src/feature/dirauth/reachability.c

   1 /* Copyright (c) 2001-2004, Roger Dingledine.
   2  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
   3  * Copyright (c) 2007-2021, The Tor Project, Inc. */
   4 /* See LICENSE for licensing information */
   5
   6 /**
   7  * \file reachability.c
   8  * \brief Router reachability testing; run by authorities to tell who is
   9  * running.
  10  */
  11
  12 #include "core/or/or.h"
  13 #include "feature/dirauth/reachability.h"
  14
  15 #include "app/config/config.h"
  16 #include "core/or/channel.h"
  17 #include "core/or/channeltls.h"
  18 #include "core/or/command.h"
  19 #include "feature/dirauth/authmode.h"
  20 #include "feature/dirauth/dirauth_sys.h"
  21 #include "feature/nodelist/describe.h"
  22 #include "feature/nodelist/nodelist.h"
  23 #include "feature/nodelist/routerinfo.h"
  24 #include "feature/nodelist/routerlist.h"
  25 #include "feature/nodelist/torcert.h"
  26 #include "feature/stats/rephist.h"
  27
  28 #include "feature/dirauth/dirauth_options_st.h"
  29 #include "feature/nodelist/node_st.h"
  30 #include "feature/nodelist/routerinfo_st.h"
  31 #include "feature/nodelist/routerlist_st.h"
  32
  33 /** Called when a TLS handshake has completed successfully with a
  34  * router listening at <b>address</b>:<b>or_port</b>, and has yielded
  35  * a certificate with digest <b>digest_rcvd</b>.
  36  *
  37  * Inform the reachability checker that we could get to this relay.
  38  */
  39 void
  40 dirserv_orconn_tls_done(const tor_addr_t *addr,
  41                         uint16_t or_port,
  42                         const char *digest_rcvd,
  43                         const ed25519_public_key_t *ed_id_rcvd)
  44 {
  45   node_t *node = NULL;
  46   tor_addr_port_t orport;
  47   routerinfo_t *ri = NULL;
  48   time_t now = time(NULL);
  49   tor_assert(addr);
  50   tor_assert(digest_rcvd);
  51
  52   node = node_get_mutable_by_id(digest_rcvd);
  53   if (node == NULL || node->ri == NULL)
  54     return;
  55
  56   ri = node->ri;
  57
  58   if (dirauth_get_options()->AuthDirTestEd25519LinkKeys &&
  59       node_supports_ed25519_link_authentication(node, 1) &&
  60       ri->cache_info.signing_key_cert) {
  61     /* We allow the node to have an ed25519 key if we haven't been told one in
  62      * the routerinfo, but if we *HAVE* been told one in the routerinfo, it
  63      * needs to match. */
  64     const ed25519_public_key_t *expected_id =
  65       &ri->cache_info.signing_key_cert->signing_key;
  66     tor_assert(!ed25519_public_key_is_zero(expected_id));
  67     if (! ed_id_rcvd || ! ed25519_pubkey_eq(ed_id_rcvd, expected_id)) {
  68       log_info(LD_DIRSERV, "Router at %s:%d with RSA ID %s "
  69                "did not present expected Ed25519 ID.",
  70                fmt_addr(addr), or_port, hex_str(digest_rcvd, DIGEST_LEN));
  71       return; /* Don't mark it as reachable. */
  72     }
  73   }
  74
  75   tor_addr_copy(&orport.addr, addr);
  76   orport.port = or_port;
  77   if (router_has_orport(ri, &orport)) {
  78     /* Found the right router.  */
  79     if (!authdir_mode_bridge(get_options()) ||
  80         ri->purpose == ROUTER_PURPOSE_BRIDGE) {
  81       char addrstr[TOR_ADDR_BUF_LEN];
  82       /* This is a bridge or we're not a bridge authority --
  83          mark it as reachable.  */
  84       log_info(LD_DIRSERV, "Found router %s to be reachable at %s:%d. Yay.",
  85                router_describe(ri),
  86                tor_addr_to_str(addrstr, addr, sizeof(addrstr), 1),
  87                ri->ipv4_orport);
  88       if (tor_addr_family(addr) == AF_INET) {
  89         rep_hist_note_router_reachable(digest_rcvd, addr, or_port, now);
  90         node->last_reachable = now;
  91       } else if (tor_addr_family(addr) == AF_INET6) {
  92         /* No rephist for IPv6.  */
  93         node->last_reachable6 = now;
  94       }
  95     }
  96   }
  97 }
  98
  99 /** Called when we, as an authority, receive a new router descriptor either as
 100  * an upload or a download.  Used to decide whether to relaunch reachability
 101  * testing for the server. */
 102 int
 103 dirserv_should_launch_reachability_test(const routerinfo_t *ri,
 104                                         const routerinfo_t *ri_old)
 105 {
 106   if (!authdir_mode_handles_descs(get_options(), ri->purpose))
 107     return 0;
 108   if (! dirauth_get_options()->AuthDirTestReachability)
 109     return 0;
 110   if (!ri_old) {
 111     /* New router: Launch an immediate reachability test, so we will have an
 112      * opinion soon in case we're generating a consensus soon */
 113     log_info(LD_DIR, "descriptor for new router %s", router_describe(ri));
 114     return 1;
 115   }
 116   if (ri_old->is_hibernating && !ri->is_hibernating) {
 117     /* It just came out of hibernation; launch a reachability test */
 118     log_info(LD_DIR, "out of hibernation: router %s", router_describe(ri));
 119     return 1;
 120   }
 121   if (! routers_have_same_or_addrs(ri, ri_old)) {
 122     /* Address or port changed; launch a reachability test */
 123     log_info(LD_DIR, "address or port changed: router %s",
 124              router_describe(ri));
 125     return 1;
 126   }
 127   return 0;
 128 }
 129
 130 /** Helper function for dirserv_test_reachability(). Start a TLS
 131  * connection to <b>router</b>, and annotate it with when we started
 132  * the test. */
 133 void
 134 dirserv_single_reachability_test(time_t now, routerinfo_t *router)
 135 {
 136   const dirauth_options_t *dirauth_options = dirauth_get_options();
 137   channel_t *chan = NULL;
 138   const node_t *node = NULL;
 139   const ed25519_public_key_t *ed_id_key;
 140   (void) now;
 141
 142   tor_assert(router);
 143   node = node_get_by_id(router->cache_info.identity_digest);
 144   tor_assert(node);
 145
 146   if (dirauth_options->AuthDirTestEd25519LinkKeys &&
 147       node_supports_ed25519_link_authentication(node, 1) &&
 148       router->cache_info.signing_key_cert) {
 149     ed_id_key = &router->cache_info.signing_key_cert->signing_key;
 150   } else {
 151     ed_id_key = NULL;
 152   }
 153
 154   /* IPv4. */
 155   log_info(LD_OR,"Testing reachability of %s at %s:%u.",
 156             router->nickname, fmt_addr(&router->ipv4_addr),
 157             router->ipv4_orport);
 158   chan = channel_tls_connect(&router->ipv4_addr, router->ipv4_orport,
 159                              router->cache_info.identity_digest,
 160                              ed_id_key);
 161   if (chan) command_setup_channel(chan);
 162
 163   /* Possible IPv6. */
 164   if (dirauth_get_options()->AuthDirHasIPv6Connectivity == 1 &&
 165       !tor_addr_is_null(&router->ipv6_addr)) {
 166     char addrstr[TOR_ADDR_BUF_LEN];
 167     log_info(LD_OR, "Testing reachability of %s at %s:%u.",
 168              router->nickname,
 169              tor_addr_to_str(addrstr, &router->ipv6_addr, sizeof(addrstr), 1),
 170              router->ipv6_orport);
 171     chan = channel_tls_connect(&router->ipv6_addr, router->ipv6_orport,
 172                                router->cache_info.identity_digest,
 173                                ed_id_key);
 174     if (chan) command_setup_channel(chan);
 175   }
 176 }
 177
 178 /** Auth dir server only: load balance such that we only
 179  * try a few connections per call.
 180  *
 181  * The load balancing is such that if we get called once every ten
 182  * seconds, we will cycle through all the tests in
 183  * REACHABILITY_TEST_CYCLE_PERIOD seconds (a bit over 20 minutes).
 184  */
 185 void
 186 dirserv_test_reachability(time_t now)
 187 {
 188   /* XXX decide what to do here; see or-talk thread "purging old router
 189    * information, revocation." -NM
 190    * We can't afford to mess with this in 0.1.2.x. The reason is that
 191    * if we stop doing reachability tests on some of routerlist, then
 192    * we'll for-sure think they're down, which may have unexpected
 193    * effects in other parts of the code. It doesn't hurt much to do
 194    * the testing, and directory authorities are easy to upgrade. Let's
 195    * wait til 0.2.0. -RD */
 196 //  time_t cutoff = now - ROUTER_MAX_AGE_TO_PUBLISH;
 197   if (! dirauth_get_options()->AuthDirTestReachability)
 198     return;
 199
 200   routerlist_t *rl = router_get_routerlist();
 201   static char ctr = 0;
 202   int bridge_auth = authdir_mode_bridge(get_options());
 203
 204   SMARTLIST_FOREACH_BEGIN(rl->routers, routerinfo_t *, router) {
 205     const char *id_digest = router->cache_info.identity_digest;
 206     if (router_is_me(router))
 207       continue;
 208     if (bridge_auth && router->purpose != ROUTER_PURPOSE_BRIDGE)
 209       continue; /* bridge authorities only test reachability on bridges */
 210 //    if (router->cache_info.published_on > cutoff)
 211 //      continue;
 212     if ((((uint8_t)id_digest[0]) % REACHABILITY_MODULO_PER_TEST) == ctr) {
 213       dirserv_single_reachability_test(now, router);
 214     }
 215   } SMARTLIST_FOREACH_END(router);
 216   ctr = (ctr + 1) % REACHABILITY_MODULO_PER_TEST; /* increment ctr */
 217 }