Comment-only change: annotate exit() calls.

Sometimes when we call exit(), it's because the process is
completely hopeless: openssl has a broken AES-CTR implementation, or
the clock is in the 1960s, or something like that.

But sometimes, we should return cleanly from tor_main() instead, so
that embedders can keep embedding us and start another Tor process.

I've gone through all the exit() and _exit() calls to annotate them
with "exit ok" or "XXXX bad exit" -- the next step will be to fix
the bad exit()s.

First step towards 23848.

8 files changed, 25 insertions, 25 deletions

diff --git a/src/or/config.c b/src/or/config.c
index 832a7c9674..55ab76c813 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -837,7 +837,7 @@ set_options(or_options_t *new_val, char **msg)
   if (options_act(old_options) < 0) { /* acting on the options failed. die. */
     log_err(LD_BUG,
             "Acting on config options left us in a broken state. Dying.");
-    exit(1);
+    exit(1); // XXXX bad exit
   }
   /* Issues a CONF_CHANGED event to notify controller of the change. If Tor is
    * just starting up then the old_options will be undefined. */
@@ -5008,22 +5008,22 @@ options_init_from_torrc(int argc, char **argv)
   if (config_line_find(cmdline_only_options, "-h") ||
       config_line_find(cmdline_only_options, "--help")) {
     print_usage();
-    exit(0);
+    exit(0); // XXXX bad exit, though probably harmless
   }
   if (config_line_find(cmdline_only_options, "--list-torrc-options")) {
     /* For validating whether we've documented everything. */
     list_torrc_options();
-    exit(0);
+    exit(0); // XXXX bad exit, though probably harmless
   }
   if (config_line_find(cmdline_only_options, "--list-deprecated-options")) {
     /* For validating whether what we have deprecated really exists. */
     list_deprecated_options();
-    exit(0);
+    exit(0); // XXXX bad exit, though probably harmless
   }
 
   if (config_line_find(cmdline_only_options, "--version")) {
     printf("Tor version %s.\n",get_version());
-    exit(0);
+    exit(0); // XXXX bad exit, though probably harmless
   }
 
   if (config_line_find(cmdline_only_options, "--library-versions")) {
@@ -5051,7 +5051,7 @@ options_init_from_torrc(int argc, char **argv)
                         tor_compress_header_version_str(ZSTD_METHOD));
     }
     //TODO: Hex versions?
-    exit(0);
+    exit(0); // XXXX bad exit, though probably harmless
   }
 
   command = CMD_RUN_TOR;
@@ -5112,7 +5112,7 @@ options_init_from_torrc(int argc, char **argv)
       get_options_mutable()->keygen_force_passphrase = FORCE_PASSPHRASE_OFF;
     } else {
       log_err(LD_CONFIG, "--no-passphrase specified without --keygen!");
-      exit(1);
+      exit(1); // XXXX bad exit
     }
   }
 
@@ -5121,7 +5121,7 @@ options_init_from_torrc(int argc, char **argv)
       get_options_mutable()->change_key_passphrase = 1;
     } else {
       log_err(LD_CONFIG, "--newpass specified without --keygen!");
-      exit(1);
+      exit(1); // XXXX bad exit
     }
   }
 
@@ -5131,17 +5131,17 @@ options_init_from_torrc(int argc, char **argv)
     if (fd_line) {
       if (get_options()->keygen_force_passphrase == FORCE_PASSPHRASE_OFF) {
         log_err(LD_CONFIG, "--no-passphrase specified with --passphrase-fd!");
-        exit(1);
+        exit(1); // XXXX bad exit
       } else if (command != CMD_KEYGEN) {
         log_err(LD_CONFIG, "--passphrase-fd specified without --keygen!");
-        exit(1);
+        exit(1); // XXXX bad exit
       } else {
         const char *v = fd_line->value;
         int ok = 1;
         long fd = tor_parse_long(v, 10, 0, INT_MAX, &ok, NULL);
         if (fd < 0 || ok == 0) {
           log_err(LD_CONFIG, "Invalid --passphrase-fd value %s", escaped(v));
-          exit(1);
+          exit(1); // XXXX bad exit
         }
         get_options_mutable()->keygen_passphrase_fd = (int)fd;
         get_options_mutable()->use_keygen_passphrase_fd = 1;
@@ -5156,7 +5156,7 @@ options_init_from_torrc(int argc, char **argv)
     if (key_line) {
       if (command != CMD_KEYGEN) {
         log_err(LD_CONFIG, "--master-key without --keygen!");
-        exit(1);
+        exit(1); // XXXX bad exit
       } else {
         get_options_mutable()->master_key_fname = tor_strdup(key_line->value);
       }
diff --git a/src/or/control.c b/src/or/control.c
index 8173cb1e56..ab164700e6 100644
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -6572,7 +6572,7 @@ monitor_owning_controller_process(const char *process_spec)
             msg);
     owning_controller_process_spec = NULL;
     tor_cleanup();
-    exit(1);
+    exit(1); // XXXX bad exit: or questionable, at least.
   }
 }
 
diff --git a/src/or/hibernate.c b/src/or/hibernate.c
index 74ab766468..be2bc7ce95 100644
--- a/src/or/hibernate.c
+++ b/src/or/hibernate.c
@@ -819,7 +819,7 @@ hibernate_begin(hibernate_state_t new_state, time_t now)
                hibernate_state == HIBERNATE_STATE_EXITING ?
                "a second time" : "while hibernating");
     tor_cleanup();
-    exit(0);
+    exit(0); // XXXX bad exit
   }
 
   if (new_state == HIBERNATE_STATE_LOWBANDWIDTH &&
@@ -981,7 +981,7 @@ consider_hibernation(time_t now)
     if (shutdown_time <= now) {
       log_notice(LD_GENERAL, "Clean shutdown finished. Exiting.");
       tor_cleanup();
-      exit(0);
+      exit(0); // XXXX bad exit
     }
     return; /* if exiting soon, don't worry about bandwidth limits */
   }
diff --git a/src/or/main.c b/src/or/main.c
index 65b0b8f4df..be61628341 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -1555,7 +1555,7 @@ check_ed_keys_callback(time_t now, const or_options_t *options)
           generate_ed_link_cert(options, now, new_signing_key > 0)) {
         log_err(LD_OR, "Unable to update Ed25519 keys!  Exiting.");
         tor_cleanup();
-        exit(1);
+        exit(1); // XXXX bad exit
       }
     }
     return 30;
@@ -2709,13 +2709,13 @@ process_signal(int sig)
     case SIGTERM:
       log_notice(LD_GENERAL,"Catching signal TERM, exiting cleanly.");
       tor_cleanup();
-      exit(0);
+      exit(0); // XXXX bad exit
       break;
     case SIGINT:
       if (!server_mode(get_options())) { /* do it now */
         log_notice(LD_GENERAL,"Interrupt: exiting cleanly.");
         tor_cleanup();
-        exit(0);
+        exit(0); // XXXX bad exit
       }
 #ifdef HAVE_SYSTEMD
       sd_notify(0, "STOPPING=1");
@@ -2745,7 +2745,7 @@ process_signal(int sig)
       if (do_hup() < 0) {
         log_warn(LD_CONFIG,"Restart failed (config error?). Exiting.");
         tor_cleanup();
-        exit(1);
+        exit(1); // XXXX bad exit
       }
 #ifdef HAVE_SYSTEMD
       sd_notify(0, "READY=1");
@@ -3198,7 +3198,7 @@ try_locking(const or_options_t *options, int err_if_locked)
         r = try_locking(options, 0);
         if (r<0) {
           log_err(LD_GENERAL, "No, it's still there.  Exiting.");
-          exit(1);
+          exit(1); // XXXX bad exit
         }
         return r;
       }
diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c
index 93bb8643d8..3a4f06fb7b 100644
--- a/src/or/networkstatus.c
+++ b/src/or/networkstatus.c
@@ -1671,7 +1671,7 @@ handle_missing_protocol_warning_impl(const networkstatus_t *c,
   }
   tor_free(protocol_warning);
   if (should_exit)
-    exit(1);
+    exit(1); // XXXX bad exit: should return from main.
 }
 
 /** Called when we have received a networkstatus <b>c</b>. If there are
diff --git a/src/or/ntmain.c b/src/or/ntmain.c
index 508e5844eb..9ce03e1f5a 100644
--- a/src/or/ntmain.c
+++ b/src/or/ntmain.c
@@ -195,7 +195,7 @@ nt_service_loadlibrary(void)
   return;
  err:
   printf("Unable to load library support for NT services: exiting.\n");
-  exit(1);
+  exit(1); // exit ok: ntmain can't read libraries
 }
 
 /** If we're compiled to run as an NT service, and the service wants to
diff --git a/src/or/routerlist.c b/src/or/routerlist.c
index 1fa27f722c..b59f318fc8 100644
--- a/src/or/routerlist.c
+++ b/src/or/routerlist.c
@@ -3082,7 +3082,7 @@ signed_descriptor_get_body_impl(const signed_descriptor_t *desc,
       log_err(LD_DIR, "We couldn't read a descriptor that is supposedly "
               "mmaped in our cache.  Is another process running in our data "
               "directory?  Exiting.");
-      exit(1);
+      exit(1); // XXXX bad exit: should recover.
     }
   }
   if (!r) /* no mmap, or not in cache. */
@@ -3096,7 +3096,7 @@ signed_descriptor_get_body_impl(const signed_descriptor_t *desc,
       log_err(LD_DIR, "descriptor at %p begins with unexpected string %s.  "
               "Is another process running in our data directory?  Exiting.",
               desc, escaped(cp));
-      exit(1);
+      exit(1); // XXXX bad exit: should recover.
     }
   }
 
diff --git a/src/or/scheduler.c b/src/or/scheduler.c
index 22a9b574ac..3ac3f406af 100644
--- a/src/or/scheduler.c
+++ b/src/or/scheduler.c
@@ -281,7 +281,7 @@ select_scheduler(void)
      * wishes of using what it has been configured and don't do a sneaky
      * fallback. Because this can be changed at runtime, we have to stop tor
      * right now. */
-    exit(1);
+    exit(1); // XXXX bad exit
   }
 
   /* Set the chosen scheduler. */