1 /* Copyright (c) 2001 Matej Pfajfar.
2 * Copyright (c) 2001-2004, Roger Dingledine.
3 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4 * Copyright (c) 2007-2017, The Tor Project, Inc. */
5 /* See LICENSE for licensing information */
9 * \brief Code to manage bridges and bridge selection.
11 * Bridges are fixed entry nodes, used for censorship circumvention.
16 #include "circuitbuild.h"
18 #include "connection.h"
19 #include "directory.h"
20 #include "entrynodes.h"
24 #include "routerlist.h"
25 #include "routerset.h"
26 #include "transports.h"
28 /** Information about a configured bridge. Currently this just matches the
29 * ones in the torrc file, but one day we may be able to learn about new
30 * bridges on our own, and remember them in the state file. */
31 struct bridge_info_t
{
32 /** Address and port of the bridge, as configured by the user.*/
33 tor_addr_port_t addrport_configured
;
34 /** Address of the bridge. */
36 /** TLS port for the bridge. */
38 /** Boolean: We are re-parsing our bridge list, and we are going to remove
39 * this one if we don't find it in the list of configured bridges. */
40 unsigned marked_for_removal
: 1;
41 /** Expected identity digest, or all zero bytes if we don't know what the
42 * digest should be. */
43 char identity
[DIGEST_LEN
];
45 /** Name of pluggable transport protocol taken from its config line. */
48 /** When should we next try to fetch a descriptor for this bridge? */
49 download_status_t fetch_status
;
51 /** A smartlist of k=v values to be passed to the SOCKS proxy, if
52 transports are used for this bridge. */
53 smartlist_t
*socks_args
;
56 static void bridge_free(bridge_info_t
*bridge
);
58 /** A list of configured bridges. Whenever we actually get a descriptor
59 * for one, we add it as an entry guard. Note that the order of bridges
60 * in this list does not necessarily correspond to the order of bridges
62 static smartlist_t
*bridge_list
= NULL
;
64 /** Mark every entry of the bridge list to be removed on our next call to
65 * sweep_bridge_list unless it has first been un-marked. */
67 mark_bridge_list(void)
70 bridge_list
= smartlist_new();
71 SMARTLIST_FOREACH(bridge_list
, bridge_info_t
*, b
,
72 b
->marked_for_removal
= 1);
75 /** Remove every entry of the bridge list that was marked with
76 * mark_bridge_list if it has not subsequently been un-marked. */
78 sweep_bridge_list(void)
81 bridge_list
= smartlist_new();
82 SMARTLIST_FOREACH_BEGIN(bridge_list
, bridge_info_t
*, b
) {
83 if (b
->marked_for_removal
) {
84 SMARTLIST_DEL_CURRENT(bridge_list
, b
);
87 } SMARTLIST_FOREACH_END(b
);
90 /** Initialize the bridge list to empty, creating it if needed. */
92 clear_bridge_list(void)
95 bridge_list
= smartlist_new();
96 SMARTLIST_FOREACH(bridge_list
, bridge_info_t
*, b
, bridge_free(b
));
97 smartlist_clear(bridge_list
);
100 /** Free the bridge <b>bridge</b>. */
102 bridge_free(bridge_info_t
*bridge
)
107 tor_free(bridge
->transport_name
);
108 if (bridge
->socks_args
) {
109 SMARTLIST_FOREACH(bridge
->socks_args
, char*, s
, tor_free(s
));
110 smartlist_free(bridge
->socks_args
);
116 /** Return a list of all the configured bridges, as bridge_info_t pointers. */
118 bridge_list_get(void)
121 bridge_list
= smartlist_new();
126 * Given a <b>bridge</b>, return a pointer to its RSA identity digest, or
127 * NULL if we don't know one for it.
130 bridge_get_rsa_id_digest(const bridge_info_t
*bridge
)
133 if (tor_digest_is_zero(bridge
->identity
))
136 return (const uint8_t *) bridge
->identity
;
140 * Given a <b>bridge</b>, return a pointer to its configured addr:port
143 const tor_addr_port_t
*
144 bridge_get_addr_port(const bridge_info_t
*bridge
)
147 return &bridge
->addrport_configured
;
150 /** If we have a bridge configured whose digest matches <b>digest</b>, or a
151 * bridge with no known digest whose address matches any of the
152 * tor_addr_port_t's in <b>orports</b>, return that bridge. Else return
154 static bridge_info_t
*
155 get_configured_bridge_by_orports_digest(const char *digest
,
156 const smartlist_t
*orports
)
160 SMARTLIST_FOREACH_BEGIN(bridge_list
, bridge_info_t
*, bridge
)
162 if (tor_digest_is_zero(bridge
->identity
)) {
163 SMARTLIST_FOREACH_BEGIN(orports
, tor_addr_port_t
*, ap
)
165 if (tor_addr_compare(&bridge
->addr
, &ap
->addr
, CMP_EXACT
) == 0 &&
166 bridge
->port
== ap
->port
)
169 SMARTLIST_FOREACH_END(ap
);
171 if (digest
&& tor_memeq(bridge
->identity
, digest
, DIGEST_LEN
))
174 SMARTLIST_FOREACH_END(bridge
);
178 /** If we have a bridge configured whose digest matches <b>digest</b>, or a
179 * bridge with no known digest whose address matches <b>addr</b>:<b>port</b>,
180 * return that bridge. Else return NULL. If <b>digest</b> is NULL, check for
181 * address/port matches only. */
183 get_configured_bridge_by_addr_port_digest(const tor_addr_t
*addr
,
189 SMARTLIST_FOREACH_BEGIN(bridge_list
, bridge_info_t
*, bridge
)
191 if ((tor_digest_is_zero(bridge
->identity
) || digest
== NULL
) &&
192 !tor_addr_compare(&bridge
->addr
, addr
, CMP_EXACT
) &&
193 bridge
->port
== port
)
195 if (digest
&& tor_memeq(bridge
->identity
, digest
, DIGEST_LEN
))
198 SMARTLIST_FOREACH_END(bridge
);
203 * As get_configured_bridge_by_addr_port, but require that the
204 * address match <b>addr</b>:<b>port</b>, and that the ID digest match
205 * <b>digest</b>. (The other function will ignore the address if the
209 get_configured_bridge_by_exact_addr_port_digest(const tor_addr_t
*addr
,
215 SMARTLIST_FOREACH_BEGIN(bridge_list
, bridge_info_t
*, bridge
) {
216 if (!tor_addr_compare(&bridge
->addr
, addr
, CMP_EXACT
) &&
217 bridge
->port
== port
) {
219 if (digest
&& tor_memeq(bridge
->identity
, digest
, DIGEST_LEN
))
221 else if (!digest
|| tor_digest_is_zero(bridge
->identity
))
225 } SMARTLIST_FOREACH_END(bridge
);
229 /** If we have a bridge configured whose digest matches <b>digest</b>, or a
230 * bridge with no known digest whose address matches <b>addr</b>:<b>port</b>,
231 * return 1. Else return 0. If <b>digest</b> is NULL, check for
232 * address/port matches only. */
234 addr_is_a_configured_bridge(const tor_addr_t
*addr
,
239 return get_configured_bridge_by_addr_port_digest(addr
, port
, digest
) ? 1 : 0;
242 /** If we have a bridge configured whose digest matches
243 * <b>ei->identity_digest</b>, or a bridge with no known digest whose address
244 * matches <b>ei->addr</b>:<b>ei->port</b>, return 1. Else return 0.
245 * If <b>ei->onion_key</b> is NULL, check for address/port matches only. */
247 extend_info_is_a_configured_bridge(const extend_info_t
*ei
)
249 const char *digest
= ei
->onion_key
? ei
->identity_digest
: NULL
;
250 return addr_is_a_configured_bridge(&ei
->addr
, ei
->port
, digest
);
253 /** Wrapper around get_configured_bridge_by_addr_port_digest() to look
254 * it up via router descriptor <b>ri</b>. */
255 static bridge_info_t
*
256 get_configured_bridge_by_routerinfo(const routerinfo_t
*ri
)
258 bridge_info_t
*bi
= NULL
;
259 smartlist_t
*orports
= router_get_all_orports(ri
);
260 bi
= get_configured_bridge_by_orports_digest(ri
->cache_info
.identity_digest
,
262 SMARTLIST_FOREACH(orports
, tor_addr_port_t
*, p
, tor_free(p
));
263 smartlist_free(orports
);
267 /** Return 1 if <b>ri</b> is one of our known bridges, else 0. */
269 routerinfo_is_a_configured_bridge(const routerinfo_t
*ri
)
271 return get_configured_bridge_by_routerinfo(ri
) ? 1 : 0;
274 /** Return 1 if <b>node</b> is one of our configured bridges, else 0. */
276 node_is_a_configured_bridge(const node_t
*node
)
279 smartlist_t
*orports
= node_get_all_orports(node
);
280 retval
= get_configured_bridge_by_orports_digest(node
->identity
,
282 SMARTLIST_FOREACH(orports
, tor_addr_port_t
*, p
, tor_free(p
));
283 smartlist_free(orports
);
287 /** We made a connection to a router at <b>addr</b>:<b>port</b>
288 * without knowing its digest. Its digest turned out to be <b>digest</b>.
289 * If it was a bridge, and we still don't know its digest, record it.
292 learned_router_identity(const tor_addr_t
*addr
, uint16_t port
,
294 const ed25519_public_key_t
*ed_id
)
296 // XXXX prop220 use ed_id here, once there is some way to specify
299 bridge_info_t
*bridge
=
300 get_configured_bridge_by_exact_addr_port_digest(addr
, port
, digest
);
301 if (bridge
&& tor_digest_is_zero(bridge
->identity
)) {
302 memcpy(bridge
->identity
, digest
, DIGEST_LEN
);
305 /* XXXX prop220 remember bridge ed25519 identities -- add a field */
307 if (bridge
&& ed_id
&&
308 ed25519_public_key_is_zero(&bridge
->ed25519_identity
) &&
309 !ed25519_public_key_is_zero(ed_id
)) {
310 memcpy(&bridge
->ed25519_identity
, ed_id
, sizeof(*ed_id
));
315 char *transport_info
= NULL
;
316 const char *transport_name
=
317 find_transport_name_by_bridge_addrport(addr
, port
);
319 tor_asprintf(&transport_info
, " (with transport '%s')", transport_name
);
321 // XXXX prop220 log both fingerprints.
322 log_notice(LD_DIR
, "Learned fingerprint %s for bridge %s%s.",
323 hex_str(digest
, DIGEST_LEN
), fmt_addrport(addr
, port
),
324 transport_info
? transport_info
: "");
325 tor_free(transport_info
);
326 entry_guard_learned_bridge_identity(&bridge
->addrport_configured
,
327 (const uint8_t *)digest
);
331 /** Return true if <b>bridge</b> has the same identity digest as
332 * <b>digest</b>. If <b>digest</b> is NULL, it matches
333 * bridges with unspecified identity digests. */
335 bridge_has_digest(const bridge_info_t
*bridge
, const char *digest
)
338 return tor_memeq(digest
, bridge
->identity
, DIGEST_LEN
);
340 return tor_digest_is_zero(bridge
->identity
);
343 /** We are about to add a new bridge at <b>addr</b>:<b>port</b>, with optional
344 * <b>digest</b> and <b>transport_name</b>. Mark for removal any previously
345 * existing bridge with the same address and port, and warn the user as
349 bridge_resolve_conflicts(const tor_addr_t
*addr
, uint16_t port
,
350 const char *digest
, const char *transport_name
)
352 /* Iterate the already-registered bridge list:
354 If you find a bridge with the same adress and port, mark it for
355 removal. It doesn't make sense to have two active bridges with
356 the same IP:PORT. If the bridge in question has a different
357 digest or transport than <b>digest</b>/<b>transport_name</b>,
358 it's probably a misconfiguration and we should warn the user.
360 SMARTLIST_FOREACH_BEGIN(bridge_list
, bridge_info_t
*, bridge
) {
361 if (bridge
->marked_for_removal
)
364 if (tor_addr_eq(&bridge
->addr
, addr
) && (bridge
->port
== port
)) {
366 bridge
->marked_for_removal
= 1;
368 if (!bridge_has_digest(bridge
, digest
) ||
369 strcmp_opt(bridge
->transport_name
, transport_name
)) {
371 char *bridge_description_new
, *bridge_description_old
;
372 tor_asprintf(&bridge_description_new
, "%s:%s:%s",
373 fmt_addrport(addr
, port
),
374 digest
? hex_str(digest
, DIGEST_LEN
) : "",
375 transport_name
? transport_name
: "");
376 tor_asprintf(&bridge_description_old
, "%s:%s:%s",
377 fmt_addrport(&bridge
->addr
, bridge
->port
),
378 tor_digest_is_zero(bridge
->identity
) ?
379 "" : hex_str(bridge
->identity
,DIGEST_LEN
),
380 bridge
->transport_name
? bridge
->transport_name
: "");
382 log_warn(LD_GENERAL
,"Tried to add bridge '%s', but we found a conflict"
383 " with the already registered bridge '%s'. We will discard"
384 " the old bridge and keep '%s'. If this is not what you"
385 " wanted, please change your configuration file accordingly.",
386 bridge_description_new
, bridge_description_old
,
387 bridge_description_new
);
389 tor_free(bridge_description_new
);
390 tor_free(bridge_description_old
);
393 } SMARTLIST_FOREACH_END(bridge
);
396 /** Return True if we have a bridge that uses a transport with name
397 * <b>transport_name</b>. */
399 transport_is_needed
, (const char *transport_name
))
404 SMARTLIST_FOREACH_BEGIN(bridge_list
, const bridge_info_t
*, bridge
) {
405 if (bridge
->transport_name
&&
406 !strcmp(bridge
->transport_name
, transport_name
))
408 } SMARTLIST_FOREACH_END(bridge
);
413 /** Register the bridge information in <b>bridge_line</b> to the
414 * bridge subsystem. Steals reference of <b>bridge_line</b>. */
416 bridge_add_from_config(bridge_line_t
*bridge_line
)
420 // XXXX prop220 add a way to specify ed25519 ID to bridge_line_t.
422 { /* Log the bridge we are about to register: */
423 log_debug(LD_GENERAL
, "Registering bridge at %s (transport: %s) (%s)",
424 fmt_addrport(&bridge_line
->addr
, bridge_line
->port
),
425 bridge_line
->transport_name
?
426 bridge_line
->transport_name
: "no transport",
427 tor_digest_is_zero(bridge_line
->digest
) ?
428 "no key listed" : hex_str(bridge_line
->digest
, DIGEST_LEN
));
430 if (bridge_line
->socks_args
) { /* print socks arguments */
433 tor_assert(smartlist_len(bridge_line
->socks_args
) > 0);
435 log_debug(LD_GENERAL
, "Bridge uses %d SOCKS arguments:",
436 smartlist_len(bridge_line
->socks_args
));
437 SMARTLIST_FOREACH(bridge_line
->socks_args
, const char *, arg
,
438 log_debug(LD_CONFIG
, "%d: %s", ++i
, arg
));
442 bridge_resolve_conflicts(&bridge_line
->addr
,
445 bridge_line
->transport_name
);
447 b
= tor_malloc_zero(sizeof(bridge_info_t
));
448 tor_addr_copy(&b
->addrport_configured
.addr
, &bridge_line
->addr
);
449 b
->addrport_configured
.port
= bridge_line
->port
;
450 tor_addr_copy(&b
->addr
, &bridge_line
->addr
);
451 b
->port
= bridge_line
->port
;
452 memcpy(b
->identity
, bridge_line
->digest
, DIGEST_LEN
);
453 if (bridge_line
->transport_name
)
454 b
->transport_name
= bridge_line
->transport_name
;
455 b
->fetch_status
.schedule
= DL_SCHED_BRIDGE
;
456 b
->fetch_status
.backoff
= DL_SCHED_RANDOM_EXPONENTIAL
;
457 b
->fetch_status
.increment_on
= DL_SCHED_INCREMENT_ATTEMPT
;
458 b
->socks_args
= bridge_line
->socks_args
;
460 bridge_list
= smartlist_new();
462 tor_free(bridge_line
); /* Deallocate bridge_line now. */
464 smartlist_add(bridge_list
, b
);
467 /** If <b>digest</b> is one of our known bridges, return it. */
469 find_bridge_by_digest(const char *digest
)
473 SMARTLIST_FOREACH(bridge_list
, bridge_info_t
*, bridge
,
475 if (tor_memeq(bridge
->identity
, digest
, DIGEST_LEN
))
481 /** Given the <b>addr</b> and <b>port</b> of a bridge, if that bridge
482 * supports a pluggable transport, return its name. Otherwise, return
485 find_transport_name_by_bridge_addrport(const tor_addr_t
*addr
, uint16_t port
)
490 SMARTLIST_FOREACH_BEGIN(bridge_list
, const bridge_info_t
*, bridge
) {
491 if (tor_addr_eq(&bridge
->addr
, addr
) &&
492 (bridge
->port
== port
))
493 return bridge
->transport_name
;
494 } SMARTLIST_FOREACH_END(bridge
);
499 /** If <b>addr</b> and <b>port</b> match the address and port of a
500 * bridge of ours that uses pluggable transports, place its transport
501 * in <b>transport</b>.
503 * Return 0 on success (found a transport, or found a bridge with no
504 * transport, or found no bridge); return -1 if we should be using a
505 * transport, but the transport could not be found.
508 get_transport_by_bridge_addrport(const tor_addr_t
*addr
, uint16_t port
,
509 const transport_t
**transport
)
515 SMARTLIST_FOREACH_BEGIN(bridge_list
, const bridge_info_t
*, bridge
) {
516 if (tor_addr_eq(&bridge
->addr
, addr
) &&
517 (bridge
->port
== port
)) { /* bridge matched */
518 if (bridge
->transport_name
) { /* it also uses pluggable transports */
519 *transport
= transport_get_by_name(bridge
->transport_name
);
520 if (*transport
== NULL
) { /* it uses pluggable transports, but
521 the transport could not be found! */
525 } else { /* bridge matched, but it doesn't use transports. */
529 } SMARTLIST_FOREACH_END(bridge
);
535 /** Return a smartlist containing all the SOCKS arguments that we
536 * should pass to the SOCKS proxy. */
538 get_socks_args_by_bridge_addrport(const tor_addr_t
*addr
, uint16_t port
)
540 bridge_info_t
*bridge
= get_configured_bridge_by_addr_port_digest(addr
,
543 return bridge
? bridge
->socks_args
: NULL
;
546 /** We need to ask <b>bridge</b> for its server descriptor. */
548 launch_direct_bridge_descriptor_fetch(bridge_info_t
*bridge
)
550 const or_options_t
*options
= get_options();
551 circuit_guard_state_t
*guard_state
= NULL
;
553 if (connection_get_by_type_addr_port_purpose(
554 CONN_TYPE_DIR
, &bridge
->addr
, bridge
->port
,
555 DIR_PURPOSE_FETCH_SERVERDESC
))
556 return; /* it's already on the way */
558 if (routerset_contains_bridge(options
->ExcludeNodes
, bridge
)) {
559 download_status_mark_impossible(&bridge
->fetch_status
);
560 log_warn(LD_APP
, "Not using bridge at %s: it is in ExcludeNodes.",
561 safe_str_client(fmt_and_decorate_addr(&bridge
->addr
)));
565 /* Until we get a descriptor for the bridge, we only know one address for
567 if (!fascist_firewall_allows_address_addr(&bridge
->addr
, bridge
->port
,
568 FIREWALL_OR_CONNECTION
, 0, 0)) {
569 log_notice(LD_CONFIG
, "Tried to fetch a descriptor directly from a "
570 "bridge, but that bridge is not reachable through our "
575 tor_addr_port_t bridge_addrport
;
576 memcpy(&bridge_addrport
.addr
, &bridge
->addr
, sizeof(tor_addr_t
));
577 bridge_addrport
.port
= bridge
->port
;
579 guard_state
= get_guard_state_for_bridge_desc_fetch(bridge
->identity
);
581 directory_request_t
*req
=
582 directory_request_new(DIR_PURPOSE_FETCH_SERVERDESC
);
583 directory_request_set_or_addr_port(req
, &bridge_addrport
);
584 directory_request_set_directory_id_digest(req
, bridge
->identity
);
585 directory_request_set_router_purpose(req
, ROUTER_PURPOSE_BRIDGE
);
586 directory_request_set_resource(req
, "authority.z");
588 directory_request_set_guard_state(req
, guard_state
);
590 directory_initiate_request(req
);
591 directory_request_free(req
);
594 /** Fetching the bridge descriptor from the bridge authority returned a
595 * "not found". Fall back to trying a direct fetch. */
597 retry_bridge_descriptor_fetch_directly(const char *digest
)
599 bridge_info_t
*bridge
= find_bridge_by_digest(digest
);
601 return; /* not found? oh well. */
603 launch_direct_bridge_descriptor_fetch(bridge
);
606 /** For each bridge in our list for which we don't currently have a
607 * descriptor, fetch a new copy of its descriptor -- either directly
608 * from the bridge or via a bridge authority. */
610 fetch_bridge_descriptors(const or_options_t
*options
, time_t now
)
612 int num_bridge_auths
= get_n_authorities(BRIDGE_DIRINFO
);
613 int ask_bridge_directly
;
614 int can_use_bridge_authority
;
619 /* If we still have unconfigured managed proxies, don't go and
620 connect to a bridge. */
621 if (pt_proxies_configuration_pending())
624 SMARTLIST_FOREACH_BEGIN(bridge_list
, bridge_info_t
*, bridge
)
626 if (!download_status_is_ready(&bridge
->fetch_status
, now
,
627 IMPOSSIBLE_TO_DOWNLOAD
))
628 continue; /* don't bother, no need to retry yet */
629 if (routerset_contains_bridge(options
->ExcludeNodes
, bridge
)) {
630 download_status_mark_impossible(&bridge
->fetch_status
);
631 log_warn(LD_APP
, "Not using bridge at %s: it is in ExcludeNodes.",
632 safe_str_client(fmt_and_decorate_addr(&bridge
->addr
)));
636 /* schedule the next attempt
637 * we can't increment after a failure, because sometimes we use the
638 * bridge authority, and sometimes we use the bridge direct */
639 download_status_increment_attempt(
640 &bridge
->fetch_status
,
641 safe_str_client(fmt_and_decorate_addr(&bridge
->addr
)),
644 can_use_bridge_authority
= !tor_digest_is_zero(bridge
->identity
) &&
646 ask_bridge_directly
= !can_use_bridge_authority
||
647 !options
->UpdateBridgesFromAuthority
;
648 log_debug(LD_DIR
, "ask_bridge_directly=%d (%d, %d, %d)",
649 ask_bridge_directly
, tor_digest_is_zero(bridge
->identity
),
650 !options
->UpdateBridgesFromAuthority
, !num_bridge_auths
);
652 if (ask_bridge_directly
&&
653 !fascist_firewall_allows_address_addr(&bridge
->addr
, bridge
->port
,
654 FIREWALL_OR_CONNECTION
, 0,
656 log_notice(LD_DIR
, "Bridge at '%s' isn't reachable by our "
657 "firewall policy. %s.",
658 fmt_addrport(&bridge
->addr
, bridge
->port
),
659 can_use_bridge_authority
?
660 "Asking bridge authority instead" : "Skipping");
661 if (can_use_bridge_authority
)
662 ask_bridge_directly
= 0;
667 if (ask_bridge_directly
) {
668 /* we need to ask the bridge itself for its descriptor. */
669 launch_direct_bridge_descriptor_fetch(bridge
);
671 /* We have a digest and we want to ask an authority. We could
672 * combine all the requests into one, but that may give more
673 * hints to the bridge authority than we want to give. */
674 char resource
[10 + HEX_DIGEST_LEN
];
675 memcpy(resource
, "fp/", 3);
676 base16_encode(resource
+3, HEX_DIGEST_LEN
+1,
677 bridge
->identity
, DIGEST_LEN
);
678 memcpy(resource
+3+HEX_DIGEST_LEN
, ".z", 3);
679 log_info(LD_DIR
, "Fetching bridge info '%s' from bridge authority.",
681 directory_get_from_dirserver(DIR_PURPOSE_FETCH_SERVERDESC
,
682 ROUTER_PURPOSE_BRIDGE
, resource
, 0, DL_WANT_AUTHORITY
);
685 SMARTLIST_FOREACH_END(bridge
);
688 /** If our <b>bridge</b> is configured to be a different address than
689 * the bridge gives in <b>node</b>, rewrite the routerinfo
690 * we received to use the address we meant to use. Now we handle
691 * multihomed bridges better.
694 rewrite_node_address_for_bridge(const bridge_info_t
*bridge
, node_t
*node
)
696 /* XXXX move this function. */
697 /* XXXX overridden addresses should really live in the node_t, so that the
698 * routerinfo_t and the microdesc_t can be immutable. But we can only
699 * do that safely if we know that no function that connects to an OR
700 * does so through an address from any source other than node_get_addr().
703 const or_options_t
*options
= get_options();
706 routerinfo_t
*ri
= node
->ri
;
707 tor_addr_from_ipv4h(&addr
, ri
->addr
);
709 if ((!tor_addr_compare(&bridge
->addr
, &addr
, CMP_EXACT
) &&
710 bridge
->port
== ri
->or_port
) ||
711 (!tor_addr_compare(&bridge
->addr
, &ri
->ipv6_addr
, CMP_EXACT
) &&
712 bridge
->port
== ri
->ipv6_orport
)) {
713 /* they match, so no need to do anything */
715 if (tor_addr_family(&bridge
->addr
) == AF_INET
) {
716 ri
->addr
= tor_addr_to_ipv4h(&bridge
->addr
);
717 ri
->or_port
= bridge
->port
;
719 "Adjusted bridge routerinfo for '%s' to match configured "
721 ri
->nickname
, fmt_addr32(ri
->addr
), ri
->or_port
);
722 } else if (tor_addr_family(&bridge
->addr
) == AF_INET6
) {
723 tor_addr_copy(&ri
->ipv6_addr
, &bridge
->addr
);
724 ri
->ipv6_orport
= bridge
->port
;
726 "Adjusted bridge routerinfo for '%s' to match configured "
728 ri
->nickname
, fmt_addrport(&ri
->ipv6_addr
, ri
->ipv6_orport
));
730 log_err(LD_BUG
, "Address family not supported: %d.",
731 tor_addr_family(&bridge
->addr
));
736 if (options
->ClientPreferIPv6ORPort
== -1) {
737 /* Mark which address to use based on which bridge_t we got. */
738 node
->ipv6_preferred
= (tor_addr_family(&bridge
->addr
) == AF_INET6
&&
739 !tor_addr_is_null(&node
->ri
->ipv6_addr
));
741 /* Mark which address to use based on user preference */
742 node
->ipv6_preferred
= (fascist_firewall_prefer_ipv6_orport(options
) &&
743 !tor_addr_is_null(&node
->ri
->ipv6_addr
));
746 /* XXXipv6 we lack support for falling back to another address for
747 the same relay, warn the user */
748 if (!tor_addr_is_null(&ri
->ipv6_addr
)) {
750 node_get_pref_orport(node
, &ap
);
751 log_notice(LD_CONFIG
,
752 "Bridge '%s' has both an IPv4 and an IPv6 address. "
753 "Will prefer using its %s address (%s) based on %s.",
755 node
->ipv6_preferred
? "IPv6" : "IPv4",
756 fmt_addrport(&ap
.addr
, ap
.port
),
757 options
->ClientPreferIPv6ORPort
== -1 ?
758 "the configured Bridge address" :
759 "ClientPreferIPv6ORPort");
763 routerstatus_t
*rs
= node
->rs
;
764 tor_addr_from_ipv4h(&addr
, rs
->addr
);
766 if (!tor_addr_compare(&bridge
->addr
, &addr
, CMP_EXACT
) &&
767 bridge
->port
== rs
->or_port
) {
768 /* they match, so no need to do anything */
770 rs
->addr
= tor_addr_to_ipv4h(&bridge
->addr
);
771 rs
->or_port
= bridge
->port
;
773 "Adjusted bridge routerstatus for '%s' to match "
774 "configured address %s.",
775 rs
->nickname
, fmt_addrport(&bridge
->addr
, rs
->or_port
));
780 /** We just learned a descriptor for a bridge. See if that
781 * digest is in our entry guard list, and add it if not. */
783 learned_bridge_descriptor(routerinfo_t
*ri
, int from_cache
)
786 tor_assert(ri
->purpose
== ROUTER_PURPOSE_BRIDGE
);
787 if (get_options()->UseBridges
) {
788 int first
= num_bridges_usable() <= 1;
789 bridge_info_t
*bridge
= get_configured_bridge_by_routerinfo(ri
);
790 time_t now
= time(NULL
);
791 router_set_status(ri
->cache_info
.identity_digest
, 1);
793 if (bridge
) { /* if we actually want to use this one */
795 /* it's here; schedule its re-fetch for a long time from now. */
797 download_status_reset(&bridge
->fetch_status
);
798 /* We have two quick attempts in the bridge schedule, and then slow
800 download_status_increment_attempt(
801 &bridge
->fetch_status
,
802 safe_str_client(fmt_and_decorate_addr(&bridge
->addr
)),
804 download_status_increment_attempt(
805 &bridge
->fetch_status
,
806 safe_str_client(fmt_and_decorate_addr(&bridge
->addr
)),
810 node
= node_get_mutable_by_id(ri
->cache_info
.identity_digest
);
812 rewrite_node_address_for_bridge(bridge
, node
);
813 if (tor_digest_is_zero(bridge
->identity
)) {
814 memcpy(bridge
->identity
,ri
->cache_info
.identity_digest
, DIGEST_LEN
);
815 log_notice(LD_DIR
, "Learned identity %s for bridge at %s:%d",
816 hex_str(bridge
->identity
, DIGEST_LEN
),
817 fmt_and_decorate_addr(&bridge
->addr
),
820 entry_guard_learned_bridge_identity(&bridge
->addrport_configured
,
821 (const uint8_t*)ri
->cache_info
.identity_digest
);
823 log_notice(LD_DIR
, "new bridge descriptor '%s' (%s): %s", ri
->nickname
,
824 from_cache
? "cached" : "fresh", router_describe(ri
));
825 /* set entry->made_contact so if it goes down we don't drop it from
826 * our entry node list */
828 routerlist_retry_directory_downloads(now
);
834 /** Return the number of bridges that have descriptors that
835 * are marked with purpose 'bridge' and are running.
837 * We use this function to decide if we're ready to start building
838 * circuits through our bridges, or if we need to wait until the
839 * directory "server/authority" requests finish. */
841 any_bridge_descriptors_known(void)
843 tor_assert(get_options()->UseBridges
);
848 SMARTLIST_FOREACH_BEGIN(bridge_list
, bridge_info_t
*, bridge
) {
850 if (!tor_digest_is_zero(bridge
->identity
) &&
851 (node
= node_get_by_id(bridge
->identity
)) != NULL
&&
855 } SMARTLIST_FOREACH_END(bridge
);
860 /** Return a smartlist containing all bridge identity digests */
861 MOCK_IMPL(smartlist_t
*,
862 list_bridge_identities
, (void))
864 smartlist_t
*result
= NULL
;
867 if (get_options()->UseBridges
&& bridge_list
) {
868 result
= smartlist_new();
870 SMARTLIST_FOREACH_BEGIN(bridge_list
, bridge_info_t
*, b
) {
871 digest_tmp
= tor_malloc(DIGEST_LEN
);
872 memcpy(digest_tmp
, b
->identity
, DIGEST_LEN
);
873 smartlist_add(result
, digest_tmp
);
874 } SMARTLIST_FOREACH_END(b
);
880 /** Get the download status for a bridge descriptor given its identity */
881 MOCK_IMPL(download_status_t
*,
882 get_bridge_dl_status_by_id
, (const char *digest
))
884 download_status_t
*dl
= NULL
;
886 if (digest
&& get_options()->UseBridges
&& bridge_list
) {
887 SMARTLIST_FOREACH_BEGIN(bridge_list
, bridge_info_t
*, b
) {
888 if (tor_memeq(digest
, b
->identity
, DIGEST_LEN
)) {
889 dl
= &(b
->fetch_status
);
892 } SMARTLIST_FOREACH_END(b
);
898 /** Release all storage held in bridges.c */
900 bridges_free_all(void)
903 smartlist_free(bridge_list
);