September 2018 - tor-commits - lists.torproject.org

[tor/master] Introduce per-service HiddenServiceExportCircuitID torrc option.
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit 27d7491f5a761c58fc687f0b816b80ff9f7a1a1d Author: George Kadianakis <desnacked(a)riseup.net> Date: Wed Sep 12 14:40:19 2018 +0300 Introduce per-service HiddenServiceExportCircuitID torrc option. Moves code to a function, better viewed with --color-moved. --- changes/bug4700 | 5 +++++ src/app/config/config.c | 1 + src/core/or/connection_edge.c | 52 ++++++++++++++++++++++++++----------------- src/feature/hs/hs_config.c | 20 ++++++++++++++++- src/feature/hs/hs_service.c | 13 +++++++++++ src/feature/hs/hs_service.h | 5 +++++ 6 files changed, 75 insertions(+), 21 deletions(-) diff --git a/changes/bug4700 b/changes/bug4700 new file mode 100644 index 000000000..3c8d9b19b --- /dev/null +++ b/changes/bug4700 @@ -0,0 +1,5 @@ + o Minor features (onion services): + - Version 3 onion services can now use the per-service + HiddenServiceExportCircuitID option to differentiate client circuits by + using the HAProxy proxy protocol which assigns IP addresses to inbound client + circuits. Closes ticket 4700. Patch by Mahrud Sayrafi. diff --git a/src/app/config/config.c b/src/app/config/config.c index 1adeb75c9..13421f103 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -457,6 +457,7 @@ static config_var_t option_vars_[] = { VAR("HiddenServiceMaxStreams",LINELIST_S, RendConfigLines, NULL), VAR("HiddenServiceMaxStreamsCloseCircuit",LINELIST_S, RendConfigLines, NULL), VAR("HiddenServiceNumIntroductionPoints", LINELIST_S, RendConfigLines, NULL), + VAR("HiddenServiceExportCircuitID", LINELIST_S, RendConfigLines, NULL), VAR("HiddenServiceStatistics", BOOL, HiddenServiceStatistics_option, "1"), V(HidServAuth, LINELIST, NULL), V(ClientOnionAuthDir, FILENAME, NULL), diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index a85419376..8b333a6f4 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -597,6 +597,33 @@ connected_cell_format_payload(uint8_t *payload_out, return connected_payload_len; } +/* DOCDOCDOC */ +static void +send_ha_proxy_header(const edge_connection_t *edge_conn, + connection_t *conn) +{ + char buf[512]; + char dst_ipv6[39] = "::1"; + /* See RFC4193 regarding fc00::/7 */ + char src_ipv6_prefix[34] = "fc00:dead:beef:4dad:"; + /* TODO: retain virtual port and use as destination port */ + uint16_t dst_port = 443; + uint16_t src_port = 0; + uint32_t gid = 0; + + if (edge_conn->on_circuit != NULL) { + gid = TO_ORIGIN_CIRCUIT(edge_conn->on_circuit)->global_identifier; + src_port = gid & 0x0000ffff; + } + + gid = (gid == 0) ? 1 : gid; + src_port = (src_port == 0) ? 1 : src_port; + + tor_snprintf(buf, sizeof(buf), "PROXY TCP6 %s:%x %s %d %d\r\n", + src_ipv6_prefix, gid, dst_ipv6, src_port, dst_port); + connection_buf_add(buf, strlen(buf), conn); +} + /** Connected handler for exit connections: start writing pending * data, deliver 'CONNECTED' relay cells as appropriate, and check * any pending data that may have been received. */ @@ -618,28 +645,13 @@ connection_edge_finished_connecting(edge_connection_t *edge_conn) conn->state = EXIT_CONN_STATE_OPEN; - /* Include Proxy Protocol header. */ - char buf[512]; - char dst_ipv6[39] = "::1"; - /* See RFC4193 regarding fc00::/7 */ - char src_ipv6_prefix[34] = "fc00:dead:beef:4dad:"; - /* TODO: retain virtual port and use as destination port */ - uint16_t dst_port = 443; - uint16_t src_port = 0; - uint32_t gid = 0; - - if (edge_conn->on_circuit != NULL) { - gid = TO_ORIGIN_CIRCUIT(edge_conn->on_circuit)->global_identifier; - src_port = gid & 0x0000ffff; + /* If it's an onion service connection, we might want to include the proxy + * protocol header */ + if (edge_conn->hs_ident && + hs_service_exports_circuit_id(&edge_conn->hs_ident->identity_pk)) { + send_ha_proxy_header(edge_conn, conn); } - gid = (gid == 0) ? 1 : gid; - src_port = (src_port == 0) ? 1 : src_port; - - tor_snprintf(buf, sizeof(buf), "PROXY TCP6 %s:%x %s %d %d\r\n", - src_ipv6_prefix, gid, dst_ipv6, src_port, dst_port); - connection_buf_add(buf, strlen(buf), conn); - connection_watch_events(conn, READ_EVENT); /* stop writing, keep reading */ if (connection_get_outbuf_len(conn)) /* in case there are any queued relay * cells */ diff --git a/src/feature/hs/hs_config.c b/src/feature/hs/hs_config.c index eaeb58829..16bfe7c54 100644 --- a/src/feature/hs/hs_config.c +++ b/src/feature/hs/hs_config.c @@ -188,6 +188,11 @@ config_has_invalid_options(const config_line_t *line_, NULL /* End marker. */ }; + const char *opts_exclude_v2[] = { + "HiddenServiceExportCircuitID", + NULL /* End marker. */ + }; + /* Defining the size explicitly allows us to take advantage of the compiler * which warns us if we ever bump the max version but forget to grow this * array. The plus one is because we have a version 0 :). */ @@ -196,7 +201,7 @@ config_has_invalid_options(const config_line_t *line_, } exclude_lists[HS_VERSION_MAX + 1] = { { NULL }, /* v0. */ { NULL }, /* v1. */ - { NULL }, /* v2 */ + { opts_exclude_v2 }, /* v2 */ { opts_exclude_v3 }, /* v3. */ }; @@ -262,6 +267,7 @@ config_service_v3(const config_line_t *line_, hs_service_config_t *config) { int have_num_ip = 0; + bool export_circuit_id = false; /* just to detect duplicate options */ const char *dup_opt_seen = NULL; const config_line_t *line; @@ -288,6 +294,18 @@ config_service_v3(const config_line_t *line_, have_num_ip = 1; continue; } + if (!strcasecmp(line->key, "HiddenServiceExportCircuitID")) { + config->export_circuit_id = + (unsigned int) helper_parse_uint64(line->key, line->value, 0, 1, &ok); + if (!ok || export_circuit_id) { + if (export_circuit_id) { + dup_opt_seen = line->key; + } + goto err; + } + export_circuit_id = true; + continue; + } } /* We do not load the key material for the service at this stage. This is diff --git a/src/feature/hs/hs_service.c b/src/feature/hs/hs_service.c index 30d23eb77..75d7cb75e 100644 --- a/src/feature/hs/hs_service.c +++ b/src/feature/hs/hs_service.c @@ -3762,6 +3762,19 @@ hs_service_set_conn_addr_port(const origin_circuit_t *circ, return -1; } +/** Does the service with identity pubkey <b>pk</b> export the circuit IDs of + * its clients? */ +bool +hs_service_exports_circuit_id(const ed25519_public_key_t *pk) +{ + hs_service_t *service = find_service(hs_service_map, pk); + if (!service) { + return 0; + } + + return service->config.export_circuit_id; +} + /* Add to file_list every filename used by a configured hidden service, and to * dir_list every directory path used by a configured hidden service. This is * used by the sandbox subsystem to whitelist those. */ diff --git a/src/feature/hs/hs_service.h b/src/feature/hs/hs_service.h index 735266071..e541cb28b 100644 --- a/src/feature/hs/hs_service.h +++ b/src/feature/hs/hs_service.h @@ -210,6 +210,9 @@ typedef struct hs_service_config_t { /* Is this service ephemeral? */ unsigned int is_ephemeral : 1; + + /* Does this service export the circuit ID of its clients? */ + bool export_circuit_id; } hs_service_config_t; /* Service state. */ @@ -316,6 +319,8 @@ void hs_service_upload_desc_to_dir(const char *encoded_desc, const ed25519_public_key_t *blinded_pk, const routerstatus_t *hsdir_rs); +bool hs_service_exports_circuit_id(const ed25519_public_key_t *pk); + #ifdef HS_SERVICE_PRIVATE #ifdef TOR_UNIT_TESTS

1 0

[tor/master] Save original virtual port in edge conn HS ident.
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit 6069185bcc61fe797582b9b9826a5d52e4aabb22 Author: George Kadianakis <desnacked(a)riseup.net> Date: Wed Sep 12 15:52:41 2018 +0300 Save original virtual port in edge conn HS ident. --- src/core/or/connection_edge.c | 8 ++++++-- src/feature/hs/hs_common.c | 5 +++++ src/feature/hs/hs_ident.h | 4 ++++ 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 9af03f7f2..891e92217 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -607,8 +607,7 @@ export_hs_client_circuit_id_haproxy(const edge_connection_t *edge_conn, const char dst_ipv6[] = "::1"; /* See RFC4193 regarding fc00::/7 */ const char src_ipv6_prefix[] = "fc00:dead:beef:4dad:"; - /* TODO: retain virtual port and use as destination port */ - uint16_t dst_port = 443; + uint16_t dst_port = 0; uint16_t src_port = 1; /* default value */ uint32_t gid = 0; /* default value */ @@ -618,6 +617,11 @@ export_hs_client_circuit_id_haproxy(const edge_connection_t *edge_conn, src_port = gid & 0x0000ffff; } + /* Grab the original dest port from the hs ident */ + if (edge_conn->hs_ident) { + dst_port = edge_conn->hs_ident->orig_virtual_port; + } + /* Build the string */ tor_asprintf(&buf, "PROXY TCP6 %s:%x %s %d %d\r\n", src_ipv6_prefix, gid, dst_ipv6, src_port, dst_port); diff --git a/src/feature/hs/hs_common.c b/src/feature/hs/hs_common.c index 12405a79c..c36892e0f 100644 --- a/src/feature/hs/hs_common.c +++ b/src/feature/hs/hs_common.c @@ -882,6 +882,11 @@ hs_set_conn_addr_port(const smartlist_t *ports, edge_connection_t *conn) smartlist_free(matching_ports); if (chosen_port) { if (!(chosen_port->is_unix_addr)) { + /* save the original destination before we overwrite it */ + if (conn->hs_ident) { + conn->hs_ident->orig_virtual_port = TO_CONN(conn)->port; + } + /* Get a non-AF_UNIX connection ready for connection_exit_connect() */ tor_addr_copy(&TO_CONN(conn)->addr, &chosen_port->real_addr); TO_CONN(conn)->port = chosen_port->real_port; diff --git a/src/feature/hs/hs_ident.h b/src/feature/hs/hs_ident.h index 92d15b052..ab87d16d1 100644 --- a/src/feature/hs/hs_ident.h +++ b/src/feature/hs/hs_ident.h @@ -111,6 +111,10 @@ typedef struct hs_ident_edge_conn_t { * in the onion address. */ ed25519_public_key_t identity_pk; + /* The original virtual port that was used by the client to access the onion + * service, regardless of the internal port forwarding that might have + * happened on the service-side. */ + uint16_t orig_virtual_port; /* XXX: Client authorization. */ } hs_ident_edge_conn_t;

1 0

[tor/master] Improve export_hs_client_circuit_id() function.
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit 5d34a8cbbb8ac4b6edd6800e10b5cb6dba1dcbcb Author: George Kadianakis <desnacked(a)riseup.net> Date: Wed Sep 12 14:43:23 2018 +0300 Improve export_hs_client_circuit_id() function. - Change default values. - Beautify. - Documentation. --- src/core/or/connection_edge.c | 31 +++++++++++++++++-------------- src/core/or/connection_edge.h | 3 +++ 2 files changed, 20 insertions(+), 14 deletions(-) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 8b333a6f4..9af03f7f2 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -597,31 +597,34 @@ connected_cell_format_payload(uint8_t *payload_out, return connected_payload_len; } -/* DOCDOCDOC */ -static void -send_ha_proxy_header(const edge_connection_t *edge_conn, - connection_t *conn) +/* This is an onion service client connection: Export the client circuit ID + * according to the HAProxy proxy protocol. */ +STATIC void +export_hs_client_circuit_id_haproxy(const edge_connection_t *edge_conn, + connection_t *conn) { - char buf[512]; - char dst_ipv6[39] = "::1"; + char *buf; + const char dst_ipv6[] = "::1"; /* See RFC4193 regarding fc00::/7 */ - char src_ipv6_prefix[34] = "fc00:dead:beef:4dad:"; + const char src_ipv6_prefix[] = "fc00:dead:beef:4dad:"; /* TODO: retain virtual port and use as destination port */ uint16_t dst_port = 443; - uint16_t src_port = 0; - uint32_t gid = 0; + uint16_t src_port = 1; /* default value */ + uint32_t gid = 0; /* default value */ + /* Generate a GID and source port for this client */ if (edge_conn->on_circuit != NULL) { gid = TO_ORIGIN_CIRCUIT(edge_conn->on_circuit)->global_identifier; src_port = gid & 0x0000ffff; } - gid = (gid == 0) ? 1 : gid; - src_port = (src_port == 0) ? 1 : src_port; + /* Build the string */ + tor_asprintf(&buf, "PROXY TCP6 %s:%x %s %d %d\r\n", + src_ipv6_prefix, gid, dst_ipv6, src_port, dst_port); - tor_snprintf(buf, sizeof(buf), "PROXY TCP6 %s:%x %s %d %d\r\n", - src_ipv6_prefix, gid, dst_ipv6, src_port, dst_port); connection_buf_add(buf, strlen(buf), conn); + + tor_free(buf); } /** Connected handler for exit connections: start writing pending @@ -649,7 +652,7 @@ connection_edge_finished_connecting(edge_connection_t *edge_conn) * protocol header */ if (edge_conn->hs_ident && hs_service_exports_circuit_id(&edge_conn->hs_ident->identity_pk)) { - send_ha_proxy_header(edge_conn, conn); + export_hs_client_circuit_id_haproxy(edge_conn, conn); } connection_watch_events(conn, READ_EVENT); /* stop writing, keep reading */ diff --git a/src/core/or/connection_edge.h b/src/core/or/connection_edge.h index 24968b277..adec4998e 100644 --- a/src/core/or/connection_edge.h +++ b/src/core/or/connection_edge.h @@ -243,6 +243,9 @@ STATIC void connection_ap_handshake_rewrite(entry_connection_t *conn, rewrite_result_t *out); STATIC int connection_ap_process_http_connect(entry_connection_t *conn); +STATIC void +export_hs_client_circuit_id_haproxy(const edge_connection_t *edge_conn, + connection_t *conn); #endif /* defined(CONNECTION_EDGE_PRIVATE) */ #endif /* !defined(TOR_CONNECTION_EDGE_H) */

1 0

[tor/master] Change HiddenServiceExportCircuitID to take a string parameter: the protocol.
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit 9b511dc5d6a9e44bd8c8c644ad9445cab7cdafe2 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Sep 15 16:33:31 2018 +0300 Change HiddenServiceExportCircuitID to take a string parameter: the protocol. This patch changes HiddenServiceExportCircuitID so instead of being a boolean it takes a string, which is the protocol. Currently only the 'haproxy' protocol is defined. See: https://bugs.torproject.org/4700 --- doc/tor.1.txt | 8 ++++---- src/core/or/connection_edge.c | 20 +++++++++++++------- src/core/or/connection_edge.h | 8 ++++++-- src/feature/hs/hs_config.c | 29 +++++++++++++++++++++++++++-- src/feature/hs/hs_service.c | 6 +++--- src/feature/hs/hs_service.h | 14 ++++++++++++-- src/test/test_hs_service.c | 19 ++++++++++++------- 7 files changed, 77 insertions(+), 27 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index abd1fdefa..d260eec10 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2835,10 +2835,10 @@ The following options are used to configure a hidden service. not an authorization mechanism; it is instead meant to be a mild inconvenience to port-scanners.) (Default: 0) -[[HiddenServiceExportCircuitID]] **HiddenServiceExportCircuitID** **0**|**1**:: - If set to 1, then the onion service will use the HAProxy proxy protocol to - assign a unique IPv6 address (in an unused IPv6 range) to each inbound - client circuit. (Default: 0) +[[HiddenServiceExportCircuitID]] **HiddenServiceExportCircuitID** __protocol__:: + The onion service will use the given protocol to expose the global circuit + identifier of each inbound client circuit via the selected protocol. The only + protocol supported right now \'haproxy\'. This option is only for v3 services. [[HiddenServiceMaxStreams]] **HiddenServiceMaxStreams** __N__:: The maximum number of simultaneous streams (connections) per rendezvous diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 62d12f498..0eff007e3 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -600,10 +600,15 @@ connected_cell_format_payload(uint8_t *payload_out, /* This is an onion service client connection: Export the client circuit ID * according to the HAProxy proxy protocol. */ STATIC void -export_hs_client_circuit_id_haproxy(const edge_connection_t *edge_conn, - connection_t *conn) +export_hs_client_circuit_id(const edge_connection_t *edge_conn, + connection_t *conn, + hs_circuit_id_protocol_t protocol) { - char *buf; + /* We only support HAProxy right now. */ + if (protocol != HS_CIRCUIT_ID_PROTOCOL_HAPROXY) + return; + + char *buf = NULL; const char dst_ipv6[] = "::1"; /* See RFC4193 regarding fc00::/7 */ const char src_ipv6_prefix[] = "fc00:dead:beef:4dad:"; @@ -655,10 +660,11 @@ connection_edge_finished_connecting(edge_connection_t *edge_conn) conn->state = EXIT_CONN_STATE_OPEN; /* If it's an onion service connection, we might want to include the proxy - * protocol header */ - if (edge_conn->hs_ident && - hs_service_exports_circuit_id(&edge_conn->hs_ident->identity_pk)) { - export_hs_client_circuit_id_haproxy(edge_conn, conn); + * protocol header: */ + if (edge_conn->hs_ident) { + hs_circuit_id_protocol_t circuit_id_protocol = + hs_service_exports_circuit_id(&edge_conn->hs_ident->identity_pk); + export_hs_client_circuit_id(edge_conn, conn, circuit_id_protocol); } connection_watch_events(conn, READ_EVENT); /* stop writing, keep reading */ diff --git a/src/core/or/connection_edge.h b/src/core/or/connection_edge.h index adec4998e..c5ad3128a 100644 --- a/src/core/or/connection_edge.h +++ b/src/core/or/connection_edge.h @@ -14,6 +14,8 @@ #include "lib/testsupport/testsupport.h" +#include "feature/hs/hs_service.h" + edge_connection_t *TO_EDGE_CONN(connection_t *); entry_connection_t *TO_ENTRY_CONN(connection_t *); entry_connection_t *EDGE_TO_ENTRY_CONN(edge_connection_t *); @@ -244,8 +246,10 @@ STATIC void connection_ap_handshake_rewrite(entry_connection_t *conn, STATIC int connection_ap_process_http_connect(entry_connection_t *conn); STATIC void -export_hs_client_circuit_id_haproxy(const edge_connection_t *edge_conn, - connection_t *conn); +export_hs_client_circuit_id(const edge_connection_t *edge_conn, + connection_t *conn, + hs_circuit_id_protocol_t protocol); + #endif /* defined(CONNECTION_EDGE_PRIVATE) */ #endif /* !defined(TOR_CONNECTION_EDGE_H) */ diff --git a/src/feature/hs/hs_config.c b/src/feature/hs/hs_config.c index 16bfe7c54..2378a4d3b 100644 --- a/src/feature/hs/hs_config.c +++ b/src/feature/hs/hs_config.c @@ -145,6 +145,31 @@ helper_parse_uint64(const char *opt, const char *value, uint64_t min, return ret; } +/** Helper function: Given a configuration option and its value, parse the + * value as a hs_circuit_id_protocol_t. On success, ok is set to 1 and ret is + * the parse value. On error, ok is set to 0 and the "none" + * hs_circuit_id_protocol_t is returned. This function logs on error. */ +static hs_circuit_id_protocol_t +helper_parse_circuit_id_protocol(const char *key, const char *value, int *ok) +{ + tor_assert(value); + tor_assert(ok); + + hs_circuit_id_protocol_t ret = HS_CIRCUIT_ID_PROTOCOL_NONE; + *ok = 0; + + if (! strcasecmp(value, "haproxy")) { + *ok = 1; + ret = HS_CIRCUIT_ID_PROTOCOL_HAPROXY; + } else { + log_warn(LD_CONFIG, "%s must be 'haproxy'.", key); + goto err; + } + + err: + return ret; +} + /* Return the service version by trying to learn it from the key on disk if * any. If nothing is found, the current service configured version is * returned. */ @@ -295,8 +320,8 @@ config_service_v3(const config_line_t *line_, continue; } if (!strcasecmp(line->key, "HiddenServiceExportCircuitID")) { - config->export_circuit_id = - (unsigned int) helper_parse_uint64(line->key, line->value, 0, 1, &ok); + config->circuit_id_protocol = + helper_parse_circuit_id_protocol(line->key, line->value, &ok); if (!ok || export_circuit_id) { if (export_circuit_id) { dup_opt_seen = line->key; diff --git a/src/feature/hs/hs_service.c b/src/feature/hs/hs_service.c index 75d7cb75e..e87cb990f 100644 --- a/src/feature/hs/hs_service.c +++ b/src/feature/hs/hs_service.c @@ -3764,15 +3764,15 @@ hs_service_set_conn_addr_port(const origin_circuit_t *circ, /** Does the service with identity pubkey <b>pk</b> export the circuit IDs of * its clients? */ -bool +hs_circuit_id_protocol_t hs_service_exports_circuit_id(const ed25519_public_key_t *pk) { hs_service_t *service = find_service(hs_service_map, pk); if (!service) { - return 0; + return HS_CIRCUIT_ID_PROTOCOL_NONE; } - return service->config.export_circuit_id; + return service->config.circuit_id_protocol; } /* Add to file_list every filename used by a configured hidden service, and to diff --git a/src/feature/hs/hs_service.h b/src/feature/hs/hs_service.h index e541cb28b..6fb15b9d3 100644 --- a/src/feature/hs/hs_service.h +++ b/src/feature/hs/hs_service.h @@ -161,6 +161,15 @@ typedef struct hs_service_authorized_client_t { curve25519_public_key_t client_pk; } hs_service_authorized_client_t; +/** Which protocol to use for exporting HS client circuit ID. */ +typedef enum { + /** Don't expose the circuit id. */ + HS_CIRCUIT_ID_PROTOCOL_NONE, + + /** Use the HAProxy proxy protocol. */ + HS_CIRCUIT_ID_PROTOCOL_HAPROXY +} hs_circuit_id_protocol_t; + /* Service configuration. The following are set from the torrc options either * set by the configuration file or by the control port. Nothing else should * change those values. */ @@ -212,7 +221,7 @@ typedef struct hs_service_config_t { unsigned int is_ephemeral : 1; /* Does this service export the circuit ID of its clients? */ - bool export_circuit_id; + hs_circuit_id_protocol_t circuit_id_protocol; } hs_service_config_t; /* Service state. */ @@ -319,7 +328,8 @@ void hs_service_upload_desc_to_dir(const char *encoded_desc, const ed25519_public_key_t *blinded_pk, const routerstatus_t *hsdir_rs); -bool hs_service_exports_circuit_id(const ed25519_public_key_t *pk); +hs_circuit_id_protocol_t +hs_service_exports_circuit_id(const ed25519_public_key_t *pk); #ifdef HS_SERVICE_PRIVATE diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c index 2b8d6e597..955bcc8af 100644 --- a/src/test/test_hs_service.c +++ b/src/test/test_hs_service.c @@ -2025,10 +2025,10 @@ test_export_client_circuit_id(void *arg) /* Create service */ hs_service_t *service = helper_create_service(); /* Check that export circuit ID detection works */ - service->config.export_circuit_id = false; + service->config.circuit_id_protocol = HS_CIRCUIT_ID_PROTOCOL_NONE; tt_int_op(0, OP_EQ, hs_service_exports_circuit_id(&service->keys.identity_pk)); - service->config.export_circuit_id = true; + service->config.circuit_id_protocol = HS_CIRCUIT_ID_PROTOCOL_HAPROXY; tt_int_op(1, OP_EQ, hs_service_exports_circuit_id(&service->keys.identity_pk)); @@ -2047,7 +2047,8 @@ test_export_client_circuit_id(void *arg) or_circ->global_identifier = 666; /* Export circuit ID */ - export_hs_client_circuit_id_haproxy(edge_conn, conn); + export_hs_client_circuit_id(edge_conn, conn, + service->config.circuit_id_protocol); /* Check contents */ cp1 = buf_get_contents(conn->outbuf, &sz); @@ -2058,7 +2059,8 @@ test_export_client_circuit_id(void *arg) or_circ->global_identifier = 22; /* check changes */ - export_hs_client_circuit_id_haproxy(edge_conn, conn); + export_hs_client_circuit_id(edge_conn, conn, + service->config.circuit_id_protocol); cp2 = buf_get_contents(conn->outbuf, &sz); tt_str_op(cp1, OP_NE, cp2); tor_free(cp1); @@ -2066,7 +2068,8 @@ test_export_client_circuit_id(void *arg) /* Check that GID with UINT32_MAX works. */ or_circ->global_identifier = UINT32_MAX; - export_hs_client_circuit_id_haproxy(edge_conn, conn); + export_hs_client_circuit_id(edge_conn, conn, + service->config.circuit_id_protocol); cp1 = buf_get_contents(conn->outbuf, &sz); tt_str_op(cp1, OP_EQ, "PROXY TCP6 fc00:dead:beef:4dad::ffff:ffff ::1 65535 42\r\n"); @@ -2075,7 +2078,8 @@ test_export_client_circuit_id(void *arg) /* Check that GID with UINT16_MAX works. */ or_circ->global_identifier = UINT16_MAX; - export_hs_client_circuit_id_haproxy(edge_conn, conn); + export_hs_client_circuit_id(edge_conn, conn, + service->config.circuit_id_protocol); cp1 = buf_get_contents(conn->outbuf, &sz); tt_str_op(cp1, OP_EQ, "PROXY TCP6 fc00:dead:beef:4dad::0:ffff ::1 65535 42\r\n"); @@ -2084,7 +2088,8 @@ test_export_client_circuit_id(void *arg) /* Check that GID with UINT16_MAX + 7 works. */ or_circ->global_identifier = UINT16_MAX + 7; - export_hs_client_circuit_id_haproxy(edge_conn, conn); + export_hs_client_circuit_id(edge_conn, conn, + service->config.circuit_id_protocol); cp1 = buf_get_contents(conn->outbuf, &sz); tt_str_op(cp1, OP_EQ, "PROXY TCP6 fc00:dead:beef:4dad::1:6 ::1 6 42\r\n");

1 0

[tor/master] Add proxy headers as early as possible.
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit 3477a73af99eb72f8374928fdc2fab4858485219 Author: Alexander Færøy <ahf(a)torproject.org> Date: Sat Sep 15 22:17:57 2018 +0200 Add proxy headers as early as possible. This patch moves the logic that adds the proxy headers to an earlier point in the exit connection lifetime, which ensures that the application data cannot be written to the outbuf before the proxy header is added. See: https://bugs.torproject.org/4700 --- src/core/or/connection_edge.c | 21 ++++++++++----------- src/core/or/connection_edge.h | 3 +-- src/test/test_hs_service.c | 15 +++++---------- 3 files changed, 16 insertions(+), 23 deletions(-) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 0eff007e3..ab2acaa39 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -600,8 +600,7 @@ connected_cell_format_payload(uint8_t *payload_out, /* This is an onion service client connection: Export the client circuit ID * according to the HAProxy proxy protocol. */ STATIC void -export_hs_client_circuit_id(const edge_connection_t *edge_conn, - connection_t *conn, +export_hs_client_circuit_id(edge_connection_t *edge_conn, hs_circuit_id_protocol_t protocol) { /* We only support HAProxy right now. */ @@ -633,7 +632,7 @@ export_hs_client_circuit_id(const edge_connection_t *edge_conn, gid >> 16, gid & 0x0000ffff, dst_ipv6, src_port, dst_port); - connection_buf_add(buf, strlen(buf), conn); + connection_buf_add(buf, strlen(buf), TO_CONN(edge_conn)); tor_free(buf); } @@ -659,14 +658,6 @@ connection_edge_finished_connecting(edge_connection_t *edge_conn) conn->state = EXIT_CONN_STATE_OPEN; - /* If it's an onion service connection, we might want to include the proxy - * protocol header: */ - if (edge_conn->hs_ident) { - hs_circuit_id_protocol_t circuit_id_protocol = - hs_service_exports_circuit_id(&edge_conn->hs_ident->identity_pk); - export_hs_client_circuit_id(edge_conn, conn, circuit_id_protocol); - } - connection_watch_events(conn, READ_EVENT); /* stop writing, keep reading */ if (connection_get_outbuf_len(conn)) /* in case there are any queued relay * cells */ @@ -3452,6 +3443,14 @@ handle_hs_exit_conn(circuit_t *circ, edge_connection_t *conn) hs_inc_rdv_stream_counter(origin_circ); + /* If it's an onion service connection, we might want to include the proxy + * protocol header: */ + if (conn->hs_ident) { + hs_circuit_id_protocol_t circuit_id_protocol = + hs_service_exports_circuit_id(&conn->hs_ident->identity_pk); + export_hs_client_circuit_id(conn, circuit_id_protocol); + } + /* Connect tor to the hidden service destination. */ connection_exit_connect(conn); diff --git a/src/core/or/connection_edge.h b/src/core/or/connection_edge.h index c5ad3128a..5b694428d 100644 --- a/src/core/or/connection_edge.h +++ b/src/core/or/connection_edge.h @@ -246,8 +246,7 @@ STATIC void connection_ap_handshake_rewrite(entry_connection_t *conn, STATIC int connection_ap_process_http_connect(entry_connection_t *conn); STATIC void -export_hs_client_circuit_id(const edge_connection_t *edge_conn, - connection_t *conn, +export_hs_client_circuit_id(edge_connection_t *edge_conn, hs_circuit_id_protocol_t protocol); #endif /* defined(CONNECTION_EDGE_PRIVATE) */ diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c index 955bcc8af..dace2b63d 100644 --- a/src/test/test_hs_service.c +++ b/src/test/test_hs_service.c @@ -2047,8 +2047,7 @@ test_export_client_circuit_id(void *arg) or_circ->global_identifier = 666; /* Export circuit ID */ - export_hs_client_circuit_id(edge_conn, conn, - service->config.circuit_id_protocol); + export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol); /* Check contents */ cp1 = buf_get_contents(conn->outbuf, &sz); @@ -2059,8 +2058,7 @@ test_export_client_circuit_id(void *arg) or_circ->global_identifier = 22; /* check changes */ - export_hs_client_circuit_id(edge_conn, conn, - service->config.circuit_id_protocol); + export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol); cp2 = buf_get_contents(conn->outbuf, &sz); tt_str_op(cp1, OP_NE, cp2); tor_free(cp1); @@ -2068,8 +2066,7 @@ test_export_client_circuit_id(void *arg) /* Check that GID with UINT32_MAX works. */ or_circ->global_identifier = UINT32_MAX; - export_hs_client_circuit_id(edge_conn, conn, - service->config.circuit_id_protocol); + export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol); cp1 = buf_get_contents(conn->outbuf, &sz); tt_str_op(cp1, OP_EQ, "PROXY TCP6 fc00:dead:beef:4dad::ffff:ffff ::1 65535 42\r\n"); @@ -2078,8 +2075,7 @@ test_export_client_circuit_id(void *arg) /* Check that GID with UINT16_MAX works. */ or_circ->global_identifier = UINT16_MAX; - export_hs_client_circuit_id(edge_conn, conn, - service->config.circuit_id_protocol); + export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol); cp1 = buf_get_contents(conn->outbuf, &sz); tt_str_op(cp1, OP_EQ, "PROXY TCP6 fc00:dead:beef:4dad::0:ffff ::1 65535 42\r\n"); @@ -2088,8 +2084,7 @@ test_export_client_circuit_id(void *arg) /* Check that GID with UINT16_MAX + 7 works. */ or_circ->global_identifier = UINT16_MAX + 7; - export_hs_client_circuit_id(edge_conn, conn, - service->config.circuit_id_protocol); + export_hs_client_circuit_id(edge_conn, service->config.circuit_id_protocol); cp1 = buf_get_contents(conn->outbuf, &sz); tt_str_op(cp1, OP_EQ, "PROXY TCP6 fc00:dead:beef:4dad::1:6 ::1 6 42\r\n");

1 0

[tor/master] Add man page entry.
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit e44e6a1857ff8ad39d3e298b512e8c8a1e513c99 Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Sep 13 17:37:05 2018 +0300 Add man page entry. --- doc/tor.1.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 869a8cedd..abd1fdefa 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2835,6 +2835,11 @@ The following options are used to configure a hidden service. not an authorization mechanism; it is instead meant to be a mild inconvenience to port-scanners.) (Default: 0) +[[HiddenServiceExportCircuitID]] **HiddenServiceExportCircuitID** **0**|**1**:: + If set to 1, then the onion service will use the HAProxy proxy protocol to + assign a unique IPv6 address (in an unused IPv6 range) to each inbound + client circuit. (Default: 0) + [[HiddenServiceMaxStreams]] **HiddenServiceMaxStreams** __N__:: The maximum number of simultaneous streams (connections) per rendezvous circuit. The maximum value allowed is 65535. (Setting this to 0 will allow

1 0

[tor/master] Encode the 32-bit Global Identifier as 2 x 16-bit in the IPv6 address.
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit 8f085841ef40f00bbc2bb146a2d555aba527738f Author: Alexander Færøy <ahf(a)torproject.org> Date: Fri Sep 14 21:37:36 2018 +0200 Encode the 32-bit Global Identifier as 2 x 16-bit in the IPv6 address. Without this patch we would encode the IPv6 address' last part as ::ffffffff instead of ::ffff:ffff when the GID is UINT32_MAX. See: https://bugs.torproject.org/4700 --- src/core/or/connection_edge.c | 6 ++++-- src/test/test_hs_service.c | 26 ++++++++++++++++++++++++++ 2 files changed, 30 insertions(+), 2 deletions(-) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 891e92217..62d12f498 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -623,8 +623,10 @@ export_hs_client_circuit_id_haproxy(const edge_connection_t *edge_conn, } /* Build the string */ - tor_asprintf(&buf, "PROXY TCP6 %s:%x %s %d %d\r\n", - src_ipv6_prefix, gid, dst_ipv6, src_port, dst_port); + tor_asprintf(&buf, "PROXY TCP6 %s:%x:%x %s %d %d\r\n", + src_ipv6_prefix, + gid >> 16, gid & 0x0000ffff, + dst_ipv6, src_port, dst_port); connection_buf_add(buf, strlen(buf), conn); diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c index 0a1c866d6..2b8d6e597 100644 --- a/src/test/test_hs_service.c +++ b/src/test/test_hs_service.c @@ -2061,6 +2061,32 @@ test_export_client_circuit_id(void *arg) export_hs_client_circuit_id_haproxy(edge_conn, conn); cp2 = buf_get_contents(conn->outbuf, &sz); tt_str_op(cp1, OP_NE, cp2); + tor_free(cp1); + + /* Check that GID with UINT32_MAX works. */ + or_circ->global_identifier = UINT32_MAX; + + export_hs_client_circuit_id_haproxy(edge_conn, conn); + cp1 = buf_get_contents(conn->outbuf, &sz); + tt_str_op(cp1, OP_EQ, + "PROXY TCP6 fc00:dead:beef:4dad::ffff:ffff ::1 65535 42\r\n"); + tor_free(cp1); + + /* Check that GID with UINT16_MAX works. */ + or_circ->global_identifier = UINT16_MAX; + + export_hs_client_circuit_id_haproxy(edge_conn, conn); + cp1 = buf_get_contents(conn->outbuf, &sz); + tt_str_op(cp1, OP_EQ, + "PROXY TCP6 fc00:dead:beef:4dad::0:ffff ::1 65535 42\r\n"); + tor_free(cp1); + + /* Check that GID with UINT16_MAX + 7 works. */ + or_circ->global_identifier = UINT16_MAX + 7; + + export_hs_client_circuit_id_haproxy(edge_conn, conn); + cp1 = buf_get_contents(conn->outbuf, &sz); + tt_str_op(cp1, OP_EQ, "PROXY TCP6 fc00:dead:beef:4dad::1:6 ::1 6 42\r\n"); done: UNMOCK(connection_write_to_buf_impl_);

1 0

[tor/master] Support 'none' in torrc for HiddenServiceExportCircuitID.
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit 8ecaf41003cc5b513cf26c4ae176d5043f5a6a93 Author: Alexander Færøy <ahf(a)torproject.org> Date: Thu Sep 20 20:59:42 2018 +0200 Support 'none' in torrc for HiddenServiceExportCircuitID. See: https://bugs.torproject.org/4700 --- doc/tor.1.txt | 3 ++- src/feature/hs/hs_config.c | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index d260eec10..df298e1d7 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2838,7 +2838,8 @@ The following options are used to configure a hidden service. [[HiddenServiceExportCircuitID]] **HiddenServiceExportCircuitID** __protocol__:: The onion service will use the given protocol to expose the global circuit identifier of each inbound client circuit via the selected protocol. The only - protocol supported right now \'haproxy\'. This option is only for v3 services. + protocol supported right now \'haproxy\'. This option is only for v3 + services. (Default: none) [[HiddenServiceMaxStreams]] **HiddenServiceMaxStreams** __N__:: The maximum number of simultaneous streams (connections) per rendezvous diff --git a/src/feature/hs/hs_config.c b/src/feature/hs/hs_config.c index 2378a4d3b..93d7403df 100644 --- a/src/feature/hs/hs_config.c +++ b/src/feature/hs/hs_config.c @@ -161,8 +161,11 @@ helper_parse_circuit_id_protocol(const char *key, const char *value, int *ok) if (! strcasecmp(value, "haproxy")) { *ok = 1; ret = HS_CIRCUIT_ID_PROTOCOL_HAPROXY; + } else if (! strcasecmp(value, "none")) { + *ok = 1; + ret = HS_CIRCUIT_ID_PROTOCOL_NONE; } else { - log_warn(LD_CONFIG, "%s must be 'haproxy'.", key); + log_warn(LD_CONFIG, "%s must be 'haproxy' or 'none'.", key); goto err; }

1 0

[tor/master] Document the haproxy option of HiddenServiceExportCircuitID.
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit 03ef4ec466fd7f1de097a7b0244ca5bc8cc32b18 Author: Alexander Færøy <ahf(a)torproject.org> Date: Thu Sep 20 21:15:25 2018 +0200 Document the haproxy option of HiddenServiceExportCircuitID. See: https://bugs.torproject.org/4700 --- doc/tor.1.txt | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index df298e1d7..124b01053 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2839,7 +2839,28 @@ The following options are used to configure a hidden service. The onion service will use the given protocol to expose the global circuit identifier of each inbound client circuit via the selected protocol. The only protocol supported right now \'haproxy\'. This option is only for v3 - services. (Default: none) + services. (Default: none) + + + + The haproxy option works in the following way: when the feature is + enabled, the Tor process will write a header line when a client is connecting + to the onion service. The header will look like this: + + + + "PROXY TCP6 fc00:dead:beef:4dad::ffff:ffff ::1 65535 42\r\n" + + + + We encode the "global circuit identifier" as the last 32-bits of the first + IPv6 address. All other values in the header can safely be ignored. You can + compute the global circuit identifier using the following formula given the + IPv6 address "fc00:dead:beef:4dad::AABB:CCDD": + + + + global_circuit_id = (0xAA << 24) + (0xBB << 16) + (0xCC << 8) + 0xDD; + + + + In the case above, where the last 32-bit is 0xffffffff, the global circuit + identifier would be 4294967295. You can use this value together with Tor's + control port where it is possible to terminate a circuit given the global + circuit identifier. For more information about this see controls-spec.txt. + + + + The HAProxy version 1 proxy protocol is described in detail at + https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt [[HiddenServiceMaxStreams]] **HiddenServiceMaxStreams** __N__:: The maximum number of simultaneous streams (connections) per rendezvous

1 0

[tor/master] Merge remote-tracking branch 'ahf-github/asn/bugs4700_2'
by nickm＠torproject.org 21 Sep '18

21 Sep '18

commit 0e4c42a912d020888e811b748925362e1b3dc67b Merge: a1b028304 03ef4ec46 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 21 09:40:16 2018 -0400 Merge remote-tracking branch 'ahf-github/asn/bugs4700_2' changes/bug4700 | 5 +++ doc/tor.1.txt | 27 ++++++++++++ src/app/config/config.c | 1 + src/core/or/connection_edge.c | 49 ++++++++++++++++++++++ src/core/or/connection_edge.h | 6 +++ src/core/or/or.h | 1 + src/feature/hs/hs_common.c | 5 +++ src/feature/hs/hs_config.c | 48 +++++++++++++++++++++- src/feature/hs/hs_ident.h | 4 ++ src/feature/hs/hs_service.c | 13 ++++++ src/feature/hs/hs_service.h | 15 +++++++ src/test/test_extorport.c | 17 +------- src/test/test_helpers.c | 19 +++++++++ src/test/test_helpers.h | 3 ++ src/test/test_hs_service.c | 96 +++++++++++++++++++++++++++++++++++++++++++ 15 files changed, 292 insertions(+), 17 deletions(-)

1 0