hs_config.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590
  1. /* Copyright (c) 2017, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /**
  4. * \file hs_config.c
  5. * \brief Implement hidden service configuration subsystem.
  6. *
  7. * \details
  8. *
  9. * This file has basically one main entry point: hs_config_service_all(). It
  10. * takes the torrc options and configure hidden service from it. In validate
  11. * mode, nothing is added to the global service list or keys are not generated
  12. * nor loaded.
  13. *
  14. * A service is configured in two steps. It is first created using the tor
  15. * options and then put in a staging list. It will stay there until
  16. * hs_service_load_all_keys() is called. That function is responsible to
  17. * load/generate the keys for the service in the staging list and if
  18. * successful, transfert the service to the main global service list where
  19. * at that point it is ready to be used.
  20. *
  21. * Configuration functions are per-version and there is a main generic one for
  22. * every option that is common to all version (config_generic_service).
  23. **/
  24. #define HS_CONFIG_PRIVATE
  25. #include "hs_common.h"
  26. #include "hs_config.h"
  27. #include "hs_service.h"
  28. #include "rendservice.h"
  29. /* Using the given list of services, stage them into our global state. Every
  30. * service version are handled. This function can remove entries in the given
  31. * service_list.
  32. *
  33. * Staging a service means that we take all services in service_list and we
  34. * put them in the staging list (global) which acts as a temporary list that
  35. * is used by the service loading key process. In other words, staging a
  36. * service puts it in a list to be considered when loading the keys and then
  37. * moved to the main global list. */
  38. static void
  39. stage_services(smartlist_t *service_list)
  40. {
  41. tor_assert(service_list);
  42. /* This is v2 specific. Trigger service pruning which will make sure the
  43. * just configured services end up in the main global list. It should only
  44. * be done in non validation mode because v2 subsystem handles service
  45. * object differently. */
  46. rend_service_prune_list();
  47. /* Cleanup v2 service from the list, we don't need those object anymore
  48. * because we validated them all against the others and we want to stage
  49. * only >= v3 service. And remember, v2 has a different object type which is
  50. * shadow copied from an hs_service_t type. */
  51. SMARTLIST_FOREACH_BEGIN(service_list, hs_service_t *, s) {
  52. if (s->config.version == HS_VERSION_TWO) {
  53. SMARTLIST_DEL_CURRENT(service_list, s);
  54. hs_service_free(s);
  55. }
  56. } SMARTLIST_FOREACH_END(s);
  57. /* This is >= v3 specific. Using the newly configured service list, stage
  58. * them into our global state. Every object ownership is lost after. */
  59. hs_service_stage_services(service_list);
  60. }
  61. /* Validate the given service against all service in the given list. If the
  62. * service is ephemeral, this function ignores it. Services with the same
  63. * directory path aren't allowed and will return an error. If a duplicate is
  64. * found, 1 is returned else 0 if none found. */
  65. static int
  66. service_is_duplicate_in_list(const smartlist_t *service_list,
  67. const hs_service_t *service)
  68. {
  69. int ret = 0;
  70. tor_assert(service_list);
  71. tor_assert(service);
  72. /* Ephemeral service don't have a directory configured so no need to check
  73. * for a service in the list having the same path. */
  74. if (service->config.is_ephemeral) {
  75. goto end;
  76. }
  77. /* XXX: Validate if we have any service that has the given service dir path.
  78. * This has two problems:
  79. *
  80. * a) It's O(n^2), but the same comment from the bottom of
  81. * rend_config_services() should apply.
  82. *
  83. * b) We only compare directory paths as strings, so we can't
  84. * detect two distinct paths that specify the same directory
  85. * (which can arise from symlinks, case-insensitivity, bind
  86. * mounts, etc.).
  87. *
  88. * It also can't detect that two separate Tor instances are trying
  89. * to use the same HiddenServiceDir; for that, we would need a
  90. * lock file. But this is enough to detect a simple mistake that
  91. * at least one person has actually made. */
  92. SMARTLIST_FOREACH_BEGIN(service_list, const hs_service_t *, s) {
  93. if (!strcmp(s->config.directory_path, service->config.directory_path)) {
  94. log_warn(LD_REND, "Another hidden service is already configured "
  95. "for directory %s",
  96. escaped(service->config.directory_path));
  97. ret = 1;
  98. goto end;
  99. }
  100. } SMARTLIST_FOREACH_END(s);
  101. end:
  102. return ret;
  103. }
  104. /* Helper function: Given an configuration option name, its value, a minimum
  105. * min and a maxium max, parse the value as a uint64_t. On success, ok is set
  106. * to 1 and ret is the parsed value. On error, ok is set to 0 and ret must be
  107. * ignored. This function logs both on error and success. */
  108. static uint64_t
  109. helper_parse_uint64(const char *opt, const char *value, uint64_t min,
  110. uint64_t max, int *ok)
  111. {
  112. uint64_t ret = 0;
  113. tor_assert(opt);
  114. tor_assert(value);
  115. tor_assert(ok);
  116. *ok = 0;
  117. ret = tor_parse_uint64(value, 10, min, max, ok, NULL);
  118. if (!*ok) {
  119. log_warn(LD_CONFIG, "%s must be between %" PRIu64 " and %"PRIu64
  120. ", not %s.",
  121. opt, min, max, value);
  122. goto err;
  123. }
  124. log_info(LD_CONFIG, "%s was parsed to %" PRIu64, opt, ret);
  125. err:
  126. return ret;
  127. }
  128. /* Return true iff the given options starting at line_ for a hidden service
  129. * contains at least one invalid option. Each hidden service option don't
  130. * apply to all versions so this function can find out. The line_ MUST start
  131. * right after the HiddenServiceDir line of this service.
  132. *
  133. * This is mainly for usability so we can inform the user of any invalid
  134. * option for the hidden service version instead of silently ignoring. */
  135. static int
  136. config_has_invalid_options(const config_line_t *line_,
  137. const hs_service_t *service)
  138. {
  139. int ret = 0;
  140. const char **optlist;
  141. const config_line_t *line;
  142. tor_assert(service);
  143. tor_assert(service->config.version <= HS_VERSION_MAX);
  144. /* List of options that a v3 service doesn't support thus must exclude from
  145. * its configuration. */
  146. const char *opts_exclude_v3[] = {
  147. "HiddenServiceAuthorizeClient",
  148. NULL /* End marker. */
  149. };
  150. /* Defining the size explicitly allows us to take advantage of the compiler
  151. * which warns us if we ever bump the max version but forget to grow this
  152. * array. The plus one is because we have a version 0 :). */
  153. struct {
  154. const char **list;
  155. } exclude_lists[HS_VERSION_MAX + 1] = {
  156. { NULL }, /* v0. */
  157. { NULL }, /* v1. */
  158. { NULL }, /* v2 */
  159. { opts_exclude_v3 }, /* v3. */
  160. };
  161. optlist = exclude_lists[service->config.version].list;
  162. if (optlist == NULL) {
  163. /* No exclude options to look at for this version. */
  164. goto end;
  165. }
  166. for (int i = 0; optlist[i]; i++) {
  167. const char *opt = optlist[i];
  168. for (line = line_; line; line = line->next) {
  169. if (!strcasecmp(line->key, "HiddenServiceDir")) {
  170. /* We just hit the next hidden service, stop right now. */
  171. goto end;
  172. }
  173. if (!strcasecmp(line->key, opt)) {
  174. log_warn(LD_CONFIG, "Hidden service option %s is incompatible with "
  175. "version %" PRIu32 " of service in %s",
  176. opt, service->config.version,
  177. service->config.directory_path);
  178. ret = 1;
  179. /* Continue the loop so we can find all possible options. */
  180. continue;
  181. }
  182. }
  183. }
  184. end:
  185. return ret;
  186. }
  187. /* Validate service configuration. This is used when loading the configuration
  188. * and once we've setup a service object, it's config object is passed to this
  189. * function for further validation. This does not validate service key
  190. * material. Return 0 if valid else -1 if invalid. */
  191. static int
  192. config_validate_service(const hs_service_config_t *config)
  193. {
  194. tor_assert(config);
  195. /* Amount of ports validation. */
  196. if (!config->ports || smartlist_len(config->ports) == 0) {
  197. log_warn(LD_CONFIG, "Hidden service (%s) with no ports configured.",
  198. escaped(config->directory_path));
  199. goto invalid;
  200. }
  201. /* Valid. */
  202. return 0;
  203. invalid:
  204. return -1;
  205. }
  206. /* Configuration funcion for a version 3 service. The line_ must be pointing
  207. * to the directive directly after a HiddenServiceDir. That way, when hitting
  208. * the next HiddenServiceDir line or reaching the end of the list of lines, we
  209. * know that we have to stop looking for more options. The given service
  210. * object must be already allocated and passed through
  211. * config_generic_service() prior to calling this function.
  212. *
  213. * Return 0 on success else a negative value. */
  214. static int
  215. config_service_v3(const config_line_t *line_,
  216. hs_service_config_t *config)
  217. {
  218. int have_num_ip = 0;
  219. const char *dup_opt_seen = NULL;
  220. const config_line_t *line;
  221. tor_assert(config);
  222. for (line = line_; line; line = line->next) {
  223. int ok = 0;
  224. if (!strcasecmp(line->key, "HiddenServiceDir")) {
  225. /* We just hit the next hidden service, stop right now. */
  226. break;
  227. }
  228. /* Number of introduction points. */
  229. if (!strcasecmp(line->key, "HiddenServiceNumIntroductionPoints")) {
  230. config->num_intro_points =
  231. (unsigned int) helper_parse_uint64(line->key, line->value,
  232. NUM_INTRO_POINTS_DEFAULT,
  233. HS_CONFIG_V3_MAX_INTRO_POINTS,
  234. &ok);
  235. if (!ok || have_num_ip) {
  236. if (have_num_ip)
  237. dup_opt_seen = line->key;
  238. goto err;
  239. }
  240. have_num_ip = 1;
  241. continue;
  242. }
  243. }
  244. /* We do not load the key material for the service at this stage. This is
  245. * done later once tor can confirm that it is in a running state. */
  246. /* We are about to return a fully configured service so do one last pass of
  247. * validation at it. */
  248. if (config_validate_service(config) < 0) {
  249. goto err;
  250. }
  251. return 0;
  252. err:
  253. if (dup_opt_seen) {
  254. log_warn(LD_CONFIG, "Duplicate directive %s.", dup_opt_seen);
  255. }
  256. return -1;
  257. }
  258. /* Configure a service using the given options in line_ and options. This is
  259. * called for any service regardless of its version which means that all
  260. * directives in this function are generic to any service version. This
  261. * function will also check the validity of the service directory path.
  262. *
  263. * The line_ must be pointing to the directive directly after a
  264. * HiddenServiceDir. That way, when hitting the next HiddenServiceDir line or
  265. * reaching the end of the list of lines, we know that we have to stop looking
  266. * for more options.
  267. *
  268. * Return 0 on success else -1. */
  269. static int
  270. config_generic_service(const config_line_t *line_,
  271. const or_options_t *options,
  272. hs_service_t *service)
  273. {
  274. int dir_seen = 0;
  275. const config_line_t *line;
  276. hs_service_config_t *config;
  277. /* If this is set, we've seen a duplicate of this option. Keep the string
  278. * so we can log the directive. */
  279. const char *dup_opt_seen = NULL;
  280. /* These variables will tell us if we ever have duplicate. */
  281. int have_version = 0, have_allow_unknown_ports = 0;
  282. int have_dir_group_read = 0, have_max_streams = 0;
  283. int have_max_streams_close = 0;
  284. tor_assert(line_);
  285. tor_assert(options);
  286. tor_assert(service);
  287. /* Makes thing easier. */
  288. config = &service->config;
  289. /* The first line starts with HiddenServiceDir so we consider what's next is
  290. * the configuration of the service. */
  291. for (line = line_; line ; line = line->next) {
  292. int ok = 0;
  293. /* This indicate that we have a new service to configure. */
  294. if (!strcasecmp(line->key, "HiddenServiceDir")) {
  295. /* This function only configures one service at a time so if we've
  296. * already seen one, stop right now. */
  297. if (dir_seen) {
  298. break;
  299. }
  300. /* Ok, we've seen one and we are about to configure it. */
  301. dir_seen = 1;
  302. config->directory_path = tor_strdup(line->value);
  303. log_info(LD_CONFIG, "HiddenServiceDir=%s. Configuring...",
  304. escaped(config->directory_path));
  305. continue;
  306. }
  307. if (BUG(!dir_seen)) {
  308. goto err;
  309. }
  310. /* Version of the service. */
  311. if (!strcasecmp(line->key, "HiddenServiceVersion")) {
  312. service->config.version =
  313. (uint32_t) helper_parse_uint64(line->key, line->value, HS_VERSION_MIN,
  314. HS_VERSION_MAX, &ok);
  315. if (!ok || have_version) {
  316. if (have_version)
  317. dup_opt_seen = line->key;
  318. goto err;
  319. }
  320. have_version = 1;
  321. continue;
  322. }
  323. /* Virtual port. */
  324. if (!strcasecmp(line->key, "HiddenServicePort")) {
  325. char *err_msg = NULL;
  326. /* XXX: Can we rename this? */
  327. rend_service_port_config_t *portcfg =
  328. rend_service_parse_port_config(line->value, " ", &err_msg);
  329. if (!portcfg) {
  330. if (err_msg) {
  331. log_warn(LD_CONFIG, "%s", err_msg);
  332. }
  333. tor_free(err_msg);
  334. goto err;
  335. }
  336. tor_assert(!err_msg);
  337. smartlist_add(config->ports, portcfg);
  338. log_info(LD_CONFIG, "HiddenServicePort=%s for %s",
  339. line->value, escaped(config->directory_path));
  340. continue;
  341. }
  342. /* Do we allow unknown ports. */
  343. if (!strcasecmp(line->key, "HiddenServiceAllowUnknownPorts")) {
  344. config->allow_unknown_ports =
  345. (unsigned int) helper_parse_uint64(line->key, line->value, 0, 1, &ok);
  346. if (!ok || have_allow_unknown_ports) {
  347. if (have_allow_unknown_ports)
  348. dup_opt_seen = line->key;
  349. goto err;
  350. }
  351. have_allow_unknown_ports = 1;
  352. continue;
  353. }
  354. /* Directory group readable. */
  355. if (!strcasecmp(line->key, "HiddenServiceDirGroupReadable")) {
  356. config->dir_group_readable =
  357. (unsigned int) helper_parse_uint64(line->key, line->value, 0, 1, &ok);
  358. if (!ok || have_dir_group_read) {
  359. if (have_dir_group_read)
  360. dup_opt_seen = line->key;
  361. goto err;
  362. }
  363. have_dir_group_read = 1;
  364. continue;
  365. }
  366. /* Maximum streams per circuit. */
  367. if (!strcasecmp(line->key, "HiddenServiceMaxStreams")) {
  368. config->max_streams_per_rdv_circuit =
  369. helper_parse_uint64(line->key, line->value, 0,
  370. HS_CONFIG_MAX_STREAMS_PER_RDV_CIRCUIT, &ok);
  371. if (!ok || have_max_streams) {
  372. if (have_max_streams)
  373. dup_opt_seen = line->key;
  374. goto err;
  375. }
  376. have_max_streams = 1;
  377. continue;
  378. }
  379. /* Maximum amount of streams before we close the circuit. */
  380. if (!strcasecmp(line->key, "HiddenServiceMaxStreamsCloseCircuit")) {
  381. config->max_streams_close_circuit =
  382. (unsigned int) helper_parse_uint64(line->key, line->value, 0, 1, &ok);
  383. if (!ok || have_max_streams_close) {
  384. if (have_max_streams_close)
  385. dup_opt_seen = line->key;
  386. goto err;
  387. }
  388. have_max_streams_close = 1;
  389. continue;
  390. }
  391. }
  392. /* Check if we are configured in non anonymous mode meaning every service
  393. * becomes a single onion service. */
  394. if (rend_service_non_anonymous_mode_enabled(options)) {
  395. config->is_single_onion = 1;
  396. /* We will add support for IPv6-only v3 single onion services in a future
  397. * Tor version. This won't catch "ReachableAddresses reject *4", but that
  398. * option doesn't work anyway. */
  399. if (options->ClientUseIPv4 == 0 && config->version == HS_VERSION_THREE) {
  400. log_warn(LD_CONFIG, "IPv6-only v3 single onion services are not "
  401. "supported. Set HiddenServiceSingleHopMode 0 and "
  402. "HiddenServiceNonAnonymousMode 0, or set ClientUseIPv4 1.");
  403. goto err;
  404. }
  405. }
  406. /* Success */
  407. return 0;
  408. err:
  409. if (dup_opt_seen) {
  410. log_warn(LD_CONFIG, "Duplicate directive %s.", dup_opt_seen);
  411. }
  412. return -1;
  413. }
  414. /* Configure a service using the given line and options. This function will
  415. * call the corresponding configuration function for a specific service
  416. * version and validate the service against the other ones. On success, add
  417. * the service to the given list and return 0. On error, nothing is added to
  418. * the list and a negative value is returned. */
  419. static int
  420. config_service(const config_line_t *line, const or_options_t *options,
  421. smartlist_t *service_list)
  422. {
  423. int ret;
  424. hs_service_t *service = NULL;
  425. tor_assert(line);
  426. tor_assert(options);
  427. tor_assert(service_list);
  428. /* We have a new hidden service. */
  429. service = hs_service_new(options);
  430. /* We'll configure that service as a generic one and then pass it to a
  431. * specific function according to the configured version number. */
  432. if (config_generic_service(line, options, service) < 0) {
  433. goto err;
  434. }
  435. tor_assert(service->config.version <= HS_VERSION_MAX);
  436. /* Before we configure the service on a per-version basis, we'll make
  437. * sure that this set of options for a service are valid that is for
  438. * instance an option only for v2 is not used for v3. */
  439. if (config_has_invalid_options(line->next, service)) {
  440. goto err;
  441. }
  442. /* Check permission on service directory that was just parsed. And this must
  443. * be done regardless of the service version. Do not ask for the directory
  444. * to be created, this is done when the keys are loaded because we could be
  445. * in validation mode right now. */
  446. if (hs_check_service_private_dir(options->User,
  447. service->config.directory_path,
  448. service->config.dir_group_readable,
  449. 0) < 0) {
  450. goto err;
  451. }
  452. /* Different functions are in charge of specific options for a version. We
  453. * start just after the service directory line so once we hit another
  454. * directory line, the function knows that it has to stop parsing. */
  455. switch (service->config.version) {
  456. case HS_VERSION_TWO:
  457. ret = rend_config_service(line->next, options, &service->config);
  458. break;
  459. case HS_VERSION_THREE:
  460. ret = config_service_v3(line->next, &service->config);
  461. break;
  462. default:
  463. /* We do validate before if we support the parsed version. */
  464. tor_assert_nonfatal_unreached();
  465. goto err;
  466. }
  467. if (ret < 0) {
  468. goto err;
  469. }
  470. /* We'll check if this service can be kept depending on the others
  471. * configured previously. */
  472. if (service_is_duplicate_in_list(service_list, service)) {
  473. goto err;
  474. }
  475. /* Passes, add it to the given list. */
  476. smartlist_add(service_list, service);
  477. return 0;
  478. err:
  479. hs_service_free(service);
  480. return -1;
  481. }
  482. /* From a set of <b>options</b>, setup every hidden service found. Return 0 on
  483. * success or -1 on failure. If <b>validate_only</b> is set, parse, warn and
  484. * return as normal, but don't actually change the configured services. */
  485. int
  486. hs_config_service_all(const or_options_t *options, int validate_only)
  487. {
  488. int dir_option_seen = 0, ret = -1;
  489. const config_line_t *line;
  490. smartlist_t *new_service_list = NULL;
  491. tor_assert(options);
  492. /* Newly configured service are put in that list which is then used for
  493. * validation and staging for >= v3. */
  494. new_service_list = smartlist_new();
  495. for (line = options->RendConfigLines; line; line = line->next) {
  496. /* Ignore all directives that aren't the start of a service. */
  497. if (strcasecmp(line->key, "HiddenServiceDir")) {
  498. if (!dir_option_seen) {
  499. log_warn(LD_CONFIG, "%s with no preceding HiddenServiceDir directive",
  500. line->key);
  501. goto err;
  502. }
  503. continue;
  504. }
  505. /* Flag that we've seen a directory directive and we'll use it to make
  506. * sure that the torrc options ordering is actually valid. */
  507. dir_option_seen = 1;
  508. /* Try to configure this service now. On success, it will be added to the
  509. * list and validated against the service in that same list. */
  510. if (config_service(line, options, new_service_list) < 0) {
  511. goto err;
  512. }
  513. }
  514. /* In non validation mode, we'll stage those services we just successfully
  515. * configured. Service ownership is transferred from the list to the global
  516. * state. If any service is invalid, it will be removed from the list and
  517. * freed. All versions are handled in that function. */
  518. if (!validate_only) {
  519. stage_services(new_service_list);
  520. } else {
  521. /* We've just validated that we were able to build a clean working list of
  522. * services. We don't need those objects anymore. */
  523. SMARTLIST_FOREACH(new_service_list, hs_service_t *, s,
  524. hs_service_free(s));
  525. /* For the v2 subsystem, the configuration function adds the service
  526. * object to the staging list and it is transferred in the main list
  527. * through the prunning process. In validation mode, we thus have to purge
  528. * the staging list so it's not kept in memory as valid service. */
  529. rend_service_free_staging_list();
  530. }
  531. /* Success. Note that the service list has no ownership of its content. */
  532. ret = 0;
  533. goto end;
  534. err:
  535. SMARTLIST_FOREACH(new_service_list, hs_service_t *, s, hs_service_free(s));
  536. end:
  537. smartlist_free(new_service_list);
  538. /* Tor main should call the free all function on error. */
  539. return ret;
  540. }