags
) < -1) {
189 log_warn(LD_FS
, "Couldn't load consensus networkstatus from \"%s\"",
196 filename
= get_datadir_fname("unverified-consensus");
197 s
= read_file_to_str(filename
, RFTS_IGNORE_MISSING
, NULL
);
199 if (networkstatus_set_current_consensus(s
,
200 flags
|NSSET_WAS_WAITING_FOR_CERTS
)) {
201 log_info(LD_FS
, "Couldn't load consensus networkstatus from \"%s\"",
208 if (!current_consensus
||
209 (stat(options
->FallbackNetworkstatusFile
, &st
)==0 &&
210 st
.st_mtime
> current_consensus
->valid_after
)) {
211 s
= read_file_to_str(options
->FallbackNetworkstatusFile
,
212 RFTS_IGNORE_MISSING
, NULL
);
214 if (networkstatus_set_current_consensus(s
,
215 flags
|NSSET_ACCEPT_OBSOLETE
)) {
216 log_info(LD_FS
, "Couldn't load consensus networkstatus from \"%s\"",
217 options
->FallbackNetworkstatusFile
);
220 "Loaded fallback consensus networkstatus from \"%s\"",
221 options
->FallbackNetworkstatusFile
);
227 if (!current_consensus
) {
228 if (!named_server_map
)
229 named_server_map
= strmap_new();
230 if (!unnamed_server_map
)
231 unnamed_server_map
= strmap_new();
234 update_certificate_downloads(time(NULL
));
236 routers_update_all_from_networkstatus(time(NULL
), 3);
241 /** Free all storage held by the vote_routerstatus object <b>rs</b>. */
243 vote_routerstatus_free(vote_routerstatus_t
*rs
)
245 tor_free(rs
->version
);
246 tor_free(rs
->status
.exitsummary
);
250 /** Free all storage held by the routerstatus object <b>rs</b>. */
252 routerstatus_free(routerstatus_t
*rs
)
254 tor_free(rs
->exitsummary
);
258 /** Free all storage held by the networkstatus object <b>ns</b>. */
260 networkstatus_v2_free(networkstatus_v2_t
*ns
)
262 tor_free(ns
->source_address
);
263 tor_free(ns
->contact
);
265 crypto_free_pk_env(ns
->signing_key
);
266 tor_free(ns
->client_versions
);
267 tor_free(ns
->server_versions
);
269 SMARTLIST_FOREACH(ns
->entries
, routerstatus_t
*, rs
,
270 routerstatus_free(rs
));
271 smartlist_free(ns
->entries
);
276 /** Clear all storage held in <b>ns</b>. */
278 networkstatus_vote_free(networkstatus_t
*ns
)
283 tor_free(ns
->client_versions
);
284 tor_free(ns
->server_versions
);
285 if (ns
->known_flags
) {
286 SMARTLIST_FOREACH(ns
->known_flags
, char *, c
, tor_free(c
));
287 smartlist_free(ns
->known_flags
);
289 if (ns
->net_params
) {
290 SMARTLIST_FOREACH(ns
->net_params
, char *, c
, tor_free(c
));
291 smartlist_free(ns
->net_params
);
293 if (ns
->supported_methods
) {
294 SMARTLIST_FOREACH(ns
->supported_methods
, char *, c
, tor_free(c
));
295 smartlist_free(ns
->supported_methods
);
298 SMARTLIST_FOREACH(ns
->voters
, networkstatus_voter_info_t
*, voter
,
300 tor_free(voter
->nickname
);
301 tor_free(voter
->address
);
302 tor_free(voter
->contact
);
303 tor_free(voter
->signature
);
306 smartlist_free(ns
->voters
);
309 authority_cert_free(ns
->cert
);
311 if (ns
->routerstatus_list
) {
312 if (ns
->type
== NS_TYPE_VOTE
|| ns
->type
== NS_TYPE_OPINION
) {
313 SMARTLIST_FOREACH(ns
->routerstatus_list
, vote_routerstatus_t
*, rs
,
314 vote_routerstatus_free(rs
));
316 SMARTLIST_FOREACH(ns
->routerstatus_list
, routerstatus_t
*, rs
,
317 routerstatus_free(rs
));
320 smartlist_free(ns
->routerstatus_list
);
322 if (ns
->desc_digest_map
)
323 digestmap_free(ns
->desc_digest_map
, NULL
);
325 memset(ns
, 11, sizeof(*ns
));
329 /** Return the voter info from <b>vote</b> for the voter whose identity digest
330 * is <b>identity</b>, or NULL if no such voter is associated with
332 networkstatus_voter_info_t
*
333 networkstatus_get_voter_by_id(networkstatus_t
*vote
,
334 const char *identity
)
336 if (!vote
|| !vote
->voters
)
338 SMARTLIST_FOREACH(vote
->voters
, networkstatus_voter_info_t
*, voter
,
339 if (fast_memeq(voter
->identity_digest
, identity
, DIGEST_LEN
))
344 /** Check whether the signature on <b>voter</b> is correctly signed by
345 * the signing key of <b>cert</b>. Return -1 if <b>cert</b> doesn't match the
346 * signing key; otherwise set the good_signature or bad_signature flag on
347 * <b>voter</b>, and return 0. */
348 /* (private; exposed for testing.) */
350 networkstatus_check_voter_signature(networkstatus_t
*consensus
,
351 networkstatus_voter_info_t
*voter
,
352 authority_cert_t
*cert
)
356 size_t signed_digest_len
;
357 if (crypto_pk_get_digest(cert
->signing_key
, d
)<0)
359 if (tor_memneq(voter
->signing_key_digest
, d
, DIGEST_LEN
))
361 signed_digest_len
= crypto_pk_keysize(cert
->signing_key
);
362 signed_digest
= tor_malloc(signed_digest_len
);
363 if (crypto_pk_public_checksig(cert
->signing_key
,
367 voter
->signature_len
) != DIGEST_LEN
||
368 tor_memneq(signed_digest
, consensus
->networkstatus_digest
, DIGEST_LEN
)) {
369 log_warn(LD_DIR
, "Got a bad signature on a networkstatus vote");
370 voter
->bad_signature
= 1;
372 voter
->good_signature
= 1;
374 tor_free(signed_digest
);
378 /** Given a v3 networkstatus consensus in <b>consensus</b>, check every
379 * as-yet-unchecked signature on <b>consensus</b>. Return 1 if there is a
380 * signature from every recognized authority on it, 0 if there are
381 * enough good signatures from recognized authorities on it, -1 if we might
382 * get enough good signatures by fetching missing certificates, and -2
383 * otherwise. Log messages at INFO or WARN: if <b>warn</b> is over 1, warn
384 * about every problem; if warn is at least 1, warn only if we can't get
385 * enough signatures; if warn is negative, log nothing at all. */
387 networkstatus_check_consensus_signature(networkstatus_t
*consensus
,
391 int n_missing_key
= 0;
394 int n_no_signature
= 0;
395 int n_v3_authorities
= get_n_authorities(V3_AUTHORITY
);
396 int n_required
= n_v3_authorities
/2 + 1;
397 smartlist_t
*need_certs_from
= smartlist_create();
398 smartlist_t
*unrecognized
= smartlist_create();
399 smartlist_t
*missing_authorities
= smartlist_create();
401 time_t now
= time(NULL
);
403 tor_assert(consensus
->type
== NS_TYPE_CONSENSUS
);
405 SMARTLIST_FOREACH(consensus
->voters
, networkstatus_voter_info_t
*, voter
,
407 if (!voter
->good_signature
&& !voter
->bad_signature
&& voter
->signature
) {
408 /* we can try to check the signature. */
409 int is_v3_auth
= trusteddirserver_get_by_v3_auth_digest(
410 voter
->identity_digest
) != NULL
;
411 authority_cert_t
*cert
=
412 authority_cert_get_by_digests(voter
->identity_digest
,
413 voter
->signing_key_digest
);
415 smartlist_add(unrecognized
, voter
);
418 } else if (!cert
|| cert
->expires
< now
) {
419 smartlist_add(need_certs_from
, voter
);
423 if (networkstatus_check_voter_signature(consensus
, voter
, cert
) < 0) {
424 smartlist_add(need_certs_from
, voter
);
429 if (voter
->good_signature
)
431 else if (voter
->bad_signature
)
437 /* Now see whether we're missing any voters entirely. */
438 SMARTLIST_FOREACH(router_get_trusted_dir_servers(),
439 trusted_dir_server_t
*, ds
,
441 if ((ds
->type
& V3_AUTHORITY
) &&
442 !networkstatus_get_voter_by_id(consensus
, ds
->v3_identity_digest
))
443 smartlist_add(missing_authorities
, ds
);
446 if (warn
> 1 || (warn
>= 0 && n_good
< n_required
))
452 SMARTLIST_FOREACH(unrecognized
, networkstatus_voter_info_t
*, voter
,
454 log_info(LD_DIR
, "Consensus includes unrecognized authority '%s' "
455 "at %s:%d (contact %s; identity %s)",
456 voter
->nickname
, voter
->address
, (int)voter
->dir_port
,
457 voter
->contact
?voter
->contact
:"n/a",
458 hex_str(voter
->identity_digest
, DIGEST_LEN
));
460 SMARTLIST_FOREACH(need_certs_from
, networkstatus_voter_info_t
*, voter
,
462 log_info(LD_DIR
, "Looks like we need to download a new certificate "
463 "from authority '%s' at %s:%d (contact %s; identity %s)",
464 voter
->nickname
, voter
->address
, (int)voter
->dir_port
,
465 voter
->contact
?voter
->contact
:"n/a",
466 hex_str(voter
->identity_digest
, DIGEST_LEN
));
468 SMARTLIST_FOREACH(missing_authorities
, trusted_dir_server_t
*, ds
,
470 log_info(LD_DIR
, "Consensus does not include configured "
471 "authority '%s' at %s:%d (identity %s)",
472 ds
->nickname
, ds
->address
, (int)ds
->dir_port
,
473 hex_str(ds
->v3_identity_digest
, DIGEST_LEN
));
475 log(severity
, LD_DIR
,
476 "%d unknown, %d missing key, %d good, %d bad, %d no signature, "
477 "%d required", n_unknown
, n_missing_key
, n_good
, n_bad
,
478 n_no_signature
, n_required
);
481 smartlist_free(unrecognized
);
482 smartlist_free(need_certs_from
);
483 smartlist_free(missing_authorities
);
485 if (n_good
== n_v3_authorities
)
487 else if (n_good
>= n_required
)
489 else if (n_good
+ n_missing_key
>= n_required
)
495 /** Helper: return a newly allocated string containing the name of the filename
496 * where we plan to cache the network status with the given identity digest. */
498 networkstatus_get_cache_filename(const char *identity_digest
)
500 char fp
[HEX_DIGEST_LEN
+1];
501 base16_encode(fp
, HEX_DIGEST_LEN
+1, identity_digest
, DIGEST_LEN
);
502 return get_datadir_fname2("cached-status", fp
);
505 /** Helper for smartlist_sort: Compare two networkstatus objects by
506 * publication date. */
508 _compare_networkstatus_v2_published_on(const void **_a
, const void **_b
)
510 const networkstatus_v2_t
*a
= *_a
, *b
= *_b
;
511 if (a
->published_on
< b
->published_on
)
513 else if (a
->published_on
> b
->published_on
)
519 /** Add the parsed v2 networkstatus in <b>ns</b> (with original document in
520 * <b>s</b>) to the disk cache (and the in-memory directory server cache) as
523 add_networkstatus_to_cache(const char *s
,
524 v2_networkstatus_source_t source
,
525 networkstatus_v2_t
*ns
)
527 if (source
!= NS_FROM_CACHE
) {
528 char *fn
= networkstatus_get_cache_filename(ns
->identity_digest
);
529 if (write_str_to_file(fn
, s
, 0)<0) {
530 log_notice(LD_FS
, "Couldn't write cached network status to \"%s\"", fn
);
535 if (directory_caches_v2_dir_info(get_options()))
536 dirserv_set_cached_networkstatus_v2(s
,
543 /** How far in the future do we allow a network-status to get before removing
545 #define NETWORKSTATUS_ALLOW_SKEW (24*60*60)
547 /** Given a string <b>s</b> containing a network status that we received at
548 * <b>arrived_at</b> from <b>source</b>, try to parse it, see if we want to
549 * store it, and put it into our cache as necessary.
551 * If <b>source</b> is NS_FROM_DIR or NS_FROM_CACHE, do not replace our
552 * own networkstatus_t (if we're an authoritative directory server).
554 * If <b>source</b> is NS_FROM_CACHE, do not write our networkstatus_t to the
557 * If <b>requested_fingerprints</b> is provided, it must contain a list of
558 * uppercased identity fingerprints. Do not update any networkstatus whose
559 * fingerprint is not on the list; after updating a networkstatus, remove its
560 * fingerprint from the list.
562 * Return 0 on success, -1 on failure.
564 * Callers should make sure that routers_update_all_from_networkstatus() is
565 * invoked after this function succeeds.
568 router_set_networkstatus_v2(const char *s
, time_t arrived_at
,
569 v2_networkstatus_source_t source
,
570 smartlist_t
*requested_fingerprints
)
572 networkstatus_v2_t
*ns
;
576 trusted_dir_server_t
*trusted_dir
= NULL
;
577 const char *source_desc
= NULL
;
578 char fp
[HEX_DIGEST_LEN
+1];
579 char published
[ISO_TIME_LEN
+1];
581 if (!directory_caches_v2_dir_info(get_options()))
582 return 0; /* Don't bother storing it. */
584 ns
= networkstatus_v2_parse_from_string(s
);
586 log_warn(LD_DIR
, "Couldn't parse network status.");
589 base16_encode(fp
, HEX_DIGEST_LEN
+1, ns
->identity_digest
, DIGEST_LEN
);
591 router_get_trusteddirserver_by_digest(ns
->identity_digest
)) ||
592 !(trusted_dir
->type
& V2_AUTHORITY
)) {
593 log_info(LD_DIR
, "Network status was signed, but not by an authoritative "
594 "directory we recognize.");
597 source_desc
= trusted_dir
->description
;
600 if (arrived_at
> now
)
603 ns
->received_on
= arrived_at
;
605 format_iso_time(published
, ns
->published_on
);
607 if (ns
->published_on
> now
+ NETWORKSTATUS_ALLOW_SKEW
) {
609 long delta
= now
- ns
->published_on
;
610 format_time_interval(dbuf
, sizeof(dbuf
), delta
);
611 log_warn(LD_GENERAL
, "Network status from %s was published %s in the "
612 "future (%s GMT). Check your time and date settings! "
614 source_desc
, dbuf
, published
);
615 control_event_general_status(LOG_WARN
,
616 "CLOCK_SKEW MIN_SKEW=%ld SOURCE=NETWORKSTATUS:%s:%d",
617 delta
, ns
->source_address
, ns
->source_dirport
);
621 if (!networkstatus_v2_list
)
622 networkstatus_v2_list
= smartlist_create();
624 if ( (source
== NS_FROM_DIR_BY_FP
|| source
== NS_FROM_DIR_ALL
) &&
625 router_digest_is_me(ns
->identity_digest
)) {
626 /* Don't replace our own networkstatus when we get it from somebody else.*/
627 networkstatus_v2_free(ns
);
631 if (requested_fingerprints
) {
632 if (smartlist_string_isin(requested_fingerprints
, fp
)) {
633 smartlist_string_remove(requested_fingerprints
, fp
);
635 if (source
!= NS_FROM_DIR_ALL
) {
637 smartlist_join_strings(requested_fingerprints
," ",0,NULL
);
639 "We received a network status with a fingerprint (%s) that we "
640 "never requested. (We asked for: %s.) Dropping.",
650 /* We got a non-trusted networkstatus, and we're a directory cache.
651 * This means that we asked an authority, and it told us about another
652 * authority we didn't recognize. */
654 "We do not recognize authority (%s) but we are willing "
656 add_networkstatus_to_cache(s
, source
, ns
);
657 networkstatus_v2_free(ns
);
663 for (i
=0; i
< smartlist_len(networkstatus_v2_list
); ++i
) {
664 networkstatus_v2_t
*old_ns
= smartlist_get(networkstatus_v2_list
, i
);
666 if (tor_memeq(old_ns
->identity_digest
, ns
->identity_digest
, DIGEST_LEN
)) {
667 if (tor_memeq(old_ns
->networkstatus_digest
,
668 ns
->networkstatus_digest
, DIGEST_LEN
)) {
669 /* Same one we had before. */
670 networkstatus_v2_free(ns
);
671 tor_assert(trusted_dir
);
673 "Not replacing network-status from %s (published %s); "
674 "we already have it.",
675 trusted_dir
->description
, published
);
676 if (old_ns
->received_on
< arrived_at
) {
677 if (source
!= NS_FROM_CACHE
) {
679 fn
= networkstatus_get_cache_filename(old_ns
->identity_digest
);
680 /* We use mtime to tell when it arrived, so update that. */
684 old_ns
->received_on
= arrived_at
;
686 download_status_failed(&trusted_dir
->v2_ns_dl_status
, 0);
688 } else if (old_ns
->published_on
>= ns
->published_on
) {
689 char old_published
[ISO_TIME_LEN
+1];
690 format_iso_time(old_published
, old_ns
->published_on
);
691 tor_assert(trusted_dir
);
693 "Not replacing network-status from %s (published %s);"
694 " we have a newer one (published %s) for this authority.",
695 trusted_dir
->description
, published
,
697 networkstatus_v2_free(ns
);
698 download_status_failed(&trusted_dir
->v2_ns_dl_status
, 0);
701 networkstatus_v2_free(old_ns
);
702 smartlist_set(networkstatus_v2_list
, i
, ns
);
709 if (source
!= NS_FROM_CACHE
&& trusted_dir
) {
710 download_status_reset(&trusted_dir
->v2_ns_dl_status
);
714 smartlist_add(networkstatus_v2_list
, ns
);
716 /** Retain any routerinfo mentioned in a V2 networkstatus for at least this
718 #define V2_NETWORKSTATUS_ROUTER_LIFETIME (3*60*60)
721 time_t live_until
= ns
->published_on
+ V2_NETWORKSTATUS_ROUTER_LIFETIME
;
722 SMARTLIST_FOREACH(ns
->entries
, routerstatus_t
*, rs
,
724 signed_descriptor_t
*sd
=
725 router_get_by_descriptor_digest(rs
->descriptor_digest
);
727 if (sd
->last_listed_as_valid_until
< live_until
)
728 sd
->last_listed_as_valid_until
= live_until
;
730 rs
->need_to_mirror
= 1;
735 log_info(LD_DIR
, "Setting networkstatus %s %s (published %s)",
736 source
== NS_FROM_CACHE
?"cached from":
737 ((source
== NS_FROM_DIR_BY_FP
|| source
== NS_FROM_DIR_ALL
) ?
738 "downloaded from":"generated for"),
739 trusted_dir
->description
, published
);
740 networkstatus_v2_list_has_changed
= 1;
742 smartlist_sort(networkstatus_v2_list
,
743 _compare_networkstatus_v2_published_on
);
746 add_networkstatus_to_cache(s
, source
, ns
);
751 /** Remove all very-old network_status_t objects from memory and from the
754 networkstatus_v2_list_clean(time_t now
)
757 if (!networkstatus_v2_list
)
760 for (i
= 0; i
< smartlist_len(networkstatus_v2_list
); ++i
) {
761 networkstatus_v2_t
*ns
= smartlist_get(networkstatus_v2_list
, i
);
763 if (ns
->published_on
+ MAX_NETWORKSTATUS_AGE
> now
)
765 /* Okay, this one is too old. Remove it from the list, and delete it
767 smartlist_del(networkstatus_v2_list
, i
--);
768 fname
= networkstatus_get_cache_filename(ns
->identity_digest
);
769 if (file_status(fname
) == FN_FILE
) {
770 log_info(LD_DIR
, "Removing too-old networkstatus in %s", fname
);
774 if (directory_caches_v2_dir_info(get_options())) {
775 dirserv_set_cached_networkstatus_v2(NULL
, ns
->identity_digest
, 0);
777 networkstatus_v2_free(ns
);
780 /* And now go through the directory cache for any cached untrusted
781 * networkstatuses and other network info. */
782 dirserv_clear_old_networkstatuses(now
- MAX_NETWORKSTATUS_AGE
);
783 dirserv_clear_old_v1_info(now
);
786 /** Helper for bsearching a list of routerstatus_t pointers: compare a
787 * digest in the key to the identity digest of a routerstatus_t. */
789 _compare_digest_to_routerstatus_entry(const void *_key
, const void **_member
)
791 const char *key
= _key
;
792 const routerstatus_t
*rs
= *_member
;
793 return tor_memcmp(key
, rs
->identity_digest
, DIGEST_LEN
);
796 /** Return the entry in <b>ns</b> for the identity digest <b>digest</b>, or
797 * NULL if none was found. */
799 networkstatus_v2_find_entry(networkstatus_v2_t
*ns
, const char *digest
)
801 return smartlist_bsearch(ns
->entries
, digest
,
802 _compare_digest_to_routerstatus_entry
);
805 /** Return the entry in <b>ns</b> for the identity digest <b>digest</b>, or
806 * NULL if none was found. */
808 networkstatus_vote_find_entry(networkstatus_t
*ns
, const char *digest
)
810 return smartlist_bsearch(ns
->routerstatus_list
, digest
,
811 _compare_digest_to_routerstatus_entry
);
814 /*XXXX make this static once functions are moved into this file. */
815 /** Search the routerstatuses in <b>ns</b> for one whose identity digest is
816 * <b>digest</b>. Return value and set *<b>found_out</b> as for
817 * smartlist_bsearch_idx(). */
819 networkstatus_vote_find_entry_idx(networkstatus_t
*ns
,
820 const char *digest
, int *found_out
)
822 return smartlist_bsearch_idx(ns
->routerstatus_list
, digest
,
823 _compare_digest_to_routerstatus_entry
,
827 /** Return a list of the v2 networkstatus documents. */
829 networkstatus_get_v2_list(void)
831 if (!networkstatus_v2_list
)
832 networkstatus_v2_list
= smartlist_create();
833 return networkstatus_v2_list
;
836 /** Return the consensus view of the status of the router whose current
837 * <i>descriptor</i> digest is <b>digest</b>, or NULL if no such router is
840 router_get_consensus_status_by_descriptor_digest(const char *digest
)
842 if (!current_consensus
) return NULL
;
843 if (!current_consensus
->desc_digest_map
) {
844 digestmap_t
* m
= current_consensus
->desc_digest_map
= digestmap_new();
845 SMARTLIST_FOREACH(current_consensus
->routerstatus_list
,
846 routerstatus_t
*, rs
,
848 digestmap_set(m
, rs
->descriptor_digest
, rs
);
851 return digestmap_get(current_consensus
->desc_digest_map
, digest
);
854 /** Given the digest of a router descriptor, return its current download
855 * status, or NULL if the digest is unrecognized. */
857 router_get_dl_status_by_descriptor_digest(const char *d
)
860 if ((rs
= router_get_consensus_status_by_descriptor_digest(d
)))
861 return &rs
->dl_status
;
862 if (v2_download_status_map
)
863 return digestmap_get(v2_download_status_map
, d
);
868 /** Return the consensus view of the status of the router whose identity
869 * digest is <b>digest</b>, or NULL if we don't know about any such router. */
871 router_get_consensus_status_by_id(const char *digest
)
873 if (!current_consensus
)
875 return smartlist_bsearch(current_consensus
->routerstatus_list
, digest
,
876 _compare_digest_to_routerstatus_entry
);
879 /** Given a nickname (possibly verbose, possibly a hexadecimal digest), return
880 * the corresponding routerstatus_t, or NULL if none exists. Warn the
881 * user if <b>warn_if_unnamed</b> is set, and they have specified a router by
882 * nickname, but the Named flag isn't set for that router. */
884 router_get_consensus_status_by_nickname(const char *nickname
,
887 char digest
[DIGEST_LEN
];
888 routerstatus_t
*best
=NULL
;
889 smartlist_t
*matches
=NULL
;
890 const char *named_id
=NULL
;
892 if (!current_consensus
|| !nickname
)
895 /* Is this name really a hexadecimal identity digest? */
896 if (nickname
[0] == '$') {
897 if (base16_decode(digest
, DIGEST_LEN
, nickname
+1, strlen(nickname
+1))<0)
899 return networkstatus_vote_find_entry(current_consensus
, digest
);
900 } else if (strlen(nickname
) == HEX_DIGEST_LEN
&&
901 (base16_decode(digest
, DIGEST_LEN
, nickname
, strlen(nickname
))==0)) {
902 return networkstatus_vote_find_entry(current_consensus
, digest
);
905 /* Is there a server that is Named with this name? */
906 if (named_server_map
)
907 named_id
= strmap_get_lc(named_server_map
, nickname
);
909 return networkstatus_vote_find_entry(current_consensus
, named_id
);
911 /* Okay; is this name listed as Unnamed? */
912 if (unnamed_server_map
&&
913 strmap_get_lc(unnamed_server_map
, nickname
)) {
914 log_info(LD_GENERAL
, "The name %s is listed as Unnamed; it is not the "
915 "canonical name of any server we know.", escaped(nickname
));
919 /* This name is not canonical for any server; go through the list and
920 * see who it matches. */
921 /*XXXX This is inefficient; optimize it if it matters. */
922 matches
= smartlist_create();
923 SMARTLIST_FOREACH(current_consensus
->routerstatus_list
,
924 routerstatus_t
*, lrs
,
926 if (!strcasecmp(lrs
->nickname
, nickname
)) {
928 tor_fragile_assert() /* This should never happen. */
929 smartlist_free(matches
);
932 if (lrs
->is_unnamed
) {
933 tor_fragile_assert(); /* nor should this. */
934 smartlist_clear(matches
);
938 smartlist_add(matches
, lrs
);
944 if (smartlist_len(matches
)>1 && warn_if_unnamed
) {
946 SMARTLIST_FOREACH(matches
, routerstatus_t
*, lrs
,
948 if (! lrs
->name_lookup_warned
) {
949 lrs
->name_lookup_warned
=1;
954 log_warn(LD_CONFIG
,"There are multiple matches for the nickname \"%s\","
955 " but none is listed as named by the directory authorities. "
956 "Choosing one arbitrarily.", nickname
);
958 } else if (warn_if_unnamed
&& best
&& !best
->name_lookup_warned
) {
959 char fp
[HEX_DIGEST_LEN
+1];
960 base16_encode(fp
, sizeof(fp
),
961 best
->identity_digest
, DIGEST_LEN
);
963 "When looking up a status, you specified a server \"%s\" by name, "
964 "but the directory authorities do not have any key registered for "
965 "this nickname -- so it could be used by any server, "
966 "not just the one you meant. "
967 "To make sure you get the same server in the future, refer to "
968 "it by key, as \"$%s\".", nickname
, fp
);
969 best
->name_lookup_warned
= 1;
971 smartlist_free(matches
);
975 /** Return the identity digest that's mapped to officially by
976 * <b>nickname</b>. */
978 networkstatus_get_router_digest_by_nickname(const char *nickname
)
980 if (!named_server_map
)
982 return strmap_get_lc(named_server_map
, nickname
);
985 /** Return true iff <b>nickname</b> is disallowed from being the nickname
988 networkstatus_nickname_is_unnamed(const char *nickname
)
990 if (!unnamed_server_map
)
992 return strmap_get_lc(unnamed_server_map
, nickname
) != NULL
;
995 /** How frequently do directory authorities re-download fresh networkstatus
997 #define AUTHORITY_NS_CACHE_INTERVAL (10*60)
999 /** How frequently do non-authority directory caches re-download fresh
1000 * networkstatus documents? */
1001 #define NONAUTHORITY_NS_CACHE_INTERVAL (60*60)
1003 /** We are a directory server, and so cache network_status documents.
1004 * Initiate downloads as needed to update them. For v2 authorities,
1005 * this means asking each trusted directory for its network-status.
1006 * For caches, this means asking a random v2 authority for all
1010 update_v2_networkstatus_cache_downloads(time_t now
)
1012 int authority
= authdir_mode_v2(get_options());
1014 authority
? AUTHORITY_NS_CACHE_INTERVAL
: NONAUTHORITY_NS_CACHE_INTERVAL
;
1015 const smartlist_t
*trusted_dir_servers
= router_get_trusted_dir_servers();
1017 if (last_networkstatus_download_attempted
+ interval
>= now
)
1020 last_networkstatus_download_attempted
= now
;
1023 /* An authority launches a separate connection for everybody. */
1024 SMARTLIST_FOREACH_BEGIN(trusted_dir_servers
, trusted_dir_server_t
*, ds
)
1026 char resource
[HEX_DIGEST_LEN
+6]; /* fp/hexdigit.z\0 */
1028 if (!(ds
->type
& V2_AUTHORITY
))
1030 if (router_digest_is_me(ds
->digest
))
1032 tor_addr_from_ipv4h(&addr
, ds
->addr
);
1033 /* Is this quite sensible with IPv6 or multiple addresses? */
1034 if (connection_get_by_type_addr_port_purpose(
1035 CONN_TYPE_DIR
, &addr
, ds
->dir_port
,
1036 DIR_PURPOSE_FETCH_V2_NETWORKSTATUS
)) {
1037 /* XXX the above dir_port won't be accurate if we're
1038 * doing a tunneled conn. In that case it should be or_port.
1039 * How to guess from here? Maybe make the function less general
1040 * and have it know that it's looking for dir conns. -RD */
1041 /* Only directory caches download v2 networkstatuses, and they
1042 * don't use tunneled connections. I think it's okay to ignore
1046 strlcpy(resource
, "fp/", sizeof(resource
));
1047 base16_encode(resource
+3, sizeof(resource
)-3, ds
->digest
, DIGEST_LEN
);
1048 strlcat(resource
, ".z", sizeof(resource
));
1049 directory_initiate_command_routerstatus(
1050 &ds
->fake_status
, DIR_PURPOSE_FETCH_V2_NETWORKSTATUS
,
1051 ROUTER_PURPOSE_GENERAL
,
1052 0, /* Not private */
1054 NULL
, 0 /* No payload. */,
1057 SMARTLIST_FOREACH_END(ds
);
1059 /* A non-authority cache launches one connection to a random authority. */
1060 /* (Check whether we're currently fetching network-status objects.) */
1061 if (!connection_get_by_type_purpose(CONN_TYPE_DIR
,
1062 DIR_PURPOSE_FETCH_V2_NETWORKSTATUS
))
1063 directory_get_from_dirserver(DIR_PURPOSE_FETCH_V2_NETWORKSTATUS
,
1064 ROUTER_PURPOSE_GENERAL
, "all.z",
1065 PDS_RETRY_IF_NO_SERVERS
);
1069 /** How many times will we try to fetch a consensus before we give up? */
1070 #define CONSENSUS_NETWORKSTATUS_MAX_DL_TRIES 8
1071 /** How long will we hang onto a possibly live consensus for which we're
1072 * fetching certs before we check whether there is a better one? */
1073 #define DELAY_WHILE_FETCHING_CERTS (20*60)
1075 /** If we want to download a fresh consensus, launch a new download as
1078 update_consensus_networkstatus_downloads(time_t now
)
1080 or_options_t
*options
= get_options();
1081 if (!networkstatus_get_live_consensus(now
))
1082 time_to_download_next_consensus
= now
; /* No live consensus? Get one now!*/
1083 if (time_to_download_next_consensus
> now
)
1084 return; /* Wait until the current consensus is older. */
1085 if (authdir_mode_v3(options
))
1086 return; /* Authorities never fetch a consensus */
1087 if (!download_status_is_ready(&consensus_dl_status
, now
,
1088 CONSENSUS_NETWORKSTATUS_MAX_DL_TRIES
))
1089 return; /* We failed downloading a consensus too recently. */
1090 if (connection_get_by_type_purpose(CONN_TYPE_DIR
,
1091 DIR_PURPOSE_FETCH_CONSENSUS
))
1092 return; /* There's an in-progress download.*/
1094 if (consensus_waiting_for_certs
) {
1095 /* XXXX make sure this doesn't delay sane downloads. */
1096 if (consensus_waiting_for_certs_set_at
+ DELAY_WHILE_FETCHING_CERTS
> now
)
1097 return; /* We're still getting certs for this one. */
1099 if (!consensus_waiting_for_certs_dl_failed
) {
1100 download_status_failed(&consensus_dl_status
, 0);
1101 consensus_waiting_for_certs_dl_failed
=1;
1106 log_info(LD_DIR
, "Launching networkstatus consensus download.");
1107 directory_get_from_dirserver(DIR_PURPOSE_FETCH_CONSENSUS
,
1108 ROUTER_PURPOSE_GENERAL
, NULL
,
1109 PDS_RETRY_IF_NO_SERVERS
);
1112 /** Called when an attempt to download a consensus fails: note that the
1113 * failure occurred, and possibly retry. */
1115 networkstatus_consensus_download_failed(int status_code
)
1117 download_status_failed(&consensus_dl_status
, status_code
);
1118 /* Retry immediately, if appropriate. */
1119 update_consensus_networkstatus_downloads(time(NULL
));
1122 /** How long do we (as a cache) wait after a consensus becomes non-fresh
1123 * before trying to fetch another? */
1124 #define CONSENSUS_MIN_SECONDS_BEFORE_CACHING 120
1126 /** Update the time at which we'll consider replacing the current
1129 update_consensus_networkstatus_fetch_time(time_t now
)
1131 or_options_t
*options
= get_options();
1132 networkstatus_t
*c
= networkstatus_get_live_consensus(now
);
1135 long interval
= c
->fresh_until
- c
->valid_after
;
1136 long min_sec_before_caching
= CONSENSUS_MIN_SECONDS_BEFORE_CACHING
;
1139 if (min_sec_before_caching
> interval
/16) {
1140 /* Usually we allow 2-minutes slop factor in case clocks get
1141 desynchronized a little. If we're on a private network with
1142 a crazy-fast voting interval, though, 2 minutes may be too
1144 min_sec_before_caching
= interval
/16;
1147 if (directory_fetches_dir_info_early(options
)) {
1148 /* We want to cache the next one at some point after this one
1149 * is no longer fresh... */
1150 start
= c
->fresh_until
+ min_sec_before_caching
;
1151 /* But only in the first half-interval after that. */
1152 dl_interval
= interval
/2;
1154 /* We're an ordinary client or a bridge. Give all the caches enough
1155 * time to download the consensus. */
1156 start
= c
->fresh_until
+ (interval
*3)/4;
1157 /* But download the next one well before this one is expired. */
1158 dl_interval
= ((c
->valid_until
- start
) * 7 )/ 8;
1160 /* If we're a bridge user, make use of the numbers we just computed
1161 * to choose the rest of the interval *after* them. */
1162 if (directory_fetches_dir_info_later(options
)) {
1163 /* Give all the *clients* enough time to download the consensus. */
1164 start
= start
+ dl_interval
+ min_sec_before_caching
;
1165 /* But try to get it before ours actually expires. */
1166 dl_interval
= (c
->valid_until
- start
) - min_sec_before_caching
;
1169 if (dl_interval
< 1)
1171 /* We must not try to replace c while it's still the most valid: */
1172 tor_assert(c
->fresh_until
< start
);
1173 /* We must download the next one before c is invalid: */
1174 tor_assert(start
+dl_interval
< c
->valid_until
);
1175 time_to_download_next_consensus
= start
+crypto_rand_int((int)dl_interval
);
1177 char tbuf1
[ISO_TIME_LEN
+1];
1178 char tbuf2
[ISO_TIME_LEN
+1];
1179 char tbuf3
[ISO_TIME_LEN
+1];
1180 format_local_iso_time(tbuf1
, c
->fresh_until
);
1181 format_local_iso_time(tbuf2
, c
->valid_until
);
1182 format_local_iso_time(tbuf3
, time_to_download_next_consensus
);
1183 log_info(LD_DIR
, "Live consensus %s the most recent until %s and will "
1184 "expire at %s; fetching the next one at %s.",
1185 (c
->fresh_until
> now
) ? "will be" : "was",
1186 tbuf1
, tbuf2
, tbuf3
);
1189 time_to_download_next_consensus
= now
;
1190 log_info(LD_DIR
, "No live consensus; we should fetch one immediately.");
1195 /** Return 1 if there's a reason we shouldn't try any directory
1196 * fetches yet (e.g. we demand bridges and none are yet known).
1199 should_delay_dir_fetches(or_options_t
*options
)
1201 if (options
->UseBridges
&& !any_bridge_descriptors_known()) {
1202 log_info(LD_DIR
, "delaying dir fetches (no running bridges known)");
1208 /** Launch requests for networkstatus documents and authority certificates as
1211 update_networkstatus_downloads(time_t now
)
1213 or_options_t
*options
= get_options();
1214 if (should_delay_dir_fetches(options
))
1216 if (directory_fetches_dir_info_early(options
))
1217 update_v2_networkstatus_cache_downloads(now
);
1218 update_consensus_networkstatus_downloads(now
);
1219 update_certificate_downloads(now
);
1222 /** Launch requests as appropriate for missing directory authority
1225 update_certificate_downloads(time_t now
)
1227 if (consensus_waiting_for_certs
)
1228 authority_certs_fetch_missing(consensus_waiting_for_certs
, now
);
1230 authority_certs_fetch_missing(current_consensus
, now
);
1233 /** Return 1 if we have a consensus but we don't have enough certificates
1234 * to start using it yet. */
1236 consensus_is_waiting_for_certs(void)
1238 return consensus_waiting_for_certs
? 1 : 0;
1241 /** Return the network status with a given identity digest. */
1242 networkstatus_v2_t
*
1243 networkstatus_v2_get_by_digest(const char *digest
)
1245 SMARTLIST_FOREACH(networkstatus_v2_list
, networkstatus_v2_t
*, ns
,
1247 if (tor_memeq(ns
->identity_digest
, digest
, DIGEST_LEN
))
1253 /** Return the most recent consensus that we have downloaded, or NULL if we
1254 * don't have one. */
1256 networkstatus_get_latest_consensus(void)
1258 return current_consensus
;
1261 /** Return the most recent consensus that we have downloaded, or NULL if it is
1262 * no longer live. */
1264 networkstatus_get_live_consensus(time_t now
)
1266 if (current_consensus
&&
1267 current_consensus
->valid_after
<= now
&&
1268 now
<= current_consensus
->valid_until
)
1269 return current_consensus
;
1274 /* XXXX remove this in favor of get_live_consensus. But actually,
1275 * leave something like it for bridge users, who need to not totally
1276 * lose if they spend a while fetching a new consensus. */
1277 /** As networkstatus_get_live_consensus(), but is way more tolerant of expired
1280 networkstatus_get_reasonably_live_consensus(time_t now
)
1282 #define REASONABLY_LIVE_TIME (24*60*60)
1283 if (current_consensus
&&
1284 current_consensus
->valid_after
<= now
&&
1285 now
<= current_consensus
->valid_until
+REASONABLY_LIVE_TIME
)
1286 return current_consensus
;
1291 /** Given two router status entries for the same router identity, return 1 if
1292 * if the contents have changed between them. Otherwise, return 0. */
1294 routerstatus_has_changed(const routerstatus_t
*a
, const routerstatus_t
*b
)
1296 tor_assert(tor_memeq(a
->identity_digest
, b
->identity_digest
, DIGEST_LEN
));
1298 return strcmp(a
->nickname
, b
->nickname
) ||
1299 fast_memneq(a
->descriptor_digest
, b
->descriptor_digest
, DIGEST_LEN
) ||
1300 a
->addr
!= b
->addr
||
1301 a
->or_port
!= b
->or_port
||
1302 a
->dir_port
!= b
->dir_port
||
1303 a
->is_authority
!= b
->is_authority
||
1304 a
->is_exit
!= b
->is_exit
||
1305 a
->is_stable
!= b
->is_stable
||
1306 a
->is_fast
!= b
->is_fast
||
1307 a
->is_running
!= b
->is_running
||
1308 a
->is_named
!= b
->is_named
||
1309 a
->is_unnamed
!= b
->is_unnamed
||
1310 a
->is_valid
!= b
->is_valid
||
1311 a
->is_v2_dir
!= b
->is_v2_dir
||
1312 a
->is_possible_guard
!= b
->is_possible_guard
||
1313 a
->is_bad_exit
!= b
->is_bad_exit
||
1314 a
->is_bad_directory
!= b
->is_bad_directory
||
1315 a
->is_hs_dir
!= b
->is_hs_dir
||
1316 a
->version_known
!= b
->version_known
||
1317 a
->version_supports_begindir
!= b
->version_supports_begindir
||
1318 a
->version_supports_extrainfo_upload
!=
1319 b
->version_supports_extrainfo_upload
||
1320 a
->version_supports_conditional_consensus
!=
1321 b
->version_supports_conditional_consensus
||
1322 a
->version_supports_v3_dir
!= b
->version_supports_v3_dir
;
1325 /** Notify controllers of any router status entries that changed between
1326 * <b>old_c</b> and <b>new_c</b>. */
1328 notify_control_networkstatus_changed(const networkstatus_t
*old_c
,
1329 const networkstatus_t
*new_c
)
1331 smartlist_t
*changed
;
1335 /* tell the controller exactly which relays are still listed, as well
1336 * as what they're listed as */
1337 control_event_newconsensus(new_c
);
1339 if (!control_event_is_interesting(EVENT_NS
))
1343 control_event_networkstatus_changed(new_c
->routerstatus_list
);
1346 changed
= smartlist_create();
1348 SMARTLIST_FOREACH_JOIN(old_c
->routerstatus_list
, routerstatus_t
*, rs_old
,
1349 new_c
->routerstatus_list
, routerstatus_t
*, rs_new
,
1350 tor_memcmp(rs_old
->identity_digest
,
1351 rs_new
->identity_digest
, DIGEST_LEN
),
1352 smartlist_add(changed
, rs_new
)) {
1353 if (routerstatus_has_changed(rs_old
, rs_new
))
1354 smartlist_add(changed
, rs_new
);
1355 } SMARTLIST_FOREACH_JOIN_END(rs_old
, rs_new
);
1357 control_event_networkstatus_changed(changed
);
1358 smartlist_free(changed
);
1361 /** Copy all the ancillary information (like router download status and so on)
1362 * from <b>old_c</b> to <b>new_c</b>. */
1364 networkstatus_copy_old_consensus_info(networkstatus_t
*new_c
,
1365 const networkstatus_t
*old_c
)
1369 if (!old_c
|| !smartlist_len(old_c
->routerstatus_list
))
1372 SMARTLIST_FOREACH_JOIN(old_c
->routerstatus_list
, routerstatus_t
*, rs_old
,
1373 new_c
->routerstatus_list
, routerstatus_t
*, rs_new
,
1374 tor_memcmp(rs_old
->identity_digest
,
1375 rs_new
->identity_digest
, DIGEST_LEN
),
1377 /* Okay, so we're looking at the same identity. */
1378 rs_new
->name_lookup_warned
= rs_old
->name_lookup_warned
;
1379 rs_new
->last_dir_503_at
= rs_old
->last_dir_503_at
;
1381 if (tor_memeq(rs_old
->descriptor_digest
, rs_new
->descriptor_digest
,
1383 /* And the same descriptor too! */
1384 memcpy(&rs_new
->dl_status
, &rs_old
->dl_status
,sizeof(download_status_t
));
1386 } SMARTLIST_FOREACH_JOIN_END(rs_old
, rs_new
);
1389 /** Try to replace the current cached v3 networkstatus with the one in
1390 * <b>consensus</b>. If we don't have enough certificates to validate it,
1391 * store it in consensus_waiting_for_certs and launch a certificate fetch.
1393 * If flags & NSSET_FROM_CACHE, this networkstatus has come from the disk
1394 * cache. If flags & NSSET_WAS_WAITING_FOR_CERTS, this networkstatus was
1395 * already received, but we were waiting for certificates on it. If flags &
1396 * NSSET_DONT_DOWNLOAD_CERTS, do not launch certificate downloads as needed.
1397 * If flags & NSSET_ACCEPT_OBSOLETE, then we should be willing to take this
1398 * consensus, even if it comes from many days in the past.
1400 * Return 0 on success, <0 on failure. On failure, caller should increment
1401 * the failure count as appropriate.
1403 * We return -1 for mild failures that don't need to be reported to the
1404 * user, and -2 for more serious problems.
1407 networkstatus_set_current_consensus(const char *consensus
, unsigned flags
)
1411 time_t now
= time(NULL
);
1412 char *unverified_fname
= NULL
, *consensus_fname
= NULL
;
1413 const unsigned from_cache
= flags
& NSSET_FROM_CACHE
;
1414 const unsigned was_waiting_for_certs
= flags
& NSSET_WAS_WAITING_FOR_CERTS
;
1415 const unsigned dl_certs
= !(flags
& NSSET_DONT_DOWNLOAD_CERTS
);
1416 const unsigned accept_obsolete
= flags
& NSSET_ACCEPT_OBSOLETE
;
1418 /* Make sure it's parseable. */
1419 c
= networkstatus_parse_vote_from_string(consensus
, NULL
, NS_TYPE_CONSENSUS
);
1421 log_warn(LD_DIR
, "Unable to parse networkstatus consensus");
1426 if (from_cache
&& !accept_obsolete
&&
1427 c
->valid_until
< now
-OLD_ROUTER_DESC_MAX_AGE
) {
1428 /* XXX022 when we try to make fallbackconsensus work again, we should
1429 * consider taking this out. Until then, believing obsolete consensuses
1430 * is causing more harm than good. See also bug 887. */
1431 log_info(LD_DIR
, "Loaded an obsolete consensus. Discarding.");
1435 if (current_consensus
&&
1436 tor_memeq(c
->networkstatus_digest
,
1437 current_consensus
->networkstatus_digest
,
1439 /* We already have this one. That's a failure. */
1440 log_info(LD_DIR
, "Got a consensus we already have");
1444 if (current_consensus
&& c
->valid_after
<= current_consensus
->valid_after
) {
1445 /* We have a newer one. There's no point in accepting this one,
1446 * even if it's great. */
1447 log_info(LD_DIR
, "Got a consensus at least as old as the one we have");
1451 consensus_fname
= get_datadir_fname("cached-consensus");
1452 unverified_fname
= get_datadir_fname("unverified-consensus");
1454 /* Make sure it's signed enough. */
1455 if ((r
=networkstatus_check_consensus_signature(c
, 1))<0) {
1457 /* Okay, so it _might_ be signed enough if we get more certificates. */
1458 if (!was_waiting_for_certs
) {
1460 "Not enough certificates to check networkstatus consensus");
1462 if (!current_consensus
||
1463 c
->valid_after
> current_consensus
->valid_after
) {
1464 if (consensus_waiting_for_certs
)
1465 networkstatus_vote_free(consensus_waiting_for_certs
);
1466 tor_free(consensus_waiting_for_certs_body
);
1467 consensus_waiting_for_certs
= c
;
1468 c
= NULL
; /* Prevent free. */
1469 consensus_waiting_for_certs_body
= tor_strdup(consensus
);
1470 consensus_waiting_for_certs_set_at
= now
;
1471 consensus_waiting_for_certs_dl_failed
= 0;
1473 write_str_to_file(unverified_fname
, consensus
, 0);
1476 authority_certs_fetch_missing(c
, now
);
1477 /* This case is not a success or a failure until we get the certs
1478 * or fail to get the certs. */
1481 /* Even if we had enough signatures, we'd never use this as the
1482 * latest consensus. */
1483 if (was_waiting_for_certs
&& from_cache
)
1484 unlink(unverified_fname
);
1488 /* This can never be signed enough: Kill it. */
1489 if (!was_waiting_for_certs
) {
1490 log_warn(LD_DIR
, "Not enough good signatures on networkstatus "
1494 if (was_waiting_for_certs
&& (r
< -1) && from_cache
)
1495 unlink(unverified_fname
);
1501 control_event_client_status(LOG_NOTICE
, "CONSENSUS_ARRIVED");
1503 /* Are we missing any certificates at all? */
1504 if (r
!= 1 && dl_certs
)
1505 authority_certs_fetch_missing(c
, now
);
1507 notify_control_networkstatus_changed(current_consensus
, c
);
1509 if (current_consensus
) {
1510 networkstatus_copy_old_consensus_info(c
, current_consensus
);
1511 networkstatus_vote_free(current_consensus
);
1514 if (consensus_waiting_for_certs
&&
1515 consensus_waiting_for_certs
->valid_after
<= c
->valid_after
) {
1516 networkstatus_vote_free(consensus_waiting_for_certs
);
1517 consensus_waiting_for_certs
= NULL
;
1518 if (consensus
!= consensus_waiting_for_certs_body
)
1519 tor_free(consensus_waiting_for_certs_body
);
1521 consensus_waiting_for_certs_body
= NULL
;
1522 consensus_waiting_for_certs_set_at
= 0;
1523 consensus_waiting_for_certs_dl_failed
= 0;
1524 unlink(unverified_fname
);
1527 /* Reset the failure count only if this consensus is actually valid. */
1528 if (c
->valid_after
<= now
&& now
<= c
->valid_until
) {
1529 download_status_reset(&consensus_dl_status
);
1532 download_status_failed(&consensus_dl_status
, 0);
1535 current_consensus
= c
;
1536 c
= NULL
; /* Prevent free. */
1538 update_consensus_networkstatus_fetch_time(now
);
1539 dirvote_recalculate_timing(get_options(), now
);
1540 routerstatus_list_update_named_server_map();
1543 write_str_to_file(consensus_fname
, consensus
, 0);
1546 if (directory_caches_dir_info(get_options()))
1547 dirserv_set_cached_networkstatus_v3(consensus
,
1548 current_consensus
->valid_after
);
1550 if (ftime_definitely_before(now
, current_consensus
->valid_after
)) {
1551 char tbuf
[ISO_TIME_LEN
+1];
1553 long delta
= now
- current_consensus
->valid_after
;
1554 format_iso_time(tbuf
, current_consensus
->valid_after
);
1555 format_time_interval(dbuf
, sizeof(dbuf
), delta
);
1556 log_warn(LD_GENERAL
, "Our clock is %s behind the time published in the "
1557 "consensus network status document (%s GMT). Tor needs an "
1558 "accurate clock to work correctly. Please check your time and "
1559 "date settings!", dbuf
, tbuf
);
1560 control_event_general_status(LOG_WARN
,
1561 "CLOCK_SKEW MIN_SKEW=%ld SOURCE=CONSENSUS", delta
);
1564 router_dir_info_changed();
1569 networkstatus_vote_free(c
);
1570 tor_free(consensus_fname
);
1571 tor_free(unverified_fname
);
1575 /** Called when we have gotten more certificates: see whether we can
1576 * now verify a pending consensus. */
1578 networkstatus_note_certs_arrived(void)
1580 if (consensus_waiting_for_certs
) {
1581 if (networkstatus_check_consensus_signature(
1582 consensus_waiting_for_certs
, 0)>=0) {
1583 if (!networkstatus_set_current_consensus(
1584 consensus_waiting_for_certs_body
,
1585 NSSET_WAS_WAITING_FOR_CERTS
)) {
1586 tor_free(consensus_waiting_for_certs_body
);
1592 /** If the network-status list has changed since the last time we called this
1593 * function, update the status of every routerinfo from the network-status
1594 * list. If <b>dir_version</b> is 2, it's a v2 networkstatus that changed.
1595 * If <b>dir_version</b> is 3, it's a v3 consensus that changed.
1598 routers_update_all_from_networkstatus(time_t now
, int dir_version
)
1600 routerlist_t
*rl
= router_get_routerlist();
1601 networkstatus_t
*consensus
= networkstatus_get_live_consensus(now
);
1603 if (networkstatus_v2_list_has_changed
)
1604 download_status_map_update_from_v2_networkstatus();
1606 if (!consensus
|| dir_version
< 3) /* nothing more we should do */
1609 /* calls router_dir_info_changed() when it's done -- more routers
1610 * might be up or down now, which might affect whether there's enough
1611 * directory info. */
1612 routers_update_status_from_consensus_networkstatus(rl
->routers
, 0);
1614 SMARTLIST_FOREACH(rl
->routers
, routerinfo_t
*, ri
,
1615 ri
->cache_info
.routerlist_index
= ri_sl_idx
);
1616 if (rl
->old_routers
)
1617 signed_descs_update_status_from_consensus_networkstatus(rl
->old_routers
);
1619 if (!have_warned_about_old_version
) {
1620 int is_server
= server_mode(get_options());
1621 version_status_t status
;
1622 const char *recommended
= is_server
?
1623 consensus
->server_versions
: consensus
->client_versions
;
1624 status
= tor_version_is_obsolete(VERSION
, recommended
);
1626 if (status
== VS_RECOMMENDED
) {
1627 log_info(LD_GENERAL
, "The directory authorities say my version is ok.");
1628 } else if (status
== VS_EMPTY
) {
1629 log_info(LD_GENERAL
,
1630 "The directory authorities don't recommend any versions.");
1631 } else if (status
== VS_NEW
|| status
== VS_NEW_IN_SERIES
) {
1632 if (!have_warned_about_new_version
) {
1633 log_notice(LD_GENERAL
, "This version of Tor (%s) is newer than any "
1634 "recommended version%s, according to the directory "
1635 "authorities. Recommended versions are: %s",
1637 status
== VS_NEW_IN_SERIES
? " in its series" : "",
1639 have_warned_about_new_version
= 1;
1640 control_event_general_status(LOG_WARN
, "DANGEROUS_VERSION "
1641 "CURRENT=%s REASON=%s RECOMMENDED=\"%s\"",
1642 VERSION
, "NEW", recommended
);
1645 log_warn(LD_GENERAL
, "Please upgrade! "
1646 "This version of Tor (%s) is %s, according to the directory "
1647 "authorities. Recommended versions are: %s",
1649 status
== VS_OLD
? "obsolete" : "not recommended",
1651 have_warned_about_old_version
= 1;
1652 control_event_general_status(LOG_WARN
, "DANGEROUS_VERSION "
1653 "CURRENT=%s REASON=%s RECOMMENDED=\"%s\"",
1654 VERSION
, status
== VS_OLD
? "OBSOLETE" : "UNRECOMMENDED",
1660 /** Update v2_download_status_map to contain an entry for every router
1661 * descriptor listed in the v2 networkstatuses. */
1663 download_status_map_update_from_v2_networkstatus(void)
1665 digestmap_t
*dl_status
;
1666 if (!networkstatus_v2_list
)
1668 if (!v2_download_status_map
)
1669 v2_download_status_map
= digestmap_new();
1671 dl_status
= digestmap_new();
1672 SMARTLIST_FOREACH(networkstatus_v2_list
, networkstatus_v2_t
*, ns
,
1674 SMARTLIST_FOREACH(ns
->entries
, routerstatus_t
*, rs
,
1676 const char *d
= rs
->descriptor_digest
;
1677 download_status_t
*s
;
1678 if (digestmap_get(dl_status
, d
))
1680 if (!(s
= digestmap_remove(v2_download_status_map
, d
))) {
1681 s
= tor_malloc_zero(sizeof(download_status_t
));
1683 digestmap_set(dl_status
, d
, s
);
1686 digestmap_free(v2_download_status_map
, _tor_free
);
1687 v2_download_status_map
= dl_status
;
1688 networkstatus_v2_list_has_changed
= 0;
1691 /** Update our view of the list of named servers from the most recently
1692 * retrieved networkstatus consensus. */
1694 routerstatus_list_update_named_server_map(void)
1696 if (!current_consensus
)
1699 if (named_server_map
)
1700 strmap_free(named_server_map
, _tor_free
);
1701 named_server_map
= strmap_new();
1702 if (unnamed_server_map
)
1703 strmap_free(unnamed_server_map
, NULL
);
1704 unnamed_server_map
= strmap_new();
1705 SMARTLIST_FOREACH(current_consensus
->routerstatus_list
, routerstatus_t
*, rs
,
1708 strmap_set_lc(named_server_map
, rs
->nickname
,
1709 tor_memdup(rs
->identity_digest
, DIGEST_LEN
));
1711 if (rs
->is_unnamed
) {
1712 strmap_set_lc(unnamed_server_map
, rs
->nickname
, (void*)1);
1717 /** Given a list <b>routers</b> of routerinfo_t *, update each status field
1718 * according to our current consensus networkstatus. May re-order
1719 * <b>routers</b>. */
1721 routers_update_status_from_consensus_networkstatus(smartlist_t
*routers
,
1724 trusted_dir_server_t
*ds
;
1725 or_options_t
*options
= get_options();
1726 int authdir
= authdir_mode_v2(options
) || authdir_mode_v3(options
);
1727 int namingdir
= authdir
&& options
->NamingAuthoritativeDir
;
1728 networkstatus_t
*ns
= current_consensus
;
1729 if (!ns
|| !smartlist_len(ns
->routerstatus_list
))
1731 if (!networkstatus_v2_list
)
1732 networkstatus_v2_list
= smartlist_create();
1734 routers_sort_by_identity(routers
);
1736 SMARTLIST_FOREACH_JOIN(ns
->routerstatus_list
, routerstatus_t
*, rs
,
1737 routers
, routerinfo_t
*, router
,
1738 tor_memcmp(rs
->identity_digest
,
1739 router
->cache_info
.identity_digest
, DIGEST_LEN
),
1741 /* We have no routerstatus for this router. Clear flags and skip it. */
1743 router
->is_named
= 0;
1745 if (router
->purpose
== ROUTER_PURPOSE_GENERAL
)
1746 router_clear_status_flags(router
);
1749 /* We have a routerstatus for this router. */
1750 const char *digest
= router
->cache_info
.identity_digest
;
1752 ds
= router_get_trusteddirserver_by_digest(digest
);
1755 if (rs
->is_named
&& !strcasecmp(router
->nickname
, rs
->nickname
))
1756 router
->is_named
= 1;
1758 router
->is_named
= 0;
1760 /* Is it the same descriptor, or only the same identity? */
1761 if (tor_memeq(router
->cache_info
.signed_descriptor_digest
,
1762 rs
->descriptor_digest
, DIGEST_LEN
)) {
1763 if (ns
->valid_until
> router
->cache_info
.last_listed_as_valid_until
)
1764 router
->cache_info
.last_listed_as_valid_until
= ns
->valid_until
;
1768 /* If we're not an authdir, believe others. */
1769 router
->is_valid
= rs
->is_valid
;
1770 router
->is_running
= rs
->is_running
;
1771 router
->is_fast
= rs
->is_fast
;
1772 router
->is_stable
= rs
->is_stable
;
1773 router
->is_possible_guard
= rs
->is_possible_guard
;
1774 router
->is_exit
= rs
->is_exit
;
1775 router
->is_bad_directory
= rs
->is_bad_directory
;
1776 router
->is_bad_exit
= rs
->is_bad_exit
;
1777 router
->is_hs_dir
= rs
->is_hs_dir
;
1779 if (router
->is_running
&& ds
) {
1780 download_status_reset(&ds
->v2_ns_dl_status
);
1782 if (reset_failures
) {
1783 download_status_reset(&rs
->dl_status
);
1785 } SMARTLIST_FOREACH_JOIN_END(rs
, router
);
1787 /* Now update last_listed_as_valid_until from v2 networkstatuses. */
1788 /* XXXX If this is slow, we need to rethink the code. */
1789 SMARTLIST_FOREACH(networkstatus_v2_list
, networkstatus_v2_t
*, ns
, {
1790 time_t live_until
= ns
->published_on
+ V2_NETWORKSTATUS_ROUTER_LIFETIME
;
1791 SMARTLIST_FOREACH_JOIN(ns
->entries
, routerstatus_t
*, rs
,
1792 routers
, routerinfo_t
*, ri
,
1793 tor_memcmp(rs
->identity_digest
,
1794 ri
->cache_info
.identity_digest
, DIGEST_LEN
),
1796 if (tor_memeq(ri
->cache_info
.signed_descriptor_digest
,
1797 rs
->descriptor_digest
, DIGEST_LEN
)) {
1798 if (live_until
> ri
->cache_info
.last_listed_as_valid_until
)
1799 ri
->cache_info
.last_listed_as_valid_until
= live_until
;
1801 } SMARTLIST_FOREACH_JOIN_END(rs
, ri
);
1804 router_dir_info_changed();
1807 /** Given a list of signed_descriptor_t, update their fields (mainly, when
1808 * they were last listed) from the most recent consensus. */
1810 signed_descs_update_status_from_consensus_networkstatus(smartlist_t
*descs
)
1812 networkstatus_t
*ns
= current_consensus
;
1816 if (!ns
->desc_digest_map
) {
1817 char dummy
[DIGEST_LEN
];
1818 /* instantiates the digest map. */
1819 memset(dummy
, 0, sizeof(dummy
));
1820 router_get_consensus_status_by_descriptor_digest(dummy
);
1822 SMARTLIST_FOREACH(descs
, signed_descriptor_t
*, d
,
1824 routerstatus_t
*rs
= digestmap_get(ns
->desc_digest_map
,
1825 d
->signed_descriptor_digest
);
1827 if (ns
->valid_until
> d
->last_listed_as_valid_until
)
1828 d
->last_listed_as_valid_until
= ns
->valid_until
;
1833 /** Generate networkstatus lines for a single routerstatus_t object, and
1834 * return the result in a newly allocated string. Used only by controller
1835 * interface (for now.) */
1837 networkstatus_getinfo_helper_single(routerstatus_t
*rs
)
1839 char buf
[RS_ENTRY_LEN
+1];
1840 routerstatus_format_entry(buf
, sizeof(buf
), rs
, NULL
, 0, 1);
1841 return tor_strdup(buf
);
1844 /** Alloc and return a string describing routerstatuses for the most
1845 * recent info of each router we know about that is of purpose
1846 * <b>purpose_string</b>. Return NULL if unrecognized purpose.
1848 * Right now this function is oriented toward listing bridges (you
1849 * shouldn't use this for general-purpose routers, since those
1850 * should be listed from the consensus, not from the routers list). */
1852 networkstatus_getinfo_by_purpose(const char *purpose_string
, time_t now
)
1854 time_t cutoff
= now
- ROUTER_MAX_AGE_TO_PUBLISH
;
1856 routerlist_t
*rl
= router_get_routerlist();
1857 smartlist_t
*statuses
;
1858 uint8_t purpose
= router_purpose_from_string(purpose_string
);
1860 int bridge_auth
= authdir_mode_bridge(get_options());
1862 if (purpose
== ROUTER_PURPOSE_UNKNOWN
) {
1863 log_info(LD_DIR
, "Unrecognized purpose '%s' when listing router statuses.",
1868 statuses
= smartlist_create();
1869 SMARTLIST_FOREACH(rl
->routers
, routerinfo_t
*, ri
, {
1870 if (ri
->cache_info
.published_on
< cutoff
)
1872 if (ri
->purpose
!= purpose
)
1874 if (bridge_auth
&& ri
->purpose
== ROUTER_PURPOSE_BRIDGE
)
1875 dirserv_set_router_is_running(ri
, now
);
1876 /* then generate and write out status lines for each of them */
1877 set_routerstatus_from_routerinfo(&rs
, ri
, now
, 0, 0, 0, 0);
1878 smartlist_add(statuses
, networkstatus_getinfo_helper_single(&rs
));
1881 answer
= smartlist_join_strings(statuses
, "", 0, NULL
);
1882 SMARTLIST_FOREACH(statuses
, char *, cp
, tor_free(cp
));
1883 smartlist_free(statuses
);
1887 /** Write out router status entries for all our bridge descriptors. */
1889 networkstatus_dump_bridge_status_to_file(time_t now
)
1891 char *status
= networkstatus_getinfo_by_purpose("bridge", now
);
1892 or_options_t
*options
= get_options();
1893 size_t len
= strlen(options
->DataDirectory
) + 32;
1894 char *fname
= tor_malloc(len
);
1895 tor_snprintf(fname
, len
, "%s"PATH_SEPARATOR
"networkstatus-bridges",
1896 options
->DataDirectory
);
1897 write_str_to_file(fname
,status
,0);
1902 /** Return the value of a integer parameter from the networkstatus <b>ns</b>
1903 * whose name is <b>param_name</b>. If <b>ns</b> is NULL, try loading the
1904 * latest consensus ourselves. Return <b>default_val</b> if no latest
1905 * consensus, or if it has no parameter called <b>param_name</b>. */
1907 networkstatus_get_param(networkstatus_t
*ns
, const char *param_name
,
1908 int32_t default_val
)
1912 if (!ns
) /* if they pass in null, go find it ourselves */
1913 ns
= networkstatus_get_latest_consensus();
1915 if (!ns
|| !ns
->net_params
)
1918 name_len
= strlen(param_name
);
1920 SMARTLIST_FOREACH_BEGIN(ns
->net_params
, const char *, p
) {
1921 if (!strcmpstart(p
, param_name
) && p
[name_len
] == '=') {
1923 long v
= tor_parse_long(p
+name_len
+1, 10, INT32_MIN
, INT32_MAX
, &ok
,
1928 } SMARTLIST_FOREACH_END(p
);
1933 /** If <b>question</b> is a string beginning with "ns/" in a format the
1934 * control interface expects for a GETINFO question, set *<b>answer</b> to a
1935 * newly-allocated string containing networkstatus lines for the appropriate
1936 * ORs. Return 0 on success, -1 on unrecognized question format. */
1938 getinfo_helper_networkstatus(control_connection_t
*conn
,
1939 const char *question
, char **answer
)
1941 routerstatus_t
*status
;
1944 if (!current_consensus
) {
1945 *answer
= tor_strdup("");
1949 if (!strcmp(question
, "ns/all")) {
1950 smartlist_t
*statuses
= smartlist_create();
1951 SMARTLIST_FOREACH(current_consensus
->routerstatus_list
,
1952 routerstatus_t
*, rs
,
1954 smartlist_add(statuses
, networkstatus_getinfo_helper_single(rs
));
1956 *answer
= smartlist_join_strings(statuses
, "", 0, NULL
);
1957 SMARTLIST_FOREACH(statuses
, char *, cp
, tor_free(cp
));
1958 smartlist_free(statuses
);
1960 } else if (!strcmpstart(question
, "ns/id/")) {
1963 if (base16_decode(d
, DIGEST_LEN
, question
+6, strlen(question
+6)))
1965 status
= router_get_consensus_status_by_id(d
);
1966 } else if (!strcmpstart(question
, "ns/name/")) {
1967 status
= router_get_consensus_status_by_nickname(question
+8, 0);
1968 } else if (!strcmpstart(question
, "ns/purpose/")) {
1969 *answer
= networkstatus_getinfo_by_purpose(question
+11, time(NULL
));
1970 return *answer
? 0 : -1;
1976 *answer
= networkstatus_getinfo_helper_single(status
);
1980 /** Free all storage held locally in this module. */
1982 networkstatus_free_all(void)
1984 if (networkstatus_v2_list
) {
1985 SMARTLIST_FOREACH(networkstatus_v2_list
, networkstatus_v2_t
*, ns
,
1986 networkstatus_v2_free(ns
));
1987 smartlist_free(networkstatus_v2_list
);
1988 networkstatus_v2_list
= NULL
;
1990 if (v2_download_status_map
) {
1991 digestmap_free(v2_download_status_map
, _tor_free
);
1992 v2_download_status_map
= NULL
;
1994 if (current_consensus
) {
1995 networkstatus_vote_free(current_consensus
);
1996 current_consensus
= NULL
;
1998 if (consensus_waiting_for_certs
) {
1999 networkstatus_vote_free(consensus_waiting_for_certs
);
2000 consensus_waiting_for_certs
= NULL
;
2002 tor_free(consensus_waiting_for_certs_body
);
2003 if (named_server_map
) {
2004 strmap_free(named_server_map
, _tor_free
);
2006 if (unnamed_server_map
) {
2007 strmap_free(unnamed_server_map
, NULL
);