summaryrefslogtreecommitdiff
path: root/src/feature/relay
diff options
context:
space:
mode:
Diffstat (limited to 'src/feature/relay')
-rw-r--r--src/feature/relay/dns.c91
-rw-r--r--src/feature/relay/dns.h5
-rw-r--r--src/feature/relay/ext_orport.c2
-rw-r--r--src/feature/relay/router.c217
-rw-r--r--src/feature/relay/router.h8
5 files changed, 243 insertions, 80 deletions
diff --git a/src/feature/relay/dns.c b/src/feature/relay/dns.c
index cc9f4cf490..feaf18e764 100644
--- a/src/feature/relay/dns.c
+++ b/src/feature/relay/dns.c
@@ -1360,6 +1360,42 @@ evdns_err_is_transient(int err)
}
}
+/**
+ * Return number of configured nameservers in <b>the_evdns_base</b>.
+ */
+size_t
+number_of_configured_nameservers(void)
+{
+ return evdns_base_count_nameservers(the_evdns_base);
+}
+
+#ifdef HAVE_EVDNS_BASE_GET_NAMESERVER_ADDR
+/**
+ * Return address of configured nameserver in <b>the_evdns_base</b>
+ * at index <b>idx</b>.
+ */
+tor_addr_t *
+configured_nameserver_address(const size_t idx)
+{
+ struct sockaddr_storage sa;
+ ev_socklen_t sa_len = sizeof(sa);
+
+ if (evdns_base_get_nameserver_addr(the_evdns_base, (int)idx,
+ (struct sockaddr *)&sa,
+ sa_len) > 0) {
+ tor_addr_t *tor_addr = tor_malloc(sizeof(tor_addr_t));
+ if (tor_addr_from_sockaddr(tor_addr,
+ (const struct sockaddr *)&sa,
+ NULL) == 0) {
+ return tor_addr;
+ }
+ tor_free(tor_addr);
+ }
+
+ return NULL;
+}
+#endif
+
/** Configure eventdns nameservers if force is true, or if the configuration
* has changed since the last time we called this function, or if we failed on
* our last attempt. On Unix, this reads from /etc/resolv.conf or
@@ -1391,16 +1427,23 @@ configure_nameservers(int force)
evdns_set_log_fn(evdns_log_cb);
if (conf_fname) {
log_debug(LD_FS, "stat()ing %s", conf_fname);
- if (stat(sandbox_intern_string(conf_fname), &st)) {
+ int missing_resolv_conf = 0;
+ int stat_res = stat(sandbox_intern_string(conf_fname), &st);
+
+ if (stat_res) {
log_warn(LD_EXIT, "Unable to stat resolver configuration in '%s': %s",
conf_fname, strerror(errno));
- goto err;
- }
- if (!force && resolv_conf_fname && !strcmp(conf_fname,resolv_conf_fname)
+ missing_resolv_conf = 1;
+ } else if (!force && resolv_conf_fname &&
+ !strcmp(conf_fname,resolv_conf_fname)
&& st.st_mtime == resolv_conf_mtime) {
log_info(LD_EXIT, "No change to '%s'", conf_fname);
return 0;
}
+
+ if (stat_res == 0 && st.st_size == 0)
+ missing_resolv_conf = 1;
+
if (nameservers_configured) {
evdns_base_search_clear(the_evdns_base);
evdns_base_clear_nameservers_and_suspend(the_evdns_base);
@@ -1413,20 +1456,34 @@ configure_nameservers(int force)
sandbox_intern_string("/etc/hosts"));
}
#endif /* defined(DNS_OPTION_HOSTSFILE) && defined(USE_LIBSECCOMP) */
- log_info(LD_EXIT, "Parsing resolver configuration in '%s'", conf_fname);
- if ((r = evdns_base_resolv_conf_parse(the_evdns_base, flags,
- sandbox_intern_string(conf_fname)))) {
- log_warn(LD_EXIT, "Unable to parse '%s', or no nameservers in '%s' (%d)",
- conf_fname, conf_fname, r);
- goto err;
- }
- if (evdns_base_count_nameservers(the_evdns_base) == 0) {
- log_warn(LD_EXIT, "Unable to find any nameservers in '%s'.", conf_fname);
- goto err;
+
+ if (!missing_resolv_conf) {
+ log_info(LD_EXIT, "Parsing resolver configuration in '%s'", conf_fname);
+ if ((r = evdns_base_resolv_conf_parse(the_evdns_base, flags,
+ sandbox_intern_string(conf_fname)))) {
+ log_warn(LD_EXIT, "Unable to parse '%s', or no nameservers "
+ "in '%s' (%d)", conf_fname, conf_fname, r);
+
+ if (r != 6) // "r = 6" means "no DNS servers were in resolv.conf" -
+ goto err; // in which case we expect libevent to add 127.0.0.1 as
+ // fallback.
+ }
+ if (evdns_base_count_nameservers(the_evdns_base) == 0) {
+ log_warn(LD_EXIT, "Unable to find any nameservers in '%s'.",
+ conf_fname);
+ }
+
+ tor_free(resolv_conf_fname);
+ resolv_conf_fname = tor_strdup(conf_fname);
+ resolv_conf_mtime = st.st_mtime;
+ } else {
+ log_warn(LD_EXIT, "Could not read your DNS config from '%s' - "
+ "please investigate your DNS configuration. "
+ "This is possibly a problem. Meanwhile, falling"
+ " back to local DNS at 127.0.0.1.", conf_fname);
+ evdns_base_nameserver_ip_add(the_evdns_base, "127.0.0.1");
}
- tor_free(resolv_conf_fname);
- resolv_conf_fname = tor_strdup(conf_fname);
- resolv_conf_mtime = st.st_mtime;
+
if (nameservers_configured)
evdns_base_resume(the_evdns_base);
}
diff --git a/src/feature/relay/dns.h b/src/feature/relay/dns.h
index e4474cdf43..7b2a31a311 100644
--- a/src/feature/relay/dns.h
+++ b/src/feature/relay/dns.h
@@ -45,6 +45,11 @@ size_t dns_cache_handle_oom(time_t now, size_t min_remove_bytes);
#ifdef DNS_PRIVATE
#include "feature/relay/dns_structs.h"
+size_t number_of_configured_nameservers(void);
+#ifdef HAVE_EVDNS_BASE_GET_NAMESERVER_ADDR
+tor_addr_t *configured_nameserver_address(const size_t idx);
+#endif
+
MOCK_DECL(STATIC int,dns_resolve_impl,(edge_connection_t *exitconn,
int is_resolve,or_circuit_t *oncirc, char **hostname_out,
int *made_connection_pending_out, cached_resolve_t **resolve_out));
diff --git a/src/feature/relay/ext_orport.c b/src/feature/relay/ext_orport.c
index 56c5bb96f5..8589efb48d 100644
--- a/src/feature/relay/ext_orport.c
+++ b/src/feature/relay/ext_orport.c
@@ -90,7 +90,7 @@ connection_ext_or_transition(or_connection_t *conn)
conn->base_.type = CONN_TYPE_OR;
TO_CONN(conn)->state = 0; // set the state to a neutral value
- control_event_or_conn_status(conn, OR_CONN_EVENT_NEW, 0);
+ connection_or_event_status(conn, OR_CONN_EVENT_NEW, 0);
connection_tls_start_handshake(conn, 1);
}
diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c
index 1dbaf2ed66..12ee1dd6e2 100644
--- a/src/feature/relay/router.c
+++ b/src/feature/relay/router.c
@@ -30,6 +30,7 @@
#include "feature/nodelist/dirlist.h"
#include "feature/nodelist/networkstatus.h"
#include "feature/nodelist/nickname.h"
+#include "feature/nodelist/nodefamily.h"
#include "feature/nodelist/nodelist.h"
#include "feature/nodelist/routerlist.h"
#include "feature/nodelist/torcert.h"
@@ -49,6 +50,7 @@
#include "lib/encoding/confline.h"
#include "lib/osinfo/uname.h"
#include "lib/tls/tortls.h"
+#include "lib/version/torversion.h"
#include "feature/dirauth/authmode.h"
@@ -58,6 +60,7 @@
#include "feature/dircommon/dir_connection_st.h"
#include "feature/nodelist/authority_cert_st.h"
#include "feature/nodelist/extrainfo_st.h"
+#include "feature/nodelist/networkstatus_st.h"
#include "feature/nodelist/node_st.h"
#include "feature/nodelist/routerinfo_st.h"
#include "feature/nodelist/routerstatus_st.h"
@@ -337,6 +340,16 @@ set_server_identity_key(crypto_pk_t *k)
}
}
+#ifdef TOR_UNIT_TESTS
+/** Testing only -- set the server's RSA identity digest to
+ * be <b>digest</b> */
+void
+set_server_identity_key_digest_testing(const uint8_t *digest)
+{
+ memcpy(server_identitykey_digest, digest, DIGEST_LEN);
+}
+#endif
+
/** Make sure that we have set up our identity keys to match or not match as
* appropriate, and die with an assertion if we have not. */
static void
@@ -634,7 +647,7 @@ load_authority_keyset(int legacy, crypto_pk_t **key_out,
fname);
goto done;
}
- parsed = authority_cert_parse_from_string(cert, &eos);
+ parsed = authority_cert_parse_from_string(cert, strlen(cert), &eos);
if (!parsed) {
log_warn(LD_DIR, "Unable to parse certificate in %s", fname);
goto done;
@@ -1467,9 +1480,9 @@ static extrainfo_t *desc_extrainfo = NULL;
static const char *desc_gen_reason = "uninitialized reason";
/** Since when has our descriptor been "clean"? 0 if we need to regenerate it
* now. */
-static time_t desc_clean_since = 0;
+STATIC time_t desc_clean_since = 0;
/** Why did we mark the descriptor dirty? */
-static const char *desc_dirty_reason = "Tor just started";
+STATIC const char *desc_dirty_reason = "Tor just started";
/** Boolean: do we need to regenerate the above? */
static int desc_needs_upload = 0;
@@ -1688,10 +1701,6 @@ router_get_descriptor_gen_reason(void)
return desc_gen_reason;
}
-/** A list of nicknames that we've warned about including in our family
- * declaration verbatim rather than as digests. */
-static smartlist_t *warned_nonexistent_family = NULL;
-
static int router_guess_address_from_dir_headers(uint32_t *guess);
/** Make a current best guess at our address, either because
@@ -1804,6 +1813,132 @@ router_check_descriptor_address_consistency(uint32_t ipv4h_desc_addr)
CONN_TYPE_DIR_LISTENER);
}
+/** A list of nicknames that we've warned about including in our family,
+ * for one reason or another. */
+static smartlist_t *warned_family = NULL;
+
+/**
+ * Return a new smartlist containing the family members configured in
+ * <b>options</b>. Warn about invalid or missing entries. Return NULL
+ * if this relay should not declare a family.
+ **/
+STATIC smartlist_t *
+get_my_declared_family(const or_options_t *options)
+{
+ if (!options->MyFamily)
+ return NULL;
+
+ if (options->BridgeRelay)
+ return NULL;
+
+ if (!warned_family)
+ warned_family = smartlist_new();
+
+ smartlist_t *declared_family = smartlist_new();
+ config_line_t *family;
+
+ /* First we try to get the whole family in the form of hexdigests. */
+ for (family = options->MyFamily; family; family = family->next) {
+ char *name = family->value;
+ const node_t *member;
+ if (options->Nickname && !strcasecmp(name, options->Nickname))
+ continue; /* Don't list ourself by nickname, that's redundant */
+ else
+ member = node_get_by_nickname(name, 0);
+
+ if (!member) {
+ /* This node doesn't seem to exist, so warn about it if it is not
+ * a hexdigest. */
+ int is_legal = is_legal_nickname_or_hexdigest(name);
+ if (!smartlist_contains_string(warned_family, name) &&
+ !is_legal_hexdigest(name)) {
+ if (is_legal)
+ log_warn(LD_CONFIG,
+ "There is a router named %s in my declared family, but "
+ "I have no descriptor for it. I'll use the nickname "
+ "as is, but this may confuse clients. Please list it "
+ "by identity digest instead.", escaped(name));
+ else
+ log_warn(LD_CONFIG, "There is a router named %s in my declared "
+ "family, but that isn't a legal digest or nickname. "
+ "Skipping it.", escaped(name));
+ smartlist_add_strdup(warned_family, name);
+ }
+ if (is_legal) {
+ smartlist_add_strdup(declared_family, name);
+ }
+ } else {
+ /* List the node by digest. */
+ char *fp = tor_malloc(HEX_DIGEST_LEN+2);
+ fp[0] = '$';
+ base16_encode(fp+1,HEX_DIGEST_LEN+1,
+ member->identity, DIGEST_LEN);
+ smartlist_add(declared_family, fp);
+
+ if (! is_legal_hexdigest(name) &&
+ !smartlist_contains_string(warned_family, name)) {
+ /* Warn if this node was not specified by hexdigest. */
+ log_warn(LD_CONFIG, "There is a router named %s in my declared "
+ "family, but it wasn't listed by digest. Please consider "
+ "saying %s instead, if that's what you meant.",
+ escaped(name), fp);
+ smartlist_add_strdup(warned_family, name);
+ }
+ }
+ }
+
+ /* Now declared_family should have the closest we can come to the
+ * identities that the user wanted.
+ *
+ * Unlike older versions of Tor, we _do_ include our own identity: this
+ * helps microdescriptor compression, and helps in-memory compression
+ * on clients. */
+ nodefamily_t *nf = nodefamily_from_members(declared_family,
+ router_get_my_id_digest(),
+ NF_WARN_MALFORMED,
+ NULL);
+ SMARTLIST_FOREACH(declared_family, char *, s, tor_free(s));
+ smartlist_free(declared_family);
+ if (!nf) {
+ return NULL;
+ }
+
+ char *s = nodefamily_format(nf);
+ nodefamily_free(nf);
+
+ smartlist_t *result = smartlist_new();
+ smartlist_split_string(result, s, NULL,
+ SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0);
+ tor_free(s);
+
+ if (smartlist_len(result) == 1) {
+ /* This is a one-element list containing only ourself; instead return
+ * nothing */
+ const char *singleton = smartlist_get(result, 0);
+ bool is_me = false;
+ if (singleton[0] == '$') {
+ char d[DIGEST_LEN];
+ int n = base16_decode(d, sizeof(d), singleton+1, strlen(singleton+1));
+ if (n == DIGEST_LEN &&
+ fast_memeq(d, router_get_my_id_digest(), DIGEST_LEN)) {
+ is_me = true;
+ }
+ }
+ if (!is_me) {
+ // LCOV_EXCL_START
+ log_warn(LD_BUG, "Found a singleton family list with an element "
+ "that wasn't us! Element was %s", escaped(singleton));
+ // LCOV_EXCL_STOP
+ } else {
+ SMARTLIST_FOREACH(result, char *, cp, tor_free(cp));
+ smartlist_free(result);
+ return NULL;
+ }
+ }
+
+ return result;
+}
+
/** Build a fresh routerinfo, signed server descriptor, and extra-info document
* for this OR. Set r to the generated routerinfo, e to the generated
* extra-info document. Return 0 on success, -1 on temporary error. Failure to
@@ -1918,54 +2053,7 @@ router_build_fresh_descriptor(routerinfo_t **r, extrainfo_t **e)
tor_free(p_tmp);
}
- if (options->MyFamily && ! options->BridgeRelay) {
- if (!warned_nonexistent_family)
- warned_nonexistent_family = smartlist_new();
- ri->declared_family = smartlist_new();
- config_line_t *family;
- for (family = options->MyFamily; family; family = family->next) {
- char *name = family->value;
- const node_t *member;
- if (!strcasecmp(name, options->Nickname))
- continue; /* Don't list ourself, that's redundant */
- else
- member = node_get_by_nickname(name, 0);
- if (!member) {
- int is_legal = is_legal_nickname_or_hexdigest(name);
- if (!smartlist_contains_string(warned_nonexistent_family, name) &&
- !is_legal_hexdigest(name)) {
- if (is_legal)
- log_warn(LD_CONFIG,
- "I have no descriptor for the router named \"%s\" in my "
- "declared family; I'll use the nickname as is, but "
- "this may confuse clients.", name);
- else
- log_warn(LD_CONFIG, "There is a router named \"%s\" in my "
- "declared family, but that isn't a legal nickname. "
- "Skipping it.", escaped(name));
- smartlist_add_strdup(warned_nonexistent_family, name);
- }
- if (is_legal) {
- smartlist_add_strdup(ri->declared_family, name);
- }
- } else if (router_digest_is_me(member->identity)) {
- /* Don't list ourself in our own family; that's redundant */
- /* XXX shouldn't be possible */
- } else {
- char *fp = tor_malloc(HEX_DIGEST_LEN+2);
- fp[0] = '$';
- base16_encode(fp+1,HEX_DIGEST_LEN+1,
- member->identity, DIGEST_LEN);
- smartlist_add(ri->declared_family, fp);
- if (smartlist_contains_string(warned_nonexistent_family, name))
- smartlist_string_remove(warned_nonexistent_family, name);
- }
- }
-
- /* remove duplicates from the list */
- smartlist_sort_strings(ri->declared_family);
- smartlist_uniq_strings(ri->declared_family);
- }
+ ri->declared_family = get_my_declared_family(options);
/* Now generate the extrainfo. */
ei = tor_malloc_zero(sizeof(extrainfo_t));
@@ -2131,7 +2219,9 @@ mark_my_descriptor_dirty_if_too_old(time_t now)
/* Now we see whether we want to be retrying frequently or no. The
* rule here is that we'll retry frequently if we aren't listed in the
* live consensus we have, or if the publication time of the
- * descriptor listed for us in the consensus is very old. */
+ * descriptor listed for us in the consensus is very old, or if the
+ * consensus lists us as "stale" and we haven't regenerated since the
+ * consensus was published. */
ns = networkstatus_get_live_consensus(now);
if (ns) {
rs = networkstatus_vote_find_entry(ns, server_identitykey_digest);
@@ -2139,6 +2229,8 @@ mark_my_descriptor_dirty_if_too_old(time_t now)
retry_fast_reason = "not listed in consensus";
else if (rs->published_on < slow_cutoff)
retry_fast_reason = "version listed in consensus is quite old";
+ else if (rs->is_staledesc && ns->valid_after > desc_clean_since)
+ retry_fast_reason = "listed as stale in consensus";
}
if (retry_fast_reason && desc_clean_since < fast_cutoff)
@@ -3055,9 +3147,9 @@ extrainfo_dump_to_string(char **s_out, extrainfo_t *extrainfo,
void
router_reset_warnings(void)
{
- if (warned_nonexistent_family) {
- SMARTLIST_FOREACH(warned_nonexistent_family, char *, cp, tor_free(cp));
- smartlist_clear(warned_nonexistent_family);
+ if (warned_family) {
+ SMARTLIST_FOREACH(warned_family, char *, cp, tor_free(cp));
+ smartlist_clear(warned_family);
}
}
@@ -3081,11 +3173,12 @@ router_free_all(void)
memwipe(&curve25519_onion_key, 0, sizeof(curve25519_onion_key));
memwipe(&last_curve25519_onion_key, 0, sizeof(last_curve25519_onion_key));
- if (warned_nonexistent_family) {
- SMARTLIST_FOREACH(warned_nonexistent_family, char *, cp, tor_free(cp));
- smartlist_free(warned_nonexistent_family);
+ if (warned_family) {
+ SMARTLIST_FOREACH(warned_family, char *, cp, tor_free(cp));
+ smartlist_free(warned_family);
}
}
+
/* From the given RSA key object, convert it to ASN-1 encoded format and set
* the newly allocated object in onion_pkey_out. The length of the key is set
* in onion_pkey_len_out. */
diff --git a/src/feature/relay/router.h b/src/feature/relay/router.h
index bd6a8a012e..60bc857ceb 100644
--- a/src/feature/relay/router.h
+++ b/src/feature/relay/router.h
@@ -117,6 +117,14 @@ void router_free_all(void);
/* Used only by router.c and test.c */
STATIC void get_platform_str(char *platform, size_t len);
STATIC int router_write_fingerprint(int hashed);
+STATIC smartlist_t *get_my_declared_family(const or_options_t *options);
+
+#ifdef TOR_UNIT_TESTS
+extern time_t desc_clean_since;
+extern const char *desc_dirty_reason;
+void set_server_identity_key_digest_testing(const uint8_t *digest);
+#endif
+
#endif
#endif /* !defined(TOR_ROUTER_H) */
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion