tor-commits December 2017

tor-commits@lists.torproject.org

14 participants
2422 discussions

[tor/master] hs-v3: Add ephemeral service support
by nickm＠torproject.org 06 Dec '17

06 Dec '17

commit f0e3331f3ca44aa8eb806487be2e03a2e9e52567 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Nov 9 14:28:22 2017 -0500 hs-v3: Add ephemeral service support The functions are now used by the ADD_ONION/DEL_ONION control port command as well. This commits makes them fully functionnal with hidden service v3. Part of #20699 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/control.c | 45 +++++++++++----- src/or/hs_service.c | 126 +++++++++++++++++++++++++++++++++++++++++++++ src/or/hs_service.h | 6 +++ src/test/test_controller.c | 81 ++++++++++++++++++++++++++++- 4 files changed, 243 insertions(+), 15 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index 19527acb3..d9102894e 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -4447,19 +4447,14 @@ add_onion_helper_add_service(int hs_version, void *pk, smartlist_t *port_cfgs, switch (hs_version) { case HS_VERSION_TWO: - { ret = rend_service_add_ephemeral(pk, port_cfgs, max_streams, max_streams_close_circuit, auth_type, auth_clients, address_out); break; - } case HS_VERSION_THREE: - { - /* XXX: Not implemented yet. */ - *address_out = tor_strdup("this is a v3 address"); - ret = RSAE_OKAY; + ret = hs_service_add_ephemeral(pk, port_cfgs, max_streams, + max_streams_close_circuit, address_out); break; - } default: tor_assert_unreached(); } @@ -4971,6 +4966,7 @@ handle_control_del_onion(control_connection_t *conn, uint32_t len, const char *body) { + int hs_version = 0; smartlist_t *args; (void) len; /* body is nul-terminated; it's safe to ignore the length */ args = getargs_helper("DEL_ONION", conn, body, 1, 1); @@ -4978,7 +4974,11 @@ handle_control_del_onion(control_connection_t *conn, return 0; const char *service_id = smartlist_get(args, 0); - if (!rend_valid_v2_service_id(service_id)) { + if (rend_valid_v2_service_id(service_id)) { + hs_version = HS_VERSION_TWO; + } else if (hs_address_is_valid(service_id)) { + hs_version = HS_VERSION_THREE; + } else { connection_printf_to_buf(conn, "512 Malformed Onion Service id\r\n"); goto out; } @@ -5005,8 +5005,20 @@ handle_control_del_onion(control_connection_t *conn, if (onion_services == NULL) { connection_printf_to_buf(conn, "552 Unknown Onion Service id\r\n"); } else { - int ret = rend_service_del_ephemeral(service_id); - if (ret) { + int ret = -1; + switch (hs_version) { + case HS_VERSION_TWO: + ret = rend_service_del_ephemeral(service_id); + break; + case HS_VERSION_THREE: + ret = hs_service_del_ephemeral(service_id); + break; + default: + /* The ret value will be -1 thus hitting the warning below. This should + * never happen because of the check at the start of the function. */ + break; + } + if (ret < 0) { /* This should *NEVER* fail, since the service is on either the * per-control connection list, or the global one. */ @@ -5076,9 +5088,16 @@ connection_control_closed(control_connection_t *conn) * The list and it's contents are scrubbed/freed in connection_free_. */ if (conn->ephemeral_onion_services) { - SMARTLIST_FOREACH(conn->ephemeral_onion_services, char *, cp, { - rend_service_del_ephemeral(cp); - }); + SMARTLIST_FOREACH_BEGIN(conn->ephemeral_onion_services, char *, cp) { + if (rend_valid_v2_service_id(cp)) { + rend_service_del_ephemeral(cp); + } else if (hs_address_is_valid(cp)) { + hs_service_del_ephemeral(cp); + } else { + /* An invalid .onion in our list should NEVER happen */ + tor_fragile_assert(); + } + } SMARTLIST_FOREACH_END(cp); } if (conn->is_owning_control_connection) { diff --git a/src/or/hs_service.c b/src/or/hs_service.c index 349aa265d..944400a0e 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -2900,6 +2900,132 @@ service_add_fnames_to_list(const hs_service_t *service, smartlist_t *list) /* Public API */ /* ========== */ +/* Add the ephemeral service using the secret key sk and ports. Both max + * streams parameter will be set in the newly created service. + * + * Ownership of sk and ports is passed to this routine. Regardless of + * success/failure, callers should not touch these values after calling this + * routine, and may assume that correct cleanup has been done on failure. + * + * Return an appropriate hs_service_add_ephemeral_status_t. */ +hs_service_add_ephemeral_status_t +hs_service_add_ephemeral(ed25519_secret_key_t *sk, smartlist_t *ports, + int max_streams_per_rdv_circuit, + int max_streams_close_circuit, char **address_out) +{ + hs_service_add_ephemeral_status_t ret; + hs_service_t *service = NULL; + + tor_assert(sk); + tor_assert(ports); + tor_assert(address_out); + + service = hs_service_new(get_options()); + + /* Setup the service configuration with specifics. A default service is + * HS_VERSION_TWO so explicitely set it. */ + service->config.version = HS_VERSION_THREE; + service->config.max_streams_per_rdv_circuit = max_streams_per_rdv_circuit; + service->config.max_streams_close_circuit = !!max_streams_close_circuit; + service->config.is_ephemeral = 1; + smartlist_free(service->config.ports); + service->config.ports = ports; + + /* Handle the keys. */ + memcpy(&service->keys.identity_sk, sk, sizeof(service->keys.identity_sk)); + if (ed25519_public_key_generate(&service->keys.identity_pk, + &service->keys.identity_sk) < 0) { + log_warn(LD_CONFIG, "Unable to generate ed25519 public key" + "for v3 service."); + ret = RSAE_BADPRIVKEY; + goto err; + } + + /* Make sure we have at least one port. */ + if (smartlist_len(service->config.ports) == 0) { + log_warn(LD_CONFIG, "At least one VIRTPORT/TARGET must be specified " + "for v3 service."); + ret = RSAE_BADVIRTPORT; + goto err; + } + + /* The only way the registration can fail is if the service public key + * already exists. */ + if (BUG(register_service(hs_service_map, service) < 0)) { + log_warn(LD_CONFIG, "Onion Service private key collides with an " + "existing v3 service."); + ret = RSAE_ADDREXISTS; + goto err; + } + + /* Last step is to build the onion address. */ + hs_build_address(&service->keys.identity_pk, + (uint8_t) service->config.version, + service->onion_address); + *address_out = tor_strdup(service->onion_address); + + log_info(LD_CONFIG, "Added ephemeral v3 onion service: %s", + safe_str_client(service->onion_address)); + ret = RSAE_OKAY; + goto end; + + err: + hs_service_free(service); + + end: + memwipe(sk, 0, sizeof(ed25519_secret_key_t)); + tor_free(sk); + return ret; +} + +/* For the given onion address, delete the ephemeral service. Return 0 on + * success else -1 on error. */ +int +hs_service_del_ephemeral(const char *address) +{ + uint8_t version; + ed25519_public_key_t pk; + hs_service_t *service = NULL; + + tor_assert(address); + + if (hs_parse_address(address, &pk, NULL, &version) < 0) { + log_warn(LD_CONFIG, "Requested malformed v3 onion address for removal."); + goto err; + } + + if (version != HS_VERSION_THREE) { + log_warn(LD_CONFIG, "Requested version of onion address for removal " + "is not supported."); + goto err; + } + + service = find_service(hs_service_map, &pk); + if (service == NULL) { + log_warn(LD_CONFIG, "Requested non-existent v3 hidden service for " + "removal."); + goto err; + } + + if (!service->config.is_ephemeral) { + log_warn(LD_CONFIG, "Requested non-ephemeral v3 hidden service for " + "removal."); + goto err; + } + + /* Close circuits, remove from map and finally free. */ + close_service_circuits(service); + remove_service(hs_service_map, service); + hs_service_free(service); + + log_info(LD_CONFIG, "Removed ephemeral v3 hidden service: %s", + safe_str_client(address)); + return 0; + + err: + return -1; +} + /* Using the ed25519 public key pk, find a service for that key and return the * current encoded descriptor as a newly allocated string or NULL if not * found. This is used by the control port subsystem. */ diff --git a/src/or/hs_service.h b/src/or/hs_service.h index e78cc4c2b..de04987c8 100644 --- a/src/or/hs_service.h +++ b/src/or/hs_service.h @@ -273,6 +273,12 @@ void hs_service_intro_circ_has_closed(origin_circuit_t *circ); char *hs_service_lookup_current_desc(const ed25519_public_key_t *pk); +hs_service_add_ephemeral_status_t +hs_service_add_ephemeral(ed25519_secret_key_t *sk, smartlist_t *ports, + int max_streams_per_rdv_circuit, + int max_streams_close_circuit, char **address_out); +int hs_service_del_ephemeral(const char *address); + #ifdef HS_SERVICE_PRIVATE #ifdef TOR_UNIT_TESTS diff --git a/src/test/test_controller.c b/src/test/test_controller.c index 056d9333f..a5132bd4c 100644 --- a/src/test/test_controller.c +++ b/src/test/test_controller.c @@ -14,7 +14,81 @@ #include "test_helpers.h" static void -test_add_onion_helper_keyarg(void *arg) +test_add_onion_helper_keyarg_v3(void *arg) +{ + int ret, hs_version; + void *pk_ptr = NULL; + char *key_new_blob = NULL; + char *err_msg = NULL; + const char *key_new_alg = NULL; + + (void) arg; + + /* Test explicit ED25519-V3 key generation. */ + ret = add_onion_helper_keyarg("NEW:ED25519-V3", 0, &key_new_alg, + &key_new_blob, &pk_ptr, &hs_version, + &err_msg); + tt_int_op(ret, OP_EQ, 0); + tt_int_op(hs_version, OP_EQ, HS_VERSION_THREE); + tt_assert(pk_ptr); + tt_str_op(key_new_alg, OP_EQ, "ED25519-V3"); + tt_assert(key_new_blob); + tt_ptr_op(err_msg, OP_EQ, NULL); + tor_free(pk_ptr); pk_ptr = NULL; + tor_free(key_new_blob); + + /* Test discarding the private key. */ + ret = add_onion_helper_keyarg("NEW:ED25519-V3", 1, &key_new_alg, + &key_new_blob, &pk_ptr, &hs_version, + &err_msg); + tt_int_op(ret, OP_EQ, 0); + tt_int_op(hs_version, OP_EQ, HS_VERSION_THREE); + tt_assert(pk_ptr); + tt_ptr_op(key_new_alg, OP_EQ, NULL); + tt_ptr_op(key_new_blob, OP_EQ, NULL); + tt_ptr_op(err_msg, OP_EQ, NULL); + tor_free(pk_ptr); pk_ptr = NULL; + tor_free(key_new_blob); + + /* Test passing a key blob. */ + { + /* The base64 key and hex key are the same. Hex key is 64 bytes long. The + * sk has been generated randomly using python3. */ + const char *base64_sk = + "a9bT19PqGC9Y+BmOo1IQvCGjjwxMiaaxEXZ+FKMxpEQW" + "6AmSV5roThUGMRCaqQSCnR2jI1vL2QxHORzI4RxMmw=="; + const char *hex_sk = + "\x6b\xd6\xd3\xd7\xd3\xea\x18\x2f\x58\xf8\x19\x8e\xa3\x52\x10\xbc" + "\x21\xa3\x8f\x0c\x4c\x89\xa6\xb1\x11\x76\x7e\x14\xa3\x31\xa4\x44" + "\x16\xe8\x09\x92\x57\x9a\xe8\x4e\x15\x06\x31\x10\x9a\xa9\x04\x82" + "\x9d\x1d\xa3\x23\x5b\xcb\xd9\x0c\x47\x39\x1c\xc8\xe1\x1c\x4c\x9b"; + char *key_blob = NULL; + + tor_asprintf(&key_blob, "ED25519-V3:%s", base64_sk); + tt_assert(key_blob); + ret = add_onion_helper_keyarg(key_blob, 1, &key_new_alg, + &key_new_blob, &pk_ptr, &hs_version, + &err_msg); + tor_free(key_blob); + tt_int_op(ret, OP_EQ, 0); + tt_int_op(hs_version, OP_EQ, HS_VERSION_THREE); + tt_assert(pk_ptr); + tt_mem_op(pk_ptr, OP_EQ, hex_sk, 64); + tt_ptr_op(key_new_alg, OP_EQ, NULL); + tt_ptr_op(key_new_blob, OP_EQ, NULL); + tt_ptr_op(err_msg, OP_EQ, NULL); + tor_free(pk_ptr); pk_ptr = NULL; + tor_free(key_new_blob); + } + + done: + tor_free(pk_ptr); + tor_free(key_new_blob); + tor_free(err_msg); +} + +static void +test_add_onion_helper_keyarg_v2(void *arg) { int ret, hs_version; void *pk_ptr = NULL; @@ -1386,7 +1460,10 @@ test_download_status_bridge(void *arg) } struct testcase_t controller_tests[] = { - { "add_onion_helper_keyarg", test_add_onion_helper_keyarg, 0, NULL, NULL }, + { "add_onion_helper_keyarg_v2", test_add_onion_helper_keyarg_v2, 0, + NULL, NULL }, + { "add_onion_helper_keyarg_v3", test_add_onion_helper_keyarg_v3, 0, + NULL, NULL }, { "getinfo_helper_onion", test_getinfo_helper_onion, 0, NULL, NULL }, { "rend_service_parse_port_config", test_rend_service_parse_port_config, 0, NULL, NULL },

1 0

[tor/master] control: Don't check if Server is an HSDir for HSPOST
by nickm＠torproject.org 06 Dec '17

06 Dec '17

commit 475d8d1a3d2e68c237095b88417f756afc360147 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Nov 15 14:37:11 2017 -0500 control: Don't check if Server is an HSDir for HSPOST This is removed for two reasons. First, HSDir accepts descriptor even though they don't think they are in fact an HSDir. This is to avoid consensus desync between client/service and directories. Second, our malicious HSDir scanner uses the HSPOST command to post on all relays in order to test them before they could become HSDir. We had to remove that check from the tor code that the scanner uses. Thus, this check should not be enforced by the control port for the above use cases. It is also a bit more complex with v3 support for which not all HSDir support it so basically irrelevant check. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/control.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index 24e3ebe7d..7ade90ea8 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -4370,11 +4370,6 @@ handle_control_hspost(control_connection_t *conn, server); goto done; } - if (!node->rs->is_hs_dir) { - connection_printf_to_buf(conn, "552 Server \"%s\" is not a HSDir" - "\r\n", server); - goto done; - } /* Valid server, add it to our local list. */ if (!hs_dirs) hs_dirs = smartlist_new();

1 0

[tor/master] control: Refactor control_event_hs_descriptor_receive_end
by nickm＠torproject.org 06 Dec '17

06 Dec '17

commit beacbbe2106f9af64a64fea3f69e5dcd43c1569e Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Nov 10 11:16:16 2017 -0500 control: Refactor control_event_hs_descriptor_receive_end First, rename and make that function static because it is internal to control.c and called by two HS_DESC events. Second, make it take more basic parameters and thus not a rend_data_t object so we can still use the function for v3 HS that doesn't use that object. Third, move the descriptor ID lookup to the two specific events (yes little code duplication there) because they get a rend_data_t object which won't be the case for v3. Finally, through this refactoring, change the pointer check to BUG() and change some parameter names to reflect what they really are. No behavior change at this commit. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/control.c | 93 ++++++++++++++++++++++++++++++++------------------------ src/or/control.h | 5 --- 2 files changed, 54 insertions(+), 44 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index 9a8d1f302..99acbcdcb 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -7289,33 +7289,20 @@ control_event_hs_descriptor_upload(const char *onion_address, * * So do not call this function directly. */ -void -control_event_hs_descriptor_receive_end(const char *action, - const char *onion_address, - const rend_data_t *rend_data, - const char *id_digest, - const char *reason) +static void +event_hs_descriptor_receive_end(const char *action, + const char *onion_address, + const char *desc_id, + rend_auth_type_t auth_type, + const char *hsdir_id_digest, + const char *reason) { - char *desc_id_field = NULL; char *reason_field = NULL; - char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; - const char *desc_id = NULL; - if (!action || !rend_data || !onion_address) { - log_warn(LD_BUG, "Called with action==%p, rend_data==%p, " - "onion_address==%p", action, rend_data, onion_address); + if (BUG(!action || !onion_address)) { return; } - desc_id = get_desc_id_from_query(rend_data, id_digest); - if (desc_id != NULL) { - /* Set the descriptor ID digest to base32 so we can send it. */ - base32_encode(desc_id_base32, sizeof(desc_id_base32), desc_id, - DIGEST_LEN); - /* Extra whitespace is needed before the value. */ - tor_asprintf(&desc_id_field, " %s", desc_id_base32); - } - if (reason) { tor_asprintf(&reason_field, " REASON=%s", reason); } @@ -7324,14 +7311,13 @@ control_event_hs_descriptor_receive_end(const char *action, "650 HS_DESC %s %s %s %s%s%s\r\n", action, rend_hsaddress_str_or_unknown(onion_address), - rend_auth_type_to_string( - TO_REND_DATA_V2(rend_data)->auth_type), - id_digest ? - node_describe_longname_by_id(id_digest) : "UNKNOWN", - desc_id_field ? desc_id_field : "", + rend_auth_type_to_string(auth_type), + hsdir_id_digest ? + node_describe_longname_by_id(hsdir_id_digest) : + "UNKNOWN", + desc_id ? desc_id : "", reason_field ? reason_field : ""); - tor_free(desc_id_field); tor_free(reason_field); } @@ -7376,15 +7362,29 @@ control_event_hs_descriptor_upload_end(const char *action, void control_event_hs_descriptor_received(const char *onion_address, const rend_data_t *rend_data, - const char *id_digest) + const char *hsdir_id_digest) { - if (!rend_data || !id_digest || !onion_address) { - log_warn(LD_BUG, "Called with rend_data==%p, id_digest==%p, " - "onion_address==%p", rend_data, id_digest, onion_address); + char *desc_id_field = NULL; + const char *desc_id; + + if (BUG(!rend_data || !hsdir_id_digest || !onion_address)) { return; } - control_event_hs_descriptor_receive_end("RECEIVED", onion_address, - rend_data, id_digest, NULL); + + desc_id = get_desc_id_from_query(rend_data, hsdir_id_digest); + if (desc_id != NULL) { + char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; + /* Set the descriptor ID digest to base32 so we can send it. */ + base32_encode(desc_id_base32, sizeof(desc_id_base32), desc_id, + DIGEST_LEN); + /* Extra whitespace is needed before the value. */ + tor_asprintf(&desc_id_field, " %s", desc_id_base32); + } + + event_hs_descriptor_receive_end("RECEIVED", onion_address, desc_id_field, + TO_REND_DATA_V2(rend_data)->auth_type, + hsdir_id_digest, NULL); + tor_free(desc_id_field); } /** send HS_DESC UPLOADED event @@ -7410,16 +7410,31 @@ control_event_hs_descriptor_uploaded(const char *id_digest, */ void control_event_hs_descriptor_failed(const rend_data_t *rend_data, - const char *id_digest, + const char *hsdir_id_digest, const char *reason) { - if (!rend_data) { - log_warn(LD_BUG, "Called with rend_data==%p", rend_data); + char *desc_id_field = NULL; + const char *desc_id; + + if (BUG(!rend_data)) { return; } - control_event_hs_descriptor_receive_end("FAILED", - rend_data_get_address(rend_data), - rend_data, id_digest, reason); + + desc_id = get_desc_id_from_query(rend_data, hsdir_id_digest); + if (desc_id != NULL) { + char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; + /* Set the descriptor ID digest to base32 so we can send it. */ + base32_encode(desc_id_base32, sizeof(desc_id_base32), desc_id, + DIGEST_LEN); + /* Extra whitespace is needed before the value. */ + tor_asprintf(&desc_id_field, " %s", desc_id_base32); + } + + event_hs_descriptor_receive_end("FAILED", rend_data_get_address(rend_data), + desc_id_field, + TO_REND_DATA_V2(rend_data)->auth_type, + hsdir_id_digest, reason); + tor_free(desc_id_field); } /** Send HS_DESC_CONTENT event after completion of a successful fetch from hs diff --git a/src/or/control.h b/src/or/control.h index 45fc4a9bc..a5f2599d2 100644 --- a/src/or/control.h +++ b/src/or/control.h @@ -125,11 +125,6 @@ void control_event_hs_descriptor_created(const char *onion_address, void control_event_hs_descriptor_upload(const char *onion_address, const char *desc_id, const char *hs_dir); -void control_event_hs_descriptor_receive_end(const char *action, - const char *onion_address, - const rend_data_t *rend_data, - const char *id_digest, - const char *reason); void control_event_hs_descriptor_upload_end(const char *action, const char *onion_address, const char *hs_dir,

1 0

[tor/master] Merge branch 'dgoulet_ticket20699_033_01'
by nickm＠torproject.org 06 Dec '17

06 Dec '17

1 0

[tor/master] control: Add changes file for HSv3 control port
by nickm＠torproject.org 06 Dec '17

06 Dec '17

commit 5d4fc193f911d669151f102e5597438e8219ea81 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Dec 5 14:54:00 2017 -0500 control: Add changes file for HSv3 control port Part of #20699. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket20699 | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/changes/ticket20699 b/changes/ticket20699 new file mode 100644 index 000000000..a93236ba4 --- /dev/null +++ b/changes/ticket20699 @@ -0,0 +1,14 @@ + o Major features (hidden service v3, control port): + - Control port now supports command and events for hidden service v3. See + proposal 284 for more information on what has been done exactly. Only + the HSFETCH command hasn't been implemented at this stage because of a + lack of use case with v3. + + It is now possible to create ephemeral v3 services using the ADD_ONION + command. Here is a summary of the events and commands that have been + modified to support v3: + + Events: HS_DESC, HS_DESC_CONTENT, CIRC and CIRC_MINOR The + Commands: GETINFO, HSPOST, ADD_ONION and DEL_ONION. + + This closes ticket 20699.

1 0

[tor/master] control: Improve ADD_ONION helper function comments
by nickm＠torproject.org 06 Dec '17

06 Dec '17

commit c094802697fe10a3f24dbb3f506c51a78f5c7a4f Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Dec 5 14:30:47 2017 -0500 control: Improve ADD_ONION helper function comments Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/control.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index d84ce7d63..f1960b884 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -4449,10 +4449,17 @@ handle_control_hspost(control_connection_t *conn, } /* Helper function for ADD_ONION that adds an ephemeral service depending on - * the given hs_version. The pk's type defers depending on the version so the - * caller should make sure those two matches. Both port_cfgs and auth_clients - * are now owned by the hidden service subsystem so the caller must stop - * accessing them. + * the given hs_version. + * + * The secret key in pk depends on the hs_version. The ownership of the key + * used in pk is given to the HS subsystem so the caller must stop accessing + * it after. + * + * The port_cfgs is a list of service port. Ownership transfered to service. + * The max_streams refers to the MaxStreams= key. + * The max_streams_close_circuit refers to the MaxStreamsCloseCircuit key. + * The auth_type is the authentication type of the clients in auth_clients. + * The ownership of that list is transfered to the service. * * On success (RSAE_OKAY), the address_out points to a newly allocated string * containing the onion address without the .onion part. On error, address_out

1 0

[tor/master] hs-v3: Implement HS_DESC REQUESTED event
by nickm＠torproject.org 06 Dec '17

06 Dec '17

commit 743d0b9d91c0c26045aa9a725865870f0c052794 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Nov 10 12:07:57 2017 -0500 hs-v3: Implement HS_DESC REQUESTED event This changes the control_event_hs_descriptor_requested() call to add the hsdir index optional value. v2 passes NULL all the time. This commit creates hs_control.{c|h} that contains wrappers for the HS subsystem to interact with the control port subsystem. The descriptor REQUESTED event is implemented following proposal 284 extension for v3. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/control.c | 16 +++++++++++++--- src/or/control.h | 3 ++- src/or/hs_client.c | 5 +++++ src/or/hs_control.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ src/or/hs_control.h | 18 ++++++++++++++++++ src/or/include.am | 4 +++- src/or/rendclient.c | 2 +- src/test/test_hs.c | 2 +- 8 files changed, 95 insertions(+), 7 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index e7ec23817..cd1be5bf4 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -7175,23 +7175,33 @@ rend_hsaddress_str_or_unknown(const char *onion_address) * rend_query is used to fetch requested onion address and auth type. * hs_dir is the description of contacting hs directory. * desc_id_base32 is the ID of requested hs descriptor. + * hsdir_index is the HSDir fetch index value for v3, an hex string. */ void control_event_hs_descriptor_requested(const char *onion_address, rend_auth_type_t auth_type, const char *id_digest, - const char *desc_id) + const char *desc_id, + const char *hsdir_index) { + char *hsdir_index_field = NULL; + if (BUG(!id_digest || !desc_id)) { return; } + if (hsdir_index) { + tor_asprintf(&hsdir_index_field, " HSDIR_INDEX=%s", hsdir_index); + } + send_control_event(EVENT_HS_DESC, - "650 HS_DESC REQUESTED %s %s %s %s\r\n", + "650 HS_DESC REQUESTED %s %s %s %s%s\r\n", rend_hsaddress_str_or_unknown(onion_address), rend_auth_type_to_string(auth_type), node_describe_longname_by_id(id_digest), - desc_id); + desc_id, + hsdir_index_field ? hsdir_index_field : ""); + tor_free(hsdir_index_field); } /** For an HS descriptor query rend_data, using the diff --git a/src/or/control.h b/src/or/control.h index 1744baba2..5a7a87c06 100644 --- a/src/or/control.h +++ b/src/or/control.h @@ -118,7 +118,8 @@ MOCK_DECL(const char *, node_describe_longname_by_id,(const char *id_digest)); void control_event_hs_descriptor_requested(const char *onion_address, rend_auth_type_t auth_type, const char *id_digest, - const char *desc_id); + const char *desc_id, + const char *hsdir_index); void control_event_hs_descriptor_created(const char *onion_address, const char *desc_id, int replica); diff --git a/src/or/hs_client.c b/src/or/hs_client.c index 9ac653c72..666860155 100644 --- a/src/or/hs_client.c +++ b/src/or/hs_client.c @@ -21,6 +21,7 @@ #include "config.h" #include "directory.h" #include "hs_client.h" +#include "hs_control.h" #include "router.h" #include "routerset.h" #include "circuitlist.h" @@ -349,6 +350,10 @@ directory_launch_v3_desc_fetch(const ed25519_public_key_t *onion_identity_pk, safe_str_client(base64_blinded_pubkey), safe_str_client(routerstatus_describe(hsdir))); + /* Fire a REQUESTED event on the control port. */ + hs_control_desc_event_requested(onion_identity_pk, base64_blinded_pubkey, + hsdir); + /* Cleanup memory. */ memwipe(&blinded_pubkey, 0, sizeof(blinded_pubkey)); memwipe(base64_blinded_pubkey, 0, sizeof(base64_blinded_pubkey)); diff --git a/src/or/hs_control.c b/src/or/hs_control.c new file mode 100644 index 000000000..0bcb41dcc --- /dev/null +++ b/src/or/hs_control.c @@ -0,0 +1,52 @@ +/* Copyright (c) 2017, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file hs_control.c + * \brief Contains control port event related code. + **/ + +#include "or.h" +#include "control.h" +#include "hs_common.h" +#include "hs_control.h" +#include "nodelist.h" + +/* Send on the control port the "HS_DESC REQUESTED [...]" event. + * + * The onion_pk is the onion service public key, base64_blinded_pk is the + * base64 encoded blinded key for the service and hsdir_rs is the routerstatus + * object of the HSDir that this request is for. */ +void +hs_control_desc_event_requested(const ed25519_public_key_t *onion_pk, + const char *base64_blinded_pk, + const routerstatus_t *hsdir_rs) +{ + char onion_address[HS_SERVICE_ADDR_LEN_BASE32 + 1]; + const uint8_t *hsdir_index; + const node_t *hsdir_node; + + tor_assert(onion_pk); + tor_assert(base64_blinded_pk); + tor_assert(hsdir_rs); + + hs_build_address(onion_pk, HS_VERSION_THREE, onion_address); + + /* Get the node from the routerstatus object to get the HSDir index used for + * this request. We can't have a routerstatus entry without a node and we + * can't pick a node without an hsdir_index. */ + hsdir_node = node_get_by_id(hsdir_rs->identity_digest); + tor_assert(hsdir_node); + tor_assert(hsdir_node->hsdir_index); + /* This is a fetch event. */ + hsdir_index = hsdir_node->hsdir_index->fetch; + + /* Trigger the event. */ + control_event_hs_descriptor_requested(onion_address, REND_NO_AUTH, + hsdir_rs->identity_digest, + base64_blinded_pk, + hex_str((const char *) hsdir_index, + DIGEST256_LEN)); + memwipe(onion_address, 0, sizeof(onion_address)); +} + diff --git a/src/or/hs_control.h b/src/or/hs_control.h new file mode 100644 index 000000000..2878ba5bc --- /dev/null +++ b/src/or/hs_control.h @@ -0,0 +1,18 @@ +/* Copyright (c) 2017, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file hs_control.h + * \brief Header file containing control port event related code. + **/ + +#ifndef TOR_HS_CONTROL_H +#define TOR_HS_CONTROL_H + +/* Event "HS_DESC REQUESTED [...]" */ +void hs_control_desc_event_requested(const ed25519_public_key_t *onion_pk, + const char *base64_blinded_pk, + const routerstatus_t *hsdir_rs); + +#endif /* !defined(TOR_HS_CONTROL_H) */ + diff --git a/src/or/include.am b/src/or/include.am index b783f4855..1c66cd2de 100644 --- a/src/or/include.am +++ b/src/or/include.am @@ -60,6 +60,7 @@ LIBTOR_A_SOURCES = \ src/or/hs_client.c \ src/or/hs_common.c \ src/or/hs_config.c \ + src/or/hs_control.c \ src/or/hs_descriptor.c \ src/or/hs_ident.c \ src/or/hs_intropoint.c \ @@ -196,11 +197,12 @@ ORHEADERS = \ src/or/hibernate.h \ src/or/hs_cache.h \ src/or/hs_cell.h \ - src/or/hs_config.h \ src/or/hs_circuit.h \ src/or/hs_circuitmap.h \ src/or/hs_client.h \ src/or/hs_common.h \ + src/or/hs_config.h \ + src/or/hs_control.h \ src/or/hs_descriptor.h \ src/or/hs_ident.h \ src/or/hs_intropoint.h \ diff --git a/src/or/rendclient.c b/src/or/rendclient.c index eb097a50f..8291e5abf 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -519,7 +519,7 @@ directory_get_from_hs_dir(const char *desc_id, control_event_hs_descriptor_requested(rend_data->onion_address, rend_data->auth_type, hs_dir->identity_digest, - desc_id_base32); + desc_id_base32, NULL); return 1; } diff --git a/src/test/test_hs.c b/src/test/test_hs.c index 14799c993..55c6218dd 100644 --- a/src/test/test_hs.c +++ b/src/test/test_hs.c @@ -260,7 +260,7 @@ test_hs_desc_event(void *arg) /* test request event */ control_event_hs_descriptor_requested(rend_query.onion_address, rend_query.auth_type, HSDIR_EXIST_ID, - STR_DESC_ID_BASE32); + STR_DESC_ID_BASE32, NULL); expected_msg = "650 HS_DESC REQUESTED "STR_HS_ADDR" NO_AUTH "\ STR_HSDIR_EXIST_LONGNAME " " STR_DESC_ID_BASE32 "\r\n"; tt_assert(received_msg);

1 0

[tor/master] control: Don't use void pointer for ADD_ONION secret key
by nickm＠torproject.org 06 Dec '17

06 Dec '17

commit 8c02fc15ae8391d800926c0c6df7fb258139ce79 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Dec 5 14:24:00 2017 -0500 control: Don't use void pointer for ADD_ONION secret key Make this a bit more safe with at least type checking of the pointers depending on the version. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/control.c | 30 ++++++++--------- src/or/control.h | 13 +++++++- src/test/test_controller.c | 81 ++++++++++++++++++++++++---------------------- 3 files changed, 69 insertions(+), 55 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index dc045c39a..d84ce7d63 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -4458,10 +4458,11 @@ handle_control_hspost(control_connection_t *conn, * containing the onion address without the .onion part. On error, address_out * is untouched. */ static hs_service_add_ephemeral_status_t -add_onion_helper_add_service(int hs_version, void *pk, smartlist_t *port_cfgs, - int max_streams, int max_streams_close_circuit, - int auth_type, smartlist_t *auth_clients, - char **address_out) +add_onion_helper_add_service(int hs_version, + add_onion_secret_key_t *pk, + smartlist_t *port_cfgs, int max_streams, + int max_streams_close_circuit, int auth_type, + smartlist_t *auth_clients, char **address_out) { hs_service_add_ephemeral_status_t ret; @@ -4471,12 +4472,12 @@ add_onion_helper_add_service(int hs_version, void *pk, smartlist_t *port_cfgs, switch (hs_version) { case HS_VERSION_TWO: - ret = rend_service_add_ephemeral(pk, port_cfgs, max_streams, + ret = rend_service_add_ephemeral(pk->v2, port_cfgs, max_streams, max_streams_close_circuit, auth_type, auth_clients, address_out); break; case HS_VERSION_THREE: - ret = hs_service_add_ephemeral(pk, port_cfgs, max_streams, + ret = hs_service_add_ephemeral(pk->v3, port_cfgs, max_streams, max_streams_close_circuit, address_out); break; default: @@ -4668,7 +4669,7 @@ handle_control_add_onion(control_connection_t *conn, /* Parse the "keytype:keyblob" argument. */ int hs_version = 0; - void *pk = NULL; + add_onion_secret_key_t pk; const char *key_new_alg = NULL; char *key_new_blob = NULL; char *err_msg = NULL; @@ -4697,7 +4698,7 @@ handle_control_add_onion(control_connection_t *conn, * regardless of success/failure. */ char *service_id = NULL; - int ret = add_onion_helper_add_service(hs_version, pk, port_cfgs, + int ret = add_onion_helper_add_service(hs_version, &pk, port_cfgs, max_streams, max_streams_close_circuit, auth_type, auth_clients, &service_id); @@ -4796,7 +4797,7 @@ handle_control_add_onion(control_connection_t *conn, STATIC int add_onion_helper_keyarg(const char *arg, int discard_pk, const char **key_new_alg_out, char **key_new_blob_out, - void **decoded_key, int *hs_version, + add_onion_secret_key_t *decoded_key, int *hs_version, char **err_msg_out) { smartlist_t *key_args = smartlist_new(); @@ -4806,8 +4807,6 @@ add_onion_helper_keyarg(const char *arg, int discard_pk, char *err_msg = NULL; int ret = -1; - *decoded_key = NULL; - smartlist_split_string(key_args, arg, ":", SPLIT_IGNORE_BLANK, 0); if (smartlist_len(key_args) != 2) { err_msg = tor_strdup("512 Invalid key type/blob\r\n"); @@ -4835,7 +4834,7 @@ add_onion_helper_keyarg(const char *arg, int discard_pk, err_msg = tor_strdup("512 Invalid RSA key size\r\n"); goto err; } - *decoded_key = pk; + decoded_key->v2 = pk; *hs_version = HS_VERSION_TWO; } else if (!strcasecmp(key_type_ed25519_v3, key_type)) { /* "ED25519-V3:<Base64 Blob>" - Loading a pre-existing ed25519 key. */ @@ -4846,7 +4845,7 @@ add_onion_helper_keyarg(const char *arg, int discard_pk, err_msg = tor_strdup("512 Failed to decode ED25519-V3 key\r\n"); goto err; } - *decoded_key = sk; + decoded_key->v3 = sk; *hs_version = HS_VERSION_THREE; } else if (!strcasecmp(key_type_new, key_type)) { /* "NEW:<Algorithm>" - Generating a new key, blob as algorithm. */ @@ -4868,7 +4867,7 @@ add_onion_helper_keyarg(const char *arg, int discard_pk, } key_new_alg = key_type_rsa1024; } - *decoded_key = pk; + decoded_key->v2 = pk; *hs_version = HS_VERSION_TWO; } else if (!strcasecmp(key_type_ed25519_v3, key_blob)) { ed25519_secret_key_t *sk = tor_malloc_zero(sizeof(*sk)); @@ -4891,7 +4890,7 @@ add_onion_helper_keyarg(const char *arg, int discard_pk, } key_new_alg = key_type_ed25519_v3; } - *decoded_key = sk; + decoded_key->v3 = sk; *hs_version = HS_VERSION_THREE; } else { err_msg = tor_strdup("513 Invalid key type\r\n"); @@ -4903,7 +4902,6 @@ add_onion_helper_keyarg(const char *arg, int discard_pk, } /* Succeded in loading or generating a private key. */ - tor_assert(*decoded_key); ret = 0; err: diff --git a/src/or/control.h b/src/or/control.h index 23f6eed8e..28ffeaed8 100644 --- a/src/or/control.h +++ b/src/or/control.h @@ -263,9 +263,20 @@ void format_cell_stats(char **event_string, circuit_t *circ, cell_stats_t *cell_stats); STATIC char *get_bw_samples(void); +/* ADD_ONION secret key to create an ephemeral service. The command supports + * multiple versions so this union stores the key and passes it to the HS + * subsystem depending on the requested version. */ +typedef union add_onion_secret_key_t { + /* Hidden service v2 secret key. */ + crypto_pk_t *v2; + /* Hidden service v3 secret key. */ + ed25519_secret_key_t *v3; +} add_onion_secret_key_t; + STATIC int add_onion_helper_keyarg(const char *arg, int discard_pk, const char **key_new_alg_out, - char **key_new_blob_out, void **decoded_key, + char **key_new_blob_out, + add_onion_secret_key_t *decoded_key, int *hs_version, char **err_msg_out); STATIC rend_authorized_client_t * diff --git a/src/test/test_controller.c b/src/test/test_controller.c index a5132bd4c..af19f63f6 100644 --- a/src/test/test_controller.c +++ b/src/test/test_controller.c @@ -17,37 +17,39 @@ static void test_add_onion_helper_keyarg_v3(void *arg) { int ret, hs_version; - void *pk_ptr = NULL; + add_onion_secret_key_t pk; char *key_new_blob = NULL; char *err_msg = NULL; const char *key_new_alg = NULL; (void) arg; + memset(&pk, 0, sizeof(pk)); + /* Test explicit ED25519-V3 key generation. */ ret = add_onion_helper_keyarg("NEW:ED25519-V3", 0, &key_new_alg, - &key_new_blob, &pk_ptr, &hs_version, + &key_new_blob, &pk, &hs_version, &err_msg); tt_int_op(ret, OP_EQ, 0); tt_int_op(hs_version, OP_EQ, HS_VERSION_THREE); - tt_assert(pk_ptr); + tt_assert(pk.v3); tt_str_op(key_new_alg, OP_EQ, "ED25519-V3"); tt_assert(key_new_blob); tt_ptr_op(err_msg, OP_EQ, NULL); - tor_free(pk_ptr); pk_ptr = NULL; + tor_free(pk.v3); pk.v3 = NULL; tor_free(key_new_blob); /* Test discarding the private key. */ ret = add_onion_helper_keyarg("NEW:ED25519-V3", 1, &key_new_alg, - &key_new_blob, &pk_ptr, &hs_version, + &key_new_blob, &pk, &hs_version, &err_msg); tt_int_op(ret, OP_EQ, 0); tt_int_op(hs_version, OP_EQ, HS_VERSION_THREE); - tt_assert(pk_ptr); + tt_assert(pk.v3); tt_ptr_op(key_new_alg, OP_EQ, NULL); tt_ptr_op(key_new_blob, OP_EQ, NULL); tt_ptr_op(err_msg, OP_EQ, NULL); - tor_free(pk_ptr); pk_ptr = NULL; + tor_free(pk.v3); pk.v3 = NULL; tor_free(key_new_blob); /* Test passing a key blob. */ @@ -67,22 +69,22 @@ test_add_onion_helper_keyarg_v3(void *arg) tor_asprintf(&key_blob, "ED25519-V3:%s", base64_sk); tt_assert(key_blob); ret = add_onion_helper_keyarg(key_blob, 1, &key_new_alg, - &key_new_blob, &pk_ptr, &hs_version, + &key_new_blob, &pk, &hs_version, &err_msg); tor_free(key_blob); tt_int_op(ret, OP_EQ, 0); tt_int_op(hs_version, OP_EQ, HS_VERSION_THREE); - tt_assert(pk_ptr); - tt_mem_op(pk_ptr, OP_EQ, hex_sk, 64); + tt_assert(pk.v3); + tt_mem_op(pk.v3, OP_EQ, hex_sk, 64); tt_ptr_op(key_new_alg, OP_EQ, NULL); tt_ptr_op(key_new_blob, OP_EQ, NULL); tt_ptr_op(err_msg, OP_EQ, NULL); - tor_free(pk_ptr); pk_ptr = NULL; + tor_free(pk.v3); pk.v3 = NULL; tor_free(key_new_blob); } done: - tor_free(pk_ptr); + tor_free(pk.v3); tor_free(key_new_blob); tor_free(err_msg); } @@ -91,8 +93,8 @@ static void test_add_onion_helper_keyarg_v2(void *arg) { int ret, hs_version; - void *pk_ptr = NULL; - crypto_pk_t *pk = NULL; + add_onion_secret_key_t pk; + crypto_pk_t *pk1 = NULL; const char *key_new_alg = NULL; char *key_new_blob = NULL; char *err_msg = NULL; @@ -101,97 +103,100 @@ test_add_onion_helper_keyarg_v2(void *arg) (void) arg; + memset(&pk, 0, sizeof(pk)); + /* Test explicit RSA1024 key generation. */ ret = add_onion_helper_keyarg("NEW:RSA1024", 0, &key_new_alg, &key_new_blob, - &pk_ptr, &hs_version, &err_msg); + &pk, &hs_version, &err_msg); tt_int_op(ret, OP_EQ, 0); tt_int_op(hs_version, OP_EQ, HS_VERSION_TWO); - tt_assert(pk_ptr); + tt_assert(pk.v2); tt_str_op(key_new_alg, OP_EQ, "RSA1024"); tt_assert(key_new_blob); tt_ptr_op(err_msg, OP_EQ, NULL); /* Test "BEST" key generation (Assumes BEST = RSA1024). */ - crypto_pk_free(pk_ptr); pk_ptr = NULL; + crypto_pk_free(pk.v2); pk.v2 = NULL; tor_free(key_new_blob); ret = add_onion_helper_keyarg("NEW:BEST", 0, &key_new_alg, &key_new_blob, - &pk_ptr, &hs_version, &err_msg); + &pk, &hs_version, &err_msg); tt_int_op(ret, OP_EQ, 0); tt_int_op(hs_version, OP_EQ, HS_VERSION_TWO); - tt_assert(pk_ptr); + tt_assert(pk.v2); tt_str_op(key_new_alg, OP_EQ, "RSA1024"); tt_assert(key_new_blob); tt_ptr_op(err_msg, OP_EQ, NULL); /* Test discarding the private key. */ - crypto_pk_free(pk_ptr); pk_ptr = NULL; + crypto_pk_free(pk.v2); pk.v2 = NULL; tor_free(key_new_blob); ret = add_onion_helper_keyarg("NEW:BEST", 1, &key_new_alg, &key_new_blob, - &pk_ptr, &hs_version, &err_msg); + &pk, &hs_version, &err_msg); tt_int_op(ret, OP_EQ, 0); tt_int_op(hs_version, OP_EQ, HS_VERSION_TWO); - tt_assert(pk_ptr); + tt_assert(pk.v2); tt_ptr_op(key_new_alg, OP_EQ, NULL); tt_ptr_op(key_new_blob, OP_EQ, NULL); tt_ptr_op(err_msg, OP_EQ, NULL); /* Test generating a invalid key type. */ - crypto_pk_free(pk_ptr); pk_ptr = NULL; + crypto_pk_free(pk.v2); pk.v2 = NULL; ret = add_onion_helper_keyarg("NEW:RSA512", 0, &key_new_alg, &key_new_blob, - &pk_ptr, &hs_version, &err_msg); + &pk, &hs_version, &err_msg); tt_int_op(ret, OP_EQ, -1); tt_int_op(hs_version, OP_EQ, HS_VERSION_TWO); - tt_ptr_op(pk_ptr, OP_EQ, NULL); + tt_assert(!pk.v2); tt_ptr_op(key_new_alg, OP_EQ, NULL); tt_ptr_op(key_new_blob, OP_EQ, NULL); tt_assert(err_msg); /* Test loading a RSA1024 key. */ tor_free(err_msg); - pk = pk_generate(0); - tt_int_op(0, OP_EQ, crypto_pk_base64_encode(pk, &encoded)); + pk1 = pk_generate(0); + tt_int_op(0, OP_EQ, crypto_pk_base64_encode(pk1, &encoded)); tor_asprintf(&arg_str, "RSA1024:%s", encoded); ret = add_onion_helper_keyarg(arg_str, 0, &key_new_alg, &key_new_blob, - &pk_ptr, &hs_version, &err_msg); + &pk, &hs_version, &err_msg); tt_int_op(ret, OP_EQ, 0); tt_int_op(hs_version, OP_EQ, HS_VERSION_TWO); - tt_assert(pk_ptr); + tt_assert(pk.v2); tt_ptr_op(key_new_alg, OP_EQ, NULL); tt_ptr_op(key_new_blob, OP_EQ, NULL); tt_ptr_op(err_msg, OP_EQ, NULL); - tt_int_op(crypto_pk_cmp_keys(pk, pk_ptr), OP_EQ, 0); + tt_int_op(crypto_pk_cmp_keys(pk1, pk.v2), OP_EQ, 0); /* Test loading a invalid key type. */ tor_free(arg_str); - crypto_pk_free(pk); pk = NULL; - crypto_pk_free(pk_ptr); pk_ptr = NULL; + crypto_pk_free(pk1); pk1 = NULL; + crypto_pk_free(pk.v2); pk.v2 = NULL; tor_asprintf(&arg_str, "RSA512:%s", encoded); ret = add_onion_helper_keyarg(arg_str, 0, &key_new_alg, &key_new_blob, - &pk_ptr, &hs_version, &err_msg); + &pk, &hs_version, &err_msg); tt_int_op(ret, OP_EQ, -1); tt_int_op(hs_version, OP_EQ, HS_VERSION_TWO); - tt_ptr_op(pk_ptr, OP_EQ, NULL); + tt_assert(!pk.v2); tt_ptr_op(key_new_alg, OP_EQ, NULL); tt_ptr_op(key_new_blob, OP_EQ, NULL); tt_assert(err_msg); /* Test loading a invalid key. */ tor_free(arg_str); - crypto_pk_free(pk_ptr); pk_ptr = NULL; + crypto_pk_free(pk.v2); pk.v2 = NULL; tor_free(err_msg); encoded[strlen(encoded)/2] = '\0'; tor_asprintf(&arg_str, "RSA1024:%s", encoded); ret = add_onion_helper_keyarg(arg_str, 0, &key_new_alg, &key_new_blob, - &pk_ptr, &hs_version, &err_msg); + &pk, &hs_version, &err_msg); tt_int_op(ret, OP_EQ, -1); tt_int_op(hs_version, OP_EQ, HS_VERSION_TWO); - tt_ptr_op(pk_ptr, OP_EQ, NULL); + tt_assert(!pk.v2); tt_ptr_op(key_new_alg, OP_EQ, NULL); tt_ptr_op(key_new_blob, OP_EQ, NULL); tt_assert(err_msg); done: - crypto_pk_free(pk_ptr); + crypto_pk_free(pk1); + crypto_pk_free(pk.v2); tor_free(key_new_blob); tor_free(err_msg); tor_free(encoded);

1 0

[tor/master] control: Support HS v3 for CIRC and CIRC_MINOR event
by nickm＠torproject.org 06 Dec '17

06 Dec '17

commit cc26d4fa2131e056dc7728335d877e0322611b12 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Nov 10 15:18:35 2017 -0500 control: Support HS v3 for CIRC and CIRC_MINOR event "REND_QUERY=" can now output a v3 address. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/control.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index 0e41aab5e..24e3ebe7d 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -2678,9 +2678,16 @@ circuit_describe_status_for_controller(origin_circuit_t *circ) } } - if (circ->rend_data != NULL) { - smartlist_add_asprintf(descparts, "REND_QUERY=%s", - rend_data_get_address(circ->rend_data)); + if (circ->rend_data != NULL || circ->hs_ident != NULL) { + char addr[HS_SERVICE_ADDR_LEN_BASE32 + 1]; + const char *onion_address; + if (circ->rend_data) { + onion_address = rend_data_get_address(circ->rend_data); + } else { + hs_build_address(&circ->hs_ident->identity_pk, HS_VERSION_THREE, addr); + onion_address = addr; + } + smartlist_add_asprintf(descparts, "REND_QUERY=%s", onion_address); } {

1 0

[tor/master] test: Add HS_DESC v3 unit tests
by nickm＠torproject.org 06 Dec '17

06 Dec '17

commit 9c6560fe29c9e2ee33549ca890f94c03cbdd94a8 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Nov 20 12:10:07 2017 -0500 test: Add HS_DESC v3 unit tests This introduces the test_hs_control.c file which at this commit contains basic unit test for the HS_DESC event. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/include.am | 1 + src/test/test.c | 1 + src/test/test.h | 1 + src/test/test_hs_control.c | 199 +++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 202 insertions(+) diff --git a/src/test/include.am b/src/test/include.am index bbf8a370e..b5c5dd24f 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -125,6 +125,7 @@ src_test_test_SOURCES = \ src/test/test_hs_service.c \ src/test/test_hs_client.c \ src/test/test_hs_intropoint.c \ + src/test/test_hs_control.c \ src/test/test_handles.c \ src/test/test_hs_cache.c \ src/test/test_hs_descriptor.c \ diff --git a/src/test/test.c b/src/test/test.c index 00857c238..432df35c3 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -1201,6 +1201,7 @@ struct testgroup_t testgroups[] = { { "hs_cell/", hs_cell_tests }, { "hs_common/", hs_common_tests }, { "hs_config/", hs_config_tests }, + { "hs_control/", hs_control_tests }, { "hs_descriptor/", hs_descriptor }, { "hs_ntor/", hs_ntor_tests }, { "hs_service/", hs_service_tests }, diff --git a/src/test/test.h b/src/test/test.h index b1a3366a8..b37fe25b3 100644 --- a/src/test/test.h +++ b/src/test/test.h @@ -210,6 +210,7 @@ extern struct testcase_t hs_cache[]; extern struct testcase_t hs_cell_tests[]; extern struct testcase_t hs_common_tests[]; extern struct testcase_t hs_config_tests[]; +extern struct testcase_t hs_control_tests[]; extern struct testcase_t hs_descriptor[]; extern struct testcase_t hs_ntor_tests[]; extern struct testcase_t hs_service_tests[]; diff --git a/src/test/test_hs_control.c b/src/test/test_hs_control.c new file mode 100644 index 000000000..207a55de6 --- /dev/null +++ b/src/test/test_hs_control.c @@ -0,0 +1,199 @@ +/* Copyright (c) 2017, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file test_hs_control.c + * \brief Unit tests for hidden service control port event and command. + **/ + +#define CONTROL_PRIVATE +#define CIRCUITBUILD_PRIVATE +#define RENDCOMMON_PRIVATE +#define RENDSERVICE_PRIVATE +#define HS_SERVICE_PRIVATE + +#include "or.h" +#include "test.h" +#include "control.h" +#include "config.h" +#include "hs_common.h" +#include "hs_control.h" +#include "nodelist.h" +//#include "rendcommon.h" +//#include "rendservice.h" +//#include "routerset.h" +//#include "circuitbuild.h" +#include "test_helpers.h" + +/* mock ID digest and longname for node that's in nodelist */ +#define HSDIR_EXIST_ID \ + "\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA" \ + "\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA" +#define STR_HSDIR_EXIST_LONGNAME \ + "$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=TestDir" +#define STR_HSDIR_NONE_EXIST_LONGNAME \ + "$BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB" + +/* Helper global variable for hidden service descriptor event test. + * It's used as a pointer to dynamically created message buffer in + * send_control_event_string_replacement function, which mocks + * send_control_event_string function. + * + * Always free it after use! */ +static char *received_msg = NULL; + +/** Mock function for send_control_event_string + */ +static void +queue_control_event_string_replacement(uint16_t event, char *msg) +{ + (void) event; + tor_free(received_msg); + received_msg = msg; +} + +/** Mock function for node_describe_longname_by_id, it returns either + * STR_HSDIR_EXIST_LONGNAME or STR_HSDIR_NONE_EXIST_LONGNAME + */ +static const char * +node_describe_longname_by_id_replacement(const char *id_digest) +{ + if (!strcmp(id_digest, HSDIR_EXIST_ID)) { + return STR_HSDIR_EXIST_LONGNAME; + } else { + return STR_HSDIR_NONE_EXIST_LONGNAME; + } +} + +/* HSDir fetch index is a series of 'D' */ +#define HSDIR_INDEX_FETCH_HEX \ + "4343434343434343434343434343434343434343434343434343434343434343" +#define HSDIR_INDEX_STORE_HEX \ + "4444444444444444444444444444444444444444444444444444444444444444" + +static const node_t * +mock_node_get_by_id(const char *digest) +{ + static node_t node; + memcpy(node.identity, digest, DIGEST_LEN); + node.hsdir_index = tor_malloc_zero(sizeof(hsdir_index_t)); + memset(node.hsdir_index->fetch, 'C', DIGEST256_LEN); + memset(node.hsdir_index->store_first, 'D', DIGEST256_LEN); + return &node; +} + +static void +test_hs_desc_event(void *arg) +{ + int ret; + char *expected_msg = NULL; + char onion_address[HS_SERVICE_ADDR_LEN_BASE32 + 1]; + ed25519_keypair_t identity_kp; + ed25519_public_key_t blinded_pk; + char base64_blinded_pk[ED25519_BASE64_LEN + 1]; + routerstatus_t hsdir_rs; + hs_ident_dir_conn_t ident; + + (void) arg; + MOCK(queue_control_event_string, + queue_control_event_string_replacement); + MOCK(node_describe_longname_by_id, + node_describe_longname_by_id_replacement); + MOCK(node_get_by_id, mock_node_get_by_id); + + /* Setup what we need for this test. */ + ed25519_keypair_generate(&identity_kp, 0); + hs_build_address(&identity_kp.pubkey, HS_VERSION_THREE, onion_address); + ret = hs_address_is_valid(onion_address); + tt_int_op(ret, OP_EQ, 1); + memset(&blinded_pk, 'B', sizeof(blinded_pk)); + memset(&hsdir_rs, 0, sizeof(hsdir_rs)); + memcpy(hsdir_rs.identity_digest, HSDIR_EXIST_ID, DIGEST_LEN); + ret = ed25519_public_to_base64(base64_blinded_pk, &blinded_pk); + tt_int_op(ret, OP_EQ, 0); + memcpy(&ident.identity_pk, &identity_kp.pubkey, + sizeof(ed25519_public_key_t)); + memcpy(&ident.blinded_pk, &blinded_pk, sizeof(blinded_pk)); + + /* HS_DESC REQUESTED ... */ + hs_control_desc_event_requested(&identity_kp.pubkey, base64_blinded_pk, + &hsdir_rs); + tor_asprintf(&expected_msg, "650 HS_DESC REQUESTED %s NO_AUTH " + STR_HSDIR_EXIST_LONGNAME " %s HSDIR_INDEX=" + HSDIR_INDEX_FETCH_HEX "\r\n", + onion_address, base64_blinded_pk); + tt_assert(received_msg); + tt_str_op(received_msg, OP_EQ, expected_msg); + tor_free(received_msg); + tor_free(expected_msg); + + /* HS_DESC CREATED... */ + hs_control_desc_event_created(onion_address, &blinded_pk); + tor_asprintf(&expected_msg, "650 HS_DESC CREATED %s UNKNOWN " + "UNKNOWN %s\r\n", + onion_address, base64_blinded_pk); + tt_assert(received_msg); + tt_str_op(received_msg, OP_EQ, expected_msg); + tor_free(received_msg); + tor_free(expected_msg); + + /* HS_DESC UPLOAD... */ + uint8_t hsdir_index_store[DIGEST256_LEN]; + memset(hsdir_index_store, 'D', sizeof(hsdir_index_store)); + hs_control_desc_event_upload(onion_address, HSDIR_EXIST_ID, + &blinded_pk, hsdir_index_store); + tor_asprintf(&expected_msg, "650 HS_DESC UPLOAD %s UNKNOWN " + STR_HSDIR_EXIST_LONGNAME " %s " + "HSDIR_INDEX=" HSDIR_INDEX_STORE_HEX "\r\n", + onion_address, base64_blinded_pk); + tt_assert(received_msg); + tt_str_op(received_msg, OP_EQ, expected_msg); + tor_free(received_msg); + tor_free(expected_msg); + + /* HS_DESC FAILED... */ + hs_control_desc_event_failed(&ident, HSDIR_EXIST_ID, "BAD_DESC"); + tor_asprintf(&expected_msg, "650 HS_DESC FAILED %s NO_AUTH " + STR_HSDIR_EXIST_LONGNAME " %s " + "REASON=BAD_DESC\r\n", + onion_address, base64_blinded_pk); + tt_assert(received_msg); + tt_str_op(received_msg, OP_EQ, expected_msg); + tor_free(received_msg); + tor_free(expected_msg); + + /* HS_DESC RECEIVED... */ + hs_control_desc_event_received(&ident, HSDIR_EXIST_ID); + tor_asprintf(&expected_msg, "650 HS_DESC RECEIVED %s NO_AUTH " + STR_HSDIR_EXIST_LONGNAME " %s\r\n", + onion_address, base64_blinded_pk); + tt_assert(received_msg); + tt_str_op(received_msg, OP_EQ, expected_msg); + tor_free(received_msg); + tor_free(expected_msg); + + /* HS_DESC UPLOADED... */ + hs_control_desc_event_uploaded(&ident, HSDIR_EXIST_ID); + tor_asprintf(&expected_msg, "650 HS_DESC UPLOADED %s UNKNOWN " + STR_HSDIR_EXIST_LONGNAME "\r\n", + onion_address); + tt_assert(received_msg); + tt_str_op(received_msg, OP_EQ, expected_msg); + tor_free(received_msg); + tor_free(expected_msg); + + done: + UNMOCK(queue_control_event_string); + UNMOCK(node_describe_longname_by_id); + UNMOCK(node_get_by_id); + tor_free(received_msg); + tor_free(expected_msg); +} + +struct testcase_t hs_control_tests[] = { + { "hs_desc_event", test_hs_desc_event, TT_FORK, + NULL, NULL }, + + END_OF_TESTCASES +}; +

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits December 2017