rendcommon.c 37 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037
  1. /* Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  2. * Copyright (c) 2007-2017, The Tor Project, Inc. */
  3. /* See LICENSE for licensing information */
  4. /**
  5. * \file rendcommon.c
  6. * \brief Rendezvous implementation: shared code between
  7. * introducers, services, clients, and rendezvous points.
  8. **/
  9. #define RENDCOMMON_PRIVATE
  10. #include "or.h"
  11. #include "circuitbuild.h"
  12. #include "config.h"
  13. #include "control.h"
  14. #include "hs_common.h"
  15. #include "rendclient.h"
  16. #include "rendcommon.h"
  17. #include "rendmid.h"
  18. #include "hs_intropoint.h"
  19. #include "hs_client.h"
  20. #include "rendservice.h"
  21. #include "rephist.h"
  22. #include "router.h"
  23. #include "routerlist.h"
  24. #include "routerparse.h"
  25. #include "networkstatus.h"
  26. /** Return 0 if one and two are the same service ids, else -1 or 1 */
  27. int
  28. rend_cmp_service_ids(const char *one, const char *two)
  29. {
  30. return strcasecmp(one,two);
  31. }
  32. /** Free the storage held by the service descriptor <b>desc</b>.
  33. */
  34. void
  35. rend_service_descriptor_free_(rend_service_descriptor_t *desc)
  36. {
  37. if (!desc)
  38. return;
  39. if (desc->pk)
  40. crypto_pk_free(desc->pk);
  41. if (desc->intro_nodes) {
  42. SMARTLIST_FOREACH(desc->intro_nodes, rend_intro_point_t *, intro,
  43. rend_intro_point_free(intro););
  44. smartlist_free(desc->intro_nodes);
  45. }
  46. if (desc->successful_uploads) {
  47. SMARTLIST_FOREACH(desc->successful_uploads, char *, c, tor_free(c););
  48. smartlist_free(desc->successful_uploads);
  49. }
  50. tor_free(desc);
  51. }
  52. /** Length of the descriptor cookie that is used for versioned hidden
  53. * service descriptors. */
  54. #define REND_DESC_COOKIE_LEN 16
  55. /** Length of the replica number that is used to determine the secret ID
  56. * part of versioned hidden service descriptors. */
  57. #define REND_REPLICA_LEN 1
  58. /** Compute the descriptor ID for <b>service_id</b> of length
  59. * <b>REND_SERVICE_ID_LEN</b> and <b>secret_id_part</b> of length
  60. * <b>DIGEST_LEN</b>, and write it to <b>descriptor_id_out</b> of length
  61. * <b>DIGEST_LEN</b>. */
  62. void
  63. rend_get_descriptor_id_bytes(char *descriptor_id_out,
  64. const char *service_id,
  65. const char *secret_id_part)
  66. {
  67. crypto_digest_t *digest = crypto_digest_new();
  68. crypto_digest_add_bytes(digest, service_id, REND_SERVICE_ID_LEN);
  69. crypto_digest_add_bytes(digest, secret_id_part, DIGEST_LEN);
  70. crypto_digest_get_digest(digest, descriptor_id_out, DIGEST_LEN);
  71. crypto_digest_free(digest);
  72. }
  73. /** Compute the secret ID part for time_period,
  74. * a <b>descriptor_cookie</b> of length
  75. * <b>REND_DESC_COOKIE_LEN</b> which may also be <b>NULL</b> if no
  76. * descriptor_cookie shall be used, and <b>replica</b>, and write it to
  77. * <b>secret_id_part</b> of length DIGEST_LEN. */
  78. static void
  79. get_secret_id_part_bytes(char *secret_id_part, uint32_t time_period,
  80. const char *descriptor_cookie, uint8_t replica)
  81. {
  82. crypto_digest_t *digest = crypto_digest_new();
  83. time_period = htonl(time_period);
  84. crypto_digest_add_bytes(digest, (char*)&time_period, sizeof(uint32_t));
  85. if (descriptor_cookie) {
  86. crypto_digest_add_bytes(digest, descriptor_cookie,
  87. REND_DESC_COOKIE_LEN);
  88. }
  89. crypto_digest_add_bytes(digest, (const char *)&replica, REND_REPLICA_LEN);
  90. crypto_digest_get_digest(digest, secret_id_part, DIGEST_LEN);
  91. crypto_digest_free(digest);
  92. }
  93. /** Return the time period for time <b>now</b> plus a potentially
  94. * intended <b>deviation</b> of one or more periods, based on the first byte
  95. * of <b>service_id</b>. */
  96. static uint32_t
  97. get_time_period(time_t now, uint8_t deviation, const char *service_id)
  98. {
  99. /* The time period is the number of REND_TIME_PERIOD_V2_DESC_VALIDITY
  100. * intervals that have passed since the epoch, offset slightly so that
  101. * each service's time periods start and end at a fraction of that
  102. * period based on their first byte. */
  103. return (uint32_t)
  104. (now + ((uint8_t) *service_id) * REND_TIME_PERIOD_V2_DESC_VALIDITY / 256)
  105. / REND_TIME_PERIOD_V2_DESC_VALIDITY + deviation;
  106. }
  107. /** Compute the time in seconds that a descriptor that is generated
  108. * <b>now</b> for <b>service_id</b> will be valid. */
  109. static uint32_t
  110. get_seconds_valid(time_t now, const char *service_id)
  111. {
  112. uint32_t result = REND_TIME_PERIOD_V2_DESC_VALIDITY -
  113. ((uint32_t)
  114. (now + ((uint8_t) *service_id) * REND_TIME_PERIOD_V2_DESC_VALIDITY / 256)
  115. % REND_TIME_PERIOD_V2_DESC_VALIDITY);
  116. return result;
  117. }
  118. /** Compute the binary <b>desc_id_out</b> (DIGEST_LEN bytes long) for a given
  119. * base32-encoded <b>service_id</b> and optional unencoded
  120. * <b>descriptor_cookie</b> of length REND_DESC_COOKIE_LEN,
  121. * at time <b>now</b> for replica number
  122. * <b>replica</b>. <b>desc_id</b> needs to have <b>DIGEST_LEN</b> bytes
  123. * free. Return 0 for success, -1 otherwise. */
  124. int
  125. rend_compute_v2_desc_id(char *desc_id_out, const char *service_id,
  126. const char *descriptor_cookie, time_t now,
  127. uint8_t replica)
  128. {
  129. char service_id_binary[REND_SERVICE_ID_LEN];
  130. char secret_id_part[DIGEST_LEN];
  131. uint32_t time_period;
  132. if (!service_id ||
  133. strlen(service_id) != REND_SERVICE_ID_LEN_BASE32) {
  134. log_warn(LD_REND, "Could not compute v2 descriptor ID: "
  135. "Illegal service ID: %s",
  136. safe_str(service_id));
  137. return -1;
  138. }
  139. if (replica >= REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS) {
  140. log_warn(LD_REND, "Could not compute v2 descriptor ID: "
  141. "Replica number out of range: %d", replica);
  142. return -1;
  143. }
  144. /* Convert service ID to binary. */
  145. if (base32_decode(service_id_binary, REND_SERVICE_ID_LEN,
  146. service_id, REND_SERVICE_ID_LEN_BASE32) < 0) {
  147. log_warn(LD_REND, "Could not compute v2 descriptor ID: "
  148. "Illegal characters in service ID: %s",
  149. safe_str_client(service_id));
  150. return -1;
  151. }
  152. /* Calculate current time-period. */
  153. time_period = get_time_period(now, 0, service_id_binary);
  154. /* Calculate secret-id-part = h(time-period | desc-cookie | replica). */
  155. get_secret_id_part_bytes(secret_id_part, time_period, descriptor_cookie,
  156. replica);
  157. /* Calculate descriptor ID: H(permanent-id | secret-id-part) */
  158. rend_get_descriptor_id_bytes(desc_id_out, service_id_binary, secret_id_part);
  159. return 0;
  160. }
  161. /** Encode the introduction points in <b>desc</b> and write the result to a
  162. * newly allocated string pointed to by <b>encoded</b>. Return 0 for
  163. * success, -1 otherwise. */
  164. static int
  165. rend_encode_v2_intro_points(char **encoded, rend_service_descriptor_t *desc)
  166. {
  167. size_t unenc_len;
  168. char *unenc = NULL;
  169. size_t unenc_written = 0;
  170. int i;
  171. int r = -1;
  172. /* Assemble unencrypted list of introduction points. */
  173. unenc_len = smartlist_len(desc->intro_nodes) * 1000; /* too long, but ok. */
  174. unenc = tor_malloc_zero(unenc_len);
  175. for (i = 0; i < smartlist_len(desc->intro_nodes); i++) {
  176. char id_base32[REND_INTRO_POINT_ID_LEN_BASE32 + 1];
  177. char *onion_key = NULL;
  178. size_t onion_key_len;
  179. crypto_pk_t *intro_key;
  180. char *service_key = NULL;
  181. char *address = NULL;
  182. size_t service_key_len;
  183. int res;
  184. rend_intro_point_t *intro = smartlist_get(desc->intro_nodes, i);
  185. /* Obtain extend info with introduction point details. */
  186. extend_info_t *info = intro->extend_info;
  187. /* Encode introduction point ID. */
  188. base32_encode(id_base32, sizeof(id_base32),
  189. info->identity_digest, DIGEST_LEN);
  190. /* Encode onion key. */
  191. if (crypto_pk_write_public_key_to_string(info->onion_key, &onion_key,
  192. &onion_key_len) < 0) {
  193. log_warn(LD_REND, "Could not write onion key.");
  194. goto done;
  195. }
  196. /* Encode intro key. */
  197. intro_key = intro->intro_key;
  198. if (!intro_key ||
  199. crypto_pk_write_public_key_to_string(intro_key, &service_key,
  200. &service_key_len) < 0) {
  201. log_warn(LD_REND, "Could not write intro key.");
  202. tor_free(onion_key);
  203. goto done;
  204. }
  205. /* Assemble everything for this introduction point. */
  206. address = tor_addr_to_str_dup(&info->addr);
  207. res = tor_snprintf(unenc + unenc_written, unenc_len - unenc_written,
  208. "introduction-point %s\n"
  209. "ip-address %s\n"
  210. "onion-port %d\n"
  211. "onion-key\n%s"
  212. "service-key\n%s",
  213. id_base32,
  214. address,
  215. info->port,
  216. onion_key,
  217. service_key);
  218. tor_free(address);
  219. tor_free(onion_key);
  220. tor_free(service_key);
  221. if (res < 0) {
  222. log_warn(LD_REND, "Not enough space for writing introduction point "
  223. "string.");
  224. goto done;
  225. }
  226. /* Update total number of written bytes for unencrypted intro points. */
  227. unenc_written += res;
  228. }
  229. /* Finalize unencrypted introduction points. */
  230. if (unenc_len < unenc_written + 2) {
  231. log_warn(LD_REND, "Not enough space for finalizing introduction point "
  232. "string.");
  233. goto done;
  234. }
  235. unenc[unenc_written++] = '\n';
  236. unenc[unenc_written++] = 0;
  237. *encoded = unenc;
  238. r = 0;
  239. done:
  240. if (r<0)
  241. tor_free(unenc);
  242. return r;
  243. }
  244. /** Encrypt the encoded introduction points in <b>encoded</b> using
  245. * authorization type 'basic' with <b>client_cookies</b> and write the
  246. * result to a newly allocated string pointed to by <b>encrypted_out</b> of
  247. * length <b>encrypted_len_out</b>. Return 0 for success, -1 otherwise. */
  248. static int
  249. rend_encrypt_v2_intro_points_basic(char **encrypted_out,
  250. size_t *encrypted_len_out,
  251. const char *encoded,
  252. smartlist_t *client_cookies)
  253. {
  254. int r = -1, i, pos, enclen, client_blocks;
  255. size_t len, client_entries_len;
  256. char *enc = NULL, iv[CIPHER_IV_LEN], *client_part = NULL,
  257. session_key[CIPHER_KEY_LEN];
  258. smartlist_t *encrypted_session_keys = NULL;
  259. crypto_digest_t *digest;
  260. crypto_cipher_t *cipher;
  261. tor_assert(encoded);
  262. tor_assert(client_cookies && smartlist_len(client_cookies) > 0);
  263. /* Generate session key. */
  264. crypto_rand(session_key, CIPHER_KEY_LEN);
  265. /* Determine length of encrypted introduction points including session
  266. * keys. */
  267. client_blocks = 1 + ((smartlist_len(client_cookies) - 1) /
  268. REND_BASIC_AUTH_CLIENT_MULTIPLE);
  269. client_entries_len = client_blocks * REND_BASIC_AUTH_CLIENT_MULTIPLE *
  270. REND_BASIC_AUTH_CLIENT_ENTRY_LEN;
  271. len = 2 + client_entries_len + CIPHER_IV_LEN + strlen(encoded);
  272. if (client_blocks >= 256) {
  273. log_warn(LD_REND, "Too many clients in introduction point string.");
  274. goto done;
  275. }
  276. enc = tor_malloc_zero(len);
  277. enc[0] = 0x01; /* type of authorization. */
  278. enc[1] = (uint8_t)client_blocks;
  279. /* Encrypt with random session key. */
  280. enclen = crypto_cipher_encrypt_with_iv(session_key,
  281. enc + 2 + client_entries_len,
  282. CIPHER_IV_LEN + strlen(encoded), encoded, strlen(encoded));
  283. if (enclen < 0) {
  284. log_warn(LD_REND, "Could not encrypt introduction point string.");
  285. goto done;
  286. }
  287. memcpy(iv, enc + 2 + client_entries_len, CIPHER_IV_LEN);
  288. /* Encrypt session key for cookies, determine client IDs, and put both
  289. * in a smartlist. */
  290. encrypted_session_keys = smartlist_new();
  291. SMARTLIST_FOREACH_BEGIN(client_cookies, const char *, cookie) {
  292. client_part = tor_malloc_zero(REND_BASIC_AUTH_CLIENT_ENTRY_LEN);
  293. /* Encrypt session key. */
  294. cipher = crypto_cipher_new(cookie);
  295. if (crypto_cipher_encrypt(cipher, client_part +
  296. REND_BASIC_AUTH_CLIENT_ID_LEN,
  297. session_key, CIPHER_KEY_LEN) < 0) {
  298. log_warn(LD_REND, "Could not encrypt session key for client.");
  299. crypto_cipher_free(cipher);
  300. tor_free(client_part);
  301. goto done;
  302. }
  303. crypto_cipher_free(cipher);
  304. /* Determine client ID. */
  305. digest = crypto_digest_new();
  306. crypto_digest_add_bytes(digest, cookie, REND_DESC_COOKIE_LEN);
  307. crypto_digest_add_bytes(digest, iv, CIPHER_IV_LEN);
  308. crypto_digest_get_digest(digest, client_part,
  309. REND_BASIC_AUTH_CLIENT_ID_LEN);
  310. crypto_digest_free(digest);
  311. /* Put both together. */
  312. smartlist_add(encrypted_session_keys, client_part);
  313. } SMARTLIST_FOREACH_END(cookie);
  314. /* Add some fake client IDs and encrypted session keys. */
  315. for (i = (smartlist_len(client_cookies) - 1) %
  316. REND_BASIC_AUTH_CLIENT_MULTIPLE;
  317. i < REND_BASIC_AUTH_CLIENT_MULTIPLE - 1; i++) {
  318. client_part = tor_malloc_zero(REND_BASIC_AUTH_CLIENT_ENTRY_LEN);
  319. crypto_rand(client_part, REND_BASIC_AUTH_CLIENT_ENTRY_LEN);
  320. smartlist_add(encrypted_session_keys, client_part);
  321. }
  322. /* Sort smartlist and put elements in result in order. */
  323. smartlist_sort_digests(encrypted_session_keys);
  324. pos = 2;
  325. SMARTLIST_FOREACH(encrypted_session_keys, const char *, entry, {
  326. memcpy(enc + pos, entry, REND_BASIC_AUTH_CLIENT_ENTRY_LEN);
  327. pos += REND_BASIC_AUTH_CLIENT_ENTRY_LEN;
  328. });
  329. *encrypted_out = enc;
  330. *encrypted_len_out = len;
  331. enc = NULL; /* prevent free. */
  332. r = 0;
  333. done:
  334. tor_free(enc);
  335. if (encrypted_session_keys) {
  336. SMARTLIST_FOREACH(encrypted_session_keys, char *, d, tor_free(d););
  337. smartlist_free(encrypted_session_keys);
  338. }
  339. return r;
  340. }
  341. /** Encrypt the encoded introduction points in <b>encoded</b> using
  342. * authorization type 'stealth' with <b>descriptor_cookie</b> of length
  343. * REND_DESC_COOKIE_LEN and write the result to a newly allocated string
  344. * pointed to by <b>encrypted_out</b> of length <b>encrypted_len_out</b>.
  345. * Return 0 for success, -1 otherwise. */
  346. static int
  347. rend_encrypt_v2_intro_points_stealth(char **encrypted_out,
  348. size_t *encrypted_len_out,
  349. const char *encoded,
  350. const char *descriptor_cookie)
  351. {
  352. int r = -1, enclen;
  353. char *enc;
  354. tor_assert(encoded);
  355. tor_assert(descriptor_cookie);
  356. enc = tor_malloc_zero(1 + CIPHER_IV_LEN + strlen(encoded));
  357. enc[0] = 0x02; /* Auth type */
  358. enclen = crypto_cipher_encrypt_with_iv(descriptor_cookie,
  359. enc + 1,
  360. CIPHER_IV_LEN+strlen(encoded),
  361. encoded, strlen(encoded));
  362. if (enclen < 0) {
  363. log_warn(LD_REND, "Could not encrypt introduction point string.");
  364. goto done;
  365. }
  366. *encrypted_out = enc;
  367. *encrypted_len_out = enclen;
  368. enc = NULL; /* prevent free */
  369. r = 0;
  370. done:
  371. tor_free(enc);
  372. return r;
  373. }
  374. /** Attempt to parse the given <b>desc_str</b> and return true if this
  375. * succeeds, false otherwise. */
  376. STATIC int
  377. rend_desc_v2_is_parsable(rend_encoded_v2_service_descriptor_t *desc)
  378. {
  379. rend_service_descriptor_t *test_parsed = NULL;
  380. char test_desc_id[DIGEST_LEN];
  381. char *test_intro_content = NULL;
  382. size_t test_intro_size;
  383. size_t test_encoded_size;
  384. const char *test_next;
  385. int res = rend_parse_v2_service_descriptor(&test_parsed, test_desc_id,
  386. &test_intro_content,
  387. &test_intro_size,
  388. &test_encoded_size,
  389. &test_next, desc->desc_str, 1);
  390. rend_service_descriptor_free(test_parsed);
  391. tor_free(test_intro_content);
  392. return (res >= 0);
  393. }
  394. /** Free the storage held by an encoded v2 service descriptor. */
  395. void
  396. rend_encoded_v2_service_descriptor_free_(
  397. rend_encoded_v2_service_descriptor_t *desc)
  398. {
  399. if (!desc)
  400. return;
  401. tor_free(desc->desc_str);
  402. tor_free(desc);
  403. }
  404. /** Free the storage held by an introduction point info. */
  405. void
  406. rend_intro_point_free_(rend_intro_point_t *intro)
  407. {
  408. if (!intro)
  409. return;
  410. extend_info_free(intro->extend_info);
  411. crypto_pk_free(intro->intro_key);
  412. if (intro->accepted_intro_rsa_parts != NULL) {
  413. replaycache_free(intro->accepted_intro_rsa_parts);
  414. }
  415. tor_free(intro);
  416. }
  417. /** Encode a set of rend_encoded_v2_service_descriptor_t's for <b>desc</b>
  418. * at time <b>now</b> using <b>service_key</b>, depending on
  419. * <b>auth_type</b> a <b>descriptor_cookie</b> and a list of
  420. * <b>client_cookies</b> (which are both <b>NULL</b> if no client
  421. * authorization is performed), and <b>period</b> (e.g. 0 for the current
  422. * period, 1 for the next period, etc.) and add them to the existing list
  423. * <b>descs_out</b>; return the number of seconds that the descriptors will
  424. * be found by clients, or -1 if the encoding was not successful. */
  425. int
  426. rend_encode_v2_descriptors(smartlist_t *descs_out,
  427. rend_service_descriptor_t *desc, time_t now,
  428. uint8_t period, rend_auth_type_t auth_type,
  429. crypto_pk_t *client_key,
  430. smartlist_t *client_cookies)
  431. {
  432. char service_id[DIGEST_LEN];
  433. char service_id_base32[REND_SERVICE_ID_LEN_BASE32+1];
  434. uint32_t time_period;
  435. char *ipos_base64 = NULL, *ipos = NULL, *ipos_encrypted = NULL,
  436. *descriptor_cookie = NULL;
  437. size_t ipos_len = 0, ipos_encrypted_len = 0;
  438. int k;
  439. uint32_t seconds_valid;
  440. crypto_pk_t *service_key;
  441. if (!desc) {
  442. log_warn(LD_BUG, "Could not encode v2 descriptor: No desc given.");
  443. return -1;
  444. }
  445. service_key = (auth_type == REND_STEALTH_AUTH) ? client_key : desc->pk;
  446. tor_assert(service_key);
  447. if (auth_type == REND_STEALTH_AUTH) {
  448. descriptor_cookie = smartlist_get(client_cookies, 0);
  449. tor_assert(descriptor_cookie);
  450. }
  451. /* Obtain service_id from public key. */
  452. if (crypto_pk_get_digest(service_key, service_id) < 0) {
  453. log_warn(LD_BUG, "Couldn't compute service key digest.");
  454. return -1;
  455. }
  456. /* Calculate current time-period. */
  457. time_period = get_time_period(now, period, service_id);
  458. /* Determine how many seconds the descriptor will be valid. */
  459. seconds_valid = period * REND_TIME_PERIOD_V2_DESC_VALIDITY +
  460. get_seconds_valid(now, service_id);
  461. /* Assemble, possibly encrypt, and encode introduction points. */
  462. if (smartlist_len(desc->intro_nodes) > 0) {
  463. if (rend_encode_v2_intro_points(&ipos, desc) < 0) {
  464. log_warn(LD_REND, "Encoding of introduction points did not succeed.");
  465. return -1;
  466. }
  467. switch (auth_type) {
  468. case REND_NO_AUTH:
  469. ipos_len = strlen(ipos);
  470. break;
  471. case REND_BASIC_AUTH:
  472. if (rend_encrypt_v2_intro_points_basic(&ipos_encrypted,
  473. &ipos_encrypted_len, ipos,
  474. client_cookies) < 0) {
  475. log_warn(LD_REND, "Encrypting of introduction points did not "
  476. "succeed.");
  477. tor_free(ipos);
  478. return -1;
  479. }
  480. tor_free(ipos);
  481. ipos = ipos_encrypted;
  482. ipos_len = ipos_encrypted_len;
  483. break;
  484. case REND_STEALTH_AUTH:
  485. if (rend_encrypt_v2_intro_points_stealth(&ipos_encrypted,
  486. &ipos_encrypted_len, ipos,
  487. descriptor_cookie) < 0) {
  488. log_warn(LD_REND, "Encrypting of introduction points did not "
  489. "succeed.");
  490. tor_free(ipos);
  491. return -1;
  492. }
  493. tor_free(ipos);
  494. ipos = ipos_encrypted;
  495. ipos_len = ipos_encrypted_len;
  496. break;
  497. default:
  498. log_warn(LD_REND|LD_BUG, "Unrecognized authorization type %d",
  499. (int)auth_type);
  500. tor_free(ipos);
  501. return -1;
  502. }
  503. /* Base64-encode introduction points. */
  504. ipos_base64 = tor_calloc(ipos_len, 2);
  505. if (base64_encode(ipos_base64, ipos_len * 2, ipos, ipos_len,
  506. BASE64_ENCODE_MULTILINE)<0) {
  507. log_warn(LD_REND, "Could not encode introduction point string to "
  508. "base64. length=%d", (int)ipos_len);
  509. tor_free(ipos_base64);
  510. tor_free(ipos);
  511. return -1;
  512. }
  513. tor_free(ipos);
  514. }
  515. /* Encode REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS descriptors. */
  516. for (k = 0; k < REND_NUMBER_OF_NON_CONSECUTIVE_REPLICAS; k++) {
  517. char secret_id_part[DIGEST_LEN];
  518. char secret_id_part_base32[REND_SECRET_ID_PART_LEN_BASE32 + 1];
  519. char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1];
  520. char *permanent_key = NULL;
  521. size_t permanent_key_len;
  522. char published[ISO_TIME_LEN+1];
  523. int i;
  524. char protocol_versions_string[16]; /* max len: "0,1,2,3,4,5,6,7\0" */
  525. size_t protocol_versions_written;
  526. size_t desc_len;
  527. char *desc_str = NULL;
  528. int result = 0;
  529. size_t written = 0;
  530. char desc_digest[DIGEST_LEN];
  531. rend_encoded_v2_service_descriptor_t *enc =
  532. tor_malloc_zero(sizeof(rend_encoded_v2_service_descriptor_t));
  533. /* Calculate secret-id-part = h(time-period | cookie | replica). */
  534. get_secret_id_part_bytes(secret_id_part, time_period, descriptor_cookie,
  535. k);
  536. base32_encode(secret_id_part_base32, sizeof(secret_id_part_base32),
  537. secret_id_part, DIGEST_LEN);
  538. /* Calculate descriptor ID. */
  539. rend_get_descriptor_id_bytes(enc->desc_id, service_id, secret_id_part);
  540. base32_encode(desc_id_base32, sizeof(desc_id_base32),
  541. enc->desc_id, DIGEST_LEN);
  542. /* PEM-encode the public key */
  543. if (crypto_pk_write_public_key_to_string(service_key, &permanent_key,
  544. &permanent_key_len) < 0) {
  545. log_warn(LD_BUG, "Could not write public key to string.");
  546. rend_encoded_v2_service_descriptor_free(enc);
  547. goto err;
  548. }
  549. /* Encode timestamp. */
  550. format_iso_time(published, desc->timestamp);
  551. /* Write protocol-versions bitmask to comma-separated value string. */
  552. protocol_versions_written = 0;
  553. for (i = 0; i < 8; i++) {
  554. if (desc->protocols & 1 << i) {
  555. tor_snprintf(protocol_versions_string + protocol_versions_written,
  556. 16 - protocol_versions_written, "%d,", i);
  557. protocol_versions_written += 2;
  558. }
  559. }
  560. if (protocol_versions_written)
  561. protocol_versions_string[protocol_versions_written - 1] = '\0';
  562. else
  563. protocol_versions_string[0]= '\0';
  564. /* Assemble complete descriptor. */
  565. desc_len = 2000 + smartlist_len(desc->intro_nodes) * 1000; /* far too long,
  566. but okay.*/
  567. enc->desc_str = desc_str = tor_malloc_zero(desc_len);
  568. result = tor_snprintf(desc_str, desc_len,
  569. "rendezvous-service-descriptor %s\n"
  570. "version 2\n"
  571. "permanent-key\n%s"
  572. "secret-id-part %s\n"
  573. "publication-time %s\n"
  574. "protocol-versions %s\n",
  575. desc_id_base32,
  576. permanent_key,
  577. secret_id_part_base32,
  578. published,
  579. protocol_versions_string);
  580. tor_free(permanent_key);
  581. if (result < 0) {
  582. log_warn(LD_BUG, "Descriptor ran out of room.");
  583. rend_encoded_v2_service_descriptor_free(enc);
  584. goto err;
  585. }
  586. written = result;
  587. /* Add introduction points. */
  588. if (ipos_base64) {
  589. result = tor_snprintf(desc_str + written, desc_len - written,
  590. "introduction-points\n"
  591. "-----BEGIN MESSAGE-----\n%s"
  592. "-----END MESSAGE-----\n",
  593. ipos_base64);
  594. if (result < 0) {
  595. log_warn(LD_BUG, "could not write introduction points.");
  596. rend_encoded_v2_service_descriptor_free(enc);
  597. goto err;
  598. }
  599. written += result;
  600. }
  601. /* Add signature. */
  602. strlcpy(desc_str + written, "signature\n", desc_len - written);
  603. written += strlen(desc_str + written);
  604. if (crypto_digest(desc_digest, desc_str, written) < 0) {
  605. log_warn(LD_BUG, "could not create digest.");
  606. rend_encoded_v2_service_descriptor_free(enc);
  607. goto err;
  608. }
  609. if (router_append_dirobj_signature(desc_str + written,
  610. desc_len - written,
  611. desc_digest, DIGEST_LEN,
  612. service_key) < 0) {
  613. log_warn(LD_BUG, "Couldn't sign desc.");
  614. rend_encoded_v2_service_descriptor_free(enc);
  615. goto err;
  616. }
  617. written += strlen(desc_str+written);
  618. if (written+2 > desc_len) {
  619. log_warn(LD_BUG, "Could not finish desc.");
  620. rend_encoded_v2_service_descriptor_free(enc);
  621. goto err;
  622. }
  623. desc_str[written++] = 0;
  624. /* Check if we can parse our own descriptor. */
  625. if (!rend_desc_v2_is_parsable(enc)) {
  626. log_warn(LD_BUG, "Could not parse my own descriptor: %s", desc_str);
  627. rend_encoded_v2_service_descriptor_free(enc);
  628. goto err;
  629. }
  630. smartlist_add(descs_out, enc);
  631. /* Add the uploaded descriptor to the local service's descriptor cache */
  632. rend_cache_store_v2_desc_as_service(enc->desc_str);
  633. base32_encode(service_id_base32, sizeof(service_id_base32),
  634. service_id, REND_SERVICE_ID_LEN);
  635. control_event_hs_descriptor_created(service_id_base32, desc_id_base32, k);
  636. }
  637. log_info(LD_REND, "Successfully encoded a v2 descriptor and "
  638. "confirmed that it is parsable.");
  639. goto done;
  640. err:
  641. SMARTLIST_FOREACH(descs_out, rend_encoded_v2_service_descriptor_t *, d,
  642. rend_encoded_v2_service_descriptor_free(d););
  643. smartlist_clear(descs_out);
  644. seconds_valid = -1;
  645. done:
  646. tor_free(ipos_base64);
  647. return seconds_valid;
  648. }
  649. /** Sets <b>out</b> to the first 10 bytes of the digest of <b>pk</b>,
  650. * base32 encoded. NUL-terminates out. (We use this string to
  651. * identify services in directory requests and .onion URLs.)
  652. */
  653. int
  654. rend_get_service_id(crypto_pk_t *pk, char *out)
  655. {
  656. char buf[DIGEST_LEN];
  657. tor_assert(pk);
  658. if (crypto_pk_get_digest(pk, buf) < 0)
  659. return -1;
  660. base32_encode(out, REND_SERVICE_ID_LEN_BASE32+1, buf, REND_SERVICE_ID_LEN);
  661. return 0;
  662. }
  663. /** Return true iff <b>query</b> is a syntactically valid service ID (as
  664. * generated by rend_get_service_id). */
  665. int
  666. rend_valid_v2_service_id(const char *query)
  667. {
  668. if (strlen(query) != REND_SERVICE_ID_LEN_BASE32)
  669. return 0;
  670. if (strspn(query, BASE32_CHARS) != REND_SERVICE_ID_LEN_BASE32)
  671. return 0;
  672. return 1;
  673. }
  674. /** Return true iff <b>query</b> is a syntactically valid descriptor ID.
  675. * (as generated by rend_get_descriptor_id_bytes). */
  676. int
  677. rend_valid_descriptor_id(const char *query)
  678. {
  679. if (strlen(query) != REND_DESC_ID_V2_LEN_BASE32) {
  680. goto invalid;
  681. }
  682. if (strspn(query, BASE32_CHARS) != REND_DESC_ID_V2_LEN_BASE32) {
  683. goto invalid;
  684. }
  685. return 1;
  686. invalid:
  687. return 0;
  688. }
  689. /** Return true iff <b>client_name</b> is a syntactically valid name
  690. * for rendezvous client authentication. */
  691. int
  692. rend_valid_client_name(const char *client_name)
  693. {
  694. size_t len = strlen(client_name);
  695. if (len < 1 || len > REND_CLIENTNAME_MAX_LEN) {
  696. return 0;
  697. }
  698. if (strspn(client_name, REND_LEGAL_CLIENTNAME_CHARACTERS) != len) {
  699. return 0;
  700. }
  701. return 1;
  702. }
  703. /** Called when we get a rendezvous-related relay cell on circuit
  704. * <b>circ</b>. Dispatch on rendezvous relay command. */
  705. void
  706. rend_process_relay_cell(circuit_t *circ, const crypt_path_t *layer_hint,
  707. int command, size_t length,
  708. const uint8_t *payload)
  709. {
  710. or_circuit_t *or_circ = NULL;
  711. origin_circuit_t *origin_circ = NULL;
  712. int r = -2;
  713. if (CIRCUIT_IS_ORIGIN(circ)) {
  714. origin_circ = TO_ORIGIN_CIRCUIT(circ);
  715. if (!layer_hint || layer_hint != origin_circ->cpath->prev) {
  716. log_fn(LOG_PROTOCOL_WARN, LD_APP,
  717. "Relay cell (rend purpose %d) from wrong hop on origin circ",
  718. command);
  719. origin_circ = NULL;
  720. }
  721. } else {
  722. or_circ = TO_OR_CIRCUIT(circ);
  723. }
  724. switch (command) {
  725. case RELAY_COMMAND_ESTABLISH_INTRO:
  726. if (or_circ)
  727. r = hs_intro_received_establish_intro(or_circ,payload,length);
  728. break;
  729. case RELAY_COMMAND_ESTABLISH_RENDEZVOUS:
  730. if (or_circ)
  731. r = rend_mid_establish_rendezvous(or_circ,payload,length);
  732. break;
  733. case RELAY_COMMAND_INTRODUCE1:
  734. if (or_circ)
  735. r = hs_intro_received_introduce1(or_circ,payload,length);
  736. break;
  737. case RELAY_COMMAND_INTRODUCE2:
  738. if (origin_circ)
  739. r = hs_service_receive_introduce2(origin_circ,payload,length);
  740. break;
  741. case RELAY_COMMAND_INTRODUCE_ACK:
  742. if (origin_circ)
  743. r = hs_client_receive_introduce_ack(origin_circ,payload,length);
  744. break;
  745. case RELAY_COMMAND_RENDEZVOUS1:
  746. if (or_circ)
  747. r = rend_mid_rendezvous(or_circ,payload,length);
  748. break;
  749. case RELAY_COMMAND_RENDEZVOUS2:
  750. if (origin_circ)
  751. r = hs_client_receive_rendezvous2(origin_circ,payload,length);
  752. break;
  753. case RELAY_COMMAND_INTRO_ESTABLISHED:
  754. if (origin_circ)
  755. r = hs_service_receive_intro_established(origin_circ,payload,length);
  756. break;
  757. case RELAY_COMMAND_RENDEZVOUS_ESTABLISHED:
  758. if (origin_circ)
  759. r = hs_client_receive_rendezvous_acked(origin_circ,payload,length);
  760. break;
  761. default:
  762. tor_fragile_assert();
  763. }
  764. if (r == -2)
  765. log_info(LD_PROTOCOL, "Dropping cell (type %d) for wrong circuit type.",
  766. command);
  767. }
  768. /** Determine the routers that are responsible for <b>id</b> (binary) and
  769. * add pointers to those routers' routerstatus_t to <b>responsible_dirs</b>.
  770. * Return -1 if we're returning an empty smartlist, else return 0.
  771. */
  772. int
  773. hid_serv_get_responsible_directories(smartlist_t *responsible_dirs,
  774. const char *id)
  775. {
  776. int start, found, n_added = 0, i;
  777. networkstatus_t *c = networkstatus_get_latest_consensus();
  778. if (!c || !smartlist_len(c->routerstatus_list)) {
  779. log_warn(LD_REND, "We don't have a consensus, so we can't perform v2 "
  780. "rendezvous operations.");
  781. return -1;
  782. }
  783. tor_assert(id);
  784. start = networkstatus_vote_find_entry_idx(c, id, &found);
  785. if (start == smartlist_len(c->routerstatus_list)) start = 0;
  786. i = start;
  787. do {
  788. routerstatus_t *r = smartlist_get(c->routerstatus_list, i);
  789. if (r->is_hs_dir) {
  790. smartlist_add(responsible_dirs, r);
  791. if (++n_added == REND_NUMBER_OF_CONSECUTIVE_REPLICAS)
  792. return 0;
  793. }
  794. if (++i == smartlist_len(c->routerstatus_list))
  795. i = 0;
  796. } while (i != start);
  797. /* Even though we don't have the desired number of hidden service
  798. * directories, be happy if we got any. */
  799. return smartlist_len(responsible_dirs) ? 0 : -1;
  800. }
  801. /* Length of the 'extended' auth cookie used to encode auth type before
  802. * base64 encoding. */
  803. #define REND_DESC_COOKIE_LEN_EXT (REND_DESC_COOKIE_LEN + 1)
  804. /* Length of the zero-padded auth cookie when base64 encoded. These two
  805. * padding bytes always (A=) are stripped off of the returned cookie. */
  806. #define REND_DESC_COOKIE_LEN_EXT_BASE64 (REND_DESC_COOKIE_LEN_BASE64 + 2)
  807. /** Encode a client authorization descriptor cookie.
  808. * The result of this function is suitable for use in the HidServAuth
  809. * option. The trailing padding characters are removed, and the
  810. * auth type is encoded into the cookie.
  811. *
  812. * Returns a new base64-encoded cookie. This function cannot fail.
  813. * The caller is responsible for freeing the returned value.
  814. */
  815. char *
  816. rend_auth_encode_cookie(const uint8_t *cookie_in, rend_auth_type_t auth_type)
  817. {
  818. uint8_t extended_cookie[REND_DESC_COOKIE_LEN_EXT];
  819. char *cookie_out = tor_malloc_zero(REND_DESC_COOKIE_LEN_EXT_BASE64 + 1);
  820. int re;
  821. tor_assert(cookie_in);
  822. memcpy(extended_cookie, cookie_in, REND_DESC_COOKIE_LEN);
  823. extended_cookie[REND_DESC_COOKIE_LEN] = ((int)auth_type - 1) << 4;
  824. re = base64_encode(cookie_out, REND_DESC_COOKIE_LEN_EXT_BASE64 + 1,
  825. (const char *) extended_cookie, REND_DESC_COOKIE_LEN_EXT,
  826. 0);
  827. tor_assert(re == REND_DESC_COOKIE_LEN_EXT_BASE64);
  828. /* Remove the trailing 'A='. Auth type is encoded in the high bits
  829. * of the last byte, so the last base64 character will always be zero
  830. * (A). This is subtly different behavior from base64_encode_nopad. */
  831. cookie_out[REND_DESC_COOKIE_LEN_BASE64] = '\0';
  832. memwipe(extended_cookie, 0, sizeof(extended_cookie));
  833. return cookie_out;
  834. }
  835. /** Decode a base64-encoded client authorization descriptor cookie.
  836. * The descriptor_cookie can be truncated to REND_DESC_COOKIE_LEN_BASE64
  837. * characters (as given to clients), or may include the two padding
  838. * characters (as stored by the service).
  839. *
  840. * The result is stored in REND_DESC_COOKIE_LEN bytes of cookie_out.
  841. * The rend_auth_type_t decoded from the cookie is stored in the
  842. * optional auth_type_out parameter.
  843. *
  844. * Return 0 on success, or -1 on error. The caller is responsible for
  845. * freeing the returned err_msg.
  846. */
  847. int
  848. rend_auth_decode_cookie(const char *cookie_in, uint8_t *cookie_out,
  849. rend_auth_type_t *auth_type_out, char **err_msg_out)
  850. {
  851. uint8_t descriptor_cookie_decoded[REND_DESC_COOKIE_LEN_EXT + 1] = { 0 };
  852. char descriptor_cookie_base64ext[REND_DESC_COOKIE_LEN_EXT_BASE64 + 1];
  853. const char *descriptor_cookie = cookie_in;
  854. char *err_msg = NULL;
  855. int auth_type_val = 0;
  856. int res = -1;
  857. int decoded_len;
  858. size_t len = strlen(descriptor_cookie);
  859. if (len == REND_DESC_COOKIE_LEN_BASE64) {
  860. /* Add a trailing zero byte to make base64-decoding happy. */
  861. tor_snprintf(descriptor_cookie_base64ext,
  862. sizeof(descriptor_cookie_base64ext),
  863. "%sA=", descriptor_cookie);
  864. descriptor_cookie = descriptor_cookie_base64ext;
  865. } else if (len != REND_DESC_COOKIE_LEN_EXT_BASE64) {
  866. tor_asprintf(&err_msg, "Authorization cookie has wrong length: %s",
  867. escaped(cookie_in));
  868. goto err;
  869. }
  870. decoded_len = base64_decode((char *) descriptor_cookie_decoded,
  871. sizeof(descriptor_cookie_decoded),
  872. descriptor_cookie,
  873. REND_DESC_COOKIE_LEN_EXT_BASE64);
  874. if (decoded_len != REND_DESC_COOKIE_LEN &&
  875. decoded_len != REND_DESC_COOKIE_LEN_EXT) {
  876. tor_asprintf(&err_msg, "Authorization cookie has invalid characters: %s",
  877. escaped(cookie_in));
  878. goto err;
  879. }
  880. if (auth_type_out) {
  881. auth_type_val = (descriptor_cookie_decoded[REND_DESC_COOKIE_LEN] >> 4) + 1;
  882. if (auth_type_val < 1 || auth_type_val > 2) {
  883. tor_asprintf(&err_msg, "Authorization cookie type is unknown: %s",
  884. escaped(cookie_in));
  885. goto err;
  886. }
  887. *auth_type_out = auth_type_val == 1 ? REND_BASIC_AUTH : REND_STEALTH_AUTH;
  888. }
  889. memcpy(cookie_out, descriptor_cookie_decoded, REND_DESC_COOKIE_LEN);
  890. res = 0;
  891. err:
  892. if (err_msg_out) {
  893. *err_msg_out = err_msg;
  894. } else {
  895. tor_free(err_msg);
  896. }
  897. memwipe(descriptor_cookie_decoded, 0, sizeof(descriptor_cookie_decoded));
  898. memwipe(descriptor_cookie_base64ext, 0, sizeof(descriptor_cookie_base64ext));
  899. return res;
  900. }
  901. /* Is this a rend client or server that allows direct (non-anonymous)
  902. * connections?
  903. * Clients must be specifically compiled and configured in this mode.
  904. * Onion services can be configured to start in this mode.
  905. * Prefer rend_client_allow_non_anonymous_connection() or
  906. * rend_service_allow_non_anonymous_connection() whenever possible, so that
  907. * checks are specific to Single Onion Services or Tor2web. */
  908. int
  909. rend_allow_non_anonymous_connection(const or_options_t* options)
  910. {
  911. return (rend_client_allow_non_anonymous_connection(options)
  912. || rend_service_allow_non_anonymous_connection(options));
  913. }
  914. /* Is this a rend client or server in non-anonymous mode?
  915. * Clients must be specifically compiled in this mode.
  916. * Onion services can be configured to start in this mode.
  917. * Prefer rend_client_non_anonymous_mode_enabled() or
  918. * rend_service_non_anonymous_mode_enabled() whenever possible, so that checks
  919. * are specific to Single Onion Services or Tor2web. */
  920. int
  921. rend_non_anonymous_mode_enabled(const or_options_t *options)
  922. {
  923. return (rend_client_non_anonymous_mode_enabled(options)
  924. || rend_service_non_anonymous_mode_enabled(options));
  925. }
  926. /* Make sure that tor only builds one-hop circuits when they would not
  927. * compromise user anonymity.
  928. *
  929. * One-hop circuits are permitted in Tor2web or Single Onion modes.
  930. *
  931. * Tor2web or Single Onion modes are also allowed to make multi-hop circuits.
  932. * For example, single onion HSDir circuits are 3-hop to prevent denial of
  933. * service.
  934. */
  935. void
  936. assert_circ_anonymity_ok(const origin_circuit_t *circ,
  937. const or_options_t *options)
  938. {
  939. tor_assert(options);
  940. tor_assert(circ);
  941. tor_assert(circ->build_state);
  942. if (circ->build_state->onehop_tunnel) {
  943. tor_assert(rend_allow_non_anonymous_connection(options));
  944. }
  945. }
  946. /* Return 1 iff the given <b>digest</b> of a permenanent hidden service key is
  947. * equal to the digest in the origin circuit <b>ocirc</b> of its rend data .
  948. * If the rend data doesn't exist, 0 is returned. This function is agnostic to
  949. * the rend data version. */
  950. int
  951. rend_circuit_pk_digest_eq(const origin_circuit_t *ocirc,
  952. const uint8_t *digest)
  953. {
  954. size_t rend_pk_digest_len;
  955. const uint8_t *rend_pk_digest;
  956. tor_assert(ocirc);
  957. tor_assert(digest);
  958. if (ocirc->rend_data == NULL) {
  959. goto no_match;
  960. }
  961. rend_pk_digest = rend_data_get_pk_digest(ocirc->rend_data,
  962. &rend_pk_digest_len);
  963. if (tor_memeq(rend_pk_digest, digest, rend_pk_digest_len)) {
  964. goto match;
  965. }
  966. no_match:
  967. return 0;
  968. match:
  969. return 1;
  970. }