src/app/main/main.c

   1 /* Copyright (c) 2001 Matej Pfajfar.
   2  * Copyright (c) 2001-2004, Roger Dingledine.
   3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
   4  * Copyright (c) 2007-2018, The Tor Project, Inc. */
   5 /* See LICENSE for licensing information */
   6
   7 /**
   8  * \file main.c
   9  * \brief Invocation module.  Initializes subsystems and runs the main loop.
  10  **/
  11
  12 #include "core/or/or.h"
  13
  14 #include "app/config/config.h"
  15 #include "app/config/statefile.h"
  16 #include "app/main/main.h"
  17 #include "app/main/ntmain.h"
  18 #include "core/mainloop/connection.h"
  19 #include "core/mainloop/cpuworker.h"
  20 #include "core/mainloop/mainloop.h"
  21 #include "core/mainloop/netstatus.h"
  22 #include "core/or/channel.h"
  23 #include "core/or/channelpadding.h"
  24 #include "core/or/channeltls.h"
  25 #include "core/or/circuitlist.h"
  26 #include "core/or/circuitmux_ewma.h"
  27 #include "core/or/command.h"
  28 #include "core/or/connection_edge.h"
  29 #include "core/or/connection_or.h"
  30 #include "core/or/dos.h"
  31 #include "core/or/policies.h"
  32 #include "core/or/protover.h"
  33 #include "core/or/relay.h"
  34 #include "core/or/scheduler.h"
  35 #include "core/or/status.h"
  36 #include "feature/api/tor_api.h"
  37 #include "feature/api/tor_api_internal.h"
  38 #include "feature/client/addressmap.h"
  39 #include "feature/client/bridges.h"
  40 #include "feature/client/entrynodes.h"
  41 #include "feature/client/transports.h"
  42 #include "feature/control/control.h"
  43 #include "feature/dirauth/bwauth.h"
  44 #include "feature/dirauth/keypin.h"
  45 #include "feature/dirauth/process_descs.h"
  46 #include "feature/dircache/consdiffmgr.h"
  47 #include "feature/dircache/dirserv.h"
  48 #include "feature/hibernate/hibernate.h"
  49 #include "feature/hs/hs_cache.h"
  50 #include "feature/nodelist/authcert.h"
  51 #include "feature/nodelist/microdesc.h"
  52 #include "feature/nodelist/networkstatus.h"
  53 #include "feature/nodelist/nodelist.h"
  54 #include "feature/nodelist/routerlist.h"
  55 #include "feature/nodelist/routerparse.h"
  56 #include "feature/relay/dns.h"
  57 #include "feature/relay/ext_orport.h"
  58 #include "feature/relay/onion_queue.h"
  59 #include "feature/relay/routerkeys.h"
  60 #include "feature/relay/routermode.h"
  61 #include "feature/rend/rendcache.h"
  62 #include "feature/rend/rendclient.h"
  63 #include "feature/rend/rendservice.h"
  64 #include "feature/stats/geoip.h"
  65 #include "feature/stats/geoip_stats.h"
  66 #include "feature/stats/predict_ports.h"
  67 #include "feature/stats/rephist.h"
  68 #include "lib/compress/compress.h"
  69 #include "lib/container/buffers.h"
  70 #include "lib/crypt_ops/crypto_rand.h"
  71 #include "lib/crypt_ops/crypto_s2k.h"
  72 #include "lib/err/backtrace.h"
  73 #include "lib/process/waitpid.h"
  74
  75 #include "lib/meminfo/meminfo.h"
  76 #include "lib/osinfo/uname.h"
  77 #include "lib/sandbox/sandbox.h"
  78 #include "lib/fs/lockfile.h"
  79 #include "lib/net/resolve.h"
  80 #include "lib/tls/tortls.h"
  81 #include "lib/evloop/compat_libevent.h"
  82 #include "lib/encoding/confline.h"
  83 #include "lib/evloop/timers.h"
  84 #include "lib/crypt_ops/crypto_init.h"
  85
  86 #include <event2/event.h>
  87
  88 #include "feature/dirauth/dirvote.h"
  89 #include "feature/dirauth/authmode.h"
  90 #include "feature/dirauth/shared_random.h"
  91
  92 #include "core/or/or_connection_st.h"
  93 #include "core/or/port_cfg_st.h"
  94
  95 #ifdef HAVE_UNISTD_H
  96 #include <unistd.h>
  97 #endif
  98
  99 #ifdef HAVE_SYSTEMD
 100 #   if defined(__COVERITY__) && !defined(__INCLUDE_LEVEL__)
 101 /* Systemd's use of gcc's __INCLUDE_LEVEL__ extension macro appears to confuse
 102  * Coverity. Here's a kludge to unconfuse it.
 103  */
 104 #   define __INCLUDE_LEVEL__ 2
 105 #endif /* defined(__COVERITY__) && !defined(__INCLUDE_LEVEL__) */
 106 #include <systemd/sd-daemon.h>
 107 #endif /* defined(HAVE_SYSTEMD) */
 108
 109 void evdns_shutdown(int);
 110
 111 #ifdef HAVE_RUST
 112 // helper function defined in Rust to output a log message indicating if tor is
 113 // running with Rust enabled. See src/rust/tor_util
 114 void rust_log_welcome_string(void);
 115 #endif
 116
 117 /********* PROTOTYPES **********/
 118
 119 static void dumpmemusage(int severity);
 120 static void dumpstats(int severity); /* log stats */
 121 static void process_signal(int sig);
 122
 123 /********* START VARIABLES **********/
 124
 125 /** Decides our behavior when no logs are configured/before any
 126  * logs have been configured.  For 0, we log notice to stdout as normal.
 127  * For 1, we log warnings only.  For 2, we log nothing.
 128  */
 129 int quiet_level = 0;
 130
 131 /********* END VARIABLES ************/
 132
 133 /** Called when we get a SIGHUP: reload configuration files and keys,
 134  * retry all connections, and so on. */
 135 static int
 136 do_hup(void)
 137 {
 138   const or_options_t *options = get_options();
 139
 140   log_notice(LD_GENERAL,"Received reload signal (hup). Reloading config and "
 141              "resetting internal state.");
 142   if (accounting_is_enabled(options))
 143     accounting_record_bandwidth_usage(time(NULL), get_or_state());
 144
 145   router_reset_warnings();
 146   routerlist_reset_warnings();
 147   /* first, reload config variables, in case they've changed */
 148   if (options->ReloadTorrcOnSIGHUP) {
 149     /* no need to provide argc/v, they've been cached in init_from_config */
 150     int init_rv = options_init_from_torrc(0, NULL);
 151     if (init_rv < 0) {
 152       log_err(LD_CONFIG,"Reading config failed--see warnings above. "
 153               "For usage, try -h.");
 154       return -1;
 155     } else if (BUG(init_rv > 0)) {
 156       // LCOV_EXCL_START
 157       /* This should be impossible: the only "return 1" cases in
 158        * options_init_from_torrc are ones caused by command-line arguments;
 159        * but they can't change while Tor is running. */
 160       return -1;
 161       // LCOV_EXCL_STOP
 162     }
 163     options = get_options(); /* they have changed now */
 164     /* Logs are only truncated the first time they are opened, but were
 165        probably intended to be cleaned up on signal. */
 166     if (options->TruncateLogFile)
 167       truncate_logs();
 168   } else {
 169     char *msg = NULL;
 170     log_notice(LD_GENERAL, "Not reloading config file: the controller told "
 171                "us not to.");
 172     /* Make stuff get rescanned, reloaded, etc. */
 173     if (set_options((or_options_t*)options, &msg) < 0) {
 174       if (!msg)
 175         msg = tor_strdup("Unknown error");
 176       log_warn(LD_GENERAL, "Unable to re-set previous options: %s", msg);
 177       tor_free(msg);
 178     }
 179   }
 180   if (authdir_mode(options)) {
 181     /* reload the approved-routers file */
 182     if (dirserv_load_fingerprint_file() < 0) {
 183       /* warnings are logged from dirserv_load_fingerprint_file() directly */
 184       log_info(LD_GENERAL, "Error reloading fingerprints. "
 185                "Continuing with old list.");
 186     }
 187   }
 188
 189   /* Rotate away from the old dirty circuits. This has to be done
 190    * after we've read the new options, but before we start using
 191    * circuits for directory fetches. */
 192   circuit_mark_all_dirty_circs_as_unusable();
 193
 194   /* retry appropriate downloads */
 195   router_reset_status_download_failures();
 196   router_reset_descriptor_download_failures();
 197   if (!net_is_disabled())
 198     update_networkstatus_downloads(time(NULL));
 199
 200   /* We'll retry routerstatus downloads in about 10 seconds; no need to
 201    * force a retry there. */
 202
 203   if (server_mode(options)) {
 204     /* Maybe we've been given a new ed25519 key or certificate?
 205      */
 206     time_t now = approx_time();
 207     int new_signing_key = load_ed_keys(options, now);
 208     if (new_signing_key < 0 ||
 209         generate_ed_link_cert(options, now, new_signing_key > 0)) {
 210       log_warn(LD_OR, "Problem reloading Ed25519 keys; still using old keys.");
 211     }
 212
 213     /* Update cpuworker and dnsworker processes, so they get up-to-date
 214      * configuration options. */
 215     cpuworkers_rotate_keyinfo();
 216     dns_reset();
 217   }
 218   return 0;
 219 }
 220
 221 /** Libevent callback: invoked when we get a signal.
 222  */
 223 static void
 224 signal_callback(evutil_socket_t fd, short events, void *arg)
 225 {
 226   const int *sigptr = arg;
 227   const int sig = *sigptr;
 228   (void)fd;
 229   (void)events;
 230
 231   update_current_time(time(NULL));
 232   process_signal(sig);
 233 }
 234
 235 /** Do the work of acting on a signal received in <b>sig</b> */
 236 static void
 237 process_signal(int sig)
 238 {
 239   switch (sig)
 240     {
 241     case SIGTERM:
 242       log_notice(LD_GENERAL,"Catching signal TERM, exiting cleanly.");
 243       tor_shutdown_event_loop_and_exit(0);
 244       break;
 245     case SIGINT:
 246       if (!server_mode(get_options())) { /* do it now */
 247         log_notice(LD_GENERAL,"Interrupt: exiting cleanly.");
 248         tor_shutdown_event_loop_and_exit(0);
 249         return;
 250       }
 251 #ifdef HAVE_SYSTEMD
 252       sd_notify(0, "STOPPING=1");
 253 #endif
 254       hibernate_begin_shutdown();
 255       break;
 256 #ifdef SIGPIPE
 257     case SIGPIPE:
 258       log_debug(LD_GENERAL,"Caught SIGPIPE. Ignoring.");
 259       break;
 260 #endif
 261     case SIGUSR1:
 262       /* prefer to log it at INFO, but make sure we always see it */
 263       dumpstats(get_min_log_level()<LOG_INFO ? get_min_log_level() : LOG_INFO);
 264       control_event_signal(sig);
 265       break;
 266     case SIGUSR2:
 267       switch_logs_debug();
 268       log_debug(LD_GENERAL,"Caught USR2, going to loglevel debug. "
 269                 "Send HUP to change back.");
 270       control_event_signal(sig);
 271       break;
 272     case SIGHUP:
 273 #ifdef HAVE_SYSTEMD
 274       sd_notify(0, "RELOADING=1");
 275 #endif
 276       if (do_hup() < 0) {
 277         log_warn(LD_CONFIG,"Restart failed (config error?). Exiting.");
 278         tor_shutdown_event_loop_and_exit(1);
 279         return;
 280       }
 281 #ifdef HAVE_SYSTEMD
 282       sd_notify(0, "READY=1");
 283 #endif
 284       control_event_signal(sig);
 285       break;
 286 #ifdef SIGCHLD
 287     case SIGCHLD:
 288       notify_pending_waitpid_callbacks();
 289       break;
 290 #endif
 291     case SIGNEWNYM: {
 292       do_signewnym(time(NULL));
 293       break;
 294     }
 295     case SIGCLEARDNSCACHE:
 296       addressmap_clear_transient();
 297       control_event_signal(sig);
 298       break;
 299     case SIGHEARTBEAT:
 300       log_heartbeat(time(NULL));
 301       control_event_signal(sig);
 302       break;
 303   }
 304 }
 305
 306 /**
 307  * Write current memory usage information to the log.
 308  */
 309 static void
 310 dumpmemusage(int severity)
 311 {
 312   connection_dump_buffer_mem_stats(severity);
 313   tor_log(severity, LD_GENERAL, "In rephist: %"PRIu64" used by %d Tors.",
 314       (rephist_total_alloc), rephist_total_num);
 315   dump_routerlist_mem_usage(severity);
 316   dump_cell_pool_usage(severity);
 317   dump_dns_mem_usage(severity);
 318   tor_log_mallinfo(severity);
 319 }
 320
 321 /** Write all statistics to the log, with log level <b>severity</b>. Called
 322  * in response to a SIGUSR1. */
 323 static void
 324 dumpstats(int severity)
 325 {
 326   time_t now = time(NULL);
 327   time_t elapsed;
 328   size_t rbuf_cap, wbuf_cap, rbuf_len, wbuf_len;
 329
 330   tor_log(severity, LD_GENERAL, "Dumping stats:");
 331
 332   SMARTLIST_FOREACH_BEGIN(get_connection_array(), connection_t *, conn) {
 333     int i = conn_sl_idx;
 334     tor_log(severity, LD_GENERAL,
 335         "Conn %d (socket %d) type %d (%s), state %d (%s), created %d secs ago",
 336         i, (int)conn->s, conn->type, conn_type_to_string(conn->type),
 337         conn->state, conn_state_to_string(conn->type, conn->state),
 338         (int)(now - conn->timestamp_created));
 339     if (!connection_is_listener(conn)) {
 340       tor_log(severity,LD_GENERAL,
 341           "Conn %d is to %s:%d.", i,
 342           safe_str_client(conn->address),
 343           conn->port);
 344       tor_log(severity,LD_GENERAL,
 345           "Conn %d: %d bytes waiting on inbuf (len %d, last read %d secs ago)",
 346           i,
 347           (int)connection_get_inbuf_len(conn),
 348           (int)buf_allocation(conn->inbuf),
 349           (int)(now - conn->timestamp_last_read_allowed));
 350       tor_log(severity,LD_GENERAL,
 351           "Conn %d: %d bytes waiting on outbuf "
 352           "(len %d, last written %d secs ago)",i,
 353           (int)connection_get_outbuf_len(conn),
 354           (int)buf_allocation(conn->outbuf),
 355           (int)(now - conn->timestamp_last_write_allowed));
 356       if (conn->type == CONN_TYPE_OR) {
 357         or_connection_t *or_conn = TO_OR_CONN(conn);
 358         if (or_conn->tls) {
 359           if (tor_tls_get_buffer_sizes(or_conn->tls, &rbuf_cap, &rbuf_len,
 360                                        &wbuf_cap, &wbuf_len) == 0) {
 361             tor_log(severity, LD_GENERAL,
 362                 "Conn %d: %d/%d bytes used on OpenSSL read buffer; "
 363                 "%d/%d bytes used on write buffer.",
 364                 i, (int)rbuf_len, (int)rbuf_cap, (int)wbuf_len, (int)wbuf_cap);
 365           }
 366         }
 367       }
 368     }
 369     circuit_dump_by_conn(conn, severity); /* dump info about all the circuits
 370                                            * using this conn */
 371   } SMARTLIST_FOREACH_END(conn);
 372
 373   channel_dumpstats(severity);
 374   channel_listener_dumpstats(severity);
 375
 376   tor_log(severity, LD_NET,
 377       "Cells processed: %"PRIu64" padding\n"
 378       "                 %"PRIu64" create\n"
 379       "                 %"PRIu64" created\n"
 380       "                 %"PRIu64" relay\n"
 381       "                        (%"PRIu64" relayed)\n"
 382       "                        (%"PRIu64" delivered)\n"
 383       "                 %"PRIu64" destroy",
 384       (stats_n_padding_cells_processed),
 385       (stats_n_create_cells_processed),
 386       (stats_n_created_cells_processed),
 387       (stats_n_relay_cells_processed),
 388       (stats_n_relay_cells_relayed),
 389       (stats_n_relay_cells_delivered),
 390       (stats_n_destroy_cells_processed));
 391   if (stats_n_data_cells_packaged)
 392     tor_log(severity,LD_NET,"Average packaged cell fullness: %2.3f%%",
 393         100*(((double)stats_n_data_bytes_packaged) /
 394              ((double)stats_n_data_cells_packaged*RELAY_PAYLOAD_SIZE)) );
 395   if (stats_n_data_cells_received)
 396     tor_log(severity,LD_NET,"Average delivered cell fullness: %2.3f%%",
 397         100*(((double)stats_n_data_bytes_received) /
 398              ((double)stats_n_data_cells_received*RELAY_PAYLOAD_SIZE)) );
 399
 400   cpuworker_log_onionskin_overhead(severity, ONION_HANDSHAKE_TYPE_TAP, "TAP");
 401   cpuworker_log_onionskin_overhead(severity, ONION_HANDSHAKE_TYPE_NTOR,"ntor");
 402
 403   if (now - time_of_process_start >= 0)
 404     elapsed = now - time_of_process_start;
 405   else
 406     elapsed = 0;
 407
 408   if (elapsed) {
 409     tor_log(severity, LD_NET,
 410         "Average bandwidth: %"PRIu64"/%d = %d bytes/sec reading",
 411         (get_bytes_read()),
 412         (int)elapsed,
 413         (int) (get_bytes_read()/elapsed));
 414     tor_log(severity, LD_NET,
 415         "Average bandwidth: %"PRIu64"/%d = %d bytes/sec writing",
 416         (get_bytes_written()),
 417         (int)elapsed,
 418         (int) (get_bytes_written()/elapsed));
 419   }
 420
 421   tor_log(severity, LD_NET, "--------------- Dumping memory information:");
 422   dumpmemusage(severity);
 423
 424   rep_hist_dump_stats(now,severity);
 425   rend_service_dump_stats(severity);
 426   dump_distinct_digest_count(severity);
 427 }
 428
 429 /** Called by exit() as we shut down the process.
 430  */
 431 static void
 432 exit_function(void)
 433 {
 434   /* NOTE: If we ever daemonize, this gets called immediately.  That's
 435    * okay for now, because we only use this on Windows.  */
 436 #ifdef _WIN32
 437   WSACleanup();
 438 #endif
 439 }
 440
 441 #ifdef _WIN32
 442 #define UNIX_ONLY 0
 443 #else
 444 #define UNIX_ONLY 1
 445 #endif
 446
 447 static struct {
 448   /** A numeric code for this signal. Must match the signal value if
 449    * try_to_register is true. */
 450   int signal_value;
 451   /** True if we should try to register this signal with libevent and catch
 452    * corresponding posix signals. False otherwise. */
 453   int try_to_register;
 454   /** Pointer to hold the event object constructed for this signal. */
 455   struct event *signal_event;
 456 } signal_handlers[] = {
 457 #ifdef SIGINT
 458   { SIGINT, UNIX_ONLY, NULL }, /* do a controlled slow shutdown */
 459 #endif
 460 #ifdef SIGTERM
 461   { SIGTERM, UNIX_ONLY, NULL }, /* to terminate now */
 462 #endif
 463 #ifdef SIGPIPE
 464   { SIGPIPE, UNIX_ONLY, NULL }, /* otherwise SIGPIPE kills us */
 465 #endif
 466 #ifdef SIGUSR1
 467   { SIGUSR1, UNIX_ONLY, NULL }, /* dump stats */
 468 #endif
 469 #ifdef SIGUSR2
 470   { SIGUSR2, UNIX_ONLY, NULL }, /* go to loglevel debug */
 471 #endif
 472 #ifdef SIGHUP
 473   { SIGHUP, UNIX_ONLY, NULL }, /* to reload config, retry conns, etc */
 474 #endif
 475 #ifdef SIGXFSZ
 476   { SIGXFSZ, UNIX_ONLY, NULL }, /* handle file-too-big resource exhaustion */
 477 #endif
 478 #ifdef SIGCHLD
 479   { SIGCHLD, UNIX_ONLY, NULL }, /* handle dns/cpu workers that exit */
 480 #endif
 481   /* These are controller-only */
 482   { SIGNEWNYM, 0, NULL },
 483   { SIGCLEARDNSCACHE, 0, NULL },
 484   { SIGHEARTBEAT, 0, NULL },
 485   { -1, -1, NULL }
 486 };
 487
 488 /** Set up the signal handler events for this process, and register them
 489  * with libevent if appropriate. */
 490 void
 491 handle_signals(void)
 492 {
 493   int i;
 494   const int enabled = !get_options()->DisableSignalHandlers;
 495
 496   for (i = 0; signal_handlers[i].signal_value >= 0; ++i) {
 497     /* Signal handlers are only registered with libevent if they need to catch
 498      * real POSIX signals.  We construct these signal handler events in either
 499      * case, though, so that controllers can activate them with the SIGNAL
 500      * command.
 501      */
 502     if (enabled && signal_handlers[i].try_to_register) {
 503       signal_handlers[i].signal_event =
 504         tor_evsignal_new(tor_libevent_get_base(),
 505                          signal_handlers[i].signal_value,
 506                          signal_callback,
 507                          &signal_handlers[i].signal_value);
 508       if (event_add(signal_handlers[i].signal_event, NULL))
 509         log_warn(LD_BUG, "Error from libevent when adding "
 510                  "event for signal %d",
 511                  signal_handlers[i].signal_value);
 512     } else {
 513       signal_handlers[i].signal_event =
 514         tor_event_new(tor_libevent_get_base(), -1,
 515                       EV_SIGNAL, signal_callback,
 516                       &signal_handlers[i].signal_value);
 517     }
 518   }
 519 }
 520
 521 /* Cause the signal handler for signal_num to be called in the event loop. */
 522 void
 523 activate_signal(int signal_num)
 524 {
 525   int i;
 526   for (i = 0; signal_handlers[i].signal_value >= 0; ++i) {
 527     if (signal_handlers[i].signal_value == signal_num) {
 528       event_active(signal_handlers[i].signal_event, EV_SIGNAL, 1);
 529       return;
 530     }
 531   }
 532 }
 533
 534 /** Main entry point for the Tor command-line client.  Return 0 on "success",
 535  * negative on "failure", and positive on "success and exit".
 536  */
 537 int
 538 tor_init(int argc, char *argv[])
 539 {
 540   char progname[256];
 541   int quiet = 0;
 542
 543   time_of_process_start = time(NULL);
 544   tor_init_connection_lists();
 545   /* Have the log set up with our application name. */
 546   tor_snprintf(progname, sizeof(progname), "Tor %s", get_version());
 547   log_set_application_name(progname);
 548
 549   /* Set up the crypto nice and early */
 550   if (crypto_early_init() < 0) {
 551     log_err(LD_GENERAL, "Unable to initialize the crypto subsystem!");
 552     return -1;
 553   }
 554
 555   /* Initialize the history structures. */
 556   rep_hist_init();
 557   /* Initialize the service cache. */
 558   rend_cache_init();
 559   addressmap_init(); /* Init the client dns cache. Do it always, since it's
 560                       * cheap. */
 561   /* Initialize the HS subsystem. */
 562   hs_init();
 563
 564   {
 565   /* We search for the "quiet" option first, since it decides whether we
 566    * will log anything at all to the command line. */
 567     config_line_t *opts = NULL, *cmdline_opts = NULL;
 568     const config_line_t *cl;
 569     (void) config_parse_commandline(argc, argv, 1, &opts, &cmdline_opts);
 570     for (cl = cmdline_opts; cl; cl = cl->next) {
 571       if (!strcmp(cl->key, "--hush"))
 572         quiet = 1;
 573       if (!strcmp(cl->key, "--quiet") ||
 574           !strcmp(cl->key, "--dump-config"))
 575         quiet = 2;
 576       /* The following options imply --hush */
 577       if (!strcmp(cl->key, "--version") || !strcmp(cl->key, "--digests") ||
 578           !strcmp(cl->key, "--list-torrc-options") ||
 579           !strcmp(cl->key, "--library-versions") ||
 580           !strcmp(cl->key, "--hash-password") ||
 581           !strcmp(cl->key, "-h") || !strcmp(cl->key, "--help")) {
 582         if (quiet < 1)
 583           quiet = 1;
 584       }
 585     }
 586     config_free_lines(opts);
 587     config_free_lines(cmdline_opts);
 588   }
 589
 590  /* give it somewhere to log to initially */
 591   switch (quiet) {
 592     case 2:
 593       /* no initial logging */
 594       break;
 595     case 1:
 596       add_temp_log(LOG_WARN);
 597       break;
 598     default:
 599       add_temp_log(LOG_NOTICE);
 600   }
 601   quiet_level = quiet;
 602
 603   {
 604     const char *version = get_version();
 605
 606     log_notice(LD_GENERAL, "Tor %s running on %s with Libevent %s, "
 607                "%s %s, Zlib %s, Liblzma %s, and Libzstd %s.", version,
 608                get_uname(),
 609                tor_libevent_get_version_str(),
 610                crypto_get_library_name(),
 611                crypto_get_library_version_string(),
 612                tor_compress_supports_method(ZLIB_METHOD) ?
 613                  tor_compress_version_str(ZLIB_METHOD) : "N/A",
 614                tor_compress_supports_method(LZMA_METHOD) ?
 615                  tor_compress_version_str(LZMA_METHOD) : "N/A",
 616                tor_compress_supports_method(ZSTD_METHOD) ?
 617                  tor_compress_version_str(ZSTD_METHOD) : "N/A");
 618
 619     log_notice(LD_GENERAL, "Tor can't help you if you use it wrong! "
 620                "Learn how to be safe at "
 621                "https://www.torproject.org/download/download#warning");
 622
 623     if (strstr(version, "alpha") || strstr(version, "beta"))
 624       log_notice(LD_GENERAL, "This version is not a stable Tor release. "
 625                  "Expect more bugs than usual.");
 626
 627     tor_compress_log_init_warnings();
 628   }
 629
 630 #ifdef HAVE_RUST
 631   rust_log_welcome_string();
 632 #endif /* defined(HAVE_RUST) */
 633
 634   if (network_init()<0) {
 635     log_err(LD_BUG,"Error initializing network; exiting.");
 636     return -1;
 637   }
 638   atexit(exit_function);
 639
 640   int init_rv = options_init_from_torrc(argc,argv);
 641   if (init_rv < 0) {
 642     log_err(LD_CONFIG,"Reading config failed--see warnings above.");
 643     return -1;
 644   } else if (init_rv > 0) {
 645     // We succeeded, and should exit anyway -- probably the user just said
 646     // "--version" or something like that.
 647     return 1;
 648   }
 649
 650   /* The options are now initialised */
 651   const or_options_t *options = get_options();
 652
 653   /* Initialize channelpadding parameters to defaults until we get
 654    * a consensus */
 655   channelpadding_new_consensus_params(NULL);
 656
 657   /* Initialize predicted ports list after loading options */
 658   predicted_ports_init();
 659
 660 #ifndef _WIN32
 661   if (geteuid()==0)
 662     log_warn(LD_GENERAL,"You are running Tor as root. You don't need to, "
 663              "and you probably shouldn't.");
 664 #endif
 665
 666   if (crypto_global_init(options->HardwareAccel,
 667                          options->AccelName,
 668                          options->AccelDir)) {
 669     log_err(LD_BUG, "Unable to initialize OpenSSL. Exiting.");
 670     return -1;
 671   }
 672   stream_choice_seed_weak_rng();
 673   if (tor_init_libevent_rng() < 0) {
 674     log_warn(LD_NET, "Problem initializing libevent RNG.");
 675   }
 676
 677   /* Scan/clean unparseable descriptors; after reading config */
 678   routerparse_init();
 679
 680   return 0;
 681 }
 682
 683 /** A lockfile structure, used to prevent two Tors from messing with the
 684  * data directory at once.  If this variable is non-NULL, we're holding
 685  * the lockfile. */
 686 static tor_lockfile_t *lockfile = NULL;
 687
 688 /** Try to grab the lock file described in <b>options</b>, if we do not
 689  * already have it.  If <b>err_if_locked</b> is true, warn if somebody else is
 690  * holding the lock, and exit if we can't get it after waiting.  Otherwise,
 691  * return -1 if we can't get the lockfile.  Return 0 on success.
 692  */
 693 int
 694 try_locking(const or_options_t *options, int err_if_locked)
 695 {
 696   if (lockfile)
 697     return 0;
 698   else {
 699     char *fname = options_get_datadir_fname(options, "lock");
 700     int already_locked = 0;
 701     tor_lockfile_t *lf = tor_lockfile_lock(fname, 0, &already_locked);
 702     tor_free(fname);
 703     if (!lf) {
 704       if (err_if_locked && already_locked) {
 705         int r;
 706         log_warn(LD_GENERAL, "It looks like another Tor process is running "
 707                  "with the same data directory.  Waiting 5 seconds to see "
 708                  "if it goes away.");
 709 #ifndef _WIN32
 710         sleep(5);
 711 #else
 712         Sleep(5000);
 713 #endif
 714         r = try_locking(options, 0);
 715         if (r<0) {
 716           log_err(LD_GENERAL, "No, it's still there.  Exiting.");
 717           return -1;
 718         }
 719         return r;
 720       }
 721       return -1;
 722     }
 723     lockfile = lf;
 724     return 0;
 725   }
 726 }
 727
 728 /** Return true iff we've successfully acquired the lock file. */
 729 int
 730 have_lockfile(void)
 731 {
 732   return lockfile != NULL;
 733 }
 734
 735 /** If we have successfully acquired the lock file, release it. */
 736 void
 737 release_lockfile(void)
 738 {
 739   if (lockfile) {
 740     tor_lockfile_unlock(lockfile);
 741     lockfile = NULL;
 742   }
 743 }
 744
 745 /** Free all memory that we might have allocated somewhere.
 746  * If <b>postfork</b>, we are a worker process and we want to free
 747  * only the parts of memory that we won't touch. If !<b>postfork</b>,
 748  * Tor is shutting down and we should free everything.
 749  *
 750  * Helps us find the real leaks with sanitizers and the like. Also valgrind
 751  * should then report 0 reachable in its leak report (in an ideal world --
 752  * in practice libevent, SSL, libc etc never quite free everything). */
 753 void
 754 tor_free_all(int postfork)
 755 {
 756   if (!postfork) {
 757     evdns_shutdown(1);
 758   }
 759   geoip_free_all();
 760   geoip_stats_free_all();
 761   dirvote_free_all();
 762   routerlist_free_all();
 763   networkstatus_free_all();
 764   addressmap_free_all();
 765   dirserv_free_fingerprint_list();
 766   dirserv_free_all();
 767   dirserv_clear_measured_bw_cache();
 768   rend_cache_free_all();
 769   rend_service_authorization_free_all();
 770   rep_hist_free_all();
 771   dns_free_all();
 772   clear_pending_onions();
 773   circuit_free_all();
 774   entry_guards_free_all();
 775   pt_free_all();
 776   channel_tls_free_all();
 777   channel_free_all();
 778   connection_free_all();
 779   connection_edge_free_all();
 780   scheduler_free_all();
 781   nodelist_free_all();
 782   microdesc_free_all();
 783   routerparse_free_all();
 784   ext_orport_free_all();
 785   control_free_all();
 786   tor_free_getaddrinfo_cache();
 787   protover_free_all();
 788   bridges_free_all();
 789   consdiffmgr_free_all();
 790   hs_free_all();
 791   dos_free_all();
 792   circuitmux_ewma_free_all();
 793   accounting_free_all();
 794
 795   if (!postfork) {
 796     config_free_all();
 797     or_state_free_all();
 798     router_free_all();
 799     routerkeys_free_all();
 800     policies_free_all();
 801   }
 802   if (!postfork) {
 803     tor_tls_free_all();
 804 #ifndef _WIN32
 805     tor_getpwnam(NULL);
 806 #endif
 807   }
 808   /* stuff in main.c */
 809
 810   tor_mainloop_free_all();
 811
 812   if (!postfork) {
 813     release_lockfile();
 814   }
 815   tor_libevent_free_all();
 816   /* Stuff in util.c and address.c*/
 817   if (!postfork) {
 818     escaped(NULL);
 819     esc_router_info(NULL);
 820     clean_up_backtrace_handler();
 821     logs_free_all(); /* free log strings. do this last so logs keep working. */
 822   }
 823 }
 824
 825 /**
 826  * Remove the specified file, and log a warning if the operation fails for
 827  * any reason other than the file not existing. Ignores NULL filenames.
 828  */
 829 void
 830 tor_remove_file(const char *filename)
 831 {
 832   if (filename && tor_unlink(filename) != 0 && errno != ENOENT) {
 833     log_warn(LD_FS, "Couldn't unlink %s: %s",
 834                filename, strerror(errno));
 835   }
 836 }
 837
 838 /** Do whatever cleanup is necessary before shutting Tor down. */
 839 void
 840 tor_cleanup(void)
 841 {
 842   const or_options_t *options = get_options();
 843   if (options->command == CMD_RUN_TOR) {
 844     time_t now = time(NULL);
 845     /* Remove our pid file. We don't care if there was an error when we
 846      * unlink, nothing we could do about it anyways. */
 847     tor_remove_file(options->PidFile);
 848     /* Remove control port file */
 849     tor_remove_file(options->ControlPortWriteToFile);
 850     /* Remove cookie authentication file */
 851     {
 852       char *cookie_fname = get_controller_cookie_file_name();
 853       tor_remove_file(cookie_fname);
 854       tor_free(cookie_fname);
 855     }
 856     /* Remove Extended ORPort cookie authentication file */
 857     {
 858       char *cookie_fname = get_ext_or_auth_cookie_file_name();
 859       tor_remove_file(cookie_fname);
 860       tor_free(cookie_fname);
 861     }
 862     if (accounting_is_enabled(options))
 863       accounting_record_bandwidth_usage(now, get_or_state());
 864     or_state_mark_dirty(get_or_state(), 0); /* force an immediate save. */
 865     or_state_save(now);
 866     if (authdir_mode(options)) {
 867       sr_save_and_cleanup();
 868     }
 869     if (authdir_mode_tests_reachability(options))
 870       rep_hist_record_mtbf_data(now, 0);
 871     keypin_close_journal();
 872   }
 873
 874   timers_shutdown();
 875
 876   tor_free_all(0); /* We could move tor_free_all back into the ifdef below
 877                       later, if it makes shutdown unacceptably slow.  But for
 878                       now, leave it here: it's helped us catch bugs in the
 879                       past. */
 880   crypto_global_cleanup();
 881 }
 882
 883 /** Read/create keys as needed, and echo our fingerprint to stdout. */
 884 static int
 885 do_list_fingerprint(void)
 886 {
 887   char buf[FINGERPRINT_LEN+1];
 888   crypto_pk_t *k;
 889   const char *nickname = get_options()->Nickname;
 890   sandbox_disable_getaddrinfo_cache();
 891   if (!server_mode(get_options())) {
 892     log_err(LD_GENERAL,
 893             "Clients don't have long-term identity keys. Exiting.");
 894     return -1;
 895   }
 896   tor_assert(nickname);
 897   if (init_keys() < 0) {
 898     log_err(LD_GENERAL,"Error initializing keys; exiting.");
 899     return -1;
 900   }
 901   if (!(k = get_server_identity_key())) {
 902     log_err(LD_GENERAL,"Error: missing identity key.");
 903     return -1;
 904   }
 905   if (crypto_pk_get_fingerprint(k, buf, 1)<0) {
 906     log_err(LD_BUG, "Error computing fingerprint");
 907     return -1;
 908   }
 909   printf("%s %s\n", nickname, buf);
 910   return 0;
 911 }
 912
 913 /** Entry point for password hashing: take the desired password from
 914  * the command line, and print its salted hash to stdout. **/
 915 static void
 916 do_hash_password(void)
 917 {
 918
 919   char output[256];
 920   char key[S2K_RFC2440_SPECIFIER_LEN+DIGEST_LEN];
 921
 922   crypto_rand(key, S2K_RFC2440_SPECIFIER_LEN-1);
 923   key[S2K_RFC2440_SPECIFIER_LEN-1] = (uint8_t)96; /* Hash 64 K of data. */
 924   secret_to_key_rfc2440(key+S2K_RFC2440_SPECIFIER_LEN, DIGEST_LEN,
 925                 get_options()->command_arg, strlen(get_options()->command_arg),
 926                 key);
 927   base16_encode(output, sizeof(output), key, sizeof(key));
 928   printf("16:%s\n",output);
 929 }
 930
 931 /** Entry point for configuration dumping: write the configuration to
 932  * stdout. */
 933 static int
 934 do_dump_config(void)
 935 {
 936   const or_options_t *options = get_options();
 937   const char *arg = options->command_arg;
 938   int how;
 939   char *opts;
 940
 941   if (!strcmp(arg, "short")) {
 942     how = OPTIONS_DUMP_MINIMAL;
 943   } else if (!strcmp(arg, "non-builtin")) {
 944     how = OPTIONS_DUMP_DEFAULTS;
 945   } else if (!strcmp(arg, "full")) {
 946     how = OPTIONS_DUMP_ALL;
 947   } else {
 948     fprintf(stderr, "No valid argument to --dump-config found!\n");
 949     fprintf(stderr, "Please select 'short', 'non-builtin', or 'full'.\n");
 950
 951     return -1;
 952   }
 953
 954   opts = options_dump(options, how);
 955   printf("%s", opts);
 956   tor_free(opts);
 957
 958   return 0;
 959 }
 960
 961 static void
 962 init_addrinfo(void)
 963 {
 964   if (! server_mode(get_options()) ||
 965       (get_options()->Address && strlen(get_options()->Address) > 0)) {
 966     /* We don't need to seed our own hostname, because we won't be calling
 967      * resolve_my_address on it.
 968      */
 969     return;
 970   }
 971   char hname[256];
 972
 973   // host name to sandbox
 974   gethostname(hname, sizeof(hname));
 975   tor_add_addrinfo(hname);
 976 }
 977
 978 static sandbox_cfg_t*
 979 sandbox_init_filter(void)
 980 {
 981   const or_options_t *options = get_options();
 982   sandbox_cfg_t *cfg = sandbox_cfg_new();
 983   int i;
 984
 985   sandbox_cfg_allow_openat_filename(&cfg,
 986       get_cachedir_fname("cached-status"));
 987
 988 #define OPEN(name)                              \
 989   sandbox_cfg_allow_open_filename(&cfg, tor_strdup(name))
 990
 991 #define OPEN_DATADIR(name)                      \
 992   sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname(name))
 993
 994 #define OPEN_DATADIR2(name, name2)                       \
 995   sandbox_cfg_allow_open_filename(&cfg, get_datadir_fname2((name), (name2)))
 996
 997 #define OPEN_DATADIR_SUFFIX(name, suffix) do {  \
 998     OPEN_DATADIR(name);                         \
 999     OPEN_DATADIR(name suffix);                  \
1000   } while (0)
1001
1002 #define OPEN_DATADIR2_SUFFIX(name, name2, suffix) do {  \
1003     OPEN_DATADIR2(name, name2);                         \
1004     OPEN_DATADIR2(name, name2 suffix);                  \
1005   } while (0)
1006
1007 #define OPEN_KEY_DIRECTORY() \
1008   sandbox_cfg_allow_open_filename(&cfg, tor_strdup(options->KeyDirectory))
1009 #define OPEN_CACHEDIR(name)                      \
1010   sandbox_cfg_allow_open_filename(&cfg, get_cachedir_fname(name))
1011 #define OPEN_CACHEDIR_SUFFIX(name, suffix) do {  \
1012     OPEN_CACHEDIR(name);                         \
1013     OPEN_CACHEDIR(name suffix);                  \
1014   } while (0)
1015 #define OPEN_KEYDIR(name)                      \
1016   sandbox_cfg_allow_open_filename(&cfg, get_keydir_fname(name))
1017 #define OPEN_KEYDIR_SUFFIX(name, suffix) do {    \
1018     OPEN_KEYDIR(name);                           \
1019     OPEN_KEYDIR(name suffix);                    \
1020   } while (0)
1021
1022   OPEN(options->DataDirectory);
1023   OPEN_KEY_DIRECTORY();
1024
1025   OPEN_CACHEDIR_SUFFIX("cached-certs", ".tmp");
1026   OPEN_CACHEDIR_SUFFIX("cached-consensus", ".tmp");
1027   OPEN_CACHEDIR_SUFFIX("unverified-consensus", ".tmp");
1028   OPEN_CACHEDIR_SUFFIX("unverified-microdesc-consensus", ".tmp");
1029   OPEN_CACHEDIR_SUFFIX("cached-microdesc-consensus", ".tmp");
1030   OPEN_CACHEDIR_SUFFIX("cached-microdescs", ".tmp");
1031   OPEN_CACHEDIR_SUFFIX("cached-microdescs.new", ".tmp");
1032   OPEN_CACHEDIR_SUFFIX("cached-descriptors", ".tmp");
1033   OPEN_CACHEDIR_SUFFIX("cached-descriptors.new", ".tmp");
1034   OPEN_CACHEDIR("cached-descriptors.tmp.tmp");
1035   OPEN_CACHEDIR_SUFFIX("cached-extrainfo", ".tmp");
1036   OPEN_CACHEDIR_SUFFIX("cached-extrainfo.new", ".tmp");
1037   OPEN_CACHEDIR("cached-extrainfo.tmp.tmp");
1038
1039   OPEN_DATADIR_SUFFIX("state", ".tmp");
1040   OPEN_DATADIR_SUFFIX("sr-state", ".tmp");
1041   OPEN_DATADIR_SUFFIX("unparseable-desc", ".tmp");
1042   OPEN_DATADIR_SUFFIX("v3-status-votes", ".tmp");
1043   OPEN_DATADIR("key-pinning-journal");
1044   OPEN("/dev/srandom");
1045   OPEN("/dev/urandom");
1046   OPEN("/dev/random");
1047   OPEN("/etc/hosts");
1048   OPEN("/proc/meminfo");
1049
1050   if (options->BridgeAuthoritativeDir)
1051     OPEN_DATADIR_SUFFIX("networkstatus-bridges", ".tmp");
1052
1053   if (authdir_mode(options))
1054     OPEN_DATADIR("approved-routers");
1055
1056   if (options->ServerDNSResolvConfFile)
1057     sandbox_cfg_allow_open_filename(&cfg,
1058                                 tor_strdup(options->ServerDNSResolvConfFile));
1059   else
1060     sandbox_cfg_allow_open_filename(&cfg, tor_strdup("/etc/resolv.conf"));
1061
1062   for (i = 0; i < 2; ++i) {
1063     if (get_torrc_fname(i)) {
1064       sandbox_cfg_allow_open_filename(&cfg, tor_strdup(get_torrc_fname(i)));
1065     }
1066   }
1067
1068   SMARTLIST_FOREACH(options->FilesOpenedByIncludes, char *, f, {
1069     OPEN(f);
1070   });
1071
1072 #define RENAME_SUFFIX(name, suffix)        \
1073   sandbox_cfg_allow_rename(&cfg,           \
1074       get_datadir_fname(name suffix),      \
1075       get_datadir_fname(name))
1076
1077 #define RENAME_SUFFIX2(prefix, name, suffix) \
1078   sandbox_cfg_allow_rename(&cfg,                                        \
1079                            get_datadir_fname2(prefix, name suffix),     \
1080                            get_datadir_fname2(prefix, name))
1081
1082 #define RENAME_CACHEDIR_SUFFIX(name, suffix)        \
1083   sandbox_cfg_allow_rename(&cfg,           \
1084       get_cachedir_fname(name suffix),      \
1085       get_cachedir_fname(name))
1086
1087 #define RENAME_KEYDIR_SUFFIX(name, suffix)    \
1088   sandbox_cfg_allow_rename(&cfg,           \
1089       get_keydir_fname(name suffix),      \
1090       get_keydir_fname(name))
1091
1092   RENAME_CACHEDIR_SUFFIX("cached-certs", ".tmp");
1093   RENAME_CACHEDIR_SUFFIX("cached-consensus", ".tmp");
1094   RENAME_CACHEDIR_SUFFIX("unverified-consensus", ".tmp");
1095   RENAME_CACHEDIR_SUFFIX("unverified-microdesc-consensus", ".tmp");
1096   RENAME_CACHEDIR_SUFFIX("cached-microdesc-consensus", ".tmp");
1097   RENAME_CACHEDIR_SUFFIX("cached-microdescs", ".tmp");
1098   RENAME_CACHEDIR_SUFFIX("cached-microdescs", ".new");
1099   RENAME_CACHEDIR_SUFFIX("cached-microdescs.new", ".tmp");
1100   RENAME_CACHEDIR_SUFFIX("cached-descriptors", ".tmp");
1101   RENAME_CACHEDIR_SUFFIX("cached-descriptors", ".new");
1102   RENAME_CACHEDIR_SUFFIX("cached-descriptors.new", ".tmp");
1103   RENAME_CACHEDIR_SUFFIX("cached-extrainfo", ".tmp");
1104   RENAME_CACHEDIR_SUFFIX("cached-extrainfo", ".new");
1105   RENAME_CACHEDIR_SUFFIX("cached-extrainfo.new", ".tmp");
1106
1107   RENAME_SUFFIX("state", ".tmp");
1108   RENAME_SUFFIX("sr-state", ".tmp");
1109   RENAME_SUFFIX("unparseable-desc", ".tmp");
1110   RENAME_SUFFIX("v3-status-votes", ".tmp");
1111
1112   if (options->BridgeAuthoritativeDir)
1113     RENAME_SUFFIX("networkstatus-bridges", ".tmp");
1114
1115 #define STAT_DATADIR(name)                      \
1116   sandbox_cfg_allow_stat_filename(&cfg, get_datadir_fname(name))
1117
1118 #define STAT_CACHEDIR(name)                                             \
1119   sandbox_cfg_allow_stat_filename(&cfg, get_cachedir_fname(name))
1120
1121 #define STAT_DATADIR2(name, name2)                                      \
1122   sandbox_cfg_allow_stat_filename(&cfg, get_datadir_fname2((name), (name2)))
1123
1124 #define STAT_KEY_DIRECTORY() \
1125   sandbox_cfg_allow_stat_filename(&cfg, tor_strdup(options->KeyDirectory))
1126
1127   STAT_DATADIR(NULL);
1128   STAT_DATADIR("lock");
1129   STAT_DATADIR("state");
1130   STAT_DATADIR("router-stability");
1131
1132   STAT_CACHEDIR("cached-extrainfo.new");
1133
1134   {
1135     smartlist_t *files = smartlist_new();
1136     tor_log_get_logfile_names(files);
1137     SMARTLIST_FOREACH(files, char *, file_name, {
1138       /* steals reference */
1139       sandbox_cfg_allow_open_filename(&cfg, file_name);
1140     });
1141     smartlist_free(files);
1142   }
1143
1144   {
1145     smartlist_t *files = smartlist_new();
1146     smartlist_t *dirs = smartlist_new();
1147     hs_service_lists_fnames_for_sandbox(files, dirs);
1148     SMARTLIST_FOREACH(files, char *, file_name, {
1149       char *tmp_name = NULL;
1150       tor_asprintf(&tmp_name, "%s.tmp", file_name);
1151       sandbox_cfg_allow_rename(&cfg,
1152                                tor_strdup(tmp_name), tor_strdup(file_name));
1153       /* steals references */
1154       sandbox_cfg_allow_open_filename(&cfg, file_name);
1155       sandbox_cfg_allow_open_filename(&cfg, tmp_name);
1156     });
1157     SMARTLIST_FOREACH(dirs, char *, dir, {
1158       /* steals reference */
1159       sandbox_cfg_allow_stat_filename(&cfg, dir);
1160     });
1161     smartlist_free(files);
1162     smartlist_free(dirs);
1163   }
1164
1165   {
1166     char *fname;
1167     if ((fname = get_controller_cookie_file_name())) {
1168       sandbox_cfg_allow_open_filename(&cfg, fname);
1169     }
1170     if ((fname = get_ext_or_auth_cookie_file_name())) {
1171       sandbox_cfg_allow_open_filename(&cfg, fname);
1172     }
1173   }
1174
1175   SMARTLIST_FOREACH_BEGIN(get_configured_ports(), port_cfg_t *, port) {
1176     if (!port->is_unix_addr)
1177       continue;
1178     /* When we open an AF_UNIX address, we want permission to open the
1179      * directory that holds it. */
1180     char *dirname = tor_strdup(port->unix_addr);
1181     if (get_parent_directory(dirname) == 0) {
1182       OPEN(dirname);
1183     }
1184     tor_free(dirname);
1185     sandbox_cfg_allow_chmod_filename(&cfg, tor_strdup(port->unix_addr));
1186     sandbox_cfg_allow_chown_filename(&cfg, tor_strdup(port->unix_addr));
1187   } SMARTLIST_FOREACH_END(port);
1188
1189   if (options->DirPortFrontPage) {
1190     sandbox_cfg_allow_open_filename(&cfg,
1191                                     tor_strdup(options->DirPortFrontPage));
1192   }
1193
1194   // orport
1195   if (server_mode(get_options())) {
1196
1197     OPEN_KEYDIR_SUFFIX("secret_id_key", ".tmp");
1198     OPEN_KEYDIR_SUFFIX("secret_onion_key", ".tmp");
1199     OPEN_KEYDIR_SUFFIX("secret_onion_key_ntor", ".tmp");
1200     OPEN_KEYDIR("secret_id_key.old");
1201     OPEN_KEYDIR("secret_onion_key.old");
1202     OPEN_KEYDIR("secret_onion_key_ntor.old");
1203
1204     OPEN_KEYDIR_SUFFIX("ed25519_master_id_secret_key", ".tmp");
1205     OPEN_KEYDIR_SUFFIX("ed25519_master_id_secret_key_encrypted", ".tmp");
1206     OPEN_KEYDIR_SUFFIX("ed25519_master_id_public_key", ".tmp");
1207     OPEN_KEYDIR_SUFFIX("ed25519_signing_secret_key", ".tmp");
1208     OPEN_KEYDIR_SUFFIX("ed25519_signing_secret_key_encrypted", ".tmp");
1209     OPEN_KEYDIR_SUFFIX("ed25519_signing_public_key", ".tmp");
1210     OPEN_KEYDIR_SUFFIX("ed25519_signing_cert", ".tmp");
1211
1212     OPEN_DATADIR2_SUFFIX("stats", "bridge-stats", ".tmp");
1213     OPEN_DATADIR2_SUFFIX("stats", "dirreq-stats", ".tmp");
1214
1215     OPEN_DATADIR2_SUFFIX("stats", "entry-stats", ".tmp");
1216     OPEN_DATADIR2_SUFFIX("stats", "exit-stats", ".tmp");
1217     OPEN_DATADIR2_SUFFIX("stats", "buffer-stats", ".tmp");
1218     OPEN_DATADIR2_SUFFIX("stats", "conn-stats", ".tmp");
1219     OPEN_DATADIR2_SUFFIX("stats", "hidserv-stats", ".tmp");
1220
1221     OPEN_DATADIR("approved-routers");
1222     OPEN_DATADIR_SUFFIX("fingerprint", ".tmp");
1223     OPEN_DATADIR_SUFFIX("hashed-fingerprint", ".tmp");
1224     OPEN_DATADIR_SUFFIX("router-stability", ".tmp");
1225
1226     OPEN("/etc/resolv.conf");
1227
1228     RENAME_SUFFIX("fingerprint", ".tmp");
1229     RENAME_KEYDIR_SUFFIX("secret_onion_key_ntor", ".tmp");
1230
1231     RENAME_KEYDIR_SUFFIX("secret_id_key", ".tmp");
1232     RENAME_KEYDIR_SUFFIX("secret_id_key.old", ".tmp");
1233     RENAME_KEYDIR_SUFFIX("secret_onion_key", ".tmp");
1234     RENAME_KEYDIR_SUFFIX("secret_onion_key.old", ".tmp");
1235
1236     RENAME_SUFFIX2("stats", "bridge-stats", ".tmp");
1237     RENAME_SUFFIX2("stats", "dirreq-stats", ".tmp");
1238     RENAME_SUFFIX2("stats", "entry-stats", ".tmp");
1239     RENAME_SUFFIX2("stats", "exit-stats", ".tmp");
1240     RENAME_SUFFIX2("stats", "buffer-stats", ".tmp");
1241     RENAME_SUFFIX2("stats", "conn-stats", ".tmp");
1242     RENAME_SUFFIX2("stats", "hidserv-stats", ".tmp");
1243     RENAME_SUFFIX("hashed-fingerprint", ".tmp");
1244     RENAME_SUFFIX("router-stability", ".tmp");
1245
1246     RENAME_KEYDIR_SUFFIX("ed25519_master_id_secret_key", ".tmp");
1247     RENAME_KEYDIR_SUFFIX("ed25519_master_id_secret_key_encrypted", ".tmp");
1248     RENAME_KEYDIR_SUFFIX("ed25519_master_id_public_key", ".tmp");
1249     RENAME_KEYDIR_SUFFIX("ed25519_signing_secret_key", ".tmp");
1250     RENAME_KEYDIR_SUFFIX("ed25519_signing_cert", ".tmp");
1251
1252     sandbox_cfg_allow_rename(&cfg,
1253              get_keydir_fname("secret_onion_key"),
1254              get_keydir_fname("secret_onion_key.old"));
1255     sandbox_cfg_allow_rename(&cfg,
1256              get_keydir_fname("secret_onion_key_ntor"),
1257              get_keydir_fname("secret_onion_key_ntor.old"));
1258
1259     STAT_KEY_DIRECTORY();
1260     OPEN_DATADIR("stats");
1261     STAT_DATADIR("stats");
1262     STAT_DATADIR2("stats", "dirreq-stats");
1263
1264     consdiffmgr_register_with_sandbox(&cfg);
1265   }
1266
1267   init_addrinfo();
1268
1269   return cfg;
1270 }
1271
1272 static int
1273 run_tor_main_loop(void)
1274 {
1275   handle_signals();
1276   monotime_init();
1277   timers_initialize();
1278   initialize_mainloop_events();
1279
1280   /* load the private keys, if we're supposed to have them, and set up the
1281    * TLS context. */
1282   if (! client_identity_key_is_set()) {
1283     if (init_keys() < 0) {
1284       log_err(LD_OR, "Error initializing keys; exiting");
1285       return -1;
1286     }
1287   }
1288
1289   /* Set up our buckets */
1290   connection_bucket_init();
1291
1292   /* initialize the bootstrap status events to know we're starting up */
1293   control_event_bootstrap(BOOTSTRAP_STATUS_STARTING, 0);
1294
1295   /* Initialize the keypinning log. */
1296   if (authdir_mode_v3(get_options())) {
1297     char *fname = get_datadir_fname("key-pinning-journal");
1298     int r = 0;
1299     if (keypin_load_journal(fname)<0) {
1300       log_err(LD_DIR, "Error loading key-pinning journal: %s",strerror(errno));
1301       r = -1;
1302     }
1303     if (keypin_open_journal(fname)<0) {
1304       log_err(LD_DIR, "Error opening key-pinning journal: %s",strerror(errno));
1305       r = -1;
1306     }
1307     tor_free(fname);
1308     if (r)
1309       return r;
1310   }
1311   {
1312     /* This is the old name for key-pinning-journal.  These got corrupted
1313      * in a couple of cases by #16530, so we started over. See #16580 for
1314      * the rationale and for other options we didn't take.  We can remove
1315      * this code once all the authorities that ran 0.2.7.1-alpha-dev are
1316      * upgraded.
1317      */
1318     char *fname = get_datadir_fname("key-pinning-entries");
1319     unlink(fname);
1320     tor_free(fname);
1321   }
1322
1323   if (trusted_dirs_reload_certs()) {
1324     log_warn(LD_DIR,
1325              "Couldn't load all cached v3 certificates. Starting anyway.");
1326   }
1327   if (router_reload_consensus_networkstatus()) {
1328     return -1;
1329   }
1330   /* load the routers file, or assign the defaults. */
1331   if (router_reload_router_list()) {
1332     return -1;
1333   }
1334   /* load the networkstatuses. (This launches a download for new routers as
1335    * appropriate.)
1336    */
1337   const time_t now = time(NULL);
1338   directory_info_has_arrived(now, 1, 0);
1339
1340   if (server_mode(get_options()) || dir_server_mode(get_options())) {
1341     /* launch cpuworkers. Need to do this *after* we've read the onion key. */
1342     cpu_init();
1343   }
1344   consdiffmgr_enable_background_compression();
1345
1346   /* Setup shared random protocol subsystem. */
1347   if (authdir_mode_v3(get_options())) {
1348     if (sr_init(1) < 0) {
1349       return -1;
1350     }
1351   }
1352
1353   /* initialize dns resolve map, spawn workers if needed */
1354   if (dns_init() < 0) {
1355     if (get_options()->ServerDNSAllowBrokenConfig)
1356       log_warn(LD_GENERAL, "Couldn't set up any working nameservers. "
1357                "Network not up yet?  Will try again soon.");
1358     else {
1359       log_err(LD_GENERAL,"Error initializing dns subsystem; exiting.  To "
1360               "retry instead, set the ServerDNSAllowBrokenResolvConf option.");
1361     }
1362   }
1363
1364 #ifdef HAVE_SYSTEMD
1365   {
1366     const int r = sd_notify(0, "READY=1");
1367     if (r < 0) {
1368       log_warn(LD_GENERAL, "Unable to send readiness to systemd: %s",
1369                strerror(r));
1370     } else if (r > 0) {
1371       log_notice(LD_GENERAL, "Signaled readiness to systemd");
1372     } else {
1373       log_info(LD_GENERAL, "Systemd NOTIFY_SOCKET not present.");
1374     }
1375   }
1376 #endif /* defined(HAVE_SYSTEMD) */
1377
1378   return do_main_loop();
1379 }
1380
1381 /* Main entry point for the Tor process.  Called from tor_main(), and by
1382  * anybody embedding Tor. */
1383 int
1384 tor_run_main(const tor_main_configuration_t *tor_cfg)
1385 {
1386   int result = 0;
1387
1388 #ifdef _WIN32
1389 #ifndef HeapEnableTerminationOnCorruption
1390 #define HeapEnableTerminationOnCorruption 1
1391 #endif
1392   /* On heap corruption, just give up; don't try to play along. */
1393   HeapSetInformation(NULL, HeapEnableTerminationOnCorruption, NULL, 0);
1394
1395   /* SetProcessDEPPolicy is only supported on 32-bit Windows.
1396    * (On 64-bit Windows it always fails, and some compilers don't like the
1397    * PSETDEP cast.)
1398    * 32-bit Windows defines _WIN32.
1399    * 64-bit Windows defines _WIN32 and _WIN64. */
1400 #ifndef _WIN64
1401   /* Call SetProcessDEPPolicy to permanently enable DEP.
1402      The function will not resolve on earlier versions of Windows,
1403      and failure is not dangerous. */
1404   HMODULE hMod = GetModuleHandleA("Kernel32.dll");
1405   if (hMod) {
1406     typedef BOOL (WINAPI *PSETDEP)(DWORD);
1407     PSETDEP setdeppolicy = (PSETDEP)GetProcAddress(hMod,
1408                            "SetProcessDEPPolicy");
1409     if (setdeppolicy) {
1410       /* PROCESS_DEP_ENABLE | PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION */
1411       setdeppolicy(3);
1412     }
1413   }
1414 #endif /* !defined(_WIN64) */
1415 #endif /* defined(_WIN32) */
1416
1417   {
1418     int bt_err = configure_backtrace_handler(get_version());
1419     if (bt_err < 0) {
1420       log_warn(LD_BUG, "Unable to install backtrace handler: %s",
1421                strerror(-bt_err));
1422     }
1423   }
1424
1425 #ifdef EVENT_SET_MEM_FUNCTIONS_IMPLEMENTED
1426   event_set_mem_functions(tor_malloc_, tor_realloc_, tor_free_);
1427 #endif
1428
1429   init_protocol_warning_severity_level();
1430
1431   update_approx_time(time(NULL));
1432   tor_threads_init();
1433   tor_compress_init();
1434   init_logging(0);
1435   monotime_init();
1436
1437   int argc = tor_cfg->argc + tor_cfg->argc_owned;
1438   char **argv = tor_calloc(argc, sizeof(char*));
1439   memcpy(argv, tor_cfg->argv, tor_cfg->argc*sizeof(char*));
1440   if (tor_cfg->argc_owned)
1441     memcpy(argv + tor_cfg->argc, tor_cfg->argv_owned,
1442            tor_cfg->argc_owned*sizeof(char*));
1443
1444 #ifdef NT_SERVICE
1445   {
1446      int done = 0;
1447      result = nt_service_parse_options(argc, argv, &done);
1448      if (done) {
1449        goto done;
1450      }
1451   }
1452 #endif /* defined(NT_SERVICE) */
1453   {
1454     int init_rv = tor_init(argc, argv);
1455     if (init_rv) {
1456       tor_free_all(0);
1457       result = (init_rv < 0) ? -1 : 0;
1458       goto done;
1459     }
1460   }
1461
1462   if (get_options()->Sandbox && get_options()->command == CMD_RUN_TOR) {
1463     sandbox_cfg_t* cfg = sandbox_init_filter();
1464
1465     if (sandbox_init(cfg)) {
1466       tor_free(argv);
1467       log_err(LD_BUG,"Failed to create syscall sandbox filter");
1468       tor_free_all(0);
1469       return -1;
1470     }
1471
1472     // registering libevent rng
1473 #ifdef HAVE_EVUTIL_SECURE_RNG_SET_URANDOM_DEVICE_FILE
1474     evutil_secure_rng_set_urandom_device_file(
1475         (char*) sandbox_intern_string("/dev/urandom"));
1476 #endif
1477   }
1478
1479   switch (get_options()->command) {
1480   case CMD_RUN_TOR:
1481 #ifdef NT_SERVICE
1482     nt_service_set_state(SERVICE_RUNNING);
1483 #endif
1484     result = run_tor_main_loop();
1485     break;
1486   case CMD_KEYGEN:
1487     result = load_ed_keys(get_options(), time(NULL)) < 0;
1488     break;
1489   case CMD_KEY_EXPIRATION:
1490     init_keys();
1491     result = log_cert_expiration();
1492     break;
1493   case CMD_LIST_FINGERPRINT:
1494     result = do_list_fingerprint();
1495     break;
1496   case CMD_HASH_PASSWORD:
1497     do_hash_password();
1498     result = 0;
1499     break;
1500   case CMD_VERIFY_CONFIG:
1501     if (quiet_level == 0)
1502       printf("Configuration was valid\n");
1503     result = 0;
1504     break;
1505   case CMD_DUMP_CONFIG:
1506     result = do_dump_config();
1507     break;
1508   case CMD_RUN_UNITTESTS: /* only set by test.c */
1509   default:
1510     log_warn(LD_BUG,"Illegal command number %d: internal error.",
1511              get_options()->command);
1512     result = -1;
1513   }
1514   tor_cleanup();
1515  done:
1516   tor_free(argv);
1517   return result;
1518 }