test_hs_service.c 75 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220
  1. /* Copyright (c) 2016-2019, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /**
  4. * \file test_hs_service.c
  5. * \brief Test hidden service functionality.
  6. */
  7. #define CIRCUITBUILD_PRIVATE
  8. #define CIRCUITLIST_PRIVATE
  9. #define CONFIG_PRIVATE
  10. #define CONNECTION_PRIVATE
  11. #define CONNECTION_EDGE_PRIVATE
  12. #define CRYPTO_PRIVATE
  13. #define HS_COMMON_PRIVATE
  14. #define HS_SERVICE_PRIVATE
  15. #define HS_INTROPOINT_PRIVATE
  16. #define HS_CIRCUIT_PRIVATE
  17. #define MAINLOOP_PRIVATE
  18. #define NETWORKSTATUS_PRIVATE
  19. #define STATEFILE_PRIVATE
  20. #define TOR_CHANNEL_INTERNAL_
  21. #define HS_CLIENT_PRIVATE
  22. #define CRYPT_PATH_PRIVATE
  23. #include "test/test.h"
  24. #include "test/test_helpers.h"
  25. #include "test/log_test_helpers.h"
  26. #include "test/rend_test_helpers.h"
  27. #include "test/hs_test_helpers.h"
  28. #include "core/or/or.h"
  29. #include "app/config/config.h"
  30. #include "app/config/statefile.h"
  31. #include "core/crypto/hs_ntor.h"
  32. #include "core/mainloop/connection.h"
  33. #include "core/mainloop/mainloop.h"
  34. #include "core/or/circuitbuild.h"
  35. #include "core/or/circuitlist.h"
  36. #include "core/or/circuituse.h"
  37. #include "core/or/connection_edge.h"
  38. #include "core/or/edge_connection_st.h"
  39. #include "core/or/relay.h"
  40. #include "core/or/versions.h"
  41. #include "feature/dirauth/dirvote.h"
  42. #include "feature/dirauth/shared_random_state.h"
  43. #include "feature/dircommon/voting_schedule.h"
  44. #include "feature/hs/hs_circuit.h"
  45. #include "feature/hs/hs_circuitmap.h"
  46. #include "feature/hs/hs_client.h"
  47. #include "feature/hs/hs_common.h"
  48. #include "feature/hs/hs_config.h"
  49. #include "feature/hs/hs_ident.h"
  50. #include "feature/hs/hs_intropoint.h"
  51. #include "feature/hs/hs_service.h"
  52. #include "feature/nodelist/networkstatus.h"
  53. #include "feature/nodelist/nodelist.h"
  54. #include "feature/rend/rendservice.h"
  55. #include "lib/crypt_ops/crypto_rand.h"
  56. #include "lib/fs/dir.h"
  57. #include "core/or/cpath_build_state_st.h"
  58. #include "core/or/crypt_path_st.h"
  59. #include "core/or/crypt_path.h"
  60. #include "feature/nodelist/networkstatus_st.h"
  61. #include "feature/nodelist/node_st.h"
  62. #include "core/or/origin_circuit_st.h"
  63. #include "app/config/or_state_st.h"
  64. #include "feature/nodelist/routerinfo_st.h"
  65. /* Trunnel */
  66. #include "trunnel/hs/cell_establish_intro.h"
  67. #ifdef HAVE_SYS_STAT_H
  68. #include <sys/stat.h>
  69. #endif
  70. #ifdef HAVE_UNISTD_H
  71. #include <unistd.h>
  72. #endif
  73. static networkstatus_t mock_ns;
  74. static networkstatus_t *
  75. mock_networkstatus_get_live_consensus(time_t now)
  76. {
  77. (void) now;
  78. return &mock_ns;
  79. }
  80. static or_state_t *dummy_state = NULL;
  81. /* Mock function to get fake or state (used for rev counters) */
  82. static or_state_t *
  83. get_or_state_replacement(void)
  84. {
  85. return dummy_state;
  86. }
  87. /* Mock function because we are not trying to test the close circuit that does
  88. * an awful lot of checks on the circuit object. */
  89. static void
  90. mock_circuit_mark_for_close(circuit_t *circ, int reason, int line,
  91. const char *file)
  92. {
  93. (void) circ;
  94. (void) reason;
  95. (void) line;
  96. (void) file;
  97. return;
  98. }
  99. static int
  100. mock_relay_send_command_from_edge(streamid_t stream_id, circuit_t *circ,
  101. uint8_t relay_command, const char *payload,
  102. size_t payload_len,
  103. crypt_path_t *cpath_layer,
  104. const char *filename, int lineno)
  105. {
  106. (void) stream_id;
  107. (void) circ;
  108. (void) relay_command;
  109. (void) payload;
  110. (void) payload_len;
  111. (void) cpath_layer;
  112. (void) filename;
  113. (void) lineno;
  114. return 0;
  115. }
  116. /* Helper: from a set of options in conf, configure a service which will add
  117. * it to the staging list of the HS subsytem. */
  118. static int
  119. helper_config_service(const char *conf)
  120. {
  121. int ret = 0;
  122. or_options_t *options = NULL;
  123. tt_assert(conf);
  124. options = helper_parse_options(conf);
  125. tt_assert(options);
  126. ret = hs_config_service_all(options, 0);
  127. done:
  128. or_options_free(options);
  129. return ret;
  130. }
  131. /* Test: Ensure that setting up rendezvous circuits works correctly. */
  132. static void
  133. test_e2e_rend_circuit_setup(void *arg)
  134. {
  135. ed25519_public_key_t service_pk;
  136. origin_circuit_t *or_circ;
  137. int retval;
  138. /** In this test we create a v3 prop224 service-side rendezvous circuit.
  139. * We simulate an HS ntor key exchange with a client, and check that
  140. * the circuit was setup correctly and is ready to accept rendezvous data */
  141. (void) arg;
  142. /* Now make dummy circuit */
  143. {
  144. or_circ = origin_circuit_new();
  145. or_circ->base_.purpose = CIRCUIT_PURPOSE_S_CONNECT_REND;
  146. or_circ->build_state = tor_malloc_zero(sizeof(cpath_build_state_t));
  147. or_circ->build_state->is_internal = 1;
  148. /* prop224: Setup hs conn identifier on the stream */
  149. ed25519_secret_key_t sk;
  150. tt_int_op(0, OP_EQ, ed25519_secret_key_generate(&sk, 0));
  151. tt_int_op(0, OP_EQ, ed25519_public_key_generate(&service_pk, &sk));
  152. or_circ->hs_ident = hs_ident_circuit_new(&service_pk);
  153. TO_CIRCUIT(or_circ)->state = CIRCUIT_STATE_OPEN;
  154. }
  155. /* Check number of hops */
  156. retval = cpath_get_n_hops(&or_circ->cpath);
  157. tt_int_op(retval, OP_EQ, 0);
  158. /* Setup the circuit: do the ntor key exchange */
  159. {
  160. uint8_t ntor_key_seed[DIGEST256_LEN] = {2};
  161. retval = hs_circuit_setup_e2e_rend_circ(or_circ,
  162. ntor_key_seed, sizeof(ntor_key_seed),
  163. 1);
  164. tt_int_op(retval, OP_EQ, 0);
  165. }
  166. /* See that a hop was added to the circuit's cpath */
  167. retval = cpath_get_n_hops(&or_circ->cpath);
  168. tt_int_op(retval, OP_EQ, 1);
  169. /* Check the digest algo */
  170. tt_int_op(
  171. crypto_digest_get_algorithm(or_circ->cpath->pvt_crypto.f_digest),
  172. OP_EQ, DIGEST_SHA3_256);
  173. tt_int_op(
  174. crypto_digest_get_algorithm(or_circ->cpath->pvt_crypto.b_digest),
  175. OP_EQ, DIGEST_SHA3_256);
  176. tt_assert(or_circ->cpath->pvt_crypto.f_crypto);
  177. tt_assert(or_circ->cpath->pvt_crypto.b_crypto);
  178. /* Ensure that circ purpose was changed */
  179. tt_int_op(or_circ->base_.purpose, OP_EQ, CIRCUIT_PURPOSE_S_REND_JOINED);
  180. done:
  181. circuit_free_(TO_CIRCUIT(or_circ));
  182. }
  183. /* Helper: Return a newly allocated and initialized origin circuit with
  184. * purpose and flags. A default HS identifier is set to an ed25519
  185. * authentication key for introduction point. */
  186. static origin_circuit_t *
  187. helper_create_origin_circuit(int purpose, int flags)
  188. {
  189. origin_circuit_t *circ = NULL;
  190. circ = origin_circuit_init(purpose, flags);
  191. tor_assert(circ);
  192. circ->cpath = tor_malloc_zero(sizeof(crypt_path_t));
  193. circ->cpath->magic = CRYPT_PATH_MAGIC;
  194. circ->cpath->state = CPATH_STATE_OPEN;
  195. circ->cpath->package_window = circuit_initial_package_window();
  196. circ->cpath->deliver_window = CIRCWINDOW_START;
  197. circ->cpath->prev = circ->cpath;
  198. /* Random nonce. */
  199. crypto_rand(circ->cpath->prev->rend_circ_nonce, DIGEST_LEN);
  200. /* Create a default HS identifier. */
  201. circ->hs_ident = tor_malloc_zero(sizeof(hs_ident_circuit_t));
  202. return circ;
  203. }
  204. /* Helper: Return a newly allocated authorized client object with
  205. * and a newly generated public key. */
  206. static hs_service_authorized_client_t *
  207. helper_create_authorized_client(void)
  208. {
  209. int ret;
  210. hs_service_authorized_client_t *client;
  211. curve25519_secret_key_t seckey;
  212. client = tor_malloc_zero(sizeof(hs_service_authorized_client_t));
  213. ret = curve25519_secret_key_generate(&seckey, 0);
  214. tt_int_op(ret, OP_EQ, 0);
  215. curve25519_public_key_generate(&client->client_pk, &seckey);
  216. done:
  217. return client;
  218. }
  219. /* Helper: Return a newly allocated authorized client object with the
  220. * same client name and the same public key as the given client. */
  221. static hs_service_authorized_client_t *
  222. helper_clone_authorized_client(const hs_service_authorized_client_t *client)
  223. {
  224. hs_service_authorized_client_t *client_out;
  225. tor_assert(client);
  226. client_out = tor_malloc_zero(sizeof(hs_service_authorized_client_t));
  227. memcpy(client_out->client_pk.public_key,
  228. client->client_pk.public_key, CURVE25519_PUBKEY_LEN);
  229. return client_out;
  230. }
  231. /* Helper: Return a newly allocated service object with the identity keypair
  232. * sets and the current descriptor. Then register it to the global map.
  233. * Caller should use hs_free_all() to free this service or remove it from the
  234. * global map before freeing. */
  235. static hs_service_t *
  236. helper_create_service(void)
  237. {
  238. /* Set a service for this circuit. */
  239. hs_service_t *service = hs_service_new(get_options());
  240. tor_assert(service);
  241. service->config.version = HS_VERSION_THREE;
  242. ed25519_secret_key_generate(&service->keys.identity_sk, 0);
  243. ed25519_public_key_generate(&service->keys.identity_pk,
  244. &service->keys.identity_sk);
  245. service->desc_current = service_descriptor_new();
  246. tt_assert(service->desc_current);
  247. /* Register service to global map. */
  248. int ret = register_service(get_hs_service_map(), service);
  249. tt_int_op(ret, OP_EQ, 0);
  250. done:
  251. return service;
  252. }
  253. /* Helper: Deallocate a given service object, its child objects and
  254. * remove it from onion service map.
  255. * */
  256. static void
  257. helper_destroy_service(hs_service_t *service)
  258. {
  259. if (!service)
  260. return;
  261. remove_service(get_hs_service_map(), service);
  262. hs_service_free(service);
  263. }
  264. /* Helper: Return a newly allocated service object with clients. */
  265. static hs_service_t *
  266. helper_create_service_with_clients(int num_clients)
  267. {
  268. int i;
  269. hs_service_t *service = helper_create_service();
  270. tt_assert(service);
  271. service->config.is_client_auth_enabled = 1;
  272. service->config.clients = smartlist_new();
  273. for (i = 0; i < num_clients; i++) {
  274. hs_service_authorized_client_t *client;
  275. client = helper_create_authorized_client();
  276. smartlist_add(service->config.clients, client);
  277. }
  278. done:
  279. return service;
  280. }
  281. /* Helper: Return a newly allocated service intro point with two link
  282. * specifiers, one IPv4 and one legacy ID set to As. */
  283. static hs_service_intro_point_t *
  284. helper_create_service_ip(void)
  285. {
  286. link_specifier_t *ls;
  287. hs_service_intro_point_t *ip = service_intro_point_new(NULL);
  288. tor_assert(ip);
  289. /* Add a first unused link specifier. */
  290. ls = link_specifier_new();
  291. link_specifier_set_ls_type(ls, LS_IPV4);
  292. smartlist_add(ip->base.link_specifiers, ls);
  293. /* Add a second link specifier used by a test. */
  294. ls = link_specifier_new();
  295. link_specifier_set_ls_type(ls, LS_LEGACY_ID);
  296. memset(link_specifier_getarray_un_legacy_id(ls), 'A',
  297. link_specifier_getlen_un_legacy_id(ls));
  298. smartlist_add(ip->base.link_specifiers, ls);
  299. return ip;
  300. }
  301. static void
  302. test_load_keys(void *arg)
  303. {
  304. int ret;
  305. char *conf = NULL;
  306. char *hsdir_v2 = tor_strdup(get_fname("hs2"));
  307. char *hsdir_v3 = tor_strdup(get_fname("hs3"));
  308. char addr[HS_SERVICE_ADDR_LEN_BASE32 + 1];
  309. (void) arg;
  310. /* We'll register two services, a v2 and a v3, then we'll load keys and
  311. * validate that both are in a correct state. */
  312. hs_init();
  313. #define conf_fmt \
  314. "HiddenServiceDir %s\n" \
  315. "HiddenServiceVersion %d\n" \
  316. "HiddenServicePort 65535\n"
  317. /* v2 service. */
  318. tor_asprintf(&conf, conf_fmt, hsdir_v2, HS_VERSION_TWO);
  319. ret = helper_config_service(conf);
  320. tor_free(conf);
  321. tt_int_op(ret, OP_EQ, 0);
  322. /* This one should now be registered into the v2 list. */
  323. tt_int_op(get_hs_service_staging_list_size(), OP_EQ, 0);
  324. tt_int_op(rend_num_services(), OP_EQ, 1);
  325. /* v3 service. */
  326. tor_asprintf(&conf, conf_fmt, hsdir_v3, HS_VERSION_THREE);
  327. ret = helper_config_service(conf);
  328. tor_free(conf);
  329. tt_int_op(ret, OP_EQ, 0);
  330. /* It's in staging? */
  331. tt_int_op(get_hs_service_staging_list_size(), OP_EQ, 1);
  332. #undef conf_fmt
  333. /* Load the keys for these. After that, the v3 service should be registered
  334. * in the global map. */
  335. hs_service_load_all_keys();
  336. tt_int_op(get_hs_service_map_size(), OP_EQ, 1);
  337. hs_service_t *s = get_first_service();
  338. tt_assert(s);
  339. /* Ok we have the service object. Validate few things. */
  340. tt_assert(!fast_mem_is_zero(s->onion_address, sizeof(s->onion_address)));
  341. tt_int_op(hs_address_is_valid(s->onion_address), OP_EQ, 1);
  342. tt_assert(!fast_mem_is_zero((char *) s->keys.identity_sk.seckey,
  343. ED25519_SECKEY_LEN));
  344. tt_assert(!fast_mem_is_zero((char *) s->keys.identity_pk.pubkey,
  345. ED25519_PUBKEY_LEN));
  346. /* Check onion address from identity key. */
  347. hs_build_address(&s->keys.identity_pk, s->config.version, addr);
  348. tt_int_op(hs_address_is_valid(addr), OP_EQ, 1);
  349. tt_str_op(addr, OP_EQ, s->onion_address);
  350. /* Check that the is_client_auth_enabled is not set. */
  351. tt_assert(!s->config.is_client_auth_enabled);
  352. done:
  353. tor_free(hsdir_v2);
  354. tor_free(hsdir_v3);
  355. hs_free_all();
  356. }
  357. static void
  358. test_client_filename_is_valid(void *arg)
  359. {
  360. (void) arg;
  361. /* Valid file name. */
  362. tt_assert(client_filename_is_valid("a.auth"));
  363. /* Valid file name with special character. */
  364. tt_assert(client_filename_is_valid("a-.auth"));
  365. /* Invalid extension. */
  366. tt_assert(!client_filename_is_valid("a.ath"));
  367. /* Nothing before the extension. */
  368. tt_assert(!client_filename_is_valid(".auth"));
  369. done:
  370. ;
  371. }
  372. static void
  373. test_parse_authorized_client(void *arg)
  374. {
  375. hs_service_authorized_client_t *client = NULL;
  376. (void) arg;
  377. /* Valid authorized client. */
  378. client = parse_authorized_client(
  379. "descriptor:x25519:dz4q5xqlb4ldnbs72iarrml4ephk3du4i7o2cgiva5lwr6wkquja");
  380. tt_assert(client);
  381. /* Wrong number of fields. */
  382. tt_assert(!parse_authorized_client("a:b:c:d:e"));
  383. /* Wrong auth type. */
  384. tt_assert(!parse_authorized_client(
  385. "x:x25519:dz4q5xqlb4ldnbs72iarrml4ephk3du4i7o2cgiva5lwr6wkquja"));
  386. /* Wrong key type. */
  387. tt_assert(!parse_authorized_client(
  388. "descriptor:x:dz4q5xqlb4ldnbs72iarrml4ephk3du4i7o2cgiva5lwr6wkquja"));
  389. /* Some malformed string. */
  390. tt_assert(!parse_authorized_client("descriptor:x25519:aa=="));
  391. tt_assert(!parse_authorized_client("descriptor:"));
  392. tt_assert(!parse_authorized_client("descriptor:x25519"));
  393. tt_assert(!parse_authorized_client("descriptor:x25519:"));
  394. tt_assert(!parse_authorized_client(""));
  395. done:
  396. service_authorized_client_free(client);
  397. }
  398. static char *
  399. mock_read_file_to_str(const char *filename, int flags, struct stat *stat_out)
  400. {
  401. char *ret = NULL;
  402. (void) flags;
  403. (void) stat_out;
  404. if (!strcmp(filename, get_fname("hs3" PATH_SEPARATOR
  405. "authorized_clients" PATH_SEPARATOR
  406. "client1.auth"))) {
  407. ret = tor_strdup("descriptor:x25519:"
  408. "dz4q5xqlb4ldnbs72iarrml4ephk3du4i7o2cgiva5lwr6wkquja");
  409. goto done;
  410. }
  411. if (!strcmp(filename, get_fname("hs3" PATH_SEPARATOR
  412. "authorized_clients" PATH_SEPARATOR
  413. "dummy.xxx"))) {
  414. ret = tor_strdup("descriptor:x25519:"
  415. "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx");
  416. goto done;
  417. }
  418. if (!strcmp(filename, get_fname("hs3" PATH_SEPARATOR
  419. "authorized_clients" PATH_SEPARATOR
  420. "client2.auth"))) {
  421. ret = tor_strdup("descriptor:x25519:"
  422. "okoi2gml3wd6x7jganlk5d66xxyjgg24sxw4y7javx4giqr66zta");
  423. goto done;
  424. }
  425. done:
  426. return ret;
  427. }
  428. static smartlist_t *
  429. mock_tor_listdir(const char *dirname)
  430. {
  431. smartlist_t *file_list = smartlist_new();
  432. (void) dirname;
  433. smartlist_add(file_list, tor_strdup("client1.auth"));
  434. smartlist_add(file_list, tor_strdup("dummy.xxx"));
  435. smartlist_add(file_list, tor_strdup("client2.auth"));
  436. return file_list;
  437. }
  438. static void
  439. test_load_keys_with_client_auth(void *arg)
  440. {
  441. int ret;
  442. char *conf = NULL;
  443. smartlist_t *pubkey_b32_list = smartlist_new();
  444. char *hsdir_v3 = tor_strdup(get_fname("hs3"));
  445. hs_service_t *service;
  446. (void) arg;
  447. hs_init();
  448. smartlist_add(pubkey_b32_list, tor_strdup(
  449. "dz4q5xqlb4ldnbs72iarrml4ephk3du4i7o2cgiva5lwr6wkquja"));
  450. smartlist_add(pubkey_b32_list, tor_strdup(
  451. "okoi2gml3wd6x7jganlk5d66xxyjgg24sxw4y7javx4giqr66zta"));
  452. #define conf_fmt \
  453. "HiddenServiceDir %s\n" \
  454. "HiddenServiceVersion %d\n" \
  455. "HiddenServicePort 65534\n"
  456. tor_asprintf(&conf, conf_fmt, hsdir_v3, HS_VERSION_THREE);
  457. ret = helper_config_service(conf);
  458. tor_free(conf);
  459. tt_int_op(ret, OP_EQ, 0);
  460. /* It's in staging? */
  461. tt_int_op(get_hs_service_staging_list_size(), OP_EQ, 1);
  462. #undef conf_fmt
  463. MOCK(read_file_to_str, mock_read_file_to_str);
  464. MOCK(tor_listdir, mock_tor_listdir);
  465. /* Load the keys for these. After that, the v3 service should be registered
  466. * in the global map. */
  467. hs_service_load_all_keys();
  468. tt_int_op(get_hs_service_map_size(), OP_EQ, 1);
  469. service = get_first_service();
  470. tt_assert(service);
  471. tt_assert(service->config.clients);
  472. tt_int_op(smartlist_len(service->config.clients), OP_EQ,
  473. smartlist_len(pubkey_b32_list));
  474. /* Test that the is_client_auth_enabled flag is set. */
  475. tt_assert(service->config.is_client_auth_enabled);
  476. /* Test that the keys in clients are correct. */
  477. SMARTLIST_FOREACH_BEGIN(pubkey_b32_list, char *, pubkey_b32) {
  478. curve25519_public_key_t pubkey;
  479. /* This flag will be set if the key is found in clients. */
  480. int is_found = 0;
  481. base32_decode((char *) pubkey.public_key, sizeof(pubkey.public_key),
  482. pubkey_b32, strlen(pubkey_b32));
  483. SMARTLIST_FOREACH_BEGIN(service->config.clients,
  484. hs_service_authorized_client_t *, client) {
  485. if (tor_memeq(&pubkey, &client->client_pk, sizeof(pubkey))) {
  486. is_found = 1;
  487. break;
  488. }
  489. } SMARTLIST_FOREACH_END(client);
  490. tt_assert(is_found);
  491. } SMARTLIST_FOREACH_END(pubkey_b32);
  492. done:
  493. SMARTLIST_FOREACH(pubkey_b32_list, char *, s, tor_free(s));
  494. smartlist_free(pubkey_b32_list);
  495. tor_free(hsdir_v3);
  496. hs_free_all();
  497. UNMOCK(read_file_to_str);
  498. UNMOCK(tor_listdir);
  499. }
  500. static void
  501. test_access_service(void *arg)
  502. {
  503. int ret;
  504. char *conf = NULL;
  505. char *hsdir_v3 = tor_strdup(get_fname("hs3"));
  506. hs_service_ht *global_map;
  507. hs_service_t *s = NULL;
  508. (void) arg;
  509. /* We'll register two services, a v2 and a v3, then we'll load keys and
  510. * validate that both are in a correct state. */
  511. hs_init();
  512. #define conf_fmt \
  513. "HiddenServiceDir %s\n" \
  514. "HiddenServiceVersion %d\n" \
  515. "HiddenServicePort 65535\n"
  516. /* v3 service. */
  517. tor_asprintf(&conf, conf_fmt, hsdir_v3, HS_VERSION_THREE);
  518. ret = helper_config_service(conf);
  519. tor_free(conf);
  520. tt_int_op(ret, OP_EQ, 0);
  521. /* It's in staging? */
  522. tt_int_op(get_hs_service_staging_list_size(), OP_EQ, 1);
  523. /* Load the keys for these. After that, the v3 service should be registered
  524. * in the global map. */
  525. hs_service_load_all_keys();
  526. tt_int_op(get_hs_service_map_size(), OP_EQ, 1);
  527. s = get_first_service();
  528. tt_assert(s);
  529. global_map = get_hs_service_map();
  530. tt_assert(global_map);
  531. /* From here, we'll try the service accessors. */
  532. hs_service_t *query = find_service(global_map, &s->keys.identity_pk);
  533. tt_assert(query);
  534. tt_mem_op(query, OP_EQ, s, sizeof(hs_service_t));
  535. /* Remove service, check if it actually works and then put it back. */
  536. remove_service(global_map, s);
  537. tt_int_op(get_hs_service_map_size(), OP_EQ, 0);
  538. query = find_service(global_map, &s->keys.identity_pk);
  539. tt_ptr_op(query, OP_EQ, NULL);
  540. /* Register back the service in the map. */
  541. ret = register_service(global_map, s);
  542. tt_int_op(ret, OP_EQ, 0);
  543. tt_int_op(get_hs_service_map_size(), OP_EQ, 1);
  544. /* Twice should fail. */
  545. ret = register_service(global_map, s);
  546. tt_int_op(ret, OP_EQ, -1);
  547. /* Remove service from map so we don't double free on cleanup. */
  548. remove_service(global_map, s);
  549. tt_int_op(get_hs_service_map_size(), OP_EQ, 0);
  550. query = find_service(global_map, &s->keys.identity_pk);
  551. tt_ptr_op(query, OP_EQ, NULL);
  552. /* Let's try to remove twice for fun. */
  553. setup_full_capture_of_logs(LOG_WARN);
  554. remove_service(global_map, s);
  555. expect_log_msg_containing("Could not find service in the global map");
  556. teardown_capture_of_logs();
  557. done:
  558. hs_service_free(s);
  559. tor_free(hsdir_v3);
  560. hs_free_all();
  561. }
  562. /** Test that we can create intro point objects, index them and find them */
  563. static void
  564. test_service_intro_point(void *arg)
  565. {
  566. hs_service_t *service = NULL;
  567. hs_service_intro_point_t *ip = NULL;
  568. (void) arg;
  569. /* Test simple creation of an object. */
  570. {
  571. time_t now = time(NULL);
  572. ip = helper_create_service_ip();
  573. tt_assert(ip);
  574. /* Make sure the authentication keypair is not zeroes. */
  575. tt_int_op(fast_mem_is_zero((const char *) &ip->auth_key_kp,
  576. sizeof(ed25519_keypair_t)), OP_EQ, 0);
  577. /* The introduce2_max MUST be in that range. */
  578. tt_u64_op(ip->introduce2_max, OP_GE,
  579. INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS);
  580. tt_u64_op(ip->introduce2_max, OP_LE,
  581. INTRO_POINT_MAX_LIFETIME_INTRODUCTIONS);
  582. /* Time to expire MUST also be in that range. We subtract 500 seconds
  583. * because there could be a gap between setting now and the time taken in
  584. * service_intro_point_new. On ARM and other older CPUs, it can be
  585. * surprisingly slow... */
  586. tt_u64_op(ip->time_to_expire, OP_GE,
  587. now + INTRO_POINT_LIFETIME_MIN_SECONDS - 500);
  588. /* We add 500 seconds, because this time we're testing against the
  589. * maximum allowed time. */
  590. tt_u64_op(ip->time_to_expire, OP_LE,
  591. now + INTRO_POINT_LIFETIME_MAX_SECONDS + 500);
  592. tt_assert(ip->replay_cache);
  593. tt_assert(ip->base.link_specifiers);
  594. /* By default, this is NOT a legacy object. */
  595. tt_int_op(ip->base.is_only_legacy, OP_EQ, 0);
  596. }
  597. /* Test functions that uses a service intropoints map with that previously
  598. * created object (non legacy). */
  599. {
  600. ed25519_public_key_t garbage = { {0} };
  601. hs_service_intro_point_t *query;
  602. service = hs_service_new(get_options());
  603. tt_assert(service);
  604. service->desc_current = service_descriptor_new();
  605. tt_assert(service->desc_current);
  606. /* Add intropoint to descriptor map. */
  607. service_intro_point_add(service->desc_current->intro_points.map, ip);
  608. query = service_intro_point_find(service, &ip->auth_key_kp.pubkey);
  609. tt_mem_op(query, OP_EQ, ip, sizeof(hs_service_intro_point_t));
  610. query = service_intro_point_find(service, &garbage);
  611. tt_ptr_op(query, OP_EQ, NULL);
  612. /* While at it, can I find the descriptor with the intro point? */
  613. hs_service_descriptor_t *desc_lookup =
  614. service_desc_find_by_intro(service, ip);
  615. tt_mem_op(service->desc_current, OP_EQ, desc_lookup,
  616. sizeof(hs_service_descriptor_t));
  617. /* Remove object from service descriptor and make sure it is out. */
  618. service_intro_point_remove(service, ip);
  619. query = service_intro_point_find(service, &ip->auth_key_kp.pubkey);
  620. tt_ptr_op(query, OP_EQ, NULL);
  621. }
  622. done:
  623. /* If the test succeed, this object is no longer referenced in the service
  624. * so we can free it without use after free. Else, it might explode because
  625. * it's still in the service descriptor map. */
  626. service_intro_point_free(ip);
  627. hs_service_free(service);
  628. }
  629. static node_t mock_node;
  630. static const node_t *
  631. mock_node_get_by_id(const char *digest)
  632. {
  633. (void) digest;
  634. memset(mock_node.identity, 'A', DIGEST_LEN);
  635. /* Only return the matchin identity of As */
  636. if (!tor_memcmp(mock_node.identity, digest, DIGEST_LEN)) {
  637. return &mock_node;
  638. }
  639. return NULL;
  640. }
  641. static void
  642. test_helper_functions(void *arg)
  643. {
  644. int ret;
  645. hs_service_t *service = NULL;
  646. hs_service_intro_point_t *ip = NULL;
  647. hs_ident_circuit_t ident;
  648. (void) arg;
  649. MOCK(node_get_by_id, mock_node_get_by_id);
  650. hs_service_init();
  651. time_t now = time(NULL);
  652. update_approx_time(now);
  653. service = helper_create_service();
  654. ip = helper_create_service_ip();
  655. /* Immediately add the intro point to the service so the free service at the
  656. * end cleans it as well. */
  657. service_intro_point_add(service->desc_current->intro_points.map, ip);
  658. /* Setup the circuit identifier. */
  659. ed25519_pubkey_copy(&ident.intro_auth_pk, &ip->auth_key_kp.pubkey);
  660. ed25519_pubkey_copy(&ident.identity_pk, &service->keys.identity_pk);
  661. /* Testing get_objects_from_ident(). */
  662. {
  663. hs_service_t *s_lookup = NULL;
  664. hs_service_intro_point_t *ip_lookup = NULL;
  665. hs_service_descriptor_t *desc_lookup = NULL;
  666. get_objects_from_ident(&ident, &s_lookup, &ip_lookup, &desc_lookup);
  667. tt_mem_op(s_lookup, OP_EQ, service, sizeof(hs_service_t));
  668. tt_mem_op(ip_lookup, OP_EQ, ip, sizeof(hs_service_intro_point_t));
  669. tt_mem_op(desc_lookup, OP_EQ, service->desc_current,
  670. sizeof(hs_service_descriptor_t));
  671. /* Reset */
  672. s_lookup = NULL; ip_lookup = NULL; desc_lookup = NULL;
  673. /* NULL parameter should work. */
  674. get_objects_from_ident(&ident, NULL, &ip_lookup, &desc_lookup);
  675. tt_mem_op(ip_lookup, OP_EQ, ip, sizeof(hs_service_intro_point_t));
  676. tt_mem_op(desc_lookup, OP_EQ, service->desc_current,
  677. sizeof(hs_service_descriptor_t));
  678. /* Reset. */
  679. s_lookup = NULL; ip_lookup = NULL; desc_lookup = NULL;
  680. /* Break the ident and we should find nothing. */
  681. memset(&ident, 0, sizeof(ident));
  682. get_objects_from_ident(&ident, &s_lookup, &ip_lookup, &desc_lookup);
  683. tt_ptr_op(s_lookup, OP_EQ, NULL);
  684. tt_ptr_op(ip_lookup, OP_EQ, NULL);
  685. tt_ptr_op(desc_lookup, OP_EQ, NULL);
  686. }
  687. /* Testing get_node_from_intro_point() */
  688. {
  689. const node_t *node = get_node_from_intro_point(ip);
  690. tt_ptr_op(node, OP_EQ, &mock_node);
  691. SMARTLIST_FOREACH_BEGIN(ip->base.link_specifiers,
  692. link_specifier_t *, ls) {
  693. if (link_specifier_get_ls_type(ls) == LS_LEGACY_ID) {
  694. /* Change legacy id in link specifier which is not the mock node. */
  695. memset(link_specifier_getarray_un_legacy_id(ls), 'B',
  696. link_specifier_getlen_un_legacy_id(ls));
  697. }
  698. } SMARTLIST_FOREACH_END(ls);
  699. node = get_node_from_intro_point(ip);
  700. tt_ptr_op(node, OP_EQ, NULL);
  701. }
  702. /* Testing can_service_launch_intro_circuit() */
  703. {
  704. /* Put the start of the retry period back in time, we should be allowed.
  705. * to launch intro circuit. */
  706. service->state.num_intro_circ_launched = 2;
  707. service->state.intro_circ_retry_started_time =
  708. (now - INTRO_CIRC_RETRY_PERIOD - 1);
  709. ret = can_service_launch_intro_circuit(service, now);
  710. tt_int_op(ret, OP_EQ, 1);
  711. tt_u64_op(service->state.intro_circ_retry_started_time, OP_EQ, now);
  712. tt_u64_op(service->state.num_intro_circ_launched, OP_EQ, 0);
  713. /* Call it again, we should still be allowed because we are under
  714. * MAX_INTRO_CIRCS_PER_PERIOD which been set to 0 previously. */
  715. ret = can_service_launch_intro_circuit(service, now);
  716. tt_int_op(ret, OP_EQ, 1);
  717. tt_u64_op(service->state.intro_circ_retry_started_time, OP_EQ, now);
  718. tt_u64_op(service->state.num_intro_circ_launched, OP_EQ, 0);
  719. /* Too many intro circuit launched means we are not allowed. */
  720. service->state.num_intro_circ_launched = 20;
  721. ret = can_service_launch_intro_circuit(service, now);
  722. tt_int_op(ret, OP_EQ, 0);
  723. }
  724. /* Testing intro_point_should_expire(). */
  725. {
  726. /* Just some basic test of the current state. */
  727. tt_u64_op(ip->introduce2_max, OP_GE,
  728. INTRO_POINT_MIN_LIFETIME_INTRODUCTIONS);
  729. tt_u64_op(ip->introduce2_max, OP_LE,
  730. INTRO_POINT_MAX_LIFETIME_INTRODUCTIONS);
  731. tt_u64_op(ip->time_to_expire, OP_GE,
  732. now + INTRO_POINT_LIFETIME_MIN_SECONDS);
  733. tt_u64_op(ip->time_to_expire, OP_LE,
  734. now + INTRO_POINT_LIFETIME_MAX_SECONDS);
  735. /* This newly created IP from above shouldn't expire now. */
  736. ret = intro_point_should_expire(ip, now);
  737. tt_int_op(ret, OP_EQ, 0);
  738. /* Maximum number of INTRODUCE2 cell reached, it should expire. */
  739. ip->introduce2_count = INTRO_POINT_MAX_LIFETIME_INTRODUCTIONS + 1;
  740. ret = intro_point_should_expire(ip, now);
  741. tt_int_op(ret, OP_EQ, 1);
  742. ip->introduce2_count = 0;
  743. /* It should expire if time to expire has been reached. */
  744. ip->time_to_expire = now - 1000;
  745. ret = intro_point_should_expire(ip, now);
  746. tt_int_op(ret, OP_EQ, 1);
  747. }
  748. done:
  749. /* This will free the service and all objects associated to it. */
  750. if (service) {
  751. remove_service(get_hs_service_map(), service);
  752. hs_service_free(service);
  753. }
  754. hs_service_free_all();
  755. UNMOCK(node_get_by_id);
  756. }
  757. /** Test that we do the right operations when an intro circuit opens */
  758. static void
  759. test_intro_circuit_opened(void *arg)
  760. {
  761. int flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
  762. hs_service_t *service = NULL;
  763. origin_circuit_t *circ = NULL;
  764. (void) arg;
  765. hs_init();
  766. MOCK(circuit_mark_for_close_, mock_circuit_mark_for_close);
  767. MOCK(relay_send_command_from_edge_, mock_relay_send_command_from_edge);
  768. circ = helper_create_origin_circuit(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO,
  769. flags);
  770. /* No service associated with this circuit. */
  771. setup_full_capture_of_logs(LOG_WARN);
  772. hs_service_circuit_has_opened(circ);
  773. expect_log_msg_containing("Unknown service identity key");
  774. teardown_capture_of_logs();
  775. /* Set a service for this circuit. */
  776. {
  777. service = helper_create_service();
  778. ed25519_pubkey_copy(&circ->hs_ident->identity_pk,
  779. &service->keys.identity_pk);
  780. /* No intro point associated with this circuit. */
  781. setup_full_capture_of_logs(LOG_WARN);
  782. hs_service_circuit_has_opened(circ);
  783. expect_log_msg_containing("Unknown introduction point auth key");
  784. teardown_capture_of_logs();
  785. }
  786. /* Set an IP object now for this circuit. */
  787. {
  788. hs_service_intro_point_t *ip = helper_create_service_ip();
  789. service_intro_point_add(service->desc_current->intro_points.map, ip);
  790. /* Update ident to contain the intro point auth key. */
  791. ed25519_pubkey_copy(&circ->hs_ident->intro_auth_pk,
  792. &ip->auth_key_kp.pubkey);
  793. }
  794. /* This one should go all the way. */
  795. setup_full_capture_of_logs(LOG_INFO);
  796. hs_service_circuit_has_opened(circ);
  797. expect_log_msg_containing("Introduction circuit 0 established for service");
  798. teardown_capture_of_logs();
  799. done:
  800. circuit_free_(TO_CIRCUIT(circ));
  801. if (service) {
  802. remove_service(get_hs_service_map(), service);
  803. hs_service_free(service);
  804. }
  805. hs_free_all();
  806. UNMOCK(circuit_mark_for_close_);
  807. UNMOCK(relay_send_command_from_edge_);
  808. }
  809. /** Test the operations we do on a circuit after we learn that we successfully
  810. * established an intro point on it */
  811. static void
  812. test_intro_established(void *arg)
  813. {
  814. int ret;
  815. int flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
  816. uint8_t payload[RELAY_PAYLOAD_SIZE] = {0};
  817. origin_circuit_t *circ = NULL;
  818. hs_service_t *service = NULL;
  819. hs_service_intro_point_t *ip = NULL;
  820. (void) arg;
  821. hs_init();
  822. MOCK(circuit_mark_for_close_, mock_circuit_mark_for_close);
  823. circ = helper_create_origin_circuit(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO,
  824. flags);
  825. tt_assert(circ);
  826. /* Test a wrong purpose. */
  827. TO_CIRCUIT(circ)->purpose = CIRCUIT_PURPOSE_S_INTRO;
  828. setup_full_capture_of_logs(LOG_WARN);
  829. ret = hs_service_receive_intro_established(circ, payload, sizeof(payload));
  830. tt_int_op(ret, OP_EQ, -1);
  831. expect_log_msg_containing("Received an INTRO_ESTABLISHED cell on a "
  832. "non introduction circuit of purpose");
  833. teardown_capture_of_logs();
  834. /* Back to normal. */
  835. TO_CIRCUIT(circ)->purpose = CIRCUIT_PURPOSE_S_ESTABLISH_INTRO;
  836. /* No service associated to it. */
  837. setup_full_capture_of_logs(LOG_WARN);
  838. ret = hs_service_receive_intro_established(circ, payload, sizeof(payload));
  839. tt_int_op(ret, OP_EQ, -1);
  840. expect_log_msg_containing("Unknown service identity key");
  841. teardown_capture_of_logs();
  842. /* Set a service for this circuit. */
  843. service = helper_create_service();
  844. ed25519_pubkey_copy(&circ->hs_ident->identity_pk,
  845. &service->keys.identity_pk);
  846. /* No introduction point associated to it. */
  847. setup_full_capture_of_logs(LOG_WARN);
  848. ret = hs_service_receive_intro_established(circ, payload, sizeof(payload));
  849. tt_int_op(ret, OP_EQ, -1);
  850. expect_log_msg_containing("Introduction circuit established without an "
  851. "intro point object on circuit");
  852. teardown_capture_of_logs();
  853. /* Set an IP object now for this circuit. */
  854. {
  855. ip = helper_create_service_ip();
  856. service_intro_point_add(service->desc_current->intro_points.map, ip);
  857. /* Update ident to contain the intro point auth key. */
  858. ed25519_pubkey_copy(&circ->hs_ident->intro_auth_pk,
  859. &ip->auth_key_kp.pubkey);
  860. }
  861. /* Send an empty payload. INTRO_ESTABLISHED cells are basically zeroes. */
  862. ret = hs_service_receive_intro_established(circ, payload, sizeof(payload));
  863. tt_int_op(ret, OP_EQ, 0);
  864. tt_u64_op(ip->circuit_established, OP_EQ, 1);
  865. tt_int_op(TO_CIRCUIT(circ)->purpose, OP_EQ, CIRCUIT_PURPOSE_S_INTRO);
  866. done:
  867. if (circ)
  868. circuit_free_(TO_CIRCUIT(circ));
  869. if (service) {
  870. remove_service(get_hs_service_map(), service);
  871. hs_service_free(service);
  872. }
  873. hs_free_all();
  874. UNMOCK(circuit_mark_for_close_);
  875. }
  876. /** Check the operations we do on a rendezvous circuit after we learn it's
  877. * open */
  878. static void
  879. test_rdv_circuit_opened(void *arg)
  880. {
  881. int flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
  882. origin_circuit_t *circ = NULL;
  883. hs_service_t *service = NULL;
  884. (void) arg;
  885. hs_init();
  886. MOCK(circuit_mark_for_close_, mock_circuit_mark_for_close);
  887. MOCK(relay_send_command_from_edge_, mock_relay_send_command_from_edge);
  888. circ = helper_create_origin_circuit(CIRCUIT_PURPOSE_S_CONNECT_REND, flags);
  889. crypto_rand((char *) circ->hs_ident->rendezvous_cookie, REND_COOKIE_LEN);
  890. crypto_rand((char *) circ->hs_ident->rendezvous_handshake_info,
  891. sizeof(circ->hs_ident->rendezvous_handshake_info));
  892. /* No service associated with this circuit. */
  893. setup_full_capture_of_logs(LOG_WARN);
  894. hs_service_circuit_has_opened(circ);
  895. expect_log_msg_containing("Unknown service identity key");
  896. teardown_capture_of_logs();
  897. /* This should be set to a non zero timestamp. */
  898. tt_u64_op(TO_CIRCUIT(circ)->timestamp_dirty, OP_NE, 0);
  899. /* Set a service for this circuit. */
  900. service = helper_create_service();
  901. ed25519_pubkey_copy(&circ->hs_ident->identity_pk,
  902. &service->keys.identity_pk);
  903. /* Should be all good. */
  904. hs_service_circuit_has_opened(circ);
  905. tt_int_op(TO_CIRCUIT(circ)->purpose, OP_EQ, CIRCUIT_PURPOSE_S_REND_JOINED);
  906. done:
  907. circuit_free_(TO_CIRCUIT(circ));
  908. if (service) {
  909. remove_service(get_hs_service_map(), service);
  910. hs_service_free(service);
  911. }
  912. hs_free_all();
  913. UNMOCK(circuit_mark_for_close_);
  914. UNMOCK(relay_send_command_from_edge_);
  915. }
  916. static void
  917. mock_assert_circuit_ok(const circuit_t *c)
  918. {
  919. (void) c;
  920. return;
  921. }
  922. /** Test for the general mechanism for closing intro circs.
  923. * Also a way to identify that #23603 has been fixed. */
  924. static void
  925. test_closing_intro_circs(void *arg)
  926. {
  927. hs_service_t *service = NULL;
  928. hs_service_intro_point_t *ip = NULL, *entry = NULL;
  929. origin_circuit_t *intro_circ = NULL, *tmp_circ;
  930. int flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
  931. (void) arg;
  932. MOCK(assert_circuit_ok, mock_assert_circuit_ok);
  933. hs_init();
  934. /* Initialize service */
  935. service = helper_create_service();
  936. /* Initialize intro point */
  937. ip = helper_create_service_ip();
  938. tt_assert(ip);
  939. service_intro_point_add(service->desc_current->intro_points.map, ip);
  940. /* Initialize intro circuit */
  941. intro_circ = origin_circuit_init(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO, flags);
  942. intro_circ->hs_ident = hs_ident_circuit_new(&service->keys.identity_pk);
  943. /* Register circuit in the circuitmap . */
  944. hs_circuitmap_register_intro_circ_v3_service_side(intro_circ,
  945. &ip->auth_key_kp.pubkey);
  946. tmp_circ =
  947. hs_circuitmap_get_intro_circ_v3_service_side(&ip->auth_key_kp.pubkey);
  948. tt_ptr_op(tmp_circ, OP_EQ, intro_circ);
  949. /* Pretend that intro point has failed too much */
  950. ip->circuit_retries = MAX_INTRO_POINT_CIRCUIT_RETRIES+1;
  951. /* Now pretend we are freeing this intro circuit. We want to see that our
  952. * destructor is not gonna kill our intro point structure since that's the
  953. * job of the cleanup routine. */
  954. circuit_free_(TO_CIRCUIT(intro_circ));
  955. intro_circ = NULL;
  956. entry = service_intro_point_find(service, &ip->auth_key_kp.pubkey);
  957. tt_assert(entry);
  958. /* The free should also remove the circuit from the circuitmap. */
  959. tmp_circ =
  960. hs_circuitmap_get_intro_circ_v3_service_side(&ip->auth_key_kp.pubkey);
  961. tt_assert(!tmp_circ);
  962. /* Now pretend that a new intro point circ was launched and opened. Check
  963. * that the intro point will be established correctly. */
  964. intro_circ = origin_circuit_init(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO, flags);
  965. intro_circ->hs_ident = hs_ident_circuit_new(&service->keys.identity_pk);
  966. ed25519_pubkey_copy(&intro_circ->hs_ident->intro_auth_pk,
  967. &ip->auth_key_kp.pubkey);
  968. /* Register circuit in the circuitmap . */
  969. hs_circuitmap_register_intro_circ_v3_service_side(intro_circ,
  970. &ip->auth_key_kp.pubkey);
  971. tmp_circ =
  972. hs_circuitmap_get_intro_circ_v3_service_side(&ip->auth_key_kp.pubkey);
  973. tt_ptr_op(tmp_circ, OP_EQ, intro_circ);
  974. tt_int_op(TO_CIRCUIT(intro_circ)->marked_for_close, OP_EQ, 0);
  975. circuit_mark_for_close(TO_CIRCUIT(intro_circ), END_CIRC_REASON_INTERNAL);
  976. tt_int_op(TO_CIRCUIT(intro_circ)->marked_for_close, OP_NE, 0);
  977. /* At this point, we should not be able to find it in the circuitmap. */
  978. tmp_circ =
  979. hs_circuitmap_get_intro_circ_v3_service_side(&ip->auth_key_kp.pubkey);
  980. tt_assert(!tmp_circ);
  981. done:
  982. if (intro_circ) {
  983. circuit_free_(TO_CIRCUIT(intro_circ));
  984. }
  985. /* Frees the service object. */
  986. if (service) {
  987. remove_service(get_hs_service_map(), service);
  988. hs_service_free(service);
  989. }
  990. hs_free_all();
  991. UNMOCK(assert_circuit_ok);
  992. }
  993. /** Test sending and receiving introduce2 cells */
  994. static void
  995. test_introduce2(void *arg)
  996. {
  997. int ret;
  998. int flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
  999. uint8_t payload[RELAY_PAYLOAD_SIZE] = {0};
  1000. origin_circuit_t *circ = NULL;
  1001. hs_service_t *service = NULL;
  1002. hs_service_intro_point_t *ip = NULL;
  1003. (void) arg;
  1004. hs_init();
  1005. MOCK(circuit_mark_for_close_, mock_circuit_mark_for_close);
  1006. MOCK(get_or_state,
  1007. get_or_state_replacement);
  1008. dummy_state = or_state_new();
  1009. circ = helper_create_origin_circuit(CIRCUIT_PURPOSE_S_INTRO, flags);
  1010. tt_assert(circ);
  1011. /* Test a wrong purpose. */
  1012. TO_CIRCUIT(circ)->purpose = CIRCUIT_PURPOSE_S_ESTABLISH_INTRO;
  1013. setup_full_capture_of_logs(LOG_WARN);
  1014. ret = hs_service_receive_introduce2(circ, payload, sizeof(payload));
  1015. tt_int_op(ret, OP_EQ, -1);
  1016. expect_log_msg_containing("Received an INTRODUCE2 cell on a "
  1017. "non introduction circuit of purpose");
  1018. teardown_capture_of_logs();
  1019. /* Back to normal. */
  1020. TO_CIRCUIT(circ)->purpose = CIRCUIT_PURPOSE_S_INTRO;
  1021. /* No service associated to it. */
  1022. setup_full_capture_of_logs(LOG_WARN);
  1023. ret = hs_service_receive_introduce2(circ, payload, sizeof(payload));
  1024. tt_int_op(ret, OP_EQ, -1);
  1025. expect_log_msg_containing("Unknown service identity key");
  1026. teardown_capture_of_logs();
  1027. /* Set a service for this circuit. */
  1028. service = helper_create_service();
  1029. ed25519_pubkey_copy(&circ->hs_ident->identity_pk,
  1030. &service->keys.identity_pk);
  1031. /* No introduction point associated to it. */
  1032. setup_full_capture_of_logs(LOG_WARN);
  1033. ret = hs_service_receive_introduce2(circ, payload, sizeof(payload));
  1034. tt_int_op(ret, OP_EQ, -1);
  1035. expect_log_msg_containing("Unknown introduction auth key when handling "
  1036. "an INTRODUCE2 cell on circuit");
  1037. teardown_capture_of_logs();
  1038. /* Set an IP object now for this circuit. */
  1039. {
  1040. ip = helper_create_service_ip();
  1041. service_intro_point_add(service->desc_current->intro_points.map, ip);
  1042. /* Update ident to contain the intro point auth key. */
  1043. ed25519_pubkey_copy(&circ->hs_ident->intro_auth_pk,
  1044. &ip->auth_key_kp.pubkey);
  1045. }
  1046. /* This will fail because receiving an INTRODUCE2 cell implies a valid cell
  1047. * and then launching circuits so let's not do that and instead test that
  1048. * behaviour differently. */
  1049. ret = hs_service_receive_introduce2(circ, payload, sizeof(payload));
  1050. tt_int_op(ret, OP_EQ, -1);
  1051. tt_u64_op(ip->introduce2_count, OP_EQ, 0);
  1052. done:
  1053. or_state_free(dummy_state);
  1054. dummy_state = NULL;
  1055. if (circ)
  1056. circuit_free_(TO_CIRCUIT(circ));
  1057. if (service) {
  1058. remove_service(get_hs_service_map(), service);
  1059. hs_service_free(service);
  1060. }
  1061. hs_free_all();
  1062. UNMOCK(circuit_mark_for_close_);
  1063. }
  1064. /** Test basic hidden service housekeeping operations (maintaining intro
  1065. * points, etc) */
  1066. static void
  1067. test_service_event(void *arg)
  1068. {
  1069. int flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
  1070. time_t now = time(NULL);
  1071. hs_service_t *service;
  1072. origin_circuit_t *circ = NULL;
  1073. (void) arg;
  1074. hs_init();
  1075. MOCK(circuit_mark_for_close_, mock_circuit_mark_for_close);
  1076. circ = helper_create_origin_circuit(CIRCUIT_PURPOSE_S_INTRO, flags);
  1077. /* Set a service for this circuit. */
  1078. service = helper_create_service();
  1079. tt_assert(service);
  1080. ed25519_pubkey_copy(&circ->hs_ident->identity_pk,
  1081. &service->keys.identity_pk);
  1082. /* Currently this consists of cleaning invalid intro points. So adding IPs
  1083. * here that should get cleaned up. */
  1084. {
  1085. hs_service_intro_point_t *ip = helper_create_service_ip();
  1086. service_intro_point_add(service->desc_current->intro_points.map, ip);
  1087. /* This run will remove the IP because we have no circuits nor node_t
  1088. * associated with it. */
  1089. run_housekeeping_event(now);
  1090. tt_int_op(digest256map_size(service->desc_current->intro_points.map),
  1091. OP_EQ, 0);
  1092. /* We'll trigger a removal because we've reached our maximum amount of
  1093. * times we should retry a circuit. For this, we need to have a node_t
  1094. * that matches the identity of this IP. */
  1095. routerinfo_t ri;
  1096. memset(&ri, 0, sizeof(ri));
  1097. ip = helper_create_service_ip();
  1098. service_intro_point_add(service->desc_current->intro_points.map, ip);
  1099. memset(ri.cache_info.identity_digest, 'A', DIGEST_LEN);
  1100. /* This triggers a node_t creation. */
  1101. tt_assert(nodelist_set_routerinfo(&ri, NULL));
  1102. ip->circuit_retries = MAX_INTRO_POINT_CIRCUIT_RETRIES + 1;
  1103. run_housekeeping_event(now);
  1104. tt_int_op(digest256map_size(service->desc_current->intro_points.map),
  1105. OP_EQ, 0);
  1106. /* No removal but no circuit so this means the IP object will stay in the
  1107. * descriptor map so we can retry it. */
  1108. ip = helper_create_service_ip();
  1109. service_intro_point_add(service->desc_current->intro_points.map, ip);
  1110. ip->circuit_established = 1; /* We'll test that, it MUST be 0 after. */
  1111. run_housekeeping_event(now);
  1112. tt_int_op(digest256map_size(service->desc_current->intro_points.map),
  1113. OP_EQ, 1);
  1114. /* Remove the IP object at once for the next test. */
  1115. ip->circuit_retries = MAX_INTRO_POINT_CIRCUIT_RETRIES + 1;
  1116. run_housekeeping_event(now);
  1117. tt_int_op(digest256map_size(service->desc_current->intro_points.map),
  1118. OP_EQ, 0);
  1119. /* Now, we'll create an IP with a registered circuit. The IP object
  1120. * shouldn't go away. */
  1121. ip = helper_create_service_ip();
  1122. service_intro_point_add(service->desc_current->intro_points.map, ip);
  1123. ed25519_pubkey_copy(&circ->hs_ident->intro_auth_pk,
  1124. &ip->auth_key_kp.pubkey);
  1125. hs_circuitmap_register_intro_circ_v3_service_side(
  1126. circ, &ip->auth_key_kp.pubkey);
  1127. run_housekeeping_event(now);
  1128. tt_int_op(digest256map_size(service->desc_current->intro_points.map),
  1129. OP_EQ, 1);
  1130. /* We'll mangle the IP object to expire. */
  1131. ip->time_to_expire = now;
  1132. run_housekeeping_event(now);
  1133. tt_int_op(digest256map_size(service->desc_current->intro_points.map),
  1134. OP_EQ, 0);
  1135. }
  1136. done:
  1137. hs_circuitmap_remove_circuit(TO_CIRCUIT(circ));
  1138. circuit_free_(TO_CIRCUIT(circ));
  1139. if (service) {
  1140. remove_service(get_hs_service_map(), service);
  1141. hs_service_free(service);
  1142. }
  1143. hs_free_all();
  1144. UNMOCK(circuit_mark_for_close_);
  1145. }
  1146. /** Test that we rotate descriptors correctly. */
  1147. static void
  1148. test_rotate_descriptors(void *arg)
  1149. {
  1150. int ret;
  1151. time_t next_rotation_time, now;
  1152. hs_service_t *service = NULL;
  1153. hs_service_descriptor_t *desc_next;
  1154. (void) arg;
  1155. dummy_state = or_state_new();
  1156. hs_init();
  1157. MOCK(get_or_state, get_or_state_replacement);
  1158. MOCK(circuit_mark_for_close_, mock_circuit_mark_for_close);
  1159. MOCK(networkstatus_get_live_consensus,
  1160. mock_networkstatus_get_live_consensus);
  1161. /* Descriptor rotation happens with a consensus with a new SRV. */
  1162. ret = parse_rfc1123_time("Sat, 26 Oct 1985 13:00:00 UTC",
  1163. &mock_ns.valid_after);
  1164. tt_int_op(ret, OP_EQ, 0);
  1165. ret = parse_rfc1123_time("Sat, 26 Oct 1985 14:00:00 UTC",
  1166. &mock_ns.fresh_until);
  1167. tt_int_op(ret, OP_EQ, 0);
  1168. voting_schedule_recalculate_timing(get_options(), mock_ns.valid_after);
  1169. update_approx_time(mock_ns.valid_after+1);
  1170. now = mock_ns.valid_after+1;
  1171. /* Create a service with a default descriptor and state. It's added to the
  1172. * global map. */
  1173. service = helper_create_service();
  1174. service_descriptor_free(service->desc_current);
  1175. service->desc_current = NULL;
  1176. /* This triggers a build for both descriptors. The time now is only used in
  1177. * the descriptor certificate which is important to be now else the decoding
  1178. * will complain that the cert has expired if we use valid_after. */
  1179. build_all_descriptors(now);
  1180. tt_assert(service->desc_current);
  1181. tt_assert(service->desc_next);
  1182. /* Tweak our service next rotation time so we can use a custom time. */
  1183. service->state.next_rotation_time = next_rotation_time =
  1184. mock_ns.valid_after + (11 * 60 * 60);
  1185. /* Nothing should happen, we are not at a new SRV. Our next rotation time
  1186. * should be untouched. */
  1187. rotate_all_descriptors(mock_ns.valid_after);
  1188. tt_u64_op(service->state.next_rotation_time, OP_EQ, next_rotation_time);
  1189. tt_assert(service->desc_current);
  1190. tt_assert(service->desc_next);
  1191. tt_u64_op(service->desc_current->time_period_num, OP_EQ,
  1192. hs_get_previous_time_period_num(0));
  1193. tt_u64_op(service->desc_next->time_period_num, OP_EQ,
  1194. hs_get_time_period_num(0));
  1195. /* Keep a reference so we can compare it after rotation to the current. */
  1196. desc_next = service->desc_next;
  1197. /* Going right after a new SRV. */
  1198. ret = parse_rfc1123_time("Sat, 27 Oct 1985 01:00:00 UTC",
  1199. &mock_ns.valid_after);
  1200. tt_int_op(ret, OP_EQ, 0);
  1201. ret = parse_rfc1123_time("Sat, 27 Oct 1985 02:00:00 UTC",
  1202. &mock_ns.fresh_until);
  1203. tt_int_op(ret, OP_EQ, 0);
  1204. voting_schedule_recalculate_timing(get_options(), mock_ns.valid_after);
  1205. update_approx_time(mock_ns.valid_after+1);
  1206. now = mock_ns.valid_after+1;
  1207. /* Note down what to expect for the next rotation time which is 01:00 + 23h
  1208. * meaning 00:00:00. */
  1209. next_rotation_time = mock_ns.valid_after + (23 * 60 * 60);
  1210. /* We should have our next rotation time modified, our current descriptor
  1211. * cleaned up and the next descriptor becoming the current. */
  1212. rotate_all_descriptors(mock_ns.valid_after);
  1213. tt_u64_op(service->state.next_rotation_time, OP_EQ, next_rotation_time);
  1214. tt_mem_op(service->desc_current, OP_EQ, desc_next, sizeof(*desc_next));
  1215. tt_assert(service->desc_next == NULL);
  1216. /* A second time should do nothing. */
  1217. rotate_all_descriptors(mock_ns.valid_after);
  1218. tt_u64_op(service->state.next_rotation_time, OP_EQ, next_rotation_time);
  1219. tt_mem_op(service->desc_current, OP_EQ, desc_next, sizeof(*desc_next));
  1220. tt_assert(service->desc_next == NULL);
  1221. build_all_descriptors(now);
  1222. tt_mem_op(service->desc_current, OP_EQ, desc_next, sizeof(*desc_next));
  1223. tt_u64_op(service->desc_current->time_period_num, OP_EQ,
  1224. hs_get_time_period_num(0));
  1225. tt_u64_op(service->desc_next->time_period_num, OP_EQ,
  1226. hs_get_next_time_period_num(0));
  1227. tt_assert(service->desc_next);
  1228. done:
  1229. if (service) {
  1230. remove_service(get_hs_service_map(), service);
  1231. hs_service_free(service);
  1232. }
  1233. hs_free_all();
  1234. UNMOCK(get_or_state);
  1235. UNMOCK(circuit_mark_for_close_);
  1236. UNMOCK(networkstatus_get_live_consensus);
  1237. }
  1238. /** Test building descriptors: picking intro points, setting up their link
  1239. * specifiers, etc. */
  1240. static void
  1241. test_build_update_descriptors(void *arg)
  1242. {
  1243. int ret;
  1244. node_t *node;
  1245. hs_service_t *service = NULL;
  1246. hs_service_intro_point_t *ip_cur, *ip_next;
  1247. routerinfo_t ri;
  1248. (void) arg;
  1249. hs_init();
  1250. MOCK(get_or_state,
  1251. get_or_state_replacement);
  1252. MOCK(networkstatus_get_live_consensus,
  1253. mock_networkstatus_get_live_consensus);
  1254. dummy_state = or_state_new();
  1255. ret = parse_rfc1123_time("Sat, 26 Oct 1985 03:00:00 UTC",
  1256. &mock_ns.valid_after);
  1257. tt_int_op(ret, OP_EQ, 0);
  1258. ret = parse_rfc1123_time("Sat, 26 Oct 1985 04:00:00 UTC",
  1259. &mock_ns.fresh_until);
  1260. tt_int_op(ret, OP_EQ, 0);
  1261. voting_schedule_recalculate_timing(get_options(), mock_ns.valid_after);
  1262. update_approx_time(mock_ns.valid_after+1);
  1263. time_t now = mock_ns.valid_after+1;
  1264. /* Create a service without a current descriptor to trigger a build. */
  1265. service = helper_create_service();
  1266. tt_assert(service);
  1267. /* Unfortunately, the helper creates a dummy descriptor so get rid of it. */
  1268. service_descriptor_free(service->desc_current);
  1269. service->desc_current = NULL;
  1270. /* We have a fresh service so this should trigger a build for both
  1271. * descriptors for specific time period that we'll test. */
  1272. build_all_descriptors(now);
  1273. /* Check *current* descriptor. */
  1274. tt_assert(service->desc_current);
  1275. tt_assert(service->desc_current->desc);
  1276. tt_assert(service->desc_current->intro_points.map);
  1277. /* The current time period is the one expected when starting at 03:00. */
  1278. tt_u64_op(service->desc_current->time_period_num, OP_EQ,
  1279. hs_get_time_period_num(0));
  1280. /* This should be untouched, the update descriptor process changes it. */
  1281. tt_u64_op(service->desc_current->next_upload_time, OP_EQ, 0);
  1282. /* Check *next* descriptor. */
  1283. tt_assert(service->desc_next);
  1284. tt_assert(service->desc_next->desc);
  1285. tt_assert(service->desc_next->intro_points.map);
  1286. tt_assert(service->desc_current != service->desc_next);
  1287. tt_u64_op(service->desc_next->time_period_num, OP_EQ,
  1288. hs_get_next_time_period_num(0));
  1289. /* This should be untouched, the update descriptor process changes it. */
  1290. tt_u64_op(service->desc_next->next_upload_time, OP_EQ, 0);
  1291. /* Time to test the update of those descriptors. At first, we have no node
  1292. * in the routerlist so this will find NO suitable node for the IPs. */
  1293. setup_full_capture_of_logs(LOG_INFO);
  1294. update_all_descriptors_intro_points(now);
  1295. expect_log_msg_containing("Unable to find a suitable node to be an "
  1296. "introduction point for service");
  1297. teardown_capture_of_logs();
  1298. tt_int_op(digest256map_size(service->desc_current->intro_points.map),
  1299. OP_EQ, 0);
  1300. tt_int_op(digest256map_size(service->desc_next->intro_points.map),
  1301. OP_EQ, 0);
  1302. /* Now, we'll setup a node_t. */
  1303. {
  1304. tor_addr_t ipv4_addr;
  1305. curve25519_secret_key_t curve25519_secret_key;
  1306. memset(&ri, 0, sizeof(routerinfo_t));
  1307. tor_addr_parse(&ipv4_addr, "127.0.0.1");
  1308. ri.addr = tor_addr_to_ipv4h(&ipv4_addr);
  1309. ri.or_port = 1337;
  1310. ri.purpose = ROUTER_PURPOSE_GENERAL;
  1311. /* Ugly yes but we never free the "ri" object so this just makes things
  1312. * easier. */
  1313. ri.protocol_list = (char *) "HSDir=1-2 LinkAuth=3";
  1314. summarize_protover_flags(&ri.pv, ri.protocol_list, NULL);
  1315. ret = curve25519_secret_key_generate(&curve25519_secret_key, 0);
  1316. tt_int_op(ret, OP_EQ, 0);
  1317. ri.onion_curve25519_pkey =
  1318. tor_malloc_zero(sizeof(curve25519_public_key_t));
  1319. ri.onion_pkey = tor_malloc_zero(140);
  1320. curve25519_public_key_generate(ri.onion_curve25519_pkey,
  1321. &curve25519_secret_key);
  1322. memset(ri.cache_info.identity_digest, 'A', DIGEST_LEN);
  1323. /* Setup ed25519 identity */
  1324. ed25519_keypair_t kp1;
  1325. ed25519_keypair_generate(&kp1, 0);
  1326. ri.cache_info.signing_key_cert = tor_malloc_zero(sizeof(tor_cert_t));
  1327. tt_assert(ri.cache_info.signing_key_cert);
  1328. ed25519_pubkey_copy(&ri.cache_info.signing_key_cert->signing_key,
  1329. &kp1.pubkey);
  1330. nodelist_set_routerinfo(&ri, NULL);
  1331. node = node_get_mutable_by_id(ri.cache_info.identity_digest);
  1332. tt_assert(node);
  1333. node->is_running = node->is_valid = node->is_fast = node->is_stable = 1;
  1334. }
  1335. /* We have to set this, or the lack of microdescriptors for these
  1336. * nodes will make them unusable. */
  1337. get_options_mutable()->UseMicrodescriptors = 0;
  1338. /* We expect to pick only one intro point from the node above. */
  1339. setup_full_capture_of_logs(LOG_INFO);
  1340. update_all_descriptors_intro_points(now);
  1341. tor_free(node->ri->onion_curve25519_pkey); /* Avoid memleak. */
  1342. tor_free(node->ri->cache_info.signing_key_cert);
  1343. tor_free(node->ri->onion_pkey);
  1344. expect_log_msg_containing("just picked 1 intro points and wanted 3 for next "
  1345. "descriptor. It currently has 0 intro points. "
  1346. "Launching ESTABLISH_INTRO circuit shortly.");
  1347. teardown_capture_of_logs();
  1348. tt_int_op(digest256map_size(service->desc_current->intro_points.map),
  1349. OP_EQ, 1);
  1350. tt_int_op(digest256map_size(service->desc_next->intro_points.map),
  1351. OP_EQ, 1);
  1352. /* Get the IP object. Because we don't have the auth key of the IP, we can't
  1353. * query it so get the first element in the map. */
  1354. {
  1355. void *obj = NULL;
  1356. const uint8_t *key;
  1357. digest256map_iter_t *iter =
  1358. digest256map_iter_init(service->desc_current->intro_points.map);
  1359. digest256map_iter_get(iter, &key, &obj);
  1360. tt_assert(obj);
  1361. ip_cur = obj;
  1362. /* Get also the IP from the next descriptor. We'll make sure it's not the
  1363. * same object as in the current descriptor. */
  1364. iter = digest256map_iter_init(service->desc_next->intro_points.map);
  1365. digest256map_iter_get(iter, &key, &obj);
  1366. tt_assert(obj);
  1367. ip_next = obj;
  1368. }
  1369. tt_mem_op(ip_cur, OP_NE, ip_next, sizeof(hs_desc_intro_point_t));
  1370. /* We won't test the service IP object because there is a specific test
  1371. * already for this but we'll make sure that the state is coherent.*/
  1372. /* Three link specifiers are mandatoy so make sure we do have them. */
  1373. tt_int_op(smartlist_len(ip_cur->base.link_specifiers), OP_EQ, 3);
  1374. /* Make sure we have a valid encryption keypair generated when we pick an
  1375. * intro point in the update process. */
  1376. tt_assert(!fast_mem_is_zero((char *) ip_cur->enc_key_kp.seckey.secret_key,
  1377. CURVE25519_SECKEY_LEN));
  1378. tt_assert(!fast_mem_is_zero((char *) ip_cur->enc_key_kp.pubkey.public_key,
  1379. CURVE25519_PUBKEY_LEN));
  1380. tt_u64_op(ip_cur->time_to_expire, OP_GE, now +
  1381. INTRO_POINT_LIFETIME_MIN_SECONDS);
  1382. tt_u64_op(ip_cur->time_to_expire, OP_LE, now +
  1383. INTRO_POINT_LIFETIME_MAX_SECONDS);
  1384. /* Now, we will try to set up a service after a new time period has started
  1385. * and see if it behaves as expected. */
  1386. ret = parse_rfc1123_time("Sat, 26 Oct 1985 13:00:00 UTC",
  1387. &mock_ns.valid_after);
  1388. tt_int_op(ret, OP_EQ, 0);
  1389. ret = parse_rfc1123_time("Sat, 26 Oct 1985 14:00:00 UTC",
  1390. &mock_ns.fresh_until);
  1391. tt_int_op(ret, OP_EQ, 0);
  1392. update_approx_time(mock_ns.valid_after+1);
  1393. now = mock_ns.valid_after+1;
  1394. /* Create a service without a current descriptor to trigger a build. */
  1395. service = helper_create_service();
  1396. tt_assert(service);
  1397. /* Unfortunately, the helper creates a dummy descriptor so get rid of it. */
  1398. service_descriptor_free(service->desc_current);
  1399. service->desc_current = NULL;
  1400. /* We have a fresh service so this should trigger a build for both
  1401. * descriptors for specific time period that we'll test. */
  1402. build_all_descriptors(now);
  1403. /* Check *current* descriptor. */
  1404. tt_assert(service->desc_current);
  1405. tt_assert(service->desc_current->desc);
  1406. tt_assert(service->desc_current->intro_points.map);
  1407. /* This should be for the previous time period. */
  1408. tt_u64_op(service->desc_current->time_period_num, OP_EQ,
  1409. hs_get_previous_time_period_num(0));
  1410. /* This should be untouched, the update descriptor process changes it. */
  1411. tt_u64_op(service->desc_current->next_upload_time, OP_EQ, 0);
  1412. /* Check *next* descriptor. */
  1413. tt_assert(service->desc_next);
  1414. tt_assert(service->desc_next->desc);
  1415. tt_assert(service->desc_next->intro_points.map);
  1416. tt_assert(service->desc_current != service->desc_next);
  1417. tt_u64_op(service->desc_next->time_period_num, OP_EQ,
  1418. hs_get_time_period_num(0));
  1419. /* This should be untouched, the update descriptor process changes it. */
  1420. tt_u64_op(service->desc_next->next_upload_time, OP_EQ, 0);
  1421. /* Let's remove the next descriptor to simulate a rotation. */
  1422. service_descriptor_free(service->desc_next);
  1423. service->desc_next = NULL;
  1424. build_all_descriptors(now);
  1425. /* Check *next* descriptor. */
  1426. tt_assert(service->desc_next);
  1427. tt_assert(service->desc_next->desc);
  1428. tt_assert(service->desc_next->intro_points.map);
  1429. tt_assert(service->desc_current != service->desc_next);
  1430. tt_u64_op(service->desc_next->time_period_num, OP_EQ,
  1431. hs_get_next_time_period_num(0));
  1432. /* This should be untouched, the update descriptor process changes it. */
  1433. tt_u64_op(service->desc_next->next_upload_time, OP_EQ, 0);
  1434. done:
  1435. if (service) {
  1436. remove_service(get_hs_service_map(), service);
  1437. hs_service_free(service);
  1438. }
  1439. hs_free_all();
  1440. nodelist_free_all();
  1441. }
  1442. /** Test building descriptors. We use this separate function instead of
  1443. * using test_build_update_descriptors because that function is too complex
  1444. * and also too interactive. */
  1445. static void
  1446. test_build_descriptors(void *arg)
  1447. {
  1448. int ret;
  1449. time_t now = time(NULL);
  1450. hs_service_t *last_service = NULL;
  1451. (void) arg;
  1452. hs_init();
  1453. MOCK(get_or_state,
  1454. get_or_state_replacement);
  1455. MOCK(networkstatus_get_live_consensus,
  1456. mock_networkstatus_get_live_consensus);
  1457. dummy_state = or_state_new();
  1458. ret = parse_rfc1123_time("Sat, 26 Oct 1985 03:00:00 UTC",
  1459. &mock_ns.valid_after);
  1460. tt_int_op(ret, OP_EQ, 0);
  1461. ret = parse_rfc1123_time("Sat, 26 Oct 1985 04:00:00 UTC",
  1462. &mock_ns.fresh_until);
  1463. tt_int_op(ret, OP_EQ, 0);
  1464. voting_schedule_recalculate_timing(get_options(), mock_ns.valid_after);
  1465. /* Generate a valid number of fake auth clients when a client authorization
  1466. * is disabled. */
  1467. {
  1468. hs_service_t *service = helper_create_service();
  1469. last_service = service;
  1470. service_descriptor_free(service->desc_current);
  1471. service->desc_current = NULL;
  1472. build_all_descriptors(now);
  1473. tt_assert(service->desc_current);
  1474. tt_assert(service->desc_current->desc);
  1475. hs_desc_superencrypted_data_t *superencrypted;
  1476. superencrypted = &service->desc_current->desc->superencrypted_data;
  1477. tt_int_op(smartlist_len(superencrypted->clients), OP_EQ, 16);
  1478. helper_destroy_service(service);
  1479. last_service = NULL;
  1480. }
  1481. /* Generate a valid number of fake auth clients when the number of
  1482. * clients is zero. */
  1483. {
  1484. hs_service_t *service = helper_create_service_with_clients(0);
  1485. last_service = service;
  1486. service_descriptor_free(service->desc_current);
  1487. service->desc_current = NULL;
  1488. build_all_descriptors(now);
  1489. hs_desc_superencrypted_data_t *superencrypted;
  1490. superencrypted = &service->desc_current->desc->superencrypted_data;
  1491. tt_int_op(smartlist_len(superencrypted->clients), OP_EQ, 16);
  1492. helper_destroy_service(service);
  1493. last_service = NULL;
  1494. }
  1495. /* Generate a valid number of fake auth clients when the number of
  1496. * clients is not a multiple of 16. */
  1497. {
  1498. hs_service_t *service = helper_create_service_with_clients(20);
  1499. last_service = service;
  1500. service_descriptor_free(service->desc_current);
  1501. service->desc_current = NULL;
  1502. build_all_descriptors(now);
  1503. hs_desc_superencrypted_data_t *superencrypted;
  1504. superencrypted = &service->desc_current->desc->superencrypted_data;
  1505. tt_int_op(smartlist_len(superencrypted->clients), OP_EQ, 32);
  1506. helper_destroy_service(service);
  1507. last_service = NULL;
  1508. }
  1509. /* Do not generate any fake desc client when the number of clients is
  1510. * a multiple of 16 but not zero. */
  1511. {
  1512. hs_service_t *service = helper_create_service_with_clients(32);
  1513. last_service = service;
  1514. service_descriptor_free(service->desc_current);
  1515. service->desc_current = NULL;
  1516. build_all_descriptors(now);
  1517. hs_desc_superencrypted_data_t *superencrypted;
  1518. superencrypted = &service->desc_current->desc->superencrypted_data;
  1519. tt_int_op(smartlist_len(superencrypted->clients), OP_EQ, 32);
  1520. helper_destroy_service(service);
  1521. last_service = NULL;
  1522. }
  1523. done:
  1524. helper_destroy_service(last_service);
  1525. hs_free_all();
  1526. }
  1527. static void
  1528. test_upload_descriptors(void *arg)
  1529. {
  1530. int ret;
  1531. time_t now;
  1532. hs_service_t *service;
  1533. (void) arg;
  1534. hs_init();
  1535. MOCK(get_or_state,
  1536. get_or_state_replacement);
  1537. MOCK(networkstatus_get_live_consensus,
  1538. mock_networkstatus_get_live_consensus);
  1539. dummy_state = or_state_new();
  1540. ret = parse_rfc1123_time("Sat, 26 Oct 1985 13:00:00 UTC",
  1541. &mock_ns.valid_after);
  1542. tt_int_op(ret, OP_EQ, 0);
  1543. ret = parse_rfc1123_time("Sat, 26 Oct 1985 14:00:00 UTC",
  1544. &mock_ns.fresh_until);
  1545. tt_int_op(ret, OP_EQ, 0);
  1546. voting_schedule_recalculate_timing(get_options(), mock_ns.valid_after);
  1547. update_approx_time(mock_ns.valid_after+1);
  1548. now = mock_ns.valid_after+1;
  1549. /* Create a service with no descriptor. It's added to the global map. */
  1550. service = hs_service_new(get_options());
  1551. tt_assert(service);
  1552. service->config.version = HS_VERSION_THREE;
  1553. ed25519_secret_key_generate(&service->keys.identity_sk, 0);
  1554. ed25519_public_key_generate(&service->keys.identity_pk,
  1555. &service->keys.identity_sk);
  1556. /* Register service to global map. */
  1557. ret = register_service(get_hs_service_map(), service);
  1558. tt_int_op(ret, OP_EQ, 0);
  1559. /* But first, build our descriptor. */
  1560. build_all_descriptors(now);
  1561. /* Nothing should happen because we have 0 introduction circuit established
  1562. * and we want (by default) 3 intro points. */
  1563. run_upload_descriptor_event(now);
  1564. /* If no upload happened, this should be untouched. */
  1565. tt_u64_op(service->desc_current->next_upload_time, OP_EQ, 0);
  1566. /* We'll simulate that we've opened our intro point circuit and that we only
  1567. * want one intro point. */
  1568. service->config.num_intro_points = 1;
  1569. /* Set our next upload time after now which will skip the upload. */
  1570. service->desc_current->next_upload_time = now + 1000;
  1571. run_upload_descriptor_event(now);
  1572. /* If no upload happened, this should be untouched. */
  1573. tt_u64_op(service->desc_current->next_upload_time, OP_EQ, now + 1000);
  1574. done:
  1575. hs_free_all();
  1576. UNMOCK(get_or_state);
  1577. }
  1578. /** Global vars used by test_rendezvous1_parsing() */
  1579. static char rend1_payload[RELAY_PAYLOAD_SIZE];
  1580. static size_t rend1_payload_len = 0;
  1581. /** Mock for relay_send_command_from_edge() to send a RENDEZVOUS1 cell. Instead
  1582. * of sending it to the network, instead save it to the global `rend1_payload`
  1583. * variable so that we can inspect it in the test_rendezvous1_parsing()
  1584. * test. */
  1585. static int
  1586. mock_relay_send_rendezvous1(streamid_t stream_id, circuit_t *circ,
  1587. uint8_t relay_command, const char *payload,
  1588. size_t payload_len,
  1589. crypt_path_t *cpath_layer,
  1590. const char *filename, int lineno)
  1591. {
  1592. (void) stream_id;
  1593. (void) circ;
  1594. (void) relay_command;
  1595. (void) cpath_layer;
  1596. (void) filename;
  1597. (void) lineno;
  1598. memcpy(rend1_payload, payload, payload_len);
  1599. rend1_payload_len = payload_len;
  1600. return 0;
  1601. }
  1602. /** Send a RENDEZVOUS1 as a service, and parse it as a client. */
  1603. static void
  1604. test_rendezvous1_parsing(void *arg)
  1605. {
  1606. int retval;
  1607. static const char *test_addr =
  1608. "4acth47i6kxnvkewtm6q7ib2s3ufpo5sqbsnzjpbi7utijcltosqemad.onion";
  1609. hs_service_t *service = NULL;
  1610. origin_circuit_t *service_circ = NULL;
  1611. origin_circuit_t *client_circ = NULL;
  1612. ed25519_keypair_t ip_auth_kp;
  1613. curve25519_keypair_t ephemeral_kp;
  1614. curve25519_keypair_t client_kp;
  1615. curve25519_keypair_t ip_enc_kp;
  1616. int flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
  1617. (void) arg;
  1618. MOCK(relay_send_command_from_edge_, mock_relay_send_rendezvous1);
  1619. {
  1620. /* Let's start by setting up the service that will start the rend */
  1621. service = tor_malloc_zero(sizeof(hs_service_t));
  1622. ed25519_secret_key_generate(&service->keys.identity_sk, 0);
  1623. ed25519_public_key_generate(&service->keys.identity_pk,
  1624. &service->keys.identity_sk);
  1625. memcpy(service->onion_address, test_addr, sizeof(service->onion_address));
  1626. tt_assert(service);
  1627. }
  1628. {
  1629. /* Now let's set up the service rendezvous circuit and its keys. */
  1630. service_circ = helper_create_origin_circuit(CIRCUIT_PURPOSE_S_CONNECT_REND,
  1631. flags);
  1632. tor_free(service_circ->hs_ident);
  1633. hs_ntor_rend_cell_keys_t hs_ntor_rend_cell_keys;
  1634. uint8_t rendezvous_cookie[HS_REND_COOKIE_LEN];
  1635. curve25519_keypair_generate(&ip_enc_kp, 0);
  1636. curve25519_keypair_generate(&ephemeral_kp, 0);
  1637. curve25519_keypair_generate(&client_kp, 0);
  1638. ed25519_keypair_generate(&ip_auth_kp, 0);
  1639. retval = hs_ntor_service_get_rendezvous1_keys(&ip_auth_kp.pubkey,
  1640. &ip_enc_kp,
  1641. &ephemeral_kp,
  1642. &client_kp.pubkey,
  1643. &hs_ntor_rend_cell_keys);
  1644. tt_int_op(retval, OP_EQ, 0);
  1645. memset(rendezvous_cookie, 2, sizeof(rendezvous_cookie));
  1646. service_circ->hs_ident =
  1647. create_rp_circuit_identifier(service, rendezvous_cookie,
  1648. &ephemeral_kp.pubkey,
  1649. &hs_ntor_rend_cell_keys);
  1650. }
  1651. /* Send out the RENDEZVOUS1 and make sure that our mock func worked */
  1652. tt_assert(fast_mem_is_zero(rend1_payload, 32));
  1653. hs_circ_service_rp_has_opened(service, service_circ);
  1654. tt_assert(!fast_mem_is_zero(rend1_payload, 32));
  1655. tt_int_op(rend1_payload_len, OP_EQ, HS_LEGACY_RENDEZVOUS_CELL_SIZE);
  1656. /******************************/
  1657. /** Now let's create the client rendezvous circuit */
  1658. client_circ =
  1659. helper_create_origin_circuit(CIRCUIT_PURPOSE_C_REND_READY_INTRO_ACKED,
  1660. flags);
  1661. /* fix up its circ ident */
  1662. ed25519_pubkey_copy(&client_circ->hs_ident->intro_auth_pk,
  1663. &ip_auth_kp.pubkey);
  1664. memcpy(&client_circ->hs_ident->rendezvous_client_kp,
  1665. &client_kp, sizeof(client_circ->hs_ident->rendezvous_client_kp));
  1666. memcpy(&client_circ->hs_ident->intro_enc_pk.public_key,
  1667. &ip_enc_kp.pubkey.public_key,
  1668. sizeof(client_circ->hs_ident->intro_enc_pk.public_key));
  1669. /* Now parse the rendezvous2 circuit and make sure it was fine. We are
  1670. * skipping 20 bytes off its payload, since that's the rendezvous cookie
  1671. * which is only present in REND1. */
  1672. retval = handle_rendezvous2(client_circ,
  1673. (uint8_t*)rend1_payload+20,
  1674. rend1_payload_len-20);
  1675. tt_int_op(retval, OP_EQ, 0);
  1676. /* TODO: We are only simulating client/service here. We could also simulate
  1677. * the rendezvous point by plugging in rend_mid_establish_rendezvous(). We
  1678. * would need an extra circuit and some more stuff but it's doable. */
  1679. done:
  1680. circuit_free_(TO_CIRCUIT(service_circ));
  1681. circuit_free_(TO_CIRCUIT(client_circ));
  1682. hs_service_free(service);
  1683. hs_free_all();
  1684. UNMOCK(relay_send_command_from_edge_);
  1685. }
  1686. static void
  1687. test_authorized_client_config_equal(void *arg)
  1688. {
  1689. int ret;
  1690. hs_service_config_t *config1, *config2;
  1691. (void) arg;
  1692. config1 = tor_malloc_zero(sizeof(*config1));
  1693. config2 = tor_malloc_zero(sizeof(*config2));
  1694. /* Both configs are empty. */
  1695. {
  1696. config1->clients = smartlist_new();
  1697. config2->clients = smartlist_new();
  1698. ret = service_authorized_client_config_equal(config1, config2);
  1699. tt_int_op(ret, OP_EQ, 1);
  1700. service_clear_config(config1);
  1701. service_clear_config(config2);
  1702. }
  1703. /* Both configs have exactly the same client config. */
  1704. {
  1705. config1->clients = smartlist_new();
  1706. config2->clients = smartlist_new();
  1707. hs_service_authorized_client_t *client1, *client2;
  1708. client1 = helper_create_authorized_client();
  1709. client2 = helper_create_authorized_client();
  1710. smartlist_add(config1->clients, client1);
  1711. smartlist_add(config1->clients, client2);
  1712. /* We should swap the order of clients here to test that the order
  1713. * does not matter. */
  1714. smartlist_add(config2->clients, helper_clone_authorized_client(client2));
  1715. smartlist_add(config2->clients, helper_clone_authorized_client(client1));
  1716. ret = service_authorized_client_config_equal(config1, config2);
  1717. tt_int_op(ret, OP_EQ, 1);
  1718. service_clear_config(config1);
  1719. service_clear_config(config2);
  1720. }
  1721. /* The numbers of clients in both configs are not equal. */
  1722. {
  1723. config1->clients = smartlist_new();
  1724. config2->clients = smartlist_new();
  1725. hs_service_authorized_client_t *client1, *client2;
  1726. client1 = helper_create_authorized_client();
  1727. client2 = helper_create_authorized_client();
  1728. smartlist_add(config1->clients, client1);
  1729. smartlist_add(config1->clients, client2);
  1730. smartlist_add(config2->clients, helper_clone_authorized_client(client1));
  1731. ret = service_authorized_client_config_equal(config1, config2);
  1732. tt_int_op(ret, OP_EQ, 0);
  1733. service_clear_config(config1);
  1734. service_clear_config(config2);
  1735. }
  1736. /* The first config has two distinct clients while the second config
  1737. * has two clients but they are duplicate. */
  1738. {
  1739. config1->clients = smartlist_new();
  1740. config2->clients = smartlist_new();
  1741. hs_service_authorized_client_t *client1, *client2;
  1742. client1 = helper_create_authorized_client();
  1743. client2 = helper_create_authorized_client();
  1744. smartlist_add(config1->clients, client1);
  1745. smartlist_add(config1->clients, client2);
  1746. smartlist_add(config2->clients, helper_clone_authorized_client(client1));
  1747. smartlist_add(config2->clients, helper_clone_authorized_client(client1));
  1748. ret = service_authorized_client_config_equal(config1, config2);
  1749. tt_int_op(ret, OP_EQ, 0);
  1750. service_clear_config(config1);
  1751. service_clear_config(config2);
  1752. }
  1753. /* Both configs have totally distinct clients. */
  1754. {
  1755. config1->clients = smartlist_new();
  1756. config2->clients = smartlist_new();
  1757. hs_service_authorized_client_t *client1, *client2, *client3, *client4;
  1758. client1 = helper_create_authorized_client();
  1759. client2 = helper_create_authorized_client();
  1760. client3 = helper_create_authorized_client();
  1761. client4 = helper_create_authorized_client();
  1762. smartlist_add(config1->clients, client1);
  1763. smartlist_add(config1->clients, client2);
  1764. smartlist_add(config2->clients, client3);
  1765. smartlist_add(config2->clients, client4);
  1766. ret = service_authorized_client_config_equal(config1, config2);
  1767. tt_int_op(ret, OP_EQ, 0);
  1768. service_clear_config(config1);
  1769. service_clear_config(config2);
  1770. }
  1771. done:
  1772. tor_free(config1);
  1773. tor_free(config2);
  1774. }
  1775. /** Test that client circuit ID gets correctly exported */
  1776. static void
  1777. test_export_client_circuit_id(void *arg)
  1778. {
  1779. origin_circuit_t *or_circ = NULL;
  1780. size_t sz;
  1781. char *cp1=NULL, *cp2=NULL;
  1782. connection_t *conn = NULL;
  1783. (void) arg;
  1784. MOCK(connection_write_to_buf_impl_, connection_write_to_buf_mock);
  1785. hs_service_init();
  1786. /* Create service */
  1787. hs_service_t *service = helper_create_service();
  1788. /* Check that export circuit ID detection works */
  1789. service->config.circuit_id_protocol = HS_CIRCUIT_ID_PROTOCOL_NONE;
  1790. tt_int_op(0, OP_EQ,
  1791. hs_service_exports_circuit_id(&service->keys.identity_pk));
  1792. service->config.circuit_id_protocol = HS_CIRCUIT_ID_PROTOCOL_HAPROXY;
  1793. tt_int_op(1, OP_EQ,
  1794. hs_service_exports_circuit_id(&service->keys.identity_pk));
  1795. /* Create client connection */
  1796. conn = test_conn_get_connection(AP_CONN_STATE_CIRCUIT_WAIT, CONN_TYPE_AP, 0);
  1797. /* Create client edge conn hs_ident */
  1798. edge_connection_t *edge_conn = TO_EDGE_CONN(conn);
  1799. edge_conn->hs_ident = hs_ident_edge_conn_new(&service->keys.identity_pk);
  1800. edge_conn->hs_ident->orig_virtual_port = 42;
  1801. /* Create rend circuit */
  1802. or_circ = origin_circuit_new();
  1803. or_circ->base_.purpose = CIRCUIT_PURPOSE_C_REND_JOINED;
  1804. edge_conn->on_circuit = TO_CIRCUIT(or_circ);
  1805. or_circ->global_identifier = 666;
  1806. /* Export circuit ID */
  1807. export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol);
  1808. /* Check contents */
  1809. cp1 = buf_get_contents(conn->outbuf, &sz);
  1810. tt_str_op(cp1, OP_EQ,
  1811. "PROXY TCP6 fc00:dead:beef:4dad::0:29a ::1 666 42\r\n");
  1812. /* Change circ GID and see that the reported circuit ID also changes */
  1813. or_circ->global_identifier = 22;
  1814. /* check changes */
  1815. export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol);
  1816. cp2 = buf_get_contents(conn->outbuf, &sz);
  1817. tt_str_op(cp1, OP_NE, cp2);
  1818. tor_free(cp1);
  1819. /* Check that GID with UINT32_MAX works. */
  1820. or_circ->global_identifier = UINT32_MAX;
  1821. export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol);
  1822. cp1 = buf_get_contents(conn->outbuf, &sz);
  1823. tt_str_op(cp1, OP_EQ,
  1824. "PROXY TCP6 fc00:dead:beef:4dad::ffff:ffff ::1 65535 42\r\n");
  1825. tor_free(cp1);
  1826. /* Check that GID with UINT16_MAX works. */
  1827. or_circ->global_identifier = UINT16_MAX;
  1828. export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol);
  1829. cp1 = buf_get_contents(conn->outbuf, &sz);
  1830. tt_str_op(cp1, OP_EQ,
  1831. "PROXY TCP6 fc00:dead:beef:4dad::0:ffff ::1 65535 42\r\n");
  1832. tor_free(cp1);
  1833. /* Check that GID with UINT16_MAX + 7 works. */
  1834. or_circ->global_identifier = UINT16_MAX + 7;
  1835. export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol);
  1836. cp1 = buf_get_contents(conn->outbuf, &sz);
  1837. tt_str_op(cp1, OP_EQ, "PROXY TCP6 fc00:dead:beef:4dad::1:6 ::1 6 42\r\n");
  1838. done:
  1839. UNMOCK(connection_write_to_buf_impl_);
  1840. circuit_free_(TO_CIRCUIT(or_circ));
  1841. connection_free_minimal(conn);
  1842. hs_service_free(service);
  1843. tor_free(cp1);
  1844. tor_free(cp2);
  1845. }
  1846. struct testcase_t hs_service_tests[] = {
  1847. { "e2e_rend_circuit_setup", test_e2e_rend_circuit_setup, TT_FORK,
  1848. NULL, NULL },
  1849. { "load_keys", test_load_keys, TT_FORK,
  1850. NULL, NULL },
  1851. { "client_filename_is_valid", test_client_filename_is_valid, TT_FORK,
  1852. NULL, NULL },
  1853. { "parse_authorized_client", test_parse_authorized_client, TT_FORK,
  1854. NULL, NULL },
  1855. { "load_keys_with_client_auth", test_load_keys_with_client_auth, TT_FORK,
  1856. NULL, NULL },
  1857. { "access_service", test_access_service, TT_FORK,
  1858. NULL, NULL },
  1859. { "service_intro_point", test_service_intro_point, TT_FORK,
  1860. NULL, NULL },
  1861. { "helper_functions", test_helper_functions, TT_FORK,
  1862. NULL, NULL },
  1863. { "intro_circuit_opened", test_intro_circuit_opened, TT_FORK,
  1864. NULL, NULL },
  1865. { "intro_established", test_intro_established, TT_FORK,
  1866. NULL, NULL },
  1867. { "closing_intro_circs", test_closing_intro_circs, TT_FORK,
  1868. NULL, NULL },
  1869. { "rdv_circuit_opened", test_rdv_circuit_opened, TT_FORK,
  1870. NULL, NULL },
  1871. { "introduce2", test_introduce2, TT_FORK,
  1872. NULL, NULL },
  1873. { "service_event", test_service_event, TT_FORK,
  1874. NULL, NULL },
  1875. { "rotate_descriptors", test_rotate_descriptors, TT_FORK,
  1876. NULL, NULL },
  1877. { "build_update_descriptors", test_build_update_descriptors, TT_FORK,
  1878. NULL, NULL },
  1879. { "build_descriptors", test_build_descriptors, TT_FORK,
  1880. NULL, NULL },
  1881. { "upload_descriptors", test_upload_descriptors, TT_FORK,
  1882. NULL, NULL },
  1883. { "rendezvous1_parsing", test_rendezvous1_parsing, TT_FORK,
  1884. NULL, NULL },
  1885. { "authorized_client_config_equal", test_authorized_client_config_equal,
  1886. TT_FORK, NULL, NULL },
  1887. { "export_client_circuit_id", test_export_client_circuit_id, TT_FORK,
  1888. NULL, NULL },
  1889. END_OF_TESTCASES
  1890. };