src/app/main/main.c

   1 /* Copyright (c) 2001 Matej Pfajfar.
   2  * Copyright (c) 2001-2004, Roger Dingledine.
   3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
   4  * Copyright (c) 2007-2021, The Tor Project, Inc. */
   5 /* See LICENSE for licensing information */
   6
   7 /**
   8  * \file main.c
   9  * \brief Invocation module.  Initializes subsystems and runs the main loop.
  10  **/
  11
  12 #include "core/or/or.h"
  13
  14 #include "app/config/config.h"
  15 #include "app/config/statefile.h"
  16 #include "app/config/quiet_level.h"
  17 #include "app/main/main.h"
  18 #include "app/main/ntmain.h"
  19 #include "app/main/risky_options.h"
  20 #include "app/main/shutdown.h"
  21 #include "app/main/subsysmgr.h"
  22 #include "core/mainloop/connection.h"
  23 #include "core/mainloop/cpuworker.h"
  24 #include "core/mainloop/mainloop.h"
  25 #include "core/mainloop/mainloop_pubsub.h"
  26 #include "core/mainloop/netstatus.h"
  27 #include "core/or/channel.h"
  28 #include "core/or/channelpadding.h"
  29 #include "core/or/circuitpadding.h"
  30 #include "core/or/congestion_control_common.h"
  31 #include "core/or/congestion_control_flow.h"
  32 #include "core/or/circuitlist.h"
  33 #include "core/or/command.h"
  34 #include "core/or/connection_or.h"
  35 #include "core/or/relay.h"
  36 #include "core/or/status.h"
  37 #include "feature/api/tor_api.h"
  38 #include "feature/api/tor_api_internal.h"
  39 #include "feature/client/addressmap.h"
  40 #include "feature/control/control.h"
  41 #include "feature/control/control_auth.h"
  42 #include "feature/control/control_events.h"
  43 #include "feature/dirauth/keypin.h"
  44 #include "feature/dirauth/process_descs.h"
  45 #include "feature/dircache/consdiffmgr.h"
  46 #include "feature/dirparse/routerparse.h"
  47 #include "feature/hibernate/hibernate.h"
  48 #include "feature/hs/hs_dos.h"
  49 #include "feature/hs/hs_service.h"
  50 #include "feature/nodelist/authcert.h"
  51 #include "feature/nodelist/networkstatus.h"
  52 #include "feature/nodelist/routerlist.h"
  53 #include "feature/relay/dns.h"
  54 #include "feature/relay/ext_orport.h"
  55 #include "feature/relay/routerkeys.h"
  56 #include "feature/relay/routermode.h"
  57 #include "feature/stats/predict_ports.h"
  58 #include "feature/stats/bwhist.h"
  59 #include "feature/stats/rephist.h"
  60 #include "lib/compress/compress.h"
  61 #include "lib/buf/buffers.h"
  62 #include "lib/crypt_ops/crypto_format.h"
  63 #include "lib/crypt_ops/crypto_rand.h"
  64 #include "lib/crypt_ops/crypto_s2k.h"
  65 #include "lib/net/resolve.h"
  66 #include "lib/trace/trace.h"
  67
  68 #include "lib/process/waitpid.h"
  69 #include "lib/pubsub/pubsub_build.h"
  70
  71 #include "lib/meminfo/meminfo.h"
  72 #include "lib/osinfo/uname.h"
  73 #include "lib/osinfo/libc.h"
  74 #include "lib/sandbox/sandbox.h"
  75 #include "lib/fs/lockfile.h"
  76 #include "lib/tls/tortls.h"
  77 #include "lib/evloop/compat_libevent.h"
  78 #include "lib/encoding/confline.h"
  79 #include "lib/evloop/timers.h"
  80 #include "lib/crypt_ops/crypto_init.h"
  81 #include "lib/version/torversion.h"
  82
  83 #include <event2/event.h>
  84
  85 #include "feature/dirauth/authmode.h"
  86 #include "feature/dirauth/shared_random.h"
  87
  88 #include "core/or/or_connection_st.h"
  89 #include "core/or/port_cfg_st.h"
  90
  91 #ifdef HAVE_UNISTD_H
  92 #include <unistd.h>
  93 #endif
  94
  95 #ifdef HAVE_SYSTEMD
  96 #   if defined(__COVERITY__) && !defined(__INCLUDE_LEVEL__)
  97 /* Systemd's use of gcc's __INCLUDE_LEVEL__ extension macro appears to confuse
  98  * Coverity. Here's a kludge to unconfuse it.
  99  */
 100 #   define __INCLUDE_LEVEL__ 2
 101 #endif /* defined(__COVERITY__) && !defined(__INCLUDE_LEVEL__) */
 102 #include <systemd/sd-daemon.h>
 103 #endif /* defined(HAVE_SYSTEMD) */
 104
 105 /********* PROTOTYPES **********/
 106
 107 static void dumpmemusage(int severity);
 108 static void dumpstats(int severity); /* log stats */
 109 static void process_signal(int sig);
 110
 111 /** Called when we get a SIGHUP: reload configuration files and keys,
 112  * retry all connections, and so on. */
 113 static int
 114 do_hup(void)
 115 {
 116   const or_options_t *options = get_options();
 117
 118   log_notice(LD_GENERAL,"Received reload signal (hup). Reloading config and "
 119              "resetting internal state.");
 120   if (accounting_is_enabled(options))
 121     accounting_record_bandwidth_usage(time(NULL), get_or_state());
 122
 123   router_reset_warnings();
 124   routerlist_reset_warnings();
 125   /* first, reload config variables, in case they've changed */
 126   if (options->ReloadTorrcOnSIGHUP) {
 127     /* no need to provide argc/v, they've been cached in init_from_config */
 128     int init_rv = options_init_from_torrc(0, NULL);
 129     if (init_rv < 0) {
 130       log_err(LD_CONFIG,"Reading config failed--see warnings above. "
 131               "For usage, try -h.");
 132       return -1;
 133     } else if (BUG(init_rv > 0)) {
 134       // LCOV_EXCL_START
 135       /* This should be impossible: the only "return 1" cases in
 136        * options_init_from_torrc are ones caused by command-line arguments;
 137        * but they can't change while Tor is running. */
 138       return -1;
 139       // LCOV_EXCL_STOP
 140     }
 141     options = get_options(); /* they have changed now */
 142     /* Logs are only truncated the first time they are opened, but were
 143        probably intended to be cleaned up on signal. */
 144     if (options->TruncateLogFile)
 145       truncate_logs();
 146   } else {
 147     char *msg = NULL;
 148     log_notice(LD_GENERAL, "Not reloading config file: the controller told "
 149                "us not to.");
 150     /* Make stuff get rescanned, reloaded, etc. */
 151     if (set_options((or_options_t*)options, &msg) < 0) {
 152       if (!msg)
 153         msg = tor_strdup("Unknown error");
 154       log_warn(LD_GENERAL, "Unable to re-set previous options: %s", msg);
 155       tor_free(msg);
 156     }
 157   }
 158   if (authdir_mode(options)) {
 159     /* reload the approved-routers file */
 160     if (dirserv_load_fingerprint_file() < 0) {
 161       /* warnings are logged from dirserv_load_fingerprint_file() directly */
 162       log_info(LD_GENERAL, "Error reloading fingerprints. "
 163                "Continuing with old list.");
 164     }
 165   }
 166
 167   /* Rotate away from the old dirty circuits. This has to be done
 168    * after we've read the new options, but before we start using
 169    * circuits for directory fetches. */
 170   circuit_mark_all_dirty_circs_as_unusable();
 171
 172   /* retry appropriate downloads */
 173   router_reset_status_download_failures();
 174   router_reset_descriptor_download_failures();
 175   if (!net_is_disabled())
 176     update_networkstatus_downloads(time(NULL));
 177
 178   /* We'll retry routerstatus downloads in about 10 seconds; no need to
 179    * force a retry there. */
 180
 181   if (server_mode(options)) {
 182     /* Maybe we've been given a new ed25519 key or certificate?
 183      */
 184     time_t now = approx_time();
 185     int new_signing_key = load_ed_keys(options, now);
 186     if (new_signing_key < 0 ||
 187         generate_ed_link_cert(options, now, new_signing_key > 0)) {
 188       log_warn(LD_OR, "Problem reloading Ed25519 keys; still using old keys.");
 189     }
 190
 191     /* Update cpuworker and dnsworker processes, so they get up-to-date
 192      * configuration options. */
 193     cpuworkers_rotate_keyinfo();
 194     dns_reset();
 195   }
 196   return 0;
 197 }
 198
 199 /** Libevent callback: invoked when we get a signal.
 200  */
 201 static void
 202 signal_callback(evutil_socket_t fd, short events, void *arg)
 203 {
 204   const int *sigptr = arg;
 205   const int sig = *sigptr;
 206   (void)fd;
 207   (void)events;
 208
 209   update_current_time(time(NULL));
 210   process_signal(sig);
 211 }
 212
 213 /** Do the work of acting on a signal received in <b>sig</b> */
 214 static void
 215 process_signal(int sig)
 216 {
 217   switch (sig)
 218     {
 219     case SIGTERM:
 220       log_notice(LD_GENERAL,"Catching signal TERM, exiting cleanly.");
 221       tor_shutdown_event_loop_and_exit(0);
 222       break;
 223     case SIGINT:
 224       if (!server_mode(get_options())) { /* do it now */
 225         log_notice(LD_GENERAL,"Interrupt: exiting cleanly.");
 226         tor_shutdown_event_loop_and_exit(0);
 227         return;
 228       }
 229 #ifdef HAVE_SYSTEMD
 230       sd_notify(0, "STOPPING=1");
 231 #endif
 232       hibernate_begin_shutdown();
 233       break;
 234 #ifdef SIGPIPE
 235     case SIGPIPE:
 236       log_debug(LD_GENERAL,"Caught SIGPIPE. Ignoring.");
 237       break;
 238 #endif
 239     case SIGUSR1:
 240       /* prefer to log it at INFO, but make sure we always see it */
 241       dumpstats(get_min_log_level()<LOG_INFO ? get_min_log_level() : LOG_INFO);
 242       control_event_signal(sig);
 243       break;
 244     case SIGUSR2:
 245       switch_logs_debug();
 246       log_debug(LD_GENERAL,"Caught USR2, going to loglevel debug. "
 247                 "Send HUP to change back.");
 248       control_event_signal(sig);
 249       break;
 250     case SIGHUP:
 251 #ifdef HAVE_SYSTEMD
 252       sd_notify(0, "RELOADING=1");
 253 #endif
 254       if (do_hup() < 0) {
 255         log_warn(LD_CONFIG,"Restart failed (config error?). Exiting.");
 256         tor_shutdown_event_loop_and_exit(1);
 257         return;
 258       }
 259 #ifdef HAVE_SYSTEMD
 260       sd_notify(0, "READY=1");
 261 #endif
 262       control_event_signal(sig);
 263       break;
 264 #ifdef SIGCHLD
 265     case SIGCHLD:
 266       notify_pending_waitpid_callbacks();
 267       break;
 268 #endif
 269     case SIGNEWNYM: {
 270       do_signewnym(time(NULL));
 271       break;
 272     }
 273     case SIGCLEARDNSCACHE:
 274       addressmap_clear_transient();
 275       control_event_signal(sig);
 276       break;
 277     case SIGHEARTBEAT:
 278       log_heartbeat(time(NULL));
 279       control_event_signal(sig);
 280       break;
 281     case SIGACTIVE:
 282       /* "SIGACTIVE" counts as ersatz user activity. */
 283       note_user_activity(approx_time());
 284       control_event_signal(sig);
 285       break;
 286     case SIGDORMANT:
 287       /* "SIGDORMANT" means to ignore past user activity */
 288       log_notice(LD_GENERAL, "Going dormant because of controller request.");
 289       reset_user_activity(0);
 290       set_network_participation(false);
 291       schedule_rescan_periodic_events();
 292       control_event_signal(sig);
 293       break;
 294   }
 295 }
 296
 297 #ifdef _WIN32
 298 /** Activate SIGINT on receiving a control signal in console. */
 299 static BOOL WINAPI
 300 process_win32_console_ctrl(DWORD ctrl_type)
 301 {
 302   /* Ignore type of the ctrl signal */
 303   (void) ctrl_type;
 304
 305   activate_signal(SIGINT);
 306   return TRUE;
 307 }
 308 #endif /* defined(_WIN32) */
 309
 310 /**
 311  * Write current memory usage information to the log.
 312  */
 313 static void
 314 dumpmemusage(int severity)
 315 {
 316   connection_dump_buffer_mem_stats(severity);
 317   tor_log(severity, LD_GENERAL, "In rephist: %"PRIu64" used by %d Tors.",
 318       (rephist_total_alloc), rephist_total_num);
 319   dump_routerlist_mem_usage(severity);
 320   dump_cell_pool_usage(severity);
 321   dump_dns_mem_usage(severity);
 322 }
 323
 324 /** Write all statistics to the log, with log level <b>severity</b>. Called
 325  * in response to a SIGUSR1. */
 326 static void
 327 dumpstats(int severity)
 328 {
 329   time_t now = time(NULL);
 330   time_t elapsed;
 331   size_t rbuf_cap, wbuf_cap, rbuf_len, wbuf_len;
 332
 333   tor_log(severity, LD_GENERAL, "Dumping stats:");
 334
 335   SMARTLIST_FOREACH_BEGIN(get_connection_array(), connection_t *, conn) {
 336     int i = conn_sl_idx;
 337     tor_log(severity, LD_GENERAL,
 338         "Conn %d (socket %d) is a %s, created %d secs ago",
 339         i, (int)conn->s,
 340         connection_describe(conn),
 341         (int)(now - conn->timestamp_created));
 342     if (!connection_is_listener(conn)) {
 343       tor_log(severity,LD_GENERAL,
 344           "Conn %d: %d bytes waiting on inbuf (len %d, last read %d secs ago)",
 345           i,
 346           (int)connection_get_inbuf_len(conn),
 347           (int)buf_allocation(conn->inbuf),
 348           (int)(now - conn->timestamp_last_read_allowed));
 349       tor_log(severity,LD_GENERAL,
 350           "Conn %d: %d bytes waiting on outbuf "
 351           "(len %d, last written %d secs ago)",i,
 352           (int)connection_get_outbuf_len(conn),
 353           (int)buf_allocation(conn->outbuf),
 354           (int)(now - conn->timestamp_last_write_allowed));
 355       if (conn->type == CONN_TYPE_OR) {
 356         or_connection_t *or_conn = TO_OR_CONN(conn);
 357         if (or_conn->tls) {
 358           if (tor_tls_get_buffer_sizes(or_conn->tls, &rbuf_cap, &rbuf_len,
 359                                        &wbuf_cap, &wbuf_len) == 0) {
 360             tor_log(severity, LD_GENERAL,
 361                 "Conn %d: %d/%d bytes used on OpenSSL read buffer; "
 362                 "%d/%d bytes used on write buffer.",
 363                 i, (int)rbuf_len, (int)rbuf_cap, (int)wbuf_len, (int)wbuf_cap);
 364           }
 365         }
 366       }
 367     }
 368     circuit_dump_by_conn(conn, severity); /* dump info about all the circuits
 369                                            * using this conn */
 370   } SMARTLIST_FOREACH_END(conn);
 371
 372   channel_dumpstats(severity);
 373   channel_listener_dumpstats(severity);
 374
 375   tor_log(severity, LD_NET,
 376       "Cells processed: %"PRIu64" padding\n"
 377       "                 %"PRIu64" create\n"
 378       "                 %"PRIu64" created\n"
 379       "                 %"PRIu64" relay\n"
 380       "                        (%"PRIu64" relayed)\n"
 381       "                        (%"PRIu64" delivered)\n"
 382       "                 %"PRIu64" destroy",
 383       (stats_n_padding_cells_processed),
 384       (stats_n_create_cells_processed),
 385       (stats_n_created_cells_processed),
 386       (stats_n_relay_cells_processed),
 387       (stats_n_relay_cells_relayed),
 388       (stats_n_relay_cells_delivered),
 389       (stats_n_destroy_cells_processed));
 390   if (stats_n_data_cells_packaged)
 391     tor_log(severity,LD_NET,"Average packaged cell fullness: %2.3f%%",
 392         100*(((double)stats_n_data_bytes_packaged) /
 393              ((double)stats_n_data_cells_packaged*RELAY_PAYLOAD_SIZE)) );
 394   if (stats_n_data_cells_received)
 395     tor_log(severity,LD_NET,"Average delivered cell fullness: %2.3f%%",
 396         100*(((double)stats_n_data_bytes_received) /
 397              ((double)stats_n_data_cells_received*RELAY_PAYLOAD_SIZE)) );
 398
 399   cpuworker_log_onionskin_overhead(severity, ONION_HANDSHAKE_TYPE_TAP, "TAP");
 400   cpuworker_log_onionskin_overhead(severity, ONION_HANDSHAKE_TYPE_NTOR,"ntor");
 401
 402   if (now - time_of_process_start >= 0)
 403     elapsed = now - time_of_process_start;
 404   else
 405     elapsed = 0;
 406
 407   if (elapsed) {
 408     tor_log(severity, LD_NET,
 409         "Average bandwidth: %"PRIu64"/%d = %d bytes/sec reading",
 410         (get_bytes_read()),
 411         (int)elapsed,
 412         (int) (get_bytes_read()/elapsed));
 413     tor_log(severity, LD_NET,
 414         "Average bandwidth: %"PRIu64"/%d = %d bytes/sec writing",
 415         (get_bytes_written()),
 416         (int)elapsed,
 417         (int) (get_bytes_written()/elapsed));
 418   }
 419
 420   tor_log(severity, LD_NET, "--------------- Dumping memory information:");
 421   dumpmemusage(severity);
 422
 423   rep_hist_dump_stats(now,severity);
 424   hs_service_dump_stats(severity);
 425 }
 426
 427 #ifdef _WIN32
 428 #define UNIX_ONLY 0
 429 #else
 430 #define UNIX_ONLY 1
 431 #endif
 432
 433 static struct {
 434   /** A numeric code for this signal. Must match the signal value if
 435    * try_to_register is true. */
 436   int signal_value;
 437   /** True if we should try to register this signal with libevent and catch
 438    * corresponding posix signals. False otherwise. */
 439   int try_to_register;
 440   /** Pointer to hold the event object constructed for this signal. */
 441   struct event *signal_event;
 442 } signal_handlers[] = {
 443 #ifdef SIGINT
 444   { SIGINT, UNIX_ONLY, NULL }, /* do a controlled slow shutdown */
 445 #endif
 446 #ifdef SIGTERM
 447   { SIGTERM, UNIX_ONLY, NULL }, /* to terminate now */
 448 #endif
 449 #ifdef SIGPIPE
 450   { SIGPIPE, UNIX_ONLY, NULL }, /* otherwise SIGPIPE kills us */
 451 #endif
 452 #ifdef SIGUSR1
 453   { SIGUSR1, UNIX_ONLY, NULL }, /* dump stats */
 454 #endif
 455 #ifdef SIGUSR2
 456   { SIGUSR2, UNIX_ONLY, NULL }, /* go to loglevel debug */
 457 #endif
 458 #ifdef SIGHUP
 459   { SIGHUP, UNIX_ONLY, NULL }, /* to reload config, retry conns, etc */
 460 #endif
 461 #ifdef SIGXFSZ
 462   { SIGXFSZ, UNIX_ONLY, NULL }, /* handle file-too-big resource exhaustion */
 463 #endif
 464 #ifdef SIGCHLD
 465   { SIGCHLD, UNIX_ONLY, NULL }, /* handle dns/cpu workers that exit */
 466 #endif
 467   /* These are controller-only */
 468   { SIGNEWNYM, 0, NULL },
 469   { SIGCLEARDNSCACHE, 0, NULL },
 470   { SIGHEARTBEAT, 0, NULL },
 471   { SIGACTIVE, 0, NULL },
 472   { SIGDORMANT, 0, NULL },
 473   { -1, -1, NULL }
 474 };
 475
 476 /** Set up the signal handler events for this process, and register them
 477  * with libevent if appropriate. */
 478 void
 479 handle_signals(void)
 480 {
 481   int i;
 482   const int enabled = !get_options()->DisableSignalHandlers;
 483
 484   for (i = 0; signal_handlers[i].signal_value >= 0; ++i) {
 485     /* Signal handlers are only registered with libevent if they need to catch
 486      * real POSIX signals.  We construct these signal handler events in either
 487      * case, though, so that controllers can activate them with the SIGNAL
 488      * command.
 489      */
 490     if (enabled && signal_handlers[i].try_to_register) {
 491       signal_handlers[i].signal_event =
 492         tor_evsignal_new(tor_libevent_get_base(),
 493                          signal_handlers[i].signal_value,
 494                          signal_callback,
 495                          &signal_handlers[i].signal_value);
 496       if (event_add(signal_handlers[i].signal_event, NULL))
 497         log_warn(LD_BUG, "Error from libevent when adding "
 498                  "event for signal %d",
 499                  signal_handlers[i].signal_value);
 500     } else {
 501       signal_handlers[i].signal_event =
 502         tor_event_new(tor_libevent_get_base(), -1,
 503                       EV_SIGNAL, signal_callback,
 504                       &signal_handlers[i].signal_value);
 505     }
 506   }
 507
 508 #ifdef _WIN32
 509     /* Windows lacks traditional POSIX signals but WinAPI provides a function
 510      * to handle control signals like Ctrl+C in the console, we can use this to
 511      * simulate the SIGINT signal */
 512     if (enabled) SetConsoleCtrlHandler(process_win32_console_ctrl, TRUE);
 513 #endif /* defined(_WIN32) */
 514 }
 515
 516 /* Cause the signal handler for signal_num to be called in the event loop. */
 517 void
 518 activate_signal(int signal_num)
 519 {
 520   int i;
 521   for (i = 0; signal_handlers[i].signal_value >= 0; ++i) {
 522     if (signal_handlers[i].signal_value == signal_num) {
 523       event_active(signal_handlers[i].signal_event, EV_SIGNAL, 1);
 524       return;
 525     }
 526   }
 527 }
 528
 529 /** Main entry point for the Tor command-line client.  Return 0 on "success",
 530  * negative on "failure", and positive on "success and exit".
 531  */
 532 int
 533 tor_init(int argc, char *argv[])
 534 {
 535   char progname[256];
 536   quiet_level_t quiet = QUIET_NONE;
 537   bool running_tor = false;
 538
 539   time_of_process_start = time(NULL);
 540   tor_init_connection_lists();
 541   /* Have the log set up with our application name. */
 542   tor_snprintf(progname, sizeof(progname), "Tor %s", get_version());
 543   log_set_application_name(progname);
 544
 545   /* Initialize the history structures. */
 546   rep_hist_init();
 547   bwhist_init();
 548   /* Initialize the service cache. */
 549   addressmap_init(); /* Init the client dns cache. Do it always, since it's
 550                       * cheap. */
 551
 552   /* Initialize the HS subsystem. */
 553   hs_init();
 554
 555   {
 556     /* We check for the "quiet"/"hush" settings first, since they decide
 557        whether we log anything at all to stdout. */
 558     parsed_cmdline_t *cmdline;
 559     cmdline = config_parse_commandline(argc, argv, 1);
 560     if (cmdline) {
 561       quiet = cmdline->quiet_level;
 562       running_tor = (cmdline->command == CMD_RUN_TOR);
 563     }
 564     parsed_cmdline_free(cmdline);
 565   }
 566
 567  /* give it somewhere to log to initially */
 568   add_default_log_for_quiet_level(quiet);
 569   quiet_level = quiet;
 570
 571   {
 572     const char *version = get_version();
 573
 574     log_notice(LD_GENERAL, "Tor %s running on %s with Libevent %s, "
 575                "%s %s, Zlib %s, Liblzma %s, Libzstd %s and %s %s as libc.",
 576                version,
 577                get_uname(),
 578                tor_libevent_get_version_str(),
 579                crypto_get_library_name(),
 580                crypto_get_library_version_string(),
 581                tor_compress_supports_method(ZLIB_METHOD) ?
 582                  tor_compress_version_str(ZLIB_METHOD) : "N/A",
 583                tor_compress_supports_method(LZMA_METHOD) ?
 584                  tor_compress_version_str(LZMA_METHOD) : "N/A",
 585                tor_compress_supports_method(ZSTD_METHOD) ?
 586                  tor_compress_version_str(ZSTD_METHOD) : "N/A",
 587                tor_libc_get_name() ?
 588                  tor_libc_get_name() : "Unknown",
 589                tor_libc_get_version_str());
 590
 591     log_notice(LD_GENERAL, "Tor can't help you if you use it wrong! "
 592                "Learn how to be safe at "
 593                "https://support.torproject.org/faq/staying-anonymous/");
 594
 595     if (strstr(version, "alpha") || strstr(version, "beta"))
 596       log_notice(LD_GENERAL, "This version is not a stable Tor release. "
 597                  "Expect more bugs than usual.");
 598
 599     if (strlen(risky_option_list) && running_tor) {
 600       log_warn(LD_GENERAL, "This build of Tor has been compiled with one "
 601                "or more options that might make it less reliable or secure! "
 602                "They are:%s", risky_option_list);
 603     }
 604
 605     tor_compress_log_init_warnings();
 606   }
 607
 608   /* Warn _if_ the tracing subsystem is built in. */
 609   tracing_log_warning();
 610
 611   int init_rv = options_init_from_torrc(argc,argv);
 612   if (init_rv < 0) {
 613     log_err(LD_CONFIG,"Reading config failed--see warnings above.");
 614     return -1;
 615   } else if (init_rv > 0) {
 616     // We succeeded, and should exit anyway -- probably the user just said
 617     // "--version" or something like that.
 618     return 1;
 619   }
 620
 621   /* Initialize channelpadding and circpad parameters to defaults
 622    * until we get a consensus */
 623   channelpadding_new_consensus_params(NULL);
 624   circpad_new_consensus_params(NULL);
 625   congestion_control_new_consensus_params(NULL);
 626   flow_control_new_consensus_params(NULL);
 627
 628   /* Initialize circuit padding to defaults+torrc until we get a consensus */
 629   circpad_machines_init();
 630
 631   /* Initialize hidden service DoS subsystem. We need to do this once the
 632    * configuration object has been set because it can be accessed. */
 633   hs_dos_init();
 634
 635   /* Initialize predicted ports list after loading options */
 636   predicted_ports_init();
 637
 638 #ifndef _WIN32
 639   if (geteuid()==0)
 640     log_warn(LD_GENERAL,"You are running Tor as root. You don't need to, "
 641              "and you probably shouldn't.");
 642 #endif
 643
 644   /* Scan/clean unparseable descriptors; after reading config */
 645   routerparse_init();
 646
 647   return 0;
 648 }
 649
 650 /** A lockfile structure, used to prevent two Tors from messing with the
 651  * data directory at once.  If this variable is non-NULL, we're holding
 652  * the lockfile. */
 653 static tor_lockfile_t *lockfile = NULL;
 654
 655 /** Try to grab the lock file described in <b>options</b>, if we do not
 656  * already have it.  If <b>err_if_locked</b> is true, warn if somebody else is
 657  * holding the lock, and exit if we can't get it after waiting.  Otherwise,
 658  * return -1 if we can't get the lockfile.  Return 0 on success.
 659  */
 660 int
 661 try_locking(const or_options_t *options, int err_if_locked)
 662 {
 663   if (lockfile)
 664     return 0;
 665   else {
 666     char *fname = options_get_datadir_fname(options, "lock");
 667     int already_locked = 0;
 668     tor_lockfile_t *lf = tor_lockfile_lock(fname, 0, &already_locked);
 669     tor_free(fname);
 670     if (!lf) {
 671       if (err_if_locked && already_locked) {
 672         int r;
 673         log_warn(LD_GENERAL, "It looks like another Tor process is running "
 674                  "with the same data directory.  Waiting 5 seconds to see "
 675                  "if it goes away.");
 676 #ifndef _WIN32
 677         sleep(5);
 678 #else
 679         Sleep(5000);
 680 #endif
 681         r = try_locking(options, 0);
 682         if (r<0) {
 683           log_err(LD_GENERAL, "No, it's still there.  Exiting.");
 684           return -1;
 685         }
 686         return r;
 687       }
 688       return -1;
 689     }
 690     lockfile = lf;
 691     return 0;
 692   }
 693 }
 694
 695 /** Return true iff we've successfully acquired the lock file. */
 696 int
 697 have_lockfile(void)
 698 {
 699   return lockfile != NULL;
 700 }
 701
 702 /** If we have successfully acquired the lock file, release it. */
 703 void
 704 release_lockfile(void)
 705 {
 706   if (lockfile) {
 707     tor_lockfile_unlock(lockfile);
 708     lockfile = NULL;
 709   }
 710 }
 711
 712 /**
 713  * Remove the specified file, and log a warning if the operation fails for
 714  * any reason other than the file not existing. Ignores NULL filenames.
 715  */
 716 void
 717 tor_remove_file(const char *filename)
 718 {
 719   if (filename && tor_unlink(filename) != 0 && errno != ENOENT) {
 720     log_warn(LD_FS, "Couldn't unlink %s: %s",
 721                filename, strerror(errno));
 722   }
 723 }
 724
 725 /** Read/create keys as needed, and echo our fingerprint to stdout. */
 726 static int
 727 do_list_fingerprint(void)
 728 {
 729   const or_options_t *options = get_options();
 730   const char *arg = options->command_arg;
 731   char rsa[FINGERPRINT_LEN + 1];
 732   crypto_pk_t *k;
 733   const ed25519_public_key_t *edkey;
 734   const char *nickname = options->Nickname;
 735   sandbox_disable_getaddrinfo_cache();
 736
 737   bool show_rsa = !strcmp(arg, "") || !strcmp(arg, "rsa");
 738   bool show_ed25519 = !strcmp(arg, "ed25519");
 739   if (!show_rsa && !show_ed25519) {
 740     log_err(LD_GENERAL,
 741       "If you give a key type, you must specify 'rsa' or 'ed25519'. Exiting.");
 742     return -1;
 743   }
 744
 745   if (!server_mode(options)) {
 746     log_err(LD_GENERAL,
 747             "Clients don't have long-term identity keys. Exiting.");
 748     return -1;
 749   }
 750   tor_assert(nickname);
 751   if (init_keys() < 0) {
 752     log_err(LD_GENERAL, "Error initializing keys; exiting.");
 753     return -1;
 754   }
 755   if (!(k = get_server_identity_key())) {
 756     log_err(LD_GENERAL, "Error: missing RSA identity key.");
 757     return -1;
 758   }
 759   if (crypto_pk_get_fingerprint(k, rsa, 1) < 0) {
 760     log_err(LD_BUG, "Error computing RSA fingerprint");
 761     return -1;
 762   }
 763   if (!(edkey = get_master_identity_key())) {
 764     log_err(LD_GENERAL,"Error: missing ed25519 identity key.");
 765     return -1;
 766   }
 767   if (show_rsa) {
 768     printf("%s %s\n", nickname, rsa);
 769   }
 770   if (show_ed25519) {
 771     char ed25519[ED25519_BASE64_LEN + 1];
 772     digest256_to_base64(ed25519, (const char *) edkey->pubkey);
 773     printf("%s %s\n", nickname, ed25519);
 774   }
 775   return 0;
 776 }
 777
 778 /** Entry point for password hashing: take the desired password from
 779  * the command line, and print its salted hash to stdout. **/
 780 static void
 781 do_hash_password(void)
 782 {
 783
 784   char output[256];
 785   char key[S2K_RFC2440_SPECIFIER_LEN+DIGEST_LEN];
 786
 787   crypto_rand(key, S2K_RFC2440_SPECIFIER_LEN-1);
 788   key[S2K_RFC2440_SPECIFIER_LEN-1] = (uint8_t)96; /* Hash 64 K of data. */
 789   secret_to_key_rfc2440(key+S2K_RFC2440_SPECIFIER_LEN, DIGEST_LEN,
 790                 get_options()->command_arg, strlen(get_options()->command_arg),
 791                 key);
 792   base16_encode(output, sizeof(output), key, sizeof(key));
 793   printf("16:%s\n",output);
 794 }
 795
 796 /** Entry point for configuration dumping: write the configuration to
 797  * stdout. */
 798 static int
 799 do_dump_config(void)
 800 {
 801   const or_options_t *options = get_options();
 802   const char *arg = options->command_arg;
 803   int how;
 804   char *opts;
 805
 806   if (!strcmp(arg, "short")) {
 807     how = OPTIONS_DUMP_MINIMAL;
 808   } else if (!strcmp(arg, "non-builtin")) {
 809     // Deprecated since 0.4.5.1-alpha.
 810     fprintf(stderr, "'non-builtin' is deprecated; use 'short' instead.\n");
 811     how = OPTIONS_DUMP_MINIMAL;
 812   } else if (!strcmp(arg, "full")) {
 813     how = OPTIONS_DUMP_ALL;
 814   } else {
 815     fprintf(stderr, "No valid argument to --dump-config found!\n");
 816     fprintf(stderr, "Please select 'short' or 'full'.\n");
 817
 818     return -1;
 819   }
 820
 821   opts = options_dump(options, how);
 822   printf("%s", opts);
 823   tor_free(opts);
 824
 825   return 0;
 826 }
 827
 828 static void
 829 init_addrinfo(void)
 830 {
 831   if (! server_mode(get_options()) || get_options()->Address) {
 832     /* We don't need to seed our own hostname, because we won't be calling
 833      * resolve_my_address on it.
 834      */
 835     return;
 836   }
 837   char hname[256];
 838
 839   // host name to sandbox
 840   gethostname(hname, sizeof(hname));
 841   tor_add_addrinfo(hname);
 842 }
 843
 844 static sandbox_cfg_t*
 845 sandbox_init_filter(void)
 846 {
 847   const or_options_t *options = get_options();
 848   sandbox_cfg_t *cfg = sandbox_cfg_new();
 849
 850   sandbox_cfg_allow_openat_filename(&cfg,
 851       get_cachedir_fname("cached-status"));
 852
 853 #define OPEN(name)                              \
 854   sandbox_cfg_allow_open_filename(&cfg, tor_strdup(name))
 855
 856 #define OPENDIR(dir)                            \
 857   sandbox_cfg_allow_opendir_dirname(&cfg, tor_strdup(dir))
 858
 859 #define OPEN_DATADIR(name)                      \
 860   sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname(name))
 861
 862 #define OPEN_DATADIR2(name, name2)                       \
 863   sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname2((name), (name2)))
 864
 865 #define OPEN_DATADIR_SUFFIX(name, suffix) do {  \
 866     OPEN_DATADIR(name);                         \
 867     OPEN_DATADIR(name suffix);                  \
 868   } while (0)
 869
 870 #define OPEN_DATADIR2_SUFFIX(name, name2, suffix) do {  \
 871     OPEN_DATADIR2(name, name2);                         \
 872     OPEN_DATADIR2(name, name2 suffix);                  \
 873   } while (0)
 874
 875 // KeyDirectory is a directory, but it is only opened in check_private_dir
 876 // which calls open instead of opendir
 877 #define OPEN_KEY_DIRECTORY() \
 878   OPEN(options->KeyDirectory)
 879 #define OPEN_CACHEDIR(name)                      \
 880   sandbox_cfg_allow_open_filename(&cfg, get_cachedir_fname(name))
 881 #define OPEN_CACHEDIR_SUFFIX(name, suffix) do {  \
 882     OPEN_CACHEDIR(name);                         \
 883     OPEN_CACHEDIR(name suffix);                  \
 884   } while (0)
 885 #define OPEN_KEYDIR(name)                      \
 886   sandbox_cfg_allow_open_filename(&cfg, get_keydir_fname(name))
 887 #define OPEN_KEYDIR_SUFFIX(name, suffix) do {    \
 888     OPEN_KEYDIR(name);                           \
 889     OPEN_KEYDIR(name suffix);                    \
 890   } while (0)
 891
 892   // DataDirectory is a directory, but it is only opened in check_private_dir
 893   // which calls open instead of opendir
 894   OPEN(options->DataDirectory);
 895   OPEN_KEY_DIRECTORY();
 896
 897   OPEN_CACHEDIR_SUFFIX("cached-certs", ".tmp");
 898   OPEN_CACHEDIR_SUFFIX("cached-consensus", ".tmp");
 899   OPEN_CACHEDIR_SUFFIX("unverified-consensus", ".tmp");
 900   OPEN_CACHEDIR_SUFFIX("unverified-microdesc-consensus", ".tmp");
 901   OPEN_CACHEDIR_SUFFIX("cached-microdesc-consensus", ".tmp");
 902   OPEN_CACHEDIR_SUFFIX("cached-microdescs", ".tmp");
 903   OPEN_CACHEDIR_SUFFIX("cached-microdescs.new", ".tmp");
 904   OPEN_CACHEDIR_SUFFIX("cached-descriptors", ".tmp");
 905   OPEN_CACHEDIR_SUFFIX("cached-descriptors.new", ".tmp");
 906   OPEN_CACHEDIR("cached-descriptors.tmp.tmp");
 907   OPEN_CACHEDIR_SUFFIX("cached-extrainfo", ".tmp");
 908   OPEN_CACHEDIR_SUFFIX("cached-extrainfo.new", ".tmp");
 909   OPEN_CACHEDIR("cached-extrainfo.tmp.tmp");
 910
 911   OPEN_DATADIR_SUFFIX("state", ".tmp");
 912   OPEN_DATADIR_SUFFIX("sr-state", ".tmp");
 913   OPEN_DATADIR_SUFFIX("unparseable-desc", ".tmp");
 914   OPEN_DATADIR_SUFFIX("v3-status-votes", ".tmp");
 915   OPEN_DATADIR("key-pinning-journal");
 916   OPEN("/dev/srandom");
 917   OPEN("/dev/urandom");
 918   OPEN("/dev/random");
 919   OPEN("/etc/hosts");
 920   OPEN("/proc/meminfo");
 921
 922   if (options->BridgeAuthoritativeDir)
 923     OPEN_DATADIR_SUFFIX("networkstatus-bridges", ".tmp");
 924
 925   if (authdir_mode(options)) {
 926     OPEN_DATADIR("approved-routers");
 927     OPEN_DATADIR_SUFFIX("my-consensus-microdesc", ".tmp");
 928     OPEN_DATADIR_SUFFIX("my-consensus-ns", ".tmp");
 929     if (options->V3BandwidthsFile) {
 930       log_notice(LD_GENERAL, "Adding V3BandwidthsFile %s to sandboxing set.",
 931                  options->V3BandwidthsFile);
 932       OPEN(options->V3BandwidthsFile);
 933     }
 934   }
 935
 936   if (options->ServerDNSResolvConfFile)
 937     sandbox_cfg_allow_open_filename(&cfg,
 938                                 tor_strdup(options->ServerDNSResolvConfFile));
 939   else
 940     sandbox_cfg_allow_open_filename(&cfg, tor_strdup("/etc/resolv.conf"));
 941
 942   const char *torrc_defaults_fname = get_torrc_fname(1);
 943   if (torrc_defaults_fname) {
 944     sandbox_cfg_allow_open_filename(&cfg, tor_strdup(torrc_defaults_fname));
 945   }
 946   const char *torrc_fname = get_torrc_fname(0);
 947   if (torrc_fname) {
 948     sandbox_cfg_allow_open_filename(&cfg, tor_strdup(torrc_fname));
 949     // allow torrc backup and torrc.tmp to make SAVECONF work
 950     char *torrc_bck = NULL;
 951     tor_asprintf(&torrc_bck, CONFIG_BACKUP_PATTERN, torrc_fname);
 952     sandbox_cfg_allow_rename(&cfg, tor_strdup(torrc_fname), torrc_bck);
 953     char *torrc_tmp = NULL;
 954     tor_asprintf(&torrc_tmp, "%s.tmp", torrc_fname);
 955     sandbox_cfg_allow_rename(&cfg, torrc_tmp, tor_strdup(torrc_fname));
 956     sandbox_cfg_allow_open_filename(&cfg, tor_strdup(torrc_tmp));
 957     // we need to stat the existing backup file
 958     sandbox_cfg_allow_stat_filename(&cfg, tor_strdup(torrc_bck));
 959   }
 960
 961   SMARTLIST_FOREACH(options->FilesOpenedByIncludes, char *, f, {
 962     if (file_status(f) == FN_DIR) {
 963       OPENDIR(f);
 964     } else {
 965       OPEN(f);
 966     }
 967   });
 968
 969 #define RENAME_SUFFIX(name, suffix)        \
 970   sandbox_cfg_allow_rename(&cfg,           \
 971       get_datadir_fname(name suffix),      \
 972       get_datadir_fname(name))
 973
 974 #define RENAME_SUFFIX2(prefix, name, suffix) \
 975   sandbox_cfg_allow_rename(&cfg,                                        \
 976                            get_datadir_fname2(prefix, name suffix),     \
 977                            get_datadir_fname2(prefix, name))
 978
 979 #define RENAME_CACHEDIR_SUFFIX(name, suffix)        \
 980   sandbox_cfg_allow_rename(&cfg,           \
 981       get_cachedir_fname(name suffix),      \
 982       get_cachedir_fname(name))
 983
 984 #define RENAME_KEYDIR_SUFFIX(name, suffix)    \
 985   sandbox_cfg_allow_rename(&cfg,           \
 986       get_keydir_fname(name suffix),      \
 987       get_keydir_fname(name))
 988
 989   RENAME_CACHEDIR_SUFFIX("cached-certs", ".tmp");
 990   RENAME_CACHEDIR_SUFFIX("cached-consensus", ".tmp");
 991   RENAME_CACHEDIR_SUFFIX("unverified-consensus", ".tmp");
 992   RENAME_CACHEDIR_SUFFIX("unverified-microdesc-consensus", ".tmp");
 993   RENAME_CACHEDIR_SUFFIX("cached-microdesc-consensus", ".tmp");
 994   RENAME_CACHEDIR_SUFFIX("cached-microdescs", ".tmp");
 995   RENAME_CACHEDIR_SUFFIX("cached-microdescs", ".new");
 996   RENAME_CACHEDIR_SUFFIX("cached-microdescs.new", ".tmp");
 997   RENAME_CACHEDIR_SUFFIX("cached-descriptors", ".tmp");
 998   RENAME_CACHEDIR_SUFFIX("cached-descriptors", ".new");
 999   RENAME_CACHEDIR_SUFFIX("cached-descriptors.new", ".tmp");
1000   RENAME_CACHEDIR_SUFFIX("cached-extrainfo", ".tmp");
1001   RENAME_CACHEDIR_SUFFIX("cached-extrainfo", ".new");
1002   RENAME_CACHEDIR_SUFFIX("cached-extrainfo.new", ".tmp");
1003
1004   RENAME_SUFFIX("state", ".tmp");
1005   RENAME_SUFFIX("sr-state", ".tmp");
1006   RENAME_SUFFIX("unparseable-desc", ".tmp");
1007   RENAME_SUFFIX("v3-status-votes", ".tmp");
1008
1009   if (options->BridgeAuthoritativeDir)
1010     RENAME_SUFFIX("networkstatus-bridges", ".tmp");
1011
1012   if (authdir_mode(options)) {
1013     RENAME_SUFFIX("my-consensus-microdesc", ".tmp");
1014     RENAME_SUFFIX("my-consensus-ns", ".tmp");
1015   }
1016
1017 #define STAT_DATADIR(name)                      \
1018   sandbox_cfg_allow_stat_filename(&cfg, get_datadir_fname(name))
1019
1020 #define STAT_CACHEDIR(name)                                             \
1021   sandbox_cfg_allow_stat_filename(&cfg, get_cachedir_fname(name))
1022
1023 #define STAT_DATADIR2(name, name2)                                      \
1024   sandbox_cfg_allow_stat_filename(&cfg, get_datadir_fname2((name), (name2)))
1025
1026 #define STAT_KEY_DIRECTORY() \
1027   sandbox_cfg_allow_stat_filename(&cfg, tor_strdup(options->KeyDirectory))
1028
1029   STAT_DATADIR(NULL);
1030   STAT_DATADIR("lock");
1031   STAT_DATADIR("state");
1032   STAT_DATADIR("router-stability");
1033
1034   STAT_CACHEDIR("cached-extrainfo.new");
1035
1036   {
1037     smartlist_t *files = smartlist_new();
1038     tor_log_get_logfile_names(files);
1039     SMARTLIST_FOREACH(files, char *, file_name, {
1040       /* steals reference */
1041       sandbox_cfg_allow_open_filename(&cfg, file_name);
1042     });
1043     smartlist_free(files);
1044   }
1045
1046   {
1047     smartlist_t *files = smartlist_new();
1048     smartlist_t *dirs = smartlist_new();
1049     hs_service_lists_fnames_for_sandbox(files, dirs);
1050     SMARTLIST_FOREACH(files, char *, file_name, {
1051       char *tmp_name = NULL;
1052       tor_asprintf(&tmp_name, "%s.tmp", file_name);
1053       sandbox_cfg_allow_rename(&cfg,
1054                                tor_strdup(tmp_name), tor_strdup(file_name));
1055       /* steals references */
1056       sandbox_cfg_allow_open_filename(&cfg, file_name);
1057       sandbox_cfg_allow_open_filename(&cfg, tmp_name);
1058     });
1059     SMARTLIST_FOREACH(dirs, char *, dir, {
1060       /* steals reference */
1061       sandbox_cfg_allow_stat_filename(&cfg, dir);
1062     });
1063     smartlist_free(files);
1064     smartlist_free(dirs);
1065   }
1066
1067   {
1068     char *fname;
1069     if ((fname = get_controller_cookie_file_name())) {
1070       sandbox_cfg_allow_open_filename(&cfg, fname);
1071     }
1072     if ((fname = get_ext_or_auth_cookie_file_name())) {
1073       sandbox_cfg_allow_open_filename(&cfg, fname);
1074     }
1075   }
1076
1077   SMARTLIST_FOREACH_BEGIN(get_configured_ports(), port_cfg_t *, port) {
1078     if (!port->is_unix_addr)
1079       continue;
1080     /* When we open an AF_UNIX address, we want permission to open the
1081      * directory that holds it. */
1082     char *dirname = tor_strdup(port->unix_addr);
1083     if (get_parent_directory(dirname) == 0) {
1084       OPENDIR(dirname);
1085     }
1086     tor_free(dirname);
1087     sandbox_cfg_allow_chmod_filename(&cfg, tor_strdup(port->unix_addr));
1088     sandbox_cfg_allow_chown_filename(&cfg, tor_strdup(port->unix_addr));
1089   } SMARTLIST_FOREACH_END(port);
1090
1091   if (options->DirPortFrontPage) {
1092     sandbox_cfg_allow_open_filename(&cfg,
1093                                     tor_strdup(options->DirPortFrontPage));
1094   }
1095
1096   // orport
1097   if (server_mode(get_options())) {
1098
1099     OPEN_KEYDIR_SUFFIX("secret_id_key", ".tmp");
1100     OPEN_KEYDIR_SUFFIX("secret_onion_key", ".tmp");
1101     OPEN_KEYDIR_SUFFIX("secret_onion_key_ntor", ".tmp");
1102     OPEN_KEYDIR("secret_id_key.old");
1103     OPEN_KEYDIR("secret_onion_key.old");
1104     OPEN_KEYDIR("secret_onion_key_ntor.old");
1105
1106     OPEN_KEYDIR_SUFFIX("ed25519_master_id_secret_key", ".tmp");
1107     OPEN_KEYDIR_SUFFIX("ed25519_master_id_secret_key_encrypted", ".tmp");
1108     OPEN_KEYDIR_SUFFIX("ed25519_master_id_public_key", ".tmp");
1109     OPEN_KEYDIR_SUFFIX("ed25519_signing_secret_key", ".tmp");
1110     OPEN_KEYDIR_SUFFIX("ed25519_signing_secret_key_encrypted", ".tmp");
1111     OPEN_KEYDIR_SUFFIX("ed25519_signing_public_key", ".tmp");
1112     OPEN_KEYDIR_SUFFIX("ed25519_signing_cert", ".tmp");
1113
1114     OPEN_DATADIR2_SUFFIX("stats", "bridge-stats", ".tmp");
1115     OPEN_DATADIR2_SUFFIX("stats", "dirreq-stats", ".tmp");
1116
1117     OPEN_DATADIR2_SUFFIX("stats", "entry-stats", ".tmp");
1118     OPEN_DATADIR2_SUFFIX("stats", "exit-stats", ".tmp");
1119     OPEN_DATADIR2_SUFFIX("stats", "buffer-stats", ".tmp");
1120     OPEN_DATADIR2_SUFFIX("stats", "conn-stats", ".tmp");
1121     OPEN_DATADIR2_SUFFIX("stats", "hidserv-stats", ".tmp");
1122     OPEN_DATADIR2_SUFFIX("stats", "hidserv-v3-stats", ".tmp");
1123
1124     OPEN_DATADIR("approved-routers");
1125     OPEN_DATADIR_SUFFIX("fingerprint", ".tmp");
1126     OPEN_DATADIR_SUFFIX("fingerprint-ed25519", ".tmp");
1127     OPEN_DATADIR_SUFFIX("hashed-fingerprint", ".tmp");
1128     OPEN_DATADIR_SUFFIX("router-stability", ".tmp");
1129
1130     OPEN("/etc/resolv.conf");
1131
1132     RENAME_SUFFIX("fingerprint", ".tmp");
1133     RENAME_SUFFIX("fingerprint-ed25519", ".tmp");
1134     RENAME_KEYDIR_SUFFIX("secret_onion_key_ntor", ".tmp");
1135
1136     RENAME_KEYDIR_SUFFIX("secret_id_key", ".tmp");
1137     RENAME_KEYDIR_SUFFIX("secret_id_key.old", ".tmp");
1138     RENAME_KEYDIR_SUFFIX("secret_onion_key", ".tmp");
1139     RENAME_KEYDIR_SUFFIX("secret_onion_key.old", ".tmp");
1140
1141     RENAME_SUFFIX2("stats", "bridge-stats", ".tmp");
1142     RENAME_SUFFIX2("stats", "dirreq-stats", ".tmp");
1143     RENAME_SUFFIX2("stats", "entry-stats", ".tmp");
1144     RENAME_SUFFIX2("stats", "exit-stats", ".tmp");
1145     RENAME_SUFFIX2("stats", "buffer-stats", ".tmp");
1146     RENAME_SUFFIX2("stats", "conn-stats", ".tmp");
1147     RENAME_SUFFIX2("stats", "hidserv-stats", ".tmp");
1148     RENAME_SUFFIX2("stats", "hidserv-v3-stats", ".tmp");
1149     RENAME_SUFFIX("hashed-fingerprint", ".tmp");
1150     RENAME_SUFFIX("router-stability", ".tmp");
1151
1152     RENAME_KEYDIR_SUFFIX("ed25519_master_id_secret_key", ".tmp");
1153     RENAME_KEYDIR_SUFFIX("ed25519_master_id_secret_key_encrypted", ".tmp");
1154     RENAME_KEYDIR_SUFFIX("ed25519_master_id_public_key", ".tmp");
1155     RENAME_KEYDIR_SUFFIX("ed25519_signing_secret_key", ".tmp");
1156     RENAME_KEYDIR_SUFFIX("ed25519_signing_cert", ".tmp");
1157
1158     sandbox_cfg_allow_rename(&cfg,
1159              get_keydir_fname("secret_onion_key"),
1160              get_keydir_fname("secret_onion_key.old"));
1161     sandbox_cfg_allow_rename(&cfg,
1162              get_keydir_fname("secret_onion_key_ntor"),
1163              get_keydir_fname("secret_onion_key_ntor.old"));
1164
1165     STAT_KEY_DIRECTORY();
1166     OPEN_DATADIR("stats");
1167     STAT_DATADIR("stats");
1168     STAT_DATADIR2("stats", "dirreq-stats");
1169
1170     consdiffmgr_register_with_sandbox(&cfg);
1171   }
1172
1173   init_addrinfo();
1174
1175   return cfg;
1176 }
1177
1178 int
1179 run_tor_main_loop(void)
1180 {
1181   handle_signals();
1182   timers_initialize();
1183   initialize_mainloop_events();
1184
1185   /* load the private keys, if we're supposed to have them, and set up the
1186    * TLS context. */
1187   if (! client_identity_key_is_set()) {
1188     if (init_keys() < 0) {
1189       log_err(LD_OR, "Error initializing keys; exiting");
1190       return -1;
1191     }
1192   }
1193
1194   /* Set up our buckets */
1195   connection_bucket_init();
1196
1197   /* initialize the bootstrap status events to know we're starting up */
1198   control_event_bootstrap(BOOTSTRAP_STATUS_STARTING, 0);
1199
1200   /* Initialize the keypinning log. */
1201   if (authdir_mode_v3(get_options())) {
1202     char *fname = get_datadir_fname("key-pinning-journal");
1203     int r = 0;
1204     if (keypin_load_journal(fname)<0) {
1205       log_err(LD_DIR, "Error loading key-pinning journal: %s",strerror(errno));
1206       r = -1;
1207     }
1208     if (keypin_open_journal(fname)<0) {
1209       log_err(LD_DIR, "Error opening key-pinning journal: %s",strerror(errno));
1210       r = -1;
1211     }
1212     tor_free(fname);
1213     if (r)
1214       return r;
1215   }
1216   {
1217     /* This is the old name for key-pinning-journal.  These got corrupted
1218      * in a couple of cases by #16530, so we started over. See #16580 for
1219      * the rationale and for other options we didn't take.  We can remove
1220      * this code once all the authorities that ran 0.2.7.1-alpha-dev are
1221      * upgraded.
1222      */
1223     char *fname = get_datadir_fname("key-pinning-entries");
1224     unlink(fname);
1225     tor_free(fname);
1226   }
1227
1228   if (trusted_dirs_reload_certs()) {
1229     log_warn(LD_DIR,
1230              "Couldn't load all cached v3 certificates. Starting anyway.");
1231   }
1232   if (router_reload_consensus_networkstatus()) {
1233     return -1;
1234   }
1235   /* load the routers file, or assign the defaults. */
1236   if (router_reload_router_list()) {
1237     return -1;
1238   }
1239   /* load the networkstatuses. (This launches a download for new routers as
1240    * appropriate.)
1241    */
1242   const time_t now = time(NULL);
1243   directory_info_has_arrived(now, 1, 0);
1244
1245   /* launch cpuworkers. Need to do this *after* we've read the onion key. */
1246   /* launch them always for all tors, now that clients can solve onion PoWs. */
1247   cpuworker_init();
1248
1249   consdiffmgr_enable_background_compression();
1250
1251   /* Setup shared random protocol subsystem. */
1252   if (authdir_mode_v3(get_options())) {
1253     if (sr_init(1) < 0) {
1254       return -1;
1255     }
1256   }
1257
1258   /* initialize dns resolve map, spawn workers if needed */
1259   if (dns_init() < 0) {
1260     if (get_options()->ServerDNSAllowBrokenConfig)
1261       log_warn(LD_GENERAL, "Couldn't set up any working nameservers. "
1262                "Network not up yet?  Will try again soon.");
1263     else {
1264       log_err(LD_GENERAL,"Error initializing dns subsystem; exiting.  To "
1265               "retry instead, set the ServerDNSAllowBrokenResolvConf option.");
1266     }
1267   }
1268
1269 #ifdef HAVE_SYSTEMD
1270   {
1271     const int r = sd_notify(0, "READY=1");
1272     if (r < 0) {
1273       log_warn(LD_GENERAL, "Unable to send readiness to systemd: %s",
1274                strerror(r));
1275     } else if (r > 0) {
1276       log_notice(LD_GENERAL, "Signaled readiness to systemd");
1277     } else {
1278       log_info(LD_GENERAL, "Systemd NOTIFY_SOCKET not present.");
1279     }
1280   }
1281 #endif /* defined(HAVE_SYSTEMD) */
1282
1283   return do_main_loop();
1284 }
1285
1286 /** Install the publish/subscribe relationships for all the subsystems. */
1287 void
1288 pubsub_install(void)
1289 {
1290     pubsub_builder_t *builder = pubsub_builder_new();
1291     int r = subsystems_add_pubsub(builder);
1292     tor_assert(r == 0);
1293     r = tor_mainloop_connect_pubsub(builder); // consumes builder
1294     tor_assert(r == 0);
1295 }
1296
1297 /** Connect the mainloop to its publish/subscribe message delivery events if
1298  * appropriate, and configure the global channels appropriately. */
1299 void
1300 pubsub_connect(void)
1301 {
1302   if (get_options()->command == CMD_RUN_TOR) {
1303     tor_mainloop_connect_pubsub_events();
1304     /* XXXX For each pubsub channel, its delivery strategy should be set at
1305      * this XXXX point, using tor_mainloop_set_delivery_strategy().
1306      */
1307     tor_mainloop_set_delivery_strategy("orconn", DELIV_IMMEDIATE);
1308     tor_mainloop_set_delivery_strategy("ocirc", DELIV_IMMEDIATE);
1309   }
1310 }
1311
1312 /* Main entry point for the Tor process.  Called from tor_main(), and by
1313  * anybody embedding Tor. */
1314 int
1315 tor_run_main(const tor_main_configuration_t *tor_cfg)
1316 {
1317   int result = 0;
1318
1319 #ifdef EVENT_SET_MEM_FUNCTIONS_IMPLEMENTED
1320   event_set_mem_functions(tor_malloc_, tor_realloc_, tor_free_);
1321 #endif
1322
1323   subsystems_init();
1324
1325   init_protocol_warning_severity_level();
1326
1327   int argc = tor_cfg->argc + tor_cfg->argc_owned;
1328   char **argv = tor_calloc(argc, sizeof(char*));
1329   memcpy(argv, tor_cfg->argv, tor_cfg->argc*sizeof(char*));
1330   if (tor_cfg->argc_owned)
1331     memcpy(argv + tor_cfg->argc, tor_cfg->argv_owned,
1332            tor_cfg->argc_owned*sizeof(char*));
1333
1334   int done = 0;
1335   result = nt_service_parse_options(argc, argv, &done);
1336   if (POSSIBLE(done))
1337     goto done;
1338
1339   pubsub_install();
1340
1341   {
1342     int init_rv = tor_init(argc, argv);
1343     if (init_rv) {
1344       tor_free_all(0);
1345       result = (init_rv < 0) ? -1 : 0;
1346       goto done;
1347     }
1348   }
1349
1350   pubsub_connect();
1351
1352   if (get_options()->Sandbox && get_options()->command == CMD_RUN_TOR) {
1353 #ifdef ENABLE_FRAGILE_HARDENING
1354     log_warn(LD_CONFIG, "Sandbox is enabled but this Tor was built using "
1355              "fragile compiler hardening. The sandbox may be unable to filter "
1356              "requests to open files and directories and its overall "
1357              "effectiveness will be reduced.");
1358 #endif
1359
1360     sandbox_cfg_t* cfg = sandbox_init_filter();
1361
1362     if (sandbox_init(cfg)) {
1363       tor_free(argv);
1364       log_err(LD_BUG,"Failed to create syscall sandbox filter");
1365       tor_free_all(0);
1366       return -1;
1367     }
1368     tor_make_getaddrinfo_cache_active();
1369
1370     // registering libevent rng
1371 #ifdef HAVE_EVUTIL_SECURE_RNG_SET_URANDOM_DEVICE_FILE
1372     evutil_secure_rng_set_urandom_device_file(
1373         (char*) sandbox_intern_string("/dev/urandom"));
1374 #endif
1375   }
1376
1377   switch (get_options()->command) {
1378   case CMD_RUN_TOR:
1379     nt_service_set_state(SERVICE_RUNNING);
1380     result = run_tor_main_loop();
1381     break;
1382   case CMD_KEYGEN:
1383     result = load_ed_keys(get_options(), time(NULL)) < 0;
1384     break;
1385   case CMD_KEY_EXPIRATION:
1386     init_keys();
1387     result = log_cert_expiration();
1388     break;
1389   case CMD_LIST_FINGERPRINT:
1390     result = do_list_fingerprint();
1391     break;
1392   case CMD_HASH_PASSWORD:
1393     do_hash_password();
1394     result = 0;
1395     break;
1396   case CMD_VERIFY_CONFIG:
1397     if (quiet_level == QUIET_NONE)
1398       printf("Configuration was valid\n");
1399     result = 0;
1400     break;
1401   case CMD_DUMP_CONFIG:
1402     result = do_dump_config();
1403     break;
1404   case CMD_RUN_UNITTESTS: /* only set by test.c */
1405   case CMD_IMMEDIATE: /* Handled in config.c */
1406   default:
1407     log_warn(LD_BUG,"Illegal command number %d: internal error.",
1408              get_options()->command);
1409     result = -1;
1410   }
1411   tor_cleanup();
1412  done:
1413   tor_free(argv);
1414   return result;
1415 }