aboutsummaryrefslogtreecommitdiff
path: root/src/or
diff options
context:
space:
mode:
Diffstat (limited to 'src/or')
-rw-r--r--src/or/connection_or.c14
-rw-r--r--src/or/control.c4
-rw-r--r--src/or/hs_circuit.c20
-rw-r--r--src/or/hs_service.c29
-rw-r--r--src/or/hs_service.h5
5 files changed, 50 insertions, 22 deletions
diff --git a/src/or/connection_or.c b/src/or/connection_or.c
index 267463312c..221b8dc8ad 100644
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@ -50,6 +50,7 @@
#include "proto_cell.h"
#include "reasons.h"
#include "relay.h"
+#include "rendcommon.h"
#include "rephist.h"
#include "router.h"
#include "routerkeys.h"
@@ -1923,10 +1924,13 @@ connection_or_client_learned_peer_id(or_connection_t *conn,
conn->identity_digest);
const int is_authority_fingerprint = router_digest_is_trusted_dir(
conn->identity_digest);
+ const int non_anonymous_mode = rend_non_anonymous_mode_enabled(options);
int severity;
const char *extra_log = "";
- if (server_mode(options)) {
+ /* Relays, Single Onion Services, and Tor2web make direct connections using
+ * untrusted authentication keys. */
+ if (server_mode(options) || non_anonymous_mode) {
severity = LOG_PROTOCOL_WARN;
} else {
if (using_hardcoded_fingerprints) {
@@ -1950,8 +1954,8 @@ connection_or_client_learned_peer_id(or_connection_t *conn,
}
log_fn(severity, LD_HANDSHAKE,
- "Tried connecting to router at %s:%d, but RSA identity key was not "
- "as expected: wanted %s + %s but got %s + %s.%s",
+ "Tried connecting to router at %s:%d, but RSA + ed25519 identity "
+ "keys were not as expected: wanted %s + %s but got %s + %s.%s",
conn->base_.address, conn->base_.port,
expected_rsa, expected_ed, seen_rsa, seen_ed, extra_log);
@@ -1968,8 +1972,8 @@ connection_or_client_learned_peer_id(or_connection_t *conn,
}
if (!expected_ed_key && ed_peer_id) {
- log_info(LD_HANDSHAKE, "(we had no Ed25519 ID in mind when we made this "
- "connection.");
+ log_info(LD_HANDSHAKE, "(We had no Ed25519 ID in mind when we made this "
+ "connection.)");
connection_or_set_identity_digest(conn,
(const char*)rsa_peer_id, ed_peer_id);
changed_identity = 1;
diff --git a/src/or/control.c b/src/or/control.c
index 1898725025..3f677ba348 100644
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -1896,6 +1896,8 @@ getinfo_helper_listeners(control_connection_t *control_conn,
if (!strcmp(question, "net/listeners/or"))
type = CONN_TYPE_OR_LISTENER;
+ else if (!strcmp(question, "net/listeners/extor"))
+ type = CONN_TYPE_EXT_OR_LISTENER;
else if (!strcmp(question, "net/listeners/dir"))
type = CONN_TYPE_DIR_LISTENER;
else if (!strcmp(question, "net/listeners/socks"))
@@ -1904,6 +1906,8 @@ getinfo_helper_listeners(control_connection_t *control_conn,
type = CONN_TYPE_AP_TRANS_LISTENER;
else if (!strcmp(question, "net/listeners/natd"))
type = CONN_TYPE_AP_NATD_LISTENER;
+ else if (!strcmp(question, "net/listeners/httptunnel"))
+ type = CONN_TYPE_AP_HTTP_CONNECT_LISTENER;
else if (!strcmp(question, "net/listeners/dns"))
type = CONN_TYPE_AP_DNS_LISTENER;
else if (!strcmp(question, "net/listeners/control"))
diff --git a/src/or/hs_circuit.c b/src/or/hs_circuit.c
index 3a674f6223..0a9999a190 100644
--- a/src/or/hs_circuit.c
+++ b/src/or/hs_circuit.c
@@ -559,10 +559,14 @@ retry_service_rendezvous_point(const origin_circuit_t *circ)
return;
}
-/* Add all possible link specifiers in node to lspecs.
- * legacy ID is mandatory thus MUST be present in node. If the primary address
- * is not IPv4, log a BUG() warning, and return an empty smartlist.
- * Includes ed25519 id and IPv6 link specifiers if present in the node. */
+/* Add all possible link specifiers in node to lspecs:
+ * - legacy ID is mandatory thus MUST be present in node;
+ * - include ed25519 link specifier if present in the node, and the node
+ * supports ed25519 link authentication, even if its link versions are not
+ * compatible with us;
+ * - include IPv4 link specifier, if the primary address is not IPv4, log a
+ * BUG() warning, and return an empty smartlist;
+ * - include IPv6 link specifier if present in the node. */
static void
get_lspecs_from_node(const node_t *node, smartlist_t *lspecs)
{
@@ -600,8 +604,12 @@ get_lspecs_from_node(const node_t *node, smartlist_t *lspecs)
link_specifier_set_ls_len(ls, link_specifier_getlen_un_legacy_id(ls));
smartlist_add(lspecs, ls);
- /* ed25519 ID is only included if the node has it. */
- if (!ed25519_public_key_is_zero(&node->ed25519_id)) {
+ /* ed25519 ID is only included if the node has it, and the node declares a
+ protocol version that supports ed25519 link authentication, even if that
+ link version is not compatible with us. (We are sending the ed25519 key
+ to another tor, which may support different link versions.) */
+ if (!ed25519_public_key_is_zero(&node->ed25519_id) &&
+ node_supports_ed25519_link_authentication(node, 0)) {
ls = link_specifier_new();
link_specifier_set_ls_type(ls, LS_ED25519_ID);
memcpy(link_specifier_getarray_un_ed25519_id(ls), &node->ed25519_id,
diff --git a/src/or/hs_service.c b/src/or/hs_service.c
index c31f8bbf68..21daaaa248 100644
--- a/src/or/hs_service.c
+++ b/src/or/hs_service.c
@@ -376,17 +376,21 @@ service_intro_point_free_void(void *obj)
}
/* Return a newly allocated service intro point and fully initialized from the
- * given extend_info_t ei if non NULL. If is_legacy is true, we also generate
- * the legacy key. On error, NULL is returned.
+ * given extend_info_t ei if non NULL.
+ * If is_legacy is true, we also generate the legacy key.
+ * If supports_ed25519_link_handshake_any is true, we add the relay's ed25519
+ * key to the link specifiers.
*
* If ei is NULL, returns a hs_service_intro_point_t with an empty link
* specifier list and no onion key. (This is used for testing.)
+ * On any other error, NULL is returned.
*
* ei must be an extend_info_t containing an IPv4 address. (We will add supoort
* for IPv6 in a later release.) When calling extend_info_from_node(), pass
* 0 in for_direct_connection to make sure ei always has an IPv4 address. */
STATIC hs_service_intro_point_t *
-service_intro_point_new(const extend_info_t *ei, unsigned int is_legacy)
+service_intro_point_new(const extend_info_t *ei, unsigned int is_legacy,
+ unsigned int supports_ed25519_link_handshake_any)
{
hs_desc_link_specifier_t *ls;
hs_service_intro_point_t *ip;
@@ -453,10 +457,13 @@ service_intro_point_new(const extend_info_t *ei, unsigned int is_legacy)
}
smartlist_add(ip->base.link_specifiers, ls);
- /* ed25519 identity key is optional for intro points */
- ls = hs_desc_link_specifier_new(ei, LS_ED25519_ID);
- if (ls) {
- smartlist_add(ip->base.link_specifiers, ls);
+ /* ed25519 identity key is optional for intro points. If the node supports
+ * ed25519 link authentication, we include it. */
+ if (supports_ed25519_link_handshake_any) {
+ ls = hs_desc_link_specifier_new(ei, LS_ED25519_ID);
+ if (ls) {
+ smartlist_add(ip->base.link_specifiers, ls);
+ }
}
/* IPv6 is not supported in this release. */
@@ -1586,8 +1593,12 @@ pick_intro_point(unsigned int direct_conn, smartlist_t *exclude_nodes)
tor_assert_nonfatal(!ed25519_public_key_is_zero(&info->ed_identity));
}
- /* Create our objects and populate them with the node information. */
- ip = service_intro_point_new(info, !node_supports_ed25519_hs_intro(node));
+ /* Create our objects and populate them with the node information.
+ * We don't care if the intro's link auth is compatible with us, because
+ * we are sending the ed25519 key to a remote client via the descriptor. */
+ ip = service_intro_point_new(info, !node_supports_ed25519_hs_intro(node),
+ node_supports_ed25519_link_authentication(node,
+ 0));
if (ip == NULL) {
goto err;
}
diff --git a/src/or/hs_service.h b/src/or/hs_service.h
index d163eeef28..f3cd49e073 100644
--- a/src/or/hs_service.h
+++ b/src/or/hs_service.h
@@ -307,8 +307,9 @@ STATIC void remove_service(hs_service_ht *map, hs_service_t *service);
STATIC int register_service(hs_service_ht *map, hs_service_t *service);
/* Service introduction point functions. */
STATIC hs_service_intro_point_t *service_intro_point_new(
- const extend_info_t *ei,
- unsigned int is_legacy);
+ const extend_info_t *ei,
+ unsigned int is_legacy,
+ unsigned int supports_ed25519_link_handshake_any);
STATIC void service_intro_point_free_(hs_service_intro_point_t *ip);
#define service_intro_point_free(ip) \
FREE_AND_NULL(hs_service_intro_point_t, \
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion