hs_circuit.c 31 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890
  1. /* Copyright (c) 2017, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /**
  4. * \file hs_circuit.c
  5. **/
  6. #include "or.h"
  7. #include "circpathbias.h"
  8. #include "circuitbuild.h"
  9. #include "circuitlist.h"
  10. #include "circuituse.h"
  11. #include "config.h"
  12. #include "policies.h"
  13. #include "relay.h"
  14. #include "rendservice.h"
  15. #include "rephist.h"
  16. #include "router.h"
  17. #include "hs_cell.h"
  18. #include "hs_circuit.h"
  19. #include "hs_ident.h"
  20. #include "hs_ntor.h"
  21. #include "hs_service.h"
  22. /* Trunnel. */
  23. #include "ed25519_cert.h"
  24. #include "hs/cell_common.h"
  25. #include "hs/cell_establish_intro.h"
  26. /* A circuit is about to become an e2e rendezvous circuit. Check
  27. * <b>circ_purpose</b> and ensure that it's properly set. Return true iff
  28. * circuit purpose is properly set, otherwise return false. */
  29. static int
  30. circuit_purpose_is_correct_for_rend(unsigned int circ_purpose,
  31. int is_service_side)
  32. {
  33. if (is_service_side) {
  34. if (circ_purpose != CIRCUIT_PURPOSE_S_CONNECT_REND) {
  35. log_warn(LD_BUG,
  36. "HS e2e circuit setup with wrong purpose (%d)", circ_purpose);
  37. return 0;
  38. }
  39. }
  40. if (!is_service_side) {
  41. if (circ_purpose != CIRCUIT_PURPOSE_C_REND_READY &&
  42. circ_purpose != CIRCUIT_PURPOSE_C_REND_READY_INTRO_ACKED) {
  43. log_warn(LD_BUG,
  44. "Client e2e circuit setup with wrong purpose (%d)", circ_purpose);
  45. return 0;
  46. }
  47. }
  48. return 1;
  49. }
  50. /* Create and return a crypt path for the final hop of a v3 prop224 rendezvous
  51. * circuit. Initialize the crypt path crypto using the output material from the
  52. * ntor key exchange at <b>ntor_key_seed</b>.
  53. *
  54. * If <b>is_service_side</b> is set, we are the hidden service and the final
  55. * hop of the rendezvous circuit is the client on the other side. */
  56. static crypt_path_t *
  57. create_rend_cpath(const uint8_t *ntor_key_seed, size_t seed_len,
  58. int is_service_side)
  59. {
  60. uint8_t keys[HS_NTOR_KEY_EXPANSION_KDF_OUT_LEN];
  61. crypt_path_t *cpath = NULL;
  62. /* Do the key expansion */
  63. if (hs_ntor_circuit_key_expansion(ntor_key_seed, seed_len,
  64. keys, sizeof(keys)) < 0) {
  65. goto err;
  66. }
  67. /* Setup the cpath */
  68. cpath = tor_malloc_zero(sizeof(crypt_path_t));
  69. cpath->magic = CRYPT_PATH_MAGIC;
  70. if (circuit_init_cpath_crypto(cpath, (char*)keys, sizeof(keys),
  71. is_service_side, 1) < 0) {
  72. tor_free(cpath);
  73. goto err;
  74. }
  75. err:
  76. memwipe(keys, 0, sizeof(keys));
  77. return cpath;
  78. }
  79. /* We are a v2 legacy HS client: Create and return a crypt path for the hidden
  80. * service on the other side of the rendezvous circuit <b>circ</b>. Initialize
  81. * the crypt path crypto using the body of the RENDEZVOUS1 cell at
  82. * <b>rend_cell_body</b> (which must be at least DH_KEY_LEN+DIGEST_LEN bytes).
  83. */
  84. static crypt_path_t *
  85. create_rend_cpath_legacy(origin_circuit_t *circ, const uint8_t *rend_cell_body)
  86. {
  87. crypt_path_t *hop = NULL;
  88. char keys[DIGEST_LEN+CPATH_KEY_MATERIAL_LEN];
  89. /* first DH_KEY_LEN bytes are g^y from the service. Finish the dh
  90. * handshake...*/
  91. tor_assert(circ->build_state);
  92. tor_assert(circ->build_state->pending_final_cpath);
  93. hop = circ->build_state->pending_final_cpath;
  94. tor_assert(hop->rend_dh_handshake_state);
  95. if (crypto_dh_compute_secret(LOG_PROTOCOL_WARN, hop->rend_dh_handshake_state,
  96. (char*)rend_cell_body, DH_KEY_LEN,
  97. keys, DIGEST_LEN+CPATH_KEY_MATERIAL_LEN)<0) {
  98. log_warn(LD_GENERAL, "Couldn't complete DH handshake.");
  99. goto err;
  100. }
  101. /* ... and set up cpath. */
  102. if (circuit_init_cpath_crypto(hop,
  103. keys+DIGEST_LEN, sizeof(keys)-DIGEST_LEN,
  104. 0, 0) < 0)
  105. goto err;
  106. /* Check whether the digest is right... */
  107. if (tor_memneq(keys, rend_cell_body+DH_KEY_LEN, DIGEST_LEN)) {
  108. log_warn(LD_PROTOCOL, "Incorrect digest of key material.");
  109. goto err;
  110. }
  111. /* clean up the crypto stuff we just made */
  112. crypto_dh_free(hop->rend_dh_handshake_state);
  113. hop->rend_dh_handshake_state = NULL;
  114. goto done;
  115. err:
  116. hop = NULL;
  117. done:
  118. memwipe(keys, 0, sizeof(keys));
  119. return hop;
  120. }
  121. /* Append the final <b>hop</b> to the cpath of the rend <b>circ</b>, and mark
  122. * <b>circ</b> ready for use to transfer HS relay cells. */
  123. static void
  124. finalize_rend_circuit(origin_circuit_t *circ, crypt_path_t *hop,
  125. int is_service_side)
  126. {
  127. tor_assert(circ);
  128. tor_assert(hop);
  129. /* Notify the circuit state machine that we are splicing this circuit */
  130. int new_circ_purpose = is_service_side ?
  131. CIRCUIT_PURPOSE_S_REND_JOINED : CIRCUIT_PURPOSE_C_REND_JOINED;
  132. circuit_change_purpose(TO_CIRCUIT(circ), new_circ_purpose);
  133. /* All is well. Extend the circuit. */
  134. hop->state = CPATH_STATE_OPEN;
  135. /* Set the windows to default. */
  136. hop->package_window = circuit_initial_package_window();
  137. hop->deliver_window = CIRCWINDOW_START;
  138. /* Now that this circuit has finished connecting to its destination,
  139. * make sure circuit_get_open_circ_or_launch is willing to return it
  140. * so we can actually use it. */
  141. circ->hs_circ_has_timed_out = 0;
  142. /* Append the hop to the cpath of this circuit */
  143. onion_append_to_cpath(&circ->cpath, hop);
  144. /* In legacy code, 'pending_final_cpath' points to the final hop we just
  145. * appended to the cpath. We set the original pointer to NULL so that we
  146. * don't double free it. */
  147. if (circ->build_state) {
  148. circ->build_state->pending_final_cpath = NULL;
  149. }
  150. /* Finally, mark circuit as ready to be used for client streams */
  151. if (!is_service_side) {
  152. circuit_try_attaching_streams(circ);
  153. }
  154. }
  155. /* For a given circuit and a service introduction point object, register the
  156. * intro circuit to the circuitmap. This supports legacy intro point. */
  157. static void
  158. register_intro_circ(const hs_service_intro_point_t *ip,
  159. origin_circuit_t *circ)
  160. {
  161. tor_assert(ip);
  162. tor_assert(circ);
  163. if (ip->base.is_only_legacy) {
  164. uint8_t digest[DIGEST_LEN];
  165. if (BUG(crypto_pk_get_digest(ip->legacy_key, (char *) digest) < 0)) {
  166. return;
  167. }
  168. hs_circuitmap_register_intro_circ_v2_service_side(circ, digest);
  169. } else {
  170. hs_circuitmap_register_intro_circ_v3_service_side(circ,
  171. &ip->auth_key_kp.pubkey);
  172. }
  173. }
  174. /* Return the number of opened introduction circuit for the given circuit that
  175. * is matching its identity key. */
  176. static unsigned int
  177. count_opened_desc_intro_point_circuits(const hs_service_t *service,
  178. const hs_service_descriptor_t *desc)
  179. {
  180. unsigned int count = 0;
  181. tor_assert(service);
  182. tor_assert(desc);
  183. DIGEST256MAP_FOREACH(desc->intro_points.map, key,
  184. const hs_service_intro_point_t *, ip) {
  185. circuit_t *circ;
  186. origin_circuit_t *ocirc;
  187. if (ip->base.is_only_legacy) {
  188. uint8_t digest[DIGEST_LEN];
  189. if (BUG(crypto_pk_get_digest(ip->legacy_key, (char *) digest) < 0)) {
  190. continue;
  191. }
  192. ocirc = hs_circuitmap_get_intro_circ_v2_service_side(digest);
  193. } else {
  194. ocirc =
  195. hs_circuitmap_get_intro_circ_v3_service_side(&ip->auth_key_kp.pubkey);
  196. }
  197. if (ocirc == NULL) {
  198. continue;
  199. }
  200. circ = TO_CIRCUIT(ocirc);
  201. tor_assert(circ->purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO ||
  202. circ->purpose == CIRCUIT_PURPOSE_S_INTRO);
  203. /* Having a circuit not for the requested service is really bad. */
  204. tor_assert(ed25519_pubkey_eq(&service->keys.identity_pk,
  205. &ocirc->hs_ident->identity_pk));
  206. /* Only count opened circuit and skip circuit that will be closed. */
  207. if (!circ->marked_for_close && circ->state == CIRCUIT_STATE_OPEN) {
  208. count++;
  209. }
  210. } DIGEST256MAP_FOREACH_END;
  211. return count;
  212. }
  213. /* From a given service, rendezvous cookie and handshake infor, create a
  214. * rendezvous point circuit identifier. This can't fail. */
  215. static hs_ident_circuit_t *
  216. create_rp_circuit_identifier(const hs_service_t *service,
  217. const uint8_t *rendezvous_cookie,
  218. const curve25519_public_key_t *server_pk,
  219. const hs_ntor_rend_cell_keys_t *keys)
  220. {
  221. hs_ident_circuit_t *ident;
  222. uint8_t handshake_info[CURVE25519_PUBKEY_LEN + DIGEST256_LEN];
  223. tor_assert(service);
  224. tor_assert(rendezvous_cookie);
  225. tor_assert(server_pk);
  226. tor_assert(keys);
  227. ident = hs_ident_circuit_new(&service->keys.identity_pk,
  228. HS_IDENT_CIRCUIT_RENDEZVOUS);
  229. /* Copy the RENDEZVOUS_COOKIE which is the unique identifier. */
  230. memcpy(ident->rendezvous_cookie, rendezvous_cookie,
  231. sizeof(ident->rendezvous_cookie));
  232. /* Build the HANDSHAKE_INFO which looks like this:
  233. * SERVER_PK [32 bytes]
  234. * AUTH_INPUT_MAC [32 bytes]
  235. */
  236. memcpy(handshake_info, server_pk->public_key, CURVE25519_PUBKEY_LEN);
  237. memcpy(handshake_info + CURVE25519_PUBKEY_LEN, keys->rend_cell_auth_mac,
  238. DIGEST256_LEN);
  239. tor_assert(sizeof(ident->rendezvous_handshake_info) ==
  240. sizeof(handshake_info));
  241. memcpy(ident->rendezvous_handshake_info, handshake_info,
  242. sizeof(ident->rendezvous_handshake_info));
  243. /* Finally copy the NTOR_KEY_SEED for e2e encryption on the circuit. */
  244. tor_assert(sizeof(ident->rendezvous_ntor_key_seed) ==
  245. sizeof(keys->ntor_key_seed));
  246. memcpy(ident->rendezvous_ntor_key_seed, keys->ntor_key_seed,
  247. sizeof(ident->rendezvous_ntor_key_seed));
  248. return ident;
  249. }
  250. /* From a given service and service intro point, create an introduction point
  251. * circuit identifier. This can't fail. */
  252. static hs_ident_circuit_t *
  253. create_intro_circuit_identifier(const hs_service_t *service,
  254. const hs_service_intro_point_t *ip)
  255. {
  256. hs_ident_circuit_t *ident;
  257. tor_assert(service);
  258. tor_assert(ip);
  259. ident = hs_ident_circuit_new(&service->keys.identity_pk,
  260. HS_IDENT_CIRCUIT_INTRO);
  261. ed25519_pubkey_copy(&ident->intro_auth_pk, &ip->auth_key_kp.pubkey);
  262. return ident;
  263. }
  264. /* For a given introduction point and an introduction circuit, send the
  265. * ESTABLISH_INTRO cell. The service object is used for logging. This can fail
  266. * and if so, the circuit is closed and the intro point object is flagged
  267. * that the circuit is not established anymore which is important for the
  268. * retry mechanism. */
  269. static void
  270. send_establish_intro(const hs_service_t *service,
  271. hs_service_intro_point_t *ip, origin_circuit_t *circ)
  272. {
  273. ssize_t cell_len;
  274. uint8_t payload[RELAY_PAYLOAD_SIZE];
  275. tor_assert(service);
  276. tor_assert(ip);
  277. tor_assert(circ);
  278. /* Encode establish intro cell. */
  279. cell_len = hs_cell_build_establish_intro(circ->cpath->prev->rend_circ_nonce,
  280. ip, payload);
  281. if (cell_len < 0) {
  282. log_warn(LD_REND, "Unable to encode ESTABLISH_INTRO cell for service %s "
  283. "on circuit %u. Closing circuit.",
  284. safe_str_client(service->onion_address),
  285. TO_CIRCUIT(circ)->n_circ_id);
  286. goto err;
  287. }
  288. /* Send the cell on the circuit. */
  289. if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(circ),
  290. RELAY_COMMAND_ESTABLISH_INTRO,
  291. (char *) payload, cell_len,
  292. circ->cpath->prev) < 0) {
  293. log_info(LD_REND, "Unable to send ESTABLISH_INTRO cell for service %s "
  294. "on circuit %u.",
  295. safe_str_client(service->onion_address),
  296. TO_CIRCUIT(circ)->n_circ_id);
  297. /* On error, the circuit has been closed. */
  298. goto done;
  299. }
  300. /* Record the attempt to use this circuit. */
  301. pathbias_count_use_attempt(circ);
  302. goto done;
  303. err:
  304. circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
  305. done:
  306. memwipe(payload, 0, sizeof(payload));
  307. }
  308. /* From a list of link specifier, an onion key and if we are requesting a
  309. * direct connection (ex: single onion service), return a newly allocated
  310. * extend_info_t object. This function checks the firewall policies and if we
  311. * are allowed to extend to the chosen address.
  312. *
  313. * if either IPv4 or legacy ID is missing, error.
  314. * if not direct_conn, IPv4 is prefered.
  315. * if direct_conn, IPv6 is prefered if we have one available.
  316. * if firewall does not allow the chosen address, error.
  317. *
  318. * Return NULL if we can fulfill the conditions. */
  319. static extend_info_t *
  320. get_rp_extend_info(const smartlist_t *link_specifiers,
  321. const curve25519_public_key_t *onion_key, int direct_conn)
  322. {
  323. int have_v4 = 0, have_v6 = 0, have_legacy_id = 0, have_ed25519_id = 0;
  324. char legacy_id[DIGEST_LEN] = {0};
  325. uint16_t port_v4 = 0, port_v6 = 0, port = 0;
  326. tor_addr_t addr_v4, addr_v6, *addr = NULL;
  327. ed25519_public_key_t ed25519_pk;
  328. extend_info_t *info = NULL;
  329. tor_assert(link_specifiers);
  330. tor_assert(onion_key);
  331. SMARTLIST_FOREACH_BEGIN(link_specifiers, const link_specifier_t *, ls) {
  332. switch (link_specifier_get_ls_type(ls)) {
  333. case LS_IPV4:
  334. /* Skip if we already seen a v4. */
  335. if (have_v4) continue;
  336. tor_addr_from_ipv4h(&addr_v4,
  337. link_specifier_get_un_ipv4_addr(ls));
  338. port_v4 = link_specifier_get_un_ipv4_port(ls);
  339. have_v4 = 1;
  340. break;
  341. case LS_IPV6:
  342. /* Skip if we already seen a v6. */
  343. if (have_v6) continue;
  344. tor_addr_from_ipv6_bytes(&addr_v6,
  345. (const char *) link_specifier_getconstarray_un_ipv6_addr(ls));
  346. port_v6 = link_specifier_get_un_ipv6_port(ls);
  347. have_v6 = 1;
  348. break;
  349. case LS_LEGACY_ID:
  350. /* Make sure we do have enough bytes for the legacy ID. */
  351. if (link_specifier_getlen_un_legacy_id(ls) < sizeof(legacy_id)) {
  352. break;
  353. }
  354. memcpy(legacy_id, link_specifier_getconstarray_un_legacy_id(ls),
  355. sizeof(legacy_id));
  356. have_legacy_id = 1;
  357. break;
  358. case LS_ED25519_ID:
  359. memcpy(ed25519_pk.pubkey,
  360. link_specifier_getconstarray_un_ed25519_id(ls),
  361. ED25519_PUBKEY_LEN);
  362. have_ed25519_id = 1;
  363. break;
  364. default:
  365. /* Ignore unknown. */
  366. break;
  367. }
  368. } SMARTLIST_FOREACH_END(ls);
  369. /* IPv4, legacy ID and ed25519 are mandatory. */
  370. if (!have_v4 || !have_legacy_id || !have_ed25519_id) {
  371. goto done;
  372. }
  373. /* By default, we pick IPv4 but this might change to v6 if certain
  374. * conditions are met. */
  375. addr = &addr_v4; port = port_v4;
  376. /* If we are NOT in a direct connection, we'll use our Guard and a 3-hop
  377. * circuit so we can't extend in IPv6. And at this point, we do have an IPv4
  378. * address available so go to validation. */
  379. if (!direct_conn) {
  380. goto validate;
  381. }
  382. /* From this point on, we have a request for a direct connection to the
  383. * rendezvous point so make sure we can actually connect through our
  384. * firewall. We'll prefer IPv6. */
  385. /* IPv6 test. */
  386. if (have_v6 &&
  387. fascist_firewall_allows_address_addr(&addr_v6, port_v6,
  388. FIREWALL_OR_CONNECTION, 1, 1)) {
  389. /* Direct connection and we can reach it in IPv6 so go for it. */
  390. addr = &addr_v6; port = port_v6;
  391. goto validate;
  392. }
  393. /* IPv4 test and we are sure we have a v4 because of the check above. */
  394. if (fascist_firewall_allows_address_addr(&addr_v4, port_v4,
  395. FIREWALL_OR_CONNECTION, 0, 0)) {
  396. /* Direct connection and we can reach it in IPv4 so go for it. */
  397. addr = &addr_v4; port = port_v4;
  398. goto validate;
  399. }
  400. validate:
  401. /* We'll validate now that the address we've picked isn't a private one. If
  402. * it is, are we allowing to extend to private address? */
  403. if (!extend_info_addr_is_allowed(addr)) {
  404. log_warn(LD_REND, "Rendezvous point address is private and it is not "
  405. "allowed to extend to it: %s:%u",
  406. fmt_addr(&addr_v4), port_v4);
  407. goto done;
  408. }
  409. /* We do have everything for which we think we can connect successfully. */
  410. info = extend_info_new(NULL, legacy_id, &ed25519_pk, NULL, onion_key,
  411. addr, port);
  412. done:
  413. return info;
  414. }
  415. /* For a given service, the ntor onion key and a rendezvous cookie, launch a
  416. * circuit to the rendezvous point specified by the link specifiers. On
  417. * success, a circuit identifier is attached to the circuit with the needed
  418. * data. This function will try to open a circuit for a maximum value of
  419. * MAX_REND_FAILURES then it will give up. */
  420. static void
  421. launch_rendezvous_point_circuit(const hs_service_t *service,
  422. const hs_service_intro_point_t *ip,
  423. const hs_cell_introduce2_data_t *data)
  424. {
  425. int circ_needs_uptime;
  426. time_t now = time(NULL);
  427. extend_info_t *info = NULL;
  428. origin_circuit_t *circ;
  429. tor_assert(service);
  430. tor_assert(ip);
  431. tor_assert(data);
  432. circ_needs_uptime = hs_service_requires_uptime_circ(service->config.ports);
  433. /* Help predict this next time */
  434. rep_hist_note_used_internal(now, circ_needs_uptime, 1);
  435. /* Get the extend info data structure for the chosen rendezvous point
  436. * specified by the given link specifiers. */
  437. info = get_rp_extend_info(data->link_specifiers, &data->onion_pk,
  438. service->config.is_single_onion);
  439. if (info == NULL) {
  440. /* We are done here, we can't extend to the rendezvous point. */
  441. goto end;
  442. }
  443. for (int i = 0; i < MAX_REND_FAILURES; i++) {
  444. int circ_flags = CIRCLAUNCH_NEED_CAPACITY | CIRCLAUNCH_IS_INTERNAL;
  445. if (circ_needs_uptime) {
  446. circ_flags |= CIRCLAUNCH_NEED_UPTIME;
  447. }
  448. /* Firewall and policies are checked when getting the extend info. */
  449. if (service->config.is_single_onion) {
  450. circ_flags |= CIRCLAUNCH_ONEHOP_TUNNEL;
  451. }
  452. circ = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_CONNECT_REND, info,
  453. circ_flags);
  454. if (circ != NULL) {
  455. /* Stop retrying, we have a circuit! */
  456. break;
  457. }
  458. }
  459. if (circ == NULL) {
  460. log_warn(LD_REND, "Giving up on launching rendezvous circuit to %s "
  461. "for service %s",
  462. safe_str_client(extend_info_describe(info)),
  463. safe_str_client(service->onion_address));
  464. goto end;
  465. }
  466. log_info(LD_REND, "Rendezvous circuit launched to %s with cookie %s "
  467. "for service %s",
  468. safe_str_client(extend_info_describe(info)),
  469. safe_str_client(hex_str((const char *) data->rendezvous_cookie,
  470. REND_COOKIE_LEN)),
  471. safe_str_client(service->onion_address));
  472. tor_assert(circ->build_state);
  473. /* Rendezvous circuit have a specific timeout for the time spent on trying
  474. * to connect to the rendezvous point. */
  475. circ->build_state->expiry_time = now + MAX_REND_TIMEOUT;
  476. /* Create circuit identifier and key material. */
  477. {
  478. hs_ntor_rend_cell_keys_t keys;
  479. curve25519_keypair_t ephemeral_kp;
  480. /* No need for extra strong, this is only for this circuit life time. This
  481. * key will be used for the RENDEZVOUS1 cell that will be sent on the
  482. * circuit once opened. */
  483. curve25519_keypair_generate(&ephemeral_kp, 0);
  484. if (hs_ntor_service_get_rendezvous1_keys(&ip->auth_key_kp.pubkey,
  485. &ip->enc_key_kp,
  486. &ephemeral_kp, &data->client_pk,
  487. &keys) < 0) {
  488. /* This should not really happened but just in case, don't make tor
  489. * freak out, close the circuit and move on. */
  490. log_info(LD_REND, "Unable to get RENDEZVOUS1 key material for "
  491. "service %s",
  492. safe_str_client(service->onion_address));
  493. circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
  494. goto end;
  495. }
  496. circ->hs_ident = create_rp_circuit_identifier(service,
  497. data->rendezvous_cookie,
  498. &ephemeral_kp.pubkey, &keys);
  499. memwipe(&ephemeral_kp, 0, sizeof(ephemeral_kp));
  500. memwipe(&keys, 0, sizeof(keys));
  501. tor_assert(circ->hs_ident);
  502. }
  503. end:
  504. extend_info_free(info);
  505. }
  506. /* ========== */
  507. /* Public API */
  508. /* ========== */
  509. /* For a given service and a service intro point, launch a circuit to the
  510. * extend info ei. If the service is a single onion, a one-hop circuit will be
  511. * requested. Return 0 if the circuit was successfully launched and tagged
  512. * with the correct identifier. On error, a negative value is returned. */
  513. int
  514. hs_circ_launch_intro_point(hs_service_t *service,
  515. const hs_service_intro_point_t *ip,
  516. extend_info_t *ei, time_t now)
  517. {
  518. /* Standard flags for introduction circuit. */
  519. int ret = -1, circ_flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
  520. origin_circuit_t *circ;
  521. tor_assert(service);
  522. tor_assert(ip);
  523. tor_assert(ei);
  524. /* Update circuit flags in case of a single onion service that requires a
  525. * direct connection. */
  526. if (service->config.is_single_onion) {
  527. circ_flags |= CIRCLAUNCH_ONEHOP_TUNNEL;
  528. }
  529. log_info(LD_REND, "Launching a circuit to intro point %s for service %s.",
  530. safe_str_client(extend_info_describe(ei)),
  531. safe_str_client(service->onion_address));
  532. /* Note down that we are about to use an internal circuit. */
  533. rep_hist_note_used_internal(now, circ_flags & CIRCLAUNCH_NEED_UPTIME,
  534. circ_flags & CIRCLAUNCH_NEED_CAPACITY);
  535. /* Note down the launch for the retry period. Even if the circuit fails to
  536. * be launched, we still want to respect the retry period to avoid stress on
  537. * the circuit subsystem. */
  538. service->state.num_intro_circ_launched++;
  539. circ = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO,
  540. ei, circ_flags);
  541. if (circ == NULL) {
  542. goto end;
  543. }
  544. /* Setup the circuit identifier and attach it to it. */
  545. circ->hs_ident = create_intro_circuit_identifier(service, ip);
  546. tor_assert(circ->hs_ident);
  547. /* Register circuit in the global circuitmap. */
  548. register_intro_circ(ip, circ);
  549. /* Success. */
  550. ret = 0;
  551. end:
  552. return ret;
  553. }
  554. /* Called when a service introduction point circuit is done building. Given
  555. * the service and intro point object, this function will send the
  556. * ESTABLISH_INTRO cell on the circuit. Return 0 on success. Return 1 if the
  557. * circuit has been repurposed to General because we already have too many
  558. * opened. */
  559. int
  560. hs_circ_service_intro_has_opened(hs_service_t *service,
  561. hs_service_intro_point_t *ip,
  562. const hs_service_descriptor_t *desc,
  563. origin_circuit_t *circ)
  564. {
  565. int ret = 0;
  566. unsigned int num_intro_circ, num_needed_circ;
  567. tor_assert(service);
  568. tor_assert(ip);
  569. tor_assert(desc);
  570. tor_assert(circ);
  571. num_intro_circ = count_opened_desc_intro_point_circuits(service, desc);
  572. num_needed_circ = service->config.num_intro_points;
  573. if (num_intro_circ > num_needed_circ) {
  574. /* There are too many opened valid intro circuit for what the service
  575. * needs so repurpose this one. */
  576. /* XXX: Legacy code checks options->ExcludeNodes and if not NULL it just
  577. * closes the circuit. I have NO idea why it does that so it hasn't been
  578. * added here. I can only assume in case our ExcludeNodes list changes but
  579. * in that case, all circuit are flagged unusable (config.c). --dgoulet */
  580. log_info(LD_CIRC | LD_REND, "Introduction circuit just opened but we "
  581. "have enough for service %s. Repurposing "
  582. "it to general and leaving internal.",
  583. safe_str_client(service->onion_address));
  584. tor_assert(circ->build_state->is_internal);
  585. /* Remove it from the circuitmap. */
  586. hs_circuitmap_remove_circuit(TO_CIRCUIT(circ));
  587. /* Cleaning up the hidden service identifier and repurpose. */
  588. hs_ident_circuit_free(circ->hs_ident);
  589. circ->hs_ident = NULL;
  590. circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_C_GENERAL);
  591. /* Inform that this circuit just opened for this new purpose. */
  592. circuit_has_opened(circ);
  593. /* This return value indicate to the caller that the IP object should be
  594. * removed from the service because it's corresponding circuit has just
  595. * been repurposed. */
  596. ret = 1;
  597. goto done;
  598. }
  599. log_info(LD_REND, "Introduction circuit %u established for service %s.",
  600. TO_CIRCUIT(circ)->n_circ_id,
  601. safe_str_client(service->onion_address));
  602. circuit_log_path(LOG_INFO, LD_REND, circ);
  603. /* Time to send an ESTABLISH_INTRO cell on this circuit. On error, this call
  604. * makes sure the circuit gets closed. */
  605. send_establish_intro(service, ip, circ);
  606. done:
  607. return ret;
  608. }
  609. /* Called when a service rendezvous point circuit is done building. Given the
  610. * service and the circuit, this function will send a RENDEZVOUS1 cell on the
  611. * circuit using the information in the circuit identifier. If the cell can't
  612. * be sent, the circuit is closed. */
  613. void
  614. hs_circ_service_rp_has_opened(const hs_service_t *service,
  615. origin_circuit_t *circ)
  616. {
  617. size_t payload_len;
  618. uint8_t payload[RELAY_PAYLOAD_SIZE] = {0};
  619. tor_assert(service);
  620. tor_assert(circ);
  621. tor_assert(circ->hs_ident);
  622. /* Some useful logging. */
  623. log_info(LD_REND, "Rendezvous circuit %u has opened with cookie %s "
  624. "for service %s",
  625. TO_CIRCUIT(circ)->n_circ_id,
  626. hex_str((const char *) circ->hs_ident->rendezvous_cookie,
  627. REND_COOKIE_LEN),
  628. safe_str_client(service->onion_address));
  629. circuit_log_path(LOG_INFO, LD_REND, circ);
  630. /* This can't fail. */
  631. payload_len = hs_cell_build_rendezvous1(
  632. circ->hs_ident->rendezvous_cookie,
  633. sizeof(circ->hs_ident->rendezvous_cookie),
  634. circ->hs_ident->rendezvous_handshake_info,
  635. sizeof(circ->hs_ident->rendezvous_handshake_info),
  636. payload);
  637. if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(circ),
  638. RELAY_COMMAND_RENDEZVOUS1,
  639. (const char *) payload, payload_len,
  640. circ->cpath->prev) < 0) {
  641. /* On error, circuit is closed. */
  642. log_warn(LD_REND, "Unable to send RENDEZVOUS1 cell on circuit %u "
  643. "for service %s",
  644. TO_CIRCUIT(circ)->n_circ_id,
  645. safe_str_client(service->onion_address));
  646. goto done;
  647. }
  648. /* Setup end-to-end rendezvous circuit between the client and us. */
  649. if (hs_circuit_setup_e2e_rend_circ(circ,
  650. circ->hs_ident->rendezvous_ntor_key_seed,
  651. sizeof(circ->hs_ident->rendezvous_ntor_key_seed),
  652. 1) < 0) {
  653. log_warn(LD_GENERAL, "Failed to setup circ");
  654. goto done;
  655. }
  656. done:
  657. memwipe(payload, 0, sizeof(payload));
  658. }
  659. /* Handle an INTRO_ESTABLISHED cell payload of length payload_len arriving on
  660. * the given introduction circuit circ. The service is only used for logging
  661. * purposes. Return 0 on success else a negative value. */
  662. int
  663. hs_circ_handle_intro_established(const hs_service_t *service,
  664. const hs_service_intro_point_t *ip,
  665. origin_circuit_t *circ,
  666. const uint8_t *payload, size_t payload_len)
  667. {
  668. int ret = -1;
  669. tor_assert(service);
  670. tor_assert(ip);
  671. tor_assert(circ);
  672. tor_assert(payload);
  673. /* Try to parse the payload into a cell making sure we do actually have a
  674. * valid cell. For a legacy node, it's an empty payload so as long as we
  675. * have the cell, we are good. */
  676. if (!ip->base.is_only_legacy &&
  677. hs_cell_parse_intro_established(payload, payload_len) < 0) {
  678. log_warn(LD_REND, "Unable to parse the INTRO_ESTABLISHED cell on "
  679. "circuit %u for service %s",
  680. TO_CIRCUIT(circ)->n_circ_id,
  681. safe_str_client(service->onion_address));
  682. goto done;
  683. }
  684. /* Switch the purpose to a fully working intro point. */
  685. circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_S_INTRO);
  686. /* Getting a valid INTRODUCE_ESTABLISHED means we've successfully used the
  687. * circuit so update our pathbias subsystem. */
  688. pathbias_mark_use_success(circ);
  689. /* Success. */
  690. ret = 0;
  691. done:
  692. return ret;
  693. }
  694. /* Handle an INTRODUCE2 unparsed payload of payload_len for the given circuit
  695. * and service. This cell is associated with the intro point object ip and the
  696. * subcredential. Return 0 on success else a negative value. */
  697. int
  698. hs_circ_handle_introduce2(const hs_service_t *service,
  699. const origin_circuit_t *circ,
  700. hs_service_intro_point_t *ip,
  701. const uint8_t *subcredential,
  702. const uint8_t *payload, size_t payload_len)
  703. {
  704. int ret = -1;
  705. hs_cell_introduce2_data_t data;
  706. tor_assert(service);
  707. tor_assert(circ);
  708. tor_assert(ip);
  709. tor_assert(subcredential);
  710. tor_assert(payload);
  711. /* Populate the data structure with everything we need for the cell to be
  712. * parsed, decrypted and key material computed correctly. */
  713. data.auth_pk = &ip->auth_key_kp.pubkey;
  714. data.enc_kp = &ip->enc_key_kp;
  715. data.subcredential = subcredential;
  716. data.payload = payload;
  717. data.payload_len = payload_len;
  718. data.link_specifiers = smartlist_new();
  719. data.is_legacy = ip->base.is_only_legacy;
  720. if (hs_cell_parse_introduce2(&data, circ, service) < 0) {
  721. goto done;
  722. }
  723. /* At this point, we just confirmed that the full INTRODUCE2 cell is valid
  724. * so increment our counter that we've seen one on this intro point. */
  725. ip->introduce2_count++;
  726. /* Launch rendezvous circuit with the onion key and rend cookie. */
  727. launch_rendezvous_point_circuit(service, ip, &data);
  728. /* Success. */
  729. ret = 0;
  730. done:
  731. SMARTLIST_FOREACH(data.link_specifiers, link_specifier_t *, lspec,
  732. link_specifier_free(lspec));
  733. smartlist_free(data.link_specifiers);
  734. memwipe(&data, 0, sizeof(data));
  735. return ret;
  736. }
  737. /* Circuit <b>circ</b> just finished the rend ntor key exchange. Use the key
  738. * exchange output material at <b>ntor_key_seed</b> and setup <b>circ</b> to
  739. * serve as a rendezvous end-to-end circuit between the client and the
  740. * service. If <b>is_service_side</b> is set, then we are the hidden service
  741. * and the other side is the client.
  742. *
  743. * Return 0 if the operation went well; in case of error return -1. */
  744. int
  745. hs_circuit_setup_e2e_rend_circ(origin_circuit_t *circ,
  746. const uint8_t *ntor_key_seed, size_t seed_len,
  747. int is_service_side)
  748. {
  749. if (BUG(!circuit_purpose_is_correct_for_rend(TO_CIRCUIT(circ)->purpose,
  750. is_service_side))) {
  751. return -1;
  752. }
  753. crypt_path_t *hop = create_rend_cpath(ntor_key_seed, seed_len,
  754. is_service_side);
  755. if (!hop) {
  756. log_warn(LD_REND, "Couldn't get v3 %s cpath!",
  757. is_service_side ? "service-side" : "client-side");
  758. return -1;
  759. }
  760. finalize_rend_circuit(circ, hop, is_service_side);
  761. return 0;
  762. }
  763. /* We are a v2 legacy HS client and we just received a RENDEZVOUS1 cell
  764. * <b>rend_cell_body</b> on <b>circ</b>. Finish up the DH key exchange and then
  765. * extend the crypt path of <b>circ</b> so that the hidden service is on the
  766. * other side. */
  767. int
  768. hs_circuit_setup_e2e_rend_circ_legacy_client(origin_circuit_t *circ,
  769. const uint8_t *rend_cell_body)
  770. {
  771. if (BUG(!circuit_purpose_is_correct_for_rend(
  772. TO_CIRCUIT(circ)->purpose, 0))) {
  773. return -1;
  774. }
  775. crypt_path_t *hop = create_rend_cpath_legacy(circ, rend_cell_body);
  776. if (!hop) {
  777. log_warn(LD_GENERAL, "Couldn't get v2 cpath.");
  778. return -1;
  779. }
  780. finalize_rend_circuit(circ, hop, 0);
  781. return 0;
  782. }