tor-commits July 2017

tor-commits@lists.torproject.org

14 participants
1743 discussions

[tor/master] test: Add HS v2 service configuration unit tests
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit 93774dcb5458115652e0be5cdfaf198967b8a31e Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Jan 13 11:20:31 2017 -0500 test: Add HS v2 service configuration unit tests Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/include.am | 1 + src/test/test.c | 1 + src/test/test.h | 1 + src/test/test_helpers.c | 42 +++++++++- src/test/test_helpers.h | 1 + src/test/test_hs_config.c | 198 ++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 242 insertions(+), 2 deletions(-) diff --git a/src/test/include.am b/src/test/include.am index e7a2e02..2e448c8 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -114,6 +114,7 @@ src_test_test_SOURCES = \ src/test/test_guardfraction.c \ src/test/test_extorport.c \ src/test/test_hs.c \ + src/test/test_hs_config.c \ src/test/test_hs_service.c \ src/test/test_hs_client.c \ src/test/test_hs_intropoint.c \ diff --git a/src/test/test.c b/src/test/test.c index 31b3db3..b6b11ce 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -1213,6 +1213,7 @@ struct testgroup_t testgroups[] = { { "extorport/", extorport_tests }, { "legacy_hs/", hs_tests }, { "hs_cache/", hs_cache }, + { "hs_config/", hs_config_tests }, { "hs_descriptor/", hs_descriptor }, { "hs_service/", hs_service_tests }, { "hs_client/", hs_client_tests }, diff --git a/src/test/test.h b/src/test/test.h index 4de0da9..9b2a0b8 100644 --- a/src/test/test.h +++ b/src/test/test.h @@ -207,6 +207,7 @@ extern struct testcase_t guardfraction_tests[]; extern struct testcase_t extorport_tests[]; extern struct testcase_t hs_tests[]; extern struct testcase_t hs_cache[]; +extern struct testcase_t hs_config_tests[]; extern struct testcase_t hs_descriptor[]; extern struct testcase_t hs_service_tests[]; extern struct testcase_t hs_client_tests[]; diff --git a/src/test/test_helpers.c b/src/test/test_helpers.c index 22d9de3..e885d27 100644 --- a/src/test/test_helpers.c +++ b/src/test/test_helpers.c @@ -7,18 +7,21 @@ */ #define ROUTERLIST_PRIVATE +#define CONFIG_PRIVATE #define CONNECTION_PRIVATE #define MAIN_PRIVATE #include "orconfig.h" #include "or.h" +#include "buffers.h" +#include "config.h" +#include "confparse.h" #include "connection.h" #include "main.h" +#include "nodelist.h" #include "relay.h" #include "routerlist.h" -#include "nodelist.h" -#include "buffers.h" #include "test.h" #include "test_helpers.h" @@ -239,3 +242,38 @@ test_conn_get_connection(uint8_t state, uint8_t type, uint8_t purpose) return NULL; } +/* Helper function to parse a set of torrc options in a text format and return + * a newly allocated or_options_t object containing the configuration. On + * error, NULL is returned indicating that the conf couldn't be parsed + * properly. */ +or_options_t * +helper_parse_options(const char *conf) +{ + int ret = 0; + char *msg = NULL; + or_options_t *opt = NULL; + config_line_t *line = NULL; + + /* Kind of pointless to call this with a NULL value. */ + tt_assert(conf); + + opt = options_new(); + tt_assert(opt); + ret = config_get_lines(conf, &line, 1); + if (ret != 0) { + goto done; + } + ret = config_assign(&options_format, opt, line, 0, &msg); + if (ret != 0) { + goto done; + } + + done: + config_free_lines(line); + if (ret != 0) { + or_options_free(opt); + opt = NULL; + } + return opt; +} + diff --git a/src/test/test_helpers.h b/src/test/test_helpers.h index 96a4b59..847104a 100644 --- a/src/test/test_helpers.h +++ b/src/test/test_helpers.h @@ -24,6 +24,7 @@ int mock_tor_addr_lookup__fail_on_bad_addrs(const char *name, connection_t *test_conn_get_connection(uint8_t state, uint8_t type, uint8_t purpose); +or_options_t *helper_parse_options(const char *conf); extern const char TEST_DESCRIPTORS[]; diff --git a/src/test/test_hs_config.c b/src/test/test_hs_config.c new file mode 100644 index 0000000..18b1194 --- /dev/null +++ b/src/test/test_hs_config.c @@ -0,0 +1,198 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file test_hs_config.c + * \brief Test hidden service configuration functionality. + */ + +#define CONFIG_PRIVATE + +#include "test.h" +#include "test_helpers.h" +#include "log_test_helpers.h" +#include "hs_config.h" +#include "config.h" + +static int +helper_config_service_v2(const char *conf, int validate_only) +{ + int ret = 0; + or_options_t *options = NULL; + tt_assert(conf); + options = helper_parse_options(conf); + tt_assert(options); + ret = hs_config_service_all(options, validate_only); + done: + or_options_free(options); + return ret; +} + +static void +test_invalid_service_v2(void *arg) +{ + int validate_only = 1, ret; + + (void) arg; + + /* Try with a missing port configuration. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n"; + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service_v2(conf, validate_only); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("with no ports configured."); + teardown_capture_of_logs(); + } + + /* Out of order directives. */ + { + const char *conf = + "HiddenServiceVersion 2\n" + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServicePort 80\n"; + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service_v2(conf, validate_only); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceVersion with no preceding " + "HiddenServiceDir directive"); + teardown_capture_of_logs(); + } + + /* Bad port. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 65536\n"; + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service_v2(conf, validate_only); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("Missing or invalid port"); + teardown_capture_of_logs(); + } + + /* Too many introduction points. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 80\n" + "HiddenServiceNumIntroductionPoints 11\n"; /* One too many. */ + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service_v2(conf, validate_only); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceNumIntroductionPoints should " + "be between 0 and 10, not 11"); + teardown_capture_of_logs(); + } + + /* Too much max streams. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 80\n" + "HiddenServiceMaxStreams 65536\n"; /* One too many. */ + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service_v2(conf, validate_only); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceMaxStreams should be between " + "0 and 65535, not 65536"); + teardown_capture_of_logs(); + } + + /* Bad authorized client type. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 80\n" + "HiddenServiceAuthorizeClient blah alice,bob\n"; /* blah is no good. */ + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service_v2(conf, validate_only); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceAuthorizeClient contains " + "unrecognized auth-type"); + teardown_capture_of_logs(); + } + + /* Duplicate directory directive. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 80\n" + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 81\n"; + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service_v2(conf, validate_only); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("Another hidden service is already " + "configured for directory"); + teardown_capture_of_logs(); + } + + done: + ; +} + +static void +test_valid_service_v2(void *arg) +{ + int ret; + + (void) arg; + + /* Valid complex configuration. Basic client authorization. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 80\n" + "HiddenServicePort 22 localhost:22\n" + "HiddenServicePort 42 unix:/path/to/socket\n" + "HiddenServiceAuthorizeClient basic alice,bob,eve\n" + "HiddenServiceAllowUnknownPorts 1\n" + "HiddenServiceMaxStreams 42\n" + "HiddenServiceMaxStreamsCloseCircuit 0\n" + "HiddenServiceDirGroupReadable 1\n" + "HiddenServiceNumIntroductionPoints 7\n"; + ret = helper_config_service_v2(conf, 1); + tt_int_op(ret, OP_EQ, 0); + } + + /* Valid complex configuration. Stealth client authorization. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs2\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 65535\n" + "HiddenServicePort 22 1.1.1.1:22\n" + "HiddenServicePort 9000 unix:/path/to/socket\n" + "HiddenServiceAuthorizeClient stealth charlie,romeo\n" + "HiddenServiceAllowUnknownPorts 0\n" + "HiddenServiceMaxStreams 42\n" + "HiddenServiceMaxStreamsCloseCircuit 0\n" + "HiddenServiceDirGroupReadable 1\n" + "HiddenServiceNumIntroductionPoints 8\n"; + ret = helper_config_service_v2(conf, 1); + tt_int_op(ret, OP_EQ, 0); + } + + done: + ; +} + +struct testcase_t hs_config_tests[] = { + { "invalid_service_v2", test_invalid_service_v2, TT_FORK, + NULL, NULL }, + { "valid_service_v2", test_valid_service_v2, TT_FORK, + NULL, NULL }, + + END_OF_TESTCASES +}; +

1 0

[tor/master] prop224: Fix clang warnings
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit 965e3a6628f26d5fb1422fb04aa12e807537a32a Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Jul 13 17:18:11 2017 -0400 prop224: Fix clang warnings Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_service.c | 3 ++- src/or/rendservice.c | 10 +++++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/src/or/hs_service.c b/src/or/hs_service.c index d8b87d1..5fde42d 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -80,9 +80,10 @@ HT_GENERATE2(hs_service_ht, hs_service_t, hs_service_node, STATIC hs_service_t * find_service(hs_service_ht *map, const ed25519_public_key_t *pk) { - hs_service_t dummy_service = {0}; + hs_service_t dummy_service; tor_assert(map); tor_assert(pk); + memset(&dummy_service, 0, sizeof(dummy_service)); ed25519_pubkey_copy(&dummy_service.keys.identity_pk, pk); return HT_FIND(hs_service_ht, map, &dummy_service); } diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 67de636..2a5d2b7 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -18,6 +18,7 @@ #include "control.h" #include "directory.h" #include "hs_common.h" +#include "hs_config.h" #include "main.h" #include "networkstatus.h" #include "nodelist.h" @@ -631,7 +632,14 @@ service_config_shadow_copy(rend_service_t *service, service->directory = tor_strdup(config->directory_path); service->dir_group_readable = config->dir_group_readable; service->allow_unknown_ports = config->allow_unknown_ports; - service->max_streams_per_circuit = config->max_streams_per_rdv_circuit; + /* This value can't go above HS_CONFIG_MAX_STREAMS_PER_RDV_CIRCUIT (65535) + * if the code flow is right so this cast is safe. But just in case, we'll + * check it. */ + service->max_streams_per_circuit = (int) config->max_streams_per_rdv_circuit; + if (BUG(config->max_streams_per_rdv_circuit > + HS_CONFIG_MAX_STREAMS_PER_RDV_CIRCUIT)) { + service->max_streams_per_circuit = HS_CONFIG_MAX_STREAMS_PER_RDV_CIRCUIT; + } service->max_streams_close_circuit = config->max_streams_close_circuit; service->n_intro_points_wanted = config->num_intro_points; /* Switching ownership of the ports to the rend service object. */

1 0

[tor/master] prop224: Use the service config object when configuring
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit 3eeebd1b0ca43bc2523fb39349078277a40d4116 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jul 12 13:52:19 2017 -0400 prop224: Use the service config object when configuring Both configuration function now takes the service config object instead of the service itself. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_config.c | 13 ++++--------- src/or/rendservice.c | 26 ++++++++++++-------------- src/or/rendservice.h | 2 +- 3 files changed, 17 insertions(+), 24 deletions(-) diff --git a/src/or/hs_config.c b/src/or/hs_config.c index c29315f..7e0124b 100644 --- a/src/or/hs_config.c +++ b/src/or/hs_config.c @@ -236,18 +236,13 @@ config_validate_service(const hs_service_config_t *config) * Return 0 on success else a negative value. */ static int config_service_v3(const config_line_t *line_, - const or_options_t *options, - hs_service_t *service) + hs_service_config_t *config) { - (void) options; int have_num_ip = 0; const char *dup_opt_seen = NULL; const config_line_t *line; - hs_service_config_t *config; - - tor_assert(service); - config = &service->config; + tor_assert(config); for (line = line_; line; line = line->next) { int ok = 0; @@ -489,10 +484,10 @@ config_service(const config_line_t *line, const or_options_t *options, * directory line, the function knows that it has to stop parsing. */ switch (service->version) { case HS_VERSION_TWO: - ret = rend_config_service(line->next, options, service); + ret = rend_config_service(line->next, options, &service->config); break; case HS_VERSION_THREE: - ret = config_service_v3(line->next, options, service); + ret = config_service_v3(line->next, &service->config); break; default: /* We do validate before if we support the parsed version. */ diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 67da760..67de636 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -622,14 +622,12 @@ rend_service_prune_list(void) * object which so we have to copy the parsed values to a rend service object * which is version 2 specific. */ static void -service_shadow_copy(rend_service_t *service, hs_service_t *hs_service) +service_config_shadow_copy(rend_service_t *service, + hs_service_config_t *config) { - hs_service_config_t *config; - tor_assert(service); - tor_assert(hs_service); + tor_assert(config); - config = &hs_service->config; service->directory = tor_strdup(config->directory_path); service->dir_group_readable = config->dir_group_readable; service->allow_unknown_ports = config->allow_unknown_ports; @@ -638,19 +636,19 @@ service_shadow_copy(rend_service_t *service, hs_service_t *hs_service) service->n_intro_points_wanted = config->num_intro_points; /* Switching ownership of the ports to the rend service object. */ smartlist_add_all(service->ports, config->ports); - smartlist_free(hs_service->config.ports); - hs_service->config.ports = NULL; + smartlist_free(config->ports); + config->ports = NULL; } /* Parse the hidden service configuration starting at line_ using the - * already configured generic service in hs_service. This function will - * translate the service object to a rend_service_t and add it to the - * temporary list if valid. If validate_only is set, parse, warn and - * return as normal but don't actually add the service to the list. */ + * already configured generic service configuration in config. This + * function will translate the config object to a rend_service_t and add it to + * the temporary list if valid. If validate_only is set, parse, warn + * and return as normal but don't actually add the service to the list. */ int rend_config_service(const config_line_t *line_, const or_options_t *options, - hs_service_t *hs_service) + hs_service_config_t *config) { const config_line_t *line; rend_service_t *service = NULL; @@ -658,7 +656,7 @@ rend_config_service(const config_line_t *line_, /* line_ can be NULL which would mean that the service configuration only * have one line that is the directory directive. */ tor_assert(options); - tor_assert(hs_service); + tor_assert(config); /* Use the staging service list so that we can check then do the pruning * process using the main list at the end. */ @@ -672,7 +670,7 @@ rend_config_service(const config_line_t *line_, service->ports = smartlist_new(); /* From the hs_service object which has been used to load the generic * options, we'll copy over the useful data to the rend_service_t object. */ - service_shadow_copy(service, hs_service); + service_config_shadow_copy(service, config); for (line = line_; line; line = line->next) { if (!strcasecmp(line->key, "HiddenServiceDir")) { diff --git a/src/or/rendservice.h b/src/or/rendservice.h index 20e827d..ffed21d 100644 --- a/src/or/rendservice.h +++ b/src/or/rendservice.h @@ -143,7 +143,7 @@ STATIC void rend_service_prune_list_impl_(void); int num_rend_services(void); int rend_config_service(const config_line_t *line_, const or_options_t *options, - hs_service_t *hs_service); + hs_service_config_t *config); void rend_service_prune_list(void); void rend_service_free_staging_list(void); int rend_service_load_all_keys(const smartlist_t *service_list);

1 0

[tor/master] hs: Add rend_service_init()
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit 87f6f96f4707cc18a58c5de8be0ee10f1893673d Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Jun 29 11:18:24 2017 -0400 hs: Add rend_service_init() Initialize both the global and staging service lists. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_service.c | 3 +++ src/or/rendservice.c | 11 +++++++++++ src/or/rendservice.h | 1 + 3 files changed, 15 insertions(+) diff --git a/src/or/hs_service.c b/src/or/hs_service.c index bce976e..eb58c76 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -616,6 +616,9 @@ hs_service_init(void) tor_assert(!hs_service_map); tor_assert(!hs_service_staging_list); + /* v2 specific. */ + rend_service_init(); + hs_service_map = tor_malloc_zero(sizeof(struct hs_service_ht)); HT_INIT(hs_service_ht, hs_service_map); diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 358efd0..67da760 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -257,6 +257,17 @@ rend_service_free_all(void) rend_service_free_staging_list(); } +/* Initialize the subsystem. */ +void +rend_service_init(void) +{ + tor_assert(!rend_service_list); + tor_assert(!rend_service_staging_list); + + rend_service_list = smartlist_new(); + rend_service_staging_list = smartlist_new(); +} + /* Validate a service. Use the service_list to make sure there * is no duplicate entry for the given service object. Return 0 if valid else * -1 if not.*/ diff --git a/src/or/rendservice.h b/src/or/rendservice.h index 361a119..20e827d 100644 --- a/src/or/rendservice.h +++ b/src/or/rendservice.h @@ -179,6 +179,7 @@ int rend_service_set_connection_addr_port(edge_connection_t *conn, origin_circuit_t *circ); void rend_service_dump_stats(int severity); void rend_service_free_all(void); +void rend_service_init(void); rend_service_port_config_t *rend_service_parse_port_config(const char *string, const char *sep,

1 0

[tor/master] prop224: Detect duplicate configuration options
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit e9dd4ed16d8606dc0aa0cd6eadc99aa959f93392 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jul 12 11:02:59 2017 -0400 prop224: Detect duplicate configuration options Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_config.c | 46 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 40 insertions(+), 6 deletions(-) diff --git a/src/or/hs_config.c b/src/or/hs_config.c index f1e130b..2e75a4e 100644 --- a/src/or/hs_config.c +++ b/src/or/hs_config.c @@ -241,6 +241,8 @@ config_service_v3(const config_line_t *line_, hs_service_t *service) { (void) options; + int have_num_ip = 0; + const char *dup_opt_seen = NULL; const config_line_t *line; hs_service_config_t *config; @@ -261,9 +263,12 @@ config_service_v3(const config_line_t *line_, NUM_INTRO_POINTS_DEFAULT, HS_CONFIG_V3_MAX_INTRO_POINTS, &ok); - if (!ok) { + if (!ok || have_num_ip) { + if (have_num_ip) + dup_opt_seen = line->key; goto err; } + have_num_ip = 1; continue; } } @@ -279,6 +284,9 @@ config_service_v3(const config_line_t *line_, return 0; err: + if (dup_opt_seen) { + log_warn(LD_CONFIG, "Duplicate directive %s.", dup_opt_seen); + } return -1; } @@ -301,6 +309,13 @@ config_generic_service(const config_line_t *line_, int dir_seen = 0; const config_line_t *line; hs_service_config_t *config; + /* If this is set, we've seen a duplicate of this option. Keep the string + * so we can log the directive. */ + const char *dup_opt_seen = NULL; + /* These variables will tell us if we ever have duplicate. */ + int have_version = 0, have_allow_unknown_ports = 0; + int have_dir_group_read = 0, have_max_streams = 0; + int have_max_streams_close = 0; tor_assert(line_); tor_assert(options); @@ -313,6 +328,7 @@ config_generic_service(const config_line_t *line_, * the configuration of the service. */ for (line = line_; line ; line = line->next) { int ok = 0; + /* This indicate that we have a new service to configure. */ if (!strcasecmp(line->key, "HiddenServiceDir")) { /* This function only configures one service at a time so if we've @@ -335,9 +351,12 @@ config_generic_service(const config_line_t *line_, service->version = (uint32_t) helper_parse_uint64(line->key, line->value, HS_VERSION_MIN, HS_VERSION_MAX, &ok); - if (!ok) { + if (!ok || have_version) { + if (have_version) + dup_opt_seen = line->key; goto err; } + have_version = 1; continue; } /* Virtual port. */ @@ -363,18 +382,24 @@ config_generic_service(const config_line_t *line_, if (!strcasecmp(line->key, "HiddenServiceAllowUnknownPorts")) { config->allow_unknown_ports = (unsigned int) helper_parse_uint64(line->key, line->value, 0, 1, &ok); - if (!ok) { + if (!ok || have_allow_unknown_ports) { + if (have_allow_unknown_ports) + dup_opt_seen = line->key; goto err; } + have_allow_unknown_ports = 1; continue; } /* Directory group readable. */ if (!strcasecmp(line->key, "HiddenServiceDirGroupReadable")) { config->dir_group_readable = (unsigned int) helper_parse_uint64(line->key, line->value, 0, 1, &ok); - if (!ok) { + if (!ok || have_dir_group_read) { + if (have_dir_group_read) + dup_opt_seen = line->key; goto err; } + have_dir_group_read = 1; continue; } /* Maximum streams per circuit. */ @@ -382,18 +407,24 @@ config_generic_service(const config_line_t *line_, config->max_streams_per_rdv_circuit = helper_parse_uint64(line->key, line->value, 0, HS_CONFIG_MAX_STREAMS_PER_RDV_CIRCUIT, &ok); - if (!ok) { + if (!ok || have_max_streams) { + if (have_max_streams) + dup_opt_seen = line->key; goto err; } + have_max_streams = 1; continue; } /* Maximum amount of streams before we close the circuit. */ if (!strcasecmp(line->key, "HiddenServiceMaxStreamsCloseCircuit")) { config->max_streams_close_circuit = (unsigned int) helper_parse_uint64(line->key, line->value, 0, 1, &ok); - if (!ok) { + if (!ok || have_max_streams_close) { + if (have_max_streams_close) + dup_opt_seen = line->key; goto err; } + have_max_streams_close = 1; continue; } } @@ -408,6 +439,9 @@ config_generic_service(const config_line_t *line_, /* Success */ return 0; err: + if (dup_opt_seen) { + log_warn(LD_CONFIG, "Duplicate directive %s.", dup_opt_seen); + } return -1; }

1 0

[tor/master] test: Add v3 service config and registration test
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit 418059dd96f5f427eceffff1daeb2a2f6c4adbeb Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 17 12:09:54 2017 -0500 test: Add v3 service config and registration test This tests our hs_config.c API to properly load v3 services and register them to the global map. It does NOT test the service object validity, that will be the hs service unit test later on. At this commit, we have 100% code coverage of hs_config.c. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_service.c | 20 +++ src/or/hs_service.h | 11 ++ src/test/test_hs_config.c | 349 +++++++++++++++++++++++++++++++++++++++++----- 3 files changed, 345 insertions(+), 35 deletions(-) diff --git a/src/or/hs_service.c b/src/or/hs_service.c index eb58c76..854ce9e 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -6,6 +6,8 @@ * \brief Implement next generation hidden service functionality **/ +#define HS_SERVICE_PRIVATE + #include "or.h" #include "circuitlist.h" #include "config.h" @@ -786,3 +788,21 @@ generate_establish_intro_cell(const uint8_t *circuit_key_material, return NULL; } +#ifdef TOR_UNIT_TESTS + +/* Return the global service map size. Only used by unit test. */ +STATIC unsigned int +get_hs_service_map_size(void) +{ + return HT_SIZE(hs_service_map); +} + +/* Return the staging list size. Only used by unit test. */ +STATIC int +get_hs_service_staging_list_size(void) +{ + return smartlist_len(hs_service_staging_list); +} + +#endif /* TOR_UNIT_TESTS */ + diff --git a/src/or/hs_service.h b/src/or/hs_service.h index 90606ac..cd154d3 100644 --- a/src/or/hs_service.h +++ b/src/or/hs_service.h @@ -224,5 +224,16 @@ ssize_t get_establish_intro_payload(uint8_t *buf, size_t buf_len, const trn_cell_establish_intro_t *cell); +#ifdef HS_SERVICE_PRIVATE + +#ifdef TOR_UNIT_TESTS + +STATIC unsigned int get_hs_service_map_size(void); +STATIC int get_hs_service_staging_list_size(void); + +#endif /* TOR_UNIT_TESTS */ + +#endif /* HS_SERVICE_PRIVATE */ + #endif /* TOR_HS_SERVICE_H */ diff --git a/src/test/test_hs_config.c b/src/test/test_hs_config.c index 18b1194..343ce9f 100644 --- a/src/test/test_hs_config.c +++ b/src/test/test_hs_config.c @@ -7,15 +7,20 @@ */ #define CONFIG_PRIVATE +#define HS_SERVICE_PRIVATE #include "test.h" #include "test_helpers.h" #include "log_test_helpers.h" -#include "hs_config.h" + #include "config.h" +#include "hs_common.h" +#include "hs_config.h" +#include "hs_service.h" +#include "rendservice.h" static int -helper_config_service_v2(const char *conf, int validate_only) +helper_config_service(const char *conf, int validate_only) { int ret = 0; or_options_t *options = NULL; @@ -29,9 +34,9 @@ helper_config_service_v2(const char *conf, int validate_only) } static void -test_invalid_service_v2(void *arg) +test_invalid_service(void *arg) { - int validate_only = 1, ret; + int ret; (void) arg; @@ -39,11 +44,98 @@ test_invalid_service_v2(void *arg) { const char *conf = "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" - "HiddenServiceVersion 2\n"; + "HiddenServiceVersion 1\n"; /* Wrong not supported version. */ setup_full_capture_of_logs(LOG_WARN); - ret = helper_config_service_v2(conf, validate_only); + ret = helper_config_service(conf, 1); tt_int_op(ret, OP_EQ, -1); - expect_log_msg_containing("with no ports configured."); + expect_log_msg_containing("HiddenServiceVersion must be between 2 and 3"); + teardown_capture_of_logs(); + } + + /* Bad value of HiddenServiceAllowUnknownPorts. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServiceAllowUnknownPorts 2\n"; /* Should be 0 or 1. */ + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceAllowUnknownPorts must be " + "between 0 and 1, not 2"); + teardown_capture_of_logs(); + } + + /* Bad value of HiddenServiceDirGroupReadable */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServiceDirGroupReadable 2\n"; /* Should be 0 or 1. */ + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceDirGroupReadable must be " + "between 0 and 1, not 2"); + teardown_capture_of_logs(); + } + + /* Bad value of HiddenServiceMaxStreamsCloseCircuit */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServiceMaxStreamsCloseCircuit 2\n"; /* Should be 0 or 1. */ + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceMaxStreamsCloseCircuit must " + "be between 0 and 1, not 2"); + teardown_capture_of_logs(); + } + + /* Too much max streams. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 80\n" + "HiddenServiceMaxStreams 65536\n"; /* One too many. */ + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceMaxStreams must be between " + "0 and 65535, not 65536"); + teardown_capture_of_logs(); + } + + /* Duplicate directory directive. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 80\n" + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 81\n"; + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("Another hidden service is already " + "configured for directory"); + teardown_capture_of_logs(); + } + + /* Bad port. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 65536\n"; + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("Missing or invalid port"); teardown_capture_of_logs(); } @@ -54,23 +146,60 @@ test_invalid_service_v2(void *arg) "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" "HiddenServicePort 80\n"; setup_full_capture_of_logs(LOG_WARN); - ret = helper_config_service_v2(conf, validate_only); + ret = helper_config_service(conf, 1); tt_int_op(ret, OP_EQ, -1); expect_log_msg_containing("HiddenServiceVersion with no preceding " "HiddenServiceDir directive"); teardown_capture_of_logs(); } - /* Bad port. */ + done: + ; +} + +static void +test_valid_service(void *arg) +{ + int ret; + + (void) arg; + + /* Mix of v2 and v3. Still valid. */ { const char *conf = "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" "HiddenServiceVersion 2\n" - "HiddenServicePort 65536\n"; + "HiddenServicePort 80\n" + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs2\n" + "HiddenServiceVersion 3\n" + "HiddenServicePort 81\n" + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs3\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 82\n"; + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, 0); + } + + done: + ; +} + +static void +test_invalid_service_v2(void *arg) +{ + int validate_only = 1, ret; + + (void) arg; + + /* Try with a missing port configuration. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n"; setup_full_capture_of_logs(LOG_WARN); - ret = helper_config_service_v2(conf, validate_only); + ret = helper_config_service(conf, validate_only); tt_int_op(ret, OP_EQ, -1); - expect_log_msg_containing("Missing or invalid port"); + expect_log_msg_containing("with no ports configured."); teardown_capture_of_logs(); } @@ -82,25 +211,25 @@ test_invalid_service_v2(void *arg) "HiddenServicePort 80\n" "HiddenServiceNumIntroductionPoints 11\n"; /* One too many. */ setup_full_capture_of_logs(LOG_WARN); - ret = helper_config_service_v2(conf, validate_only); + ret = helper_config_service(conf, validate_only); tt_int_op(ret, OP_EQ, -1); expect_log_msg_containing("HiddenServiceNumIntroductionPoints should " "be between 0 and 10, not 11"); teardown_capture_of_logs(); } - /* Too much max streams. */ + /* Too little introduction points. */ { const char *conf = "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" "HiddenServiceVersion 2\n" "HiddenServicePort 80\n" - "HiddenServiceMaxStreams 65536\n"; /* One too many. */ + "HiddenServiceNumIntroductionPoints -1\n"; setup_full_capture_of_logs(LOG_WARN); - ret = helper_config_service_v2(conf, validate_only); + ret = helper_config_service(conf, validate_only); tt_int_op(ret, OP_EQ, -1); - expect_log_msg_containing("HiddenServiceMaxStreams should be between " - "0 and 65535, not 65536"); + expect_log_msg_containing("HiddenServiceNumIntroductionPoints should " + "be between 0 and 10, not -1"); teardown_capture_of_logs(); } @@ -112,27 +241,110 @@ test_invalid_service_v2(void *arg) "HiddenServicePort 80\n" "HiddenServiceAuthorizeClient blah alice,bob\n"; /* blah is no good. */ setup_full_capture_of_logs(LOG_WARN); - ret = helper_config_service_v2(conf, validate_only); + ret = helper_config_service(conf, validate_only); tt_int_op(ret, OP_EQ, -1); expect_log_msg_containing("HiddenServiceAuthorizeClient contains " "unrecognized auth-type"); teardown_capture_of_logs(); } - /* Duplicate directory directive. */ + done: + ; +} + +static void +test_valid_service_v2(void *arg) +{ + int ret; + + (void) arg; + + /* Valid complex configuration. Basic client authorization. */ { const char *conf = "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" "HiddenServiceVersion 2\n" "HiddenServicePort 80\n" - "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServicePort 22 localhost:22\n" + "HiddenServicePort 42 unix:/path/to/socket\n" + "HiddenServiceAuthorizeClient basic alice,bob,eve\n" + "HiddenServiceAllowUnknownPorts 1\n" + "HiddenServiceMaxStreams 42\n" + "HiddenServiceMaxStreamsCloseCircuit 0\n" + "HiddenServiceDirGroupReadable 1\n" + "HiddenServiceNumIntroductionPoints 7\n"; + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, 0); + } + + /* Valid complex configuration. Stealth client authorization. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs2\n" "HiddenServiceVersion 2\n" - "HiddenServicePort 81\n"; + "HiddenServicePort 65535\n" + "HiddenServicePort 22 1.1.1.1:22\n" + "HiddenServicePort 9000 unix:/path/to/socket\n" + "HiddenServiceAuthorizeClient stealth charlie,romeo\n" + "HiddenServiceAllowUnknownPorts 0\n" + "HiddenServiceMaxStreams 42\n" + "HiddenServiceMaxStreamsCloseCircuit 0\n" + "HiddenServiceDirGroupReadable 1\n" + "HiddenServiceNumIntroductionPoints 8\n"; + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, 0); + } + + done: + ; +} + +static void +test_invalid_service_v3(void *arg) +{ + int validate_only = 1, ret; + + (void) arg; + + /* Try with a missing port configuration. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 3\n"; setup_full_capture_of_logs(LOG_WARN); - ret = helper_config_service_v2(conf, validate_only); + ret = helper_config_service(conf, validate_only); tt_int_op(ret, OP_EQ, -1); - expect_log_msg_containing("Another hidden service is already " - "configured for directory"); + expect_log_msg_containing("with no ports configured."); + teardown_capture_of_logs(); + } + + /* Too many introduction points. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 3\n" + "HiddenServicePort 80\n" + "HiddenServiceNumIntroductionPoints 21\n"; /* One too many. */ + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service(conf, validate_only); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceNumIntroductionPoints must " + "be between 3 and 20, not 21."); + teardown_capture_of_logs(); + } + + /* Too little introduction points. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 3\n" + "HiddenServicePort 80\n" + "HiddenServiceNumIntroductionPoints 1\n"; + setup_full_capture_of_logs(LOG_WARN); + ret = helper_config_service(conf, validate_only); + tt_int_op(ret, OP_EQ, -1); + expect_log_msg_containing("HiddenServiceNumIntroductionPoints must " + "be between 3 and 20, not 1."); teardown_capture_of_logs(); } @@ -141,45 +353,59 @@ test_invalid_service_v2(void *arg) } static void -test_valid_service_v2(void *arg) +test_valid_service_v3(void *arg) { int ret; (void) arg; - /* Valid complex configuration. Basic client authorization. */ + /* Valid complex configuration. */ { const char *conf = "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" - "HiddenServiceVersion 2\n" + "HiddenServiceVersion 3\n" "HiddenServicePort 80\n" "HiddenServicePort 22 localhost:22\n" "HiddenServicePort 42 unix:/path/to/socket\n" - "HiddenServiceAuthorizeClient basic alice,bob,eve\n" "HiddenServiceAllowUnknownPorts 1\n" "HiddenServiceMaxStreams 42\n" "HiddenServiceMaxStreamsCloseCircuit 0\n" "HiddenServiceDirGroupReadable 1\n" "HiddenServiceNumIntroductionPoints 7\n"; - ret = helper_config_service_v2(conf, 1); + ret = helper_config_service(conf, 1); tt_int_op(ret, OP_EQ, 0); } - /* Valid complex configuration. Stealth client authorization. */ + /* Valid complex configuration. */ { const char *conf = "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs2\n" - "HiddenServiceVersion 2\n" + "HiddenServiceVersion 3\n" "HiddenServicePort 65535\n" "HiddenServicePort 22 1.1.1.1:22\n" "HiddenServicePort 9000 unix:/path/to/socket\n" - "HiddenServiceAuthorizeClient stealth charlie,romeo\n" "HiddenServiceAllowUnknownPorts 0\n" "HiddenServiceMaxStreams 42\n" "HiddenServiceMaxStreamsCloseCircuit 0\n" "HiddenServiceDirGroupReadable 1\n" - "HiddenServiceNumIntroductionPoints 8\n"; - ret = helper_config_service_v2(conf, 1); + "HiddenServiceNumIntroductionPoints 20\n"; + ret = helper_config_service(conf, 1); + tt_int_op(ret, OP_EQ, 0); + } + + /* Mix of v2 and v3. Still valid. */ + { + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs1\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 80\n" + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs2\n" + "HiddenServiceVersion 3\n" + "HiddenServicePort 81\n" + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs3\n" + "HiddenServiceVersion 2\n" + "HiddenServicePort 82\n"; + ret = helper_config_service(conf, 1); tt_int_op(ret, OP_EQ, 0); } @@ -187,12 +413,65 @@ test_valid_service_v2(void *arg) ; } +static void +test_staging_service_v3(void *arg) +{ + int ret; + + (void) arg; + + /* We don't validate a service object, this is the service test that are in + * charge of doing so. We just check for the stable state after + * registration. */ + + hs_init(); + + /* Time for a valid v3 service that should get staged. */ + const char *conf = + "HiddenServiceDir /tmp/tor-test-hs-RANDOM/hs2\n" + "HiddenServiceVersion 3\n" + "HiddenServicePort 65535\n" + "HiddenServicePort 22 1.1.1.1:22\n" + "HiddenServicePort 9000 unix:/path/to/socket\n" + "HiddenServiceAllowUnknownPorts 0\n" + "HiddenServiceMaxStreams 42\n" + "HiddenServiceMaxStreamsCloseCircuit 0\n" + "HiddenServiceDirGroupReadable 1\n" + "HiddenServiceNumIntroductionPoints 20\n"; + ret = helper_config_service(conf, 0); + tt_int_op(ret, OP_EQ, 0); + /* Ok, we have a service in our map! Registration went well. */ + tt_int_op(get_hs_service_staging_list_size(), OP_EQ, 1); + /* Make sure we don't have a magic v2 service out of this. */ + tt_int_op(num_rend_services(), OP_EQ, 0); + + done: + hs_free_all(); +} + struct testcase_t hs_config_tests[] = { + /* Invalid service not specific to any version. */ + { "invalid_service", test_invalid_service, TT_FORK, + NULL, NULL }, + { "valid_service", test_valid_service, TT_FORK, + NULL, NULL }, + + /* Test case only for version 2. */ { "invalid_service_v2", test_invalid_service_v2, TT_FORK, NULL, NULL }, { "valid_service_v2", test_valid_service_v2, TT_FORK, NULL, NULL }, + /* Test case only for version 3. */ + { "invalid_service_v3", test_invalid_service_v3, TT_FORK, + NULL, NULL }, + { "valid_service_v3", test_valid_service_v3, TT_FORK, + NULL, NULL }, + + /* Test service staging. */ + { "staging_service_v3", test_staging_service_v3, TT_FORK, + NULL, NULL }, + END_OF_TESTCASES };

1 0

[tor/master] Revert "fixup! prop224: Add hs_config.{c|h} with a refactoring"
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit 28f643139951ee6b60cefa7d7a77bbb257c3af50 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jul 11 16:17:58 2017 -0400 Revert "fixup! prop224: Add hs_config.{c|h} with a refactoring" This reverts commit e2497e2ba038133026a475f0f93c9054187b2a1d. --- src/or/hs_config.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/or/hs_config.c b/src/or/hs_config.c index afc9631..3baab46 100644 --- a/src/or/hs_config.c +++ b/src/or/hs_config.c @@ -287,7 +287,6 @@ config_generic_service(const config_line_t *line_, /* Makes thing easier. */ config = &service->config; - memset(config, 0, sizeof(*config)); /* The first line starts with HiddenServiceDir so we consider what's next is * the configuration of the service. */

1 0

[tor/master] test: Add v3 service load keys and accessors
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit 09b12c40947ea496c0bfaeeafba7540925c17a32 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Feb 2 15:26:04 2017 -0500 test: Add v3 service load keys and accessors Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_service.c | 27 +++++--- src/or/hs_service.h | 14 ++++ src/test/test_hs_service.c | 166 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 199 insertions(+), 8 deletions(-) diff --git a/src/or/hs_service.c b/src/or/hs_service.c index 854ce9e..bfce780 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -57,11 +57,6 @@ hs_service_ht_hash(const hs_service_t *service) sizeof(service->keys.identity_pk.pubkey)); } -/* For the service global hash map, we define a specific type for it which - * will make it safe to use and specific to some controlled parameters such as - * the hashing function and how to compare services. */ -typedef HT_HEAD(hs_service_ht, hs_service_t) hs_service_ht; - /* This is _the_ global hash map of hidden services which indexed the service * contained in it by master public identity key which is roughly the onion * address of the service. */ @@ -82,7 +77,7 @@ HT_GENERATE2(hs_service_ht, hs_service_t, hs_service_node, * if found else NULL. It is also possible to set a directory path in the * search query. If pk is NULL, then it will be set to zero indicating the * hash table to compare the directory path instead. */ -static hs_service_t * +STATIC hs_service_t * find_service(hs_service_ht *map, const ed25519_public_key_t *pk) { hs_service_t dummy_service = {0}; @@ -95,7 +90,7 @@ find_service(hs_service_ht *map, const ed25519_public_key_t *pk) /* Register the given service in the given map. If the service already exists * in the map, -1 is returned. On success, 0 is returned and the service * ownership has been transfered to the global map. */ -static int +STATIC int register_service(hs_service_ht *map, hs_service_t *service) { tor_assert(map); @@ -113,7 +108,7 @@ register_service(hs_service_ht *map, hs_service_t *service) /* Remove a given service from the given map. If service is NULL or the * service key is unset, return gracefully. */ -static void +STATIC void remove_service(hs_service_ht *map, hs_service_t *service) { hs_service_t *elm; @@ -804,5 +799,21 @@ get_hs_service_staging_list_size(void) return smartlist_len(hs_service_staging_list); } +STATIC hs_service_ht * +get_hs_service_map(void) +{ + return hs_service_map; +} + +STATIC hs_service_t * +get_first_service(void) +{ + hs_service_t **obj = HT_START(hs_service_ht, hs_service_map); + if (obj == NULL) { + return NULL; + } + return *obj; +} + #endif /* TOR_UNIT_TESTS */ diff --git a/src/or/hs_service.h b/src/or/hs_service.h index cd154d3..a98884f 100644 --- a/src/or/hs_service.h +++ b/src/or/hs_service.h @@ -200,6 +200,11 @@ typedef struct hs_service_t { } hs_service_t; +/* For the service global hash map, we define a specific type for it which + * will make it safe to use and specific to some controlled parameters such as + * the hashing function and how to compare services. */ +typedef HT_HEAD(hs_service_ht, hs_service_t) hs_service_ht; + /* API */ /* Global initializer and cleanup function. */ @@ -228,8 +233,17 @@ get_establish_intro_payload(uint8_t *buf, size_t buf_len, #ifdef TOR_UNIT_TESTS +/* Useful getters for unit tests. */ STATIC unsigned int get_hs_service_map_size(void); STATIC int get_hs_service_staging_list_size(void); +STATIC hs_service_ht *get_hs_service_map(void); +STATIC hs_service_t *get_first_service(void); + +/* Service accessors. */ +STATIC hs_service_t *find_service(hs_service_ht *map, + const ed25519_public_key_t *pk); +STATIC void remove_service(hs_service_ht *map, hs_service_t *service); +STATIC int register_service(hs_service_ht *map, hs_service_t *service); #endif /* TOR_UNIT_TESTS */ diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c index e081b7f..c695b90 100644 --- a/src/test/test_hs_service.c +++ b/src/test/test_hs_service.c @@ -8,14 +8,17 @@ #define CIRCUITBUILD_PRIVATE #define CIRCUITLIST_PRIVATE +#define CONFIG_PRIVATE #define CONNECTION_PRIVATE #define CRYPTO_PRIVATE #define HS_COMMON_PRIVATE +#define HS_SERVICE_PRIVATE #define HS_INTROPOINT_PRIVATE #define MAIN_PRIVATE #define TOR_CHANNEL_INTERNAL_ #include "test.h" +#include "test_helpers.h" #include "log_test_helpers.h" #include "rend_test_helpers.h" @@ -26,8 +29,10 @@ #include "circuituse.h" #include "config.h" #include "connection.h" +#include "crypto.h" #include "hs_circuit.h" #include "hs_common.h" +#include "hs_config.h" #include "hs_ident.h" #include "hs_intropoint.h" #include "hs_ntor.h" @@ -35,6 +40,25 @@ #include "main.h" #include "rendservice.h" +/* Trunnel */ +#include "hs/cell_establish_intro.h" + +/* Helper: from a set of options in conf, configure a service which will add + * it to the staging list of the HS subsytem. */ +static int +helper_config_service(const char *conf) +{ + int ret = 0; + or_options_t *options = NULL; + tt_assert(conf); + options = helper_parse_options(conf); + tt_assert(options); + ret = hs_config_service_all(options, 0); + done: + or_options_free(options); + return ret; +} + /** We simulate the creation of an outgoing ESTABLISH_INTRO cell, and then we * parse it from the receiver side. */ static void @@ -394,6 +418,144 @@ test_e2e_rend_circuit_setup(void *arg) circuit_free(TO_CIRCUIT(or_circ)); } +static void +test_load_keys(void *arg) +{ + int ret; + char *conf = NULL; + char *hsdir_v2 = tor_strdup(get_fname("hs2")); + char *hsdir_v3 = tor_strdup(get_fname("hs3")); + char addr[HS_SERVICE_ADDR_LEN_BASE32 + 1]; + + (void) arg; + + /* We'll register two services, a v2 and a v3, then we'll load keys and + * validate that both are in a correct state. */ + + hs_init(); + +#define conf_fmt \ + "HiddenServiceDir %s\n" \ + "HiddenServiceVersion %d\n" \ + "HiddenServicePort 65535\n" + + /* v2 service. */ + tor_asprintf(&conf, conf_fmt, hsdir_v2, HS_VERSION_TWO); + ret = helper_config_service(conf); + tor_free(conf); + tt_int_op(ret, OP_EQ, 0); + /* This one should now be registered into the v2 list. */ + tt_int_op(get_hs_service_staging_list_size(), OP_EQ, 0); + tt_int_op(num_rend_services(), OP_EQ, 1); + + /* v3 service. */ + tor_asprintf(&conf, conf_fmt, hsdir_v3, HS_VERSION_THREE); + ret = helper_config_service(conf); + tor_free(conf); + tt_int_op(ret, OP_EQ, 0); + /* It's in staging? */ + tt_int_op(get_hs_service_staging_list_size(), OP_EQ, 1); + + /* Load the keys for these. After that, the v3 service should be registered + * in the global map. */ + hs_service_load_all_keys(); + tt_int_op(get_hs_service_map_size(), OP_EQ, 1); + hs_service_t *s = get_first_service(); + tt_assert(s); + + /* Ok we have the service object. Validate few things. */ + tt_assert(!tor_mem_is_zero(s->onion_address, sizeof(s->onion_address))); + tt_int_op(hs_address_is_valid(s->onion_address), OP_EQ, 1); + tt_assert(!tor_mem_is_zero((char *) s->keys.identity_sk.seckey, + ED25519_SECKEY_LEN)); + tt_assert(!tor_mem_is_zero((char *) s->keys.identity_pk.pubkey, + ED25519_PUBKEY_LEN)); + /* Check onion address from identity key. */ + hs_build_address(&s->keys.identity_pk, s->version, addr); + tt_int_op(hs_address_is_valid(addr), OP_EQ, 1); + tt_str_op(addr, OP_EQ, s->onion_address); + + done: + tor_free(hsdir_v2); + tor_free(hsdir_v3); + hs_free_all(); +} + +static void +test_access_service(void *arg) +{ + int ret; + char *conf = NULL; + char *hsdir_v3 = tor_strdup(get_fname("hs3")); + hs_service_ht *global_map; + + (void) arg; + + /* We'll register two services, a v2 and a v3, then we'll load keys and + * validate that both are in a correct state. */ + + hs_init(); + +#define conf_fmt \ + "HiddenServiceDir %s\n" \ + "HiddenServiceVersion %d\n" \ + "HiddenServicePort 65535\n" + + /* v3 service. */ + tor_asprintf(&conf, conf_fmt, hsdir_v3, HS_VERSION_THREE); + ret = helper_config_service(conf); + tor_free(conf); + tt_int_op(ret, OP_EQ, 0); + /* It's in staging? */ + tt_int_op(get_hs_service_staging_list_size(), OP_EQ, 1); + + /* Load the keys for these. After that, the v3 service should be registered + * in the global map. */ + hs_service_load_all_keys(); + tt_int_op(get_hs_service_map_size(), OP_EQ, 1); + hs_service_t *s = get_first_service(); + tt_assert(s); + global_map = get_hs_service_map(); + tt_assert(global_map); + + /* From here, we'll try the service accessors. */ + hs_service_t *query = find_service(global_map, &s->keys.identity_pk); + tt_assert(query); + tt_mem_op(query, OP_EQ, s, sizeof(hs_service_t)); + /* Remove service, check if it actually works and then put it back. */ + remove_service(global_map, s); + tt_int_op(get_hs_service_map_size(), OP_EQ, 0); + query = find_service(global_map, &s->keys.identity_pk); + tt_assert(!query); + + /* Register back the service in the map. */ + ret = register_service(global_map, s); + tt_int_op(ret, OP_EQ, 0); + tt_int_op(get_hs_service_map_size(), OP_EQ, 1); + /* Twice should fail. */ + ret = register_service(global_map, s); + tt_int_op(ret, OP_EQ, -1); + /* Modify key of service and we should be able to put it back in. */ + s->keys.identity_pk.pubkey[1] = '\x42'; + ret = register_service(global_map, s); + tt_int_op(ret, OP_EQ, 0); + tt_int_op(get_hs_service_map_size(), OP_EQ, 2); + /* Remove service from map so we don't double free on cleanup. */ + remove_service(global_map, s); + tt_int_op(get_hs_service_map_size(), OP_EQ, 1); + query = find_service(global_map, &s->keys.identity_pk); + tt_assert(!query); + /* Let's try to remove twice for fun. */ + setup_full_capture_of_logs(LOG_WARN); + remove_service(global_map, s); + expect_log_msg_containing("Could not find service in the global map"); + teardown_capture_of_logs(); + + done: + tor_free(hsdir_v3); + hs_free_all(); +} + struct testcase_t hs_service_tests[] = { { "gen_establish_intro_cell", test_gen_establish_intro_cell, TT_FORK, NULL, NULL }, @@ -409,6 +571,10 @@ struct testcase_t hs_service_tests[] = { NULL, NULL }, { "validate_address", test_validate_address, TT_FORK, NULL, NULL }, + { "load_keys", test_load_keys, TT_FORK, + NULL, NULL }, + { "access_service", test_access_service, TT_FORK, + NULL, NULL }, END_OF_TESTCASES };

1 0

[tor/master] prop224: Load and/or generate v3 service keys
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit 138e03c488bfa05504b69ced48ddf8f0afd1310c Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Feb 1 09:18:58 2017 -0500 prop224: Load and/or generate v3 service keys Try to load or/and generate service keys for v3. This write both the public and private key file to disk along with the hostname file containing the onion address. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/config.c | 2 +- src/or/hs_common.c | 14 ++++ src/or/hs_common.h | 1 + src/or/hs_service.c | 215 +++++++++++++++++++++++++++++++++++++++++++++------ src/or/hs_service.h | 7 +- src/or/rendservice.c | 9 +-- 6 files changed, 215 insertions(+), 33 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index 062ab27..f460ec6 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1799,7 +1799,7 @@ options_act(const or_options_t *old_options) monitor_owning_controller_process(options->OwningControllerProcess); /* reload keys as needed for rendezvous services. */ - if (rend_service_load_all_keys(NULL)<0) { + if (hs_service_load_all_keys() < 0) { log_warn(LD_GENERAL,"Error loading rendezvous service keys"); return -1; } diff --git a/src/or/hs_common.c b/src/or/hs_common.c index 00befab..87c29d5 100644 --- a/src/or/hs_common.c +++ b/src/or/hs_common.c @@ -20,6 +20,20 @@ #include "hs_service.h" #include "rendcommon.h" +/* Allocate and return a string containing the path to filename in directory. + * This function will never return NULL. The caller must free this path. */ +char * +hs_path_from_filename(const char *directory, const char *filename) +{ + char *file_path = NULL; + + tor_assert(directory); + tor_assert(filename); + + tor_asprintf(&file_path, "%s%s%s", directory, PATH_SEPARATOR, filename); + return file_path; +} + /* Make sure that the directory for service is private, using the config * username. * If create is true: diff --git a/src/or/hs_common.h b/src/or/hs_common.h index 64bf89f..2b33914 100644 --- a/src/or/hs_common.h +++ b/src/or/hs_common.h @@ -88,6 +88,7 @@ void hs_free_all(void); int hs_check_service_private_dir(const char *username, const char *path, unsigned int dir_group_readable, unsigned int create); +char *hs_path_from_filename(const char *directory, const char *filename); void hs_build_address(const ed25519_public_key_t *key, uint8_t version, char *addr_out); int hs_address_is_valid(const char *address); diff --git a/src/or/hs_service.c b/src/or/hs_service.c index b267e1d..bce976e 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -12,6 +12,7 @@ #include "relay.h" #include "rendservice.h" #include "router.h" +#include "routerkeys.h" #include "hs_common.h" #include "hs_config.h" @@ -21,6 +22,11 @@ #include "hs/cell_establish_intro.h" #include "hs/cell_common.h" +/* Onion service directory file names. */ +static const char *fname_keyfile_prefix = "hs_ed25519"; +static const char *fname_hostname = "hostname"; +static const char *address_tld = "onion"; + /* Staging list of service object. When configuring service, we add them to * this list considered a staging area and they will get added to our global * map once the keys have been loaded. These two steps are seperated because @@ -163,19 +169,21 @@ ht_free_service_(struct hs_service_t *service, void *data) static void service_free_all(void) { - if (hs_service_map == NULL) { - return; + if (hs_service_map) { + /* The free helper function returns 1 so this is safe. */ + hs_service_ht_HT_FOREACH_FN(hs_service_map, ht_free_service_, NULL); + HT_CLEAR(hs_service_ht, hs_service_map); + tor_free(hs_service_map); + hs_service_map = NULL; + } + + if (hs_service_staging_list) { + /* Cleanup staging list. */ + SMARTLIST_FOREACH(hs_service_staging_list, hs_service_t *, s, + hs_service_free(s)); + smartlist_free(hs_service_staging_list); + hs_service_staging_list = NULL; } - /* The free helper function returns 1 so this is safe. */ - hs_service_ht_HT_FOREACH_FN(hs_service_map, ht_free_service_, NULL); - HT_CLEAR(hs_service_ht, hs_service_map); - tor_free(hs_service_map); - hs_service_map = NULL; - /* Cleanup staging list. */ - SMARTLIST_FOREACH(hs_service_staging_list, hs_service_t *, s, - hs_service_free(s)); - smartlist_free(hs_service_staging_list); - hs_service_staging_list = NULL; } /* Close all rendezvous circuits for the given service. */ @@ -299,19 +307,29 @@ move_ephemeral_services(hs_service_ht *src, hs_service_ht *dst) } } -/* Register services that are in the list. Once this function returns, the - * global service map will be set with the right content and all non surviving - * services will be cleaned up. */ -void -hs_service_register_services(smartlist_t *new_service_list) +/* Return a const string of the directory path escaped. If this is an + * ephemeral service, it returns "[EPHEMERAL]". This can only be called from + * the main thread because escaped() uses a static variable. */ +static const char * +service_escaped_dir(const hs_service_t *s) +{ + return (s->config.is_ephemeral) ? "[EPHEMERAL]" : + escaped(s->config.directory_path); +} + +/* Register services that are in the staging list. Once this function returns, + * the global service map will be set with the right content and all non + * surviving services will be cleaned up. */ +static void +register_all_services(void) { struct hs_service_ht *new_service_map; hs_service_t *s, **iter; - tor_assert(new_service_list); + tor_assert(hs_service_staging_list); /* We'll save us some allocation and computing time. */ - if (smartlist_len(new_service_list) == 0) { + if (smartlist_len(hs_service_staging_list) == 0) { return; } @@ -325,7 +343,7 @@ hs_service_register_services(smartlist_t *new_service_list) * port or stopping the tor daemon. */ move_ephemeral_services(hs_service_map, new_service_map); - SMARTLIST_FOREACH_BEGIN(new_service_list, hs_service_t *, snew) { + SMARTLIST_FOREACH_BEGIN(hs_service_staging_list, hs_service_t *, snew) { /* Check if that service is already in our global map and if so, we'll * transfer the intro points to it. */ s = find_service(hs_service_map, &snew->keys.identity_pk); @@ -345,8 +363,8 @@ hs_service_register_services(smartlist_t *new_service_list) * service means we failed to validate correctly. In that case, don't * break tor and ignore the service but tell user. */ log_warn(LD_BUG, "Unable to register service with directory %s", - snew->config.directory_path); - SMARTLIST_DEL_CURRENT(new_service_list, snew); + service_escaped_dir(snew)); + SMARTLIST_DEL_CURRENT(hs_service_staging_list, snew); hs_service_free(snew); } } SMARTLIST_FOREACH_END(snew); @@ -357,11 +375,162 @@ hs_service_register_services(smartlist_t *new_service_list) close_service_circuits(*iter); } - /* Time to make the switch. We'll wipe the current list and switch. */ + /* Time to make the switch. We'll clear the staging list because its content + * has now changed ownership to the map. */ + smartlist_clear(hs_service_staging_list); service_free_all(); hs_service_map = new_service_map; } +/* Write the onion address of a given service to the given filename fname_ in + * the service directory. Return 0 on success else -1 on error. */ +static int +write_address_to_file(const hs_service_t *service, const char *fname_) +{ + int ret = -1; + char *fname = NULL; + /* Length of an address plus the sizeof the address tld (onion) which counts + * the NUL terminated byte so we keep it for the "." and the newline. */ + char buf[HS_SERVICE_ADDR_LEN_BASE32 + sizeof(address_tld) + 1]; + + tor_assert(service); + tor_assert(fname_); + + /* Construct the full address with the onion tld and write the hostname file + * to disk. */ + tor_snprintf(buf, sizeof(buf), "%s.%s\n", service->onion_address, + address_tld); + /* Notice here that we use the given "fname_". */ + fname = hs_path_from_filename(service->config.directory_path, fname_); + if (write_str_to_file(fname, buf, 0) < 0) { + log_warn(LD_REND, "Could not write onion address to hostname file %s", + escaped(fname)); + goto end; + } + +#ifndef _WIN32 + if (service->config.dir_group_readable) { + /* Mode to 0640. */ + if (chmod(fname, S_IRUSR | S_IWUSR | S_IRGRP) < 0) { + log_warn(LD_FS, "Unable to make onion service hostname file %s " + "group-readable.", escaped(fname)); + } + } +#endif /* _WIN32 */ + + /* Success. */ + ret = 0; + end: + tor_free(fname); + return ret; +} + +/* Load and/or generate private keys for the given service. On success, the + * hostname file will be written to disk along with the master private key iff + * the service is not configured for offline keys. Return 0 on success else -1 + * on failure. */ +static int +load_service_keys(hs_service_t *service) +{ + int ret = -1; + char *fname = NULL; + ed25519_keypair_t *kp; + const hs_service_config_t *config; + + tor_assert(service); + + config = &service->config; + + /* Create and fix permission on service directory. We are about to write + * files to that directory so make sure it exists and has the right + * permissions. We do this here because at this stage we know that Tor is + * actually running and the service we have has been validated. */ + if (BUG(hs_check_service_private_dir(get_options()->User, + config->directory_path, + config->dir_group_readable, 1) < 0)) { + goto end; + } + + /* Try to load the keys from file or generate it if not found. */ + fname = hs_path_from_filename(config->directory_path, fname_keyfile_prefix); + /* Don't ask for key creation, we want to know if we were able to load it or + * we had to generate it. Better logging! */ + kp = ed_key_init_from_file(fname, 0, LOG_INFO, NULL, 0, 0, 0, NULL); + if (!kp) { + log_info(LD_REND, "Unable to load keys from %s. Generating it...", fname); + /* We'll now try to generate the keys and for it we want the strongest + * randomness for it. The keypair will be written in different files. */ + uint32_t key_flags = INIT_ED_KEY_CREATE | INIT_ED_KEY_EXTRA_STRONG | + INIT_ED_KEY_SPLIT; + kp = ed_key_init_from_file(fname, key_flags, LOG_WARN, NULL, 0, 0, 0, + NULL); + if (!kp) { + log_warn(LD_REND, "Unable to generate keys and save in %s.", fname); + goto end; + } + } + + /* Copy loaded or generated keys to service object. */ + ed25519_pubkey_copy(&service->keys.identity_pk, &kp->pubkey); + memcpy(&service->keys.identity_sk, &kp->seckey, + sizeof(service->keys.identity_sk)); + /* This does a proper memory wipe. */ + ed25519_keypair_free(kp); + + /* Build onion address from the newly loaded keys. */ + tor_assert(service->version <= UINT8_MAX); + hs_build_address(&service->keys.identity_pk, (uint8_t) service->version, + service->onion_address); + + /* Write onion address to hostname file. */ + if (write_address_to_file(service, fname_hostname) < 0) { + goto end; + } + + /* Succes. */ + ret = 0; + end: + tor_free(fname); + return ret; +} + +/* Load and/or generate keys for all onion services including the client + * authorization if any. Return 0 on success, -1 on failure. */ +int +hs_service_load_all_keys(void) +{ + /* Load v2 service keys if we have v2. */ + if (num_rend_services() != 0) { + if (rend_service_load_all_keys(NULL) < 0) { + goto err; + } + } + + /* Load or/and generate them for v3+. */ + SMARTLIST_FOREACH_BEGIN(hs_service_staging_list, hs_service_t *, service) { + /* Ignore ephemeral service, they already have their keys set. */ + if (service->config.is_ephemeral) { + continue; + } + log_info(LD_REND, "Loading v3 onion service keys from %s", + service_escaped_dir(service)); + if (load_service_keys(service) < 0) { + goto err; + } + /* XXX: Load/Generate client authorization keys. (#20700) */ + } SMARTLIST_FOREACH_END(service); + + /* Final step, the staging list contains service in a quiescent state that + * is ready to be used. Register them to the global map. Once this is over, + * the staging list will be cleaned up. */ + register_all_services(); + + /* All keys have been loaded successfully. */ + return 0; + err: + return -1; +} + /* Put all service object in the given service list. After this, the caller * looses ownership of every elements in the list and responsible to free the * list pointer. */ diff --git a/src/or/hs_service.h b/src/or/hs_service.h index 8d92e75..90606ac 100644 --- a/src/or/hs_service.h +++ b/src/or/hs_service.h @@ -13,6 +13,7 @@ #include "crypto_ed25519.h" #include "replaycache.h" +#include "hs_common.h" #include "hs_descriptor.h" #include "hs_intropoint.h" @@ -172,6 +173,10 @@ typedef struct hs_service_t { /* Protocol version of the service. Specified by HiddenServiceVersion. */ uint32_t version; + /* Onion address base32 encoded and NUL terminated. We keep it for logging + * purposes so we don't have to build it everytime. */ + char onion_address[HS_SERVICE_ADDR_LEN_BASE32 + 1]; + /* Hashtable node: use to look up the service by its master public identity * key in the service global map. */ HT_ENTRY(hs_service_t) hs_service_node; @@ -205,8 +210,8 @@ void hs_service_free_all(void); hs_service_t *hs_service_new(const or_options_t *options); void hs_service_free(hs_service_t *service); -void hs_service_register_services(smartlist_t *new_service_list); void hs_service_stage_services(const smartlist_t *service_list); +int hs_service_load_all_keys(void); /* These functions are only used by unit tests and we need to expose them else * hs_service.o ends up with no symbols in libor.a which makes clang throw a diff --git a/src/or/rendservice.c b/src/or/rendservice.c index e86119f..358efd0 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1046,15 +1046,8 @@ rend_service_update_descriptor(rend_service_t *service) static char * rend_service_path(const rend_service_t *service, const char *file_name) { - char *file_path = NULL; - tor_assert(service->directory); - - /* Can never fail: asserts rather than leaving file_path NULL. */ - tor_asprintf(&file_path, "%s%s%s", - service->directory, PATH_SEPARATOR, file_name); - - return file_path; + return hs_path_from_filename(service->directory, file_name); } /* Allocate and return a string containing the path to the single onion

1 0

[tor/master] prop224: Move service version into config object
by nickm＠torproject.org 13 Jul '17

13 Jul '17

commit 5d64ceb12defdc7db8402088fb2946c35274636a Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Jul 13 08:51:14 2017 -0400 prop224: Move service version into config object It makes more sense to have the version in the configuration object of the service because it is afterall a torrc option (HiddenServiceVersion). Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_config.c | 15 ++++++++------- src/or/hs_service.c | 9 +++++---- src/or/hs_service.h | 7 ++++--- src/test/test_hs_service.c | 2 +- 4 files changed, 18 insertions(+), 15 deletions(-) diff --git a/src/or/hs_config.c b/src/or/hs_config.c index 7e0124b..5f9282e 100644 --- a/src/or/hs_config.c +++ b/src/or/hs_config.c @@ -55,7 +55,7 @@ stage_services(smartlist_t *service_list) * only >= v3 service. And remember, v2 has a different object type which is * shadow copied from an hs_service_t type. */ SMARTLIST_FOREACH_BEGIN(service_list, hs_service_t *, s) { - if (s->version == HS_VERSION_TWO) { + if (s->config.version == HS_VERSION_TWO) { SMARTLIST_DEL_CURRENT(service_list, s); hs_service_free(s); } @@ -157,7 +157,7 @@ config_has_invalid_options(const config_line_t *line_, const config_line_t *line; tor_assert(service); - tor_assert(service->version <= HS_VERSION_MAX); + tor_assert(service->config.version <= HS_VERSION_MAX); /* List of options that a v3 service doesn't support thus must exclude from * its configuration. */ @@ -178,7 +178,7 @@ config_has_invalid_options(const config_line_t *line_, { opts_exclude_v3 }, /* v3. */ }; - optlist = exclude_lists[service->version].list; + optlist = exclude_lists[service->config.version].list; if (optlist == NULL) { /* No exclude options to look at for this version. */ goto end; @@ -193,7 +193,8 @@ config_has_invalid_options(const config_line_t *line_, if (!strcasecmp(line->key, opt)) { log_warn(LD_CONFIG, "Hidden service option %s is incompatible with " "version %" PRIu32 " of service in %s", - opt, service->version, service->config.directory_path); + opt, service->config.version, + service->config.directory_path); ret = 1; /* Continue the loop so we can find all possible options. */ continue; @@ -342,7 +343,7 @@ config_generic_service(const config_line_t *line_, } /* Version of the service. */ if (!strcasecmp(line->key, "HiddenServiceVersion")) { - service->version = + service->config.version = (uint32_t) helper_parse_uint64(line->key, line->value, HS_VERSION_MIN, HS_VERSION_MAX, &ok); if (!ok || have_version) { @@ -462,7 +463,7 @@ config_service(const config_line_t *line, const or_options_t *options, if (config_generic_service(line, options, service) < 0) { goto err; } - tor_assert(service->version <= HS_VERSION_MAX); + tor_assert(service->config.version <= HS_VERSION_MAX); /* Before we configure the service on a per-version basis, we'll make * sure that this set of options for a service are valid that is for * instance an option only for v2 is not used for v3. */ @@ -482,7 +483,7 @@ config_service(const config_line_t *line, const or_options_t *options, /* Different functions are in charge of specific options for a version. We * start just after the service directory line so once we hit another * directory line, the function knows that it has to stop parsing. */ - switch (service->version) { + switch (service->config.version) { case HS_VERSION_TWO: ret = rend_config_service(line->next, options, &service->config); break; diff --git a/src/or/hs_service.c b/src/or/hs_service.c index 97d3288..d8b87d1 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -250,7 +250,7 @@ close_service_circuits(hs_service_t *service) tor_assert(service); /* Only support for version >= 3. */ - if (BUG(service->version < HS_VERSION_THREE)) { + if (BUG(service->config.version < HS_VERSION_THREE)) { return; } /* Close intro points. */ @@ -492,8 +492,9 @@ load_service_keys(hs_service_t *service) ed25519_keypair_free(kp); /* Build onion address from the newly loaded keys. */ - tor_assert(service->version <= UINT8_MAX); - hs_build_address(&service->keys.identity_pk, (uint8_t) service->version, + tor_assert(service->config.version <= UINT8_MAX); + hs_build_address(&service->keys.identity_pk, + (uint8_t) service->config.version, service->onion_address); /* Write onion address to hostname file. */ @@ -572,7 +573,7 @@ hs_service_new(const or_options_t *options) /* Set default configuration value. */ set_service_default_config(&service->config, options); /* Set the default service version. */ - service->version = HS_SERVICE_DEFAULT_VERSION; + service->config.version = HS_SERVICE_DEFAULT_VERSION; return service; } diff --git a/src/or/hs_service.h b/src/or/hs_service.h index a98884f..54b9e69 100644 --- a/src/or/hs_service.h +++ b/src/or/hs_service.h @@ -112,6 +112,10 @@ typedef struct hs_service_keys_t { * set by the configuration file or by the control port. Nothing else should * change those values. */ typedef struct hs_service_config_t { + /* Protocol version of the service. Specified by HiddenServiceVersion + * option. */ + uint32_t version; + /* List of rend_service_port_config_t */ smartlist_t *ports; @@ -170,9 +174,6 @@ typedef struct hs_service_state_t { /* Representation of a service running on this tor instance. */ typedef struct hs_service_t { - /* Protocol version of the service. Specified by HiddenServiceVersion. */ - uint32_t version; - /* Onion address base32 encoded and NUL terminated. We keep it for logging * purposes so we don't have to build it everytime. */ char onion_address[HS_SERVICE_ADDR_LEN_BASE32 + 1]; diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c index c695b90..24fca08 100644 --- a/src/test/test_hs_service.c +++ b/src/test/test_hs_service.c @@ -471,7 +471,7 @@ test_load_keys(void *arg) tt_assert(!tor_mem_is_zero((char *) s->keys.identity_pk.pubkey, ED25519_PUBKEY_LEN)); /* Check onion address from identity key. */ - hs_build_address(&s->keys.identity_pk, s->version, addr); + hs_build_address(&s->keys.identity_pk, s->config.version, addr); tt_int_op(hs_address_is_valid(addr), OP_EQ, 1); tt_str_op(addr, OP_EQ, s->onion_address);

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits July 2017