|
@@ -59,6 +59,17 @@ struct link_specifier_t;
|
|
#define HS_DESC_ENCRYPTED_KEY_LEN CIPHER256_KEY_LEN
|
|
#define HS_DESC_ENCRYPTED_KEY_LEN CIPHER256_KEY_LEN
|
|
#define HS_DESC_ENCRYPTED_BIT_SIZE (HS_DESC_ENCRYPTED_KEY_LEN * 8)
|
|
#define HS_DESC_ENCRYPTED_BIT_SIZE (HS_DESC_ENCRYPTED_KEY_LEN * 8)
|
|
|
|
|
|
|
|
+/* Length of each components in the auth client section in the descriptor. */
|
|
|
|
+#define HS_DESC_CLIENT_ID_LEN 8
|
|
|
|
+#define HS_DESC_DESCRIPTOR_COOKIE_LEN 16
|
|
|
|
+#define HS_DESC_COOKIE_KEY_LEN 32
|
|
|
|
+#define HS_DESC_COOKIE_KEY_BIT_SIZE (HS_DESC_COOKIE_KEY_LEN * 8)
|
|
|
|
+#define HS_DESC_ENCRYPED_COOKIE_LEN HS_DESC_DESCRIPTOR_COOKIE_LEN
|
|
|
|
+
|
|
|
|
+/* The number of auth client entries in the descriptor must be the multiple
|
|
|
|
+ * of this constant. */
|
|
|
|
+#define HS_DESC_AUTH_CLIENT_MULTIPLE 16
|
|
|
|
+
|
|
/* Type of authentication in the descriptor. */
|
|
/* Type of authentication in the descriptor. */
|
|
typedef enum {
|
|
typedef enum {
|
|
HS_DESC_AUTH_ED25519 = 1
|
|
HS_DESC_AUTH_ED25519 = 1
|
|
@@ -126,6 +137,20 @@ typedef struct hs_desc_intro_point_t {
|
|
unsigned int cross_certified : 1;
|
|
unsigned int cross_certified : 1;
|
|
} hs_desc_intro_point_t;
|
|
} hs_desc_intro_point_t;
|
|
|
|
|
|
|
|
+/* Authorized client information located in a descriptor. */
|
|
|
|
+typedef struct hs_desc_authorized_client_t {
|
|
|
|
+ /* An identifier that the client will use to identify which auth client
|
|
|
|
+ * entry it needs to use. */
|
|
|
|
+ uint8_t client_id[HS_DESC_CLIENT_ID_LEN];
|
|
|
|
+
|
|
|
|
+ /* An IV that is used to decrypt the encrypted descriptor cookie. */
|
|
|
|
+ uint8_t iv[CIPHER_IV_LEN];
|
|
|
|
+
|
|
|
|
+ /* An encrypted descriptor cookie that the client needs to decrypt to use
|
|
|
|
+ * it to decrypt the descriptor. */
|
|
|
|
+ uint8_t encrypted_cookie[HS_DESC_ENCRYPED_COOKIE_LEN];
|
|
|
|
+} hs_desc_authorized_client_t;
|
|
|
|
+
|
|
/* The encrypted data section of a descriptor. Obviously the data in this is
|
|
/* The encrypted data section of a descriptor. Obviously the data in this is
|
|
* in plaintext but encrypted once encoded. */
|
|
* in plaintext but encrypted once encoded. */
|
|
typedef struct hs_desc_encrypted_data_t {
|
|
typedef struct hs_desc_encrypted_data_t {
|
|
@@ -144,6 +169,24 @@ typedef struct hs_desc_encrypted_data_t {
|
|
smartlist_t *intro_points;
|
|
smartlist_t *intro_points;
|
|
} hs_desc_encrypted_data_t;
|
|
} hs_desc_encrypted_data_t;
|
|
|
|
|
|
|
|
+/* The superencrypted data section of a descriptor. Obviously the data in
|
|
|
|
+ * this is in plaintext but encrypted once encoded. */
|
|
|
|
+typedef struct hs_desc_superencrypted_data_t {
|
|
|
|
+ /* This field contains ephemeral x25519 public key which is used by
|
|
|
|
+ * the encryption scheme in the client authorization. */
|
|
|
|
+ curve25519_public_key_t auth_ephemeral_pubkey;
|
|
|
|
+
|
|
|
|
+ /* A list of authorized clients. Contains hs_desc_authorized_client_t
|
|
|
|
+ * objects. */
|
|
|
|
+ smartlist_t *clients;
|
|
|
|
+
|
|
|
|
+ /* Decoding only: The b64-decoded encrypted blob from the descriptor */
|
|
|
|
+ uint8_t *encrypted_blob;
|
|
|
|
+
|
|
|
|
+ /* Decoding only: Size of the encrypted_blob */
|
|
|
|
+ size_t encrypted_blob_size;
|
|
|
|
+} hs_desc_superencrypted_data_t;
|
|
|
|
+
|
|
/* Plaintext data that is unencrypted information of the descriptor. */
|
|
/* Plaintext data that is unencrypted information of the descriptor. */
|
|
typedef struct hs_desc_plaintext_data_t {
|
|
typedef struct hs_desc_plaintext_data_t {
|
|
/* Version of the descriptor format. Spec specifies this field as a
|
|
/* Version of the descriptor format. Spec specifies this field as a
|
|
@@ -182,6 +225,11 @@ typedef struct hs_descriptor_t {
|
|
/* Contains the plaintext part of the descriptor. */
|
|
/* Contains the plaintext part of the descriptor. */
|
|
hs_desc_plaintext_data_t plaintext_data;
|
|
hs_desc_plaintext_data_t plaintext_data;
|
|
|
|
|
|
|
|
+ /* The following contains what's in the superencrypted part of the
|
|
|
|
+ * descriptor. It's only encrypted in the encoded version of the descriptor
|
|
|
|
+ * thus the data contained in that object is in plaintext. */
|
|
|
|
+ hs_desc_superencrypted_data_t superencrypted_data;
|
|
|
|
+
|
|
/* The following contains what's in the encrypted part of the descriptor.
|
|
/* The following contains what's in the encrypted part of the descriptor.
|
|
* It's only encrypted in the encoded version of the descriptor thus the
|
|
* It's only encrypted in the encoded version of the descriptor thus the
|
|
* data contained in that object is in plaintext. */
|
|
* data contained in that object is in plaintext. */
|
|
@@ -211,6 +259,10 @@ void hs_descriptor_free_(hs_descriptor_t *desc);
|
|
void hs_desc_plaintext_data_free_(hs_desc_plaintext_data_t *desc);
|
|
void hs_desc_plaintext_data_free_(hs_desc_plaintext_data_t *desc);
|
|
#define hs_desc_plaintext_data_free(desc) \
|
|
#define hs_desc_plaintext_data_free(desc) \
|
|
FREE_AND_NULL(hs_desc_plaintext_data_t, hs_desc_plaintext_data_free_, (desc))
|
|
FREE_AND_NULL(hs_desc_plaintext_data_t, hs_desc_plaintext_data_free_, (desc))
|
|
|
|
+void hs_desc_superencrypted_data_free_(hs_desc_superencrypted_data_t *desc);
|
|
|
|
+#define hs_desc_superencrypted_data_free(desc) \
|
|
|
|
+ FREE_AND_NULL(hs_desc_superencrypted_data_t, \
|
|
|
|
+ hs_desc_superencrypted_data_free_, (desc))
|
|
void hs_desc_encrypted_data_free_(hs_desc_encrypted_data_t *desc);
|
|
void hs_desc_encrypted_data_free_(hs_desc_encrypted_data_t *desc);
|
|
#define hs_desc_encrypted_data_free(desc) \
|
|
#define hs_desc_encrypted_data_free(desc) \
|
|
FREE_AND_NULL(hs_desc_encrypted_data_t, hs_desc_encrypted_data_free_, (desc))
|
|
FREE_AND_NULL(hs_desc_encrypted_data_t, hs_desc_encrypted_data_free_, (desc))
|
|
@@ -243,10 +295,22 @@ hs_desc_intro_point_t *hs_desc_intro_point_new(void);
|
|
void hs_desc_intro_point_free_(hs_desc_intro_point_t *ip);
|
|
void hs_desc_intro_point_free_(hs_desc_intro_point_t *ip);
|
|
#define hs_desc_intro_point_free(ip) \
|
|
#define hs_desc_intro_point_free(ip) \
|
|
FREE_AND_NULL(hs_desc_intro_point_t, hs_desc_intro_point_free_, (ip))
|
|
FREE_AND_NULL(hs_desc_intro_point_t, hs_desc_intro_point_free_, (ip))
|
|
|
|
+void hs_desc_authorized_client_free_(hs_desc_authorized_client_t *client);
|
|
|
|
+#define hs_desc_authorized_client_free(client) \
|
|
|
|
+ FREE_AND_NULL(hs_desc_authorized_client_t, \
|
|
|
|
+ hs_desc_authorized_client_free_, (client))
|
|
|
|
|
|
link_specifier_t *hs_desc_lspec_to_trunnel(
|
|
link_specifier_t *hs_desc_lspec_to_trunnel(
|
|
const hs_desc_link_specifier_t *spec);
|
|
const hs_desc_link_specifier_t *spec);
|
|
|
|
|
|
|
|
+void
|
|
|
|
+hs_desc_build_fake_authorized_client(hs_desc_authorized_client_t *client_out);
|
|
|
|
+void hs_desc_build_authorized_client(const curve25519_public_key_t *client_pk,
|
|
|
|
+ const curve25519_secret_key_t *
|
|
|
|
+ auth_ephemeral_sk,
|
|
|
|
+ const uint8_t *descriptor_cookie,
|
|
|
|
+ hs_desc_authorized_client_t *client_out);
|
|
|
|
+
|
|
#ifdef HS_DESCRIPTOR_PRIVATE
|
|
#ifdef HS_DESCRIPTOR_PRIVATE
|
|
|
|
|
|
/* Encoding. */
|
|
/* Encoding. */
|