123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203 |
- #define HS_CIRCUIT_PRIVATE
- #include "or.h"
- #include "circpathbias.h"
- #include "circuitbuild.h"
- #include "circuitlist.h"
- #include "circuituse.h"
- #include "config.h"
- #include "nodelist.h"
- #include "policies.h"
- #include "relay.h"
- #include "rendservice.h"
- #include "rephist.h"
- #include "router.h"
- #include "hs_cell.h"
- #include "hs_ident.h"
- #include "hs_ntor.h"
- #include "hs_service.h"
- #include "hs_circuit.h"
- #include "ed25519_cert.h"
- #include "hs/cell_common.h"
- #include "hs/cell_establish_intro.h"
- static int
- circuit_purpose_is_correct_for_rend(unsigned int circ_purpose,
- int is_service_side)
- {
- if (is_service_side) {
- if (circ_purpose != CIRCUIT_PURPOSE_S_CONNECT_REND) {
- log_warn(LD_BUG,
- "HS e2e circuit setup with wrong purpose (%d)", circ_purpose);
- return 0;
- }
- }
- if (!is_service_side) {
- if (circ_purpose != CIRCUIT_PURPOSE_C_REND_READY &&
- circ_purpose != CIRCUIT_PURPOSE_C_REND_READY_INTRO_ACKED) {
- log_warn(LD_BUG,
- "Client e2e circuit setup with wrong purpose (%d)", circ_purpose);
- return 0;
- }
- }
- return 1;
- }
- static crypt_path_t *
- create_rend_cpath(const uint8_t *ntor_key_seed, size_t seed_len,
- int is_service_side)
- {
- uint8_t keys[HS_NTOR_KEY_EXPANSION_KDF_OUT_LEN];
- crypt_path_t *cpath = NULL;
-
- if (hs_ntor_circuit_key_expansion(ntor_key_seed, seed_len,
- keys, sizeof(keys)) < 0) {
- goto err;
- }
-
- cpath = tor_malloc_zero(sizeof(crypt_path_t));
- cpath->magic = CRYPT_PATH_MAGIC;
- if (circuit_init_cpath_crypto(cpath, (char*)keys, sizeof(keys),
- is_service_side, 1) < 0) {
- tor_free(cpath);
- goto err;
- }
- err:
- memwipe(keys, 0, sizeof(keys));
- return cpath;
- }
- static crypt_path_t *
- create_rend_cpath_legacy(origin_circuit_t *circ, const uint8_t *rend_cell_body)
- {
- crypt_path_t *hop = NULL;
- char keys[DIGEST_LEN+CPATH_KEY_MATERIAL_LEN];
-
- tor_assert(circ->build_state);
- tor_assert(circ->build_state->pending_final_cpath);
- hop = circ->build_state->pending_final_cpath;
- tor_assert(hop->rend_dh_handshake_state);
- if (crypto_dh_compute_secret(LOG_PROTOCOL_WARN, hop->rend_dh_handshake_state,
- (char*)rend_cell_body, DH_KEY_LEN,
- keys, DIGEST_LEN+CPATH_KEY_MATERIAL_LEN)<0) {
- log_warn(LD_GENERAL, "Couldn't complete DH handshake.");
- goto err;
- }
-
- if (circuit_init_cpath_crypto(hop,
- keys+DIGEST_LEN, sizeof(keys)-DIGEST_LEN,
- 0, 0) < 0)
- goto err;
-
- if (tor_memneq(keys, rend_cell_body+DH_KEY_LEN, DIGEST_LEN)) {
- log_warn(LD_PROTOCOL, "Incorrect digest of key material.");
- goto err;
- }
-
- crypto_dh_free(hop->rend_dh_handshake_state);
- hop->rend_dh_handshake_state = NULL;
- goto done;
- err:
- hop = NULL;
- done:
- memwipe(keys, 0, sizeof(keys));
- return hop;
- }
- static void
- finalize_rend_circuit(origin_circuit_t *circ, crypt_path_t *hop,
- int is_service_side)
- {
- tor_assert(circ);
- tor_assert(hop);
-
- int new_circ_purpose = is_service_side ?
- CIRCUIT_PURPOSE_S_REND_JOINED : CIRCUIT_PURPOSE_C_REND_JOINED;
- circuit_change_purpose(TO_CIRCUIT(circ), new_circ_purpose);
-
- hop->state = CPATH_STATE_OPEN;
-
- hop->package_window = circuit_initial_package_window();
- hop->deliver_window = CIRCWINDOW_START;
-
- circ->hs_circ_has_timed_out = 0;
-
- onion_append_to_cpath(&circ->cpath, hop);
-
- if (circ->build_state) {
- circ->build_state->pending_final_cpath = NULL;
- }
-
- if (!is_service_side) {
- circuit_try_attaching_streams(circ);
- }
- }
- static void
- register_intro_circ(const hs_service_intro_point_t *ip,
- origin_circuit_t *circ)
- {
- tor_assert(ip);
- tor_assert(circ);
- if (ip->base.is_only_legacy) {
- uint8_t digest[DIGEST_LEN];
- if (BUG(crypto_pk_get_digest(ip->legacy_key, (char *) digest) < 0)) {
- return;
- }
- hs_circuitmap_register_intro_circ_v2_service_side(circ, digest);
- } else {
- hs_circuitmap_register_intro_circ_v3_service_side(circ,
- &ip->auth_key_kp.pubkey);
- }
- }
- static unsigned int
- count_opened_desc_intro_point_circuits(const hs_service_t *service,
- const hs_service_descriptor_t *desc)
- {
- unsigned int count = 0;
- tor_assert(service);
- tor_assert(desc);
- DIGEST256MAP_FOREACH(desc->intro_points.map, key,
- const hs_service_intro_point_t *, ip) {
- const circuit_t *circ;
- const origin_circuit_t *ocirc = hs_circ_service_get_intro_circ(ip);
- if (ocirc == NULL) {
- continue;
- }
- circ = TO_CIRCUIT(ocirc);
- tor_assert(circ->purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO ||
- circ->purpose == CIRCUIT_PURPOSE_S_INTRO);
-
- tor_assert(ed25519_pubkey_eq(&service->keys.identity_pk,
- ô->hs_ident->identity_pk));
-
- if (!circ->marked_for_close && circ->state == CIRCUIT_STATE_OPEN) {
- count++;
- }
- } DIGEST256MAP_FOREACH_END;
- return count;
- }
- STATIC hs_ident_circuit_t *
- create_rp_circuit_identifier(const hs_service_t *service,
- const uint8_t *rendezvous_cookie,
- const curve25519_public_key_t *server_pk,
- const hs_ntor_rend_cell_keys_t *keys)
- {
- hs_ident_circuit_t *ident;
- uint8_t handshake_info[CURVE25519_PUBKEY_LEN + DIGEST256_LEN];
- tor_assert(service);
- tor_assert(rendezvous_cookie);
- tor_assert(server_pk);
- tor_assert(keys);
- ident = hs_ident_circuit_new(&service->keys.identity_pk,
- HS_IDENT_CIRCUIT_RENDEZVOUS);
-
- memcpy(ident->rendezvous_cookie, rendezvous_cookie,
- sizeof(ident->rendezvous_cookie));
-
- memcpy(handshake_info, server_pk->public_key, CURVE25519_PUBKEY_LEN);
- memcpy(handshake_info + CURVE25519_PUBKEY_LEN, keys->rend_cell_auth_mac,
- DIGEST256_LEN);
- tor_assert(sizeof(ident->rendezvous_handshake_info) ==
- sizeof(handshake_info));
- memcpy(ident->rendezvous_handshake_info, handshake_info,
- sizeof(ident->rendezvous_handshake_info));
-
- tor_assert(sizeof(ident->rendezvous_ntor_key_seed) ==
- sizeof(keys->ntor_key_seed));
- memcpy(ident->rendezvous_ntor_key_seed, keys->ntor_key_seed,
- sizeof(ident->rendezvous_ntor_key_seed));
- return ident;
- }
- static hs_ident_circuit_t *
- create_intro_circuit_identifier(const hs_service_t *service,
- const hs_service_intro_point_t *ip)
- {
- hs_ident_circuit_t *ident;
- tor_assert(service);
- tor_assert(ip);
- ident = hs_ident_circuit_new(&service->keys.identity_pk,
- HS_IDENT_CIRCUIT_INTRO);
- ed25519_pubkey_copy(&ident->intro_auth_pk, &ip->auth_key_kp.pubkey);
- return ident;
- }
- static void
- send_establish_intro(const hs_service_t *service,
- hs_service_intro_point_t *ip, origin_circuit_t *circ)
- {
- ssize_t cell_len;
- uint8_t payload[RELAY_PAYLOAD_SIZE];
- tor_assert(service);
- tor_assert(ip);
- tor_assert(circ);
-
- cell_len = hs_cell_build_establish_intro(circ->cpath->prev->rend_circ_nonce,
- ip, payload);
- if (cell_len < 0) {
- log_warn(LD_REND, "Unable to encode ESTABLISH_INTRO cell for service %s "
- "on circuit %u. Closing circuit.",
- safe_str_client(service->onion_address),
- TO_CIRCUIT(circ)->n_circ_id);
- goto err;
- }
-
- if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(circ),
- RELAY_COMMAND_ESTABLISH_INTRO,
- (char *) payload, cell_len,
- circ->cpath->prev) < 0) {
- log_info(LD_REND, "Unable to send ESTABLISH_INTRO cell for service %s "
- "on circuit %u.",
- safe_str_client(service->onion_address),
- TO_CIRCUIT(circ)->n_circ_id);
-
- goto done;
- }
-
- pathbias_count_use_attempt(circ);
- goto done;
- err:
- circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
- done:
- memwipe(payload, 0, sizeof(payload));
- }
- static const char *
- get_service_anonymity_string(const hs_service_t *service)
- {
- if (service->config.is_single_onion) {
- return "single onion";
- } else {
- return "hidden";
- }
- }
- static void
- launch_rendezvous_point_circuit(const hs_service_t *service,
- const hs_service_intro_point_t *ip,
- const hs_cell_introduce2_data_t *data)
- {
- int circ_needs_uptime;
- time_t now = time(NULL);
- extend_info_t *info = NULL;
- origin_circuit_t *circ;
- tor_assert(service);
- tor_assert(ip);
- tor_assert(data);
- circ_needs_uptime = hs_service_requires_uptime_circ(service->config.ports);
-
- info = hs_get_extend_info_from_lspecs(data->link_specifiers,
- &data->onion_pk,
- service->config.is_single_onion);
- if (info == NULL) {
-
- log_fn(LOG_PROTOCOL_WARN, LD_REND,
- "Not enough info to open a circuit to a rendezvous point for "
- "%s service %s.",
- get_service_anonymity_string(service),
- safe_str_client(service->onion_address));
- goto end;
- }
- for (int i = 0; i < MAX_REND_FAILURES; i++) {
- int circ_flags = CIRCLAUNCH_NEED_CAPACITY | CIRCLAUNCH_IS_INTERNAL;
- if (circ_needs_uptime) {
- circ_flags |= CIRCLAUNCH_NEED_UPTIME;
- }
-
- if (service->config.is_single_onion) {
- circ_flags |= CIRCLAUNCH_ONEHOP_TUNNEL;
- }
- circ = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_CONNECT_REND, info,
- circ_flags);
- if (circ != NULL) {
-
- break;
- }
- }
- if (circ == NULL) {
- log_warn(LD_REND, "Giving up on launching a rendezvous circuit to %s "
- "for %s service %s",
- safe_str_client(extend_info_describe(info)),
- get_service_anonymity_string(service),
- safe_str_client(service->onion_address));
- goto end;
- }
- log_info(LD_REND, "Rendezvous circuit launched to %s with cookie %s "
- "for %s service %s",
- safe_str_client(extend_info_describe(info)),
- safe_str_client(hex_str((const char *) data->rendezvous_cookie,
- REND_COOKIE_LEN)),
- get_service_anonymity_string(service),
- safe_str_client(service->onion_address));
- tor_assert(circ->build_state);
-
- circ->build_state->expiry_time = now + MAX_REND_TIMEOUT;
-
- {
- hs_ntor_rend_cell_keys_t keys;
- curve25519_keypair_t ephemeral_kp;
-
- curve25519_keypair_generate(&ephemeral_kp, 0);
- if (hs_ntor_service_get_rendezvous1_keys(&ip->auth_key_kp.pubkey,
- &ip->enc_key_kp,
- &ephemeral_kp, &data->client_pk,
- &keys) < 0) {
-
- log_info(LD_REND, "Unable to get RENDEZVOUS1 key material for "
- "service %s",
- safe_str_client(service->onion_address));
- circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
- goto end;
- }
- circ->hs_ident = create_rp_circuit_identifier(service,
- data->rendezvous_cookie,
- &ephemeral_kp.pubkey, &keys);
- memwipe(&ephemeral_kp, 0, sizeof(ephemeral_kp));
- memwipe(&keys, 0, sizeof(keys));
- tor_assert(circ->hs_ident);
- }
- end:
- extend_info_free(info);
- }
- static int
- can_relaunch_service_rendezvous_point(const origin_circuit_t *circ)
- {
- tor_assert(circ);
-
- tor_assert(circ->build_state);
- tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_CONNECT_REND);
-
-
- if (circ->hs_service_side_rend_circ_has_been_relaunched) {
- log_info(LD_REND, "Rendezvous circuit to %s has already been retried. "
- "Skipping retry.",
- safe_str_client(
- extend_info_describe(circ->build_state->chosen_exit)));
- goto disallow;
- }
-
- if (circ->build_state->failure_count > MAX_REND_FAILURES ||
- circ->build_state->expiry_time <= time(NULL)) {
- log_info(LD_REND, "Attempt to build a rendezvous circuit to %s has "
- "failed with %d attempts and expiry time %ld. "
- "Giving up building.",
- safe_str_client(
- extend_info_describe(circ->build_state->chosen_exit)),
- circ->build_state->failure_count,
- (long int) circ->build_state->expiry_time);
- goto disallow;
- }
-
- return 1;
- disallow:
- return 0;
- }
- static void
- retry_service_rendezvous_point(const origin_circuit_t *circ)
- {
- int flags = 0;
- origin_circuit_t *new_circ;
- cpath_build_state_t *bstate;
- tor_assert(circ);
-
- tor_assert(circ->build_state);
- tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_CONNECT_REND);
-
- bstate = circ->build_state;
- log_info(LD_REND, "Retrying rendezvous point circuit to %s",
- safe_str_client(extend_info_describe(bstate->chosen_exit)));
-
- flags |= (bstate->need_uptime) ? CIRCLAUNCH_NEED_UPTIME : 0;
- flags |= (bstate->need_capacity) ? CIRCLAUNCH_NEED_CAPACITY : 0;
- flags |= (bstate->is_internal) ? CIRCLAUNCH_IS_INTERNAL : 0;
-
- new_circ = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_CONNECT_REND,
- bstate->chosen_exit, flags);
- if (new_circ == NULL) {
- log_warn(LD_REND, "Failed to launch rendezvous circuit to %s",
- safe_str_client(extend_info_describe(bstate->chosen_exit)));
- goto done;
- }
-
- new_circ->build_state->failure_count = bstate->failure_count++;
- new_circ->build_state->expiry_time = bstate->expiry_time;
- new_circ->hs_ident = hs_ident_circuit_dup(circ->hs_ident);
- done:
- return;
- }
- static void
- get_lspecs_from_node(const node_t *node, smartlist_t *lspecs)
- {
- link_specifier_t *ls;
- tor_addr_port_t ap;
- tor_assert(node);
- tor_assert(lspecs);
-
- node_get_prim_orport(node, &ap);
-
- if (BUG(!tor_addr_is_v4(&ap.addr)) ||
- BUG(!tor_addr_port_is_valid_ap(&ap, 0))) {
- return;
- }
- ls = link_specifier_new();
- link_specifier_set_ls_type(ls, LS_IPV4);
- link_specifier_set_un_ipv4_addr(ls, tor_addr_to_ipv4h(&ap.addr));
- link_specifier_set_un_ipv4_port(ls, ap.port);
-
- link_specifier_set_ls_len(ls, sizeof(ap.addr.addr.in_addr) +
- sizeof(ap.port));
- smartlist_add(lspecs, ls);
-
- ls = link_specifier_new();
- link_specifier_set_ls_type(ls, LS_LEGACY_ID);
- memcpy(link_specifier_getarray_un_legacy_id(ls), node->identity,
- link_specifier_getlen_un_legacy_id(ls));
- link_specifier_set_ls_len(ls, link_specifier_getlen_un_legacy_id(ls));
- smartlist_add(lspecs, ls);
-
- if (!ed25519_public_key_is_zero(&node->ed25519_id)) {
- ls = link_specifier_new();
- link_specifier_set_ls_type(ls, LS_ED25519_ID);
- memcpy(link_specifier_getarray_un_ed25519_id(ls), &node->ed25519_id,
- link_specifier_getlen_un_ed25519_id(ls));
- link_specifier_set_ls_len(ls, link_specifier_getlen_un_ed25519_id(ls));
- smartlist_add(lspecs, ls);
- }
-
- if (node_has_ipv6_orport(node)) {
- ls = link_specifier_new();
- node_get_pref_ipv6_orport(node, &ap);
- link_specifier_set_ls_type(ls, LS_IPV6);
- size_t addr_len = link_specifier_getlen_un_ipv6_addr(ls);
- const uint8_t *in6_addr = tor_addr_to_in6_addr8(&ap.addr);
- uint8_t *ipv6_array = link_specifier_getarray_un_ipv6_addr(ls);
- memcpy(ipv6_array, in6_addr, addr_len);
- link_specifier_set_un_ipv6_port(ls, ap.port);
-
- link_specifier_set_ls_len(ls, addr_len + sizeof(ap.port));
- }
- }
- static void
- setup_introduce1_data(const hs_desc_intro_point_t *ip,
- const node_t *rp_node,
- const uint8_t *subcredential,
- hs_cell_introduce1_data_t *intro1_data)
- {
- smartlist_t *rp_lspecs;
- tor_assert(ip);
- tor_assert(rp_node);
- tor_assert(subcredential);
- tor_assert(intro1_data);
-
- rp_lspecs = smartlist_new();
- get_lspecs_from_node(rp_node, rp_lspecs);
-
- memset(intro1_data, 0, sizeof(hs_cell_introduce1_data_t));
- if (ip->legacy.key != NULL) {
- intro1_data->is_legacy = 1;
- intro1_data->legacy_key = ip->legacy.key;
- }
- intro1_data->auth_pk = &ip->auth_key_cert->signed_key;
- intro1_data->enc_pk = &ip->enc_key;
- intro1_data->subcredential = subcredential;
- intro1_data->onion_pk = node_get_curve25519_onion_key(rp_node);
- intro1_data->link_specifiers = rp_lspecs;
- }
- origin_circuit_t *
- hs_circ_service_get_intro_circ(const hs_service_intro_point_t *ip)
- {
- origin_circuit_t *circ = NULL;
- tor_assert(ip);
- if (ip->base.is_only_legacy) {
- uint8_t digest[DIGEST_LEN];
- if (BUG(crypto_pk_get_digest(ip->legacy_key, (char *) digest) < 0)) {
- goto end;
- }
- circ = hs_circuitmap_get_intro_circ_v2_service_side(digest);
- } else {
- circ = hs_circuitmap_get_intro_circ_v3_service_side(
- &ip->auth_key_kp.pubkey);
- }
- end:
- return circ;
- }
- void
- hs_circ_retry_service_rendezvous_point(origin_circuit_t *circ)
- {
- tor_assert(circ);
- tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_S_CONNECT_REND);
-
- if (!can_relaunch_service_rendezvous_point(circ)) {
- goto done;
- }
-
- circ->hs_service_side_rend_circ_has_been_relaunched = 1;
-
- if (circ->hs_ident) {
- retry_service_rendezvous_point(circ);
- } else {
- rend_service_relaunch_rendezvous(circ);
- }
- done:
- return;
- }
- int
- hs_circ_launch_intro_point(hs_service_t *service,
- const hs_service_intro_point_t *ip,
- extend_info_t *ei)
- {
-
- int ret = -1, circ_flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL;
- origin_circuit_t *circ;
- tor_assert(service);
- tor_assert(ip);
- tor_assert(ei);
-
- if (service->config.is_single_onion) {
- circ_flags |= CIRCLAUNCH_ONEHOP_TUNNEL;
- }
- log_info(LD_REND, "Launching a circuit to intro point %s for service %s.",
- safe_str_client(extend_info_describe(ei)),
- safe_str_client(service->onion_address));
-
- service->state.num_intro_circ_launched++;
- circ = circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO,
- ei, circ_flags);
- if (circ == NULL) {
- goto end;
- }
-
- circ->hs_ident = create_intro_circuit_identifier(service, ip);
- tor_assert(circ->hs_ident);
-
- register_intro_circ(ip, circ);
-
- ret = 0;
- end:
- return ret;
- }
- int
- hs_circ_service_intro_has_opened(hs_service_t *service,
- hs_service_intro_point_t *ip,
- const hs_service_descriptor_t *desc,
- origin_circuit_t *circ)
- {
- int ret = 0;
- unsigned int num_intro_circ, num_needed_circ;
- tor_assert(service);
- tor_assert(ip);
- tor_assert(desc);
- tor_assert(circ);
-
- num_intro_circ = count_opened_desc_intro_point_circuits(service, desc);
- num_needed_circ = service->config.num_intro_points;
- if (num_intro_circ > num_needed_circ) {
-
-
- log_info(LD_CIRC | LD_REND, "Introduction circuit just opened but we "
- "have enough for service %s. Repurposing "
- "it to general and leaving internal.",
- safe_str_client(service->onion_address));
- tor_assert(circ->build_state->is_internal);
-
- hs_circuitmap_remove_circuit(TO_CIRCUIT(circ));
-
- hs_ident_circuit_free(circ->hs_ident);
- circ->hs_ident = NULL;
- circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_C_GENERAL);
-
- circuit_has_opened(circ);
-
- ret = 1;
- goto done;
- }
- log_info(LD_REND, "Introduction circuit %u established for service %s.",
- TO_CIRCUIT(circ)->n_circ_id,
- safe_str_client(service->onion_address));
- circuit_log_path(LOG_INFO, LD_REND, circ);
-
- send_establish_intro(service, ip, circ);
- done:
- return ret;
- }
- void
- hs_circ_service_rp_has_opened(const hs_service_t *service,
- origin_circuit_t *circ)
- {
- size_t payload_len;
- uint8_t payload[RELAY_PAYLOAD_SIZE] = {0};
- tor_assert(service);
- tor_assert(circ);
- tor_assert(circ->hs_ident);
-
- log_info(LD_REND, "Rendezvous circuit %u has opened with cookie %s "
- "for service %s",
- TO_CIRCUIT(circ)->n_circ_id,
- hex_str((const char *) circ->hs_ident->rendezvous_cookie,
- REND_COOKIE_LEN),
- safe_str_client(service->onion_address));
- circuit_log_path(LOG_INFO, LD_REND, circ);
-
- payload_len = hs_cell_build_rendezvous1(
- circ->hs_ident->rendezvous_cookie,
- sizeof(circ->hs_ident->rendezvous_cookie),
- circ->hs_ident->rendezvous_handshake_info,
- sizeof(circ->hs_ident->rendezvous_handshake_info),
- payload);
-
- if (payload_len < HS_LEGACY_RENDEZVOUS_CELL_SIZE) {
- crypto_rand((char *) payload + payload_len,
- HS_LEGACY_RENDEZVOUS_CELL_SIZE - payload_len);
- payload_len = HS_LEGACY_RENDEZVOUS_CELL_SIZE;
- }
- if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(circ),
- RELAY_COMMAND_RENDEZVOUS1,
- (const char *) payload, payload_len,
- circ->cpath->prev) < 0) {
-
- log_warn(LD_REND, "Unable to send RENDEZVOUS1 cell on circuit %u "
- "for service %s",
- TO_CIRCUIT(circ)->n_circ_id,
- safe_str_client(service->onion_address));
- goto done;
- }
-
- if (hs_circuit_setup_e2e_rend_circ(circ,
- circ->hs_ident->rendezvous_ntor_key_seed,
- sizeof(circ->hs_ident->rendezvous_ntor_key_seed),
- 1) < 0) {
- log_warn(LD_GENERAL, "Failed to setup circ");
- goto done;
- }
- done:
- memwipe(payload, 0, sizeof(payload));
- }
- int
- hs_circ_handle_intro_established(const hs_service_t *service,
- const hs_service_intro_point_t *ip,
- origin_circuit_t *circ,
- const uint8_t *payload, size_t payload_len)
- {
- int ret = -1;
- tor_assert(service);
- tor_assert(ip);
- tor_assert(circ);
- tor_assert(payload);
- if (BUG(TO_CIRCUIT(circ)->purpose != CIRCUIT_PURPOSE_S_ESTABLISH_INTRO)) {
- goto done;
- }
-
- if (!ip->base.is_only_legacy &&
- hs_cell_parse_intro_established(payload, payload_len) < 0) {
- log_warn(LD_REND, "Unable to parse the INTRO_ESTABLISHED cell on "
- "circuit %u for service %s",
- TO_CIRCUIT(circ)->n_circ_id,
- safe_str_client(service->onion_address));
- goto done;
- }
-
- circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_S_INTRO);
-
- pathbias_mark_use_success(circ);
-
- ret = 0;
- done:
- return ret;
- }
- int
- hs_circ_handle_introduce2(const hs_service_t *service,
- const origin_circuit_t *circ,
- hs_service_intro_point_t *ip,
- const uint8_t *subcredential,
- const uint8_t *payload, size_t payload_len)
- {
- int ret = -1;
- time_t elapsed;
- hs_cell_introduce2_data_t data;
- tor_assert(service);
- tor_assert(circ);
- tor_assert(ip);
- tor_assert(subcredential);
- tor_assert(payload);
-
- data.auth_pk = &ip->auth_key_kp.pubkey;
- data.enc_kp = &ip->enc_key_kp;
- data.subcredential = subcredential;
- data.payload = payload;
- data.payload_len = payload_len;
- data.link_specifiers = smartlist_new();
- data.replay_cache = ip->replay_cache;
- if (hs_cell_parse_introduce2(&data, circ, service) < 0) {
- goto done;
- }
-
- if (replaycache_add_test_and_elapsed(
- service->state.replay_cache_rend_cookie,
- data.rendezvous_cookie, sizeof(data.rendezvous_cookie),
- &elapsed)) {
-
- log_info(LD_REND, "We received an INTRODUCE2 cell with same REND_COOKIE "
- "field %ld seconds ago. Dropping cell.",
- (long int) elapsed);
- goto done;
- }
-
- ip->introduce2_count++;
-
- launch_rendezvous_point_circuit(service, ip, &data);
-
- ret = 0;
- done:
- SMARTLIST_FOREACH(data.link_specifiers, link_specifier_t *, lspec,
- link_specifier_free(lspec));
- smartlist_free(data.link_specifiers);
- memwipe(&data, 0, sizeof(data));
- return ret;
- }
- int
- hs_circuit_setup_e2e_rend_circ(origin_circuit_t *circ,
- const uint8_t *ntor_key_seed, size_t seed_len,
- int is_service_side)
- {
- if (BUG(!circuit_purpose_is_correct_for_rend(TO_CIRCUIT(circ)->purpose,
- is_service_side))) {
- return -1;
- }
- crypt_path_t *hop = create_rend_cpath(ntor_key_seed, seed_len,
- is_service_side);
- if (!hop) {
- log_warn(LD_REND, "Couldn't get v3 %s cpath!",
- is_service_side ? "service-side" : "client-side");
- return -1;
- }
- finalize_rend_circuit(circ, hop, is_service_side);
- return 0;
- }
- int
- hs_circuit_setup_e2e_rend_circ_legacy_client(origin_circuit_t *circ,
- const uint8_t *rend_cell_body)
- {
- if (BUG(!circuit_purpose_is_correct_for_rend(
- TO_CIRCUIT(circ)->purpose, 0))) {
- return -1;
- }
- crypt_path_t *hop = create_rend_cpath_legacy(circ, rend_cell_body);
- if (!hop) {
- log_warn(LD_GENERAL, "Couldn't get v2 cpath.");
- return -1;
- }
- finalize_rend_circuit(circ, hop, 0);
- return 0;
- }
- int
- hs_circ_send_introduce1(origin_circuit_t *intro_circ,
- origin_circuit_t *rend_circ,
- const hs_desc_intro_point_t *ip,
- const uint8_t *subcredential)
- {
- int ret = -1;
- ssize_t payload_len;
- uint8_t payload[RELAY_PAYLOAD_SIZE] = {0};
- hs_cell_introduce1_data_t intro1_data;
- tor_assert(intro_circ);
- tor_assert(rend_circ);
- tor_assert(ip);
- tor_assert(subcredential);
-
- const node_t *exit_node = build_state_get_exit_node(rend_circ->build_state);
- setup_introduce1_data(ip, exit_node, subcredential, &intro1_data);
-
- if (BUG(!intro1_data.link_specifiers) ||
- !smartlist_len(intro1_data.link_specifiers)) {
- log_warn(LD_REND, "Unable to get link specifiers for INTRODUCE1 cell on "
- "circuit %u.", TO_CIRCUIT(intro_circ)->n_circ_id);
- goto done;
- }
-
- intro1_data.rendezvous_cookie = rend_circ->hs_ident->rendezvous_cookie;
- intro1_data.client_kp = &rend_circ->hs_ident->rendezvous_client_kp;
- memcpy(intro_circ->hs_ident->rendezvous_cookie,
- rend_circ->hs_ident->rendezvous_cookie,
- sizeof(intro_circ->hs_ident->rendezvous_cookie));
-
- payload_len = hs_cell_build_introduce1(&intro1_data, payload);
- if (BUG(payload_len < 0)) {
- goto done;
- }
- if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(intro_circ),
- RELAY_COMMAND_INTRODUCE1,
- (const char *) payload, payload_len,
- intro_circ->cpath->prev) < 0) {
-
- log_warn(LD_REND, "Unable to send INTRODUCE1 cell on circuit %u.",
- TO_CIRCUIT(intro_circ)->n_circ_id);
- goto done;
- }
-
- ret = 0;
- goto done;
- done:
- hs_cell_introduce1_data_clear(&intro1_data);
- memwipe(payload, 0, sizeof(payload));
- return ret;
- }
- int
- hs_circ_send_establish_rendezvous(origin_circuit_t *circ)
- {
- ssize_t cell_len = 0;
- uint8_t cell[RELAY_PAYLOAD_SIZE] = {0};
- tor_assert(circ);
- tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_C_ESTABLISH_REND);
- log_info(LD_REND, "Send an ESTABLISH_RENDEZVOUS cell on circuit %u",
- TO_CIRCUIT(circ)->n_circ_id);
-
- TO_CIRCUIT(circ)->timestamp_dirty = time(NULL);
-
- pathbias_count_use_attempt(circ);
-
- crypto_rand((char *) circ->hs_ident->rendezvous_cookie, HS_REND_COOKIE_LEN);
-
- curve25519_keypair_generate(&circ->hs_ident->rendezvous_client_kp, 0);
- cell_len =
- hs_cell_build_establish_rendezvous(circ->hs_ident->rendezvous_cookie,
- cell);
- if (BUG(cell_len < 0)) {
- goto err;
- }
- if (relay_send_command_from_edge(CONTROL_CELL_ID, TO_CIRCUIT(circ),
- RELAY_COMMAND_ESTABLISH_RENDEZVOUS,
- (const char *) cell, cell_len,
- circ->cpath->prev) < 0) {
-
- log_warn(LD_REND, "Unable to send ESTABLISH_RENDEZVOUS cell on "
- "circuit %u", TO_CIRCUIT(circ)->n_circ_id);
- memwipe(cell, 0, cell_len);
- goto err;
- }
- memwipe(cell, 0, cell_len);
- return 0;
- err:
- return -1;
- }
|