onion.c 44 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2017, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file onion.c
  8. * \brief Functions to queue create cells, wrap the various onionskin types,
  9. * and parse and create the CREATE cell and its allies.
  10. *
  11. * This module has a few functions, all related to the CREATE/CREATED
  12. * handshake that we use on links in order to create a circuit, and the
  13. * related EXTEND/EXTENDED handshake that we use over circuits in order to
  14. * extend them an additional hop.
  15. *
  16. * In this module, we provide a set of abstractions to create a uniform
  17. * interface over the three circuit extension handshakes that Tor has used
  18. * over the years (TAP, CREATE_FAST, and ntor). These handshakes are
  19. * implemented in onion_tap.c, onion_fast.c, and onion_ntor.c respectively.
  20. *
  21. * All[*] of these handshakes follow a similar pattern: a client, knowing
  22. * some key from the relay it wants to extend through, generates the
  23. * first part of a handshake. A relay receives that handshake, and sends
  24. * a reply. Once the client handles the reply, it knows that it is
  25. * talking to the right relay, and it shares some freshly negotiated key
  26. * material with that relay.
  27. *
  28. * We sometimes call the client's part of the handshake an "onionskin".
  29. * We do this because historically, Onion Routing used a multi-layer
  30. * structure called an "onion" to construct circuits. Each layer of the
  31. * onion contained key material chosen by the client, the identity of
  32. * the next relay in the circuit, and a smaller onion, encrypted with
  33. * the key of the next relay. When we changed Tor to use a telescoping
  34. * circuit extension design, it corresponded to sending each layer of the
  35. * onion separately -- as a series of onionskins.
  36. *
  37. * Clients invoke these functions when creating or extending a circuit,
  38. * from circuitbuild.c.
  39. *
  40. * Relays invoke these functions when they receive a CREATE or EXTEND
  41. * cell in command.c or relay.c, in order to queue the pending request.
  42. * They also invoke them from cpuworker.c, which handles dispatching
  43. * onionskin requests to different worker threads.
  44. *
  45. * <br>
  46. *
  47. * This module also handles:
  48. * <ul>
  49. * <li> Queueing incoming onionskins on the relay side before passing
  50. * them to worker threads.
  51. * <li>Expiring onionskins on the relay side if they have waited for
  52. * too long.
  53. * <li>Packaging private keys on the server side in order to pass
  54. * them to worker threads.
  55. * <li>Encoding and decoding CREATE, CREATED, CREATE2, and CREATED2 cells.
  56. * <li>Encoding and decodign EXTEND, EXTENDED, EXTEND2, and EXTENDED2
  57. * relay cells.
  58. * </ul>
  59. *
  60. * [*] The CREATE_FAST handshake is weaker than described here; see
  61. * onion_fast.c for more information.
  62. **/
  63. #include "or.h"
  64. #include "circuitbuild.h"
  65. #include "circuitlist.h"
  66. #include "config.h"
  67. #include "cpuworker.h"
  68. #include "networkstatus.h"
  69. #include "onion.h"
  70. #include "onion_fast.h"
  71. #include "onion_ntor.h"
  72. #include "onion_tap.h"
  73. #include "relay.h"
  74. #include "rephist.h"
  75. #include "router.h"
  76. // trunnel
  77. #include "ed25519_cert.h"
  78. /** Type for a linked list of circuits that are waiting for a free CPU worker
  79. * to process a waiting onion handshake. */
  80. typedef struct onion_queue_t {
  81. TOR_TAILQ_ENTRY(onion_queue_t) next;
  82. or_circuit_t *circ;
  83. uint16_t handshake_type;
  84. create_cell_t *onionskin;
  85. time_t when_added;
  86. } onion_queue_t;
  87. /** 5 seconds on the onion queue til we just send back a destroy */
  88. #define ONIONQUEUE_WAIT_CUTOFF 5
  89. /** Array of queues of circuits waiting for CPU workers. An element is NULL
  90. * if that queue is empty.*/
  91. static TOR_TAILQ_HEAD(onion_queue_head_t, onion_queue_t)
  92. ol_list[MAX_ONION_HANDSHAKE_TYPE+1] =
  93. { TOR_TAILQ_HEAD_INITIALIZER(ol_list[0]), /* tap */
  94. TOR_TAILQ_HEAD_INITIALIZER(ol_list[1]), /* fast */
  95. TOR_TAILQ_HEAD_INITIALIZER(ol_list[2]), /* ntor */
  96. };
  97. /** Number of entries of each type currently in each element of ol_list[]. */
  98. static int ol_entries[MAX_ONION_HANDSHAKE_TYPE+1];
  99. static int num_ntors_per_tap(void);
  100. static void onion_queue_entry_remove(onion_queue_t *victim);
  101. /* XXXX Check lengths vs MAX_ONIONSKIN_{CHALLENGE,REPLY}_LEN.
  102. *
  103. * (By which I think I meant, "make sure that no
  104. * X_ONIONSKIN_CHALLENGE/REPLY_LEN is greater than
  105. * MAX_ONIONSKIN_CHALLENGE/REPLY_LEN." Also, make sure that we can pass
  106. * over-large values via EXTEND2/EXTENDED2, for future-compatibility.*/
  107. /** Return true iff we have room to queue another onionskin of type
  108. * <b>type</b>. */
  109. static int
  110. have_room_for_onionskin(uint16_t type)
  111. {
  112. const or_options_t *options = get_options();
  113. int num_cpus;
  114. uint64_t tap_usec, ntor_usec;
  115. uint64_t ntor_during_tap_usec, tap_during_ntor_usec;
  116. /* If we've got fewer than 50 entries, we always have room for one more. */
  117. if (ol_entries[type] < 50)
  118. return 1;
  119. num_cpus = get_num_cpus(options);
  120. /* Compute how many microseconds we'd expect to need to clear all
  121. * onionskins in various combinations of the queues. */
  122. /* How long would it take to process all the TAP cells in the queue? */
  123. tap_usec = estimated_usec_for_onionskins(
  124. ol_entries[ONION_HANDSHAKE_TYPE_TAP],
  125. ONION_HANDSHAKE_TYPE_TAP) / num_cpus;
  126. /* How long would it take to process all the NTor cells in the queue? */
  127. ntor_usec = estimated_usec_for_onionskins(
  128. ol_entries[ONION_HANDSHAKE_TYPE_NTOR],
  129. ONION_HANDSHAKE_TYPE_NTOR) / num_cpus;
  130. /* How long would it take to process the tap cells that we expect to
  131. * process while draining the ntor queue? */
  132. tap_during_ntor_usec = estimated_usec_for_onionskins(
  133. MIN(ol_entries[ONION_HANDSHAKE_TYPE_TAP],
  134. ol_entries[ONION_HANDSHAKE_TYPE_NTOR] / num_ntors_per_tap()),
  135. ONION_HANDSHAKE_TYPE_TAP) / num_cpus;
  136. /* How long would it take to process the ntor cells that we expect to
  137. * process while draining the tap queue? */
  138. ntor_during_tap_usec = estimated_usec_for_onionskins(
  139. MIN(ol_entries[ONION_HANDSHAKE_TYPE_NTOR],
  140. ol_entries[ONION_HANDSHAKE_TYPE_TAP] * num_ntors_per_tap()),
  141. ONION_HANDSHAKE_TYPE_NTOR) / num_cpus;
  142. /* See whether that exceeds MaxOnionQueueDelay. If so, we can't queue
  143. * this. */
  144. if (type == ONION_HANDSHAKE_TYPE_NTOR &&
  145. (ntor_usec + tap_during_ntor_usec) / 1000 >
  146. (uint64_t)options->MaxOnionQueueDelay)
  147. return 0;
  148. if (type == ONION_HANDSHAKE_TYPE_TAP &&
  149. (tap_usec + ntor_during_tap_usec) / 1000 >
  150. (uint64_t)options->MaxOnionQueueDelay)
  151. return 0;
  152. /* If we support the ntor handshake, then don't let TAP handshakes use
  153. * more than 2/3 of the space on the queue. */
  154. if (type == ONION_HANDSHAKE_TYPE_TAP &&
  155. tap_usec / 1000 > (uint64_t)options->MaxOnionQueueDelay * 2 / 3)
  156. return 0;
  157. return 1;
  158. }
  159. /** Add <b>circ</b> to the end of ol_list and return 0, except
  160. * if ol_list is too long, in which case do nothing and return -1.
  161. */
  162. int
  163. onion_pending_add(or_circuit_t *circ, create_cell_t *onionskin)
  164. {
  165. onion_queue_t *tmp;
  166. time_t now = time(NULL);
  167. if (onionskin->handshake_type > MAX_ONION_HANDSHAKE_TYPE) {
  168. /* LCOV_EXCL_START
  169. * We should have rejected this far before this point */
  170. log_warn(LD_BUG, "Handshake %d out of range! Dropping.",
  171. onionskin->handshake_type);
  172. return -1;
  173. /* LCOV_EXCL_STOP */
  174. }
  175. tmp = tor_malloc_zero(sizeof(onion_queue_t));
  176. tmp->circ = circ;
  177. tmp->handshake_type = onionskin->handshake_type;
  178. tmp->onionskin = onionskin;
  179. tmp->when_added = now;
  180. if (!have_room_for_onionskin(onionskin->handshake_type)) {
  181. #define WARN_TOO_MANY_CIRC_CREATIONS_INTERVAL (60)
  182. static ratelim_t last_warned =
  183. RATELIM_INIT(WARN_TOO_MANY_CIRC_CREATIONS_INTERVAL);
  184. char *m;
  185. if (onionskin->handshake_type == ONION_HANDSHAKE_TYPE_NTOR &&
  186. (m = rate_limit_log(&last_warned, approx_time()))) {
  187. log_warn(LD_GENERAL,
  188. "Your computer is too slow to handle this many circuit "
  189. "creation requests! Please consider using the "
  190. "MaxAdvertisedBandwidth config option or choosing a more "
  191. "restricted exit policy.%s",m);
  192. tor_free(m);
  193. }
  194. tor_free(tmp);
  195. return -1;
  196. }
  197. ++ol_entries[onionskin->handshake_type];
  198. log_info(LD_OR, "New create (%s). Queues now ntor=%d and tap=%d.",
  199. onionskin->handshake_type == ONION_HANDSHAKE_TYPE_NTOR ? "ntor" : "tap",
  200. ol_entries[ONION_HANDSHAKE_TYPE_NTOR],
  201. ol_entries[ONION_HANDSHAKE_TYPE_TAP]);
  202. circ->onionqueue_entry = tmp;
  203. TOR_TAILQ_INSERT_TAIL(&ol_list[onionskin->handshake_type], tmp, next);
  204. /* cull elderly requests. */
  205. while (1) {
  206. onion_queue_t *head = TOR_TAILQ_FIRST(&ol_list[onionskin->handshake_type]);
  207. if (now - head->when_added < (time_t)ONIONQUEUE_WAIT_CUTOFF)
  208. break;
  209. circ = head->circ;
  210. circ->onionqueue_entry = NULL;
  211. onion_queue_entry_remove(head);
  212. log_info(LD_CIRC,
  213. "Circuit create request is too old; canceling due to overload.");
  214. if (! TO_CIRCUIT(circ)->marked_for_close) {
  215. circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_RESOURCELIMIT);
  216. }
  217. }
  218. return 0;
  219. }
  220. /** Return a fairness parameter, to prefer processing NTOR style
  221. * handshakes but still slowly drain the TAP queue so we don't starve
  222. * it entirely. */
  223. static int
  224. num_ntors_per_tap(void)
  225. {
  226. #define DEFAULT_NUM_NTORS_PER_TAP 10
  227. #define MIN_NUM_NTORS_PER_TAP 1
  228. #define MAX_NUM_NTORS_PER_TAP 100000
  229. return networkstatus_get_param(NULL, "NumNTorsPerTAP",
  230. DEFAULT_NUM_NTORS_PER_TAP,
  231. MIN_NUM_NTORS_PER_TAP,
  232. MAX_NUM_NTORS_PER_TAP);
  233. }
  234. /** Choose which onion queue we'll pull from next. If one is empty choose
  235. * the other; if they both have elements, load balance across them but
  236. * favoring NTOR. */
  237. static uint16_t
  238. decide_next_handshake_type(void)
  239. {
  240. /* The number of times we've chosen ntor lately when both were available. */
  241. static int recently_chosen_ntors = 0;
  242. if (!ol_entries[ONION_HANDSHAKE_TYPE_NTOR])
  243. return ONION_HANDSHAKE_TYPE_TAP; /* no ntors? try tap */
  244. if (!ol_entries[ONION_HANDSHAKE_TYPE_TAP]) {
  245. /* Nick wants us to prioritize new tap requests when there aren't
  246. * any in the queue and we've processed k ntor cells since the last
  247. * tap cell. This strategy is maybe a good idea, since it starves tap
  248. * less in the case where tap is rare, or maybe a poor idea, since it
  249. * makes the new tap cell unfairly jump in front of ntor cells that
  250. * got here first. In any case this edge case will only become relevant
  251. * once tap is rare. We should reevaluate whether we like this decision
  252. * once tap gets more rare. */
  253. if (ol_entries[ONION_HANDSHAKE_TYPE_NTOR] &&
  254. recently_chosen_ntors <= num_ntors_per_tap())
  255. ++recently_chosen_ntors;
  256. return ONION_HANDSHAKE_TYPE_NTOR; /* no taps? try ntor */
  257. }
  258. /* They both have something queued. Pick ntor if we haven't done that
  259. * too much lately. */
  260. if (++recently_chosen_ntors <= num_ntors_per_tap()) {
  261. return ONION_HANDSHAKE_TYPE_NTOR;
  262. }
  263. /* Else, it's time to let tap have its turn. */
  264. recently_chosen_ntors = 0;
  265. return ONION_HANDSHAKE_TYPE_TAP;
  266. }
  267. /** Remove the highest priority item from ol_list[] and return it, or
  268. * return NULL if the lists are empty.
  269. */
  270. or_circuit_t *
  271. onion_next_task(create_cell_t **onionskin_out)
  272. {
  273. or_circuit_t *circ;
  274. uint16_t handshake_to_choose = decide_next_handshake_type();
  275. onion_queue_t *head = TOR_TAILQ_FIRST(&ol_list[handshake_to_choose]);
  276. if (!head)
  277. return NULL; /* no onions pending, we're done */
  278. tor_assert(head->circ);
  279. tor_assert(head->handshake_type <= MAX_ONION_HANDSHAKE_TYPE);
  280. // tor_assert(head->circ->p_chan); /* make sure it's still valid */
  281. /* XXX I only commented out the above line to make the unit tests
  282. * more manageable. That's probably not good long-term. -RD */
  283. circ = head->circ;
  284. if (head->onionskin)
  285. --ol_entries[head->handshake_type];
  286. log_info(LD_OR, "Processing create (%s). Queues now ntor=%d and tap=%d.",
  287. head->handshake_type == ONION_HANDSHAKE_TYPE_NTOR ? "ntor" : "tap",
  288. ol_entries[ONION_HANDSHAKE_TYPE_NTOR],
  289. ol_entries[ONION_HANDSHAKE_TYPE_TAP]);
  290. *onionskin_out = head->onionskin;
  291. head->onionskin = NULL; /* prevent free. */
  292. circ->onionqueue_entry = NULL;
  293. onion_queue_entry_remove(head);
  294. return circ;
  295. }
  296. /** Return the number of <b>handshake_type</b>-style create requests pending.
  297. */
  298. int
  299. onion_num_pending(uint16_t handshake_type)
  300. {
  301. return ol_entries[handshake_type];
  302. }
  303. /** Go through ol_list, find the onion_queue_t element which points to
  304. * circ, remove and free that element. Leave circ itself alone.
  305. */
  306. void
  307. onion_pending_remove(or_circuit_t *circ)
  308. {
  309. onion_queue_t *victim;
  310. if (!circ)
  311. return;
  312. victim = circ->onionqueue_entry;
  313. if (victim)
  314. onion_queue_entry_remove(victim);
  315. cpuworker_cancel_circ_handshake(circ);
  316. }
  317. /** Remove a queue entry <b>victim</b> from the queue, unlinking it from
  318. * its circuit and freeing it and any structures it owns.*/
  319. static void
  320. onion_queue_entry_remove(onion_queue_t *victim)
  321. {
  322. if (victim->handshake_type > MAX_ONION_HANDSHAKE_TYPE) {
  323. /* LCOV_EXCL_START
  324. * We should have rejected this far before this point */
  325. log_warn(LD_BUG, "Handshake %d out of range! Dropping.",
  326. victim->handshake_type);
  327. /* XXX leaks */
  328. return;
  329. /* LCOV_EXCL_STOP */
  330. }
  331. TOR_TAILQ_REMOVE(&ol_list[victim->handshake_type], victim, next);
  332. if (victim->circ)
  333. victim->circ->onionqueue_entry = NULL;
  334. if (victim->onionskin)
  335. --ol_entries[victim->handshake_type];
  336. tor_free(victim->onionskin);
  337. tor_free(victim);
  338. }
  339. /** Remove all circuits from the pending list. Called from tor_free_all. */
  340. void
  341. clear_pending_onions(void)
  342. {
  343. onion_queue_t *victim, *next;
  344. int i;
  345. for (i=0; i<=MAX_ONION_HANDSHAKE_TYPE; i++) {
  346. for (victim = TOR_TAILQ_FIRST(&ol_list[i]); victim; victim = next) {
  347. next = TOR_TAILQ_NEXT(victim,next);
  348. onion_queue_entry_remove(victim);
  349. }
  350. tor_assert(TOR_TAILQ_EMPTY(&ol_list[i]));
  351. }
  352. memset(ol_entries, 0, sizeof(ol_entries));
  353. }
  354. /* ============================================================ */
  355. /** Return a new server_onion_keys_t object with all of the keys
  356. * and other info we might need to do onion handshakes. (We make a copy of
  357. * our keys for each cpuworker to avoid race conditions with the main thread,
  358. * and to avoid locking) */
  359. server_onion_keys_t *
  360. server_onion_keys_new(void)
  361. {
  362. server_onion_keys_t *keys = tor_malloc_zero(sizeof(server_onion_keys_t));
  363. memcpy(keys->my_identity, router_get_my_id_digest(), DIGEST_LEN);
  364. dup_onion_keys(&keys->onion_key, &keys->last_onion_key);
  365. keys->curve25519_key_map = construct_ntor_key_map();
  366. keys->junk_keypair = tor_malloc_zero(sizeof(curve25519_keypair_t));
  367. curve25519_keypair_generate(keys->junk_keypair, 0);
  368. return keys;
  369. }
  370. /** Release all storage held in <b>keys</b>. */
  371. void
  372. server_onion_keys_free(server_onion_keys_t *keys)
  373. {
  374. if (! keys)
  375. return;
  376. crypto_pk_free(keys->onion_key);
  377. crypto_pk_free(keys->last_onion_key);
  378. ntor_key_map_free(keys->curve25519_key_map);
  379. tor_free(keys->junk_keypair);
  380. memwipe(keys, 0, sizeof(server_onion_keys_t));
  381. tor_free(keys);
  382. }
  383. /** Release whatever storage is held in <b>state</b>, depending on its
  384. * type, and clear its pointer. */
  385. void
  386. onion_handshake_state_release(onion_handshake_state_t *state)
  387. {
  388. switch (state->tag) {
  389. case ONION_HANDSHAKE_TYPE_TAP:
  390. crypto_dh_free(state->u.tap);
  391. state->u.tap = NULL;
  392. break;
  393. case ONION_HANDSHAKE_TYPE_FAST:
  394. fast_handshake_state_free(state->u.fast);
  395. state->u.fast = NULL;
  396. break;
  397. case ONION_HANDSHAKE_TYPE_NTOR:
  398. ntor_handshake_state_free(state->u.ntor);
  399. state->u.ntor = NULL;
  400. break;
  401. default:
  402. /* LCOV_EXCL_START
  403. * This state should not even exist. */
  404. log_warn(LD_BUG, "called with unknown handshake state type %d",
  405. (int)state->tag);
  406. tor_fragile_assert();
  407. /* LCOV_EXCL_STOP */
  408. }
  409. }
  410. /** Perform the first step of a circuit-creation handshake of type <b>type</b>
  411. * (one of ONION_HANDSHAKE_TYPE_*): generate the initial "onion skin" in
  412. * <b>onion_skin_out</b>, and store any state information in <b>state_out</b>.
  413. * Return -1 on failure, and the length of the onionskin on acceptance.
  414. */
  415. int
  416. onion_skin_create(int type,
  417. const extend_info_t *node,
  418. onion_handshake_state_t *state_out,
  419. uint8_t *onion_skin_out)
  420. {
  421. int r = -1;
  422. switch (type) {
  423. case ONION_HANDSHAKE_TYPE_TAP:
  424. if (!node->onion_key)
  425. return -1;
  426. if (onion_skin_TAP_create(node->onion_key,
  427. &state_out->u.tap,
  428. (char*)onion_skin_out) < 0)
  429. return -1;
  430. r = TAP_ONIONSKIN_CHALLENGE_LEN;
  431. break;
  432. case ONION_HANDSHAKE_TYPE_FAST:
  433. if (fast_onionskin_create(&state_out->u.fast, onion_skin_out) < 0)
  434. return -1;
  435. r = CREATE_FAST_LEN;
  436. break;
  437. case ONION_HANDSHAKE_TYPE_NTOR:
  438. if (!extend_info_supports_ntor(node))
  439. return -1;
  440. if (onion_skin_ntor_create((const uint8_t*)node->identity_digest,
  441. &node->curve25519_onion_key,
  442. &state_out->u.ntor,
  443. onion_skin_out) < 0)
  444. return -1;
  445. r = NTOR_ONIONSKIN_LEN;
  446. break;
  447. default:
  448. /* LCOV_EXCL_START
  449. * We should never try to create an impossible handshake type. */
  450. log_warn(LD_BUG, "called with unknown handshake state type %d", type);
  451. tor_fragile_assert();
  452. r = -1;
  453. /* LCOV_EXCL_STOP */
  454. }
  455. if (r > 0)
  456. state_out->tag = (uint16_t) type;
  457. return r;
  458. }
  459. /** Perform the second (server-side) step of a circuit-creation handshake of
  460. * type <b>type</b>, responding to the client request in <b>onion_skin</b>
  461. * using the keys in <b>keys</b>. On success, write our response into
  462. * <b>reply_out</b>, generate <b>keys_out_len</b> bytes worth of key material
  463. * in <b>keys_out_len</b>, a hidden service nonce to <b>rend_nonce_out</b>,
  464. * and return the length of the reply. On failure, return -1.
  465. */
  466. int
  467. onion_skin_server_handshake(int type,
  468. const uint8_t *onion_skin, size_t onionskin_len,
  469. const server_onion_keys_t *keys,
  470. uint8_t *reply_out,
  471. uint8_t *keys_out, size_t keys_out_len,
  472. uint8_t *rend_nonce_out)
  473. {
  474. int r = -1;
  475. switch (type) {
  476. case ONION_HANDSHAKE_TYPE_TAP:
  477. if (onionskin_len != TAP_ONIONSKIN_CHALLENGE_LEN)
  478. return -1;
  479. if (onion_skin_TAP_server_handshake((const char*)onion_skin,
  480. keys->onion_key, keys->last_onion_key,
  481. (char*)reply_out,
  482. (char*)keys_out, keys_out_len)<0)
  483. return -1;
  484. r = TAP_ONIONSKIN_REPLY_LEN;
  485. memcpy(rend_nonce_out, reply_out+DH_KEY_LEN, DIGEST_LEN);
  486. break;
  487. case ONION_HANDSHAKE_TYPE_FAST:
  488. if (onionskin_len != CREATE_FAST_LEN)
  489. return -1;
  490. if (fast_server_handshake(onion_skin, reply_out, keys_out, keys_out_len)<0)
  491. return -1;
  492. r = CREATED_FAST_LEN;
  493. memcpy(rend_nonce_out, reply_out+DIGEST_LEN, DIGEST_LEN);
  494. break;
  495. case ONION_HANDSHAKE_TYPE_NTOR:
  496. if (onionskin_len < NTOR_ONIONSKIN_LEN)
  497. return -1;
  498. {
  499. size_t keys_tmp_len = keys_out_len + DIGEST_LEN;
  500. uint8_t *keys_tmp = tor_malloc(keys_out_len + DIGEST_LEN);
  501. if (onion_skin_ntor_server_handshake(
  502. onion_skin, keys->curve25519_key_map,
  503. keys->junk_keypair,
  504. keys->my_identity,
  505. reply_out, keys_tmp, keys_tmp_len)<0) {
  506. tor_free(keys_tmp);
  507. return -1;
  508. }
  509. memcpy(keys_out, keys_tmp, keys_out_len);
  510. memcpy(rend_nonce_out, keys_tmp+keys_out_len, DIGEST_LEN);
  511. memwipe(keys_tmp, 0, keys_tmp_len);
  512. tor_free(keys_tmp);
  513. r = NTOR_REPLY_LEN;
  514. }
  515. break;
  516. default:
  517. /* LCOV_EXCL_START
  518. * We should have rejected this far before this point */
  519. log_warn(LD_BUG, "called with unknown handshake state type %d", type);
  520. tor_fragile_assert();
  521. return -1;
  522. /* LCOV_EXCL_STOP */
  523. }
  524. return r;
  525. }
  526. /** Perform the final (client-side) step of a circuit-creation handshake of
  527. * type <b>type</b>, using our state in <b>handshake_state</b> and the
  528. * server's response in <b>reply</b>. On success, generate <b>keys_out_len</b>
  529. * bytes worth of key material in <b>keys_out_len</b>, set
  530. * <b>rend_authenticator_out</b> to the "KH" field that can be used to
  531. * establish introduction points at this hop, and return 0. On failure,
  532. * return -1, and set *msg_out to an error message if this is worth
  533. * complaining to the user about. */
  534. int
  535. onion_skin_client_handshake(int type,
  536. const onion_handshake_state_t *handshake_state,
  537. const uint8_t *reply, size_t reply_len,
  538. uint8_t *keys_out, size_t keys_out_len,
  539. uint8_t *rend_authenticator_out,
  540. const char **msg_out)
  541. {
  542. if (handshake_state->tag != type)
  543. return -1;
  544. switch (type) {
  545. case ONION_HANDSHAKE_TYPE_TAP:
  546. if (reply_len != TAP_ONIONSKIN_REPLY_LEN) {
  547. if (msg_out)
  548. *msg_out = "TAP reply was not of the correct length.";
  549. return -1;
  550. }
  551. if (onion_skin_TAP_client_handshake(handshake_state->u.tap,
  552. (const char*)reply,
  553. (char *)keys_out, keys_out_len,
  554. msg_out) < 0)
  555. return -1;
  556. memcpy(rend_authenticator_out, reply+DH_KEY_LEN, DIGEST_LEN);
  557. return 0;
  558. case ONION_HANDSHAKE_TYPE_FAST:
  559. if (reply_len != CREATED_FAST_LEN) {
  560. if (msg_out)
  561. *msg_out = "TAP reply was not of the correct length.";
  562. return -1;
  563. }
  564. if (fast_client_handshake(handshake_state->u.fast, reply,
  565. keys_out, keys_out_len, msg_out) < 0)
  566. return -1;
  567. memcpy(rend_authenticator_out, reply+DIGEST_LEN, DIGEST_LEN);
  568. return 0;
  569. case ONION_HANDSHAKE_TYPE_NTOR:
  570. if (reply_len < NTOR_REPLY_LEN) {
  571. if (msg_out)
  572. *msg_out = "ntor reply was not of the correct length.";
  573. return -1;
  574. }
  575. {
  576. size_t keys_tmp_len = keys_out_len + DIGEST_LEN;
  577. uint8_t *keys_tmp = tor_malloc(keys_tmp_len);
  578. if (onion_skin_ntor_client_handshake(handshake_state->u.ntor,
  579. reply,
  580. keys_tmp, keys_tmp_len, msg_out) < 0) {
  581. tor_free(keys_tmp);
  582. return -1;
  583. }
  584. memcpy(keys_out, keys_tmp, keys_out_len);
  585. memcpy(rend_authenticator_out, keys_tmp + keys_out_len, DIGEST_LEN);
  586. memwipe(keys_tmp, 0, keys_tmp_len);
  587. tor_free(keys_tmp);
  588. }
  589. return 0;
  590. default:
  591. log_warn(LD_BUG, "called with unknown handshake state type %d", type);
  592. tor_fragile_assert();
  593. return -1;
  594. }
  595. }
  596. /** Helper: return 0 if <b>cell</b> appears valid, -1 otherwise. If
  597. * <b>unknown_ok</b> is true, allow cells with handshake types we don't
  598. * recognize. */
  599. static int
  600. check_create_cell(const create_cell_t *cell, int unknown_ok)
  601. {
  602. switch (cell->cell_type) {
  603. case CELL_CREATE:
  604. if (cell->handshake_type != ONION_HANDSHAKE_TYPE_TAP &&
  605. cell->handshake_type != ONION_HANDSHAKE_TYPE_NTOR)
  606. return -1;
  607. break;
  608. case CELL_CREATE_FAST:
  609. if (cell->handshake_type != ONION_HANDSHAKE_TYPE_FAST)
  610. return -1;
  611. break;
  612. case CELL_CREATE2:
  613. break;
  614. default:
  615. return -1;
  616. }
  617. switch (cell->handshake_type) {
  618. case ONION_HANDSHAKE_TYPE_TAP:
  619. if (cell->handshake_len != TAP_ONIONSKIN_CHALLENGE_LEN)
  620. return -1;
  621. break;
  622. case ONION_HANDSHAKE_TYPE_FAST:
  623. if (cell->handshake_len != CREATE_FAST_LEN)
  624. return -1;
  625. break;
  626. case ONION_HANDSHAKE_TYPE_NTOR:
  627. if (cell->handshake_len != NTOR_ONIONSKIN_LEN)
  628. return -1;
  629. break;
  630. default:
  631. if (! unknown_ok)
  632. return -1;
  633. }
  634. return 0;
  635. }
  636. /** Write the various parameters into the create cell. Separate from
  637. * create_cell_parse() to make unit testing easier.
  638. */
  639. void
  640. create_cell_init(create_cell_t *cell_out, uint8_t cell_type,
  641. uint16_t handshake_type, uint16_t handshake_len,
  642. const uint8_t *onionskin)
  643. {
  644. memset(cell_out, 0, sizeof(*cell_out));
  645. cell_out->cell_type = cell_type;
  646. cell_out->handshake_type = handshake_type;
  647. cell_out->handshake_len = handshake_len;
  648. memcpy(cell_out->onionskin, onionskin, handshake_len);
  649. }
  650. /** Helper: parse the CREATE2 payload at <b>p</b>, which could be up to
  651. * <b>p_len</b> bytes long, and use it to fill the fields of
  652. * <b>cell_out</b>. Return 0 on success and -1 on failure.
  653. *
  654. * Note that part of the body of an EXTEND2 cell is a CREATE2 payload, so
  655. * this function is also used for parsing those.
  656. */
  657. static int
  658. parse_create2_payload(create_cell_t *cell_out, const uint8_t *p, size_t p_len)
  659. {
  660. uint16_t handshake_type, handshake_len;
  661. if (p_len < 4)
  662. return -1;
  663. handshake_type = ntohs(get_uint16(p));
  664. handshake_len = ntohs(get_uint16(p+2));
  665. if (handshake_len > CELL_PAYLOAD_SIZE - 4 || handshake_len > p_len - 4)
  666. return -1;
  667. if (handshake_type == ONION_HANDSHAKE_TYPE_FAST)
  668. return -1;
  669. create_cell_init(cell_out, CELL_CREATE2, handshake_type, handshake_len,
  670. p+4);
  671. return 0;
  672. }
  673. /** Magic string which, in a CREATE or EXTEND cell, indicates that a seeming
  674. * TAP payload is really an ntor payload. We'd do away with this if every
  675. * relay supported EXTEND2, but we want to be able to extend from A to B with
  676. * ntor even when A doesn't understand EXTEND2 and so can't generate a
  677. * CREATE2 cell.
  678. **/
  679. #define NTOR_CREATE_MAGIC "ntorNTORntorNTOR"
  680. /** Parse a CREATE, CREATE_FAST, or CREATE2 cell from <b>cell_in</b> into
  681. * <b>cell_out</b>. Return 0 on success, -1 on failure. (We reject some
  682. * syntactically valid CREATE2 cells that we can't generate or react to.) */
  683. int
  684. create_cell_parse(create_cell_t *cell_out, const cell_t *cell_in)
  685. {
  686. switch (cell_in->command) {
  687. case CELL_CREATE:
  688. if (tor_memeq(cell_in->payload, NTOR_CREATE_MAGIC, 16)) {
  689. create_cell_init(cell_out, CELL_CREATE, ONION_HANDSHAKE_TYPE_NTOR,
  690. NTOR_ONIONSKIN_LEN, cell_in->payload+16);
  691. } else {
  692. create_cell_init(cell_out, CELL_CREATE, ONION_HANDSHAKE_TYPE_TAP,
  693. TAP_ONIONSKIN_CHALLENGE_LEN, cell_in->payload);
  694. }
  695. break;
  696. case CELL_CREATE_FAST:
  697. create_cell_init(cell_out, CELL_CREATE_FAST, ONION_HANDSHAKE_TYPE_FAST,
  698. CREATE_FAST_LEN, cell_in->payload);
  699. break;
  700. case CELL_CREATE2:
  701. if (parse_create2_payload(cell_out, cell_in->payload,
  702. CELL_PAYLOAD_SIZE) < 0)
  703. return -1;
  704. break;
  705. default:
  706. return -1;
  707. }
  708. return check_create_cell(cell_out, 0);
  709. }
  710. /** Helper: return 0 if <b>cell</b> appears valid, -1 otherwise. */
  711. static int
  712. check_created_cell(const created_cell_t *cell)
  713. {
  714. switch (cell->cell_type) {
  715. case CELL_CREATED:
  716. if (cell->handshake_len != TAP_ONIONSKIN_REPLY_LEN &&
  717. cell->handshake_len != NTOR_REPLY_LEN)
  718. return -1;
  719. break;
  720. case CELL_CREATED_FAST:
  721. if (cell->handshake_len != CREATED_FAST_LEN)
  722. return -1;
  723. break;
  724. case CELL_CREATED2:
  725. if (cell->handshake_len > RELAY_PAYLOAD_SIZE-2)
  726. return -1;
  727. break;
  728. }
  729. return 0;
  730. }
  731. /** Parse a CREATED, CREATED_FAST, or CREATED2 cell from <b>cell_in</b> into
  732. * <b>cell_out</b>. Return 0 on success, -1 on failure. */
  733. int
  734. created_cell_parse(created_cell_t *cell_out, const cell_t *cell_in)
  735. {
  736. memset(cell_out, 0, sizeof(*cell_out));
  737. switch (cell_in->command) {
  738. case CELL_CREATED:
  739. cell_out->cell_type = CELL_CREATED;
  740. cell_out->handshake_len = TAP_ONIONSKIN_REPLY_LEN;
  741. memcpy(cell_out->reply, cell_in->payload, TAP_ONIONSKIN_REPLY_LEN);
  742. break;
  743. case CELL_CREATED_FAST:
  744. cell_out->cell_type = CELL_CREATED_FAST;
  745. cell_out->handshake_len = CREATED_FAST_LEN;
  746. memcpy(cell_out->reply, cell_in->payload, CREATED_FAST_LEN);
  747. break;
  748. case CELL_CREATED2:
  749. {
  750. const uint8_t *p = cell_in->payload;
  751. cell_out->cell_type = CELL_CREATED2;
  752. cell_out->handshake_len = ntohs(get_uint16(p));
  753. if (cell_out->handshake_len > CELL_PAYLOAD_SIZE - 2)
  754. return -1;
  755. memcpy(cell_out->reply, p+2, cell_out->handshake_len);
  756. break;
  757. }
  758. }
  759. return check_created_cell(cell_out);
  760. }
  761. /** Helper: return 0 if <b>cell</b> appears valid, -1 otherwise. */
  762. static int
  763. check_extend_cell(const extend_cell_t *cell)
  764. {
  765. if (tor_digest_is_zero((const char*)cell->node_id))
  766. return -1;
  767. /* We don't currently allow EXTEND2 cells without an IPv4 address */
  768. if (tor_addr_family(&cell->orport_ipv4.addr) == AF_UNSPEC)
  769. return -1;
  770. if (cell->create_cell.cell_type == CELL_CREATE) {
  771. if (cell->cell_type != RELAY_COMMAND_EXTEND)
  772. return -1;
  773. } else if (cell->create_cell.cell_type == CELL_CREATE2) {
  774. if (cell->cell_type != RELAY_COMMAND_EXTEND2 &&
  775. cell->cell_type != RELAY_COMMAND_EXTEND)
  776. return -1;
  777. } else {
  778. /* In particular, no CREATE_FAST cells are allowed */
  779. return -1;
  780. }
  781. if (cell->create_cell.handshake_type == ONION_HANDSHAKE_TYPE_FAST)
  782. return -1;
  783. return check_create_cell(&cell->create_cell, 1);
  784. }
  785. static int
  786. extend_cell_from_extend1_cell_body(extend_cell_t *cell_out,
  787. const extend1_cell_body_t *cell)
  788. {
  789. tor_assert(cell_out);
  790. tor_assert(cell);
  791. memset(cell_out, 0, sizeof(*cell_out));
  792. tor_addr_make_unspec(&cell_out->orport_ipv4.addr);
  793. tor_addr_make_unspec(&cell_out->orport_ipv6.addr);
  794. cell_out->cell_type = RELAY_COMMAND_EXTEND;
  795. tor_addr_from_ipv4h(&cell_out->orport_ipv4.addr, cell->ipv4addr);
  796. cell_out->orport_ipv4.port = cell->port;
  797. if (tor_memeq(cell->onionskin, NTOR_CREATE_MAGIC, 16)) {
  798. cell_out->create_cell.cell_type = CELL_CREATE2;
  799. cell_out->create_cell.handshake_type = ONION_HANDSHAKE_TYPE_NTOR;
  800. cell_out->create_cell.handshake_len = NTOR_ONIONSKIN_LEN;
  801. memcpy(cell_out->create_cell.onionskin, cell->onionskin + 16,
  802. NTOR_ONIONSKIN_LEN);
  803. } else {
  804. cell_out->create_cell.cell_type = CELL_CREATE;
  805. cell_out->create_cell.handshake_type = ONION_HANDSHAKE_TYPE_TAP;
  806. cell_out->create_cell.handshake_len = TAP_ONIONSKIN_CHALLENGE_LEN;
  807. memcpy(cell_out->create_cell.onionskin, cell->onionskin,
  808. TAP_ONIONSKIN_CHALLENGE_LEN);
  809. }
  810. memcpy(cell_out->node_id, cell->identity, DIGEST_LEN);
  811. return 0;
  812. }
  813. static int
  814. create_cell_from_create2_cell_body(create_cell_t *cell_out,
  815. const create2_cell_body_t *cell)
  816. {
  817. tor_assert(cell_out);
  818. tor_assert(cell);
  819. memset(cell_out, 0, sizeof(create_cell_t));
  820. if (BUG(cell->handshake_len > sizeof(cell_out->onionskin))) {
  821. /* This should be impossible because there just isn't enough room in the
  822. * input cell to make the handshake_len this large and provide a
  823. * handshake_data to match. */
  824. return -1;
  825. }
  826. cell_out->cell_type = CELL_CREATE2;
  827. cell_out->handshake_type = cell->handshake_type;
  828. cell_out->handshake_len = cell->handshake_len;
  829. memcpy(cell_out->onionskin,
  830. create2_cell_body_getconstarray_handshake_data(cell),
  831. cell->handshake_len);
  832. return 0;
  833. }
  834. static int
  835. extend_cell_from_extend2_cell_body(extend_cell_t *cell_out,
  836. const extend2_cell_body_t *cell)
  837. {
  838. tor_assert(cell_out);
  839. tor_assert(cell);
  840. int found_ipv4 = 0, found_ipv6 = 0, found_rsa_id = 0, found_ed_id = 0;
  841. memset(cell_out, 0, sizeof(*cell_out));
  842. tor_addr_make_unspec(&cell_out->orport_ipv4.addr);
  843. tor_addr_make_unspec(&cell_out->orport_ipv6.addr);
  844. cell_out->cell_type = RELAY_COMMAND_EXTEND2;
  845. unsigned i;
  846. for (i = 0; i < cell->n_spec; ++i) {
  847. const link_specifier_t *ls = extend2_cell_body_getconst_ls(cell, i);
  848. switch (ls->ls_type) {
  849. case LS_IPV4:
  850. if (found_ipv4)
  851. continue;
  852. found_ipv4 = 1;
  853. tor_addr_from_ipv4h(&cell_out->orport_ipv4.addr, ls->un_ipv4_addr);
  854. cell_out->orport_ipv4.port = ls->un_ipv4_port;
  855. break;
  856. case LS_IPV6:
  857. if (found_ipv6)
  858. continue;
  859. found_ipv6 = 1;
  860. tor_addr_from_ipv6_bytes(&cell_out->orport_ipv6.addr,
  861. (const char *)ls->un_ipv6_addr);
  862. cell_out->orport_ipv6.port = ls->un_ipv6_port;
  863. break;
  864. case LS_LEGACY_ID:
  865. if (found_rsa_id)
  866. return -1;
  867. found_rsa_id = 1;
  868. memcpy(cell_out->node_id, ls->un_legacy_id, 20);
  869. break;
  870. case LS_ED25519_ID:
  871. if (found_ed_id)
  872. return -1;
  873. found_ed_id = 1;
  874. memcpy(cell_out->ed_pubkey.pubkey, ls->un_ed25519_id, 32);
  875. break;
  876. default:
  877. /* Ignore this, whatever it is. */
  878. break;
  879. }
  880. }
  881. if (!found_rsa_id || !found_ipv4) /* These are mandatory */
  882. return -1;
  883. return create_cell_from_create2_cell_body(&cell_out->create_cell,
  884. cell->create2);
  885. }
  886. /** Parse an EXTEND or EXTEND2 cell (according to <b>command</b>) from the
  887. * <b>payload_length</b> bytes of <b>payload</b> into <b>cell_out</b>. Return
  888. * 0 on success, -1 on failure. */
  889. int
  890. extend_cell_parse(extend_cell_t *cell_out, const uint8_t command,
  891. const uint8_t *payload, size_t payload_length)
  892. {
  893. tor_assert(cell_out);
  894. tor_assert(payload);
  895. if (payload_length > RELAY_PAYLOAD_SIZE)
  896. return -1;
  897. switch (command) {
  898. case RELAY_COMMAND_EXTEND:
  899. {
  900. extend1_cell_body_t *cell = NULL;
  901. if (extend1_cell_body_parse(&cell, payload, payload_length)<0 ||
  902. cell == NULL) {
  903. if (cell)
  904. extend1_cell_body_free(cell);
  905. return -1;
  906. }
  907. int r = extend_cell_from_extend1_cell_body(cell_out, cell);
  908. extend1_cell_body_free(cell);
  909. if (r < 0)
  910. return r;
  911. }
  912. break;
  913. case RELAY_COMMAND_EXTEND2:
  914. {
  915. extend2_cell_body_t *cell = NULL;
  916. if (extend2_cell_body_parse(&cell, payload, payload_length) < 0 ||
  917. cell == NULL) {
  918. if (cell)
  919. extend2_cell_body_free(cell);
  920. return -1;
  921. }
  922. int r = extend_cell_from_extend2_cell_body(cell_out, cell);
  923. extend2_cell_body_free(cell);
  924. if (r < 0)
  925. return r;
  926. }
  927. break;
  928. default:
  929. return -1;
  930. }
  931. return check_extend_cell(cell_out);
  932. }
  933. /** Helper: return 0 if <b>cell</b> appears valid, -1 otherwise. */
  934. static int
  935. check_extended_cell(const extended_cell_t *cell)
  936. {
  937. tor_assert(cell);
  938. if (cell->created_cell.cell_type == CELL_CREATED) {
  939. if (cell->cell_type != RELAY_COMMAND_EXTENDED)
  940. return -1;
  941. } else if (cell->created_cell.cell_type == CELL_CREATED2) {
  942. if (cell->cell_type != RELAY_COMMAND_EXTENDED2)
  943. return -1;
  944. } else {
  945. return -1;
  946. }
  947. return check_created_cell(&cell->created_cell);
  948. }
  949. /** Parse an EXTENDED or EXTENDED2 cell (according to <b>command</b>) from the
  950. * <b>payload_length</b> bytes of <b>payload</b> into <b>cell_out</b>. Return
  951. * 0 on success, -1 on failure. */
  952. int
  953. extended_cell_parse(extended_cell_t *cell_out,
  954. const uint8_t command, const uint8_t *payload,
  955. size_t payload_len)
  956. {
  957. tor_assert(cell_out);
  958. tor_assert(payload);
  959. memset(cell_out, 0, sizeof(*cell_out));
  960. if (payload_len > RELAY_PAYLOAD_SIZE)
  961. return -1;
  962. switch (command) {
  963. case RELAY_COMMAND_EXTENDED:
  964. if (payload_len != TAP_ONIONSKIN_REPLY_LEN)
  965. return -1;
  966. cell_out->cell_type = RELAY_COMMAND_EXTENDED;
  967. cell_out->created_cell.cell_type = CELL_CREATED;
  968. cell_out->created_cell.handshake_len = TAP_ONIONSKIN_REPLY_LEN;
  969. memcpy(cell_out->created_cell.reply, payload, TAP_ONIONSKIN_REPLY_LEN);
  970. break;
  971. case RELAY_COMMAND_EXTENDED2:
  972. {
  973. cell_out->cell_type = RELAY_COMMAND_EXTENDED2;
  974. cell_out->created_cell.cell_type = CELL_CREATED2;
  975. cell_out->created_cell.handshake_len = ntohs(get_uint16(payload));
  976. if (cell_out->created_cell.handshake_len > RELAY_PAYLOAD_SIZE - 2 ||
  977. cell_out->created_cell.handshake_len > payload_len - 2)
  978. return -1;
  979. memcpy(cell_out->created_cell.reply, payload+2,
  980. cell_out->created_cell.handshake_len);
  981. }
  982. break;
  983. default:
  984. return -1;
  985. }
  986. return check_extended_cell(cell_out);
  987. }
  988. /** Fill <b>cell_out</b> with a correctly formatted version of the
  989. * CREATE{,_FAST,2} cell in <b>cell_in</b>. Return 0 on success, -1 on
  990. * failure. This is a cell we didn't originate if <b>relayed</b> is true. */
  991. static int
  992. create_cell_format_impl(cell_t *cell_out, const create_cell_t *cell_in,
  993. int relayed)
  994. {
  995. uint8_t *p;
  996. size_t space;
  997. if (check_create_cell(cell_in, relayed) < 0)
  998. return -1;
  999. memset(cell_out->payload, 0, sizeof(cell_out->payload));
  1000. cell_out->command = cell_in->cell_type;
  1001. p = cell_out->payload;
  1002. space = sizeof(cell_out->payload);
  1003. switch (cell_in->cell_type) {
  1004. case CELL_CREATE:
  1005. if (cell_in->handshake_type == ONION_HANDSHAKE_TYPE_NTOR) {
  1006. memcpy(p, NTOR_CREATE_MAGIC, 16);
  1007. p += 16;
  1008. space -= 16;
  1009. }
  1010. /* Fall through */
  1011. case CELL_CREATE_FAST:
  1012. tor_assert(cell_in->handshake_len <= space);
  1013. memcpy(p, cell_in->onionskin, cell_in->handshake_len);
  1014. break;
  1015. case CELL_CREATE2:
  1016. tor_assert(cell_in->handshake_len <= sizeof(cell_out->payload)-4);
  1017. set_uint16(cell_out->payload, htons(cell_in->handshake_type));
  1018. set_uint16(cell_out->payload+2, htons(cell_in->handshake_len));
  1019. memcpy(cell_out->payload + 4, cell_in->onionskin, cell_in->handshake_len);
  1020. break;
  1021. default:
  1022. return -1;
  1023. }
  1024. return 0;
  1025. }
  1026. int
  1027. create_cell_format(cell_t *cell_out, const create_cell_t *cell_in)
  1028. {
  1029. return create_cell_format_impl(cell_out, cell_in, 0);
  1030. }
  1031. int
  1032. create_cell_format_relayed(cell_t *cell_out, const create_cell_t *cell_in)
  1033. {
  1034. return create_cell_format_impl(cell_out, cell_in, 1);
  1035. }
  1036. /** Fill <b>cell_out</b> with a correctly formatted version of the
  1037. * CREATED{,_FAST,2} cell in <b>cell_in</b>. Return 0 on success, -1 on
  1038. * failure. */
  1039. int
  1040. created_cell_format(cell_t *cell_out, const created_cell_t *cell_in)
  1041. {
  1042. if (check_created_cell(cell_in) < 0)
  1043. return -1;
  1044. memset(cell_out->payload, 0, sizeof(cell_out->payload));
  1045. cell_out->command = cell_in->cell_type;
  1046. switch (cell_in->cell_type) {
  1047. case CELL_CREATED:
  1048. case CELL_CREATED_FAST:
  1049. tor_assert(cell_in->handshake_len <= sizeof(cell_out->payload));
  1050. memcpy(cell_out->payload, cell_in->reply, cell_in->handshake_len);
  1051. break;
  1052. case CELL_CREATED2:
  1053. tor_assert(cell_in->handshake_len <= sizeof(cell_out->payload)-2);
  1054. set_uint16(cell_out->payload, htons(cell_in->handshake_len));
  1055. memcpy(cell_out->payload + 2, cell_in->reply, cell_in->handshake_len);
  1056. break;
  1057. default:
  1058. return -1;
  1059. }
  1060. return 0;
  1061. }
  1062. /** Return true iff we are configured (by torrc or by the networkstatus
  1063. * parameters) to use Ed25519 identities in our Extend2 cells. */
  1064. static int
  1065. should_include_ed25519_id_extend_cells(const networkstatus_t *ns,
  1066. const or_options_t *options)
  1067. {
  1068. if (options->ExtendByEd25519ID != -1)
  1069. return options->ExtendByEd25519ID; /* The user has an opinion. */
  1070. return (int) networkstatus_get_param(ns, "ExtendByEd25519ID",
  1071. 0 /* default */,
  1072. 0 /* min */,
  1073. 1 /*max*/);
  1074. }
  1075. /** Format the EXTEND{,2} cell in <b>cell_in</b>, storing its relay payload in
  1076. * <b>payload_out</b>, the number of bytes used in *<b>len_out</b>, and the
  1077. * relay command in *<b>command_out</b>. The <b>payload_out</b> must have
  1078. * RELAY_PAYLOAD_SIZE bytes available. Return 0 on success, -1 on failure. */
  1079. int
  1080. extend_cell_format(uint8_t *command_out, uint16_t *len_out,
  1081. uint8_t *payload_out, const extend_cell_t *cell_in)
  1082. {
  1083. uint8_t *p;
  1084. if (check_extend_cell(cell_in) < 0)
  1085. return -1;
  1086. p = payload_out;
  1087. memset(p, 0, RELAY_PAYLOAD_SIZE);
  1088. switch (cell_in->cell_type) {
  1089. case RELAY_COMMAND_EXTEND:
  1090. {
  1091. *command_out = RELAY_COMMAND_EXTEND;
  1092. *len_out = 6 + TAP_ONIONSKIN_CHALLENGE_LEN + DIGEST_LEN;
  1093. set_uint32(p, tor_addr_to_ipv4n(&cell_in->orport_ipv4.addr));
  1094. set_uint16(p+4, ntohs(cell_in->orport_ipv4.port));
  1095. if (cell_in->create_cell.handshake_type == ONION_HANDSHAKE_TYPE_NTOR) {
  1096. memcpy(p+6, NTOR_CREATE_MAGIC, 16);
  1097. memcpy(p+22, cell_in->create_cell.onionskin, NTOR_ONIONSKIN_LEN);
  1098. } else {
  1099. memcpy(p+6, cell_in->create_cell.onionskin,
  1100. TAP_ONIONSKIN_CHALLENGE_LEN);
  1101. }
  1102. memcpy(p+6+TAP_ONIONSKIN_CHALLENGE_LEN, cell_in->node_id, DIGEST_LEN);
  1103. }
  1104. break;
  1105. case RELAY_COMMAND_EXTEND2:
  1106. {
  1107. uint8_t n_specifiers = 2;
  1108. *command_out = RELAY_COMMAND_EXTEND2;
  1109. extend2_cell_body_t *cell = extend2_cell_body_new();
  1110. link_specifier_t *ls;
  1111. {
  1112. /* IPv4 specifier first. */
  1113. ls = link_specifier_new();
  1114. extend2_cell_body_add_ls(cell, ls);
  1115. ls->ls_type = LS_IPV4;
  1116. ls->ls_len = 6;
  1117. ls->un_ipv4_addr = tor_addr_to_ipv4h(&cell_in->orport_ipv4.addr);
  1118. ls->un_ipv4_port = cell_in->orport_ipv4.port;
  1119. }
  1120. {
  1121. /* Then RSA id */
  1122. ls = link_specifier_new();
  1123. extend2_cell_body_add_ls(cell, ls);
  1124. ls->ls_type = LS_LEGACY_ID;
  1125. ls->ls_len = DIGEST_LEN;
  1126. memcpy(ls->un_legacy_id, cell_in->node_id, DIGEST_LEN);
  1127. }
  1128. if (should_include_ed25519_id_extend_cells(NULL, get_options()) &&
  1129. !ed25519_public_key_is_zero(&cell_in->ed_pubkey)) {
  1130. /* Then, maybe, the ed25519 id! */
  1131. ++n_specifiers;
  1132. ls = link_specifier_new();
  1133. extend2_cell_body_add_ls(cell, ls);
  1134. ls->ls_type = LS_ED25519_ID;
  1135. ls->ls_len = 32;
  1136. memcpy(ls->un_ed25519_id, cell_in->ed_pubkey.pubkey, 32);
  1137. }
  1138. cell->n_spec = n_specifiers;
  1139. /* Now, the handshake */
  1140. cell->create2 = create2_cell_body_new();
  1141. cell->create2->handshake_type = cell_in->create_cell.handshake_type;
  1142. cell->create2->handshake_len = cell_in->create_cell.handshake_len;
  1143. create2_cell_body_setlen_handshake_data(cell->create2,
  1144. cell_in->create_cell.handshake_len);
  1145. memcpy(create2_cell_body_getarray_handshake_data(cell->create2),
  1146. cell_in->create_cell.onionskin,
  1147. cell_in->create_cell.handshake_len);
  1148. ssize_t len_encoded = extend2_cell_body_encode(
  1149. payload_out, RELAY_PAYLOAD_SIZE,
  1150. cell);
  1151. extend2_cell_body_free(cell);
  1152. if (len_encoded < 0 || len_encoded > UINT16_MAX)
  1153. return -1;
  1154. *len_out = (uint16_t) len_encoded;
  1155. }
  1156. break;
  1157. default:
  1158. return -1;
  1159. }
  1160. return 0;
  1161. }
  1162. /** Format the EXTENDED{,2} cell in <b>cell_in</b>, storing its relay payload
  1163. * in <b>payload_out</b>, the number of bytes used in *<b>len_out</b>, and the
  1164. * relay command in *<b>command_out</b>. The <b>payload_out</b> must have
  1165. * RELAY_PAYLOAD_SIZE bytes available. Return 0 on success, -1 on failure. */
  1166. int
  1167. extended_cell_format(uint8_t *command_out, uint16_t *len_out,
  1168. uint8_t *payload_out, const extended_cell_t *cell_in)
  1169. {
  1170. uint8_t *p;
  1171. if (check_extended_cell(cell_in) < 0)
  1172. return -1;
  1173. p = payload_out;
  1174. memset(p, 0, RELAY_PAYLOAD_SIZE);
  1175. switch (cell_in->cell_type) {
  1176. case RELAY_COMMAND_EXTENDED:
  1177. {
  1178. *command_out = RELAY_COMMAND_EXTENDED;
  1179. *len_out = TAP_ONIONSKIN_REPLY_LEN;
  1180. memcpy(payload_out, cell_in->created_cell.reply,
  1181. TAP_ONIONSKIN_REPLY_LEN);
  1182. }
  1183. break;
  1184. case RELAY_COMMAND_EXTENDED2:
  1185. {
  1186. *command_out = RELAY_COMMAND_EXTENDED2;
  1187. *len_out = 2 + cell_in->created_cell.handshake_len;
  1188. set_uint16(payload_out, htons(cell_in->created_cell.handshake_len));
  1189. if (2+cell_in->created_cell.handshake_len > RELAY_PAYLOAD_SIZE)
  1190. return -1;
  1191. memcpy(payload_out+2, cell_in->created_cell.reply,
  1192. cell_in->created_cell.handshake_len);
  1193. }
  1194. break;
  1195. default:
  1196. return -1;
  1197. }
  1198. return 0;
  1199. }