reachability.c (8063B)
1 /* Copyright (c) 2001-2004, Roger Dingledine. 2 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. 3 * Copyright (c) 2007-2021, The Tor Project, Inc. */ 4 /* See LICENSE for licensing information */ 5 6 /** 7 * \file reachability.c 8 * \brief Router reachability testing; run by authorities to tell who is 9 * running. 10 */ 11 12 #include "core/or/or.h" 13 #include "feature/dirauth/reachability.h" 14 15 #include "app/config/config.h" 16 #include "core/or/channel.h" 17 #include "core/or/channeltls.h" 18 #include "core/or/command.h" 19 #include "feature/dirauth/authmode.h" 20 #include "feature/dirauth/dirauth_sys.h" 21 #include "feature/nodelist/describe.h" 22 #include "feature/nodelist/nodelist.h" 23 #include "feature/nodelist/routerinfo.h" 24 #include "feature/nodelist/routerlist.h" 25 #include "feature/nodelist/torcert.h" 26 #include "feature/stats/rephist.h" 27 28 #include "feature/dirauth/dirauth_options_st.h" 29 #include "feature/nodelist/node_st.h" 30 #include "feature/nodelist/routerinfo_st.h" 31 #include "feature/nodelist/routerlist_st.h" 32 33 /** Called when a TLS handshake has completed successfully with a 34 * router listening at <b>address</b>:<b>or_port</b>, and has yielded 35 * a certificate with digest <b>digest_rcvd</b>. 36 * 37 * Inform the reachability checker that we could get to this relay. 38 */ 39 void 40 dirserv_orconn_tls_done(const tor_addr_t *addr, 41 uint16_t or_port, 42 const char *digest_rcvd, 43 const ed25519_public_key_t *ed_id_rcvd) 44 { 45 node_t *node = NULL; 46 tor_addr_port_t orport; 47 routerinfo_t *ri = NULL; 48 time_t now = time(NULL); 49 tor_assert(addr); 50 tor_assert(digest_rcvd); 51 52 node = node_get_mutable_by_id(digest_rcvd); 53 if (node == NULL || node->ri == NULL) 54 return; 55 56 ri = node->ri; 57 58 if (dirauth_get_options()->AuthDirTestEd25519LinkKeys && 59 node_supports_ed25519_link_authentication(node, 1) && 60 ri->cache_info.signing_key_cert) { 61 /* We allow the node to have an ed25519 key if we haven't been told one in 62 * the routerinfo, but if we *HAVE* been told one in the routerinfo, it 63 * needs to match. */ 64 const ed25519_public_key_t *expected_id = 65 &ri->cache_info.signing_key_cert->signing_key; 66 tor_assert(!ed25519_public_key_is_zero(expected_id)); 67 if (! ed_id_rcvd || ! ed25519_pubkey_eq(ed_id_rcvd, expected_id)) { 68 log_info(LD_DIRSERV, "Router at %s:%d with RSA ID %s " 69 "did not present expected Ed25519 ID.", 70 fmt_addr(addr), or_port, hex_str(digest_rcvd, DIGEST_LEN)); 71 return; /* Don't mark it as reachable. */ 72 } 73 } 74 75 tor_addr_copy(&orport.addr, addr); 76 orport.port = or_port; 77 if (router_has_orport(ri, &orport)) { 78 /* Found the right router. */ 79 if (!authdir_mode_bridge(get_options()) || 80 ri->purpose == ROUTER_PURPOSE_BRIDGE) { 81 char addrstr[TOR_ADDR_BUF_LEN]; 82 /* This is a bridge or we're not a bridge authority -- 83 mark it as reachable. */ 84 log_info(LD_DIRSERV, "Found router %s to be reachable at %s:%d. Yay.", 85 router_describe(ri), 86 tor_addr_to_str(addrstr, addr, sizeof(addrstr), 1), 87 ri->ipv4_orport); 88 if (tor_addr_family(addr) == AF_INET) { 89 rep_hist_note_router_reachable(digest_rcvd, addr, or_port, now); 90 node->last_reachable = now; 91 } else if (tor_addr_family(addr) == AF_INET6) { 92 /* No rephist for IPv6. */ 93 node->last_reachable6 = now; 94 } 95 } 96 } 97 } 98 99 /** Called when we, as an authority, receive a new router descriptor either as 100 * an upload or a download. Used to decide whether to relaunch reachability 101 * testing for the server. */ 102 int 103 dirserv_should_launch_reachability_test(const routerinfo_t *ri, 104 const routerinfo_t *ri_old) 105 { 106 if (!authdir_mode_handles_descs(get_options(), ri->purpose)) 107 return 0; 108 if (! dirauth_get_options()->AuthDirTestReachability) 109 return 0; 110 if (!ri_old) { 111 /* New router: Launch an immediate reachability test, so we will have an 112 * opinion soon in case we're generating a consensus soon */ 113 log_info(LD_DIR, "descriptor for new router %s", router_describe(ri)); 114 return 1; 115 } 116 if (ri_old->is_hibernating && !ri->is_hibernating) { 117 /* It just came out of hibernation; launch a reachability test */ 118 log_info(LD_DIR, "out of hibernation: router %s", router_describe(ri)); 119 return 1; 120 } 121 if (! routers_have_same_or_addrs(ri, ri_old)) { 122 /* Address or port changed; launch a reachability test */ 123 log_info(LD_DIR, "address or port changed: router %s", 124 router_describe(ri)); 125 return 1; 126 } 127 return 0; 128 } 129 130 /** Helper function for dirserv_test_reachability(). Start a TLS 131 * connection to <b>router</b>, and annotate it with when we started 132 * the test. */ 133 void 134 dirserv_single_reachability_test(time_t now, routerinfo_t *router) 135 { 136 const dirauth_options_t *dirauth_options = dirauth_get_options(); 137 channel_t *chan = NULL; 138 const node_t *node = NULL; 139 const ed25519_public_key_t *ed_id_key; 140 (void) now; 141 142 tor_assert(router); 143 node = node_get_by_id(router->cache_info.identity_digest); 144 tor_assert(node); 145 146 if (dirauth_options->AuthDirTestEd25519LinkKeys && 147 node_supports_ed25519_link_authentication(node, 1) && 148 router->cache_info.signing_key_cert) { 149 ed_id_key = &router->cache_info.signing_key_cert->signing_key; 150 } else { 151 ed_id_key = NULL; 152 } 153 154 /* IPv4. */ 155 log_info(LD_OR,"Testing reachability of %s at %s:%u.", 156 router->nickname, fmt_addr(&router->ipv4_addr), 157 router->ipv4_orport); 158 chan = channel_tls_connect(&router->ipv4_addr, router->ipv4_orport, 159 router->cache_info.identity_digest, 160 ed_id_key); 161 if (chan) command_setup_channel(chan); 162 163 /* Possible IPv6. */ 164 if (dirauth_get_options()->AuthDirHasIPv6Connectivity == 1 && 165 !tor_addr_is_null(&router->ipv6_addr)) { 166 char addrstr[TOR_ADDR_BUF_LEN]; 167 log_info(LD_OR, "Testing reachability of %s at %s:%u.", 168 router->nickname, 169 tor_addr_to_str(addrstr, &router->ipv6_addr, sizeof(addrstr), 1), 170 router->ipv6_orport); 171 chan = channel_tls_connect(&router->ipv6_addr, router->ipv6_orport, 172 router->cache_info.identity_digest, 173 ed_id_key); 174 if (chan) command_setup_channel(chan); 175 } 176 } 177 178 /** Auth dir server only: load balance such that we only 179 * try a few connections per call. 180 * 181 * The load balancing is such that if we get called once every ten 182 * seconds, we will cycle through all the tests in 183 * REACHABILITY_TEST_CYCLE_PERIOD seconds (a bit over 20 minutes). 184 */ 185 void 186 dirserv_test_reachability(time_t now) 187 { 188 /* XXX decide what to do here; see or-talk thread "purging old router 189 * information, revocation." -NM 190 * We can't afford to mess with this in 0.1.2.x. The reason is that 191 * if we stop doing reachability tests on some of routerlist, then 192 * we'll for-sure think they're down, which may have unexpected 193 * effects in other parts of the code. It doesn't hurt much to do 194 * the testing, and directory authorities are easy to upgrade. Let's 195 * wait til 0.2.0. -RD */ 196 // time_t cutoff = now - ROUTER_MAX_AGE_TO_PUBLISH; 197 if (! dirauth_get_options()->AuthDirTestReachability) 198 return; 199 200 routerlist_t *rl = router_get_routerlist(); 201 static char ctr = 0; 202 int bridge_auth = authdir_mode_bridge(get_options()); 203 204 SMARTLIST_FOREACH_BEGIN(rl->routers, routerinfo_t *, router) { 205 const char *id_digest = router->cache_info.identity_digest; 206 if (router_is_me(router)) 207 continue; 208 if (bridge_auth && router->purpose != ROUTER_PURPOSE_BRIDGE) 209 continue; /* bridge authorities only test reachability on bridges */ 210 // if (router->cache_info.published_on > cutoff) 211 // continue; 212 if ((((uint8_t)id_digest[0]) % REACHABILITY_MODULO_PER_TEST) == ctr) { 213 dirserv_single_reachability_test(now, router); 214 } 215 } SMARTLIST_FOREACH_END(router); 216 ctr = (ctr + 1) % REACHABILITY_MODULO_PER_TEST; /* increment ctr */ 217 }