src/common/util.c

   1 /* Copyright (c) 2003, Roger Dingledine
   2  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
   3  * Copyright (c) 2007-2008, The Tor Project, Inc. */
   4 /* See LICENSE for licensing information */
   5
   6 /**
   7  * \file util.c
   8  * \brief Common functions for strings, IO, network, data structures,
   9  * process control.
  10  **/
  11
  12 /* This is required on rh7 to make strptime not complain.
  13  */
  14 #define _GNU_SOURCE
  15
  16 #include "orconfig.h"
  17 #include "util.h"
  18 #include "log.h"
  19 #include "crypto.h"
  20 #include "torint.h"
  21 #include "container.h"
  22 #include "address.h"
  23
  24 #ifdef MS_WINDOWS
  25 #include <io.h>
  26 #include <direct.h>
  27 #include <process.h>
  28 #else
  29 #include <dirent.h>
  30 #include <pwd.h>
  31 #endif
  32
  33 #ifdef HAVE_CTYPE_H
  34 #include <ctype.h>
  35 #endif
  36 #include <stdlib.h>
  37 #include <stdio.h>
  38 #include <string.h>
  39 #include <assert.h>
  40
  41 #ifdef HAVE_NETINET_IN_H
  42 #include <netinet/in.h>
  43 #endif
  44 #ifdef HAVE_ARPA_INET_H
  45 #include <arpa/inet.h>
  46 #endif
  47 #ifdef HAVE_ERRNO_H
  48 #include <errno.h>
  49 #endif
  50 #ifdef HAVE_SYS_SOCKET_H
  51 #include <sys/socket.h>
  52 #endif
  53 #ifdef HAVE_SYS_TIME_H
  54 #include <sys/time.h>
  55 #endif
  56 #ifdef HAVE_UNISTD_H
  57 #include <unistd.h>
  58 #endif
  59 #ifdef HAVE_SYS_STAT_H
  60 #include <sys/stat.h>
  61 #endif
  62 #ifdef HAVE_SYS_FCNTL_H
  63 #include <sys/fcntl.h>
  64 #endif
  65 #ifdef HAVE_FCNTL_H
  66 #include <fcntl.h>
  67 #endif
  68 #ifdef HAVE_TIME_H
  69 #include <time.h>
  70 #endif
  71 #ifdef HAVE_MALLOC_MALLOC_H
  72 #include <malloc/malloc.h>
  73 #endif
  74 #ifdef HAVE_MALLOC_H
  75 #ifndef OPENBSD
  76 /* OpenBSD has a malloc.h, but for our purposes, it only exists in order to
  77  * scold us for being so stupid as to autodetect its presence.  To be fair,
  78  * they've done this since 1996, when autoconf was only 5 years old. */
  79 #include <malloc.h>
  80 #endif
  81 #endif
  82 #ifdef HAVE_MALLOC_NP_H
  83 #include <malloc_np.h>
  84 #endif
  85
  86 /* =====
  87  * Memory management
  88  * ===== */
  89 #ifdef USE_DMALLOC
  90  #undef strndup
  91  #include <dmalloc.h>
  92  /* Macro to pass the extra dmalloc args to another function. */
  93  #define DMALLOC_FN_ARGS , file, line
  94
  95  #if defined(HAVE_DMALLOC_STRDUP)
  96  /* the dmalloc_strdup should be fine as defined */
  97  #elif defined(HAVE_DMALLOC_STRNDUP)
  98  #define dmalloc_strdup(file, line, string, xalloc_b) \
  99          dmalloc_strndup(file, line, (string), -1, xalloc_b)
 100  #else
 101  #error "No dmalloc_strdup or equivalent"
 102  #endif
 103
 104 #else /* not using dmalloc */
 105
 106  #define DMALLOC_FN_ARGS
 107 #endif
 108
 109 /** Allocate a chunk of <b>size</b> bytes of memory, and return a pointer to
 110  * result.  On error, log and terminate the process.  (Same as malloc(size),
 111  * but never returns NULL.)
 112  *
 113  * <b>file</b> and <b>line</b> are used if dmalloc is enabled, and
 114  * ignored otherwise.
 115  */
 116 void *
 117 _tor_malloc(size_t size DMALLOC_PARAMS)
 118 {
 119   void *result;
 120
 121 #ifndef MALLOC_ZERO_WORKS
 122   /* Some libc mallocs don't work when size==0. Override them. */
 123   if (size==0) {
 124     size=1;
 125   }
 126 #endif
 127
 128 #ifdef USE_DMALLOC
 129   result = dmalloc_malloc(file, line, size, DMALLOC_FUNC_MALLOC, 0, 0);
 130 #else
 131   result = malloc(size);
 132 #endif
 133
 134   if (PREDICT_UNLIKELY(result == NULL)) {
 135     log_err(LD_MM,"Out of memory on malloc(). Dying.");
 136     /* If these functions die within a worker process, they won't call
 137      * spawn_exit, but that's ok, since the parent will run out of memory soon
 138      * anyway. */
 139     exit(1);
 140   }
 141   return result;
 142 }
 143
 144 /** Allocate a chunk of <b>size</b> bytes of memory, fill the memory with
 145  * zero bytes, and return a pointer to the result.  Log and terminate
 146  * the process on error.  (Same as calloc(size,1), but never returns NULL.)
 147  */
 148 void *
 149 _tor_malloc_zero(size_t size DMALLOC_PARAMS)
 150 {
 151   /* You may ask yourself, "wouldn't it be smart to use calloc instead of
 152    * malloc+memset?  Perhaps libc's calloc knows some nifty optimization trick
 153    * we don't!"  Indeed it does, but its optimizations are only a big win when
 154    * we're allocating something very big (it knows if it just got the memory
 155    * from the OS in a pre-zeroed state).  We don't want to use tor_malloc_zero
 156    * for big stuff, so we don't bother with calloc. */
 157   void *result = _tor_malloc(size DMALLOC_FN_ARGS);
 158   memset(result, 0, size);
 159   return result;
 160 }
 161
 162 /** Change the size of the memory block pointed to by <b>ptr</b> to <b>size</b>
 163  * bytes long; return the new memory block.  On error, log and
 164  * terminate. (Like realloc(ptr,size), but never returns NULL.)
 165  */
 166 void *
 167 _tor_realloc(void *ptr, size_t size DMALLOC_PARAMS)
 168 {
 169   void *result;
 170
 171 #ifdef USE_DMALLOC
 172   result = dmalloc_realloc(file, line, ptr, size, DMALLOC_FUNC_REALLOC, 0);
 173 #else
 174   result = realloc(ptr, size);
 175 #endif
 176
 177   if (PREDICT_UNLIKELY(result == NULL)) {
 178     log_err(LD_MM,"Out of memory on realloc(). Dying.");
 179     exit(1);
 180   }
 181   return result;
 182 }
 183
 184 /** Return a newly allocated copy of the NUL-terminated string s. On
 185  * error, log and terminate.  (Like strdup(s), but never returns
 186  * NULL.)
 187  */
 188 char *
 189 _tor_strdup(const char *s DMALLOC_PARAMS)
 190 {
 191   char *dup;
 192   tor_assert(s);
 193
 194 #ifdef USE_DMALLOC
 195   dup = dmalloc_strdup(file, line, s, 0);
 196 #else
 197   dup = strdup(s);
 198 #endif
 199   if (PREDICT_UNLIKELY(dup == NULL)) {
 200     log_err(LD_MM,"Out of memory on strdup(). Dying.");
 201     exit(1);
 202   }
 203   return dup;
 204 }
 205
 206 /** Allocate and return a new string containing the first <b>n</b>
 207  * characters of <b>s</b>.  If <b>s</b> is longer than <b>n</b>
 208  * characters, only the first <b>n</b> are copied.  The result is
 209  * always NUL-terminated.  (Like strndup(s,n), but never returns
 210  * NULL.)
 211  */
 212 char *
 213 _tor_strndup(const char *s, size_t n DMALLOC_PARAMS)
 214 {
 215   char *dup;
 216   tor_assert(s);
 217   dup = _tor_malloc((n+1) DMALLOC_FN_ARGS);
 218   /* Performance note: Ordinarily we prefer strlcpy to strncpy.  But
 219    * this function gets called a whole lot, and platform strncpy is
 220    * much faster than strlcpy when strlen(s) is much longer than n.
 221    */
 222   strncpy(dup, s, n);
 223   dup[n]='\0';
 224   return dup;
 225 }
 226
 227 /** Allocate a chunk of <b>len</b> bytes, with the same contents as the
 228  * <b>len</b> bytes starting at <b>mem</b>. */
 229 void *
 230 _tor_memdup(const void *mem, size_t len DMALLOC_PARAMS)
 231 {
 232   char *dup;
 233   tor_assert(mem);
 234   dup = _tor_malloc(len DMALLOC_FN_ARGS);
 235   memcpy(dup, mem, len);
 236   return dup;
 237 }
 238
 239 /** Helper for places that need to take a function pointer to the right
 240  * spelling of "free()". */
 241 void
 242 _tor_free(void *mem)
 243 {
 244   tor_free(mem);
 245 }
 246
 247 #if defined(HAVE_MALLOC_GOOD_SIZE) && !defined(HAVE_MALLOC_GOOD_SIZE_PROTOTYPE)
 248 /* Some version of Mac OSX have malloc_good_size in their libc, but not
 249  * actually defined in malloc/malloc.h.  We detect this and work around it by
 250  * prototyping.
 251  */
 252 extern size_t malloc_good_size(size_t size);
 253 #endif
 254
 255 /** Allocate and return a chunk of memory of size at least *<b>size</b>, using
 256  * the same resources we would use to malloc *<b>sizep</b>.  Set *<b>sizep</b>
 257  * to the number of usable bytes in the chunk of memory. */
 258 void *
 259 _tor_malloc_roundup(size_t *sizep DMALLOC_PARAMS)
 260 {
 261 #ifdef HAVE_MALLOC_GOOD_SIZE
 262   *sizep = malloc_good_size(*sizep);
 263   return _tor_malloc(*sizep DMALLOC_FN_ARGS);
 264 #elif defined(HAVE_MALLOC_USABLE_SIZE) && !defined(USE_DMALLOC)
 265   void *result = _tor_malloc(*sizep DMALLOC_FN_ARGS);
 266   *sizep = malloc_usable_size(result);
 267   return result;
 268 #else
 269   return _tor_malloc(*sizep DMALLOC_FN_ARGS);
 270 #endif
 271 }
 272
 273 /** Call the platform malloc info function, and dump the results to the log at
 274  * level <b>severity</b>.  If no such function exists, do nothing. */
 275 void
 276 tor_log_mallinfo(int severity)
 277 {
 278 #ifdef HAVE_MALLINFO
 279   struct mallinfo mi;
 280   memset(&mi, 0, sizeof(mi));
 281   mi = mallinfo();
 282   log(severity, LD_MM,
 283       "mallinfo() said: arena=%d, ordblks=%d, smblks=%d, hblks=%d, "
 284       "hblkhd=%d, usmblks=%d, fsmblks=%d, uordblks=%d, fordblks=%d, "
 285       "keepcost=%d",
 286       mi.arena, mi.ordblks, mi.smblks, mi.hblks,
 287       mi.hblkhd, mi.usmblks, mi.fsmblks, mi.uordblks, mi.fordblks,
 288       mi.keepcost);
 289 #else
 290   (void)severity;
 291 #endif
 292 #ifdef USE_DMALLOC
 293   dmalloc_log_changed(0, /* Since the program started. */
 294                       1, /* Log info about non-freed pointers. */
 295                       0, /* Do not log info about freed pointers. */
 296                       0  /* Do not log individual pointers. */
 297                       );
 298 #endif
 299 }
 300
 301 /* =====
 302  * Math
 303  * ===== */
 304
 305 /** Returns floor(log2(u64)).  If u64 is 0, (incorrectly) returns 0. */
 306 int
 307 tor_log2(uint64_t u64)
 308 {
 309   int r = 0;
 310   if (u64 >= (U64_LITERAL(1)<<32)) {
 311     u64 >>= 32;
 312     r = 32;
 313   }
 314   if (u64 >= (U64_LITERAL(1)<<16)) {
 315     u64 >>= 16;
 316     r += 16;
 317   }
 318   if (u64 >= (U64_LITERAL(1)<<8)) {
 319     u64 >>= 8;
 320     r += 8;
 321   }
 322   if (u64 >= (U64_LITERAL(1)<<4)) {
 323     u64 >>= 4;
 324     r += 4;
 325   }
 326   if (u64 >= (U64_LITERAL(1)<<2)) {
 327     u64 >>= 2;
 328     r += 2;
 329   }
 330   if (u64 >= (U64_LITERAL(1)<<1)) {
 331     u64 >>= 1;
 332     r += 1;
 333   }
 334   return r;
 335 }
 336
 337 /** Return the power of 2 closest to <b>u64</b>. */
 338 uint64_t
 339 round_to_power_of_2(uint64_t u64)
 340 {
 341   int lg2 = tor_log2(u64);
 342   uint64_t low = U64_LITERAL(1) << lg2, high = U64_LITERAL(1) << (lg2+1);
 343   if (high - u64 < u64 - low)
 344     return high;
 345   else
 346     return low;
 347 }
 348
 349 /* =====
 350  * String manipulation
 351  * ===== */
 352
 353 /** Remove from the string <b>s</b> every character which appears in
 354  * <b>strip</b>. */
 355 void
 356 tor_strstrip(char *s, const char *strip)
 357 {
 358   char *read = s;
 359   while (*read) {
 360     if (strchr(strip, *read)) {
 361       ++read;
 362     } else {
 363       *s++ = *read++;
 364     }
 365   }
 366   *s = '\0';
 367 }
 368
 369 /** Return a pointer to a NUL-terminated hexadecimal string encoding
 370  * the first <b>fromlen</b> bytes of <b>from</b>. (fromlen must be \<= 32.) The
 371  * result does not need to be deallocated, but repeated calls to
 372  * hex_str will trash old results.
 373  */
 374 const char *
 375 hex_str(const char *from, size_t fromlen)
 376 {
 377   static char buf[65];
 378   if (fromlen>(sizeof(buf)-1)/2)
 379     fromlen = (sizeof(buf)-1)/2;
 380   base16_encode(buf,sizeof(buf),from,fromlen);
 381   return buf;
 382 }
 383
 384 /** Convert all alphabetic characters in the nul-terminated string <b>s</b> to
 385  * lowercase. */
 386 void
 387 tor_strlower(char *s)
 388 {
 389   while (*s) {
 390     *s = TOR_TOLOWER(*s);
 391     ++s;
 392   }
 393 }
 394
 395 /** Convert all alphabetic characters in the nul-terminated string <b>s</b> to
 396  * lowercase. */
 397 void
 398 tor_strupper(char *s)
 399 {
 400   while (*s) {
 401     *s = TOR_TOUPPER(*s);
 402     ++s;
 403   }
 404 }
 405
 406 /** Return 1 if every character in <b>s</b> is printable, else return 0.
 407  */
 408 int
 409 tor_strisprint(const char *s)
 410 {
 411   while (*s) {
 412     if (!TOR_ISPRINT(*s))
 413       return 0;
 414     s++;
 415   }
 416   return 1;
 417 }
 418
 419 /** Return 1 if no character in <b>s</b> is uppercase, else return 0.
 420  */
 421 int
 422 tor_strisnonupper(const char *s)
 423 {
 424   while (*s) {
 425     if (TOR_ISUPPER(*s))
 426       return 0;
 427     s++;
 428   }
 429   return 1;
 430 }
 431
 432 /** Compares the first strlen(s2) characters of s1 with s2.  Returns as for
 433  * strcmp.
 434  */
 435 int
 436 strcmpstart(const char *s1, const char *s2)
 437 {
 438   size_t n = strlen(s2);
 439   return strncmp(s1, s2, n);
 440 }
 441
 442 /** Compare the s1_len-byte string <b>s1</b> with <b>s2</b>,
 443  * without depending on a terminating nul in s1.  Sorting order is first by
 444  * length, then lexically; return values are as for strcmp.
 445  */
 446 int
 447 strcmp_len(const char *s1, const char *s2, size_t s1_len)
 448 {
 449   size_t s2_len = strlen(s2);
 450   if (s1_len < s2_len)
 451     return -1;
 452   if (s1_len > s2_len)
 453     return 1;
 454   return memcmp(s1, s2, s2_len);
 455 }
 456
 457 /** Compares the first strlen(s2) characters of s1 with s2.  Returns as for
 458  * strcasecmp.
 459  */
 460 int
 461 strcasecmpstart(const char *s1, const char *s2)
 462 {
 463   size_t n = strlen(s2);
 464   return strncasecmp(s1, s2, n);
 465 }
 466
 467 /** Compares the last strlen(s2) characters of s1 with s2.  Returns as for
 468  * strcmp.
 469  */
 470 int
 471 strcmpend(const char *s1, const char *s2)
 472 {
 473   size_t n1 = strlen(s1), n2 = strlen(s2);
 474   if (n2>n1)
 475     return strcmp(s1,s2);
 476   else
 477     return strncmp(s1+(n1-n2), s2, n2);
 478 }
 479
 480 /** Compares the last strlen(s2) characters of s1 with s2.  Returns as for
 481  * strcasecmp.
 482  */
 483 int
 484 strcasecmpend(const char *s1, const char *s2)
 485 {
 486   size_t n1 = strlen(s1), n2 = strlen(s2);
 487   if (n2>n1) /* then they can't be the same; figure out which is bigger */
 488     return strcasecmp(s1,s2);
 489   else
 490     return strncasecmp(s1+(n1-n2), s2, n2);
 491 }
 492
 493 /** Compare the value of the string <b>prefix</b> with the start of the
 494  * <b>memlen</b>-byte memory chunk at <b>mem</b>.  Return as for strcmp.
 495  *
 496  * [As memcmp(mem, prefix, strlen(prefix)) but returns -1 if memlen is less
 497  * than strlen(prefix).]
 498  */
 499 int
 500 memcmpstart(const void *mem, size_t memlen,
 501                 const char *prefix)
 502 {
 503   size_t plen = strlen(prefix);
 504   if (memlen < plen)
 505     return -1;
 506   return memcmp(mem, prefix, plen);
 507 }
 508
 509 /** Return a pointer to the first char of s that is not whitespace and
 510  * not a comment, or to the terminating NUL if no such character exists.
 511  */
 512 const char *
 513 eat_whitespace(const char *s)
 514 {
 515   tor_assert(s);
 516
 517   while (1) {
 518     switch (*s) {
 519     case '\0':
 520     default:
 521       return s;
 522     case ' ':
 523     case '\t':
 524     case '\n':
 525     case '\r':
 526       ++s;
 527       break;
 528     case '#':
 529       ++s;
 530       while (*s && *s != '\n')
 531         ++s;
 532     }
 533   }
 534 }
 535
 536 /** Return a pointer to the first char of s that is not whitespace and
 537  * not a comment, or to the terminating NUL if no such character exists.
 538  */
 539 const char *
 540 eat_whitespace_eos(const char *s, const char *eos)
 541 {
 542   tor_assert(s);
 543   tor_assert(eos && s <= eos);
 544
 545   while (s < eos) {
 546     switch (*s) {
 547     case '\0':
 548     default:
 549       return s;
 550     case ' ':
 551     case '\t':
 552     case '\n':
 553     case '\r':
 554       ++s;
 555       break;
 556     case '#':
 557       ++s;
 558       while (s < eos && *s && *s != '\n')
 559         ++s;
 560     }
 561   }
 562   return s;
 563 }
 564
 565 /** Return a pointer to the first char of s that is not a space or a tab
 566  * or a \\r, or to the terminating NUL if no such character exists. */
 567 const char *
 568 eat_whitespace_no_nl(const char *s)
 569 {
 570   while (*s == ' ' || *s == '\t' || *s == '\r')
 571     ++s;
 572   return s;
 573 }
 574
 575 /** As eat_whitespace_no_nl, but stop at <b>eos</b> whether we have
 576  * found a non-whitespace character or not. */
 577 const char *
 578 eat_whitespace_eos_no_nl(const char *s, const char *eos)
 579 {
 580   while (s < eos && (*s == ' ' || *s == '\t' || *s == '\r'))
 581     ++s;
 582   return s;
 583 }
 584
 585 /** Return a pointer to the first char of s that is whitespace or <b>#</b>,
 586  * or to the terminating NUL if no such character exists.
 587  */
 588 const char *
 589 find_whitespace(const char *s)
 590 {
 591   /* tor_assert(s); */
 592   while (1) {
 593     switch (*s)
 594     {
 595     case '\0':
 596     case '#':
 597     case ' ':
 598     case '\r':
 599     case '\n':
 600     case '\t':
 601       return s;
 602     default:
 603       ++s;
 604     }
 605   }
 606 }
 607
 608 /** As find_whitespace, but stop at <b>eos</b> whether we have found a
 609  * whitespace or not. */
 610 const char *
 611 find_whitespace_eos(const char *s, const char *eos)
 612 {
 613   /* tor_assert(s); */
 614   while (s < eos) {
 615     switch (*s)
 616     {
 617     case '\0':
 618     case '#':
 619     case ' ':
 620     case '\r':
 621     case '\n':
 622     case '\t':
 623       return s;
 624     default:
 625       ++s;
 626     }
 627   }
 628   return s;
 629 }
 630
 631 /** Return true iff the 'len' bytes at 'mem' are all zero. */
 632 int
 633 tor_mem_is_zero(const char *mem, size_t len)
 634 {
 635   static const char ZERO[] = {
 636     0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0,
 637   };
 638   while (len >= sizeof(ZERO)) {
 639     if (memcmp(mem, ZERO, sizeof(ZERO)))
 640       return 0;
 641     len -= sizeof(ZERO);
 642     mem += sizeof(ZERO);
 643   }
 644   /* Deal with leftover bytes. */
 645   if (len)
 646     return ! memcmp(mem, ZERO, len);
 647
 648   return 1;
 649 }
 650
 651 /** Return true iff the DIGEST_LEN bytes in digest are all zero. */
 652 int
 653 tor_digest_is_zero(const char *digest)
 654 {
 655   return tor_mem_is_zero(digest, DIGEST_LEN);
 656 }
 657
 658 /* Helper: common code to check whether the result of a strtol or strtoul or
 659  * strtoll is correct. */
 660 #define CHECK_STRTOX_RESULT()                           \
 661   /* Was at least one character converted? */           \
 662   if (endptr == s)                                      \
 663     goto err;                                           \
 664   /* Were there unexpected unconverted characters? */   \
 665   if (!next && *endptr)                                 \
 666     goto err;                                           \
 667   /* Is r within limits? */                             \
 668   if (r < min || r > max)                               \
 669     goto err;                                           \
 670   if (ok) *ok = 1;                                      \
 671   if (next) *next = endptr;                             \
 672   return r;                                             \
 673  err:                                                   \
 674   if (ok) *ok = 0;                                      \
 675   if (next) *next = endptr;                             \
 676   return 0
 677
 678 /** Extract a long from the start of s, in the given numeric base.  If
 679  * there is unconverted data and next is provided, set *next to the
 680  * first unconverted character.  An error has occurred if no characters
 681  * are converted; or if there are unconverted characters and next is NULL; or
 682  * if the parsed value is not between min and max.  When no error occurs,
 683  * return the parsed value and set *ok (if provided) to 1.  When an error
 684  * occurs, return 0 and set *ok (if provided) to 0.
 685  */
 686 long
 687 tor_parse_long(const char *s, int base, long min, long max,
 688                int *ok, char **next)
 689 {
 690   char *endptr;
 691   long r;
 692
 693   r = strtol(s, &endptr, base);
 694   CHECK_STRTOX_RESULT();
 695 }
 696
 697 /** As tor_parse_long(), but return an unsigned long. */
 698 unsigned long
 699 tor_parse_ulong(const char *s, int base, unsigned long min,
 700                 unsigned long max, int *ok, char **next)
 701 {
 702   char *endptr;
 703   unsigned long r;
 704
 705   r = strtoul(s, &endptr, base);
 706   CHECK_STRTOX_RESULT();
 707 }
 708
 709 /** As tor_parse_log, but return a unit64_t.  Only base 10 is guaranteed to
 710  * work for now. */
 711 uint64_t
 712 tor_parse_uint64(const char *s, int base, uint64_t min,
 713                  uint64_t max, int *ok, char **next)
 714 {
 715   char *endptr;
 716   uint64_t r;
 717
 718 #ifdef HAVE_STRTOULL
 719   r = (uint64_t)strtoull(s, &endptr, base);
 720 #elif defined(MS_WINDOWS)
 721 #if defined(_MSC_VER) && _MSC_VER < 1300
 722   tor_assert(base <= 10);
 723   r = (uint64_t)_atoi64(s);
 724   endptr = (char*)s;
 725   while (TOR_ISSPACE(*endptr)) endptr++;
 726   while (TOR_ISDIGIT(*endptr)) endptr++;
 727 #else
 728   r = (uint64_t)_strtoui64(s, &endptr, base);
 729 #endif
 730 #elif SIZEOF_LONG == 8
 731   r = (uint64_t)strtoul(s, &endptr, base);
 732 #else
 733 #error "I don't know how to parse 64-bit numbers."
 734 #endif
 735
 736   CHECK_STRTOX_RESULT();
 737 }
 738
 739 /** Encode the <b>srclen</b> bytes at <b>src</b> in a NUL-terminated,
 740  * uppercase hexadecimal string; store it in the <b>destlen</b>-byte buffer
 741  * <b>dest</b>.
 742  */
 743 void
 744 base16_encode(char *dest, size_t destlen, const char *src, size_t srclen)
 745 {
 746   const char *end;
 747   char *cp;
 748
 749   tor_assert(destlen >= srclen*2+1);
 750   tor_assert(destlen < SIZE_T_CEILING);
 751
 752   cp = dest;
 753   end = src+srclen;
 754   while (src<end) {
 755     *cp++ = "0123456789ABCDEF"[ (*(const uint8_t*)src) >> 4 ];
 756     *cp++ = "0123456789ABCDEF"[ (*(const uint8_t*)src) & 0xf ];
 757     ++src;
 758   }
 759   *cp = '\0';
 760 }
 761
 762 /** Helper: given a hex digit, return its value, or -1 if it isn't hex. */
 763 static INLINE int
 764 _hex_decode_digit(char c)
 765 {
 766   switch (c) {
 767     case '0': return 0;
 768     case '1': return 1;
 769     case '2': return 2;
 770     case '3': return 3;
 771     case '4': return 4;
 772     case '5': return 5;
 773     case '6': return 6;
 774     case '7': return 7;
 775     case '8': return 8;
 776     case '9': return 9;
 777     case 'A': case 'a': return 10;
 778     case 'B': case 'b': return 11;
 779     case 'C': case 'c': return 12;
 780     case 'D': case 'd': return 13;
 781     case 'E': case 'e': return 14;
 782     case 'F': case 'f': return 15;
 783     default:
 784       return -1;
 785   }
 786 }
 787
 788 /** Helper: given a hex digit, return its value, or -1 if it isn't hex. */
 789 int
 790 hex_decode_digit(char c)
 791 {
 792   return _hex_decode_digit(c);
 793 }
 794
 795 /** Given a hexadecimal string of <b>srclen</b> bytes in <b>src</b>, decode it
 796  * and store the result in the <b>destlen</b>-byte buffer at <b>dest</b>.
 797  * Return 0 on success, -1 on failure. */
 798 int
 799 base16_decode(char *dest, size_t destlen, const char *src, size_t srclen)
 800 {
 801   const char *end;
 802
 803   int v1,v2;
 804   if ((srclen % 2) != 0)
 805     return -1;
 806   if (destlen < srclen/2 || destlen > SIZE_T_CEILING)
 807     return -1;
 808   end = src+srclen;
 809   while (src<end) {
 810     v1 = _hex_decode_digit(*src);
 811     v2 = _hex_decode_digit(*(src+1));
 812     if (v1<0||v2<0)
 813       return -1;
 814     *(uint8_t*)dest = (v1<<4)|v2;
 815     ++dest;
 816     src+=2;
 817   }
 818   return 0;
 819 }
 820
 821 /** Allocate and return a new string representing the contents of <b>s</b>,
 822  * surrounded by quotes and using standard C escapes.
 823  *
 824  * Generally, we use this for logging values that come in over the network to
 825  * keep them from tricking users, and for sending certain values to the
 826  * controller.
 827  *
 828  * We trust values from the resolver, OS, configuration file, and command line
 829  * to not be maliciously ill-formed.  We validate incoming routerdescs and
 830  * SOCKS requests and addresses from BEGIN cells as they're parsed;
 831  * afterwards, we trust them as non-malicious.
 832  */
 833 char *
 834 esc_for_log(const char *s)
 835 {
 836   const char *cp;
 837   char *result, *outp;
 838   size_t len = 3;
 839   if (!s) {
 840     return tor_strdup("");
 841   }
 842
 843   for (cp = s; *cp; ++cp) {
 844     switch (*cp) {
 845       case '\\':
 846       case '\"':
 847       case '\'':
 848         len += 2;
 849         break;
 850       default:
 851         if (TOR_ISPRINT(*cp) && ((uint8_t)*cp)<127)
 852           ++len;
 853         else
 854           len += 4;
 855         break;
 856     }
 857   }
 858
 859   result = outp = tor_malloc(len);
 860   *outp++ = '\"';
 861   for (cp = s; *cp; ++cp) {
 862     switch (*cp) {
 863       case '\\':
 864       case '\"':
 865       case '\'':
 866         *outp++ = '\\';
 867         *outp++ = *cp;
 868         break;
 869       case '\n':
 870         *outp++ = '\\';
 871         *outp++ = 'n';
 872         break;
 873       case '\t':
 874         *outp++ = '\\';
 875         *outp++ = 't';
 876         break;
 877       case '\r':
 878         *outp++ = '\\';
 879         *outp++ = 'r';
 880         break;
 881       default:
 882         if (TOR_ISPRINT(*cp) && ((uint8_t)*cp)<127) {
 883           *outp++ = *cp;
 884         } else {
 885           tor_snprintf(outp, 5, "\\%03o", (int)(uint8_t) *cp);
 886           outp += 4;
 887         }
 888         break;
 889     }
 890   }
 891
 892   *outp++ = '\"';
 893   *outp++ = 0;
 894
 895   return result;
 896 }
 897
 898 /** Allocate and return a new string representing the contents of <b>s</b>,
 899  * surrounded by quotes and using standard C escapes.
 900  *
 901  * THIS FUNCTION IS NOT REENTRANT.  Don't call it from outside the main
 902  * thread.  Also, each call invalidates the last-returned value, so don't
 903  * try log_warn(LD_GENERAL, "%s %s", escaped(a), escaped(b));
 904  */
 905 const char *
 906 escaped(const char *s)
 907 {
 908   static char *_escaped_val = NULL;
 909   if (_escaped_val)
 910     tor_free(_escaped_val);
 911
 912   if (s)
 913     _escaped_val = esc_for_log(s);
 914   else
 915     _escaped_val = NULL;
 916
 917   return _escaped_val;
 918 }
 919
 920 /** Rudimentary string wrapping code: given a un-wrapped <b>string</b> (no
 921  * newlines!), break the string into newline-terminated lines of no more than
 922  * <b>width</b> characters long (not counting newline) and insert them into
 923  * <b>out</b> in order.  Precede the first line with prefix0, and subsequent
 924  * lines with prefixRest.
 925  */
 926 /* This uses a stupid greedy wrapping algorithm right now:
 927  *  - For each line:
 928  *    - Try to fit as much stuff as possible, but break on a space.
 929  *    - If the first "word" of the line will extend beyond the allowable
 930  *      width, break the word at the end of the width.
 931  */
 932 void
 933 wrap_string(smartlist_t *out, const char *string, size_t width,
 934             const char *prefix0, const char *prefixRest)
 935 {
 936   size_t p0Len, pRestLen, pCurLen;
 937   const char *eos, *prefixCur;
 938   tor_assert(out);
 939   tor_assert(string);
 940   tor_assert(width);
 941   if (!prefix0)
 942     prefix0 = "";
 943   if (!prefixRest)
 944     prefixRest = "";
 945
 946   p0Len = strlen(prefix0);
 947   pRestLen = strlen(prefixRest);
 948   tor_assert(width > p0Len && width > pRestLen);
 949   eos = strchr(string, '\0');
 950   tor_assert(eos);
 951   pCurLen = p0Len;
 952   prefixCur = prefix0;
 953
 954   while ((eos-string)+pCurLen > width) {
 955     const char *eol = string + width - pCurLen;
 956     while (eol > string && *eol != ' ')
 957       --eol;
 958     /* eol is now the last space that can fit, or the start of the string. */
 959     if (eol > string) {
 960       size_t line_len = (eol-string) + pCurLen + 2;
 961       char *line = tor_malloc(line_len);
 962       memcpy(line, prefixCur, pCurLen);
 963       memcpy(line+pCurLen, string, eol-string);
 964       line[line_len-2] = '\n';
 965       line[line_len-1] = '\0';
 966       smartlist_add(out, line);
 967       string = eol + 1;
 968     } else {
 969       size_t line_len = width + 2;
 970       char *line = tor_malloc(line_len);
 971       memcpy(line, prefixCur, pCurLen);
 972       memcpy(line+pCurLen, string, width - pCurLen);
 973       line[line_len-2] = '\n';
 974       line[line_len-1] = '\0';
 975       smartlist_add(out, line);
 976       string += width-pCurLen;
 977     }
 978     prefixCur = prefixRest;
 979     pCurLen = pRestLen;
 980   }
 981
 982   if (string < eos) {
 983     size_t line_len = (eos-string) + pCurLen + 2;
 984     char *line = tor_malloc(line_len);
 985     memcpy(line, prefixCur, pCurLen);
 986     memcpy(line+pCurLen, string, eos-string);
 987     line[line_len-2] = '\n';
 988     line[line_len-1] = '\0';
 989     smartlist_add(out, line);
 990   }
 991 }
 992
 993 /* =====
 994  * Time
 995  * ===== */
 996
 997 /** Return the number of microseconds elapsed between *start and *end.
 998  */
 999 long
1000 tv_udiff(const struct timeval *start, const struct timeval *end)
1001 {
1002   long udiff;
1003   long secdiff = end->tv_sec - start->tv_sec;
1004
1005   if (labs(secdiff+1) > LONG_MAX/1000000) {
1006     log_warn(LD_GENERAL, "comparing times too far apart.");
1007     return LONG_MAX;
1008   }
1009
1010   udiff = secdiff*1000000L + (end->tv_usec - start->tv_usec);
1011   return udiff;
1012 }
1013
1014 /** Yield true iff <b>y</b> is a leap-year. */
1015 #define IS_LEAPYEAR(y) (!(y % 4) && ((y % 100) || !(y % 400)))
1016 /** Helper: Return the number of leap-days between Jan 1, y1 and Jan 1, y2. */
1017 static int
1018 n_leapdays(int y1, int y2)
1019 {
1020   --y1;
1021   --y2;
1022   return (y2/4 - y1/4) - (y2/100 - y1/100) + (y2/400 - y1/400);
1023 }
1024 /** Number of days per month in non-leap year; used by tor_timegm. */
1025 static const int days_per_month[] =
1026   { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31};
1027
1028 /** Return a time_t given a struct tm.  The result is given in GMT, and
1029  * does not account for leap seconds.
1030  */
1031 time_t
1032 tor_timegm(struct tm *tm)
1033 {
1034   /* This is a pretty ironclad timegm implementation, snarfed from Python2.2.
1035    * It's way more brute-force than fiddling with tzset().
1036    */
1037   time_t ret;
1038   unsigned long year, days, hours, minutes;
1039   int i;
1040   year = tm->tm_year + 1900;
1041   if (year < 1970 || tm->tm_mon < 0 || tm->tm_mon > 11) {
1042     log_warn(LD_BUG, "Out-of-range argument to tor_timegm");
1043     return -1;
1044   }
1045   tor_assert(year < INT_MAX);
1046   days = 365 * (year-1970) + n_leapdays(1970,(int)year);
1047   for (i = 0; i < tm->tm_mon; ++i)
1048     days += days_per_month[i];
1049   if (tm->tm_mon > 1 && IS_LEAPYEAR(year))
1050     ++days;
1051   days += tm->tm_mday - 1;
1052   hours = days*24 + tm->tm_hour;
1053
1054   minutes = hours*60 + tm->tm_min;
1055   ret = minutes*60 + tm->tm_sec;
1056   return ret;
1057 }
1058
1059 /* strftime is locale-specific, so we need to replace those parts */
1060
1061 /** A c-locale array of 3-letter names of weekdays, starting with Sun. */
1062 static const char *WEEKDAY_NAMES[] =
1063   { "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat" };
1064 /** A c-locale array of 3-letter names of months, starting with Jan. */
1065 static const char *MONTH_NAMES[] =
1066   { "Jan", "Feb", "Mar", "Apr", "May", "Jun",
1067     "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
1068
1069 /** Set <b>buf</b> to the RFC1123 encoding of the GMT value of <b>t</b>.
1070  * The buffer must be at least RFC1123_TIME_LEN+1 bytes long.
1071  *
1072  * (RFC1123 format is Fri, 29 Sep 2006 15:54:20 GMT)
1073  */
1074 void
1075 format_rfc1123_time(char *buf, time_t t)
1076 {
1077   struct tm tm;
1078
1079   tor_gmtime_r(&t, &tm);
1080
1081   strftime(buf, RFC1123_TIME_LEN+1, "___, %d ___ %Y %H:%M:%S GMT", &tm);
1082   tor_assert(tm.tm_wday >= 0);
1083   tor_assert(tm.tm_wday <= 6);
1084   memcpy(buf, WEEKDAY_NAMES[tm.tm_wday], 3);
1085   tor_assert(tm.tm_wday >= 0);
1086   tor_assert(tm.tm_mon <= 11);
1087   memcpy(buf+8, MONTH_NAMES[tm.tm_mon], 3);
1088 }
1089
1090 /** Parse the the RFC1123 encoding of some time (in GMT) from <b>buf</b>,
1091  * and store the result in *<b>t</b>.
1092  *
1093  * Return 0 on succcess, -1 on failure.
1094 */
1095 int
1096 parse_rfc1123_time(const char *buf, time_t *t)
1097 {
1098   struct tm tm;
1099   char month[4];
1100   char weekday[4];
1101   int i, m;
1102
1103   if (strlen(buf) != RFC1123_TIME_LEN)
1104     return -1;
1105   memset(&tm, 0, sizeof(tm));
1106   if (sscanf(buf, "%3s, %d %3s %d %d:%d:%d GMT", weekday,
1107              &tm.tm_mday, month, &tm.tm_year, &tm.tm_hour,
1108              &tm.tm_min, &tm.tm_sec) < 7) {
1109     char *esc = esc_for_log(buf);
1110     log_warn(LD_GENERAL, "Got invalid RFC1123 time %s", esc);
1111     tor_free(esc);
1112     return -1;
1113   }
1114
1115   m = -1;
1116   for (i = 0; i < 12; ++i) {
1117     if (!strcmp(month, MONTH_NAMES[i])) {
1118       m = i;
1119       break;
1120     }
1121   }
1122   if (m<0) {
1123     char *esc = esc_for_log(buf);
1124     log_warn(LD_GENERAL, "Got invalid RFC1123 time %s: No such month", esc);
1125     tor_free(esc);
1126     return -1;
1127   }
1128   tm.tm_mon = m;
1129
1130   if (tm.tm_year < 1970) {
1131     char *esc = esc_for_log(buf);
1132     log_warn(LD_GENERAL,
1133              "Got invalid RFC1123 time %s. (Before 1970)", esc);
1134     tor_free(esc);
1135     return -1;
1136   }
1137   tm.tm_year -= 1900;
1138
1139   *t = tor_timegm(&tm);
1140   return 0;
1141 }
1142
1143 /** Set <b>buf</b> to the ISO8601 encoding of the local value of <b>t</b>.
1144  * The buffer must be at least ISO_TIME_LEN+1 bytes long.
1145  *
1146  * (ISO8601 format is 2006-10-29 10:57:20)
1147  */
1148 void
1149 format_local_iso_time(char *buf, time_t t)
1150 {
1151   struct tm tm;
1152   strftime(buf, ISO_TIME_LEN+1, "%Y-%m-%d %H:%M:%S", tor_localtime_r(&t, &tm));
1153 }
1154
1155 /** Set <b>buf</b> to the ISO8601 encoding of the GMT value of <b>t</b>.
1156  * The buffer must be at least ISO_TIME_LEN+1 bytes long.
1157  */
1158 void
1159 format_iso_time(char *buf, time_t t)
1160 {
1161   struct tm tm;
1162   strftime(buf, ISO_TIME_LEN+1, "%Y-%m-%d %H:%M:%S", tor_gmtime_r(&t, &tm));
1163 }
1164
1165 /** Given an ISO-formatted UTC time value (after the epoch) in <b>cp</b>,
1166  * parse it and store its value in *<b>t</b>.  Return 0 on success, -1 on
1167  * failure.  Ignore extraneous stuff in <b>cp</b> separated by whitespace from
1168  * the end of the time string. */
1169 int
1170 parse_iso_time(const char *cp, time_t *t)
1171 {
1172   struct tm st_tm;
1173 #ifdef HAVE_STRPTIME
1174   if (!strptime(cp, "%Y-%m-%d %H:%M:%S", &st_tm)) {
1175     log_warn(LD_GENERAL, "ISO time was unparseable by strptime"); return -1;
1176   }
1177 #else
1178   unsigned int year=0, month=0, day=0, hour=100, minute=100, second=100;
1179   if (sscanf(cp, "%u-%u-%u %u:%u:%u", &year, &month,
1180                 &day, &hour, &minute, &second) < 6) {
1181     log_warn(LD_GENERAL, "ISO time was unparseable"); return -1;
1182   }
1183   if (year < 1970 || month < 1 || month > 12 || day < 1 || day > 31 ||
1184           hour > 23 || minute > 59 || second > 61) {
1185     log_warn(LD_GENERAL, "ISO time was nonsensical"); return -1;
1186   }
1187   st_tm.tm_year = year-1900;
1188   st_tm.tm_mon = month-1;
1189   st_tm.tm_mday = day;
1190   st_tm.tm_hour = hour;
1191   st_tm.tm_min = minute;
1192   st_tm.tm_sec = second;
1193 #endif
1194   if (st_tm.tm_year < 70) {
1195     char *esc = esc_for_log(cp);
1196     log_warn(LD_GENERAL, "Got invalid ISO time %s. (Before 1970)", esc);
1197     tor_free(esc);
1198     return -1;
1199   }
1200   *t = tor_timegm(&st_tm);
1201   return 0;
1202 }
1203
1204 /** Given a <b>date</b> in one of the three formats allowed by HTTP (ugh),
1205  * parse it into <b>tm</b>.  Return 0 on success, negative on failure. */
1206 int
1207 parse_http_time(const char *date, struct tm *tm)
1208 {
1209   const char *cp;
1210   char month[4];
1211   char wkday[4];
1212   int i;
1213
1214   tor_assert(tm);
1215   memset(tm, 0, sizeof(*tm));
1216
1217   /* First, try RFC1123 or RFC850 format: skip the weekday.  */
1218   if ((cp = strchr(date, ','))) {
1219     ++cp;
1220     if (sscanf(date, "%2d %3s %4d %2d:%2d:%2d GMT",
1221                &tm->tm_mday, month, &tm->tm_year,
1222                &tm->tm_hour, &tm->tm_min, &tm->tm_sec) == 6) {
1223       /* rfc1123-date */
1224       tm->tm_year -= 1900;
1225     } else if (sscanf(date, "%2d-%3s-%2d %2d:%2d:%2d GMT",
1226                       &tm->tm_mday, month, &tm->tm_year,
1227                       &tm->tm_hour, &tm->tm_min, &tm->tm_sec) == 6) {
1228       /* rfc850-date */
1229     } else {
1230       return -1;
1231     }
1232   } else {
1233     /* No comma; possibly asctime() format. */
1234     if (sscanf(date, "%3s %3s %2d %2d:%2d:%2d %4d",
1235                wkday, month, &tm->tm_mday,
1236                &tm->tm_hour, &tm->tm_min, &tm->tm_sec, &tm->tm_year) == 7) {
1237       tm->tm_year -= 1900;
1238     } else {
1239       return -1;
1240     }
1241   }
1242
1243   month[3] = '\0';
1244   /* Okay, now decode the month. */
1245   for (i = 0; i < 12; ++i) {
1246     if (!strcasecmp(MONTH_NAMES[i], month)) {
1247       tm->tm_mon = i+1;
1248     }
1249   }
1250
1251   if (tm->tm_year < 0 ||
1252       tm->tm_mon < 1  || tm->tm_mon > 12 ||
1253       tm->tm_mday < 0 || tm->tm_mday > 31 ||
1254       tm->tm_hour < 0 || tm->tm_hour > 23 ||
1255       tm->tm_min < 0  || tm->tm_min > 59 ||
1256       tm->tm_sec < 0  || tm->tm_sec > 61)
1257     return -1; /* Out of range, or bad month. */
1258
1259   return 0;
1260 }
1261
1262 /** Given an <b>interval</b> in seconds, try to write it to the
1263  * <b>out_len</b>-byte buffer in <b>out</b> in a human-readable form.
1264  * Return 0 on success, -1 on failure.
1265  */
1266 int
1267 format_time_interval(char *out, size_t out_len, long interval)
1268 {
1269   /* We only report seconds if there's no hours. */
1270   long sec = 0, min = 0, hour = 0, day = 0;
1271   if (interval < 0)
1272     interval = -interval;
1273
1274   if (interval >= 86400) {
1275     day = interval / 86400;
1276     interval %= 86400;
1277   }
1278   if (interval >= 3600) {
1279     hour = interval / 3600;
1280     interval %= 3600;
1281   }
1282   if (interval >= 60) {
1283     min = interval / 60;
1284     interval %= 60;
1285   }
1286   sec = interval;
1287
1288   if (day) {
1289     return tor_snprintf(out, out_len, "%ld days, %ld hours, %ld minutes",
1290                         day, hour, min);
1291   } else if (hour) {
1292     return tor_snprintf(out, out_len, "%ld hours, %ld minutes", hour, min);
1293   } else if (min) {
1294     return tor_snprintf(out, out_len, "%ld minutes, %ld seconds", min, sec);
1295   } else {
1296     return tor_snprintf(out, out_len, "%ld seconds", sec);
1297   }
1298 }
1299
1300 /* =====
1301  * Cached time
1302  * ===== */
1303
1304 #ifndef TIME_IS_FAST
1305 /** Cached estimate of the currrent time.  Updated around once per second;
1306  * may be a few seconds off if we are really busy.  This is a hack to avoid
1307  * calling time(NULL) (which not everybody has optimized) on critical paths.
1308  */
1309 static time_t cached_approx_time = 0;
1310
1311 /** Return a cached estimate of the current time from when
1312  * update_approx_time() was last called.  This is a hack to avoid calling
1313  * time(NULL) on critical paths: please do not even think of calling it
1314  * anywhere else. */
1315 time_t
1316 approx_time(void)
1317 {
1318   return cached_approx_time;
1319 }
1320
1321 /** Update the cached estimate of the current time.  This function SHOULD be
1322  * called once per second, and MUST be called before the first call to
1323  * get_approx_time. */
1324 void
1325 update_approx_time(time_t now)
1326 {
1327   cached_approx_time = now;
1328 }
1329 #endif
1330
1331 /* =====
1332  * Fuzzy time
1333  * XXXX022 Use this consistently or rip most of it out.
1334  * ===== */
1335
1336 /* In a perfect world, everybody would run ntp, and ntp would be perfect, so
1337  * if we wanted to know "Is the current time before time X?" we could just say
1338  * "time(NULL) < X".
1339  *
1340  * But unfortunately, many users are running Tor in an imperfect world, on
1341  * even more imperfect computers.  Hence, we need to track time oddly.  We
1342  * model the user's computer as being "skewed" from accurate time by
1343  * -<b>ftime_skew</b> seconds, such that our best guess of the current time is
1344  * time(NULL)+ftime_skew.  We also assume that our measurements of time may
1345  * have up to <b>ftime_slop</b> seconds of inaccuracy; IOW, our window of
1346  * estimate for the current time is now + ftime_skew +/- ftime_slop.
1347  */
1348 /** Our current estimate of our skew, such that we think the current time is
1349  * closest to time(NULL)+ftime_skew. */
1350 static int ftime_skew = 0;
1351 /** Tolerance during time comparisons, in seconds. */
1352 static int ftime_slop = 60;
1353 /** Set the largest amount of sloppiness we'll allow in fuzzy time
1354  * comparisons. */
1355 void
1356 ftime_set_maximum_sloppiness(int seconds)
1357 {
1358   tor_assert(seconds >= 0);
1359   ftime_slop = seconds;
1360 }
1361 /** Set the amount by which we believe our system clock to differ from
1362  * real time. */
1363 void
1364 ftime_set_estimated_skew(int seconds)
1365 {
1366   ftime_skew = seconds;
1367 }
1368 #if 0
1369 void
1370 ftime_get_window(time_t now, ftime_t *ft_out)
1371 {
1372   ft_out->earliest = now + ftime_skew - ftime_slop;
1373   ft_out->latest =  now + ftime_skew + ftime_slop;
1374 }
1375 #endif
1376 /** Return true iff we think that <b>now</b> might be after <b>when</b>. */
1377 int
1378 ftime_maybe_after(time_t now, time_t when)
1379 {
1380   /* It may be after when iff the latest possible current time is after when */
1381   return (now + ftime_skew + ftime_slop) >= when;
1382 }
1383 /** Return true iff we think that <b>now</b> might be before <b>when</b>. */
1384 int
1385 ftime_maybe_before(time_t now, time_t when)
1386 {
1387   /* It may be before when iff the earliest possible current time is before */
1388   return (now + ftime_skew - ftime_slop) < when;
1389 }
1390 /** Return true if we think that <b>now</b> is definitely after <b>when</b>. */
1391 int
1392 ftime_definitely_after(time_t now, time_t when)
1393 {
1394   /* It is definitely after when if the earliest time it could be is still
1395    * after when. */
1396   return (now + ftime_skew - ftime_slop) >= when;
1397 }
1398 /** Return true if we think that <b>now</b> is definitely before <b>when</b>.
1399  */
1400 int
1401 ftime_definitely_before(time_t now, time_t when)
1402 {
1403   /* It is definitely before when if the latest time it could be is still
1404    * before when. */
1405   return (now + ftime_skew + ftime_slop) < when;
1406 }
1407
1408 /* =====
1409  * File helpers
1410  * ===== */
1411
1412 /** Write <b>count</b> bytes from <b>buf</b> to <b>fd</b>.  <b>isSocket</b>
1413  * must be 1 if fd was returned by socket() or accept(), and 0 if fd
1414  * was returned by open().  Return the number of bytes written, or -1
1415  * on error.  Only use if fd is a blocking fd.  */
1416 ssize_t
1417 write_all(int fd, const char *buf, size_t count, int isSocket)
1418 {
1419   size_t written = 0;
1420   ssize_t result;
1421   tor_assert(count < SSIZE_T_MAX);
1422
1423   while (written != count) {
1424     if (isSocket)
1425       result = tor_socket_send(fd, buf+written, count-written, 0);
1426     else
1427       result = write(fd, buf+written, count-written);
1428     if (result<0)
1429       return -1;
1430     written += result;
1431   }
1432   return (ssize_t)count;
1433 }
1434
1435 /** Read from <b>fd</b> to <b>buf</b>, until we get <b>count</b> bytes
1436  * or reach the end of the file. <b>isSocket</b> must be 1 if fd
1437  * was returned by socket() or accept(), and 0 if fd was returned by
1438  * open().  Return the number of bytes read, or -1 on error. Only use
1439  * if fd is a blocking fd. */
1440 ssize_t
1441 read_all(int fd, char *buf, size_t count, int isSocket)
1442 {
1443   size_t numread = 0;
1444   ssize_t result;
1445
1446   if (count > SIZE_T_CEILING || count > SSIZE_T_MAX)
1447     return -1;
1448
1449   while (numread != count) {
1450     if (isSocket)
1451       result = tor_socket_recv(fd, buf+numread, count-numread, 0);
1452     else
1453       result = read(fd, buf+numread, count-numread);
1454     if (result<0)
1455       return -1;
1456     else if (result == 0)
1457       break;
1458     numread += result;
1459   }
1460   return (ssize_t)numread;
1461 }
1462
1463 /*
1464  *    Filesystem operations.
1465  */
1466
1467 /** Clean up <b>name</b> so that we can use it in a call to "stat".  On Unix,
1468  * we do nothing.  On Windows, we remove a trailing slash, unless the path is
1469  * the root of a disk. */
1470 static void
1471 clean_name_for_stat(char *name)
1472 {
1473 #ifdef MS_WINDOWS
1474   size_t len = strlen(name);
1475   if (!len)
1476     return;
1477   if (name[len-1]=='\\' || name[len-1]=='/') {
1478     if (len == 1 || (len==3 && name[1]==':'))
1479       return;
1480     name[len-1]='\0';
1481   }
1482 #else
1483   (void)name;
1484 #endif
1485 }
1486
1487 /** Return FN_ERROR if filename can't be read, FN_NOENT if it doesn't
1488  * exist, FN_FILE if it is a regular file, or FN_DIR if it's a
1489  * directory.  On FN_ERROR, sets errno. */
1490 file_status_t
1491 file_status(const char *fname)
1492 {
1493   struct stat st;
1494   char *f;
1495   int r;
1496   f = tor_strdup(fname);
1497   clean_name_for_stat(f);
1498   r = stat(f, &st);
1499   tor_free(f);
1500   if (r) {
1501     if (errno == ENOENT) {
1502       return FN_NOENT;
1503     }
1504     return FN_ERROR;
1505   }
1506   if (st.st_mode & S_IFDIR)
1507     return FN_DIR;
1508   else if (st.st_mode & S_IFREG)
1509     return FN_FILE;
1510   else
1511     return FN_ERROR;
1512 }
1513
1514 /** Check whether dirname exists and is private.  If yes return 0.  If
1515  * it does not exist, and check==CPD_CREATE is set, try to create it
1516  * and return 0 on success. If it does not exist, and
1517  * check==CPD_CHECK, and we think we can create it, return 0.  Else
1518  * return -1. */
1519 int
1520 check_private_dir(const char *dirname, cpd_check_t check)
1521 {
1522   int r;
1523   struct stat st;
1524   char *f;
1525   tor_assert(dirname);
1526   f = tor_strdup(dirname);
1527   clean_name_for_stat(f);
1528   r = stat(f, &st);
1529   tor_free(f);
1530   if (r) {
1531     if (errno != ENOENT) {
1532       log(LOG_WARN, LD_FS, "Directory %s cannot be read: %s", dirname,
1533           strerror(errno));
1534       return -1;
1535     }
1536     if (check == CPD_NONE) {
1537       log(LOG_WARN, LD_FS, "Directory %s does not exist.", dirname);
1538       return -1;
1539     } else if (check == CPD_CREATE) {
1540       log_info(LD_GENERAL, "Creating directory %s", dirname);
1541 #ifdef MS_WINDOWS
1542       r = mkdir(dirname);
1543 #else
1544       r = mkdir(dirname, 0700);
1545 #endif
1546       if (r) {
1547         log(LOG_WARN, LD_FS, "Error creating directory %s: %s", dirname,
1548             strerror(errno));
1549         return -1;
1550       }
1551     }
1552     /* XXXX In the case where check==CPD_CHECK, we should look at the
1553      * parent directory a little harder. */
1554     return 0;
1555   }
1556   if (!(st.st_mode & S_IFDIR)) {
1557     log(LOG_WARN, LD_FS, "%s is not a directory", dirname);
1558     return -1;
1559   }
1560 #ifndef MS_WINDOWS
1561   if (st.st_uid != getuid()) {
1562     struct passwd *pw = NULL;
1563     char *process_ownername = NULL;
1564
1565     pw = getpwuid(getuid());
1566     process_ownername = pw ? tor_strdup(pw->pw_name) : tor_strdup("<unknown>");
1567
1568     pw = getpwuid(st.st_uid);
1569
1570     log(LOG_WARN, LD_FS, "%s is not owned by this user (%s, %d) but by "
1571         "%s (%d). Perhaps you are running Tor as the wrong user?",
1572                          dirname, process_ownername, (int)getuid(),
1573                          pw ? pw->pw_name : "<unknown>", (int)st.st_uid);
1574
1575     tor_free(process_ownername);
1576     return -1;
1577   }
1578   if (st.st_mode & 0077) {
1579     log(LOG_WARN, LD_FS, "Fixing permissions on directory %s", dirname);
1580     if (chmod(dirname, 0700)) {
1581       log(LOG_WARN, LD_FS, "Could not chmod directory %s: %s", dirname,
1582           strerror(errno));
1583       return -1;
1584     } else {
1585       return 0;
1586     }
1587   }
1588 #endif
1589   return 0;
1590 }
1591
1592 /** Create a file named <b>fname</b> with the contents <b>str</b>.  Overwrite
1593  * the previous <b>fname</b> if possible.  Return 0 on success, -1 on failure.
1594  *
1595  * This function replaces the old file atomically, if possible.  This
1596  * function, and all other functions in util.c that create files, create them
1597  * with mode 0600.
1598  */
1599 int
1600 write_str_to_file(const char *fname, const char *str, int bin)
1601 {
1602 #ifdef MS_WINDOWS
1603   if (!bin && strchr(str, '\r')) {
1604     log_warn(LD_BUG,
1605              "We're writing a text string that already contains a CR.");
1606   }
1607 #endif
1608   return write_bytes_to_file(fname, str, strlen(str), bin);
1609 }
1610
1611 /** Represents a file that we're writing to, with support for atomic commit:
1612  * we can write into a a temporary file, and either remove the file on
1613  * failure, or replace the original file on success. */
1614 struct open_file_t {
1615   char *tempname; /**< Name of the temporary file. */
1616   char *filename; /**< Name of the original file. */
1617   int rename_on_close; /**< Are we using the temporary file or not? */
1618   int fd; /**< fd for the open file. */
1619   FILE *stdio_file; /**< stdio wrapper for <b>fd</b>. */
1620 };
1621
1622 /** Try to start writing to the file in <b>fname</b>, passing the flags
1623  * <b>open_flags</b> to the open() syscall, creating the file (if needed) with
1624  * access value <b>mode</b>.  If the O_APPEND flag is set, we append to the
1625  * original file.  Otherwise, we open a new temporary file in the same
1626  * directory, and either replace the original or remove the temporary file
1627  * when we're done.
1628  *
1629  * Return the fd for the newly opened file, and store working data in
1630  * *<b>data_out</b>.  The caller should not close the fd manually:
1631  * instead, call finish_writing_to_file() or abort_writing_to_file().
1632  * Returns -1 on failure.
1633  *
1634  * NOTE: When not appending, the flags O_CREAT and O_TRUNC are treated
1635  * as true and the flag O_EXCL is treated as false.
1636  *
1637  * NOTE: Ordinarily, O_APPEND means "seek to the end of the file before each
1638  * write()".  We don't do that.
1639  */
1640 int
1641 start_writing_to_file(const char *fname, int open_flags, int mode,
1642                       open_file_t **data_out)
1643 {
1644   size_t tempname_len = strlen(fname)+16;
1645   open_file_t *new_file = tor_malloc_zero(sizeof(open_file_t));
1646   const char *open_name;
1647   int append = 0;
1648
1649   tor_assert(fname);
1650   tor_assert(data_out);
1651 #if (O_BINARY != 0 && O_TEXT != 0)
1652   tor_assert((open_flags & (O_BINARY|O_TEXT)) != 0);
1653 #endif
1654   new_file->fd = -1;
1655   tor_assert(tempname_len > strlen(fname)); /*check for overflow*/
1656   new_file->filename = tor_strdup(fname);
1657   if (open_flags & O_APPEND) {
1658     open_name = fname;
1659     new_file->rename_on_close = 0;
1660     append = 1;
1661     open_flags &= ~O_APPEND;
1662   } else {
1663     open_name = new_file->tempname = tor_malloc(tempname_len);
1664     if (tor_snprintf(new_file->tempname, tempname_len, "%s.tmp", fname)<0) {
1665       log(LOG_WARN, LD_GENERAL, "Failed to generate filename");
1666       goto err;
1667     }
1668     /* We always replace an existing temporary file if there is one. */
1669     open_flags |= O_CREAT|O_TRUNC;
1670     open_flags &= ~O_EXCL;
1671     new_file->rename_on_close = 1;
1672   }
1673
1674   if ((new_file->fd = open(open_name, open_flags, mode)) < 0) {
1675     log(LOG_WARN, LD_FS, "Couldn't open \"%s\" (%s) for writing: %s",
1676         open_name, fname, strerror(errno));
1677     goto err;
1678   }
1679   if (append) {
1680     if (tor_fd_seekend(new_file->fd) < 0) {
1681       log_warn(LD_FS, "Couldn't seek to end of file \"%s\": %s", open_name,
1682                strerror(errno));
1683       goto err;
1684     }
1685   }
1686
1687   *data_out = new_file;
1688
1689   return new_file->fd;
1690
1691  err:
1692   if (new_file->fd >= 0)
1693     close(new_file->fd);
1694   *data_out = NULL;
1695   tor_free(new_file->filename);
1696   tor_free(new_file->tempname);
1697   tor_free(new_file);
1698   return -1;
1699 }
1700
1701 /** Given <b>file_data</b> from start_writing_to_file(), return a stdio FILE*
1702  * that can be used to write to the same file.  The caller should not mix
1703  * stdio calls with non-stdio calls. */
1704 FILE *
1705 fdopen_file(open_file_t *file_data)
1706 {
1707   tor_assert(file_data);
1708   if (file_data->stdio_file)
1709     return file_data->stdio_file;
1710   tor_assert(file_data->fd >= 0);
1711   if (!(file_data->stdio_file = fdopen(file_data->fd, "a"))) {
1712     log_warn(LD_FS, "Couldn't fdopen \"%s\" [%d]: %s", file_data->filename,
1713              file_data->fd, strerror(errno));
1714   }
1715   return file_data->stdio_file;
1716 }
1717
1718 /** Combines start_writing_to_file with fdopen_file(): arguments are as
1719  * for start_writing_to_file, but  */
1720 FILE *
1721 start_writing_to_stdio_file(const char *fname, int open_flags, int mode,
1722                             open_file_t **data_out)
1723 {
1724   FILE *res;
1725   if (start_writing_to_file(fname, open_flags, mode, data_out)<0)
1726     return NULL;
1727   if (!(res = fdopen_file(*data_out))) {
1728     abort_writing_to_file(*data_out);
1729     *data_out = NULL;
1730   }
1731   return res;
1732 }
1733
1734 /** Helper function: close and free the underlying file and memory in
1735  * <b>file_data</b>.  If we were writing into a temporary file, then delete
1736  * that file (if abort_write is true) or replaces the target file with
1737  * the temporary file (if abort_write is false). */
1738 static int
1739 finish_writing_to_file_impl(open_file_t *file_data, int abort_write)
1740 {
1741   int r = 0;
1742   tor_assert(file_data && file_data->filename);
1743   if (file_data->stdio_file) {
1744     if (fclose(file_data->stdio_file)) {
1745       log_warn(LD_FS, "Error closing \"%s\": %s", file_data->filename,
1746                strerror(errno));
1747       abort_write = r = -1;
1748     }
1749   } else if (file_data->fd >= 0 && close(file_data->fd) < 0) {
1750     log_warn(LD_FS, "Error flushing \"%s\": %s", file_data->filename,
1751              strerror(errno));
1752     abort_write = r = -1;
1753   }
1754
1755   if (file_data->rename_on_close) {
1756     tor_assert(file_data->tempname && file_data->filename);
1757     if (abort_write) {
1758       unlink(file_data->tempname);
1759     } else {
1760       tor_assert(strcmp(file_data->filename, file_data->tempname));
1761       if (replace_file(file_data->tempname, file_data->filename)) {
1762         log_warn(LD_FS, "Error replacing \"%s\": %s", file_data->filename,
1763                  strerror(errno));
1764         r = -1;
1765       }
1766     }
1767   }
1768
1769   tor_free(file_data->filename);
1770   tor_free(file_data->tempname);
1771   tor_free(file_data);
1772
1773   return r;
1774 }
1775
1776 /** Finish writing to <b>file_data</b>: close the file handle, free memory as
1777  * needed, and if using a temporary file, replace the original file with
1778  * the temporary file. */
1779 int
1780 finish_writing_to_file(open_file_t *file_data)
1781 {
1782   return finish_writing_to_file_impl(file_data, 0);
1783 }
1784
1785 /** Finish writing to <b>file_data</b>: close the file handle, free memory as
1786  * needed, and if using a temporary file, delete it. */
1787 int
1788 abort_writing_to_file(open_file_t *file_data)
1789 {
1790   return finish_writing_to_file_impl(file_data, 1);
1791 }
1792
1793 /** Helper: given a set of flags as passed to open(2), open the file
1794  * <b>fname</b> and write all the sized_chunk_t structs in <b>chunks</b> to
1795  * the file.  Do so as atomically as possible e.g. by opening temp files and
1796  * renaming. */
1797 static int
1798 write_chunks_to_file_impl(const char *fname, const smartlist_t *chunks,
1799                           int open_flags)
1800 {
1801   open_file_t *file = NULL;
1802   int fd, result;
1803   fd = start_writing_to_file(fname, open_flags, 0600, &file);
1804   if (fd<0)
1805     return -1;
1806   SMARTLIST_FOREACH(chunks, sized_chunk_t *, chunk,
1807   {
1808     result = write_all(fd, chunk->bytes, chunk->len, 0);
1809     if (result < 0) {
1810       log(LOG_WARN, LD_FS, "Error writing to \"%s\": %s", fname,
1811           strerror(errno));
1812       goto err;
1813     }
1814     tor_assert((size_t)result == chunk->len);
1815   });
1816
1817   return finish_writing_to_file(file);
1818  err:
1819   abort_writing_to_file(file);
1820   return -1;
1821 }
1822
1823 /** Given a smartlist of sized_chunk_t, write them atomically to a file
1824  * <b>fname</b>, overwriting or creating the file as necessary. */
1825 int
1826 write_chunks_to_file(const char *fname, const smartlist_t *chunks, int bin)
1827 {
1828   int flags = OPEN_FLAGS_REPLACE|(bin?O_BINARY:O_TEXT);
1829   return write_chunks_to_file_impl(fname, chunks, flags);
1830 }
1831
1832 /** As write_str_to_file, but does not assume a NUL-terminated
1833  * string. Instead, we write <b>len</b> bytes, starting at <b>str</b>. */
1834 int
1835 write_bytes_to_file(const char *fname, const char *str, size_t len,
1836                     int bin)
1837 {
1838   int flags = OPEN_FLAGS_REPLACE|(bin?O_BINARY:O_TEXT);
1839   int r;
1840   sized_chunk_t c = { str, len };
1841   smartlist_t *chunks = smartlist_create();
1842   smartlist_add(chunks, &c);
1843   r = write_chunks_to_file_impl(fname, chunks, flags);
1844   smartlist_free(chunks);
1845   return r;
1846 }
1847
1848 /** As write_bytes_to_file, but if the file already exists, append the bytes
1849  * to the end of the file instead of overwriting it. */
1850 int
1851 append_bytes_to_file(const char *fname, const char *str, size_t len,
1852                      int bin)
1853 {
1854   int flags = OPEN_FLAGS_APPEND|(bin?O_BINARY:O_TEXT);
1855   int r;
1856   sized_chunk_t c = { str, len };
1857   smartlist_t *chunks = smartlist_create();
1858   smartlist_add(chunks, &c);
1859   r = write_chunks_to_file_impl(fname, chunks, flags);
1860   smartlist_free(chunks);
1861   return r;
1862 }
1863
1864 /** Read the contents of <b>filename</b> into a newly allocated
1865  * string; return the string on success or NULL on failure.
1866  *
1867  * If <b>stat_out</b> is provided, store the result of stat()ing the
1868  * file into <b>stat_out</b>.
1869  *
1870  * If <b>flags</b> &amp; RFTS_BIN, open the file in binary mode.
1871  * If <b>flags</b> &amp; RFTS_IGNORE_MISSING, don't warn if the file
1872  * doesn't exist.
1873  */
1874 /*
1875  * This function <em>may</em> return an erroneous result if the file
1876  * is modified while it is running, but must not crash or overflow.
1877  * Right now, the error case occurs when the file length grows between
1878  * the call to stat and the call to read_all: the resulting string will
1879  * be truncated.
1880  */
1881 char *
1882 read_file_to_str(const char *filename, int flags, struct stat *stat_out)
1883 {
1884   int fd; /* router file */
1885   struct stat statbuf;
1886   char *string;
1887   int r;
1888   int bin = flags & RFTS_BIN;
1889
1890   tor_assert(filename);
1891
1892   fd = open(filename,O_RDONLY|(bin?O_BINARY:O_TEXT),0);
1893   if (fd<0) {
1894     int severity = LOG_WARN;
1895     int save_errno = errno;
1896     if (errno == ENOENT && (flags & RFTS_IGNORE_MISSING))
1897       severity = LOG_INFO;
1898     log_fn(severity, LD_FS,"Could not open \"%s\": %s ",filename,
1899            strerror(errno));
1900     errno = save_errno;
1901     return NULL;
1902   }
1903
1904   if (fstat(fd, &statbuf)<0) {
1905     int save_errno = errno;
1906     close(fd);
1907     log_warn(LD_FS,"Could not fstat \"%s\".",filename);
1908     errno = save_errno;
1909     return NULL;
1910   }
1911
1912   if ((uint64_t)(statbuf.st_size)+1 > SIZE_T_MAX)
1913     return NULL;
1914
1915   string = tor_malloc((size_t)(statbuf.st_size+1));
1916
1917   r = read_all(fd,string,(size_t)statbuf.st_size,0);
1918   if (r<0) {
1919     int save_errno = errno;
1920     log_warn(LD_FS,"Error reading from file \"%s\": %s", filename,
1921              strerror(errno));
1922     tor_free(string);
1923     close(fd);
1924     errno = save_errno;
1925     return NULL;
1926   }
1927   string[r] = '\0'; /* NUL-terminate the result. */
1928
1929 #ifdef MS_WINDOWS
1930   if (!bin && strchr(string, '\r')) {
1931     log_debug(LD_FS, "We didn't convert CRLF to LF as well as we hoped "
1932               "when reading %s. Coping.",
1933               filename);
1934     tor_strstrip(string, "\r");
1935     r = strlen(string);
1936   }
1937   if (!bin) {
1938     statbuf.st_size = (size_t) r;
1939   } else
1940 #endif
1941     if (r != statbuf.st_size) {
1942       /* Unless we're using text mode on win32, we'd better have an exact
1943        * match for size. */
1944       int save_errno = errno;
1945       log_warn(LD_FS,"Could read only %d of %ld bytes of file \"%s\".",
1946                r, (long)statbuf.st_size,filename);
1947       tor_free(string);
1948       close(fd);
1949       errno = save_errno;
1950       return NULL;
1951     }
1952   close(fd);
1953   if (stat_out) {
1954     memcpy(stat_out, &statbuf, sizeof(struct stat));
1955   }
1956
1957   return string;
1958 }
1959
1960 #define TOR_ISODIGIT(c) ('0' <= (c) && (c) <= '7')
1961
1962 /** Given a c-style double-quoted escaped string in <b>s</b>, extract and
1963  * decode its contents into a newly allocated string.  On success, assign this
1964  * string to *<b>result</b>, assign its length to <b>size_out</b> (if
1965  * provided), and return a pointer to the position in <b>s</b> immediately
1966  * after the string.  On failure, return NULL.
1967  */
1968 static const char *
1969 unescape_string(const char *s, char **result, size_t *size_out)
1970 {
1971   const char *cp;
1972   char *out;
1973   if (s[0] != '\"')
1974     return NULL;
1975   cp = s+1;
1976   while (1) {
1977     switch (*cp) {
1978       case '\0':
1979       case '\n':
1980         return NULL;
1981       case '\"':
1982         goto end_of_loop;
1983       case '\\':
1984         if ((cp[1] == 'x' || cp[1] == 'X')
1985             && TOR_ISXDIGIT(cp[2]) && TOR_ISXDIGIT(cp[3])) {
1986           cp += 4;
1987         } else if (TOR_ISODIGIT(cp[1])) {
1988           cp += 2;
1989           if (TOR_ISODIGIT(*cp)) ++cp;
1990           if (TOR_ISODIGIT(*cp)) ++cp;
1991         } else if (cp[1]) {
1992           cp += 2;
1993         } else {
1994           return NULL;
1995         }
1996         break;
1997       default:
1998         ++cp;
1999         break;
2000     }
2001   }
2002  end_of_loop:
2003   out = *result = tor_malloc(cp-s + 1);
2004   cp = s+1;
2005   while (1) {
2006     switch (*cp)
2007       {
2008       case '\"':
2009         *out = '\0';
2010         if (size_out) *size_out = out - *result;
2011         return cp+1;
2012       case '\0':
2013         tor_fragile_assert();
2014         tor_free(*result);
2015         return NULL;
2016       case '\\':
2017         switch (cp[1])
2018           {
2019           case 'n': *out++ = '\n'; cp += 2; break;
2020           case 'r': *out++ = '\r'; cp += 2; break;
2021           case 't': *out++ = '\t'; cp += 2; break;
2022           case 'x': case 'X':
2023             *out++ = ((hex_decode_digit(cp[2])<<4) +
2024                       hex_decode_digit(cp[3]));
2025             cp += 4;
2026             break;
2027           case '0': case '1': case '2': case '3': case '4': case '5':
2028           case '6': case '7':
2029             {
2030               int n = cp[1]-'0';
2031               cp += 2;
2032               if (TOR_ISODIGIT(*cp)) { n = n*8 + *cp-'0'; cp++; }
2033               if (TOR_ISODIGIT(*cp)) { n = n*8 + *cp-'0'; cp++; }
2034               if (n > 255) { tor_free(*result); return NULL; }
2035               *out++ = (char)n;
2036             }
2037             break;
2038           case '\'':
2039           case '\"':
2040           case '\\':
2041           case '\?':
2042             *out++ = cp[1];
2043             cp += 2;
2044             break;
2045           default:
2046             tor_free(*result); return NULL;
2047           }
2048         break;
2049       default:
2050         *out++ = *cp++;
2051       }
2052   }
2053 }
2054
2055 /** Given a string containing part of a configuration file or similar format,
2056  * advance past comments and whitespace and try to parse a single line.  If we
2057  * parse a line successfully, set *<b>key_out</b> to a new string holding the
2058  * key portion and *<b>value_out</b> to a new string holding the value portion
2059  * of the line, and return a pointer to the start of the next line.  If we run
2060  * out of data, return a pointer to the end of the string.  If we encounter an
2061  * error, return NULL.
2062  */
2063 const char *
2064 parse_config_line_from_str(const char *line, char **key_out, char **value_out)
2065 {
2066   const char *key, *val, *cp;
2067
2068   tor_assert(key_out);
2069   tor_assert(value_out);
2070
2071   *key_out = *value_out = NULL;
2072   key = val = NULL;
2073   /* Skip until the first keyword. */
2074   while (1) {
2075     while (TOR_ISSPACE(*line))
2076       ++line;
2077     if (*line == '#') {
2078       while (*line && *line != '\n')
2079         ++line;
2080     } else {
2081       break;
2082     }
2083   }
2084
2085   if (!*line) { /* End of string? */
2086     *key_out = *value_out = NULL;
2087     return line;
2088   }
2089
2090   /* Skip until the next space. */
2091   key = line;
2092   while (*line && !TOR_ISSPACE(*line) && *line != '#')
2093     ++line;
2094   *key_out = tor_strndup(key, line-key);
2095
2096   /* Skip until the value. */
2097   while (*line == ' ' || *line == '\t')
2098     ++line;
2099
2100   val = line;
2101
2102   /* Find the end of the line. */
2103   if (*line == '\"') {
2104     if (!(line = unescape_string(line, value_out, NULL)))
2105        return NULL;
2106     while (*line == ' ' || *line == '\t')
2107       ++line;
2108     if (*line && *line != '#' && *line != '\n')
2109       return NULL;
2110   } else {
2111     while (*line && *line != '\n' && *line != '#')
2112       ++line;
2113     if (*line == '\n') {
2114       cp = line++;
2115     } else {
2116       cp = line;
2117     }
2118     while (cp>val && TOR_ISSPACE(*(cp-1)))
2119       --cp;
2120
2121     tor_assert(cp >= val);
2122     *value_out = tor_strndup(val, cp-val);
2123   }
2124
2125   if (*line == '#') {
2126     do {
2127       ++line;
2128     } while (*line && *line != '\n');
2129   }
2130   while (TOR_ISSPACE(*line)) ++line;
2131
2132   return line;
2133 }
2134
2135 /** Expand any homedir prefix on <b>filename</b>; return a newly allocated
2136  * string. */
2137 char *
2138 expand_filename(const char *filename)
2139 {
2140   tor_assert(filename);
2141   if (*filename == '~') {
2142     size_t len;
2143     char *home, *result;
2144     const char *rest;
2145
2146     if (filename[1] == '/' || filename[1] == '\0') {
2147       home = getenv("HOME");
2148       if (!home) {
2149         log_warn(LD_CONFIG, "Couldn't find $HOME environment variable while "
2150                  "expanding \"%s\"", filename);
2151         return NULL;
2152       }
2153       home = tor_strdup(home);
2154       rest = strlen(filename)>=2?(filename+2):"";
2155     } else {
2156 #ifdef HAVE_PWD_H
2157       char *username, *slash;
2158       slash = strchr(filename, '/');
2159       if (slash)
2160         username = tor_strndup(filename+1,slash-filename-1);
2161       else
2162         username = tor_strdup(filename+1);
2163       if (!(home = get_user_homedir(username))) {
2164         log_warn(LD_CONFIG,"Couldn't get homedir for \"%s\"",username);
2165         tor_free(username);
2166         return NULL;
2167       }
2168       tor_free(username);
2169       rest = slash ? (slash+1) : "";
2170 #else
2171       log_warn(LD_CONFIG, "Couldn't expend homedir on system without pwd.h");
2172       return tor_strdup(filename);
2173 #endif
2174     }
2175     tor_assert(home);
2176     /* Remove trailing slash. */
2177     if (strlen(home)>1 && !strcmpend(home,PATH_SEPARATOR)) {
2178       home[strlen(home)-1] = '\0';
2179     }
2180     /* Plus one for /, plus one for NUL.
2181      * Round up to 16 in case we can't do math. */
2182     len = strlen(home)+strlen(rest)+16;
2183     result = tor_malloc(len);
2184     tor_snprintf(result,len,"%s"PATH_SEPARATOR"%s",home,rest);
2185     tor_free(home);
2186     return result;
2187   } else {
2188     return tor_strdup(filename);
2189   }
2190 }
2191
2192 /** Return a new list containing the filenames in the directory <b>dirname</b>.
2193  * Return NULL on error or if <b>dirname</b> is not a directory.
2194  */
2195 smartlist_t *
2196 tor_listdir(const char *dirname)
2197 {
2198   smartlist_t *result;
2199 #ifdef MS_WINDOWS
2200   char *pattern;
2201   HANDLE handle;
2202   WIN32_FIND_DATA findData;
2203   size_t pattern_len = strlen(dirname)+16;
2204   pattern = tor_malloc(pattern_len);
2205   tor_snprintf(pattern, pattern_len, "%s\\*", dirname);
2206   if (INVALID_HANDLE_VALUE == (handle = FindFirstFile(pattern, &findData))) {
2207     tor_free(pattern);
2208     return NULL;
2209   }
2210   result = smartlist_create();
2211   while (1) {
2212     if (strcmp(findData.cFileName, ".") &&
2213         strcmp(findData.cFileName, "..")) {
2214       smartlist_add(result, tor_strdup(findData.cFileName));
2215     }
2216     if (!FindNextFile(handle, &findData)) {
2217       DWORD err;
2218       if ((err = GetLastError()) != ERROR_NO_MORE_FILES) {
2219         char *errstr = format_win32_error(err);
2220         log_warn(LD_FS, "Error reading directory '%s': %s", dirname, errstr);
2221         tor_free(errstr);
2222       }
2223       break;
2224     }
2225   }
2226   FindClose(handle);
2227   tor_free(pattern);
2228 #else
2229   DIR *d;
2230   struct dirent *de;
2231   if (!(d = opendir(dirname)))
2232     return NULL;
2233
2234   result = smartlist_create();
2235   while ((de = readdir(d))) {
2236     if (!strcmp(de->d_name, ".") ||
2237         !strcmp(de->d_name, ".."))
2238       continue;
2239     smartlist_add(result, tor_strdup(de->d_name));
2240   }
2241   closedir(d);
2242 #endif
2243   return result;
2244 }
2245
2246 /** Return true iff <b>filename</b> is a relative path. */
2247 int
2248 path_is_relative(const char *filename)
2249 {
2250   if (filename && filename[0] == '/')
2251     return 0;
2252 #ifdef MS_WINDOWS
2253   else if (filename && filename[0] == '\\')
2254     return 0;
2255   else if (filename && strlen(filename)>3 && TOR_ISALPHA(filename[0]) &&
2256            filename[1] == ':' && filename[2] == '\\')
2257     return 0;
2258 #endif
2259   else
2260     return 1;
2261 }
2262
2263 /* =====
2264  * Process helpers
2265  * ===== */
2266
2267 #ifndef MS_WINDOWS
2268 /* Based on code contributed by christian grothoff */
2269 /** True iff we've called start_daemon(). */
2270 static int start_daemon_called = 0;
2271 /** True iff we've called finish_daemon(). */
2272 static int finish_daemon_called = 0;
2273 /** Socketpair used to communicate between parent and child process while
2274  * daemonizing. */
2275 static int daemon_filedes[2];
2276 /** Start putting the process into daemon mode: fork and drop all resources
2277  * except standard fds.  The parent process never returns, but stays around
2278  * until finish_daemon is called.  (Note: it's safe to call this more
2279  * than once: calls after the first are ignored.)
2280  */
2281 void
2282 start_daemon(void)
2283 {
2284   pid_t pid;
2285
2286   if (start_daemon_called)
2287     return;
2288   start_daemon_called = 1;
2289
2290   if (pipe(daemon_filedes)) {
2291     log_err(LD_GENERAL,"pipe failed; exiting. Error was %s", strerror(errno));
2292     exit(1);
2293   }
2294   pid = fork();
2295   if (pid < 0) {
2296     log_err(LD_GENERAL,"fork failed. Exiting.");
2297     exit(1);
2298   }
2299   if (pid) {  /* Parent */
2300     int ok;
2301     char c;
2302
2303     close(daemon_filedes[1]); /* we only read */
2304     ok = -1;
2305     while (0 < read(daemon_filedes[0], &c, sizeof(char))) {
2306       if (c == '.')
2307         ok = 1;
2308     }
2309     fflush(stdout);
2310     if (ok == 1)
2311       exit(0);
2312     else
2313       exit(1); /* child reported error */
2314   } else { /* Child */
2315     close(daemon_filedes[0]); /* we only write */
2316
2317     pid = setsid(); /* Detach from controlling terminal */
2318     /*
2319      * Fork one more time, so the parent (the session group leader) can exit.
2320      * This means that we, as a non-session group leader, can never regain a
2321      * controlling terminal.   This part is recommended by Stevens's
2322      * _Advanced Programming in the Unix Environment_.
2323      */
2324     if (fork() != 0) {
2325       exit(0);
2326     }
2327     return;
2328   }
2329 }
2330
2331 /** Finish putting the process into daemon mode: drop standard fds, and tell
2332  * the parent process to exit.  (Note: it's safe to call this more than once:
2333  * calls after the first are ignored.  Calls start_daemon first if it hasn't
2334  * been called already.)
2335  */
2336 void
2337 finish_daemon(const char *desired_cwd)
2338 {
2339   int nullfd;
2340   char c = '.';
2341   if (finish_daemon_called)
2342     return;
2343   if (!start_daemon_called)
2344     start_daemon();
2345   finish_daemon_called = 1;
2346
2347   if (!desired_cwd)
2348     desired_cwd = "/";
2349    /* Don't hold the wrong FS mounted */
2350   if (chdir(desired_cwd) < 0) {
2351     log_err(LD_GENERAL,"chdir to \"%s\" failed. Exiting.",desired_cwd);
2352     exit(1);
2353   }
2354
2355   nullfd = open("/dev/null", O_RDWR);
2356   if (nullfd < 0) {
2357     log_err(LD_GENERAL,"/dev/null can't be opened. Exiting.");
2358     exit(1);
2359   }
2360   /* close fds linking to invoking terminal, but
2361    * close usual incoming fds, but redirect them somewhere
2362    * useful so the fds don't get reallocated elsewhere.
2363    */
2364   if (dup2(nullfd,0) < 0 ||
2365       dup2(nullfd,1) < 0 ||
2366       dup2(nullfd,2) < 0) {
2367     log_err(LD_GENERAL,"dup2 failed. Exiting.");
2368     exit(1);
2369   }
2370   if (nullfd > 2)
2371     close(nullfd);
2372   /* signal success */
2373   if (write(daemon_filedes[1], &c, sizeof(char)) != sizeof(char)) {
2374     log_err(LD_GENERAL,"write failed. Exiting.");
2375   }
2376   close(daemon_filedes[1]);
2377 }
2378 #else
2379 /* defined(MS_WINDOWS) */
2380 void
2381 start_daemon(void)
2382 {
2383 }
2384 void
2385 finish_daemon(const char *cp)
2386 {
2387   (void)cp;
2388 }
2389 #endif
2390
2391 /** Write the current process ID, followed by NL, into <b>filename</b>.
2392  */
2393 void
2394 write_pidfile(char *filename)
2395 {
2396   FILE *pidfile;
2397
2398   if ((pidfile = fopen(filename, "w")) == NULL) {
2399     log_warn(LD_FS, "Unable to open \"%s\" for writing: %s", filename,
2400              strerror(errno));
2401   } else {
2402 #ifdef MS_WINDOWS
2403     fprintf(pidfile, "%d\n", (int)_getpid());
2404 #else
2405     fprintf(pidfile, "%d\n", (int)getpid());
2406 #endif
2407     fclose(pidfile);
2408   }
2409 }
2410