1 /* Copyright (c) 2001 Matej Pfajfar.
2 * Copyright (c) 2001-2004, Roger Dingledine.
3 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. */
4 /* See LICENSE for licensing information */
6 const char connection_edge_c_id
[] =
10 * \file connection_edge.c
11 * \brief Handle edge streams.
16 #ifdef HAVE_LINUX_NETFILTER_IPV4_H
17 #include <linux/netfilter_ipv4.h>
18 #define TRANS_NETFILTER
21 #if defined(HAVE_NET_IF_H) && defined(HAVE_NET_PFVAR_H)
23 #include <net/pfvar.h>
27 /* List of exit_redirect_t */
28 static smartlist_t
*redirect_exit_list
= NULL
;
30 static int connection_ap_handshake_process_socks(edge_connection_t
*conn
);
31 static int connection_ap_process_natd(edge_connection_t
*conn
);
32 static int connection_exit_connect_dir(edge_connection_t
*exit_conn
);
33 static int hostname_is_noconnect_address(const char *address
);
35 /** An AP stream has failed/finished. If it hasn't already sent back
36 * a socks reply, send one now (based on endreason). Also set
37 * has_sent_end to 1, and mark the conn.
40 _connection_mark_unattached_ap(edge_connection_t
*conn
, int endreason
,
41 int line
, const char *file
)
43 tor_assert(conn
->_base
.type
== CONN_TYPE_AP
);
44 conn
->_base
.edge_has_sent_end
= 1; /* no circ yet */
46 if (conn
->_base
.marked_for_close
) {
47 /* This call will warn as appropriate. */
48 _connection_mark_for_close(TO_CONN(conn
), line
, file
);
52 if (!conn
->socks_request
->has_finished
) {
53 if (endreason
== END_STREAM_REASON_ALREADY_SOCKS_REPLIED
)
55 "Bug: stream (marked at %s:%d) sending two socks replies?",
58 if (SOCKS_COMMAND_IS_CONNECT(conn
->socks_request
->command
))
59 connection_ap_handshake_socks_reply(conn
, NULL
, 0, endreason
);
61 connection_ap_handshake_socks_resolved(conn
, RESOLVED_TYPE_ERROR
,
65 _connection_mark_for_close(TO_CONN(conn
), line
, file
);
66 conn
->_base
.hold_open_until_flushed
= 1;
67 conn
->end_reason
= endreason
;
70 /** There was an EOF. Send an end and mark the connection for close.
73 connection_edge_reached_eof(edge_connection_t
*conn
)
75 if (buf_datalen(conn
->_base
.inbuf
) &&
76 connection_state_is_open(TO_CONN(conn
))) {
77 /* it still has stuff to process. don't let it die yet. */
80 log_info(LD_EDGE
,"conn (fd %d) reached eof. Closing.", conn
->_base
.s
);
81 if (!conn
->_base
.marked_for_close
) {
82 /* only mark it if not already marked. it's possible to
83 * get the 'end' right around when the client hangs up on us. */
84 connection_edge_end(conn
, END_STREAM_REASON_DONE
, conn
->cpath_layer
);
85 if (conn
->socks_request
) /* eof, so don't send a socks reply back */
86 conn
->socks_request
->has_finished
= 1;
87 connection_mark_for_close(TO_CONN(conn
));
92 /** Handle new bytes on conn->inbuf based on state:
93 * - If it's waiting for socks info, try to read another step of the
94 * socks handshake out of conn->inbuf.
95 * - If it's waiting for the original destination, fetch it.
96 * - If it's open, then package more relay cells from the stream.
97 * - Else, leave the bytes on inbuf alone for now.
99 * Mark and return -1 if there was an unexpected error with the conn,
103 connection_edge_process_inbuf(edge_connection_t
*conn
, int package_partial
)
107 switch (conn
->_base
.state
) {
108 case AP_CONN_STATE_SOCKS_WAIT
:
109 if (connection_ap_handshake_process_socks(conn
) < 0) {
114 case AP_CONN_STATE_NATD_WAIT
:
115 if (connection_ap_process_natd(conn
) < 0) {
120 case AP_CONN_STATE_OPEN
:
121 case EXIT_CONN_STATE_OPEN
:
122 if (connection_edge_package_raw_inbuf(conn
, package_partial
) < 0) {
123 /* (We already sent an end cell if possible) */
124 connection_mark_for_close(TO_CONN(conn
));
128 case EXIT_CONN_STATE_CONNECTING
:
129 case AP_CONN_STATE_RENDDESC_WAIT
:
130 case AP_CONN_STATE_CIRCUIT_WAIT
:
131 case AP_CONN_STATE_CONNECT_WAIT
:
132 case AP_CONN_STATE_RESOLVE_WAIT
:
133 case AP_CONN_STATE_CONTROLLER_WAIT
:
135 "data from edge while in '%s' state. Leaving it on buffer.",
136 conn_state_to_string(conn
->_base
.type
, conn
->_base
.state
));
139 log_warn(LD_BUG
,"Bug: Got unexpected state %d. Closing.",conn
->_base
.state
);
140 tor_fragile_assert();
141 connection_edge_end(conn
, END_STREAM_REASON_INTERNAL
, conn
->cpath_layer
);
142 connection_mark_for_close(TO_CONN(conn
));
146 /** This edge needs to be closed, because its circuit has closed.
147 * Mark it for close and return 0.
150 connection_edge_destroy(uint16_t circ_id
, edge_connection_t
*conn
)
152 if (!conn
->_base
.marked_for_close
) {
154 "CircID %d: At an edge. Marking connection for close.", circ_id
);
155 if (conn
->_base
.type
== CONN_TYPE_AP
) {
156 connection_mark_unattached_ap(conn
, END_STREAM_REASON_DESTROY
);
158 /* closing the circuit, nothing to send an END to */
159 conn
->_base
.edge_has_sent_end
= 1;
160 conn
->end_reason
= END_STREAM_REASON_DESTROY
;
161 connection_mark_for_close(TO_CONN(conn
));
162 conn
->_base
.hold_open_until_flushed
= 1;
165 conn
->cpath_layer
= NULL
;
166 conn
->on_circuit
= NULL
;
170 /** Send a relay end cell from stream <b>conn</b> to conn's circuit,
171 * with a destination of cpath_layer. (If cpath_layer is NULL, the
172 * destination is the circuit's origin.) Mark the relay end cell as
173 * closing because of <b>reason</b>.
175 * Return -1 if this function has already been called on this conn,
179 connection_edge_end(edge_connection_t
*conn
, char reason
,
180 crypt_path_t
*cpath_layer
)
182 char payload
[RELAY_PAYLOAD_SIZE
];
183 size_t payload_len
=1;
186 if (conn
->_base
.edge_has_sent_end
) {
187 log_warn(LD_BUG
,"Harmless bug: Calling connection_edge_end (reason %d) "
188 "on an already ended stream?", reason
);
189 tor_fragile_assert();
193 if (conn
->_base
.marked_for_close
) {
195 "Bug: called on conn that's already marked for close at %s:%d.",
196 conn
->_base
.marked_for_close_file
, conn
->_base
.marked_for_close
);
201 if (reason
== END_STREAM_REASON_EXITPOLICY
&&
202 !connection_edge_is_rendezvous_stream(conn
)) {
203 set_uint32(payload
+1, htonl(conn
->_base
.addr
));
204 set_uint32(payload
+5, htonl(dns_clip_ttl(conn
->address_ttl
)));
208 circ
= circuit_get_by_edge_conn(conn
);
209 if (circ
&& !circ
->marked_for_close
) {
210 log_debug(LD_EDGE
,"Marking conn (fd %d) and sending end.",conn
->_base
.s
);
211 connection_edge_send_command(conn
, circ
, RELAY_COMMAND_END
,
212 payload
, payload_len
, cpath_layer
);
214 log_debug(LD_EDGE
,"Marking conn (fd %d); no circ to send end.",
218 conn
->_base
.edge_has_sent_end
= 1;
219 conn
->end_reason
= reason
;
223 /** An error has just occured on an operation on an edge connection
224 * <b>conn</b>. Extract the errno; convert it to an end reason, and send
225 * an appropriate relay end cell to <b>cpath_layer</b>.
228 connection_edge_end_errno(edge_connection_t
*conn
, crypt_path_t
*cpath_layer
)
232 reason
= (uint8_t)errno_to_end_reason(tor_socket_errno(conn
->_base
.s
));
233 return connection_edge_end(conn
, reason
, cpath_layer
);
236 /** Connection <b>conn</b> has finished writing and has no bytes left on
239 * If it's in state 'open', stop writing, consider responding with a
240 * sendme, and return.
241 * Otherwise, stop writing and return.
243 * If <b>conn</b> is broken, mark it for close and return -1, else
247 connection_edge_finished_flushing(edge_connection_t
*conn
)
251 switch (conn
->_base
.state
) {
252 case AP_CONN_STATE_OPEN
:
253 case EXIT_CONN_STATE_OPEN
:
254 connection_stop_writing(TO_CONN(conn
));
255 connection_edge_consider_sending_sendme(conn
);
257 case AP_CONN_STATE_SOCKS_WAIT
:
258 case AP_CONN_STATE_NATD_WAIT
:
259 case AP_CONN_STATE_RENDDESC_WAIT
:
260 case AP_CONN_STATE_CIRCUIT_WAIT
:
261 case AP_CONN_STATE_CONNECT_WAIT
:
262 case AP_CONN_STATE_CONTROLLER_WAIT
:
263 connection_stop_writing(TO_CONN(conn
));
266 log_warn(LD_BUG
,"BUG: called in unexpected state %d.",conn
->_base
.state
);
267 tor_fragile_assert();
273 /** Connected handler for exit connections: start writing pending
274 * data, deliver 'CONNECTED' relay cells as appropriate, and check
275 * any pending data that may have been received. */
277 connection_edge_finished_connecting(edge_connection_t
*edge_conn
)
279 char valbuf
[INET_NTOA_BUF_LEN
];
283 tor_assert(edge_conn
);
284 tor_assert(edge_conn
->_base
.type
== CONN_TYPE_EXIT
);
285 conn
= TO_CONN(edge_conn
);
286 tor_assert(conn
->state
== EXIT_CONN_STATE_CONNECTING
);
288 in
.s_addr
= htonl(conn
->addr
);
289 tor_inet_ntoa(&in
,valbuf
,sizeof(valbuf
));
290 log_info(LD_EXIT
,"Exit connection to %s:%u (%s) established.",
291 escaped_safe_str(conn
->address
),conn
->port
,safe_str(valbuf
));
293 conn
->state
= EXIT_CONN_STATE_OPEN
;
294 connection_watch_events(conn
, EV_READ
); /* stop writing, continue reading */
295 if (connection_wants_to_flush(conn
)) /* in case there are any queued relay
297 connection_start_writing(conn
);
298 /* deliver a 'connected' relay cell back through the circuit. */
299 if (connection_edge_is_rendezvous_stream(edge_conn
)) {
300 if (connection_edge_send_command(edge_conn
,
301 circuit_get_by_edge_conn(edge_conn
),
302 RELAY_COMMAND_CONNECTED
, NULL
, 0,
303 edge_conn
->cpath_layer
) < 0)
304 return 0; /* circuit is closed, don't continue */
306 char connected_payload
[8];
307 set_uint32(connected_payload
, htonl(conn
->addr
));
308 set_uint32(connected_payload
+4,
309 htonl(dns_clip_ttl(edge_conn
->address_ttl
)));
310 if (connection_edge_send_command(edge_conn
,
311 circuit_get_by_edge_conn(edge_conn
),
312 RELAY_COMMAND_CONNECTED
,
313 connected_payload
, 8,
314 edge_conn
->cpath_layer
) < 0)
315 return 0; /* circuit is closed, don't continue */
317 tor_assert(edge_conn
->package_window
> 0);
318 /* in case the server has written anything */
319 return connection_edge_process_inbuf(edge_conn
, 1);
322 /** Define a schedule for how long to wait between retrying
323 * application connections. Rather than waiting a fixed amount of
324 * time between each retry, we wait 10 seconds each for the first
325 * two tries, and 15 seconds for each retry after
326 * that. Hopefully this will improve the expected user experience. */
328 compute_socks_timeout(edge_connection_t
*conn
)
330 if (conn
->num_socks_retries
< 2) /* try 0 and try 1 */
335 /** Find all general-purpose AP streams waiting for a response that sent their
336 * begin/resolve cell >=15 seconds ago. Detach from their current circuit, and
337 * mark their current circuit as unsuitable for new streams. Then call
338 * connection_ap_handshake_attach_circuit() to attach to a new circuit (if
339 * available) or launch a new one.
341 * For rendezvous streams, simply give up after SocksTimeout seconds (with no
345 connection_ap_expire_beginning(void)
347 connection_t
**carray
;
348 edge_connection_t
*conn
;
350 const char *nickname
;
352 time_t now
= time(NULL
);
353 or_options_t
*options
= get_options();
357 get_connection_array(&carray
, &n
);
359 for (i
= 0; i
< n
; ++i
) {
360 if (carray
[i
]->type
!= CONN_TYPE_AP
)
362 conn
= TO_EDGE_CONN(carray
[i
]);
363 /* if it's an internal bridge connection, don't yell its status. */
364 severity
= (!conn
->_base
.addr
&& !conn
->_base
.port
)
365 ? LOG_INFO
: LOG_NOTICE
;
366 if (conn
->_base
.state
== AP_CONN_STATE_CONTROLLER_WAIT
) {
367 if (now
- conn
->_base
.timestamp_lastread
>= options
->SocksTimeout
) {
368 log_fn(severity
, LD_APP
, "Closing unattached stream.");
369 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TIMEOUT
);
374 if (conn
->_base
.state
!= AP_CONN_STATE_RESOLVE_WAIT
&&
375 conn
->_base
.state
!= AP_CONN_STATE_CONNECT_WAIT
)
377 cutoff
= compute_socks_timeout(conn
);
378 if (now
- conn
->_base
.timestamp_lastread
< cutoff
)
380 circ
= circuit_get_by_edge_conn(conn
);
381 if (!circ
) { /* it's vanished? */
382 log_info(LD_APP
,"Conn is waiting (address %s), but lost its circ.",
383 safe_str(conn
->socks_request
->address
));
384 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TIMEOUT
);
387 if (circ
->purpose
== CIRCUIT_PURPOSE_C_REND_JOINED
) {
388 if (now
- conn
->_base
.timestamp_lastread
> options
->SocksTimeout
) {
389 log_fn(severity
, LD_REND
,
390 "Rend stream is %d seconds late. Giving up on address"
392 (int)(now
- conn
->_base
.timestamp_lastread
),
393 safe_str(conn
->socks_request
->address
));
394 connection_edge_end(conn
, END_STREAM_REASON_TIMEOUT
,
396 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TIMEOUT
);
400 tor_assert(circ
->purpose
== CIRCUIT_PURPOSE_C_GENERAL
);
401 nickname
= build_state_get_exit_nickname(
402 TO_ORIGIN_CIRCUIT(circ
)->build_state
);
403 log_fn(cutoff
< 15 ? LOG_INFO
: severity
, LD_APP
,
404 "We tried for %d seconds to connect to '%s' using exit '%s'."
405 " Retrying on a new circuit.",
406 (int)(now
- conn
->_base
.timestamp_lastread
),
407 safe_str(conn
->socks_request
->address
),
408 nickname
? nickname
: "*unnamed*");
409 /* send an end down the circuit */
410 connection_edge_end(conn
, END_STREAM_REASON_TIMEOUT
, conn
->cpath_layer
);
411 /* un-mark it as ending, since we're going to reuse it */
412 conn
->_base
.edge_has_sent_end
= 0;
413 conn
->end_reason
= 0;
414 /* kludge to make us not try this circuit again, yet to allow
415 * current streams on it to survive if they can: make it
416 * unattractive to use for new streams */
417 tor_assert(circ
->timestamp_dirty
);
418 circ
->timestamp_dirty
-= options
->MaxCircuitDirtiness
;
419 /* give our stream another 'cutoff' seconds to try */
420 conn
->_base
.timestamp_lastread
+= cutoff
;
421 if (conn
->num_socks_retries
< 250) /* avoid overflow */
422 conn
->num_socks_retries
++;
423 /* move it back into 'pending' state, and try to attach. */
424 if (connection_ap_detach_retriable(conn
, TO_ORIGIN_CIRCUIT(circ
),
425 END_STREAM_REASON_TIMEOUT
)<0) {
426 connection_mark_unattached_ap(conn
, END_STREAM_REASON_CANT_ATTACH
);
431 /** Tell any AP streams that are waiting for a new circuit to try again,
432 * either attaching to an available circ or launching a new one.
435 connection_ap_attach_pending(void)
437 connection_t
**carray
;
439 edge_connection_t
*edge_conn
;
442 get_connection_array(&carray
, &n
);
444 for (i
= 0; i
< n
; ++i
) {
446 if (conn
->marked_for_close
||
447 conn
->type
!= CONN_TYPE_AP
||
448 conn
->state
!= AP_CONN_STATE_CIRCUIT_WAIT
)
450 edge_conn
= TO_EDGE_CONN(conn
);
451 if (connection_ap_handshake_attach_circuit(edge_conn
) < 0) {
452 connection_mark_unattached_ap(edge_conn
, END_STREAM_REASON_CANT_ATTACH
);
457 /** A circuit failed to finish on its last hop <b>info</b>. If there
458 * are any streams waiting with this exit node in mind, but they
459 * don't absolutely require it, make them give up on it.
462 circuit_discard_optional_exit_enclaves(extend_info_t
*info
)
464 connection_t
**carray
;
466 edge_connection_t
*edge_conn
;
467 routerinfo_t
*r1
, *r2
;
470 get_connection_array(&carray
, &n
);
472 for (i
= 0; i
< n
; ++i
) {
474 if (conn
->marked_for_close
||
475 conn
->type
!= CONN_TYPE_AP
||
476 !conn
->chosen_exit_optional
)
478 edge_conn
= TO_EDGE_CONN(conn
);
479 r1
= router_get_by_nickname(edge_conn
->chosen_exit_name
, 0);
480 r2
= router_get_by_nickname(info
->nickname
, 0);
481 if (r1
&& r2
&& r1
==r2
) {
482 tor_assert(edge_conn
->socks_request
);
483 log_info(LD_APP
, "Giving up on enclave exit '%s' for destination %s.",
484 safe_str(edge_conn
->chosen_exit_name
),
485 escaped_safe_str(edge_conn
->socks_request
->address
));
486 conn
->chosen_exit_optional
= 0;
487 tor_free(edge_conn
->chosen_exit_name
); /* clears it */
492 /** The AP connection <b>conn</b> has just failed while attaching or
493 * sending a BEGIN or resolving on <b>circ</b>, but another circuit
494 * might work. Detach the circuit, and either reattach it, launch a
495 * new circuit, tell the controller, or give up as a appropriate.
497 * Returns -1 on err, 1 on success, 0 on not-yet-sure.
500 connection_ap_detach_retriable(edge_connection_t
*conn
, origin_circuit_t
*circ
,
503 control_event_stream_status(conn
, STREAM_EVENT_FAILED_RETRIABLE
, reason
);
504 conn
->_base
.timestamp_lastread
= time(NULL
);
505 if (! get_options()->LeaveStreamsUnattached
) {
506 conn
->_base
.state
= AP_CONN_STATE_CIRCUIT_WAIT
;
507 circuit_detach_stream(TO_CIRCUIT(circ
),conn
);
508 return connection_ap_handshake_attach_circuit(conn
);
510 conn
->_base
.state
= AP_CONN_STATE_CONTROLLER_WAIT
;
511 circuit_detach_stream(TO_CIRCUIT(circ
),conn
);
516 /** A client-side struct to remember requests to rewrite addresses
517 * to new addresses. These structs are stored in the hash table
518 * "addressmap" below.
520 * There are 5 ways to set an address mapping:
521 * - A MapAddress command from the controller [permanent]
522 * - An AddressMap directive in the torrc [permanent]
523 * - When a TrackHostExits torrc directive is triggered [temporary]
524 * - When a dns resolve succeeds [temporary]
525 * - When a dns resolve fails [temporary]
527 * When an addressmap request is made but one is already registered,
528 * the new one is replaced only if the currently registered one has
529 * no "new_address" (that is, it's in the process of dns resolve),
530 * or if the new one is permanent (expires==0 or 1).
532 * (We overload the 'expires' field, using "0" for mappings set via
533 * the configuration file, "1" for mappings set from the control
534 * interface, and other values for DNS mappings that can expire.)
539 int num_resolve_failures
;
540 } addressmap_entry_t
;
542 /** Entry for mapping addresses to which virtual address we mapped them to. */
545 char *hostname_address
;
546 } virtaddress_entry_t
;
548 /** A hash table to store client-side address rewrite instructions. */
549 static strmap_t
*addressmap
=NULL
;
551 * Table mapping addresses to which virtual address, if any, we
554 * We maintain the following invariant: if [A,B] is in
555 * virtaddress_reversemap, then B must be a virtual address, and [A,B]
556 * must be in addressmap. We do not require that the converse hold:
557 * if it fails, then we could end up mapping two virtual addresses to
558 * the same address, which is no disaster.
560 static strmap_t
*virtaddress_reversemap
=NULL
;
562 /** Initialize addressmap. */
564 addressmap_init(void)
566 addressmap
= strmap_new();
567 virtaddress_reversemap
= strmap_new();
570 /** Free the memory associated with the addressmap entry <b>_ent</b>. */
572 addressmap_ent_free(void *_ent
)
574 addressmap_entry_t
*ent
= _ent
;
575 tor_free(ent
->new_address
);
579 /** Free storage held by a virtaddress_entry_t* entry in <b>ent</b> */
581 addressmap_virtaddress_ent_free(void *_ent
)
583 virtaddress_entry_t
*ent
= _ent
;
584 tor_free(ent
->ipv4_address
);
585 tor_free(ent
->hostname_address
);
589 /** Free storage held by a virtaddress_entry_t* entry in <b>ent</b> */
591 addressmap_virtaddress_remove(const char *address
, addressmap_entry_t
*ent
)
593 if (ent
&& ent
->new_address
&&
594 address_is_in_virtual_range(ent
->new_address
)) {
595 virtaddress_entry_t
*ve
=
596 strmap_get(virtaddress_reversemap
, ent
->new_address
);
597 /*log_fn(LOG_NOTICE,"remove reverse mapping for %s",ent->new_address);*/
599 if (!strcmp(address
, ve
->ipv4_address
))
600 tor_free(ve
->ipv4_address
);
601 if (!strcmp(address
, ve
->hostname_address
))
602 tor_free(ve
->hostname_address
);
603 if (!ve
->ipv4_address
&& !ve
->hostname_address
) {
605 strmap_remove(virtaddress_reversemap
, ent
->new_address
);
613 addressmap_ent_remove(const char *address
, addressmap_entry_t
*ent
)
615 addressmap_virtaddress_remove(address
, ent
);
616 addressmap_ent_free(ent
);
619 /** Remove all entries from the addressmap that were set via the
620 * configuration file or the command line. */
622 addressmap_clear_configured(void)
624 addressmap_get_mappings(NULL
, 0, 0);
627 /** Remove all entries from the addressmap that are set to expire, ever. */
629 addressmap_clear_transient(void)
631 addressmap_get_mappings(NULL
, 2, TIME_MAX
);
634 /** Clean out entries from the addressmap cache that were
635 * added long enough ago that they are no longer valid.
638 addressmap_clean(time_t now
)
640 addressmap_get_mappings(NULL
, 2, now
);
643 /** Free all the elements in the addressmap, and free the addressmap
646 addressmap_free_all(void)
649 strmap_free(addressmap
, addressmap_ent_free
);
652 if (virtaddress_reversemap
) {
653 strmap_free(virtaddress_reversemap
, addressmap_virtaddress_ent_free
);
654 virtaddress_reversemap
= NULL
;
658 /** Look at address, and rewrite it until it doesn't want any
659 * more rewrites; but don't get into an infinite loop.
660 * Don't write more than maxlen chars into address.
663 addressmap_rewrite(char *address
, size_t maxlen
)
665 addressmap_entry_t
*ent
;
669 for (rewrites
= 0; rewrites
< 16; rewrites
++) {
670 ent
= strmap_get(addressmap
, address
);
672 if (!ent
|| !ent
->new_address
)
673 return; /* done, no rewrite needed */
675 cp
= tor_strdup(escaped_safe_str(ent
->new_address
));
676 log_info(LD_APP
, "Addressmap: rewriting %s to %s",
677 escaped_safe_str(address
), cp
);
679 strlcpy(address
, ent
->new_address
, maxlen
);
682 "Loop detected: we've rewritten %s 16 times! Using it as-is.",
683 escaped_safe_str(address
));
684 /* it's fine to rewrite a rewrite, but don't loop forever */
689 addressmap_rewrite_reverse(char *address
, size_t maxlen
)
691 size_t len
= maxlen
+ 16;
692 char *s
= tor_malloc(len
), *cp
;
693 addressmap_entry_t
*ent
;
695 tor_snprintf(s
, len
, "REVERSE[%s]", address
);
696 ent
= strmap_get(addressmap
, s
);
698 cp
= tor_strdup(escaped_safe_str(ent
->new_address
));
699 log_info(LD_APP
, "Rewrote reverse lookup %s -> %s",
700 escaped_safe_str(s
), cp
);
702 strlcpy(address
, ent
->new_address
, maxlen
);
709 /** Return 1 if <b>address</b> is already registered, else return 0 */
711 addressmap_have_mapping(const char *address
)
713 return strmap_get_lc(addressmap
, address
) ? 1 : 0;
716 /** Register a request to map <b>address</b> to <b>new_address</b>,
717 * which will expire on <b>expires</b> (or 0 if never expires from
718 * config file, 1 if never expires from controller, 2 if never expires
719 * (virtual address mapping) from the controller.)
721 * <b>new_address</b> should be a newly dup'ed string, which we'll use or
722 * free as appropriate. We will leave address alone.
724 * If <b>new_address</b> is NULL, or equal to <b>address</b>, remove
725 * any mappings that exist from <b>address</b>.
728 addressmap_register(const char *address
, char *new_address
, time_t expires
)
730 addressmap_entry_t
*ent
;
732 ent
= strmap_get(addressmap
, address
);
733 if (!new_address
|| !strcasecmp(address
,new_address
)) {
734 /* Remove the mapping, if any. */
735 tor_free(new_address
);
737 addressmap_ent_remove(address
,ent
);
738 strmap_remove(addressmap
, address
);
742 if (!ent
) { /* make a new one and register it */
743 ent
= tor_malloc_zero(sizeof(addressmap_entry_t
));
744 strmap_set(addressmap
, address
, ent
);
745 } else if (ent
->new_address
) { /* we need to clean up the old mapping. */
747 log_info(LD_APP
,"Temporary addressmap ('%s' to '%s') not performed, "
748 "since it's already mapped to '%s'",
749 safe_str(address
), safe_str(new_address
), safe_str(ent
->new_address
));
750 tor_free(new_address
);
753 if (address_is_in_virtual_range(ent
->new_address
) &&
755 /* XXX This isn't the perfect test; we want to avoid removing
756 * mappings set from the control interface _as virtual mapping */
757 addressmap_virtaddress_remove(address
, ent
);
759 tor_free(ent
->new_address
);
760 } /* else { we have an in-progress resolve with no mapping. } */
762 ent
->new_address
= new_address
;
763 ent
->expires
= expires
==2 ? 1 : expires
;
764 ent
->num_resolve_failures
= 0;
766 log_info(LD_CONFIG
, "Addressmap: (re)mapped '%s' to '%s'",
767 safe_str(address
), safe_str(ent
->new_address
));
768 control_event_address_mapped(address
, ent
->new_address
, expires
);
771 /** An attempt to resolve <b>address</b> failed at some OR.
772 * Increment the number of resolve failures we have on record
773 * for it, and then return that number.
776 client_dns_incr_failures(const char *address
)
778 addressmap_entry_t
*ent
= strmap_get(addressmap
, address
);
780 ent
= tor_malloc_zero(sizeof(addressmap_entry_t
));
781 ent
->expires
= time(NULL
) + MAX_DNS_ENTRY_AGE
;
782 strmap_set(addressmap
,address
,ent
);
784 ++ent
->num_resolve_failures
;
785 log_info(LD_APP
, "Address %s now has %d resolve failures.",
786 safe_str(address
), ent
->num_resolve_failures
);
787 return ent
->num_resolve_failures
;
790 /** If <b>address</b> is in the client dns addressmap, reset
791 * the number of resolve failures we have on record for it.
792 * This is used when we fail a stream because it won't resolve:
793 * otherwise future attempts on that address will only try once.
796 client_dns_clear_failures(const char *address
)
798 addressmap_entry_t
*ent
= strmap_get(addressmap
, address
);
800 ent
->num_resolve_failures
= 0;
803 /** Record the fact that <b>address</b> resolved to <b>name</b>.
804 * We can now use this in subsequent streams via addressmap_rewrite()
805 * so we can more correctly choose an exit that will allow <b>address</b>.
807 * If <b>exitname</b> is defined, then append the addresses with
808 * ".exitname.exit" before registering the mapping.
810 * If <b>ttl</b> is nonnegative, the mapping will be valid for
811 * <b>ttl</b>seconds; otherwise, we use the default.
814 client_dns_set_addressmap_impl(const char *address
, const char *name
,
815 const char *exitname
,
818 /* <address>.<hex or nickname>.exit\0 or just <address>\0 */
819 char extendedaddress
[MAX_SOCKS_ADDR_LEN
+MAX_VERBOSE_NICKNAME_LEN
+10];
820 /* 123.123.123.123.<hex or nickname>.exit\0 or just 123.123.123.123\0 */
821 char extendedval
[INET_NTOA_BUF_LEN
+MAX_VERBOSE_NICKNAME_LEN
+10];
827 ttl
= DEFAULT_DNS_TTL
;
829 ttl
= dns_clip_ttl(ttl
);
832 /* XXXX fails to ever get attempts to get an exit address of
833 * google.com.digest[=~]nickname.exit; we need a syntax for this that
834 * won't make strict RFC952-compliant applications (like us) barf. */
835 tor_snprintf(extendedaddress
, sizeof(extendedaddress
),
836 "%s.%s.exit", address
, exitname
);
837 tor_snprintf(extendedval
, sizeof(extendedval
),
838 "%s.%s.exit", name
, exitname
);
840 tor_snprintf(extendedaddress
, sizeof(extendedaddress
),
842 tor_snprintf(extendedval
, sizeof(extendedval
),
845 addressmap_register(extendedaddress
, tor_strdup(extendedval
),
849 /** Record the fact that <b>address</b> resolved to <b>val</b>.
850 * We can now use this in subsequent streams via addressmap_rewrite()
851 * so we can more correctly choose an exit that will allow <b>address</b>.
853 * If <b>exitname</b> is defined, then append the addresses with
854 * ".exitname.exit" before registering the mapping.
856 * If <b>ttl</b> is nonnegative, the mapping will be valid for
857 * <b>ttl</b>seconds; otherwise, we use the default.
860 client_dns_set_addressmap(const char *address
, uint32_t val
,
861 const char *exitname
,
865 char valbuf
[INET_NTOA_BUF_LEN
];
869 if (tor_inet_aton(address
, &in
))
870 return; /* If address was an IP address already, don't add a mapping. */
871 in
.s_addr
= htonl(val
);
872 tor_inet_ntoa(&in
,valbuf
,sizeof(valbuf
));
874 client_dns_set_addressmap_impl(address
, valbuf
, exitname
, ttl
);
879 client_dns_set_reverse_addressmap(const char *address
, const char *v
,
880 const char *exitname
,
883 size_t len
= strlen(address
) + 16;
884 char *s
= tor_malloc(len
);
885 tor_snprintf(s
, len
, "REVERSE[%s]", address
);
886 client_dns_set_addressmap_impl(s
, v
, exitname
, ttl
);
890 /* By default, we hand out 127.192.0.1 through 127.254.254.254.
891 * These addresses should map to localhost, so even if the
892 * application accidentally tried to connect to them directly (not
893 * via Tor), it wouldn't get too far astray.
895 * Eventually, we should probably make this configurable.
897 static uint32_t virtual_addr_network
= 0x7fc00000u
;
898 static uint32_t virtual_addr_netmask
= 0xffc00000u
;
899 static int virtual_addr_netmask_bits
= 10;
900 static uint32_t next_virtual_addr
= 0x7fc00000u
;
902 /** Read a netmask of the form 127.192.0.0/10 from "val", and check whether
903 * it's a valid set of virtual addresses to hand out in response to MAPADDRESS
904 * requests. Return 0 on success; set *msg (if provided) to a newly allocated
905 * string and return -1 on failure. If validate_only is false, sets the
906 * actual virtual address range to the parsed value. */
908 parse_virtual_addr_network(const char *val
, int validate_only
,
912 uint16_t port_min
, port_max
;
915 if (parse_addr_and_port_range(val
, &addr
, &mask
, &port_min
, &port_max
)) {
916 if (msg
) *msg
= tor_strdup("Error parsing VirtualAddressNetwork");
920 if (port_min
!= 1 || port_max
!= 65535) {
921 if (msg
) *msg
= tor_strdup("Can't specify ports on VirtualAddressNetwork");
925 bits
= addr_mask_get_bits(mask
);
927 if (msg
) *msg
= tor_strdup("VirtualAddressNetwork must have a mask that "
928 "can be expressed as a prefix");
933 if (msg
) *msg
= tor_strdup("VirtualAddressNetwork expects a /16 "
934 "network or larger");
941 virtual_addr_network
= addr
& mask
;
942 virtual_addr_netmask
= mask
;
943 virtual_addr_netmask_bits
= bits
;
945 if ((next_virtual_addr
& mask
) != addr
)
946 next_virtual_addr
= addr
;
952 * Return true iff <b>addr</b> is likely to have been returned by
953 * client_dns_get_unused_address.
956 address_is_in_virtual_range(const char *address
)
960 if (!strcasecmpend(address
, ".virtual")) {
962 } else if (tor_inet_aton(address
, &in
)) {
963 uint32_t addr
= ntohl(in
.s_addr
);
964 if ((addr
& virtual_addr_netmask
) == virtual_addr_network
)
970 /** Return a newly allocated string holding an address of <b>type</b>
971 * (one of RESOLVED_TYPE_{IPV4|HOSTNAME}) that has not yet been mapped,
972 * and that is very unlikely to be the address of any real host.
975 addressmap_get_virtual_address(int type
)
980 if (type
== RESOLVED_TYPE_HOSTNAME
) {
983 crypto_rand(rand
, sizeof(rand
));
984 base32_encode(buf
,sizeof(buf
),rand
,sizeof(rand
));
985 strlcat(buf
, ".virtual", sizeof(buf
));
986 } while (strmap_get(addressmap
, buf
));
987 return tor_strdup(buf
);
988 } else if (type
== RESOLVED_TYPE_IPV4
) {
989 // This is an imperfect estimate of how many addresses are available, but
991 uint32_t available
= 1u << (32-virtual_addr_netmask_bits
);
993 /* Don't hand out any .0 or .255 address. */
994 while ((next_virtual_addr
& 0xff) == 0 ||
995 (next_virtual_addr
& 0xff) == 0xff) {
998 in
.s_addr
= htonl(next_virtual_addr
);
999 tor_inet_ntoa(&in
, buf
, sizeof(buf
));
1000 if (!strmap_get(addressmap
, buf
))
1003 ++next_virtual_addr
;
1005 log_notice(LD_CONFIG
, "%d addrs available", (int)available
);
1006 if (! --available
) {
1007 log_warn(LD_CONFIG
, "Ran out of virtual addresses!");
1010 if ((next_virtual_addr
& virtual_addr_netmask
) != virtual_addr_network
)
1011 next_virtual_addr
= virtual_addr_network
;
1013 return tor_strdup(buf
);
1015 log_warn(LD_BUG
, "Called with unsupported address type (%d)", type
);
1020 /** A controller has requested that we map some address of type
1021 * <b>type</b> to the address <b>new_address</b>. Choose an address
1022 * that is unlikely to be used, and map it, and return it in a newly
1023 * allocated string. If another address of the same type is already
1024 * mapped to <b>new_address</b>, try to return a copy of that address.
1026 * The string in <b>new_address</b> may be freed, or inserted into a map
1030 addressmap_register_virtual_address(int type
, char *new_address
)
1033 virtaddress_entry_t
*vent
;
1035 tor_assert(new_address
);
1036 tor_assert(addressmap
);
1037 tor_assert(virtaddress_reversemap
);
1039 vent
= strmap_get(virtaddress_reversemap
, new_address
);
1041 vent
= tor_malloc_zero(sizeof(virtaddress_entry_t
));
1042 strmap_set(virtaddress_reversemap
, new_address
, vent
);
1045 addrp
= (type
== RESOLVED_TYPE_IPV4
) ?
1046 &vent
->ipv4_address
: &vent
->hostname_address
;
1048 addressmap_entry_t
*ent
= strmap_get(addressmap
, *addrp
);
1049 if (ent
&& ent
->new_address
&&
1050 !strcasecmp(new_address
, ent
->new_address
)) {
1051 tor_free(new_address
);
1052 return tor_strdup(*addrp
);
1055 "Internal confusion: I thought that '%s' was mapped to by "
1056 "'%s', but '%s' really maps to '%s'. This is a harmless bug.",
1057 safe_str(new_address
), safe_str(*addrp
), safe_str(*addrp
),
1058 ent
?safe_str(ent
->new_address
):"(nothing)");
1062 *addrp
= addressmap_get_virtual_address(type
);
1063 addressmap_register(*addrp
, new_address
, 2);
1067 /* Try to catch possible bugs */
1068 addressmap_entry_t
*ent
;
1069 ent
= strmap_get(addressmap
, *addrp
);
1071 tor_assert(!strcasecmp(ent
->new_address
,new_address
));
1072 vent
= strmap_get(virtaddress_reversemap
, new_address
);
1074 tor_assert(!strcasecmp(*addrp
,
1075 (type
== RESOLVED_TYPE_IPV4
) ?
1076 vent
->ipv4_address
: vent
->hostname_address
));
1077 log_fn(LOG_INFO
, "Map from %s to %s okay.",
1078 safe_str(*addrp
),safe_str(new_address
));
1085 /** Return 1 if <b>address</b> has funny characters in it like colons. Return
1086 * 0 if it's fine, or if we're configured to allow it anyway. <b>client</b>
1087 * should be true if we're using this address as a client; false if we're
1088 * using it as a server.
1091 address_is_invalid_destination(const char *address
, int client
)
1094 if (get_options()->AllowNonRFC953Hostnames
)
1097 if (get_options()->ServerDNSAllowNonRFC953Hostnames
)
1102 if (TOR_ISALNUM(*address
) ||
1105 *address
== '_') /* Underscore is not allowed, but Windows does it
1106 * sometimes, just to thumb its nose at the IETF. */
1114 /** Iterate over all address mappings which have expiry times between
1115 * min_expires and max_expires, inclusive. If sl is provided, add an
1116 * "old-addr new-addr" string to sl for each mapping. If sl is NULL,
1117 * remove the mappings.
1120 addressmap_get_mappings(smartlist_t
*sl
, time_t min_expires
,
1123 strmap_iter_t
*iter
;
1126 addressmap_entry_t
*val
;
1131 for (iter
= strmap_iter_init(addressmap
); !strmap_iter_done(iter
); ) {
1132 strmap_iter_get(iter
, &key
, &_val
);
1134 if (val
->expires
>= min_expires
&& val
->expires
<= max_expires
) {
1136 iter
= strmap_iter_next_rmv(addressmap
,iter
);
1137 addressmap_ent_remove(key
, val
);
1139 } else if (val
->new_address
) {
1140 size_t len
= strlen(key
)+strlen(val
->new_address
)+2;
1141 char *line
= tor_malloc(len
);
1142 tor_snprintf(line
, len
, "%s %s", key
, val
->new_address
);
1143 smartlist_add(sl
, line
);
1146 iter
= strmap_iter_next(addressmap
,iter
);
1150 /* Connection <b>conn</b> just finished its socks handshake, or the
1151 * controller asked us to take care of it. If <b>circ</b> is defined,
1152 * then that's where we'll want to attach it. Otherwise we have to
1153 * figure it out ourselves.
1155 * First, parse whether it's a .exit address, remap it, and so on. Then
1156 * if it's for a general circuit, try to attach it to a circuit (or launch
1157 * one as needed), else if it's for a rendezvous circuit, fetch a
1158 * rendezvous descriptor first (or attach/launch a circuit if the
1159 * rendezvous descriptor is already here and fresh enough).
1162 connection_ap_handshake_rewrite_and_attach(edge_connection_t
*conn
,
1163 origin_circuit_t
*circ
)
1165 socks_request_t
*socks
= conn
->socks_request
;
1166 hostname_type_t addresstype
;
1168 tor_strlower(socks
->address
); /* normalize it */
1169 log_debug(LD_APP
,"Client asked for %s:%d",
1170 safe_str(socks
->address
),
1173 if (socks
->command
== SOCKS_COMMAND_RESOLVE_PTR
) {
1174 if (addressmap_rewrite_reverse(socks
->address
, sizeof(socks
->address
))) {
1175 connection_ap_handshake_socks_resolved(conn
, RESOLVED_TYPE_HOSTNAME
,
1176 strlen(socks
->address
),
1177 socks
->address
, -1);
1178 connection_mark_unattached_ap(conn
,
1179 END_STREAM_REASON_ALREADY_SOCKS_REPLIED
);
1183 /* For address map controls, remap the address */
1184 addressmap_rewrite(socks
->address
, sizeof(socks
->address
));
1187 if (address_is_in_virtual_range(socks
->address
)) {
1188 /* This address was probably handed out by client_dns_get_unmapped_address,
1189 * but the mapping was discarded for some reason. We *don't* want to send
1190 * the address through Tor; that's likely to fail, and may leak
1193 log_warn(LD_APP
,"Missing mapping for virtual address '%s'. Refusing.",
1194 socks
->address
); /* don't safe_str() this yet. */
1195 connection_mark_unattached_ap(conn
, END_STREAM_REASON_INTERNAL
);
1199 /* Parse the address provided by SOCKS. Modify it in-place if it
1200 * specifies a hidden-service (.onion) or particular exit node (.exit).
1202 addresstype
= parse_extended_hostname(socks
->address
);
1204 if (addresstype
== BAD_HOSTNAME
) {
1205 log_warn(LD_APP
, "Invalid hostname %s; rejecting", socks
->address
);
1206 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TORPROTOCOL
);
1210 if (addresstype
== EXIT_HOSTNAME
) {
1211 /* foo.exit -- modify conn->chosen_exit_node to specify the exit
1212 * node, and conn->address to hold only the address portion.*/
1213 char *s
= strrchr(socks
->address
,'.');
1216 conn
->chosen_exit_name
= tor_strdup(s
+1);
1219 log_warn(LD_APP
,"Malformed exit address '%s.exit'. Refusing.",
1220 safe_str(socks
->address
));
1221 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TORPROTOCOL
);
1226 conn
->chosen_exit_name
= tor_strdup(socks
->address
);
1227 r
= router_get_by_nickname(conn
->chosen_exit_name
, 1);
1228 *socks
->address
= 0;
1230 strlcpy(socks
->address
, r
->address
, sizeof(socks
->address
));
1233 "Unrecognized server in exit address '%s.exit'. Refusing.",
1234 safe_str(socks
->address
));
1235 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TORPROTOCOL
);
1241 if (addresstype
!= ONION_HOSTNAME
) {
1242 /* not a hidden-service request (i.e. normal or .exit) */
1244 if (address_is_invalid_destination(socks
->address
, 1)) {
1246 "Destination '%s' seems to be an invalid hostname. Failing.",
1247 safe_str(socks
->address
));
1248 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TORPROTOCOL
);
1252 if (socks
->command
== SOCKS_COMMAND_RESOLVE
) {
1255 /* Reply to resolves immediately if we can. */
1256 if (strlen(socks
->address
) > RELAY_PAYLOAD_SIZE
) {
1257 log_warn(LD_APP
,"Address to be resolved is too large. Failing.");
1258 connection_ap_handshake_socks_resolved(conn
,RESOLVED_TYPE_ERROR
,
1260 connection_mark_unattached_ap(conn
,
1261 END_STREAM_REASON_ALREADY_SOCKS_REPLIED
);
1264 if (tor_inet_aton(socks
->address
, &in
)) { /* see if it's an IP already */
1265 answer
= in
.s_addr
; /* leave it in network order */
1266 connection_ap_handshake_socks_resolved(conn
,RESOLVED_TYPE_IPV4
,4,
1268 connection_mark_unattached_ap(conn
,
1269 END_STREAM_REASON_ALREADY_SOCKS_REPLIED
);
1272 rep_hist_note_used_resolve(time(NULL
)); /* help predict this next time */
1273 } else if (socks
->command
== SOCKS_COMMAND_CONNECT
) {
1274 if (socks
->port
== 0) {
1275 log_notice(LD_APP
,"Application asked to connect to port 0. Refusing.");
1276 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TORPROTOCOL
);
1280 if (!conn
->chosen_exit_name
&& !circ
) {
1281 /* see if we can find a suitable enclave exit */
1283 router_find_exact_exit_enclave(socks
->address
, socks
->port
);
1286 "Redirecting address %s to exit at enclave router %s",
1287 safe_str(socks
->address
), r
->nickname
);
1288 /* use the hex digest, not nickname, in case there are two
1289 routers with this nickname */
1290 conn
->chosen_exit_name
=
1291 tor_strdup(hex_str(r
->cache_info
.identity_digest
, DIGEST_LEN
));
1292 conn
->_base
.chosen_exit_optional
= 1;
1296 /* help predict this next time */
1297 rep_hist_note_used_port(socks
->port
, time(NULL
));
1298 } else if (socks
->command
== SOCKS_COMMAND_RESOLVE_PTR
) {
1299 rep_hist_note_used_resolve(time(NULL
)); /* help predict this next time */
1300 } else if (socks
->command
== SOCKS_COMMAND_CONNECT_DIR
) {
1303 tor_fragile_assert();
1305 conn
->_base
.state
= AP_CONN_STATE_CIRCUIT_WAIT
;
1307 connection_ap_handshake_attach_chosen_circuit(conn
, circ
) < 0) ||
1309 connection_ap_handshake_attach_circuit(conn
) < 0)) {
1310 connection_mark_unattached_ap(conn
, END_STREAM_REASON_CANT_ATTACH
);
1315 /* it's a hidden-service request */
1316 rend_cache_entry_t
*entry
;
1319 if (!SOCKS_COMMAND_IS_CONNECT(socks
->command
)) {
1320 /* if it's a resolve request, fail it right now, rather than
1321 * building all the circuits and then realizing it won't work. */
1323 "Resolve requests to hidden services not allowed. Failing.");
1324 connection_ap_handshake_socks_resolved(conn
,RESOLVED_TYPE_ERROR
,
1326 connection_mark_unattached_ap(conn
,
1327 END_STREAM_REASON_ALREADY_SOCKS_REPLIED
);
1332 log_warn(LD_CONTROL
, "Attachstream to a circuit is not "
1333 "supported for .onion addresses currently. Failing.");
1334 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TORPROTOCOL
);
1338 strlcpy(conn
->rend_query
, socks
->address
, sizeof(conn
->rend_query
));
1339 log_info(LD_REND
,"Got a hidden service request for ID '%s'",
1340 safe_str(conn
->rend_query
));
1341 /* see if we already have it cached */
1342 r
= rend_cache_lookup_entry(conn
->rend_query
, -1, &entry
);
1344 log_warn(LD_BUG
,"Bug: Invalid service name '%s'",
1345 safe_str(conn
->rend_query
));
1346 connection_mark_unattached_ap(conn
, END_STREAM_REASON_TORPROTOCOL
);
1350 conn
->_base
.state
= AP_CONN_STATE_RENDDESC_WAIT
;
1351 log_info(LD_REND
, "Unknown descriptor %s. Fetching.",
1352 safe_str(conn
->rend_query
));
1353 rend_client_refetch_renddesc(conn
->rend_query
);
1354 } else { /* r > 0 */
1355 #define NUM_SECONDS_BEFORE_REFETCH (60*15)
1356 if (time(NULL
) - entry
->received
< NUM_SECONDS_BEFORE_REFETCH
) {
1357 conn
->_base
.state
= AP_CONN_STATE_CIRCUIT_WAIT
;
1358 log_info(LD_REND
, "Descriptor is here and fresh enough. Great.");
1359 if (connection_ap_handshake_attach_circuit(conn
) < 0) {
1360 connection_mark_unattached_ap(conn
, END_STREAM_REASON_CANT_ATTACH
);
1364 conn
->_base
.state
= AP_CONN_STATE_RENDDESC_WAIT
;
1365 log_info(LD_REND
, "Stale descriptor %s. Refetching.",
1366 safe_str(conn
->rend_query
));
1367 rend_client_refetch_renddesc(conn
->rend_query
);
1372 return 0; /* unreached but keeps the compiler happy */
1376 static int pf_socket
= -1;
1381 /* Ideally, this should be opened before dropping privs. */
1386 /* only works on OpenBSD */
1387 pf
= open("/dev/pf", O_RDONLY
);
1389 /* works on NetBSD and FreeBSD */
1390 pf
= open("/dev/pf", O_RDWR
);
1394 log_warn(LD_NET
, "open(\"/dev/pf\") failed: %s", strerror(errno
));
1403 /** Fetch the original destination address and port from a
1404 * system-specific interface and put them into a
1405 * socks_request_t as if they came from a socks request.
1407 * Return -1 if an error prevents fetching the destination,
1411 connection_ap_get_original_destination(edge_connection_t
*conn
,
1412 socks_request_t
*req
)
1414 #ifdef TRANS_NETFILTER
1416 struct sockaddr_in orig_dst
;
1417 socklen_t orig_dst_len
= sizeof(orig_dst
);
1418 char tmpbuf
[INET_NTOA_BUF_LEN
];
1420 if (getsockopt(conn
->_base
.s
, SOL_IP
, SO_ORIGINAL_DST
,
1421 (struct sockaddr
*)&orig_dst
, &orig_dst_len
) < 0) {
1422 int e
= tor_socket_errno(conn
->_base
.s
);
1423 log_warn(LD_NET
, "getsockopt() failed: %s", tor_socket_strerror(e
));
1427 tor_inet_ntoa(&orig_dst
.sin_addr
, tmpbuf
, sizeof(tmpbuf
));
1428 strlcpy(req
->address
, tmpbuf
, sizeof(req
->address
));
1429 req
->port
= ntohs(orig_dst
.sin_port
);
1432 #elif defined(TRANS_PF)
1433 struct sockaddr_in proxy_addr
;
1434 socklen_t proxy_addr_len
= sizeof(proxy_addr
);
1435 char tmpbuf
[INET_NTOA_BUF_LEN
];
1436 struct pfioc_natlook pnl
;
1439 if (getsockname(conn
->_base
.s
, (struct sockaddr
*)&proxy_addr
,
1440 &proxy_addr_len
) < 0) {
1441 int e
= tor_socket_errno(conn
->_base
.s
);
1442 log_warn(LD_NET
, "getsockname() to determine transocks destination "
1443 "failed: %s", tor_socket_strerror(e
));
1447 memset(&pnl
, 0, sizeof(pnl
));
1449 pnl
.proto
= IPPROTO_TCP
;
1450 pnl
.direction
= PF_OUT
;
1451 pnl
.saddr
.v4
.s_addr
= htonl(conn
->_base
.addr
);
1452 pnl
.sport
= htons(conn
->_base
.port
);
1453 pnl
.daddr
.v4
.s_addr
= proxy_addr
.sin_addr
.s_addr
;
1454 pnl
.dport
= proxy_addr
.sin_port
;
1456 pf
= get_pf_socket();
1460 if (ioctl(pf
, DIOCNATLOOK
, &pnl
) < 0) {
1461 log_warn(LD_NET
, "ioctl(DIOCNATLOOK) failed: %s", strerror(errno
));
1465 tor_inet_ntoa(&pnl
.rdaddr
.v4
, tmpbuf
, sizeof(tmpbuf
));
1466 strlcpy(req
->address
, tmpbuf
, sizeof(req
->address
));
1467 req
->port
= ntohs(pnl
.rdport
);
1473 log_warn(LD_BUG
, "Called connection_ap_get_original_destination, but no "
1474 "transparent proxy method was configured.");
1479 /** connection_edge_process_inbuf() found a conn in state
1480 * socks_wait. See if conn->inbuf has the right bytes to proceed with
1481 * the socks handshake.
1483 * If the handshake is complete, send it to
1484 * connection_ap_handshake_rewrite_and_attach().
1486 * Return -1 if an unexpected error with conn occurs (and mark it for close),
1490 connection_ap_handshake_process_socks(edge_connection_t
*conn
)
1492 socks_request_t
*socks
;
1494 or_options_t
*options
= get_options();
1497 tor_assert(conn
->_base
.type
== CONN_TYPE_AP
);
1498 tor_assert(conn
->_base
.state
== AP_CONN_STATE_SOCKS_WAIT
);
1499 tor_assert(conn
->socks_request
);
1500 socks
= conn
->socks_request
;
1502 log_debug(LD_APP
,"entered.");
1504 sockshere
= fetch_from_buf_socks(conn
->_base
.inbuf
, socks
,
1505 options
->TestSocks
, options
->SafeSocks
);
1506 if (sockshere
== 0) {
1507 if (socks
->replylen
) {
1508 connection_write_to_buf(socks
->reply
, socks
->replylen
, TO_CONN(conn
));
1509 /* zero it out so we can do another round of negotiation */
1510 socks
->replylen
= 0;
1512 log_debug(LD_APP
,"socks handshake not all here yet.");
1515 } else if (sockshere
== -1) {
1516 if (socks
->replylen
) { /* we should send reply back */
1517 log_debug(LD_APP
,"reply is already set for us. Using it.");
1518 connection_ap_handshake_socks_reply(conn
, socks
->reply
, socks
->replylen
,
1519 END_STREAM_REASON_SOCKSPROTOCOL
);
1522 log_warn(LD_APP
,"Fetching socks handshake failed. Closing.");
1523 connection_ap_handshake_socks_reply(conn
, NULL
, 0,
1524 END_STREAM_REASON_SOCKSPROTOCOL
);
1526 connection_mark_unattached_ap(conn
,
1527 END_STREAM_REASON_ALREADY_SOCKS_REPLIED
);
1529 } /* else socks handshake is done, continue processing */
1531 if (hostname_is_noconnect_address(socks
->address
))
1533 control_event_stream_status(conn
, STREAM_EVENT_NEW
, 0);
1534 control_event_stream_status(conn
, STREAM_EVENT_CLOSED
, 0);
1535 connection_mark_unattached_ap(conn
, END_STREAM_REASON_DONE
);
1539 if (SOCKS_COMMAND_IS_CONNECT(socks
->command
))
1540 control_event_stream_status(conn
, STREAM_EVENT_NEW
, 0);
1542 control_event_stream_status(conn
, STREAM_EVENT_NEW_RESOLVE
, 0);
1544 if (options
->LeaveStreamsUnattached
) {
1545 conn
->_base
.state
= AP_CONN_STATE_CONTROLLER_WAIT
;
1548 return connection_ap_handshake_rewrite_and_attach(conn
, NULL
);
1551 /** connection_init_accepted_conn() found a new trans AP conn.
1552 * Get the original destination and send it to
1553 * connection_ap_handshake_rewrite_and_attach().
1555 * Return -1 if an unexpected error with conn (and it should be marked
1556 * for close), else return 0.
1559 connection_ap_process_transparent(edge_connection_t
*conn
)
1561 socks_request_t
*socks
;
1562 or_options_t
*options
= get_options();
1565 tor_assert(conn
->_base
.type
== CONN_TYPE_AP
);
1566 tor_assert(conn
->socks_request
);
1567 socks
= conn
->socks_request
;
1569 /* pretend that a socks handshake completed so we don't try to
1570 * send a socks reply down a transparent conn */
1571 socks
->command
= SOCKS_COMMAND_CONNECT
;
1572 socks
->has_finished
= 1;
1574 log_debug(LD_APP
,"entered.");
1576 if (connection_ap_get_original_destination(conn
, socks
) < 0) {
1577 log_warn(LD_APP
,"Fetching original destination failed. Closing.");
1578 connection_mark_unattached_ap(conn
,
1579 END_STREAM_REASON_CANT_FETCH_ORIG_DEST
);
1582 /* we have the original destination */
1584 control_event_stream_status(conn
, STREAM_EVENT_NEW
, 0);
1586 if (options
->LeaveStreamsUnattached
) {
1587 conn
->_base
.state
= AP_CONN_STATE_CONTROLLER_WAIT
;
1590 return connection_ap_handshake_rewrite_and_attach(conn
, NULL
);
1593 /** connection_edge_process_inbuf() found a conn in state natd_wait. See if
1594 * conn-\>inbuf has the right bytes to proceed. See FreeBSD's libalias(3) and
1595 * ProxyEncodeTcpStream() in src/lib/libalias/alias_proxy.c for the encoding
1596 * form of the original destination.
1598 * If the original destination is complete, send it to
1599 * connection_ap_handshake_rewrite_and_attach().
1601 * Return -1 if an unexpected error with conn (and it should be marked
1602 * for close), else return 0.
1605 connection_ap_process_natd(edge_connection_t
*conn
)
1607 char tmp_buf
[36], *tbuf
, *daddr
;
1610 socks_request_t
*socks
;
1611 or_options_t
*options
= get_options();
1614 tor_assert(conn
->_base
.type
== CONN_TYPE_AP
);
1615 tor_assert(conn
->_base
.state
== AP_CONN_STATE_NATD_WAIT
);
1616 tor_assert(conn
->socks_request
);
1617 socks
= conn
->socks_request
;
1619 log_debug(LD_APP
,"entered.");
1621 /* look for LF-terminated "[DEST ip_addr port]"
1622 * where ip_addr is a dotted-quad and port is in string form */
1623 err
= fetch_from_buf_line_lf(conn
->_base
.inbuf
, tmp_buf
, &tlen
);
1627 log_warn(LD_APP
,"Natd handshake failed (DEST too long). Closing");
1628 connection_mark_unattached_ap(conn
, END_STREAM_REASON_INVALID_NATD_DEST
);
1632 if (strcmpstart(tmp_buf
, "[DEST ")) {
1633 log_warn(LD_APP
,"Natd handshake was ill-formed; closing. The client "
1636 connection_mark_unattached_ap(conn
, END_STREAM_REASON_INVALID_NATD_DEST
);
1640 daddr
= tbuf
= &tmp_buf
[0] + 6; /* after end of "[DEST " */
1641 while (*tbuf
!= '\0' && *tbuf
!= ' ')
1646 /* pretend that a socks handshake completed so we don't try to
1647 * send a socks reply down a natd conn */
1648 strlcpy(socks
->address
, daddr
, sizeof(socks
->address
));
1649 socks
->port
= (uint16_t)
1650 tor_parse_long(tbuf
, 10, 1, 65535, &port_ok
, &daddr
);
1652 log_warn(LD_APP
,"Natd handshake failed; port %s is ill-formed or out "
1653 "of range.", escaped(tbuf
));
1654 connection_mark_unattached_ap(conn
, END_STREAM_REASON_INVALID_NATD_DEST
);
1658 socks
->command
= SOCKS_COMMAND_CONNECT
;
1659 socks
->has_finished
= 1;
1661 control_event_stream_status(conn
, STREAM_EVENT_NEW
, 0);
1663 if (options
->LeaveStreamsUnattached
) {
1664 conn
->_base
.state
= AP_CONN_STATE_CONTROLLER_WAIT
;
1667 conn
->_base
.state
= AP_CONN_STATE_CIRCUIT_WAIT
;
1669 return connection_ap_handshake_rewrite_and_attach(conn
, NULL
);
1672 /** Iterate over the two bytes of stream_id until we get one that is not
1673 * already in use; return it. Return 0 if can't get a unique stream_id.
1676 get_unique_stream_id_by_circ(origin_circuit_t
*circ
)
1678 edge_connection_t
*tmpconn
;
1679 uint16_t test_stream_id
;
1680 uint32_t attempts
=0;
1683 test_stream_id
= circ
->next_stream_id
++;
1684 if (++attempts
> 1<<16) {
1685 /* Make sure we don't loop forever if all stream_id's are used. */
1686 log_warn(LD_APP
,"No unused stream IDs. Failing.");
1689 if (test_stream_id
== 0)
1691 for (tmpconn
= circ
->p_streams
; tmpconn
; tmpconn
=tmpconn
->next_stream
)
1692 if (tmpconn
->stream_id
== test_stream_id
)
1694 return test_stream_id
;
1697 /** Write a relay begin cell, using destaddr and destport from ap_conn's
1698 * socks_request field, and send it down circ.
1700 * If ap_conn is broken, mark it for close and return -1. Else return 0.
1703 connection_ap_handshake_send_begin(edge_connection_t
*ap_conn
,
1704 origin_circuit_t
*circ
)
1706 char payload
[CELL_PAYLOAD_SIZE
];
1710 tor_assert(ap_conn
->_base
.type
== CONN_TYPE_AP
);
1711 tor_assert(ap_conn
->_base
.state
== AP_CONN_STATE_CIRCUIT_WAIT
);
1712 tor_assert(ap_conn
->socks_request
);
1713 tor_assert(SOCKS_COMMAND_IS_CONNECT(ap_conn
->socks_request
->command
));
1715 ap_conn
->stream_id
= get_unique_stream_id_by_circ(circ
);
1716 if (ap_conn
->stream_id
==0) {
1717 connection_mark_unattached_ap(ap_conn
, END_STREAM_REASON_INTERNAL
);
1718 circuit_mark_for_close(TO_CIRCUIT(circ
), END_CIRC_REASON_RESOURCELIMIT
);
1722 tor_snprintf(payload
,RELAY_PAYLOAD_SIZE
, "%s:%d",
1723 (circ
->_base
.purpose
== CIRCUIT_PURPOSE_C_GENERAL
) ?
1724 ap_conn
->socks_request
->address
: "",
1725 ap_conn
->socks_request
->port
);
1726 payload_len
= strlen(payload
)+1;
1729 "Sending relay cell to begin stream %d.", ap_conn
->stream_id
);
1731 begin_type
= ap_conn
->socks_request
->command
== SOCKS_COMMAND_CONNECT
?
1732 RELAY_COMMAND_BEGIN
: RELAY_COMMAND_BEGIN_DIR
;
1733 if (begin_type
== RELAY_COMMAND_BEGIN
) {
1734 tor_assert(circ
->build_state
->onehop_tunnel
== 0);
1737 if (connection_edge_send_command(ap_conn
, TO_CIRCUIT(circ
), begin_type
,
1738 begin_type
== RELAY_COMMAND_BEGIN
? payload
: NULL
,
1739 begin_type
== RELAY_COMMAND_BEGIN
? payload_len
: 0,
1740 ap_conn
->cpath_layer
) < 0)
1741 return -1; /* circuit is closed, don't continue */
1743 ap_conn
->package_window
= STREAMWINDOW_START
;
1744 ap_conn
->deliver_window
= STREAMWINDOW_START
;
1745 ap_conn
->_base
.state
= AP_CONN_STATE_CONNECT_WAIT
;
1746 log_info(LD_APP
,"Address/port sent, ap socket %d, n_circ_id %d",
1747 ap_conn
->_base
.s
, circ
->_base
.n_circ_id
);
1748 control_event_stream_status(ap_conn
, STREAM_EVENT_SENT_CONNECT
, 0);
1752 /** Write a relay resolve cell, using destaddr and destport from ap_conn's
1753 * socks_request field, and send it down circ.
1755 * If ap_conn is broken, mark it for close and return -1. Else return 0.
1758 connection_ap_handshake_send_resolve(edge_connection_t
*ap_conn
,
1759 origin_circuit_t
*circ
)
1761 int payload_len
, command
;
1762 const char *string_addr
;
1763 char inaddr_buf
[32];
1765 tor_assert(ap_conn
->_base
.type
== CONN_TYPE_AP
);
1766 tor_assert(ap_conn
->_base
.state
== AP_CONN_STATE_CIRCUIT_WAIT
);
1767 tor_assert(ap_conn
->socks_request
);
1768 tor_assert(circ
->_base
.purpose
== CIRCUIT_PURPOSE_C_GENERAL
);
1770 command
= ap_conn
->socks_request
->command
;
1771 tor_assert(SOCKS_COMMAND_IS_RESOLVE(command
));
1773 ap_conn
->stream_id
= get_unique_stream_id_by_circ(circ
);
1774 if (ap_conn
->stream_id
==0) {
1775 connection_mark_unattached_ap(ap_conn
, END_STREAM_REASON_INTERNAL
);
1776 circuit_mark_for_close(TO_CIRCUIT(circ
), END_CIRC_REASON_RESOURCELIMIT
);
1780 if (command
== SOCKS_COMMAND_RESOLVE
) {
1781 string_addr
= ap_conn
->socks_request
->address
;
1782 payload_len
= strlen(string_addr
)+1;
1783 tor_assert(payload_len
<= RELAY_PAYLOAD_SIZE
);
1787 if (tor_inet_aton(ap_conn
->socks_request
->address
, &in
) == 0) {
1788 connection_mark_unattached_ap(ap_conn
, END_STREAM_REASON_INTERNAL
);
1791 a
= ntohl(in
.s_addr
);
1792 tor_snprintf(inaddr_buf
, sizeof(inaddr_buf
), "%d.%d.%d.%d.in-addr.arpa",
1793 (int)(uint8_t)((a
)&0xff),
1794 (int)(uint8_t)((a
>>8 )&0xff),
1795 (int)(uint8_t)((a
>>16)&0xff),
1796 (int)(uint8_t)((a
>>24)&0xff));
1797 string_addr
= inaddr_buf
;
1798 payload_len
= strlen(inaddr_buf
)+1;
1799 tor_assert(payload_len
<= RELAY_PAYLOAD_SIZE
);
1803 "Sending relay cell to begin stream %d.", ap_conn
->stream_id
);
1805 if (connection_edge_send_command(ap_conn
, TO_CIRCUIT(circ
),
1806 RELAY_COMMAND_RESOLVE
,
1807 string_addr
, payload_len
, ap_conn
->cpath_layer
) < 0)
1808 return -1; /* circuit is closed, don't continue */
1810 ap_conn
->_base
.state
= AP_CONN_STATE_RESOLVE_WAIT
;
1811 log_info(LD_APP
,"Address sent for resolve, ap socket %d, n_circ_id %d",
1812 ap_conn
->_base
.s
, circ
->_base
.n_circ_id
);
1813 control_event_stream_status(ap_conn
, STREAM_EVENT_SENT_RESOLVE
, 0);
1817 /** Make an AP connection_t, do a socketpair and attach one side
1818 * to the conn, connection_add it, initialize it to circuit_wait,
1819 * and call connection_ap_handshake_attach_circuit(conn) on it.
1821 * Return the other end of the socketpair, or -1 if error.
1824 connection_ap_make_bridge(char *address
, uint16_t port
,
1825 const char *digest
, int command
)
1828 edge_connection_t
*conn
;
1831 log_info(LD_APP
,"Making AP bridge to %s:%d ...",safe_str(address
),port
);
1833 if ((err
= tor_socketpair(AF_UNIX
, SOCK_STREAM
, 0, fd
)) < 0) {
1835 "Couldn't construct socketpair (%s). Network down? Delaying.",
1836 tor_socket_strerror(-err
));
1840 tor_assert(fd
[0] >= 0);
1841 tor_assert(fd
[1] >= 0);
1843 set_socket_nonblocking(fd
[0]);
1844 set_socket_nonblocking(fd
[1]);
1846 conn
= TO_EDGE_CONN(connection_new(CONN_TYPE_AP
));
1847 conn
->_base
.s
= fd
[0];
1849 /* populate conn->socks_request */
1851 /* leave version at zero, so the socks_reply is empty */
1852 conn
->socks_request
->socks_version
= 0;
1853 conn
->socks_request
->has_finished
= 0; /* waiting for 'connected' */
1854 strlcpy(conn
->socks_request
->address
, address
,
1855 sizeof(conn
->socks_request
->address
));
1856 conn
->socks_request
->port
= port
;
1857 conn
->socks_request
->command
= command
;
1858 if (command
== SOCKS_COMMAND_CONNECT_DIR
) {
1859 conn
->chosen_exit_name
= tor_malloc(HEX_DIGEST_LEN
+2);
1860 conn
->chosen_exit_name
[0] = '$';
1861 base16_encode(conn
->chosen_exit_name
+1,HEX_DIGEST_LEN
+1,
1862 digest
, DIGEST_LEN
);
1865 conn
->_base
.address
= tor_strdup("(local bridge)");
1866 conn
->_base
.addr
= 0;
1867 conn
->_base
.port
= 0;
1869 if (connection_add(TO_CONN(conn
)) < 0) { /* no space, forget it */
1870 connection_free(TO_CONN(conn
)); /* this closes fd[0] */
1871 tor_close_socket(fd
[1]);
1875 conn
->_base
.state
= AP_CONN_STATE_CIRCUIT_WAIT
;
1876 connection_start_reading(TO_CONN(conn
));
1878 /* attaching to a dirty circuit is fine */
1879 if (connection_ap_handshake_attach_circuit(conn
) < 0) {
1880 connection_mark_unattached_ap(conn
, END_STREAM_REASON_CANT_ATTACH
);
1881 tor_close_socket(fd
[1]);
1885 log_info(LD_APP
,"... AP bridge created and connected.");
1889 /** Send an answer to an AP connection that has requested a DNS lookup
1890 * via SOCKS. The type should be one of RESOLVED_TYPE_(IPV4|IPV6|HOSTNAME) or
1891 * -1 for unreachable; the answer should be in the format specified
1892 * in the socks extensions document.
1895 connection_ap_handshake_socks_resolved(edge_connection_t
*conn
,
1905 if (answer_type
== RESOLVED_TYPE_IPV4
&& answer_len
== 4) {
1906 uint32_t a
= ntohl(get_uint32(answer
));
1908 client_dns_set_addressmap(conn
->socks_request
->address
, a
,
1909 conn
->chosen_exit_name
, ttl
);
1910 } else if (answer_type
== RESOLVED_TYPE_HOSTNAME
&& answer_len
< 256) {
1911 char *cp
= tor_strndup(answer
, answer_len
);
1912 client_dns_set_reverse_addressmap(conn
->socks_request
->address
,
1914 conn
->chosen_exit_name
, ttl
);
1919 if (conn
->socks_request
->socks_version
== 4) {
1920 buf
[0] = 0x00; /* version */
1921 if (answer_type
== RESOLVED_TYPE_IPV4
&& answer_len
== 4) {
1922 buf
[1] = 90; /* "Granted" */
1923 set_uint16(buf
+2, 0);
1924 memcpy(buf
+4, answer
, 4); /* address */
1925 replylen
= SOCKS4_NETWORK_LEN
;
1927 buf
[1] = 91; /* "error" */
1928 memset(buf
+2, 0, 6);
1929 replylen
= SOCKS4_NETWORK_LEN
;
1933 buf
[0] = 0x05; /* version */
1934 if (answer_type
== RESOLVED_TYPE_IPV4
&& answer_len
== 4) {
1935 buf
[1] = SOCKS5_SUCCEEDED
;
1936 buf
[2] = 0; /* reserved */
1937 buf
[3] = 0x01; /* IPv4 address type */
1938 memcpy(buf
+4, answer
, 4); /* address */
1939 set_uint16(buf
+8, 0); /* port == 0. */
1941 } else if (answer_type
== RESOLVED_TYPE_IPV6
&& answer_len
== 16) {
1942 buf
[1] = SOCKS5_SUCCEEDED
;
1943 buf
[2] = 0; /* reserved */
1944 buf
[3] = 0x04; /* IPv6 address type */
1945 memcpy(buf
+4, answer
, 16); /* address */
1946 set_uint16(buf
+20, 0); /* port == 0. */
1948 } else if (answer_type
== RESOLVED_TYPE_HOSTNAME
&& answer_len
< 256) {
1949 buf
[1] = SOCKS5_SUCCEEDED
;
1950 buf
[2] = 0; /* reserved */
1951 buf
[3] = 0x03; /* Domainname address type */
1952 buf
[4] = (char)answer_len
;
1953 memcpy(buf
+5, answer
, answer_len
); /* address */
1954 set_uint16(buf
+5+answer_len
, 0); /* port == 0. */
1955 replylen
= 5+answer_len
+2;
1957 buf
[1] = SOCKS5_HOST_UNREACHABLE
;
1958 memset(buf
+2, 0, 8);
1962 connection_ap_handshake_socks_reply(conn
, buf
, replylen
,
1963 (answer_type
== RESOLVED_TYPE_IPV4
||
1964 answer_type
== RESOLVED_TYPE_IPV6
) ?
1965 0 : END_STREAM_REASON_RESOLVEFAILED
);
1968 /** Send a socks reply to stream <b>conn</b>, using the appropriate
1969 * socks version, etc, and mark <b>conn</b> as completed with SOCKS
1972 * If <b>reply</b> is defined, then write <b>replylen</b> bytes of it
1973 * to conn and return, else reply based on <b>status</b>.
1975 * If <b>reply</b> is undefined, <b>status</b> can't be 0.
1979 connection_ap_handshake_socks_reply(edge_connection_t
*conn
, char *reply
,
1980 size_t replylen
, int endreason
)
1983 socks5_reply_status_t status
=
1984 connection_edge_end_reason_socks5_response(endreason
);
1986 tor_assert(conn
->socks_request
); /* make sure it's an AP stream */
1988 control_event_stream_status(conn
,
1989 status
==SOCKS5_SUCCEEDED
? STREAM_EVENT_SUCCEEDED
: STREAM_EVENT_FAILED
,
1992 if (conn
->socks_request
->has_finished
) {
1993 log_warn(LD_BUG
, "Harmless bug: duplicate calls to "
1994 "connection_ap_handshake_socks_reply.");
1997 if (replylen
) { /* we already have a reply in mind */
1998 connection_write_to_buf(reply
, replylen
, TO_CONN(conn
));
1999 conn
->socks_request
->has_finished
= 1;
2002 if (conn
->socks_request
->socks_version
== 4) {
2003 memset(buf
,0,SOCKS4_NETWORK_LEN
);
2004 #define SOCKS4_GRANTED 90
2005 #define SOCKS4_REJECT 91
2006 buf
[1] = (status
==SOCKS5_SUCCEEDED
? SOCKS4_GRANTED
: SOCKS4_REJECT
);
2007 /* leave version, destport, destip zero */
2008 connection_write_to_buf(buf
, SOCKS4_NETWORK_LEN
, TO_CONN(conn
));
2009 } else if (conn
->socks_request
->socks_version
== 5) {
2010 buf
[0] = 5; /* version 5 */
2011 buf
[1] = (char)status
;
2013 buf
[3] = 1; /* ipv4 addr */
2014 memset(buf
+4,0,6); /* Set external addr/port to 0.
2015 The spec doesn't seem to say what to do here. -RD */
2016 connection_write_to_buf(buf
,10,TO_CONN(conn
));
2018 /* If socks_version isn't 4 or 5, don't send anything.
2019 * This can happen in the case of AP bridges. */
2020 conn
->socks_request
->has_finished
= 1;
2024 /** A relay 'begin' cell has arrived, and either we are an exit hop
2025 * for the circuit, or we are the origin and it is a rendezvous begin.
2027 * Launch a new exit connection and initialize things appropriately.
2029 * If it's a rendezvous stream, call connection_exit_connect() on
2032 * For general streams, call dns_resolve() on it first, and only call
2033 * connection_exit_connect() if the dns answer is already known.
2035 * Note that we don't call connection_add() on the new stream! We wait
2036 * for connection_exit_connect() to do that.
2038 * Return -(some circuit end reason) if we want to tear down <b>circ</b>.
2042 connection_exit_begin_conn(cell_t
*cell
, circuit_t
*circ
)
2044 edge_connection_t
*n_stream
;
2048 char end_payload
[1];
2049 or_circuit_t
*or_circ
= NULL
;
2051 assert_circuit_ok(circ
);
2052 if (!CIRCUIT_IS_ORIGIN(circ
))
2053 or_circ
= TO_OR_CIRCUIT(circ
);
2055 relay_header_unpack(&rh
, cell
->payload
);
2057 /* Note: we have to use relay_send_command_from_edge here, not
2058 * connection_edge_end or connection_edge_send_command, since those require
2059 * that we have a stream connected to a circuit, and we don't connect to a
2060 * circuit until we have a pending/successful resolve. */
2062 if (!server_mode(get_options()) &&
2063 circ
->purpose
!= CIRCUIT_PURPOSE_S_REND_JOINED
) {
2064 log_fn(LOG_PROTOCOL_WARN
, LD_PROTOCOL
,
2065 "Relay begin cell at non-server. Closing.");
2066 end_payload
[0] = END_STREAM_REASON_EXITPOLICY
;
2067 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2068 end_payload
, 1, NULL
);
2072 if (rh
.command
== RELAY_COMMAND_BEGIN
) {
2073 if (!memchr(cell
->payload
+RELAY_HEADER_SIZE
, 0, rh
.length
)) {
2074 log_fn(LOG_PROTOCOL_WARN
, LD_PROTOCOL
,
2075 "Relay begin cell has no \\0. Closing.");
2076 end_payload
[0] = END_STREAM_REASON_TORPROTOCOL
;
2077 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2078 end_payload
, 1, NULL
);
2081 if (parse_addr_port(LOG_PROTOCOL_WARN
, cell
->payload
+RELAY_HEADER_SIZE
,
2082 &address
,NULL
,&port
)<0) {
2083 log_fn(LOG_PROTOCOL_WARN
, LD_PROTOCOL
,
2084 "Unable to parse addr:port in relay begin cell. Closing.");
2085 end_payload
[0] = END_STREAM_REASON_TORPROTOCOL
;
2086 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2087 end_payload
, 1, NULL
);
2091 log_fn(LOG_PROTOCOL_WARN
, LD_PROTOCOL
,
2092 "Missing port in relay begin cell. Closing.");
2093 end_payload
[0] = END_STREAM_REASON_TORPROTOCOL
;
2094 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2095 end_payload
, 1, NULL
);
2099 if (or_circ
&& or_circ
->is_first_hop
) {
2100 /* Don't let clients use us as a single-hop proxy; it attracts attackers
2101 * and users who'd be better off with, well, single-hop proxies.
2103 log_fn(LOG_PROTOCOL_WARN
, LD_PROTOCOL
,
2104 "Attempt to open a stream on first hop of circuit. Closing.");
2105 end_payload
[0] = END_STREAM_REASON_TORPROTOCOL
;
2106 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2107 end_payload
, 1, NULL
);
2111 } else if (rh
.command
== RELAY_COMMAND_BEGIN_DIR
) {
2112 or_options_t
*options
= get_options();
2113 port
= options
->DirPort
; /* not actually used to open a connection */
2114 if (!port
|| circ
->purpose
!= CIRCUIT_PURPOSE_OR
) {
2115 end_payload
[0] = END_STREAM_REASON_NOTDIRECTORY
;
2116 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2117 end_payload
, 1, NULL
);
2120 if (or_circ
&& or_circ
->p_conn
&& or_circ
->p_conn
->_base
.address
)
2121 address
= tor_strdup(or_circ
->p_conn
->_base
.address
);
2123 address
= tor_strdup("127.0.0.1");
2125 log_warn(LD_BUG
, "Got an unexpected command %d", (int)rh
.command
);
2126 end_payload
[0] = END_STREAM_REASON_INTERNAL
;
2127 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2128 end_payload
, 1, NULL
);
2132 log_debug(LD_EXIT
,"Creating new exit connection.");
2133 n_stream
= TO_EDGE_CONN(connection_new(CONN_TYPE_EXIT
));
2134 n_stream
->_base
.purpose
= EXIT_PURPOSE_CONNECT
;
2136 n_stream
->stream_id
= rh
.stream_id
;
2137 n_stream
->_base
.port
= port
;
2138 /* leave n_stream->s at -1, because it's not yet valid */
2139 n_stream
->package_window
= STREAMWINDOW_START
;
2140 n_stream
->deliver_window
= STREAMWINDOW_START
;
2142 if (circ
->purpose
== CIRCUIT_PURPOSE_S_REND_JOINED
) {
2143 origin_circuit_t
*origin_circ
= TO_ORIGIN_CIRCUIT(circ
);
2144 log_debug(LD_REND
,"begin is for rendezvous. configuring stream.");
2145 n_stream
->_base
.address
= tor_strdup("(rendezvous)");
2146 n_stream
->_base
.state
= EXIT_CONN_STATE_CONNECTING
;
2147 strlcpy(n_stream
->rend_query
, origin_circ
->rend_query
,
2148 sizeof(n_stream
->rend_query
));
2149 tor_assert(connection_edge_is_rendezvous_stream(n_stream
));
2150 assert_circuit_ok(circ
);
2151 if (rend_service_set_connection_addr_port(n_stream
, origin_circ
) < 0) {
2152 log_info(LD_REND
,"Didn't find rendezvous service (port %d)",
2153 n_stream
->_base
.port
);
2154 end_payload
[0] = END_STREAM_REASON_EXITPOLICY
;
2155 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2156 end_payload
, 1, NULL
);
2157 connection_free(TO_CONN(n_stream
));
2158 /* knock the whole thing down, somebody screwed up */
2159 circuit_mark_for_close(circ
, END_CIRC_REASON_CONNECTFAILED
);
2163 assert_circuit_ok(circ
);
2164 log_debug(LD_REND
,"Finished assigning addr/port");
2165 n_stream
->cpath_layer
= origin_circ
->cpath
->prev
; /* link it */
2167 /* add it into the linked list of n_streams on this circuit */
2168 n_stream
->next_stream
= origin_circ
->p_streams
;
2169 n_stream
->on_circuit
= circ
;
2170 origin_circ
->p_streams
= n_stream
;
2171 assert_circuit_ok(circ
);
2173 connection_exit_connect(n_stream
);
2177 tor_strlower(address
);
2178 n_stream
->_base
.address
= address
;
2179 n_stream
->_base
.state
= EXIT_CONN_STATE_RESOLVEFAILED
;
2180 /* default to failed, change in dns_resolve if it turns out not to fail */
2182 if (we_are_hibernating()) {
2183 end_payload
[0] = END_STREAM_REASON_HIBERNATING
;
2184 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2185 end_payload
, 1, NULL
);
2186 connection_free(TO_CONN(n_stream
));
2189 log_debug(LD_EXIT
,"about to start the dns_resolve().");
2191 if (rh
.command
== RELAY_COMMAND_BEGIN_DIR
) {
2192 if (or_circ
&& or_circ
->p_conn
&& or_circ
->p_conn
->_base
.addr
)
2193 n_stream
->_base
.addr
= or_circ
->p_conn
->_base
.addr
;
2194 n_stream
->next_stream
= TO_OR_CIRCUIT(circ
)->n_streams
;
2195 n_stream
->on_circuit
= circ
;
2196 TO_OR_CIRCUIT(circ
)->n_streams
= n_stream
;
2197 return connection_exit_connect_dir(n_stream
);
2200 /* send it off to the gethostbyname farm */
2201 switch (dns_resolve(n_stream
, NULL
)) {
2202 case 1: /* resolve worked */
2204 /* add it into the linked list of n_streams on this circuit */
2205 n_stream
->next_stream
= TO_OR_CIRCUIT(circ
)->n_streams
;
2206 n_stream
->on_circuit
= circ
;
2207 TO_OR_CIRCUIT(circ
)->n_streams
= n_stream
;
2208 assert_circuit_ok(circ
);
2210 log_debug(LD_EXIT
,"about to call connection_exit_connect().");
2211 connection_exit_connect(n_stream
);
2213 case -1: /* resolve failed */
2214 end_payload
[0] = END_STREAM_REASON_RESOLVEFAILED
;
2215 relay_send_command_from_edge(rh
.stream_id
, circ
, RELAY_COMMAND_END
,
2216 end_payload
, 1, NULL
);
2217 /* n_stream got freed. don't touch it. */
2219 case 0: /* resolve added to pending list */
2220 /* add it into the linked list of resolving_streams on this circuit */
2221 n_stream
->next_stream
= TO_OR_CIRCUIT(circ
)->resolving_streams
;
2222 n_stream
->on_circuit
= circ
;
2223 TO_OR_CIRCUIT(circ
)->resolving_streams
= n_stream
;
2224 assert_circuit_ok(circ
);
2231 * Called when we receive a RELAY_RESOLVE cell 'cell' along the circuit 'circ';
2232 * begin resolving the hostname, and (eventually) reply with a RESOLVED cell.
2235 connection_exit_begin_resolve(cell_t
*cell
, or_circuit_t
*circ
)
2237 edge_connection_t
*dummy_conn
;
2240 assert_circuit_ok(TO_CIRCUIT(circ
));
2241 relay_header_unpack(&rh
, cell
->payload
);
2243 /* This 'dummy_conn' only exists to remember the stream ID
2244 * associated with the resolve request; and to make the
2245 * implementation of dns.c more uniform. (We really only need to
2246 * remember the circuit, the stream ID, and the hostname to be
2247 * resolved; but if we didn't store them in a connection like this,
2248 * the housekeeping in dns.c would get way more complicated.)
2250 dummy_conn
= TO_EDGE_CONN(connection_new(CONN_TYPE_EXIT
));
2251 dummy_conn
->stream_id
= rh
.stream_id
;
2252 dummy_conn
->_base
.address
= tor_strndup(cell
->payload
+RELAY_HEADER_SIZE
,
2254 dummy_conn
->_base
.port
= 0;
2255 dummy_conn
->_base
.state
= EXIT_CONN_STATE_RESOLVEFAILED
;
2256 dummy_conn
->_base
.purpose
= EXIT_PURPOSE_RESOLVE
;
2258 /* send it off to the gethostbyname farm */
2259 switch (dns_resolve(dummy_conn
, circ
)) {
2260 case -1: /* Impossible to resolve; a resolved cell was sent. */
2261 /* Connection freed; don't touch it. */
2263 case 1: /* The result was cached; a resolved cell was sent. */
2264 if (!dummy_conn
->_base
.marked_for_close
)
2265 connection_free(TO_CONN(dummy_conn
));
2267 case 0: /* resolve added to pending list */
2268 dummy_conn
->next_stream
= circ
->resolving_streams
;
2269 dummy_conn
->on_circuit
= TO_CIRCUIT(circ
);
2270 circ
->resolving_streams
= dummy_conn
;
2271 assert_circuit_ok(TO_CIRCUIT(circ
));
2277 /** Connect to conn's specified addr and port. If it worked, conn
2278 * has now been added to the connection_array.
2280 * Send back a connected cell. Include the resolved IP of the destination
2281 * address, but <em>only</em> if it's a general exit stream. (Rendezvous
2282 * streams must not reveal what IP they connected to.)
2285 connection_exit_connect(edge_connection_t
*edge_conn
)
2289 connection_t
*conn
= TO_CONN(edge_conn
);
2291 if (!connection_edge_is_rendezvous_stream(edge_conn
) &&
2292 router_compare_to_my_exit_policy(edge_conn
)) {
2293 log_info(LD_EXIT
,"%s:%d failed exit policy. Closing.",
2294 escaped_safe_str(conn
->address
), conn
->port
);
2295 connection_edge_end(edge_conn
, END_STREAM_REASON_EXITPOLICY
,
2296 edge_conn
->cpath_layer
);
2297 circuit_detach_stream(circuit_get_by_edge_conn(edge_conn
), edge_conn
);
2298 connection_free(conn
);
2304 if (redirect_exit_list
) {
2305 SMARTLIST_FOREACH(redirect_exit_list
, exit_redirect_t
*, r
,
2307 if ((addr
&r
->mask
)==(r
->addr
&r
->mask
) &&
2308 (r
->port_min
<= port
) && (port
<= r
->port_max
)) {
2310 if (r
->is_redirect
) {
2311 char tmpbuf
[INET_NTOA_BUF_LEN
];
2312 addr
= r
->addr_dest
;
2313 port
= r
->port_dest
;
2314 in
.s_addr
= htonl(addr
);
2315 tor_inet_ntoa(&in
, tmpbuf
, sizeof(tmpbuf
));
2316 log_debug(LD_EXIT
, "Redirecting connection from %s:%d to %s:%d",
2317 escaped_safe_str(conn
->address
), conn
->port
,
2318 safe_str(tmpbuf
), port
);
2325 log_debug(LD_EXIT
,"about to try connecting");
2326 switch (connection_connect(conn
, conn
->address
, addr
, port
)) {
2328 connection_edge_end_errno(edge_conn
, edge_conn
->cpath_layer
);
2329 circuit_detach_stream(circuit_get_by_edge_conn(edge_conn
), edge_conn
);
2330 connection_free(conn
);
2333 conn
->state
= EXIT_CONN_STATE_CONNECTING
;
2335 connection_watch_events(conn
, EV_WRITE
| EV_READ
);
2336 /* writable indicates finish;
2337 * readable/error indicates broken link in windowsland. */
2339 /* case 1: fall through */
2342 conn
->state
= EXIT_CONN_STATE_OPEN
;
2343 if (connection_wants_to_flush(conn
)) {
2344 /* in case there are any queued data cells */
2345 log_warn(LD_BUG
,"Bug: newly connected conn had data waiting!");
2346 // connection_start_writing(conn);
2348 connection_watch_events(conn
, EV_READ
);
2350 /* also, deliver a 'connected' cell back through the circuit. */
2351 if (connection_edge_is_rendezvous_stream(edge_conn
)) {
2352 /* rendezvous stream */
2353 /* don't send an address back! */
2354 connection_edge_send_command(edge_conn
,
2355 circuit_get_by_edge_conn(edge_conn
),
2356 RELAY_COMMAND_CONNECTED
,
2357 NULL
, 0, edge_conn
->cpath_layer
);
2358 } else { /* normal stream */
2359 /* This must be the original address, not the redirected address. */
2360 char connected_payload
[8];
2361 set_uint32(connected_payload
, htonl(conn
->addr
));
2362 set_uint32(connected_payload
+4,
2363 htonl(dns_clip_ttl(edge_conn
->address_ttl
)));
2364 connection_edge_send_command(edge_conn
,
2365 circuit_get_by_edge_conn(edge_conn
),
2366 RELAY_COMMAND_CONNECTED
,
2367 connected_payload
, 8, edge_conn
->cpath_layer
);
2371 /** Given an exit conn that should attach to us as a directory server, open a
2372 * bridge connection with a socketpair, create a new directory conn, and join
2373 * them together. Return 0 on success (or if there was an error we could send
2374 * back an end cell for). Return -(some circuit end reason) if the circuit
2375 * needs to be torn down. Either connects exit_conn, frees it, or marks it,
2379 connection_exit_connect_dir(edge_connection_t
*exit_conn
)
2383 dir_connection_t
*dir_conn
= NULL
;
2385 log_info(LD_EXIT
, "Opening dir bridge");
2387 if ((err
= tor_socketpair(AF_UNIX
, SOCK_STREAM
, 0, fd
)) < 0) {
2389 "Couldn't construct socketpair (%s). "
2390 "Network down? Out of sockets?",
2391 tor_socket_strerror(-err
));
2392 connection_edge_end(exit_conn
, END_STREAM_REASON_RESOURCELIMIT
,
2393 exit_conn
->cpath_layer
);
2394 connection_free(TO_CONN(exit_conn
));
2398 tor_assert(fd
[0] >= 0);
2399 tor_assert(fd
[1] >= 0);
2401 set_socket_nonblocking(fd
[0]);
2402 set_socket_nonblocking(fd
[1]);
2404 exit_conn
->_base
.s
= fd
[0];
2405 exit_conn
->_base
.state
= EXIT_CONN_STATE_OPEN
;
2407 dir_conn
= TO_DIR_CONN(connection_new(CONN_TYPE_DIR
));
2408 dir_conn
->_base
.s
= fd
[1];
2410 dir_conn
->_base
.addr
= 0x7f000001;
2411 dir_conn
->_base
.port
= 0;
2412 dir_conn
->_base
.address
= tor_strdup("Tor network");
2413 dir_conn
->_base
.type
= CONN_TYPE_DIR
;
2414 dir_conn
->_base
.purpose
= DIR_PURPOSE_SERVER
;
2415 dir_conn
->_base
.state
= DIR_CONN_STATE_SERVER_COMMAND_WAIT
;
2417 if (connection_add(TO_CONN(exit_conn
))<0) {
2418 connection_edge_end(exit_conn
, END_STREAM_REASON_RESOURCELIMIT
,
2419 exit_conn
->cpath_layer
);
2420 connection_free(TO_CONN(exit_conn
));
2421 connection_free(TO_CONN(dir_conn
));
2425 if (connection_add(TO_CONN(dir_conn
))<0) {
2426 connection_edge_end(exit_conn
, END_STREAM_REASON_RESOURCELIMIT
,
2427 exit_conn
->cpath_layer
);
2428 connection_close_immediate(TO_CONN(exit_conn
));
2429 connection_mark_for_close(TO_CONN(exit_conn
));
2430 connection_free(TO_CONN(dir_conn
));
2434 connection_start_reading(TO_CONN(dir_conn
));
2435 connection_start_reading(TO_CONN(exit_conn
));
2437 if (connection_edge_send_command(exit_conn
,
2438 circuit_get_by_edge_conn(exit_conn
),
2439 RELAY_COMMAND_CONNECTED
, NULL
, 0,
2440 exit_conn
->cpath_layer
) < 0) {
2441 connection_mark_for_close(TO_CONN(exit_conn
));
2442 connection_mark_for_close(TO_CONN(dir_conn
));
2449 /** Return 1 if <b>conn</b> is a rendezvous stream, or 0 if
2450 * it is a general stream.
2453 connection_edge_is_rendezvous_stream(edge_connection_t
*conn
)
2456 if (*conn
->rend_query
) /* XXX */
2461 /** Return 1 if router <b>exit</b> is likely to allow stream <b>conn</b>
2462 * to exit from it, or 0 if it probably will not allow it.
2463 * (We might be uncertain if conn's destination address has not yet been
2467 connection_ap_can_use_exit(edge_connection_t
*conn
, routerinfo_t
*exit
)
2470 tor_assert(conn
->_base
.type
== CONN_TYPE_AP
);
2471 tor_assert(conn
->socks_request
);
2474 /* If a particular exit node has been requested for the new connection,
2475 * make sure the exit node of the existing circuit matches exactly.
2477 if (conn
->chosen_exit_name
) {
2478 if (router_get_by_nickname(conn
->chosen_exit_name
, 1) != exit
) {
2480 // log_debug(LD_APP,"Requested node '%s', considering node '%s'. No.",
2481 // conn->chosen_exit_name, exit->nickname);
2486 if (conn
->socks_request
->command
== SOCKS_COMMAND_CONNECT
) {
2489 addr_policy_result_t r
;
2490 if (tor_inet_aton(conn
->socks_request
->address
, &in
))
2491 addr
= ntohl(in
.s_addr
);
2492 r
= compare_addr_to_addr_policy(addr
, conn
->socks_request
->port
,
2494 if (r
== ADDR_POLICY_REJECTED
|| r
== ADDR_POLICY_PROBABLY_REJECTED
)
2496 } else if (SOCKS_COMMAND_IS_RESOLVE(conn
->socks_request
->command
)) {
2497 /* Can't support reverse lookups without eventdns. */
2498 if (conn
->socks_request
->command
== SOCKS_COMMAND_RESOLVE_PTR
&&
2499 exit
->has_old_dnsworkers
)
2502 /* Don't send DNS requests to non-exit servers by default. */
2503 if (!conn
->chosen_exit_name
&& policy_is_reject_star(exit
->exit_policy
))
2509 /** Make connection redirection follow the provided list of
2510 * exit_redirect_t */
2512 set_exit_redirects(smartlist_t
*lst
)
2514 if (redirect_exit_list
) {
2515 SMARTLIST_FOREACH(redirect_exit_list
, exit_redirect_t
*, p
, tor_free(p
));
2516 smartlist_free(redirect_exit_list
);
2518 redirect_exit_list
= lst
;
2521 /** If address is of the form "y.onion" with a well-formed handle y:
2522 * Put a NUL after y, lower-case it, and return ONION_HOSTNAME.
2524 * If address is of the form "y.exit":
2525 * Put a NUL after y and return EXIT_HOSTNAME.
2528 * Return NORMAL_HOSTNAME and change nothing.
2531 parse_extended_hostname(char *address
)
2534 char query
[REND_SERVICE_ID_LEN
+1];
2536 s
= strrchr(address
,'.');
2538 return NORMAL_HOSTNAME
; /* no dot, thus normal */
2539 if (!strcmp(s
+1,"exit")) {
2540 *s
= 0; /* nul-terminate it */
2541 return EXIT_HOSTNAME
; /* .exit */
2543 if (strcmp(s
+1,"onion"))
2544 return NORMAL_HOSTNAME
; /* neither .exit nor .onion, thus normal */
2546 /* so it is .onion */
2547 *s
= 0; /* nul-terminate it */
2548 if (strlcpy(query
, address
, REND_SERVICE_ID_LEN
+1) >=
2549 REND_SERVICE_ID_LEN
+1)
2551 if (rend_valid_service_id(query
)) {
2552 return ONION_HOSTNAME
; /* success */
2555 /* otherwise, return to previous state and return 0 */
2557 return BAD_HOSTNAME
;
2560 /** Check if the address is of the form "y.noconnect"
2563 hostname_is_noconnect_address(const char *address
)
2565 return ! strcasecmpend(address
, ".noconnect");