dirserv.c 12.3 KB
Newer Older
1
2
3
4
5
6
/* Copyright 2001,2002,2003 Roger Dingledine, Matej Pfajfar. */
/* See LICENSE for licensing information */
/* $Id$ */

#include "or.h"

7
8
extern or_options_t options; /* command-line and config-file options */

9
10
11
12
static int the_directory_is_dirty = 1;
static char *the_directory = NULL;
static int the_directory_len = -1;

13
14
static int list_running_servers(char **nicknames_out);

15
16
/************** Fingerprint handling code ************/

17
18
19
20
21
22
23
24
typedef struct fingerprint_entry_t {
  char *nickname;
  char *fingerprint;
} fingerprint_entry_t;

static fingerprint_entry_t fingerprint_list[MAX_ROUTERS_IN_DIR];
static int n_fingerprints = 0;

Nick Mathewson's avatar
Nick Mathewson committed
25
26
27
28
29
30
31
static void
add_fingerprint_to_dir(const char *nickname, const char *fp)
{
  int i;
  for (i = 0; i < n_fingerprints; ++i) {
    if (!strcasecmp(fingerprint_list[i].nickname,nickname)) {
      free(fingerprint_list[i].fingerprint);
32
      fingerprint_list[i].fingerprint = tor_strdup(fp);
Nick Mathewson's avatar
Nick Mathewson committed
33
34
35
      return;
    }
  }
36
37
  fingerprint_list[n_fingerprints].nickname = tor_strdup(nickname);
  fingerprint_list[n_fingerprints].fingerprint = tor_strdup(fp);
Nick Mathewson's avatar
Nick Mathewson committed
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
  ++n_fingerprints;
}

int
dirserv_add_own_fingerprint(const char *nickname, crypto_pk_env_t *pk)
{
  char fp[FINGERPRINT_LEN+1];
  if (crypto_pk_get_fingerprint(pk, fp)<0) {
    log_fn(LOG_ERR, "Error computing fingerprint");
    return -1;
  }
  add_fingerprint_to_dir(nickname, fp);
  return 0;
}

53
54
55
56
57
/* return 0 on success, -1 on failure */
int 
dirserv_parse_fingerprint_file(const char *fname)
{
  FILE *file;
58
59
  char line[FINGERPRINT_LEN+MAX_NICKNAME_LEN+20+1];
  char *nickname, *fingerprint;
60
61
  fingerprint_entry_t fingerprint_list_tmp[MAX_ROUTERS_IN_DIR];
  int n_fingerprints_tmp = 0;
62
63
64
65
66
  int i, result;

  if(!(file = fopen(fname, "r"))) {
    log_fn(LOG_WARNING, "Cannot open fingerprint file %s", fname);
    return -1;
67
  }
68
  while( (result=parse_line_from_file(line, sizeof(line),file,&nickname,&fingerprint)) > 0) {
69
    if (strlen(nickname) > MAX_NICKNAME_LEN) {
70
71
      log(LOG_WARNING, "Nickname %s too long in fingerprint file. Skipping.", nickname);
      continue;
72
    }
73
74
75
76
77
    if(strlen(fingerprint) != FINGERPRINT_LEN ||
       !crypto_pk_check_fingerprint_syntax(fingerprint)) {
      log_fn(LOG_WARNING, "Invalid fingerprint (nickname %s, fingerprint %s). Skipping.",
             nickname, fingerprint);
      continue;
78
79
80
    }
    for (i = 0; i < n_fingerprints_tmp; ++i) {
      if (0==strcasecmp(fingerprint_list_tmp[i].nickname, nickname)) {
81
82
        log(LOG_WARNING, "Duplicate nickname %s. Skipping.",nickname);
        break; /* out of the for. the 'if' below means skip to the next line. */
83
84
      }
    }
85
    if(i == n_fingerprints_tmp) { /* not a duplicate */
86
87
      fingerprint_list_tmp[n_fingerprints_tmp].nickname = tor_strdup(nickname);
      fingerprint_list_tmp[n_fingerprints_tmp].fingerprint = tor_strdup(fingerprint);
88
89
      ++n_fingerprints_tmp;
    }
90
  }
91
92
93
94
95
96
97
98
99
100
  fclose(file);
  if(result == 0) { /* eof; replace the global fingerprints list. */
    dirserv_free_fingerprint_list();
    memcpy(fingerprint_list, fingerprint_list_tmp,
           sizeof(fingerprint_entry_t)*n_fingerprints_tmp);
    n_fingerprints = n_fingerprints_tmp;
    return 0;
  }
  /* error */
  log_fn(LOG_WARNING, "Error reading from fingerprint file");
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
  for (i = 0; i < n_fingerprints_tmp; ++i) {
    free(fingerprint_list_tmp[i].nickname);
    free(fingerprint_list_tmp[i].fingerprint);
  }
  return -1;
}    

/* return 1 if router's identity and nickname match. */
int
dirserv_router_fingerprint_is_known(const routerinfo_t *router)
{
  int i;
  fingerprint_entry_t *ent =NULL;
  char fp[FINGERPRINT_LEN+1];

Nick Mathewson's avatar
Nick Mathewson committed
116
  log_fn(LOG_DEBUG, "%d fingerprints known.", n_fingerprints);
117
  for (i=0;i<n_fingerprints;++i) {
Nick Mathewson's avatar
Nick Mathewson committed
118
    log_fn(LOG_DEBUG,"%s vs %s", router->nickname, fingerprint_list[i].nickname);
119
120
121
122
123
124
    if (!strcasecmp(router->nickname,fingerprint_list[i].nickname)) {
      ent = &fingerprint_list[i];
      break;
    }
  }
  
125
  if (!ent) { /* No such server known */
Nick Mathewson's avatar
Nick Mathewson committed
126
    log_fn(LOG_WARNING,"no fingerprint found for %s",router->nickname);
127
128
129
    return 0;
  }
  if (crypto_pk_get_fingerprint(router->identity_pkey, fp)) {
130
    log_fn(LOG_WARNING,"error computing fingerprint");
131
132
133
    return 0;
  }
  if (0==strcasecmp(ent->fingerprint, fp)) {
Nick Mathewson's avatar
Nick Mathewson committed
134
    log_fn(LOG_DEBUG,"good fingerprint for %s",router->nickname);
135
    return 1; /* Right fingerprint. */
136
  } else {
Nick Mathewson's avatar
Nick Mathewson committed
137
    log_fn(LOG_WARNING,"mismatched fingerprint for %s",router->nickname);
138
    return 0; /* Wrong fingerprint. */
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
  }
}

void 
dirserv_free_fingerprint_list()
{
  int i;
  for (i = 0; i < n_fingerprints; ++i) {
    free(fingerprint_list[i].nickname);
    free(fingerprint_list[i].fingerprint);
  }
  n_fingerprints = 0;
}

/*
 *    Descriptor list
 */
typedef struct descriptor_entry_t {
  char *nickname;
  time_t published;
  size_t desc_len;
  char *descriptor;
} descriptor_entry_t;

static descriptor_entry_t *descriptor_list[MAX_ROUTERS_IN_DIR];
static int n_descriptors = 0;

static void free_descriptor_entry(descriptor_entry_t *desc)
{
  if (desc->descriptor)
    free(desc->descriptor);
  if (desc->nickname)
    free(desc->nickname);
  free(desc);
}

void 
dirserv_free_descriptors()
{
  int i;
  for (i = 0; i < n_descriptors; ++i) {
    free_descriptor_entry(descriptor_list[i]);
  }
  n_descriptors = 0;
}

/* Return 0 if descriptor added; -1 if descriptor rejected.  Updates *desc
 * to point after the descriptor if the descriptor is OK.
 */
int
dirserv_add_descriptor(const char **desc)
{
  descriptor_entry_t **desc_ent_ptr;
  routerinfo_t *ri = NULL;
  int i;
  char *start, *end;
195
  char *desc_tmp = NULL, *cp;
196
197
198
199
200
201
202
  size_t desc_len;

  start = strstr(*desc, "router ");
  if (!start) {
    log(LOG_WARNING, "no descriptor found.");
    goto err;
  }
203
  if ((end = strstr(start+6, "\nrouter "))) {
204
    ++end; /* Include NL. */
205
206
  } else if ((end = strstr(start+6, "\ndirectory-signature"))) {
    ++end;
207
208
209
210
  } else {
    end = start+strlen(start);
  }
  desc_len = end-start;
211
  cp = desc_tmp = tor_malloc(desc_len+1);
212
213
214
215
  strncpy(desc_tmp, start, desc_len);
  desc_tmp[desc_len]='\0';

  /* Check: is the descriptor syntactically valid? */
216
  ri = router_get_entry_from_string(&cp);
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
  if (!ri) {
    log(LOG_WARNING, "Couldn't parse descriptor");
    goto err;
  }
  free(desc_tmp); desc_tmp = NULL;
  /* Okay.  Now check whether the fingerprint is recognized. */
  if (!dirserv_router_fingerprint_is_known(ri)) {
    log(LOG_WARNING, "Identity is unrecognized for descriptor");
    goto err;
  }
  /* Do we already have an entry for this router? */
  desc_ent_ptr = NULL;
  for (i = 0; i < n_descriptors; ++i) {
    if (!strcasecmp(ri->nickname, descriptor_list[i]->nickname)) {
      desc_ent_ptr = &descriptor_list[i];
      break;
    }
  }
  if (desc_ent_ptr) {
    /* if so, decide whether to update it. */
    if ((*desc_ent_ptr)->published > ri->published_on) {
      /* We already have a newer descriptor */
239
      log_fn(LOG_INFO,"We already have a newer desc for nickname %s. Not adding.",ri->nickname);
Nick Mathewson's avatar
Nick Mathewson committed
240
241
242
243
244
      /* This isn't really an error; return. */
      if (desc_tmp) free(desc_tmp);
      if (ri) routerinfo_free(ri);
      *desc = end;
      return 0;
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
    }
    /* We don't have a newer one; we'll update this one. */
    free_descriptor_entry(*desc_ent_ptr);
  } else {
    /* Add this at the end. */
    desc_ent_ptr = &descriptor_list[n_descriptors++];
  }
  
  (*desc_ent_ptr) = tor_malloc(sizeof(descriptor_entry_t));
  (*desc_ent_ptr)->nickname = ri->nickname;
  (*desc_ent_ptr)->published = ri->published_on;
  (*desc_ent_ptr)->desc_len = desc_len;
  (*desc_ent_ptr)->descriptor = tor_malloc(desc_len+1);
  strncpy((*desc_ent_ptr)->descriptor, start, desc_len);
  (*desc_ent_ptr)->descriptor[desc_len] = '\0';
  *desc = end;
  the_directory_is_dirty = 1;
  
  routerinfo_free(ri);
  return 0;
 err:
  if (desc_tmp)
    free(desc_tmp);
  if (ri)
    routerinfo_free(ri);
  
  return -1;
}

void 
directory_set_dirty()
{
  the_directory_is_dirty = 1;
}

int 
dirserv_init_from_directory_string(const char *dir)
{
  const char *cp = dir;
  while(1) {
    cp = strstr(cp, "\nrouter ");
    if (!cp) break;
    ++cp;
    if (dirserv_add_descriptor(&cp)) {
      return -1;
    }
    --cp; /*Back up to newline.*/
  }
  return 0;
}

296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
static int 
list_running_servers(char **nicknames_out)
{
  char *nickname_lst[MAX_ROUTERS_IN_DIR];
  connection_t **connection_array;
  int n_conns;
  connection_t *conn;
  char *cp;
  int n = 0, i;
  int length;
  *nicknames_out = NULL;
  nickname_lst[n++] = options.Nickname;
  
  get_connection_array(&connection_array, &n_conns);
  for (i = 0; i<n_conns; ++i) {
    conn = connection_array[i];
    if (conn->type != CONN_TYPE_OR || conn->state != OR_CONN_STATE_OPEN)
      continue; /* only list successfully handshaked OR's. */
    if(!conn->nickname) /* it's an OP, don't list it */
      continue;
    nickname_lst[n++] = conn->nickname;
  }
  length = n + 1; /* spaces + EOS + 1. */
  for (i = 0; i<n; ++i) {
    length += strlen(nickname_lst[i]);
  }
  *nicknames_out = tor_malloc(length);
  cp = *nicknames_out;
  memset(cp,0,length);
  for (i = 0; i<n; ++i) {
    if (i)
      strcat(cp, " ");
    strcat(cp, nickname_lst[i]);
    while (*cp) 
      ++cp;
  }
  return 0;
}


336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
int
dirserv_dump_directory_to_string(char *s, int maxlen,
                                 crypto_pk_env_t *private_key)
{
  char *cp, *eos;
  char digest[20];
  char signature[128];
  char published[33];
  time_t published_on;
  int i;
  eos = s+maxlen;

  if (list_running_servers(&cp))
    return -1;
  published_on = time(NULL);
  strftime(published, 32, "%Y-%m-%d %H:%M:%S", gmtime(&published_on));
  snprintf(s, maxlen,
           "signed-directory\n"
           "published %s\n"
           "recommended-software "RECOMMENDED_SOFTWARE_VERSIONS"\n"
           "running-routers %s\n", published, cp);
  free(cp);
  i = strlen(s);
  cp = s+i;
  
  for (i = 0; i < n_descriptors; ++i) {
    strncat(cp, descriptor_list[i]->descriptor, descriptor_list[i]->desc_len);
    cp += descriptor_list[i]->desc_len;
364
    assert(!*cp);
365
366
367
368
369
370
371
372
373
  }
  /* These multiple strlen calls are inefficient, but dwarfed by the RSA
     signature.
  */
  i = strlen(s);
  strncat(s, "directory-signature\n", maxlen-i);
  i = strlen(s);
  cp = s + i;
  
Nick Mathewson's avatar
Nick Mathewson committed
374
  if (router_get_dir_hash(s,digest)) {
375
376
377
378
379
380
381
    log_fn(LOG_WARNING,"couldn't compute digest");
    return -1;
  }
  if (crypto_pk_private_sign(private_key, digest, 20, signature) < 0) {
    log_fn(LOG_WARNING,"couldn't sign digest");
    return -1;
  }
382
383
384
  log(LOG_DEBUG,"generated directory digest begins with %02x:%02x:%02x:%02x",
      ((int)digest[0])&0xff,((int)digest[1])&0xff,
      ((int)digest[2])&0xff,((int)digest[3])&0xff);
385
386
387
388
389
390
391
  
  strncpy(cp, 
          "-----BEGIN SIGNATURE-----\n", maxlen-i);
          
  i = strlen(s);
  cp = s+i;
  if (base64_encode(cp, maxlen-i, signature, 128) < 0) {
Nick Mathewson's avatar
Nick Mathewson committed
392
    log_fn(LOG_WARNING,"couldn't base64-encode signature");
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
    return -1;
  }

  i = strlen(s);
  cp = s+i;
  strncat(cp, "-----END SIGNATURE-----\n", maxlen-i);
  i = strlen(s);
  if (i == maxlen) {
    log_fn(LOG_WARNING,"tried to exceed string length.");
    return -1;
  }

  return 0;
}

size_t dirserv_get_directory(const char **directory)
{
  char *new_directory;
411
  char filename[512];
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
  if (the_directory_is_dirty) {
    new_directory = tor_malloc(MAX_DIR_SIZE);
    if (dirserv_dump_directory_to_string(new_directory, MAX_DIR_SIZE,
                                         get_identity_key())) {
      log(LOG_WARNING, "Error creating directory.");
      free(new_directory);
      return 0;
    }
    if (the_directory)
      free(the_directory);
    the_directory = new_directory;
    the_directory_len = strlen(the_directory);
    log_fn(LOG_INFO,"New directory (size %d):\n%s",the_directory_len,
           the_directory);
    the_directory_is_dirty = 0;
    /* Now read the directory we just made in order to update our own
     * router lists.  This does more signature checking than is strictly
     * necessary, but safe is better than sorry. */
430
    new_directory = tor_strdup(the_directory);
431
    /* use a new copy of the dir, since get_dir_from_string scribbles on it */
432
433
434
435
436
    if (router_get_dir_from_string(new_directory, get_identity_key())) {
      log_fn(LOG_ERR, "We just generated a directory we can't parse. Dying.");
      exit(0);
    }
    free(new_directory);
437
438
439
440
    sprintf(filename,"%s/cached-directory", options.DataDirectory);
    if(write_str_to_file(filename,the_directory) < 0) {
      log_fn(LOG_WARNING, "Couldn't write cached directory to disk. Ignoring.");
    }
441
442
443
444
445
446
  } else {
    log(LOG_INFO,"Directory still clean, reusing.");
  }
  *directory = the_directory;
  return the_directory_len;
}