hs_circuit.c 45 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251
  1. /* Copyright (c) 2017, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /**
  4. * \file hs_circuit.c
  5. **/
  6. #define HS_CIRCUIT_PRIVATE
  7. #include "or.h"
  8. #include "circpathbias.h"
  9. #include "circuitbuild.h"
  10. #include "circuitlist.h"
  11. #include "circuituse.h"
  12. #include "config.h"
  13. #include "nodelist.h"
  14. #include "policies.h"
  15. #include "relay.h"
  16. #include "rendservice.h"
  17. #include "rephist.h"
  18. #include "router.h"
  19. #include "hs_cell.h"
  20. #include "hs_ident.h"
  21. #include "hs_ntor.h"
  22. #include "hs_service.h"
  23. #include "hs_circuit.h"
  24. /* Trunnel. */
  25. #include "ed25519_cert.h"
  26. #include "hs/cell_common.h"
  27. #include "hs/cell_establish_intro.h"
  28. /* A circuit is about to become an e2e rendezvous circuit. Check
  29. * <b>circ_purpose</b> and ensure that it's properly set. Return true iff
  30. * circuit purpose is properly set, otherwise return false. */
  31. static int
  32. circuit_purpose_is_correct_for_rend(unsigned int circ_purpose,
  33. int is_service_side)
  34. {
  35. if (is_service_side) {
  36. if (circ_purpose != CIRCUIT_PURPOSE_S_CONNECT_REND) {
  37. log_warn(LD_BUG,
  38. "HS e2e circuit setup with wrong purpose (%d)", circ_purpose);
  39. return 0;
  40. }
  41. }
  42. if (!is_service_side) {
  43. if (circ_purpose != CIRCUIT_PURPOSE_C_REND_READY &&
  44. circ_purpose != CIRCUIT_PURPOSE_C_REND_READY_INTRO_ACKED) {
  45. log_warn(LD_BUG,
  46. "Client e2e circuit setup with wrong purpose (%d)", circ_purpose);
  47. return 0;
  48. }
  49. }
  50. return 1;
  51. }
  52. /* Create and return a crypt path for the final hop of a v3 prop224 rendezvous
  53. * circuit. Initialize the crypt path crypto using the output material from the
  54. * ntor key exchange at <b>ntor_key_seed</b>.
  55. *
  56. * If <b>is_service_side</b> is set, we are the hidden service and the final
  57. * hop of the rendezvous circuit is the client on the other side. */
  58. static crypt_path_t *
  59. create_rend_cpath(const uint8_t *ntor_key_seed, size_t seed_len,
  60. int is_service_side)
  61. {
  62. uint8_t keys[HS_NTOR_KEY_EXPANSION_KDF_OUT_LEN];
  63. crypt_path_t *cpath = NULL;
  64. /* Do the key expansion */
  65. if (hs_ntor_circuit_key_expansion(ntor_key_seed, seed_len,
  66. keys, sizeof(keys)) < 0) {
  67. goto err;
  68. }
  69. /* Setup the cpath */
  70. cpath = tor_malloc_zero(sizeof(crypt_path_t));
  71. cpath->magic = CRYPT_PATH_MAGIC;
  72. if (circuit_init_cpath_crypto(cpath, (char*)keys, sizeof(keys),
  73. is_service_side, 1) < 0) {
  74. tor_free(cpath);
  75. goto err;
  76. }
  77. err:
  78. memwipe(keys, 0, sizeof(keys));
  79. return cpath;
  80. }
  81. /* We are a v2 legacy HS client: Create and return a crypt path for the hidden
  82. * service on the other side of the rendezvous circuit <b>circ</b>. Initialize
  83. * the crypt path crypto using the body of the RENDEZVOUS1 cell at
  84. * <b>rend_cell_body</b> (which must be at least DH_KEY_LEN+DIGEST_LEN bytes).
  85. */
  86. static crypt_path_t *
  87. create_rend_cpath_legacy(origin_circuit_t *circ, const uint8_t *rend_cell_body)
  88. {
  89. crypt_path_t *hop = NULL;
  90. char keys[DIGEST_LEN+CPATH_KEY_MATERIAL_LEN];
  91. /* first DH_KEY_LEN bytes are g^y from the service. Finish the dh
  92. * handshake...*/
  93. tor_assert(circ->build_state);
  94. tor_assert(circ->build_state->pending_final_cpath);
  95. hop = circ->build_state->pending_final_cpath;
  96. tor_assert(hop->rend_dh_handshake_state);
  97. if (crypto_dh_compute_secret(LOG_PROTOCOL_WARN, hop->rend_dh_handshake_state,
  98. (char*)rend_cell_body, DH_KEY_LEN,
  99. keys, DIGEST_LEN+CPATH_KEY_MATERIAL_LEN)<0) {
  100. log_warn(LD_GENERAL, "Couldn't complete DH handshake.");
  101. goto err;
  102. }
  103. /* ... and set up cpath. */
  104. if (circuit_init_cpath_crypto(hop,
  105. keys+DIGEST_LEN, sizeof(keys)-DIGEST_LEN,
  106. 0, 0) < 0)
  107. goto err;
  108. /* Check whether the digest is right... */
  109. if (tor_memneq(keys, rend_cell_body+DH_KEY_LEN, DIGEST_LEN)) {
  110. log_warn(LD_PROTOCOL, "Incorrect digest of key material.");
  111. goto err;
  112. }
  113. /* clean up the crypto stuff we just made */
  114. crypto_dh_free(hop->rend_dh_handshake_state);
  115. hop->rend_dh_handshake_state = NULL;
  116. goto done;
  117. err:
  118. hop = NULL;
  119. done:
  120. memwipe(keys, 0, sizeof(keys));
  121. return hop;
  122. }
  123. /* Append the final <b>hop</b> to the cpath of the rend <b>circ</b>, and mark
  124. * <b>circ</b> ready for use to transfer HS relay cells. */
  125. static void
  126. finalize_rend_circuit(origin_circuit_t *circ, crypt_path_t *hop,
  127. int is_service_side)
  128. {
  129. tor_assert(circ);
  130. tor_assert(hop);
  131. /* Notify the circuit state machine that we are splicing this circuit */
  132. int new_circ_purpose = is_service_side ?
  133. CIRCUIT_PURPOSE_S_REND_JOINED : CIRCUIT_PURPOSE_C_REND_JOINED;
  134. circuit_change_purpose(TO_CIRCUIT(circ), new_circ_purpose);
  135. /* All is well. Extend the circuit. */
  136. hop->state = CPATH_STATE_OPEN;
  137. /* Set the windows to default. */
  138. hop->package_window = circuit_initial_package_window();
  139. hop->deliver_window = CIRCWINDOW_START;
  140. /* Now that this circuit has finished connecting to its destination,
  141. * make sure circuit_get_open_circ_or_launch is willing to return it
  142. * so we can actually use it. */
  143. circ->hs_circ_has_timed_out = 0;
  144. /* Append the hop to the cpath of this circuit */
  145. onion_append_to_cpath(&circ->cpath, hop);
  146. /* In legacy code, 'pending_final_cpath' points to the final hop we just
  147. * appended to the cpath. We set the original pointer to NULL so that we
  148. * don't double free it. */
  149. if (circ->build_state) {
  150. circ->build_state->pending_final_cpath = NULL;
  151. }
  152. /* Finally, mark circuit as ready to be used for client streams */
  153. if (!is_service_side) {
  154. circuit_try_attaching_streams(circ);
  155. }
  156. }
  157. /* For a given circuit and a service introduction point object, register the
  158. * intro circuit to the circuitmap. This supports legacy intro point. */
  159. static void
  160. register_intro_circ(const hs_service_intro_point_t *ip,
  161. origin_circuit_t *circ)
  162. {
  163. tor_assert(ip);
  164. tor_assert(circ);
  165. if (ip->base.is_only_legacy) {
  166. uint8_t digest[DIGEST_LEN];
  167. if (BUG(crypto_pk_get_digest(ip->legacy_key, (char *) digest) < 0)) {
  168. return;
  169. }
  170. hs_circuitmap_register_intro_circ_v2_service_side(circ, digest);
  171. } else {
  172. hs_circuitmap_register_intro_circ_v3_service_side(circ,
  173. &ip->auth_key_kp.pubkey);
  174. }
  175. }
  176. /* Return the number of opened introduction circuit for the given circuit that
  177. * is matching its identity key. */
  178. static unsigned int
  179. count_opened_desc_intro_point_circuits(const hs_service_t *service,
  180. const hs_service_descriptor_t *desc)
  181. {
  182. unsigned int count = 0;
  183. tor_assert(service);
  184. tor_assert(desc);
  185. DIGEST256MAP_FOREACH(desc->intro_points.map, key,
  186. const hs_service_intro_point_t *, ip) {
  187. const circuit_t *circ;
  188. const origin_circuit_t *ocirc = hs_circ_service_get_intro_circ(ip);
  189. if (ocirc == NULL) {
  190. continue;
  191. }
  192. circ = TO_CIRCUIT(ocirc);
  193. tor_assert(circ->purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO ||
  194. circ->purpose == CIRCUIT_PURPOSE_S_INTRO);
  195. /* Having a circuit not for the requested service is really bad. */
  196. tor_assert(ed25519_pubkey_eq(&service->keys.identity_pk,
  197. &ocirc->hs_ident->identity_pk));
  198. /* Only count opened circuit and skip circuit that will be closed. */
  199. if (!circ->marked_for_close && circ->state == CIRCUIT_STATE_OPEN) {
  200. count++;
  201. }
  202. } DIGEST256MAP_FOREACH_END;
  203. return count;
  204. }
  205. /* From a given service, rendezvous cookie and handshake info, create a
  206. * rendezvous point circuit identifier. This can't fail. */
  207. STATIC hs_ident_circuit_t *
  208. create_rp_circuit_identifier(const hs_service_t *service,
  209. const uint8_t *rendezvous_cookie,
  210. const curve25519_public_key_t *server_pk,
  211. const hs_ntor_rend_cell_keys_t *keys)
  212. {
  213. hs_ident_circuit_t *ident;
  214. uint8_t handshake_info[CURVE25519_PUBKEY_LEN + DIGEST256_LEN];
  215. tor_assert(service);
  216. tor_assert(rendezvous_cookie);
  217. tor_assert(server_pk);
  218. tor_assert(keys);
  219. ident = hs_ident_circuit_new(&service->keys.identity_pk,
  220. HS_IDENT_CIRCUIT_RENDEZVOUS);
  221. /* Copy the RENDEZVOUS_COOKIE which is the unique identifier. */
  222. memcpy(ident->rendezvous_cookie, rendezvous_cookie,
  223. sizeof(ident->rendezvous_cookie));
  224. /* Build the HANDSHAKE_INFO which looks like this:
  225. * SERVER_PK [32 bytes]
  226. * AUTH_INPUT_MAC [32 bytes]
  227. */
  228. memcpy(handshake_info, server_pk->public_key, CURVE25519_PUBKEY_LEN);
  229. memcpy(handshake_info + CURVE25519_PUBKEY_LEN, keys->rend_cell_auth_mac,
  230. DIGEST256_LEN);
  231. tor_assert(sizeof(ident->rendezvous_handshake_info) ==
  232. sizeof(handshake_info));
  233. memcpy(ident->rendezvous_handshake_info, handshake_info,
  234. sizeof(ident->rendezvous_handshake_info));
  235. /* Finally copy the NTOR_KEY_SEED for e2e encryption on the circuit. */
  236. tor_assert(sizeof(ident->rendezvous_ntor_key_seed) ==
  237. sizeof(keys->ntor_key_seed));
  238. memcpy(ident->rendezvous_ntor_key_seed, keys->ntor_key_seed,
  239. sizeof(ident->rendezvous_ntor_key_seed));
  240. return ident;
  241. }
  242. /* From a given service and service intro point, create an introduction point
  243. * circuit identifier. This can't fail. */
  244. static hs_ident_circuit_t *
  245. create_intro_circuit_identifier(const hs_service_t *service,
  246. const hs_service_intro_point_t *ip)
  247. {
  248. hs_ident_circuit_t *ident;
  249. tor_assert(service);
  250. tor_assert(ip);
  251. ident = hs_ident_circuit_new(&service->keys.identity_pk,
  252. HS_IDENT_CIRCUIT_INTRO);
  253. ed25519_pubkey_copy(&ident->intro_auth_pk, &ip->auth_key_kp.pubkey);
  254. return ident;
  255. }
  256. /* For a given introduction point and an introduction circuit, send the
  257. * ESTABLISH_INTRO cell. The service object is used for logging. This can fail
  258. * and if so, the circuit is closed and the intro point object is flagged
  259. * that the circuit is not established anymore which is important for the
  260. * retry mechanism. */
  261. static void
  262. send_establish_intro(const hs_service_t *service,
  263. hs_service_intro_point_t *ip, origin_circuit_t *circ)
  264. {
  265. ssize_t cell_len;
  266. uint8_t payload[RELAY_PAYLOAD_SIZE];
  267. tor_assert(service);
  268. tor_assert(ip);
  269. tor_assert(circ);
  270. /* Encode establish intro cell. */
  271. cell_len = hs_cell_build_establish_intro(circ->cpath->prev->rend_circ_nonce,
  272. ip, payload);
  273. if (cell_len < 0) {
  274. log_warn(LD_REND, "Unable to encode ESTABLISH_INTRO cell for service %s "
  275. "on circuit %u. Closing circuit.",
  276. safe_str_client(service->onion_address),
  277. TO_CIRCUIT(circ)->n_circ_id);
  278. goto err;
  279. }
  280. /* Send the cell on the circuit. */
  281. if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(circ),
  282. RELAY_COMMAND_ESTABLISH_INTRO,
  283. (char *) payload, cell_len,
  284. circ->cpath->prev) < 0) {
  285. log_info(LD_REND, "Unable to send ESTABLISH_INTRO cell for service %s "
  286. "on circuit %u.",
  287. safe_str_client(service->onion_address),
  288. TO_CIRCUIT(circ)->n_circ_id);
  289. /* On error, the circuit has been closed. */
  290. goto done;
  291. }
  292. /* Record the attempt to use this circuit. */
  293. pathbias_count_use_attempt(circ);
  294. goto done;
  295. err:
  296. circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
  297. done:
  298. memwipe(payload, 0, sizeof(payload));
  299. }
  300. /* Return a string constant describing the anonymity of service. */
  301. static const char *
  302. get_service_anonymity_string(const hs_service_t *service)
  303. {
  304. if (service->config.is_single_onion) {
  305. return "single onion";
  306. } else {
  307. return "hidden";
  308. }
  309. }
  310. /* For a given service, the ntor onion key and a rendezvous cookie, launch a
  311. * circuit to the rendezvous point specified by the link specifiers. On
  312. * success, a circuit identifier is attached to the circuit with the needed
  313. * data. This function will try to open a circuit for a maximum value of
  314. * MAX_REND_FAILURES then it will give up. */
  315. static void
  316. launch_rendezvous_point_circuit(const hs_service_t *service,
  317. const hs_service_intro_point_t *ip,
  318. const hs_cell_introduce2_data_t *data)
  319. {
  320. int circ_needs_uptime;
  321. time_t now = time(NULL);
  322. extend_info_t *info = NULL;
  323. origin_circuit_t *circ;
  324. tor_assert(service);
  325. tor_assert(ip);
  326. tor_assert(data);
  327. circ_needs_uptime = hs_service_requires_uptime_circ(service->config.ports);
  328. /* Get the extend info data structure for the chosen rendezvous point
  329. * specified by the given link specifiers. */
  330. info = hs_get_extend_info_from_lspecs(data->link_specifiers,
  331. &data->onion_pk,
  332. service->config.is_single_onion);
  333. if (info == NULL) {
  334. /* We are done here, we can't extend to the rendezvous point.
  335. * If you're running an IPv6-only v3 single onion service on 0.3.2 or with
  336. * 0.3.2 clients, and somehow disable the option check, it will fail here.
  337. */
  338. log_fn(LOG_PROTOCOL_WARN, LD_REND,
  339. "Not enough info to open a circuit to a rendezvous point for "
  340. "%s service %s.",
  341. get_service_anonymity_string(service),
  342. safe_str_client(service->onion_address));
  343. goto end;
  344. }
  345. for (int i = 0; i < MAX_REND_FAILURES; i++) {
  346. int circ_flags = CIRCLAUNCH_NEED_CAPACITY | CIRCLAUNCH_IS_INTERNAL;
  347. if (circ_needs_uptime) {
  348. circ_flags |= CIRCLAUNCH_NEED_UPTIME;
  349. }
  350. /* Firewall and policies are checked when getting the extend info. */
  351. if (service->config.is_single_onion) {
  352. circ_flags |= CIRCLAUNCH_ONEHOP_TUNNEL;
  353. }
  354. circ = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_CONNECT_REND, info,
  355. circ_flags);
  356. if (circ != NULL) {
  357. /* Stop retrying, we have a circuit! */
  358. break;
  359. }
  360. }
  361. if (circ == NULL) {
  362. log_warn(LD_REND, "Giving up on launching a rendezvous circuit to %s "
  363. "for %s service %s",
  364. safe_str_client(extend_info_describe(info)),
  365. get_service_anonymity_string(service),
  366. safe_str_client(service->onion_address));
  367. goto end;
  368. }
  369. log_info(LD_REND, "Rendezvous circuit launched to %s with cookie %s "
  370. "for %s service %s",
  371. safe_str_client(extend_info_describe(info)),
  372. safe_str_client(hex_str((const char *) data->rendezvous_cookie,
  373. REND_COOKIE_LEN)),
  374. get_service_anonymity_string(service),
  375. safe_str_client(service->onion_address));
  376. tor_assert(circ->build_state);
  377. /* Rendezvous circuit have a specific timeout for the time spent on trying
  378. * to connect to the rendezvous point. */
  379. circ->build_state->expiry_time = now + MAX_REND_TIMEOUT;
  380. /* Create circuit identifier and key material. */
  381. {
  382. hs_ntor_rend_cell_keys_t keys;
  383. curve25519_keypair_t ephemeral_kp;
  384. /* No need for extra strong, this is only for this circuit life time. This
  385. * key will be used for the RENDEZVOUS1 cell that will be sent on the
  386. * circuit once opened. */
  387. curve25519_keypair_generate(&ephemeral_kp, 0);
  388. if (hs_ntor_service_get_rendezvous1_keys(&ip->auth_key_kp.pubkey,
  389. &ip->enc_key_kp,
  390. &ephemeral_kp, &data->client_pk,
  391. &keys) < 0) {
  392. /* This should not really happened but just in case, don't make tor
  393. * freak out, close the circuit and move on. */
  394. log_info(LD_REND, "Unable to get RENDEZVOUS1 key material for "
  395. "service %s",
  396. safe_str_client(service->onion_address));
  397. circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
  398. goto end;
  399. }
  400. circ->hs_ident = create_rp_circuit_identifier(service,
  401. data->rendezvous_cookie,
  402. &ephemeral_kp.pubkey, &keys);
  403. memwipe(&ephemeral_kp, 0, sizeof(ephemeral_kp));
  404. memwipe(&keys, 0, sizeof(keys));
  405. tor_assert(circ->hs_ident);
  406. }
  407. end:
  408. extend_info_free(info);
  409. }
  410. /* Return true iff the given service rendezvous circuit circ is allowed for a
  411. * relaunch to the rendezvous point. */
  412. static int
  413. can_relaunch_service_rendezvous_point(const origin_circuit_t *circ)
  414. {
  415. tor_assert(circ);
  416. /* This is initialized when allocating an origin circuit. */
  417. tor_assert(circ->build_state);
  418. tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_CONNECT_REND);
  419. /* XXX: Retrying under certain condition. This is related to #22455. */
  420. /* Avoid to relaunch twice a circuit to the same rendezvous point at the
  421. * same time. */
  422. if (circ->hs_service_side_rend_circ_has_been_relaunched) {
  423. log_info(LD_REND, "Rendezvous circuit to %s has already been retried. "
  424. "Skipping retry.",
  425. safe_str_client(
  426. extend_info_describe(circ->build_state->chosen_exit)));
  427. goto disallow;
  428. }
  429. /* We check failure_count >= hs_get_service_max_rend_failures()-1 below, and
  430. * the -1 is because we increment the failure count for our current failure
  431. * *after* this clause. */
  432. int max_rend_failures = hs_get_service_max_rend_failures() - 1;
  433. /* A failure count that has reached maximum allowed or circuit that expired,
  434. * we skip relaunching. */
  435. if (circ->build_state->failure_count > max_rend_failures ||
  436. circ->build_state->expiry_time <= time(NULL)) {
  437. log_info(LD_REND, "Attempt to build a rendezvous circuit to %s has "
  438. "failed with %d attempts and expiry time %ld. "
  439. "Giving up building.",
  440. safe_str_client(
  441. extend_info_describe(circ->build_state->chosen_exit)),
  442. circ->build_state->failure_count,
  443. (long int) circ->build_state->expiry_time);
  444. goto disallow;
  445. }
  446. /* Allowed to relaunch. */
  447. return 1;
  448. disallow:
  449. return 0;
  450. }
  451. /* Retry the rendezvous point of circ by launching a new circuit to it. */
  452. static void
  453. retry_service_rendezvous_point(const origin_circuit_t *circ)
  454. {
  455. int flags = 0;
  456. origin_circuit_t *new_circ;
  457. cpath_build_state_t *bstate;
  458. tor_assert(circ);
  459. /* This is initialized when allocating an origin circuit. */
  460. tor_assert(circ->build_state);
  461. tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_CONNECT_REND);
  462. /* Ease our life. */
  463. bstate = circ->build_state;
  464. log_info(LD_REND, "Retrying rendezvous point circuit to %s",
  465. safe_str_client(extend_info_describe(bstate->chosen_exit)));
  466. /* Get the current build state flags for the next circuit. */
  467. flags |= (bstate->need_uptime) ? CIRCLAUNCH_NEED_UPTIME : 0;
  468. flags |= (bstate->need_capacity) ? CIRCLAUNCH_NEED_CAPACITY : 0;
  469. flags |= (bstate->is_internal) ? CIRCLAUNCH_IS_INTERNAL : 0;
  470. /* We do NOT add the onehop tunnel flag even though it might be a single
  471. * onion service. The reason is that if we failed once to connect to the RP
  472. * with a direct connection, we consider that chances are that we will fail
  473. * again so try a 3-hop circuit and hope for the best. Because the service
  474. * has no anonymity (single onion), this change of behavior won't affect
  475. * security directly. */
  476. new_circ = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_CONNECT_REND,
  477. bstate->chosen_exit, flags);
  478. if (new_circ == NULL) {
  479. log_warn(LD_REND, "Failed to launch rendezvous circuit to %s",
  480. safe_str_client(extend_info_describe(bstate->chosen_exit)));
  481. goto done;
  482. }
  483. /* Transfer build state information to the new circuit state in part to
  484. * catch any other failures. */
  485. new_circ->build_state->failure_count = bstate->failure_count+1;
  486. new_circ->build_state->expiry_time = bstate->expiry_time;
  487. new_circ->hs_ident = hs_ident_circuit_dup(circ->hs_ident);
  488. done:
  489. return;
  490. }
  491. /* Add all possible link specifiers in node to lspecs.
  492. * legacy ID is mandatory thus MUST be present in node. If the primary address
  493. * is not IPv4, log a BUG() warning, and return an empty smartlist.
  494. * Includes ed25519 id and IPv6 link specifiers if present in the node. */
  495. static void
  496. get_lspecs_from_node(const node_t *node, smartlist_t *lspecs)
  497. {
  498. link_specifier_t *ls;
  499. tor_addr_port_t ap;
  500. tor_assert(node);
  501. tor_assert(lspecs);
  502. /* Get the relay's IPv4 address. */
  503. node_get_prim_orport(node, &ap);
  504. /* We expect the node's primary address to be a valid IPv4 address.
  505. * This conforms to the protocol, which requires either an IPv4 or IPv6
  506. * address (or both). */
  507. if (BUG(!tor_addr_is_v4(&ap.addr)) ||
  508. BUG(!tor_addr_port_is_valid_ap(&ap, 0))) {
  509. return;
  510. }
  511. ls = link_specifier_new();
  512. link_specifier_set_ls_type(ls, LS_IPV4);
  513. link_specifier_set_un_ipv4_addr(ls, tor_addr_to_ipv4h(&ap.addr));
  514. link_specifier_set_un_ipv4_port(ls, ap.port);
  515. /* Four bytes IPv4 and two bytes port. */
  516. link_specifier_set_ls_len(ls, sizeof(ap.addr.addr.in_addr) +
  517. sizeof(ap.port));
  518. smartlist_add(lspecs, ls);
  519. /* Legacy ID is mandatory and will always be present in node. */
  520. ls = link_specifier_new();
  521. link_specifier_set_ls_type(ls, LS_LEGACY_ID);
  522. memcpy(link_specifier_getarray_un_legacy_id(ls), node->identity,
  523. link_specifier_getlen_un_legacy_id(ls));
  524. link_specifier_set_ls_len(ls, link_specifier_getlen_un_legacy_id(ls));
  525. smartlist_add(lspecs, ls);
  526. /* ed25519 ID is only included if the node has it. */
  527. if (!ed25519_public_key_is_zero(&node->ed25519_id)) {
  528. ls = link_specifier_new();
  529. link_specifier_set_ls_type(ls, LS_ED25519_ID);
  530. memcpy(link_specifier_getarray_un_ed25519_id(ls), &node->ed25519_id,
  531. link_specifier_getlen_un_ed25519_id(ls));
  532. link_specifier_set_ls_len(ls, link_specifier_getlen_un_ed25519_id(ls));
  533. smartlist_add(lspecs, ls);
  534. }
  535. /* Check for IPv6. If so, include it as well. */
  536. if (node_has_ipv6_orport(node)) {
  537. ls = link_specifier_new();
  538. node_get_pref_ipv6_orport(node, &ap);
  539. link_specifier_set_ls_type(ls, LS_IPV6);
  540. size_t addr_len = link_specifier_getlen_un_ipv6_addr(ls);
  541. const uint8_t *in6_addr = tor_addr_to_in6_addr8(&ap.addr);
  542. uint8_t *ipv6_array = link_specifier_getarray_un_ipv6_addr(ls);
  543. memcpy(ipv6_array, in6_addr, addr_len);
  544. link_specifier_set_un_ipv6_port(ls, ap.port);
  545. /* Sixteen bytes IPv6 and two bytes port. */
  546. link_specifier_set_ls_len(ls, addr_len + sizeof(ap.port));
  547. smartlist_add(lspecs, ls);
  548. }
  549. }
  550. /* Using the given descriptor intro point ip, the node of the
  551. * rendezvous point rp_node and the service's subcredential, populate the
  552. * already allocated intro1_data object with the needed key material and link
  553. * specifiers.
  554. *
  555. * If rp_node has an invalid primary address, intro1_data->link_specifiers
  556. * will be an empty list. Otherwise, this function can't fail. The ip
  557. * MUST be a valid object containing the needed keys and authentication
  558. * method. */
  559. static void
  560. setup_introduce1_data(const hs_desc_intro_point_t *ip,
  561. const node_t *rp_node,
  562. const uint8_t *subcredential,
  563. hs_cell_introduce1_data_t *intro1_data)
  564. {
  565. smartlist_t *rp_lspecs;
  566. tor_assert(ip);
  567. tor_assert(rp_node);
  568. tor_assert(subcredential);
  569. tor_assert(intro1_data);
  570. /* Build the link specifiers from the extend information of the rendezvous
  571. * circuit that we've picked previously. */
  572. rp_lspecs = smartlist_new();
  573. get_lspecs_from_node(rp_node, rp_lspecs);
  574. /* Populate the introduce1 data object. */
  575. memset(intro1_data, 0, sizeof(hs_cell_introduce1_data_t));
  576. if (ip->legacy.key != NULL) {
  577. intro1_data->is_legacy = 1;
  578. intro1_data->legacy_key = ip->legacy.key;
  579. }
  580. intro1_data->auth_pk = &ip->auth_key_cert->signed_key;
  581. intro1_data->enc_pk = &ip->enc_key;
  582. intro1_data->subcredential = subcredential;
  583. intro1_data->onion_pk = node_get_curve25519_onion_key(rp_node);
  584. intro1_data->link_specifiers = rp_lspecs;
  585. }
  586. /* ========== */
  587. /* Public API */
  588. /* ========== */
  589. /* Return an introduction point circuit matching the given intro point object.
  590. * NULL is returned is no such circuit can be found. */
  591. origin_circuit_t *
  592. hs_circ_service_get_intro_circ(const hs_service_intro_point_t *ip)
  593. {
  594. origin_circuit_t *circ = NULL;
  595. tor_assert(ip);
  596. if (ip->base.is_only_legacy) {
  597. uint8_t digest[DIGEST_LEN];
  598. if (BUG(crypto_pk_get_digest(ip->legacy_key, (char *) digest) < 0)) {
  599. goto end;
  600. }
  601. circ = hs_circuitmap_get_intro_circ_v2_service_side(digest);
  602. } else {
  603. circ = hs_circuitmap_get_intro_circ_v3_service_side(
  604. &ip->auth_key_kp.pubkey);
  605. }
  606. end:
  607. return circ;
  608. }
  609. /* Called when we fail building a rendezvous circuit at some point other than
  610. * the last hop: launches a new circuit to the same rendezvous point. This
  611. * supports legacy service.
  612. *
  613. * We currently relaunch connections to rendezvous points if:
  614. * - A rendezvous circuit timed out before connecting to RP.
  615. * - The redenzvous circuit failed to connect to the RP.
  616. *
  617. * We avoid relaunching a connection to this rendezvous point if:
  618. * - We have already tried MAX_REND_FAILURES times to connect to this RP.
  619. * - We've been trying to connect to this RP for more than MAX_REND_TIMEOUT
  620. * seconds
  621. * - We've already retried this specific rendezvous circuit.
  622. */
  623. void
  624. hs_circ_retry_service_rendezvous_point(origin_circuit_t *circ)
  625. {
  626. tor_assert(circ);
  627. tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_CONNECT_REND);
  628. /* Check if we are allowed to relaunch to the rendezvous point of circ. */
  629. if (!can_relaunch_service_rendezvous_point(circ)) {
  630. goto done;
  631. }
  632. /* Flag the circuit that we are relaunching so to avoid to relaunch twice a
  633. * circuit to the same rendezvous point at the same time. */
  634. circ->hs_service_side_rend_circ_has_been_relaunched = 1;
  635. /* Legacy service don't have an hidden service ident. */
  636. if (circ->hs_ident) {
  637. retry_service_rendezvous_point(circ);
  638. } else {
  639. rend_service_relaunch_rendezvous(circ);
  640. }
  641. done:
  642. return;
  643. }
  644. /* For a given service and a service intro point, launch a circuit to the
  645. * extend info ei. If the service is a single onion, a one-hop circuit will be
  646. * requested. Return 0 if the circuit was successfully launched and tagged
  647. * with the correct identifier. On error, a negative value is returned. */
  648. int
  649. hs_circ_launch_intro_point(hs_service_t *service,
  650. const hs_service_intro_point_t *ip,
  651. extend_info_t *ei)
  652. {
  653. /* Standard flags for introduction circuit. */
  654. int ret = -1, circ_flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
  655. origin_circuit_t *circ;
  656. tor_assert(service);
  657. tor_assert(ip);
  658. tor_assert(ei);
  659. /* Update circuit flags in case of a single onion service that requires a
  660. * direct connection. */
  661. if (service->config.is_single_onion) {
  662. circ_flags |= CIRCLAUNCH_ONEHOP_TUNNEL;
  663. }
  664. log_info(LD_REND, "Launching a circuit to intro point %s for service %s.",
  665. safe_str_client(extend_info_describe(ei)),
  666. safe_str_client(service->onion_address));
  667. /* Note down the launch for the retry period. Even if the circuit fails to
  668. * be launched, we still want to respect the retry period to avoid stress on
  669. * the circuit subsystem. */
  670. service->state.num_intro_circ_launched++;
  671. circ = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO,
  672. ei, circ_flags);
  673. if (circ == NULL) {
  674. goto end;
  675. }
  676. /* Setup the circuit identifier and attach it to it. */
  677. circ->hs_ident = create_intro_circuit_identifier(service, ip);
  678. tor_assert(circ->hs_ident);
  679. /* Register circuit in the global circuitmap. */
  680. register_intro_circ(ip, circ);
  681. /* Success. */
  682. ret = 0;
  683. end:
  684. return ret;
  685. }
  686. /* Called when a service introduction point circuit is done building. Given
  687. * the service and intro point object, this function will send the
  688. * ESTABLISH_INTRO cell on the circuit. Return 0 on success. Return 1 if the
  689. * circuit has been repurposed to General because we already have too many
  690. * opened. */
  691. int
  692. hs_circ_service_intro_has_opened(hs_service_t *service,
  693. hs_service_intro_point_t *ip,
  694. const hs_service_descriptor_t *desc,
  695. origin_circuit_t *circ)
  696. {
  697. int ret = 0;
  698. unsigned int num_intro_circ, num_needed_circ;
  699. tor_assert(service);
  700. tor_assert(ip);
  701. tor_assert(desc);
  702. tor_assert(circ);
  703. /* Cound opened circuits that have sent ESTABLISH_INTRO cells or are already
  704. * established introduction circuits */
  705. num_intro_circ = count_opened_desc_intro_point_circuits(service, desc);
  706. num_needed_circ = service->config.num_intro_points;
  707. if (num_intro_circ > num_needed_circ) {
  708. /* There are too many opened valid intro circuit for what the service
  709. * needs so repurpose this one. */
  710. /* XXX: Legacy code checks options->ExcludeNodes and if not NULL it just
  711. * closes the circuit. I have NO idea why it does that so it hasn't been
  712. * added here. I can only assume in case our ExcludeNodes list changes but
  713. * in that case, all circuit are flagged unusable (config.c). --dgoulet */
  714. log_info(LD_CIRC | LD_REND, "Introduction circuit just opened but we "
  715. "have enough for service %s. Repurposing "
  716. "it to general and leaving internal.",
  717. safe_str_client(service->onion_address));
  718. tor_assert(circ->build_state->is_internal);
  719. /* Remove it from the circuitmap. */
  720. hs_circuitmap_remove_circuit(TO_CIRCUIT(circ));
  721. /* Cleaning up the hidden service identifier and repurpose. */
  722. hs_ident_circuit_free(circ->hs_ident);
  723. circ->hs_ident = NULL;
  724. if (circuit_should_use_vanguards(TO_CIRCUIT(circ)->purpose))
  725. circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_HS_VANGUARDS);
  726. else
  727. circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_C_GENERAL);
  728. /* Inform that this circuit just opened for this new purpose. */
  729. circuit_has_opened(circ);
  730. /* This return value indicate to the caller that the IP object should be
  731. * removed from the service because it's corresponding circuit has just
  732. * been repurposed. */
  733. ret = 1;
  734. goto done;
  735. }
  736. log_info(LD_REND, "Introduction circuit %u established for service %s.",
  737. TO_CIRCUIT(circ)->n_circ_id,
  738. safe_str_client(service->onion_address));
  739. circuit_log_path(LOG_INFO, LD_REND, circ);
  740. /* Time to send an ESTABLISH_INTRO cell on this circuit. On error, this call
  741. * makes sure the circuit gets closed. */
  742. send_establish_intro(service, ip, circ);
  743. done:
  744. return ret;
  745. }
  746. /* Called when a service rendezvous point circuit is done building. Given the
  747. * service and the circuit, this function will send a RENDEZVOUS1 cell on the
  748. * circuit using the information in the circuit identifier. If the cell can't
  749. * be sent, the circuit is closed. */
  750. void
  751. hs_circ_service_rp_has_opened(const hs_service_t *service,
  752. origin_circuit_t *circ)
  753. {
  754. size_t payload_len;
  755. uint8_t payload[RELAY_PAYLOAD_SIZE] = {0};
  756. tor_assert(service);
  757. tor_assert(circ);
  758. tor_assert(circ->hs_ident);
  759. /* Some useful logging. */
  760. log_info(LD_REND, "Rendezvous circuit %u has opened with cookie %s "
  761. "for service %s",
  762. TO_CIRCUIT(circ)->n_circ_id,
  763. hex_str((const char *) circ->hs_ident->rendezvous_cookie,
  764. REND_COOKIE_LEN),
  765. safe_str_client(service->onion_address));
  766. circuit_log_path(LOG_INFO, LD_REND, circ);
  767. /* This can't fail. */
  768. payload_len = hs_cell_build_rendezvous1(
  769. circ->hs_ident->rendezvous_cookie,
  770. sizeof(circ->hs_ident->rendezvous_cookie),
  771. circ->hs_ident->rendezvous_handshake_info,
  772. sizeof(circ->hs_ident->rendezvous_handshake_info),
  773. payload);
  774. /* Pad the payload with random bytes so it matches the size of a legacy cell
  775. * which is normally always bigger. Also, the size of a legacy cell is
  776. * always smaller than the RELAY_PAYLOAD_SIZE so this is safe. */
  777. if (payload_len < HS_LEGACY_RENDEZVOUS_CELL_SIZE) {
  778. crypto_rand((char *) payload + payload_len,
  779. HS_LEGACY_RENDEZVOUS_CELL_SIZE - payload_len);
  780. payload_len = HS_LEGACY_RENDEZVOUS_CELL_SIZE;
  781. }
  782. if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(circ),
  783. RELAY_COMMAND_RENDEZVOUS1,
  784. (const char *) payload, payload_len,
  785. circ->cpath->prev) < 0) {
  786. /* On error, circuit is closed. */
  787. log_warn(LD_REND, "Unable to send RENDEZVOUS1 cell on circuit %u "
  788. "for service %s",
  789. TO_CIRCUIT(circ)->n_circ_id,
  790. safe_str_client(service->onion_address));
  791. goto done;
  792. }
  793. /* Setup end-to-end rendezvous circuit between the client and us. */
  794. if (hs_circuit_setup_e2e_rend_circ(circ,
  795. circ->hs_ident->rendezvous_ntor_key_seed,
  796. sizeof(circ->hs_ident->rendezvous_ntor_key_seed),
  797. 1) < 0) {
  798. log_warn(LD_GENERAL, "Failed to setup circ");
  799. goto done;
  800. }
  801. done:
  802. memwipe(payload, 0, sizeof(payload));
  803. }
  804. /* Circ has been expecting an INTRO_ESTABLISHED cell that just arrived. Handle
  805. * the INTRO_ESTABLISHED cell payload of length payload_len arriving on the
  806. * given introduction circuit circ. The service is only used for logging
  807. * purposes. Return 0 on success else a negative value. */
  808. int
  809. hs_circ_handle_intro_established(const hs_service_t *service,
  810. const hs_service_intro_point_t *ip,
  811. origin_circuit_t *circ,
  812. const uint8_t *payload, size_t payload_len)
  813. {
  814. int ret = -1;
  815. tor_assert(service);
  816. tor_assert(ip);
  817. tor_assert(circ);
  818. tor_assert(payload);
  819. if (BUG(TO_CIRCUIT(circ)->purpose != CIRCUIT_PURPOSE_S_ESTABLISH_INTRO)) {
  820. goto done;
  821. }
  822. /* Try to parse the payload into a cell making sure we do actually have a
  823. * valid cell. For a legacy node, it's an empty payload so as long as we
  824. * have the cell, we are good. */
  825. if (!ip->base.is_only_legacy &&
  826. hs_cell_parse_intro_established(payload, payload_len) < 0) {
  827. log_warn(LD_REND, "Unable to parse the INTRO_ESTABLISHED cell on "
  828. "circuit %u for service %s",
  829. TO_CIRCUIT(circ)->n_circ_id,
  830. safe_str_client(service->onion_address));
  831. goto done;
  832. }
  833. /* Switch the purpose to a fully working intro point. */
  834. circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_S_INTRO);
  835. /* Getting a valid INTRODUCE_ESTABLISHED means we've successfully used the
  836. * circuit so update our pathbias subsystem. */
  837. pathbias_mark_use_success(circ);
  838. /* Success. */
  839. ret = 0;
  840. done:
  841. return ret;
  842. }
  843. /* We just received an INTRODUCE2 cell on the established introduction circuit
  844. * circ. Handle the INTRODUCE2 payload of size payload_len for the given
  845. * circuit and service. This cell is associated with the intro point object ip
  846. * and the subcredential. Return 0 on success else a negative value. */
  847. int
  848. hs_circ_handle_introduce2(const hs_service_t *service,
  849. const origin_circuit_t *circ,
  850. hs_service_intro_point_t *ip,
  851. const uint8_t *subcredential,
  852. const uint8_t *payload, size_t payload_len)
  853. {
  854. int ret = -1;
  855. time_t elapsed;
  856. hs_cell_introduce2_data_t data;
  857. tor_assert(service);
  858. tor_assert(circ);
  859. tor_assert(ip);
  860. tor_assert(subcredential);
  861. tor_assert(payload);
  862. /* Populate the data structure with everything we need for the cell to be
  863. * parsed, decrypted and key material computed correctly. */
  864. data.auth_pk = &ip->auth_key_kp.pubkey;
  865. data.enc_kp = &ip->enc_key_kp;
  866. data.subcredential = subcredential;
  867. data.payload = payload;
  868. data.payload_len = payload_len;
  869. data.link_specifiers = smartlist_new();
  870. data.replay_cache = ip->replay_cache;
  871. if (hs_cell_parse_introduce2(&data, circ, service) < 0) {
  872. goto done;
  873. }
  874. /* Check whether we've seen this REND_COOKIE before to detect repeats. */
  875. if (replaycache_add_test_and_elapsed(
  876. service->state.replay_cache_rend_cookie,
  877. data.rendezvous_cookie, sizeof(data.rendezvous_cookie),
  878. &elapsed)) {
  879. /* A Tor client will send a new INTRODUCE1 cell with the same REND_COOKIE
  880. * as its previous one if its intro circ times out while in state
  881. * CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT. If we received the first
  882. * INTRODUCE1 cell (the intro-point relay converts it into an INTRODUCE2
  883. * cell), we are already trying to connect to that rend point (and may
  884. * have already succeeded); drop this cell. */
  885. log_info(LD_REND, "We received an INTRODUCE2 cell with same REND_COOKIE "
  886. "field %ld seconds ago. Dropping cell.",
  887. (long int) elapsed);
  888. goto done;
  889. }
  890. /* At this point, we just confirmed that the full INTRODUCE2 cell is valid
  891. * so increment our counter that we've seen one on this intro point. */
  892. ip->introduce2_count++;
  893. /* Launch rendezvous circuit with the onion key and rend cookie. */
  894. launch_rendezvous_point_circuit(service, ip, &data);
  895. /* Success. */
  896. ret = 0;
  897. done:
  898. SMARTLIST_FOREACH(data.link_specifiers, link_specifier_t *, lspec,
  899. link_specifier_free(lspec));
  900. smartlist_free(data.link_specifiers);
  901. memwipe(&data, 0, sizeof(data));
  902. return ret;
  903. }
  904. /* Circuit <b>circ</b> just finished the rend ntor key exchange. Use the key
  905. * exchange output material at <b>ntor_key_seed</b> and setup <b>circ</b> to
  906. * serve as a rendezvous end-to-end circuit between the client and the
  907. * service. If <b>is_service_side</b> is set, then we are the hidden service
  908. * and the other side is the client.
  909. *
  910. * Return 0 if the operation went well; in case of error return -1. */
  911. int
  912. hs_circuit_setup_e2e_rend_circ(origin_circuit_t *circ,
  913. const uint8_t *ntor_key_seed, size_t seed_len,
  914. int is_service_side)
  915. {
  916. if (BUG(!circuit_purpose_is_correct_for_rend(TO_CIRCUIT(circ)->purpose,
  917. is_service_side))) {
  918. return -1;
  919. }
  920. crypt_path_t *hop = create_rend_cpath(ntor_key_seed, seed_len,
  921. is_service_side);
  922. if (!hop) {
  923. log_warn(LD_REND, "Couldn't get v3 %s cpath!",
  924. is_service_side ? "service-side" : "client-side");
  925. return -1;
  926. }
  927. finalize_rend_circuit(circ, hop, is_service_side);
  928. return 0;
  929. }
  930. /* We are a v2 legacy HS client and we just received a RENDEZVOUS1 cell
  931. * <b>rend_cell_body</b> on <b>circ</b>. Finish up the DH key exchange and then
  932. * extend the crypt path of <b>circ</b> so that the hidden service is on the
  933. * other side. */
  934. int
  935. hs_circuit_setup_e2e_rend_circ_legacy_client(origin_circuit_t *circ,
  936. const uint8_t *rend_cell_body)
  937. {
  938. if (BUG(!circuit_purpose_is_correct_for_rend(
  939. TO_CIRCUIT(circ)->purpose, 0))) {
  940. return -1;
  941. }
  942. crypt_path_t *hop = create_rend_cpath_legacy(circ, rend_cell_body);
  943. if (!hop) {
  944. log_warn(LD_GENERAL, "Couldn't get v2 cpath.");
  945. return -1;
  946. }
  947. finalize_rend_circuit(circ, hop, 0);
  948. return 0;
  949. }
  950. /* Given the introduction circuit intro_circ, the rendezvous circuit
  951. * rend_circ, a descriptor intro point object ip and the service's
  952. * subcredential, send an INTRODUCE1 cell on intro_circ.
  953. *
  954. * This will also setup the circuit identifier on rend_circ containing the key
  955. * material for the handshake and e2e encryption. Return 0 on success else
  956. * negative value. Because relay_send_command_from_edge() closes the circuit
  957. * on error, it is possible that intro_circ is closed on error. */
  958. int
  959. hs_circ_send_introduce1(origin_circuit_t *intro_circ,
  960. origin_circuit_t *rend_circ,
  961. const hs_desc_intro_point_t *ip,
  962. const uint8_t *subcredential)
  963. {
  964. int ret = -1;
  965. ssize_t payload_len;
  966. uint8_t payload[RELAY_PAYLOAD_SIZE] = {0};
  967. hs_cell_introduce1_data_t intro1_data;
  968. tor_assert(intro_circ);
  969. tor_assert(rend_circ);
  970. tor_assert(ip);
  971. tor_assert(subcredential);
  972. /* It is undefined behavior in hs_cell_introduce1_data_clear() if intro1_data
  973. * has been declared on the stack but not initialized. Here, we set it to 0.
  974. */
  975. memset(&intro1_data, 0, sizeof(hs_cell_introduce1_data_t));
  976. /* This takes various objects in order to populate the introduce1 data
  977. * object which is used to build the content of the cell. */
  978. const node_t *exit_node = build_state_get_exit_node(rend_circ->build_state);
  979. if (exit_node == NULL) {
  980. log_info(LD_REND, "Unable to get rendezvous point for circuit %u. "
  981. "Failing.", TO_CIRCUIT(intro_circ)->n_circ_id);
  982. goto done;
  983. }
  984. setup_introduce1_data(ip, exit_node, subcredential, &intro1_data);
  985. /* If we didn't get any link specifiers, it's because our node was
  986. * bad. */
  987. if (BUG(!intro1_data.link_specifiers) ||
  988. !smartlist_len(intro1_data.link_specifiers)) {
  989. log_warn(LD_REND, "Unable to get link specifiers for INTRODUCE1 cell on "
  990. "circuit %u.", TO_CIRCUIT(intro_circ)->n_circ_id);
  991. goto done;
  992. }
  993. /* Final step before we encode a cell, we setup the circuit identifier which
  994. * will generate both the rendezvous cookie and client keypair for this
  995. * connection. Those are put in the ident. */
  996. intro1_data.rendezvous_cookie = rend_circ->hs_ident->rendezvous_cookie;
  997. intro1_data.client_kp = &rend_circ->hs_ident->rendezvous_client_kp;
  998. memcpy(intro_circ->hs_ident->rendezvous_cookie,
  999. rend_circ->hs_ident->rendezvous_cookie,
  1000. sizeof(intro_circ->hs_ident->rendezvous_cookie));
  1001. /* From the introduce1 data object, this will encode the INTRODUCE1 cell
  1002. * into payload which is then ready to be sent as is. */
  1003. payload_len = hs_cell_build_introduce1(&intro1_data, payload);
  1004. if (BUG(payload_len < 0)) {
  1005. goto done;
  1006. }
  1007. if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(intro_circ),
  1008. RELAY_COMMAND_INTRODUCE1,
  1009. (const char *) payload, payload_len,
  1010. intro_circ->cpath->prev) < 0) {
  1011. /* On error, circuit is closed. */
  1012. log_warn(LD_REND, "Unable to send INTRODUCE1 cell on circuit %u.",
  1013. TO_CIRCUIT(intro_circ)->n_circ_id);
  1014. goto done;
  1015. }
  1016. /* Success. */
  1017. ret = 0;
  1018. goto done;
  1019. done:
  1020. hs_cell_introduce1_data_clear(&intro1_data);
  1021. memwipe(payload, 0, sizeof(payload));
  1022. return ret;
  1023. }
  1024. /* Send an ESTABLISH_RENDEZVOUS cell along the rendezvous circuit circ. On
  1025. * success, 0 is returned else -1 and the circuit is marked for close. */
  1026. int
  1027. hs_circ_send_establish_rendezvous(origin_circuit_t *circ)
  1028. {
  1029. ssize_t cell_len = 0;
  1030. uint8_t cell[RELAY_PAYLOAD_SIZE] = {0};
  1031. tor_assert(circ);
  1032. tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_C_ESTABLISH_REND);
  1033. log_info(LD_REND, "Send an ESTABLISH_RENDEZVOUS cell on circuit %u",
  1034. TO_CIRCUIT(circ)->n_circ_id);
  1035. /* Set timestamp_dirty, because circuit_expire_building expects it,
  1036. * and the rend cookie also means we've used the circ. */
  1037. TO_CIRCUIT(circ)->timestamp_dirty = time(NULL);
  1038. /* We've attempted to use this circuit. Probe it if we fail */
  1039. pathbias_count_use_attempt(circ);
  1040. /* Generate the RENDEZVOUS_COOKIE and place it in the identifier so we can
  1041. * complete the handshake when receiving the acknowledgement. */
  1042. crypto_rand((char *) circ->hs_ident->rendezvous_cookie, HS_REND_COOKIE_LEN);
  1043. /* Generate the client keypair. No need to be extra strong, not long term */
  1044. curve25519_keypair_generate(&circ->hs_ident->rendezvous_client_kp, 0);
  1045. cell_len =
  1046. hs_cell_build_establish_rendezvous(circ->hs_ident->rendezvous_cookie,
  1047. cell);
  1048. if (BUG(cell_len < 0)) {
  1049. goto err;
  1050. }
  1051. if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(circ),
  1052. RELAY_COMMAND_ESTABLISH_RENDEZVOUS,
  1053. (const char *) cell, cell_len,
  1054. circ->cpath->prev) < 0) {
  1055. /* Circuit has been marked for close */
  1056. log_warn(LD_REND, "Unable to send ESTABLISH_RENDEZVOUS cell on "
  1057. "circuit %u", TO_CIRCUIT(circ)->n_circ_id);
  1058. memwipe(cell, 0, cell_len);
  1059. goto err;
  1060. }
  1061. memwipe(cell, 0, cell_len);
  1062. return 0;
  1063. err:
  1064. return -1;
  1065. }
  1066. /* We are about to close or free this <b>circ</b>. Clean it up from any
  1067. * related HS data structures. This function can be called multiple times
  1068. * safely for the same circuit. */
  1069. void
  1070. hs_circ_cleanup(circuit_t *circ)
  1071. {
  1072. tor_assert(circ);
  1073. /* If it's a service-side intro circ, notify the HS subsystem for the intro
  1074. * point circuit closing so it can be dealt with cleanly. */
  1075. if (circ->purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO ||
  1076. circ->purpose == CIRCUIT_PURPOSE_S_INTRO) {
  1077. hs_service_intro_circ_has_closed(TO_ORIGIN_CIRCUIT(circ));
  1078. }
  1079. /* Clear HS circuitmap token for this circ (if any). Very important to be
  1080. * done after the HS subsystem has been notified of the close else the
  1081. * circuit will not be found.
  1082. *
  1083. * We do this at the close if possible because from that point on, the
  1084. * circuit is good as dead. We can't rely on removing it in the circuit
  1085. * free() function because we open a race window between the close and free
  1086. * where we can't register a new circuit for the same intro point. */
  1087. if (circ->hs_token) {
  1088. hs_circuitmap_remove_circuit(circ);
  1089. }
  1090. }