/* Copyright (c) 2001 Matej Pfajfar.

 * Copyright (c) 2001-2004, Roger Dingledine.

 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.

 * Copyright (c) 2007-2021, The Tor Project, Inc. */

/* See LICENSE for licensing information */

/**

 * \file config.c

 * \brief Code to interpret the user's configuration of Tor.

 *

 * This module handles torrc configuration file, including parsing it,

 * combining it with torrc.defaults and the command line, allowing

 * user changes to it (via editing and SIGHUP or via the control port),

 * writing it back to disk (because of SAVECONF from the control port),

 * and -- most importantly, acting on it.

 *

 * The module additionally has some tools for manipulating and

 * inspecting values that are calculated as a result of the

 * configured options.

 *

 * <h3>How to add new options</h3>

 *

 * To add new items to the torrc, there are a minimum of three places to edit:

 * <ul>

 *   <li>The or_options_t structure in or_options_st.h, where the options are

 *       stored.

 *   <li>The option_vars_ array below in this module, which configures

 *       the names of the torrc options, their types, their multiplicities,

 *       and their mappings to fields in or_options_t.

 *   <li>The manual in doc/man/tor.1.txt, to document what the new option

 *       is, and how it works.

 * </ul>

 *

 * Additionally, you might need to edit these places too:

 * <ul>

 *   <li>options_validate_cb() below, in case you want to reject some possible

 *       values of the new configuration option.

 *   <li>options_transition_allowed() below, in case you need to

 *       forbid some or all changes in the option while Tor is

 *       running.

 *   <li>options_transition_affects_workers(), in case changes in the option

 *       might require Tor to relaunch or reconfigure its worker threads.

 *       (This function is now in the relay module.)

 *   <li>options_transition_affects_descriptor(), in case changes in the

 *       option might require a Tor relay to build and publish a new server

 *       descriptor.

 *       (This function is now in the relay module.)

 *   <li>options_act() and/or options_act_reversible(), in case there's some

 *       action that needs to be taken immediately based on the option's

 *       value.

 * </ul>

 *

 * <h3>Changing the value of an option</h3>

 *

 * Because of the SAVECONF command from the control port, it's a bad

 * idea to change the value of any user-configured option in the

 * or_options_t.  If you want to sometimes do this anyway, we recommend

 * that you create a secondary field in or_options_t; that you have the

 * user option linked only to the secondary field; that you use the

 * secondary field to initialize the one that Tor actually looks at; and that

 * you use the one Tor looks as the one that you modify.

 **/

#define CONFIG_PRIVATE

#include "core/or/or.h"

#include "app/config/config.h"

#include "lib/confmgt/confmgt.h"

#include "app/config/statefile.h"

#include "app/main/main.h"

#include "app/main/subsysmgr.h"

#include "core/mainloop/connection.h"

#include "core/mainloop/mainloop.h"

#include "core/mainloop/netstatus.h"

#include "core/or/channel.h"

#include "core/or/circuitlist.h"

#include "core/or/circuitmux.h"

#include "core/or/circuitmux_ewma.h"

#include "core/or/circuitstats.h"

#include "core/or/connection_edge.h"

#include "trunnel/conflux.h"

#include "core/or/dos.h"

#include "core/or/policies.h"

#include "core/or/relay.h"

#include "core/or/scheduler.h"

#include "feature/client/addressmap.h"

#include "feature/client/bridges.h"

#include "feature/client/entrynodes.h"

#include "feature/client/transports.h"

#include "feature/control/control.h"

#include "feature/control/control_auth.h"

#include "feature/control/control_events.h"

#include "feature/dircache/dirserv.h"

#include "feature/dirclient/dirclient_modes.h"

#include "feature/hibernate/hibernate.h"

#include "feature/hs/hs_config.h"

#include "feature/hs/hs_pow.h"

#include "feature/metrics/metrics.h"

#include "feature/nodelist/dirlist.h"

#include "feature/nodelist/networkstatus.h"

#include "feature/nodelist/nickname.h"

#include "feature/nodelist/nodelist.h"

#include "feature/nodelist/routerlist.h"

#include "feature/nodelist/routerset.h"

#include "feature/relay/dns.h"

#include "feature/relay/ext_orport.h"

#include "feature/relay/routermode.h"

#include "feature/relay/relay_config.h"

#include "feature/relay/transport_config.h"

#include "lib/geoip/geoip.h"

#include "feature/stats/geoip_stats.h"

#include "lib/compress/compress.h"

#include "lib/confmgt/structvar.h"

#include "lib/crypt_ops/crypto_init.h"

#include "lib/crypt_ops/crypto_rand.h"

#include "lib/crypt_ops/crypto_util.h"

#include "lib/encoding/confline.h"

#include "lib/net/resolve.h"

#include "lib/sandbox/sandbox.h"

#include "lib/version/torversion.h"

#ifdef ENABLE_NSS

#include "lib/crypt_ops/crypto_nss_mgt.h"

#else

#include "lib/crypt_ops/crypto_openssl_mgt.h"

#endif

#ifdef _WIN32

#include <shlobj.h>

#endif

#ifdef HAVE_FCNTL_H

#include <fcntl.h>

#endif

#ifdef HAVE_SYS_STAT_H

#include <sys/stat.h>

#endif

#ifdef HAVE_SYS_PARAM_H

#include <sys/param.h>

#endif

#ifdef HAVE_UNISTD_H

#include <unistd.h>

#endif

#include "lib/meminfo/meminfo.h"

#include "lib/osinfo/uname.h"

#include "lib/osinfo/libc.h"

#include "lib/process/daemon.h"

#include "lib/process/pidfile.h"

#include "lib/process/restrict.h"

#include "lib/process/setuid.h"

#include "lib/process/process.h"

#include "lib/net/gethostname.h"

#include "lib/thread/numcpus.h"

#include "lib/encoding/keyval.h"

#include "lib/fs/conffile.h"

#include "lib/evloop/procmon.h"

#include "feature/dirauth/authmode.h"

#include "feature/dirauth/dirauth_config.h"

#include "core/or/connection_st.h"

#include "core/or/port_cfg_st.h"

#ifdef HAVE_SYSTEMD

#   if defined(__COVERITY__) && !defined(__INCLUDE_LEVEL__)

/* Systemd's use of gcc's __INCLUDE_LEVEL__ extension macro appears to confuse

 * Coverity. Here's a kludge to unconfuse it.

 */

#   define __INCLUDE_LEVEL__ 2

#endif /* defined(__COVERITY__) && !defined(__INCLUDE_LEVEL__) */

#include <systemd/sd-daemon.h>

#endif /* defined(HAVE_SYSTEMD) */

/* Prefix used to indicate a Unix socket in a FooPort configuration. */

static const char unix_socket_prefix[] = "unix:";

/* Prefix used to indicate a Unix socket with spaces in it, in a FooPort

 * configuration. */

static const char unix_q_socket_prefix[] = "unix:\"";

/* limits for TCP send and recv buffer size used for constrained sockets */

#define MIN_CONSTRAINED_TCP_BUFFER 2048

#define MAX_CONSTRAINED_TCP_BUFFER 262144  /* 256k */

/** macro to help with the bulk rename of *DownloadSchedule to

 * *DownloadInitialDelay . */

#ifndef COCCI

#define DOWNLOAD_SCHEDULE(name) \

  { (#name "DownloadSchedule"), (#name "DownloadInitialDelay"), 0, 1 }

#else

#define DOWNLOAD_SCHEDULE(name) { NULL, NULL, 0, 1 }

#endif /* !defined(COCCI) */

/** A list of abbreviations and aliases to map command-line options, obsolete

 * option names, or alternative option names, to their current values. */

static const config_abbrev_t option_abbrevs_[] = {

  PLURAL(AuthDirBadDirCC),

  PLURAL(AuthDirBadExitCC),

  PLURAL(AuthDirInvalidCC),

  PLURAL(AuthDirMiddleOnlyCC),

  PLURAL(AuthDirRejectCC),

  PLURAL(EntryNode),

  PLURAL(ExcludeNode),

  PLURAL(FirewallPort),

  PLURAL(LongLivedPort),

  PLURAL(HiddenServiceNode),

  PLURAL(HiddenServiceExcludeNode),

  PLURAL(NumCPU),

  PLURAL(RendNode),

  PLURAL(RecommendedPackage),

  PLURAL(RendExcludeNode),

  PLURAL(StrictEntryNode),

  PLURAL(StrictExitNode),

  PLURAL(StrictNode),

  { "l", "Log", 1, 0},

  { "AllowUnverifiedNodes", "AllowInvalidNodes", 0, 0},

  { "AutomapHostSuffixes", "AutomapHostsSuffixes", 0, 0},

  { "AutomapHostOnResolve", "AutomapHostsOnResolve", 0, 0},

  { "BandwidthRateBytes", "BandwidthRate", 0, 0},

  { "BandwidthBurstBytes", "BandwidthBurst", 0, 0},

  { "DirFetchPostPeriod", "StatusFetchPeriod", 0, 0},

  { "DirServer", "DirAuthority", 0, 0}, /* XXXX later, make this warn? */

  { "MaxConn", "ConnLimit", 0, 1},

  { "MaxMemInCellQueues", "MaxMemInQueues", 0, 0},

  { "ORBindAddress", "ORListenAddress", 0, 0},

  { "DirBindAddress", "DirListenAddress", 0, 0},

  { "SocksBindAddress", "SocksListenAddress", 0, 0},

  { "UseHelperNodes", "UseEntryGuards", 0, 0},

  { "NumHelperNodes", "NumEntryGuards", 0, 0},

  { "UseEntryNodes", "UseEntryGuards", 0, 0},

  { "NumEntryNodes", "NumEntryGuards", 0, 0},

  { "ResolvConf", "ServerDNSResolvConfFile", 0, 1},

  { "SearchDomains", "ServerDNSSearchDomains", 0, 1},

  { "ServerDNSAllowBrokenResolvConf", "ServerDNSAllowBrokenConfig", 0, 0},

  { "PreferTunnelledDirConns", "PreferTunneledDirConns", 0, 0},

  { "BridgeAuthoritativeDirectory", "BridgeAuthoritativeDir", 0, 0},

  { "HashedControlPassword", "__HashedControlSessionPassword", 1, 0},

  { "VirtualAddrNetwork", "VirtualAddrNetworkIPv4", 0, 0},

  { "SocksSocketsGroupWritable", "UnixSocksGroupWritable", 0, 1},

  { "_HSLayer2Nodes", "HSLayer2Nodes", 0, 1 },

  { "_HSLayer3Nodes", "HSLayer3Nodes", 0, 1 },

  DOWNLOAD_SCHEDULE(ClientBootstrapConsensusAuthority),

  DOWNLOAD_SCHEDULE(ClientBootstrapConsensusAuthorityOnly),

  DOWNLOAD_SCHEDULE(ClientBootstrapConsensusFallback),

  DOWNLOAD_SCHEDULE(TestingBridge),

  DOWNLOAD_SCHEDULE(TestingBridgeBootstrap),

  DOWNLOAD_SCHEDULE(TestingClient),

  DOWNLOAD_SCHEDULE(TestingClientConsensus),

  DOWNLOAD_SCHEDULE(TestingServer),

  DOWNLOAD_SCHEDULE(TestingServerConsensus),

  { NULL, NULL, 0, 0},

};

/** dummy instance of or_options_t, used for type-checking its

 * members with CONF_CHECK_VAR_TYPE. */

DUMMY_TYPECHECK_INSTANCE(or_options_t);

/** An entry for config_vars: "The option <b>varname</b> has type

 * CONFIG_TYPE_<b>conftype</b>, and corresponds to

 * or_options_t.<b>member</b>"

 */

#define VAR(varname,conftype,member,initvalue)                          \

  CONFIG_VAR_ETYPE(or_options_t, varname, conftype, member, 0, initvalue)

/* As VAR, but uses a type definition in addition to a type enum. */

#define VAR_D(varname,conftype,member,initvalue)                        \

  CONFIG_VAR_DEFN(or_options_t, varname, conftype, member, 0, initvalue)

#define VAR_NODUMP(varname,conftype,member,initvalue)             \

  CONFIG_VAR_ETYPE(or_options_t, varname, conftype, member,       \

                   CFLG_NODUMP, initvalue)

#define VAR_NODUMP_IMMUTABLE(varname,conftype,member,initvalue)   \

  CONFIG_VAR_ETYPE(or_options_t, varname, conftype, member,       \

                   CFLG_NODUMP | CFLG_IMMUTABLE, initvalue)

#define VAR_INVIS(varname,conftype,member,initvalue)              \

  CONFIG_VAR_ETYPE(or_options_t, varname, conftype, member,       \

                   CFLG_NODUMP | CFLG_NOSET | CFLG_NOLIST, initvalue)

#define V(member,conftype,initvalue)            \

  VAR(#member, conftype, member, initvalue)

#define VAR_IMMUTABLE(varname, conftype, member, initvalue)             \

  CONFIG_VAR_ETYPE(or_options_t, varname, conftype, member,             \

                   CFLG_IMMUTABLE, initvalue)

#define V_IMMUTABLE(member,conftype,initvalue)                 \

  VAR_IMMUTABLE(#member, conftype, member, initvalue)

/** As V, but uses a type definition instead of a type enum */

#define V_D(member,type,initvalue)              \

  VAR_D(#member, type, member, initvalue)

/** An entry for config_vars: "The option <b>varname</b> is obsolete." */

#define OBSOLETE(varname) CONFIG_VAR_OBSOLETE(varname)

/**

 * Macro to declare *Port options.  Each one comes in three entries.

 * For example, most users should use "SocksPort" to configure the

 * socks port, but TorBrowser wants to use __SocksPort so that it

 * isn't stored by SAVECONF.  The SocksPortLines virtual option is

 * used to query both options from the controller.

 */

#define VPORT(member)                                           \

  VAR(#member "Lines", LINELIST_V, member ## _lines, NULL),     \

  VAR(#member, LINELIST_S, member ## _lines, NULL),             \

  VAR_NODUMP("__" #member, LINELIST_S, member ## _lines, NULL)

/** UINT64_MAX as a decimal string */

#define UINT64_MAX_STRING "18446744073709551615"

/** Array of configuration options.  Until we disallow nonstandard

 * abbreviations, order is significant, since the first matching option will

 * be chosen first.

 */

static const config_var_t option_vars_[] = {

  V(AccountingMax,               MEMUNIT,  "0 bytes"),

  VAR("AccountingRule",          STRING,   AccountingRule_option,  "max"),

  V(AccountingStart,             STRING,   NULL),

  V(Address,                     LINELIST, NULL),

  V(AddressDisableIPv6,          BOOL,     "0"),

  OBSOLETE("AllowDotExit"),

  OBSOLETE("AllowInvalidNodes"),

  V(AllowNonRFC953Hostnames,     BOOL,     "0"),

  OBSOLETE("AllowSingleHopCircuits"),

  OBSOLETE("AllowSingleHopExits"),

  V(AlternateBridgeAuthority,    LINELIST, NULL),

  V(AlternateDirAuthority,       LINELIST, NULL),

  OBSOLETE("AlternateHSAuthority"),

  V(AssumeReachable,             BOOL,     "0"),

  V(AssumeReachableIPv6,         AUTOBOOL, "auto"),

  OBSOLETE("AuthDirBadDir"),

  OBSOLETE("AuthDirBadDirCCs"),

  V(AuthDirBadExit,              LINELIST, NULL),

  V(AuthDirBadExitCCs,           CSV,      ""),

  V(AuthDirInvalid,              LINELIST, NULL),

  V(AuthDirInvalidCCs,           CSV,      ""),

  V(AuthDirMiddleOnly,           LINELIST, NULL),

  V(AuthDirMiddleOnlyCCs,        CSV,      ""),

  V(AuthDirReject,               LINELIST, NULL),

  V(AuthDirRejectCCs,            CSV,      ""),

  OBSOLETE("AuthDirRejectUnlisted"),

  OBSOLETE("AuthDirListBadDirs"),

  OBSOLETE("AuthDirMaxServersPerAuthAddr"),

  VAR("AuthoritativeDirectory",  BOOL, AuthoritativeDir,    "0"),

  V(AutomapHostsOnResolve,       BOOL,     "0"),

  V(AutomapHostsSuffixes,        CSV,      ".onion,.exit"),

  V(AvoidDiskWrites,             BOOL,     "0"),

  V(BandwidthBurst,              MEMUNIT,  "1 GB"),

  V(BandwidthRate,               MEMUNIT,  "1 GB"),

  V(BridgeAuthoritativeDir,      BOOL,     "0"),

  VAR("Bridge",                  LINELIST, Bridges,    NULL),

  V(BridgePassword,              STRING,   NULL),

  V(BridgeRecordUsageByCountry,  BOOL,     "1"),

  V(BridgeRelay,                 BOOL,     "0"),

  V(BridgeDistribution,          STRING,   NULL),

  VAR_IMMUTABLE("CacheDirectory",FILENAME, CacheDirectory_option, NULL),

  V(CacheDirectoryGroupReadable, AUTOBOOL,     "auto"),

  V(CellStatistics,              BOOL,     "0"),

  V(PaddingStatistics,           BOOL,     "1"),

  V(OverloadStatistics,          BOOL,     "1"),

  V(LearnCircuitBuildTimeout,    BOOL,     "1"),

  V(CircuitBuildTimeout,         INTERVAL, "0"),

  OBSOLETE("CircuitIdleTimeout"),

  V(CircuitsAvailableTimeout,    INTERVAL, "0"),

  V(CircuitStreamTimeout,        INTERVAL, "0"),

  V(CircuitPriorityHalflife,     DOUBLE,  "-1.0"), /*negative:'Use default'*/

  V(ClientDNSRejectInternalAddresses, BOOL,"1"),

#if defined(HAVE_MODULE_RELAY) || defined(TOR_UNIT_TESTS)

  /* The unit tests expect the ClientOnly default to be 0. */

  V(ClientOnly,                  BOOL,     "0"),

#else

  /* We must be a Client if the relay module is disabled. */

  V(ClientOnly,                  BOOL,     "1"),

#endif /* defined(HAVE_MODULE_RELAY) || defined(TOR_UNIT_TESTS) */

  V(ClientPreferIPv6ORPort,      AUTOBOOL, "auto"),

  V(ClientPreferIPv6DirPort,     AUTOBOOL, "auto"),

  OBSOLETE("ClientAutoIPv6ORPort"),

  V(ClientRejectInternalAddresses, BOOL,   "1"),

  V(ClientTransportPlugin,       LINELIST, NULL),

  V(ClientUseIPv6,               BOOL,     "1"),

  V(ClientUseIPv4,               BOOL,     "1"),

  V(CompiledProofOfWorkHash,     AUTOBOOL, "auto"),

  V(ConfluxEnabled,              AUTOBOOL, "auto"),

  VAR("ConfluxClientUX",         STRING,   ConfluxClientUX_option,

          "throughput"),

  V(ConnLimit,                   POSINT,     "1000"),

  V(ConnDirectionStatistics,     BOOL,     "0"),

  V(ConstrainedSockets,          BOOL,     "0"),

  V(ConstrainedSockSize,         MEMUNIT,  "8192"),

  V(ContactInfo,                 STRING,   NULL),

  OBSOLETE("ControlListenAddress"),

  VPORT(ControlPort),

  V(ControlPortFileGroupReadable,BOOL,     "0"),

  V(ControlPortWriteToFile,      FILENAME, NULL),

  V(ControlSocket,               LINELIST, NULL),

  V(ControlSocketsGroupWritable, BOOL,     "0"),

  V(UnixSocksGroupWritable,    BOOL,     "0"),

  V(CookieAuthentication,        BOOL,     "0"),

  V(CookieAuthFileGroupReadable, BOOL,     "0"),

  V(CookieAuthFile,              FILENAME, NULL),

  V(CountPrivateBandwidth,       BOOL,     "0"),

  VAR_IMMUTABLE("DataDirectory", FILENAME, DataDirectory_option, NULL),

  V(DataDirectoryGroupReadable,  BOOL,     "0"),

  V(DisableOOSCheck,             BOOL,     "1"),

  V(DisableNetwork,              BOOL,     "0"),

  V(DirAllowPrivateAddresses,    BOOL,     "0"),

  OBSOLETE("DirListenAddress"),

  V(DirPolicy,                   LINELIST, NULL),

  VPORT(DirPort),

  V(DirPortFrontPage,            FILENAME, NULL),

  VAR("DirReqStatistics",        BOOL,     DirReqStatistics_option, "1"),

  VAR("DirAuthority",            LINELIST, DirAuthorities, NULL),

#if defined(HAVE_MODULE_RELAY) || defined(TOR_UNIT_TESTS)

  /* The unit tests expect the DirCache default to be 1. */

  V(DirCache,                    BOOL,     "1"),

#else

  /* We can't be a DirCache if the relay module is disabled. */

  V(DirCache,                    BOOL,     "0"),

#endif /* defined(HAVE_MODULE_RELAY) || defined(TOR_UNIT_TESTS) */

  /* A DirAuthorityFallbackRate of 0.1 means that 0.5% of clients try an

   * authority when all fallbacks are up, and 2% try an authority when 25% of

   * fallbacks are down. (We rebuild the list when 25% of fallbacks are down).

   *

   * We want to reduce load on authorities, but keep these two figures within

   * an order of magnitude, so there isn't too much load shifting to

   * authorities when fallbacks go down. */

  V(DirAuthorityFallbackRate,    DOUBLE,   "0.1"),

  V_IMMUTABLE(DisableAllSwap,    BOOL,     "0"),

  V_IMMUTABLE(DisableDebuggerAttachment,   BOOL,     "1"),

  OBSOLETE("DisableIOCP"),

  OBSOLETE("DisableV2DirectoryInfo_"),

  OBSOLETE("DynamicDHGroups"),

  VPORT(DNSPort),

  OBSOLETE("DNSListenAddress"),

  V(DormantClientTimeout,        INTERVAL, "24 hours"),

  V(DormantTimeoutEnabled,       BOOL,     "1"),

  V(DormantTimeoutDisabledByIdleStreams,   BOOL,     "1"),

  V(DormantOnFirstStartup,       BOOL,      "0"),

  V(DormantCanceledByStartup,    BOOL,      "0"),

  V(DownloadExtraInfo,           BOOL,     "0"),

  V(TestingEnableConnBwEvent,    BOOL,     "0"),

  V(TestingEnableCellStatsEvent, BOOL,     "0"),

  OBSOLETE("TestingEnableTbEmptyEvent"),

  V(EnforceDistinctSubnets,      BOOL,     "1"),

  V_D(EntryNodes,                ROUTERSET,   NULL),

  V(EntryStatistics,             BOOL,     "0"),

  OBSOLETE("TestingEstimatedDescriptorPropagationTime"),

  V_D(ExcludeNodes,              ROUTERSET, NULL),

  V_D(ExcludeExitNodes,          ROUTERSET, NULL),

  OBSOLETE("ExcludeSingleHopRelays"),

  V_D(ExitNodes,                 ROUTERSET, NULL),

  /* Researchers need a way to tell their clients to use specific

   * middles that they also control, to allow safe live-network

   * experimentation with new padding machines. */

  V_D(MiddleNodes,               ROUTERSET, NULL),

  V(ExitPolicy,                  LINELIST, NULL),

  V(ExitPolicyRejectPrivate,     BOOL,     "1"),

  V(ExitPolicyRejectLocalInterfaces, BOOL, "0"),

  V(ExitPortStatistics,          BOOL,     "0"),

  V(ExtendAllowPrivateAddresses, BOOL,     "0"),

  V(ExitRelay,                   AUTOBOOL, "auto"),

  VPORT(ExtORPort),

  V(ExtORPortCookieAuthFile,     FILENAME,   NULL),

  V(ExtORPortCookieAuthFileGroupReadable, BOOL, "0"),

  V(ExtraInfoStatistics,         BOOL,     "1"),

  V(ExtendByEd25519ID,           AUTOBOOL, "auto"),

  V(FallbackDir,                 LINELIST, NULL),

  V(UseDefaultFallbackDirs,      BOOL,     "1"),

  OBSOLETE("FallbackNetworkstatusFile"),

  V(FascistFirewall,             BOOL,     "0"),

  V(FirewallPorts,               CSV,      ""),

  OBSOLETE("FastFirstHopPK"),

  V(FetchDirInfoEarly,           BOOL,     "0"),

  V(FetchDirInfoExtraEarly,      BOOL,     "0"),

  V(FetchServerDescriptors,      BOOL,     "1"),

  V(FetchHidServDescriptors,     BOOL,     "1"),

  V(FetchUselessDescriptors,     BOOL,     "0"),

  OBSOLETE("FetchV2Networkstatus"),

  V(GeoIPExcludeUnknown,         AUTOBOOL, "auto"),

#ifdef _WIN32

  V(GeoIPFile,                   FILENAME, "<default>"),

  V(GeoIPv6File,                 FILENAME, "<default>"),

#elif defined(__ANDROID__)

  /* Android apps use paths that are configured at runtime.

   * /data/local/tmp is guaranteed to exist, but will only be

   * usable by the 'shell' and 'root' users, so this fallback is

   * for debugging only. */

  V(GeoIPFile,                   FILENAME, "/data/local/tmp/geoip"),

  V(GeoIPv6File,                 FILENAME, "/data/local/tmp/geoip6"),

#else

  V(GeoIPFile,                   FILENAME,

    SHARE_DATADIR PATH_SEPARATOR "tor" PATH_SEPARATOR "geoip"),

  V(GeoIPv6File,                 FILENAME,

    SHARE_DATADIR PATH_SEPARATOR "tor" PATH_SEPARATOR "geoip6"),

#endif /* defined(_WIN32) */

  OBSOLETE("Group"),

  V(GuardLifetime,               INTERVAL, "0 minutes"),

  V(HeartbeatPeriod,             INTERVAL, "6 hours"),

  V(MainloopStats,               BOOL,     "0"),

  V(HashedControlPassword,       LINELIST, NULL),

  OBSOLETE("HidServDirectoryV2"),

  OBSOLETE("HiddenServiceAuthorizeClient"),

  OBSOLETE("HidServAuth"),

  VAR("HiddenServiceDir",    LINELIST_S, RendConfigLines,    NULL),

  VAR("HiddenServiceDirGroupReadable",  LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServiceOptions",LINELIST_V, RendConfigLines,    NULL),

  VAR("HiddenServicePort",   LINELIST_S, RendConfigLines,    NULL),

  VAR("HiddenServiceVersion",LINELIST_S, RendConfigLines,    NULL),

  VAR("HiddenServiceAllowUnknownPorts",LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServiceMaxStreams",LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServiceMaxStreamsCloseCircuit",LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServiceNumIntroductionPoints", LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServiceExportCircuitID", LINELIST_S,  RendConfigLines, NULL),

  VAR("HiddenServiceEnableIntroDoSDefense", LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServiceEnableIntroDoSRatePerSec",

      LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServiceEnableIntroDoSBurstPerSec",

      LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServiceOnionBalanceInstance",

      LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServicePoWDefensesEnabled", LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServicePoWQueueRate", LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServicePoWQueueBurst", LINELIST_S, RendConfigLines, NULL),

  VAR("HiddenServiceStatistics", BOOL, HiddenServiceStatistics_option, "1"),

  V(ClientOnionAuthDir,          FILENAME, NULL),

  OBSOLETE("CloseHSClientCircuitsImmediatelyOnTimeout"),

  OBSOLETE("CloseHSServiceRendCircuitsImmediatelyOnTimeout"),

  V_IMMUTABLE(HiddenServiceSingleHopMode,  BOOL,     "0"),

  V_IMMUTABLE(HiddenServiceNonAnonymousMode,BOOL,    "0"),

  V(HTTPProxy,                   STRING,   NULL),

  V(HTTPProxyAuthenticator,      STRING,   NULL),

  V(HTTPSProxy,                  STRING,   NULL),

  V(HTTPSProxyAuthenticator,     STRING,   NULL),

  VPORT(HTTPTunnelPort),

  V(IPv6Exit,                    BOOL,     "0"),

  VAR("ServerTransportPlugin",   LINELIST, ServerTransportPlugin,  NULL),

  V(ServerTransportListenAddr,   LINELIST, NULL),

  V(ServerTransportOptions,      LINELIST, NULL),

  V(SigningKeyLifetime,          INTERVAL, "30 days"),

  V(Socks4Proxy,                 STRING,   NULL),

  V(Socks5Proxy,                 STRING,   NULL),

  V(Socks5ProxyUsername,         STRING,   NULL),

  V(Socks5ProxyPassword,         STRING,   NULL),

  V(TCPProxy,                    STRING,   NULL),

  VAR_IMMUTABLE("KeyDirectory",  FILENAME, KeyDirectory_option, NULL),

  V(KeyDirectoryGroupReadable,   AUTOBOOL, "auto"),

  VAR_D("HSLayer2Nodes",         ROUTERSET,  HSLayer2Nodes,  NULL),

  VAR_D("HSLayer3Nodes",         ROUTERSET,  HSLayer3Nodes,  NULL),

  V(KeepalivePeriod,             INTERVAL, "5 minutes"),

  V_IMMUTABLE(KeepBindCapabilities,        AUTOBOOL, "auto"),

  VAR("Log",                     LINELIST, Logs,             NULL),

  V(LogMessageDomains,           BOOL,     "0"),

  V(LogTimeGranularity,          MSEC_INTERVAL, "1 second"),

  V(TruncateLogFile,             BOOL,     "0"),

  V_IMMUTABLE(SyslogIdentityTag, STRING,   NULL),

  OBSOLETE("AndroidIdentityTag"),

  V(LongLivedPorts,              CSV,

        "21,22,706,1863,5050,5190,5222,5223,6523,6667,6697,8300"),

  VAR("MapAddress",              LINELIST, AddressMap,           NULL),

  V(MaxAdvertisedBandwidth,      MEMUNIT,  "1 GB"),

  V(MaxCircuitDirtiness,         INTERVAL, "10 minutes"),

  V(MaxClientCircuitsPending,    POSINT,     "32"),

  V(MaxConsensusAgeForDiffs,     INTERVAL, "0 seconds"),

  VAR("MaxMemInQueues",          MEMUNIT,   MaxMemInQueues_raw, "0"),

  OBSOLETE("MaxOnionsPending"),

  V(MaxOnionQueueDelay,          MSEC_INTERVAL, "0"),

  V(MaxUnparseableDescSizeToLog, MEMUNIT, "10 MB"),

  VPORT(MetricsPort),

  V(MetricsPortPolicy,           LINELIST, NULL),

  V(TestingMinTimeToReportBandwidth,    INTERVAL, "1 day"),

  VAR("MyFamily",                LINELIST, MyFamily_lines,       NULL),

  V(NewCircuitPeriod,            INTERVAL, "30 seconds"),

  OBSOLETE("NamingAuthoritativeDirectory"),

  OBSOLETE("NATDListenAddress"),

  VPORT(NATDPort),

  V(Nickname,                    STRING,   NULL),

  OBSOLETE("PredictedPortsRelevanceTime"),

  OBSOLETE("WarnUnsafeSocks"),

  VAR("NodeFamily",              LINELIST, NodeFamilies,         NULL),

  V_IMMUTABLE(NoExec,            BOOL,     "0"),

  V(NumCPUs,                     POSINT,     "0"),

  V(NumDirectoryGuards,          POSINT,     "0"),

  V(NumEntryGuards,              POSINT,     "0"),

  V(NumPrimaryGuards,            POSINT,     "0"),

  V(OfflineMasterKey,            BOOL,     "0"),

  OBSOLETE("ORListenAddress"),

  VPORT(ORPort),

  V(OutboundBindAddress,         LINELIST,   NULL),

  V(OutboundBindAddressOR,       LINELIST,   NULL),

  V(OutboundBindAddressExit,     LINELIST,   NULL),

  V(OutboundBindAddressPT,       LINELIST,   NULL),

  OBSOLETE("PathBiasDisableRate"),

  V(PathBiasCircThreshold,       INT,      "-1"),

  V(PathBiasNoticeRate,          DOUBLE,   "-1"),

  V(PathBiasWarnRate,            DOUBLE,   "-1"),

  V(PathBiasExtremeRate,         DOUBLE,   "-1"),

  V(PathBiasScaleThreshold,      INT,      "-1"),

  OBSOLETE("PathBiasScaleFactor"),

  OBSOLETE("PathBiasMultFactor"),

  V(PathBiasDropGuards,          AUTOBOOL, "0"),

  OBSOLETE("PathBiasUseCloseCounts"),

  V(PathBiasUseThreshold,       INT,      "-1"),

  V(PathBiasNoticeUseRate,          DOUBLE,   "-1"),

  V(PathBiasExtremeUseRate,         DOUBLE,   "-1"),

  V(PathBiasScaleUseThreshold,      INT,      "-1"),

  V(PathsNeededToBuildCircuits,  DOUBLE,   "-1"),

  V(PerConnBWBurst,              MEMUNIT,  "0"),

  V(PerConnBWRate,               MEMUNIT,  "0"),

  V_IMMUTABLE(PidFile,           FILENAME,   NULL),

  V_IMMUTABLE(TestingTorNetwork, BOOL,     "0"),

  V(TestingLinkCertLifetime,          INTERVAL, "2 days"),

  V(TestingAuthKeyLifetime,          INTERVAL, "2 days"),

  V(TestingLinkKeySlop,              INTERVAL, "3 hours"),

  V(TestingAuthKeySlop,              INTERVAL, "3 hours"),

  V(TestingSigningKeySlop,           INTERVAL, "1 day"),

  OBSOLETE("OptimisticData"),

  OBSOLETE("PortForwarding"),

  OBSOLETE("PortForwardingHelper"),

  OBSOLETE("PreferTunneledDirConns"),

  V(ProtocolWarnings,            BOOL,     "0"),

  V(PublishServerDescriptor,     CSV,      "1"),

  V(PublishHidServDescriptors,   BOOL,     "1"),

  V(ReachableAddresses,          LINELIST, NULL),

  V(ReachableDirAddresses,       LINELIST, NULL),

  V(ReachableORAddresses,        LINELIST, NULL),

  OBSOLETE("RecommendedPackages"),

  V(ReducedConnectionPadding,    BOOL,     "0"),

  V(ConnectionPadding,           AUTOBOOL, "auto"),

  V(RefuseUnknownExits,          AUTOBOOL, "auto"),

  V(CircuitPadding,              BOOL,     "1"),

  V(ReconfigDropsBridgeDescs,    BOOL,     "0"),

  V(ReducedCircuitPadding,       BOOL,     "0"),

  V(RejectPlaintextPorts,        CSV,      ""),

  V(RelayBandwidthBurst,         MEMUNIT,  "0"),

  V(RelayBandwidthRate,          MEMUNIT,  "0"),

  V(RephistTrackTime,            INTERVAL, "24 hours"),

  V_IMMUTABLE(RunAsDaemon,       BOOL,     "0"),

  V(ReducedExitPolicy,           BOOL,     "0"),

  V(ReevaluateExitPolicy,        BOOL,     "0"),

  OBSOLETE("RunTesting"), // currently unused

  V_IMMUTABLE(Sandbox,           BOOL,     "0"),

  V(SafeLogging,                 STRING,   "1"),

  V(SafeSocks,                   BOOL,     "0"),

  V(ServerDNSAllowBrokenConfig,  BOOL,     "1"),

  V(ServerDNSAllowNonRFC953Hostnames, BOOL,"0"),

  V(ServerDNSDetectHijacking,    BOOL,     "1"),

  V(ServerDNSRandomizeCase,      BOOL,     "1"),

  V(ServerDNSResolvConfFile,     FILENAME,   NULL),

  V(ServerDNSSearchDomains,      BOOL,     "0"),

  V(ServerDNSTestAddresses,      CSV,

      "www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org"),

  OBSOLETE("SchedulerLowWaterMark__"),

  OBSOLETE("SchedulerHighWaterMark__"),

  OBSOLETE("SchedulerMaxFlushCells__"),

  V(KISTSchedRunInterval,        MSEC_INTERVAL, "0 msec"),

  V(KISTSockBufSizeFactor,       DOUBLE,   "1.0"),

  V(Schedulers,                  CSV,      "KIST,KISTLite,Vanilla"),

  V(ShutdownWaitLength,          INTERVAL, "30 seconds"),

  OBSOLETE("SocksListenAddress"),

  V(SocksPolicy,                 LINELIST, NULL),

  VPORT(SocksPort),

  V(SocksTimeout,                INTERVAL, "2 minutes"),

  V(SSLKeyLifetime,              INTERVAL, "0"),

  OBSOLETE("StrictEntryNodes"),

  OBSOLETE("StrictExitNodes"),

  V(StrictNodes,                 BOOL,     "0"),

  OBSOLETE("Support022HiddenServices"),

  V(TestSocks,                   BOOL,     "0"),

  V_IMMUTABLE(TokenBucketRefillInterval,   MSEC_INTERVAL, "100 msec"),

  OBSOLETE("Tor2webMode"),

  OBSOLETE("Tor2webRendezvousPoints"),

  OBSOLETE("TLSECGroup"),

  V(TrackHostExits,              CSV,      NULL),

  V(TrackHostExitsExpire,        INTERVAL, "30 minutes"),

  OBSOLETE("TransListenAddress"),

  VPORT(TransPort),

  V(TransProxyType,              STRING,   "default"),

  OBSOLETE("TunnelDirConns"),

  V(UpdateBridgesFromAuthority,  BOOL,     "0"),

  V(UseBridges,                  BOOL,     "0"),

  VAR("UseEntryGuards",          BOOL,     UseEntryGuards_option, "1"),

  OBSOLETE("UseEntryGuardsAsDirGuards"),

  V(UseGuardFraction,            AUTOBOOL, "auto"),

  V(VanguardsLiteEnabled,        AUTOBOOL, "auto"),

  V(UseMicrodescriptors,         AUTOBOOL, "auto"),

  OBSOLETE("UseNTorHandshake"),

  VAR("__AlwaysCongestionControl",  BOOL, AlwaysCongestionControl, "0"),

  VAR("__SbwsExit",  BOOL, SbwsExit, "0"),

  V_IMMUTABLE(User,              STRING,   NULL),

  OBSOLETE("UserspaceIOCPBuffers"),

  OBSOLETE("V1AuthoritativeDirectory"),

  OBSOLETE("V2AuthoritativeDirectory"),

  VAR("V3AuthoritativeDirectory",BOOL, V3AuthoritativeDir,   "0"),

  V(TestingV3AuthInitialVotingInterval, INTERVAL, "30 minutes"),

  V(TestingV3AuthInitialVoteDelay, INTERVAL, "5 minutes"),

  V(TestingV3AuthInitialDistDelay, INTERVAL, "5 minutes"),

  V(TestingV3AuthVotingStartOffset, INTERVAL, "0"),

  V(V3AuthVotingInterval,        INTERVAL, "1 hour"),

  V(V3AuthVoteDelay,             INTERVAL, "5 minutes"),

  V(V3AuthDistDelay,             INTERVAL, "5 minutes"),

  V(V3AuthNIntervalsValid,       POSINT,     "3"),

  V(V3AuthUseLegacyKey,          BOOL,     "0"),

  V(V3BandwidthsFile,            FILENAME, NULL),

  V(GuardfractionFile,           FILENAME, NULL),

  OBSOLETE("VoteOnHidServDirectoriesV2"),

  V(VirtualAddrNetworkIPv4,      STRING,   "127.192.0.0/10"),

  V(VirtualAddrNetworkIPv6,      STRING,   "[FE80::]/10"),

  V(WarnPlaintextPorts,          CSV,      "23,109,110,143"),

  OBSOLETE("UseFilteringSSLBufferevents"),

  OBSOLETE("__UseFilteringSSLBufferevents"),

  VAR_NODUMP("__ReloadTorrcOnSIGHUP",   BOOL,  ReloadTorrcOnSIGHUP,      "1"),

  VAR_NODUMP("__AllDirActionsPrivate",  BOOL,  AllDirActionsPrivate,     "0"),

  VAR_NODUMP("__DisablePredictedCircuits",BOOL,DisablePredictedCircuits, "0"),

  VAR_NODUMP_IMMUTABLE("__DisableSignalHandlers", BOOL,

                       DisableSignalHandlers,    "0"),

  VAR_NODUMP("__LeaveStreamsUnattached",BOOL,  LeaveStreamsUnattached,   "0"),

  VAR_NODUMP("__HashedControlSessionPassword", LINELIST,

             HashedControlSessionPassword,

      NULL),

  VAR_NODUMP("__OwningControllerProcess",STRING,

                       OwningControllerProcess, NULL),

  VAR_NODUMP_IMMUTABLE("__OwningControllerFD", UINT64, OwningControllerFD,

             UINT64_MAX_STRING),

  V(TestingServerDownloadInitialDelay, CSV_INTERVAL, "0"),

  V(TestingClientDownloadInitialDelay, CSV_INTERVAL, "0"),

  V(TestingServerConsensusDownloadInitialDelay, CSV_INTERVAL, "0"),

  V(TestingClientConsensusDownloadInitialDelay, CSV_INTERVAL, "0"),

  /* With the ClientBootstrapConsensus*Download* below:

   * Clients with only authorities will try:

   *  - at least 3 authorities over 10 seconds, then exponentially backoff,

   *    with the next attempt 3-21 seconds later,

   * Clients with authorities and fallbacks will try:

   *  - at least 2 authorities and 4 fallbacks over 21 seconds, then

   *    exponentially backoff, with the next attempts 4-33 seconds later,

   * Clients will also retry when an application request arrives.

   * After a number of failed requests, clients retry every 3 days + 1 hour.

   *

   * Clients used to try 2 authorities over 10 seconds, then wait for

   * 60 minutes or an application request.

   *

   * When clients have authorities and fallbacks available, they use these

   * schedules: (we stagger the times to avoid thundering herds) */

  V(ClientBootstrapConsensusAuthorityDownloadInitialDelay, CSV_INTERVAL, "6"),

  V(ClientBootstrapConsensusFallbackDownloadInitialDelay, CSV_INTERVAL, "0"),

  /* When clients only have authorities available, they use this schedule: */

  V(ClientBootstrapConsensusAuthorityOnlyDownloadInitialDelay, CSV_INTERVAL,

    "0"),

  /* We don't want to overwhelm slow networks (or mirrors whose replies are

   * blocked), but we also don't want to fail if only some mirrors are

   * blackholed. Clients will try 3 directories simultaneously.

   * (Relays never use simultaneous connections.) */

  V(ClientBootstrapConsensusMaxInProgressTries, POSINT, "3"),

  /* When a client has any running bridges, check each bridge occasionally,

    * whether or not that bridge is actually up. */

  V(TestingBridgeDownloadInitialDelay, CSV_INTERVAL,"10800"),

  /* When a client is just starting, or has no running bridges, check each

   * bridge a few times quickly, and then try again later. These schedules

   * are much longer than the other schedules, because we try each and every

   * configured bridge with this schedule. */

  V(TestingBridgeBootstrapDownloadInitialDelay, CSV_INTERVAL, "0"),

  V(TestingClientMaxIntervalWithoutRequest, INTERVAL, "10 minutes"),

  V(TestingDirConnectionMaxStall, INTERVAL, "5 minutes"),

  OBSOLETE("TestingConsensusMaxDownloadTries"),

  OBSOLETE("ClientBootstrapConsensusMaxDownloadTries"),

  OBSOLETE("ClientBootstrapConsensusAuthorityOnlyMaxDownloadTries"),

  OBSOLETE("TestingDescriptorMaxDownloadTries"),

  OBSOLETE("TestingMicrodescMaxDownloadTries"),

  OBSOLETE("TestingCertMaxDownloadTries"),

  VAR_INVIS("___UsingTestNetworkDefaults", BOOL, UsingTestNetworkDefaults_,

            "0"),

  END_OF_CONFIG_VARS

};

/** List of default directory authorities */

static const char *default_authorities[] = {

#ifndef COCCI

#include "auth_dirs.inc"

#endif

  NULL

};

/** List of fallback directory authorities. The list is generated by opt-in of

 * relays that meet certain stability criteria.

 */

static const char *default_fallbacks[] = {

#ifndef COCCI

#include "fallback_dirs.inc"

#endif

  NULL

};

/** Override default values with these if the user sets the TestingTorNetwork

 * option. */

static const struct {

  const char *k;

  const char *v;

} testing_tor_network_defaults[] = {

#ifndef COCCI

#include "testnet.inc"

#endif

  { NULL, NULL }

};

#undef VAR

#undef V

#undef OBSOLETE

static const config_deprecation_t option_deprecation_notes_[] = {

  /* Deprecated since 0.3.2.0-alpha. */

  { "HTTPProxy", "It only applies to direct unencrypted HTTP connections "

    "to your directory server, which your Tor probably wasn't using." },

  { "HTTPProxyAuthenticator", "HTTPProxy is deprecated in favor of HTTPSProxy "

    "which should be used with HTTPSProxyAuthenticator." },

  /* End of options deprecated since 0.3.2.1-alpha */

  /* Options deprecated since 0.3.2.2-alpha */

  { "ReachableDirAddresses", "It has no effect on relays, and has had no "

    "effect on clients since 0.2.8." },

  { "ClientPreferIPv6DirPort", "It has no effect on relays, and has had no "

    "effect on clients since 0.2.8." },

  /* End of options deprecated since 0.3.2.2-alpha. */

  /* Options deprecated since 0.4.3.1-alpha. */

  { "ClientAutoIPv6ORPort", "This option is unreliable if a connection isn't "

    "reliably dual-stack."},

  /* End of options deprecated since 0.4.3.1-alpha. */

  { NULL, NULL }

};

#ifdef _WIN32

static char *get_windows_conf_root(void);

#endif

static int options_check_transition_cb(const void *old,

                                       const void *new,

                                       char **msg);

static int validate_data_directories(or_options_t *options);

static int write_configuration_file(const char *fname,

                                    const or_options_t *options);

static void init_libevent(const or_options_t *options);

static int opt_streq(const char *s1, const char *s2);

static int parse_outbound_addresses(or_options_t *options, int validate_only,

                                    char **msg);

static void config_maybe_load_geoip_files_(const or_options_t *options,

                                           const or_options_t *old_options);

static int options_validate_cb(const void *old_options, void *options,

                               char **msg);

static void cleanup_protocol_warning_severity_level(void);

static void set_protocol_warning_severity_level(int warning_severity);

static void options_clear_cb(const config_mgr_t *mgr, void *opts);

static setopt_err_t options_validate_and_set(const or_options_t *old_options,

                                             or_options_t *new_options,

                                             char **msg_out);

struct listener_transaction_t;

static void options_rollback_listener_transaction(

                                           struct listener_transaction_t *xn);

/** Magic value for or_options_t. */

#define OR_OPTIONS_MAGIC 9090909

/** Configuration format for or_options_t. */

static const config_format_t options_format = {

  .size = sizeof(or_options_t),

  .magic = {

   "or_options_t",

   OR_OPTIONS_MAGIC,

   offsetof(or_options_t, magic_),

  },

  .abbrevs = option_abbrevs_,

  .deprecations = option_deprecation_notes_,

  .vars = option_vars_,

  .legacy_validate_fn = options_validate_cb,

  .check_transition_fn = options_check_transition_cb,

  .clear_fn = options_clear_cb,

  .has_config_suite = true,

  .config_suite_offset = offsetof(or_options_t, subconfigs_),

};

/*

 * Functions to read and write the global options pointer.

 */

/** Command-line and config-file options. */

static or_options_t *global_options = NULL;

/** The fallback options_t object; this is where we look for options not

 * in torrc before we fall back to Tor's defaults. */

static or_options_t *global_default_options = NULL;

/** Name of most recently read torrc file. */

static char *torrc_fname = NULL;

/** Name of the most recently read torrc-defaults file.*/

static char *torrc_defaults_fname = NULL;

/** Result of parsing the command line. */

static parsed_cmdline_t *global_cmdline = NULL;

/** List of port_cfg_t for all configured ports. */

static smartlist_t *configured_ports = NULL;

/** True iff we're currently validating options, and any calls to

 * get_options() are likely to be bugs. */

static int in_option_validation = 0;

/** True iff we have run options_act_once_on_startup() */

static bool have_set_startup_options = false;

/* A global configuration manager to handle all configuration objects. */

static config_mgr_t *options_mgr = NULL;

/** Return the global configuration manager object for torrc options. */

STATIC const config_mgr_t *

get_options_mgr(void)

{

  if (PREDICT_UNLIKELY(options_mgr == NULL)) {

    options_mgr = config_mgr_new(&options_format);

    int rv = subsystems_register_options_formats(options_mgr);

    tor_assert(rv == 0);

    config_mgr_freeze(options_mgr);

  }

  return options_mgr;

}

#define CHECK_OPTIONS_MAGIC(opt) STMT_BEGIN                      \

    config_check_toplevel_magic(get_options_mgr(), (opt));       \

  STMT_END

/** Returns the currently configured options. */

MOCK_IMPL(or_options_t *,

get_options_mutable, (void))

{

  tor_assert(global_options);

  tor_assert_nonfatal(! in_option_validation);

  return global_options;

}

/** Returns the currently configured options */

MOCK_IMPL(const or_options_t *,

get_options,(void))

{

  return get_options_mutable();

}

/**

 * True iff we have noticed that this is a testing tor network, and we

 * should use the corresponding defaults.

 **/

static bool testing_network_configured = false;

/** Return a set of lines for any default options that we want to override

 * from those set in our config_var_t values. */

static config_line_t *

get_options_defaults(void)

{

  int i;

  config_line_t *result = NULL, **next = &result;

  if (testing_network_configured) {

    for (i = 0; testing_tor_network_defaults[i].k; ++i) {

      config_line_append(next,

                         testing_tor_network_defaults[i].k,

                         testing_tor_network_defaults[i].v);

      next = &(*next)->next;

    }

  }

  return result;

}

/** Change the current global options to contain <b>new_val</b> instead of

 * their current value; take action based on the new value; free the old value

 * as necessary.  Returns 0 on success, -1 on failure.

 */

int

set_options(or_options_t *new_val, char **msg)

{

  or_options_t *old_options = global_options;

  global_options = new_val;

  /* Note that we pass the *old* options below, for comparison. It

   * pulls the new options directly out of global_options. */

  if (options_act_reversible(old_options, msg)<0) {

    tor_assert(*msg);

    global_options = old_options;

    return -1;

  }

  if (subsystems_set_options(get_options_mgr(), new_val) < 0 ||

      options_act(old_options) < 0) { /* acting on the options failed. die. */

    if (! tor_event_loop_shutdown_is_pending()) {

      log_err(LD_BUG,

              "Acting on config options left us in a broken state. Dying.");

      tor_shutdown_event_loop_and_exit(1);

    }

    global_options = old_options;

    return -1;

  }

  /* Issues a CONF_CHANGED event to notify controller of the change. If Tor is

   * just starting up then the old_options will be undefined. */

  if (old_options && old_options != global_options) {

    config_line_t *changes =

      config_get_changes(get_options_mgr(), old_options, new_val);

    control_event_conf_changed(changes);

    connection_reapply_exit_policy(changes);

    config_free_lines(changes);

  }

  if (old_options != global_options) {

    or_options_free(old_options);

    /* If we are here it means we've successfully applied the new options and

     * that the global options have been changed to the new values. We'll

     * check if we need to remove or add periodic events. */

    periodic_events_on_new_options(global_options);

  }

  return 0;

}

/** Release additional memory allocated in options

 */

static void

options_clear_cb(const config_mgr_t *mgr, void *opts)

{

  (void)mgr;

  CHECK_OPTIONS_MAGIC(opts);

  or_options_t *options = opts;

  routerset_free(options->ExcludeExitNodesUnion_);

  if (options->NodeFamilySets) {

    SMARTLIST_FOREACH(options->NodeFamilySets, routerset_t *,

                      rs, routerset_free(rs));

    smartlist_free(options->NodeFamilySets);

  }

  if (options->SchedulerTypes_) {

    SMARTLIST_FOREACH(options->SchedulerTypes_, int *, i, tor_free(i));

    smartlist_free(options->SchedulerTypes_);

  }

  if (options->FilesOpenedByIncludes) {

    SMARTLIST_FOREACH(options->FilesOpenedByIncludes, char *, f, tor_free(f));

    smartlist_free(options->FilesOpenedByIncludes);

  }

  tor_free(options->DataDirectory);

  tor_free(options->CacheDirectory);

  tor_free(options->KeyDirectory);

  tor_free(options->BridgePassword_AuthDigest_);

  tor_free(options->command_arg);

  tor_free(options->master_key_fname);

  config_free_lines(options->MyFamily);

}

/** Release all memory allocated in options

 */

STATIC void

or_options_free_(or_options_t *options)

{

  config_free(get_options_mgr(), options);

}

/** Release all memory and resources held by global configuration structures.

 */

void

config_free_all(void)

{

  or_options_free(global_options);

  global_options = NULL;

  or_options_free(global_default_options);

  global_default_options = NULL;

  parsed_cmdline_free(global_cmdline);

  if (configured_ports) {

    SMARTLIST_FOREACH(configured_ports,

                      port_cfg_t *, p, port_cfg_free(p));

    smartlist_free(configured_ports);

    configured_ports = NULL;

  }

  tor_free(torrc_fname);

  tor_free(torrc_defaults_fname);

  cleanup_protocol_warning_severity_level();

  have_set_startup_options = false;

  config_mgr_free(options_mgr);

}

/** Make <b>address</b> -- a piece of information related to our operation as

 * a client -- safe to log according to the settings in options->SafeLogging,