1 /* Copyright (c) 2001 Matej Pfajfar.
2 * Copyright (c) 2001-2004, Roger Dingledine.
3 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4 * Copyright (c) 2007-2017, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
9 * \brief Master header file for Tor-specific functionality.
26 #ifdef HAVE_SYS_PARAM_H
27 #include <sys/param.h> /* FreeBSD needs this to know what version it is */
30 #ifdef HAVE_SYS_FCNTL_H
31 #include <sys/fcntl.h>
36 #ifdef HAVE_SYS_IOCTL_H
37 #include <sys/ioctl.h>
42 #ifdef HAVE_SYS_STAT_H
45 #ifdef HAVE_NETINET_IN_H
46 #include <netinet/in.h>
48 #ifdef HAVE_ARPA_INET_H
49 #include <arpa/inet.h>
67 #endif /* defined(_WIN32) */
70 #include "crypto_format.h"
73 #include "container.h"
76 #include "compat_libevent.h"
79 #include "replaycache.h"
80 #include "crypto_curve25519.h"
81 #include "crypto_ed25519.h"
82 #include "tor_queue.h"
83 #include "util_format.h"
84 #include "hs_circuitmap.h"
86 /* These signals are defined to help handle_control_signal work.
103 /* Controller signals start at a high number so we don't
104 * conflict with system-defined signals. */
105 #define SIGNEWNYM 129
106 #define SIGCLEARDNSCACHE 130
107 #define SIGHEARTBEAT 131
109 #if (SIZEOF_CELL_T != 0)
110 /* On Irix, stdlib.h defines a cell_t type, so we need to make sure
111 * that our stuff always calls cell_t something different. */
112 #define cell_t tor_cell_t
115 #ifdef ENABLE_TOR2WEB_MODE
116 #define NON_ANONYMOUS_MODE_ENABLED 1
119 /** Helper macro: Given a pointer to to.base_, of type from*, return &to. */
120 #define DOWNCAST(to, ptr) ((to*)SUBTYPE_P(ptr, to, base_))
122 /** Length of longest allowable configured nickname. */
123 #define MAX_NICKNAME_LEN 19
124 /** Length of a router identity encoded as a hexadecimal digest, plus
125 * possible dollar sign. */
126 #define MAX_HEX_NICKNAME_LEN (HEX_DIGEST_LEN+1)
127 /** Maximum length of verbose router identifier: dollar sign, hex ID digest,
128 * equal sign or tilde, nickname. */
129 #define MAX_VERBOSE_NICKNAME_LEN (1+HEX_DIGEST_LEN+1+MAX_NICKNAME_LEN)
131 /** Maximum size, in bytes, for resized buffers. */
132 #define MAX_BUF_SIZE ((1<<24)-1) /* 16MB-1 */
133 /** Maximum size, in bytes, for any directory object that we've downloaded. */
134 #define MAX_DIR_DL_SIZE MAX_BUF_SIZE
136 /** For HTTP parsing: Maximum number of bytes we'll accept in the headers
137 * of an HTTP request or response. */
138 #define MAX_HEADERS_SIZE 50000
139 /** Maximum size, in bytes, for any directory object that we're accepting
141 #define MAX_DIR_UL_SIZE MAX_BUF_SIZE
143 /** Maximum size, in bytes, of a single router descriptor uploaded to us
144 * as a directory authority. Caches and clients fetch whatever descriptors
145 * the authorities tell them to fetch, and don't care about size. */
146 #define MAX_DESCRIPTOR_UPLOAD_SIZE 20000
148 /** Maximum size of a single extrainfo document, as above. */
149 #define MAX_EXTRAINFO_UPLOAD_SIZE 50000
151 /** Minimum lifetime for an onion key in days. */
152 #define MIN_ONION_KEY_LIFETIME_DAYS (1)
154 /** Maximum lifetime for an onion key in days. */
155 #define MAX_ONION_KEY_LIFETIME_DAYS (90)
157 /** Default lifetime for an onion key in days. */
158 #define DEFAULT_ONION_KEY_LIFETIME_DAYS (28)
160 /** Minimum grace period for acceptance of an onion key in days.
161 * The maximum value is defined in proposal #274 as being the current network
162 * consensus parameter for "onion-key-rotation-days". */
163 #define MIN_ONION_KEY_GRACE_PERIOD_DAYS (1)
165 /** Default grace period for acceptance of an onion key in days. */
166 #define DEFAULT_ONION_KEY_GRACE_PERIOD_DAYS (7)
168 /** How often we should check the network consensus if it is time to rotate or
169 * expire onion keys. */
170 #define ONION_KEY_CONSENSUS_CHECK_INTERVAL (60*60)
172 /** How often do we rotate TLS contexts? */
173 #define MAX_SSL_KEY_LIFETIME_INTERNAL (2*60*60)
175 /** How old do we allow a router to get before removing it
176 * from the router list? In seconds. */
177 #define ROUTER_MAX_AGE (60*60*48)
178 /** How old can a router get before we (as a server) will no longer
179 * consider it live? In seconds. */
180 #define ROUTER_MAX_AGE_TO_PUBLISH (60*60*24)
181 /** How old do we let a saved descriptor get before force-removing it? */
182 #define OLD_ROUTER_DESC_MAX_AGE (60*60*24*5)
184 /** Possible rules for generating circuit IDs on an OR connection. */
186 CIRC_ID_TYPE_LOWER
=0, /**< Pick from 0..1<<15-1. */
187 CIRC_ID_TYPE_HIGHER
=1, /**< Pick from 1<<15..1<<16-1. */
188 /** The other side of a connection is an OP: never create circuits to it,
189 * and let it use any circuit ID it wants. */
190 CIRC_ID_TYPE_NEITHER
=2
192 #define circ_id_type_bitfield_t ENUM_BF(circ_id_type_t)
194 #define CONN_TYPE_MIN_ 3
195 /** Type for sockets listening for OR connections. */
196 #define CONN_TYPE_OR_LISTENER 3
197 /** A bidirectional TLS connection transmitting a sequence of cells.
198 * May be from an OR to an OR, or from an OP to an OR. */
199 #define CONN_TYPE_OR 4
200 /** A TCP connection from an onion router to a stream's destination. */
201 #define CONN_TYPE_EXIT 5
202 /** Type for sockets listening for SOCKS connections. */
203 #define CONN_TYPE_AP_LISTENER 6
204 /** A SOCKS proxy connection from the user application to the onion
206 #define CONN_TYPE_AP 7
207 /** Type for sockets listening for HTTP connections to the directory server. */
208 #define CONN_TYPE_DIR_LISTENER 8
209 /** Type for HTTP connections to the directory server. */
210 #define CONN_TYPE_DIR 9
211 /* Type 10 is unused. */
212 /** Type for listening for connections from user interface process. */
213 #define CONN_TYPE_CONTROL_LISTENER 11
214 /** Type for connections from user interface process. */
215 #define CONN_TYPE_CONTROL 12
216 /** Type for sockets listening for transparent connections redirected by pf or
218 #define CONN_TYPE_AP_TRANS_LISTENER 13
219 /** Type for sockets listening for transparent connections redirected by
221 #define CONN_TYPE_AP_NATD_LISTENER 14
222 /** Type for sockets listening for DNS requests. */
223 #define CONN_TYPE_AP_DNS_LISTENER 15
225 /** Type for connections from the Extended ORPort. */
226 #define CONN_TYPE_EXT_OR 16
227 /** Type for sockets listening for Extended ORPort connections. */
228 #define CONN_TYPE_EXT_OR_LISTENER 17
229 /** Type for sockets listening for HTTP CONNECT tunnel connections. */
230 #define CONN_TYPE_AP_HTTP_CONNECT_LISTENER 18
232 #define CONN_TYPE_MAX_ 19
233 /* !!!! If _CONN_TYPE_MAX is ever over 31, we must grow the type field in
236 /* Proxy client types */
238 #define PROXY_CONNECT 1
239 #define PROXY_SOCKS4 2
240 #define PROXY_SOCKS5 3
241 /* !!!! If there is ever a PROXY_* type over 3, we must grow the proxy_type
242 * field in or_connection_t */
244 /* Pluggable transport proxy type. Don't use this in or_connection_t,
245 * instead use the actual underlying proxy type (see above). */
246 #define PROXY_PLUGGABLE 4
248 /* Proxy client handshake states */
249 /* We use a proxy but we haven't even connected to it yet. */
250 #define PROXY_INFANT 1
251 /* We use an HTTP proxy and we've sent the CONNECT command. */
252 #define PROXY_HTTPS_WANT_CONNECT_OK 2
253 /* We use a SOCKS4 proxy and we've sent the CONNECT command. */
254 #define PROXY_SOCKS4_WANT_CONNECT_OK 3
255 /* We use a SOCKS5 proxy and we try to negotiate without
256 any authentication . */
257 #define PROXY_SOCKS5_WANT_AUTH_METHOD_NONE 4
258 /* We use a SOCKS5 proxy and we try to negotiate with
259 Username/Password authentication . */
260 #define PROXY_SOCKS5_WANT_AUTH_METHOD_RFC1929 5
261 /* We use a SOCKS5 proxy and we just sent our credentials. */
262 #define PROXY_SOCKS5_WANT_AUTH_RFC1929_OK 6
263 /* We use a SOCKS5 proxy and we just sent our CONNECT command. */
264 #define PROXY_SOCKS5_WANT_CONNECT_OK 7
265 /* We use a proxy and we CONNECTed successfully!. */
266 #define PROXY_CONNECTED 8
268 /** True iff <b>x</b> is an edge connection. */
269 #define CONN_IS_EDGE(x) \
270 ((x)->type == CONN_TYPE_EXIT || (x)->type == CONN_TYPE_AP)
272 /** State for any listener connection. */
273 #define LISTENER_STATE_READY 0
275 #define OR_CONN_STATE_MIN_ 1
276 /** State for a connection to an OR: waiting for connect() to finish. */
277 #define OR_CONN_STATE_CONNECTING 1
278 /** State for a connection to an OR: waiting for proxy handshake to complete */
279 #define OR_CONN_STATE_PROXY_HANDSHAKING 2
280 /** State for an OR connection client: SSL is handshaking, not done
282 #define OR_CONN_STATE_TLS_HANDSHAKING 3
283 /** State for a connection to an OR: We're doing a second SSL handshake for
284 * renegotiation purposes. (V2 handshake only.) */
285 #define OR_CONN_STATE_TLS_CLIENT_RENEGOTIATING 4
286 /** State for a connection at an OR: We're waiting for the client to
287 * renegotiate (to indicate a v2 handshake) or send a versions cell (to
288 * indicate a v3 handshake) */
289 #define OR_CONN_STATE_TLS_SERVER_RENEGOTIATING 5
290 /** State for an OR connection: We're done with our SSL handshake, we've done
291 * renegotiation, but we haven't yet negotiated link protocol versions and
292 * sent a netinfo cell. */
293 #define OR_CONN_STATE_OR_HANDSHAKING_V2 6
294 /** State for an OR connection: We're done with our SSL handshake, but we
295 * haven't yet negotiated link protocol versions, done a V3 handshake, and
296 * sent a netinfo cell. */
297 #define OR_CONN_STATE_OR_HANDSHAKING_V3 7
298 /** State for an OR connection: Ready to send/receive cells. */
299 #define OR_CONN_STATE_OPEN 8
300 #define OR_CONN_STATE_MAX_ 8
302 /** States of the Extended ORPort protocol. Be careful before changing
303 * the numbers: they matter. */
304 #define EXT_OR_CONN_STATE_MIN_ 1
305 /** Extended ORPort authentication is waiting for the authentication
306 * type selected by the client. */
307 #define EXT_OR_CONN_STATE_AUTH_WAIT_AUTH_TYPE 1
308 /** Extended ORPort authentication is waiting for the client nonce. */
309 #define EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_NONCE 2
310 /** Extended ORPort authentication is waiting for the client hash. */
311 #define EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_HASH 3
312 #define EXT_OR_CONN_STATE_AUTH_MAX 3
313 /** Authentication finished and the Extended ORPort is now accepting
315 #define EXT_OR_CONN_STATE_OPEN 4
316 /** Extended ORPort is flushing its last messages and preparing to
317 * start accepting OR connections. */
318 #define EXT_OR_CONN_STATE_FLUSHING 5
319 #define EXT_OR_CONN_STATE_MAX_ 5
321 #define EXIT_CONN_STATE_MIN_ 1
322 /** State for an exit connection: waiting for response from DNS farm. */
323 #define EXIT_CONN_STATE_RESOLVING 1
324 /** State for an exit connection: waiting for connect() to finish. */
325 #define EXIT_CONN_STATE_CONNECTING 2
326 /** State for an exit connection: open and ready to transmit data. */
327 #define EXIT_CONN_STATE_OPEN 3
328 /** State for an exit connection: waiting to be removed. */
329 #define EXIT_CONN_STATE_RESOLVEFAILED 4
330 #define EXIT_CONN_STATE_MAX_ 4
332 /* The AP state values must be disjoint from the EXIT state values. */
333 #define AP_CONN_STATE_MIN_ 5
334 /** State for a SOCKS connection: waiting for SOCKS request. */
335 #define AP_CONN_STATE_SOCKS_WAIT 5
336 /** State for a SOCKS connection: got a y.onion URL; waiting to receive
337 * rendezvous descriptor. */
338 #define AP_CONN_STATE_RENDDESC_WAIT 6
339 /** The controller will attach this connection to a circuit; it isn't our
341 #define AP_CONN_STATE_CONTROLLER_WAIT 7
342 /** State for a SOCKS connection: waiting for a completed circuit. */
343 #define AP_CONN_STATE_CIRCUIT_WAIT 8
344 /** State for a SOCKS connection: sent BEGIN, waiting for CONNECTED. */
345 #define AP_CONN_STATE_CONNECT_WAIT 9
346 /** State for a SOCKS connection: sent RESOLVE, waiting for RESOLVED. */
347 #define AP_CONN_STATE_RESOLVE_WAIT 10
348 /** State for a SOCKS connection: ready to send and receive. */
349 #define AP_CONN_STATE_OPEN 11
350 /** State for a transparent natd connection: waiting for original
352 #define AP_CONN_STATE_NATD_WAIT 12
353 /** State for an HTTP tunnel: waiting for an HTTP CONNECT command. */
354 #define AP_CONN_STATE_HTTP_CONNECT_WAIT 13
355 #define AP_CONN_STATE_MAX_ 13
357 /** True iff the AP_CONN_STATE_* value <b>s</b> means that the corresponding
358 * edge connection is not attached to any circuit. */
359 #define AP_CONN_STATE_IS_UNATTACHED(s) \
360 ((s) <= AP_CONN_STATE_CIRCUIT_WAIT || (s) == AP_CONN_STATE_NATD_WAIT)
362 #define DIR_CONN_STATE_MIN_ 1
363 /** State for connection to directory server: waiting for connect(). */
364 #define DIR_CONN_STATE_CONNECTING 1
365 /** State for connection to directory server: sending HTTP request. */
366 #define DIR_CONN_STATE_CLIENT_SENDING 2
367 /** State for connection to directory server: reading HTTP response. */
368 #define DIR_CONN_STATE_CLIENT_READING 3
369 /** State for connection to directory server: happy and finished. */
370 #define DIR_CONN_STATE_CLIENT_FINISHED 4
371 /** State for connection at directory server: waiting for HTTP request. */
372 #define DIR_CONN_STATE_SERVER_COMMAND_WAIT 5
373 /** State for connection at directory server: sending HTTP response. */
374 #define DIR_CONN_STATE_SERVER_WRITING 6
375 #define DIR_CONN_STATE_MAX_ 6
377 /** True iff the purpose of <b>conn</b> means that it's a server-side
378 * directory connection. */
379 #define DIR_CONN_IS_SERVER(conn) ((conn)->purpose == DIR_PURPOSE_SERVER)
381 #define CONTROL_CONN_STATE_MIN_ 1
382 /** State for a control connection: Authenticated and accepting v1 commands. */
383 #define CONTROL_CONN_STATE_OPEN 1
384 /** State for a control connection: Waiting for authentication; speaking
386 #define CONTROL_CONN_STATE_NEEDAUTH 2
387 #define CONTROL_CONN_STATE_MAX_ 2
389 #define DIR_PURPOSE_MIN_ 4
390 /** A connection to a directory server: set after a v2 rendezvous
391 * descriptor is downloaded. */
392 #define DIR_PURPOSE_HAS_FETCHED_RENDDESC_V2 4
393 /** A connection to a directory server: download one or more server
395 #define DIR_PURPOSE_FETCH_SERVERDESC 6
396 /** A connection to a directory server: download one or more extra-info
398 #define DIR_PURPOSE_FETCH_EXTRAINFO 7
399 /** A connection to a directory server: upload a server descriptor. */
400 #define DIR_PURPOSE_UPLOAD_DIR 8
401 /** A connection to a directory server: upload a v3 networkstatus vote. */
402 #define DIR_PURPOSE_UPLOAD_VOTE 10
403 /** A connection to a directory server: upload a v3 consensus signature */
404 #define DIR_PURPOSE_UPLOAD_SIGNATURES 11
405 /** A connection to a directory server: download one or more v3 networkstatus
407 #define DIR_PURPOSE_FETCH_STATUS_VOTE 12
408 /** A connection to a directory server: download a v3 detached signatures
409 * object for a consensus. */
410 #define DIR_PURPOSE_FETCH_DETACHED_SIGNATURES 13
411 /** A connection to a directory server: download a v3 networkstatus
413 #define DIR_PURPOSE_FETCH_CONSENSUS 14
414 /** A connection to a directory server: download one or more directory
415 * authority certificates. */
416 #define DIR_PURPOSE_FETCH_CERTIFICATE 15
418 /** Purpose for connection at a directory server. */
419 #define DIR_PURPOSE_SERVER 16
420 /** A connection to a hidden service directory server: upload a v2 rendezvous
422 #define DIR_PURPOSE_UPLOAD_RENDDESC_V2 17
423 /** A connection to a hidden service directory server: download a v2 rendezvous
425 #define DIR_PURPOSE_FETCH_RENDDESC_V2 18
426 /** A connection to a directory server: download a microdescriptor. */
427 #define DIR_PURPOSE_FETCH_MICRODESC 19
428 /** A connection to a hidden service directory: upload a v3 descriptor. */
429 #define DIR_PURPOSE_UPLOAD_HSDESC 20
430 /** A connection to a hidden service directory: fetch a v3 descriptor. */
431 #define DIR_PURPOSE_FETCH_HSDESC 21
432 /** A connection to a directory server: set after a hidden service descriptor
434 #define DIR_PURPOSE_HAS_FETCHED_HSDESC 22
435 #define DIR_PURPOSE_MAX_ 22
437 /** True iff <b>p</b> is a purpose corresponding to uploading
438 * data to a directory server. */
439 #define DIR_PURPOSE_IS_UPLOAD(p) \
440 ((p)==DIR_PURPOSE_UPLOAD_DIR || \
441 (p)==DIR_PURPOSE_UPLOAD_VOTE || \
442 (p)==DIR_PURPOSE_UPLOAD_SIGNATURES || \
443 (p)==DIR_PURPOSE_UPLOAD_RENDDESC_V2 || \
444 (p)==DIR_PURPOSE_UPLOAD_HSDESC)
446 #define EXIT_PURPOSE_MIN_ 1
447 /** This exit stream wants to do an ordinary connect. */
448 #define EXIT_PURPOSE_CONNECT 1
449 /** This exit stream wants to do a resolve (either normal or reverse). */
450 #define EXIT_PURPOSE_RESOLVE 2
451 #define EXIT_PURPOSE_MAX_ 2
453 /* !!!! If any connection purpose is ever over 31, we must grow the type
454 * field in connection_t. */
456 /** Circuit state: I'm the origin, still haven't done all my handshakes. */
457 #define CIRCUIT_STATE_BUILDING 0
458 /** Circuit state: Waiting to process the onionskin. */
459 #define CIRCUIT_STATE_ONIONSKIN_PENDING 1
460 /** Circuit state: I'd like to deliver a create, but my n_chan is still
462 #define CIRCUIT_STATE_CHAN_WAIT 2
463 /** Circuit state: the circuit is open but we don't want to actually use it
464 * until we find out if a better guard will be available.
466 #define CIRCUIT_STATE_GUARD_WAIT 3
467 /** Circuit state: onionskin(s) processed, ready to send/receive cells. */
468 #define CIRCUIT_STATE_OPEN 4
470 #define CIRCUIT_PURPOSE_MIN_ 1
472 /* these circuits were initiated elsewhere */
473 #define CIRCUIT_PURPOSE_OR_MIN_ 1
474 /** OR-side circuit purpose: normal circuit, at OR. */
475 #define CIRCUIT_PURPOSE_OR 1
476 /** OR-side circuit purpose: At OR, from the service, waiting for intro from
478 #define CIRCUIT_PURPOSE_INTRO_POINT 2
479 /** OR-side circuit purpose: At OR, from the client, waiting for the service.
481 #define CIRCUIT_PURPOSE_REND_POINT_WAITING 3
482 /** OR-side circuit purpose: At OR, both circuits have this purpose. */
483 #define CIRCUIT_PURPOSE_REND_ESTABLISHED 4
484 #define CIRCUIT_PURPOSE_OR_MAX_ 4
486 /* these circuits originate at this node */
488 /* here's how circ client-side purposes work:
489 * normal circuits are C_GENERAL.
490 * circuits that are c_introducing are either on their way to
491 * becoming open, or they are open and waiting for a
492 * suitable rendcirc before they send the intro.
493 * circuits that are c_introduce_ack_wait have sent the intro,
494 * but haven't gotten a response yet.
495 * circuits that are c_establish_rend are either on their way
496 * to becoming open, or they are open and have sent the
497 * establish_rendezvous cell but haven't received an ack.
498 * circuits that are c_rend_ready are open and have received a
499 * rend ack, but haven't heard from the service yet. if they have a
500 * buildstate->pending_final_cpath then they're expecting a
501 * cell from the service, else they're not.
502 * circuits that are c_rend_ready_intro_acked are open, and
503 * some intro circ has sent its intro and received an ack.
504 * circuits that are c_rend_joined are open, have heard from
505 * the service, and are talking to it.
507 /** Client-side circuit purpose: Normal circuit, with cpath. */
508 #define CIRCUIT_PURPOSE_C_GENERAL 5
509 #define CIRCUIT_PURPOSE_C_HS_MIN_ 6
510 /** Client-side circuit purpose: at the client, connecting to intro point. */
511 #define CIRCUIT_PURPOSE_C_INTRODUCING 6
512 /** Client-side circuit purpose: at the client, sent INTRODUCE1 to intro point,
513 * waiting for ACK/NAK. */
514 #define CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT 7
515 /** Client-side circuit purpose: at the client, introduced and acked, closing.
517 #define CIRCUIT_PURPOSE_C_INTRODUCE_ACKED 8
518 /** Client-side circuit purpose: at the client, waiting for ack. */
519 #define CIRCUIT_PURPOSE_C_ESTABLISH_REND 9
520 /** Client-side circuit purpose: at the client, waiting for the service. */
521 #define CIRCUIT_PURPOSE_C_REND_READY 10
522 /** Client-side circuit purpose: at the client, waiting for the service,
523 * INTRODUCE has been acknowledged. */
524 #define CIRCUIT_PURPOSE_C_REND_READY_INTRO_ACKED 11
525 /** Client-side circuit purpose: at the client, rendezvous established. */
526 #define CIRCUIT_PURPOSE_C_REND_JOINED 12
527 /** This circuit is used for getting hsdirs */
528 #define CIRCUIT_PURPOSE_C_HSDIR_GET 13
529 #define CIRCUIT_PURPOSE_C_HS_MAX_ 13
530 /** This circuit is used for build time measurement only */
531 #define CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT 14
532 #define CIRCUIT_PURPOSE_C_MAX_ 14
534 #define CIRCUIT_PURPOSE_S_HS_MIN_ 15
535 /** Hidden-service-side circuit purpose: at the service, waiting for
537 #define CIRCUIT_PURPOSE_S_ESTABLISH_INTRO 15
538 /** Hidden-service-side circuit purpose: at the service, successfully
539 * established intro. */
540 #define CIRCUIT_PURPOSE_S_INTRO 16
541 /** Hidden-service-side circuit purpose: at the service, connecting to rend
543 #define CIRCUIT_PURPOSE_S_CONNECT_REND 17
544 /** Hidden-service-side circuit purpose: at the service, rendezvous
546 #define CIRCUIT_PURPOSE_S_REND_JOINED 18
547 /** This circuit is used for uploading hsdirs */
548 #define CIRCUIT_PURPOSE_S_HSDIR_POST 19
549 #define CIRCUIT_PURPOSE_S_HS_MAX_ 19
551 /** A testing circuit; not meant to be used for actual traffic. */
552 #define CIRCUIT_PURPOSE_TESTING 20
553 /** A controller made this circuit and Tor should not use it. */
554 #define CIRCUIT_PURPOSE_CONTROLLER 21
555 /** This circuit is used for path bias probing only */
556 #define CIRCUIT_PURPOSE_PATH_BIAS_TESTING 22
558 /** This circuit is used for vanguards/restricted paths.
560 * This type of circuit is *only* created preemptively and never
561 * on-demand. When an HS operation needs to take place (e.g. connect to an
562 * intro point), these circuits are then cannibalized and repurposed to the
563 * actual needed HS purpose. */
564 #define CIRCUIT_PURPOSE_HS_VANGUARDS 23
566 #define CIRCUIT_PURPOSE_MAX_ 23
567 /** A catch-all for unrecognized purposes. Currently we don't expect
568 * to make or see any circuits with this purpose. */
569 #define CIRCUIT_PURPOSE_UNKNOWN 255
571 /** True iff the circuit purpose <b>p</b> is for a circuit that
572 * originated at this node. */
573 #define CIRCUIT_PURPOSE_IS_ORIGIN(p) ((p)>CIRCUIT_PURPOSE_OR_MAX_)
574 /** True iff the circuit purpose <b>p</b> is for a circuit that originated
575 * here to serve as a client. (Hidden services don't count here.) */
576 #define CIRCUIT_PURPOSE_IS_CLIENT(p) \
577 ((p)> CIRCUIT_PURPOSE_OR_MAX_ && \
578 (p)<=CIRCUIT_PURPOSE_C_MAX_)
579 /** True iff the circuit_t <b>c</b> is actually an origin_circuit_t. */
580 #define CIRCUIT_IS_ORIGIN(c) (CIRCUIT_PURPOSE_IS_ORIGIN((c)->purpose))
581 /** True iff the circuit purpose <b>p</b> is for an established rendezvous
583 #define CIRCUIT_PURPOSE_IS_ESTABLISHED_REND(p) \
584 ((p) == CIRCUIT_PURPOSE_C_REND_JOINED || \
585 (p) == CIRCUIT_PURPOSE_S_REND_JOINED)
586 /** True iff the circuit_t c is actually an or_circuit_t */
587 #define CIRCUIT_IS_ORCIRC(c) (((circuit_t *)(c))->magic == OR_CIRCUIT_MAGIC)
589 /** How many circuits do we want simultaneously in-progress to handle
591 #define MIN_CIRCUITS_HANDLING_STREAM 2
593 /* These RELAY_COMMAND constants define values for relay cell commands, and
594 * must match those defined in tor-spec.txt. */
595 #define RELAY_COMMAND_BEGIN 1
596 #define RELAY_COMMAND_DATA 2
597 #define RELAY_COMMAND_END 3
598 #define RELAY_COMMAND_CONNECTED 4
599 #define RELAY_COMMAND_SENDME 5
600 #define RELAY_COMMAND_EXTEND 6
601 #define RELAY_COMMAND_EXTENDED 7
602 #define RELAY_COMMAND_TRUNCATE 8
603 #define RELAY_COMMAND_TRUNCATED 9
604 #define RELAY_COMMAND_DROP 10
605 #define RELAY_COMMAND_RESOLVE 11
606 #define RELAY_COMMAND_RESOLVED 12
607 #define RELAY_COMMAND_BEGIN_DIR 13
608 #define RELAY_COMMAND_EXTEND2 14
609 #define RELAY_COMMAND_EXTENDED2 15
611 #define RELAY_COMMAND_ESTABLISH_INTRO 32
612 #define RELAY_COMMAND_ESTABLISH_RENDEZVOUS 33
613 #define RELAY_COMMAND_INTRODUCE1 34
614 #define RELAY_COMMAND_INTRODUCE2 35
615 #define RELAY_COMMAND_RENDEZVOUS1 36
616 #define RELAY_COMMAND_RENDEZVOUS2 37
617 #define RELAY_COMMAND_INTRO_ESTABLISHED 38
618 #define RELAY_COMMAND_RENDEZVOUS_ESTABLISHED 39
619 #define RELAY_COMMAND_INTRODUCE_ACK 40
621 /* Reasons why an OR connection is closed. */
622 #define END_OR_CONN_REASON_DONE 1
623 #define END_OR_CONN_REASON_REFUSED 2 /* connection refused */
624 #define END_OR_CONN_REASON_OR_IDENTITY 3
625 #define END_OR_CONN_REASON_CONNRESET 4 /* connection reset by peer */
626 #define END_OR_CONN_REASON_TIMEOUT 5
627 #define END_OR_CONN_REASON_NO_ROUTE 6 /* no route to host/net */
628 #define END_OR_CONN_REASON_IO_ERROR 7 /* read/write error */
629 #define END_OR_CONN_REASON_RESOURCE_LIMIT 8 /* sockets, buffers, etc */
630 #define END_OR_CONN_REASON_PT_MISSING 9 /* PT failed or not available */
631 #define END_OR_CONN_REASON_MISC 10
633 /* Reasons why we (or a remote OR) might close a stream. See tor-spec.txt for
634 * documentation of these. The values must match. */
635 #define END_STREAM_REASON_MISC 1
636 #define END_STREAM_REASON_RESOLVEFAILED 2
637 #define END_STREAM_REASON_CONNECTREFUSED 3
638 #define END_STREAM_REASON_EXITPOLICY 4
639 #define END_STREAM_REASON_DESTROY 5
640 #define END_STREAM_REASON_DONE 6
641 #define END_STREAM_REASON_TIMEOUT 7
642 #define END_STREAM_REASON_NOROUTE 8
643 #define END_STREAM_REASON_HIBERNATING 9
644 #define END_STREAM_REASON_INTERNAL 10
645 #define END_STREAM_REASON_RESOURCELIMIT 11
646 #define END_STREAM_REASON_CONNRESET 12
647 #define END_STREAM_REASON_TORPROTOCOL 13
648 #define END_STREAM_REASON_NOTDIRECTORY 14
649 #define END_STREAM_REASON_ENTRYPOLICY 15
651 /* These high-numbered end reasons are not part of the official spec,
652 * and are not intended to be put in relay end cells. They are here
653 * to be more informative when sending back socks replies to the
655 /* XXXX 256 is no longer used; feel free to reuse it. */
656 /** We were unable to attach the connection to any circuit at all. */
657 /* XXXX the ways we use this one don't make a lot of sense. */
658 #define END_STREAM_REASON_CANT_ATTACH 257
659 /** We can't connect to any directories at all, so we killed our streams
660 * before they can time out. */
661 #define END_STREAM_REASON_NET_UNREACHABLE 258
662 /** This is a SOCKS connection, and the client used (or misused) the SOCKS
663 * protocol in a way we couldn't handle. */
664 #define END_STREAM_REASON_SOCKSPROTOCOL 259
665 /** This is a transparent proxy connection, but we can't extract the original
666 * target address:port. */
667 #define END_STREAM_REASON_CANT_FETCH_ORIG_DEST 260
668 /** This is a connection on the NATD port, and the destination IP:Port was
669 * either ill-formed or out-of-range. */
670 #define END_STREAM_REASON_INVALID_NATD_DEST 261
671 /** The target address is in a private network (like 127.0.0.1 or 10.0.0.1);
672 * you don't want to do that over a randomly chosen exit */
673 #define END_STREAM_REASON_PRIVATE_ADDR 262
674 /** This is an HTTP tunnel connection and the client used or misused HTTP in a
675 * way we can't handle.
677 #define END_STREAM_REASON_HTTPPROTOCOL 263
679 /** Bitwise-and this value with endreason to mask out all flags. */
680 #define END_STREAM_REASON_MASK 511
682 /** Bitwise-or this with the argument to control_event_stream_status
683 * to indicate that the reason came from an END cell. */
684 #define END_STREAM_REASON_FLAG_REMOTE 512
685 /** Bitwise-or this with the argument to control_event_stream_status
686 * to indicate that we already sent a CLOSED stream event. */
687 #define END_STREAM_REASON_FLAG_ALREADY_SENT_CLOSED 1024
688 /** Bitwise-or this with endreason to indicate that we already sent
689 * a socks reply, and no further reply needs to be sent from
690 * connection_mark_unattached_ap(). */
691 #define END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED 2048
693 /** Reason for remapping an AP connection's address: we have a cached
695 #define REMAP_STREAM_SOURCE_CACHE 1
696 /** Reason for remapping an AP connection's address: the exit node told us an
698 #define REMAP_STREAM_SOURCE_EXIT 2
700 /* 'type' values to use in RESOLVED cells. Specified in tor-spec.txt. */
701 #define RESOLVED_TYPE_HOSTNAME 0
702 #define RESOLVED_TYPE_IPV4 4
703 #define RESOLVED_TYPE_IPV6 6
704 #define RESOLVED_TYPE_ERROR_TRANSIENT 0xF0
705 #define RESOLVED_TYPE_ERROR 0xF1
707 /* Negative reasons are internal: we never send them in a DESTROY or TRUNCATE
708 * call; they only go to the controller for tracking */
710 /* Closing introduction point that were opened in parallel. */
711 #define END_CIRC_REASON_IP_NOW_REDUNDANT -4
713 /** Our post-timeout circuit time measurement period expired.
714 * We must give up now */
715 #define END_CIRC_REASON_MEASUREMENT_EXPIRED -3
717 /** We couldn't build a path for this circuit. */
718 #define END_CIRC_REASON_NOPATH -2
719 /** Catch-all "other" reason for closing origin circuits. */
720 #define END_CIRC_AT_ORIGIN -1
722 /* Reasons why we (or a remote OR) might close a circuit. See tor-spec.txt for
723 * documentation of these. */
724 #define END_CIRC_REASON_MIN_ 0
725 #define END_CIRC_REASON_NONE 0
726 #define END_CIRC_REASON_TORPROTOCOL 1
727 #define END_CIRC_REASON_INTERNAL 2
728 #define END_CIRC_REASON_REQUESTED 3
729 #define END_CIRC_REASON_HIBERNATING 4
730 #define END_CIRC_REASON_RESOURCELIMIT 5
731 #define END_CIRC_REASON_CONNECTFAILED 6
732 #define END_CIRC_REASON_OR_IDENTITY 7
733 #define END_CIRC_REASON_CHANNEL_CLOSED 8
734 #define END_CIRC_REASON_FINISHED 9
735 #define END_CIRC_REASON_TIMEOUT 10
736 #define END_CIRC_REASON_DESTROYED 11
737 #define END_CIRC_REASON_NOSUCHSERVICE 12
738 #define END_CIRC_REASON_MAX_ 12
740 /** Bitwise-OR this with the argument to circuit_mark_for_close() or
741 * control_event_circuit_status() to indicate that the reason was
742 * passed through from a destroy or truncate cell. */
743 #define END_CIRC_REASON_FLAG_REMOTE 512
745 /** Length of 'y' portion of 'y.onion' URL. */
746 #define REND_SERVICE_ID_LEN_BASE32 16
748 /** Length of 'y.onion' including '.onion' URL. */
749 #define REND_SERVICE_ADDRESS_LEN (16+1+5)
751 /** Length of a binary-encoded rendezvous service ID. */
752 #define REND_SERVICE_ID_LEN 10
754 /** Time period for which a v2 descriptor will be valid. */
755 #define REND_TIME_PERIOD_V2_DESC_VALIDITY (24*60*60)
757 /** Time period within which two sets of v2 descriptors will be uploaded in
759 #define REND_TIME_PERIOD_OVERLAPPING_V2_DESCS (60*60)
761 /** Number of non-consecutive replicas (i.e. distributed somewhere
762 * in the ring) for a descriptor. */
763 #define REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS 2
765 /** Number of consecutive replicas for a descriptor. */
766 #define REND_NUMBER_OF_CONSECUTIVE_REPLICAS 3
768 /** Length of v2 descriptor ID (32 base32 chars = 160 bits). */
769 #define REND_DESC_ID_V2_LEN_BASE32 BASE32_DIGEST_LEN
771 /** Length of the base32-encoded secret ID part of versioned hidden service
773 #define REND_SECRET_ID_PART_LEN_BASE32 BASE32_DIGEST_LEN
775 /** Length of the base32-encoded hash of an introduction point's
777 #define REND_INTRO_POINT_ID_LEN_BASE32 BASE32_DIGEST_LEN
779 /** Length of the descriptor cookie that is used for client authorization
780 * to hidden services. */
781 #define REND_DESC_COOKIE_LEN 16
783 /** Length of the base64-encoded descriptor cookie that is used for
784 * exchanging client authorization between hidden service and client. */
785 #define REND_DESC_COOKIE_LEN_BASE64 22
787 /** Length of client identifier in encrypted introduction points for hidden
788 * service authorization type 'basic'. */
789 #define REND_BASIC_AUTH_CLIENT_ID_LEN 4
791 /** Multiple of the number of clients to which the real number of clients
792 * is padded with fake clients for hidden service authorization type
794 #define REND_BASIC_AUTH_CLIENT_MULTIPLE 16
796 /** Length of client entry consisting of client identifier and encrypted
797 * session key for hidden service authorization type 'basic'. */
798 #define REND_BASIC_AUTH_CLIENT_ENTRY_LEN (REND_BASIC_AUTH_CLIENT_ID_LEN \
801 /** Maximum size of v2 hidden service descriptors. */
802 #define REND_DESC_MAX_SIZE (20 * 1024)
804 /** Legal characters for use in authorized client names for a hidden
806 #define REND_LEGAL_CLIENTNAME_CHARACTERS \
807 "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-_"
809 /** Maximum length of authorized client names for a hidden service. */
810 #define REND_CLIENTNAME_MAX_LEN 16
812 /** Length of the rendezvous cookie that is used to connect circuits at the
813 * rendezvous point. */
814 #define REND_COOKIE_LEN DIGEST_LEN
816 /** Client authorization type that a hidden service performs. */
817 typedef enum rend_auth_type_t
{
820 REND_STEALTH_AUTH
= 2,
823 /** Client-side configuration of authorization for a hidden service. */
824 typedef struct rend_service_authorization_t
{
825 uint8_t descriptor_cookie
[REND_DESC_COOKIE_LEN
];
826 char onion_address
[REND_SERVICE_ADDRESS_LEN
+1];
827 rend_auth_type_t auth_type
;
828 } rend_service_authorization_t
;
830 /** Client- and server-side data that is used for hidden service connection
831 * establishment. Not all fields contain data depending on where this struct
833 typedef struct rend_data_t
{
834 /* Hidden service protocol version of this base object. */
837 /** List of HSDir fingerprints on which this request has been sent to. This
838 * contains binary identity digest of the directory of size DIGEST_LEN. */
839 smartlist_t
*hsdirs_fp
;
841 /** Rendezvous cookie used by both, client and service. */
842 char rend_cookie
[REND_COOKIE_LEN
];
844 /** Number of streams associated with this rendezvous circuit. */
848 typedef struct rend_data_v2_t
{
849 /* Rendezvous base data. */
852 /** Onion address (without the .onion part) that a client requests. */
853 char onion_address
[REND_SERVICE_ID_LEN_BASE32
+1];
855 /** Descriptor ID for each replicas computed from the onion address. If
856 * the onion address is empty, this array MUST be empty. We keep them so
857 * we know when to purge our entry in the last hsdir request table. */
858 char descriptor_id
[REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS
][DIGEST_LEN
];
860 /** (Optional) descriptor cookie that is used by a client. */
861 char descriptor_cookie
[REND_DESC_COOKIE_LEN
];
863 /** Authorization type for accessing a service used by a client. */
864 rend_auth_type_t auth_type
;
866 /** Descriptor ID for a client request. The control port command HSFETCH
867 * uses this. It's set if the descriptor query should only use this
869 char desc_id_fetch
[DIGEST_LEN
];
871 /** Hash of the hidden service's PK used by a service. */
872 char rend_pk_digest
[DIGEST_LEN
];
875 /* From a base rend_data_t object <b>d</d>, return the v2 object. */
877 rend_data_v2_t
*TO_REND_DATA_V2(const rend_data_t
*d
)
880 tor_assert(d
->version
== 2);
881 return DOWNCAST(rend_data_v2_t
, d
);
884 /* Stub because we can't include hs_ident.h. */
885 struct hs_ident_edge_conn_t
;
886 struct hs_ident_dir_conn_t
;
887 struct hs_ident_circuit_t
;
888 /* Stub because we can't include hs_common.h. */
889 struct hsdir_index_t
;
891 /** Time interval for tracking replays of DH public keys received in
892 * INTRODUCE2 cells. Used only to avoid launching multiple
893 * simultaneous attempts to connect to the same rendezvous point. */
894 #define REND_REPLAY_TIME_INTERVAL (5 * 60)
896 /** Used to indicate which way a cell is going on a circuit. */
898 CELL_DIRECTION_IN
=1, /**< The cell is moving towards the origin. */
899 CELL_DIRECTION_OUT
=2, /**< The cell is moving away from the origin. */
902 /** Initial value for both sides of a circuit transmission window when the
903 * circuit is initialized. Measured in cells. */
904 #define CIRCWINDOW_START 1000
905 #define CIRCWINDOW_START_MIN 100
906 #define CIRCWINDOW_START_MAX 1000
907 /** Amount to increment a circuit window when we get a circuit SENDME. */
908 #define CIRCWINDOW_INCREMENT 100
909 /** Initial value on both sides of a stream transmission window when the
910 * stream is initialized. Measured in cells. */
911 #define STREAMWINDOW_START 500
912 /** Amount to increment a stream window when we get a stream SENDME. */
913 #define STREAMWINDOW_INCREMENT 50
915 /** Maximum number of queued cells on a circuit for which we are the
916 * midpoint before we give up and kill it. This must be >= circwindow
917 * to avoid killing innocent circuits, and >= circwindow*2 to give
918 * leaky-pipe a chance of working someday. The ORCIRC_MAX_MIDDLE_KILL_THRESH
919 * ratio controls the margin of error between emitting a warning and
920 * killing the circuit.
922 #define ORCIRC_MAX_MIDDLE_CELLS (CIRCWINDOW_START_MAX*2)
923 /** Ratio of hard (circuit kill) to soft (warning) thresholds for the
924 * ORCIRC_MAX_MIDDLE_CELLS tests.
926 #define ORCIRC_MAX_MIDDLE_KILL_THRESH (1.1f)
928 /* Cell commands. These values are defined in tor-spec.txt. */
929 #define CELL_PADDING 0
930 #define CELL_CREATE 1
931 #define CELL_CREATED 2
933 #define CELL_DESTROY 4
934 #define CELL_CREATE_FAST 5
935 #define CELL_CREATED_FAST 6
936 #define CELL_VERSIONS 7
937 #define CELL_NETINFO 8
938 #define CELL_RELAY_EARLY 9
939 #define CELL_CREATE2 10
940 #define CELL_CREATED2 11
941 #define CELL_PADDING_NEGOTIATE 12
943 #define CELL_VPADDING 128
944 #define CELL_CERTS 129
945 #define CELL_AUTH_CHALLENGE 130
946 #define CELL_AUTHENTICATE 131
947 #define CELL_AUTHORIZE 132
948 #define CELL_COMMAND_MAX_ 132
950 /** How long to test reachability before complaining to the user. */
951 #define TIMEOUT_UNTIL_UNREACHABILITY_COMPLAINT (20*60)
953 /** Legal characters in a nickname. */
954 #define LEGAL_NICKNAME_CHARACTERS \
955 "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
957 /** Name to use in client TLS certificates if no nickname is given. Once
958 * Tor 0.1.2.x is obsolete, we can remove this. */
959 #define DEFAULT_CLIENT_NICKNAME "client"
961 /** Name chosen by routers that don't configure nicknames */
962 #define UNNAMED_ROUTER_NICKNAME "Unnamed"
964 /** Number of bytes in a SOCKS4 header. */
965 #define SOCKS4_NETWORK_LEN 8
969 * Relay command [1 byte]
970 * Recognized [2 bytes]
971 * Stream ID [2 bytes]
972 * Partial SHA-1 [4 bytes]
974 * Relay payload [498 bytes]
977 /** Number of bytes in a cell, minus cell header. */
978 #define CELL_PAYLOAD_SIZE 509
979 /** Number of bytes in a cell transmitted over the network, in the longest
981 #define CELL_MAX_NETWORK_SIZE 514
983 /** Maximum length of a header on a variable-length cell. */
984 #define VAR_CELL_MAX_HEADER_SIZE 7
986 static int get_cell_network_size(int wide_circ_ids
);
987 static inline int get_cell_network_size(int wide_circ_ids
)
989 return wide_circ_ids
? CELL_MAX_NETWORK_SIZE
: CELL_MAX_NETWORK_SIZE
- 2;
991 static int get_var_cell_header_size(int wide_circ_ids
);
992 static inline int get_var_cell_header_size(int wide_circ_ids
)
994 return wide_circ_ids
? VAR_CELL_MAX_HEADER_SIZE
:
995 VAR_CELL_MAX_HEADER_SIZE
- 2;
997 static int get_circ_id_size(int wide_circ_ids
);
998 static inline int get_circ_id_size(int wide_circ_ids
)
1000 return wide_circ_ids
? 4 : 2;
1003 /** Number of bytes in a relay cell's header (not including general cell
1005 #define RELAY_HEADER_SIZE (1+2+2+4+2)
1006 /** Largest number of bytes that can fit in a relay cell payload. */
1007 #define RELAY_PAYLOAD_SIZE (CELL_PAYLOAD_SIZE-RELAY_HEADER_SIZE)
1009 /** Identifies a circuit on an or_connection */
1010 typedef uint32_t circid_t
;
1011 /** Identifies a stream on a circuit */
1012 typedef uint16_t streamid_t
;
1014 /* channel_t typedef; struct channel_s is in channel.h */
1016 typedef struct channel_s channel_t
;
1018 /* channel_listener_t typedef; struct channel_listener_s is in channel.h */
1020 typedef struct channel_listener_s channel_listener_t
;
1022 /* channel states for channel_t */
1026 * Closed state - channel is inactive
1028 * Permitted transitions from:
1029 * - CHANNEL_STATE_CLOSING
1030 * Permitted transitions to:
1031 * - CHANNEL_STATE_OPENING
1033 CHANNEL_STATE_CLOSED
= 0,
1035 * Opening state - channel is trying to connect
1037 * Permitted transitions from:
1038 * - CHANNEL_STATE_CLOSED
1039 * Permitted transitions to:
1040 * - CHANNEL_STATE_CLOSING
1041 * - CHANNEL_STATE_ERROR
1042 * - CHANNEL_STATE_OPEN
1044 CHANNEL_STATE_OPENING
,
1046 * Open state - channel is active and ready for use
1048 * Permitted transitions from:
1049 * - CHANNEL_STATE_MAINT
1050 * - CHANNEL_STATE_OPENING
1051 * Permitted transitions to:
1052 * - CHANNEL_STATE_CLOSING
1053 * - CHANNEL_STATE_ERROR
1054 * - CHANNEL_STATE_MAINT
1058 * Maintenance state - channel is temporarily offline for subclass specific
1059 * maintenance activities such as TLS renegotiation.
1061 * Permitted transitions from:
1062 * - CHANNEL_STATE_OPEN
1063 * Permitted transitions to:
1064 * - CHANNEL_STATE_CLOSING
1065 * - CHANNEL_STATE_ERROR
1066 * - CHANNEL_STATE_OPEN
1068 CHANNEL_STATE_MAINT
,
1070 * Closing state - channel is shutting down
1072 * Permitted transitions from:
1073 * - CHANNEL_STATE_MAINT
1074 * - CHANNEL_STATE_OPEN
1075 * Permitted transitions to:
1076 * - CHANNEL_STATE_CLOSED,
1077 * - CHANNEL_STATE_ERROR
1079 CHANNEL_STATE_CLOSING
,
1081 * Error state - channel has experienced a permanent error
1083 * Permitted transitions from:
1084 * - CHANNEL_STATE_CLOSING
1085 * - CHANNEL_STATE_MAINT
1086 * - CHANNEL_STATE_OPENING
1087 * - CHANNEL_STATE_OPEN
1088 * Permitted transitions to:
1091 CHANNEL_STATE_ERROR
,
1093 * Placeholder for maximum state value
1098 /* channel listener states for channel_listener_t */
1102 * Closed state - channel listener is inactive
1104 * Permitted transitions from:
1105 * - CHANNEL_LISTENER_STATE_CLOSING
1106 * Permitted transitions to:
1107 * - CHANNEL_LISTENER_STATE_LISTENING
1109 CHANNEL_LISTENER_STATE_CLOSED
= 0,
1111 * Listening state - channel listener is listening for incoming
1114 * Permitted transitions from:
1115 * - CHANNEL_LISTENER_STATE_CLOSED
1116 * Permitted transitions to:
1117 * - CHANNEL_LISTENER_STATE_CLOSING
1118 * - CHANNEL_LISTENER_STATE_ERROR
1120 CHANNEL_LISTENER_STATE_LISTENING
,
1122 * Closing state - channel listener is shutting down
1124 * Permitted transitions from:
1125 * - CHANNEL_LISTENER_STATE_LISTENING
1126 * Permitted transitions to:
1127 * - CHANNEL_LISTENER_STATE_CLOSED,
1128 * - CHANNEL_LISTENER_STATE_ERROR
1130 CHANNEL_LISTENER_STATE_CLOSING
,
1132 * Error state - channel listener has experienced a permanent error
1134 * Permitted transitions from:
1135 * - CHANNEL_STATE_CLOSING
1136 * - CHANNEL_STATE_LISTENING
1137 * Permitted transitions to:
1140 CHANNEL_LISTENER_STATE_ERROR
,
1142 * Placeholder for maximum state value
1144 CHANNEL_LISTENER_STATE_LAST
1145 } channel_listener_state_t
;
1147 /* TLS channel stuff */
1149 typedef struct channel_tls_s channel_tls_t
;
1151 /* circuitmux_t typedef; struct circuitmux_s is in circuitmux.h */
1153 typedef struct circuitmux_s circuitmux_t
;
1155 /** Parsed onion routing cell. All communication between nodes
1157 typedef struct cell_t
{
1158 circid_t circ_id
; /**< Circuit which received the cell. */
1159 uint8_t command
; /**< Type of the cell: one of CELL_PADDING, CELL_CREATE,
1160 * CELL_DESTROY, etc */
1161 uint8_t payload
[CELL_PAYLOAD_SIZE
]; /**< Cell body. */
1164 /** Parsed variable-length onion routing cell. */
1165 typedef struct var_cell_t
{
1166 /** Type of the cell: CELL_VERSIONS, etc. */
1168 /** Circuit thich received the cell */
1170 /** Number of bytes actually stored in <b>payload</b> */
1171 uint16_t payload_len
;
1172 /** Payload of this cell */
1173 uint8_t payload
[FLEXIBLE_ARRAY_MEMBER
];
1176 /** A parsed Extended ORPort message. */
1177 typedef struct ext_or_cmd_t
{
1178 uint16_t cmd
; /** Command type */
1179 uint16_t len
; /** Body length */
1180 char body
[FLEXIBLE_ARRAY_MEMBER
]; /** Message body */
1183 /** A cell as packed for writing to the network. */
1184 typedef struct packed_cell_t
{
1185 /** Next cell queued on this circuit. */
1186 TOR_SIMPLEQ_ENTRY(packed_cell_t
) next
;
1187 char body
[CELL_MAX_NETWORK_SIZE
]; /**< Cell as packed for network. */
1188 uint32_t inserted_timestamp
; /**< Time (in timestamp units) when this cell
1192 /** A queue of cells on a circuit, waiting to be added to the
1193 * or_connection_t's outbuf. */
1194 typedef struct cell_queue_t
{
1195 /** Linked list of packed_cell_t*/
1196 TOR_SIMPLEQ_HEAD(cell_simpleq
, packed_cell_t
) head
;
1197 int n
; /**< The number of cells in the queue. */
1200 /** A single queued destroy cell. */
1201 typedef struct destroy_cell_t
{
1202 TOR_SIMPLEQ_ENTRY(destroy_cell_t
) next
;
1204 uint32_t inserted_timestamp
; /**< Time (in timestamp units) when this cell
1209 /** A queue of destroy cells on a channel. */
1210 typedef struct destroy_cell_queue_t
{
1211 /** Linked list of packed_cell_t */
1212 TOR_SIMPLEQ_HEAD(dcell_simpleq
, destroy_cell_t
) head
;
1213 int n
; /**< The number of cells in the queue. */
1214 } destroy_cell_queue_t
;
1216 /** Beginning of a RELAY cell payload. */
1218 uint8_t command
; /**< The end-to-end relay command. */
1219 uint16_t recognized
; /**< Used to tell whether cell is for us. */
1220 streamid_t stream_id
; /**< Which stream is this cell associated with? */
1221 char integrity
[4]; /**< Used to tell whether cell is corrupted. */
1222 uint16_t length
; /**< How long is the payload body? */
1225 typedef struct socks_request_t socks_request_t
;
1227 typedef struct entry_port_cfg_t
{
1228 /* Client port types (socks, dns, trans, natd) only: */
1229 uint8_t isolation_flags
; /**< Zero or more isolation flags */
1230 int session_group
; /**< A session group, or -1 if this port is not in a
1234 /** When both no-auth and user/pass are advertised by a SOCKS client, select
1236 unsigned int socks_prefer_no_auth
: 1;
1237 /** When ISO_SOCKSAUTH is in use, Keep-Alive circuits indefinitely. */
1238 unsigned int socks_iso_keep_alive
: 1;
1240 /* Client port types only: */
1241 unsigned int ipv4_traffic
: 1;
1242 unsigned int ipv6_traffic
: 1;
1243 unsigned int prefer_ipv6
: 1;
1244 unsigned int dns_request
: 1;
1245 unsigned int onion_traffic
: 1;
1247 /** For a socks listener: should we cache IPv4/IPv6 DNS information that
1248 * exit nodes tell us?
1251 unsigned int cache_ipv4_answers
: 1;
1252 unsigned int cache_ipv6_answers
: 1;
1254 /** For a socks listeners: if we find an answer in our client-side DNS cache,
1258 unsigned int use_cached_ipv4_answers
: 1;
1259 unsigned int use_cached_ipv6_answers
: 1;
1261 /** For socks listeners: When we can automap an address to IPv4 or IPv6,
1262 * do we prefer IPv6? */
1263 unsigned int prefer_ipv6_virtaddr
: 1;
1267 typedef struct server_port_cfg_t
{
1268 /* Server port types (or, dir) only: */
1269 unsigned int no_advertise
: 1;
1270 unsigned int no_listen
: 1;
1271 unsigned int all_addrs
: 1;
1272 unsigned int bind_ipv4_only
: 1;
1273 unsigned int bind_ipv6_only
: 1;
1274 } server_port_cfg_t
;
1276 /* Values for connection_t.magic: used to make sure that downcasts (casts from
1277 * connection_t to foo_connection_t) are safe. */
1278 #define BASE_CONNECTION_MAGIC 0x7C3C304Eu
1279 #define OR_CONNECTION_MAGIC 0x7D31FF03u
1280 #define EDGE_CONNECTION_MAGIC 0xF0374013u
1281 #define ENTRY_CONNECTION_MAGIC 0xbb4a5703
1282 #define DIR_CONNECTION_MAGIC 0x9988ffeeu
1283 #define CONTROL_CONNECTION_MAGIC 0x8abc765du
1284 #define LISTENER_CONNECTION_MAGIC 0x1a1ac741u
1288 /** Description of a connection to another host or process, and associated
1291 * A connection is named based on what it's connected to -- an "OR
1292 * connection" has a Tor node on the other end, an "exit
1293 * connection" has a website or other server on the other end, and an
1294 * "AP connection" has an application proxy (and thus a user) on the
1297 * Every connection has a type and a state. Connections never change
1298 * their type, but can go through many state changes in their lifetime.
1300 * Every connection has two associated input and output buffers.
1301 * Listeners don't use them. For non-listener connections, incoming
1302 * data is appended to conn->inbuf, and outgoing data is taken from
1303 * conn->outbuf. Connections differ primarily in the functions called
1304 * to fill and drain these buffers.
1306 typedef struct connection_t
{
1307 uint32_t magic
; /**< For memory debugging: must equal one of
1308 * *_CONNECTION_MAGIC. */
1310 uint8_t state
; /**< Current state of this connection. */
1311 unsigned int type
:5; /**< What kind of connection is this? */
1312 unsigned int purpose
:5; /**< Only used for DIR and EXIT types currently. */
1314 /* The next fields are all one-bit booleans. Some are only applicable to
1315 * connection subtypes, but we hold them here anyway, to save space.
1317 unsigned int read_blocked_on_bw
:1; /**< Boolean: should we start reading
1318 * again once the bandwidth throttler allows it? */
1319 unsigned int write_blocked_on_bw
:1; /**< Boolean: should we start writing
1320 * again once the bandwidth throttler allows
1322 unsigned int hold_open_until_flushed
:1; /**< Despite this connection's being
1323 * marked for close, do we flush it
1324 * before closing it? */
1325 unsigned int inbuf_reached_eof
:1; /**< Boolean: did read() return 0 on this
1327 /** Set to 1 when we're inside connection_flushed_some to keep us from
1328 * calling connection_handle_write() recursively. */
1329 unsigned int in_flushed_some
:1;
1330 /** True if connection_handle_write is currently running on this connection.
1332 unsigned int in_connection_handle_write
:1;
1334 /* For linked connections:
1336 unsigned int linked
:1; /**< True if there is, or has been, a linked_conn. */
1337 /** True iff we'd like to be notified about read events from the
1339 unsigned int reading_from_linked_conn
:1;
1340 /** True iff we're willing to write to the linked conn. */
1341 unsigned int writing_to_linked_conn
:1;
1342 /** True iff we're currently able to read on the linked conn, and our
1343 * read_event should be made active with libevent. */
1344 unsigned int active_on_link
:1;
1345 /** True iff we've called connection_close_immediate() on this linked
1347 unsigned int linked_conn_is_closed
:1;
1349 /** CONNECT/SOCKS proxy client handshake state (for outgoing connections). */
1350 unsigned int proxy_state
:4;
1352 /** Our socket; set to TOR_INVALID_SOCKET if this connection is closed,
1353 * or has no socket. */
1355 int conn_array_index
; /**< Index into the global connection array. */
1357 struct event
*read_event
; /**< Libevent event structure. */
1358 struct event
*write_event
; /**< Libevent event structure. */
1359 struct buf_t
*inbuf
; /**< Buffer holding data read over this connection. */
1360 struct buf_t
*outbuf
; /**< Buffer holding data to write over this
1362 size_t outbuf_flushlen
; /**< How much data should we try to flush from the
1364 time_t timestamp_lastread
; /**< When was the last time libevent said we could
1366 time_t timestamp_lastwritten
; /**< When was the last time libevent said we
1369 time_t timestamp_created
; /**< When was this connection_t created? */
1371 int socket_family
; /**< Address family of this connection's socket. Usually
1372 * AF_INET, but it can also be AF_UNIX, or AF_INET6 */
1373 tor_addr_t addr
; /**< IP that socket "s" is directly connected to;
1374 * may be the IP address for a proxy or pluggable transport,
1375 * see "address" for the address of the final destination.
1377 uint16_t port
; /**< If non-zero, port that socket "s" is directly connected
1378 * to; may be the port for a proxy or pluggable transport,
1379 * see "address" for the port at the final destination. */
1380 uint16_t marked_for_close
; /**< Should we close this conn on the next
1381 * iteration of the main loop? (If true, holds
1382 * the line number where this connection was
1384 const char *marked_for_close_file
; /**< For debugging: in which file were
1385 * we marked for close? */
1386 char *address
; /**< FQDN (or IP) and port of the final destination for this
1387 * connection; this is always the remote address, it is
1388 * passed to a proxy or pluggable transport if one in use.
1389 * See "addr" and "port" for the address that socket "s" is
1390 * directly connected to.
1391 * strdup into this, because free_connection() frees it. */
1392 /** Another connection that's connected to this one in lieu of a socket. */
1393 struct connection_t
*linked_conn
;
1395 /** Unique identifier for this connection on this Tor instance. */
1396 uint64_t global_identifier
;
1398 /** Bytes read since last call to control_event_conn_bandwidth_used().
1399 * Only used if we're configured to emit CONN_BW events. */
1400 uint32_t n_read_conn_bw
;
1402 /** Bytes written since last call to control_event_conn_bandwidth_used().
1403 * Only used if we're configured to emit CONN_BW events. */
1404 uint32_t n_written_conn_bw
;
1407 /** Subtype of connection_t; used for a listener socket. */
1408 typedef struct listener_connection_t
{
1411 /** If the connection is a CONN_TYPE_AP_DNS_LISTENER, this field points
1412 * to the evdns_server_port it uses to listen to and answer connections. */
1413 struct evdns_server_port
*dns_server_port
;
1415 entry_port_cfg_t entry_cfg
;
1417 } listener_connection_t
;
1419 /** Minimum length of the random part of an AUTH_CHALLENGE cell. */
1420 #define OR_AUTH_CHALLENGE_LEN 32
1423 * @name Certificate types for CERTS cells.
1425 * These values are defined by the protocol, and affect how an X509
1426 * certificate in a CERTS cell is interpreted and used.
1429 /** A certificate that authenticates a TLS link key. The subject key
1430 * must match the key used in the TLS handshake; it must be signed by
1431 * the identity key. */
1432 #define OR_CERT_TYPE_TLS_LINK 1
1433 /** A self-signed identity certificate. The subject key must be a
1434 * 1024-bit RSA key. */
1435 #define OR_CERT_TYPE_ID_1024 2
1436 /** A certificate that authenticates a key used in an AUTHENTICATE cell
1437 * in the v3 handshake. The subject key must be a 1024-bit RSA key; it
1438 * must be signed by the identity key */
1439 #define OR_CERT_TYPE_AUTH_1024 3
1441 #define OR_CERT_TYPE_RSA_ED_CROSSCERT 7
1444 /** The first supported type of AUTHENTICATE cell. It contains
1445 * a bunch of structures signed with an RSA1024 key. The signed
1446 * structures include a HMAC using negotiated TLS secrets, and a digest
1447 * of all cells sent or received before the AUTHENTICATE cell (including
1448 * the random server-generated AUTH_CHALLENGE cell).
1450 #define AUTHTYPE_RSA_SHA256_TLSSECRET 1
1451 /** As AUTHTYPE_RSA_SHA256_TLSSECRET, but instead of using the
1452 * negotiated TLS secrets, uses exported keying material from the TLS
1453 * session as described in RFC 5705.
1455 * Not used by today's tors, since everything that supports this
1456 * also supports ED25519_SHA256_5705, which is better.
1458 #define AUTHTYPE_RSA_SHA256_RFC5705 2
1459 /** As AUTHTYPE_RSA_SHA256_RFC5705, but uses an Ed25519 identity key to
1461 #define AUTHTYPE_ED25519_SHA256_RFC5705 3
1463 * NOTE: authchallenge_type_is_better() relies on these AUTHTYPE codes
1464 * being sorted in order of preference. If we someday add one with
1465 * a higher numerical value that we don't like as much, we should revise
1466 * authchallenge_type_is_better().
1469 /** The length of the part of the AUTHENTICATE cell body that the client and
1470 * server can generate independently (when using RSA_SHA256_TLSSECRET). It
1471 * contains everything except the client's timestamp, the client's randomly
1472 * generated nonce, and the signature. */
1473 #define V3_AUTH_FIXED_PART_LEN (8+(32*6))
1474 /** The length of the part of the AUTHENTICATE cell body that the client
1476 #define V3_AUTH_BODY_LEN (V3_AUTH_FIXED_PART_LEN + 8 + 16)
1478 /** Structure to hold all the certificates we've received on an OR connection
1480 typedef struct or_handshake_certs_t
{
1481 /** True iff we originated this connection. */
1483 /** The cert for the 'auth' RSA key that's supposed to sign the AUTHENTICATE
1484 * cell. Signed with the RSA identity key. */
1485 tor_x509_cert_t
*auth_cert
;
1486 /** The cert for the 'link' RSA key that was used to negotiate the TLS
1487 * connection. Signed with the RSA identity key. */
1488 tor_x509_cert_t
*link_cert
;
1489 /** A self-signed identity certificate: the RSA identity key signed
1491 tor_x509_cert_t
*id_cert
;
1492 /** The Ed25519 signing key, signed with the Ed25519 identity key. */
1493 struct tor_cert_st
*ed_id_sign
;
1494 /** A digest of the X509 link certificate for the TLS connection, signed
1495 * with the Ed25519 siging key. */
1496 struct tor_cert_st
*ed_sign_link
;
1497 /** The Ed25519 authentication key (that's supposed to sign an AUTHENTICATE
1498 * cell) , signed with the Ed25519 siging key. */
1499 struct tor_cert_st
*ed_sign_auth
;
1500 /** The Ed25519 identity key, crosssigned with the RSA identity key. */
1501 uint8_t *ed_rsa_crosscert
;
1502 /** The length of <b>ed_rsa_crosscert</b> in bytes */
1503 size_t ed_rsa_crosscert_len
;
1504 } or_handshake_certs_t
;
1506 /** Stores flags and information related to the portion of a v2/v3 Tor OR
1507 * connection handshake that happens after the TLS handshake is finished.
1509 typedef struct or_handshake_state_t
{
1510 /** When was the VERSIONS cell sent on this connection? Used to get
1511 * an estimate of the skew in the returning NETINFO reply. */
1512 time_t sent_versions_at
;
1513 /** True iff we originated this connection */
1514 unsigned int started_here
: 1;
1515 /** True iff we have received and processed a VERSIONS cell. */
1516 unsigned int received_versions
: 1;
1517 /** True iff we have received and processed an AUTH_CHALLENGE cell */
1518 unsigned int received_auth_challenge
: 1;
1519 /** True iff we have received and processed a CERTS cell. */
1520 unsigned int received_certs_cell
: 1;
1521 /** True iff we have received and processed an AUTHENTICATE cell */
1522 unsigned int received_authenticate
: 1;
1524 /* True iff we've received valid authentication to some identity. */
1525 unsigned int authenticated
: 1;
1526 unsigned int authenticated_rsa
: 1;
1527 unsigned int authenticated_ed25519
: 1;
1529 /* True iff we have sent a netinfo cell */
1530 unsigned int sent_netinfo
: 1;
1532 /** The signing->ed25519 link certificate corresponding to the x509
1533 * certificate we used on the TLS connection (if this is a server-side
1534 * connection). We make a copy of this here to prevent a race condition
1535 * caused by TLS context rotation. */
1536 struct tor_cert_st
*own_link_cert
;
1538 /** True iff we should feed outgoing cells into digest_sent and
1539 * digest_received respectively.
1541 * From the server's side of the v3 handshake, we want to capture everything
1542 * from the VERSIONS cell through and including the AUTH_CHALLENGE cell.
1543 * From the client's, we want to capture everything from the VERSIONS cell
1544 * through but *not* including the AUTHENTICATE cell.
1547 unsigned int digest_sent_data
: 1;
1548 unsigned int digest_received_data
: 1;
1551 /** Identity RSA digest that we have received and authenticated for our peer
1552 * on this connection. */
1553 uint8_t authenticated_rsa_peer_id
[DIGEST_LEN
];
1554 /** Identity Ed25519 public key that we have received and authenticated for
1555 * our peer on this connection. */
1556 ed25519_public_key_t authenticated_ed25519_peer_id
;
1558 /** Digests of the cells that we have sent or received as part of a V3
1559 * handshake. Used for making and checking AUTHENTICATE cells.
1563 crypto_digest_t
*digest_sent
;
1564 crypto_digest_t
*digest_received
;
1567 /** Certificates that a connection initiator sent us in a CERTS cell; we're
1568 * holding on to them until we get an AUTHENTICATE cell.
1570 or_handshake_certs_t
*certs
;
1571 } or_handshake_state_t
;
1573 /** Length of Extended ORPort connection identifier. */
1574 #define EXT_OR_CONN_ID_LEN DIGEST_LEN /* 20 */
1576 * OR_CONN_HIGHWATER and OR_CONN_LOWWATER moved from connection_or.c so
1577 * channeltls.c can see them too.
1580 /** When adding cells to an OR connection's outbuf, keep adding until the
1581 * outbuf is at least this long, or we run out of cells. */
1582 #define OR_CONN_HIGHWATER (32*1024)
1584 /** Add cells to an OR connection's outbuf whenever the outbuf's data length
1585 * drops below this size. */
1586 #define OR_CONN_LOWWATER (16*1024)
1588 /** Subtype of connection_t for an "OR connection" -- that is, one that speaks
1589 * cells over TLS. */
1590 typedef struct or_connection_t
{
1593 /** Hash of the public RSA key for the other side's identity key, or zeroes
1594 * if the other side hasn't shown us a valid identity key. */
1595 char identity_digest
[DIGEST_LEN
];
1597 /** Extended ORPort connection identifier. */
1598 char *ext_or_conn_id
;
1599 /** This is the ClientHash value we expect to receive from the
1600 * client during the Extended ORPort authentication protocol. We
1601 * compute it upon receiving the ClientNoce from the client, and we
1602 * compare it with the acual ClientHash value sent by the
1604 char *ext_or_auth_correct_client_hash
;
1605 /** String carrying the name of the pluggable transport
1606 * (e.g. "obfs2") that is obfuscating this connection. If no
1607 * pluggable transports are used, it's NULL. */
1608 char *ext_or_transport
;
1610 char *nickname
; /**< Nickname of OR on other side (if any). */
1612 tor_tls_t
*tls
; /**< TLS connection state. */
1613 int tls_error
; /**< Last tor_tls error code. */
1614 /** When we last used this conn for any client traffic. If not
1615 * recent, we can rate limit it further. */
1617 /* Channel using this connection */
1618 channel_tls_t
*chan
;
1620 tor_addr_t real_addr
; /**< The actual address that this connection came from
1621 * or went to. The <b>addr</b> field is prone to
1622 * getting overridden by the address from the router
1623 * descriptor matching <b>identity_digest</b>. */
1625 /** Should this connection be used for extending circuits to the server
1626 * matching the <b>identity_digest</b> field? Set to true if we're pretty
1627 * sure we aren't getting MITMed, either because we're connected to an
1628 * address listed in a server descriptor, or because an authenticated
1629 * NETINFO cell listed the address we're connected to as recognized. */
1630 unsigned int is_canonical
:1;
1632 /** True iff this is an outgoing connection. */
1633 unsigned int is_outgoing
:1;
1634 unsigned int proxy_type
:2; /**< One of PROXY_NONE...PROXY_SOCKS5 */
1635 unsigned int wide_circ_ids
:1;
1636 /** True iff this connection has had its bootstrap failure logged with
1637 * control_event_bootstrap_problem. */
1638 unsigned int have_noted_bootstrap_problem
:1;
1639 /** True iff this is a client connection and its address has been put in the
1640 * geoip cache and handled by the DoS mitigation subsystem. We use this to
1641 * insure we have a coherent count of concurrent connection. */
1642 unsigned int tracked_for_dos_mitigation
: 1;
1644 uint16_t link_proto
; /**< What protocol version are we using? 0 for
1645 * "none negotiated yet." */
1646 uint16_t idle_timeout
; /**< How long can this connection sit with no
1647 * circuits on it before we close it? Based on
1648 * IDLE_CIRCUIT_TIMEOUT_{NON,}CANONICAL and
1649 * on is_canonical, randomized. */
1650 or_handshake_state_t
*handshake_state
; /**< If we are setting this connection
1651 * up, state information to do so. */
1653 time_t timestamp_lastempty
; /**< When was the outbuf last completely empty?*/
1655 /* bandwidth* and *_bucket only used by ORs in OPEN state: */
1656 int bandwidthrate
; /**< Bytes/s added to the bucket. (OPEN ORs only.) */
1657 int bandwidthburst
; /**< Max bucket size for this conn. (OPEN ORs only.) */
1658 int read_bucket
; /**< When this hits 0, stop receiving. Every second we
1659 * add 'bandwidthrate' to this, capping it at
1660 * bandwidthburst. (OPEN ORs only) */
1661 int write_bucket
; /**< When this hits 0, stop writing. Like read_bucket. */
1663 /** Last emptied read token bucket in msec since midnight; only used if
1664 * TB_EMPTY events are enabled. */
1665 uint32_t read_emptied_time
;
1666 /** Last emptied write token bucket in msec since midnight; only used if
1667 * TB_EMPTY events are enabled. */
1668 uint32_t write_emptied_time
;
1671 * Count the number of bytes flushed out on this orconn, and the number of
1672 * bytes TLS actually sent - used for overhead estimation for scheduling.
1674 uint64_t bytes_xmitted
, bytes_xmitted_by_tls
;
1677 /** Subtype of connection_t for an "edge connection" -- that is, an entry (ap)
1678 * connection, or an exit. */
1679 typedef struct edge_connection_t
{
1682 struct edge_connection_t
*next_stream
; /**< Points to the next stream at this
1684 int package_window
; /**< How many more relay cells can I send into the
1686 int deliver_window
; /**< How many more relay cells can end at me? */
1688 struct circuit_t
*on_circuit
; /**< The circuit (if any) that this edge
1689 * connection is using. */
1691 /** A pointer to which node in the circ this conn exits at. Set for AP
1692 * connections and for hidden service exit connections. */
1693 struct crypt_path_t
*cpath_layer
;
1694 /** What rendezvous service are we querying for (if an AP) or providing (if
1696 rend_data_t
*rend_data
;
1698 /* Hidden service connection identifier for edge connections. Used by the HS
1699 * client-side code to identify client SOCKS connections and by the
1700 * service-side code to match HS circuits with their streams. */
1701 struct hs_ident_edge_conn_t
*hs_ident
;
1703 uint32_t address_ttl
; /**< TTL for address-to-addr mapping on exit
1704 * connection. Exit connections only. */
1705 uint32_t begincell_flags
; /** Flags sent or received in the BEGIN cell
1706 * for this connection */
1708 streamid_t stream_id
; /**< The stream ID used for this edge connection on its
1711 /** The reason why this connection is closing; passed to the controller. */
1712 uint16_t end_reason
;
1714 /** Bytes read since last call to control_event_stream_bandwidth_used() */
1717 /** Bytes written since last call to control_event_stream_bandwidth_used() */
1720 /** True iff this connection is for a DNS request only. */
1721 unsigned int is_dns_request
:1;
1722 /** True iff this connection is for a PTR DNS request. (exit only) */
1723 unsigned int is_reverse_dns_lookup
:1;
1725 unsigned int edge_has_sent_end
:1; /**< For debugging; only used on edge
1726 * connections. Set once we've set the stream end,
1727 * and check in connection_about_to_close_connection().
1729 /** True iff we've blocked reading until the circuit has fewer queued
1731 unsigned int edge_blocked_on_circ
:1;
1733 /** Unique ID for directory requests; this used to be in connection_t, but
1734 * that's going away and being used on channels instead. We still tag
1735 * edge connections with dirreq_id from circuits, so it's copied here. */
1737 } edge_connection_t
;
1739 /** Subtype of edge_connection_t for an "entry connection" -- that is, a SOCKS
1740 * connection, a DNS request, a TransPort connection or a NATD connection */
1741 typedef struct entry_connection_t
{
1742 edge_connection_t edge_
;
1744 /** Nickname of planned exit node -- used with .exit support. */
1745 /* XXX prop220: we need to make chosen_exit_name able to encode Ed IDs too.
1746 * That's logically part of the UI parts for prop220 though. */
1747 char *chosen_exit_name
;
1749 socks_request_t
*socks_request
; /**< SOCKS structure describing request (AP
1752 /* === Isolation related, AP only. === */
1753 entry_port_cfg_t entry_cfg
;
1754 /** AP only: The newnym epoch in which we created this connection. */
1757 /** AP only: The original requested address before we rewrote it. */
1758 char *original_dest_address
;
1759 /* Other fields to isolate on already exist. The ClientAddr is addr. The
1760 ClientProtocol is a combination of type and socks_request->
1761 socks_version. SocksAuth is socks_request->username/password.
1762 DestAddr is in socks_request->address. */
1764 /** Number of times we've reassigned this application connection to
1765 * a new circuit. We keep track because the timeout is longer if we've
1766 * already retried several times. */
1767 uint8_t num_socks_retries
;
1769 /** For AP connections only: buffer for data that we have sent
1770 * optimistically, which we might need to re-send if we have to
1771 * retry this connection. */
1772 struct buf_t
*pending_optimistic_data
;
1773 /* For AP connections only: buffer for data that we previously sent
1774 * optimistically which we are currently re-sending as we retry this
1776 struct buf_t
*sending_optimistic_data
;
1778 /** If this is a DNSPort connection, this field holds the pending DNS
1779 * request that we're going to try to answer. */
1780 struct evdns_server_request
*dns_server_request
;
1782 #define DEBUGGING_17659
1784 #ifdef DEBUGGING_17659
1785 uint16_t marked_pending_circ_line
;
1786 const char *marked_pending_circ_file
;
1789 #define NUM_CIRCUITS_LAUNCHED_THRESHOLD 10
1790 /** Number of times we've launched a circuit to handle this stream. If
1791 * it gets too high, that could indicate an inconsistency between our
1792 * "launch a circuit to handle this stream" logic and our "attach our
1793 * stream to one of the available circuits" logic. */
1794 unsigned int num_circuits_launched
:4;
1796 /** True iff this stream must attach to a one-hop circuit (e.g. for
1798 unsigned int want_onehop
:1;
1799 /** True iff this stream should use a BEGIN_DIR relay command to establish
1800 * itself rather than BEGIN (either via onehop or via a whole circuit). */
1801 unsigned int use_begindir
:1;
1803 /** For AP connections only. If 1, and we fail to reach the chosen exit,
1804 * stop requiring it. */
1805 unsigned int chosen_exit_optional
:1;
1806 /** For AP connections only. If non-zero, this exit node was picked as
1807 * a result of the TrackHostExit, and the value decrements every time
1808 * we fail to complete a circuit to our chosen exit -- if it reaches
1809 * zero, abandon the associated mapaddress. */
1810 unsigned int chosen_exit_retries
:3;
1812 /** True iff this is an AP connection that came from a transparent or
1813 * NATd connection */
1814 unsigned int is_transparent_ap
:1;
1816 /** For AP connections only: Set if this connection's target exit node
1817 * allows optimistic data (that is, data sent on this stream before
1818 * the exit has sent a CONNECTED cell) and we have chosen to use it.
1820 unsigned int may_use_optimistic_data
: 1;
1822 /** Are we a socks SocksSocket listener? */
1823 unsigned int is_socks_socket
:1;
1824 } entry_connection_t
;
1826 /** Subtype of connection_t for an "directory connection" -- that is, an HTTP
1827 * connection to retrieve or serve directory material. */
1828 typedef struct dir_connection_t
{
1831 /** Which 'resource' did we ask the directory for? This is typically the part
1832 * of the URL string that defines, relative to the directory conn purpose,
1833 * what thing we want. For example, in router descriptor downloads by
1834 * descriptor digest, it contains "d/", then one or more +-separated
1837 char *requested_resource
;
1838 unsigned int dirconn_direct
:1; /**< Is this dirconn direct, or via Tor? */
1840 /** If we're fetching descriptors, what router purpose shall we assign
1842 uint8_t router_purpose
;
1844 /** List of spooled_resource_t for objects that we're spooling. We use
1845 * it from back to front. */
1847 /** The compression object doing on-the-fly compression for spooled data. */
1848 tor_compress_state_t
*compress_state
;
1850 /** What rendezvous service are we querying for? */
1851 rend_data_t
*rend_data
;
1853 /* Hidden service connection identifier for dir connections: Used by HS
1854 client-side code to fetch HS descriptors, and by the service-side code to
1855 upload descriptors. */
1856 struct hs_ident_dir_conn_t
*hs_ident
;
1858 /** If this is a one-hop connection, tracks the state of the directory guard
1859 * for this connection (if any). */
1860 struct circuit_guard_state_t
*guard_state
;
1862 char identity_digest
[DIGEST_LEN
]; /**< Hash of the public RSA key for
1863 * the directory server's signing key. */
1865 /** Unique ID for directory requests; this used to be in connection_t, but
1866 * that's going away and being used on channels instead. The dirserver still
1867 * needs this for the incoming side, so it's moved here. */
1870 #ifdef MEASUREMENTS_21206
1871 /** Number of RELAY_DATA cells received. */
1872 uint32_t data_cells_received
;
1874 /** Number of RELAY_DATA cells sent. */
1875 uint32_t data_cells_sent
;
1876 #endif /* defined(MEASUREMENTS_21206) */
1879 /** Subtype of connection_t for an connection to a controller. */
1880 typedef struct control_connection_t
{
1883 uint64_t event_mask
; /**< Bitfield: which events does this controller
1885 * EVENT_MAX_ is >31, so we need a 64 bit mask */
1887 /** True if we have sent a protocolinfo reply on this connection. */
1888 unsigned int have_sent_protocolinfo
:1;
1889 /** True if we have received a takeownership command on this
1891 unsigned int is_owning_control_connection
:1;
1893 /** List of ephemeral onion services belonging to this connection. */
1894 smartlist_t
*ephemeral_onion_services
;
1896 /** If we have sent an AUTHCHALLENGE reply on this connection and
1897 * have not received a successful AUTHENTICATE command, points to
1898 * the value which the client must send to authenticate itself;
1899 * otherwise, NULL. */
1900 char *safecookie_client_hash
;
1902 /** Amount of space allocated in incoming_cmd. */
1903 uint32_t incoming_cmd_len
;
1904 /** Number of bytes currently stored in incoming_cmd. */
1905 uint32_t incoming_cmd_cur_len
;
1906 /** A control command that we're reading from the inbuf, but which has not
1907 * yet arrived completely. */
1909 } control_connection_t
;
1911 /** Cast a connection_t subtype pointer to a connection_t **/
1912 #define TO_CONN(c) (&(((c)->base_)))
1914 /** Cast a entry_connection_t subtype pointer to a edge_connection_t **/
1915 #define ENTRY_TO_EDGE_CONN(c) (&(((c))->edge_))
1916 /** Cast a entry_connection_t subtype pointer to a connection_t **/
1917 #define ENTRY_TO_CONN(c) (TO_CONN(ENTRY_TO_EDGE_CONN(c)))
1919 /** Convert a connection_t* to an or_connection_t*; assert if the cast is
1921 static or_connection_t
*TO_OR_CONN(connection_t
*);
1922 /** Convert a connection_t* to a dir_connection_t*; assert if the cast is
1924 static dir_connection_t
*TO_DIR_CONN(connection_t
*);
1925 /** Convert a connection_t* to an edge_connection_t*; assert if the cast is
1927 static edge_connection_t
*TO_EDGE_CONN(connection_t
*);
1928 /** Convert a connection_t* to an entry_connection_t*; assert if the cast is
1930 static entry_connection_t
*TO_ENTRY_CONN(connection_t
*);
1931 /** Convert a edge_connection_t* to an entry_connection_t*; assert if the cast
1933 static entry_connection_t
*EDGE_TO_ENTRY_CONN(edge_connection_t
*);
1934 /** Convert a connection_t* to an control_connection_t*; assert if the cast is
1936 static control_connection_t
*TO_CONTROL_CONN(connection_t
*);
1937 /** Convert a connection_t* to an listener_connection_t*; assert if the cast is
1939 static listener_connection_t
*TO_LISTENER_CONN(connection_t
*);
1941 static inline or_connection_t
*TO_OR_CONN(connection_t
*c
)
1943 tor_assert(c
->magic
== OR_CONNECTION_MAGIC
);
1944 return DOWNCAST(or_connection_t
, c
);
1946 static inline dir_connection_t
*TO_DIR_CONN(connection_t
*c
)
1948 tor_assert(c
->magic
== DIR_CONNECTION_MAGIC
);
1949 return DOWNCAST(dir_connection_t
, c
);
1951 static inline edge_connection_t
*TO_EDGE_CONN(connection_t
*c
)
1953 tor_assert(c
->magic
== EDGE_CONNECTION_MAGIC
||
1954 c
->magic
== ENTRY_CONNECTION_MAGIC
);
1955 return DOWNCAST(edge_connection_t
, c
);
1957 static inline entry_connection_t
*TO_ENTRY_CONN(connection_t
*c
)
1959 tor_assert(c
->magic
== ENTRY_CONNECTION_MAGIC
);
1960 return (entry_connection_t
*) SUBTYPE_P(c
, entry_connection_t
, edge_
.base_
);
1962 static inline entry_connection_t
*EDGE_TO_ENTRY_CONN(edge_connection_t
*c
)
1964 tor_assert(c
->base_
.magic
== ENTRY_CONNECTION_MAGIC
);
1965 return (entry_connection_t
*) SUBTYPE_P(c
, entry_connection_t
, edge_
);
1967 static inline control_connection_t
*TO_CONTROL_CONN(connection_t
*c
)
1969 tor_assert(c
->magic
== CONTROL_CONNECTION_MAGIC
);
1970 return DOWNCAST(control_connection_t
, c
);
1972 static inline listener_connection_t
*TO_LISTENER_CONN(connection_t
*c
)
1974 tor_assert(c
->magic
== LISTENER_CONNECTION_MAGIC
);
1975 return DOWNCAST(listener_connection_t
, c
);
1978 /** What action type does an address policy indicate: accept or reject? */
1980 ADDR_POLICY_ACCEPT
=1,
1981 ADDR_POLICY_REJECT
=2,
1982 } addr_policy_action_t
;
1983 #define addr_policy_action_bitfield_t ENUM_BF(addr_policy_action_t)
1985 /** A reference-counted address policy rule. */
1986 typedef struct addr_policy_t
{
1987 int refcnt
; /**< Reference count */
1988 /** What to do when the policy matches.*/
1989 addr_policy_action_bitfield_t policy_type
:2;
1990 unsigned int is_private
:1; /**< True iff this is the pseudo-address,
1992 unsigned int is_canonical
:1; /**< True iff this policy is the canonical
1993 * copy (stored in a hash table to avoid
1994 * duplication of common policies) */
1995 maskbits_t maskbits
; /**< Accept/reject all addresses <b>a</b> such that the
1996 * first <b>maskbits</b> bits of <b>a</b> match
1998 /** Base address to accept or reject.
2000 * Note that wildcards are treated
2001 * differntly depending on address family. An AF_UNSPEC address means
2002 * "All addresses, IPv4 or IPv6." An AF_INET address with maskbits==0 means
2003 * "All IPv4 addresses" and an AF_INET6 address with maskbits == 0 means
2004 * "All IPv6 addresses".
2007 uint16_t prt_min
; /**< Lowest port number to accept/reject. */
2008 uint16_t prt_max
; /**< Highest port number to accept/reject. */
2011 /** A cached_dir_t represents a cacheable directory object, along with its
2012 * compressed form. */
2013 typedef struct cached_dir_t
{
2014 char *dir
; /**< Contents of this object, NUL-terminated. */
2015 char *dir_compressed
; /**< Compressed contents of this object. */
2016 size_t dir_len
; /**< Length of <b>dir</b> (not counting its NUL). */
2017 size_t dir_compressed_len
; /**< Length of <b>dir_compressed</b>. */
2018 time_t published
; /**< When was this object published. */
2019 common_digests_t digests
; /**< Digests of this object (networkstatus only) */
2020 /** Sha3 digest (also ns only) */
2021 uint8_t digest_sha3_as_signed
[DIGEST256_LEN
];
2022 int refcnt
; /**< Reference count for this cached_dir_t. */
2025 /** Enum used to remember where a signed_descriptor_t is stored and how to
2026 * manage the memory for signed_descriptor_body. */
2028 /** The descriptor isn't stored on disk at all: the copy in memory is
2029 * canonical; the saved_offset field is meaningless. */
2031 /** The descriptor is stored in the cached_routers file: the
2032 * signed_descriptor_body is meaningless; the signed_descriptor_len and
2033 * saved_offset are used to index into the mmaped cache file. */
2035 /** The descriptor is stored in the cached_routers.new file: the
2036 * signed_descriptor_body and saved_offset fields are both set. */
2037 /* FFFF (We could also mmap the file and grow the mmap as needed, or
2038 * lazy-load the descriptor text by using seek and read. We don't, for
2043 #define saved_location_bitfield_t ENUM_BF(saved_location_t)
2045 /** Enumeration: what directory object is being downloaded?
2046 * This determines which schedule is selected to perform the download. */
2048 DL_SCHED_GENERIC
= 0,
2049 DL_SCHED_CONSENSUS
= 1,
2050 DL_SCHED_BRIDGE
= 2,
2051 } download_schedule_t
;
2052 #define download_schedule_bitfield_t ENUM_BF(download_schedule_t)
2054 /** Enumeration: is the download schedule for downloading from an authority,
2055 * or from any available directory mirror?
2056 * During bootstrap, "any" means a fallback (or an authority, if there
2057 * are no fallbacks).
2058 * When we have a valid consensus, "any" means any directory server. */
2060 DL_WANT_ANY_DIRSERVER
= 0,
2061 DL_WANT_AUTHORITY
= 1,
2062 } download_want_authority_t
;
2063 #define download_want_authority_bitfield_t \
2064 ENUM_BF(download_want_authority_t)
2066 /** Enumeration: do we want to increment the schedule position each time a
2067 * connection is attempted (these attempts can be concurrent), or do we want
2068 * to increment the schedule position after a connection fails? */
2070 DL_SCHED_INCREMENT_FAILURE
= 0,
2071 DL_SCHED_INCREMENT_ATTEMPT
= 1,
2072 } download_schedule_increment_t
;
2073 #define download_schedule_increment_bitfield_t \
2074 ENUM_BF(download_schedule_increment_t)
2076 /** Enumeration: do we want to use the random exponential backoff
2079 DL_SCHED_DETERMINISTIC
= 0,
2080 DL_SCHED_RANDOM_EXPONENTIAL
= 1,
2081 } download_schedule_backoff_t
;
2082 #define download_schedule_backoff_bitfield_t \
2083 ENUM_BF(download_schedule_backoff_t)
2085 /** Information about our plans for retrying downloads for a downloadable
2087 * Each type of downloadable directory object has a corresponding retry
2088 * <b>schedule</b>, which can be different depending on whether the object is
2089 * being downloaded from an authority or a mirror (<b>want_authority</b>).
2090 * <b>next_attempt_at</b> contains the next time we will attempt to download
2092 * For schedules that <b>increment_on</b> failure, <b>n_download_failures</b>
2093 * is used to determine the position in the schedule. (Each schedule is a
2094 * smartlist of integer delays, parsed from a CSV option.) Every time a
2095 * connection attempt fails, <b>n_download_failures</b> is incremented,
2096 * the new delay value is looked up from the schedule, and
2097 * <b>next_attempt_at</b> is set delay seconds from the time the previous
2098 * connection failed. Therefore, at most one failure-based connection can be
2099 * in progress for each download_status_t.
2100 * For schedules that <b>increment_on</b> attempt, <b>n_download_attempts</b>
2101 * is used to determine the position in the schedule. Every time a
2102 * connection attempt is made, <b>n_download_attempts</b> is incremented,
2103 * the new delay value is looked up from the schedule, and
2104 * <b>next_attempt_at</b> is set delay seconds from the time the previous
2105 * connection was attempted. Therefore, multiple concurrent attempted-based
2106 * connections can be in progress for each download_status_t.
2107 * After an object is successfully downloaded, any other concurrent connections
2108 * are terminated. A new schedule which starts at position 0 is used for
2109 * subsequent downloads of the same object.
2111 typedef struct download_status_t
{
2112 time_t next_attempt_at
; /**< When should we try downloading this object
2114 uint8_t n_download_failures
; /**< Number of failed downloads of the most
2115 * recent object, since the last success. */
2116 uint8_t n_download_attempts
; /**< Number of (potentially concurrent) attempts
2117 * to download the most recent object, since
2118 * the last success. */
2119 download_schedule_bitfield_t schedule
: 8; /**< What kind of object is being
2120 * downloaded? This determines the
2121 * schedule used for the download.
2123 download_want_authority_bitfield_t want_authority
: 1; /**< Is the download
2124 * happening from an authority
2125 * or a mirror? This determines
2126 * the schedule used for the
2128 download_schedule_increment_bitfield_t increment_on
: 1; /**< does this
2129 * schedule increment on each attempt,
2130 * or after each failure? */
2131 download_schedule_backoff_bitfield_t backoff
: 1; /**< do we use the
2132 * deterministic schedule, or random
2133 * exponential backoffs?
2134 * Increment on failure schedules
2135 * always use exponential backoff. */
2136 uint8_t last_backoff_position
; /**< number of attempts/failures, depending
2137 * on increment_on, when we last recalculated
2138 * the delay. Only updated if backoff
2140 int last_delay_used
; /**< last delay used for random exponential backoff;
2141 * only updated if backoff == 1 */
2142 } download_status_t
;
2144 /** If n_download_failures is this high, the download can never happen. */
2145 #define IMPOSSIBLE_TO_DOWNLOAD 255
2147 /** The max size we expect router descriptor annotations we create to
2148 * be. We'll accept larger ones if we see them on disk, but we won't
2149 * create any that are larger than this. */
2150 #define ROUTER_ANNOTATION_BUF_LEN 256
2152 /** Information need to cache an onion router's descriptor. */
2153 typedef struct signed_descriptor_t
{
2154 /** Pointer to the raw server descriptor, preceded by annotations. Not
2155 * necessarily NUL-terminated. If saved_location is SAVED_IN_CACHE, this
2156 * pointer is null. */
2157 char *signed_descriptor_body
;
2158 /** Length of the annotations preceding the server descriptor. */
2159 size_t annotations_len
;
2160 /** Length of the server descriptor. */
2161 size_t signed_descriptor_len
;
2162 /** Digest of the server descriptor, computed as specified in
2164 char signed_descriptor_digest
[DIGEST_LEN
];
2165 /** Identity digest of the router. */
2166 char identity_digest
[DIGEST_LEN
];
2167 /** Declared publication time of the descriptor. */
2168 time_t published_on
;
2169 /** For routerdescs only: digest of the corresponding extrainfo. */
2170 char extra_info_digest
[DIGEST_LEN
];
2171 /** For routerdescs only: A SHA256-digest of the extrainfo (if any) */
2172 char extra_info_digest256
[DIGEST256_LEN
];
2173 /** Certificate for ed25519 signing key. */
2174 struct tor_cert_st
*signing_key_cert
;
2175 /** For routerdescs only: Status of downloading the corresponding
2177 download_status_t ei_dl_status
;
2178 /** Where is the descriptor saved? */
2179 saved_location_t saved_location
;
2180 /** If saved_location is SAVED_IN_CACHE or SAVED_IN_JOURNAL, the offset of
2181 * this descriptor in the corresponding file. */
2183 /** What position is this descriptor within routerlist->routers or
2184 * routerlist->old_routers? -1 for none. */
2185 int routerlist_index
;
2186 /** The valid-until time of the most recent consensus that listed this
2187 * descriptor. 0 for "never listed in a consensus, so far as we know." */
2188 time_t last_listed_as_valid_until
;
2189 /* If true, we do not ever try to save this object in the cache. */
2190 unsigned int do_not_cache
: 1;
2191 /* If true, this item is meant to represent an extrainfo. */
2192 unsigned int is_extrainfo
: 1;
2193 /* If true, we got an extrainfo for this item, and the digest was right,
2194 * but it was incompatible. */
2195 unsigned int extrainfo_is_bogus
: 1;
2196 /* If true, we are willing to transmit this item unencrypted. */
2197 unsigned int send_unencrypted
: 1;
2198 } signed_descriptor_t
;
2200 /** A signed integer representing a country code. */
2201 typedef int16_t country_t
;
2203 /** Information about another onion router in the network. */
2205 signed_descriptor_t cache_info
;
2206 char *nickname
; /**< Human-readable OR name. */
2208 uint32_t addr
; /**< IPv4 address of OR, in host order. */
2209 uint16_t or_port
; /**< Port for TLS connections. */
2210 uint16_t dir_port
; /**< Port for HTTP directory connections. */
2212 /** A router's IPv6 address, if it has one. */
2213 /* XXXXX187 Actually these should probably be part of a list of addresses,
2214 * not just a special case. Use abstractions to access these; don't do it
2216 tor_addr_t ipv6_addr
;
2217 uint16_t ipv6_orport
;
2219 crypto_pk_t
*onion_pkey
; /**< Public RSA key for onions. */
2220 crypto_pk_t
*identity_pkey
; /**< Public RSA key for signing. */
2221 /** Public curve25519 key for onions */
2222 curve25519_public_key_t
*onion_curve25519_pkey
;
2223 /** What's the earliest expiration time on all the certs in this
2225 time_t cert_expiration_time
;
2227 char *platform
; /**< What software/operating system is this OR using? */
2229 char *protocol_list
; /**< Encoded list of subprotocol versions supported
2233 uint32_t bandwidthrate
; /**< How many bytes does this OR add to its token
2234 * bucket per second? */
2235 uint32_t bandwidthburst
; /**< How large is this OR's token bucket? */
2236 /** How many bytes/s is this router known to handle? */
2237 uint32_t bandwidthcapacity
;
2238 smartlist_t
*exit_policy
; /**< What streams will this OR permit
2239 * to exit on IPv4? NULL for 'reject *:*'. */
2240 /** What streams will this OR permit to exit on IPv6?
2241 * NULL for 'reject *:*' */
2242 struct short_policy_t
*ipv6_exit_policy
;
2243 long uptime
; /**< How many seconds the router claims to have been up */
2244 smartlist_t
*declared_family
; /**< Nicknames of router which this router
2245 * claims are its family. */
2246 char *contact_info
; /**< Declared contact info for this router. */
2247 unsigned int is_hibernating
:1; /**< Whether the router claims to be
2249 unsigned int caches_extra_info
:1; /**< Whether the router says it caches and
2250 * serves extrainfo documents. */
2251 unsigned int allow_single_hop_exits
:1; /**< Whether the router says
2252 * it allows single hop exits. */
2254 unsigned int wants_to_be_hs_dir
:1; /**< True iff this router claims to be
2255 * a hidden service directory. */
2256 unsigned int policy_is_reject_star
:1; /**< True iff the exit policy for this
2257 * router rejects everything. */
2258 /** True if, after we have added this router, we should re-launch
2260 unsigned int needs_retest_if_added
:1;
2262 /** True iff this router included "tunnelled-dir-server" in its descriptor,
2263 * implying it accepts tunnelled directory requests, or it advertised
2265 unsigned int supports_tunnelled_dir_requests
:1;
2267 /** Used during voting to indicate that we should not include an entry for
2268 * this routerinfo. Used only during voting. */
2269 unsigned int omit_from_vote
:1;
2271 /** Tor can use this router for general positions in circuits; we got it
2272 * from a directory server as usual, or we're an authority and a server
2274 #define ROUTER_PURPOSE_GENERAL 0
2275 /** Tor should avoid using this router for circuit-building: we got it
2276 * from a controller. If the controller wants to use it, it'll have to
2277 * ask for it by identity. */
2278 #define ROUTER_PURPOSE_CONTROLLER 1
2279 /** Tor should use this router only for bridge positions in circuits: we got
2280 * it via a directory request from the bridge itself, or a bridge
2282 #define ROUTER_PURPOSE_BRIDGE 2
2283 /** Tor should not use this router; it was marked in cached-descriptors with
2284 * a purpose we didn't recognize. */
2285 #define ROUTER_PURPOSE_UNKNOWN 255
2287 /** In what way did we find out about this router? One of ROUTER_PURPOSE_*.
2288 * Routers of different purposes are kept segregated and used for different
2289 * things; see notes on ROUTER_PURPOSE_* macros above.
2294 /** Information needed to keep and cache a signed extra-info document. */
2295 typedef struct extrainfo_t
{
2296 signed_descriptor_t cache_info
;
2297 /** SHA256 digest of this document */
2298 uint8_t digest256
[DIGEST256_LEN
];
2299 /** The router's nickname. */
2300 char nickname
[MAX_NICKNAME_LEN
+1];
2301 /** True iff we found the right key for this extra-info, verified the
2302 * signature, and found it to be bad. */
2303 unsigned int bad_sig
: 1;
2304 /** If present, we didn't have the right key to verify this extra-info,
2305 * so this is a copy of the signature in the document. */
2307 /** Length of pending_sig. */
2308 size_t pending_sig_len
;
2311 /** Contents of a single router entry in a network status object.
2313 typedef struct routerstatus_t
{
2314 time_t published_on
; /**< When was this router published? */
2315 char nickname
[MAX_NICKNAME_LEN
+1]; /**< The nickname this router says it
2317 char identity_digest
[DIGEST_LEN
]; /**< Digest of the router's identity
2319 /** Digest of the router's most recent descriptor or microdescriptor.
2320 * If it's a descriptor, we only use the first DIGEST_LEN bytes. */
2321 char descriptor_digest
[DIGEST256_LEN
];
2322 uint32_t addr
; /**< IPv4 address for this router, in host order. */
2323 uint16_t or_port
; /**< OR port for this router. */
2324 uint16_t dir_port
; /**< Directory port for this router. */
2325 tor_addr_t ipv6_addr
; /**< IPv6 address for this router. */
2326 uint16_t ipv6_orport
; /**<IPV6 OR port for this router. */
2327 unsigned int is_authority
:1; /**< True iff this router is an authority. */
2328 unsigned int is_exit
:1; /**< True iff this router is a good exit. */
2329 unsigned int is_stable
:1; /**< True iff this router stays up a long time. */
2330 unsigned int is_fast
:1; /**< True iff this router has good bandwidth. */
2331 /** True iff this router is called 'running' in the consensus. We give it
2332 * this funny name so that we don't accidentally use this bit as a view of
2333 * whether we think the router is *currently* running. If that's what you
2334 * want to know, look at is_running in node_t. */
2335 unsigned int is_flagged_running
:1;
2336 unsigned int is_named
:1; /**< True iff "nickname" belongs to this router. */
2337 unsigned int is_unnamed
:1; /**< True iff "nickname" belongs to another
2339 unsigned int is_valid
:1; /**< True iff this router isn't invalid. */
2340 unsigned int is_possible_guard
:1; /**< True iff this router would be a good
2341 * choice as an entry guard. */
2342 unsigned int is_bad_exit
:1; /**< True iff this node is a bad choice for
2344 unsigned int is_hs_dir
:1; /**< True iff this router is a v2-or-later hidden
2345 * service directory. */
2346 unsigned int is_v2_dir
:1; /** True iff this router publishes an open DirPort
2347 * or it claims to accept tunnelled dir requests.
2349 /** True iff we have a proto line for this router, or a versions line
2350 * from which we could infer the protocols. */
2351 unsigned int protocols_known
:1;
2353 /** True iff this router has a version or protocol list that allows it to
2354 * accept EXTEND2 cells */
2355 unsigned int supports_extend2_cells
:1;
2357 /** True iff this router has a protocol list that allows it to negotiate
2358 * ed25519 identity keys on a link handshake with us. */
2359 unsigned int supports_ed25519_link_handshake_compat
:1;
2361 /** True iff this router has a protocol list that allows it to negotiate
2362 * ed25519 identity keys on a link handshake, at all. */
2363 unsigned int supports_ed25519_link_handshake_any
:1;
2365 /** True iff this router has a protocol list that allows it to be an
2366 * introduction point supporting ed25519 authentication key which is part of
2367 * the v3 protocol detailed in proposal 224. This requires HSIntro=4. */
2368 unsigned int supports_ed25519_hs_intro
: 1;
2370 /** True iff this router has a protocol list that allows it to be an hidden
2371 * service directory supporting version 3 as seen in proposal 224. This
2372 * requires HSDir=2. */
2373 unsigned int supports_v3_hsdir
: 1;
2375 /** True iff this router has a protocol list that allows it to be an hidden
2376 * service rendezvous point supporting version 3 as seen in proposal 224.
2377 * This requires HSRend=2. */
2378 unsigned int supports_v3_rendezvous_point
: 1;
2380 unsigned int has_bandwidth
:1; /**< The vote/consensus had bw info */
2381 unsigned int has_exitsummary
:1; /**< The vote/consensus had exit summaries */
2382 unsigned int bw_is_unmeasured
:1; /**< This is a consensus entry, with
2383 * the Unmeasured flag set. */
2385 uint32_t bandwidth_kb
; /**< Bandwidth (capacity) of the router as reported in
2386 * the vote/consensus, in kilobytes/sec. */
2388 /** The consensus has guardfraction information for this router. */
2389 unsigned int has_guardfraction
:1;
2390 /** The guardfraction value of this router. */
2391 uint32_t guardfraction_percentage
;
2393 char *exitsummary
; /**< exit policy summary -
2394 * XXX weasel: this probably should not stay a string. */
2396 /* ---- The fields below aren't derived from the networkstatus; they
2397 * hold local information only. */
2399 time_t last_dir_503_at
; /**< When did this router last tell us that it
2400 * was too busy to serve directory info? */
2401 download_status_t dl_status
;
2405 /** A single entry in a parsed policy summary, describing a range of ports. */
2406 typedef struct short_policy_entry_t
{
2407 uint16_t min_port
, max_port
;
2408 } short_policy_entry_t
;
2410 /** A short_poliy_t is the parsed version of a policy summary. */
2411 typedef struct short_policy_t
{
2412 /** True if the members of 'entries' are port ranges to accept; false if
2413 * they are port ranges to reject */
2414 unsigned int is_accept
: 1;
2415 /** The actual number of values in 'entries'. */
2416 unsigned int n_entries
: 31;
2417 /** An array of 0 or more short_policy_entry_t values, each describing a
2418 * range of ports that this policy accepts or rejects (depending on the
2419 * value of is_accept).
2421 short_policy_entry_t entries
[FLEXIBLE_ARRAY_MEMBER
];
2424 /** A microdescriptor is the smallest amount of information needed to build a
2425 * circuit through a router. They are generated by the directory authorities,
2426 * using information from the uploaded routerinfo documents. They are not
2427 * self-signed, but are rather authenticated by having their hash in a signed
2428 * networkstatus document. */
2429 typedef struct microdesc_t
{
2430 /** Hashtable node, used to look up the microdesc by its digest. */
2431 HT_ENTRY(microdesc_t
) node
;
2433 /* Cache information */
2435 /** When was this microdescriptor last listed in a consensus document?
2436 * Once a microdesc has been unlisted long enough, we can drop it.
2439 /** Where is this microdescriptor currently stored? */
2440 saved_location_bitfield_t saved_location
: 3;
2441 /** If true, do not attempt to cache this microdescriptor on disk. */
2442 unsigned int no_save
: 1;
2443 /** If true, this microdesc has an entry in the microdesc_map */
2444 unsigned int held_in_map
: 1;
2445 /** Reference count: how many node_ts have a reference to this microdesc? */
2446 unsigned int held_by_nodes
;
2448 /** If saved_location == SAVED_IN_CACHE, this field holds the offset of the
2449 * microdescriptor in the cache. */
2452 /* The string containing the microdesc. */
2454 /** A pointer to the encoded body of the microdescriptor. If the
2455 * saved_location is SAVED_IN_CACHE, then the body is a pointer into an
2456 * mmap'd region. Otherwise, it is a malloc'd string. The string might not
2457 * be NUL-terminated; take the length from <b>bodylen</b>. */
2459 /** The length of the microdescriptor in <b>body</b>. */
2461 /** A SHA256-digest of the microdescriptor. */
2462 char digest
[DIGEST256_LEN
];
2464 /* Fields in the microdescriptor. */
2466 /** As routerinfo_t.onion_pkey */
2467 crypto_pk_t
*onion_pkey
;
2468 /** As routerinfo_t.onion_curve25519_pkey */
2469 curve25519_public_key_t
*onion_curve25519_pkey
;
2470 /** Ed25519 identity key, if included. */
2471 ed25519_public_key_t
*ed25519_identity_pkey
;
2472 /** As routerinfo_t.ipv6_addr */
2473 tor_addr_t ipv6_addr
;
2474 /** As routerinfo_t.ipv6_orport */
2475 uint16_t ipv6_orport
;
2476 /** As routerinfo_t.family */
2477 smartlist_t
*family
;
2478 /** IPv4 exit policy summary */
2479 short_policy_t
*exit_policy
;
2480 /** IPv6 exit policy summary */
2481 short_policy_t
*ipv6_exit_policy
;
2485 /** A node_t represents a Tor router.
2487 * Specifically, a node_t is a Tor router as we are using it: a router that
2488 * we are considering for circuits, connections, and so on. A node_t is a
2489 * thin wrapper around the routerstatus, routerinfo, and microdesc for a
2490 * single router, and provides a consistent interface for all of them.
2492 * Also, a node_t has mutable state. While a routerinfo, a routerstatus,
2493 * and a microdesc have[*] only the information read from a router
2494 * descriptor, a consensus entry, and a microdescriptor (respectively)...
2495 * a node_t has flags based on *our own current opinion* of the node.
2497 * [*] Actually, there is some leftover information in each that is mutable.
2498 * We should try to excise that.
2500 typedef struct node_t
{
2501 /* Indexing information */
2503 /** Used to look up the node_t by its identity digest. */
2504 HT_ENTRY(node_t
) ht_ent
;
2505 /** Used to look up the node_t by its ed25519 identity digest. */
2506 HT_ENTRY(node_t
) ed_ht_ent
;
2507 /** Position of the node within the list of nodes */
2510 /** The identity digest of this node_t. No more than one node_t per
2511 * identity may exist at a time. */
2512 char identity
[DIGEST_LEN
];
2514 /** The ed25519 identity of this node_t. This field is nonzero iff we
2515 * currently have an ed25519 identity for this node in either md or ri,
2516 * _and_ this node has been inserted to the ed25519-to-node map in the
2519 ed25519_public_key_t ed25519_id
;
2525 /* local info: copied from routerstatus, then possibly frobbed based
2526 * on experience. Authorities set this stuff directly. Note that
2527 * these reflect knowledge of the primary (IPv4) OR port only. */
2529 unsigned int is_running
:1; /**< As far as we know, is this OR currently
2531 unsigned int is_valid
:1; /**< Has a trusted dirserver validated this OR?
2532 * (For Authdir: Have we validated this OR?) */
2533 unsigned int is_fast
:1; /** Do we think this is a fast OR? */
2534 unsigned int is_stable
:1; /** Do we think this is a stable OR? */
2535 unsigned int is_possible_guard
:1; /**< Do we think this is an OK guard? */
2536 unsigned int is_exit
:1; /**< Do we think this is an OK exit? */
2537 unsigned int is_bad_exit
:1; /**< Do we think this exit is censored, borked,
2538 * or otherwise nasty? */
2539 unsigned int is_hs_dir
:1; /**< True iff this router is a hidden service
2540 * directory according to the authorities. */
2542 /* Local info: warning state. */
2544 unsigned int name_lookup_warned
:1; /**< Have we warned the user for referring
2545 * to this (unnamed) router by nickname?
2548 /** Local info: we treat this node as if it rejects everything */
2549 unsigned int rejects_all
:1;
2551 /* Local info: derived. */
2553 /** True if the IPv6 OR port is preferred over the IPv4 OR port.
2554 * XX/teor - can this become out of date if the torrc changes? */
2555 unsigned int ipv6_preferred
:1;
2557 /** According to the geoip db what country is this router in? */
2558 /* XXXprop186 what is this suppose to mean with multiple OR ports? */
2561 /* The below items are used only by authdirservers for
2562 * reachability testing. */
2564 /** When was the last time we could reach this OR? */
2565 time_t last_reachable
; /* IPv4. */
2566 time_t last_reachable6
; /* IPv6. */
2568 /* Hidden service directory index data. This is used by a service or client
2569 * in order to know what's the hs directory index for this node at the time
2570 * the consensus is set. */
2571 struct hsdir_index_t
*hsdir_index
;
2574 /** Linked list of microdesc hash lines for a single router in a directory
2577 typedef struct vote_microdesc_hash_t
{
2578 /** Next element in the list, or NULL. */
2579 struct vote_microdesc_hash_t
*next
;
2580 /** The raw contents of the microdesc hash line, from the "m" through the
2582 char *microdesc_hash_line
;
2583 } vote_microdesc_hash_t
;
2585 /** The claim about a single router, made in a vote. */
2586 typedef struct vote_routerstatus_t
{
2587 routerstatus_t status
; /**< Underlying 'status' object for this router.
2588 * Flags are redundant. */
2589 /** How many known-flags are allowed in a vote? This is the width of
2590 * the flags field of vote_routerstatus_t */
2591 #define MAX_KNOWN_FLAGS_IN_VOTE 64
2592 uint64_t flags
; /**< Bit-field for all recognized flags; index into
2593 * networkstatus_t.known_flags. */
2594 char *version
; /**< The version that the authority says this router is
2596 char *protocols
; /**< The protocols that this authority says this router
2598 unsigned int has_measured_bw
:1; /**< The vote had a measured bw */
2599 /** True iff the vote included an entry for ed25519 ID, or included
2600 * "id ed25519 none" to indicate that there was no ed25519 ID. */
2601 unsigned int has_ed25519_listing
:1;
2602 /** True if the Ed25519 listing here is the consensus-opinion for the
2603 * Ed25519 listing; false if there was no consensus on Ed25519 key status,
2604 * or if this VRS doesn't reflect it. */
2605 unsigned int ed25519_reflects_consensus
:1;
2606 uint32_t measured_bw_kb
; /**< Measured bandwidth (capacity) of the router */
2607 /** The hash or hashes that the authority claims this microdesc has. */
2608 vote_microdesc_hash_t
*microdesc
;
2609 /** Ed25519 identity for this router, or zero if it has none. */
2610 uint8_t ed25519_id
[ED25519_PUBKEY_LEN
];
2611 } vote_routerstatus_t
;
2613 /** A signature of some document by an authority. */
2614 typedef struct document_signature_t
{
2615 /** Declared SHA-1 digest of this voter's identity key */
2616 char identity_digest
[DIGEST_LEN
];
2617 /** Declared SHA-1 digest of signing key used by this voter. */
2618 char signing_key_digest
[DIGEST_LEN
];
2619 /** Algorithm used to compute the digest of the document. */
2620 digest_algorithm_t alg
;
2621 /** Signature of the signed thing. */
2623 /** Length of <b>signature</b> */
2625 unsigned int bad_signature
: 1; /**< Set to true if we've tried to verify
2626 * the sig, and we know it's bad. */
2627 unsigned int good_signature
: 1; /**< Set to true if we've verified the sig
2629 } document_signature_t
;
2631 /** Information about a single voter in a vote or a consensus. */
2632 typedef struct networkstatus_voter_info_t
{
2633 /** Declared SHA-1 digest of this voter's identity key */
2634 char identity_digest
[DIGEST_LEN
];
2635 char *nickname
; /**< Nickname of this voter */
2636 /** Digest of this voter's "legacy" identity key, if any. In vote only; for
2637 * consensuses, we treat legacy keys as additional signers. */
2638 char legacy_id_digest
[DIGEST_LEN
];
2639 char *address
; /**< Address of this voter, in string format. */
2640 uint32_t addr
; /**< Address of this voter, in IPv4, in host order. */
2641 uint16_t dir_port
; /**< Directory port of this voter */
2642 uint16_t or_port
; /**< OR port of this voter */
2643 char *contact
; /**< Contact information for this voter. */
2644 char vote_digest
[DIGEST_LEN
]; /**< Digest of this voter's vote, as signed. */
2646 /* Nothing from here on is signed. */
2647 /** The signature of the document and the signature's status. */
2649 } networkstatus_voter_info_t
;
2651 typedef struct networkstatus_sr_info_t
{
2652 /* Indicate if the dirauth partitipates in the SR protocol with its vote.
2653 * This is tied to the SR flag in the vote. */
2654 unsigned int participate
:1;
2655 /* Both vote and consensus: Current and previous SRV. If list is empty,
2656 * this means none were found in either the consensus or vote. */
2657 struct sr_srv_t
*previous_srv
;
2658 struct sr_srv_t
*current_srv
;
2659 /* Vote only: List of commitments. */
2660 smartlist_t
*commits
;
2661 } networkstatus_sr_info_t
;
2663 /** Enumerates the possible seriousness values of a networkstatus document. */
2668 } networkstatus_type_t
;
2670 /** Enumerates recognized flavors of a consensus networkstatus document. All
2671 * flavors of a consensus are generated from the same set of votes, but they
2672 * present different types information to different versions of Tor. */
2676 } consensus_flavor_t
;
2678 /** How many different consensus flavors are there? */
2679 #define N_CONSENSUS_FLAVORS ((int)(FLAV_MICRODESC)+1)
2681 /** A common structure to hold a v3 network status vote, or a v3 network
2682 * status consensus. */
2683 typedef struct networkstatus_t
{
2684 networkstatus_type_t type
; /**< Vote, consensus, or opinion? */
2685 consensus_flavor_t flavor
; /**< If a consensus, what kind? */
2686 unsigned int has_measured_bws
: 1;/**< True iff this networkstatus contains
2687 * measured= bandwidth values. */
2689 time_t published
; /**< Vote only: Time when vote was written. */
2690 time_t valid_after
; /**< Time after which this vote or consensus applies. */
2691 time_t fresh_until
; /**< Time before which this is the most recent vote or
2693 time_t valid_until
; /**< Time after which this vote or consensus should not
2696 /** Consensus only: what method was used to produce this consensus? */
2697 int consensus_method
;
2698 /** Vote only: what methods is this voter willing to use? */
2699 smartlist_t
*supported_methods
;
2701 /** List of 'package' lines describing hashes of downloadable packages */
2702 smartlist_t
*package_lines
;
2704 /** How long does this vote/consensus claim that authorities take to
2705 * distribute their votes to one another? */
2707 /** How long does this vote/consensus claim that authorities take to
2708 * distribute their consensus signatures to one another? */
2711 /** Comma-separated list of recommended client software, or NULL if this
2712 * voter has no opinion. */
2713 char *client_versions
;
2714 char *server_versions
;
2716 /** Lists of subprotocol versions which are _recommended_ for relays and
2717 * clients, or which are _require_ for relays and clients. Tor shouldn't
2718 * make any more network connections if a required protocol is missing.
2720 char *recommended_relay_protocols
;
2721 char *recommended_client_protocols
;
2722 char *required_relay_protocols
;
2723 char *required_client_protocols
;
2725 /** List of flags that this vote/consensus applies to routers. If a flag is
2726 * not listed here, the voter has no opinion on what its value should be. */
2727 smartlist_t
*known_flags
;
2729 /** List of key=value strings for the parameters in this vote or
2730 * consensus, sorted by key. */
2731 smartlist_t
*net_params
;
2733 /** List of key=value strings for the bw weight parameters in the
2735 smartlist_t
*weight_params
;
2737 /** List of networkstatus_voter_info_t. For a vote, only one element
2738 * is included. For a consensus, one element is included for every voter
2739 * whose vote contributed to the consensus. */
2740 smartlist_t
*voters
;
2742 struct authority_cert_t
*cert
; /**< Vote only: the voter's certificate. */
2744 /** Digests of this document, as signed. */
2745 common_digests_t digests
;
2746 /** A SHA3-256 digest of the document, not including signatures: used for
2747 * consensus diffs */
2748 uint8_t digest_sha3_as_signed
[DIGEST256_LEN
];
2750 /** List of router statuses, sorted by identity digest. For a vote,
2751 * the elements are vote_routerstatus_t; for a consensus, the elements
2752 * are routerstatus_t. */
2753 smartlist_t
*routerstatus_list
;
2755 /** If present, a map from descriptor digest to elements of
2756 * routerstatus_list. */
2757 digestmap_t
*desc_digest_map
;
2759 /** Contains the shared random protocol data from a vote or consensus. */
2760 networkstatus_sr_info_t sr_info
;
2763 /** A set of signatures for a networkstatus consensus. Unless otherwise
2764 * noted, all fields are as for networkstatus_t. */
2765 typedef struct ns_detached_signatures_t
{
2769 strmap_t
*digests
; /**< Map from flavor name to digestset_t */
2770 strmap_t
*signatures
; /**< Map from flavor name to list of
2771 * document_signature_t */
2772 } ns_detached_signatures_t
;
2774 /** Allowable types of desc_store_t. */
2775 typedef enum store_type_t
{
2780 /** A 'store' is a set of descriptors saved on disk, with accompanying
2781 * journal, mmaped as needed, rebuilt as needed. */
2782 typedef struct desc_store_t
{
2783 /** Filename (within DataDir) for the store. We append .tmp to this
2784 * filename for a temporary file when rebuilding the store, and .new to this
2785 * filename for the journal. */
2786 const char *fname_base
;
2787 /** Human-readable description of what this store contains. */
2788 const char *description
;
2790 tor_mmap_t
*mmap
; /**< A mmap for the main file in the store. */
2792 store_type_t type
; /**< What's stored in this store? */
2794 /** The size of the router log, in bytes. */
2796 /** The size of the router store, in bytes. */
2798 /** Total bytes dropped since last rebuild: this is space currently
2799 * used in the cache and the journal that could be freed by a rebuild. */
2800 size_t bytes_dropped
;
2803 /** Contents of a directory of onion routers. */
2805 /** Map from server identity digest to a member of routers. */
2806 struct digest_ri_map_t
*identity_map
;
2807 /** Map from server descriptor digest to a signed_descriptor_t from
2808 * routers or old_routers. */
2809 struct digest_sd_map_t
*desc_digest_map
;
2810 /** Map from extra-info digest to an extrainfo_t. Only exists for
2811 * routers in routers or old_routers. */
2812 struct digest_ei_map_t
*extra_info_map
;
2813 /** Map from extra-info digests to a signed_descriptor_t for a router
2814 * descriptor having that extra-info digest. Only exists for
2815 * routers in routers or old_routers. */
2816 struct digest_sd_map_t
*desc_by_eid_map
;
2817 /** List of routerinfo_t for all currently live routers we know. */
2818 smartlist_t
*routers
;
2819 /** List of signed_descriptor_t for older router descriptors we're
2821 smartlist_t
*old_routers
;
2822 /** Store holding server descriptors. If present, any router whose
2823 * cache_info.saved_location == SAVED_IN_CACHE is stored in this file
2824 * starting at cache_info.saved_offset */
2825 desc_store_t desc_store
;
2826 /** Store holding extra-info documents. */
2827 desc_store_t extrainfo_store
;
2830 /** Information on router used when extending a circuit. We don't need a
2831 * full routerinfo_t to extend: we only need addr:port:keyid to build an OR
2832 * connection, and onion_key to create the onionskin. Note that for onehop
2833 * general-purpose tunnels, the onion_key is NULL. */
2834 typedef struct extend_info_t
{
2835 char nickname
[MAX_HEX_NICKNAME_LEN
+1]; /**< This router's nickname for
2837 /** Hash of this router's RSA identity key. */
2838 char identity_digest
[DIGEST_LEN
];
2839 /** Ed25519 identity for this router, if any. */
2840 ed25519_public_key_t ed_identity
;
2841 uint16_t port
; /**< OR port. */
2842 tor_addr_t addr
; /**< IP address. */
2843 crypto_pk_t
*onion_key
; /**< Current onionskin key. */
2844 curve25519_public_key_t curve25519_onion_key
;
2847 /** Certificate for v3 directory protocol: binds long-term authority identity
2848 * keys to medium-term authority signing keys. */
2849 typedef struct authority_cert_t
{
2850 /** Information relating to caching this cert on disk and looking it up. */
2851 signed_descriptor_t cache_info
;
2852 /** This authority's long-term authority identity key. */
2853 crypto_pk_t
*identity_key
;
2854 /** This authority's medium-term signing key. */
2855 crypto_pk_t
*signing_key
;
2856 /** The digest of <b>signing_key</b> */
2857 char signing_key_digest
[DIGEST_LEN
];
2858 /** The listed expiration time of this certificate. */
2860 /** This authority's IPv4 address, in host order. */
2862 /** This authority's directory port. */
2866 /** Bitfield enum type listing types of information that directory authorities
2867 * can be authoritative about, and that directory caches may or may not cache.
2869 * Note that the granularity here is based on authority granularity and on
2870 * cache capabilities. Thus, one particular bit may correspond in practice to
2871 * a few types of directory info, so long as every authority that pronounces
2872 * officially about one of the types prounounces officially about all of them,
2873 * and so long as every cache that caches one of them caches all of them.
2877 /** Serves/signs v3 directory information: votes, consensuses, certs */
2878 V3_DIRINFO
= 1 << 2,
2879 /** Serves bridge descriptors. */
2880 BRIDGE_DIRINFO
= 1 << 4,
2881 /** Serves extrainfo documents. */
2882 EXTRAINFO_DIRINFO
=1 << 5,
2883 /** Serves microdescriptors. */
2884 MICRODESC_DIRINFO
=1 << 6,
2887 #define ALL_DIRINFO ((dirinfo_type_t)((1<<7)-1))
2889 #define CRYPT_PATH_MAGIC 0x70127012u
2891 struct fast_handshake_state_t
;
2892 struct ntor_handshake_state_t
;
2893 #define ONION_HANDSHAKE_TYPE_TAP 0x0000
2894 #define ONION_HANDSHAKE_TYPE_FAST 0x0001
2895 #define ONION_HANDSHAKE_TYPE_NTOR 0x0002
2896 #define MAX_ONION_HANDSHAKE_TYPE 0x0002
2900 struct fast_handshake_state_t
*fast
;
2902 struct ntor_handshake_state_t
*ntor
;
2904 } onion_handshake_state_t
;
2906 /** Holds accounting information for a single step in the layered encryption
2907 * performed by a circuit. Used only at the client edge of a circuit. */
2908 typedef struct crypt_path_t
{
2911 /* crypto environments */
2912 /** Encryption key and counter for cells heading towards the OR at this
2914 crypto_cipher_t
*f_crypto
;
2915 /** Encryption key and counter for cells heading back from the OR at this
2917 crypto_cipher_t
*b_crypto
;
2919 /** Digest state for cells heading towards the OR at this step. */
2920 crypto_digest_t
*f_digest
; /* for integrity checking */
2921 /** Digest state for cells heading away from the OR at this step. */
2922 crypto_digest_t
*b_digest
;
2924 /** Current state of the handshake as performed with the OR at this
2926 onion_handshake_state_t handshake_state
;
2927 /** Diffie-hellman handshake state for performing an introduction
2929 crypto_dh_t
*rend_dh_handshake_state
;
2931 /** Negotiated key material shared with the OR at this step. */
2932 char rend_circ_nonce
[DIGEST_LEN
];/* KH in tor-spec.txt */
2934 /** Information to extend to the OR at this step. */
2935 extend_info_t
*extend_info
;
2937 /** Is the circuit built to this step? Must be one of:
2938 * - CPATH_STATE_CLOSED (The circuit has not been extended to this step)
2939 * - CPATH_STATE_AWAITING_KEYS (We have sent an EXTEND/CREATE to this step
2940 * and not received an EXTENDED/CREATED)
2941 * - CPATH_STATE_OPEN (The circuit has been extended to this step) */
2943 #define CPATH_STATE_CLOSED 0
2944 #define CPATH_STATE_AWAITING_KEYS 1
2945 #define CPATH_STATE_OPEN 2
2946 struct crypt_path_t
*next
; /**< Link to next crypt_path_t in the circuit.
2947 * (The list is circular, so the last node
2948 * links to the first.) */
2949 struct crypt_path_t
*prev
; /**< Link to previous crypt_path_t in the
2952 int package_window
; /**< How many cells are we allowed to originate ending
2954 int deliver_window
; /**< How many cells are we willing to deliver originating
2958 /** A reference-counted pointer to a crypt_path_t, used only to share
2959 * the final rendezvous cpath to be used on a service-side rendezvous
2960 * circuit among multiple circuits built in parallel to the same
2961 * destination rendezvous point. */
2963 /** The reference count. */
2964 unsigned int refcount
;
2965 /** The pointer. Set to NULL when the crypt_path_t is put into use
2966 * on an opened rendezvous circuit. */
2967 crypt_path_t
*cpath
;
2968 } crypt_path_reference_t
;
2970 #define CPATH_KEY_MATERIAL_LEN (20*2+16*2)
2972 #define DH_KEY_LEN DH_BYTES
2974 /** Information used to build a circuit. */
2976 /** Intended length of the final circuit. */
2977 int desired_path_len
;
2978 /** How to extend to the planned exit node. */
2979 extend_info_t
*chosen_exit
;
2980 /** Whether every node in the circ must have adequate uptime. */
2981 unsigned int need_uptime
: 1;
2982 /** Whether every node in the circ must have adequate capacity. */
2983 unsigned int need_capacity
: 1;
2984 /** Whether the last hop was picked with exiting in mind. */
2985 unsigned int is_internal
: 1;
2986 /** Did we pick this as a one-hop tunnel (not safe for other streams)?
2987 * These are for encrypted dir conns that exit to this router, not
2988 * for arbitrary exits from the circuit. */
2989 unsigned int onehop_tunnel
: 1;
2990 /** The crypt_path_t to append after rendezvous: used for rendezvous. */
2991 crypt_path_t
*pending_final_cpath
;
2992 /** A ref-counted reference to the crypt_path_t to append after
2993 * rendezvous; used on the service side. */
2994 crypt_path_reference_t
*service_pending_final_cpath_ref
;
2995 /** How many times has building a circuit for this task failed? */
2997 /** At what time should we give up on this task? */
2999 } cpath_build_state_t
;
3001 /** "magic" value for an origin_circuit_t */
3002 #define ORIGIN_CIRCUIT_MAGIC 0x35315243u
3003 /** "magic" value for an or_circuit_t */
3004 #define OR_CIRCUIT_MAGIC 0x98ABC04Fu
3005 /** "magic" value for a circuit that would have been freed by circuit_free,
3006 * but which we're keeping around until a cpuworker reply arrives. See
3007 * circuit_free() for more documentation. */
3008 #define DEAD_CIRCUIT_MAGIC 0xdeadc14c
3010 struct create_cell_t
;
3012 /** Entry in the cell stats list of a circuit; used only if CELL_STATS
3013 * events are enabled. */
3014 typedef struct testing_cell_stats_entry_t
{
3015 uint8_t command
; /**< cell command number. */
3016 /** Waiting time in centiseconds if this event is for a removed cell,
3017 * or 0 if this event is for adding a cell to the queue. 22 bits can
3018 * store more than 11 hours, enough to assume that a circuit with this
3019 * delay would long have been closed. */
3020 unsigned int waiting_time
:22;
3021 unsigned int removed
:1; /**< 0 for added to, 1 for removed from queue. */
3022 unsigned int exitward
:1; /**< 0 for app-ward, 1 for exit-ward. */
3023 } testing_cell_stats_entry_t
;
3026 * A circuit is a path over the onion routing
3027 * network. Applications can connect to one end of the circuit, and can
3028 * create exit connections at the other end of the circuit. AP and exit
3029 * connections have only one circuit associated with them (and thus these
3030 * connection types are closed when the circuit is closed), whereas
3031 * OR connections multiplex many circuits at once, and stay standing even
3032 * when there are no circuits running over them.
3034 * A circuit_t structure can fill one of two roles. First, a or_circuit_t
3035 * links two connections together: either an edge connection and an OR
3036 * connection, or two OR connections. (When joined to an OR connection, a
3037 * circuit_t affects only cells sent to a particular circID on that
3038 * connection. When joined to an edge connection, a circuit_t affects all
3041 * Second, an origin_circuit_t holds the cipher keys and state for sending data
3042 * along a given circuit. At the OP, it has a sequence of ciphers, each
3043 * of which is shared with a single OR along the circuit. Separate
3044 * ciphers are used for data going "forward" (away from the OP) and
3045 * "backward" (towards the OP). At the OR, a circuit has only two stream
3046 * ciphers: one for data going forward, and one for data going backward.
3048 typedef struct circuit_t
{
3049 uint32_t magic
; /**< For memory and type debugging: must equal
3050 * ORIGIN_CIRCUIT_MAGIC or OR_CIRCUIT_MAGIC. */
3052 /** The channel that is next in this circuit. */
3056 * The circuit_id used in the next (forward) hop of this circuit;
3057 * this is unique to n_chan, but this ordered pair is globally
3060 * (n_chan->global_identifier, n_circ_id)
3065 * Circuit mux associated with n_chan to which this circuit is attached;
3066 * NULL if we have no n_chan.
3068 circuitmux_t
*n_mux
;
3070 /** Queue of cells waiting to be transmitted on n_chan */
3071 cell_queue_t n_chan_cells
;
3074 * The hop to which we want to extend this circuit. Should be NULL if
3075 * the circuit has attached to a channel.
3077 extend_info_t
*n_hop
;
3079 /** True iff we are waiting for n_chan_cells to become less full before
3080 * allowing p_streams to add any more cells. (Origin circuit only.) */
3081 unsigned int streams_blocked_on_n_chan
: 1;
3082 /** True iff we are waiting for p_chan_cells to become less full before
3083 * allowing n_streams to add any more cells. (OR circuit only.) */
3084 unsigned int streams_blocked_on_p_chan
: 1;
3086 /** True iff we have queued a delete backwards on this circuit, but not put
3087 * it on the output buffer. */
3088 unsigned int p_delete_pending
: 1;
3089 /** True iff we have queued a delete forwards on this circuit, but not put
3090 * it on the output buffer. */
3091 unsigned int n_delete_pending
: 1;
3093 /** True iff this circuit has received a DESTROY cell in either direction */
3094 unsigned int received_destroy
: 1;
3096 uint8_t state
; /**< Current status of this circuit. */
3097 uint8_t purpose
; /**< Why are we creating this circuit? */
3099 /** How many relay data cells can we package (read from edge streams)
3100 * on this circuit before we receive a circuit-level sendme cell asking
3103 /** How many relay data cells will we deliver (write to edge streams)
3104 * on this circuit? When deliver_window gets low, we send some
3105 * circuit-level sendme cells to indicate that we're willing to accept
3109 /** Temporary field used during circuits_handle_oom. */
3112 /** For storage while n_chan is pending (state CIRCUIT_STATE_CHAN_WAIT). */
3113 struct create_cell_t
*n_chan_create_cell
;
3115 /** When did circuit construction actually begin (ie send the
3116 * CREATE cell or begin cannibalization).
3118 * Note: This timer will get reset if we decide to cannibalize
3119 * a circuit. It may also get reset during certain phases of hidden
3120 * service circuit use.
3122 * We keep this timestamp with a higher resolution than most so that the
3123 * circuit-build-time tracking code can get millisecond resolution.
3125 struct timeval timestamp_began
;
3127 /** This timestamp marks when the init_circuit_base constructor ran. */
3128 struct timeval timestamp_created
;
3130 /** When the circuit was first used, or 0 if the circuit is clean.
3132 * XXXX Note that some code will artifically adjust this value backward
3133 * in time in order to indicate that a circuit shouldn't be used for new
3134 * streams, but that it can stay alive as long as it has streams on it.
3135 * That's a kludge we should fix.
3137 * XXX The CBT code uses this field to record when HS-related
3138 * circuits entered certain states. This usage probably won't
3139 * interfere with this field's primary purpose, but we should
3140 * document it more thoroughly to make sure of that.
3142 * XXX The SocksPort option KeepaliveIsolateSOCKSAuth will artificially
3143 * adjust this value forward each time a suitable stream is attached to an
3144 * already constructed circuit, potentially keeping the circuit alive
3147 time_t timestamp_dirty
;
3149 uint16_t marked_for_close
; /**< Should we close this circuit at the end of
3150 * the main loop? (If true, holds the line number
3151 * where this circuit was marked.) */
3152 const char *marked_for_close_file
; /**< For debugging: in which file was this
3153 * circuit marked for close? */
3154 /** For what reason (See END_CIRC_REASON...) is this circuit being closed?
3155 * This field is set in circuit_mark_for_close and used later in
3156 * circuit_about_to_free. */
3157 int marked_for_close_reason
;
3158 /** As marked_for_close_reason, but reflects the underlying reason for
3159 * closing this circuit.
3161 int marked_for_close_orig_reason
;
3163 /** Unique ID for measuring tunneled network status requests. */
3166 /** Index in smartlist of all circuits (global_circuitlist). */
3167 int global_circuitlist_idx
;
3169 /** Next circuit in the doubly-linked ring of circuits waiting to add
3170 * cells to n_conn. NULL if we have no cells pending, or if we're not
3171 * linked to an OR connection. */
3172 struct circuit_t
*next_active_on_n_chan
;
3173 /** Previous circuit in the doubly-linked ring of circuits waiting to add
3174 * cells to n_conn. NULL if we have no cells pending, or if we're not
3175 * linked to an OR connection. */
3176 struct circuit_t
*prev_active_on_n_chan
;
3178 /** Various statistics about cells being added to or removed from this
3179 * circuit's queues; used only if CELL_STATS events are enabled and
3180 * cleared after being sent to control port. */
3181 smartlist_t
*testing_cell_stats
;
3183 /** If set, points to an HS token that this circuit might be carrying.
3184 * Used by the HS circuitmap. */
3185 hs_token_t
*hs_token
;
3186 /** Hashtable node: used to look up the circuit by its HS token using the HS
3188 HT_ENTRY(circuit_t
) hs_circuitmap_node
;
3191 /** Largest number of relay_early cells that we can send on a given
3193 #define MAX_RELAY_EARLY_CELLS_PER_CIRCUIT 8
3196 * Describes the circuit building process in simplified terms based
3197 * on the path bias accounting state for a circuit.
3199 * NOTE: These state values are enumerated in the order for which we
3200 * expect circuits to transition through them. If you add states,
3201 * you need to preserve this overall ordering. The various pathbias
3202 * state transition and accounting functions (pathbias_mark_* and
3203 * pathbias_count_*) contain ordinal comparisons to enforce proper
3204 * state transitions for corrections.
3206 * This state machine and the associated logic was created to prevent
3207 * miscounting due to unknown cases of circuit reuse. See also tickets
3211 /** This circuit is "new". It has not yet completed a first hop
3212 * or been counted by the path bias code. */
3213 PATH_STATE_NEW_CIRC
= 0,
3214 /** This circuit has completed one/two hops, and has been counted by
3215 * the path bias logic. */
3216 PATH_STATE_BUILD_ATTEMPTED
= 1,
3217 /** This circuit has been completely built */
3218 PATH_STATE_BUILD_SUCCEEDED
= 2,
3219 /** Did we try to attach any SOCKS streams or hidserv introductions to
3222 * Note: If we ever implement end-to-end stream timing through test
3223 * stream probes (#5707), we must *not* set this for those probes
3224 * (or any other automatic streams) because the adversary could
3225 * just tag at a later point.
3227 PATH_STATE_USE_ATTEMPTED
= 3,
3228 /** Did any SOCKS streams or hidserv introductions actually succeed on
3231 * If any streams detatch/fail from this circuit, the code transitions
3232 * the circuit back to PATH_STATE_USE_ATTEMPTED to ensure we probe. See
3233 * pathbias_mark_use_rollback() for that.
3235 PATH_STATE_USE_SUCCEEDED
= 4,
3238 * This is a special state to indicate that we got a corrupted
3239 * relay cell on a circuit and we don't intend to probe it.
3241 PATH_STATE_USE_FAILED
= 5,
3244 * This is a special state to indicate that we already counted
3245 * the circuit. Used to guard against potential state machine
3248 PATH_STATE_ALREADY_COUNTED
= 6,
3250 #define path_state_bitfield_t ENUM_BF(path_state_t)
3252 /** An origin_circuit_t holds data necessary to build and use a circuit.
3254 typedef struct origin_circuit_t
{
3257 /** Linked list of AP streams (or EXIT streams if hidden service)
3258 * associated with this circuit. */
3259 edge_connection_t
*p_streams
;
3261 /** Bytes read from any attached stream since last call to
3262 * control_event_circ_bandwidth_used(). Only used if we're configured
3263 * to emit CIRC_BW events. */
3264 uint32_t n_read_circ_bw
;
3266 /** Bytes written to any attached stream since last call to
3267 * control_event_circ_bandwidth_used(). Only used if we're configured
3268 * to emit CIRC_BW events. */
3269 uint32_t n_written_circ_bw
;
3271 /** Build state for this circuit. It includes the intended path
3272 * length, the chosen exit router, rendezvous information, etc.
3274 cpath_build_state_t
*build_state
;
3275 /** The doubly-linked list of crypt_path_t entries, one per hop,
3276 * for this circuit. This includes ciphers for each hop,
3277 * integrity-checking digests for each hop, and package/delivery
3278 * windows for each hop.
3280 crypt_path_t
*cpath
;
3282 /** Holds all rendezvous data on either client or service side. */
3283 rend_data_t
*rend_data
;
3285 /** Holds hidden service identifier on either client or service side. This
3286 * is for both introduction and rendezvous circuit. */
3287 struct hs_ident_circuit_t
*hs_ident
;
3289 /** Holds the data that the entry guard system uses to track the
3290 * status of the guard this circuit is using, and thereby to determine
3291 * whether this circuit can be used. */
3292 struct circuit_guard_state_t
*guard_state
;
3294 /** Index into global_origin_circuit_list for this circuit. -1 if not
3296 int global_origin_circuit_list_idx
;
3298 /** How many more relay_early cells can we send on this circuit, according
3299 * to the specification? */
3300 unsigned int remaining_relay_early_cells
: 4;
3302 /** Set if this circuit is insanely old and we already informed the user */
3303 unsigned int is_ancient
: 1;
3305 /** Set if this circuit has already been opened. Used to detect
3306 * cannibalized circuits. */
3307 unsigned int has_opened
: 1;
3310 * Path bias state machine. Used to ensure integrity of our
3311 * circuit building and usage accounting. See path_state_t
3314 path_state_bitfield_t path_state
: 3;
3316 /* If this flag is set, we should not consider attaching any more
3317 * connections to this circuit. */
3318 unsigned int unusable_for_new_conns
: 1;
3321 * Tristate variable to guard against pathbias miscounting
3322 * due to circuit purpose transitions changing the decision
3323 * of pathbias_should_count(). This variable is informational
3324 * only. The current results of pathbias_should_count() are
3325 * the official decision for pathbias accounting.
3327 uint8_t pathbias_shouldcount
;
3328 #define PATHBIAS_SHOULDCOUNT_UNDECIDED 0
3329 #define PATHBIAS_SHOULDCOUNT_IGNORED 1
3330 #define PATHBIAS_SHOULDCOUNT_COUNTED 2
3332 /** For path probing. Store the temporary probe stream ID
3333 * for response comparison */
3334 streamid_t pathbias_probe_id
;
3336 /** For path probing. Store the temporary probe address nonce
3337 * (in host byte order) for response comparison. */
3338 uint32_t pathbias_probe_nonce
;
3340 /** Set iff this is a hidden-service circuit which has timed out
3341 * according to our current circuit-build timeout, but which has
3342 * been kept around because it might still succeed in connecting to
3343 * its destination, and which is not a fully-connected rendezvous
3346 * (We clear this flag for client-side rendezvous circuits when they
3347 * are 'joined' to the other side's rendezvous circuit, so that
3348 * connection_ap_handshake_attach_circuit can put client streams on
3349 * the circuit. We also clear this flag for service-side rendezvous
3350 * circuits when they are 'joined' to a client's rend circ, but only
3351 * for symmetry with the client case. Client-side introduction
3352 * circuits are closed when we get a joined rend circ, and
3353 * service-side introduction circuits never have this flag set.) */
3354 unsigned int hs_circ_has_timed_out
: 1;
3356 /** Set iff this circuit has been given a relaxed timeout because
3357 * no circuits have opened. Used to prevent spamming logs. */
3358 unsigned int relaxed_timeout
: 1;
3360 /** Set iff this is a service-side rendezvous circuit for which a
3361 * new connection attempt has been launched. We consider launching
3362 * a new service-side rend circ to a client when the previous one
3363 * fails; now that we don't necessarily close a service-side rend
3364 * circ when we launch a new one to the same client, this flag keeps
3365 * us from launching two retries for the same failed rend circ. */
3366 unsigned int hs_service_side_rend_circ_has_been_relaunched
: 1;
3368 /** What commands were sent over this circuit that decremented the
3369 * RELAY_EARLY counter? This is for debugging task 878. */
3370 uint8_t relay_early_commands
[MAX_RELAY_EARLY_CELLS_PER_CIRCUIT
];
3372 /** How many RELAY_EARLY cells have been sent over this circuit? This is
3373 * for debugging task 878, too. */
3374 int relay_early_cells_sent
;
3376 /** The next stream_id that will be tried when we're attempting to
3377 * construct a new AP stream originating at this circuit. */
3378 streamid_t next_stream_id
;
3380 /* The intro key replaces the hidden service's public key if purpose is
3381 * S_ESTABLISH_INTRO or S_INTRO, provided that no unversioned rendezvous
3382 * descriptor is used. */
3383 crypto_pk_t
*intro_key
;
3385 /** Quasi-global identifier for this circuit; used for control.c */
3386 /* XXXX NM This can get re-used after 2**32 circuits. */
3387 uint32_t global_identifier
;
3389 /** True if we have associated one stream to this circuit, thereby setting
3390 * the isolation paramaters for this circuit. Note that this doesn't
3391 * necessarily mean that we've <em>attached</em> any streams to the circuit:
3392 * we may only have marked up this circuit during the launch process.
3394 unsigned int isolation_values_set
: 1;
3395 /** True iff any stream has <em>ever</em> been attached to this circuit.
3397 * In a better world we could use timestamp_dirty for this, but
3398 * timestamp_dirty is far too overloaded at the moment.
3400 unsigned int isolation_any_streams_attached
: 1;
3402 /** A bitfield of ISO_* flags for every isolation field such that this
3403 * circuit has had streams with more than one value for that field
3404 * attached to it. */
3405 uint8_t isolation_flags_mixed
;
3407 /** @name Isolation parameters
3409 * If any streams have been associated with this circ (isolation_values_set
3410 * == 1), and all streams associated with the circuit have had the same
3411 * value for some field ((isolation_flags_mixed & ISO_FOO) == 0), then these
3412 * elements hold the value for that field.
3414 * Note again that "associated" is not the same as "attached": we
3415 * preliminarily associate streams with a circuit while the circuit is being
3416 * launched, so that we can tell whether we need to launch more circuits.
3420 uint8_t client_proto_type
;
3421 uint8_t client_proto_socksver
;
3423 tor_addr_t client_addr
;
3427 size_t socks_username_len
;
3428 uint8_t socks_password_len
;
3429 /* Note that the next two values are NOT NUL-terminated; see
3430 socks_username_len and socks_password_len for their lengths. */
3431 char *socks_username
;
3432 char *socks_password
;
3433 /** Global identifier for the first stream attached here; used by
3435 uint64_t associated_isolated_stream_global_id
;
3437 /** A list of addr_policy_t for this circuit in particular. Used by
3438 * adjust_exit_policy_from_exitpolicy_failure.
3440 smartlist_t
*prepend_policy
;
3442 /** How long do we wait before closing this circuit if it remains
3443 * completely idle after it was built, in seconds? This value
3444 * is randomized on a per-circuit basis from CircuitsAvailableTimoeut
3445 * to 2*CircuitsAvailableTimoeut. */
3446 int circuit_idle_timeout
;
3450 struct onion_queue_t
;
3452 /** An or_circuit_t holds information needed to implement a circuit at an
3454 typedef struct or_circuit_t
{
3457 /** Next circuit in the doubly-linked ring of circuits waiting to add
3458 * cells to p_chan. NULL if we have no cells pending, or if we're not
3459 * linked to an OR connection. */
3460 struct circuit_t
*next_active_on_p_chan
;
3461 /** Previous circuit in the doubly-linked ring of circuits waiting to add
3462 * cells to p_chan. NULL if we have no cells pending, or if we're not
3463 * linked to an OR connection. */
3464 struct circuit_t
*prev_active_on_p_chan
;
3465 /** Pointer to an entry on the onion queue, if this circuit is waiting for a
3466 * chance to give an onionskin to a cpuworker. Used only in onion.c */
3467 struct onion_queue_t
*onionqueue_entry
;
3468 /** Pointer to a workqueue entry, if this circuit has given an onionskin to
3469 * a cpuworker and is waiting for a response. Used to decide whether it is
3470 * safe to free a circuit or if it is still in use by a cpuworker. */
3471 struct workqueue_entry_s
*workqueue_entry
;
3473 /** The circuit_id used in the previous (backward) hop of this circuit. */
3475 /** Queue of cells waiting to be transmitted on p_conn. */
3476 cell_queue_t p_chan_cells
;
3477 /** The channel that is previous in this circuit. */
3480 * Circuit mux associated with p_chan to which this circuit is attached;
3481 * NULL if we have no p_chan.
3483 circuitmux_t
*p_mux
;
3484 /** Linked list of Exit streams associated with this circuit. */
3485 edge_connection_t
*n_streams
;
3486 /** Linked list of Exit streams associated with this circuit that are
3487 * still being resolved. */
3488 edge_connection_t
*resolving_streams
;
3489 /** The cipher used by intermediate hops for cells heading toward the
3491 crypto_cipher_t
*p_crypto
;
3492 /** The cipher used by intermediate hops for cells heading away from
3494 crypto_cipher_t
*n_crypto
;
3496 /** The integrity-checking digest used by intermediate hops, for
3497 * cells packaged here and heading towards the OP.
3499 crypto_digest_t
*p_digest
;
3500 /** The integrity-checking digest used by intermediate hops, for
3501 * cells packaged at the OP and arriving here.
3503 crypto_digest_t
*n_digest
;
3505 /** Points to spliced circuit if purpose is REND_ESTABLISHED, and circuit
3506 * is not marked for close. */
3507 struct or_circuit_t
*rend_splice
;
3509 /** Stores KH for the handshake. */
3510 char rend_circ_nonce
[DIGEST_LEN
];/* KH in tor-spec.txt */
3512 /** How many more relay_early cells can we send on this circuit, according
3513 * to the specification? */
3514 unsigned int remaining_relay_early_cells
: 4;
3516 /* We have already received an INTRODUCE1 cell on this circuit. */
3517 unsigned int already_received_introduce1
: 1;
3519 /** If set, this circuit carries HS traffic. Consider it in any HS
3521 unsigned int circuit_carries_hs_traffic_stats
: 1;
3523 /** Number of cells that were removed from circuit queue; reset every
3524 * time when writing buffer stats to disk. */
3525 uint32_t processed_cells
;
3527 /** Total time in milliseconds that cells spent in both app-ward and
3528 * exit-ward queues of this circuit; reset every time when writing
3529 * buffer stats to disk. */
3530 uint64_t total_cell_waiting_time
;
3532 /** Maximum cell queue size for a middle relay; this is stored per circuit
3533 * so append_cell_to_circuit_queue() can adjust it if it changes. If set
3534 * to zero, it is initialized to the default value.
3536 uint32_t max_middle_cells
;
3539 #if REND_COOKIE_LEN != DIGEST_LEN
3540 #error "The REND_TOKEN_LEN macro assumes REND_COOKIE_LEN == DIGEST_LEN"
3542 #define REND_TOKEN_LEN DIGEST_LEN
3544 /** Convert a circuit subtype to a circuit_t. */
3545 #define TO_CIRCUIT(x) (&((x)->base_))
3547 /** Convert a circuit_t* to a pointer to the enclosing or_circuit_t. Assert
3548 * if the cast is impossible. */
3549 static or_circuit_t
*TO_OR_CIRCUIT(circuit_t
*);
3550 static const or_circuit_t
*CONST_TO_OR_CIRCUIT(const circuit_t
*);
3551 /** Convert a circuit_t* to a pointer to the enclosing origin_circuit_t.
3552 * Assert if the cast is impossible. */
3553 static origin_circuit_t
*TO_ORIGIN_CIRCUIT(circuit_t
*);
3554 static const origin_circuit_t
*CONST_TO_ORIGIN_CIRCUIT(const circuit_t
*);
3556 /** Return 1 iff <b>node</b> has Exit flag and no BadExit flag.
3557 * Otherwise, return 0.
3559 static inline int node_is_good_exit(const node_t
*node
)
3561 return node
->is_exit
&& ! node
->is_bad_exit
;
3564 static inline or_circuit_t
*TO_OR_CIRCUIT(circuit_t
*x
)
3566 tor_assert(x
->magic
== OR_CIRCUIT_MAGIC
);
3567 return DOWNCAST(or_circuit_t
, x
);
3569 static inline const or_circuit_t
*CONST_TO_OR_CIRCUIT(const circuit_t
*x
)
3571 tor_assert(x
->magic
== OR_CIRCUIT_MAGIC
);
3572 return DOWNCAST(or_circuit_t
, x
);
3574 static inline origin_circuit_t
*TO_ORIGIN_CIRCUIT(circuit_t
*x
)
3576 tor_assert(x
->magic
== ORIGIN_CIRCUIT_MAGIC
);
3577 return DOWNCAST(origin_circuit_t
, x
);
3579 static inline const origin_circuit_t
*CONST_TO_ORIGIN_CIRCUIT(
3582 tor_assert(x
->magic
== ORIGIN_CIRCUIT_MAGIC
);
3583 return DOWNCAST(origin_circuit_t
, x
);
3586 /* limits for TCP send and recv buffer size used for constrained sockets */
3587 #define MIN_CONSTRAINED_TCP_BUFFER 2048
3588 #define MAX_CONSTRAINED_TCP_BUFFER 262144 /* 256k */
3590 /** @name Isolation flags
3592 Ways to isolate client streams
3596 /** Isolate based on destination port */
3597 #define ISO_DESTPORT (1u<<0)
3598 /** Isolate based on destination address */
3599 #define ISO_DESTADDR (1u<<1)
3600 /** Isolate based on SOCKS authentication */
3601 #define ISO_SOCKSAUTH (1u<<2)
3602 /** Isolate based on client protocol choice */
3603 #define ISO_CLIENTPROTO (1u<<3)
3604 /** Isolate based on client address */
3605 #define ISO_CLIENTADDR (1u<<4)
3606 /** Isolate based on session group (always on). */
3607 #define ISO_SESSIONGRP (1u<<5)
3608 /** Isolate based on newnym epoch (always on). */
3609 #define ISO_NYM_EPOCH (1u<<6)
3610 /** Isolate all streams (Internal only). */
3611 #define ISO_STREAM (1u<<7)
3614 /** Default isolation level for ports. */
3615 #define ISO_DEFAULT (ISO_CLIENTADDR|ISO_SOCKSAUTH|ISO_SESSIONGRP|ISO_NYM_EPOCH)
3617 /** Indicates that we haven't yet set a session group on a port_cfg_t. */
3618 #define SESSION_GROUP_UNSET -1
3619 /** Session group reserved for directory connections */
3620 #define SESSION_GROUP_DIRCONN -2
3621 /** Session group reserved for resolve requests launched by a controller */
3622 #define SESSION_GROUP_CONTROL_RESOLVE -3
3623 /** First automatically allocated session group number */
3624 #define SESSION_GROUP_FIRST_AUTO -4
3626 /** Configuration for a single port that we're listening on. */
3627 typedef struct port_cfg_t
{
3628 tor_addr_t addr
; /**< The actual IP to listen on, if !is_unix_addr. */
3629 int port
; /**< The configured port, or CFG_AUTO_PORT to tell Tor to pick its
3631 uint8_t type
; /**< One of CONN_TYPE_*_LISTENER */
3632 unsigned is_unix_addr
: 1; /**< True iff this is an AF_UNIX address. */
3634 unsigned is_group_writable
: 1;
3635 unsigned is_world_writable
: 1;
3636 unsigned relax_dirmode_check
: 1;
3638 entry_port_cfg_t entry_cfg
;
3640 server_port_cfg_t server_cfg
;
3642 /* Unix sockets only: */
3643 /** Path for an AF_UNIX address */
3644 char unix_addr
[FLEXIBLE_ARRAY_MEMBER
];
3647 typedef struct routerset_t routerset_t
;
3649 /** A magic value for the (Socks|OR|...)Port options below, telling Tor
3650 * to pick its own port. */
3651 #define CFG_AUTO_PORT 0xc4005e
3653 /** Enumeration of outbound address configuration types:
3654 * Exit-only, OR-only, or both */
3655 typedef enum {OUTBOUND_ADDR_EXIT
, OUTBOUND_ADDR_OR
,
3656 OUTBOUND_ADDR_EXIT_AND_OR
,
3657 OUTBOUND_ADDR_MAX
} outbound_addr_t
;
3659 /** Configuration options for a Tor process. */
3663 /** What should the tor process actually do? */
3665 CMD_RUN_TOR
=0, CMD_LIST_FINGERPRINT
, CMD_HASH_PASSWORD
,
3666 CMD_VERIFY_CONFIG
, CMD_RUN_UNITTESTS
, CMD_DUMP_CONFIG
,
3670 char *command_arg
; /**< Argument for command-line option. */
3672 config_line_t
*Logs
; /**< New-style list of configuration lines
3674 int LogTimeGranularity
; /**< Log resolution in milliseconds. */
3676 int LogMessageDomains
; /**< Boolean: Should we log the domain(s) in which
3677 * each log message occurs? */
3678 int TruncateLogFile
; /**< Boolean: Should we truncate the log file
3679 before we start writing? */
3680 char *SyslogIdentityTag
; /**< Identity tag to add for syslog logging. */
3681 char *AndroidIdentityTag
; /**< Identity tag to add for Android logging. */
3683 char *DebugLogFile
; /**< Where to send verbose log messages. */
3684 char *DataDirectory_option
; /**< Where to store long-term data, as
3685 * configured by the user. */
3686 char *DataDirectory
; /**< Where to store long-term data, as modified. */
3687 int DataDirectoryGroupReadable
; /**< Boolean: Is the DataDirectory g+r? */
3689 char *KeyDirectory_option
; /**< Where to store keys, as
3690 * configured by the user. */
3691 char *KeyDirectory
; /**< Where to store keys data, as modified. */
3692 int KeyDirectoryGroupReadable
; /**< Boolean: Is the KeyDirectory g+r? */
3694 char *CacheDirectory_option
; /**< Where to store cached data, as
3695 * configured by the user. */
3696 char *CacheDirectory
; /**< Where to store cached data, as modified. */
3697 int CacheDirectoryGroupReadable
; /**< Boolean: Is the CacheDirectory g+r? */
3699 char *Nickname
; /**< OR only: nickname of this onion router. */
3700 char *Address
; /**< OR only: configured address for this onion router. */
3701 char *PidFile
; /**< Where to store PID of Tor process. */
3703 routerset_t
*ExitNodes
; /**< Structure containing nicknames, digests,
3704 * country codes and IP address patterns of ORs to
3705 * consider as exits. */
3706 routerset_t
*EntryNodes
;/**< Structure containing nicknames, digests,
3707 * country codes and IP address patterns of ORs to
3708 * consider as entry points. */
3709 int StrictNodes
; /**< Boolean: When none of our EntryNodes or ExitNodes
3710 * are up, or we need to access a node in ExcludeNodes,
3711 * do we just fail instead? */
3712 routerset_t
*ExcludeNodes
;/**< Structure containing nicknames, digests,
3713 * country codes and IP address patterns of ORs
3714 * not to use in circuits. But see StrictNodes
3716 routerset_t
*ExcludeExitNodes
;/**< Structure containing nicknames, digests,
3717 * country codes and IP address patterns of
3718 * ORs not to consider as exits. */
3720 /** Union of ExcludeNodes and ExcludeExitNodes */
3721 routerset_t
*ExcludeExitNodesUnion_
;
3723 int DisableAllSwap
; /**< Boolean: Attempt to call mlockall() on our
3724 * process for all current and future memory. */
3726 config_line_t
*ExitPolicy
; /**< Lists of exit policy components. */
3727 int ExitPolicyRejectPrivate
; /**< Should we not exit to reserved private
3728 * addresses, and our own published addresses?
3730 int ExitPolicyRejectLocalInterfaces
; /**< Should we not exit to local
3731 * interface addresses?
3732 * Includes OutboundBindAddresses and
3733 * configured ports. */
3734 int ReducedExitPolicy
; /**<Should we use the Reduced Exit Policy? */
3735 config_line_t
*SocksPolicy
; /**< Lists of socks policy components */
3736 config_line_t
*DirPolicy
; /**< Lists of dir policy components */
3737 /** Local address to bind outbound sockets */
3738 config_line_t
*OutboundBindAddress
;
3739 /** Local address to bind outbound relay sockets */
3740 config_line_t
*OutboundBindAddressOR
;
3741 /** Local address to bind outbound exit sockets */
3742 config_line_t
*OutboundBindAddressExit
;
3743 /** Addresses derived from the various OutboundBindAddress lines.
3744 * [][0] is IPv4, [][1] is IPv6
3746 tor_addr_t OutboundBindAddresses
[OUTBOUND_ADDR_MAX
][2];
3747 /** Directory server only: which versions of
3748 * Tor should we tell users to run? */
3749 config_line_t
*RecommendedVersions
;
3750 config_line_t
*RecommendedClientVersions
;
3751 config_line_t
*RecommendedServerVersions
;
3752 config_line_t
*RecommendedPackages
;
3753 /** Whether dirservers allow router descriptors with private IPs. */
3754 int DirAllowPrivateAddresses
;
3755 /** Whether routers accept EXTEND cells to routers with private IPs. */
3756 int ExtendAllowPrivateAddresses
;
3757 char *User
; /**< Name of user to run Tor as. */
3758 config_line_t
*ORPort_lines
; /**< Ports to listen on for OR connections. */
3759 /** Ports to listen on for extended OR connections. */
3760 config_line_t
*ExtORPort_lines
;
3761 /** Ports to listen on for SOCKS connections. */
3762 config_line_t
*SocksPort_lines
;
3763 /** Ports to listen on for transparent pf/netfilter connections. */
3764 config_line_t
*TransPort_lines
;
3765 char *TransProxyType
; /**< What kind of transparent proxy
3766 * implementation are we using? */
3767 /** Parsed value of TransProxyType. */
3773 } TransProxyType_parsed
;
3774 config_line_t
*NATDPort_lines
; /**< Ports to listen on for transparent natd
3776 /** Ports to listen on for HTTP Tunnel connections. */
3777 config_line_t
*HTTPTunnelPort_lines
;
3778 config_line_t
*ControlPort_lines
; /**< Ports to listen on for control
3780 config_line_t
*ControlSocket
; /**< List of Unix Domain Sockets to listen on
3781 * for control connections. */
3783 int ControlSocketsGroupWritable
; /**< Boolean: Are control sockets g+rw? */
3784 int SocksSocketsGroupWritable
; /**< Boolean: Are SOCKS sockets g+rw? */
3785 /** Ports to listen on for directory connections. */
3786 config_line_t
*DirPort_lines
;
3787 config_line_t
*DNSPort_lines
; /**< Ports to listen on for DNS requests. */
3789 /* MaxMemInQueues value as input by the user. We clean this up to be
3790 * MaxMemInQueues. */
3791 uint64_t MaxMemInQueues_raw
;
3792 uint64_t MaxMemInQueues
;/**< If we have more memory than this allocated
3793 * for queues and buffers, run the OOM handler */
3794 /** Above this value, consider ourselves low on RAM. */
3795 uint64_t MaxMemInQueues_low_threshold
;
3797 /** @name port booleans
3799 * Derived booleans: For server ports and ControlPort, true iff there is a
3800 * non-listener port on an AF_INET or AF_INET6 address of the given type
3801 * configured in one of the _lines options above.
3802 * For client ports, also true if there is a unix socket configured.
3803 * If you are checking for client ports, you may want to use:
3804 * SocksPort_set || TransPort_set || NATDPort_set || DNSPort_set ||
3805 * HTTPTunnelPort_set
3806 * rather than SocksPort_set.
3810 unsigned int ORPort_set
: 1;
3811 unsigned int SocksPort_set
: 1;
3812 unsigned int TransPort_set
: 1;
3813 unsigned int NATDPort_set
: 1;
3814 unsigned int ControlPort_set
: 1;
3815 unsigned int DirPort_set
: 1;
3816 unsigned int DNSPort_set
: 1;
3817 unsigned int ExtORPort_set
: 1;
3818 unsigned int HTTPTunnelPort_set
: 1;
3821 int AssumeReachable
; /**< Whether to publish our descriptor regardless. */
3822 int AuthoritativeDir
; /**< Boolean: is this an authoritative directory? */
3823 int V3AuthoritativeDir
; /**< Boolean: is this an authoritative directory
3824 * for version 3 directories? */
3825 int VersioningAuthoritativeDir
; /**< Boolean: is this an authoritative
3826 * directory that's willing to recommend
3828 int BridgeAuthoritativeDir
; /**< Boolean: is this an authoritative directory
3829 * that aggregates bridge descriptors? */
3831 /** If set on a bridge relay, it will include this value on a new
3832 * "bridge-distribution-request" line in its bridge descriptor. */
3833 char *BridgeDistribution
;
3835 /** If set on a bridge authority, it will answer requests on its dirport
3836 * for bridge statuses -- but only if the requests use this password. */
3837 char *BridgePassword
;
3838 /** If BridgePassword is set, this is a SHA256 digest of the basic http
3839 * authenticator for it. Used so we can do a time-independent comparison. */
3840 char *BridgePassword_AuthDigest_
;
3842 int UseBridges
; /**< Boolean: should we start all circuits with a bridge? */
3843 config_line_t
*Bridges
; /**< List of bootstrap bridge addresses. */
3845 config_line_t
*ClientTransportPlugin
; /**< List of client
3846 transport plugins. */
3848 config_line_t
*ServerTransportPlugin
; /**< List of client
3849 transport plugins. */
3851 /** List of TCP/IP addresses that transports should listen at. */
3852 config_line_t
*ServerTransportListenAddr
;
3854 /** List of options that must be passed to pluggable transports. */
3855 config_line_t
*ServerTransportOptions
;
3857 int BridgeRelay
; /**< Boolean: are we acting as a bridge relay? We make
3858 * this explicit so we can change how we behave in the
3861 /** Boolean: if we know the bridge's digest, should we get new
3862 * descriptors from the bridge authorities or from the bridge itself? */
3863 int UpdateBridgesFromAuthority
;
3865 int AvoidDiskWrites
; /**< Boolean: should we never cache things to disk?
3867 int ClientOnly
; /**< Boolean: should we never evolve into a server role? */
3869 int ReducedConnectionPadding
; /**< Boolean: Should we try to keep connections
3870 open shorter and pad them less against
3871 connection-level traffic analysis? */
3872 /** Autobool: if auto, then connection padding will be negotiated by client
3873 * and server. If 0, it will be fully disabled. If 1, the client will still
3874 * pad to the server regardless of server support. */
3875 int ConnectionPadding
;
3877 /** To what authority types do we publish our descriptor? Choices are
3878 * "v1", "v2", "v3", "bridge", or "". */
3879 smartlist_t
*PublishServerDescriptor
;
3880 /** A bitfield of authority types, derived from PublishServerDescriptor. */
3881 dirinfo_type_t PublishServerDescriptor_
;
3882 /** Boolean: do we publish hidden service descriptors to the HS auths? */
3883 int PublishHidServDescriptors
;
3884 int FetchServerDescriptors
; /**< Do we fetch server descriptors as normal? */
3885 int FetchHidServDescriptors
; /**< and hidden service descriptors? */
3887 int MinUptimeHidServDirectoryV2
; /**< As directory authority, accept hidden
3888 * service directories after what time? */
3890 int FetchUselessDescriptors
; /**< Do we fetch non-running descriptors too? */
3891 int AllDirActionsPrivate
; /**< Should every directory action be sent
3892 * through a Tor circuit? */
3894 /** Run in 'tor2web mode'? (I.e. only make client connections to hidden
3895 * services, and use a single hop for all hidden-service-related
3899 /** A routerset that should be used when picking RPs for HS circuits. */
3900 routerset_t
*Tor2webRendezvousPoints
;
3902 /** A routerset that should be used when picking middle nodes for HS
3904 routerset_t
*HSLayer2Nodes
;
3906 /** A routerset that should be used when picking third-hop nodes for HS
3908 routerset_t
*HSLayer3Nodes
;
3910 /** Onion Services in HiddenServiceSingleHopMode make one-hop (direct)
3911 * circuits between the onion service server, and the introduction and
3912 * rendezvous points. (Onion service descriptors are still posted using
3913 * 3-hop paths, to avoid onion service directories blocking the service.)
3914 * This option makes every hidden service instance hosted by
3915 * this tor instance a Single Onion Service.
3916 * HiddenServiceSingleHopMode requires HiddenServiceNonAnonymousMode to be
3918 * Use rend_service_allow_non_anonymous_connection() or
3919 * rend_service_reveal_startup_time() instead of using this option directly.
3921 int HiddenServiceSingleHopMode
;
3922 /* Makes hidden service clients and servers non-anonymous on this tor
3923 * instance. Allows the non-anonymous HiddenServiceSingleHopMode. Enables
3924 * non-anonymous behaviour in the hidden service protocol.
3925 * Use rend_service_non_anonymous_mode_enabled() instead of using this option
3928 int HiddenServiceNonAnonymousMode
;
3930 int ConnLimit
; /**< Demanded minimum number of simultaneous connections. */
3931 int ConnLimit_
; /**< Maximum allowed number of simultaneous connections. */
3932 int ConnLimit_high_thresh
; /**< start trying to lower socket usage if we
3933 * have this many. */
3934 int ConnLimit_low_thresh
; /**< try to get down to here after socket
3936 int RunAsDaemon
; /**< If true, run in the background. (Unix only) */
3937 int FascistFirewall
; /**< Whether to prefer ORs reachable on open ports. */
3938 smartlist_t
*FirewallPorts
; /**< Which ports our firewall allows
3940 config_line_t
*ReachableAddresses
; /**< IP:ports our firewall allows. */
3941 config_line_t
*ReachableORAddresses
; /**< IP:ports for OR conns. */
3942 config_line_t
*ReachableDirAddresses
; /**< IP:ports for Dir conns. */
3944 int ConstrainedSockets
; /**< Shrink xmit and recv socket buffers. */
3945 uint64_t ConstrainedSockSize
; /**< Size of constrained buffers. */
3947 /** Whether we should drop exit streams from Tors that we don't know are
3948 * relays. One of "0" (never refuse), "1" (always refuse), or "-1" (do
3949 * what the consensus says, defaulting to 'refuse' if the consensus says
3951 int RefuseUnknownExits
;
3953 /** Application ports that require all nodes in circ to have sufficient
3955 smartlist_t
*LongLivedPorts
;
3956 /** Application ports that are likely to be unencrypted and
3957 * unauthenticated; we reject requests for them to prevent the
3958 * user from screwing up and leaking plaintext secrets to an
3959 * observer somewhere on the Internet. */
3960 smartlist_t
*RejectPlaintextPorts
;
3961 /** Related to RejectPlaintextPorts above, except this config option
3962 * controls whether we warn (in the log and via a controller status
3963 * event) every time a risky connection is attempted. */
3964 smartlist_t
*WarnPlaintextPorts
;
3965 /** Should we try to reuse the same exit node for a given host */
3966 smartlist_t
*TrackHostExits
;
3967 int TrackHostExitsExpire
; /**< Number of seconds until we expire an
3969 config_line_t
*AddressMap
; /**< List of address map directives. */
3970 int AutomapHostsOnResolve
; /**< If true, when we get a resolve request for a
3971 * hostname ending with one of the suffixes in
3972 * <b>AutomapHostsSuffixes</b>, map it to a
3973 * virtual address. */
3974 /** List of suffixes for <b>AutomapHostsOnResolve</b>. The special value
3975 * "." means "match everything." */
3976 smartlist_t
*AutomapHostsSuffixes
;
3977 int RendPostPeriod
; /**< How often do we post each rendezvous service
3978 * descriptor? Remember to publish them independently. */
3979 int KeepalivePeriod
; /**< How often do we send padding cells to keep
3980 * connections alive? */
3981 int SocksTimeout
; /**< How long do we let a socks connection wait
3982 * unattached before we fail it? */
3983 int LearnCircuitBuildTimeout
; /**< If non-zero, we attempt to learn a value
3984 * for CircuitBuildTimeout based on timeout
3985 * history. Use circuit_build_times_disabled()
3986 * rather than checking this value directly. */
3987 int CircuitBuildTimeout
; /**< Cull non-open circuits that were born at
3988 * least this many seconds ago. Used until
3989 * adaptive algorithm learns a new value. */
3990 int CircuitsAvailableTimeout
; /**< Try to have an open circuit for at
3991 least this long after last activity */
3992 int CircuitStreamTimeout
; /**< If non-zero, detach streams from circuits
3993 * and try a new circuit if the stream has been
3994 * waiting for this many seconds. If zero, use
3995 * our default internal timeout schedule. */
3996 int MaxOnionQueueDelay
; /*< DOCDOC */
3997 int NewCircuitPeriod
; /**< How long do we use a circuit before building
3999 int MaxCircuitDirtiness
; /**< Never use circs that were first used more than
4000 this interval ago. */
4001 uint64_t BandwidthRate
; /**< How much bandwidth, on average, are we willing
4002 * to use in a second? */
4003 uint64_t BandwidthBurst
; /**< How much bandwidth, at maximum, are we willing
4004 * to use in a second? */
4005 uint64_t MaxAdvertisedBandwidth
; /**< How much bandwidth are we willing to
4006 * tell other nodes we have? */
4007 uint64_t RelayBandwidthRate
; /**< How much bandwidth, on average, are we
4008 * willing to use for all relayed conns? */
4009 uint64_t RelayBandwidthBurst
; /**< How much bandwidth, at maximum, will we
4010 * use in a second for all relayed conns? */
4011 uint64_t PerConnBWRate
; /**< Long-term bw on a single TLS conn, if set. */
4012 uint64_t PerConnBWBurst
; /**< Allowed burst on a single TLS conn, if set. */
4013 int NumCPUs
; /**< How many CPUs should we try to use? */
4014 config_line_t
*RendConfigLines
; /**< List of configuration lines
4015 * for rendezvous services. */
4016 config_line_t
*HidServAuth
; /**< List of configuration lines for client-side
4017 * authorizations for hidden services */
4018 char *ContactInfo
; /**< Contact info to be published in the directory. */
4020 int HeartbeatPeriod
; /**< Log heartbeat messages after this many seconds
4022 int MainloopStats
; /**< Log main loop statistics as part of the
4023 * heartbeat messages. */
4025 char *HTTPProxy
; /**< hostname[:port] to use as http proxy, if any. */
4026 tor_addr_t HTTPProxyAddr
; /**< Parsed IPv4 addr for http proxy, if any. */
4027 uint16_t HTTPProxyPort
; /**< Parsed port for http proxy, if any. */
4028 char *HTTPProxyAuthenticator
; /**< username:password string, if any. */
4030 char *HTTPSProxy
; /**< hostname[:port] to use as https proxy, if any. */
4031 tor_addr_t HTTPSProxyAddr
; /**< Parsed addr for https proxy, if any. */
4032 uint16_t HTTPSProxyPort
; /**< Parsed port for https proxy, if any. */
4033 char *HTTPSProxyAuthenticator
; /**< username:password string, if any. */
4035 char *Socks4Proxy
; /**< hostname:port to use as a SOCKS4 proxy, if any. */
4036 tor_addr_t Socks4ProxyAddr
; /**< Derived from Socks4Proxy. */
4037 uint16_t Socks4ProxyPort
; /**< Derived from Socks4Proxy. */
4039 char *Socks5Proxy
; /**< hostname:port to use as a SOCKS5 proxy, if any. */
4040 tor_addr_t Socks5ProxyAddr
; /**< Derived from Sock5Proxy. */
4041 uint16_t Socks5ProxyPort
; /**< Derived from Socks5Proxy. */
4042 char *Socks5ProxyUsername
; /**< Username for SOCKS5 authentication, if any */
4043 char *Socks5ProxyPassword
; /**< Password for SOCKS5 authentication, if any */
4045 /** List of configuration lines for replacement directory authorities.
4046 * If you just want to replace one class of authority at a time,
4047 * use the "Alternate*Authority" options below instead. */
4048 config_line_t
*DirAuthorities
;
4050 /** List of fallback directory servers */
4051 config_line_t
*FallbackDir
;
4052 /** Whether to use the default hard-coded FallbackDirs */
4053 int UseDefaultFallbackDirs
;
4055 /** Weight to apply to all directory authority rates if considering them
4056 * along with fallbackdirs */
4057 double DirAuthorityFallbackRate
;
4059 /** If set, use these main (currently v3) directory authorities and
4060 * not the default ones. */
4061 config_line_t
*AlternateDirAuthority
;
4063 /** If set, use these bridge authorities and not the default one. */
4064 config_line_t
*AlternateBridgeAuthority
;
4066 config_line_t
*MyFamily_lines
; /**< Declared family for this OR. */
4067 config_line_t
*MyFamily
; /**< Declared family for this OR, normalized */
4068 config_line_t
*NodeFamilies
; /**< List of config lines for
4070 smartlist_t
*NodeFamilySets
; /**< List of parsed NodeFamilies values. */
4071 config_line_t
*AuthDirBadExit
; /**< Address policy for descriptors to
4072 * mark as bad exits. */
4073 config_line_t
*AuthDirReject
; /**< Address policy for descriptors to
4075 config_line_t
*AuthDirInvalid
; /**< Address policy for descriptors to
4076 * never mark as valid. */
4077 /** @name AuthDir...CC
4079 * Lists of country codes to mark as BadExit, or Invalid, or to
4084 smartlist_t
*AuthDirBadExitCCs
;
4085 smartlist_t
*AuthDirInvalidCCs
;
4086 smartlist_t
*AuthDirRejectCCs
;
4089 int AuthDirListBadExits
; /**< True iff we should list bad exits,
4090 * and vote for all other exits as good. */
4091 int AuthDirMaxServersPerAddr
; /**< Do not permit more than this
4092 * number of servers per IP address. */
4093 int AuthDirHasIPv6Connectivity
; /**< Boolean: are we on IPv6? */
4094 int AuthDirPinKeys
; /**< Boolean: Do we enforce key-pinning? */
4096 /** If non-zero, always vote the Fast flag for any relay advertising
4097 * this amount of capacity or more. */
4098 uint64_t AuthDirFastGuarantee
;
4100 /** If non-zero, this advertised capacity or more is always sufficient
4101 * to satisfy the bandwidth requirement for the Guard flag. */
4102 uint64_t AuthDirGuardBWGuarantee
;
4104 char *AccountingStart
; /**< How long is the accounting interval, and when
4106 uint64_t AccountingMax
; /**< How many bytes do we allow per accounting
4107 * interval before hibernation? 0 for "never
4109 /** How do we determine when our AccountingMax has been reached?
4110 * "max" for when in or out reaches AccountingMax
4111 * "sum" for when in plus out reaches AccountingMax
4112 * "in" for when in reaches AccountingMax
4113 * "out" for when out reaches AccountingMax */
4114 char *AccountingRule_option
;
4115 enum { ACCT_MAX
, ACCT_SUM
, ACCT_IN
, ACCT_OUT
} AccountingRule
;
4117 /** Base64-encoded hash of accepted passwords for the control system. */
4118 config_line_t
*HashedControlPassword
;
4119 /** As HashedControlPassword, but not saved. */
4120 config_line_t
*HashedControlSessionPassword
;
4122 int CookieAuthentication
; /**< Boolean: do we enable cookie-based auth for
4123 * the control system? */
4124 char *CookieAuthFile
; /**< Filesystem location of a ControlPort
4125 * authentication cookie. */
4126 char *ExtORPortCookieAuthFile
; /**< Filesystem location of Extended
4127 * ORPort authentication cookie. */
4128 int CookieAuthFileGroupReadable
; /**< Boolean: Is the CookieAuthFile g+r? */
4129 int ExtORPortCookieAuthFileGroupReadable
; /**< Boolean: Is the
4130 * ExtORPortCookieAuthFile g+r? */
4131 int LeaveStreamsUnattached
; /**< Boolean: Does Tor attach new streams to
4132 * circuits itself (0), or does it expect a controller
4134 int DisablePredictedCircuits
; /**< Boolean: does Tor preemptively
4135 * make circuits in the background (0),
4138 /** Process specifier for a controller that ‘owns’ this Tor
4139 * instance. Tor will terminate if its owning controller does. */
4140 char *OwningControllerProcess
;
4141 /** FD specifier for a controller that owns this Tor instance. */
4142 int OwningControllerFD
;
4144 int ShutdownWaitLength
; /**< When we get a SIGINT and we're a server, how
4145 * long do we wait before exiting? */
4146 char *SafeLogging
; /**< Contains "relay", "1", "0" (meaning no scrubbing). */
4148 /* Derived from SafeLogging */
4150 SAFELOG_SCRUB_ALL
, SAFELOG_SCRUB_RELAY
, SAFELOG_SCRUB_NONE
4153 int Sandbox
; /**< Boolean: should sandboxing be enabled? */
4154 int SafeSocks
; /**< Boolean: should we outright refuse application
4155 * connections that use socks4 or socks5-with-local-dns? */
4156 int ProtocolWarnings
; /**< Boolean: when other parties screw up the Tor
4157 * protocol, is it a warn or an info in our logs? */
4158 int TestSocks
; /**< Boolean: when we get a socks connection, do we loudly
4159 * log whether it was DNS-leaking or not? */
4160 int HardwareAccel
; /**< Boolean: Should we enable OpenSSL hardware
4161 * acceleration where available? */
4162 /** Token Bucket Refill resolution in milliseconds. */
4163 int TokenBucketRefillInterval
;
4164 char *AccelName
; /**< Optional hardware acceleration engine name. */
4165 char *AccelDir
; /**< Optional hardware acceleration engine search dir. */
4167 /** Boolean: Do we try to enter from a smallish number
4168 * of fixed nodes? */
4169 int UseEntryGuards_option
;
4170 /** Internal variable to remember whether we're actually acting on
4171 * UseEntryGuards_option -- when we're a non-anonymous Tor2web client or
4172 * Single Onion Service, it is alwasy false, otherwise we use the value of
4173 * UseEntryGuards_option. */
4176 int NumEntryGuards
; /**< How many entry guards do we try to establish? */
4178 /** If 1, we use any guardfraction information we see in the
4179 * consensus. If 0, we don't. If -1, let the consensus parameter
4181 int UseGuardFraction
;
4183 int NumDirectoryGuards
; /**< How many dir guards do we try to establish?
4184 * If 0, use value from NumEntryGuards. */
4185 int RephistTrackTime
; /**< How many seconds do we keep rephist info? */
4186 /** Should we always fetch our dir info on the mirror schedule (which
4187 * means directly from the authorities) no matter our other config? */
4188 int FetchDirInfoEarly
;
4190 /** Should we fetch our dir info at the start of the consensus period? */
4191 int FetchDirInfoExtraEarly
;
4193 int DirCache
; /**< Cache all directory documents and accept requests via
4194 * tunnelled dir conns from clients. If 1, enabled (default);
4195 * If 0, disabled. */
4197 char *VirtualAddrNetworkIPv4
; /**< Address and mask to hand out for virtual
4198 * MAPADDRESS requests for IPv4 addresses */
4199 char *VirtualAddrNetworkIPv6
; /**< Address and mask to hand out for virtual
4200 * MAPADDRESS requests for IPv6 addresses */
4201 int ServerDNSSearchDomains
; /**< Boolean: If set, we don't force exit
4202 * addresses to be FQDNs, but rather search for them in
4203 * the local domains. */
4204 int ServerDNSDetectHijacking
; /**< Boolean: If true, check for DNS failure
4206 int ServerDNSRandomizeCase
; /**< Boolean: Use the 0x20-hack to prevent
4207 * DNS poisoning attacks. */
4208 char *ServerDNSResolvConfFile
; /**< If provided, we configure our internal
4209 * resolver from the file here rather than from
4210 * /etc/resolv.conf (Unix) or the registry (Windows). */
4211 char *DirPortFrontPage
; /**< This is a full path to a file with an html
4212 disclaimer. This allows a server administrator to show
4213 that they're running Tor and anyone visiting their server
4214 will know this without any specialized knowledge. */
4215 int DisableDebuggerAttachment
; /**< Currently Linux only specific attempt to
4216 disable ptrace; needs BSD testing. */
4217 /** Boolean: if set, we start even if our resolv.conf file is missing
4219 int ServerDNSAllowBrokenConfig
;
4220 /** Boolean: if set, then even connections to private addresses will get
4222 int CountPrivateBandwidth
;
4223 smartlist_t
*ServerDNSTestAddresses
; /**< A list of addresses that definitely
4224 * should be resolvable. Used for
4225 * testing our DNS server. */
4226 int EnforceDistinctSubnets
; /**< If true, don't allow multiple routers in the
4227 * same network zone in the same circuit. */
4228 int PortForwarding
; /**< If true, use NAT-PMP or UPnP to automatically
4229 * forward the DirPort and ORPort on the NAT device */
4230 char *PortForwardingHelper
; /** < Filename or full path of the port
4231 forwarding helper executable */
4232 int AllowNonRFC953Hostnames
; /**< If true, we allow connections to hostnames
4233 * with weird characters. */
4234 /** If true, we try resolving hostnames with weird characters. */
4235 int ServerDNSAllowNonRFC953Hostnames
;
4237 /** If true, we try to download extra-info documents (and we serve them,
4238 * if we are a cache). For authorities, this is always true. */
4239 int DownloadExtraInfo
;
4241 /** If true, we're configured to collect statistics on clients
4242 * requesting network statuses from us as directory. */
4243 int DirReqStatistics_option
;
4244 /** Internal variable to remember whether we're actually acting on
4245 * DirReqStatistics_option -- yes if it's set and we're a server, else no. */
4246 int DirReqStatistics
;
4248 /** If true, the user wants us to collect statistics on port usage. */
4249 int ExitPortStatistics
;
4251 /** If true, the user wants us to collect connection statistics. */
4252 int ConnDirectionStatistics
;
4254 /** If true, the user wants us to collect cell statistics. */
4257 /** If true, the user wants us to collect padding statistics. */
4258 int PaddingStatistics
;
4260 /** If true, the user wants us to collect statistics as entry node. */
4261 int EntryStatistics
;
4263 /** If true, the user wants us to collect statistics as hidden service
4264 * directory, introduction point, or rendezvous point. */
4265 int HiddenServiceStatistics_option
;
4266 /** Internal variable to remember whether we're actually acting on
4267 * HiddenServiceStatistics_option -- yes if it's set and we're a server,
4269 int HiddenServiceStatistics
;
4271 /** If true, include statistics file contents in extra-info documents. */
4272 int ExtraInfoStatistics
;
4274 /** If true, do not believe anybody who tells us that a domain resolves
4275 * to an internal address, or that an internal address has a PTR mapping.
4276 * Helps avoid some cross-site attacks. */
4277 int ClientDNSRejectInternalAddresses
;
4279 /** If true, do not accept any requests to connect to internal addresses
4280 * over randomly chosen exits. */
4281 int ClientRejectInternalAddresses
;
4283 /** If true, clients may connect over IPv4. If false, they will avoid
4284 * connecting over IPv4. We enforce this for OR and Dir connections. */
4286 /** If true, clients may connect over IPv6. If false, they will avoid
4287 * connecting over IPv4. We enforce this for OR and Dir connections.
4288 * Use fascist_firewall_use_ipv6() instead of accessing this value
4291 /** If true, prefer an IPv6 OR port over an IPv4 one for entry node
4292 * connections. If auto, bridge clients prefer IPv6, and other clients
4293 * prefer IPv4. Use node_ipv6_or_preferred() instead of accessing this value
4295 int ClientPreferIPv6ORPort
;
4296 /** If true, prefer an IPv6 directory port over an IPv4 one for direct
4297 * directory connections. If auto, bridge clients prefer IPv6, and other
4298 * clients prefer IPv4. Use fascist_firewall_prefer_ipv6_dirport() instead of
4299 * accessing this value directly. */
4300 int ClientPreferIPv6DirPort
;
4302 /** The length of time that we think a consensus should be fresh. */
4303 int V3AuthVotingInterval
;
4304 /** The length of time we think it will take to distribute votes. */
4305 int V3AuthVoteDelay
;
4306 /** The length of time we think it will take to distribute signatures. */
4307 int V3AuthDistDelay
;
4308 /** The number of intervals we think a consensus should be valid. */
4309 int V3AuthNIntervalsValid
;
4311 /** Should advertise and sign consensuses with a legacy key, for key
4312 * migration purposes? */
4313 int V3AuthUseLegacyKey
;
4315 /** Location of bandwidth measurement file */
4316 char *V3BandwidthsFile
;
4318 /** Location of guardfraction file */
4319 char *GuardfractionFile
;
4321 /** Authority only: key=value pairs that we add to our networkstatus
4322 * consensus vote on the 'params' line. */
4323 char *ConsensusParams
;
4325 /** Authority only: minimum number of measured bandwidths we must see
4326 * before we only believe measured bandwidths to assign flags. */
4327 int MinMeasuredBWsForAuthToIgnoreAdvertised
;
4329 /** The length of time that we think an initial consensus should be fresh.
4330 * Only altered on testing networks. */
4331 int TestingV3AuthInitialVotingInterval
;
4333 /** The length of time we think it will take to distribute initial votes.
4334 * Only altered on testing networks. */
4335 int TestingV3AuthInitialVoteDelay
;
4337 /** The length of time we think it will take to distribute initial
4338 * signatures. Only altered on testing networks.*/
4339 int TestingV3AuthInitialDistDelay
;
4341 /** Offset in seconds added to the starting time for consensus
4342 voting. Only altered on testing networks. */
4343 int TestingV3AuthVotingStartOffset
;
4345 /** If an authority has been around for less than this amount of time, it
4346 * does not believe its reachability information is accurate. Only
4347 * altered on testing networks. */
4348 int TestingAuthDirTimeToLearnReachability
;
4350 /** Clients don't download any descriptor this recent, since it will
4351 * probably not have propagated to enough caches. Only altered on testing
4353 int TestingEstimatedDescriptorPropagationTime
;
4355 /** Schedule for when servers should download things in general. Only
4356 * altered on testing networks. */
4357 smartlist_t
*TestingServerDownloadSchedule
;
4359 /** Schedule for when clients should download things in general. Only
4360 * altered on testing networks. */
4361 smartlist_t
*TestingClientDownloadSchedule
;
4363 /** Schedule for when servers should download consensuses. Only altered
4364 * on testing networks. */
4365 smartlist_t
*TestingServerConsensusDownloadSchedule
;
4367 /** Schedule for when clients should download consensuses. Only altered
4368 * on testing networks. */
4369 smartlist_t
*TestingClientConsensusDownloadSchedule
;
4371 /** Schedule for when clients should download consensuses from authorities
4372 * if they are bootstrapping (that is, they don't have a usable, reasonably
4373 * live consensus). Only used by clients fetching from a list of fallback
4374 * directory mirrors.
4376 * This schedule is incremented by (potentially concurrent) connection
4377 * attempts, unlike other schedules, which are incremented by connection
4378 * failures. Only altered on testing networks. */
4379 smartlist_t
*ClientBootstrapConsensusAuthorityDownloadSchedule
;
4381 /** Schedule for when clients should download consensuses from fallback
4382 * directory mirrors if they are bootstrapping (that is, they don't have a
4383 * usable, reasonably live consensus). Only used by clients fetching from a
4384 * list of fallback directory mirrors.
4386 * This schedule is incremented by (potentially concurrent) connection
4387 * attempts, unlike other schedules, which are incremented by connection
4388 * failures. Only altered on testing networks. */
4389 smartlist_t
*ClientBootstrapConsensusFallbackDownloadSchedule
;
4391 /** Schedule for when clients should download consensuses from authorities
4392 * if they are bootstrapping (that is, they don't have a usable, reasonably
4393 * live consensus). Only used by clients which don't have or won't fetch
4394 * from a list of fallback directory mirrors.
4396 * This schedule is incremented by (potentially concurrent) connection
4397 * attempts, unlike other schedules, which are incremented by connection
4398 * failures. Only altered on testing networks. */
4399 smartlist_t
*ClientBootstrapConsensusAuthorityOnlyDownloadSchedule
;
4401 /** Schedule for when clients should download bridge descriptors. Only
4402 * altered on testing networks. */
4403 smartlist_t
*TestingBridgeDownloadSchedule
;
4405 /** Schedule for when clients should download bridge descriptors when they
4406 * have no running bridges. Only altered on testing networks. */
4407 smartlist_t
*TestingBridgeBootstrapDownloadSchedule
;
4409 /** When directory clients have only a few descriptors to request, they
4410 * batch them until they have more, or until this amount of time has
4411 * passed. Only altered on testing networks. */
4412 int TestingClientMaxIntervalWithoutRequest
;
4414 /** How long do we let a directory connection stall before expiring
4415 * it? Only altered on testing networks. */
4416 int TestingDirConnectionMaxStall
;
4418 /** How many times will we try to fetch a consensus before we give
4419 * up? Only altered on testing networks. */
4420 int TestingConsensusMaxDownloadTries
;
4422 /** How many times will a client try to fetch a consensus while
4423 * bootstrapping using a list of fallback directories, before it gives up?
4424 * Only altered on testing networks. */
4425 int ClientBootstrapConsensusMaxDownloadTries
;
4427 /** How many times will a client try to fetch a consensus while
4428 * bootstrapping using only a list of authorities, before it gives up?
4429 * Only altered on testing networks. */
4430 int ClientBootstrapConsensusAuthorityOnlyMaxDownloadTries
;
4432 /** How many simultaneous in-progress connections will we make when trying
4433 * to fetch a consensus before we wait for one to complete, timeout, or
4434 * error out? Only altered on testing networks. */
4435 int ClientBootstrapConsensusMaxInProgressTries
;
4437 /** How many times will we try to download a router's descriptor before
4438 * giving up? Only altered on testing networks. */
4439 int TestingDescriptorMaxDownloadTries
;
4441 /** How many times will we try to download a microdescriptor before
4442 * giving up? Only altered on testing networks. */
4443 int TestingMicrodescMaxDownloadTries
;
4445 /** How many times will we try to fetch a certificate before giving
4446 * up? Only altered on testing networks. */
4447 int TestingCertMaxDownloadTries
;
4449 /** If true, we take part in a testing network. Change the defaults of a
4450 * couple of other configuration options and allow to change the values
4451 * of certain configuration options. */
4452 int TestingTorNetwork
;
4454 /** Minimum value for the Exit flag threshold on testing networks. */
4455 uint64_t TestingMinExitFlagThreshold
;
4457 /** Minimum value for the Fast flag threshold on testing networks. */
4458 uint64_t TestingMinFastFlagThreshold
;
4460 /** Relays in a testing network which should be voted Exit
4461 * regardless of exit policy. */
4462 routerset_t
*TestingDirAuthVoteExit
;
4463 int TestingDirAuthVoteExitIsStrict
;
4465 /** Relays in a testing network which should be voted Guard
4466 * regardless of uptime and bandwidth. */
4467 routerset_t
*TestingDirAuthVoteGuard
;
4468 int TestingDirAuthVoteGuardIsStrict
;
4470 /** Relays in a testing network which should be voted HSDir
4471 * regardless of uptime and DirPort. */
4472 routerset_t
*TestingDirAuthVoteHSDir
;
4473 int TestingDirAuthVoteHSDirIsStrict
;
4475 /** Enable CONN_BW events. Only altered on testing networks. */
4476 int TestingEnableConnBwEvent
;
4478 /** Enable CELL_STATS events. Only altered on testing networks. */
4479 int TestingEnableCellStatsEvent
;
4481 /** Enable TB_EMPTY events. Only altered on testing networks. */
4482 int TestingEnableTbEmptyEvent
;
4484 /** If true, and we have GeoIP data, and we're a bridge, keep a per-country
4485 * count of how many client addresses have contacted us so that we can help
4486 * the bridge authority guess which countries have blocked access to us. */
4487 int BridgeRecordUsageByCountry
;
4489 /** Optionally, IPv4 and IPv6 GeoIP data. */
4493 /** Autobool: if auto, then any attempt to Exclude{Exit,}Nodes a particular
4494 * country code will exclude all nodes in ?? and A1. If true, all nodes in
4495 * ?? and A1 are excluded. Has no effect if we don't know any GeoIP data. */
4496 int GeoIPExcludeUnknown
;
4498 /** If true, SIGHUP should reload the torrc. Sometimes controllers want
4499 * to make this false. */
4500 int ReloadTorrcOnSIGHUP
;
4502 /* The main parameter for picking circuits within a connection.
4504 * If this value is positive, when picking a cell to relay on a connection,
4505 * we always relay from the circuit whose weighted cell count is lowest.
4506 * Cells are weighted exponentially such that if one cell is sent
4507 * 'CircuitPriorityHalflife' seconds before another, it counts for half as
4510 * If this value is zero, we're disabling the cell-EWMA algorithm.
4512 * If this value is negative, we're using the default approach
4513 * according to either Tor or a parameter set in the consensus.
4515 double CircuitPriorityHalflife
;
4517 /** Set to true if the TestingTorNetwork configuration option is set.
4518 * This is used so that options_validate() has a chance to realize that
4519 * the defaults have changed. */
4520 int UsingTestNetworkDefaults_
;
4522 /** If 1, we try to use microdescriptors to build circuits. If 0, we don't.
4523 * If -1, Tor decides. */
4524 int UseMicrodescriptors
;
4526 /** File where we should write the ControlPort. */
4527 char *ControlPortWriteToFile
;
4528 /** Should that file be group-readable? */
4529 int ControlPortFileGroupReadable
;
4531 #define MAX_MAX_CLIENT_CIRCUITS_PENDING 1024
4532 /** Maximum number of non-open general-purpose origin circuits to allow at
4534 int MaxClientCircuitsPending
;
4536 /** If 1, we always send optimistic data when it's supported. If 0, we
4537 * never use it. If -1, we do what the consensus says. */
4540 /** If 1, we accept and launch no external network connections, except on
4545 * Parameters for path-bias detection.
4547 * These options override the default behavior of Tor's (**currently
4548 * experimental**) path bias detection algorithm. To try to find broken or
4549 * misbehaving guard nodes, Tor looks for nodes where more than a certain
4550 * fraction of circuits through that guard fail to get built.
4552 * The PathBiasCircThreshold option controls how many circuits we need to
4553 * build through a guard before we make these checks. The
4554 * PathBiasNoticeRate, PathBiasWarnRate and PathBiasExtremeRate options
4555 * control what fraction of circuits must succeed through a guard so we
4556 * won't write log messages. If less than PathBiasExtremeRate circuits
4557 * succeed *and* PathBiasDropGuards is set to 1, we disable use of that
4560 * When we have seen more than PathBiasScaleThreshold circuits through a
4561 * guard, we scale our observations by 0.5 (governed by the consensus) so
4562 * that new observations don't get swamped by old ones.
4564 * By default, or if a negative value is provided for one of these options,
4565 * Tor uses reasonable defaults from the networkstatus consensus document.
4566 * If no defaults are available there, these options default to 150, .70,
4567 * .50, .30, 0, and 300 respectively.
4569 int PathBiasCircThreshold
;
4570 double PathBiasNoticeRate
;
4571 double PathBiasWarnRate
;
4572 double PathBiasExtremeRate
;
4573 int PathBiasDropGuards
;
4574 int PathBiasScaleThreshold
;
4578 * Parameters for path-bias use detection
4580 * Similar to the above options, these options override the default behavior
4581 * of Tor's (**currently experimental**) path use bias detection algorithm.
4583 * Where as the path bias parameters govern thresholds for successfully
4584 * building circuits, these four path use bias parameters govern thresholds
4585 * only for circuit usage. Circuits which receive no stream usage are not
4586 * counted by this detection algorithm. A used circuit is considered
4587 * successful if it is capable of carrying streams or otherwise receiving
4588 * well-formed responses to RELAY cells.
4590 * By default, or if a negative value is provided for one of these options,
4591 * Tor uses reasonable defaults from the networkstatus consensus document.
4592 * If no defaults are available there, these options default to 20, .80,
4593 * .60, and 100, respectively.
4595 int PathBiasUseThreshold
;
4596 double PathBiasNoticeUseRate
;
4597 double PathBiasExtremeUseRate
;
4598 int PathBiasScaleUseThreshold
;
4601 int IPv6Exit
; /**< Do we support exiting to IPv6 addresses? */
4604 double PathsNeededToBuildCircuits
;
4606 /** What expiry time shall we place on our SSL certs? "0" means we
4607 * should guess a suitable value. */
4610 /** How long (seconds) do we keep a guard before picking a new one? */
4613 /** Is this an exit node? This is a tristate, where "1" means "yes, and use
4614 * the default exit policy if none is given" and "0" means "no; exit policy
4615 * is 'reject *'" and "auto" (-1) means "same as 1, but warn the user."
4617 * XXXX Eventually, the default will be 0. */
4620 /** For how long (seconds) do we declare our signing keys to be valid? */
4621 int SigningKeyLifetime
;
4622 /** For how long (seconds) do we declare our link keys to be valid? */
4623 int TestingLinkCertLifetime
;
4624 /** For how long (seconds) do we declare our auth keys to be valid? */
4625 int TestingAuthKeyLifetime
;
4627 /** How long before signing keys expire will we try to make a new one? */
4628 int TestingSigningKeySlop
;
4629 /** How long before link keys expire will we try to make a new one? */
4630 int TestingLinkKeySlop
;
4631 /** How long before auth keys expire will we try to make a new one? */
4632 int TestingAuthKeySlop
;
4634 /** Force use of offline master key features: never generate a master
4635 * ed25519 identity key except from tor --keygen */
4636 int OfflineMasterKey
;
4639 FORCE_PASSPHRASE_AUTO
=0,
4640 FORCE_PASSPHRASE_ON
,
4641 FORCE_PASSPHRASE_OFF
4642 } keygen_force_passphrase
;
4643 int use_keygen_passphrase_fd
;
4644 int keygen_passphrase_fd
;
4645 int change_key_passphrase
;
4646 char *master_key_fname
;
4648 /** Autobool: Do we try to retain capabilities if we can? */
4649 int KeepBindCapabilities
;
4651 /** Maximum total size of unparseable descriptors to log during the
4652 * lifetime of this Tor process.
4654 uint64_t MaxUnparseableDescSizeToLog
;
4656 /** Bool (default: 1): Switch for the shared random protocol. Only
4657 * relevant to a directory authority. If off, the authority won't
4658 * participate in the protocol. If on (default), a flag is added to the
4659 * vote indicating participation. */
4660 int AuthDirSharedRandomness
;
4662 /** If 1, we skip all OOS checks. */
4663 int DisableOOSCheck
;
4665 /** Autobool: Should we include Ed25519 identities in extend2 cells?
4666 * If -1, we should do whatever the consensus parameter says. */
4667 int ExtendByEd25519ID
;
4669 /** Bool (default: 1): When testing routerinfos as a directory authority,
4670 * do we enforce Ed25519 identity match? */
4671 /* NOTE: remove this option someday. */
4672 int AuthDirTestEd25519LinkKeys
;
4674 /** Bool (default: 0): Tells if a %include was used on torrc */
4677 /** The seconds after expiration which we as a relay should keep old
4678 * consensuses around so that we can generate diffs from them. If 0,
4679 * use the default. */
4680 int MaxConsensusAgeForDiffs
;
4682 /** Bool (default: 0). Tells Tor to never try to exec another program.
4686 /** Have the KIST scheduler run every X milliseconds. If less than zero, do
4687 * not use the KIST scheduler but use the old vanilla scheduler instead. If
4688 * zero, do what the consensus says and fall back to using KIST as if this is
4689 * set to "10 msec" if the consensus doesn't say anything. */
4690 int KISTSchedRunInterval
;
4692 /** A multiplier for the KIST per-socket limit calculation. */
4693 double KISTSockBufSizeFactor
;
4695 /** The list of scheduler type string ordered by priority that is first one
4696 * has to be tried first. Default: KIST,KISTLite,Vanilla */
4697 smartlist_t
*Schedulers
;
4698 /* An ordered list of scheduler_types mapped from Schedulers. */
4699 smartlist_t
*SchedulerTypes_
;
4701 /** List of files that were opened by %include in torrc and torrc-defaults */
4702 smartlist_t
*FilesOpenedByIncludes
;
4704 /** If true, Tor shouldn't install any posix signal handlers, since it is
4705 * running embedded inside another process.
4707 int DisableSignalHandlers
;
4709 /** Autobool: Is the circuit creation DoS mitigation subsystem enabled? */
4710 int DoSCircuitCreationEnabled
;
4711 /** Minimum concurrent connection needed from one single address before any
4712 * defense is used. */
4713 int DoSCircuitCreationMinConnections
;
4714 /** Circuit rate used to refill the token bucket. */
4715 int DoSCircuitCreationRate
;
4716 /** Maximum allowed burst of circuits. Reaching that value, the address is
4717 * detected as malicious and a defense might be used. */
4718 int DoSCircuitCreationBurst
;
4719 /** When an address is marked as malicous, what defense should be used
4720 * against it. See the dos_cc_defense_type_t enum. */
4721 int DoSCircuitCreationDefenseType
;
4722 /** For how much time (in seconds) the defense is applicable for a malicious
4723 * address. A random time delta is added to the defense time of an address
4724 * which will be between 1 second and half of this value. */
4725 int DoSCircuitCreationDefenseTimePeriod
;
4727 /** Autobool: Is the DoS connection mitigation subsystem enabled? */
4728 int DoSConnectionEnabled
;
4729 /** Maximum concurrent connection allowed per address. */
4730 int DoSConnectionMaxConcurrentCount
;
4731 /** When an address is reaches the maximum count, what defense should be
4732 * used against it. See the dos_conn_defense_type_t enum. */
4733 int DoSConnectionDefenseType
;
4735 /** Autobool: Do we refuse single hop client rendezvous? */
4736 int DoSRefuseSingleHopClientRendezvous
;
4739 #define LOG_PROTOCOL_WARN (get_protocol_warning_severity_level())
4741 /** Persistent state for an onion router, as saved to disk. */
4744 /** The time at which we next plan to write the state to the disk. Equal to
4745 * TIME_MAX if there are no savable changes, 0 if there are changes that
4746 * should be saved right away. */
4749 /** When was the state last written to disk? */
4752 /** Fields for accounting bandwidth use. */
4753 time_t AccountingIntervalStart
;
4754 uint64_t AccountingBytesReadInInterval
;
4755 uint64_t AccountingBytesWrittenInInterval
;
4756 int AccountingSecondsActive
;
4757 int AccountingSecondsToReachSoftLimit
;
4758 time_t AccountingSoftLimitHitAt
;
4759 uint64_t AccountingBytesAtSoftLimit
;
4760 uint64_t AccountingExpectedUsage
;
4762 /** A list of Entry Guard-related configuration lines. (pre-prop271) */
4763 config_line_t
*EntryGuards
;
4765 /** A list of guard-related configuration lines. (post-prop271) */
4766 config_line_t
*Guard
;
4768 config_line_t
*TransportProxies
;
4770 /** Cached revision counters for active hidden services on this host */
4771 config_line_t
*HidServRevCounter
;
4773 /** These fields hold information on the history of bandwidth usage for
4774 * servers. The "Ends" fields hold the time when we last updated the
4775 * bandwidth usage. The "Interval" fields hold the granularity, in seconds,
4776 * of the entries of Values. The "Values" lists hold decimal string
4777 * representations of the number of bytes read or written in each
4778 * interval. The "Maxima" list holds decimal strings describing the highest
4779 * rate achieved during the interval.
4781 time_t BWHistoryReadEnds
;
4782 int BWHistoryReadInterval
;
4783 smartlist_t
*BWHistoryReadValues
;
4784 smartlist_t
*BWHistoryReadMaxima
;
4785 time_t BWHistoryWriteEnds
;
4786 int BWHistoryWriteInterval
;
4787 smartlist_t
*BWHistoryWriteValues
;
4788 smartlist_t
*BWHistoryWriteMaxima
;
4789 time_t BWHistoryDirReadEnds
;
4790 int BWHistoryDirReadInterval
;
4791 smartlist_t
*BWHistoryDirReadValues
;
4792 smartlist_t
*BWHistoryDirReadMaxima
;
4793 time_t BWHistoryDirWriteEnds
;
4794 int BWHistoryDirWriteInterval
;
4795 smartlist_t
*BWHistoryDirWriteValues
;
4796 smartlist_t
*BWHistoryDirWriteMaxima
;
4798 /** Build time histogram */
4799 config_line_t
* BuildtimeHistogram
;
4800 int TotalBuildTimes
;
4801 int CircuitBuildAbandonedCount
;
4803 /** What version of Tor wrote this state file? */
4806 /** Holds any unrecognized values we found in the state file, in the order
4807 * in which we found them. */
4808 config_line_t
*ExtraLines
;
4810 /** When did we last rotate our onion key? "0" for 'no idea'. */
4811 time_t LastRotatedOnionKey
;
4814 /** Change the next_write time of <b>state</b> to <b>when</b>, unless the
4815 * state is already scheduled to be written to disk earlier than <b>when</b>.
4817 static inline void or_state_mark_dirty(or_state_t
*state
, time_t when
)
4819 if (state
->next_write
> when
)
4820 state
->next_write
= when
;
4823 #define MAX_SOCKS_REPLY_LEN 1024
4824 #define MAX_SOCKS_ADDR_LEN 256
4825 #define SOCKS_NO_AUTH 0x00
4826 #define SOCKS_USER_PASS 0x02
4828 /** Please open a TCP connection to this addr:port. */
4829 #define SOCKS_COMMAND_CONNECT 0x01
4830 /** Please turn this FQDN into an IP address, privately. */
4831 #define SOCKS_COMMAND_RESOLVE 0xF0
4832 /** Please turn this IP address into an FQDN, privately. */
4833 #define SOCKS_COMMAND_RESOLVE_PTR 0xF1
4835 /* || 0 is for -Wparentheses-equality (-Wall?) appeasement under clang */
4836 #define SOCKS_COMMAND_IS_CONNECT(c) (((c)==SOCKS_COMMAND_CONNECT) || 0)
4837 #define SOCKS_COMMAND_IS_RESOLVE(c) ((c)==SOCKS_COMMAND_RESOLVE || \
4838 (c)==SOCKS_COMMAND_RESOLVE_PTR)
4840 /** State of a SOCKS request from a user to an OP. Also used to encode other
4841 * information for non-socks user request (such as those on TransPort and
4843 struct socks_request_t
{
4844 /** Which version of SOCKS did the client use? One of "0, 4, 5" -- where
4845 * 0 means that no socks handshake ever took place, and this is just a
4846 * stub connection (e.g. see connection_ap_make_link()). */
4847 uint8_t socks_version
;
4848 /** If using socks5 authentication, which authentication type did we
4849 * negotiate? currently we support 0 (no authentication) and 2
4850 * (username/password). */
4852 /** What is this stream's goal? One of the SOCKS_COMMAND_* values */
4854 /** Which kind of listener created this stream? */
4855 uint8_t listener_type
;
4856 size_t replylen
; /**< Length of <b>reply</b>. */
4857 uint8_t reply
[MAX_SOCKS_REPLY_LEN
]; /**< Write an entry into this string if
4858 * we want to specify our own socks reply,
4859 * rather than using the default socks4 or
4860 * socks5 socks reply. We use this for the
4861 * two-stage socks5 handshake.
4863 char address
[MAX_SOCKS_ADDR_LEN
]; /**< What address did the client ask to
4864 connect to/resolve? */
4865 uint16_t port
; /**< What port did the client ask to connect to? */
4866 unsigned int has_finished
: 1; /**< Has the SOCKS handshake finished? Used to
4867 * make sure we send back a socks reply for
4868 * every connection. */
4869 unsigned int got_auth
: 1; /**< Have we received any authentication data? */
4870 /** If this is set, we will choose "no authentication" instead of
4871 * "username/password" authentication if both are offered. Used as input to
4873 unsigned int socks_prefer_no_auth
: 1;
4875 /** Number of bytes in username; 0 if username is NULL */
4877 /** Number of bytes in password; 0 if password is NULL */
4878 uint8_t passwordlen
;
4879 /** The negotiated username value if any (for socks5), or the entire
4880 * authentication string (for socks4). This value is NOT nul-terminated;
4881 * see usernamelen for its length. */
4883 /** The negotiated password value if any (for socks5). This value is NOT
4884 * nul-terminated; see passwordlen for its length. */
4888 /********************************* circuitbuild.c **********************/
4890 /** How many hops does a general-purpose circuit have by default? */
4891 #define DEFAULT_ROUTE_LEN 3
4893 /* Circuit Build Timeout "public" structures. */
4895 /** Precision multiplier for the Bw weights */
4896 #define BW_WEIGHT_SCALE 10000
4897 #define BW_MIN_WEIGHT_SCALE 1
4898 #define BW_MAX_WEIGHT_SCALE INT32_MAX
4900 /** Total size of the circuit timeout history to accumulate.
4901 * 1000 is approx 2.5 days worth of continual-use circuits. */
4902 #define CBT_NCIRCUITS_TO_OBSERVE 1000
4904 /** Width of the histogram bins in milliseconds */
4905 #define CBT_BIN_WIDTH ((build_time_t)50)
4907 /** Number of modes to use in the weighted-avg computation of Xm */
4908 #define CBT_DEFAULT_NUM_XM_MODES 3
4909 #define CBT_MIN_NUM_XM_MODES 1
4910 #define CBT_MAX_NUM_XM_MODES 20
4912 /** A build_time_t is milliseconds */
4913 typedef uint32_t build_time_t
;
4916 * CBT_BUILD_ABANDONED is our flag value to represent a force-closed
4917 * circuit (Aka a 'right-censored' pareto value).
4919 #define CBT_BUILD_ABANDONED ((build_time_t)(INT32_MAX-1))
4920 #define CBT_BUILD_TIME_MAX ((build_time_t)(INT32_MAX))
4922 /** Save state every 10 circuits */
4923 #define CBT_SAVE_STATE_EVERY 10
4925 /* Circuit build times consensus parameters */
4928 * How long to wait before actually closing circuits that take too long to
4929 * build in terms of CDF quantile.
4931 #define CBT_DEFAULT_CLOSE_QUANTILE 95
4932 #define CBT_MIN_CLOSE_QUANTILE CBT_MIN_QUANTILE_CUTOFF
4933 #define CBT_MAX_CLOSE_QUANTILE CBT_MAX_QUANTILE_CUTOFF
4936 * How many circuits count as recent when considering if the
4937 * connection has gone gimpy or changed.
4939 #define CBT_DEFAULT_RECENT_CIRCUITS 20
4940 #define CBT_MIN_RECENT_CIRCUITS 3
4941 #define CBT_MAX_RECENT_CIRCUITS 1000
4944 * Maximum count of timeouts that finish the first hop in the past
4945 * RECENT_CIRCUITS before calculating a new timeout.
4947 * This tells us whether to abandon timeout history and set
4948 * the timeout back to whatever circuit_build_times_get_initial_timeout()
4951 #define CBT_DEFAULT_MAX_RECENT_TIMEOUT_COUNT (CBT_DEFAULT_RECENT_CIRCUITS*9/10)
4952 #define CBT_MIN_MAX_RECENT_TIMEOUT_COUNT 3
4953 #define CBT_MAX_MAX_RECENT_TIMEOUT_COUNT 10000
4955 /** Minimum circuits before estimating a timeout */
4956 #define CBT_DEFAULT_MIN_CIRCUITS_TO_OBSERVE 100
4957 #define CBT_MIN_MIN_CIRCUITS_TO_OBSERVE 1
4958 #define CBT_MAX_MIN_CIRCUITS_TO_OBSERVE 10000
4960 /** Cutoff percentile on the CDF for our timeout estimation. */
4961 #define CBT_DEFAULT_QUANTILE_CUTOFF 80
4962 #define CBT_MIN_QUANTILE_CUTOFF 10
4963 #define CBT_MAX_QUANTILE_CUTOFF 99
4964 double circuit_build_times_quantile_cutoff(void);
4966 /** How often in seconds should we build a test circuit */
4967 #define CBT_DEFAULT_TEST_FREQUENCY 10
4968 #define CBT_MIN_TEST_FREQUENCY 1
4969 #define CBT_MAX_TEST_FREQUENCY INT32_MAX
4971 /** Lowest allowable value for CircuitBuildTimeout in milliseconds */
4972 #define CBT_DEFAULT_TIMEOUT_MIN_VALUE (1500)
4973 #define CBT_MIN_TIMEOUT_MIN_VALUE 500
4974 #define CBT_MAX_TIMEOUT_MIN_VALUE INT32_MAX
4976 /** Initial circuit build timeout in milliseconds */
4977 #define CBT_DEFAULT_TIMEOUT_INITIAL_VALUE (60*1000)
4978 #define CBT_MIN_TIMEOUT_INITIAL_VALUE CBT_MIN_TIMEOUT_MIN_VALUE
4979 #define CBT_MAX_TIMEOUT_INITIAL_VALUE INT32_MAX
4980 int32_t circuit_build_times_initial_timeout(void);
4982 #if CBT_DEFAULT_MAX_RECENT_TIMEOUT_COUNT < CBT_MIN_MAX_RECENT_TIMEOUT_COUNT
4983 #error "RECENT_CIRCUITS is set too low."
4986 /** Information about the state of our local network connection */
4988 /** The timestamp we last completed a TLS handshake or received a cell */
4989 time_t network_last_live
;
4990 /** If the network is not live, how many timeouts has this caused? */
4991 int nonlive_timeouts
;
4992 /** Circular array of circuits that have made it to the first hop. Slot is
4993 * 1 if circuit timed out, 0 if circuit succeeded */
4994 int8_t *timeouts_after_firsthop
;
4995 /** Number of elements allocated for the above array */
4996 int num_recent_circs
;
4997 /** Index into circular array. */
4998 int after_firsthop_idx
;
4999 } network_liveness_t
;
5001 typedef struct circuit_build_times_s circuit_build_times_t
;
5003 /********************************* config.c ***************************/
5005 /** An error from options_trial_assign() or options_init_from_string(). */
5006 typedef enum setopt_err_t
{
5008 SETOPT_ERR_MISC
= -1,
5009 SETOPT_ERR_PARSE
= -2,
5010 SETOPT_ERR_TRANSITION
= -3,
5011 SETOPT_ERR_SETTING
= -4,
5014 /********************************* connection_edge.c *************************/
5016 /** Enumerates possible origins of a client-side address mapping. */
5018 /** We're remapping this address because the controller told us to. */
5019 ADDRMAPSRC_CONTROLLER
,
5020 /** We're remapping this address because of an AutomapHostsOnResolve
5023 /** We're remapping this address because our configuration (via torrc, the
5024 * command line, or a SETCONF command) told us to. */
5026 /** We're remapping this address because we have TrackHostExit configured,
5027 * and we want to remember to use the same exit next time. */
5028 ADDRMAPSRC_TRACKEXIT
,
5029 /** We're remapping this address because we got a DNS resolution from a
5030 * Tor server that told us what its value was. */
5033 /** No remapping has occurred. This isn't a possible value for an
5034 * addrmap_entry_t; it's used as a null value when we need to answer "Why
5035 * did this remapping happen." */
5037 } addressmap_entry_source_t
;
5038 #define addressmap_entry_source_bitfield_t ENUM_BF(addressmap_entry_source_t)
5040 /********************************* control.c ***************************/
5042 /** Used to indicate the type of a circuit event passed to the controller.
5043 * The various types are defined in control-spec.txt */
5044 typedef enum circuit_status_event_t
{
5045 CIRC_EVENT_LAUNCHED
= 0,
5046 CIRC_EVENT_BUILT
= 1,
5047 CIRC_EVENT_EXTENDED
= 2,
5048 CIRC_EVENT_FAILED
= 3,
5049 CIRC_EVENT_CLOSED
= 4,
5050 } circuit_status_event_t
;
5052 /** Used to indicate the type of a CIRC_MINOR event passed to the controller.
5053 * The various types are defined in control-spec.txt . */
5054 typedef enum circuit_status_minor_event_t
{
5055 CIRC_MINOR_EVENT_PURPOSE_CHANGED
,
5056 CIRC_MINOR_EVENT_CANNIBALIZED
,
5057 } circuit_status_minor_event_t
;
5059 /** Used to indicate the type of a stream event passed to the controller.
5060 * The various types are defined in control-spec.txt */
5061 typedef enum stream_status_event_t
{
5062 STREAM_EVENT_SENT_CONNECT
= 0,
5063 STREAM_EVENT_SENT_RESOLVE
= 1,
5064 STREAM_EVENT_SUCCEEDED
= 2,
5065 STREAM_EVENT_FAILED
= 3,
5066 STREAM_EVENT_CLOSED
= 4,
5067 STREAM_EVENT_NEW
= 5,
5068 STREAM_EVENT_NEW_RESOLVE
= 6,
5069 STREAM_EVENT_FAILED_RETRIABLE
= 7,
5070 STREAM_EVENT_REMAP
= 8
5071 } stream_status_event_t
;
5073 /** Used to indicate the type of an OR connection event passed to the
5074 * controller. The various types are defined in control-spec.txt */
5075 typedef enum or_conn_status_event_t
{
5076 OR_CONN_EVENT_LAUNCHED
= 0,
5077 OR_CONN_EVENT_CONNECTED
= 1,
5078 OR_CONN_EVENT_FAILED
= 2,
5079 OR_CONN_EVENT_CLOSED
= 3,
5080 OR_CONN_EVENT_NEW
= 4,
5081 } or_conn_status_event_t
;
5083 /** Used to indicate the type of a buildtime event */
5084 typedef enum buildtimeout_set_event_t
{
5085 BUILDTIMEOUT_SET_EVENT_COMPUTED
= 0,
5086 BUILDTIMEOUT_SET_EVENT_RESET
= 1,
5087 BUILDTIMEOUT_SET_EVENT_SUSPENDED
= 2,
5088 BUILDTIMEOUT_SET_EVENT_DISCARD
= 3,
5089 BUILDTIMEOUT_SET_EVENT_RESUME
= 4
5090 } buildtimeout_set_event_t
;
5092 /** Execute the statement <b>stmt</b>, which may log events concerning the
5093 * connection <b>conn</b>. To prevent infinite loops, disable log messages
5094 * being sent to controllers if <b>conn</b> is a control connection.
5096 * Stmt must not contain any return or goto statements.
5098 #define CONN_LOG_PROTECT(conn, stmt) \
5100 int _log_conn_is_control; \
5102 _log_conn_is_control = (conn->type == CONN_TYPE_CONTROL); \
5103 if (_log_conn_is_control) \
5104 disable_control_logging(); \
5105 STMT_BEGIN stmt; STMT_END; \
5106 if (_log_conn_is_control) \
5107 enable_control_logging(); \
5110 /** Enum describing various stages of bootstrapping, for use with controller
5111 * bootstrap status events. The values range from 0 to 100. */
5113 BOOTSTRAP_STATUS_UNDEF
=-1,
5114 BOOTSTRAP_STATUS_STARTING
=0,
5115 BOOTSTRAP_STATUS_CONN_DIR
=5,
5116 BOOTSTRAP_STATUS_HANDSHAKE
=-2,
5117 BOOTSTRAP_STATUS_HANDSHAKE_DIR
=10,
5118 BOOTSTRAP_STATUS_ONEHOP_CREATE
=15,
5119 BOOTSTRAP_STATUS_REQUESTING_STATUS
=20,
5120 BOOTSTRAP_STATUS_LOADING_STATUS
=25,
5121 BOOTSTRAP_STATUS_LOADING_KEYS
=40,
5122 BOOTSTRAP_STATUS_REQUESTING_DESCRIPTORS
=45,
5123 BOOTSTRAP_STATUS_LOADING_DESCRIPTORS
=50,
5124 BOOTSTRAP_STATUS_CONN_OR
=80,
5125 BOOTSTRAP_STATUS_HANDSHAKE_OR
=85,
5126 BOOTSTRAP_STATUS_CIRCUIT_CREATE
=90,
5127 BOOTSTRAP_STATUS_DONE
=100
5128 } bootstrap_status_t
;
5130 /********************************* directory.c ***************************/
5132 /** A pair of digests created by dir_split_resource_info_fingerprint_pairs() */
5134 char first
[DIGEST_LEN
];
5135 char second
[DIGEST_LEN
];
5138 /********************************* dirserv.c ***************************/
5140 /** An enum to describe what format we're generating a routerstatus line in.
5143 /** For use in a v2 opinion */
5145 /** For use in a consensus networkstatus document (ns flavor) */
5147 /** For use in a vote networkstatus document */
5149 /** For passing to the controlport in response to a GETINFO request */
5151 /** For use in a consensus networkstatus document (microdesc flavor) */
5152 NS_V3_CONSENSUS_MICRODESC
5153 } routerstatus_format_type_t
;
5155 #ifdef DIRSERV_PRIVATE
5156 typedef struct measured_bw_line_t
{
5157 char node_id
[DIGEST_LEN
];
5158 char node_hex
[MAX_HEX_NICKNAME_LEN
+1];
5160 } measured_bw_line_t
;
5162 #endif /* defined(DIRSERV_PRIVATE) */
5164 /********************************* dirvote.c ************************/
5166 /** Describes the schedule by which votes should be generated. */
5167 typedef struct vote_timing_t
{
5168 /** Length in seconds between one consensus becoming valid and the next
5169 * becoming valid. */
5171 /** For how many intervals is a consensus valid? */
5172 int n_intervals_valid
;
5173 /** Time in seconds allowed to propagate votes */
5175 /** Time in seconds allowed to propagate signatures */
5179 /********************************* geoip.c **************************/
5181 /** Indicates an action that we might be noting geoip statistics on.
5182 * Note that if we're noticing CONNECT, we're a bridge, and if we're noticing
5183 * the others, we're not.
5186 /** We've noticed a connection as a bridge relay or entry guard. */
5187 GEOIP_CLIENT_CONNECT
= 0,
5188 /** We've served a networkstatus consensus as a directory server. */
5189 GEOIP_CLIENT_NETWORKSTATUS
= 1,
5190 } geoip_client_action_t
;
5191 /** Indicates either a positive reply or a reason for rejectng a network
5192 * status request that will be included in geoip statistics. */
5194 /** Request is answered successfully. */
5196 /** V3 network status is not signed by a sufficient number of requested
5198 GEOIP_REJECT_NOT_ENOUGH_SIGS
= 1,
5199 /** Requested network status object is unavailable. */
5200 GEOIP_REJECT_UNAVAILABLE
= 2,
5201 /** Requested network status not found. */
5202 GEOIP_REJECT_NOT_FOUND
= 3,
5203 /** Network status has not been modified since If-Modified-Since time. */
5204 GEOIP_REJECT_NOT_MODIFIED
= 4,
5205 /** Directory is busy. */
5206 GEOIP_REJECT_BUSY
= 5,
5207 } geoip_ns_response_t
;
5208 #define GEOIP_NS_RESPONSE_NUM 6
5210 /** Directory requests that we are measuring can be either direct or
5214 DIRREQ_TUNNELED
= 1,
5217 /** Possible states for either direct or tunneled directory requests that
5218 * are relevant for determining network status download times. */
5220 /** Found that the client requests a network status; applies to both
5221 * direct and tunneled requests; initial state of a request that we are
5223 DIRREQ_IS_FOR_NETWORK_STATUS
= 0,
5224 /** Finished writing a network status to the directory connection;
5225 * applies to both direct and tunneled requests; completes a direct
5227 DIRREQ_FLUSHING_DIR_CONN_FINISHED
= 1,
5228 /** END cell sent to circuit that initiated a tunneled request. */
5229 DIRREQ_END_CELL_SENT
= 2,
5230 /** Flushed last cell from queue of the circuit that initiated a
5231 * tunneled request to the outbuf of the OR connection. */
5232 DIRREQ_CIRC_QUEUE_FLUSHED
= 3,
5233 /** Flushed last byte from buffer of the channel belonging to the
5234 * circuit that initiated a tunneled request; completes a tunneled
5236 DIRREQ_CHANNEL_BUFFER_FLUSHED
= 4
5239 #define WRITE_STATS_INTERVAL (24*60*60)
5241 /********************************* microdesc.c *************************/
5243 typedef struct microdesc_cache_t microdesc_cache_t
;
5245 /********************************* networkstatus.c *********************/
5247 /** Possible statuses of a version of Tor, given opinions from the directory
5249 typedef enum version_status_t
{
5250 VS_RECOMMENDED
=0, /**< This version is listed as recommended. */
5251 VS_OLD
=1, /**< This version is older than any recommended version. */
5252 VS_NEW
=2, /**< This version is newer than any recommended version. */
5253 VS_NEW_IN_SERIES
=3, /**< This version is newer than any recommended version
5254 * in its series, but later recommended versions exist.
5256 VS_UNRECOMMENDED
=4, /**< This version is not recommended (general case). */
5257 VS_EMPTY
=5, /**< The version list was empty; no agreed-on versions. */
5258 VS_UNKNOWN
, /**< We have no idea. */
5261 /********************************* policies.c ************************/
5263 /** Outcome of applying an address policy to an address. */
5265 /** The address was accepted */
5266 ADDR_POLICY_ACCEPTED
=0,
5267 /** The address was rejected */
5268 ADDR_POLICY_REJECTED
=-1,
5269 /** Part of the address was unknown, but as far as we can tell, it was
5271 ADDR_POLICY_PROBABLY_ACCEPTED
=1,
5272 /** Part of the address was unknown, but as far as we can tell, it was
5274 ADDR_POLICY_PROBABLY_REJECTED
=2,
5275 } addr_policy_result_t
;
5277 /********************************* rephist.c ***************************/
5279 /** Possible public/private key operations in Tor: used to keep track of where
5280 * we're spending our time. */
5283 VERIFY_DIR
, VERIFY_RTR
,
5284 ENC_ONIONSKIN
, DEC_ONIONSKIN
,
5285 TLS_HANDSHAKE_C
, TLS_HANDSHAKE_S
,
5286 REND_CLIENT
, REND_MID
, REND_SERVER
,
5289 /********************************* rendcommon.c ***************************/
5291 /** Hidden-service side configuration of client authorization. */
5292 typedef struct rend_authorized_client_t
{
5294 uint8_t descriptor_cookie
[REND_DESC_COOKIE_LEN
];
5295 crypto_pk_t
*client_key
;
5296 } rend_authorized_client_t
;
5298 /** ASCII-encoded v2 hidden service descriptor. */
5299 typedef struct rend_encoded_v2_service_descriptor_t
{
5300 char desc_id
[DIGEST_LEN
]; /**< Descriptor ID. */
5301 char *desc_str
; /**< Descriptor string. */
5302 } rend_encoded_v2_service_descriptor_t
;
5304 /** The maximum number of non-circuit-build-timeout failures a hidden
5305 * service client will tolerate while trying to build a circuit to an
5306 * introduction point. See also rend_intro_point_t.unreachable_count. */
5307 #define MAX_INTRO_POINT_REACHABILITY_FAILURES 5
5309 /** The minimum and maximum number of distinct INTRODUCE2 cells which a
5310 * hidden service's introduction point will receive before it begins to
5312 #define INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS 16384
5313 /* Double the minimum value so the interval is [min, min * 2]. */
5314 #define INTRO_POINT_MAX_LIFETIME_INTRODUCTIONS \
5315 (INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS * 2)
5317 /** The minimum number of seconds that an introduction point will last
5318 * before expiring due to old age. (If it receives
5319 * INTRO_POINT_LIFETIME_INTRODUCTIONS INTRODUCE2 cells, it may expire
5322 * XXX Should this be configurable? */
5323 #define INTRO_POINT_LIFETIME_MIN_SECONDS (18*60*60)
5324 /** The maximum number of seconds that an introduction point will last
5325 * before expiring due to old age.
5327 * XXX Should this be configurable? */
5328 #define INTRO_POINT_LIFETIME_MAX_SECONDS (24*60*60)
5330 /** The maximum number of circuit creation retry we do to an intro point
5331 * before giving up. We try to reuse intro point that fails during their
5332 * lifetime so this is a hard limit on the amount of time we do that. */
5333 #define MAX_INTRO_POINT_CIRCUIT_RETRIES 3
5335 /** Introduction point information. Used both in rend_service_t (on
5336 * the service side) and in rend_service_descriptor_t (on both the
5337 * client and service side). */
5338 typedef struct rend_intro_point_t
{
5339 extend_info_t
*extend_info
; /**< Extend info for connecting to this
5340 * introduction point via a multi-hop path. */
5341 crypto_pk_t
*intro_key
; /**< Introduction key that replaces the service
5342 * key, if this descriptor is V2. */
5344 /** (Client side only) Flag indicating that a timeout has occurred
5345 * after sending an INTRODUCE cell to this intro point. After a
5346 * timeout, an intro point should not be tried again during the same
5347 * hidden service connection attempt, but it may be tried again
5348 * during a future connection attempt. */
5349 unsigned int timed_out
: 1;
5351 /** (Client side only) The number of times we have failed to build a
5352 * circuit to this intro point for some reason other than our
5353 * circuit-build timeout. See also MAX_INTRO_POINT_REACHABILITY_FAILURES. */
5354 unsigned int unreachable_count
: 3;
5356 /** (Service side only) Flag indicating that this intro point was
5357 * included in the last HS descriptor we generated. */
5358 unsigned int listed_in_last_desc
: 1;
5360 /** (Service side only) A replay cache recording the RSA-encrypted parts
5361 * of INTRODUCE2 cells this intro point's circuit has received. This is
5362 * used to prevent replay attacks. */
5363 replaycache_t
*accepted_intro_rsa_parts
;
5365 /** (Service side only) Count of INTRODUCE2 cells accepted from this
5368 int accepted_introduce2_count
;
5370 /** (Service side only) Number of maximum INTRODUCE2 cells that this IP
5371 * will accept. This is a random value between
5372 * INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS and
5373 * INTRO_POINT_MAX_LIFETIME_INTRODUCTIONS. */
5374 int max_introductions
;
5376 /** (Service side only) The time at which this intro point was first
5377 * published, or -1 if this intro point has not yet been
5379 time_t time_published
;
5381 /** (Service side only) The time at which this intro point should
5382 * (start to) expire, or -1 if we haven't decided when this intro
5383 * point should expire. */
5384 time_t time_to_expire
;
5386 /** (Service side only) The amount of circuit creation we've made to this
5387 * intro point. This is incremented every time we do a circuit relaunch on
5388 * this object which is triggered when the circuit dies but the node is
5389 * still in the consensus. After MAX_INTRO_POINT_CIRCUIT_RETRIES, we give
5391 unsigned int circuit_retries
;
5393 /** (Service side only) Set if this intro point has an established circuit
5394 * and unset if it doesn't. */
5395 unsigned int circuit_established
:1;
5396 } rend_intro_point_t
;
5398 #define REND_PROTOCOL_VERSION_BITMASK_WIDTH 16
5400 /** Information used to connect to a hidden service. Used on both the
5401 * service side and the client side. */
5402 typedef struct rend_service_descriptor_t
{
5403 crypto_pk_t
*pk
; /**< This service's public key. */
5404 int version
; /**< Version of the descriptor format: 0 or 2. */
5405 time_t timestamp
; /**< Time when the descriptor was generated. */
5406 /** Bitmask: which introduce/rendezvous protocols are supported?
5407 * (We allow bits '0', '1', '2' and '3' to be set.) */
5408 unsigned protocols
: REND_PROTOCOL_VERSION_BITMASK_WIDTH
;
5409 /** List of the service's introduction points. Elements are removed if
5410 * introduction attempts fail. */
5411 smartlist_t
*intro_nodes
;
5412 /** Has descriptor been uploaded to all hidden service directories? */
5413 int all_uploads_performed
;
5414 /** List of hidden service directories to which an upload request for
5415 * this descriptor could be sent. Smartlist exists only when at least one
5416 * of the previous upload requests failed (otherwise it's not important
5417 * to know which uploads succeeded and which not). */
5418 smartlist_t
*successful_uploads
;
5419 } rend_service_descriptor_t
;
5421 /********************************* routerlist.c ***************************/
5423 /** Represents information about a single trusted or fallback directory
5425 typedef struct dir_server_t
{
5428 char *address
; /**< Hostname. */
5429 /* XX/teor - why do we duplicate the address and port fields here and in
5430 * fake_status? Surely we could just use fake_status (#17867). */
5431 tor_addr_t ipv6_addr
; /**< IPv6 address if present; AF_UNSPEC if not */
5432 uint32_t addr
; /**< IPv4 address. */
5433 uint16_t dir_port
; /**< Directory port. */
5434 uint16_t or_port
; /**< OR port: Used for tunneling connections. */
5435 uint16_t ipv6_orport
; /**< OR port corresponding to ipv6_addr. */
5436 double weight
; /** Weight used when selecting this node at random */
5437 char digest
[DIGEST_LEN
]; /**< Digest of identity key. */
5438 char v3_identity_digest
[DIGEST_LEN
]; /**< Digest of v3 (authority only,
5439 * high-security) identity key. */
5441 unsigned int is_running
:1; /**< True iff we think this server is running. */
5442 unsigned int is_authority
:1; /**< True iff this is a directory authority
5445 /** True iff this server has accepted the most recent server descriptor
5446 * we tried to upload to it. */
5447 unsigned int has_accepted_serverdesc
:1;
5449 /** What kind of authority is this? (Bitfield.) */
5450 dirinfo_type_t type
;
5452 time_t addr_current_at
; /**< When was the document that we derived the
5453 * address information from published? */
5455 routerstatus_t fake_status
; /**< Used when we need to pass this trusted
5457 * directory_request_set_routerstatus.
5458 * as a routerstatus_t. Not updated by the
5459 * router-status management code!
5463 #define RELAY_REQUIRED_MIN_BANDWIDTH (75*1024)
5464 #define BRIDGE_REQUIRED_MIN_BANDWIDTH (50*1024)
5466 #define ROUTER_MAX_DECLARED_BANDWIDTH INT32_MAX
5468 /* Flags for pick_directory_server() and pick_trusteddirserver(). */
5469 /** Flag to indicate that we should not automatically be willing to use
5470 * ourself to answer a directory request.
5471 * Passed to router_pick_directory_server (et al).*/
5472 #define PDS_ALLOW_SELF (1<<0)
5473 /** Flag to indicate that if no servers seem to be up, we should mark all
5474 * directory servers as up and try again.
5475 * Passed to router_pick_directory_server (et al).*/
5476 #define PDS_RETRY_IF_NO_SERVERS (1<<1)
5477 /** Flag to indicate that we should not exclude directory servers that
5478 * our ReachableAddress settings would exclude. This usually means that
5479 * we're going to connect to the server over Tor, and so we don't need to
5480 * worry about our firewall telling us we can't.
5481 * Passed to router_pick_directory_server (et al).*/
5482 #define PDS_IGNORE_FASCISTFIREWALL (1<<2)
5483 /** Flag to indicate that we should not use any directory authority to which
5484 * we have an existing directory connection for downloading server descriptors
5485 * or extrainfo documents.
5487 * Passed to router_pick_directory_server (et al)
5489 #define PDS_NO_EXISTING_SERVERDESC_FETCH (1<<3)
5490 /** Flag to indicate that we should not use any directory authority to which
5491 * we have an existing directory connection for downloading microdescs.
5493 * Passed to router_pick_directory_server (et al)
5495 #define PDS_NO_EXISTING_MICRODESC_FETCH (1<<4)
5497 /** Possible ways to weight routers when choosing one randomly. See
5498 * routerlist_sl_choose_by_bandwidth() for more information.*/
5499 typedef enum bandwidth_weight_rule_t
{
5500 NO_WEIGHTING
, WEIGHT_FOR_EXIT
, WEIGHT_FOR_MID
, WEIGHT_FOR_GUARD
,
5502 } bandwidth_weight_rule_t
;
5504 /** Flags to be passed to control router_choose_random_node() to indicate what
5505 * kind of nodes to pick according to what algorithm. */
5507 CRN_NEED_UPTIME
= 1<<0,
5508 CRN_NEED_CAPACITY
= 1<<1,
5509 CRN_NEED_GUARD
= 1<<2,
5510 /* XXXX not used, apparently. */
5511 CRN_WEIGHT_AS_EXIT
= 1<<5,
5512 CRN_NEED_DESC
= 1<<6,
5513 /* On clients, only provide nodes that satisfy ClientPreferIPv6OR */
5514 CRN_PREF_ADDR
= 1<<7,
5515 /* On clients, only provide nodes that we can connect to directly, based on
5516 * our firewall rules */
5517 CRN_DIRECT_CONN
= 1<<8,
5518 /* On clients, only provide nodes with HSRend >= 2 protocol version which
5519 * is required for hidden service version >= 3. */
5520 CRN_RENDEZVOUS_V3
= 1<<9,
5521 } router_crn_flags_t
;
5523 /** Return value for router_add_to_routerlist() and dirserv_add_descriptor() */
5524 typedef enum was_router_added_t
{
5525 /* Router was added successfully. */
5526 ROUTER_ADDED_SUCCESSFULLY
= 1,
5527 /* Extrainfo document was rejected because no corresponding router
5528 * descriptor was found OR router descriptor was rejected because
5529 * it was incompatible with its extrainfo document. */
5531 /* Router descriptor was rejected because it is already known. */
5532 ROUTER_IS_ALREADY_KNOWN
= -2,
5533 /* General purpose router was rejected, because it was not listed
5535 ROUTER_NOT_IN_CONSENSUS
= -3,
5536 /* Router was neither in directory consensus nor in any of
5537 * networkstatus documents. Caching it to access later.
5538 * (Applies to fetched descriptors only.) */
5539 ROUTER_NOT_IN_CONSENSUS_OR_NETWORKSTATUS
= -4,
5540 /* Router was rejected by directory authority. */
5541 ROUTER_AUTHDIR_REJECTS
= -5,
5542 /* Bridge descriptor was rejected because such bridge was not one
5543 * of the bridges we have listed in our configuration. */
5544 ROUTER_WAS_NOT_WANTED
= -6,
5545 /* Router descriptor was rejected because it was older than
5546 * OLD_ROUTER_DESC_MAX_AGE. */
5547 ROUTER_WAS_TOO_OLD
= -7, /* note contrast with 'NOT_NEW' */
5549 ROUTER_CERTS_EXPIRED
= -8
5550 } was_router_added_t
;
5552 /********************************* routerparse.c ************************/
5554 #define MAX_STATUS_TAG_LEN 32
5555 /** Structure to hold parsed Tor versions. This is a little messier
5556 * than we would like it to be, because we changed version schemes with 0.1.0.
5558 * See version-spec.txt for the whole business.
5560 typedef struct tor_version_t
{
5564 /** Release status. For version in the post-0.1 format, this is always
5566 enum { VER_PRE
=0, VER_RC
=1, VER_RELEASE
=2, } status
;
5568 char status_tag
[MAX_STATUS_TAG_LEN
];
5572 char git_tag
[DIGEST_LEN
];
5575 #endif /* !defined(TOR_OR_H) */