Merge remote-tracking branch 'asn/bug12207_second_draft'

4 files changed, 881 insertions, 0 deletions

diff --git a/src/test/include.am b/src/test/include.am
index fba439a616..e7c06dca20 100644
--- a/src/test/include.am
+++ b/src/test/include.am
@@ -28,6 +28,7 @@ src_test_test_SOURCES = \
 	src/test/test_cell_queue.c \
 	src/test/test_data.c \
 	src/test/test_dir.c \
+	src/test/test_entrynodes.c \
 	src/test/test_extorport.c \
 	src/test/test_introduce.c \
 	src/test/test_logging.c \
diff --git a/src/test/test.c b/src/test/test.c
index 429e79ccdc..5786f3ca54 100644
--- a/src/test/test.c
+++ b/src/test/test.c
@@ -1313,6 +1313,7 @@ extern struct testcase_t circuitmux_tests[];
 extern struct testcase_t cell_queue_tests[];
 extern struct testcase_t options_tests[];
 extern struct testcase_t socks_tests[];
+extern struct testcase_t entrynodes_tests[];
 extern struct testcase_t extorport_tests[];
 extern struct testcase_t controller_event_tests[];
 extern struct testcase_t logging_tests[];
@@ -1344,6 +1345,7 @@ static struct testgroup_t testgroups[] = {
   { "circuitlist/", circuitlist_tests },
   { "circuitmux/", circuitmux_tests },
   { "options/", options_tests },
+  { "entrynodes/", entrynodes_tests },
   { "extorport/", extorport_tests },
   { "control/", controller_event_tests },
   { "hs/", hs_tests },
diff --git a/src/test/test_descriptors.txt b/src/test/test_descriptors.txt
new file mode 100644
index 0000000000..80a1f6201c
--- /dev/null
+++ b/src/test/test_descriptors.txt
@@ -0,0 +1,304 @@
+@uploaded-at 2014-06-08 19:20:11
+@source "127.0.0.1"
+router test000a 127.0.0.1 5000 0 7000
+platform Tor 0.2.5.3-alpha-dev on Linux
+protocols Link 1 2 Circuit 1
+published 2014-06-08 19:20:11
+fingerprint C7E7 CCB8 179F 8CC3 7F5C 8A04 2B3A 180B 934B 14BA
+uptime 0
+bandwidth 1073741824 1073741824 0
+extra-info-digest 67A152A4C7686FB07664F872620635F194D76D95
+caches-extra-info
+onion-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAOuBUIEBARMkkka/TGyaQNgUEDLP0KG7sy6KNQTNOlZHUresPr/vlVjo
+HPpLMfu9M2z18c51YX/muWwY9x4MyQooD56wI4+AqXQcJRwQfQlPn3Ay82uZViA9
+DpBajRieLlKKkl145KjArpD7F5BVsqccvjErgFYXvhhjSrx7BVLnAgMBAAE=
+-----END RSA PUBLIC KEY-----
+signing-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAN6NLnSxWQnFXxqZi5D3b0BMgV6y9NJLGjYQVP+eWtPZWgqyv4zeYsqv
+O9y6c5lvxyUxmNHfoAbe/s8f2Vf3/YaC17asAVSln4ktrr3e9iY74a9RMWHv1Gzk
+3042nMcqj3PEhRN0PoLkcOZNjjmNbaqki6qy9bWWZDNTdo+uI44dAgMBAAE=
+-----END RSA PUBLIC KEY-----
+hidden-service-dir
+contact auth0@test.test
+ntor-onion-key pK4bs08ERYN591jj7ca17Rn9Q02TIEfhnjR6hSq+fhU=
+reject *:*
+router-signature
+-----BEGIN SIGNATURE-----
+rx88DuM3Y7tODlHNDDEVzKpwh3csaG1or+T4l2Xs1oq3iHHyPEtB6QTLYrC60trG
+aAPsj3DEowGfjga1b248g2dtic8Ab+0exfjMm1RHXfDam5TXXZU3A0wMyoHjqHuf
+eChGPgFNUvEc+5YtD27qEDcUjcinYztTs7/dzxBT4PE=
+-----END SIGNATURE-----
+@uploaded-at 2014-06-08 19:20:11
+@source "127.0.0.1"
+router test001a 127.0.0.1 5001 0 7001
+platform Tor 0.2.5.3-alpha-dev on Linux
+protocols Link 1 2 Circuit 1
+published 2014-06-08 19:20:11
+fingerprint 35DA 711C FC62 F88B C243 DE32 DC0B C28A 3F62 2610
+uptime 0
+bandwidth 1073741824 1073741824 0
+extra-info-digest 9E12278D6CF7608071FE98CE9DCEE48FA264518A
+caches-extra-info
+onion-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAPbyUrorqoXMW4oezqd307ZGxgobqvQs2nb3TdQyWrwsHtJmS3utdrJS
+xJUZPNHOQ2hrDWW1VvevYqRTGeXGZr9TDZ3+t/gVUttqYRhuzzgEKVAZSsTo5ctO
+QNHnzJ6Xx/w/trhWqPTeJ7R0TCyAbWW7aE3KaKdwvZilRZp/oRUnAgMBAAE=
+-----END RSA PUBLIC KEY-----
+signing-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBALwOJ7XZHBnjJEuwF3Os6eashNbTH9YnH8TBZBdKgu3iFJYqDslcMIPX
+gWCJ9apPHyh1+/8OLRWeEYlwoZzgGi0rjm/+BNeOOmJbjfyjk97DuB9/2O5zr1BM
+CvOHqQSzMD+vz1ebvfM039a2mO8lXruUFPZQaFVxk8371XP2khqhAgMBAAE=
+-----END RSA PUBLIC KEY-----
+hidden-service-dir
+contact auth1@test.test
+ntor-onion-key t5bI1ksTdigOksMKRHUDwx/34ajEvDN1IpArOxIEWgk=
+reject *:*
+router-signature
+-----BEGIN SIGNATURE-----
+KtMW7A/pzu+np6aKJSy6d7drIb4yjz8SPCo+oQNxj2IqNHJir2O2nWu69xy+K0c1
+RL05KkcDaYzr5hC80FD1H+sTpGYD28SPkQkzPw+0pReSDl93pVXh0rU6Cdcm75FC
+t0UZzDt4TsMuFB0ZYpM3phKcQPpiDG6aR0LskL/YUvY=
+-----END SIGNATURE-----
+@uploaded-at 2014-06-08 19:20:11
+@source "127.0.0.1"
+router test004r 127.0.0.1 5004 0 7004
+platform Tor 0.2.5.3-alpha-dev on Linux
+protocols Link 1 2 Circuit 1
+published 2014-06-08 19:20:10
+fingerprint CC6A 48BD 52BD 9A2C 6670 5863 AC31 AE17 6E63 8B02
+uptime 0
+bandwidth 1073741824 1073741824 0
+extra-info-digest B5CC249CEF394B5AFCA0C77FA7D5605615FA487C
+onion-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAMze36Hupy7HACcF3TMv5mJuZbx3d3cS0WYLl6vTeChBgpS5CEXq6zIu
+d31YmtUcxH6fOjDOudhbnXuoh1nH4CP+LocVHAdlGG1giAm7u8yZudVvVJiIqFgQ
+wVDcWx8LbGCi5P9J/ZPKAIVsSyS7xkOqHjz3VMo/uYLbQCFAwfkdAgMBAAE=
+-----END RSA PUBLIC KEY-----
+signing-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAM/qGP365x6bH+ug7rKVy7V5lC9Ff2Jfk0wlTFIzzwn+DMSG6xDvulKe
+wcIzgGNdQu7qlKlQUif3GPMr0KSS32cRsmoRQJcsm9+lGUK871NyZ8AyrHT+LhyF
+cs718P0iN5yKF2FikNr727kEANCzvC1l9eP4qF5GGzsNtglbJ7bTAgMBAAE=
+-----END RSA PUBLIC KEY-----
+hidden-service-dir
+ntor-onion-key a9Pavqnx7DFhMWUO0d17qF9Py8+iie4FnxTHaTgfIXY=
+reject *:25
+reject *:119
+reject *:135-139
+reject *:445
+reject *:563
+reject *:1214
+reject *:4661-4666
+reject *:6346-6429
+reject *:6699
+reject *:6881-6999
+accept *:*
+router-signature
+-----BEGIN SIGNATURE-----
+HVW7kjBgEt+Qdvcrq+NQE1F9B8uV9D38KA2Bp6cYHLWCxL6N4GS8JQqbOEtnqaj7
+Vxrv7uy1Fzb15Zr+1sUVMxNv+LLRfr+JzfETMNYVkYDrNgr1cAAVEQzFWbIziond
+xMFp64yjEW9/I+82lb5GBZEiKdEd4QqWMmQosoYMTM8=
+-----END SIGNATURE-----
+@uploaded-at 2014-06-08 19:20:12
+@source "127.0.0.1"
+router test002a 127.0.0.1 5002 0 7002
+platform Tor 0.2.5.3-alpha-dev on Linux
+protocols Link 1 2 Circuit 1
+published 2014-06-08 19:20:11
+fingerprint 29C7 BBB6 C437 32D5 BDF1 5671 F5C5 F1FB 6E36 4B47
+uptime 0
+bandwidth 1073741824 1073741824 0
+extra-info-digest 9BB181EA86E0130680C3CC04AD7DE4C341ADC2C7
+caches-extra-info
+onion-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBALNH19oF8Ajf+djlH/g7L+enFBf5Wwjmf3bPwNKWZ9G+B+Lg8SpfhZiw
+rUqi7h21f45BV/dN05dK6leWD8rj1T9kuM9TKBOEZxIWeq7zbXihyu4XPxP4FNTS
++0G7BhdP4biALENmeyLhUCZaw5Ic/jFkHT4gV9S0iVZiEDwC9twXAgMBAAE=
+-----END RSA PUBLIC KEY-----
+signing-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBALeyQGMQBHgTxpO/i30uHjflTm9MNi3ZBNcOKpvBXWYgY42qTqOZ7Uam
+c5pmZhTLrQ1W8XlGDw8Cl8ktZ0ylodLZyUNajBtJvSFWTb8iwdZsshW6Ahb8TyfI
+Y7MwTlQ/7xw4mj1NEaui6bwGgEZUs18RTqhDrUc2Mcj1Yf61Rq+7AgMBAAE=
+-----END RSA PUBLIC KEY-----
+hidden-service-dir
+contact auth2@test.test
+ntor-onion-key ukR41RjtiZ69KO0SrFTvL0LoZK/ZTT01FQWmCXTCUlE=
+reject *:*
+router-signature
+-----BEGIN SIGNATURE-----
+IY2s/RY4tdahrgfGG+vW7lOvpfofoxxSo7guGpSKGxVApiroCQtumoYifnnJ88G2
+K4IbxwEO8pgO8fnz1mibblUWw2vdDNjCifc1wtXJUE+ONA0UcLRlfQ94GbL8h2PG
+72z6i1+NN0QahXMk7MUbzI7bOXTJOiO8e2Zjk9vRnxI=
+-----END SIGNATURE-----
+@uploaded-at 2014-06-08 19:20:12
+@source "127.0.0.1"
+router test006r 127.0.0.1 5006 0 7006
+platform Tor 0.2.5.3-alpha-dev on Linux
+protocols Link 1 2 Circuit 1
+published 2014-06-08 19:20:11
+fingerprint 829B 3FAA A42B 605A EB0B F380 8F32 8ED1 73E7 0D25
+uptime 0
+bandwidth 1073741824 1073741824 0
+extra-info-digest 7ECB757002EB9B5838B13AE6F2357A5E585131B8
+onion-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBALsNBChcLVndlS4HNXL3hxBJVgXctATz6yXcJt3bkDB5cjv7Q9fqN3Ue
+j3SI1OUBx4YrLcSLD/hELHVilLrrfbaraAFfAsydlRLjTVcMRx5FFlDd0E7TAadc
+71CkTipNnjwqz1mTRKkEFeepnh/JaFDidY9ER1rMBA5JRyBvqrD9AgMBAAE=
+-----END RSA PUBLIC KEY-----
+signing-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAPgipA8yLj1kqrMlAH7cK7IQEdmqmfNHGXdkYQ+TKtfLh0zeEIvvh9yh
+k+vKHS+HVoHo3tecB9QjJyDyyJTiETXCupSOY+ebG648JADAvv8v1WiE+KBXtjpl
+qgDTrDj5CwGuY6cvQdej5yg1UAVlMMZSg3thL3tCYtQbOq66lAlnAgMBAAE=
+-----END RSA PUBLIC KEY-----
+hidden-service-dir
+ntor-onion-key q02F3AQsCX7+zXNpfTqBF8O8lusPhRJpQVxOnBvbOwc=
+reject *:25
+reject *:119
+reject *:135-139
+reject *:445
+reject *:563
+reject *:1214
+reject *:4661-4666
+reject *:6346-6429
+reject *:6699
+reject *:6881-6999
+accept *:*
+router-signature
+-----BEGIN SIGNATURE-----
+L1fdgoN/eXgdzIIXO63W4yGoC9lRozMU+T0Fimhd/XFV8qxeUT83Vgf63vxLUHIb
+D4a80Wj7Pm4y5a766qLGXxlz2FYjCdkp070UpgZneB+VifUlFd/bNAjsiYTstBKM
+EI2L0mhl9d/7KK8vgtadHdX1z1u7QjyF6ccnzhfqeiY=
+-----END SIGNATURE-----
+@uploaded-at 2014-06-08 19:20:12
+@source "127.0.0.1"
+router test003r 127.0.0.1 5003 0 7003
+platform Tor 0.2.5.3-alpha-dev on Linux
+protocols Link 1 2 Circuit 1
+published 2014-06-08 19:20:11
+fingerprint 71FD 3A35 F705 8020 D595 B711 D52A 9A0A 99BB B467
+uptime 0
+bandwidth 1073741824 1073741824 0
+extra-info-digest 3796BE0A95B699595445DFD3453CA2074E75BCE8
+onion-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAL44ctIioIfCYFzMTYNfK5qFAPGGUpsAFmS8pThQEY/tJU14+frJDBrC
+BkLvBs05Bw7xOUb0f2geiYGowBA6028smiq5HzTO7Kaga8vfV7AnANPX+n9cfHCr
+/2cMnKkT/GZzpdk0WbUw5Kc/G1ATIPFQHA8gZAi1fsSIDDn3GRV5AgMBAAE=
+-----END RSA PUBLIC KEY-----
+signing-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBALlPo5AI1mVTi+194yOSf40caoFlxSTfXt8KjGVa1dO/bpX7L3noOjYg
+goU4Aqim7BHmBWQDE/tZNTrchFoLQFHi9N4pv/0ND3sY904pzqGpe3FeTuU8P9Jg
+q2w3MeO3GwG8CJf4FOdSkgi8UKkJhOld4g4kViQbrFLXfdFvnT/zAgMBAAE=
+-----END RSA PUBLIC KEY-----
+hidden-service-dir
+ntor-onion-key qluYCRrsesOTkavCLnNK6H1ToywyDquCyYeP0h/qol4=
+reject *:25
+reject *:119
+reject *:135-139
+reject *:445
+reject *:563
+reject *:1214
+reject *:4661-4666
+reject *:6346-6429
+reject *:6699
+reject *:6881-6999
+accept *:*
+router-signature
+-----BEGIN SIGNATURE-----
+d09K7rW/OpVzoUpfZXJuJW7a+P4pROCOZTgvDUIy/Nv+EAjcYqv95PlJ8cAMqnn3
+1oQibRmmQwn0OmG5cB8NaZiueaVIRheGzHEM8rndpHn5oFXdFvV7KKjScvfuBbTk
+RYME8XyawRaqsEZnwirDDlZuiZOjdQs8bbGsko3grJE=
+-----END SIGNATURE-----
+@uploaded-at 2014-06-08 19:20:12
+@source "127.0.0.1"
+router test005r 127.0.0.1 5005 0 7005
+platform Tor 0.2.5.3-alpha-dev on Linux
+protocols Link 1 2 Circuit 1
+published 2014-06-08 19:20:11
+fingerprint EB6E 42ED E6BF 5EE0 19F5 EFC1 53AD 094C 1327 7B76
+uptime 0
+bandwidth 1073741824 1073741824 0
+extra-info-digest C031EE4E1AE826C1E3C4E21D81C961869E63F5D2
+onion-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAMd9Fm4KTSjFDzEABPZ1fwBCC2DNgee6nAmlde8FRbCVfcIHRiJyv9YG
+h530yUJal3hBfiWwy/SBA4LDz1flNCEwJm81s3waj4T9c676dAOLPcnOcJM5SbaQ
+hYPDrIZLEZHAk+IoM+avKYYocwCJXwx6WTtsedF0wJBZ9mQAJERJAgMBAAE=
+-----END RSA PUBLIC KEY-----
+signing-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAKT7ldhV43S1CgoER/pU0Rigf0NzcSy25DQJrMRQnNmXnL03Dwuv/Iu7
+dCjgg64odnvSkXHFhkbjGcg8aXikvfbMyZTbsD8NrrP6FS6pfgPgZD9W2TK7QdHI
+QXwx1IYaaJK4nDUNfJhjrclydEdxmHbO1nLG1aS0ypn/G0EBpOSnAgMBAAE=
+-----END RSA PUBLIC KEY-----
+hidden-service-dir
+ntor-onion-key umFmyRPA0dIsi0CFYCbGIPe2+OUkyslTkKKDEohjQQg=
+reject *:25
+reject *:119
+reject *:135-139
+reject *:445
+reject *:563
+reject *:1214
+reject *:4661-4666
+reject *:6346-6429
+reject *:6699
+reject *:6881-6999
+accept *:*
+router-signature
+-----BEGIN SIGNATURE-----
+JiXEbqPgDPWEb9DzCYINRXfmvMIc/IRtvshS8Vmmn7DW67TrTLKCEAnisGo92gMA
+bhxGb9G5Mxq/8YqGoqdI2Vp6tfKlz/9AmjHzFAo01y42gafXIdr1oUS2RimA8jfF
+hwfQkbG0FYEsJrH3EUa8sMhcjsEaohK/kgklMR7OgQY=
+-----END SIGNATURE-----
+@uploaded-at 2014-06-08 19:20:12
+@source "127.0.0.1"
+router test007r 127.0.0.1 5007 0 7007
+platform Tor 0.2.5.3-alpha-dev on Linux
+protocols Link 1 2 Circuit 1
+published 2014-06-08 19:20:11
+fingerprint DABD 2AAF 8C9F 3B71 7839 9C08 DCD8 CD9D 341D 0002
+uptime 0
+bandwidth 1073741824 1073741824 0
+extra-info-digest F80104A0DFFB4EB429325D41D1F71E5BF8C6C726
+onion-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAL42fYAriR/JeB/9NpVq5Y5EEHca+ugIpaSdRfbopWDtFjXLEk2jmO5A
+KoAGIkTKDr7e9101x63H+0Nh/7w3uYs/WqTXEH8/1sHwe+0PY2HL0S6qhlOo6X54
+EfK0nDDBAWFOpyiAMHRk8JVikKb56+FVIhCJgi1RIbLIiUQK2/kxAgMBAAE=
+-----END RSA PUBLIC KEY-----
+signing-key
+-----BEGIN RSA PUBLIC KEY-----
+MIGJAoGBAKQj2U5hmB68V6NQBqD8DfIkJjovvM8t6nGfYpkT8ORsROnmgI5mjM38
+cmh5GIjY9RgoOWolLmsWQ4SXtS0FvrPft1M61UMTSHzlrEeuod5KenV7vGlX2TxT
+0DoA5TL9yY7CmxCk8CNRCtN/g7WocgIiP4KCIiEZ4VE6LIb6sxUnAgMBAAE=
+-----END RSA PUBLIC KEY-----
+hidden-service-dir
+ntor-onion-key 1UBS8rTlL39u9YxRJWhz+GTG1dS15VRi4au1i5qZOyI=
+reject *:25
+reject *:119
+reject *:135-139
+reject *:445
+reject *:563
+reject *:1214
+reject *:4661-4666
+reject *:6346-6429
+reject *:6699
+reject *:6881-6999
+accept *:*
+router-signature
+-----BEGIN SIGNATURE-----
+m7xHh+XPdLN+qcMLz1dBAEAmcdCFrtdseMHCc0FyAP2kXdayxqe3o2IOOHN++bTH
+Y5iHsZembsIJJ+D/d0YEKWKh42TUWCXBu0Gbfc4OcNuR6PFlTWO2wk7rDT3HOiFr
+pe3wJqZYkLxlBDamROAlMMRe71iag89H/4EulC18opw=
+-----END SIGNATURE-----
diff --git a/src/test/test_entrynodes.c b/src/test/test_entrynodes.c
new file mode 100644
index 0000000000..c9b8321c79
--- /dev/null
+++ b/src/test/test_entrynodes.c
@@ -0,0 +1,574 @@
+/* Copyright (c) 2014, The Tor Project, Inc. */
+/* See LICENSE for licensing information */
+
+#include "orconfig.h"
+
+#define STATEFILE_PRIVATE
+#define ENTRYNODES_PRIVATE
+#define ROUTERLIST_PRIVATE
+
+#include "or.h"
+#include "test.h"
+#include "entrynodes.h"
+#include "routerparse.h"
+#include "nodelist.h"
+#include "util.h"
+#include "routerlist.h"
+#include "routerset.h"
+#include "statefile.h"
+#include "config.h"
+
+/* TODO:
+ * choose_random_entry() test with state set.
+ *
+ * parse_state() tests with more than one guards.
+ *
+ * More tests for set_from_config(): Multiple nodes, use fingerprints,
+ *                                   use country codes.
+ */
+
+/** Dummy Tor state used in unittests. */
+static or_state_t *dummy_state = NULL;
+static or_state_t *
+get_or_state_replacement(void)
+{
+  return dummy_state;
+}
+
+/* NOP replacement for router_descriptor_is_older_than() */
+static int
+router_descriptor_is_older_than_replacement(const routerinfo_t *router,
+                                            int seconds)
+{
+  (void) router;
+  (void) seconds;
+  return 0;
+}
+
+/* Number of descriptors contained in test_descriptors.txt. */
+#define NUMBER_OF_DESCRIPTORS 8
+
+/** Parse a file containing router descriptors and load them to our
+    routerlist. This function is used to setup an artificial network
+    so that we can conduct entry guard tests. */
+static void
+setup_fake_routerlist(const char *fname)
+{
+  int retval;
+  char *contents = NULL;
+  struct stat st;
+  routerlist_t *our_routerlist = NULL;
+  smartlist_t *our_nodelist = NULL;
+
+  /* Read the file that contains our test descriptors. */
+  test_assert(file_status(fname) == FN_FILE);
+  contents = read_file_to_str(fname, RFTS_BIN|RFTS_IGNORE_MISSING, &st);
+  test_assert(contents);
+
+  /* We need to mock this function otherwise the descriptors will not
+     accepted as they are too old. */
+  MOCK(router_descriptor_is_older_than,
+       router_descriptor_is_older_than_replacement);
+
+  /* Load all the test descriptors to the routerlist. */
+  retval = router_load_routers_from_string(contents, NULL, SAVED_IN_JOURNAL,
+                                           NULL, 0, NULL);
+  tt_int_op(retval, ==, NUMBER_OF_DESCRIPTORS);
+
+  /* Sanity checking of routerlist and nodelist. */
+  our_routerlist = router_get_routerlist();
+  tt_int_op(smartlist_len(our_routerlist->routers), ==, NUMBER_OF_DESCRIPTORS);
+  routerlist_assert_ok(our_routerlist);
+
+  our_nodelist = nodelist_get_list();
+  tt_int_op(smartlist_len(our_nodelist), ==, NUMBER_OF_DESCRIPTORS);
+
+  /* Mark all routers as non-guards but up and running! */
+  SMARTLIST_FOREACH_BEGIN(our_nodelist, node_t *, node) {
+    node->is_running = 1;
+    node->is_valid = 1;
+    node->is_possible_guard = 0;
+  } SMARTLIST_FOREACH_END(node);
+
+ done:
+  UNMOCK(router_descriptor_is_older_than);
+  tor_free(contents);
+}
+
+/* Unittest cleanup function: Cleanup the fake network. */
+static int
+fake_network_cleanup(const struct testcase_t *testcase, void *ptr)
+{
+  (void) testcase;
+  (void) ptr;
+
+  routerlist_free_all();
+  nodelist_free_all();
+  entry_guards_free_all();
+  or_state_free(dummy_state);
+
+  return 1; /* NOP */
+}
+
+/* Unittest setup function: Setup a fake network. */
+static void *
+fake_network_setup(const struct testcase_t *testcase)
+{
+  /* This is the file containing our test descriptors. */
+  const char *fname = BUILDDIR "/src/test/test_descriptors.txt";
+
+  (void) testcase;
+
+  /* Setup fake state */
+  dummy_state = tor_malloc_zero(sizeof(or_state_t));
+  MOCK(get_or_state,
+       get_or_state_replacement);
+
+  /* Setup fake routerlist. */
+  setup_fake_routerlist(fname);
+
+  /* Return anything but NULL (it's interpreted as test fail) */
+  return dummy_state;
+}
+
+/** Test choose_random_entry() with none of our routers being guard nodes. */
+static void
+test_choose_random_entry_no_guards(void *arg)
+{
+  const node_t *chosen_entry = NULL;
+
+  (void) arg;
+
+  /* Try to pick an entry even though none of our routers are guards. */
+  chosen_entry = choose_random_entry(NULL);
+
+  /* Unintuitively, we actually pick a random node as our entry,
+     because router_choose_random_node() relaxes its constraints if it
+     can't find a proper entry guard. */
+  test_assert(chosen_entry);
+
+ done:
+  ;
+}
+
+/** Test choose_random_entry() with only one of our routers being a
+    guard node. */
+static void
+test_choose_random_entry_one_possible_guard(void *arg)
+{
+  const node_t *chosen_entry = NULL;
+  node_t *the_guard = NULL;
+  smartlist_t *our_nodelist = NULL;
+
+  (void) arg;
+
+  /* Set one of the nodes to be a guard. */
+  our_nodelist = nodelist_get_list();
+  the_guard = smartlist_get(our_nodelist, 4); /* chosen by fair dice roll */
+  the_guard->is_possible_guard = 1;
+
+  /* Pick an entry. Make sure we pick the node we marked as guard. */
+  chosen_entry = choose_random_entry(NULL);
+  tt_ptr_op(chosen_entry, ==, the_guard);
+
+ done:
+  ;
+}
+
+/** Helper to conduct tests for populate_live_entry_guards().
+
+   This test adds some entry guards to our list, and then tests
+   populate_live_entry_guards() to mke sure it filters them correctly.
+
+   <b>num_needed</b> is the number of guard nodes we support. It's
+   configurable to make sure we function properly with 1 or 3 guard
+   nodes configured.
+*/
+static void
+populate_live_entry_guards_test_helper(int num_needed)
+{
+  smartlist_t *our_nodelist = NULL;
+  smartlist_t *live_entry_guards = smartlist_new();
+  const smartlist_t *all_entry_guards = get_entry_guards();
+  or_options_t *options = get_options_mutable();
+  int retval;
+
+  /* Set NumEntryGuards to the provided number. */
+  options->NumEntryGuards = num_needed;
+  tt_int_op(num_needed, ==, decide_num_guards(options, 0));
+
+  /* The global entry guards smartlist should be empty now. */
+  tt_int_op(smartlist_len(all_entry_guards), ==, 0);
+
+  /* Walk the nodelist and add all nodes as entry guards. */
+  our_nodelist = nodelist_get_list();
+  tt_int_op(smartlist_len(our_nodelist), ==, NUMBER_OF_DESCRIPTORS);
+
+  SMARTLIST_FOREACH_BEGIN(our_nodelist, const node_t *, node) {
+    const node_t *node_tmp;
+    node_tmp = add_an_entry_guard(node, 0, 1, 0, 0);
+    test_assert(node_tmp);
+  } SMARTLIST_FOREACH_END(node);
+
+  /* Make sure the nodes were added as entry guards. */
+  tt_int_op(smartlist_len(all_entry_guards), ==, NUMBER_OF_DESCRIPTORS);
+
+  /* Ensure that all the possible entry guards are enough to satisfy us. */
+  tt_int_op(smartlist_len(all_entry_guards), >=, num_needed);
+
+  /* Walk the entry guard list for some sanity checking */
+  SMARTLIST_FOREACH_BEGIN(all_entry_guards, const entry_guard_t *, entry) {
+    /* Since we called add_an_entry_guard() with 'for_discovery' being
+       False, all guards should have made_contact enabled. */
+    tt_int_op(entry->made_contact, ==, 1);
+
+    /* Since we don't have a routerstatus, all of the entry guards are
+       not directory servers. */
+    tt_int_op(entry->is_dir_cache, ==, 0);
+  } SMARTLIST_FOREACH_END(entry);
+
+  /* First, try to get some fast guards. This should fail. */
+  retval = populate_live_entry_guards(live_entry_guards,
+                                      all_entry_guards,
+                                      NULL,
+                                      NO_DIRINFO, /* Don't care about DIRINFO*/
+                                      0, 0,
+                                      1); /* We want fast guard! */
+  tt_int_op(retval, ==, 0);
+  tt_int_op(smartlist_len(live_entry_guards), ==, 0);
+
+  /* Now try to get some stable guards. This should fail too. */
+  retval = populate_live_entry_guards(live_entry_guards,
+                                      all_entry_guards,
+                                      NULL,
+                                      NO_DIRINFO,
+                                      0,
+                                      1, /* We want stable guard! */
+                                      0);
+  tt_int_op(retval, ==, 0);
+  tt_int_op(smartlist_len(live_entry_guards), ==, 0);
+
+  /* Now try to get any guard we can find. This should succeed. */
+  retval = populate_live_entry_guards(live_entry_guards,
+                                      all_entry_guards,
+                                      NULL,
+                                      NO_DIRINFO,
+                                      0, 0, 0); /* No restrictions! */
+
+  /* Since we had more than enough guards in 'all_entry_guards', we
+     should have added 'num_needed' of them to live_entry_guards.
+     'retval' should be 1 since we now have enough live entry guards
+     to pick one.  */
+  tt_int_op(retval, ==, 1);
+  tt_int_op(smartlist_len(live_entry_guards), ==, num_needed);
+
+ done:
+  smartlist_free(live_entry_guards);
+}
+
+/* Test populate_live_entry_guards() for 1 guard node. */
+static void
+test_populate_live_entry_guards_1guard(void *arg)
+{
+  (void) arg;
+
+  populate_live_entry_guards_test_helper(1);
+}
+
+/* Test populate_live_entry_guards() for 3 guard nodes. */
+static void
+test_populate_live_entry_guards_3guards(void *arg)
+{
+  (void) arg;
+
+  populate_live_entry_guards_test_helper(3);
+}
+
+/** Append some EntryGuard lines to the Tor state at <b>state</b>.
+
+   <b>entry_guard_lines</b> is a smartlist containing 2-tuple
+   smartlists that carry the key and values of the statefile.
+   As an example:
+   entry_guard_lines =
+     (("EntryGuard", "name 67E72FF33D7D41BF11C569646A0A7B4B188340DF DirCache"),
+      ("EntryGuardDownSince", "2014-06-07 16:02:46 2014-06-07 16:02:46"))
+*/
+static void
+state_insert_entry_guard_helper(or_state_t *state,
+                                smartlist_t *entry_guard_lines)
+{
+  config_line_t **next, *line;
+
+  next = &state->EntryGuards;
+  *next = NULL;
+
+  /* Loop over all the state lines in the smartlist */
+  SMARTLIST_FOREACH_BEGIN(entry_guard_lines, const smartlist_t *,state_lines) {
+    /* Get key and value for each line */
+    const char *state_key = smartlist_get(state_lines, 0);
+    const char *state_value = smartlist_get(state_lines, 1);
+
+    *next = line = tor_malloc_zero(sizeof(config_line_t));
+    line->key = tor_strdup(state_key);
+    tor_asprintf(&line->value, "%s", state_value);
+    next = &(line->next);
+  } SMARTLIST_FOREACH_END(state_lines);
+}
+
+/** Free memory occupied by <b>entry_guard_lines</b>. */
+static void
+state_lines_free(smartlist_t *entry_guard_lines)
+{
+  SMARTLIST_FOREACH_BEGIN(entry_guard_lines, smartlist_t *, state_lines) {
+    char *state_key = smartlist_get(state_lines, 0);
+    char *state_value = smartlist_get(state_lines, 1);
+
+    tor_free(state_key);
+    tor_free(state_value);
+    smartlist_free(state_lines);
+  } SMARTLIST_FOREACH_END(state_lines);
+
+  smartlist_free(entry_guard_lines);
+}
+
+/* Tests entry_guards_parse_state(). It creates a fake Tor state with
+   a saved entry guard and makes sure that Tor can parse it and
+   creates the right entry node out of it.
+*/
+static void
+test_entry_guards_parse_state_simple(void *arg)
+{
+  or_state_t *state = or_state_new();
+  const smartlist_t *all_entry_guards = get_entry_guards();
+  smartlist_t *entry_state_lines = smartlist_new();
+  char *msg = NULL;
+  int retval;
+
+  /* Details of our fake guard node */
+  const char *nickname = "hagbard";
+  const char *fpr = "B29D536DD1752D542E1FBB3C9CE4449D51298212";
+  const char *tor_version = "0.2.5.3-alpha-dev";
+  const char *added_at = "2014-05-22 02:40:47";
+  const char *unlisted_since = "2014-06-08 16:16:50";
+
+  (void) arg;
+
+  /* The global entry guards smartlist should be empty now. */
+  tt_int_op(smartlist_len(all_entry_guards), ==, 0);
+
+  { /* Prepare the state entry */
+
+    /* Prepare the smartlist to hold the key/value of each line */
+    smartlist_t *state_line = smartlist_new();
+    smartlist_add_asprintf(state_line, "EntryGuard");
+    smartlist_add_asprintf(state_line, "%s %s %s", nickname, fpr, "DirCache");
+    smartlist_add(entry_state_lines, state_line);
+
+    state_line = smartlist_new();
+    smartlist_add_asprintf(state_line, "EntryGuardAddedBy");
+    smartlist_add_asprintf(state_line, "%s %s %s", fpr, tor_version, added_at);
+    smartlist_add(entry_state_lines, state_line);
+
+    state_line = smartlist_new();
+    smartlist_add_asprintf(state_line, "EntryGuardUnlistedSince");
+    smartlist_add_asprintf(state_line, "%s", unlisted_since);
+    smartlist_add(entry_state_lines, state_line);
+  }
+
+  /* Inject our lines in the state */
+  state_insert_entry_guard_helper(state, entry_state_lines);
+
+  /* Parse state */
+  retval = entry_guards_parse_state(state, 1, &msg);
+  tt_int_op(retval, >=, 0);
+
+  /* Test that the guard was registered.
+     We need to re-get the entry guard list since its pointer was
+     overwritten in entry_guards_parse_state(). */
+  all_entry_guards = get_entry_guards();
+  tt_int_op(smartlist_len(all_entry_guards), ==, 1);
+
+  { /* Test the entry guard structure */
+    char hex_digest[1024];
+    char str_time[1024];
+
+    const entry_guard_t *e = smartlist_get(all_entry_guards, 0);
+    tt_str_op(e->nickname, ==, nickname); /* Verify nickname */
+
+    base16_encode(hex_digest, sizeof(hex_digest),
+                  e->identity, DIGEST_LEN);
+    tt_str_op(hex_digest, ==, fpr); /* Verify fingerprint */
+
+    tt_assert(e->is_dir_cache); /* Verify dirness */
+
+    tt_str_op(e->chosen_by_version, ==, tor_version); /* Verify tor version */
+
+    tt_assert(e->made_contact); /* All saved guards have been contacted */
+
+    tt_assert(e->bad_since); /* Verify bad_since timestamp */
+    format_iso_time(str_time, e->bad_since);
+    tt_str_op(str_time, ==, unlisted_since);
+
+    /* The rest should be unset */
+    tt_assert(!e->unreachable_since);
+    tt_assert(!e->can_retry);
+    tt_assert(!e->path_bias_noticed);
+    tt_assert(!e->path_bias_warned);
+    tt_assert(!e->path_bias_extreme);
+    tt_assert(!e->path_bias_disabled);
+    tt_assert(!e->path_bias_use_noticed);
+    tt_assert(!e->path_bias_use_extreme);
+    tt_assert(!e->last_attempted);
+  }
+
+ done:
+  state_lines_free(entry_state_lines);
+  or_state_free(state);
+}
+
+/** Similar to test_entry_guards_parse_state_simple() but aims to test
+    the PathBias-related details of the entry guard. */
+static void
+test_entry_guards_parse_state_pathbias(void *arg)
+{
+  or_state_t *state = or_state_new();
+  const smartlist_t *all_entry_guards = get_entry_guards();
+  char *msg = NULL;
+  int retval;
+  smartlist_t *entry_state_lines = smartlist_new();
+
+  /* Path bias details of the fake guard */
+  const double circ_attempts = 9;
+  const double circ_successes = 8;
+  const double successful_closed = 4;
+  const double collapsed = 2;
+  const double unusable = 0;
+  const double timeouts = 1;
+
+  (void) arg;
+
+  /* The global entry guards smartlist should be empty now. */
+  tt_int_op(smartlist_len(all_entry_guards), ==, 0);
+
+  { /* Prepare the state entry */
+
+    /* Prepare the smartlist to hold the key/value of each line */
+    smartlist_t *state_line = smartlist_new();
+    smartlist_add_asprintf(state_line, "EntryGuard");
+    smartlist_add_asprintf(state_line,
+             "givethanks B29D536DD1752D542E1FBB3C9CE4449D51298212 NoDirCache");
+    smartlist_add(entry_state_lines, state_line);
+
+    state_line = smartlist_new();
+    smartlist_add_asprintf(state_line, "EntryGuardAddedBy");
+    smartlist_add_asprintf(state_line,
+      "B29D536DD1752D542E1FBB3C9CE4449D51298212 0.2.5.3-alpha-dev "
+      "2014-05-22 02:40:47");
+    smartlist_add(entry_state_lines, state_line);
+
+    state_line = smartlist_new();
+    smartlist_add_asprintf(state_line, "EntryGuardUnlistedSince");
+    smartlist_add_asprintf(state_line, "2014-06-08 16:16:50");
+    smartlist_add(entry_state_lines, state_line);
+
+    state_line = smartlist_new();
+    smartlist_add_asprintf(state_line, "EntryGuardPathBias");
+    smartlist_add_asprintf(state_line, "%f %f %f %f %f %f",
+                           circ_attempts, circ_successes, successful_closed,
+                           collapsed, unusable, timeouts);
+    smartlist_add(entry_state_lines, state_line);
+  }
+
+  /* Inject our lines in the state */
+  state_insert_entry_guard_helper(state, entry_state_lines);
+
+  /* Parse state */
+  retval = entry_guards_parse_state(state, 1, &msg);
+  tt_int_op(retval, >=, 0);
+
+  /* Test that the guard was registered */
+  all_entry_guards = get_entry_guards();
+  tt_int_op(smartlist_len(all_entry_guards), ==, 1);
+
+  { /* Test the path bias of this guard */
+    const entry_guard_t *e = smartlist_get(all_entry_guards, 0);
+
+    tt_assert(!e->is_dir_cache);
+    tt_assert(!e->can_retry);
+
+    /* XXX tt_double_op doesn't support equality. Cast to int for now. */
+    tt_int_op((int)e->circ_attempts, ==, (int)circ_attempts);
+    tt_int_op((int)e->circ_successes, ==, (int)circ_successes);
+    tt_int_op((int)e->successful_circuits_closed, ==, (int)successful_closed);
+    tt_int_op((int)e->timeouts, ==, (int)timeouts);
+    tt_int_op((int)e->collapsed_circuits, ==, (int)collapsed);
+    tt_int_op((int)e->unusable_circuits, ==, (int)unusable);
+  }
+
+ done:
+  or_state_free(state);
+  state_lines_free(entry_state_lines);
+}
+
+/* Simple test of entry_guards_set_from_config() by specifying a
+   particular EntryNode and making sure it gets picked. */
+static void
+test_entry_guards_set_from_config(void *arg)
+{
+  or_options_t *options = get_options_mutable();
+  const smartlist_t *all_entry_guards = get_entry_guards();
+  const char *entrynodes_str = "test003r";
+  const node_t *chosen_entry = NULL;
+  int retval;
+
+  (void) arg;
+
+  /* Prase EntryNodes as a routerset. */
+  options->EntryNodes = routerset_new();
+  retval = routerset_parse(options->EntryNodes,
+                           entrynodes_str,
+                           "test_entrynodes");
+  tt_int_op(retval, >=, 0);
+
+  /* Read nodes from EntryNodes */
+  entry_guards_set_from_config(options);
+
+  /* Test that only one guard was added. */
+  tt_int_op(smartlist_len(all_entry_guards), ==, 1);
+
+  /* Make sure it was the guard we specified. */
+  chosen_entry = choose_random_entry(NULL);
+  tt_str_op(chosen_entry->ri->nickname, ==, entrynodes_str);
+
+ done:
+  routerset_free(options->EntryNodes);
+}
+
+static const struct testcase_setup_t fake_network = {
+  fake_network_setup, fake_network_cleanup
+};
+
+struct testcase_t entrynodes_tests[] = {
+  { "choose_random_entry_no_guards", test_choose_random_entry_no_guards,
+    TT_FORK, &fake_network, NULL },
+  { "choose_random_entry_one_possibleguard",
+    test_choose_random_entry_one_possible_guard,
+    TT_FORK, &fake_network, NULL },
+  { "populate_live_entry_guards_1guard",
+    test_populate_live_entry_guards_1guard,
+    TT_FORK, &fake_network, NULL },
+  { "populate_live_entry_guards_3guards",
+    test_populate_live_entry_guards_3guards,
+    TT_FORK, &fake_network, NULL },
+  { "entry_guards_parse_state_simple",
+    test_entry_guards_parse_state_simple,
+    TT_FORK, &fake_network, NULL },
+  { "entry_guards_parse_state_pathbias",
+    test_entry_guards_parse_state_pathbias,
+    TT_FORK, &fake_network, NULL },
+  { "entry_guards_set_from_config",
+    test_entry_guards_set_from_config,
+    TT_FORK, &fake_network, NULL },
+  END_OF_TESTCASES
+};
+