diff options
Diffstat (limited to 'src/feature/rend')
| -rw-r--r-- | src/feature/rend/feature_rend.md | 7 | ||||
| -rw-r--r-- | src/feature/rend/include.am | 16 | ||||
| -rw-r--r-- | src/feature/rend/rend_authorized_client_st.h | 22 | ||||
| -rw-r--r-- | src/feature/rend/rend_encoded_v2_service_descriptor_st.h | 21 | ||||
| -rw-r--r-- | src/feature/rend/rend_intro_point_st.h | 81 | ||||
| -rw-r--r-- | src/feature/rend/rend_service_descriptor_st.h | 38 | ||||
| -rw-r--r-- | src/feature/rend/rendcache.c | 1029 | ||||
| -rw-r--r-- | src/feature/rend/rendcache.h | 132 | ||||
| -rw-r--r-- | src/feature/rend/rendclient.c | 1322 | ||||
| -rw-r--r-- | src/feature/rend/rendclient.h | 54 | ||||
| -rw-r--r-- | src/feature/rend/rendcommon.c | 944 | ||||
| -rw-r--r-- | src/feature/rend/rendcommon.h | 55 | ||||
| -rw-r--r-- | src/feature/rend/rendmid.c | 207 | ||||
| -rw-r--r-- | src/feature/rend/rendmid.h | 2 | ||||
| -rw-r--r-- | src/feature/rend/rendparse.c | 612 | ||||
| -rw-r--r-- | src/feature/rend/rendparse.h | 32 | ||||
| -rw-r--r-- | src/feature/rend/rendservice.c | 4535 | ||||
| -rw-r--r-- | src/feature/rend/rendservice.h | 223 |
18 files changed, 12 insertions, 9320 deletions
diff --git a/src/feature/rend/feature_rend.md b/src/feature/rend/feature_rend.md deleted file mode 100644 index bfd8ae3dbc..0000000000 --- a/src/feature/rend/feature_rend.md +++ /dev/null @@ -1,7 +0,0 @@ -@dir /feature/rend -@brief feature/rend: version 2 (old) hidden services - -This directory implements the v2 onion service protocol, -as specified in -[rend-spec-v2.txt](https://gitweb.torproject.org/torspec.git/tree/rend-spec-v2.txt). - diff --git a/src/feature/rend/include.am b/src/feature/rend/include.am index fb12439a90..d338869b5b 100644 --- a/src/feature/rend/include.am +++ b/src/feature/rend/include.am @@ -1,22 +1,10 @@ # ADD_C_FILE: INSERT SOURCES HERE. LIBTOR_APP_A_SOURCES += \ - src/feature/rend/rendcache.c \ - src/feature/rend/rendclient.c \ src/feature/rend/rendcommon.c \ - src/feature/rend/rendmid.c \ - src/feature/rend/rendparse.c \ - src/feature/rend/rendservice.c + src/feature/rend/rendmid.c # ADD_C_FILE: INSERT HEADERS HERE. noinst_HEADERS += \ - src/feature/rend/rend_authorized_client_st.h \ - src/feature/rend/rend_encoded_v2_service_descriptor_st.h \ - src/feature/rend/rend_intro_point_st.h \ - src/feature/rend/rend_service_descriptor_st.h \ - src/feature/rend/rendcache.h \ - src/feature/rend/rendclient.h \ src/feature/rend/rendcommon.h \ - src/feature/rend/rendmid.h \ - src/feature/rend/rendparse.h \ - src/feature/rend/rendservice.h + src/feature/rend/rendmid.h diff --git a/src/feature/rend/rend_authorized_client_st.h b/src/feature/rend/rend_authorized_client_st.h deleted file mode 100644 index c6a6676da9..0000000000 --- a/src/feature/rend/rend_authorized_client_st.h +++ /dev/null @@ -1,22 +0,0 @@ -/* Copyright (c) 2001 Matej Pfajfar. - * Copyright (c) 2001-2004, Roger Dingledine. - * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * @file rend_authorized_client_st.h - * @brief Hidden-service authorized client structure. - **/ - -#ifndef REND_AUTHORIZED_CLIENT_ST_H -#define REND_AUTHORIZED_CLIENT_ST_H - -/** Hidden-service side configuration of client authorization. */ -struct rend_authorized_client_t { - char *client_name; - uint8_t descriptor_cookie[REND_DESC_COOKIE_LEN]; - crypto_pk_t *client_key; -}; - -#endif /* !defined(REND_AUTHORIZED_CLIENT_ST_H) */ diff --git a/src/feature/rend/rend_encoded_v2_service_descriptor_st.h b/src/feature/rend/rend_encoded_v2_service_descriptor_st.h deleted file mode 100644 index fea91b876a..0000000000 --- a/src/feature/rend/rend_encoded_v2_service_descriptor_st.h +++ /dev/null @@ -1,21 +0,0 @@ -/* Copyright (c) 2001 Matej Pfajfar. - * Copyright (c) 2001-2004, Roger Dingledine. - * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * @file rend_encoded_v2_service_descriptor_st.h - * @brief Encoded v2 HS descriptor structure. - **/ - -#ifndef REND_ENCODED_V2_SERVICE_DESCRIPTOR_ST_H -#define REND_ENCODED_V2_SERVICE_DESCRIPTOR_ST_H - -/** ASCII-encoded v2 hidden service descriptor. */ -struct rend_encoded_v2_service_descriptor_t { - char desc_id[DIGEST_LEN]; /**< Descriptor ID. */ - char *desc_str; /**< Descriptor string. */ -}; - -#endif /* !defined(REND_ENCODED_V2_SERVICE_DESCRIPTOR_ST_H) */ diff --git a/src/feature/rend/rend_intro_point_st.h b/src/feature/rend/rend_intro_point_st.h deleted file mode 100644 index 4f0aa01523..0000000000 --- a/src/feature/rend/rend_intro_point_st.h +++ /dev/null @@ -1,81 +0,0 @@ -/* Copyright (c) 2001 Matej Pfajfar. - * Copyright (c) 2001-2004, Roger Dingledine. - * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * @file rend_intro_point_st.h - * @brief v2 hidden service introduction point structure. - **/ - -#ifndef REND_INTRO_POINT_ST_H -#define REND_INTRO_POINT_ST_H - -struct replaycache_t; -struct crypto_pk_t; - -/** Introduction point information. Used both in rend_service_t (on - * the service side) and in rend_service_descriptor_t (on both the - * client and service side). */ -struct rend_intro_point_t { - extend_info_t *extend_info; /**< Extend info for connecting to this - * introduction point via a multi-hop path. */ - struct crypto_pk_t *intro_key; /**< Introduction key that replaces the - * service key, if this descriptor is V2. */ - - /** (Client side only) Flag indicating that a timeout has occurred - * after sending an INTRODUCE cell to this intro point. After a - * timeout, an intro point should not be tried again during the same - * hidden service connection attempt, but it may be tried again - * during a future connection attempt. */ - unsigned int timed_out : 1; - - /** (Client side only) The number of times we have failed to build a - * circuit to this intro point for some reason other than our - * circuit-build timeout. See also MAX_INTRO_POINT_REACHABILITY_FAILURES. */ - unsigned int unreachable_count : 3; - - /** (Service side only) Flag indicating that this intro point was - * included in the last HS descriptor we generated. */ - unsigned int listed_in_last_desc : 1; - - /** (Service side only) A replay cache recording the RSA-encrypted parts - * of INTRODUCE2 cells this intro point's circuit has received. This is - * used to prevent replay attacks. */ - struct replaycache_t *accepted_intro_rsa_parts; - - /** (Service side only) Count of INTRODUCE2 cells accepted from this - * intro point. - */ - int accepted_introduce2_count; - - /** (Service side only) Maximum number of INTRODUCE2 cells that this IP - * will accept. This is a random value between - * INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS and - * INTRO_POINT_MAX_LIFETIME_INTRODUCTIONS. */ - int max_introductions; - - /** (Service side only) The time at which this intro point was first - * published, or -1 if this intro point has not yet been - * published. */ - time_t time_published; - - /** (Service side only) The time at which this intro point should - * (start to) expire, or -1 if we haven't decided when this intro - * point should expire. */ - time_t time_to_expire; - - /** (Service side only) The amount of circuit creation we've made to this - * intro point. This is incremented every time we do a circuit relaunch on - * this object which is triggered when the circuit dies but the node is - * still in the consensus. After MAX_INTRO_POINT_CIRCUIT_RETRIES, we give - * up on it. */ - unsigned int circuit_retries; - - /** (Service side only) Set if this intro point has an established circuit - * and unset if it doesn't. */ - unsigned int circuit_established:1; -}; - -#endif /* !defined(REND_INTRO_POINT_ST_H) */ diff --git a/src/feature/rend/rend_service_descriptor_st.h b/src/feature/rend/rend_service_descriptor_st.h deleted file mode 100644 index 80c8034f46..0000000000 --- a/src/feature/rend/rend_service_descriptor_st.h +++ /dev/null @@ -1,38 +0,0 @@ -/* Copyright (c) 2001 Matej Pfajfar. - * Copyright (c) 2001-2004, Roger Dingledine. - * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * @file rend_service_descriptor_st.h - * @brief Parsed v2 HS descriptor structure. - **/ - -#ifndef REND_SERVICE_DESCRIPTOR_ST_H -#define REND_SERVICE_DESCRIPTOR_ST_H - -#define REND_PROTOCOL_VERSION_BITMASK_WIDTH 16 - -/** Information used to connect to a hidden service. Used on both the - * service side and the client side. */ -struct rend_service_descriptor_t { - crypto_pk_t *pk; /**< This service's public key. */ - int version; /**< Version of the descriptor format: 0 or 2. */ - time_t timestamp; /**< Time when the descriptor was generated. */ - /** Bitmask: which introduce/rendezvous protocols are supported? - * (We allow bits '0', '1', '2' and '3' to be set.) */ - unsigned protocols : REND_PROTOCOL_VERSION_BITMASK_WIDTH; - /** List of the service's introduction points. Elements are removed if - * introduction attempts fail. */ - smartlist_t *intro_nodes; - /** Has descriptor been uploaded to all hidden service directories? */ - int all_uploads_performed; - /** List of hidden service directories to which an upload request for - * this descriptor could be sent. Smartlist exists only when at least one - * of the previous upload requests failed (otherwise it's not important - * to know which uploads succeeded and which not). */ - smartlist_t *successful_uploads; -}; - -#endif /* !defined(REND_SERVICE_DESCRIPTOR_ST_H) */ diff --git a/src/feature/rend/rendcache.c b/src/feature/rend/rendcache.c deleted file mode 100644 index 04f6390a7f..0000000000 --- a/src/feature/rend/rendcache.c +++ /dev/null @@ -1,1029 +0,0 @@ -/* Copyright (c) 2015-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * \file rendcache.c - * \brief Hidden service descriptor cache. - **/ - -#define RENDCACHE_PRIVATE -#include "feature/rend/rendcache.h" - -#include "app/config/config.h" -#include "feature/stats/rephist.h" -#include "feature/nodelist/routerlist.h" -#include "feature/rend/rendcommon.h" -#include "feature/rend/rendparse.h" - -#include "core/or/extend_info_st.h" -#include "feature/rend/rend_intro_point_st.h" -#include "feature/rend/rend_service_descriptor_st.h" - -#include "lib/ctime/di_ops.h" - -/** Map from service id (as generated by rend_get_service_id) to - * rend_cache_entry_t. */ -STATIC strmap_t *rend_cache = NULL; - -/** Map from service id to rend_cache_entry_t; only for hidden services. */ -static strmap_t *rend_cache_local_service = NULL; - -/** Map from descriptor id to rend_cache_entry_t; only for hidden service - * directories. */ -STATIC digestmap_t *rend_cache_v2_dir = NULL; - -/** (Client side only) Map from service id to rend_cache_failure_t. This - * cache is used to track intro point(IP) failures so we know when to keep - * or discard a new descriptor we just fetched. Here is a description of the - * cache behavior. - * - * Every time tor discards an IP (ex: receives a NACK), we add an entry to - * this cache noting the identity digest of the IP and it's failure type for - * the service ID. The reason we indexed this cache by service ID is to - * differentiate errors that can occur only for a specific service like a - * NACK for instance. It applies for one but maybe not for the others. - * - * Once a service descriptor is fetched and considered valid, each IP is - * looked up in this cache and if present, it is discarded from the fetched - * descriptor. At the end, all IP(s) in the cache, for a specific service - * ID, that were NOT present in the descriptor are removed from this cache. - * Which means that if at least one IP was not in this cache, thus usable, - * it's considered a new descriptor so we keep it. Else, if all IPs were in - * this cache, we discard the descriptor as it's considered unusable. - * - * Once a descriptor is removed from the rend cache or expires, the entry - * in this cache is also removed for the service ID. - * - * This scheme allows us to not rely on the descriptor's timestamp (which - * is rounded down to the hour) to know if we have a newer descriptor. We - * only rely on the usability of intro points from an internal state. */ -STATIC strmap_t *rend_cache_failure = NULL; - -/* DOCDOC */ -STATIC size_t rend_cache_total_allocation = 0; - -/** Initializes the service descriptor cache. -*/ -void -rend_cache_init(void) -{ - rend_cache = strmap_new(); - rend_cache_v2_dir = digestmap_new(); - rend_cache_local_service = strmap_new(); - rend_cache_failure = strmap_new(); -} - -/** Return the approximate number of bytes needed to hold <b>e</b>. */ -STATIC size_t -rend_cache_entry_allocation(const rend_cache_entry_t *e) -{ - if (!e) - return 0; - - /* This doesn't count intro_nodes or key size */ - return sizeof(*e) + e->len + sizeof(*e->parsed); -} - -/* DOCDOC */ -size_t -rend_cache_get_total_allocation(void) -{ - return rend_cache_total_allocation; -} - -/** Decrement the total bytes attributed to the rendezvous cache by n. */ -void -rend_cache_decrement_allocation(size_t n) -{ - static int have_underflowed = 0; - - if (rend_cache_total_allocation >= n) { - rend_cache_total_allocation -= n; - } else { - rend_cache_total_allocation = 0; - if (! have_underflowed) { - have_underflowed = 1; - log_warn(LD_BUG, "Underflow in rend_cache_decrement_allocation"); - } - } -} - -/** Increase the total bytes attributed to the rendezvous cache by n. */ -void -rend_cache_increment_allocation(size_t n) -{ - static int have_overflowed = 0; - if (rend_cache_total_allocation <= SIZE_MAX - n) { - rend_cache_total_allocation += n; - } else { - rend_cache_total_allocation = SIZE_MAX; - if (! have_overflowed) { - have_overflowed = 1; - log_warn(LD_BUG, "Overflow in rend_cache_increment_allocation"); - } - } -} - -/** Helper: free a rend cache failure intro object. */ -STATIC void -rend_cache_failure_intro_entry_free_(rend_cache_failure_intro_t *entry) -{ - if (entry == NULL) { - return; - } - tor_free(entry); -} - -static void -rend_cache_failure_intro_entry_free_void(void *entry) -{ - rend_cache_failure_intro_entry_free_(entry); -} - -/** Allocate a rend cache failure intro object and return it. <b>failure</b> - * is set into the object. This function can not fail. */ -STATIC rend_cache_failure_intro_t * -rend_cache_failure_intro_entry_new(rend_intro_point_failure_t failure) -{ - rend_cache_failure_intro_t *entry = tor_malloc(sizeof(*entry)); - entry->failure_type = failure; - entry->created_ts = time(NULL); - return entry; -} - -/** Helper: free a rend cache failure object. */ -STATIC void -rend_cache_failure_entry_free_(rend_cache_failure_t *entry) -{ - if (entry == NULL) { - return; - } - - /* Free and remove every intro failure object. */ - digestmap_free(entry->intro_failures, - rend_cache_failure_intro_entry_free_void); - - tor_free(entry); -} - -/** Helper: deallocate a rend_cache_failure_t. (Used with strmap_free(), - * which requires a function pointer whose argument is void*). */ -STATIC void -rend_cache_failure_entry_free_void(void *entry) -{ - rend_cache_failure_entry_free_(entry); -} - -/** Allocate a rend cache failure object and return it. This function can - * not fail. */ -STATIC rend_cache_failure_t * -rend_cache_failure_entry_new(void) -{ - rend_cache_failure_t *entry = tor_malloc(sizeof(*entry)); - entry->intro_failures = digestmap_new(); - return entry; -} - -/** Remove failure cache entry for the service ID in the given descriptor - * <b>desc</b>. */ -STATIC void -rend_cache_failure_remove(rend_service_descriptor_t *desc) -{ - char service_id[REND_SERVICE_ID_LEN_BASE32 + 1]; - rend_cache_failure_t *entry; - - if (desc == NULL) { - return; - } - if (rend_get_service_id(desc->pk, service_id) < 0) { - return; - } - entry = strmap_get_lc(rend_cache_failure, service_id); - if (entry != NULL) { - strmap_remove_lc(rend_cache_failure, service_id); - rend_cache_failure_entry_free(entry); - } -} - -/** Helper: free storage held by a single service descriptor cache entry. */ -STATIC void -rend_cache_entry_free_(rend_cache_entry_t *e) -{ - if (!e) - return; - rend_cache_decrement_allocation(rend_cache_entry_allocation(e)); - /* We are about to remove a descriptor from the cache so remove the entry - * in the failure cache. */ - rend_cache_failure_remove(e->parsed); - rend_service_descriptor_free(e->parsed); - tor_free(e->desc); - tor_free(e); -} - -/** Helper: deallocate a rend_cache_entry_t. (Used with strmap_free(), which - * requires a function pointer whose argument is void*). */ -static void -rend_cache_entry_free_void(void *p) -{ - rend_cache_entry_free_(p); -} - -/** Check if a failure cache entry exists for the given intro point. */ -bool -rend_cache_intro_failure_exists(const char *service_id, - const uint8_t *intro_identity) -{ - tor_assert(service_id); - tor_assert(intro_identity); - - return cache_failure_intro_lookup(intro_identity, service_id, NULL); -} - -/** Free all storage held by the service descriptor cache. */ -void -rend_cache_free_all(void) -{ - strmap_free(rend_cache, rend_cache_entry_free_void); - digestmap_free(rend_cache_v2_dir, rend_cache_entry_free_void); - strmap_free(rend_cache_local_service, rend_cache_entry_free_void); - strmap_free(rend_cache_failure, rend_cache_failure_entry_free_void); - rend_cache = NULL; - rend_cache_v2_dir = NULL; - rend_cache_local_service = NULL; - rend_cache_failure = NULL; - rend_cache_total_allocation = 0; -} - -/** Remove all entries that re REND_CACHE_FAILURE_MAX_AGE old. This is - * called every second. - * - * We have to clean these regularly else if for whatever reasons an hidden - * service goes offline and a client tries to connect to it during that - * time, a failure entry is created and the client will be unable to connect - * for a while even though the service has return online. */ -void -rend_cache_failure_clean(time_t now) -{ - time_t cutoff = now - REND_CACHE_FAILURE_MAX_AGE; - STRMAP_FOREACH_MODIFY(rend_cache_failure, key, - rend_cache_failure_t *, ent) { - /* Free and remove every intro failure object that match the cutoff. */ - DIGESTMAP_FOREACH_MODIFY(ent->intro_failures, ip_key, - rend_cache_failure_intro_t *, ip_ent) { - if (ip_ent->created_ts < cutoff) { - rend_cache_failure_intro_entry_free(ip_ent); - MAP_DEL_CURRENT(ip_key); - } - } DIGESTMAP_FOREACH_END; - /* If the entry is now empty of intro point failures, remove it. */ - if (digestmap_isempty(ent->intro_failures)) { - rend_cache_failure_entry_free(ent); - MAP_DEL_CURRENT(key); - } - } STRMAP_FOREACH_END; -} - -/** Removes all old entries from the client or service descriptor cache. -*/ -void -rend_cache_clean(time_t now, rend_cache_type_t cache_type) -{ - strmap_iter_t *iter; - const char *key; - void *val; - rend_cache_entry_t *ent; - time_t cutoff = now - REND_CACHE_MAX_AGE - REND_CACHE_MAX_SKEW; - strmap_t *cache = NULL; - - if (cache_type == REND_CACHE_TYPE_CLIENT) { - cache = rend_cache; - } else if (cache_type == REND_CACHE_TYPE_SERVICE) { - cache = rend_cache_local_service; - } - tor_assert(cache); - - for (iter = strmap_iter_init(cache); !strmap_iter_done(iter); ) { - strmap_iter_get(iter, &key, &val); - ent = (rend_cache_entry_t*)val; - if (ent->parsed->timestamp < cutoff) { - iter = strmap_iter_next_rmv(cache, iter); - rend_cache_entry_free(ent); - } else { - iter = strmap_iter_next(cache, iter); - } - } -} - -/** Remove ALL entries from the rendezvous service descriptor cache. -*/ -void -rend_cache_purge(void) -{ - if (rend_cache) { - log_info(LD_REND, "Purging HS v2 descriptor cache"); - strmap_free(rend_cache, rend_cache_entry_free_void); - } - rend_cache = strmap_new(); -} - -/** Remove ALL entries from the failure cache. This is also called when a - * NEWNYM signal is received. */ -void -rend_cache_failure_purge(void) -{ - if (rend_cache_failure) { - log_info(LD_REND, "Purging HS v2 failure cache"); - strmap_free(rend_cache_failure, rend_cache_failure_entry_free_void); - } - rend_cache_failure = strmap_new(); -} - -/** Lookup the rend failure cache using a relay identity digest in - * <b>identity</b> which has DIGEST_LEN bytes and service ID <b>service_id</b> - * which is a null-terminated string. If @a intro_entry is provided, then it - * is set to the entry on success, and to NULL on failure. - * Return 1 iff found else 0. */ -STATIC int -cache_failure_intro_lookup(const uint8_t *identity, const char *service_id, - rend_cache_failure_intro_t **intro_entry) -{ - rend_cache_failure_t *elem; - rend_cache_failure_intro_t *intro_elem; - - tor_assert(rend_cache_failure); - - if (intro_entry) { - *intro_entry = NULL; - } - - /* Lookup descriptor and return it. */ - elem = strmap_get_lc(rend_cache_failure, service_id); - if (elem == NULL) { - goto not_found; - } - intro_elem = digestmap_get(elem->intro_failures, (char *) identity); - if (intro_elem == NULL) { - goto not_found; - } - if (intro_entry) { - *intro_entry = intro_elem; - } - return 1; - not_found: - return 0; -} - -/** Allocate a new cache failure intro object and copy the content from - * <b>entry</b> to this newly allocated object. Return it. */ -static rend_cache_failure_intro_t * -cache_failure_intro_dup(const rend_cache_failure_intro_t *entry) -{ - rend_cache_failure_intro_t *ent_dup = - rend_cache_failure_intro_entry_new(entry->failure_type); - ent_dup->created_ts = entry->created_ts; - return ent_dup; -} - -/** Add an intro point failure to the failure cache using the relay - * <b>identity</b> and service ID <b>service_id</b>. Record the - * <b>failure</b> in that object. */ -STATIC void -cache_failure_intro_add(const uint8_t *identity, const char *service_id, - rend_intro_point_failure_t failure) -{ - rend_cache_failure_t *fail_entry; - rend_cache_failure_intro_t *entry, *old_entry; - - /* Make sure we have a failure object for this service ID and if not, - * create it with this new intro failure entry. */ - fail_entry = strmap_get_lc(rend_cache_failure, service_id); - if (fail_entry == NULL) { - fail_entry = rend_cache_failure_entry_new(); - /* Add failure entry to global rend failure cache. */ - strmap_set_lc(rend_cache_failure, service_id, fail_entry); - } - entry = rend_cache_failure_intro_entry_new(failure); - old_entry = digestmap_set(fail_entry->intro_failures, - (char *) identity, entry); - /* This _should_ be NULL, but in case it isn't, free it. */ - rend_cache_failure_intro_entry_free(old_entry); -} - -/** Using a parsed descriptor <b>desc</b>, check if the introduction points - * are present in the failure cache and if so they are removed from the - * descriptor and kept into the failure cache. Then, each intro points that - * are NOT in the descriptor but in the failure cache for the given - * <b>service_id</b> are removed from the failure cache. */ -STATIC void -validate_intro_point_failure(const rend_service_descriptor_t *desc, - const char *service_id) -{ - rend_cache_failure_t *new_entry, *cur_entry; - /* New entry for the service ID that will be replacing the one in the - * failure cache since we have a new descriptor. In the case where all - * intro points are removed, we are assured that the new entry is the same - * as the current one. */ - new_entry = tor_malloc(sizeof(*new_entry)); - new_entry->intro_failures = digestmap_new(); - - tor_assert(desc); - - SMARTLIST_FOREACH_BEGIN(desc->intro_nodes, rend_intro_point_t *, intro) { - int found; - rend_cache_failure_intro_t *entry; - const uint8_t *identity = - (uint8_t *) intro->extend_info->identity_digest; - - found = cache_failure_intro_lookup(identity, service_id, &entry); - if (found) { - /* Dup here since it will be freed at the end when removing the - * original entry in the cache. */ - rend_cache_failure_intro_t *ent_dup = cache_failure_intro_dup(entry); - /* This intro point is in our cache, discard it from the descriptor - * because chances are that it's unusable. */ - SMARTLIST_DEL_CURRENT(desc->intro_nodes, intro); - /* Keep it for our new entry. */ - digestmap_set(new_entry->intro_failures, (char *) identity, ent_dup); - /* Only free it when we're done looking at it. */ - rend_intro_point_free(intro); - continue; - } - } SMARTLIST_FOREACH_END(intro); - - /* Swap the failure entry in the cache and free the current one. */ - cur_entry = strmap_get_lc(rend_cache_failure, service_id); - if (cur_entry != NULL) { - rend_cache_failure_entry_free(cur_entry); - } - strmap_set_lc(rend_cache_failure, service_id, new_entry); -} - -/** Note down an intro failure in the rend failure cache using the type of - * failure in <b>failure</b> for the relay identity digest in - * <b>identity</b> and service ID <b>service_id</b>. If an entry already - * exists in the cache, the failure type is changed with <b>failure</b>. */ -void -rend_cache_intro_failure_note(rend_intro_point_failure_t failure, - const uint8_t *identity, - const char *service_id) -{ - int found; - rend_cache_failure_intro_t *entry; - - found = cache_failure_intro_lookup(identity, service_id, &entry); - if (!found) { - cache_failure_intro_add(identity, service_id, failure); - } else { - /* Replace introduction point failure with this one. */ - entry->failure_type = failure; - } -} - -/** Remove all old v2 descriptors and those for which this hidden service - * directory is not responsible for any more. The cutoff is the time limit for - * which we want to keep the cache entry. In other words, any entry created - * before will be removed. */ -size_t -rend_cache_clean_v2_descs_as_dir(time_t cutoff) -{ - digestmap_iter_t *iter; - size_t bytes_removed = 0; - - for (iter = digestmap_iter_init(rend_cache_v2_dir); - !digestmap_iter_done(iter); ) { - const char *key; - void *val; - rend_cache_entry_t *ent; - digestmap_iter_get(iter, &key, &val); - ent = val; - if (ent->parsed->timestamp < cutoff) { - char key_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; - base32_encode(key_base32, sizeof(key_base32), key, DIGEST_LEN); - log_info(LD_REND, "Removing descriptor with ID '%s' from cache", - safe_str_client(key_base32)); - bytes_removed += rend_cache_entry_allocation(ent); - iter = digestmap_iter_next_rmv(rend_cache_v2_dir, iter); - rend_cache_entry_free(ent); - } else { - iter = digestmap_iter_next(rend_cache_v2_dir, iter); - } - } - - return bytes_removed; -} - -/** Lookup in the client cache the given service ID <b>query</b> for - * <b>version</b>. - * - * Return 0 if found and if <b>e</b> is non NULL, set it with the entry - * found. Else, a negative value is returned and <b>e</b> is untouched. - * -EINVAL means that <b>query</b> is not a valid service id. - * -ENOENT means that no entry in the cache was found. */ -int -rend_cache_lookup_entry(const char *query, int version, rend_cache_entry_t **e) -{ - int ret = 0; - char key[REND_SERVICE_ID_LEN_BASE32 + 2]; /* <version><query>\0 */ - rend_cache_entry_t *entry = NULL; - static const int default_version = 2; - - tor_assert(query); - - /* This is possible if we are in the shutdown process and the cache was - * freed while some other subsystem might do a lookup to the cache for - * cleanup reasons such HS circuit cleanup for instance. */ - if (!rend_cache) { - ret = -ENOENT; - goto end; - } - - if (!rend_valid_v2_service_id(query)) { - ret = -EINVAL; - goto end; - } - - switch (version) { - case 0: - log_warn(LD_REND, "Cache lookup of a v0 renddesc is deprecated."); - break; - case 2: - /* Default is version 2. */ - default: - tor_snprintf(key, sizeof(key), "%d%s", default_version, query); - entry = strmap_get_lc(rend_cache, key); - break; - } - if (!entry) { - ret = -ENOENT; - goto end; - } - tor_assert(entry->parsed && entry->parsed->intro_nodes); - - if (e) { - *e = entry; - } - - end: - return ret; -} - -/* - * Lookup the v2 service descriptor with the service ID <b>query</b> in the - * local service descriptor cache. Return 0 if found and if <b>e</b> is - * non NULL, set it with the entry found. Else, a negative value is returned - * and <b>e</b> is untouched. - * -EINVAL means that <b>query</b> is not a valid service id. - * -ENOENT means that no entry in the cache was found. */ -int -rend_cache_lookup_v2_desc_as_service(const char *query, rend_cache_entry_t **e) -{ - int ret = 0; - rend_cache_entry_t *entry = NULL; - - tor_assert(rend_cache_local_service); - tor_assert(query); - - if (!rend_valid_v2_service_id(query)) { - ret = -EINVAL; - goto end; - } - - /* Lookup descriptor and return. */ - entry = strmap_get_lc(rend_cache_local_service, query); - if (!entry) { - ret = -ENOENT; - goto end; - } - - if (e) { - *e = entry; - } - - end: - return ret; -} - -/** Lookup the v2 service descriptor with base32-encoded <b>desc_id</b> and - * copy the pointer to it to *<b>desc</b>. Return 1 on success, 0 on - * well-formed-but-not-found, and -1 on failure. - */ -int -rend_cache_lookup_v2_desc_as_dir(const char *desc_id, const char **desc) -{ - rend_cache_entry_t *e; - char desc_id_digest[DIGEST_LEN]; - tor_assert(rend_cache_v2_dir); - if (base32_decode(desc_id_digest, DIGEST_LEN, - desc_id, REND_DESC_ID_V2_LEN_BASE32) != DIGEST_LEN) { - log_fn(LOG_PROTOCOL_WARN, LD_REND, - "Rejecting v2 rendezvous descriptor request -- descriptor ID " - "has wrong length or illegal characters: %s", - safe_str(desc_id)); - return -1; - } - /* Lookup descriptor and return. */ - e = digestmap_get(rend_cache_v2_dir, desc_id_digest); - if (e) { - *desc = e->desc; - e->last_served = approx_time(); - return 1; - } - return 0; -} - -/** Parse the v2 service descriptor(s) in <b>desc</b> and store it/them to the - * local rend cache. Don't attempt to decrypt the included list of introduction - * points (as we don't have a descriptor cookie for it). - * - * If we have a newer descriptor with the same ID, ignore this one. - * If we have an older descriptor with the same ID, replace it. - * - * Return 0 on success, or -1 if we couldn't parse any of them. - * - * We should only call this function for public (e.g. non bridge) relays. - */ -int -rend_cache_store_v2_desc_as_dir(const char *desc) -{ - const or_options_t *options = get_options(); - rend_service_descriptor_t *parsed; - char desc_id[DIGEST_LEN]; - char *intro_content; - size_t intro_size; - size_t encoded_size; - char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; - int number_parsed = 0, number_stored = 0; - const char *current_desc = desc; - const char *next_desc; - rend_cache_entry_t *e; - time_t now = time(NULL); - tor_assert(rend_cache_v2_dir); - tor_assert(desc); - while (rend_parse_v2_service_descriptor(&parsed, desc_id, &intro_content, - &intro_size, &encoded_size, - &next_desc, current_desc, 1) >= 0) { - number_parsed++; - /* We don't care about the introduction points. */ - tor_free(intro_content); - /* For pretty log statements. */ - base32_encode(desc_id_base32, sizeof(desc_id_base32), - desc_id, DIGEST_LEN); - /* Is descriptor too old? */ - if (parsed->timestamp < now - REND_CACHE_MAX_AGE-REND_CACHE_MAX_SKEW) { - log_info(LD_REND, "Service descriptor with desc ID %s is too old.", - safe_str(desc_id_base32)); - goto skip; - } - /* Is descriptor too far in the future? */ - if (parsed->timestamp > now + REND_CACHE_MAX_SKEW) { - log_info(LD_REND, "Service descriptor with desc ID %s is too far in the " - "future.", - safe_str(desc_id_base32)); - goto skip; - } - /* Do we already have a newer descriptor? */ - e = digestmap_get(rend_cache_v2_dir, desc_id); - if (e && e->parsed->timestamp > parsed->timestamp) { - log_info(LD_REND, "We already have a newer service descriptor with the " - "same desc ID %s and version.", - safe_str(desc_id_base32)); - goto skip; - } - /* Do we already have this descriptor? */ - if (e && !strcmp(desc, e->desc)) { - log_info(LD_REND, "We already have this service descriptor with desc " - "ID %s.", safe_str(desc_id_base32)); - goto skip; - } - /* Store received descriptor. */ - if (!e) { - e = tor_malloc_zero(sizeof(rend_cache_entry_t)); - digestmap_set(rend_cache_v2_dir, desc_id, e); - /* Treat something just uploaded as having been served a little - * while ago, so that flooding with new descriptors doesn't help - * too much. - */ - e->last_served = approx_time() - 3600; - } else { - rend_cache_decrement_allocation(rend_cache_entry_allocation(e)); - rend_service_descriptor_free(e->parsed); - tor_free(e->desc); - } - e->parsed = parsed; - e->desc = tor_strndup(current_desc, encoded_size); - e->len = encoded_size; - rend_cache_increment_allocation(rend_cache_entry_allocation(e)); - log_info(LD_REND, "Successfully stored service descriptor with desc ID " - "'%s' and len %d.", - safe_str(desc_id_base32), (int)encoded_size); - /* Statistics: Note down this potentially new HS. */ - if (options->HiddenServiceStatistics) { - rep_hist_stored_maybe_new_hs(e->parsed->pk); - } - - number_stored++; - goto advance; - skip: - rend_service_descriptor_free(parsed); - advance: - /* advance to next descriptor, if available. */ - current_desc = next_desc; - /* check if there is a next descriptor. */ - if (!current_desc || - strcmpstart(current_desc, "rendezvous-service-descriptor ")) - break; - } - if (!number_parsed) { - log_info(LD_REND, "Could not parse any descriptor."); - return -1; - } - log_info(LD_REND, "Parsed %d and added %d descriptor%s.", - number_parsed, number_stored, number_stored != 1 ? "s" : ""); - return 0; -} - -/** Parse the v2 service descriptor in <b>desc</b> and store it to the -* local service rend cache. Don't attempt to decrypt the included list of -* introduction points. -* -* If we have a newer descriptor with the same ID, ignore this one. -* If we have an older descriptor with the same ID, replace it. -* -* Return 0 on success, or -1 if we couldn't understand the descriptor. -*/ -int -rend_cache_store_v2_desc_as_service(const char *desc) -{ - rend_service_descriptor_t *parsed = NULL; - char desc_id[DIGEST_LEN]; - char *intro_content = NULL; - size_t intro_size; - size_t encoded_size; - const char *next_desc; - char service_id[REND_SERVICE_ID_LEN_BASE32+1]; - rend_cache_entry_t *e; - int retval = -1; - tor_assert(rend_cache_local_service); - tor_assert(desc); - - /* Parse the descriptor. */ - if (rend_parse_v2_service_descriptor(&parsed, desc_id, &intro_content, - &intro_size, &encoded_size, - &next_desc, desc, 0) < 0) { - log_warn(LD_REND, "Could not parse descriptor."); - goto err; - } - /* Compute service ID from public key. */ - if (rend_get_service_id(parsed->pk, service_id)<0) { - log_warn(LD_REND, "Couldn't compute service ID."); - goto err; - } - - /* Do we already have a newer descriptor? Allow new descriptors with a - rounded timestamp equal to or newer than the current descriptor */ - e = (rend_cache_entry_t*) strmap_get_lc(rend_cache_local_service, - service_id); - if (e && e->parsed->timestamp > parsed->timestamp) { - log_info(LD_REND, "We already have a newer service descriptor for " - "service ID %s.", safe_str_client(service_id)); - goto okay; - } - /* We don't care about the introduction points. */ - tor_free(intro_content); - if (!e) { - e = tor_malloc_zero(sizeof(rend_cache_entry_t)); - strmap_set_lc(rend_cache_local_service, service_id, e); - } else { - rend_cache_decrement_allocation(rend_cache_entry_allocation(e)); - rend_service_descriptor_free(e->parsed); - tor_free(e->desc); - } - e->parsed = parsed; - e->desc = tor_malloc_zero(encoded_size + 1); - strlcpy(e->desc, desc, encoded_size + 1); - e->len = encoded_size; - rend_cache_increment_allocation(rend_cache_entry_allocation(e)); - log_debug(LD_REND,"Successfully stored rend desc '%s', len %d.", - safe_str_client(service_id), (int)encoded_size); - return 0; - - okay: - retval = 0; - - err: - rend_service_descriptor_free(parsed); - tor_free(intro_content); - return retval; -} - -/** Parse the v2 service descriptor in <b>desc</b>, decrypt the included list - * of introduction points with <b>descriptor_cookie</b> (which may also be - * <b>NULL</b> if decryption is not necessary), and store the descriptor to - * the local cache under its version and service id. - * - * If we have a newer v2 descriptor with the same ID, ignore this one. - * If we have an older descriptor with the same ID, replace it. - * If the descriptor's service ID does not match - * <b>rend_query</b>-\>onion_address, reject it. - * - * If the descriptor's descriptor ID doesn't match <b>desc_id_base32</b>, - * reject it. - * - * Return 0 on success, or -1 if we rejected the descriptor. - * If entry is not NULL, set it with the cache entry pointer of the descriptor. - */ -int -rend_cache_store_v2_desc_as_client(const char *desc, - const char *desc_id_base32, - const rend_data_t *rend_query, - rend_cache_entry_t **entry) -{ - /*XXXX this seems to have a bit of duplicate code with - * rend_cache_store_v2_desc_as_dir(). Fix that. */ - /* Though having similar elements, both functions were separated on - * purpose: - * - dirs don't care about encoded/encrypted introduction points, clients - * do. - * - dirs store descriptors in a separate cache by descriptor ID, whereas - * clients store them by service ID; both caches are different data - * structures and have different access methods. - * - dirs store a descriptor only if they are responsible for its ID, - * clients do so in every way (because they have requested it before). - * - dirs can process multiple concatenated descriptors which is required - * for replication, whereas clients only accept a single descriptor. - * Thus, combining both methods would result in a lot of if statements - * which probably would not improve, but worsen code readability. -KL */ - rend_service_descriptor_t *parsed = NULL; - char desc_id[DIGEST_LEN]; - char *intro_content = NULL; - size_t intro_size; - size_t encoded_size; - const char *next_desc; - time_t now = time(NULL); - char key[REND_SERVICE_ID_LEN_BASE32+2]; - char service_id[REND_SERVICE_ID_LEN_BASE32+1]; - char want_desc_id[DIGEST_LEN]; - rend_cache_entry_t *e; - int retval = -1; - rend_data_v2_t *rend_data = TO_REND_DATA_V2(rend_query); - - tor_assert(rend_cache); - tor_assert(desc); - tor_assert(desc_id_base32); - memset(want_desc_id, 0, sizeof(want_desc_id)); - if (entry) { - *entry = NULL; - } - if (base32_decode(want_desc_id, sizeof(want_desc_id), - desc_id_base32, strlen(desc_id_base32)) != - sizeof(want_desc_id)) { - log_warn(LD_BUG, "Couldn't decode base32 %s for descriptor id.", - escaped_safe_str_client(desc_id_base32)); - goto err; - } - /* Parse the descriptor. */ - if (rend_parse_v2_service_descriptor(&parsed, desc_id, &intro_content, - &intro_size, &encoded_size, - &next_desc, desc, 0) < 0) { - log_warn(LD_REND, "Could not parse descriptor."); - goto err; - } - /* Compute service ID from public key. */ - if (rend_get_service_id(parsed->pk, service_id)<0) { - log_warn(LD_REND, "Couldn't compute service ID."); - goto err; - } - if (rend_data->onion_address[0] != '\0' && - strcmp(rend_data->onion_address, service_id)) { - log_warn(LD_REND, "Received service descriptor for service ID %s; " - "expected descriptor for service ID %s.", - service_id, safe_str(rend_data->onion_address)); - goto err; - } - if (tor_memneq(desc_id, want_desc_id, DIGEST_LEN)) { - log_warn(LD_REND, "Received service descriptor for %s with incorrect " - "descriptor ID.", service_id); - goto err; - } - - /* Decode/decrypt introduction points. */ - if (intro_content && intro_size > 0) { - int n_intro_points; - if (rend_data->auth_type != REND_NO_AUTH && - !safe_mem_is_zero(rend_data->descriptor_cookie, - sizeof(rend_data->descriptor_cookie))) { - char *ipos_decrypted = NULL; - size_t ipos_decrypted_size; - if (rend_decrypt_introduction_points(&ipos_decrypted, - &ipos_decrypted_size, - rend_data->descriptor_cookie, - intro_content, - intro_size) < 0) { - log_warn(LD_REND, "Failed to decrypt introduction points. We are " - "probably unable to parse the encoded introduction points."); - } else { - /* Replace encrypted with decrypted introduction points. */ - log_info(LD_REND, "Successfully decrypted introduction points."); - tor_free(intro_content); - intro_content = ipos_decrypted; - intro_size = ipos_decrypted_size; - } - } - n_intro_points = rend_parse_introduction_points(parsed, intro_content, - intro_size); - if (n_intro_points <= 0) { - log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); - goto err; - } else if (n_intro_points > MAX_INTRO_POINTS) { - log_warn(LD_REND, "Found too many introduction points on a hidden " - "service descriptor for %s. This is probably a (misguided) " - "attempt to improve reliability, but it could also be an " - "attempt to do a guard enumeration attack. Rejecting.", - safe_str_client(service_id)); - - goto err; - } - } else { - log_info(LD_REND, "Descriptor does not contain any introduction points."); - parsed->intro_nodes = smartlist_new(); - } - /* We don't need the encoded/encrypted introduction points any longer. */ - tor_free(intro_content); - /* Is descriptor too old? */ - if (parsed->timestamp < now - REND_CACHE_MAX_AGE-REND_CACHE_MAX_SKEW) { - log_warn(LD_REND, "Service descriptor with service ID %s is too old.", - safe_str_client(service_id)); - goto err; - } - /* Is descriptor too far in the future? */ - if (parsed->timestamp > now + REND_CACHE_MAX_SKEW) { - log_warn(LD_REND, "Service descriptor with service ID %s is too far in " - "the future.", safe_str_client(service_id)); - goto err; - } - /* Do we have the same exact copy already in our cache? */ - tor_snprintf(key, sizeof(key), "2%s", service_id); - e = (rend_cache_entry_t*) strmap_get_lc(rend_cache, key); - if (e && !strcmp(desc, e->desc)) { - log_info(LD_REND,"We already have this service descriptor %s.", - safe_str_client(service_id)); - goto okay; - } - /* Verify that we are not replacing an older descriptor. It's important to - * avoid an evil HSDir serving old descriptor. We validate if the - * timestamp is greater than and not equal because it's a rounded down - * timestamp to the hour so if the descriptor changed in the same hour, - * the rend cache failure will tell us if we have a new descriptor. */ - if (e && e->parsed->timestamp > parsed->timestamp) { - log_info(LD_REND, "We already have a new enough service descriptor for " - "service ID %s with the same desc ID and version.", - safe_str_client(service_id)); - goto okay; - } - /* Lookup our failure cache for intro point that might be unusable. */ - validate_intro_point_failure(parsed, service_id); - /* It's now possible that our intro point list is empty, which means that - * this descriptor is useless to us because intro points have all failed - * somehow before. Discard the descriptor. */ - if (smartlist_len(parsed->intro_nodes) == 0) { - log_info(LD_REND, "Service descriptor with service ID %s has no " - "usable intro points. Discarding it.", - safe_str_client(service_id)); - goto err; - } - /* Now either purge the current one and replace its content or create a - * new one and add it to the rend cache. */ - if (!e) { - e = tor_malloc_zero(sizeof(rend_cache_entry_t)); - strmap_set_lc(rend_cache, key, e); - } else { - rend_cache_decrement_allocation(rend_cache_entry_allocation(e)); - rend_cache_failure_remove(e->parsed); - rend_service_descriptor_free(e->parsed); - tor_free(e->desc); - } - e->parsed = parsed; - e->desc = tor_malloc_zero(encoded_size + 1); - strlcpy(e->desc, desc, encoded_size + 1); - e->len = encoded_size; - rend_cache_increment_allocation(rend_cache_entry_allocation(e)); - log_debug(LD_REND,"Successfully stored rend desc '%s', len %d.", - safe_str_client(service_id), (int)encoded_size); - if (entry) { - *entry = e; - } - return 0; - - okay: - if (entry) { - *entry = e; - } - retval = 0; - - err: - rend_service_descriptor_free(parsed); - tor_free(intro_content); - return retval; -} diff --git a/src/feature/rend/rendcache.h b/src/feature/rend/rendcache.h deleted file mode 100644 index 45410610b4..0000000000 --- a/src/feature/rend/rendcache.h +++ /dev/null @@ -1,132 +0,0 @@ -/* Copyright (c) 2015-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * \file rendcache.h - * \brief Header file for rendcache.c - **/ - -#ifndef TOR_RENDCACHE_H -#define TOR_RENDCACHE_H - -#include "core/or/or.h" -#include "feature/rend/rendcommon.h" - -/** How old do we let hidden service descriptors get before discarding - * them as too old? */ -#define REND_CACHE_MAX_AGE (2*24*60*60) -/** How wrong do we assume our clock may be when checking whether hidden - * services are too old or too new? */ -#define REND_CACHE_MAX_SKEW (24*60*60) -/** How old do we keep an intro point failure entry in the failure cache? */ -#define REND_CACHE_FAILURE_MAX_AGE (5*60) - -/* Do not allow more than this many introduction points in a hidden service - * descriptor */ -#define MAX_INTRO_POINTS 10 - -/** A cached rendezvous descriptor. */ -typedef struct rend_cache_entry_t { - size_t len; /**< Length of <b>desc</b> */ - time_t last_served; /**< When did we last write this one to somebody? - * (HSDir only) */ - char *desc; /**< Service descriptor */ - rend_service_descriptor_t *parsed; /**< Parsed value of 'desc' */ -} rend_cache_entry_t; - -/* Introduction point failure type. */ -typedef struct rend_cache_failure_intro_t { - /* When this intro point failure occurred thus we allocated this object and - * cache it. */ - time_t created_ts; - rend_intro_point_failure_t failure_type; -} rend_cache_failure_intro_t; - -/** Cache failure object indexed by service ID. */ -typedef struct rend_cache_failure_t { - /* Contains rend_cache_failure_intro_t indexed by identity digest. */ - digestmap_t *intro_failures; -} rend_cache_failure_t; - -typedef enum { - REND_CACHE_TYPE_CLIENT = 1, - REND_CACHE_TYPE_SERVICE = 2, -} rend_cache_type_t; - -/* Return maximum lifetime in seconds of a cache entry. */ -static inline time_t -rend_cache_max_entry_lifetime(void) -{ - return REND_CACHE_MAX_AGE + REND_CACHE_MAX_SKEW; -} - -void rend_cache_init(void); -void rend_cache_clean(time_t now, rend_cache_type_t cache_type); -void rend_cache_failure_clean(time_t now); -size_t rend_cache_clean_v2_descs_as_dir(time_t cutoff); -void rend_cache_purge(void); -void rend_cache_free_all(void); -int rend_cache_lookup_entry(const char *query, int version, - rend_cache_entry_t **entry_out); -int rend_cache_lookup_v2_desc_as_service(const char *query, - rend_cache_entry_t **entry_out); -int rend_cache_lookup_v2_desc_as_dir(const char *query, const char **desc); - -int rend_cache_store_v2_desc_as_dir(const char *desc); -int rend_cache_store_v2_desc_as_service(const char *desc); -int rend_cache_store_v2_desc_as_client(const char *desc, - const char *desc_id_base32, - const rend_data_t *rend_query, - rend_cache_entry_t **entry); -size_t rend_cache_get_total_allocation(void); - -bool rend_cache_intro_failure_exists(const char *service_id, - const uint8_t *intro_identity); -void rend_cache_intro_failure_note(rend_intro_point_failure_t failure, - const uint8_t *identity, - const char *service_id); -void rend_cache_failure_purge(void); -void rend_cache_decrement_allocation(size_t n); -void rend_cache_increment_allocation(size_t n); - -#ifdef RENDCACHE_PRIVATE - -STATIC size_t rend_cache_entry_allocation(const rend_cache_entry_t *e); -STATIC void rend_cache_entry_free_(rend_cache_entry_t *e); -#define rend_cache_entry_free(e) \ - FREE_AND_NULL(rend_cache_entry_t, rend_cache_entry_free_, (e)) -STATIC void rend_cache_failure_intro_entry_free_(rend_cache_failure_intro_t - *entry); -#define rend_cache_failure_intro_entry_free(e) \ - FREE_AND_NULL(rend_cache_failure_intro_t, \ - rend_cache_failure_intro_entry_free_, (e)) -STATIC void rend_cache_failure_entry_free_(rend_cache_failure_t *entry); -#define rend_cache_failure_entry_free(e) \ - FREE_AND_NULL(rend_cache_failure_t, \ - rend_cache_failure_entry_free_, (e)) -STATIC int cache_failure_intro_lookup(const uint8_t *identity, - const char *service_id, - rend_cache_failure_intro_t - **intro_entry); -STATIC rend_cache_failure_intro_t *rend_cache_failure_intro_entry_new( - rend_intro_point_failure_t failure); -STATIC rend_cache_failure_t *rend_cache_failure_entry_new(void); -STATIC void rend_cache_failure_remove(rend_service_descriptor_t *desc); -STATIC void cache_failure_intro_add(const uint8_t *identity, - const char *service_id, - rend_intro_point_failure_t failure); -STATIC void validate_intro_point_failure(const rend_service_descriptor_t *desc, - const char *service_id); - -STATIC void rend_cache_failure_entry_free_void(void *entry); - -#ifdef TOR_UNIT_TESTS -extern strmap_t *rend_cache; -extern strmap_t *rend_cache_failure; -extern digestmap_t *rend_cache_v2_dir; -extern size_t rend_cache_total_allocation; -#endif /* defined(TOR_UNIT_TESTS) */ -#endif /* defined(RENDCACHE_PRIVATE) */ - -#endif /* !defined(TOR_RENDCACHE_H) */ - diff --git a/src/feature/rend/rendclient.c b/src/feature/rend/rendclient.c deleted file mode 100644 index 3dda7cd46d..0000000000 --- a/src/feature/rend/rendclient.c +++ /dev/null @@ -1,1322 +0,0 @@ -/* Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * \file rendclient.c - * \brief Client code to access location-hidden services. - **/ - -#include "core/or/or.h" -#include "app/config/config.h" -#include "core/mainloop/connection.h" -#include "core/mainloop/mainloop.h" -#include "core/or/circuitbuild.h" -#include "core/or/circuitlist.h" -#include "core/or/circuituse.h" -#include "core/or/connection_edge.h" -#include "core/or/extendinfo.h" -#include "core/or/relay.h" -#include "feature/client/circpathbias.h" -#include "feature/control/control_events.h" -#include "feature/dirclient/dirclient.h" -#include "feature/dircommon/directory.h" -#include "feature/hs/hs_circuit.h" -#include "feature/hs/hs_client.h" -#include "feature/hs/hs_common.h" -#include "feature/nodelist/describe.h" -#include "feature/nodelist/networkstatus.h" -#include "feature/nodelist/nodelist.h" -#include "feature/nodelist/routerlist.h" -#include "feature/nodelist/routerset.h" -#include "feature/rend/rendclient.h" -#include "feature/rend/rendcommon.h" -#include "feature/stats/rephist.h" -#include "lib/crypt_ops/crypto_dh.h" -#include "lib/crypt_ops/crypto_rand.h" -#include "lib/crypt_ops/crypto_util.h" -#include "lib/encoding/confline.h" - -#include "core/or/cpath_build_state_st.h" -#include "core/or/crypt_path_st.h" -#include "feature/dircommon/dir_connection_st.h" -#include "core/or/entry_connection_st.h" -#include "core/or/extend_info_st.h" -#include "core/or/origin_circuit_st.h" -#include "feature/rend/rend_intro_point_st.h" -#include "feature/rend/rend_service_descriptor_st.h" -#include "feature/nodelist/routerstatus_st.h" - -static extend_info_t *rend_client_get_random_intro_impl( - const rend_cache_entry_t *rend_query, - const int strict, const int warnings); - -/** Purge all potentially remotely-detectable state held in the hidden - * service client code. Called on SIGNAL NEWNYM. */ -void -rend_client_purge_state(void) -{ - rend_cache_purge(); - rend_cache_failure_purge(); - rend_client_cancel_descriptor_fetches(); - hs_purge_last_hid_serv_requests(); -} - -/** Called when we've established a circuit to an introduction point: - * send the introduction request. */ -void -rend_client_introcirc_has_opened(origin_circuit_t *circ) -{ - tor_assert(circ->base_.purpose == CIRCUIT_PURPOSE_C_INTRODUCING); - tor_assert(circ->cpath); - - log_info(LD_REND,"introcirc is open"); - connection_ap_attach_pending(1); -} - -/** Send the establish-rendezvous cell along a rendezvous circuit. if - * it fails, mark the circ for close and return -1. else return 0. - */ -static int -rend_client_send_establish_rendezvous(origin_circuit_t *circ) -{ - tor_assert(circ->base_.purpose == CIRCUIT_PURPOSE_C_ESTABLISH_REND); - tor_assert(circ->rend_data); - log_info(LD_REND, "Sending an ESTABLISH_RENDEZVOUS cell"); - - crypto_rand(circ->rend_data->rend_cookie, REND_COOKIE_LEN); - - /* Set timestamp_dirty, because circuit_expire_building expects it, - * and the rend cookie also means we've used the circ. */ - circ->base_.timestamp_dirty = time(NULL); - - /* We've attempted to use this circuit. Probe it if we fail */ - pathbias_count_use_attempt(circ); - - if (relay_send_command_from_edge(0, TO_CIRCUIT(circ), - RELAY_COMMAND_ESTABLISH_RENDEZVOUS, - circ->rend_data->rend_cookie, - REND_COOKIE_LEN, - circ->cpath->prev)<0) { - /* circ is already marked for close */ - log_warn(LD_GENERAL, "Couldn't send ESTABLISH_RENDEZVOUS cell"); - return -1; - } - - return 0; -} - -/** Called when we're trying to connect an ap conn; sends an INTRODUCE1 cell - * down introcirc if possible. - */ -int -rend_client_send_introduction(origin_circuit_t *introcirc, - origin_circuit_t *rendcirc) -{ - const or_options_t *options = get_options(); - size_t payload_len; - int r, v3_shift = 0; - char payload[RELAY_PAYLOAD_SIZE]; - char tmp[RELAY_PAYLOAD_SIZE]; - rend_cache_entry_t *entry = NULL; - crypt_path_t *cpath; - ptrdiff_t dh_offset; - crypto_pk_t *intro_key = NULL; - int status = 0; - const char *onion_address; - - tor_assert(introcirc->base_.purpose == CIRCUIT_PURPOSE_C_INTRODUCING); - tor_assert(rendcirc->base_.purpose == CIRCUIT_PURPOSE_C_REND_READY); - tor_assert(introcirc->rend_data); - tor_assert(rendcirc->rend_data); - tor_assert(!rend_cmp_service_ids(rend_data_get_address(introcirc->rend_data), - rend_data_get_address(rendcirc->rend_data))); - assert_circ_anonymity_ok(introcirc, options); - assert_circ_anonymity_ok(rendcirc, options); - onion_address = rend_data_get_address(introcirc->rend_data); - - r = rend_cache_lookup_entry(onion_address, -1, &entry); - /* An invalid onion address is not possible else we have a big issue. */ - tor_assert(r != -EINVAL); - if (r < 0 || !rend_client_any_intro_points_usable(entry)) { - /* If the descriptor is not found or the intro points are not usable - * anymore, trigger a fetch. */ - log_info(LD_REND, - "query %s didn't have valid rend desc in cache. " - "Refetching descriptor.", - safe_str_client(onion_address)); - rend_client_refetch_v2_renddesc(introcirc->rend_data); - { - connection_t *conn; - - while ((conn = connection_get_by_type_state_rendquery(CONN_TYPE_AP, - AP_CONN_STATE_CIRCUIT_WAIT, onion_address))) { - connection_ap_mark_as_waiting_for_renddesc(TO_ENTRY_CONN(conn)); - } - } - - status = -1; - goto cleanup; - } - - /* first 20 bytes of payload are the hash of the service's pk */ - intro_key = NULL; - SMARTLIST_FOREACH(entry->parsed->intro_nodes, rend_intro_point_t *, - intro, { - if (tor_memeq(introcirc->build_state->chosen_exit->identity_digest, - intro->extend_info->identity_digest, DIGEST_LEN)) { - intro_key = intro->intro_key; - break; - } - }); - if (!intro_key) { - log_info(LD_REND, "Could not find intro key for %s at %s; we " - "have a v2 rend desc with %d intro points. " - "Trying a different intro point...", - safe_str_client(onion_address), - safe_str_client(extend_info_describe( - introcirc->build_state->chosen_exit)), - smartlist_len(entry->parsed->intro_nodes)); - - if (hs_client_reextend_intro_circuit(introcirc)) { - status = -2; - goto perm_err; - } else { - status = -1; - goto cleanup; - } - } - if (crypto_pk_get_digest(intro_key, payload)<0) { - log_warn(LD_BUG, "Internal error: couldn't hash public key."); - status = -2; - goto perm_err; - } - - /* Initialize the pending_final_cpath and start the DH handshake. */ - cpath = rendcirc->build_state->pending_final_cpath; - if (!cpath) { - cpath = rendcirc->build_state->pending_final_cpath = - tor_malloc_zero(sizeof(crypt_path_t)); - cpath->magic = CRYPT_PATH_MAGIC; - if (!(cpath->rend_dh_handshake_state = crypto_dh_new(DH_TYPE_REND))) { - log_warn(LD_BUG, "Internal error: couldn't allocate DH."); - status = -2; - goto perm_err; - } - if (crypto_dh_generate_public(cpath->rend_dh_handshake_state)<0) { - log_warn(LD_BUG, "Internal error: couldn't generate g^x."); - status = -2; - goto perm_err; - } - } - - /* If version is 3, write (optional) auth data and timestamp. */ - if (entry->parsed->protocols & (1<<3)) { - tmp[0] = 3; /* version 3 of the cell format */ - /* auth type, if any */ - tmp[1] = (uint8_t) TO_REND_DATA_V2(introcirc->rend_data)->auth_type; - v3_shift = 1; - if (tmp[1] != REND_NO_AUTH) { - set_uint16(tmp+2, htons(REND_DESC_COOKIE_LEN)); - memcpy(tmp+4, TO_REND_DATA_V2(introcirc->rend_data)->descriptor_cookie, - REND_DESC_COOKIE_LEN); - v3_shift += 2+REND_DESC_COOKIE_LEN; - } - /* Once this held a timestamp. */ - set_uint32(tmp+v3_shift+1, 0); - v3_shift += 4; - } /* if version 2 only write version number */ - else if (entry->parsed->protocols & (1<<2)) { - tmp[0] = 2; /* version 2 of the cell format */ - } - - /* write the remaining items into tmp */ - if (entry->parsed->protocols & (1<<3) || entry->parsed->protocols & (1<<2)) { - /* version 2 format */ - extend_info_t *extend_info = rendcirc->build_state->chosen_exit; - int klen; - const tor_addr_port_t *orport = - extend_info_get_orport(extend_info, AF_INET); - IF_BUG_ONCE(! orport) { - /* we should never put an IPv6 address here. */ - goto perm_err; - } - /* nul pads */ - set_uint32(tmp+v3_shift+1, tor_addr_to_ipv4n(&orport->addr)); - set_uint16(tmp+v3_shift+5, htons(orport->port)); - memcpy(tmp+v3_shift+7, extend_info->identity_digest, DIGEST_LEN); - klen = crypto_pk_asn1_encode(extend_info->onion_key, - tmp+v3_shift+7+DIGEST_LEN+2, - sizeof(tmp)-(v3_shift+7+DIGEST_LEN+2)); - if (klen < 0) { - log_warn(LD_BUG,"Internal error: can't encode public key."); - status = -2; - goto perm_err; - } - set_uint16(tmp+v3_shift+7+DIGEST_LEN, htons(klen)); - memcpy(tmp+v3_shift+7+DIGEST_LEN+2+klen, rendcirc->rend_data->rend_cookie, - REND_COOKIE_LEN); - dh_offset = v3_shift+7+DIGEST_LEN+2+klen+REND_COOKIE_LEN; - } else { - /* Version 0. */ - - /* Some compilers are smart enough to work out that nickname can be more - * than 19 characters, when it's a hexdigest. They warn that strncpy() - * will truncate hexdigests without NUL-terminating them. But we only put - * hexdigests in HSDir and general circuit exits. */ - if (BUG(strlen(rendcirc->build_state->chosen_exit->nickname) - > MAX_NICKNAME_LEN)) { - goto perm_err; - } - strlcpy(tmp, rendcirc->build_state->chosen_exit->nickname, - sizeof(tmp)); - memcpy(tmp+MAX_NICKNAME_LEN+1, rendcirc->rend_data->rend_cookie, - REND_COOKIE_LEN); - dh_offset = MAX_NICKNAME_LEN+1+REND_COOKIE_LEN; - } - - if (crypto_dh_get_public(cpath->rend_dh_handshake_state, tmp+dh_offset, - DH1024_KEY_LEN)<0) { - log_warn(LD_BUG, "Internal error: couldn't extract g^x."); - status = -2; - goto perm_err; - } - - /*XXX maybe give crypto_pk_obsolete_public_hybrid_encrypt a max_len arg, - * to avoid buffer overflows? */ - r = crypto_pk_obsolete_public_hybrid_encrypt(intro_key, payload+DIGEST_LEN, - sizeof(payload)-DIGEST_LEN, - tmp, - (int)(dh_offset+DH1024_KEY_LEN), - PK_PKCS1_OAEP_PADDING, 0); - if (r<0) { - log_warn(LD_BUG,"Internal error: hybrid pk encrypt failed."); - status = -2; - goto perm_err; - } - - payload_len = DIGEST_LEN + r; - tor_assert(payload_len <= RELAY_PAYLOAD_SIZE); /* we overran something */ - - /* Copy the rendezvous cookie from rendcirc to introcirc, so that - * when introcirc gets an ack, we can change the state of the right - * rendezvous circuit. */ - memcpy(introcirc->rend_data->rend_cookie, rendcirc->rend_data->rend_cookie, - REND_COOKIE_LEN); - - log_info(LD_REND, "Sending an INTRODUCE1 cell"); - if (relay_send_command_from_edge(0, TO_CIRCUIT(introcirc), - RELAY_COMMAND_INTRODUCE1, - payload, payload_len, - introcirc->cpath->prev)<0) { - /* introcirc is already marked for close. leave rendcirc alone. */ - log_warn(LD_BUG, "Couldn't send INTRODUCE1 cell"); - status = -2; - goto cleanup; - } - - /* Now, we wait for an ACK or NAK on this circuit. */ - circuit_change_purpose(TO_CIRCUIT(introcirc), - CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT); - /* Set timestamp_dirty, because circuit_expire_building expects it - * to specify when a circuit entered the _C_INTRODUCE_ACK_WAIT - * state. */ - introcirc->base_.timestamp_dirty = time(NULL); - - pathbias_count_use_attempt(introcirc); - - goto cleanup; - - perm_err: - if (!introcirc->base_.marked_for_close) - circuit_mark_for_close(TO_CIRCUIT(introcirc), END_CIRC_REASON_INTERNAL); - circuit_mark_for_close(TO_CIRCUIT(rendcirc), END_CIRC_REASON_INTERNAL); - cleanup: - memwipe(payload, 0, sizeof(payload)); - memwipe(tmp, 0, sizeof(tmp)); - - return status; -} - -/** Called when a rendezvous circuit is open; sends a establish - * rendezvous circuit as appropriate. */ -void -rend_client_rendcirc_has_opened(origin_circuit_t *circ) -{ - tor_assert(circ->base_.purpose == CIRCUIT_PURPOSE_C_ESTABLISH_REND); - - log_info(LD_REND,"rendcirc is open"); - - /* generate a rendezvous cookie, store it in circ */ - if (rend_client_send_establish_rendezvous(circ) < 0) { - return; - } -} - -/** - * Called to close other intro circuits we launched in parallel. - */ -static void -rend_client_close_other_intros(const uint8_t *rend_pk_digest) -{ - /* abort parallel intro circs, if any */ - SMARTLIST_FOREACH_BEGIN(circuit_get_global_list(), circuit_t *, c) { - if ((c->purpose == CIRCUIT_PURPOSE_C_INTRODUCING || - c->purpose == CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT) && - !c->marked_for_close && CIRCUIT_IS_ORIGIN(c)) { - origin_circuit_t *oc = TO_ORIGIN_CIRCUIT(c); - if (oc->rend_data && - rend_circuit_pk_digest_eq(oc, rend_pk_digest)) { - log_info(LD_REND|LD_CIRC, "Closing introduction circuit %d that we " - "built in parallel (Purpose %d).", oc->global_identifier, - c->purpose); - circuit_mark_for_close(c, END_CIRC_REASON_IP_NOW_REDUNDANT); - } - } - } - SMARTLIST_FOREACH_END(c); -} - -/** Called when get an ACK or a NAK for a REND_INTRODUCE1 cell. - */ -int -rend_client_introduction_acked(origin_circuit_t *circ, - const uint8_t *request, size_t request_len) -{ - const or_options_t *options = get_options(); - origin_circuit_t *rendcirc; - (void) request; // XXXX Use this. - - tor_assert(circ->build_state); - tor_assert(circ->build_state->chosen_exit); - assert_circ_anonymity_ok(circ, options); - tor_assert(circ->rend_data); - - if (request_len == 0) { - /* It's an ACK; the introduction point relayed our introduction request. */ - /* Locate the rend circ which is waiting to hear about this ack, - * and tell it. - */ - log_info(LD_REND,"Received ack. Telling rend circ..."); - rendcirc = circuit_get_ready_rend_circ_by_rend_data(circ->rend_data); - if (rendcirc) { /* remember the ack */ - assert_circ_anonymity_ok(rendcirc, options); - circuit_change_purpose(TO_CIRCUIT(rendcirc), - CIRCUIT_PURPOSE_C_REND_READY_INTRO_ACKED); - /* Set timestamp_dirty, because circuit_expire_building expects - * it to specify when a circuit entered the - * _C_REND_READY_INTRO_ACKED state. */ - rendcirc->base_.timestamp_dirty = time(NULL); - } else { - log_info(LD_REND,"...Found no rend circ. Dropping on the floor."); - } - /* Save the rend data digest to a temporary object so that we don't access - * it after we mark the circuit for close. */ - const uint8_t *rend_digest_tmp = NULL; - size_t digest_len; - uint8_t *cached_rend_digest = NULL; - rend_digest_tmp = rend_data_get_pk_digest(circ->rend_data, &digest_len); - cached_rend_digest = tor_malloc_zero(digest_len); - memcpy(cached_rend_digest, rend_digest_tmp, digest_len); - - /* close the circuit: we won't need it anymore. */ - circuit_change_purpose(TO_CIRCUIT(circ), - CIRCUIT_PURPOSE_C_INTRODUCE_ACKED); - circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_FINISHED); - - /* close any other intros launched in parallel */ - rend_client_close_other_intros(cached_rend_digest); - tor_free(cached_rend_digest); /* free the temporary digest */ - } else { - /* It's a NAK; the introduction point didn't relay our request. */ - circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_C_INTRODUCING); - /* Remove this intro point from the set of viable introduction - * points. If any remain, extend to a new one and try again. - * If none remain, refetch the service descriptor. - */ - log_info(LD_REND, "Got nack for %s from %s...", - safe_str_client(rend_data_get_address(circ->rend_data)), - safe_str_client(extend_info_describe(circ->build_state->chosen_exit))); - if (rend_client_report_intro_point_failure(circ->build_state->chosen_exit, - circ->rend_data, - INTRO_POINT_FAILURE_GENERIC)>0) { - /* There are introduction points left. Re-extend the circuit to - * another intro point and try again. */ - int result = hs_client_reextend_intro_circuit(circ); - /* XXXX If that call failed, should we close the rend circuit, - * too? */ - return result; - } else { - /* Close circuit because no more intro points are usable thus not - * useful anymore. Change it's purpose before so we don't report an - * intro point failure again triggering an extra descriptor fetch. */ - circuit_change_purpose(TO_CIRCUIT(circ), - CIRCUIT_PURPOSE_C_INTRODUCE_ACKED); - circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_FINISHED); - } - } - return 0; -} - -/** Determine the responsible hidden service directories for <b>desc_id</b> - * and fetch the descriptor with that ID from one of them. Only - * send a request to a hidden service directory that we have not yet tried - * during this attempt to connect to this hidden service; on success, return 1, - * in the case that no hidden service directory is left to ask for the - * descriptor, return 0, and in case of a failure -1. */ -static int -directory_get_from_hs_dir(const char *desc_id, - const rend_data_t *rend_query, - routerstatus_t *rs_hsdir) -{ - routerstatus_t *hs_dir = rs_hsdir; - char *hsdir_fp; - char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; - char descriptor_cookie_base64[3*REND_DESC_COOKIE_LEN_BASE64]; - const rend_data_v2_t *rend_data; - const int how_to_fetch = DIRIND_ANONYMOUS; - - tor_assert(desc_id); - tor_assert(rend_query); - rend_data = TO_REND_DATA_V2(rend_query); - - base32_encode(desc_id_base32, sizeof(desc_id_base32), - desc_id, DIGEST_LEN); - - /* Automatically pick an hs dir if none given. */ - if (!rs_hsdir) { - bool rate_limited = false; - - /* Determine responsible dirs. Even if we can't get all we want, work with - * the ones we have. If it's empty, we'll notice in hs_pick_hsdir(). */ - smartlist_t *responsible_dirs = smartlist_new(); - hid_serv_get_responsible_directories(responsible_dirs, desc_id); - - hs_dir = hs_pick_hsdir(responsible_dirs, desc_id_base32, &rate_limited); - if (!hs_dir) { - /* No suitable hs dir can be found, stop right now. */ - const char *query_response = (rate_limited) ? "QUERY_RATE_LIMITED" : - "QUERY_NO_HSDIR"; - control_event_hsv2_descriptor_failed(rend_query, NULL, query_response); - control_event_hs_descriptor_content(rend_data_get_address(rend_query), - desc_id_base32, NULL, NULL); - return 0; - } - } - - /* Add a copy of the HSDir identity digest to the query so we can track it - * on the control port. */ - hsdir_fp = tor_memdup(hs_dir->identity_digest, - sizeof(hs_dir->identity_digest)); - smartlist_add(rend_query->hsdirs_fp, hsdir_fp); - - /* Encode descriptor cookie for logging purposes. Also, if the cookie is - * malformed, no fetch is triggered thus this needs to be done before the - * fetch request. */ - if (rend_data->auth_type != REND_NO_AUTH) { - if (base64_encode(descriptor_cookie_base64, - sizeof(descriptor_cookie_base64), - rend_data->descriptor_cookie, - REND_DESC_COOKIE_LEN, - 0)<0) { - log_warn(LD_BUG, "Could not base64-encode descriptor cookie."); - control_event_hsv2_descriptor_failed(rend_query, hsdir_fp, "BAD_DESC"); - control_event_hs_descriptor_content(rend_data_get_address(rend_query), - desc_id_base32, hsdir_fp, NULL); - return 0; - } - /* Remove == signs. */ - descriptor_cookie_base64[strlen(descriptor_cookie_base64)-2] = '\0'; - } else { - strlcpy(descriptor_cookie_base64, "(none)", - sizeof(descriptor_cookie_base64)); - } - - /* Send fetch request. (Pass query and possibly descriptor cookie so that - * they can be written to the directory connection and be referred to when - * the response arrives. */ - directory_request_t *req = - directory_request_new(DIR_PURPOSE_FETCH_RENDDESC_V2); - directory_request_set_routerstatus(req, hs_dir); - directory_request_set_indirection(req, how_to_fetch); - directory_request_set_resource(req, desc_id_base32); - directory_request_set_rend_query(req, rend_query); - directory_initiate_request(req); - directory_request_free(req); - - log_info(LD_REND, "Sending fetch request for v2 descriptor for " - "service '%s' with descriptor ID '%s', auth type %d, " - "and descriptor cookie '%s' to hidden service " - "directory %s", - rend_data->onion_address, desc_id_base32, - rend_data->auth_type, - (rend_data->auth_type == REND_NO_AUTH ? "[none]" : - escaped_safe_str_client(descriptor_cookie_base64)), - routerstatus_describe(hs_dir)); - control_event_hs_descriptor_requested(rend_data->onion_address, - rend_data->auth_type, - hs_dir->identity_digest, - desc_id_base32, NULL); - return 1; -} - -/** Remove tracked HSDir requests from our history for this hidden service - * descriptor <b>desc_id</b> (of size DIGEST_LEN) */ -static void -purge_v2_hidserv_req(const char *desc_id) -{ - char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; - - /* The hsdir request tracker stores v2 keys using the base32 encoded - desc_id. Do it: */ - base32_encode(desc_id_base32, sizeof(desc_id_base32), desc_id, - DIGEST_LEN); - hs_purge_hid_serv_from_last_hid_serv_requests(desc_id_base32); -} - -/** Fetch a v2 descriptor using the given descriptor id. If any hsdir(s) are - * given, they will be used instead. - * - * On success, 1 is returned. If no hidden service is left to ask, return 0. - * On error, -1 is returned. */ -static int -fetch_v2_desc_by_descid(const char *desc_id, - const rend_data_t *rend_query, smartlist_t *hsdirs) -{ - int ret; - - tor_assert(rend_query); - - if (!hsdirs) { - ret = directory_get_from_hs_dir(desc_id, rend_query, NULL); - goto end; /* either success or failure, but we're done */ - } - - /* Using the given hsdir list, trigger a fetch on each of them. */ - SMARTLIST_FOREACH_BEGIN(hsdirs, routerstatus_t *, hs_dir) { - /* This should always be a success. */ - ret = directory_get_from_hs_dir(desc_id, rend_query, hs_dir); - tor_assert(ret); - } SMARTLIST_FOREACH_END(hs_dir); - - /* Everything went well. */ - ret = 0; - - end: - return ret; -} - -/** Fetch a v2 descriptor using the onion address in the given query object. - * This will compute the descriptor id for each replicas and fetch it on the - * given hsdir(s) if any or the responsible ones that are chosen - * automatically. - * - * On success, 1 is returned. If no hidden service is left to ask, return 0. - * On error, -1 is returned. */ -static int -fetch_v2_desc_by_addr(rend_data_t *rend_query, smartlist_t *hsdirs) -{ - char descriptor_id[DIGEST_LEN]; - int replicas_left_to_try[REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS]; - int i, tries_left, ret; - rend_data_v2_t *rend_data = TO_REND_DATA_V2(rend_query); - - /* Randomly iterate over the replicas until a descriptor can be fetched - * from one of the consecutive nodes, or no options are left. */ - for (i = 0; i < REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS; i++) { - replicas_left_to_try[i] = i; - } - - tries_left = REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS; - while (tries_left > 0) { - int rand_val = crypto_rand_int(tries_left); - int chosen_replica = replicas_left_to_try[rand_val]; - replicas_left_to_try[rand_val] = replicas_left_to_try[--tries_left]; - - ret = rend_compute_v2_desc_id(descriptor_id, - rend_data->onion_address, - rend_data->auth_type == REND_STEALTH_AUTH ? - rend_data->descriptor_cookie : NULL, - time(NULL), chosen_replica); - if (ret < 0) { - /* Normally, on failure the descriptor_id is untouched but let's be - * safe in general in case the function changes at some point. */ - goto end; - } - - if (tor_memcmp(descriptor_id, rend_data->descriptor_id[chosen_replica], - sizeof(descriptor_id)) != 0) { - /* Not equal from what we currently have so purge the last hid serv - * request cache and update the descriptor ID with the new value. */ - purge_v2_hidserv_req(rend_data->descriptor_id[chosen_replica]); - memcpy(rend_data->descriptor_id[chosen_replica], descriptor_id, - sizeof(rend_data->descriptor_id[chosen_replica])); - } - - /* Trigger the fetch with the computed descriptor ID. */ - ret = fetch_v2_desc_by_descid(descriptor_id, rend_query, hsdirs); - if (ret != 0) { - /* Either on success or failure, as long as we tried a fetch we are - * done here. */ - goto end; - } - } - - /* If we come here, there are no hidden service directories left. */ - log_info(LD_REND, "Could not pick one of the responsible hidden " - "service directories to fetch descriptors, because " - "we already tried them all unsuccessfully."); - ret = 0; - - end: - memwipe(descriptor_id, 0, sizeof(descriptor_id)); - return ret; -} - -/** Fetch a v2 descriptor using the given query. If any hsdir are specified, - * use them for the fetch. - * - * On success, 1 is returned. If no hidden service is left to ask, return 0. - * On error, -1 is returned. */ -int -rend_client_fetch_v2_desc(rend_data_t *query, smartlist_t *hsdirs) -{ - int ret; - rend_data_v2_t *rend_data; - const char *onion_address; - - tor_assert(query); - - /* Get the version 2 data structure of the query. */ - rend_data = TO_REND_DATA_V2(query); - onion_address = rend_data_get_address(query); - - /* Depending on what's available in the rend data query object, we will - * trigger a fetch by HS address or using a descriptor ID. */ - - if (onion_address[0] != '\0') { - ret = fetch_v2_desc_by_addr(query, hsdirs); - } else if (!tor_digest_is_zero(rend_data->desc_id_fetch)) { - ret = fetch_v2_desc_by_descid(rend_data->desc_id_fetch, query, - hsdirs); - } else { - /* Query data is invalid. */ - ret = -1; - goto error; - } - - error: - return ret; -} - -/** Unless we already have a descriptor for <b>rend_query</b> with at least - * one (possibly) working introduction point in it, start a connection to a - * hidden service directory to fetch a v2 rendezvous service descriptor. */ -void -rend_client_refetch_v2_renddesc(rend_data_t *rend_query) -{ - rend_cache_entry_t *e = NULL; - const char *onion_address = rend_data_get_address(rend_query); - - tor_assert(rend_query); - /* Before fetching, check if we already have a usable descriptor here. */ - if (rend_cache_lookup_entry(onion_address, -1, &e) == 0 && - rend_client_any_intro_points_usable(e)) { - log_info(LD_REND, "We would fetch a v2 rendezvous descriptor, but we " - "already have a usable descriptor here. Not fetching."); - return; - } - /* Are we configured to fetch descriptors? */ - if (!get_options()->FetchHidServDescriptors) { - log_warn(LD_REND, "We received an onion address for a v2 rendezvous " - "service descriptor, but are not fetching service descriptors."); - return; - } - log_debug(LD_REND, "Fetching v2 rendezvous descriptor for service %s", - safe_str_client(onion_address)); - - rend_client_fetch_v2_desc(rend_query, NULL); - /* We don't need to look the error code because either on failure or - * success, the necessary steps to continue the HS connection will be - * triggered once the descriptor arrives or if all fetch failed. */ - return; -} - -/** Cancel all rendezvous descriptor fetches currently in progress. - */ -void -rend_client_cancel_descriptor_fetches(void) -{ - smartlist_t *connection_array = get_connection_array(); - - SMARTLIST_FOREACH_BEGIN(connection_array, connection_t *, conn) { - if (conn->type == CONN_TYPE_DIR && - conn->purpose == DIR_PURPOSE_FETCH_RENDDESC_V2) { - /* It's a rendezvous descriptor fetch in progress -- cancel it - * by marking the connection for close. - * - * Even if this connection has already reached EOF, this is - * enough to make sure that if the descriptor hasn't been - * processed yet, it won't be. See the end of - * connection_handle_read; connection_reached_eof (indirectly) - * processes whatever response the connection received. */ - - const rend_data_t *rd = (TO_DIR_CONN(conn))->rend_data; - if (!rd) { - log_warn(LD_BUG | LD_REND, - "Marking for close dir conn fetching rendezvous " - "descriptor for unknown service!"); - } else { - log_debug(LD_REND, "Marking for close dir conn fetching " - "rendezvous descriptor for service %s", - safe_str(rend_data_get_address(rd))); - } - connection_mark_for_close(conn); - } - } SMARTLIST_FOREACH_END(conn); -} - -/** Mark <b>failed_intro</b> as a failed introduction point for the - * hidden service specified by <b>rend_query</b>. If the HS now has no - * usable intro points, or we do not have an HS descriptor for it, - * then launch a new renddesc fetch. - * - * If <b>failure_type</b> is INTRO_POINT_FAILURE_GENERIC, remove the - * intro point from (our parsed copy of) the HS descriptor. - * - * If <b>failure_type</b> is INTRO_POINT_FAILURE_TIMEOUT, mark the - * intro point as 'timed out'; it will not be retried until the - * current hidden service connection attempt has ended or it has - * appeared in a newly fetched rendezvous descriptor. - * - * If <b>failure_type</b> is INTRO_POINT_FAILURE_UNREACHABLE, - * increment the intro point's reachability-failure count; if it has - * now failed MAX_INTRO_POINT_REACHABILITY_FAILURES or more times, - * remove the intro point from (our parsed copy of) the HS descriptor. - * - * Return -1 if error, 0 if no usable intro points remain or service - * unrecognized, 1 if recognized and some intro points remain. - */ -int -rend_client_report_intro_point_failure(extend_info_t *failed_intro, - rend_data_t *rend_data, - unsigned int failure_type) -{ - int i, r; - rend_cache_entry_t *ent; - connection_t *conn; - const char *onion_address = rend_data_get_address(rend_data); - - r = rend_cache_lookup_entry(onion_address, -1, &ent); - if (r < 0) { - /* Either invalid onion address or cache entry not found. */ - switch (-r) { - case EINVAL: - log_warn(LD_BUG, "Malformed service ID %s.", - escaped_safe_str_client(onion_address)); - return -1; - case ENOENT: - log_info(LD_REND, "Unknown service %s. Re-fetching descriptor.", - escaped_safe_str_client(onion_address)); - rend_client_refetch_v2_renddesc(rend_data); - return 0; - default: - log_warn(LD_BUG, "Unknown cache lookup returned code: %d", r); - return -1; - } - } - /* The intro points are not checked here if they are usable or not because - * this is called when an intro point circuit is closed thus there must be - * at least one intro point that is usable and is about to be flagged. */ - - for (i = 0; i < smartlist_len(ent->parsed->intro_nodes); i++) { - rend_intro_point_t *intro = smartlist_get(ent->parsed->intro_nodes, i); - if (tor_memeq(failed_intro->identity_digest, - intro->extend_info->identity_digest, DIGEST_LEN)) { - switch (failure_type) { - default: - log_warn(LD_BUG, "Unknown failure type %u. Removing intro point.", - failure_type); - tor_fragile_assert(); - FALLTHROUGH_UNLESS_ALL_BUGS_ARE_FATAL; - case INTRO_POINT_FAILURE_GENERIC: - rend_cache_intro_failure_note(failure_type, - (uint8_t *)failed_intro->identity_digest, - onion_address); - rend_intro_point_free(intro); - smartlist_del(ent->parsed->intro_nodes, i); - break; - case INTRO_POINT_FAILURE_TIMEOUT: - intro->timed_out = 1; - break; - case INTRO_POINT_FAILURE_UNREACHABLE: - ++(intro->unreachable_count); - { - int zap_intro_point = - intro->unreachable_count >= MAX_INTRO_POINT_REACHABILITY_FAILURES; - log_info(LD_REND, "Failed to reach this intro point %u times.%s", - intro->unreachable_count, - zap_intro_point ? " Removing from descriptor.": ""); - if (zap_intro_point) { - rend_cache_intro_failure_note( - failure_type, - (uint8_t *) failed_intro->identity_digest, onion_address); - rend_intro_point_free(intro); - smartlist_del(ent->parsed->intro_nodes, i); - } - } - break; - } - break; - } - } - - if (! rend_client_any_intro_points_usable(ent)) { - log_info(LD_REND, - "No more intro points remain for %s. Re-fetching descriptor.", - escaped_safe_str_client(onion_address)); - rend_client_refetch_v2_renddesc(rend_data); - - /* move all pending streams back to renddesc_wait */ - /* NOTE: We can now do this faster, if we use pending_entry_connections */ - while ((conn = connection_get_by_type_state_rendquery(CONN_TYPE_AP, - AP_CONN_STATE_CIRCUIT_WAIT, - onion_address))) { - connection_ap_mark_as_waiting_for_renddesc(TO_ENTRY_CONN(conn)); - } - - return 0; - } - log_info(LD_REND,"%d options left for %s.", - smartlist_len(ent->parsed->intro_nodes), - escaped_safe_str_client(onion_address)); - return 1; -} - -/** The service sent us a rendezvous cell; join the circuits. */ -int -rend_client_receive_rendezvous(origin_circuit_t *circ, const uint8_t *request, - size_t request_len) -{ - if (request_len != DH1024_KEY_LEN+DIGEST_LEN) { - log_warn(LD_PROTOCOL,"Incorrect length (%d) on RENDEZVOUS2 cell.", - (int)request_len); - goto err; - } - - if (hs_circuit_setup_e2e_rend_circ_legacy_client(circ, request) < 0) { - log_warn(LD_GENERAL, "Failed to setup circ"); - goto err; - } - return 0; - - err: - circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL); - return -1; -} - -/** Find all the apconns in state AP_CONN_STATE_RENDDESC_WAIT that are - * waiting on <b>query</b>. If there's a working cache entry here with at - * least one intro point, move them to the next state. */ -void -rend_client_desc_trynow(const char *query) -{ - entry_connection_t *conn; - rend_cache_entry_t *entry; - const rend_data_t *rend_data; - time_t now = time(NULL); - - smartlist_t *conns = get_connection_array(); - SMARTLIST_FOREACH_BEGIN(conns, connection_t *, base_conn) { - if (base_conn->type != CONN_TYPE_AP || - base_conn->state != AP_CONN_STATE_RENDDESC_WAIT || - base_conn->marked_for_close) - continue; - conn = TO_ENTRY_CONN(base_conn); - rend_data = ENTRY_TO_EDGE_CONN(conn)->rend_data; - if (!rend_data) - continue; - const char *onion_address = rend_data_get_address(rend_data); - if (rend_cmp_service_ids(query, onion_address)) - continue; - assert_connection_ok(base_conn, now); - if (rend_cache_lookup_entry(onion_address, -1, - &entry) == 0 && - rend_client_any_intro_points_usable(entry)) { - /* either this fetch worked, or it failed but there was a - * valid entry from before which we should reuse */ - log_info(LD_REND,"Rend desc is usable. Launching circuits."); - base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT; - - /* restart their timeout values, so they get a fair shake at - * connecting to the hidden service. */ - base_conn->timestamp_created = now; - base_conn->timestamp_last_read_allowed = now; - base_conn->timestamp_last_write_allowed = now; - - connection_ap_mark_as_pending_circuit(conn); - } else { /* 404, or fetch didn't get that far */ - log_notice(LD_REND,"Closing stream for '%s.onion': hidden service is " - "unavailable (try again later).", - safe_str_client(query)); - connection_mark_unattached_ap(conn, END_STREAM_REASON_RESOLVEFAILED); - rend_client_note_connection_attempt_ended(rend_data); - } - } SMARTLIST_FOREACH_END(base_conn); -} - -/** Clear temporary state used only during an attempt to connect to the - * hidden service with <b>rend_data</b>. Called when a connection attempt - * has ended; it is possible for this to be called multiple times while - * handling an ended connection attempt, and any future changes to this - * function must ensure it remains idempotent. */ -void -rend_client_note_connection_attempt_ended(const rend_data_t *rend_data) -{ - unsigned int have_onion = 0; - rend_cache_entry_t *cache_entry = NULL; - const char *onion_address = rend_data_get_address(rend_data); - rend_data_v2_t *rend_data_v2 = TO_REND_DATA_V2(rend_data); - - if (onion_address[0] != '\0') { - /* Ignore return value; we find an entry, or we don't. */ - (void) rend_cache_lookup_entry(onion_address, -1, &cache_entry); - have_onion = 1; - } - - /* Clear the timed_out flag on all remaining intro points for this HS. */ - if (cache_entry != NULL) { - SMARTLIST_FOREACH(cache_entry->parsed->intro_nodes, - rend_intro_point_t *, ip, - ip->timed_out = 0; ); - } - - /* Remove the HS's entries in last_hid_serv_requests. */ - if (have_onion) { - unsigned int replica; - for (replica = 0; replica < ARRAY_LENGTH(rend_data_v2->descriptor_id); - replica++) { - const char *desc_id = rend_data_v2->descriptor_id[replica]; - purge_v2_hidserv_req(desc_id); - } - log_info(LD_REND, "Connection attempt for %s has ended; " - "cleaning up temporary state.", - safe_str_client(onion_address)); - } else { - /* We only have an ID for a fetch. Probably used by HSFETCH. */ - purge_v2_hidserv_req(rend_data_v2->desc_id_fetch); - } -} - -/** Return a newly allocated extend_info_t* for a randomly chosen introduction - * point for the named hidden service. Return NULL if all introduction points - * have been tried and failed. - */ -extend_info_t * -rend_client_get_random_intro(const rend_data_t *rend_query) -{ - int ret; - extend_info_t *result; - rend_cache_entry_t *entry; - const char *onion_address = rend_data_get_address(rend_query); - - ret = rend_cache_lookup_entry(onion_address, -1, &entry); - if (ret < 0 || !rend_client_any_intro_points_usable(entry)) { - log_warn(LD_REND, - "Query '%s' didn't have valid rend desc in cache. Failing.", - safe_str_client(onion_address)); - /* XXX: Should we refetch the descriptor here if the IPs are not usable - * anymore ?. */ - return NULL; - } - - /* See if we can get a node that complies with ExcludeNodes */ - if ((result = rend_client_get_random_intro_impl(entry, 1, 1))) - return result; - /* If not, and StrictNodes is not set, see if we can return any old node - */ - if (!get_options()->StrictNodes) - return rend_client_get_random_intro_impl(entry, 0, 1); - return NULL; -} - -/** As rend_client_get_random_intro, except assume that StrictNodes is set - * iff <b>strict</b> is true. If <b>warnings</b> is false, don't complain - * to the user when we're out of nodes, even if StrictNodes is true. - */ -static extend_info_t * -rend_client_get_random_intro_impl(const rend_cache_entry_t *entry, - const int strict, - const int warnings) -{ - int i; - - rend_intro_point_t *intro; - const or_options_t *options = get_options(); - smartlist_t *usable_nodes; - int n_excluded = 0; - char service_id[REND_SERVICE_ID_LEN_BASE32 + 1]; - - /* We'll keep a separate list of the usable nodes. If this becomes empty, - * no nodes are usable. */ - usable_nodes = smartlist_new(); - smartlist_add_all(usable_nodes, entry->parsed->intro_nodes); - - /* Get service ID so we can use it to query the failure cache. If we fail to - * parse it, this cache entry is no good. */ - if (BUG(rend_get_service_id(entry->parsed->pk, service_id) < 0)) { - smartlist_free(usable_nodes); - return NULL; - } - - /* Remove the intro points that have timed out during this HS - * connection attempt from our list of usable nodes. */ - SMARTLIST_FOREACH_BEGIN(usable_nodes, const rend_intro_point_t *, ip) { - bool failed_intro = - rend_cache_intro_failure_exists(service_id, - (const uint8_t *) ip->extend_info->identity_digest); - if (ip->timed_out || failed_intro) { - SMARTLIST_DEL_CURRENT(usable_nodes, ip); - }; - } SMARTLIST_FOREACH_END(ip); - - again: - if (smartlist_len(usable_nodes) == 0) { - if (n_excluded && get_options()->StrictNodes && warnings) { - /* We only want to warn if StrictNodes is really set. Otherwise - * we're just about to retry anyways. - */ - log_warn(LD_REND, "All introduction points for hidden service are " - "at excluded relays, and StrictNodes is set. Skipping."); - } - smartlist_free(usable_nodes); - return NULL; - } - - i = crypto_rand_int(smartlist_len(usable_nodes)); - intro = smartlist_get(usable_nodes, i); - if (BUG(!intro->extend_info)) { - /* This should never happen, but it isn't fatal, just try another */ - smartlist_del(usable_nodes, i); - goto again; - } - /* All version 2 HS descriptors come with a TAP onion key. - * Clients used to try to get the TAP onion key from the consensus, but this - * meant that hidden services could discover which consensus clients have. */ - if (!extend_info_supports_tap(intro->extend_info)) { - log_info(LD_REND, "The HS descriptor is missing a TAP onion key for the " - "intro-point relay '%s'; trying another.", - safe_str_client(extend_info_describe(intro->extend_info))); - smartlist_del(usable_nodes, i); - goto again; - } - /* Check if we should refuse to talk to this router. */ - if (strict && - routerset_contains_extendinfo(options->ExcludeNodes, - intro->extend_info)) { - n_excluded++; - smartlist_del(usable_nodes, i); - goto again; - } - - smartlist_free(usable_nodes); - return extend_info_dup(intro->extend_info); -} - -/** Return true iff any introduction points still listed in <b>entry</b> are - * usable. */ -int -rend_client_any_intro_points_usable(const rend_cache_entry_t *entry) -{ - extend_info_t *extend_info = - rend_client_get_random_intro_impl(entry, get_options()->StrictNodes, 0); - - int rv = (extend_info != NULL); - - extend_info_free(extend_info); - return rv; -} - -/** Client-side authorizations for hidden services; map of onion address to - * rend_service_authorization_t*. */ -static strmap_t *auth_hid_servs = NULL; - -/** Look up the client-side authorization for the hidden service with - * <b>onion_address</b>. Return NULL if no authorization is available for - * that address. */ -rend_service_authorization_t* -rend_client_lookup_service_authorization(const char *onion_address) -{ - tor_assert(onion_address); - if (!auth_hid_servs) return NULL; - return strmap_get(auth_hid_servs, onion_address); -} - -#define rend_service_authorization_free(val) \ - FREE_AND_NULL(rend_service_authorization_t, \ - rend_service_authorization_free_, (val)) - -/** Helper: Free storage held by rend_service_authorization_t. */ -static void -rend_service_authorization_free_(rend_service_authorization_t *auth) -{ - tor_free(auth); -} - -/** Helper for strmap_free. */ -static void -rend_service_authorization_free_void(void *service_auth) -{ - rend_service_authorization_free_(service_auth); -} - -/** Release all the storage held in auth_hid_servs. - */ -void -rend_service_authorization_free_all(void) -{ - if (!auth_hid_servs) { - return; - } - strmap_free(auth_hid_servs, rend_service_authorization_free_void); - auth_hid_servs = NULL; -} - -/** Parse <b>config_line</b> as a client-side authorization for a hidden - * service and add it to the local map of hidden service authorizations. - * Return 0 for success and -1 for failure. */ -int -rend_parse_service_authorization(const or_options_t *options, - int validate_only) -{ - config_line_t *line; - int res = -1; - strmap_t *parsed = strmap_new(); - smartlist_t *sl = smartlist_new(); - rend_service_authorization_t *auth = NULL; - char *err_msg = NULL; - - for (line = options->HidServAuth; line; line = line->next) { - char *onion_address, *descriptor_cookie; - auth = NULL; - SMARTLIST_FOREACH(sl, char *, c, tor_free(c);); - smartlist_clear(sl); - smartlist_split_string(sl, line->value, " ", - SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 3); - if (smartlist_len(sl) < 2) { - log_warn(LD_CONFIG, "Configuration line does not consist of " - "\"onion-address authorization-cookie [service-name]\": " - "'%s'", line->value); - goto err; - } - auth = tor_malloc_zero(sizeof(rend_service_authorization_t)); - /* Parse onion address. */ - onion_address = smartlist_get(sl, 0); - if (strlen(onion_address) != REND_SERVICE_ADDRESS_LEN || - strcmpend(onion_address, ".onion")) { - log_warn(LD_CONFIG, "Onion address has wrong format: '%s'", - onion_address); - goto err; - } - strlcpy(auth->onion_address, onion_address, REND_SERVICE_ID_LEN_BASE32+1); - if (!rend_valid_v2_service_id(auth->onion_address)) { - log_warn(LD_CONFIG, "Onion address has wrong format: '%s'", - onion_address); - goto err; - } - /* Parse descriptor cookie. */ - descriptor_cookie = smartlist_get(sl, 1); - if (rend_auth_decode_cookie(descriptor_cookie, auth->descriptor_cookie, - &auth->auth_type, &err_msg) < 0) { - tor_assert(err_msg); - log_warn(LD_CONFIG, "%s", err_msg); - tor_free(err_msg); - goto err; - } - if (strmap_get(parsed, auth->onion_address)) { - log_warn(LD_CONFIG, "Duplicate authorization for the same hidden " - "service."); - goto err; - } - strmap_set(parsed, auth->onion_address, auth); - auth = NULL; - } - res = 0; - goto done; - err: - res = -1; - done: - rend_service_authorization_free(auth); - SMARTLIST_FOREACH(sl, char *, c, tor_free(c);); - smartlist_free(sl); - if (!validate_only && res == 0) { - rend_service_authorization_free_all(); - auth_hid_servs = parsed; - } else { - strmap_free(parsed, rend_service_authorization_free_void); - } - return res; -} - -/** The given circuit is being freed. Take appropriate action if it is of - * interest to the client subsystem. */ -void -rend_client_circuit_cleanup_on_free(const circuit_t *circ) -{ - int reason, orig_reason; - bool has_timed_out, ip_is_redundant; - const origin_circuit_t *ocirc = NULL; - - tor_assert(circ); - tor_assert(CIRCUIT_IS_ORIGIN(circ)); - - reason = circ->marked_for_close_reason; - orig_reason = circ->marked_for_close_orig_reason; - ocirc = CONST_TO_ORIGIN_CIRCUIT(circ); - tor_assert(ocirc->rend_data); - - has_timed_out = (reason == END_CIRC_REASON_TIMEOUT); - ip_is_redundant = (orig_reason == END_CIRC_REASON_IP_NOW_REDUNDANT); - - switch (circ->purpose) { - case CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT: - { - if (ip_is_redundant) { - break; - } - tor_assert(circ->state == CIRCUIT_STATE_OPEN); - tor_assert(ocirc->build_state->chosen_exit); - /* Treat this like getting a nack from it */ - log_info(LD_REND, "Failed intro circ %s to %s (awaiting ack). %s", - safe_str_client(rend_data_get_address(ocirc->rend_data)), - safe_str_client(build_state_get_exit_nickname(ocirc->build_state)), - has_timed_out ? "Recording timeout." : "Removing from descriptor."); - rend_client_report_intro_point_failure(ocirc->build_state->chosen_exit, - ocirc->rend_data, - has_timed_out ? - INTRO_POINT_FAILURE_TIMEOUT : - INTRO_POINT_FAILURE_GENERIC); - break; - } - case CIRCUIT_PURPOSE_C_INTRODUCING: - { - /* Ignore if we were introducing and it timed out, we didn't pick an exit - * point yet (IP) or the reason indicate that it was a redundant IP. */ - if (has_timed_out || !ocirc->build_state->chosen_exit || ip_is_redundant) { - break; - } - log_info(LD_REND, "Failed intro circ %s to %s " - "(building circuit to intro point). " - "Marking intro point as possibly unreachable.", - safe_str_client(rend_data_get_address(ocirc->rend_data)), - safe_str_client(build_state_get_exit_nickname( - ocirc->build_state))); - rend_client_report_intro_point_failure(ocirc->build_state->chosen_exit, - ocirc->rend_data, - INTRO_POINT_FAILURE_UNREACHABLE); - break; - } - default: - break; - } -} diff --git a/src/feature/rend/rendclient.h b/src/feature/rend/rendclient.h deleted file mode 100644 index b7aa212487..0000000000 --- a/src/feature/rend/rendclient.h +++ /dev/null @@ -1,54 +0,0 @@ -/* Copyright (c) 2001 Matej Pfajfar. - * Copyright (c) 2001-2004, Roger Dingledine. - * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * \file rendclient.h - * \brief Header file for rendclient.c. - **/ - -#ifndef TOR_RENDCLIENT_H -#define TOR_RENDCLIENT_H - -#include "feature/hs/hs_circuit.h" -#include "feature/rend/rendcache.h" - -void rend_client_purge_state(void); - -void rend_client_introcirc_has_opened(origin_circuit_t *circ); -void rend_client_rendcirc_has_opened(origin_circuit_t *circ); -int rend_client_introduction_acked(origin_circuit_t *circ, - const uint8_t *request, - size_t request_len); -void rend_client_refetch_v2_renddesc(rend_data_t *rend_query); -int rend_client_fetch_v2_desc(rend_data_t *query, smartlist_t *hsdirs); -void rend_client_cancel_descriptor_fetches(void); - -int rend_client_report_intro_point_failure(extend_info_t *failed_intro, - rend_data_t *rend_data, - unsigned int failure_type); - -int rend_client_receive_rendezvous(origin_circuit_t *circ, - const uint8_t *request, - size_t request_len); -void rend_client_desc_trynow(const char *query); - -void rend_client_note_connection_attempt_ended(const rend_data_t *rend_data); - -extend_info_t *rend_client_get_random_intro(const rend_data_t *rend_query); -int rend_client_any_intro_points_usable(const rend_cache_entry_t *entry); - -int rend_client_send_introduction(origin_circuit_t *introcirc, - origin_circuit_t *rendcirc); -int rend_parse_service_authorization(const or_options_t *options, - int validate_only); -rend_service_authorization_t *rend_client_lookup_service_authorization( - const char *onion_address); -void rend_service_authorization_free_all(void); - -void rend_client_circuit_cleanup_on_free(const circuit_t *circ); - -#endif /* !defined(TOR_RENDCLIENT_H) */ - diff --git a/src/feature/rend/rendcommon.c b/src/feature/rend/rendcommon.c index 775d487805..0628422812 100644 --- a/src/feature/rend/rendcommon.c +++ b/src/feature/rend/rendcommon.c @@ -1,5 +1,5 @@ /* Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ + * Copyright (c) 2007-2021, The Tor Project, Inc. */ /* See LICENSE for licensing information */ /** @@ -11,761 +11,22 @@ #define RENDCOMMON_PRIVATE #include "core/or/or.h" -#include "core/or/circuitbuild.h" + +#include "app/config/config.h" + #include "core/or/circuitlist.h" #include "core/or/circuituse.h" -#include "core/or/extendinfo.h" -#include "app/config/config.h" -#include "feature/control/control_events.h" -#include "lib/crypt_ops/crypto_rand.h" -#include "lib/crypt_ops/crypto_util.h" + #include "feature/hs/hs_client.h" #include "feature/hs/hs_common.h" #include "feature/hs/hs_intropoint.h" -#include "feature/nodelist/networkstatus.h" -#include "feature/rend/rendclient.h" #include "feature/rend/rendcommon.h" #include "feature/rend/rendmid.h" -#include "feature/rend/rendparse.h" -#include "feature/rend/rendservice.h" -#include "feature/stats/rephist.h" -#include "feature/hs_common/replaycache.h" -#include "feature/relay/router.h" -#include "feature/nodelist/routerlist.h" -#include "feature/dirparse/signing.h" +#include "core/or/circuit_st.h" #include "core/or/cpath_build_state_st.h" #include "core/or/crypt_path_st.h" -#include "core/or/extend_info_st.h" -#include "feature/nodelist/networkstatus_st.h" #include "core/or/origin_circuit_st.h" -#include "feature/rend/rend_encoded_v2_service_descriptor_st.h" -#include "feature/rend/rend_intro_point_st.h" -#include "feature/rend/rend_service_descriptor_st.h" -#include "feature/nodelist/routerstatus_st.h" - -/** Return 0 if one and two are the same service ids, else -1 or 1 */ -int -rend_cmp_service_ids(const char *one, const char *two) -{ - return strcasecmp(one,two); -} - -/** Free the storage held by the service descriptor <b>desc</b>. - */ -void -rend_service_descriptor_free_(rend_service_descriptor_t *desc) -{ - if (!desc) - return; - if (desc->pk) - crypto_pk_free(desc->pk); - if (desc->intro_nodes) { - SMARTLIST_FOREACH(desc->intro_nodes, rend_intro_point_t *, intro, - rend_intro_point_free(intro);); - smartlist_free(desc->intro_nodes); - } - if (desc->successful_uploads) { - SMARTLIST_FOREACH(desc->successful_uploads, char *, c, tor_free(c);); - smartlist_free(desc->successful_uploads); - } - tor_free(desc); -} - -/** Length of the descriptor cookie that is used for versioned hidden - * service descriptors. */ -#define REND_DESC_COOKIE_LEN 16 - -/** Length of the replica number that is used to determine the secret ID - * part of versioned hidden service descriptors. */ -#define REND_REPLICA_LEN 1 - -/** Compute the descriptor ID for <b>service_id</b> of length - * <b>REND_SERVICE_ID_LEN</b> and <b>secret_id_part</b> of length - * <b>DIGEST_LEN</b>, and write it to <b>descriptor_id_out</b> of length - * <b>DIGEST_LEN</b>. */ -void -rend_get_descriptor_id_bytes(char *descriptor_id_out, - const char *service_id, - const char *secret_id_part) -{ - crypto_digest_t *digest = crypto_digest_new(); - crypto_digest_add_bytes(digest, service_id, REND_SERVICE_ID_LEN); - crypto_digest_add_bytes(digest, secret_id_part, DIGEST_LEN); - crypto_digest_get_digest(digest, descriptor_id_out, DIGEST_LEN); - crypto_digest_free(digest); -} - -/** Compute the secret ID part for time_period, - * a <b>descriptor_cookie</b> of length - * <b>REND_DESC_COOKIE_LEN</b> which may also be <b>NULL</b> if no - * descriptor_cookie shall be used, and <b>replica</b>, and write it to - * <b>secret_id_part</b> of length DIGEST_LEN. */ -static void -get_secret_id_part_bytes(char *secret_id_part, uint32_t time_period, - const char *descriptor_cookie, uint8_t replica) -{ - crypto_digest_t *digest = crypto_digest_new(); - time_period = htonl(time_period); - crypto_digest_add_bytes(digest, (char*)&time_period, sizeof(uint32_t)); - if (descriptor_cookie) { - crypto_digest_add_bytes(digest, descriptor_cookie, - REND_DESC_COOKIE_LEN); - } - crypto_digest_add_bytes(digest, (const char *)&replica, REND_REPLICA_LEN); - crypto_digest_get_digest(digest, secret_id_part, DIGEST_LEN); - crypto_digest_free(digest); -} - -/** Return the time period for time <b>now</b> plus a potentially - * intended <b>deviation</b> of one or more periods, based on the first byte - * of <b>service_id</b>. */ -static uint32_t -get_time_period(time_t now, uint8_t deviation, const char *service_id) -{ - /* The time period is the number of REND_TIME_PERIOD_V2_DESC_VALIDITY - * intervals that have passed since the epoch, offset slightly so that - * each service's time periods start and end at a fraction of that - * period based on their first byte. */ - return (uint32_t) - (now + ((uint8_t) *service_id) * REND_TIME_PERIOD_V2_DESC_VALIDITY / 256) - / REND_TIME_PERIOD_V2_DESC_VALIDITY + deviation; -} - -/** Compute the time in seconds that a descriptor that is generated - * <b>now</b> for <b>service_id</b> will be valid. */ -static uint32_t -get_seconds_valid(time_t now, const char *service_id) -{ - uint32_t result = REND_TIME_PERIOD_V2_DESC_VALIDITY - - ((uint32_t) - (now + ((uint8_t) *service_id) * REND_TIME_PERIOD_V2_DESC_VALIDITY / 256) - % REND_TIME_PERIOD_V2_DESC_VALIDITY); - return result; -} - -/** Compute the binary <b>desc_id_out</b> (DIGEST_LEN bytes long) for a given - * base32-encoded <b>service_id</b> and optional unencoded - * <b>descriptor_cookie</b> of length REND_DESC_COOKIE_LEN, - * at time <b>now</b> for replica number - * <b>replica</b>. <b>desc_id</b> needs to have <b>DIGEST_LEN</b> bytes - * free. Return 0 for success, -1 otherwise. */ -int -rend_compute_v2_desc_id(char *desc_id_out, const char *service_id, - const char *descriptor_cookie, time_t now, - uint8_t replica) -{ - char service_id_binary[REND_SERVICE_ID_LEN]; - char secret_id_part[DIGEST_LEN]; - uint32_t time_period; - if (!service_id || - strlen(service_id) != REND_SERVICE_ID_LEN_BASE32) { - log_warn(LD_REND, "Could not compute v2 descriptor ID: " - "Illegal service ID: %s", - safe_str(service_id)); - return -1; - } - if (replica >= REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS) { - log_warn(LD_REND, "Could not compute v2 descriptor ID: " - "Replica number out of range: %d", replica); - return -1; - } - /* Convert service ID to binary. */ - if (base32_decode(service_id_binary, REND_SERVICE_ID_LEN, - service_id, REND_SERVICE_ID_LEN_BASE32) != - REND_SERVICE_ID_LEN) { - log_warn(LD_REND, "Could not compute v2 descriptor ID: " - "Illegal characters or wrong length for service ID: %s", - safe_str_client(service_id)); - return -1; - } - /* Calculate current time-period. */ - time_period = get_time_period(now, 0, service_id_binary); - /* Calculate secret-id-part = h(time-period | desc-cookie | replica). */ - get_secret_id_part_bytes(secret_id_part, time_period, descriptor_cookie, - replica); - /* Calculate descriptor ID: H(permanent-id | secret-id-part) */ - rend_get_descriptor_id_bytes(desc_id_out, service_id_binary, secret_id_part); - return 0; -} - -/** Encode the introduction points in <b>desc</b> and write the result to a - * newly allocated string pointed to by <b>encoded</b>. Return 0 for - * success, -1 otherwise. */ -static int -rend_encode_v2_intro_points(char **encoded, rend_service_descriptor_t *desc) -{ - size_t unenc_len; - char *unenc = NULL; - size_t unenc_written = 0; - int i; - int r = -1; - /* Assemble unencrypted list of introduction points. */ - unenc_len = smartlist_len(desc->intro_nodes) * 1000; /* too long, but ok. */ - unenc = tor_malloc_zero(unenc_len); - for (i = 0; i < smartlist_len(desc->intro_nodes); i++) { - char id_base32[REND_INTRO_POINT_ID_LEN_BASE32 + 1]; - char *onion_key = NULL; - size_t onion_key_len; - crypto_pk_t *intro_key; - char *service_key = NULL; - char *address = NULL; - size_t service_key_len; - int res; - rend_intro_point_t *intro = smartlist_get(desc->intro_nodes, i); - /* Obtain extend info with introduction point details. */ - extend_info_t *info = intro->extend_info; - /* Encode introduction point ID. */ - base32_encode(id_base32, sizeof(id_base32), - info->identity_digest, DIGEST_LEN); - /* Encode onion key. */ - if (crypto_pk_write_public_key_to_string(info->onion_key, &onion_key, - &onion_key_len) < 0) { - log_warn(LD_REND, "Could not write onion key."); - goto done; - } - /* Encode intro key. */ - intro_key = intro->intro_key; - if (!intro_key || - crypto_pk_write_public_key_to_string(intro_key, &service_key, - &service_key_len) < 0) { - log_warn(LD_REND, "Could not write intro key."); - tor_free(onion_key); - goto done; - } - /* Assemble everything for this introduction point. */ - const tor_addr_port_t *orport = extend_info_get_orport(info, AF_INET); - IF_BUG_ONCE(!orport) { - /* There must be an IPv4 address for v2 hs. */ - goto done; - } - address = tor_addr_to_str_dup(&orport->addr); - res = tor_snprintf(unenc + unenc_written, unenc_len - unenc_written, - "introduction-point %s\n" - "ip-address %s\n" - "onion-port %d\n" - "onion-key\n%s" - "service-key\n%s", - id_base32, - address, - orport->port, - onion_key, - service_key); - tor_free(address); - tor_free(onion_key); - tor_free(service_key); - if (res < 0) { - log_warn(LD_REND, "Not enough space for writing introduction point " - "string."); - goto done; - } - /* Update total number of written bytes for unencrypted intro points. */ - unenc_written += res; - } - /* Finalize unencrypted introduction points. */ - if (unenc_len < unenc_written + 2) { - log_warn(LD_REND, "Not enough space for finalizing introduction point " - "string."); - goto done; - } - unenc[unenc_written++] = '\n'; - unenc[unenc_written++] = 0; - *encoded = unenc; - r = 0; - done: - if (r<0) - tor_free(unenc); - return r; -} - -/** Encrypt the encoded introduction points in <b>encoded</b> using - * authorization type 'basic' with <b>client_cookies</b> and write the - * result to a newly allocated string pointed to by <b>encrypted_out</b> of - * length <b>encrypted_len_out</b>. Return 0 for success, -1 otherwise. */ -static int -rend_encrypt_v2_intro_points_basic(char **encrypted_out, - size_t *encrypted_len_out, - const char *encoded, - smartlist_t *client_cookies) -{ - int r = -1, i, pos, enclen, client_blocks; - size_t len, client_entries_len; - char *enc = NULL, iv[CIPHER_IV_LEN], *client_part = NULL, - session_key[CIPHER_KEY_LEN]; - smartlist_t *encrypted_session_keys = NULL; - crypto_digest_t *digest; - crypto_cipher_t *cipher; - tor_assert(encoded); - tor_assert(client_cookies && smartlist_len(client_cookies) > 0); - - /* Generate session key. */ - crypto_rand(session_key, CIPHER_KEY_LEN); - - /* Determine length of encrypted introduction points including session - * keys. */ - client_blocks = 1 + ((smartlist_len(client_cookies) - 1) / - REND_BASIC_AUTH_CLIENT_MULTIPLE); - client_entries_len = client_blocks * REND_BASIC_AUTH_CLIENT_MULTIPLE * - REND_BASIC_AUTH_CLIENT_ENTRY_LEN; - len = 2 + client_entries_len + CIPHER_IV_LEN + strlen(encoded); - if (client_blocks >= 256) { - log_warn(LD_REND, "Too many clients in introduction point string."); - goto done; - } - enc = tor_malloc_zero(len); - enc[0] = 0x01; /* type of authorization. */ - enc[1] = (uint8_t)client_blocks; - - /* Encrypt with random session key. */ - enclen = crypto_cipher_encrypt_with_iv(session_key, - enc + 2 + client_entries_len, - CIPHER_IV_LEN + strlen(encoded), encoded, strlen(encoded)); - - if (enclen < 0) { - log_warn(LD_REND, "Could not encrypt introduction point string."); - goto done; - } - memcpy(iv, enc + 2 + client_entries_len, CIPHER_IV_LEN); - - /* Encrypt session key for cookies, determine client IDs, and put both - * in a smartlist. */ - encrypted_session_keys = smartlist_new(); - SMARTLIST_FOREACH_BEGIN(client_cookies, const char *, cookie) { - client_part = tor_malloc_zero(REND_BASIC_AUTH_CLIENT_ENTRY_LEN); - /* Encrypt session key. */ - cipher = crypto_cipher_new(cookie); - if (crypto_cipher_encrypt(cipher, client_part + - REND_BASIC_AUTH_CLIENT_ID_LEN, - session_key, CIPHER_KEY_LEN) < 0) { - log_warn(LD_REND, "Could not encrypt session key for client."); - crypto_cipher_free(cipher); - tor_free(client_part); - goto done; - } - crypto_cipher_free(cipher); - - /* Determine client ID. */ - digest = crypto_digest_new(); - crypto_digest_add_bytes(digest, cookie, REND_DESC_COOKIE_LEN); - crypto_digest_add_bytes(digest, iv, CIPHER_IV_LEN); - crypto_digest_get_digest(digest, client_part, - REND_BASIC_AUTH_CLIENT_ID_LEN); - crypto_digest_free(digest); - - /* Put both together. */ - smartlist_add(encrypted_session_keys, client_part); - } SMARTLIST_FOREACH_END(cookie); - - /* Add some fake client IDs and encrypted session keys. */ - for (i = (smartlist_len(client_cookies) - 1) % - REND_BASIC_AUTH_CLIENT_MULTIPLE; - i < REND_BASIC_AUTH_CLIENT_MULTIPLE - 1; i++) { - client_part = tor_malloc_zero(REND_BASIC_AUTH_CLIENT_ENTRY_LEN); - crypto_rand(client_part, REND_BASIC_AUTH_CLIENT_ENTRY_LEN); - smartlist_add(encrypted_session_keys, client_part); - } - /* Sort smartlist and put elements in result in order. */ - smartlist_sort_digests(encrypted_session_keys); - pos = 2; - SMARTLIST_FOREACH(encrypted_session_keys, const char *, entry, { - memcpy(enc + pos, entry, REND_BASIC_AUTH_CLIENT_ENTRY_LEN); - pos += REND_BASIC_AUTH_CLIENT_ENTRY_LEN; - }); - *encrypted_out = enc; - *encrypted_len_out = len; - enc = NULL; /* prevent free. */ - r = 0; - done: - tor_free(enc); - if (encrypted_session_keys) { - SMARTLIST_FOREACH(encrypted_session_keys, char *, d, tor_free(d);); - smartlist_free(encrypted_session_keys); - } - return r; -} - -/** Encrypt the encoded introduction points in <b>encoded</b> using - * authorization type 'stealth' with <b>descriptor_cookie</b> of length - * REND_DESC_COOKIE_LEN and write the result to a newly allocated string - * pointed to by <b>encrypted_out</b> of length <b>encrypted_len_out</b>. - * Return 0 for success, -1 otherwise. */ -static int -rend_encrypt_v2_intro_points_stealth(char **encrypted_out, - size_t *encrypted_len_out, - const char *encoded, - const char *descriptor_cookie) -{ - int r = -1, enclen; - char *enc; - tor_assert(encoded); - tor_assert(descriptor_cookie); - - enc = tor_malloc_zero(1 + CIPHER_IV_LEN + strlen(encoded)); - enc[0] = 0x02; /* Auth type */ - enclen = crypto_cipher_encrypt_with_iv(descriptor_cookie, - enc + 1, - CIPHER_IV_LEN+strlen(encoded), - encoded, strlen(encoded)); - if (enclen < 0) { - log_warn(LD_REND, "Could not encrypt introduction point string."); - goto done; - } - *encrypted_out = enc; - *encrypted_len_out = enclen; - enc = NULL; /* prevent free */ - r = 0; - done: - tor_free(enc); - return r; -} - -/** Attempt to parse the given <b>desc_str</b> and return true if this - * succeeds, false otherwise. */ -STATIC int -rend_desc_v2_is_parsable(rend_encoded_v2_service_descriptor_t *desc) -{ - rend_service_descriptor_t *test_parsed = NULL; - char test_desc_id[DIGEST_LEN]; - char *test_intro_content = NULL; - size_t test_intro_size; - size_t test_encoded_size; - const char *test_next; - int res = rend_parse_v2_service_descriptor(&test_parsed, test_desc_id, - &test_intro_content, - &test_intro_size, - &test_encoded_size, - &test_next, desc->desc_str, 1); - rend_service_descriptor_free(test_parsed); - tor_free(test_intro_content); - return (res >= 0); -} - -/** Free the storage held by an encoded v2 service descriptor. */ -void -rend_encoded_v2_service_descriptor_free_( - rend_encoded_v2_service_descriptor_t *desc) -{ - if (!desc) - return; - tor_free(desc->desc_str); - tor_free(desc); -} - -/** Free the storage held by an introduction point info. */ -void -rend_intro_point_free_(rend_intro_point_t *intro) -{ - if (!intro) - return; - - extend_info_free(intro->extend_info); - crypto_pk_free(intro->intro_key); - - if (intro->accepted_intro_rsa_parts != NULL) { - replaycache_free(intro->accepted_intro_rsa_parts); - } - - tor_free(intro); -} - -/** Encode a set of rend_encoded_v2_service_descriptor_t's for <b>desc</b> - * at time <b>now</b> using <b>service_key</b>, depending on - * <b>auth_type</b> a <b>descriptor_cookie</b> and a list of - * <b>client_cookies</b> (which are both <b>NULL</b> if no client - * authorization is performed), and <b>period</b> (e.g. 0 for the current - * period, 1 for the next period, etc.) and add them to the existing list - * <b>descs_out</b>; return the number of seconds that the descriptors will - * be found by clients, or -1 if the encoding was not successful. */ -int -rend_encode_v2_descriptors(smartlist_t *descs_out, - rend_service_descriptor_t *desc, time_t now, - uint8_t period, rend_auth_type_t auth_type, - crypto_pk_t *client_key, - smartlist_t *client_cookies) -{ - char service_id[DIGEST_LEN]; - char service_id_base32[REND_SERVICE_ID_LEN_BASE32+1]; - uint32_t time_period; - char *ipos_base64 = NULL, *ipos = NULL, *ipos_encrypted = NULL, - *descriptor_cookie = NULL; - size_t ipos_len = 0, ipos_encrypted_len = 0; - int k; - uint32_t seconds_valid; - crypto_pk_t *service_key; - if (!desc) { - log_warn(LD_BUG, "Could not encode v2 descriptor: No desc given."); - return -1; - } - service_key = (auth_type == REND_STEALTH_AUTH) ? client_key : desc->pk; - tor_assert(service_key); - if (auth_type == REND_STEALTH_AUTH) { - descriptor_cookie = smartlist_get(client_cookies, 0); - tor_assert(descriptor_cookie); - } - /* Obtain service_id from public key. */ - if (crypto_pk_get_digest(service_key, service_id) < 0) { - log_warn(LD_BUG, "Couldn't compute service key digest."); - return -1; - } - /* Calculate current time-period. */ - time_period = get_time_period(now, period, service_id); - /* Determine how many seconds the descriptor will be valid. */ - seconds_valid = period * REND_TIME_PERIOD_V2_DESC_VALIDITY + - get_seconds_valid(now, service_id); - /* Assemble, possibly encrypt, and encode introduction points. */ - if (smartlist_len(desc->intro_nodes) > 0) { - if (rend_encode_v2_intro_points(&ipos, desc) < 0) { - log_warn(LD_REND, "Encoding of introduction points did not succeed."); - return -1; - } - switch (auth_type) { - case REND_NO_AUTH: - ipos_len = strlen(ipos); - break; - case REND_BASIC_AUTH: - if (rend_encrypt_v2_intro_points_basic(&ipos_encrypted, - &ipos_encrypted_len, ipos, - client_cookies) < 0) { - log_warn(LD_REND, "Encrypting of introduction points did not " - "succeed."); - tor_free(ipos); - return -1; - } - tor_free(ipos); - ipos = ipos_encrypted; - ipos_len = ipos_encrypted_len; - break; - case REND_STEALTH_AUTH: - if (rend_encrypt_v2_intro_points_stealth(&ipos_encrypted, - &ipos_encrypted_len, ipos, - descriptor_cookie) < 0) { - log_warn(LD_REND, "Encrypting of introduction points did not " - "succeed."); - tor_free(ipos); - return -1; - } - tor_free(ipos); - ipos = ipos_encrypted; - ipos_len = ipos_encrypted_len; - break; - default: - log_warn(LD_REND|LD_BUG, "Unrecognized authorization type %d", - (int)auth_type); - tor_free(ipos); - return -1; - } - /* Base64-encode introduction points. */ - ipos_base64 = tor_calloc(ipos_len, 2); - if (base64_encode(ipos_base64, ipos_len * 2, ipos, ipos_len, - BASE64_ENCODE_MULTILINE)<0) { - log_warn(LD_REND, "Could not encode introduction point string to " - "base64. length=%d", (int)ipos_len); - tor_free(ipos_base64); - tor_free(ipos); - return -1; - } - tor_free(ipos); - } - /* Encode REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS descriptors. */ - for (k = 0; k < REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS; k++) { - char secret_id_part[DIGEST_LEN]; - char secret_id_part_base32[REND_SECRET_ID_PART_LEN_BASE32 + 1]; - char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; - char *permanent_key = NULL; - size_t permanent_key_len; - char published[ISO_TIME_LEN+1]; - int i; - char protocol_versions_string[16]; /* max len: "0,1,2,3,4,5,6,7\0" */ - size_t protocol_versions_written; - size_t desc_len; - char *desc_str = NULL; - int result = 0; - size_t written = 0; - char desc_digest[DIGEST_LEN]; - rend_encoded_v2_service_descriptor_t *enc = - tor_malloc_zero(sizeof(rend_encoded_v2_service_descriptor_t)); - /* Calculate secret-id-part = h(time-period | cookie | replica). */ - get_secret_id_part_bytes(secret_id_part, time_period, descriptor_cookie, - k); - base32_encode(secret_id_part_base32, sizeof(secret_id_part_base32), - secret_id_part, DIGEST_LEN); - /* Calculate descriptor ID. */ - rend_get_descriptor_id_bytes(enc->desc_id, service_id, secret_id_part); - base32_encode(desc_id_base32, sizeof(desc_id_base32), - enc->desc_id, DIGEST_LEN); - /* PEM-encode the public key */ - if (crypto_pk_write_public_key_to_string(service_key, &permanent_key, - &permanent_key_len) < 0) { - log_warn(LD_BUG, "Could not write public key to string."); - rend_encoded_v2_service_descriptor_free(enc); - goto err; - } - /* Encode timestamp. */ - format_iso_time(published, desc->timestamp); - /* Write protocol-versions bitmask to comma-separated value string. */ - protocol_versions_written = 0; - for (i = 0; i < 8; i++) { - if (desc->protocols & 1 << i) { - tor_snprintf(protocol_versions_string + protocol_versions_written, - 16 - protocol_versions_written, "%d,", i); - protocol_versions_written += 2; - } - } - if (protocol_versions_written) - protocol_versions_string[protocol_versions_written - 1] = '\0'; - else - protocol_versions_string[0]= '\0'; - /* Assemble complete descriptor. */ - desc_len = 2000 + smartlist_len(desc->intro_nodes) * 1000; /* far too long, - but okay.*/ - enc->desc_str = desc_str = tor_malloc_zero(desc_len); - result = tor_snprintf(desc_str, desc_len, - "rendezvous-service-descriptor %s\n" - "version 2\n" - "permanent-key\n%s" - "secret-id-part %s\n" - "publication-time %s\n" - "protocol-versions %s\n", - desc_id_base32, - permanent_key, - secret_id_part_base32, - published, - protocol_versions_string); - tor_free(permanent_key); - if (result < 0) { - log_warn(LD_BUG, "Descriptor ran out of room."); - rend_encoded_v2_service_descriptor_free(enc); - goto err; - } - written = result; - /* Add introduction points. */ - if (ipos_base64) { - result = tor_snprintf(desc_str + written, desc_len - written, - "introduction-points\n" - "-----BEGIN MESSAGE-----\n%s" - "-----END MESSAGE-----\n", - ipos_base64); - if (result < 0) { - log_warn(LD_BUG, "could not write introduction points."); - rend_encoded_v2_service_descriptor_free(enc); - goto err; - } - written += result; - } - /* Add signature. */ - strlcpy(desc_str + written, "signature\n", desc_len - written); - written += strlen(desc_str + written); - if (crypto_digest(desc_digest, desc_str, written) < 0) { - log_warn(LD_BUG, "could not create digest."); - rend_encoded_v2_service_descriptor_free(enc); - goto err; - } - if (router_append_dirobj_signature(desc_str + written, - desc_len - written, - desc_digest, DIGEST_LEN, - service_key) < 0) { - log_warn(LD_BUG, "Couldn't sign desc."); - rend_encoded_v2_service_descriptor_free(enc); - goto err; - } - written += strlen(desc_str+written); - if (written+2 > desc_len) { - log_warn(LD_BUG, "Could not finish desc."); - rend_encoded_v2_service_descriptor_free(enc); - goto err; - } - desc_str[written++] = 0; - /* Check if we can parse our own descriptor. */ - if (!rend_desc_v2_is_parsable(enc)) { - log_warn(LD_BUG, "Could not parse my own descriptor: %s", desc_str); - rend_encoded_v2_service_descriptor_free(enc); - goto err; - } - smartlist_add(descs_out, enc); - /* Add the uploaded descriptor to the local service's descriptor cache */ - rend_cache_store_v2_desc_as_service(enc->desc_str); - base32_encode(service_id_base32, sizeof(service_id_base32), - service_id, REND_SERVICE_ID_LEN); - control_event_hs_descriptor_created(service_id_base32, desc_id_base32, k); - } - - log_info(LD_REND, "Successfully encoded a v2 descriptor and " - "confirmed that it is parsable."); - goto done; - - err: - SMARTLIST_FOREACH(descs_out, rend_encoded_v2_service_descriptor_t *, d, - rend_encoded_v2_service_descriptor_free(d);); - smartlist_clear(descs_out); - seconds_valid = -1; - - done: - tor_free(ipos_base64); - return seconds_valid; -} - -/** Sets <b>out</b> to the first 10 bytes of the digest of <b>pk</b>, - * base32 encoded. NUL-terminates out. (We use this string to - * identify services in directory requests and .onion URLs.) - */ -int -rend_get_service_id(crypto_pk_t *pk, char *out) -{ - char buf[DIGEST_LEN]; - tor_assert(pk); - if (crypto_pk_get_digest(pk, buf) < 0) - return -1; - base32_encode(out, REND_SERVICE_ID_LEN_BASE32+1, buf, REND_SERVICE_ID_LEN); - return 0; -} - -/** Return true iff <b>query</b> is a syntactically valid service ID (as - * generated by rend_get_service_id). */ -int -rend_valid_v2_service_id(const char *query) -{ - if (strlen(query) != REND_SERVICE_ID_LEN_BASE32) - return 0; - - if (strspn(query, BASE32_CHARS) != REND_SERVICE_ID_LEN_BASE32) - return 0; - - return 1; -} - -/** Return true iff <b>query</b> is a syntactically valid descriptor ID. - * (as generated by rend_get_descriptor_id_bytes). */ -int -rend_valid_descriptor_id(const char *query) -{ - if (strlen(query) != REND_DESC_ID_V2_LEN_BASE32) { - goto invalid; - } - if (strspn(query, BASE32_CHARS) != REND_DESC_ID_V2_LEN_BASE32) { - goto invalid; - } - - return 1; - - invalid: - return 0; -} - -/** Return true iff <b>client_name</b> is a syntactically valid name - * for rendezvous client authentication. */ -int -rend_valid_client_name(const char *client_name) -{ - size_t len = strlen(client_name); - if (len < 1 || len > REND_CLIENTNAME_MAX_LEN) { - return 0; - } - if (strspn(client_name, REND_LEGAL_CLIENTNAME_CHARACTERS) != len) { - return 0; - } - - return 1; -} /** Called when we get a rendezvous-related relay cell on circuit * <b>circ</b>. Dispatch on rendezvous relay command. */ @@ -840,168 +101,6 @@ rend_process_relay_cell(circuit_t *circ, const crypt_path_t *layer_hint, command); } -/** Determine the routers that are responsible for <b>id</b> (binary) and - * add pointers to those routers' routerstatus_t to <b>responsible_dirs</b>. - * Return -1 if we're returning an empty smartlist, else return 0. - */ -int -hid_serv_get_responsible_directories(smartlist_t *responsible_dirs, - const char *id) -{ - int start, found, n_added = 0, i; - networkstatus_t *c = networkstatus_get_latest_consensus(); - if (!c || !smartlist_len(c->routerstatus_list)) { - log_info(LD_REND, "We don't have a consensus, so we can't perform v2 " - "rendezvous operations."); - return -1; - } - tor_assert(id); - start = networkstatus_vote_find_entry_idx(c, id, &found); - if (start == smartlist_len(c->routerstatus_list)) start = 0; - i = start; - do { - routerstatus_t *r = smartlist_get(c->routerstatus_list, i); - if (r->is_hs_dir) { - smartlist_add(responsible_dirs, r); - if (++n_added == REND_NUMBER_OF_CONSECUTIVE_REPLICAS) - return 0; - } - if (++i == smartlist_len(c->routerstatus_list)) - i = 0; - } while (i != start); - - /* Even though we don't have the desired number of hidden service - * directories, be happy if we got any. */ - return smartlist_len(responsible_dirs) ? 0 : -1; -} - -/* Length of the 'extended' auth cookie used to encode auth type before - * base64 encoding. */ -#define REND_DESC_COOKIE_LEN_EXT (REND_DESC_COOKIE_LEN + 1) -/* Length of the zero-padded auth cookie when base64 encoded. These two - * padding bytes always (A=) are stripped off of the returned cookie. */ -#define REND_DESC_COOKIE_LEN_EXT_BASE64 (REND_DESC_COOKIE_LEN_BASE64 + 2) - -/** Encode a client authorization descriptor cookie. - * The result of this function is suitable for use in the HidServAuth - * option. The trailing padding characters are removed, and the - * auth type is encoded into the cookie. - * - * Returns a new base64-encoded cookie. This function cannot fail. - * The caller is responsible for freeing the returned value. - */ -char * -rend_auth_encode_cookie(const uint8_t *cookie_in, rend_auth_type_t auth_type) -{ - uint8_t extended_cookie[REND_DESC_COOKIE_LEN_EXT]; - char *cookie_out = tor_malloc_zero(REND_DESC_COOKIE_LEN_EXT_BASE64 + 1); - int re; - - tor_assert(cookie_in); - - memcpy(extended_cookie, cookie_in, REND_DESC_COOKIE_LEN); - extended_cookie[REND_DESC_COOKIE_LEN] = ((int)auth_type - 1) << 4; - re = base64_encode(cookie_out, REND_DESC_COOKIE_LEN_EXT_BASE64 + 1, - (const char *) extended_cookie, REND_DESC_COOKIE_LEN_EXT, - 0); - tor_assert(re == REND_DESC_COOKIE_LEN_EXT_BASE64); - - /* Remove the trailing 'A='. Auth type is encoded in the high bits - * of the last byte, so the last base64 character will always be zero - * (A). This is subtly different behavior from base64_encode_nopad. */ - cookie_out[REND_DESC_COOKIE_LEN_BASE64] = '\0'; - memwipe(extended_cookie, 0, sizeof(extended_cookie)); - return cookie_out; -} - -/** Decode a base64-encoded client authorization descriptor cookie. - * The descriptor_cookie can be truncated to REND_DESC_COOKIE_LEN_BASE64 - * characters (as given to clients), or may include the two padding - * characters (as stored by the service). - * - * The result is stored in REND_DESC_COOKIE_LEN bytes of cookie_out. - * The rend_auth_type_t decoded from the cookie is stored in the - * optional auth_type_out parameter. - * - * Return 0 on success, or -1 on error. The caller is responsible for - * freeing the returned err_msg. - */ -int -rend_auth_decode_cookie(const char *cookie_in, uint8_t *cookie_out, - rend_auth_type_t *auth_type_out, char **err_msg_out) -{ - uint8_t descriptor_cookie_decoded[REND_DESC_COOKIE_LEN_EXT + 1] = { 0 }; - char descriptor_cookie_base64ext[REND_DESC_COOKIE_LEN_EXT_BASE64 + 1]; - const char *descriptor_cookie = cookie_in; - char *err_msg = NULL; - int auth_type_val = 0; - int res = -1; - int decoded_len; - - size_t len = strlen(descriptor_cookie); - if (len == REND_DESC_COOKIE_LEN_BASE64) { - /* Add a trailing zero byte to make base64-decoding happy. */ - tor_snprintf(descriptor_cookie_base64ext, - sizeof(descriptor_cookie_base64ext), - "%sA=", descriptor_cookie); - descriptor_cookie = descriptor_cookie_base64ext; - } else if (len != REND_DESC_COOKIE_LEN_EXT_BASE64) { - tor_asprintf(&err_msg, "Authorization cookie has wrong length: %s", - escaped(cookie_in)); - goto err; - } - - decoded_len = base64_decode((char *) descriptor_cookie_decoded, - sizeof(descriptor_cookie_decoded), - descriptor_cookie, - REND_DESC_COOKIE_LEN_EXT_BASE64); - if (decoded_len != REND_DESC_COOKIE_LEN && - decoded_len != REND_DESC_COOKIE_LEN_EXT) { - tor_asprintf(&err_msg, "Authorization cookie has invalid characters: %s", - escaped(cookie_in)); - goto err; - } - - if (auth_type_out) { - auth_type_val = (descriptor_cookie_decoded[REND_DESC_COOKIE_LEN] >> 4) + 1; - if (auth_type_val < 1 || auth_type_val > 2) { - tor_asprintf(&err_msg, "Authorization cookie type is unknown: %s", - escaped(cookie_in)); - goto err; - } - *auth_type_out = auth_type_val == 1 ? REND_BASIC_AUTH : REND_STEALTH_AUTH; - } - - memcpy(cookie_out, descriptor_cookie_decoded, REND_DESC_COOKIE_LEN); - res = 0; - err: - if (err_msg_out) { - *err_msg_out = err_msg; - } else { - tor_free(err_msg); - } - memwipe(descriptor_cookie_decoded, 0, sizeof(descriptor_cookie_decoded)); - memwipe(descriptor_cookie_base64ext, 0, sizeof(descriptor_cookie_base64ext)); - return res; -} - -/* Is this a rend client or server that allows direct (non-anonymous) - * connections? - * Onion services can be configured to start in this mode for single onion. */ -int -rend_allow_non_anonymous_connection(const or_options_t* options) -{ - return rend_service_allow_non_anonymous_connection(options); -} - -/* Is this a rend client or server in non-anonymous mode? - * Onion services can be configured to start in this mode for single onion. */ -int -rend_non_anonymous_mode_enabled(const or_options_t *options) -{ - return rend_service_non_anonymous_mode_enabled(options); -} - /* Make sure that tor only builds one-hop circuits when they would not * compromise user anonymity. * @@ -1020,35 +119,6 @@ assert_circ_anonymity_ok(const origin_circuit_t *circ, tor_assert(circ->build_state); if (circ->build_state->onehop_tunnel) { - tor_assert(rend_allow_non_anonymous_connection(options)); - } -} - -/* Return 1 iff the given <b>digest</b> of a permenanent hidden service key is - * equal to the digest in the origin circuit <b>ocirc</b> of its rend data . - * If the rend data doesn't exist, 0 is returned. This function is agnostic to - * the rend data version. */ -int -rend_circuit_pk_digest_eq(const origin_circuit_t *ocirc, - const uint8_t *digest) -{ - size_t rend_pk_digest_len; - const uint8_t *rend_pk_digest; - - tor_assert(ocirc); - tor_assert(digest); - - if (ocirc->rend_data == NULL) { - goto no_match; - } - - rend_pk_digest = rend_data_get_pk_digest(ocirc->rend_data, - &rend_pk_digest_len); - if (tor_memeq(rend_pk_digest, digest, rend_pk_digest_len)) { - goto match; + tor_assert(hs_service_allow_non_anonymous_connection(options)); } - no_match: - return 0; - match: - return 1; } diff --git a/src/feature/rend/rendcommon.h b/src/feature/rend/rendcommon.h index d8281e0578..113438e6fc 100644 --- a/src/feature/rend/rendcommon.h +++ b/src/feature/rend/rendcommon.h @@ -1,7 +1,7 @@ /* Copyright (c) 2001 Matej Pfajfar. * Copyright (c) 2001-2004, Roger Dingledine. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ + * Copyright (c) 2007-2021, The Tor Project, Inc. */ /* See LICENSE for licensing information */ /** @@ -18,65 +18,12 @@ typedef enum rend_intro_point_failure_t { INTRO_POINT_FAILURE_UNREACHABLE = 2, } rend_intro_point_failure_t; -int rend_cmp_service_ids(const char *one, const char *two); - void rend_process_relay_cell(circuit_t *circ, const crypt_path_t *layer_hint, int command, size_t length, const uint8_t *payload); -void rend_service_descriptor_free_(rend_service_descriptor_t *desc); -#define rend_service_descriptor_free(desc) \ - FREE_AND_NULL(rend_service_descriptor_t, rend_service_descriptor_free_, \ - (desc)) -int rend_get_service_id(crypto_pk_t *pk, char *out); -void rend_encoded_v2_service_descriptor_free_( - rend_encoded_v2_service_descriptor_t *desc); -#define rend_encoded_v2_service_descriptor_free(desc) \ - FREE_AND_NULL(rend_encoded_v2_service_descriptor_t, \ - rend_encoded_v2_service_descriptor_free_, (desc)) -void rend_intro_point_free_(rend_intro_point_t *intro); -#define rend_intro_point_free(intro) \ - FREE_AND_NULL(rend_intro_point_t, rend_intro_point_free_, (intro)) - -int rend_valid_v2_service_id(const char *query); -int rend_valid_descriptor_id(const char *query); -int rend_valid_client_name(const char *client_name); -int rend_encode_v2_descriptors(smartlist_t *descs_out, - rend_service_descriptor_t *desc, time_t now, - uint8_t period, rend_auth_type_t auth_type, - crypto_pk_t *client_key, - smartlist_t *client_cookies); -int rend_compute_v2_desc_id(char *desc_id_out, const char *service_id, - const char *descriptor_cookie, - time_t now, uint8_t replica); -void rend_get_descriptor_id_bytes(char *descriptor_id_out, - const char *service_id, - const char *secret_id_part); -int hid_serv_get_responsible_directories(smartlist_t *responsible_dirs, - const char *id); - -int rend_circuit_pk_digest_eq(const origin_circuit_t *ocirc, - const uint8_t *digest); - -char *rend_auth_encode_cookie(const uint8_t *cookie_in, - rend_auth_type_t auth_type); -int rend_auth_decode_cookie(const char *cookie_in, - uint8_t *cookie_out, - rend_auth_type_t *auth_type_out, - char **err_msg_out); - -int rend_allow_non_anonymous_connection(const or_options_t* options); -int rend_non_anonymous_mode_enabled(const or_options_t *options); - void assert_circ_anonymity_ok(const origin_circuit_t *circ, const or_options_t *options); -#ifdef RENDCOMMON_PRIVATE - -STATIC int -rend_desc_v2_is_parsable(rend_encoded_v2_service_descriptor_t *desc); - -#endif /* defined(RENDCOMMON_PRIVATE) */ - #endif /* !defined(TOR_RENDCOMMON_H) */ diff --git a/src/feature/rend/rendmid.c b/src/feature/rend/rendmid.c index b497362857..df838aa527 100644 --- a/src/feature/rend/rendmid.c +++ b/src/feature/rend/rendmid.c @@ -1,5 +1,5 @@ /* Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ + * Copyright (c) 2007-2021, The Tor Project, Inc. */ /* See LICENSE for licensing information */ /** @@ -16,217 +16,12 @@ #include "core/or/dos.h" #include "core/or/relay.h" #include "feature/rend/rendmid.h" -#include "feature/stats/rephist.h" #include "feature/hs/hs_circuitmap.h" #include "feature/hs/hs_dos.h" #include "feature/hs/hs_intropoint.h" #include "core/or/or_circuit_st.h" -/** Respond to an ESTABLISH_INTRO cell by checking the signed data and - * setting the circuit's purpose and service pk digest. - */ -int -rend_mid_establish_intro_legacy(or_circuit_t *circ, const uint8_t *request, - size_t request_len) -{ - crypto_pk_t *pk = NULL; - char buf[DIGEST_LEN+9]; - char expected_digest[DIGEST_LEN]; - char pk_digest[DIGEST_LEN]; - size_t asn1len; - or_circuit_t *c; - char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; - int reason = END_CIRC_REASON_INTERNAL; - - log_info(LD_REND, - "Received a legacy ESTABLISH_INTRO request on circuit %u", - (unsigned) circ->p_circ_id); - - if (!hs_intro_circuit_is_suitable_for_establish_intro(circ)) { - reason = END_CIRC_REASON_TORPROTOCOL; - goto err; - } - - if (request_len < 2+DIGEST_LEN) - goto truncated; - /* First 2 bytes: length of asn1-encoded key. */ - asn1len = ntohs(get_uint16(request)); - - /* Next asn1len bytes: asn1-encoded key. */ - if (request_len < 2+DIGEST_LEN+asn1len) - goto truncated; - pk = crypto_pk_asn1_decode((char*)(request+2), asn1len); - if (!pk) { - reason = END_CIRC_REASON_TORPROTOCOL; - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Couldn't decode public key."); - goto err; - } - - /* Next 20 bytes: Hash of rend_circ_nonce | "INTRODUCE" */ - memcpy(buf, circ->rend_circ_nonce, DIGEST_LEN); - memcpy(buf+DIGEST_LEN, "INTRODUCE", 9); - if (crypto_digest(expected_digest, buf, DIGEST_LEN+9) < 0) { - log_warn(LD_BUG, "Internal error computing digest."); - goto err; - } - if (tor_memneq(expected_digest, request+2+asn1len, DIGEST_LEN)) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Hash of session info was not as expected."); - reason = END_CIRC_REASON_TORPROTOCOL; - goto err; - } - /* Rest of body: signature of previous data */ - if (crypto_pk_public_checksig_digest(pk, - (char*)request, 2+asn1len+DIGEST_LEN, - (char*)(request+2+DIGEST_LEN+asn1len), - request_len-(2+DIGEST_LEN+asn1len))<0) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Incorrect signature on ESTABLISH_INTRO cell; rejecting."); - reason = END_CIRC_REASON_TORPROTOCOL; - goto err; - } - - /* The request is valid. First, compute the hash of the service's PK.*/ - if (crypto_pk_get_digest(pk, pk_digest)<0) { - log_warn(LD_BUG, "Internal error: couldn't hash public key."); - goto err; - } - - crypto_pk_free(pk); /* don't need it anymore */ - pk = NULL; /* so we don't free it again if err */ - - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32+1, - pk_digest, REND_SERVICE_ID_LEN); - - /* Close any other intro circuits with the same pk. */ - c = NULL; - while ((c = hs_circuitmap_get_intro_circ_v2_relay_side( - (const uint8_t *)pk_digest))) { - log_info(LD_REND, "Replacing old circuit for service %s", - safe_str(serviceid)); - circuit_mark_for_close(TO_CIRCUIT(c), END_CIRC_REASON_FINISHED); - /* Now it's marked, and it won't be returned next time. */ - } - - /* Acknowledge the request. */ - if (hs_intro_send_intro_established_cell(circ) < 0) { - log_info(LD_GENERAL, "Couldn't send INTRO_ESTABLISHED cell."); - goto err_no_close; - } - - /* Now, set up this circuit. */ - circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_INTRO_POINT); - hs_circuitmap_register_intro_circ_v2_relay_side(circ, (uint8_t *)pk_digest); - hs_dos_setup_default_intro2_defenses(circ); - - log_info(LD_REND, - "Established introduction point on circuit %u for service %s", - (unsigned) circ->p_circ_id, safe_str(serviceid)); - - return 0; - truncated: - log_warn(LD_PROTOCOL, "Rejecting truncated ESTABLISH_INTRO cell."); - reason = END_CIRC_REASON_TORPROTOCOL; - err: - circuit_mark_for_close(TO_CIRCUIT(circ), reason); - err_no_close: - if (pk) crypto_pk_free(pk); - return -1; -} - -/** Process an INTRODUCE1 cell by finding the corresponding introduction - * circuit, and relaying the body of the INTRODUCE1 cell inside an - * INTRODUCE2 cell. - */ -int -rend_mid_introduce_legacy(or_circuit_t *circ, const uint8_t *request, - size_t request_len) -{ - or_circuit_t *intro_circ; - char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; - char nak_body[1]; - - log_info(LD_REND, "Received an INTRODUCE1 request on circuit %u", - (unsigned)circ->p_circ_id); - - /* At this point, we know that the circuit is valid for an INTRODUCE1 - * because the validation has been made before calling this function. */ - tor_assert(circ->base_.purpose == CIRCUIT_PURPOSE_OR); - tor_assert(!circ->base_.n_chan); - - /* We could change this to MAX_HEX_NICKNAME_LEN now that 0.0.9.x is - * obsolete; however, there isn't much reason to do so, and we're going - * to revise this protocol anyway. - */ - if (request_len < (DIGEST_LEN+(MAX_NICKNAME_LEN+1)+REND_COOKIE_LEN+ - DH1024_KEY_LEN+CIPHER_KEY_LEN+ - PKCS1_OAEP_PADDING_OVERHEAD)) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Impossibly short INTRODUCE1 cell on circuit %u; " - "responding with nack.", (unsigned)circ->p_circ_id); - goto err; - } - - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32+1, - (char*)request, REND_SERVICE_ID_LEN); - - /* The first 20 bytes are all we look at: they have a hash of the service's - * PK. */ - intro_circ = hs_circuitmap_get_intro_circ_v2_relay_side( - (const uint8_t*)request); - if (!intro_circ) { - log_info(LD_REND, - "No intro circ found for INTRODUCE1 cell (%s) from circuit %u; " - "responding with nack.", - safe_str(serviceid), (unsigned)circ->p_circ_id); - goto err; - } - - /* Before sending, lets make sure this cell can be sent on the service - * circuit asking the DoS defenses. */ - if (!hs_dos_can_send_intro2(intro_circ)) { - log_info(LD_PROTOCOL, "Can't relay INTRODUCE1 v2 cell due to DoS " - "limitations. Sending NACK to client."); - goto err; - } - - log_info(LD_REND, - "Sending introduction request for service %s " - "from circ %u to circ %u", - safe_str(serviceid), (unsigned)circ->p_circ_id, - (unsigned)intro_circ->p_circ_id); - - /* Great. Now we just relay the cell down the circuit. */ - if (relay_send_command_from_edge(0, TO_CIRCUIT(intro_circ), - RELAY_COMMAND_INTRODUCE2, - (char*)request, request_len, NULL)) { - log_warn(LD_GENERAL, - "Unable to send INTRODUCE2 cell to Tor client."); - /* Stop right now, the circuit has been closed. */ - return -1; - } - /* And send an ack down the client's circuit. Empty body means succeeded. */ - if (relay_send_command_from_edge(0,TO_CIRCUIT(circ), - RELAY_COMMAND_INTRODUCE_ACK, - NULL,0,NULL)) { - log_warn(LD_GENERAL, "Unable to send INTRODUCE_ACK cell to Tor client."); - /* Stop right now, the circuit has been closed. */ - return -1; - } - - return 0; - err: - /* Send the client a NACK */ - nak_body[0] = 1; - if (relay_send_command_from_edge(0,TO_CIRCUIT(circ), - RELAY_COMMAND_INTRODUCE_ACK, - nak_body, 1, NULL)) { - log_warn(LD_GENERAL, "Unable to send NAK to Tor client."); - } - return -1; -} - /** Process an ESTABLISH_RENDEZVOUS cell by setting the circuit's purpose and * rendezvous cookie. */ diff --git a/src/feature/rend/rendmid.h b/src/feature/rend/rendmid.h index 789596d855..d42d5cfa05 100644 --- a/src/feature/rend/rendmid.h +++ b/src/feature/rend/rendmid.h @@ -1,7 +1,7 @@ /* Copyright (c) 2001 Matej Pfajfar. * Copyright (c) 2001-2004, Roger Dingledine. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ + * Copyright (c) 2007-2021, The Tor Project, Inc. */ /* See LICENSE for licensing information */ /** diff --git a/src/feature/rend/rendparse.c b/src/feature/rend/rendparse.c deleted file mode 100644 index c28add5ca9..0000000000 --- a/src/feature/rend/rendparse.c +++ /dev/null @@ -1,612 +0,0 @@ -/* Copyright (c) 2001 Matej Pfajfar. - * Copyright (c) 2001-2004, Roger Dingledine. - * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * \file rendparse.c - * \brief Code to parse and validate v2 hidden service descriptors. - **/ - -#include "core/or/or.h" -#include "core/or/extendinfo.h" -#include "feature/dirparse/parsecommon.h" -#include "feature/dirparse/sigcommon.h" -#include "feature/rend/rendcommon.h" -#include "feature/rend/rendparse.h" -#include "lib/memarea/memarea.h" - -#include "core/or/extend_info_st.h" -#include "feature/rend/rend_authorized_client_st.h" -#include "feature/rend/rend_intro_point_st.h" -#include "feature/rend/rend_service_descriptor_st.h" - -/** List of tokens recognized in rendezvous service descriptors */ -static token_rule_t desc_token_table[] = { - T1_START("rendezvous-service-descriptor", R_RENDEZVOUS_SERVICE_DESCRIPTOR, - EQ(1), NO_OBJ), - T1("version", R_VERSION, EQ(1), NO_OBJ), - T1("permanent-key", R_PERMANENT_KEY, NO_ARGS, NEED_KEY_1024), - T1("secret-id-part", R_SECRET_ID_PART, EQ(1), NO_OBJ), - T1("publication-time", R_PUBLICATION_TIME, CONCAT_ARGS, NO_OBJ), - T1("protocol-versions", R_PROTOCOL_VERSIONS, EQ(1), NO_OBJ), - T01("introduction-points", R_INTRODUCTION_POINTS, NO_ARGS, NEED_OBJ), - T1_END("signature", R_SIGNATURE, NO_ARGS, NEED_OBJ), - END_OF_TABLE -}; - -/** List of tokens recognized in the (encrypted) list of introduction points of - * rendezvous service descriptors */ -static token_rule_t ipo_token_table[] = { - T1_START("introduction-point", R_IPO_IDENTIFIER, EQ(1), NO_OBJ), - T1("ip-address", R_IPO_IP_ADDRESS, EQ(1), NO_OBJ), - T1("onion-port", R_IPO_ONION_PORT, EQ(1), NO_OBJ), - T1("onion-key", R_IPO_ONION_KEY, NO_ARGS, NEED_KEY_1024), - T1("service-key", R_IPO_SERVICE_KEY, NO_ARGS, NEED_KEY_1024), - END_OF_TABLE -}; - -/** List of tokens recognized in the (possibly encrypted) list of introduction - * points of rendezvous service descriptors */ -static token_rule_t client_keys_token_table[] = { - T1_START("client-name", C_CLIENT_NAME, CONCAT_ARGS, NO_OBJ), - T1("descriptor-cookie", C_DESCRIPTOR_COOKIE, EQ(1), NO_OBJ), - T01("client-key", C_CLIENT_KEY, NO_ARGS, NEED_SKEY_1024), - END_OF_TABLE -}; - -/** Parse and validate the ASCII-encoded v2 descriptor in <b>desc</b>, - * write the parsed descriptor to the newly allocated *<b>parsed_out</b>, the - * binary descriptor ID of length DIGEST_LEN to <b>desc_id_out</b>, the - * encrypted introduction points to the newly allocated - * *<b>intro_points_encrypted_out</b>, their encrypted size to - * *<b>intro_points_encrypted_size_out</b>, the size of the encoded descriptor - * to *<b>encoded_size_out</b>, and a pointer to the possibly next - * descriptor to *<b>next_out</b>; return 0 for success (including validation) - * and -1 for failure. - * - * If <b>as_hsdir</b> is 1, we're parsing this as an HSDir, and we should - * be strict about time formats. - */ -int -rend_parse_v2_service_descriptor(rend_service_descriptor_t **parsed_out, - char *desc_id_out, - char **intro_points_encrypted_out, - size_t *intro_points_encrypted_size_out, - size_t *encoded_size_out, - const char **next_out, const char *desc, - int as_hsdir) -{ - rend_service_descriptor_t *result = - tor_malloc_zero(sizeof(rend_service_descriptor_t)); - char desc_hash[DIGEST_LEN]; - const char *eos; - smartlist_t *tokens = smartlist_new(); - directory_token_t *tok; - char secret_id_part[DIGEST_LEN]; - int i, version, num_ok=1; - smartlist_t *versions; - char public_key_hash[DIGEST_LEN]; - char test_desc_id[DIGEST_LEN]; - memarea_t *area = NULL; - const int strict_time_fmt = as_hsdir; - - tor_assert(desc); - /* Check if desc starts correctly. */ - if (strcmpstart(desc, "rendezvous-service-descriptor ")) { - log_info(LD_REND, "Descriptor does not start correctly."); - goto err; - } - /* Compute descriptor hash for later validation. */ - if (router_get_hash_impl(desc, strlen(desc), desc_hash, - "rendezvous-service-descriptor ", - "\nsignature", '\n', DIGEST_SHA1) < 0) { - log_warn(LD_REND, "Couldn't compute descriptor hash."); - goto err; - } - /* Determine end of string. */ - eos = strstr(desc, "\nrendezvous-service-descriptor "); - if (!eos) - eos = desc + strlen(desc); - else - eos = eos + 1; - /* Check length. */ - if (eos-desc > REND_DESC_MAX_SIZE) { - /* XXXX+ If we are parsing this descriptor as a server, this - * should be a protocol warning. */ - log_warn(LD_REND, "Descriptor length is %d which exceeds " - "maximum rendezvous descriptor size of %d bytes.", - (int)(eos-desc), REND_DESC_MAX_SIZE); - goto err; - } - /* Tokenize descriptor. */ - area = memarea_new(); - if (tokenize_string(area, desc, eos, tokens, desc_token_table, 0)) { - log_warn(LD_REND, "Error tokenizing descriptor."); - goto err; - } - /* Set next to next descriptor, if available. */ - *next_out = eos; - /* Set length of encoded descriptor. */ - *encoded_size_out = eos - desc; - /* Check min allowed length of token list. */ - if (smartlist_len(tokens) < 7) { - log_warn(LD_REND, "Impossibly short descriptor."); - goto err; - } - /* Parse base32-encoded descriptor ID. */ - tok = find_by_keyword(tokens, R_RENDEZVOUS_SERVICE_DESCRIPTOR); - tor_assert(tok == smartlist_get(tokens, 0)); - tor_assert(tok->n_args == 1); - if (!rend_valid_descriptor_id(tok->args[0])) { - log_warn(LD_REND, "Invalid descriptor ID: '%s'", tok->args[0]); - goto err; - } - if (base32_decode(desc_id_out, DIGEST_LEN, - tok->args[0], REND_DESC_ID_V2_LEN_BASE32) != DIGEST_LEN) { - log_warn(LD_REND, - "Descriptor ID has wrong length or illegal characters: %s", - tok->args[0]); - goto err; - } - /* Parse descriptor version. */ - tok = find_by_keyword(tokens, R_VERSION); - tor_assert(tok->n_args == 1); - result->version = - (int) tor_parse_long(tok->args[0], 10, 0, INT_MAX, &num_ok, NULL); - if (result->version != 2 || !num_ok) { - /* If it's <2, it shouldn't be under this format. If the number - * is greater than 2, we bumped it because we broke backward - * compatibility. See how version numbers in our other formats - * work. */ - log_warn(LD_REND, "Unrecognized descriptor version: %s", - escaped(tok->args[0])); - goto err; - } - /* Parse public key. */ - tok = find_by_keyword(tokens, R_PERMANENT_KEY); - result->pk = tok->key; - tok->key = NULL; /* Prevent free */ - /* Parse secret ID part. */ - tok = find_by_keyword(tokens, R_SECRET_ID_PART); - tor_assert(tok->n_args == 1); - if (strlen(tok->args[0]) != REND_SECRET_ID_PART_LEN_BASE32 || - strspn(tok->args[0], BASE32_CHARS) != REND_SECRET_ID_PART_LEN_BASE32) { - log_warn(LD_REND, "Invalid secret ID part: '%s'", tok->args[0]); - goto err; - } - if (base32_decode(secret_id_part, DIGEST_LEN, tok->args[0], 32) != - DIGEST_LEN) { - log_warn(LD_REND, - "Secret ID part has wrong length or illegal characters: %s", - tok->args[0]); - goto err; - } - /* Parse publication time -- up-to-date check is done when storing the - * descriptor. */ - tok = find_by_keyword(tokens, R_PUBLICATION_TIME); - tor_assert(tok->n_args == 1); - if (parse_iso_time_(tok->args[0], &result->timestamp, - strict_time_fmt, 0) < 0) { - log_warn(LD_REND, "Invalid publication time: '%s'", tok->args[0]); - goto err; - } - /* Parse protocol versions. */ - tok = find_by_keyword(tokens, R_PROTOCOL_VERSIONS); - tor_assert(tok->n_args == 1); - versions = smartlist_new(); - smartlist_split_string(versions, tok->args[0], ",", - SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 0); - for (i = 0; i < smartlist_len(versions); i++) { - version = (int) tor_parse_long(smartlist_get(versions, i), - 10, 0, INT_MAX, &num_ok, NULL); - if (!num_ok) /* It's a string; let's ignore it. */ - continue; - if (version >= REND_PROTOCOL_VERSION_BITMASK_WIDTH) - /* Avoid undefined left-shift behaviour. */ - continue; - result->protocols |= 1 << version; - } - SMARTLIST_FOREACH(versions, char *, cp, tor_free(cp)); - smartlist_free(versions); - /* Parse encrypted introduction points. Don't verify. */ - tok = find_opt_by_keyword(tokens, R_INTRODUCTION_POINTS); - if (tok) { - if (strcmp(tok->object_type, "MESSAGE")) { - log_warn(LD_DIR, "Bad object type: introduction points should be of " - "type MESSAGE"); - goto err; - } - *intro_points_encrypted_out = tor_memdup(tok->object_body, - tok->object_size); - *intro_points_encrypted_size_out = tok->object_size; - } else { - *intro_points_encrypted_out = NULL; - *intro_points_encrypted_size_out = 0; - } - /* Parse and verify signature. */ - tok = find_by_keyword(tokens, R_SIGNATURE); - if (check_signature_token(desc_hash, DIGEST_LEN, tok, result->pk, 0, - "v2 rendezvous service descriptor") < 0) - goto err; - /* Verify that descriptor ID belongs to public key and secret ID part. */ - if (crypto_pk_get_digest(result->pk, public_key_hash) < 0) { - log_warn(LD_REND, "Unable to compute rend descriptor public key digest"); - goto err; - } - rend_get_descriptor_id_bytes(test_desc_id, public_key_hash, - secret_id_part); - if (tor_memneq(desc_id_out, test_desc_id, DIGEST_LEN)) { - log_warn(LD_REND, "Parsed descriptor ID does not match " - "computed descriptor ID."); - goto err; - } - goto done; - err: - rend_service_descriptor_free(result); - result = NULL; - done: - if (tokens) { - SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t)); - smartlist_free(tokens); - } - if (area) - memarea_drop_all(area); - *parsed_out = result; - if (result) - return 0; - return -1; -} - -/** Decrypt the encrypted introduction points in <b>ipos_encrypted</b> of - * length <b>ipos_encrypted_size</b> using <b>descriptor_cookie</b> and - * write the result to a newly allocated string that is pointed to by - * <b>ipos_decrypted</b> and its length to <b>ipos_decrypted_size</b>. - * Return 0 if decryption was successful and -1 otherwise. */ -int -rend_decrypt_introduction_points(char **ipos_decrypted, - size_t *ipos_decrypted_size, - const char *descriptor_cookie, - const char *ipos_encrypted, - size_t ipos_encrypted_size) -{ - tor_assert(ipos_encrypted); - tor_assert(descriptor_cookie); - if (ipos_encrypted_size < 2) { - log_warn(LD_REND, "Size of encrypted introduction points is too " - "small."); - return -1; - } - if (ipos_encrypted[0] == (int)REND_BASIC_AUTH) { - char iv[CIPHER_IV_LEN], client_id[REND_BASIC_AUTH_CLIENT_ID_LEN], - session_key[CIPHER_KEY_LEN], *dec; - int declen, client_blocks; - size_t pos = 0, len, client_entries_len; - crypto_digest_t *digest; - crypto_cipher_t *cipher; - client_blocks = (int) ipos_encrypted[1]; - client_entries_len = client_blocks * REND_BASIC_AUTH_CLIENT_MULTIPLE * - REND_BASIC_AUTH_CLIENT_ENTRY_LEN; - if (ipos_encrypted_size < 2 + client_entries_len + CIPHER_IV_LEN + 1) { - log_warn(LD_REND, "Size of encrypted introduction points is too " - "small."); - return -1; - } - memcpy(iv, ipos_encrypted + 2 + client_entries_len, CIPHER_IV_LEN); - digest = crypto_digest_new(); - crypto_digest_add_bytes(digest, descriptor_cookie, REND_DESC_COOKIE_LEN); - crypto_digest_add_bytes(digest, iv, CIPHER_IV_LEN); - crypto_digest_get_digest(digest, client_id, - REND_BASIC_AUTH_CLIENT_ID_LEN); - crypto_digest_free(digest); - for (pos = 2; pos < 2 + client_entries_len; - pos += REND_BASIC_AUTH_CLIENT_ENTRY_LEN) { - if (tor_memeq(ipos_encrypted + pos, client_id, - REND_BASIC_AUTH_CLIENT_ID_LEN)) { - /* Attempt to decrypt introduction points. */ - cipher = crypto_cipher_new(descriptor_cookie); - if (crypto_cipher_decrypt(cipher, session_key, ipos_encrypted - + pos + REND_BASIC_AUTH_CLIENT_ID_LEN, - CIPHER_KEY_LEN) < 0) { - log_warn(LD_REND, "Could not decrypt session key for client."); - crypto_cipher_free(cipher); - return -1; - } - crypto_cipher_free(cipher); - - len = ipos_encrypted_size - 2 - client_entries_len - CIPHER_IV_LEN; - dec = tor_malloc_zero(len + 1); - declen = crypto_cipher_decrypt_with_iv(session_key, dec, len, - ipos_encrypted + 2 + client_entries_len, - ipos_encrypted_size - 2 - client_entries_len); - - if (declen < 0) { - log_warn(LD_REND, "Could not decrypt introduction point string."); - tor_free(dec); - return -1; - } - if (fast_memcmpstart(dec, declen, "introduction-point ")) { - log_warn(LD_REND, "Decrypted introduction points don't " - "look like we could parse them."); - tor_free(dec); - continue; - } - *ipos_decrypted = dec; - *ipos_decrypted_size = declen; - return 0; - } - } - log_warn(LD_REND, "Could not decrypt introduction points. Please " - "check your authorization for this service!"); - return -1; - } else if (ipos_encrypted[0] == (int)REND_STEALTH_AUTH) { - char *dec; - int declen; - if (ipos_encrypted_size < CIPHER_IV_LEN + 2) { - log_warn(LD_REND, "Size of encrypted introduction points is too " - "small."); - return -1; - } - dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1 + 1); - - declen = crypto_cipher_decrypt_with_iv(descriptor_cookie, dec, - ipos_encrypted_size - - CIPHER_IV_LEN - 1, - ipos_encrypted + 1, - ipos_encrypted_size - 1); - - if (declen < 0) { - log_warn(LD_REND, "Decrypting introduction points failed!"); - tor_free(dec); - return -1; - } - *ipos_decrypted = dec; - *ipos_decrypted_size = declen; - return 0; - } else { - log_warn(LD_REND, "Unknown authorization type number: %d", - ipos_encrypted[0]); - return -1; - } -} - -/** Parse the encoded introduction points in <b>intro_points_encoded</b> of - * length <b>intro_points_encoded_size</b> and write the result to the - * descriptor in <b>parsed</b>; return the number of successfully parsed - * introduction points or -1 in case of a failure. */ -int -rend_parse_introduction_points(rend_service_descriptor_t *parsed, - const char *intro_points_encoded, - size_t intro_points_encoded_size) -{ - const char *current_ipo, *end_of_intro_points; - smartlist_t *tokens = NULL; - directory_token_t *tok; - rend_intro_point_t *intro; - extend_info_t *info; - int result, num_ok=1; - memarea_t *area = NULL; - tor_assert(parsed); - /** Function may only be invoked once. */ - tor_assert(!parsed->intro_nodes); - if (!intro_points_encoded || intro_points_encoded_size == 0) { - log_warn(LD_REND, "Empty or zero size introduction point list"); - goto err; - } - /* Consider one intro point after the other. */ - current_ipo = intro_points_encoded; - end_of_intro_points = intro_points_encoded + intro_points_encoded_size; - tokens = smartlist_new(); - parsed->intro_nodes = smartlist_new(); - area = memarea_new(); - - while (!fast_memcmpstart(current_ipo, end_of_intro_points-current_ipo, - "introduction-point ")) { - /* Determine end of string. */ - const char *eos = tor_memstr(current_ipo, end_of_intro_points-current_ipo, - "\nintroduction-point "); - if (!eos) - eos = end_of_intro_points; - else - eos = eos+1; - tor_assert(eos <= intro_points_encoded+intro_points_encoded_size); - /* Free tokens and clear token list. */ - SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t)); - smartlist_clear(tokens); - memarea_clear(area); - /* Tokenize string. */ - if (tokenize_string(area, current_ipo, eos, tokens, ipo_token_table, 0)) { - log_warn(LD_REND, "Error tokenizing introduction point"); - goto err; - } - /* Advance to next introduction point, if available. */ - current_ipo = eos; - /* Check minimum allowed length of introduction point. */ - if (smartlist_len(tokens) < 5) { - log_warn(LD_REND, "Impossibly short introduction point."); - goto err; - } - /* Allocate new intro point and extend info. */ - intro = tor_malloc_zero(sizeof(rend_intro_point_t)); - info = intro->extend_info = - extend_info_new(NULL, NULL, NULL, NULL, NULL, NULL, 0); - /* Parse identifier. */ - tok = find_by_keyword(tokens, R_IPO_IDENTIFIER); - if (base32_decode(info->identity_digest, DIGEST_LEN, - tok->args[0], REND_INTRO_POINT_ID_LEN_BASE32) != - DIGEST_LEN) { - log_warn(LD_REND, - "Identity digest has wrong length or illegal characters: %s", - tok->args[0]); - rend_intro_point_free(intro); - goto err; - } - /* Write identifier to nickname. */ - info->nickname[0] = '$'; - base16_encode(info->nickname + 1, sizeof(info->nickname) - 1, - info->identity_digest, DIGEST_LEN); - /* Parse IP address. */ - tok = find_by_keyword(tokens, R_IPO_IP_ADDRESS); - tor_addr_t addr; - if (tor_addr_parse(&addr, tok->args[0])<0) { - log_warn(LD_REND, "Could not parse introduction point address."); - rend_intro_point_free(intro); - goto err; - } - if (tor_addr_family(&addr) != AF_INET) { - log_warn(LD_REND, "Introduction point address was not ipv4."); - rend_intro_point_free(intro); - goto err; - } - - /* Parse onion port. */ - tok = find_by_keyword(tokens, R_IPO_ONION_PORT); - uint16_t port = (uint16_t) tor_parse_long(tok->args[0],10,1,65535, - &num_ok,NULL); - if (!port || !num_ok) { - log_warn(LD_REND, "Introduction point onion port %s is invalid", - escaped(tok->args[0])); - rend_intro_point_free(intro); - goto err; - } - - /* Add the address and port. */ - extend_info_add_orport(info, &addr, port); - - /* Parse onion key. */ - tok = find_by_keyword(tokens, R_IPO_ONION_KEY); - if (!crypto_pk_public_exponent_ok(tok->key)) { - log_warn(LD_REND, - "Introduction point's onion key had invalid exponent."); - rend_intro_point_free(intro); - goto err; - } - info->onion_key = tok->key; - tok->key = NULL; /* Prevent free */ - /* Parse service key. */ - tok = find_by_keyword(tokens, R_IPO_SERVICE_KEY); - if (!crypto_pk_public_exponent_ok(tok->key)) { - log_warn(LD_REND, - "Introduction point key had invalid exponent."); - rend_intro_point_free(intro); - goto err; - } - intro->intro_key = tok->key; - tok->key = NULL; /* Prevent free */ - /* Add extend info to list of introduction points. */ - smartlist_add(parsed->intro_nodes, intro); - } - result = smartlist_len(parsed->intro_nodes); - goto done; - - err: - result = -1; - - done: - /* Free tokens and clear token list. */ - if (tokens) { - SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t)); - smartlist_free(tokens); - } - if (area) - memarea_drop_all(area); - - return result; -} - -/** Parse the content of a client_key file in <b>ckstr</b> and add - * rend_authorized_client_t's for each parsed client to - * <b>parsed_clients</b>. Return the number of parsed clients as result - * or -1 for failure. */ -int -rend_parse_client_keys(strmap_t *parsed_clients, const char *ckstr) -{ - int result = -1; - smartlist_t *tokens; - directory_token_t *tok; - const char *current_entry = NULL; - memarea_t *area = NULL; - char *err_msg = NULL; - if (!ckstr || strlen(ckstr) == 0) - return -1; - tokens = smartlist_new(); - /* Begin parsing with first entry, skipping comments or whitespace at the - * beginning. */ - area = memarea_new(); - current_entry = eat_whitespace(ckstr); - while (!strcmpstart(current_entry, "client-name ")) { - rend_authorized_client_t *parsed_entry; - /* Determine end of string. */ - const char *eos = strstr(current_entry, "\nclient-name "); - if (!eos) - eos = current_entry + strlen(current_entry); - else - eos = eos + 1; - /* Free tokens and clear token list. */ - SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t)); - smartlist_clear(tokens); - memarea_clear(area); - /* Tokenize string. */ - if (tokenize_string(area, current_entry, eos, tokens, - client_keys_token_table, 0)) { - log_warn(LD_REND, "Error tokenizing client keys file."); - goto err; - } - /* Advance to next entry, if available. */ - current_entry = eos; - /* Check minimum allowed length of token list. */ - if (smartlist_len(tokens) < 2) { - log_warn(LD_REND, "Impossibly short client key entry."); - goto err; - } - /* Parse client name. */ - tok = find_by_keyword(tokens, C_CLIENT_NAME); - tor_assert(tok == smartlist_get(tokens, 0)); - tor_assert(tok->n_args == 1); - - if (!rend_valid_client_name(tok->args[0])) { - log_warn(LD_CONFIG, "Illegal client name: %s. (Length must be " - "between 1 and %d, and valid characters are " - "[A-Za-z0-9+-_].)", tok->args[0], REND_CLIENTNAME_MAX_LEN); - goto err; - } - /* Check if client name is duplicate. */ - if (strmap_get(parsed_clients, tok->args[0])) { - log_warn(LD_CONFIG, "HiddenServiceAuthorizeClient contains a " - "duplicate client name: '%s'. Ignoring.", tok->args[0]); - goto err; - } - parsed_entry = tor_malloc_zero(sizeof(rend_authorized_client_t)); - parsed_entry->client_name = tor_strdup(tok->args[0]); - strmap_set(parsed_clients, parsed_entry->client_name, parsed_entry); - /* Parse client key. */ - tok = find_opt_by_keyword(tokens, C_CLIENT_KEY); - if (tok) { - parsed_entry->client_key = tok->key; - tok->key = NULL; /* Prevent free */ - } - - /* Parse descriptor cookie. */ - tok = find_by_keyword(tokens, C_DESCRIPTOR_COOKIE); - tor_assert(tok->n_args == 1); - if (rend_auth_decode_cookie(tok->args[0], parsed_entry->descriptor_cookie, - NULL, &err_msg) < 0) { - tor_assert(err_msg); - log_warn(LD_REND, "%s", err_msg); - tor_free(err_msg); - goto err; - } - } - result = strmap_size(parsed_clients); - goto done; - err: - result = -1; - done: - /* Free tokens and clear token list. */ - SMARTLIST_FOREACH(tokens, directory_token_t *, t, token_clear(t)); - smartlist_free(tokens); - if (area) - memarea_drop_all(area); - return result; -} diff --git a/src/feature/rend/rendparse.h b/src/feature/rend/rendparse.h deleted file mode 100644 index 75109c204d..0000000000 --- a/src/feature/rend/rendparse.h +++ /dev/null @@ -1,32 +0,0 @@ -/* Copyright (c) 2001 Matej Pfajfar. - * Copyright (c) 2001-2004, Roger Dingledine. - * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * \file rendparse.h - * \brief Header file for rendparse.c. - **/ - -#ifndef TOR_REND_PARSE_H -#define TOR_REND_PARSE_H - -int rend_parse_v2_service_descriptor(rend_service_descriptor_t **parsed_out, - char *desc_id_out, - char **intro_points_encrypted_out, - size_t *intro_points_encrypted_size_out, - size_t *encoded_size_out, - const char **next_out, const char *desc, - int as_hsdir); -int rend_decrypt_introduction_points(char **ipos_decrypted, - size_t *ipos_decrypted_size, - const char *descriptor_cookie, - const char *ipos_encrypted, - size_t ipos_encrypted_size); -int rend_parse_introduction_points(rend_service_descriptor_t *parsed, - const char *intro_points_encoded, - size_t intro_points_encoded_size); -int rend_parse_client_keys(strmap_t *parsed_clients, const char *str); - -#endif /* !defined(TOR_REND_PARSE_H) */ diff --git a/src/feature/rend/rendservice.c b/src/feature/rend/rendservice.c deleted file mode 100644 index a2be900e2a..0000000000 --- a/src/feature/rend/rendservice.c +++ /dev/null @@ -1,4535 +0,0 @@ -/* Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * \file rendservice.c - * \brief The hidden-service side of rendezvous functionality. - **/ - -#define RENDSERVICE_PRIVATE - -#include "core/or/or.h" - -#include "app/config/config.h" -#include "core/mainloop/mainloop.h" -#include "core/or/circuitbuild.h" -#include "core/or/circuitlist.h" -#include "core/or/circuituse.h" -#include "core/or/extendinfo.h" -#include "core/or/policies.h" -#include "core/or/relay.h" -#include "core/or/crypt_path.h" -#include "feature/client/circpathbias.h" -#include "feature/control/control_events.h" -#include "feature/dirclient/dirclient.h" -#include "feature/dircommon/directory.h" -#include "feature/hs/hs_common.h" -#include "feature/hs/hs_config.h" -#include "feature/hs_common/replaycache.h" -#include "feature/keymgt/loadkey.h" -#include "feature/nodelist/describe.h" -#include "feature/nodelist/networkstatus.h" -#include "feature/nodelist/nickname.h" -#include "feature/nodelist/node_select.h" -#include "feature/nodelist/nodelist.h" -#include "feature/nodelist/routerset.h" -#include "feature/rend/rendclient.h" -#include "feature/rend/rendcommon.h" -#include "feature/rend/rendparse.h" -#include "feature/rend/rendservice.h" -#include "feature/stats/predict_ports.h" -#include "lib/crypt_ops/crypto_dh.h" -#include "lib/crypt_ops/crypto_rand.h" -#include "lib/crypt_ops/crypto_util.h" -#include "lib/encoding/confline.h" -#include "lib/net/resolve.h" - -#include "core/or/cpath_build_state_st.h" -#include "core/or/crypt_path_st.h" -#include "core/or/crypt_path_reference_st.h" -#include "core/or/edge_connection_st.h" -#include "core/or/extend_info_st.h" -#include "feature/hs/hs_opts_st.h" -#include "feature/nodelist/networkstatus_st.h" -#include "core/or/origin_circuit_st.h" -#include "feature/rend/rend_authorized_client_st.h" -#include "feature/rend/rend_encoded_v2_service_descriptor_st.h" -#include "feature/rend/rend_intro_point_st.h" -#include "feature/rend/rend_service_descriptor_st.h" -#include "feature/nodelist/routerstatus_st.h" - -#ifdef HAVE_FCNTL_H -#include <fcntl.h> -#endif -#ifdef HAVE_UNISTD_H -#include <unistd.h> -#endif -#ifdef HAVE_SYS_STAT_H -#include <sys/stat.h> -#endif - -struct rend_service_t; -static origin_circuit_t *find_intro_circuit(rend_intro_point_t *intro, - const char *pk_digest); -static rend_intro_point_t *find_intro_point(origin_circuit_t *circ); -static rend_intro_point_t *find_expiring_intro_point( - struct rend_service_t *service, origin_circuit_t *circ); - -static extend_info_t *find_rp_for_intro( - const rend_intro_cell_t *intro, - char **err_msg_out); - -static int intro_point_accepted_intro_count(rend_intro_point_t *intro); -static int intro_point_should_expire_now(rend_intro_point_t *intro, - time_t now); -static int rend_service_derive_key_digests(struct rend_service_t *s); -static int rend_service_load_keys(struct rend_service_t *s); -static int rend_service_load_auth_keys(struct rend_service_t *s, - const char *hfname); -static struct rend_service_t *rend_service_get_by_pk_digest( - const char* digest); -static struct rend_service_t *rend_service_get_by_service_id(const char *id); -static const char *rend_service_escaped_dir( - const struct rend_service_t *s); - -static ssize_t rend_service_parse_intro_for_v0_or_v1( - rend_intro_cell_t *intro, - const uint8_t *buf, - size_t plaintext_len, - char **err_msg_out); -static ssize_t rend_service_parse_intro_for_v2( - rend_intro_cell_t *intro, - const uint8_t *buf, - size_t plaintext_len, - char **err_msg_out); -static ssize_t rend_service_parse_intro_for_v3( - rend_intro_cell_t *intro, - const uint8_t *buf, - size_t plaintext_len, - char **err_msg_out); - -static int rend_service_check_private_dir(const or_options_t *options, - const rend_service_t *s, - int create); -static const smartlist_t* rend_get_service_list( - const smartlist_t* substitute_service_list); -static smartlist_t* rend_get_service_list_mutable( - smartlist_t* substitute_service_list); -static int rend_max_intro_circs_per_period(unsigned int n_intro_points_wanted); - -/* Hidden service directory file names: - * new file names should be added to rend_service_add_filenames_to_list() - * for sandboxing purposes. */ -static const char *private_key_fname = "private_key"; -static const char *hostname_fname = "hostname"; -static const char *client_keys_fname = "client_keys"; -static const char *sos_poison_fname = "onion_service_non_anonymous"; - -/** A list of rend_service_t's for services run on this OP. */ -static smartlist_t *rend_service_list = NULL; -/** A list of rend_service_t's for services run on this OP which is used as a - * staging area before they are put in the main list in order to prune dying - * service on config reload. */ -static smartlist_t *rend_service_staging_list = NULL; - -/** Helper: log the deprecation warning for version 2 only once. */ -static void -log_once_deprecation_warning(void) -{ - static bool logged_once = false; - if (!logged_once) { - log_warn(LD_REND, "DEPRECATED: Onion service version 2 are deprecated. " - "Please use version 3 which is the default now. " - "Currently, version 2 is planned to be obsolete in " - "the Tor version 0.4.6 stable series."); - logged_once = true; - } -} -/** Macro to make it very explicit that we are warning about deprecation. */ -#define WARN_ONCE_DEPRECATION() log_once_deprecation_warning() - -/* Like rend_get_service_list_mutable, but returns a read-only list. */ -static const smartlist_t* -rend_get_service_list(const smartlist_t* substitute_service_list) -{ - /* It is safe to cast away the const here, because - * rend_get_service_list_mutable does not actually modify the list */ - return rend_get_service_list_mutable((smartlist_t*)substitute_service_list); -} - -/* Return a mutable list of hidden services. - * If substitute_service_list is not NULL, return it. - * Otherwise, check if the global rend_service_list is non-NULL, and if so, - * return it. - * Otherwise, log a BUG message and return NULL. - * */ -static smartlist_t* -rend_get_service_list_mutable(smartlist_t* substitute_service_list) -{ - if (substitute_service_list) { - return substitute_service_list; - } - - /* If no special service list is provided, then just use the global one. */ - - if (BUG(!rend_service_list)) { - /* No global HS list, which is a programmer error. */ - return NULL; - } - - return rend_service_list; -} - -/** Tells if onion service <b>s</b> is ephemeral. - */ -static unsigned int -rend_service_is_ephemeral(const struct rend_service_t *s) -{ - return (s->directory == NULL); -} - -/** Returns a escaped string representation of the service, <b>s</b>. - */ -static const char * -rend_service_escaped_dir(const struct rend_service_t *s) -{ - return rend_service_is_ephemeral(s) ? "[EPHEMERAL]" : escaped(s->directory); -} - -/** Return the number of rendezvous services we have configured. */ -int -rend_num_services(void) -{ - if (!rend_service_list) - return 0; - return smartlist_len(rend_service_list); -} - -/** Helper: free storage held by a single service authorized client entry. */ -void -rend_authorized_client_free_(rend_authorized_client_t *client) -{ - if (!client) - return; - if (client->client_key) - crypto_pk_free(client->client_key); - if (client->client_name) - memwipe(client->client_name, 0, strlen(client->client_name)); - tor_free(client->client_name); - memwipe(client->descriptor_cookie, 0, sizeof(client->descriptor_cookie)); - tor_free(client); -} - -/** Helper for strmap_free. */ -static void -rend_authorized_client_free_void(void *authorized_client) -{ - rend_authorized_client_free_(authorized_client); -} - -/** Release the storage held by <b>service</b>. - */ -STATIC void -rend_service_free_(rend_service_t *service) -{ - if (!service) - return; - - tor_free(service->directory); - if (service->ports) { - SMARTLIST_FOREACH(service->ports, rend_service_port_config_t*, p, - rend_service_port_config_free(p)); - smartlist_free(service->ports); - } - if (service->private_key) - crypto_pk_free(service->private_key); - if (service->intro_nodes) { - SMARTLIST_FOREACH(service->intro_nodes, rend_intro_point_t *, intro, - rend_intro_point_free(intro);); - smartlist_free(service->intro_nodes); - } - if (service->expiring_nodes) { - SMARTLIST_FOREACH(service->expiring_nodes, rend_intro_point_t *, intro, - rend_intro_point_free(intro);); - smartlist_free(service->expiring_nodes); - } - - rend_service_descriptor_free(service->desc); - if (service->clients) { - SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, c, - rend_authorized_client_free(c);); - smartlist_free(service->clients); - } - if (service->accepted_intro_dh_parts) { - replaycache_free(service->accepted_intro_dh_parts); - } - tor_free(service); -} - -/* Release all the storage held in rend_service_staging_list. */ -void -rend_service_free_staging_list(void) -{ - if (rend_service_staging_list) { - SMARTLIST_FOREACH(rend_service_staging_list, rend_service_t*, ptr, - rend_service_free(ptr)); - smartlist_free(rend_service_staging_list); - rend_service_staging_list = NULL; - } -} - -/** Release all the storage held in both rend_service_list and - * rend_service_staging_list. */ -void -rend_service_free_all(void) -{ - if (rend_service_list) { - SMARTLIST_FOREACH(rend_service_list, rend_service_t*, ptr, - rend_service_free(ptr)); - smartlist_free(rend_service_list); - rend_service_list = NULL; - } - rend_service_free_staging_list(); -} - -/* Initialize the subsystem. */ -void -rend_service_init(void) -{ - tor_assert(!rend_service_list); - tor_assert(!rend_service_staging_list); - - rend_service_list = smartlist_new(); - rend_service_staging_list = smartlist_new(); -} - -/* Validate a <b>service</b>. Use the <b>service_list</b> to make sure there - * is no duplicate entry for the given service object. Return 0 if valid else - * -1 if not.*/ -static int -rend_validate_service(const smartlist_t *service_list, - const rend_service_t *service) -{ - tor_assert(service_list); - tor_assert(service); - - if (service->max_streams_per_circuit < 0) { - log_warn(LD_CONFIG, "Hidden service (%s) configured with negative max " - "streams per circuit.", - rend_service_escaped_dir(service)); - goto invalid; - } - - if (service->max_streams_close_circuit < 0 || - service->max_streams_close_circuit > 1) { - log_warn(LD_CONFIG, "Hidden service (%s) configured with invalid " - "max streams handling.", - rend_service_escaped_dir(service)); - goto invalid; - } - - if (service->auth_type != REND_NO_AUTH && - (!service->clients || smartlist_len(service->clients) == 0)) { - log_warn(LD_CONFIG, "Hidden service (%s) with client authorization but " - "no clients.", - rend_service_escaped_dir(service)); - goto invalid; - } - - if (!service->ports || !smartlist_len(service->ports)) { - log_warn(LD_CONFIG, "Hidden service (%s) with no ports configured.", - rend_service_escaped_dir(service)); - goto invalid; - } - - /* Valid. */ - return 0; - invalid: - return -1; -} - -/** Add it to <b>service_list</b>, or to the global rend_service_list if - * <b>service_list</b> is NULL. Return 0 on success. On failure, free - * <b>service</b> and return -1. Takes ownership of <b>service</b>. */ -static int -rend_add_service(smartlist_t *service_list, rend_service_t *service) -{ - int i; - rend_service_port_config_t *p; - - tor_assert(service); - - smartlist_t *s_list = rend_get_service_list_mutable(service_list); - /* We must have a service list, even if it's a temporary one, so we can - * check for duplicate services */ - if (BUG(!s_list)) { - rend_service_free(service); - return -1; - } - - service->intro_nodes = smartlist_new(); - service->expiring_nodes = smartlist_new(); - - log_debug(LD_REND,"Configuring service with directory %s", - rend_service_escaped_dir(service)); - for (i = 0; i < smartlist_len(service->ports); ++i) { - p = smartlist_get(service->ports, i); - if (!(p->is_unix_addr)) { - log_debug(LD_REND, - "Service maps port %d to %s", - p->virtual_port, - fmt_addrport(&p->real_addr, p->real_port)); - } else { -#ifdef HAVE_SYS_UN_H - log_debug(LD_REND, - "Service maps port %d to socket at \"%s\"", - p->virtual_port, p->unix_addr); -#else - log_warn(LD_BUG, - "Service maps port %d to an AF_UNIX socket, but we " - "have no AF_UNIX support on this platform. This is " - "probably a bug.", - p->virtual_port); - rend_service_free(service); - return -1; -#endif /* defined(HAVE_SYS_UN_H) */ - } - } - /* The service passed all the checks */ - tor_assert(s_list); - smartlist_add(s_list, service); - - /* Notify that our global service list has changed only if this new service - * went into our global list. If not, when we move service from the staging - * list to the new list, a notify is triggered. */ - if (s_list == rend_service_list) { - hs_service_map_has_changed(); - } - return 0; -} - -/** Return a new rend_service_port_config_t with its path set to - * <b>socket_path</b> or empty if <b>socket_path</b> is NULL */ -static rend_service_port_config_t * -rend_service_port_config_new(const char *socket_path) -{ - if (!socket_path) - return tor_malloc_zero(sizeof(rend_service_port_config_t) + 1); - - const size_t pathlen = strlen(socket_path) + 1; - rend_service_port_config_t *conf = - tor_malloc_zero(sizeof(rend_service_port_config_t) + pathlen); - memcpy(conf->unix_addr, socket_path, pathlen); - conf->is_unix_addr = 1; - return conf; -} - -/** Parses a virtual-port to real-port/socket mapping separated by - * the provided separator and returns a new rend_service_port_config_t, - * or NULL and an optional error string on failure. - * - * The format is: VirtualPort SEP (IP|RealPort|IP:RealPort|'socket':path)? - * - * IP defaults to 127.0.0.1; RealPort defaults to VirtualPort. - */ -rend_service_port_config_t * -rend_service_parse_port_config(const char *string, const char *sep, - char **err_msg_out) -{ - smartlist_t *sl; - int virtport; - int realport = 0; - uint16_t p; - tor_addr_t addr; - rend_service_port_config_t *result = NULL; - unsigned int is_unix_addr = 0; - const char *socket_path = NULL; - char *err_msg = NULL; - char *addrport = NULL; - - sl = smartlist_new(); - smartlist_split_string(sl, string, sep, - SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 2); - if (smartlist_len(sl) < 1 || BUG(smartlist_len(sl) > 2)) { - err_msg = tor_strdup("Bad syntax in hidden service port configuration."); - goto err; - } - virtport = (int)tor_parse_long(smartlist_get(sl,0), 10, 1, 65535, NULL,NULL); - if (!virtport) { - tor_asprintf(&err_msg, "Missing or invalid port %s in hidden service " - "port configuration", escaped(smartlist_get(sl,0))); - - goto err; - } - if (smartlist_len(sl) == 1) { - /* No addr:port part; use default. */ - realport = virtport; - tor_addr_from_ipv4h(&addr, 0x7F000001u); /* 127.0.0.1 */ - } else { - int ret; - - const char *addrport_element = smartlist_get(sl,1); - const char *rest = NULL; - int is_unix; - ret = port_cfg_line_extract_addrport(addrport_element, &addrport, - &is_unix, &rest); - - if (ret < 0) { - tor_asprintf(&err_msg, "Couldn't process address <%s> from hidden " - "service configuration", addrport_element); - goto err; - } - - if (rest && strlen(rest)) { - err_msg = tor_strdup("HiddenServicePort parse error: invalid port " - "mapping"); - goto err; - } - - if (is_unix) { - socket_path = addrport; - is_unix_addr = 1; - } else if (strchr(addrport, ':') || strchr(addrport, '.')) { - /* else try it as an IP:port pair if it has a : or . in it */ - if (tor_addr_port_lookup(addrport, &addr, &p)<0) { - err_msg = tor_strdup("Unparseable address in hidden service port " - "configuration."); - goto err; - } - realport = p?p:virtport; - } else { - /* No addr:port, no addr -- must be port. */ - realport = (int)tor_parse_long(addrport, 10, 1, 65535, NULL, NULL); - if (!realport) { - tor_asprintf(&err_msg, "Unparseable or out-of-range port %s in " - "hidden service port configuration.", - escaped(addrport)); - goto err; - } - tor_addr_from_ipv4h(&addr, 0x7F000001u); /* Default to 127.0.0.1 */ - } - } - - /* Allow room for unix_addr */ - result = rend_service_port_config_new(socket_path); - result->virtual_port = virtport; - result->is_unix_addr = is_unix_addr; - if (!is_unix_addr) { - result->real_port = realport; - tor_addr_copy(&result->real_addr, &addr); - result->unix_addr[0] = '\0'; - } - - err: - tor_free(addrport); - if (err_msg_out != NULL) { - *err_msg_out = err_msg; - } else { - tor_free(err_msg); - } - SMARTLIST_FOREACH(sl, char *, c, tor_free(c)); - smartlist_free(sl); - - return result; -} - -/** Release all storage held in a rend_service_port_config_t. */ -void -rend_service_port_config_free_(rend_service_port_config_t *p) -{ - tor_free(p); -} - -/* Copy relevant data from service src to dst while pruning the service lists. - * This should only be called during the pruning process which takes existing - * services and copy their data to the newly configured services. The src - * service replaycache will be set to NULL after this call. */ -static void -copy_service_on_prunning(rend_service_t *dst, rend_service_t *src) -{ - tor_assert(dst); - tor_assert(src); - - /* Keep the timestamps for when the content changed and the next upload - * time so we can properly upload the descriptor if needed for the new - * service object. */ - dst->desc_is_dirty = src->desc_is_dirty; - dst->next_upload_time = src->next_upload_time; - /* Move the replaycache to the new object. */ - dst->accepted_intro_dh_parts = src->accepted_intro_dh_parts; - src->accepted_intro_dh_parts = NULL; - /* Copy intro point information to destination service. */ - dst->intro_period_started = src->intro_period_started; - dst->n_intro_circuits_launched = src->n_intro_circuits_launched; - dst->n_intro_points_wanted = src->n_intro_points_wanted; -} - -/* Helper: Actual implementation of the pruning on reload which we've - * decoupled in order to make the unit test workeable without ugly hacks. - * Furthermore, this function does NOT free any memory but will nullify the - * temporary list pointer whatever happens. */ -STATIC void -rend_service_prune_list_impl_(void) -{ - origin_circuit_t *ocirc = NULL; - smartlist_t *surviving_services, *old_service_list, *new_service_list; - - /* When pruning our current service list, we must have a staging list that - * contains what we want to check else it's a code flow error. */ - tor_assert(rend_service_staging_list); - - /* We are about to prune the current list of its dead service so set the - * semantic for that list to be the "old" one. */ - old_service_list = rend_service_list; - /* The staging list is now the "new" list so set this semantic. */ - new_service_list = rend_service_staging_list; - /* After this, whatever happens, we'll use our new list. */ - rend_service_list = new_service_list; - /* Finally, nullify the staging list pointer as we don't need it anymore - * and it needs to be NULL before the next reload. */ - rend_service_staging_list = NULL; - /* Nothing to prune if we have no service list so stop right away. */ - if (!old_service_list) { - return; - } - - /* This contains all _existing_ services that survives the relaod that is - * that haven't been removed from the configuration. The difference between - * this list and the new service list is that the new list can possibly - * contain newly configured service that have no introduction points opened - * yet nor key material loaded or generated. */ - surviving_services = smartlist_new(); - - /* Preserve the existing ephemeral services. - * - * This is the ephemeral service equivalent of the "Copy introduction - * points to new services" block, except there's no copy required since - * the service structure isn't regenerated. - * - * After this is done, all ephemeral services will be: - * * Removed from old_service_list, so the equivalent non-ephemeral code - * will not attempt to preserve them. - * * Added to the new_service_list (that previously only had the - * services listed in the configuration). - * * Added to surviving_services, which is the list of services that - * will NOT have their intro point closed. - */ - SMARTLIST_FOREACH_BEGIN(old_service_list, rend_service_t *, old) { - if (rend_service_is_ephemeral(old)) { - SMARTLIST_DEL_CURRENT(old_service_list, old); - smartlist_add(surviving_services, old); - smartlist_add(new_service_list, old); - } - } SMARTLIST_FOREACH_END(old); - - /* Copy introduction points to new services. This is O(n^2), but it's only - * called on reconfigure, so it's ok performance wise. */ - SMARTLIST_FOREACH_BEGIN(new_service_list, rend_service_t *, new) { - SMARTLIST_FOREACH_BEGIN(old_service_list, rend_service_t *, old) { - /* Skip ephemeral services as we only want to copy introduction points - * from current services to newly configured one that already exists. - * The same directory means it's the same service. */ - if (rend_service_is_ephemeral(new) || rend_service_is_ephemeral(old) || - strcmp(old->directory, new->directory)) { - continue; - } - smartlist_add_all(new->intro_nodes, old->intro_nodes); - smartlist_clear(old->intro_nodes); - smartlist_add_all(new->expiring_nodes, old->expiring_nodes); - smartlist_clear(old->expiring_nodes); - - /* Copy needed information from old to new. */ - copy_service_on_prunning(new, old); - - /* This regular service will survive the closing IPs step after. */ - smartlist_add(surviving_services, old); - break; - } SMARTLIST_FOREACH_END(old); - } SMARTLIST_FOREACH_END(new); - - /* For every service introduction circuit we can find, see if we have a - * matching surviving configured service. If not, close the circuit. */ - while ((ocirc = circuit_get_next_intro_circ(ocirc, false))) { - int keep_it = 0; - if (ocirc->rend_data == NULL) { - /* This is a v3 circuit, ignore it. */ - continue; - } - SMARTLIST_FOREACH_BEGIN(surviving_services, const rend_service_t *, s) { - if (rend_circuit_pk_digest_eq(ocirc, (uint8_t *) s->pk_digest)) { - /* Keep this circuit as we have a matching configured service. */ - keep_it = 1; - break; - } - } SMARTLIST_FOREACH_END(s); - if (keep_it) { - continue; - } - log_info(LD_REND, "Closing intro point %s for service %s.", - safe_str_client(extend_info_describe( - ocirc->build_state->chosen_exit)), - safe_str_client(rend_data_get_address(ocirc->rend_data))); - /* Reason is FINISHED because service has been removed and thus the - * circuit is considered old/unneeded. */ - circuit_mark_for_close(TO_CIRCUIT(ocirc), END_CIRC_REASON_FINISHED); - } - smartlist_free(surviving_services); - /* Notify that our global service list has changed. */ - hs_service_map_has_changed(); -} - -/* Try to prune our main service list using the temporary one that we just - * loaded and parsed successfully. The pruning process decides which onion - * services to keep and which to discard after a reload. */ -void -rend_service_prune_list(void) -{ - smartlist_t *old_service_list = rend_service_list; - - if (!rend_service_staging_list) { - rend_service_staging_list = smartlist_new(); - } - - rend_service_prune_list_impl_(); - if (old_service_list) { - /* Every remaining service in the old list have been removed from the - * configuration so clean them up safely. */ - SMARTLIST_FOREACH(old_service_list, rend_service_t *, s, - rend_service_free(s)); - smartlist_free(old_service_list); - } -} - -/* Copy all the relevant data that the hs_service object contains over to the - * rend_service_t object. The reason to do so is because when configuring a - * service, we go through a generic handler that creates an hs_service_t - * object which so we have to copy the parsed values to a rend service object - * which is version 2 specific. */ -static void -service_config_shadow_copy(rend_service_t *service, - hs_service_config_t *config) -{ - tor_assert(service); - tor_assert(config); - - service->directory = tor_strdup(config->directory_path); - service->dir_group_readable = config->dir_group_readable; - service->allow_unknown_ports = config->allow_unknown_ports; - /* This value can't go above HS_CONFIG_MAX_STREAMS_PER_RDV_CIRCUIT (65535) - * if the code flow is right so this cast is safe. But just in case, we'll - * check it. */ - service->max_streams_per_circuit = (int) config->max_streams_per_rdv_circuit; - if (BUG(config->max_streams_per_rdv_circuit > - HS_CONFIG_MAX_STREAMS_PER_RDV_CIRCUIT)) { - service->max_streams_per_circuit = HS_CONFIG_MAX_STREAMS_PER_RDV_CIRCUIT; - } - service->max_streams_close_circuit = config->max_streams_close_circuit; - service->n_intro_points_wanted = config->num_intro_points; - /* Switching ownership of the ports to the rend service object. */ - smartlist_add_all(service->ports, config->ports); - smartlist_free(config->ports); - config->ports = NULL; -} - -/* Parse the hidden service configuration from <b>hs_opts</b> using the - * already configured generic service configuration in <b>config</b>. This - * function will translate the config object to a rend_service_t and add it to - * the temporary list if valid. If <b>validate_only</b> is set, parse, warn - * and return as normal but don't actually add the service to the list. */ -int -rend_config_service(const hs_opts_t *hs_opts, - const or_options_t *options, - hs_service_config_t *config) -{ - rend_service_t *service = NULL; - - tor_assert(options); - tor_assert(hs_opts); - tor_assert(config); - - /* We are about to configure a version 2 service. Warn of deprecation. */ - WARN_ONCE_DEPRECATION(); - - /* Use the staging service list so that we can check then do the pruning - * process using the main list at the end. */ - if (rend_service_staging_list == NULL) { - rend_service_staging_list = smartlist_new(); - } - - /* Initialize service. */ - service = tor_malloc_zero(sizeof(rend_service_t)); - service->intro_period_started = time(NULL); - service->ports = smartlist_new(); - /* From the hs_service object which has been used to load the generic - * options, we'll copy over the useful data to the rend_service_t object. */ - service_config_shadow_copy(service, config); - - /* Number of introduction points. */ - if (hs_opts->HiddenServiceNumIntroductionPoints > NUM_INTRO_POINTS_MAX) { - log_warn(LD_CONFIG, "HiddenServiceNumIntroductionPoints must be " - "between 0 and %d, not %d.", - NUM_INTRO_POINTS_MAX, - hs_opts->HiddenServiceNumIntroductionPoints); - goto err; - } - service->n_intro_points_wanted = hs_opts->HiddenServiceNumIntroductionPoints; - log_info(LD_CONFIG, "HiddenServiceNumIntroductionPoints=%d for %s", - service->n_intro_points_wanted, escaped(service->directory)); - - /* Client authorization */ - if (hs_opts->HiddenServiceAuthorizeClient) { - /* Parse auth type and comma-separated list of client names and add a - * rend_authorized_client_t for each client to the service's list - * of authorized clients. */ - smartlist_t *type_names_split, *clients; - const char *authname; - type_names_split = smartlist_new(); - smartlist_split_string(type_names_split, - hs_opts->HiddenServiceAuthorizeClient, " ", 0, 2); - if (smartlist_len(type_names_split) < 1) { - log_warn(LD_BUG, "HiddenServiceAuthorizeClient has no value. This " - "should have been prevented when parsing the " - "configuration."); - smartlist_free(type_names_split); - goto err; - } - authname = smartlist_get(type_names_split, 0); - if (!strcasecmp(authname, "basic")) { - service->auth_type = REND_BASIC_AUTH; - } else if (!strcasecmp(authname, "stealth")) { - service->auth_type = REND_STEALTH_AUTH; - } else { - log_warn(LD_CONFIG, "HiddenServiceAuthorizeClient contains " - "unrecognized auth-type '%s'. Only 'basic' or 'stealth' " - "are recognized.", - (char *) smartlist_get(type_names_split, 0)); - SMARTLIST_FOREACH(type_names_split, char *, cp, tor_free(cp)); - smartlist_free(type_names_split); - goto err; - } - service->clients = smartlist_new(); - if (smartlist_len(type_names_split) < 2) { - log_warn(LD_CONFIG, "HiddenServiceAuthorizeClient contains " - "auth-type '%s', but no client names.", - service->auth_type == REND_BASIC_AUTH ? "basic" : "stealth"); - SMARTLIST_FOREACH(type_names_split, char *, cp, tor_free(cp)); - smartlist_free(type_names_split); - goto err; - } - clients = smartlist_new(); - smartlist_split_string(clients, smartlist_get(type_names_split, 1), - ",", SPLIT_SKIP_SPACE, 0); - SMARTLIST_FOREACH(type_names_split, char *, cp, tor_free(cp)); - smartlist_free(type_names_split); - /* Remove duplicate client names. */ - { - int num_clients = smartlist_len(clients); - smartlist_sort_strings(clients); - smartlist_uniq_strings(clients); - if (smartlist_len(clients) < num_clients) { - log_info(LD_CONFIG, "HiddenServiceAuthorizeClient contains %d " - "duplicate client name(s); removing.", - num_clients - smartlist_len(clients)); - } - } - SMARTLIST_FOREACH_BEGIN(clients, const char *, client_name) { - rend_authorized_client_t *client; - if (!rend_valid_client_name(client_name)) { - log_warn(LD_CONFIG, "HiddenServiceAuthorizeClient contains an " - "illegal client name: '%s'. Names must be " - "between 1 and %d characters and contain " - "only [A-Za-z0-9+_-].", - client_name, REND_CLIENTNAME_MAX_LEN); - SMARTLIST_FOREACH(clients, char *, cp, tor_free(cp)); - smartlist_free(clients); - goto err; - } - client = tor_malloc_zero(sizeof(rend_authorized_client_t)); - client->client_name = tor_strdup(client_name); - smartlist_add(service->clients, client); - log_debug(LD_REND, "Adding client name '%s'", client_name); - } SMARTLIST_FOREACH_END(client_name); - SMARTLIST_FOREACH(clients, char *, cp, tor_free(cp)); - smartlist_free(clients); - /* Ensure maximum number of clients. */ - if ((service->auth_type == REND_BASIC_AUTH && - smartlist_len(service->clients) > 512) || - (service->auth_type == REND_STEALTH_AUTH && - smartlist_len(service->clients) > 16)) { - log_warn(LD_CONFIG, "HiddenServiceAuthorizeClient contains %d " - "client authorization entries, but only a " - "maximum of %d entries is allowed for " - "authorization type '%s'.", - smartlist_len(service->clients), - service->auth_type == REND_BASIC_AUTH ? 512 : 16, - service->auth_type == REND_BASIC_AUTH ? "basic" : "stealth"); - goto err; - } - } - - /* Validate the service just parsed. */ - if (rend_validate_service(rend_service_staging_list, service) < 0) { - /* Service is in the staging list so don't try to free it. */ - goto err; - } - - /* Add it to the temporary list which we will use to prune our current - * list if any after configuring all services. */ - if (rend_add_service(rend_service_staging_list, service) < 0) { - /* The object has been freed on error already. */ - service = NULL; - goto err; - } - - return 0; - err: - rend_service_free(service); - return -1; -} - -/** Add the ephemeral service <b>pk</b>/<b>ports</b> if possible, using - * client authorization <b>auth_type</b> and an optional list of - * rend_authorized_client_t in <b>auth_clients</b>, with - * <b>max_streams_per_circuit</b> streams allowed per rendezvous circuit, - * and circuit closure on max streams being exceeded set by - * <b>max_streams_close_circuit</b>. - * - * Ownership of pk, ports, and auth_clients is passed to this routine. - * Regardless of success/failure, callers should not touch these values - * after calling this routine, and may assume that correct cleanup has - * been done on failure. - * - * Return an appropriate hs_service_add_ephemeral_status_t. - */ -hs_service_add_ephemeral_status_t -rend_service_add_ephemeral(crypto_pk_t *pk, - smartlist_t *ports, - int max_streams_per_circuit, - int max_streams_close_circuit, - rend_auth_type_t auth_type, - smartlist_t *auth_clients, - char **service_id_out) -{ - *service_id_out = NULL; - /* Allocate the service structure, and initialize the key, and key derived - * parameters. - */ - rend_service_t *s = tor_malloc_zero(sizeof(rend_service_t)); - s->directory = NULL; /* This indicates the service is ephemeral. */ - s->private_key = pk; - s->auth_type = auth_type; - s->clients = auth_clients; - s->ports = ports; - s->intro_period_started = time(NULL); - s->n_intro_points_wanted = NUM_INTRO_POINTS_DEFAULT; - s->max_streams_per_circuit = max_streams_per_circuit; - s->max_streams_close_circuit = max_streams_close_circuit; - if (rend_service_derive_key_digests(s) < 0) { - rend_service_free(s); - return RSAE_BADPRIVKEY; - } - - if (!s->ports || smartlist_len(s->ports) == 0) { - log_warn(LD_CONFIG, "At least one VIRTPORT/TARGET must be specified."); - rend_service_free(s); - return RSAE_BADVIRTPORT; - } - if (s->auth_type != REND_NO_AUTH && - (!s->clients || smartlist_len(s->clients) == 0)) { - log_warn(LD_CONFIG, "At least one authorized client must be specified."); - rend_service_free(s); - return RSAE_BADAUTH; - } - - /* Enforcing pk/id uniqueness should be done by rend_service_load_keys(), but - * it's not, see #14828. - */ - if (rend_service_get_by_pk_digest(s->pk_digest)) { - log_warn(LD_CONFIG, "Onion Service private key collides with an " - "existing service."); - rend_service_free(s); - return RSAE_ADDREXISTS; - } - if (rend_service_get_by_service_id(s->service_id)) { - log_warn(LD_CONFIG, "Onion Service id collides with an existing service."); - rend_service_free(s); - return RSAE_ADDREXISTS; - } - - /* Initialize the service. */ - if (rend_add_service(NULL, s)) { - return RSAE_INTERNAL; - } - *service_id_out = tor_strdup(s->service_id); - - log_debug(LD_CONFIG, "Added ephemeral Onion Service: %s", s->service_id); - return RSAE_OKAY; -} - -/** Remove the ephemeral service <b>service_id</b> if possible. Returns 0 on - * success, and -1 on failure. - */ -int -rend_service_del_ephemeral(const char *service_id) -{ - rend_service_t *s; - if (!rend_valid_v2_service_id(service_id)) { - log_warn(LD_CONFIG, "Requested malformed Onion Service id for removal."); - return -1; - } - if ((s = rend_service_get_by_service_id(service_id)) == NULL) { - log_warn(LD_CONFIG, "Requested non-existent Onion Service id for " - "removal."); - return -1; - } - if (!rend_service_is_ephemeral(s)) { - log_warn(LD_CONFIG, "Requested non-ephemeral Onion Service for removal."); - return -1; - } - - /* Kill the intro point circuit for the Onion Service, and remove it from - * the list. Closing existing connections is the application's problem. - * - * XXX: As with the comment in rend_config_services(), a nice abstraction - * would be ideal here, but for now just duplicate the code. - */ - SMARTLIST_FOREACH_BEGIN(circuit_get_global_list(), circuit_t *, circ) { - if (!circ->marked_for_close && - (circ->purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO || - circ->purpose == CIRCUIT_PURPOSE_S_INTRO)) { - origin_circuit_t *oc = TO_ORIGIN_CIRCUIT(circ); - if (oc->rend_data == NULL || - !rend_circuit_pk_digest_eq(oc, (uint8_t *) s->pk_digest)) { - continue; - } - log_debug(LD_REND, "Closing intro point %s for service %s.", - safe_str_client(extend_info_describe( - oc->build_state->chosen_exit)), - rend_data_get_address(oc->rend_data)); - circuit_mark_for_close(circ, END_CIRC_REASON_FINISHED); - } - } SMARTLIST_FOREACH_END(circ); - smartlist_remove(rend_service_list, s); - /* Notify that we just removed a service from our global list. */ - hs_service_map_has_changed(); - rend_service_free(s); - - log_debug(LD_CONFIG, "Removed ephemeral Onion Service: %s", service_id); - - return 0; -} - -/* There can be 1 second's delay due to second_elapsed_callback, and perhaps - * another few seconds due to blocking calls. */ -#define INTRO_CIRC_RETRY_PERIOD_SLOP 10 - -/** Log information about the intro point creation rate and current intro - * points for service, upgrading the log level from min_severity to warn if - * we have stopped launching new intro point circuits. */ -static void -rend_log_intro_limit(const rend_service_t *service, int min_severity) -{ - int exceeded_limit = (service->n_intro_circuits_launched >= - rend_max_intro_circs_per_period( - service->n_intro_points_wanted)); - int severity = min_severity; - /* We stopped creating circuits */ - if (exceeded_limit) { - severity = LOG_WARN; - } - time_t intro_period_elapsed = time(NULL) - service->intro_period_started; - tor_assert_nonfatal(intro_period_elapsed >= 0); - { - char *msg; - static ratelim_t rlimit = RATELIM_INIT(INTRO_CIRC_RETRY_PERIOD); - if ((msg = rate_limit_log(&rlimit, approx_time()))) { - log_fn(severity, LD_REND, - "Hidden service %s %s %d intro points in the last %d seconds. " - "Intro circuit launches are limited to %d per %d seconds.%s", - service->service_id, - exceeded_limit ? "exceeded launch limit with" : "launched", - service->n_intro_circuits_launched, - (int)intro_period_elapsed, - rend_max_intro_circs_per_period(service->n_intro_points_wanted), - INTRO_CIRC_RETRY_PERIOD, msg); - rend_service_dump_stats(severity); - tor_free(msg); - } - } -} - -/** Replace the old value of <b>service</b>-\>desc with one that reflects - * the other fields in service. - */ -static void -rend_service_update_descriptor(rend_service_t *service) -{ - rend_service_descriptor_t *d; - int i; - - rend_service_descriptor_free(service->desc); - service->desc = NULL; - - d = service->desc = tor_malloc_zero(sizeof(rend_service_descriptor_t)); - d->pk = crypto_pk_dup_key(service->private_key); - d->timestamp = time(NULL); - d->timestamp -= d->timestamp % 3600; /* Round down to nearest hour */ - d->intro_nodes = smartlist_new(); - /* Support intro protocols 2 and 3. */ - d->protocols = (1 << 2) + (1 << 3); - - for (i = 0; i < smartlist_len(service->intro_nodes); ++i) { - rend_intro_point_t *intro_svc = smartlist_get(service->intro_nodes, i); - rend_intro_point_t *intro_desc; - - /* This intro point won't be listed in the descriptor... */ - intro_svc->listed_in_last_desc = 0; - - /* circuit_established is set in rend_service_intro_established(), and - * checked every second in rend_consider_services_intro_points(), so it's - * safe to use it here */ - if (!intro_svc->circuit_established) { - continue; - } - - /* ...unless this intro point is listed in the descriptor. */ - intro_svc->listed_in_last_desc = 1; - - /* We have an entirely established intro circuit. Publish it in - * our descriptor. */ - intro_desc = tor_malloc_zero(sizeof(rend_intro_point_t)); - intro_desc->extend_info = extend_info_dup(intro_svc->extend_info); - if (intro_svc->intro_key) - intro_desc->intro_key = crypto_pk_dup_key(intro_svc->intro_key); - smartlist_add(d->intro_nodes, intro_desc); - - if (intro_svc->time_published == -1) { - /* We are publishing this intro point in a descriptor for the - * first time -- note the current time in the service's copy of - * the intro point. */ - intro_svc->time_published = time(NULL); - } - } - - /* Check that we have the right number of intro points */ - unsigned int have_intro = (unsigned int)smartlist_len(d->intro_nodes); - if (have_intro != service->n_intro_points_wanted) { - int severity; - /* Getting less than we wanted or more than we're allowed is serious */ - if (have_intro < service->n_intro_points_wanted || - have_intro > NUM_INTRO_POINTS_MAX) { - severity = LOG_WARN; - } else { - /* Getting more than we wanted is weird, but less of a problem */ - severity = LOG_NOTICE; - } - log_fn(severity, LD_REND, "Hidden service %s wanted %d intro points, but " - "descriptor was updated with %d instead.", - service->service_id, - service->n_intro_points_wanted, have_intro); - /* Now log an informative message about how we might have got here. */ - rend_log_intro_limit(service, severity); - } -} - -/* Allocate and return a string containing the path to file_name in - * service->directory. Asserts that service has a directory. - * This function will never return NULL. - * The caller must free this path. */ -static char * -rend_service_path(const rend_service_t *service, const char *file_name) -{ - tor_assert(service->directory); - return hs_path_from_filename(service->directory, file_name); -} - -/* Allocate and return a string containing the path to the single onion - * service poison file in service->directory. Asserts that service has a - * directory. - * The caller must free this path. */ -STATIC char * -rend_service_sos_poison_path(const rend_service_t *service) -{ - return rend_service_path(service, sos_poison_fname); -} - -/** Return True if hidden services <b>service</b> has been poisoned by single - * onion mode. */ -static int -service_is_single_onion_poisoned(const rend_service_t *service) -{ - char *poison_fname = NULL; - file_status_t fstatus; - - /* Passing a NULL service is a bug */ - if (BUG(!service)) { - return 0; - } - - if (rend_service_is_ephemeral(service)) { - return 0; - } - - poison_fname = rend_service_sos_poison_path(service); - - fstatus = file_status(poison_fname); - tor_free(poison_fname); - - /* If this fname is occupied, the hidden service has been poisoned. - * fstatus can be FN_ERROR if the service directory does not exist, in that - * case, there is obviously no private key. */ - if (fstatus == FN_FILE || fstatus == FN_EMPTY) { - return 1; - } - - return 0; -} - -/* Return 1 if the private key file for service exists and has a non-zero size, - * and 0 otherwise. */ -static int -rend_service_private_key_exists(const rend_service_t *service) -{ - char *private_key_path = rend_service_path(service, private_key_fname); - const file_status_t private_key_status = file_status(private_key_path); - tor_free(private_key_path); - /* Only non-empty regular private key files could have been used before. - * fstatus can be FN_ERROR if the service directory does not exist, in that - * case, there is obviously no private key. */ - return private_key_status == FN_FILE; -} - -/** Check the single onion service poison state of the directory for s: - * - If the service is poisoned, and we are in Single Onion Mode, - * return 0, - * - If the service is not poisoned, and we are not in Single Onion Mode, - * return 0, - * - Otherwise, the poison state is invalid: the service was created in one - * mode, and is being used in the other, return -1. - * Hidden service directories without keys are always considered consistent. - * They will be poisoned after their directory is created (if needed). */ -STATIC int -rend_service_verify_single_onion_poison(const rend_service_t* s, - const or_options_t* options) -{ - /* Passing a NULL service is a bug */ - if (BUG(!s)) { - return -1; - } - - /* Ephemeral services are checked at ADD_ONION time */ - if (BUG(rend_service_is_ephemeral(s))) { - return -1; - } - - /* Service is expected to have a directory */ - if (BUG(!s->directory)) { - return -1; - } - - /* Services without keys are always ok - their keys will only ever be used - * in the current mode */ - if (!rend_service_private_key_exists(s)) { - return 0; - } - - /* The key has been used before in a different mode */ - if (service_is_single_onion_poisoned(s) != - rend_service_non_anonymous_mode_enabled(options)) { - return -1; - } - - /* The key exists and is consistent with the current mode */ - return 0; -} - -/*** Helper for rend_service_poison_new_single_onion_dir(). Add a file to - * the hidden service directory for s that marks it as a single onion service. - * Tor must be in single onion mode before calling this function, and the - * service directory must already have been created. - * Returns 0 when a directory is successfully poisoned, or if it is already - * poisoned. Returns -1 on a failure to read the directory or write the poison - * file, or if there is an existing private key file in the directory. (The - * service should have been poisoned when the key was created.) */ -static int -poison_new_single_onion_hidden_service_dir_impl(const rend_service_t *service, - const or_options_t* options) -{ - /* Passing a NULL service is a bug */ - if (BUG(!service)) { - return -1; - } - - /* We must only poison directories if we're in Single Onion mode */ - tor_assert(rend_service_non_anonymous_mode_enabled(options)); - - int fd; - int retval = -1; - char *poison_fname = NULL; - - if (rend_service_is_ephemeral(service)) { - log_info(LD_REND, "Ephemeral HS started in non-anonymous mode."); - return 0; - } - - /* Make sure we're only poisoning new hidden service directories */ - if (rend_service_private_key_exists(service)) { - log_warn(LD_BUG, "Tried to single onion poison a service directory after " - "the private key was created."); - return -1; - } - - /* Make sure the directory was created before calling this function. */ - if (BUG(hs_check_service_private_dir(options->User, service->directory, - service->dir_group_readable, 0) < 0)) - return -1; - - poison_fname = rend_service_sos_poison_path(service); - - switch (file_status(poison_fname)) { - case FN_DIR: - case FN_ERROR: - log_warn(LD_FS, "Can't read single onion poison file \"%s\"", - poison_fname); - goto done; - case FN_FILE: /* single onion poison file already exists. NOP. */ - case FN_EMPTY: /* single onion poison file already exists. NOP. */ - log_debug(LD_FS, "Tried to re-poison a single onion poisoned file \"%s\"", - poison_fname); - break; - case FN_NOENT: - fd = tor_open_cloexec(poison_fname, O_RDWR|O_CREAT|O_TRUNC, 0600); - if (fd < 0) { - log_warn(LD_FS, "Could not create single onion poison file %s", - poison_fname); - goto done; - } - close(fd); - break; - default: - tor_assert(0); - } - - retval = 0; - - done: - tor_free(poison_fname); - - return retval; -} - -/** We just got launched in Single Onion Mode. That's a non-anonymous mode for - * hidden services. If s is new, we should mark its hidden service - * directory appropriately so that it is never launched as a location-private - * hidden service. (New directories don't have private key files.) - * Return 0 on success, -1 on fail. */ -STATIC int -rend_service_poison_new_single_onion_dir(const rend_service_t *s, - const or_options_t* options) -{ - /* Passing a NULL service is a bug */ - if (BUG(!s)) { - return -1; - } - - /* We must only poison directories if we're in Single Onion mode */ - tor_assert(rend_service_non_anonymous_mode_enabled(options)); - - /* Ephemeral services aren't allowed in non-anonymous mode */ - if (BUG(rend_service_is_ephemeral(s))) { - return -1; - } - - /* Service is expected to have a directory */ - if (BUG(!s->directory)) { - return -1; - } - - if (!rend_service_private_key_exists(s)) { - if (poison_new_single_onion_hidden_service_dir_impl(s, options) - < 0) { - return -1; - } - } - - return 0; -} - -/* Return true iff the given service identity key is present on disk. This is - * used to try to learn the service version during configuration time. */ -int -rend_service_key_on_disk(const char *directory_path) -{ - int ret = 0; - char *fname; - crypto_pk_t *pk = NULL; - - tor_assert(directory_path); - - /* Load key */ - fname = hs_path_from_filename(directory_path, private_key_fname); - pk = init_key_from_file(fname, 0, LOG_DEBUG, NULL); - if (pk) { - ret = 1; - } - - crypto_pk_free(pk); - tor_free(fname); - return ret; -} - -/** Load and/or generate private keys for all hidden services, possibly - * including keys for client authorization. - * If a <b>service_list</b> is provided, treat it as the list of hidden - * services (used in unittests). Otherwise, require that rend_service_list is - * not NULL. - * Return 0 on success, -1 on failure. */ -int -rend_service_load_all_keys(const smartlist_t *service_list) -{ - /* Use service_list for unit tests */ - const smartlist_t *s_list = rend_get_service_list(service_list); - if (BUG(!s_list)) { - return -1; - } - - SMARTLIST_FOREACH_BEGIN(s_list, rend_service_t *, s) { - if (s->private_key) - continue; - log_info(LD_REND, "Loading hidden-service keys from %s", - rend_service_escaped_dir(s)); - - if (rend_service_load_keys(s) < 0) - return -1; - } SMARTLIST_FOREACH_END(s); - - return 0; -} - -/** Add to <b>lst</b> every filename used by <b>s</b>. */ -static void -rend_service_add_filenames_to_list(smartlist_t *lst, const rend_service_t *s) -{ - tor_assert(lst); - tor_assert(s); - tor_assert(s->directory); - smartlist_add(lst, rend_service_path(s, private_key_fname)); - smartlist_add(lst, rend_service_path(s, hostname_fname)); - smartlist_add(lst, rend_service_path(s, client_keys_fname)); - smartlist_add(lst, rend_service_sos_poison_path(s)); -} - -/** Add to <b>open_lst</b> every filename used by a configured hidden service, - * and to <b>stat_lst</b> every directory used by a configured hidden - * service */ -void -rend_services_add_filenames_to_lists(smartlist_t *open_lst, - smartlist_t *stat_lst) -{ - if (!rend_service_list) - return; - SMARTLIST_FOREACH_BEGIN(rend_service_list, rend_service_t *, s) { - if (!rend_service_is_ephemeral(s)) { - rend_service_add_filenames_to_list(open_lst, s); - smartlist_add_strdup(stat_lst, s->directory); - } - } SMARTLIST_FOREACH_END(s); -} - -/** Derive all rend_service_t internal material based on the service's key. - * Returns 0 on success, -1 on failure. - */ -static int -rend_service_derive_key_digests(struct rend_service_t *s) -{ - if (rend_get_service_id(s->private_key, s->service_id)<0) { - log_warn(LD_BUG, "Internal error: couldn't encode service ID."); - return -1; - } - if (crypto_pk_get_digest(s->private_key, s->pk_digest)<0) { - log_warn(LD_BUG, "Couldn't compute hash of public key."); - return -1; - } - - return 0; -} - -/** Make sure that the directory for <b>s</b> is private, using the config in - * <b>options</b>. - * If <b>create</b> is true: - * - if the directory exists, change permissions if needed, - * - if the directory does not exist, create it with the correct permissions. - * If <b>create</b> is false: - * - if the directory exists, check permissions, - * - if the directory does not exist, check if we think we can create it. - * Return 0 on success, -1 on failure. */ -static int -rend_service_check_private_dir(const or_options_t *options, - const rend_service_t *s, - int create) -{ - /* Passing a NULL service is a bug */ - if (BUG(!s)) { - return -1; - } - - /* Check/create directory */ - if (hs_check_service_private_dir(options->User, s->directory, - s->dir_group_readable, create) < 0) { - return -1; - } - - /* Check if the hidden service key exists, and was created in a different - * single onion service mode, and refuse to launch if it has. - * This is safe to call even when create is false, as it ignores missing - * keys and directories: they are always valid. - */ - if (rend_service_verify_single_onion_poison(s, options) < 0) { - /* We can't use s->service_id here, as the key may not have been loaded */ - log_warn(LD_GENERAL, "We are configured with " - "HiddenServiceNonAnonymousMode %d, but the hidden " - "service key in directory %s was created in %s mode. " - "This is not allowed.", - rend_service_non_anonymous_mode_enabled(options) ? 1 : 0, - rend_service_escaped_dir(s), - rend_service_non_anonymous_mode_enabled(options) ? - "an anonymous" : "a non-anonymous" - ); - return -1; - } - - /* Poison new single onion directories immediately after they are created, - * so that we never accidentally launch non-anonymous hidden services - * thinking they are anonymous. Any keys created later will end up with the - * correct poisoning state. - */ - if (create && rend_service_non_anonymous_mode_enabled(options)) { - static int logged_warning = 0; - - if (rend_service_poison_new_single_onion_dir(s, options) < 0) { - log_warn(LD_GENERAL,"Failed to mark new hidden services as non-anonymous" - "."); - return -1; - } - - if (!logged_warning) { - /* The keys for these services are linked to the server IP address */ - log_notice(LD_REND, "The configured onion service directories have been " - "used in single onion mode. They can not be used for " - "anonymous hidden services."); - logged_warning = 1; - } - } - - return 0; -} - -/** Load and/or generate private keys for the hidden service <b>s</b>, - * possibly including keys for client authorization. Return 0 on success, -1 - * on failure. */ -static int -rend_service_load_keys(rend_service_t *s) -{ - char *fname = NULL; - char buf[128]; - - /* Create the directory if needed which will also poison it in case of - * single onion service. */ - if (rend_service_check_private_dir(get_options(), s, 1) < 0) - goto err; - - /* Load key */ - fname = rend_service_path(s, private_key_fname); - s->private_key = init_key_from_file(fname, 1, LOG_ERR, NULL); - - if (!s->private_key) - goto err; - - if (rend_service_derive_key_digests(s) < 0) - goto err; - - tor_free(fname); - /* Create service file */ - fname = rend_service_path(s, hostname_fname); - - tor_snprintf(buf, sizeof(buf),"%s.onion\n", s->service_id); - if (write_str_to_file_if_not_equal(fname, buf)) { - log_warn(LD_CONFIG, "Could not write onion address to hostname file."); - goto err; - } -#ifndef _WIN32 - if (s->dir_group_readable) { - /* Also verify hostname file created with group read. */ - if (chmod(fname, 0640)) - log_warn(LD_FS,"Unable to make hidden hostname file %s group-readable.", - fname); - } -#endif /* !defined(_WIN32) */ - - /* If client authorization is configured, load or generate keys. */ - if (s->auth_type != REND_NO_AUTH) { - if (rend_service_load_auth_keys(s, fname) < 0) { - goto err; - } - } - - int r = 0; - goto done; - err: - r = -1; - done: - memwipe(buf, 0, sizeof(buf)); - tor_free(fname); - return r; -} - -/** Load and/or generate client authorization keys for the hidden service - * <b>s</b>, which stores its hostname in <b>hfname</b>. Return 0 on success, - * -1 on failure. */ -static int -rend_service_load_auth_keys(rend_service_t *s, const char *hfname) -{ - int r = 0; - char *cfname = NULL; - char *client_keys_str = NULL; - strmap_t *parsed_clients = strmap_new(); - FILE *cfile, *hfile; - open_file_t *open_cfile = NULL, *open_hfile = NULL; - char desc_cook_out[3*REND_DESC_COOKIE_LEN_BASE64+1]; - char service_id[16+1]; - char buf[1500]; - - /* Load client keys and descriptor cookies, if available. */ - cfname = rend_service_path(s, client_keys_fname); - client_keys_str = read_file_to_str(cfname, RFTS_IGNORE_MISSING, NULL); - if (client_keys_str) { - if (rend_parse_client_keys(parsed_clients, client_keys_str) < 0) { - log_warn(LD_CONFIG, "Previously stored client_keys file could not " - "be parsed."); - goto err; - } else { - log_info(LD_CONFIG, "Parsed %d previously stored client entries.", - strmap_size(parsed_clients)); - } - } - - /* Prepare client_keys and hostname files. */ - if (!(cfile = start_writing_to_stdio_file(cfname, - OPEN_FLAGS_REPLACE | O_TEXT, - 0600, &open_cfile))) { - log_warn(LD_CONFIG, "Could not open client_keys file %s", - escaped(cfname)); - goto err; - } - - if (!(hfile = start_writing_to_stdio_file(hfname, - OPEN_FLAGS_REPLACE | O_TEXT, - 0600, &open_hfile))) { - log_warn(LD_CONFIG, "Could not open hostname file %s", escaped(hfname)); - goto err; - } - - /* Either use loaded keys for configured clients or generate new - * ones if a client is new. */ - SMARTLIST_FOREACH_BEGIN(s->clients, rend_authorized_client_t *, client) { - rend_authorized_client_t *parsed = - strmap_get(parsed_clients, client->client_name); - int written; - size_t len; - /* Copy descriptor cookie from parsed entry or create new one. */ - if (parsed) { - memcpy(client->descriptor_cookie, parsed->descriptor_cookie, - REND_DESC_COOKIE_LEN); - } else { - crypto_rand((char *) client->descriptor_cookie, REND_DESC_COOKIE_LEN); - } - /* For compatibility with older tor clients, this does not - * truncate the padding characters, unlike rend_auth_encode_cookie. */ - if (base64_encode(desc_cook_out, 3*REND_DESC_COOKIE_LEN_BASE64+1, - (char *) client->descriptor_cookie, - REND_DESC_COOKIE_LEN, 0) < 0) { - log_warn(LD_BUG, "Could not base64-encode descriptor cookie."); - goto err; - } - /* Copy client key from parsed entry or create new one if required. */ - if (parsed && parsed->client_key) { - client->client_key = crypto_pk_dup_key(parsed->client_key); - } else if (s->auth_type == REND_STEALTH_AUTH) { - /* Create private key for client. */ - crypto_pk_t *prkey = NULL; - if (!(prkey = crypto_pk_new())) { - log_warn(LD_BUG,"Error constructing client key"); - goto err; - } - if (crypto_pk_generate_key(prkey)) { - log_warn(LD_BUG,"Error generating client key"); - crypto_pk_free(prkey); - goto err; - } - if (! crypto_pk_is_valid_private_key(prkey)) { - log_warn(LD_BUG,"Generated client key seems invalid"); - crypto_pk_free(prkey); - goto err; - } - client->client_key = prkey; - } - /* Add entry to client_keys file. */ - written = tor_snprintf(buf, sizeof(buf), - "client-name %s\ndescriptor-cookie %s\n", - client->client_name, desc_cook_out); - if (written < 0) { - log_warn(LD_BUG, "Could not write client entry."); - goto err; - } - if (client->client_key) { - char *client_key_out = NULL; - if (crypto_pk_write_private_key_to_string(client->client_key, - &client_key_out, &len) != 0) { - log_warn(LD_BUG, "Internal error: " - "crypto_pk_write_private_key_to_string() failed."); - goto err; - } - if (rend_get_service_id(client->client_key, service_id)<0) { - log_warn(LD_BUG, "Internal error: couldn't encode service ID."); - /* - * len is string length, not buffer length, but last byte is NUL - * anyway. - */ - memwipe(client_key_out, 0, len); - tor_free(client_key_out); - goto err; - } - written = tor_snprintf(buf + written, sizeof(buf) - written, - "client-key\n%s", client_key_out); - memwipe(client_key_out, 0, len); - tor_free(client_key_out); - if (written < 0) { - log_warn(LD_BUG, "Could not write client entry."); - goto err; - } - } else { - strlcpy(service_id, s->service_id, sizeof(service_id)); - } - - if (fputs(buf, cfile) < 0) { - log_warn(LD_FS, "Could not append client entry to file: %s", - strerror(errno)); - goto err; - } - - /* Add line to hostname file. This is not the same encoding as in - * client_keys. */ - char *encoded_cookie = rend_auth_encode_cookie(client->descriptor_cookie, - s->auth_type); - if (!encoded_cookie) { - log_warn(LD_BUG, "Could not base64-encode descriptor cookie."); - goto err; - } - tor_snprintf(buf, sizeof(buf), "%s.onion %s # client: %s\n", - service_id, encoded_cookie, client->client_name); - memwipe(encoded_cookie, 0, strlen(encoded_cookie)); - tor_free(encoded_cookie); - - if (fputs(buf, hfile)<0) { - log_warn(LD_FS, "Could not append host entry to file: %s", - strerror(errno)); - goto err; - } - } SMARTLIST_FOREACH_END(client); - - finish_writing_to_file(open_cfile); - finish_writing_to_file(open_hfile); - - goto done; - err: - r = -1; - if (open_cfile) - abort_writing_to_file(open_cfile); - if (open_hfile) - abort_writing_to_file(open_hfile); - done: - if (client_keys_str) { - memwipe(client_keys_str, 0, strlen(client_keys_str)); - tor_free(client_keys_str); - } - strmap_free(parsed_clients, rend_authorized_client_free_void); - - if (cfname) { - memwipe(cfname, 0, strlen(cfname)); - tor_free(cfname); - } - - /* Clear stack buffers that held key-derived material. */ - memwipe(buf, 0, sizeof(buf)); - memwipe(desc_cook_out, 0, sizeof(desc_cook_out)); - memwipe(service_id, 0, sizeof(service_id)); - - return r; -} - -/** Return the service whose public key has a digest of <b>digest</b>, or - * NULL if no such service exists. - */ -static rend_service_t * -rend_service_get_by_pk_digest(const char* digest) -{ - SMARTLIST_FOREACH(rend_service_list, rend_service_t*, s, - if (tor_memeq(s->pk_digest,digest,DIGEST_LEN)) - return s); - return NULL; -} - -/** Return the service whose service id is <b>id</b>, or NULL if no such - * service exists. - */ -static struct rend_service_t * -rend_service_get_by_service_id(const char *id) -{ - tor_assert(strlen(id) == REND_SERVICE_ID_LEN_BASE32); - SMARTLIST_FOREACH(rend_service_list, rend_service_t*, s, { - if (tor_memeq(s->service_id, id, REND_SERVICE_ID_LEN_BASE32)) - return s; - }); - return NULL; -} - -/** Check client authorization of a given <b>descriptor_cookie</b> of - * length <b>cookie_len</b> for <b>service</b>. Return 1 for success - * and 0 for failure. */ -static int -rend_check_authorization(rend_service_t *service, - const char *descriptor_cookie, - size_t cookie_len) -{ - rend_authorized_client_t *auth_client = NULL; - tor_assert(service); - tor_assert(descriptor_cookie); - if (!service->clients) { - log_warn(LD_BUG, "Can't check authorization for a service that has no " - "authorized clients configured."); - return 0; - } - - if (cookie_len != REND_DESC_COOKIE_LEN) { - log_info(LD_REND, "Descriptor cookie is %lu bytes, but we expected " - "%lu bytes. Dropping cell.", - (unsigned long)cookie_len, (unsigned long)REND_DESC_COOKIE_LEN); - return 0; - } - - /* Look up client authorization by descriptor cookie. */ - SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, { - if (tor_memeq(client->descriptor_cookie, descriptor_cookie, - REND_DESC_COOKIE_LEN)) { - auth_client = client; - break; - } - }); - if (!auth_client) { - char descriptor_cookie_base64[3*REND_DESC_COOKIE_LEN_BASE64]; - base64_encode(descriptor_cookie_base64, sizeof(descriptor_cookie_base64), - descriptor_cookie, REND_DESC_COOKIE_LEN, 0); - log_info(LD_REND, "No authorization found for descriptor cookie '%s'! " - "Dropping cell!", - descriptor_cookie_base64); - return 0; - } - - /* Allow the request. */ - log_info(LD_REND, "Client %s authorized for service %s.", - auth_client->client_name, service->service_id); - return 1; -} - -/* Can this service make a direct connection to ei? - * It must be a single onion service, and the firewall rules must allow ei. */ -static int -rend_service_use_direct_connection(const or_options_t* options, - const extend_info_t* ei) -{ - /* We'll connect directly all reachable addresses, whether preferred or not. - * The prefer_ipv6 argument to reachable_addr_allows_addr is - * ignored, because pref_only is 0. */ - const tor_addr_port_t *ap = extend_info_get_orport(ei, AF_INET); - if (!ap) - return 0; - return (rend_service_allow_non_anonymous_connection(options) && - reachable_addr_allows_addr(&ap->addr, ap->port, - FIREWALL_OR_CONNECTION, 0, 0)); -} - -/* Like rend_service_use_direct_connection, but to a node. */ -static int -rend_service_use_direct_connection_node(const or_options_t* options, - const node_t* node) -{ - /* We'll connect directly all reachable addresses, whether preferred or not. - */ - return (rend_service_allow_non_anonymous_connection(options) && - reachable_addr_allows_node(node, FIREWALL_OR_CONNECTION, 0)); -} - -/****** - * Handle cells - ******/ - -/** Respond to an INTRODUCE2 cell by launching a circuit to the chosen - * rendezvous point. - */ -int -rend_service_receive_introduction(origin_circuit_t *circuit, - const uint8_t *request, - size_t request_len) -{ - /* Global status stuff */ - int status = 0, result; - const or_options_t *options = get_options(); - char *err_msg = NULL; - int err_msg_severity = LOG_WARN; - const char *stage_descr = NULL, *rend_pk_digest; - int reason = END_CIRC_REASON_TORPROTOCOL; - /* Service/circuit/key stuff we can learn before parsing */ - char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; - rend_service_t *service = NULL; - rend_intro_point_t *intro_point = NULL; - crypto_pk_t *intro_key = NULL; - /* Parsed cell */ - rend_intro_cell_t *parsed_req = NULL; - /* Rendezvous point */ - extend_info_t *rp = NULL; - /* XXX not handled yet */ - char buf[RELAY_PAYLOAD_SIZE]; - char keys[DIGEST_LEN+CPATH_KEY_MATERIAL_LEN]; /* Holds KH, Df, Db, Kf, Kb */ - int i; - crypto_dh_t *dh = NULL; - origin_circuit_t *launched = NULL; - crypt_path_t *cpath = NULL; - char hexcookie[9]; - int circ_needs_uptime; - time_t now = time(NULL); - time_t elapsed; - int replay; - ssize_t keylen; - - /* Do some initial validation and logging before we parse the cell */ - if (circuit->base_.purpose != CIRCUIT_PURPOSE_S_INTRO) { - log_warn(LD_PROTOCOL, - "Got an INTRODUCE2 over a non-introduction circuit %u.", - (unsigned) circuit->base_.n_circ_id); - goto err; - } - - assert_circ_anonymity_ok(circuit, options); - tor_assert(circuit->rend_data); - /* XXX: This is version 2 specific (only one supported). */ - rend_pk_digest = (char *) rend_data_get_pk_digest(circuit->rend_data, NULL); - - /* We'll use this in a bazillion log messages */ - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32+1, - rend_pk_digest, REND_SERVICE_ID_LEN); - - /* look up service depending on circuit. */ - service = rend_service_get_by_pk_digest(rend_pk_digest); - if (!service) { - log_warn(LD_BUG, - "Internal error: Got an INTRODUCE2 cell on an intro " - "circ for an unrecognized service %s.", - escaped(serviceid)); - goto err; - } - - intro_point = find_intro_point(circuit); - if (intro_point == NULL) { - intro_point = find_expiring_intro_point(service, circuit); - if (intro_point == NULL) { - log_warn(LD_BUG, - "Internal error: Got an INTRODUCE2 cell on an " - "intro circ (for service %s) with no corresponding " - "rend_intro_point_t.", - escaped(serviceid)); - goto err; - } - } - - log_info(LD_REND, "Received INTRODUCE2 cell for service %s on circ %u.", - escaped(serviceid), (unsigned)circuit->base_.n_circ_id); - - /* use intro key instead of service key. */ - intro_key = circuit->intro_key; - - tor_free(err_msg); - stage_descr = NULL; - - stage_descr = "early parsing"; - /* Early parsing pass (get pk, ciphertext); type 2 is INTRODUCE2 */ - parsed_req = - rend_service_begin_parse_intro(request, request_len, 2, &err_msg); - if (!parsed_req) { - goto log_error; - } else if (err_msg) { - log_info(LD_REND, "%s on circ %u.", err_msg, - (unsigned)circuit->base_.n_circ_id); - tor_free(err_msg); - } - - /* make sure service replay caches are present */ - if (!service->accepted_intro_dh_parts) { - service->accepted_intro_dh_parts = - replaycache_new(REND_REPLAY_TIME_INTERVAL, - REND_REPLAY_TIME_INTERVAL); - } - - if (!intro_point->accepted_intro_rsa_parts) { - intro_point->accepted_intro_rsa_parts = replaycache_new(0, 0); - } - - /* check for replay of PK-encrypted portion. */ - keylen = crypto_pk_keysize(intro_key); - replay = replaycache_add_test_and_elapsed( - intro_point->accepted_intro_rsa_parts, - parsed_req->ciphertext, MIN(parsed_req->ciphertext_len, keylen), - &elapsed); - - if (replay) { - log_warn(LD_REND, - "Possible replay detected! We received an " - "INTRODUCE2 cell with same PK-encrypted part %d " - "seconds ago. Dropping cell.", - (int)elapsed); - goto err; - } - - stage_descr = "decryption"; - /* Now try to decrypt it */ - result = rend_service_decrypt_intro(parsed_req, intro_key, &err_msg); - if (result < 0) { - goto log_error; - } else if (err_msg) { - log_info(LD_REND, "%s on circ %u.", err_msg, - (unsigned)circuit->base_.n_circ_id); - tor_free(err_msg); - } - - stage_descr = "late parsing"; - /* Parse the plaintext */ - result = rend_service_parse_intro_plaintext(parsed_req, &err_msg); - if (result < 0) { - goto log_error; - } else if (err_msg) { - log_info(LD_REND, "%s on circ %u.", err_msg, - (unsigned)circuit->base_.n_circ_id); - tor_free(err_msg); - } - - stage_descr = "late validation"; - /* Validate the parsed plaintext parts */ - result = rend_service_validate_intro_late(parsed_req, &err_msg); - if (result < 0) { - goto log_error; - } else if (err_msg) { - log_info(LD_REND, "%s on circ %u.", err_msg, - (unsigned)circuit->base_.n_circ_id); - tor_free(err_msg); - } - stage_descr = NULL; - - /* Increment INTRODUCE2 counter */ - ++(intro_point->accepted_introduce2_count); - - /* Find the rendezvous point */ - rp = find_rp_for_intro(parsed_req, &err_msg); - if (!rp) { - err_msg_severity = LOG_PROTOCOL_WARN; - goto log_error; - } - - /* Check if we'd refuse to talk to this router */ - if (options->StrictNodes && - routerset_contains_extendinfo(options->ExcludeNodes, rp)) { - log_warn(LD_REND, "Client asked to rendezvous at a relay that we " - "exclude, and StrictNodes is set. Refusing service."); - reason = END_CIRC_REASON_INTERNAL; /* XXX might leak why we refused */ - goto err; - } - - base16_encode(hexcookie, 9, (const char *)(parsed_req->rc), 4); - - /* Check whether there is a past request with the same Diffie-Hellman, - * part 1. */ - replay = replaycache_add_test_and_elapsed( - service->accepted_intro_dh_parts, - parsed_req->dh, DH1024_KEY_LEN, - &elapsed); - - if (replay) { - /* A Tor client will send a new INTRODUCE1 cell with the same rend - * cookie and DH public key as its previous one if its intro circ - * times out while in state CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT . - * If we received the first INTRODUCE1 cell (the intro-point relay - * converts it into an INTRODUCE2 cell), we are already trying to - * connect to that rend point (and may have already succeeded); - * drop this cell. */ - log_info(LD_REND, "We received an " - "INTRODUCE2 cell with same first part of " - "Diffie-Hellman handshake %d seconds ago. Dropping " - "cell.", - (int) elapsed); - goto err; - } - - /* If the service performs client authorization, check included auth data. */ - if (service->clients) { - if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) { - if (rend_check_authorization(service, - (const char*)parsed_req->u.v3.auth_data, - parsed_req->u.v3.auth_len)) { - log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid."); - } else { - log_info(LD_REND, "The authorization data that are contained in " - "the INTRODUCE2 cell are invalid. Dropping cell."); - reason = END_CIRC_REASON_CONNECTFAILED; - goto err; - } - } else { - log_info(LD_REND, "INTRODUCE2 cell does not contain authentication " - "data, but we require client authorization. Dropping cell."); - reason = END_CIRC_REASON_CONNECTFAILED; - goto err; - } - } - - /* Try DH handshake... */ - dh = crypto_dh_new(DH_TYPE_REND); - if (!dh || crypto_dh_generate_public(dh)<0) { - log_warn(LD_BUG,"Internal error: couldn't build DH state " - "or generate public key."); - reason = END_CIRC_REASON_INTERNAL; - goto err; - } - if (crypto_dh_compute_secret(LOG_PROTOCOL_WARN, dh, - (char *)(parsed_req->dh), - DH1024_KEY_LEN, keys, - DIGEST_LEN+CPATH_KEY_MATERIAL_LEN)<0) { - log_warn(LD_BUG, "Internal error: couldn't complete DH handshake"); - reason = END_CIRC_REASON_INTERNAL; - goto err; - } - - circ_needs_uptime = hs_service_requires_uptime_circ(service->ports); - - /* help predict this next time */ - rep_hist_note_used_internal(now, circ_needs_uptime, 1); - - /* Launch a circuit to the client's chosen rendezvous point. - */ - int max_rend_failures=hs_get_service_max_rend_failures(); - for (i=0;i<max_rend_failures;i++) { - int flags = CIRCLAUNCH_NEED_CAPACITY | CIRCLAUNCH_IS_INTERNAL; - if (circ_needs_uptime) flags |= CIRCLAUNCH_NEED_UPTIME; - /* A Single Onion Service only uses a direct connection if its - * firewall rules permit direct connections to the address. - * - * We only use a one-hop path on the first attempt. If the first attempt - * fails, we use a 3-hop path for reachability / reliability. - * See the comment in rend_service_relaunch_rendezvous() for details. */ - if (rend_service_use_direct_connection(options, rp) && i == 0) { - flags = flags | CIRCLAUNCH_ONEHOP_TUNNEL; - } - launched = circuit_launch_by_extend_info( - CIRCUIT_PURPOSE_S_CONNECT_REND, rp, flags); - - if (launched) - break; - } - if (!launched) { /* give up */ - log_warn(LD_REND, "Giving up launching first hop of circuit to rendezvous " - "point %s for service %s.", - safe_str_client(extend_info_describe(rp)), - serviceid); - reason = END_CIRC_REASON_CONNECTFAILED; - goto err; - } - log_info(LD_REND, - "Accepted intro; launching circuit to %s " - "(cookie %s) for service %s.", - safe_str_client(extend_info_describe(rp)), - hexcookie, serviceid); - tor_assert(launched->build_state); - /* Fill in the circuit's state. */ - - launched->rend_data = - rend_data_service_create(service->service_id, rend_pk_digest, - parsed_req->rc, service->auth_type); - - launched->build_state->service_pending_final_cpath_ref = - tor_malloc_zero(sizeof(crypt_path_reference_t)); - launched->build_state->service_pending_final_cpath_ref->refcount = 1; - - launched->build_state->service_pending_final_cpath_ref->cpath = cpath = - tor_malloc_zero(sizeof(crypt_path_t)); - cpath->magic = CRYPT_PATH_MAGIC; - launched->build_state->expiry_time = now + MAX_REND_TIMEOUT; - - cpath->rend_dh_handshake_state = dh; - dh = NULL; - if (cpath_init_circuit_crypto(cpath, - keys+DIGEST_LEN, sizeof(keys)-DIGEST_LEN, - 1, 0)<0) - goto err; - memcpy(cpath->rend_circ_nonce, keys, DIGEST_LEN); - - goto done; - - log_error: - if (!err_msg) { - if (stage_descr) { - tor_asprintf(&err_msg, - "unknown %s error for INTRODUCE2", stage_descr); - } else { - err_msg = tor_strdup("unknown error for INTRODUCE2"); - } - } - - log_fn(err_msg_severity, LD_REND, "%s on circ %u", err_msg, - (unsigned)circuit->base_.n_circ_id); - err: - status = -1; - if (dh) crypto_dh_free(dh); - if (launched) { - circuit_mark_for_close(TO_CIRCUIT(launched), reason); - } - tor_free(err_msg); - - done: - memwipe(keys, 0, sizeof(keys)); - memwipe(buf, 0, sizeof(buf)); - memwipe(serviceid, 0, sizeof(serviceid)); - memwipe(hexcookie, 0, sizeof(hexcookie)); - - /* Free the parsed cell */ - rend_service_free_intro(parsed_req); - - /* Free rp */ - extend_info_free(rp); - - return status; -} - -/** Given a parsed and decrypted INTRODUCE2, find the rendezvous point or - * return NULL and an error string if we can't. Return a newly allocated - * extend_info_t* for the rendezvous point. */ -static extend_info_t * -find_rp_for_intro(const rend_intro_cell_t *intro, - char **err_msg_out) -{ - extend_info_t *rp = NULL; - char *err_msg = NULL; - const char *rp_nickname = NULL; - const node_t *node = NULL; - - if (!intro) { - if (err_msg_out) - err_msg = tor_strdup("Bad parameters to find_rp_for_intro()"); - - goto err; - } - - if (intro->version == 0 || intro->version == 1) { - rp_nickname = (const char *)(intro->u.v0_v1.rp); - - node = node_get_by_nickname(rp_nickname, NNF_NO_WARN_UNNAMED); - if (!node) { - if (err_msg_out) { - tor_asprintf(&err_msg, - "Couldn't find router %s named in INTRODUCE2 cell", - escaped_safe_str_client(rp_nickname)); - } - - goto err; - } - - /* Are we in single onion mode? */ - const int allow_direct = rend_service_allow_non_anonymous_connection( - get_options()); - rp = extend_info_from_node(node, allow_direct); - if (!rp) { - if (err_msg_out) { - tor_asprintf(&err_msg, - "Couldn't build extend_info_t for router %s named " - "in INTRODUCE2 cell", - escaped_safe_str_client(rp_nickname)); - } - - goto err; - } - } else if (intro->version == 2) { - rp = extend_info_dup(intro->u.v2.extend_info); - } else if (intro->version == 3) { - rp = extend_info_dup(intro->u.v3.extend_info); - } else { - if (err_msg_out) { - tor_asprintf(&err_msg, - "Unknown version %d in INTRODUCE2 cell", - (int)(intro->version)); - } - - goto err; - } - - /* rp is always set here: extend_info_dup guarantees a non-NULL result, and - * the other cases goto err. */ - tor_assert(rp); - - /* Make sure the RP we are being asked to connect to is _not_ a private - * address unless it's allowed. Let's avoid to build a circuit to our - * second middle node and fail right after when extending to the RP. */ - const tor_addr_port_t *orport = extend_info_get_orport(rp, AF_INET); - if (! orport || !extend_info_addr_is_allowed(&orport->addr)) { - if (err_msg_out) { - tor_asprintf(&err_msg, - "Relay IP in INTRODUCE2 cell is private address."); - } - extend_info_free(rp); - rp = NULL; - goto err; - } - goto done; - - err: - if (err_msg_out) - *err_msg_out = err_msg; - else - tor_free(err_msg); - - done: - return rp; -} - -/** Free a parsed INTRODUCE1 or INTRODUCE2 cell that was allocated by - * rend_service_parse_intro(). - */ -void -rend_service_free_intro_(rend_intro_cell_t *request) -{ - if (!request) { - return; - } - - /* Free ciphertext */ - tor_free(request->ciphertext); - request->ciphertext_len = 0; - - /* Have plaintext? */ - if (request->plaintext) { - /* Zero it out just to be safe */ - memwipe(request->plaintext, 0, request->plaintext_len); - tor_free(request->plaintext); - request->plaintext_len = 0; - } - - /* Have parsed plaintext? */ - if (request->parsed) { - switch (request->version) { - case 0: - case 1: - /* - * Nothing more to do; these formats have no further pointers - * in them. - */ - break; - case 2: - extend_info_free(request->u.v2.extend_info); - request->u.v2.extend_info = NULL; - break; - case 3: - if (request->u.v3.auth_data) { - memwipe(request->u.v3.auth_data, 0, request->u.v3.auth_len); - tor_free(request->u.v3.auth_data); - } - - extend_info_free(request->u.v3.extend_info); - request->u.v3.extend_info = NULL; - break; - default: - log_info(LD_BUG, - "rend_service_free_intro() saw unknown protocol " - "version %d.", - request->version); - } - } - - /* Zero it out to make sure sensitive stuff doesn't hang around in memory */ - memwipe(request, 0, sizeof(*request)); - - tor_free(request); -} - -/** Parse an INTRODUCE1 or INTRODUCE2 cell into a newly allocated - * rend_intro_cell_t structure. Free it with rend_service_free_intro() - * when finished. The type parameter should be 1 or 2 to indicate whether - * this is INTRODUCE1 or INTRODUCE2. This parses only the non-encrypted - * parts; after this, call rend_service_decrypt_intro() with a key, then - * rend_service_parse_intro_plaintext() to finish parsing. The optional - * err_msg_out parameter is set to a string suitable for log output - * if parsing fails. This function does some validation, but only - * that which depends solely on the contents of the cell and the - * key; it can be unit-tested. Further validation is done in - * rend_service_validate_intro(). - */ - -rend_intro_cell_t * -rend_service_begin_parse_intro(const uint8_t *request, - size_t request_len, - uint8_t type, - char **err_msg_out) -{ - rend_intro_cell_t *rv = NULL; - char *err_msg = NULL; - - if (!request || request_len <= 0) goto err; - if (!(type == 1 || type == 2)) goto err; - - /* First, check that the cell is long enough to be a sensible INTRODUCE */ - - /* min key length plus digest length plus nickname length */ - if (request_len < - (DIGEST_LEN + REND_COOKIE_LEN + (MAX_NICKNAME_LEN + 1) + - DH1024_KEY_LEN + 42)) { - if (err_msg_out) { - tor_asprintf(&err_msg, - "got a truncated INTRODUCE%d cell", - (int)type); - } - goto err; - } - - /* Allocate a new parsed cell structure */ - rv = tor_malloc_zero(sizeof(*rv)); - - /* Set the type */ - rv->type = type; - - /* Copy in the ID */ - memcpy(rv->pk, request, DIGEST_LEN); - - /* Copy in the ciphertext */ - rv->ciphertext = tor_malloc(request_len - DIGEST_LEN); - memcpy(rv->ciphertext, request + DIGEST_LEN, request_len - DIGEST_LEN); - rv->ciphertext_len = request_len - DIGEST_LEN; - - goto done; - - err: - rend_service_free_intro(rv); - rv = NULL; - - if (err_msg_out && !err_msg) { - tor_asprintf(&err_msg, - "unknown INTRODUCE%d error", - (int)type); - } - - done: - if (err_msg_out) *err_msg_out = err_msg; - else tor_free(err_msg); - - return rv; -} - -/** Parse the version-specific parts of a v0 or v1 INTRODUCE1 or INTRODUCE2 - * cell - */ - -static ssize_t -rend_service_parse_intro_for_v0_or_v1( - rend_intro_cell_t *intro, - const uint8_t *buf, - size_t plaintext_len, - char **err_msg_out) -{ - const char *rp_nickname, *endptr; - size_t nickname_field_len, ver_specific_len; - - if (intro->version == 1) { - ver_specific_len = MAX_HEX_NICKNAME_LEN + 2; - rp_nickname = ((const char *)buf) + 1; - nickname_field_len = MAX_HEX_NICKNAME_LEN + 1; - } else if (intro->version == 0) { - ver_specific_len = MAX_NICKNAME_LEN + 1; - rp_nickname = (const char *)buf; - nickname_field_len = MAX_NICKNAME_LEN + 1; - } else { - if (err_msg_out) - tor_asprintf(err_msg_out, - "rend_service_parse_intro_for_v0_or_v1() called with " - "bad version %d on INTRODUCE%d cell (this is a bug)", - intro->version, - (int)(intro->type)); - goto err; - } - - if (plaintext_len < ver_specific_len) { - if (err_msg_out) - tor_asprintf(err_msg_out, - "short plaintext of encrypted part in v1 INTRODUCE%d " - "cell (%lu bytes, needed %lu)", - (int)(intro->type), - (unsigned long)plaintext_len, - (unsigned long)ver_specific_len); - goto err; - } - - endptr = memchr(rp_nickname, 0, nickname_field_len); - if (!endptr || endptr == rp_nickname) { - if (err_msg_out) { - tor_asprintf(err_msg_out, - "couldn't find a nul-padded nickname in " - "INTRODUCE%d cell", - (int)(intro->type)); - } - goto err; - } - - if ((intro->version == 0 && - !is_legal_nickname(rp_nickname)) || - (intro->version == 1 && - !is_legal_nickname_or_hexdigest(rp_nickname))) { - if (err_msg_out) { - tor_asprintf(err_msg_out, - "bad nickname in INTRODUCE%d cell", - (int)(intro->type)); - } - goto err; - } - - memcpy(intro->u.v0_v1.rp, rp_nickname, endptr - rp_nickname + 1); - - return ver_specific_len; - - err: - return -1; -} - -/** Parse the version-specific parts of a v2 INTRODUCE1 or INTRODUCE2 cell - */ - -static ssize_t -rend_service_parse_intro_for_v2( - rend_intro_cell_t *intro, - const uint8_t *buf, - size_t plaintext_len, - char **err_msg_out) -{ - unsigned int klen; - extend_info_t *extend_info = NULL; - ssize_t ver_specific_len; - - /* - * We accept version 3 too so that the v3 parser can call this with - * an adjusted buffer for the latter part of a v3 cell, which is - * identical to a v2 cell. - */ - if (!(intro->version == 2 || - intro->version == 3)) { - if (err_msg_out) - tor_asprintf(err_msg_out, - "rend_service_parse_intro_for_v2() called with " - "bad version %d on INTRODUCE%d cell (this is a bug)", - intro->version, - (int)(intro->type)); - goto err; - } - - /* 7 == version, IP and port, DIGEST_LEN == id, 2 == key length */ - if (plaintext_len < 7 + DIGEST_LEN + 2) { - if (err_msg_out) { - tor_asprintf(err_msg_out, - "truncated plaintext of encrypted parted of " - "version %d INTRODUCE%d cell", - intro->version, - (int)(intro->type)); - } - - goto err; - } - - extend_info = extend_info_new(NULL, NULL, NULL, NULL, NULL, NULL, 0); - tor_addr_t addr; - tor_addr_from_ipv4n(&addr, get_uint32(buf + 1)); - uint16_t port = ntohs(get_uint16(buf + 5)); - extend_info_add_orport(extend_info, &addr, port); - memcpy(extend_info->identity_digest, buf + 7, DIGEST_LEN); - extend_info->nickname[0] = '$'; - base16_encode(extend_info->nickname + 1, sizeof(extend_info->nickname) - 1, - extend_info->identity_digest, DIGEST_LEN); - klen = ntohs(get_uint16(buf + 7 + DIGEST_LEN)); - - /* 7 == version, IP and port, DIGEST_LEN == id, 2 == key length */ - if (plaintext_len < 7 + DIGEST_LEN + 2 + klen) { - if (err_msg_out) { - tor_asprintf(err_msg_out, - "truncated plaintext of encrypted parted of " - "version %d INTRODUCE%d cell", - intro->version, - (int)(intro->type)); - } - - goto err; - } - - extend_info->onion_key = - crypto_pk_asn1_decode((const char *)(buf + 7 + DIGEST_LEN + 2), klen); - if (!extend_info->onion_key) { - if (err_msg_out) { - tor_asprintf(err_msg_out, - "error decoding onion key in version %d " - "INTRODUCE%d cell", - intro->version, - (intro->type)); - } - - goto err; - } - if (128 != crypto_pk_keysize(extend_info->onion_key)) { - if (err_msg_out) { - tor_asprintf(err_msg_out, - "invalid onion key size in version %d INTRODUCE%d cell", - intro->version, - (intro->type)); - } - - goto err; - } - - ver_specific_len = 7+DIGEST_LEN+2+klen; - - if (intro->version == 2) intro->u.v2.extend_info = extend_info; - else intro->u.v3.extend_info = extend_info; - - return ver_specific_len; - - err: - extend_info_free(extend_info); - - return -1; -} - -/** Parse the version-specific parts of a v3 INTRODUCE1 or INTRODUCE2 cell - */ - -static ssize_t -rend_service_parse_intro_for_v3( - rend_intro_cell_t *intro, - const uint8_t *buf, - size_t plaintext_len, - char **err_msg_out) -{ - ssize_t adjust, v2_ver_specific_len, ts_offset; - - /* This should only be called on v3 cells */ - if (intro->version != 3) { - if (err_msg_out) - tor_asprintf(err_msg_out, - "rend_service_parse_intro_for_v3() called with " - "bad version %d on INTRODUCE%d cell (this is a bug)", - intro->version, - (int)(intro->type)); - goto err; - } - - /* - * Check that we have at least enough to get auth_len: - * - * 1 octet for version, 1 for auth_type, 2 for auth_len - */ - if (plaintext_len < 4) { - if (err_msg_out) { - tor_asprintf(err_msg_out, - "truncated plaintext of encrypted parted of " - "version %d INTRODUCE%d cell", - intro->version, - (int)(intro->type)); - } - - goto err; - } - - /* - * The rend_client_send_introduction() function over in rendclient.c is - * broken (i.e., fails to match the spec) in such a way that we can't - * change it without breaking the protocol. Specifically, it doesn't - * emit auth_len when auth-type is REND_NO_AUTH, so everything is off - * by two bytes after that. Calculate ts_offset and do everything from - * the timestamp on relative to that to handle this dain bramage. - */ - - intro->u.v3.auth_type = buf[1]; - if (intro->u.v3.auth_type != REND_NO_AUTH) { - intro->u.v3.auth_len = ntohs(get_uint16(buf + 2)); - ts_offset = 4 + intro->u.v3.auth_len; - } else { - intro->u.v3.auth_len = 0; - ts_offset = 2; - } - - /* Check that auth len makes sense for this auth type */ - if (intro->u.v3.auth_type == REND_BASIC_AUTH || - intro->u.v3.auth_type == REND_STEALTH_AUTH) { - if (intro->u.v3.auth_len != REND_DESC_COOKIE_LEN) { - if (err_msg_out) { - tor_asprintf(err_msg_out, - "wrong auth data size %d for INTRODUCE%d cell, " - "should be %d", - (int)(intro->u.v3.auth_len), - (int)(intro->type), - REND_DESC_COOKIE_LEN); - } - - goto err; - } - } - - /* Check that we actually have everything up through the timestamp */ - if (plaintext_len < (size_t)(ts_offset)+4) { - if (err_msg_out) { - tor_asprintf(err_msg_out, - "truncated plaintext of encrypted parted of " - "version %d INTRODUCE%d cell", - intro->version, - (int)(intro->type)); - } - - goto err; - } - - if (intro->u.v3.auth_type != REND_NO_AUTH && - intro->u.v3.auth_len > 0) { - /* Okay, we can go ahead and copy auth_data */ - intro->u.v3.auth_data = tor_malloc(intro->u.v3.auth_len); - /* - * We know we had an auth_len field in this case, so 4 is - * always right. - */ - memcpy(intro->u.v3.auth_data, buf + 4, intro->u.v3.auth_len); - } - - /* - * From here on, the format is as in v2, so we call the v2 parser with - * adjusted buffer and length. We are 4 + ts_offset octets in, but the - * v2 parser expects to skip over a version byte at the start, so we - * adjust by 3 + ts_offset. - */ - adjust = 3 + ts_offset; - - v2_ver_specific_len = - rend_service_parse_intro_for_v2(intro, - buf + adjust, plaintext_len - adjust, - err_msg_out); - - /* Success in v2 parser */ - if (v2_ver_specific_len >= 0) return v2_ver_specific_len + adjust; - /* Failure in v2 parser; it will have provided an err_msg */ - else return v2_ver_specific_len; - - err: - return -1; -} - -/** Table of parser functions for version-specific parts of an INTRODUCE2 - * cell. - */ - -static ssize_t - (*intro_version_handlers[])( - rend_intro_cell_t *, - const uint8_t *, - size_t, - char **) = -{ rend_service_parse_intro_for_v0_or_v1, - rend_service_parse_intro_for_v0_or_v1, - rend_service_parse_intro_for_v2, - rend_service_parse_intro_for_v3 }; - -/** Decrypt the encrypted part of an INTRODUCE1 or INTRODUCE2 cell, - * return 0 if successful, or < 0 and write an error message to - * *err_msg_out if provided. - */ - -int -rend_service_decrypt_intro( - rend_intro_cell_t *intro, - crypto_pk_t *key, - char **err_msg_out) -{ - char *err_msg = NULL; - uint8_t key_digest[DIGEST_LEN]; - char service_id[REND_SERVICE_ID_LEN_BASE32+1]; - ssize_t key_len; - uint8_t buf[RELAY_PAYLOAD_SIZE]; - int result, status = -1; - - if (!intro || !key) { - if (err_msg_out) { - err_msg = - tor_strdup("rend_service_decrypt_intro() called with bad " - "parameters"); - } - - status = -2; - goto err; - } - - /* Make sure we have ciphertext */ - if (!(intro->ciphertext) || intro->ciphertext_len <= 0) { - if (err_msg_out) { - tor_asprintf(&err_msg, - "rend_intro_cell_t was missing ciphertext for " - "INTRODUCE%d cell", - (int)(intro->type)); - } - status = -3; - goto err; - } - - /* Check that this cell actually matches this service key */ - - /* first DIGEST_LEN bytes of request is intro or service pk digest */ - if (crypto_pk_get_digest(key, (char *)key_digest) < 0) { - if (err_msg_out) - *err_msg_out = tor_strdup("Couldn't compute RSA digest."); - log_warn(LD_BUG, "Couldn't compute key digest."); - status = -7; - goto err; - } - - if (tor_memneq(key_digest, intro->pk, DIGEST_LEN)) { - if (err_msg_out) { - base32_encode(service_id, REND_SERVICE_ID_LEN_BASE32 + 1, - (char*)(intro->pk), REND_SERVICE_ID_LEN); - tor_asprintf(&err_msg, - "got an INTRODUCE%d cell for the wrong service (%s)", - (int)(intro->type), - escaped(service_id)); - } - - status = -4; - goto err; - } - - /* Make sure the encrypted part is long enough to decrypt */ - - key_len = crypto_pk_keysize(key); - if (intro->ciphertext_len < key_len) { - if (err_msg_out) { - tor_asprintf(&err_msg, - "got an INTRODUCE%d cell with a truncated PK-encrypted " - "part", - (int)(intro->type)); - } - - status = -5; - goto err; - } - - /* Decrypt the encrypted part */ - result = - crypto_pk_obsolete_private_hybrid_decrypt( - key, (char *)buf, sizeof(buf), - (const char *)(intro->ciphertext), intro->ciphertext_len, - PK_PKCS1_OAEP_PADDING, 1); - if (result < 0) { - if (err_msg_out) { - tor_asprintf(&err_msg, - "couldn't decrypt INTRODUCE%d cell", - (int)(intro->type)); - } - status = -6; - goto err; - } - intro->plaintext_len = result; - intro->plaintext = tor_malloc(intro->plaintext_len); - memcpy(intro->plaintext, buf, intro->plaintext_len); - - status = 0; - - goto done; - - err: - if (err_msg_out && !err_msg) { - tor_asprintf(&err_msg, - "unknown INTRODUCE%d error decrypting encrypted part", - intro ? (int)(intro->type) : -1); - } - - done: - if (err_msg_out) *err_msg_out = err_msg; - else tor_free(err_msg); - - /* clean up potentially sensitive material */ - memwipe(buf, 0, sizeof(buf)); - memwipe(key_digest, 0, sizeof(key_digest)); - memwipe(service_id, 0, sizeof(service_id)); - - return status; -} - -/** Parse the plaintext of the encrypted part of an INTRODUCE1 or - * INTRODUCE2 cell, return 0 if successful, or < 0 and write an error - * message to *err_msg_out if provided. - */ - -int -rend_service_parse_intro_plaintext( - rend_intro_cell_t *intro, - char **err_msg_out) -{ - char *err_msg = NULL; - ssize_t ver_specific_len, ver_invariant_len; - uint8_t version; - int status = -1; - - if (!intro) { - if (err_msg_out) { - err_msg = - tor_strdup("rend_service_parse_intro_plaintext() called with NULL " - "rend_intro_cell_t"); - } - - status = -2; - goto err; - } - - /* Check that we have plaintext */ - if (!(intro->plaintext) || intro->plaintext_len <= 0) { - if (err_msg_out) { - err_msg = tor_strdup("rend_intro_cell_t was missing plaintext"); - } - status = -3; - goto err; - } - - /* In all formats except v0, the first byte is a version number */ - version = intro->plaintext[0]; - - /* v0 has no version byte (stupid...), so handle it as a fallback */ - if (version > 3) version = 0; - - /* Copy the version into the parsed cell structure */ - intro->version = version; - - /* Call the version-specific parser from the table */ - ver_specific_len = - intro_version_handlers[version](intro, - intro->plaintext, intro->plaintext_len, - &err_msg); - if (ver_specific_len < 0) { - status = -4; - goto err; - } - - /** The rendezvous cookie and Diffie-Hellman stuff are version-invariant - * and at the end of the plaintext of the encrypted part of the cell. - */ - - ver_invariant_len = intro->plaintext_len - ver_specific_len; - if (ver_invariant_len < REND_COOKIE_LEN + DH1024_KEY_LEN) { - tor_asprintf(&err_msg, - "decrypted plaintext of INTRODUCE%d cell was truncated (%ld bytes)", - (int)(intro->type), - (long)(intro->plaintext_len)); - status = -5; - goto err; - } else if (ver_invariant_len > REND_COOKIE_LEN + DH1024_KEY_LEN) { - tor_asprintf(&err_msg, - "decrypted plaintext of INTRODUCE%d cell was too long (%ld bytes)", - (int)(intro->type), - (long)(intro->plaintext_len)); - status = -6; - goto err; - } else { - memcpy(intro->rc, - intro->plaintext + ver_specific_len, - REND_COOKIE_LEN); - memcpy(intro->dh, - intro->plaintext + ver_specific_len + REND_COOKIE_LEN, - DH1024_KEY_LEN); - } - - /* Flag it as being fully parsed */ - intro->parsed = 1; - - status = 0; - goto done; - - err: - if (err_msg_out && !err_msg) { - tor_asprintf(&err_msg, - "unknown INTRODUCE%d error parsing encrypted part", - intro ? (int)(intro->type) : -1); - } - - done: - if (err_msg_out) *err_msg_out = err_msg; - else tor_free(err_msg); - - return status; -} - -/** Do validity checks on a parsed intro cell after decryption; some of - * these are not done in rend_service_parse_intro_plaintext() itself because - * they depend on a lot of other state and would make it hard to unit test. - * Returns >= 0 if successful or < 0 if the intro cell is invalid, and - * optionally writes out an error message for logging. If an err_msg - * pointer is provided, it is the caller's responsibility to free any - * provided message. - */ - -int -rend_service_validate_intro_late(const rend_intro_cell_t *intro, - char **err_msg_out) -{ - int status = 0; - - if (!intro) { - if (err_msg_out) - *err_msg_out = - tor_strdup("NULL intro cell passed to " - "rend_service_validate_intro_late()"); - - status = -1; - goto err; - } - - if (intro->version == 3 && intro->parsed) { - if (!(intro->u.v3.auth_type == REND_NO_AUTH || - intro->u.v3.auth_type == REND_BASIC_AUTH || - intro->u.v3.auth_type == REND_STEALTH_AUTH)) { - /* This is an informative message, not an error, as in the old code */ - if (err_msg_out) - tor_asprintf(err_msg_out, - "unknown authorization type %d", - intro->u.v3.auth_type); - } - } - - err: - return status; -} - -/** Called when we fail building a rendezvous circuit at some point other - * than the last hop: launches a new circuit to the same rendezvous point. - */ -void -rend_service_relaunch_rendezvous(origin_circuit_t *oldcirc) -{ - origin_circuit_t *newcirc; - cpath_build_state_t *newstate, *oldstate; - const char *rend_pk_digest; - rend_service_t *service = NULL; - - int flags = CIRCLAUNCH_NEED_CAPACITY | CIRCLAUNCH_IS_INTERNAL; - - tor_assert(oldcirc->base_.purpose == CIRCUIT_PURPOSE_S_CONNECT_REND); - oldstate = oldcirc->build_state; - tor_assert(oldstate); - - if (oldstate->service_pending_final_cpath_ref == NULL) { - log_info(LD_REND,"Skipping relaunch of circ that failed on its first hop. " - "Initiator will retry."); - return; - } - - log_info(LD_REND,"Reattempting rendezvous circuit to '%s'", - safe_str(extend_info_describe(oldstate->chosen_exit))); - - /* Look up the service. */ - rend_pk_digest = (char *) rend_data_get_pk_digest(oldcirc->rend_data, NULL); - service = rend_service_get_by_pk_digest(rend_pk_digest); - - if (!service) { - char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32+1, - rend_pk_digest, REND_SERVICE_ID_LEN); - - log_warn(LD_BUG, "Internal error: Trying to relaunch a rendezvous circ " - "for an unrecognized service %s.", - safe_str_client(serviceid)); - return; - } - - if (hs_service_requires_uptime_circ(service->ports)) { - flags |= CIRCLAUNCH_NEED_UPTIME; - } - - /* You'd think Single Onion Services would want to retry the rendezvous - * using a direct connection. But if it's blocked by a firewall, or the - * service is IPv6-only, or the rend point avoiding becoming a one-hop - * proxy, we need a 3-hop connection. */ - newcirc = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_CONNECT_REND, - oldstate->chosen_exit, flags); - - if (!newcirc) { - log_warn(LD_REND,"Couldn't relaunch rendezvous circuit to '%s'.", - safe_str(extend_info_describe(oldstate->chosen_exit))); - return; - } - newstate = newcirc->build_state; - tor_assert(newstate); - newstate->failure_count = oldstate->failure_count+1; - newstate->expiry_time = oldstate->expiry_time; - newstate->service_pending_final_cpath_ref = - oldstate->service_pending_final_cpath_ref; - ++(newstate->service_pending_final_cpath_ref->refcount); - - newcirc->rend_data = rend_data_dup(oldcirc->rend_data); -} - -/** Launch a circuit to serve as an introduction point for the service - * <b>service</b> at the introduction point <b>nickname</b> - */ -static int -rend_service_launch_establish_intro(rend_service_t *service, - rend_intro_point_t *intro) -{ - origin_circuit_t *launched; - int flags = CIRCLAUNCH_NEED_UPTIME|CIRCLAUNCH_IS_INTERNAL; - const or_options_t *options = get_options(); - extend_info_t *launch_ei = intro->extend_info; - extend_info_t *direct_ei = NULL; - - /* Are we in single onion mode? - * - * We only use a one-hop path on the first attempt. If the first attempt - * fails, we use a 3-hop path for reachability / reliability. - * (Unlike v3, retries is incremented by the caller after it calls this - * function.) - */ - if (rend_service_allow_non_anonymous_connection(options) && - intro->circuit_retries == 0) { - /* Do we have a descriptor for the node? - * We've either just chosen it from the consensus, or we've just reviewed - * our intro points to see which ones are still valid, and deleted the ones - * that aren't in the consensus any more. */ - const node_t *node = node_get_by_id(launch_ei->identity_digest); - if (BUG(!node)) { - /* The service has kept an intro point after it went missing from the - * consensus. If we did anything else here, it would be a consensus - * distinguisher. Which are less of an issue for single onion services, - * but still a bug. */ - return -1; - } - /* Can we connect to the node directly? If so, replace launch_ei - * (a multi-hop extend_info) with one suitable for direct connection. */ - if (rend_service_use_direct_connection_node(options, node)) { - direct_ei = extend_info_from_node(node, 1); - if (BUG(!direct_ei)) { - /* rend_service_use_direct_connection_node and extend_info_from_node - * disagree about which addresses on this node are permitted. This - * should never happen. Avoiding the connection is a safe response. */ - return -1; - } - flags = flags | CIRCLAUNCH_ONEHOP_TUNNEL; - launch_ei = direct_ei; - } - } - /* launch_ei is either intro->extend_info, or has been replaced with a valid - * extend_info for single onion service direct connection. */ - tor_assert(launch_ei); - /* We must have the same intro when making a direct connection. */ - tor_assert(tor_memeq(intro->extend_info->identity_digest, - launch_ei->identity_digest, - DIGEST_LEN)); - - log_info(LD_REND, - "Launching circuit to introduction point %s%s%s for service %s", - safe_str_client(extend_info_describe(intro->extend_info)), - direct_ei ? " via direct address " : "", - direct_ei ? safe_str_client(extend_info_describe(direct_ei)) : "", - service->service_id); - - rep_hist_note_used_internal(time(NULL), 1, 0); - - ++service->n_intro_circuits_launched; - launched = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO, - launch_ei, flags); - - if (!launched) { - log_info(LD_REND, - "Can't launch circuit to establish introduction at %s%s%s.", - safe_str_client(extend_info_describe(intro->extend_info)), - direct_ei ? " via direct address " : "", - direct_ei ? safe_str_client(extend_info_describe(direct_ei)) : "" - ); - extend_info_free(direct_ei); - return -1; - } - /* We must have the same exit node even if cannibalized or direct connection. - */ - tor_assert(tor_memeq(intro->extend_info->identity_digest, - launched->build_state->chosen_exit->identity_digest, - DIGEST_LEN)); - - launched->rend_data = rend_data_service_create(service->service_id, - service->pk_digest, NULL, - service->auth_type); - launched->intro_key = crypto_pk_dup_key(intro->intro_key); - if (launched->base_.state == CIRCUIT_STATE_OPEN) - rend_service_intro_has_opened(launched); - extend_info_free(direct_ei); - return 0; -} - -/** Return the number of introduction points that are established for the - * given service. */ -static unsigned int -count_established_intro_points(const rend_service_t *service) -{ - unsigned int num = 0; - - SMARTLIST_FOREACH(service->intro_nodes, rend_intro_point_t *, intro, - num += intro->circuit_established - ); - return num; -} - -/** Return the number of introduction points that are or are being - * established for the given service. This function iterates over all - * circuit and count those that are linked to the service and are waiting - * for the intro point to respond. */ -static unsigned int -count_intro_point_circuits(const rend_service_t *service) -{ - unsigned int num_ipos = 0; - SMARTLIST_FOREACH_BEGIN(circuit_get_global_list(), circuit_t *, circ) { - if (!circ->marked_for_close && - circ->state == CIRCUIT_STATE_OPEN && - (circ->purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO || - circ->purpose == CIRCUIT_PURPOSE_S_INTRO)) { - origin_circuit_t *oc = TO_ORIGIN_CIRCUIT(circ); - if (oc->rend_data && - rend_circuit_pk_digest_eq(oc, (uint8_t *) service->pk_digest)) { - num_ipos++; - } - } - } - SMARTLIST_FOREACH_END(circ); - return num_ipos; -} - -/* Given a buffer of at least RELAY_PAYLOAD_SIZE bytes in <b>cell_body_out</b>, - write the body of a legacy ESTABLISH_INTRO cell in it. Use <b>intro_key</b> - as the intro point auth key, and <b>rend_circ_nonce</b> as the circuit - crypto material. On success, fill <b>cell_body_out</b> and return the number - of bytes written. On fail, return -1. - */ -ssize_t -rend_service_encode_establish_intro_cell(char *cell_body_out, - size_t cell_body_out_len, - crypto_pk_t *intro_key, - const char *rend_circ_nonce) -{ - int retval = -1; - int r; - int len = 0; - char auth[DIGEST_LEN + 9]; - - tor_assert(intro_key); - tor_assert(rend_circ_nonce); - - /* Build the payload for a RELAY_ESTABLISH_INTRO cell. */ - r = crypto_pk_asn1_encode(intro_key, cell_body_out+2, - RELAY_PAYLOAD_SIZE-2); - if (r < 0) { - log_warn(LD_BUG, "Internal error; failed to establish intro point."); - goto err; - } - len = r; - set_uint16(cell_body_out, htons((uint16_t)len)); - len += 2; - memcpy(auth, rend_circ_nonce, DIGEST_LEN); - memcpy(auth+DIGEST_LEN, "INTRODUCE", 9); - if (crypto_digest(cell_body_out+len, auth, DIGEST_LEN+9)) - goto err; - len += 20; - r = crypto_pk_private_sign_digest(intro_key, cell_body_out+len, - cell_body_out_len - len, - cell_body_out, len); - if (r<0) { - log_warn(LD_BUG, "Internal error: couldn't sign introduction request."); - goto err; - } - len += r; - - retval = len; - - err: - memwipe(auth, 0, sizeof(auth)); - - return retval; -} - -/** Called when we're done building a circuit to an introduction point: - * sends a RELAY_ESTABLISH_INTRO cell. - */ -void -rend_service_intro_has_opened(origin_circuit_t *circuit) -{ - rend_service_t *service; - char buf[RELAY_PAYLOAD_SIZE]; - char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; - unsigned int expiring_nodes_len, num_ip_circuits, valid_ip_circuits = 0; - int reason = END_CIRC_REASON_TORPROTOCOL; - const char *rend_pk_digest; - - tor_assert(circuit->base_.purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO); - assert_circ_anonymity_ok(circuit, get_options()); - tor_assert(circuit->cpath); - tor_assert(circuit->rend_data); - /* XXX: This is version 2 specific (only on supported). */ - rend_pk_digest = (char *) rend_data_get_pk_digest(circuit->rend_data, NULL); - - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32+1, - rend_pk_digest, REND_SERVICE_ID_LEN); - - service = rend_service_get_by_pk_digest(rend_pk_digest); - if (!service) { - log_warn(LD_REND, "Unrecognized service ID %s on introduction circuit %u.", - safe_str_client(serviceid), (unsigned)circuit->base_.n_circ_id); - reason = END_CIRC_REASON_NOSUCHSERVICE; - goto err; - } - - /* Take the current amount of expiring nodes and the current amount of IP - * circuits and compute how many valid IP circuits we have. */ - expiring_nodes_len = (unsigned int) smartlist_len(service->expiring_nodes); - num_ip_circuits = count_intro_point_circuits(service); - /* Let's avoid an underflow. The valid_ip_circuits is initialized to 0 in - * case this condition turns out false because it means that all circuits - * are expiring so we need to keep this circuit. */ - if (num_ip_circuits > expiring_nodes_len) { - valid_ip_circuits = num_ip_circuits - expiring_nodes_len; - } - - /* If we already have enough introduction circuits for this service, - * redefine this one as a general circuit or close it, depending. - * Subtract the amount of expiring nodes here because the circuits are - * still opened. */ - if (valid_ip_circuits > service->n_intro_points_wanted) { - const or_options_t *options = get_options(); - /* Remove the intro point associated with this circuit, it's being - * repurposed or closed thus cleanup memory. */ - rend_intro_point_t *intro = find_intro_point(circuit); - if (intro != NULL) { - smartlist_remove(service->intro_nodes, intro); - rend_intro_point_free(intro); - } - - if (options->ExcludeNodes) { - /* XXXX in some future version, we can test whether the transition is - allowed or not given the actual nodes in the circuit. But for now, - this case, we might as well close the thing. */ - log_info(LD_CIRC|LD_REND, "We have just finished an introduction " - "circuit, but we already have enough. Closing it."); - reason = END_CIRC_REASON_NONE; - goto err; - } else { - tor_assert(circuit->build_state->is_internal); - log_info(LD_CIRC|LD_REND, "We have just finished an introduction " - "circuit, but we already have enough. Redefining purpose to " - "general; leaving as internal."); - - if (circuit_should_use_vanguards(TO_CIRCUIT(circuit)->purpose)) { - circuit_change_purpose(TO_CIRCUIT(circuit), - CIRCUIT_PURPOSE_HS_VANGUARDS); - } else { - circuit_change_purpose(TO_CIRCUIT(circuit), CIRCUIT_PURPOSE_C_GENERAL); - } - - { - rend_data_free(circuit->rend_data); - circuit->rend_data = NULL; - } - { - crypto_pk_t *intro_key = circuit->intro_key; - circuit->intro_key = NULL; - crypto_pk_free(intro_key); - } - - circuit_has_opened(circuit); - goto done; - } - } - - log_info(LD_REND, - "Established circuit %u as introduction point for service %s", - (unsigned)circuit->base_.n_circ_id, serviceid); - circuit_log_path(LOG_INFO, LD_REND, circuit); - - /* Send the ESTABLISH_INTRO cell */ - { - ssize_t len; - len = rend_service_encode_establish_intro_cell(buf, sizeof(buf), - circuit->intro_key, - circuit->cpath->prev->rend_circ_nonce); - if (len < 0) { - reason = END_CIRC_REASON_INTERNAL; - goto err; - } - - if (relay_send_command_from_edge(0, TO_CIRCUIT(circuit), - RELAY_COMMAND_ESTABLISH_INTRO, - buf, len, circuit->cpath->prev)<0) { - log_info(LD_GENERAL, - "Couldn't send introduction request for service %s on circuit %u", - serviceid, (unsigned)circuit->base_.n_circ_id); - goto done; - } - } - - /* We've attempted to use this circuit */ - pathbias_count_use_attempt(circuit); - - goto done; - - err: - circuit_mark_for_close(TO_CIRCUIT(circuit), reason); - done: - memwipe(buf, 0, sizeof(buf)); - memwipe(serviceid, 0, sizeof(serviceid)); - - return; -} - -/** Called when we get an INTRO_ESTABLISHED cell; mark the circuit as a - * live introduction point, and note that the service descriptor is - * now out-of-date. */ -int -rend_service_intro_established(origin_circuit_t *circuit, - const uint8_t *request, - size_t request_len) -{ - rend_service_t *service; - rend_intro_point_t *intro; - char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; - (void) request; - (void) request_len; - tor_assert(circuit->rend_data); - /* XXX: This is version 2 specific (only supported one for now). */ - const char *rend_pk_digest = - (char *) rend_data_get_pk_digest(circuit->rend_data, NULL); - - if (circuit->base_.purpose != CIRCUIT_PURPOSE_S_ESTABLISH_INTRO) { - log_warn(LD_PROTOCOL, - "received INTRO_ESTABLISHED cell on non-intro circuit."); - goto err; - } - service = rend_service_get_by_pk_digest(rend_pk_digest); - if (!service) { - log_warn(LD_REND, "Unknown service on introduction circuit %u.", - (unsigned)circuit->base_.n_circ_id); - goto err; - } - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1, - rend_pk_digest, REND_SERVICE_ID_LEN); - /* We've just successfully established a intro circuit to one of our - * introduction point, account for it. */ - intro = find_intro_point(circuit); - if (intro == NULL) { - log_warn(LD_REND, - "Introduction circuit established without a rend_intro_point_t " - "object for service %s on circuit %u", - safe_str_client(serviceid), (unsigned)circuit->base_.n_circ_id); - goto err; - } - intro->circuit_established = 1; - /* We might not have every introduction point ready but at this point we - * know that the descriptor needs to be uploaded. */ - service->desc_is_dirty = time(NULL); - circuit_change_purpose(TO_CIRCUIT(circuit), CIRCUIT_PURPOSE_S_INTRO); - - log_info(LD_REND, - "Received INTRO_ESTABLISHED cell on circuit %u for service %s", - (unsigned)circuit->base_.n_circ_id, serviceid); - - /* Getting a valid INTRODUCE_ESTABLISHED means we've successfully - * used the circ */ - pathbias_mark_use_success(circuit); - - return 0; - err: - circuit_mark_for_close(TO_CIRCUIT(circuit), END_CIRC_REASON_TORPROTOCOL); - return -1; -} - -/** Called once a circuit to a rendezvous point is established: sends a - * RELAY_COMMAND_RENDEZVOUS1 cell. - */ -void -rend_service_rendezvous_has_opened(origin_circuit_t *circuit) -{ - rend_service_t *service; - char buf[RELAY_PAYLOAD_SIZE]; - crypt_path_t *hop; - char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; - char hexcookie[9]; - int reason; - const char *rend_cookie, *rend_pk_digest; - - tor_assert(circuit->base_.purpose == CIRCUIT_PURPOSE_S_CONNECT_REND); - tor_assert(circuit->cpath); - tor_assert(circuit->build_state); - assert_circ_anonymity_ok(circuit, get_options()); - tor_assert(circuit->rend_data); - - /* XXX: This is version 2 specific (only one supported). */ - rend_pk_digest = (char *) rend_data_get_pk_digest(circuit->rend_data, - NULL); - rend_cookie = circuit->rend_data->rend_cookie; - - /* Declare the circuit dirty to avoid reuse, and for path-bias. We set the - * timestamp regardless of its content because that circuit could have been - * cannibalized so in any cases, we are about to use that circuit more. */ - circuit->base_.timestamp_dirty = time(NULL); - - /* This may be redundant */ - pathbias_count_use_attempt(circuit); - - hop = circuit->build_state->service_pending_final_cpath_ref->cpath; - - base16_encode(hexcookie,9, rend_cookie,4); - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32+1, - rend_pk_digest, REND_SERVICE_ID_LEN); - - log_info(LD_REND, - "Done building circuit %u to rendezvous with " - "cookie %s for service %s", - (unsigned)circuit->base_.n_circ_id, hexcookie, serviceid); - circuit_log_path(LOG_INFO, LD_REND, circuit); - - /* Clear the 'in-progress HS circ has timed out' flag for - * consistency with what happens on the client side; this line has - * no effect on Tor's behaviour. */ - circuit->hs_circ_has_timed_out = 0; - - /* If hop is NULL, another rend circ has already connected to this - * rend point. Close this circ. */ - if (hop == NULL) { - log_info(LD_REND, "Another rend circ has already reached this rend point; " - "closing this rend circ."); - reason = END_CIRC_REASON_NONE; - goto err; - } - - /* Remove our final cpath element from the reference, so that no - * other circuit will try to use it. Store it in - * pending_final_cpath for now to ensure that it will be freed if - * our rendezvous attempt fails. */ - circuit->build_state->pending_final_cpath = hop; - circuit->build_state->service_pending_final_cpath_ref->cpath = NULL; - - service = rend_service_get_by_pk_digest(rend_pk_digest); - if (!service) { - log_warn(LD_GENERAL, "Internal error: unrecognized service ID on " - "rendezvous circuit."); - reason = END_CIRC_REASON_INTERNAL; - goto err; - } - - /* All we need to do is send a RELAY_RENDEZVOUS1 cell... */ - memcpy(buf, rend_cookie, REND_COOKIE_LEN); - if (crypto_dh_get_public(hop->rend_dh_handshake_state, - buf+REND_COOKIE_LEN, DH1024_KEY_LEN)<0) { - log_warn(LD_GENERAL,"Couldn't get DH public key."); - reason = END_CIRC_REASON_INTERNAL; - goto err; - } - memcpy(buf+REND_COOKIE_LEN+DH1024_KEY_LEN, hop->rend_circ_nonce, - DIGEST_LEN); - - /* Send the cell */ - if (relay_send_command_from_edge(0, TO_CIRCUIT(circuit), - RELAY_COMMAND_RENDEZVOUS1, - buf, HS_LEGACY_RENDEZVOUS_CELL_SIZE, - circuit->cpath->prev)<0) { - log_warn(LD_GENERAL, "Couldn't send RENDEZVOUS1 cell."); - goto done; - } - - crypto_dh_free(hop->rend_dh_handshake_state); - hop->rend_dh_handshake_state = NULL; - - /* Append the cpath entry. */ - hop->state = CPATH_STATE_OPEN; - /* set the windows to default. these are the windows - * that the service thinks the client has. - */ - hop->package_window = circuit_initial_package_window(); - hop->deliver_window = CIRCWINDOW_START; - - cpath_extend_linked_list(&circuit->cpath, hop); - circuit->build_state->pending_final_cpath = NULL; /* prevent double-free */ - - /* Change the circuit purpose. */ - circuit_change_purpose(TO_CIRCUIT(circuit), CIRCUIT_PURPOSE_S_REND_JOINED); - - goto done; - - err: - circuit_mark_for_close(TO_CIRCUIT(circuit), reason); - done: - memwipe(buf, 0, sizeof(buf)); - memwipe(serviceid, 0, sizeof(serviceid)); - memwipe(hexcookie, 0, sizeof(hexcookie)); - - return; -} - -/* - * Manage introduction points - */ - -/** Return the (possibly non-open) introduction circuit ending at - * <b>intro</b> for the service whose public key is <b>pk_digest</b>. - * (<b>desc_version</b> is ignored). Return NULL if no such service is - * found. - */ -static origin_circuit_t * -find_intro_circuit(rend_intro_point_t *intro, const char *pk_digest) -{ - origin_circuit_t *circ = NULL; - - tor_assert(intro); - while ((circ = circuit_get_next_by_pk_and_purpose(circ, - (uint8_t *) pk_digest, CIRCUIT_PURPOSE_S_INTRO))) { - if (tor_memeq(circ->build_state->chosen_exit->identity_digest, - intro->extend_info->identity_digest, DIGEST_LEN) && - circ->rend_data) { - return circ; - } - } - - circ = NULL; - while ((circ = circuit_get_next_by_pk_and_purpose(circ, - (uint8_t *) pk_digest, - CIRCUIT_PURPOSE_S_ESTABLISH_INTRO))) { - if (tor_memeq(circ->build_state->chosen_exit->identity_digest, - intro->extend_info->identity_digest, DIGEST_LEN) && - circ->rend_data) { - return circ; - } - } - return NULL; -} - -/** Return the corresponding introdution point using the circuit <b>circ</b> - * found in the <b>service</b>. NULL is returned if not found. */ -static rend_intro_point_t * -find_expiring_intro_point(rend_service_t *service, origin_circuit_t *circ) -{ - tor_assert(service); - tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO || - TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_INTRO); - - SMARTLIST_FOREACH(service->expiring_nodes, rend_intro_point_t *, - intro_point, - if (crypto_pk_eq_keys(intro_point->intro_key, circ->intro_key)) { - return intro_point; - }); - - return NULL; -} - -/** Return a pointer to the rend_intro_point_t corresponding to the - * service-side introduction circuit <b>circ</b>. */ -static rend_intro_point_t * -find_intro_point(origin_circuit_t *circ) -{ - const char *serviceid; - rend_service_t *service = NULL; - - tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO || - TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_INTRO); - tor_assert(circ->rend_data); - serviceid = rend_data_get_address(circ->rend_data); - - SMARTLIST_FOREACH(rend_service_list, rend_service_t *, s, - if (tor_memeq(s->service_id, serviceid, REND_SERVICE_ID_LEN_BASE32)) { - service = s; - break; - }); - - if (service == NULL) return NULL; - - SMARTLIST_FOREACH(service->intro_nodes, rend_intro_point_t *, intro_point, - if (crypto_pk_eq_keys(intro_point->intro_key, circ->intro_key)) { - return intro_point; - }); - - return NULL; -} - -/** Upload the rend_encoded_v2_service_descriptor_t's in <b>descs</b> - * associated with the rend_service_descriptor_t <b>renddesc</b> to - * the responsible hidden service directories OR the hidden service - * directories specified by <b>hs_dirs</b>; <b>service_id</b> and - * <b>seconds_valid</b> are only passed for logging purposes. - */ -void -directory_post_to_hs_dir(rend_service_descriptor_t *renddesc, - smartlist_t *descs, smartlist_t *hs_dirs, - const char *service_id, int seconds_valid) -{ - int i, j, failed_upload = 0; - smartlist_t *responsible_dirs = smartlist_new(); - smartlist_t *successful_uploads = smartlist_new(); - routerstatus_t *hs_dir; - for (i = 0; i < smartlist_len(descs); i++) { - rend_encoded_v2_service_descriptor_t *desc = smartlist_get(descs, i); - /** If any HSDirs are specified, they should be used instead of - * the responsible directories */ - if (hs_dirs && smartlist_len(hs_dirs) > 0) { - smartlist_add_all(responsible_dirs, hs_dirs); - } else { - /* Determine responsible dirs. */ - if (hid_serv_get_responsible_directories(responsible_dirs, - desc->desc_id) < 0) { - log_warn(LD_REND, "Could not determine the responsible hidden service " - "directories to post descriptors to."); - control_event_hs_descriptor_upload(service_id, - "UNKNOWN", - "UNKNOWN", NULL); - goto done; - } - } - for (j = 0; j < smartlist_len(responsible_dirs); j++) { - char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; - char *hs_dir_ip; - const node_t *node; - rend_data_t *rend_data; - hs_dir = smartlist_get(responsible_dirs, j); - if (smartlist_contains_digest(renddesc->successful_uploads, - hs_dir->identity_digest)) - /* Don't upload descriptor if we succeeded in doing so last time. */ - continue; - node = node_get_by_id(hs_dir->identity_digest); - if (!node || !node_has_preferred_descriptor(node,0)) { - log_info(LD_REND, "Not launching upload for for v2 descriptor to " - "hidden service directory %s; we don't have its " - "router descriptor. Queuing for later upload.", - safe_str_client(routerstatus_describe(hs_dir))); - failed_upload = -1; - continue; - } - /* Send publish request. */ - - /* We need the service ID to identify which service did the upload - * request. Lookup is made in rend_service_desc_has_uploaded(). */ - rend_data = rend_data_client_create(service_id, desc->desc_id, NULL, - REND_NO_AUTH); - directory_request_t *req = - directory_request_new(DIR_PURPOSE_UPLOAD_RENDDESC_V2); - directory_request_set_routerstatus(req, hs_dir); - directory_request_set_indirection(req, DIRIND_ANONYMOUS); - directory_request_set_payload(req, - desc->desc_str, strlen(desc->desc_str)); - directory_request_set_rend_query(req, rend_data); - directory_initiate_request(req); - directory_request_free(req); - - rend_data_free(rend_data); - base32_encode(desc_id_base32, sizeof(desc_id_base32), - desc->desc_id, DIGEST_LEN); - hs_dir_ip = tor_addr_to_str_dup(&hs_dir->ipv4_addr); - if (hs_dir_ip) { - log_info(LD_REND, "Launching upload for v2 descriptor for " - "service '%s' with descriptor ID '%s' with validity " - "of %d seconds to hidden service directory '%s' on " - "%s:%d.", - safe_str_client(service_id), - safe_str_client(desc_id_base32), - seconds_valid, - hs_dir->nickname, - hs_dir_ip, - hs_dir->ipv4_orport); - tor_free(hs_dir_ip); - } - - control_event_hs_descriptor_upload(service_id, - hs_dir->identity_digest, - desc_id_base32, NULL); - /* Remember successful upload to this router for next time. */ - if (!smartlist_contains_digest(successful_uploads, - hs_dir->identity_digest)) - smartlist_add(successful_uploads, hs_dir->identity_digest); - } - smartlist_clear(responsible_dirs); - } - if (!failed_upload) { - if (renddesc->successful_uploads) { - SMARTLIST_FOREACH(renddesc->successful_uploads, char *, c, tor_free(c);); - smartlist_free(renddesc->successful_uploads); - renddesc->successful_uploads = NULL; - } - renddesc->all_uploads_performed = 1; - } else { - /* Remember which routers worked this time, so that we don't upload the - * descriptor to them again. */ - if (!renddesc->successful_uploads) - renddesc->successful_uploads = smartlist_new(); - SMARTLIST_FOREACH(successful_uploads, const char *, c, { - if (!smartlist_contains_digest(renddesc->successful_uploads, c)) { - char *hsdir_id = tor_memdup(c, DIGEST_LEN); - smartlist_add(renddesc->successful_uploads, hsdir_id); - } - }); - } - done: - smartlist_free(responsible_dirs); - smartlist_free(successful_uploads); -} - -/** Encode and sign an up-to-date service descriptor for <b>service</b>, - * and upload it/them to the responsible hidden service directories. - */ -static void -upload_service_descriptor(rend_service_t *service) -{ - time_t now = time(NULL); - int rendpostperiod; - char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; - int uploaded = 0; - - rendpostperiod = get_options()->RendPostPeriod; - - networkstatus_t *c = networkstatus_get_latest_consensus(); - if (c && smartlist_len(c->routerstatus_list) > 0) { - int seconds_valid, i, j, num_descs; - smartlist_t *descs = smartlist_new(); - smartlist_t *client_cookies = smartlist_new(); - /* Either upload a single descriptor (including replicas) or one - * descriptor for each authorized client in case of authorization - * type 'stealth'. */ - num_descs = service->auth_type == REND_STEALTH_AUTH ? - smartlist_len(service->clients) : 1; - for (j = 0; j < num_descs; j++) { - crypto_pk_t *client_key = NULL; - rend_authorized_client_t *client = NULL; - smartlist_clear(client_cookies); - switch (service->auth_type) { - case REND_NO_AUTH: - /* Do nothing here. */ - break; - case REND_BASIC_AUTH: - SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, - cl, smartlist_add(client_cookies, cl->descriptor_cookie)); - break; - case REND_STEALTH_AUTH: - client = smartlist_get(service->clients, j); - client_key = client->client_key; - smartlist_add(client_cookies, client->descriptor_cookie); - break; - } - /* Encode the current descriptor. */ - seconds_valid = rend_encode_v2_descriptors(descs, service->desc, - now, 0, - service->auth_type, - client_key, - client_cookies); - if (seconds_valid < 0) { - log_warn(LD_BUG, "Internal error: couldn't encode service " - "descriptor; not uploading."); - smartlist_free(descs); - smartlist_free(client_cookies); - return; - } - rend_get_service_id(service->desc->pk, serviceid); - if (get_options()->PublishHidServDescriptors) { - /* Post the current descriptors to the hidden service directories. */ - /* This log message is used by Chutney as part of its bootstrap - * detection mechanism. Please don't change without first checking - * Chutney. */ - log_info(LD_REND, "Launching upload for hidden service %s", - serviceid); - directory_post_to_hs_dir(service->desc, descs, NULL, serviceid, - seconds_valid); - } - /* Free memory for descriptors. */ - for (i = 0; i < smartlist_len(descs); i++) - rend_encoded_v2_service_descriptor_free_(smartlist_get(descs, i)); - smartlist_clear(descs); - /* Update next upload time. */ - if (seconds_valid - REND_TIME_PERIOD_OVERLAPPING_V2_DESCS - > rendpostperiod) - service->next_upload_time = now + rendpostperiod; - else if (seconds_valid < REND_TIME_PERIOD_OVERLAPPING_V2_DESCS) - service->next_upload_time = now + seconds_valid + 1; - else - service->next_upload_time = now + seconds_valid - - REND_TIME_PERIOD_OVERLAPPING_V2_DESCS + 1; - /* Post also the next descriptors, if necessary. */ - if (seconds_valid < REND_TIME_PERIOD_OVERLAPPING_V2_DESCS) { - seconds_valid = rend_encode_v2_descriptors(descs, service->desc, - now, 1, - service->auth_type, - client_key, - client_cookies); - if (seconds_valid < 0) { - log_warn(LD_BUG, "Internal error: couldn't encode service " - "descriptor; not uploading."); - smartlist_free(descs); - smartlist_free(client_cookies); - return; - } - if (get_options()->PublishHidServDescriptors) { - directory_post_to_hs_dir(service->desc, descs, NULL, serviceid, - seconds_valid); - } - /* Free memory for descriptors. */ - for (i = 0; i < smartlist_len(descs); i++) - rend_encoded_v2_service_descriptor_free_(smartlist_get(descs, i)); - smartlist_clear(descs); - } - } - smartlist_free(descs); - smartlist_free(client_cookies); - uploaded = 1; - if (get_options()->PublishHidServDescriptors) { - log_info(LD_REND, "Successfully uploaded v2 rend descriptors!"); - } else { - log_info(LD_REND, "Successfully stored created v2 rend descriptors!"); - } - } - - /* If not uploaded, try again in one minute. */ - if (!uploaded) - service->next_upload_time = now + 60; - - /* Unmark dirty flag of this service. */ - service->desc_is_dirty = 0; -} - -/** Return the number of INTRODUCE2 cells this hidden service has received - * from this intro point. */ -static int -intro_point_accepted_intro_count(rend_intro_point_t *intro) -{ - return intro->accepted_introduce2_count; -} - -/** Return non-zero iff <b>intro</b> should 'expire' now (i.e. we - * should stop publishing it in new descriptors and eventually close - * it). */ -static int -intro_point_should_expire_now(rend_intro_point_t *intro, - time_t now) -{ - tor_assert(intro != NULL); - - if (intro->time_published == -1) { - /* Don't expire an intro point if we haven't even published it yet. */ - return 0; - } - - if (intro_point_accepted_intro_count(intro) >= - intro->max_introductions) { - /* This intro point has been used too many times. Expire it now. */ - return 1; - } - - if (intro->time_to_expire == -1) { - /* This intro point has been published, but we haven't picked an - * expiration time for it. Pick one now. */ - int intro_point_lifetime_seconds = - crypto_rand_int_range(INTRO_POINT_LIFETIME_MIN_SECONDS, - INTRO_POINT_LIFETIME_MAX_SECONDS); - - /* Start the expiration timer now, rather than when the intro - * point was first published. There shouldn't be much of a time - * difference. */ - intro->time_to_expire = now + intro_point_lifetime_seconds; - - return 0; - } - - /* This intro point has a time to expire set already. Use it. */ - return (now >= intro->time_to_expire); -} - -/** Iterate over intro points in the given service and remove the invalid - * ones. For an intro point object to be considered invalid, the circuit - * _and_ node need to have disappeared. - * - * If the intro point should expire, it's placed into the expiring_nodes - * list of the service and removed from the active intro nodes list. - * - * If <b>exclude_nodes</b> is not NULL, add the valid nodes to it. - * - * If <b>retry_nodes</b> is not NULL, add the valid node to it if the - * circuit disappeared but the node is still in the consensus. */ -static void -remove_invalid_intro_points(rend_service_t *service, - smartlist_t *exclude_nodes, - smartlist_t *retry_nodes, time_t now) -{ - tor_assert(service); - - /* Remove any expired nodes that doesn't have a circuit. */ - SMARTLIST_FOREACH_BEGIN(service->expiring_nodes, rend_intro_point_t *, - intro) { - origin_circuit_t *intro_circ = - find_intro_circuit(intro, service->pk_digest); - if (intro_circ) { - continue; - } - /* No more circuit, cleanup the into point object. */ - SMARTLIST_DEL_CURRENT(service->expiring_nodes, intro); - rend_intro_point_free(intro); - } SMARTLIST_FOREACH_END(intro); - - SMARTLIST_FOREACH_BEGIN(service->intro_nodes, rend_intro_point_t *, - intro) { - /* Find the introduction point node object. */ - const node_t *node = - node_get_by_id(intro->extend_info->identity_digest); - /* Find the intro circuit, this might be NULL. */ - origin_circuit_t *intro_circ = - find_intro_circuit(intro, service->pk_digest); - - /* Add the valid node to the exclusion list so we don't try to establish - * an introduction point to it again. */ - if (node && exclude_nodes) { - smartlist_add(exclude_nodes, (void*) node); - } - - /* First, make sure we still have a valid circuit for this intro point. - * If we dont, we'll give up on it and make a new one. */ - if (intro_circ == NULL) { - log_info(LD_REND, "Attempting to retry on %s as intro point for %s" - " (circuit disappeared).", - safe_str_client(extend_info_describe(intro->extend_info)), - safe_str_client(service->service_id)); - /* We've lost the circuit for this intro point, flag it so it can be - * accounted for when considiring uploading a descriptor. */ - intro->circuit_established = 0; - - /* Node is gone or we've reached our maximum circuit creation retry - * count, clean up everything, we'll find a new one. */ - if (node == NULL || - intro->circuit_retries >= MAX_INTRO_POINT_CIRCUIT_RETRIES) { - rend_intro_point_free(intro); - SMARTLIST_DEL_CURRENT(service->intro_nodes, intro); - /* We've just killed the intro point, nothing left to do. */ - continue; - } - - /* The intro point is still alive so let's try to use it again because - * we have a published descriptor containing it. Keep the intro point - * in the intro_nodes list because it's still valid, we are rebuilding - * a circuit to it. */ - if (retry_nodes) { - smartlist_add(retry_nodes, intro); - } - } - /* else, the circuit is valid so in both cases, node being alive or not, - * we leave the circuit and intro point object as is. Closing the - * circuit here would leak new consensus timing and freeing the intro - * point object would make the intro circuit unusable. */ - - /* Now, check if intro point should expire. If it does, queue it so - * it can be cleaned up once it has been replaced properly. */ - if (intro_point_should_expire_now(intro, now)) { - log_info(LD_REND, "Expiring %s as intro point for %s.", - safe_str_client(extend_info_describe(intro->extend_info)), - safe_str_client(service->service_id)); - /* We might have put it in the retry list if so, undo. */ - if (retry_nodes) { - smartlist_remove(retry_nodes, intro); - } - smartlist_add(service->expiring_nodes, intro); - SMARTLIST_DEL_CURRENT(service->intro_nodes, intro); - /* Intro point is expired, we need a new one thus don't consider it - * anymore has a valid established intro point. */ - intro->circuit_established = 0; - } - } SMARTLIST_FOREACH_END(intro); -} - -/** A new descriptor has been successfully uploaded for the given - * <b>rend_data</b>. Remove and free the expiring nodes from the associated - * service. */ -void -rend_service_desc_has_uploaded(const rend_data_t *rend_data) -{ - rend_service_t *service; - const char *onion_address; - - tor_assert(rend_data); - - onion_address = rend_data_get_address(rend_data); - - service = rend_service_get_by_service_id(onion_address); - if (service == NULL) { - return; - } - - SMARTLIST_FOREACH_BEGIN(service->expiring_nodes, rend_intro_point_t *, - intro) { - origin_circuit_t *intro_circ = - find_intro_circuit(intro, service->pk_digest); - if (intro_circ != NULL) { - circuit_mark_for_close(TO_CIRCUIT(intro_circ), - END_CIRC_REASON_FINISHED); - } - SMARTLIST_DEL_CURRENT(service->expiring_nodes, intro); - rend_intro_point_free(intro); - } SMARTLIST_FOREACH_END(intro); -} - -/** Don't try to build more than this many circuits before giving up - * for a while. Dynamically calculated based on the configured number of - * introduction points for the service, n_intro_points_wanted. */ -static int -rend_max_intro_circs_per_period(unsigned int n_intro_points_wanted) -{ - /* Allow all but one of the initial connections to fail and be - * retried. (If all fail, we *want* to wait, because something is broken.) */ - tor_assert(n_intro_points_wanted <= NUM_INTRO_POINTS_MAX); - - /* For the normal use case, 3 intro points plus 2 extra for performance and - * allow that twice because once every 24h or so, we can do it twice for two - * descriptors that is the current one and the next one. So (3 + 2) * 2 == - * 12 allowed attempts for one period. */ - return ((n_intro_points_wanted + NUM_INTRO_POINTS_EXTRA) * 2); -} - -/** For every service, check how many intro points it currently has, and: - * - Invalidate introdution points based on specific criteria, see - * remove_invalid_intro_points comments. - * - Pick new intro points as necessary. - * - Launch circuits to any new intro points. - * - * This is called once a second by the main loop. - */ -void -rend_consider_services_intro_points(time_t now) -{ - int i; - const or_options_t *options = get_options(); - /* Are we in single onion mode? */ - const int allow_direct = rend_service_allow_non_anonymous_connection( - get_options()); - /* List of nodes we need to _exclude_ when choosing a new node to - * establish an intro point to. */ - smartlist_t *exclude_nodes; - /* List of nodes we need to retry to build a circuit on them because the - * node is valid but circuit died. */ - smartlist_t *retry_nodes; - - if (!have_completed_a_circuit()) - return; - - exclude_nodes = smartlist_new(); - retry_nodes = smartlist_new(); - - SMARTLIST_FOREACH_BEGIN(rend_service_list, rend_service_t *, service) { - int r; - /* Number of intro points we want to open and add to the intro nodes - * list of the service. */ - unsigned int n_intro_points_to_open; - /* Have an unsigned len so we can use it to compare values else gcc is - * not happy with unmatching signed comparison. */ - unsigned int intro_nodes_len; - /* Different service are allowed to have the same introduction point as - * long as they are on different circuit thus why we clear this list. */ - smartlist_clear(exclude_nodes); - smartlist_clear(retry_nodes); - - /* Cleanup the invalid intro points and save the node objects, if any, - * in the exclude_nodes and retry_nodes lists. */ - remove_invalid_intro_points(service, exclude_nodes, retry_nodes, now); - - /* This retry period is important here so we don't stress circuit - * creation. */ - - if (now > service->intro_period_started + INTRO_CIRC_RETRY_PERIOD) { - /* One period has elapsed: - * - if we stopped, we can try building circuits again, - * - if we haven't, we reset the circuit creation counts. */ - rend_log_intro_limit(service, LOG_INFO); - service->intro_period_started = now; - service->n_intro_circuits_launched = 0; - } else if (service->n_intro_circuits_launched >= - rend_max_intro_circs_per_period( - service->n_intro_points_wanted)) { - /* We have failed too many times in this period; wait for the next - * one before we try to initiate any more connections. */ - rend_log_intro_limit(service, LOG_WARN); - continue; - } - - /* Let's try to rebuild circuit on the nodes we want to retry on. */ - SMARTLIST_FOREACH_BEGIN(retry_nodes, rend_intro_point_t *, intro) { - r = rend_service_launch_establish_intro(service, intro); - if (r < 0) { - log_warn(LD_REND, "Error launching circuit to node %s for service %s.", - safe_str_client(extend_info_describe(intro->extend_info)), - safe_str_client(service->service_id)); - /* Unable to launch a circuit to that intro point, remove it from - * the valid list so we can create a new one. */ - smartlist_remove(service->intro_nodes, intro); - rend_intro_point_free(intro); - continue; - } - intro->circuit_retries++; - } SMARTLIST_FOREACH_END(intro); - - /* Avoid mismatched signed comparison below. */ - intro_nodes_len = (unsigned int) smartlist_len(service->intro_nodes); - - /* Quiescent state, we have more or the equal amount of wanted node for - * this service. Proceed to the next service. We can have more nodes - * because we launch extra preemptive circuits if our intro nodes list was - * originally empty for performance reasons. */ - if (intro_nodes_len >= service->n_intro_points_wanted) { - continue; - } - - /* Number of intro points we want to open which is the wanted amount minus - * the current amount of valid nodes. We know that this won't underflow - * because of the check above. */ - n_intro_points_to_open = service->n_intro_points_wanted - intro_nodes_len; - if (intro_nodes_len == 0) { - /* We want to end up with n_intro_points_wanted intro points, but if - * we have no intro points at all (chances are they all cycled or we - * are starting up), we launch NUM_INTRO_POINTS_EXTRA extra circuits - * and use the first n_intro_points_wanted that complete. See proposal - * #155, section 4 for the rationale of this which is purely for - * performance. - * - * The ones after the first n_intro_points_to_open will be converted - * to 'general' internal circuits in rend_service_intro_has_opened(), - * and then we'll drop them from the list of intro points. */ - n_intro_points_to_open += NUM_INTRO_POINTS_EXTRA; - } - - for (i = 0; i < (int) n_intro_points_to_open; i++) { - const node_t *node; - rend_intro_point_t *intro; - router_crn_flags_t flags = CRN_NEED_UPTIME|CRN_NEED_DESC; - router_crn_flags_t direct_flags = flags; - direct_flags |= CRN_PREF_ADDR; - direct_flags |= CRN_DIRECT_CONN; - - node = router_choose_random_node(exclude_nodes, - options->ExcludeNodes, - allow_direct ? direct_flags : flags); - /* If we are in single onion mode, retry node selection for a 3-hop - * path */ - if (allow_direct && !node) { - log_info(LD_REND, - "Unable to find an intro point that we can connect to " - "directly for %s, falling back to a 3-hop path.", - safe_str_client(service->service_id)); - node = router_choose_random_node(exclude_nodes, - options->ExcludeNodes, flags); - } - - if (!node) { - log_warn(LD_REND, - "We only have %d introduction points established for %s; " - "wanted %u.", - smartlist_len(service->intro_nodes), - safe_str_client(service->service_id), - n_intro_points_to_open); - break; - } - /* Add the chosen node to the exclusion list in order to avoid picking - * it again in the next iteration. */ - smartlist_add(exclude_nodes, (void*)node); - intro = tor_malloc_zero(sizeof(rend_intro_point_t)); - /* extend_info is for clients, so we want the multi-hop primary ORPort, - * even if we are a single onion service and intend to connect to it - * directly ourselves. */ - intro->extend_info = extend_info_from_node(node, 0); - if (BUG(intro->extend_info == NULL)) { - tor_free(intro); - break; - } - intro->intro_key = crypto_pk_new(); - const int fail = crypto_pk_generate_key(intro->intro_key); - tor_assert(!fail); - intro->time_published = -1; - intro->time_to_expire = -1; - intro->max_introductions = - crypto_rand_int_range(INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS, - INTRO_POINT_MAX_LIFETIME_INTRODUCTIONS); - smartlist_add(service->intro_nodes, intro); - log_info(LD_REND, "Picked router %s as an intro point for %s.", - safe_str_client(node_describe(node)), - safe_str_client(service->service_id)); - /* Establish new introduction circuit to our chosen intro point. */ - r = rend_service_launch_establish_intro(service, intro); - if (r < 0) { - log_warn(LD_REND, "Error launching circuit to node %s for service %s.", - safe_str_client(extend_info_describe(intro->extend_info)), - safe_str_client(service->service_id)); - /* This function will be called again by the main loop so this intro - * point without a intro circuit will be retried on or removed after - * a maximum number of attempts. */ - } - } - } SMARTLIST_FOREACH_END(service); - smartlist_free(exclude_nodes); - smartlist_free(retry_nodes); -} - -#define MIN_REND_INITIAL_POST_DELAY (30) -#define MIN_REND_INITIAL_POST_DELAY_TESTING (5) - -/** Regenerate and upload rendezvous service descriptors for all - * services, if necessary. If the descriptor has been dirty enough - * for long enough, definitely upload; else only upload when the - * periodic timeout has expired. - * - * For the first upload, pick a random time between now and two periods - * from now, and pick it independently for each service. - */ -void -rend_consider_services_upload(time_t now) -{ - int i; - rend_service_t *service; - const or_options_t *options = get_options(); - int rendpostperiod = options->RendPostPeriod; - int rendinitialpostdelay = (options->TestingTorNetwork ? - MIN_REND_INITIAL_POST_DELAY_TESTING : - MIN_REND_INITIAL_POST_DELAY); - - for (i=0; i < smartlist_len(rend_service_list); ++i) { - service = smartlist_get(rend_service_list, i); - if (!service->next_upload_time) { /* never been uploaded yet */ - /* The fixed lower bound of rendinitialpostdelay seconds ensures that - * the descriptor is stable before being published. See comment below. */ - service->next_upload_time = - now + rendinitialpostdelay + crypto_rand_int(2*rendpostperiod); - /* Single Onion Services prioritise availability over hiding their - * startup time, as their IP address is publicly discoverable anyway. - */ - if (rend_service_reveal_startup_time(options)) { - service->next_upload_time = now + rendinitialpostdelay; - } - } - /* Does every introduction points have been established? */ - unsigned int intro_points_ready = - count_established_intro_points(service) >= - service->n_intro_points_wanted; - if (intro_points_ready && - (service->next_upload_time < now || - (service->desc_is_dirty && - service->desc_is_dirty < now-rendinitialpostdelay))) { - /* if it's time, or if the directory servers have a wrong service - * descriptor and ours has been stable for rendinitialpostdelay seconds, - * upload a new one of each format. */ - rend_service_update_descriptor(service); - upload_service_descriptor(service); - } - } -} - -/** True if the list of available router descriptors might have changed so - * that we should have a look whether we can republish previously failed - * rendezvous service descriptors. */ -static int consider_republishing_rend_descriptors = 1; - -/** Called when our internal view of the directory has changed, so that we - * might have router descriptors of hidden service directories available that - * we did not have before. */ -void -rend_hsdir_routers_changed(void) -{ - consider_republishing_rend_descriptors = 1; -} - -/** Consider republication of v2 rendezvous service descriptors that failed - * previously, but without regenerating descriptor contents. - */ -void -rend_consider_descriptor_republication(void) -{ - int i; - rend_service_t *service; - - if (!consider_republishing_rend_descriptors) - return; - consider_republishing_rend_descriptors = 0; - - if (!get_options()->PublishHidServDescriptors) - return; - - for (i=0; i < smartlist_len(rend_service_list); ++i) { - service = smartlist_get(rend_service_list, i); - if (service->desc && !service->desc->all_uploads_performed) { - /* If we failed in uploading a descriptor last time, try again *without* - * updating the descriptor's contents. */ - upload_service_descriptor(service); - } - } -} - -/** Log the status of introduction points for all rendezvous services - * at log severity <b>severity</b>. - */ -void -rend_service_dump_stats(int severity) -{ - rend_service_t *service; - rend_intro_point_t *intro; - const char *safe_name; - origin_circuit_t *circ; - - for (int i = 0; i < smartlist_len(rend_service_list); ++i) { - service = smartlist_get(rend_service_list, i); - tor_log(severity, LD_GENERAL, "Service configured in %s:", - rend_service_escaped_dir(service)); - for (int j = 0; j < smartlist_len(service->intro_nodes); ++j) { - intro = smartlist_get(service->intro_nodes, j); - safe_name = safe_str_client(intro->extend_info->nickname); - - circ = find_intro_circuit(intro, service->pk_digest); - if (!circ) { - tor_log(severity, LD_GENERAL, " Intro point %d at %s: no circuit", - j, safe_name); - continue; - } - tor_log(severity, LD_GENERAL, " Intro point %d at %s: circuit is %s", - j, safe_name, circuit_state_to_string(circ->base_.state)); - } - } -} - -/** Given <b>conn</b>, a rendezvous exit stream, look up the hidden service for - * <b>circ</b>, and look up the port and address based on conn-\>port. - * Assign the actual conn-\>addr and conn-\>port. Return -2 on failure - * for which the circuit should be closed, -1 on other failure, - * or 0 for success. - */ -int -rend_service_set_connection_addr_port(edge_connection_t *conn, - origin_circuit_t *circ) -{ - rend_service_t *service; - char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; - const char *rend_pk_digest; - - tor_assert(circ->base_.purpose == CIRCUIT_PURPOSE_S_REND_JOINED); - tor_assert(circ->rend_data); - log_debug(LD_REND,"beginning to hunt for addr/port"); - rend_pk_digest = (char *) rend_data_get_pk_digest(circ->rend_data, NULL); - base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32+1, - rend_pk_digest, REND_SERVICE_ID_LEN); - service = rend_service_get_by_pk_digest(rend_pk_digest); - if (!service) { - log_warn(LD_REND, "Couldn't find any service associated with pk %s on " - "rendezvous circuit %u; closing.", - serviceid, (unsigned)circ->base_.n_circ_id); - return -2; - } - if (service->max_streams_per_circuit > 0) { - /* Enforce the streams-per-circuit limit, and refuse to provide a - * mapping if this circuit will exceed the limit. */ -#define MAX_STREAM_WARN_INTERVAL 600 - static struct ratelim_t stream_ratelim = - RATELIM_INIT(MAX_STREAM_WARN_INTERVAL); - if (circ->rend_data->nr_streams >= service->max_streams_per_circuit) { - log_fn_ratelim(&stream_ratelim, LOG_WARN, LD_REND, - "Maximum streams per circuit limit reached on rendezvous " - "circuit %u; %s. Circuit has %d out of %d streams.", - (unsigned)circ->base_.n_circ_id, - service->max_streams_close_circuit ? - "closing circuit" : - "ignoring open stream request", - circ->rend_data->nr_streams, - service->max_streams_per_circuit); - return service->max_streams_close_circuit ? -2 : -1; - } - } - - if (hs_set_conn_addr_port(service->ports, conn) == 0) { - /* Successfully set the port to the connection. We are done. */ - return 0; - } - - log_info(LD_REND, - "No virtual port mapping exists for port %d on service %s", - conn->base_.port, serviceid); - - if (service->allow_unknown_ports) - return -1; - else - return -2; -} - -/* Are HiddenServiceSingleHopMode and HiddenServiceNonAnonymousMode consistent? - */ -static int -rend_service_non_anonymous_mode_consistent(const or_options_t *options) -{ - /* !! is used to make these options boolean */ - return (!! options->HiddenServiceSingleHopMode == - !! options->HiddenServiceNonAnonymousMode); -} - -/* Do the options allow onion services to make direct (non-anonymous) - * connections to introduction or rendezvous points? - * Must only be called after options_validate_single_onion() has successfully - * checked onion service option consistency. - * Returns true if tor is in HiddenServiceSingleHopMode. */ -int -rend_service_allow_non_anonymous_connection(const or_options_t *options) -{ - tor_assert(rend_service_non_anonymous_mode_consistent(options)); - return options->HiddenServiceSingleHopMode ? 1 : 0; -} - -/* Do the options allow us to reveal the exact startup time of the onion - * service? - * Single Onion Services prioritise availability over hiding their - * startup time, as their IP address is publicly discoverable anyway. - * Must only be called after options_validate_single_onion() has successfully - * checked onion service option consistency. - * Returns true if tor is in non-anonymous hidden service mode. */ -int -rend_service_reveal_startup_time(const or_options_t *options) -{ - tor_assert(rend_service_non_anonymous_mode_consistent(options)); - return rend_service_non_anonymous_mode_enabled(options); -} - -/* Is non-anonymous mode enabled using the HiddenServiceNonAnonymousMode - * config option? - * Must only be called after options_validate_single_onion() has successfully - * checked onion service option consistency. - */ -int -rend_service_non_anonymous_mode_enabled(const or_options_t *options) -{ - tor_assert(rend_service_non_anonymous_mode_consistent(options)); - return options->HiddenServiceNonAnonymousMode ? 1 : 0; -} - -#ifdef TOR_UNIT_TESTS - -STATIC void -set_rend_service_list(smartlist_t *new_list) -{ - rend_service_list = new_list; -} - -STATIC void -set_rend_rend_service_staging_list(smartlist_t *new_list) -{ - rend_service_staging_list = new_list; -} - -#endif /* defined(TOR_UNIT_TESTS) */ diff --git a/src/feature/rend/rendservice.h b/src/feature/rend/rendservice.h deleted file mode 100644 index 012afc0f9f..0000000000 --- a/src/feature/rend/rendservice.h +++ /dev/null @@ -1,223 +0,0 @@ -/* Copyright (c) 2001 Matej Pfajfar. - * Copyright (c) 2001-2004, Roger Dingledine. - * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ -/* See LICENSE for licensing information */ - -/** - * \file rendservice.h - * \brief Header file for rendservice.c. - **/ - -#ifndef TOR_RENDSERVICE_H -#define TOR_RENDSERVICE_H - -#include "core/or/or.h" -#include "feature/hs/hs_service.h" - -typedef struct rend_intro_cell_t rend_intro_cell_t; -struct config_line_t; - -/* This can be used for both INTRODUCE1 and INTRODUCE2 */ - -struct rend_intro_cell_t { - /* Is this an INTRODUCE1 or INTRODUCE2? (set to 1 or 2) */ - uint8_t type; - /* Public key digest */ - uint8_t pk[DIGEST_LEN]; - /* Optionally, store ciphertext here */ - uint8_t *ciphertext; - ssize_t ciphertext_len; - /* Optionally, store plaintext */ - uint8_t *plaintext; - ssize_t plaintext_len; - /* Have we parsed the plaintext? */ - uint8_t parsed; - /* intro protocol version (0, 1, 2 or 3) */ - uint8_t version; - /* Version-specific parts */ - union { - struct { - /* Rendezvous point nickname or hex-encoded key digest */ - uint8_t rp[42]; - } v0_v1; - struct { - /* The extend_info_t struct has everything v2 uses */ - extend_info_t *extend_info; - } v2; - struct { - /* Auth type used */ - uint8_t auth_type; - /* Length of auth data */ - uint16_t auth_len; - /* Auth data */ - uint8_t *auth_data; - /* Rendezvous point's IP address/port, identity digest and onion key */ - extend_info_t *extend_info; - } v3; - } u; - /* Rendezvous cookie */ - uint8_t rc[REND_COOKIE_LEN]; - /* Diffie-Hellman data */ - uint8_t dh[DH1024_KEY_LEN]; -}; - -#ifdef RENDSERVICE_PRIVATE - -/** Represents a single hidden service running at this OP. */ -typedef struct rend_service_t { - /* Fields specified in config file */ - char *directory; /**< where in the filesystem it stores it. Will be NULL if - * this service is ephemeral. */ - int dir_group_readable; /**< if 1, allow group read - permissions on directory */ - smartlist_t *ports; /**< List of rend_service_port_config_t */ - rend_auth_type_t auth_type; /**< Client authorization type or 0 if no client - * authorization is performed. */ - smartlist_t *clients; /**< List of rend_authorized_client_t's of - * clients that may access our service. Can be NULL - * if no client authorization is performed. */ - /* Other fields */ - crypto_pk_t *private_key; /**< Permanent hidden-service key. */ - char service_id[REND_SERVICE_ID_LEN_BASE32+1]; /**< Onion address without - * '.onion' */ - char pk_digest[DIGEST_LEN]; /**< Hash of permanent hidden-service key. */ - smartlist_t *intro_nodes; /**< List of rend_intro_point_t's we have, - * or are trying to establish. */ - /** List of rend_intro_point_t that are expiring. They are removed once - * the new descriptor is successfully uploaded. A node in this list CAN - * NOT appear in the intro_nodes list. */ - smartlist_t *expiring_nodes; - time_t intro_period_started; /**< Start of the current period to build - * introduction points. */ - int n_intro_circuits_launched; /**< Count of intro circuits we have - * established in this period. */ - unsigned int n_intro_points_wanted; /**< Number of intro points this - * service wants to have open. */ - rend_service_descriptor_t *desc; /**< Current hidden service descriptor. */ - time_t desc_is_dirty; /**< Time at which changes to the hidden service - * descriptor content occurred, or 0 if it's - * up-to-date. */ - time_t next_upload_time; /**< Scheduled next hidden service descriptor - * upload time. */ - /** Replay cache for Diffie-Hellman values of INTRODUCE2 cells, to - * detect repeats. Clients may send INTRODUCE1 cells for the same - * rendezvous point through two or more different introduction points; - * when they do, this keeps us from launching multiple simultaneous attempts - * to connect to the same rend point. */ - replaycache_t *accepted_intro_dh_parts; - /** If true, we don't close circuits for making requests to unsupported - * ports. */ - int allow_unknown_ports; - /** The maximum number of simultaneous streams-per-circuit that are allowed - * to be established, or 0 if no limit is set. - */ - int max_streams_per_circuit; - /** If true, we close circuits that exceed the max_streams_per_circuit - * limit. */ - int max_streams_close_circuit; -} rend_service_t; - -STATIC void rend_service_free_(rend_service_t *service); -#define rend_service_free(s) \ - FREE_AND_NULL(rend_service_t, rend_service_free_, (s)) -STATIC char *rend_service_sos_poison_path(const rend_service_t *service); -STATIC int rend_service_verify_single_onion_poison( - const rend_service_t *s, - const or_options_t *options); -STATIC int rend_service_poison_new_single_onion_dir( - const rend_service_t *s, - const or_options_t* options); -#ifdef TOR_UNIT_TESTS - -STATIC void set_rend_service_list(smartlist_t *new_list); -STATIC void set_rend_rend_service_staging_list(smartlist_t *new_list); -STATIC void rend_service_prune_list_impl_(void); - -#endif /* defined(TOR_UNIT_TESTS) */ - -#endif /* defined(RENDSERVICE_PRIVATE) */ - -int rend_num_services(void); -struct hs_opts_t; -int rend_config_service(const struct hs_opts_t *hs_opts, - const or_options_t *options, - hs_service_config_t *config); -void rend_service_prune_list(void); -void rend_service_free_staging_list(void); -int rend_service_load_all_keys(const smartlist_t *service_list); -int rend_service_key_on_disk(const char *directory_path); -void rend_services_add_filenames_to_lists(smartlist_t *open_lst, - smartlist_t *stat_lst); -void rend_consider_services_intro_points(time_t now); -void rend_consider_services_upload(time_t now); -void rend_hsdir_routers_changed(void); -void rend_consider_descriptor_republication(void); - -void rend_service_intro_has_opened(origin_circuit_t *circuit); -int rend_service_intro_established(origin_circuit_t *circuit, - const uint8_t *request, - size_t request_len); -void rend_service_rendezvous_has_opened(origin_circuit_t *circuit); -int rend_service_receive_introduction(origin_circuit_t *circuit, - const uint8_t *request, - size_t request_len); -int rend_service_decrypt_intro(rend_intro_cell_t *request, - crypto_pk_t *key, - char **err_msg_out); -void rend_service_free_intro_(rend_intro_cell_t *request); -#define rend_service_free_intro(req) do { \ - rend_service_free_intro_(req); \ - (req) = NULL; \ - } while (0) -rend_intro_cell_t * rend_service_begin_parse_intro(const uint8_t *request, - size_t request_len, - uint8_t type, - char **err_msg_out); -int rend_service_parse_intro_plaintext(rend_intro_cell_t *intro, - char **err_msg_out); -ssize_t rend_service_encode_establish_intro_cell(char *cell_body_out, - size_t cell_body_out_len, - crypto_pk_t *intro_key, - const char *rend_circ_nonce); -int rend_service_validate_intro_late(const rend_intro_cell_t *intro, - char **err_msg_out); -void rend_service_relaunch_rendezvous(origin_circuit_t *oldcirc); -int rend_service_set_connection_addr_port(edge_connection_t *conn, - origin_circuit_t *circ); -void rend_service_dump_stats(int severity); -void rend_service_free_all(void); -void rend_service_init(void); - -rend_service_port_config_t *rend_service_parse_port_config(const char *string, - const char *sep, - char **err_msg_out); -void rend_service_port_config_free_(rend_service_port_config_t *p); -#define rend_service_port_config_free(p) \ - FREE_AND_NULL(rend_service_port_config_t, rend_service_port_config_free_, \ - (p)) - -void rend_authorized_client_free_(rend_authorized_client_t *client); -#define rend_authorized_client_free(client) \ - FREE_AND_NULL(rend_authorized_client_t, rend_authorized_client_free_, \ - (client)) - -hs_service_add_ephemeral_status_t rend_service_add_ephemeral(crypto_pk_t *pk, - smartlist_t *ports, - int max_streams_per_circuit, - int max_streams_close_circuit, - rend_auth_type_t auth_type, - smartlist_t *auth_clients, - char **service_id_out); -int rend_service_del_ephemeral(const char *service_id); - -void directory_post_to_hs_dir(rend_service_descriptor_t *renddesc, - smartlist_t *descs, smartlist_t *hs_dirs, - const char *service_id, int seconds_valid); -void rend_service_desc_has_uploaded(const rend_data_t *rend_data); - -int rend_service_allow_non_anonymous_connection(const or_options_t *options); -int rend_service_reveal_startup_time(const or_options_t *options); -int rend_service_non_anonymous_mode_enabled(const or_options_t *options); - -#endif /* !defined(TOR_RENDSERVICE_H) */ |