1 /* Copyright (c) 2017, The Tor Project, Inc. */
2 /* See LICENSE for licensing information */
8 #define HS_CIRCUIT_PRIVATE
11 #include "circpathbias.h"
12 #include "circuitbuild.h"
13 #include "circuitlist.h"
14 #include "circuituse.h"
18 #include "rendservice.h"
25 #include "hs_service.h"
26 #include "hs_circuit.h"
29 #include "ed25519_cert.h"
30 #include "hs/cell_common.h"
31 #include "hs/cell_establish_intro.h"
33 /* A circuit is about to become an e2e rendezvous circuit. Check
34 * <b>circ_purpose</b> and ensure that it's properly set. Return true iff
35 * circuit purpose is properly set, otherwise return false. */
37 circuit_purpose_is_correct_for_rend(unsigned int circ_purpose
,
40 if (is_service_side
) {
41 if (circ_purpose
!= CIRCUIT_PURPOSE_S_CONNECT_REND
) {
43 "HS e2e circuit setup with wrong purpose (%d)", circ_purpose
);
48 if (!is_service_side
) {
49 if (circ_purpose
!= CIRCUIT_PURPOSE_C_REND_READY
&&
50 circ_purpose
!= CIRCUIT_PURPOSE_C_REND_READY_INTRO_ACKED
) {
52 "Client e2e circuit setup with wrong purpose (%d)", circ_purpose
);
60 /* Create and return a crypt path for the final hop of a v3 prop224 rendezvous
61 * circuit. Initialize the crypt path crypto using the output material from the
62 * ntor key exchange at <b>ntor_key_seed</b>.
64 * If <b>is_service_side</b> is set, we are the hidden service and the final
65 * hop of the rendezvous circuit is the client on the other side. */
67 create_rend_cpath(const uint8_t *ntor_key_seed
, size_t seed_len
,
70 uint8_t keys
[HS_NTOR_KEY_EXPANSION_KDF_OUT_LEN
];
71 crypt_path_t
*cpath
= NULL
;
73 /* Do the key expansion */
74 if (hs_ntor_circuit_key_expansion(ntor_key_seed
, seed_len
,
75 keys
, sizeof(keys
)) < 0) {
80 cpath
= tor_malloc_zero(sizeof(crypt_path_t
));
81 cpath
->magic
= CRYPT_PATH_MAGIC
;
83 if (circuit_init_cpath_crypto(cpath
, (char*)keys
, sizeof(keys
),
84 is_service_side
, 1) < 0) {
90 memwipe(keys
, 0, sizeof(keys
));
94 /* We are a v2 legacy HS client: Create and return a crypt path for the hidden
95 * service on the other side of the rendezvous circuit <b>circ</b>. Initialize
96 * the crypt path crypto using the body of the RENDEZVOUS1 cell at
97 * <b>rend_cell_body</b> (which must be at least DH_KEY_LEN+DIGEST_LEN bytes).
100 create_rend_cpath_legacy(origin_circuit_t
*circ
, const uint8_t *rend_cell_body
)
102 crypt_path_t
*hop
= NULL
;
103 char keys
[DIGEST_LEN
+CPATH_KEY_MATERIAL_LEN
];
105 /* first DH_KEY_LEN bytes are g^y from the service. Finish the dh
107 tor_assert(circ
->build_state
);
108 tor_assert(circ
->build_state
->pending_final_cpath
);
109 hop
= circ
->build_state
->pending_final_cpath
;
111 tor_assert(hop
->rend_dh_handshake_state
);
112 if (crypto_dh_compute_secret(LOG_PROTOCOL_WARN
, hop
->rend_dh_handshake_state
,
113 (char*)rend_cell_body
, DH_KEY_LEN
,
114 keys
, DIGEST_LEN
+CPATH_KEY_MATERIAL_LEN
)<0) {
115 log_warn(LD_GENERAL
, "Couldn't complete DH handshake.");
118 /* ... and set up cpath. */
119 if (circuit_init_cpath_crypto(hop
,
120 keys
+DIGEST_LEN
, sizeof(keys
)-DIGEST_LEN
,
124 /* Check whether the digest is right... */
125 if (tor_memneq(keys
, rend_cell_body
+DH_KEY_LEN
, DIGEST_LEN
)) {
126 log_warn(LD_PROTOCOL
, "Incorrect digest of key material.");
130 /* clean up the crypto stuff we just made */
131 crypto_dh_free(hop
->rend_dh_handshake_state
);
132 hop
->rend_dh_handshake_state
= NULL
;
140 memwipe(keys
, 0, sizeof(keys
));
144 /* Append the final <b>hop</b> to the cpath of the rend <b>circ</b>, and mark
145 * <b>circ</b> ready for use to transfer HS relay cells. */
147 finalize_rend_circuit(origin_circuit_t
*circ
, crypt_path_t
*hop
,
153 /* Notify the circuit state machine that we are splicing this circuit */
154 int new_circ_purpose
= is_service_side
?
155 CIRCUIT_PURPOSE_S_REND_JOINED
: CIRCUIT_PURPOSE_C_REND_JOINED
;
156 circuit_change_purpose(TO_CIRCUIT(circ
), new_circ_purpose
);
158 /* All is well. Extend the circuit. */
159 hop
->state
= CPATH_STATE_OPEN
;
160 /* Set the windows to default. */
161 hop
->package_window
= circuit_initial_package_window();
162 hop
->deliver_window
= CIRCWINDOW_START
;
164 /* Now that this circuit has finished connecting to its destination,
165 * make sure circuit_get_open_circ_or_launch is willing to return it
166 * so we can actually use it. */
167 circ
->hs_circ_has_timed_out
= 0;
169 /* Append the hop to the cpath of this circuit */
170 onion_append_to_cpath(&circ
->cpath
, hop
);
172 /* In legacy code, 'pending_final_cpath' points to the final hop we just
173 * appended to the cpath. We set the original pointer to NULL so that we
174 * don't double free it. */
175 if (circ
->build_state
) {
176 circ
->build_state
->pending_final_cpath
= NULL
;
179 /* Finally, mark circuit as ready to be used for client streams */
180 if (!is_service_side
) {
181 circuit_try_attaching_streams(circ
);
185 /* For a given circuit and a service introduction point object, register the
186 * intro circuit to the circuitmap. This supports legacy intro point. */
188 register_intro_circ(const hs_service_intro_point_t
*ip
,
189 origin_circuit_t
*circ
)
194 if (ip
->base
.is_only_legacy
) {
195 uint8_t digest
[DIGEST_LEN
];
196 if (BUG(crypto_pk_get_digest(ip
->legacy_key
, (char *) digest
) < 0)) {
199 hs_circuitmap_register_intro_circ_v2_service_side(circ
, digest
);
201 hs_circuitmap_register_intro_circ_v3_service_side(circ
,
202 &ip
->auth_key_kp
.pubkey
);
206 /* Return the number of opened introduction circuit for the given circuit that
207 * is matching its identity key. */
209 count_opened_desc_intro_point_circuits(const hs_service_t
*service
,
210 const hs_service_descriptor_t
*desc
)
212 unsigned int count
= 0;
217 DIGEST256MAP_FOREACH(desc
->intro_points
.map
, key
,
218 const hs_service_intro_point_t
*, ip
) {
219 const circuit_t
*circ
;
220 const origin_circuit_t
*ocirc
= hs_circ_service_get_intro_circ(ip
);
224 circ
= TO_CIRCUIT(ocirc
);
225 tor_assert(circ
->purpose
== CIRCUIT_PURPOSE_S_ESTABLISH_INTRO
||
226 circ
->purpose
== CIRCUIT_PURPOSE_S_INTRO
);
227 /* Having a circuit not for the requested service is really bad. */
228 tor_assert(ed25519_pubkey_eq(&service
->keys
.identity_pk
,
229 ô
->hs_ident
->identity_pk
));
230 /* Only count opened circuit and skip circuit that will be closed. */
231 if (!circ
->marked_for_close
&& circ
->state
== CIRCUIT_STATE_OPEN
) {
234 } DIGEST256MAP_FOREACH_END
;
238 /* From a given service, rendezvous cookie and handshake info, create a
239 * rendezvous point circuit identifier. This can't fail. */
240 STATIC hs_ident_circuit_t
*
241 create_rp_circuit_identifier(const hs_service_t
*service
,
242 const uint8_t *rendezvous_cookie
,
243 const curve25519_public_key_t
*server_pk
,
244 const hs_ntor_rend_cell_keys_t
*keys
)
246 hs_ident_circuit_t
*ident
;
247 uint8_t handshake_info
[CURVE25519_PUBKEY_LEN
+ DIGEST256_LEN
];
250 tor_assert(rendezvous_cookie
);
251 tor_assert(server_pk
);
254 ident
= hs_ident_circuit_new(&service
->keys
.identity_pk
,
255 HS_IDENT_CIRCUIT_RENDEZVOUS
);
256 /* Copy the RENDEZVOUS_COOKIE which is the unique identifier. */
257 memcpy(ident
->rendezvous_cookie
, rendezvous_cookie
,
258 sizeof(ident
->rendezvous_cookie
));
259 /* Build the HANDSHAKE_INFO which looks like this:
260 * SERVER_PK [32 bytes]
261 * AUTH_INPUT_MAC [32 bytes]
263 memcpy(handshake_info
, server_pk
->public_key
, CURVE25519_PUBKEY_LEN
);
264 memcpy(handshake_info
+ CURVE25519_PUBKEY_LEN
, keys
->rend_cell_auth_mac
,
266 tor_assert(sizeof(ident
->rendezvous_handshake_info
) ==
267 sizeof(handshake_info
));
268 memcpy(ident
->rendezvous_handshake_info
, handshake_info
,
269 sizeof(ident
->rendezvous_handshake_info
));
270 /* Finally copy the NTOR_KEY_SEED for e2e encryption on the circuit. */
271 tor_assert(sizeof(ident
->rendezvous_ntor_key_seed
) ==
272 sizeof(keys
->ntor_key_seed
));
273 memcpy(ident
->rendezvous_ntor_key_seed
, keys
->ntor_key_seed
,
274 sizeof(ident
->rendezvous_ntor_key_seed
));
278 /* From a given service and service intro point, create an introduction point
279 * circuit identifier. This can't fail. */
280 static hs_ident_circuit_t
*
281 create_intro_circuit_identifier(const hs_service_t
*service
,
282 const hs_service_intro_point_t
*ip
)
284 hs_ident_circuit_t
*ident
;
289 ident
= hs_ident_circuit_new(&service
->keys
.identity_pk
,
290 HS_IDENT_CIRCUIT_INTRO
);
291 ed25519_pubkey_copy(&ident
->intro_auth_pk
, &ip
->auth_key_kp
.pubkey
);
296 /* For a given introduction point and an introduction circuit, send the
297 * ESTABLISH_INTRO cell. The service object is used for logging. This can fail
298 * and if so, the circuit is closed and the intro point object is flagged
299 * that the circuit is not established anymore which is important for the
300 * retry mechanism. */
302 send_establish_intro(const hs_service_t
*service
,
303 hs_service_intro_point_t
*ip
, origin_circuit_t
*circ
)
306 uint8_t payload
[RELAY_PAYLOAD_SIZE
];
312 /* Encode establish intro cell. */
313 cell_len
= hs_cell_build_establish_intro(circ
->cpath
->prev
->rend_circ_nonce
,
316 log_warn(LD_REND
, "Unable to encode ESTABLISH_INTRO cell for service %s "
317 "on circuit %u. Closing circuit.",
318 safe_str_client(service
->onion_address
),
319 TO_CIRCUIT(circ
)->n_circ_id
);
323 /* Send the cell on the circuit. */
324 if (relay_send_command_from_edge(CONTROL_CELL_ID
, TO_CIRCUIT(circ
),
325 RELAY_COMMAND_ESTABLISH_INTRO
,
326 (char *) payload
, cell_len
,
327 circ
->cpath
->prev
) < 0) {
328 log_info(LD_REND
, "Unable to send ESTABLISH_INTRO cell for service %s "
330 safe_str_client(service
->onion_address
),
331 TO_CIRCUIT(circ
)->n_circ_id
);
332 /* On error, the circuit has been closed. */
336 /* Record the attempt to use this circuit. */
337 pathbias_count_use_attempt(circ
);
341 circuit_mark_for_close(TO_CIRCUIT(circ
), END_CIRC_REASON_INTERNAL
);
343 memwipe(payload
, 0, sizeof(payload
));
346 /* Return a string constant describing the anonymity of service. */
348 get_service_anonymity_string(const hs_service_t
*service
)
350 if (service
->config
.is_single_onion
) {
351 return "single onion";
357 /* For a given service, the ntor onion key and a rendezvous cookie, launch a
358 * circuit to the rendezvous point specified by the link specifiers. On
359 * success, a circuit identifier is attached to the circuit with the needed
360 * data. This function will try to open a circuit for a maximum value of
361 * MAX_REND_FAILURES then it will give up. */
363 launch_rendezvous_point_circuit(const hs_service_t
*service
,
364 const hs_service_intro_point_t
*ip
,
365 const hs_cell_introduce2_data_t
*data
)
367 int circ_needs_uptime
;
368 time_t now
= time(NULL
);
369 extend_info_t
*info
= NULL
;
370 origin_circuit_t
*circ
;
376 circ_needs_uptime
= hs_service_requires_uptime_circ(service
->config
.ports
);
378 /* Get the extend info data structure for the chosen rendezvous point
379 * specified by the given link specifiers. */
380 info
= hs_get_extend_info_from_lspecs(data
->link_specifiers
,
382 service
->config
.is_single_onion
);
384 /* We are done here, we can't extend to the rendezvous point.
385 * If you're running an IPv6-only v3 single onion service on 0.3.2 or with
386 * 0.3.2 clients, and somehow disable the option check, it will fail here.
388 log_fn(LOG_PROTOCOL_WARN
, LD_REND
,
389 "Not enough info to open a circuit to a rendezvous point for "
391 get_service_anonymity_string(service
),
392 safe_str_client(service
->onion_address
));
396 for (int i
= 0; i
< MAX_REND_FAILURES
; i
++) {
397 int circ_flags
= CIRCLAUNCH_NEED_CAPACITY
| CIRCLAUNCH_IS_INTERNAL
;
398 if (circ_needs_uptime
) {
399 circ_flags
|= CIRCLAUNCH_NEED_UPTIME
;
401 /* Firewall and policies are checked when getting the extend info. */
402 if (service
->config
.is_single_onion
) {
403 circ_flags
|= CIRCLAUNCH_ONEHOP_TUNNEL
;
406 circ
= circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_CONNECT_REND
, info
,
409 /* Stop retrying, we have a circuit! */
414 log_warn(LD_REND
, "Giving up on launching a rendezvous circuit to %s "
416 safe_str_client(extend_info_describe(info
)),
417 get_service_anonymity_string(service
),
418 safe_str_client(service
->onion_address
));
421 log_info(LD_REND
, "Rendezvous circuit launched to %s with cookie %s "
423 safe_str_client(extend_info_describe(info
)),
424 safe_str_client(hex_str((const char *) data
->rendezvous_cookie
,
426 get_service_anonymity_string(service
),
427 safe_str_client(service
->onion_address
));
428 tor_assert(circ
->build_state
);
429 /* Rendezvous circuit have a specific timeout for the time spent on trying
430 * to connect to the rendezvous point. */
431 circ
->build_state
->expiry_time
= now
+ MAX_REND_TIMEOUT
;
433 /* Create circuit identifier and key material. */
435 hs_ntor_rend_cell_keys_t keys
;
436 curve25519_keypair_t ephemeral_kp
;
437 /* No need for extra strong, this is only for this circuit life time. This
438 * key will be used for the RENDEZVOUS1 cell that will be sent on the
439 * circuit once opened. */
440 curve25519_keypair_generate(&ephemeral_kp
, 0);
441 if (hs_ntor_service_get_rendezvous1_keys(&ip
->auth_key_kp
.pubkey
,
443 &ephemeral_kp
, &data
->client_pk
,
445 /* This should not really happened but just in case, don't make tor
446 * freak out, close the circuit and move on. */
447 log_info(LD_REND
, "Unable to get RENDEZVOUS1 key material for "
449 safe_str_client(service
->onion_address
));
450 circuit_mark_for_close(TO_CIRCUIT(circ
), END_CIRC_REASON_INTERNAL
);
453 circ
->hs_ident
= create_rp_circuit_identifier(service
,
454 data
->rendezvous_cookie
,
455 &ephemeral_kp
.pubkey
, &keys
);
456 memwipe(&ephemeral_kp
, 0, sizeof(ephemeral_kp
));
457 memwipe(&keys
, 0, sizeof(keys
));
458 tor_assert(circ
->hs_ident
);
462 extend_info_free(info
);
465 /* Return true iff the given service rendezvous circuit circ is allowed for a
466 * relaunch to the rendezvous point. */
468 can_relaunch_service_rendezvous_point(const origin_circuit_t
*circ
)
471 /* This is initialized when allocating an origin circuit. */
472 tor_assert(circ
->build_state
);
473 tor_assert(TO_CIRCUIT(circ
)->purpose
== CIRCUIT_PURPOSE_S_CONNECT_REND
);
475 /* XXX: Retrying under certain condition. This is related to #22455. */
477 /* Avoid to relaunch twice a circuit to the same rendezvous point at the
479 if (circ
->hs_service_side_rend_circ_has_been_relaunched
) {
480 log_info(LD_REND
, "Rendezvous circuit to %s has already been retried. "
483 extend_info_describe(circ
->build_state
->chosen_exit
)));
487 /* A failure count that has reached maximum allowed or circuit that expired,
488 * we skip relaunching. */
489 if (circ
->build_state
->failure_count
> MAX_REND_FAILURES
||
490 circ
->build_state
->expiry_time
<= time(NULL
)) {
491 log_info(LD_REND
, "Attempt to build a rendezvous circuit to %s has "
492 "failed with %d attempts and expiry time %ld. "
493 "Giving up building.",
495 extend_info_describe(circ
->build_state
->chosen_exit
)),
496 circ
->build_state
->failure_count
,
497 (long int) circ
->build_state
->expiry_time
);
501 /* Allowed to relaunch. */
507 /* Retry the rendezvous point of circ by launching a new circuit to it. */
509 retry_service_rendezvous_point(const origin_circuit_t
*circ
)
512 origin_circuit_t
*new_circ
;
513 cpath_build_state_t
*bstate
;
516 /* This is initialized when allocating an origin circuit. */
517 tor_assert(circ
->build_state
);
518 tor_assert(TO_CIRCUIT(circ
)->purpose
== CIRCUIT_PURPOSE_S_CONNECT_REND
);
521 bstate
= circ
->build_state
;
523 log_info(LD_REND
, "Retrying rendezvous point circuit to %s",
524 safe_str_client(extend_info_describe(bstate
->chosen_exit
)));
526 /* Get the current build state flags for the next circuit. */
527 flags
|= (bstate
->need_uptime
) ? CIRCLAUNCH_NEED_UPTIME
: 0;
528 flags
|= (bstate
->need_capacity
) ? CIRCLAUNCH_NEED_CAPACITY
: 0;
529 flags
|= (bstate
->is_internal
) ? CIRCLAUNCH_IS_INTERNAL
: 0;
531 /* We do NOT add the onehop tunnel flag even though it might be a single
532 * onion service. The reason is that if we failed once to connect to the RP
533 * with a direct connection, we consider that chances are that we will fail
534 * again so try a 3-hop circuit and hope for the best. Because the service
535 * has no anonymity (single onion), this change of behavior won't affect
536 * security directly. */
538 new_circ
= circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_CONNECT_REND
,
539 bstate
->chosen_exit
, flags
);
540 if (new_circ
== NULL
) {
541 log_warn(LD_REND
, "Failed to launch rendezvous circuit to %s",
542 safe_str_client(extend_info_describe(bstate
->chosen_exit
)));
546 /* Transfer build state information to the new circuit state in part to
547 * catch any other failures. */
548 new_circ
->build_state
->failure_count
= bstate
->failure_count
++;
549 new_circ
->build_state
->expiry_time
= bstate
->expiry_time
;
550 new_circ
->hs_ident
= hs_ident_circuit_dup(circ
->hs_ident
);
556 /* Using an extend info object ei, set all possible link specifiers in lspecs.
557 * legacy ID is mandatory thus MUST be present in ei. If IPv4 is not present,
558 * logs a BUG() warning, and returns an empty smartlist. Clients never make
559 * direct connections to rendezvous points, so they should always have an
560 * IPv4 address in ei. */
562 get_lspecs_from_extend_info(const extend_info_t
*ei
, smartlist_t
*lspecs
)
564 link_specifier_t
*ls
;
569 /* We require IPv4, we will add IPv6 support in a later tor version */
570 if (BUG(!tor_addr_is_v4(&ei
->addr
))) {
574 ls
= link_specifier_new();
575 link_specifier_set_ls_type(ls
, LS_IPV4
);
576 link_specifier_set_un_ipv4_addr(ls
, tor_addr_to_ipv4h(&ei
->addr
));
577 link_specifier_set_un_ipv4_port(ls
, ei
->port
);
578 /* Four bytes IPv4 and two bytes port. */
579 link_specifier_set_ls_len(ls
, sizeof(ei
->addr
.addr
.in_addr
) +
581 smartlist_add(lspecs
, ls
);
583 /* Legacy ID is mandatory. */
584 ls
= link_specifier_new();
585 link_specifier_set_ls_type(ls
, LS_LEGACY_ID
);
586 memcpy(link_specifier_getarray_un_legacy_id(ls
), ei
->identity_digest
,
587 link_specifier_getlen_un_legacy_id(ls
));
588 link_specifier_set_ls_len(ls
, link_specifier_getlen_un_legacy_id(ls
));
589 smartlist_add(lspecs
, ls
);
591 /* ed25519 ID is only included if the extend_info has it. */
592 if (!ed25519_public_key_is_zero(&ei
->ed_identity
)) {
593 ls
= link_specifier_new();
594 link_specifier_set_ls_type(ls
, LS_ED25519_ID
);
595 memcpy(link_specifier_getarray_un_ed25519_id(ls
), &ei
->ed_identity
,
596 link_specifier_getlen_un_ed25519_id(ls
));
597 link_specifier_set_ls_len(ls
, link_specifier_getlen_un_ed25519_id(ls
));
598 smartlist_add(lspecs
, ls
);
602 /* Using the given descriptor intro point ip, the extend information of the
603 * rendezvous point rp_ei and the service's subcredential, populate the
604 * already allocated intro1_data object with the needed key material and link
607 * This can't fail but the ip MUST be a valid object containing the needed
608 * keys and authentication method. */
610 setup_introduce1_data(const hs_desc_intro_point_t
*ip
,
611 const extend_info_t
*rp_ei
,
612 const uint8_t *subcredential
,
613 hs_cell_introduce1_data_t
*intro1_data
)
615 smartlist_t
*rp_lspecs
;
619 tor_assert(subcredential
);
620 tor_assert(intro1_data
);
622 /* Build the link specifiers from the extend information of the rendezvous
623 * circuit that we've picked previously. */
624 rp_lspecs
= smartlist_new();
625 get_lspecs_from_extend_info(rp_ei
, rp_lspecs
);
627 /* Populate the introduce1 data object. */
628 memset(intro1_data
, 0, sizeof(hs_cell_introduce1_data_t
));
629 if (ip
->legacy
.key
!= NULL
) {
630 intro1_data
->is_legacy
= 1;
631 intro1_data
->legacy_key
= ip
->legacy
.key
;
633 intro1_data
->auth_pk
= &ip
->auth_key_cert
->signed_key
;
634 intro1_data
->enc_pk
= &ip
->enc_key
;
635 intro1_data
->subcredential
= subcredential
;
636 intro1_data
->onion_pk
= &rp_ei
->curve25519_onion_key
;
637 intro1_data
->link_specifiers
= rp_lspecs
;
644 /* Return an introduction point circuit matching the given intro point object.
645 * NULL is returned is no such circuit can be found. */
647 hs_circ_service_get_intro_circ(const hs_service_intro_point_t
*ip
)
649 origin_circuit_t
*circ
= NULL
;
653 if (ip
->base
.is_only_legacy
) {
654 uint8_t digest
[DIGEST_LEN
];
655 if (BUG(crypto_pk_get_digest(ip
->legacy_key
, (char *) digest
) < 0)) {
658 circ
= hs_circuitmap_get_intro_circ_v2_service_side(digest
);
660 circ
= hs_circuitmap_get_intro_circ_v3_service_side(
661 &ip
->auth_key_kp
.pubkey
);
667 /* Called when we fail building a rendezvous circuit at some point other than
668 * the last hop: launches a new circuit to the same rendezvous point. This
669 * supports legacy service.
671 * We currently relaunch connections to rendezvous points if:
672 * - A rendezvous circuit timed out before connecting to RP.
673 * - The redenzvous circuit failed to connect to the RP.
675 * We avoid relaunching a connection to this rendezvous point if:
676 * - We have already tried MAX_REND_FAILURES times to connect to this RP.
677 * - We've been trying to connect to this RP for more than MAX_REND_TIMEOUT
679 * - We've already retried this specific rendezvous circuit.
682 hs_circ_retry_service_rendezvous_point(origin_circuit_t
*circ
)
685 tor_assert(TO_CIRCUIT(circ
)->purpose
== CIRCUIT_PURPOSE_S_CONNECT_REND
);
687 /* Check if we are allowed to relaunch to the rendezvous point of circ. */
688 if (!can_relaunch_service_rendezvous_point(circ
)) {
692 /* Flag the circuit that we are relaunching so to avoid to relaunch twice a
693 * circuit to the same rendezvous point at the same time. */
694 circ
->hs_service_side_rend_circ_has_been_relaunched
= 1;
696 /* Legacy service don't have an hidden service ident. */
697 if (circ
->hs_ident
) {
698 retry_service_rendezvous_point(circ
);
700 rend_service_relaunch_rendezvous(circ
);
707 /* For a given service and a service intro point, launch a circuit to the
708 * extend info ei. If the service is a single onion, a one-hop circuit will be
709 * requested. Return 0 if the circuit was successfully launched and tagged
710 * with the correct identifier. On error, a negative value is returned. */
712 hs_circ_launch_intro_point(hs_service_t
*service
,
713 const hs_service_intro_point_t
*ip
,
716 /* Standard flags for introduction circuit. */
717 int ret
= -1, circ_flags
= CIRCLAUNCH_NEED_UPTIME
| CIRCLAUNCH_IS_INTERNAL
;
718 origin_circuit_t
*circ
;
724 /* Update circuit flags in case of a single onion service that requires a
725 * direct connection. */
726 if (service
->config
.is_single_onion
) {
727 circ_flags
|= CIRCLAUNCH_ONEHOP_TUNNEL
;
730 log_info(LD_REND
, "Launching a circuit to intro point %s for service %s.",
731 safe_str_client(extend_info_describe(ei
)),
732 safe_str_client(service
->onion_address
));
734 /* Note down the launch for the retry period. Even if the circuit fails to
735 * be launched, we still want to respect the retry period to avoid stress on
736 * the circuit subsystem. */
737 service
->state
.num_intro_circ_launched
++;
738 circ
= circuit_launch_by_extend_info(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO
,
744 /* Setup the circuit identifier and attach it to it. */
745 circ
->hs_ident
= create_intro_circuit_identifier(service
, ip
);
746 tor_assert(circ
->hs_ident
);
747 /* Register circuit in the global circuitmap. */
748 register_intro_circ(ip
, circ
);
756 /* Called when a service introduction point circuit is done building. Given
757 * the service and intro point object, this function will send the
758 * ESTABLISH_INTRO cell on the circuit. Return 0 on success. Return 1 if the
759 * circuit has been repurposed to General because we already have too many
762 hs_circ_service_intro_has_opened(hs_service_t
*service
,
763 hs_service_intro_point_t
*ip
,
764 const hs_service_descriptor_t
*desc
,
765 origin_circuit_t
*circ
)
768 unsigned int num_intro_circ
, num_needed_circ
;
775 /* Cound opened circuits that have sent ESTABLISH_INTRO cells or are already
776 * established introduction circuits */
777 num_intro_circ
= count_opened_desc_intro_point_circuits(service
, desc
);
778 num_needed_circ
= service
->config
.num_intro_points
;
779 if (num_intro_circ
> num_needed_circ
) {
780 /* There are too many opened valid intro circuit for what the service
781 * needs so repurpose this one. */
783 /* XXX: Legacy code checks options->ExcludeNodes and if not NULL it just
784 * closes the circuit. I have NO idea why it does that so it hasn't been
785 * added here. I can only assume in case our ExcludeNodes list changes but
786 * in that case, all circuit are flagged unusable (config.c). --dgoulet */
788 log_info(LD_CIRC
| LD_REND
, "Introduction circuit just opened but we "
789 "have enough for service %s. Repurposing "
790 "it to general and leaving internal.",
791 safe_str_client(service
->onion_address
));
792 tor_assert(circ
->build_state
->is_internal
);
793 /* Remove it from the circuitmap. */
794 hs_circuitmap_remove_circuit(TO_CIRCUIT(circ
));
795 /* Cleaning up the hidden service identifier and repurpose. */
796 hs_ident_circuit_free(circ
->hs_ident
);
797 circ
->hs_ident
= NULL
;
798 circuit_change_purpose(TO_CIRCUIT(circ
), CIRCUIT_PURPOSE_C_GENERAL
);
799 /* Inform that this circuit just opened for this new purpose. */
800 circuit_has_opened(circ
);
801 /* This return value indicate to the caller that the IP object should be
802 * removed from the service because it's corresponding circuit has just
803 * been repurposed. */
808 log_info(LD_REND
, "Introduction circuit %u established for service %s.",
809 TO_CIRCUIT(circ
)->n_circ_id
,
810 safe_str_client(service
->onion_address
));
811 circuit_log_path(LOG_INFO
, LD_REND
, circ
);
813 /* Time to send an ESTABLISH_INTRO cell on this circuit. On error, this call
814 * makes sure the circuit gets closed. */
815 send_establish_intro(service
, ip
, circ
);
821 /* Called when a service rendezvous point circuit is done building. Given the
822 * service and the circuit, this function will send a RENDEZVOUS1 cell on the
823 * circuit using the information in the circuit identifier. If the cell can't
824 * be sent, the circuit is closed. */
826 hs_circ_service_rp_has_opened(const hs_service_t
*service
,
827 origin_circuit_t
*circ
)
830 uint8_t payload
[RELAY_PAYLOAD_SIZE
] = {0};
834 tor_assert(circ
->hs_ident
);
836 /* Some useful logging. */
837 log_info(LD_REND
, "Rendezvous circuit %u has opened with cookie %s "
839 TO_CIRCUIT(circ
)->n_circ_id
,
840 hex_str((const char *) circ
->hs_ident
->rendezvous_cookie
,
842 safe_str_client(service
->onion_address
));
843 circuit_log_path(LOG_INFO
, LD_REND
, circ
);
845 /* This can't fail. */
846 payload_len
= hs_cell_build_rendezvous1(
847 circ
->hs_ident
->rendezvous_cookie
,
848 sizeof(circ
->hs_ident
->rendezvous_cookie
),
849 circ
->hs_ident
->rendezvous_handshake_info
,
850 sizeof(circ
->hs_ident
->rendezvous_handshake_info
),
853 /* Pad the payload with random bytes so it matches the size of a legacy cell
854 * which is normally always bigger. Also, the size of a legacy cell is
855 * always smaller than the RELAY_PAYLOAD_SIZE so this is safe. */
856 if (payload_len
< HS_LEGACY_RENDEZVOUS_CELL_SIZE
) {
857 crypto_rand((char *) payload
+ payload_len
,
858 HS_LEGACY_RENDEZVOUS_CELL_SIZE
- payload_len
);
859 payload_len
= HS_LEGACY_RENDEZVOUS_CELL_SIZE
;
862 if (relay_send_command_from_edge(CONTROL_CELL_ID
, TO_CIRCUIT(circ
),
863 RELAY_COMMAND_RENDEZVOUS1
,
864 (const char *) payload
, payload_len
,
865 circ
->cpath
->prev
) < 0) {
866 /* On error, circuit is closed. */
867 log_warn(LD_REND
, "Unable to send RENDEZVOUS1 cell on circuit %u "
869 TO_CIRCUIT(circ
)->n_circ_id
,
870 safe_str_client(service
->onion_address
));
874 /* Setup end-to-end rendezvous circuit between the client and us. */
875 if (hs_circuit_setup_e2e_rend_circ(circ
,
876 circ
->hs_ident
->rendezvous_ntor_key_seed
,
877 sizeof(circ
->hs_ident
->rendezvous_ntor_key_seed
),
879 log_warn(LD_GENERAL
, "Failed to setup circ");
884 memwipe(payload
, 0, sizeof(payload
));
887 /* Circ has been expecting an INTRO_ESTABLISHED cell that just arrived. Handle
888 * the INTRO_ESTABLISHED cell payload of length payload_len arriving on the
889 * given introduction circuit circ. The service is only used for logging
890 * purposes. Return 0 on success else a negative value. */
892 hs_circ_handle_intro_established(const hs_service_t
*service
,
893 const hs_service_intro_point_t
*ip
,
894 origin_circuit_t
*circ
,
895 const uint8_t *payload
, size_t payload_len
)
904 if (BUG(TO_CIRCUIT(circ
)->purpose
!= CIRCUIT_PURPOSE_S_ESTABLISH_INTRO
)) {
908 /* Try to parse the payload into a cell making sure we do actually have a
909 * valid cell. For a legacy node, it's an empty payload so as long as we
910 * have the cell, we are good. */
911 if (!ip
->base
.is_only_legacy
&&
912 hs_cell_parse_intro_established(payload
, payload_len
) < 0) {
913 log_warn(LD_REND
, "Unable to parse the INTRO_ESTABLISHED cell on "
914 "circuit %u for service %s",
915 TO_CIRCUIT(circ
)->n_circ_id
,
916 safe_str_client(service
->onion_address
));
920 /* Switch the purpose to a fully working intro point. */
921 circuit_change_purpose(TO_CIRCUIT(circ
), CIRCUIT_PURPOSE_S_INTRO
);
922 /* Getting a valid INTRODUCE_ESTABLISHED means we've successfully used the
923 * circuit so update our pathbias subsystem. */
924 pathbias_mark_use_success(circ
);
932 /* We just received an INTRODUCE2 cell on the established introduction circuit
933 * circ. Handle the INTRODUCE2 payload of size payload_len for the given
934 * circuit and service. This cell is associated with the intro point object ip
935 * and the subcredential. Return 0 on success else a negative value. */
937 hs_circ_handle_introduce2(const hs_service_t
*service
,
938 const origin_circuit_t
*circ
,
939 hs_service_intro_point_t
*ip
,
940 const uint8_t *subcredential
,
941 const uint8_t *payload
, size_t payload_len
)
945 hs_cell_introduce2_data_t data
;
950 tor_assert(subcredential
);
953 /* Populate the data structure with everything we need for the cell to be
954 * parsed, decrypted and key material computed correctly. */
955 data
.auth_pk
= &ip
->auth_key_kp
.pubkey
;
956 data
.enc_kp
= &ip
->enc_key_kp
;
957 data
.subcredential
= subcredential
;
958 data
.payload
= payload
;
959 data
.payload_len
= payload_len
;
960 data
.link_specifiers
= smartlist_new();
961 data
.replay_cache
= ip
->replay_cache
;
963 if (hs_cell_parse_introduce2(&data
, circ
, service
) < 0) {
967 /* Check whether we've seen this REND_COOKIE before to detect repeats. */
968 if (replaycache_add_test_and_elapsed(
969 service
->state
.replay_cache_rend_cookie
,
970 data
.rendezvous_cookie
, sizeof(data
.rendezvous_cookie
),
972 /* A Tor client will send a new INTRODUCE1 cell with the same REND_COOKIE
973 * as its previous one if its intro circ times out while in state
974 * CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT. If we received the first
975 * INTRODUCE1 cell (the intro-point relay converts it into an INTRODUCE2
976 * cell), we are already trying to connect to that rend point (and may
977 * have already succeeded); drop this cell. */
978 log_info(LD_REND
, "We received an INTRODUCE2 cell with same REND_COOKIE "
979 "field %ld seconds ago. Dropping cell.",
984 /* At this point, we just confirmed that the full INTRODUCE2 cell is valid
985 * so increment our counter that we've seen one on this intro point. */
986 ip
->introduce2_count
++;
988 /* Launch rendezvous circuit with the onion key and rend cookie. */
989 launch_rendezvous_point_circuit(service
, ip
, &data
);
994 SMARTLIST_FOREACH(data
.link_specifiers
, link_specifier_t
*, lspec
,
995 link_specifier_free(lspec
));
996 smartlist_free(data
.link_specifiers
);
997 memwipe(&data
, 0, sizeof(data
));
1001 /* Circuit <b>circ</b> just finished the rend ntor key exchange. Use the key
1002 * exchange output material at <b>ntor_key_seed</b> and setup <b>circ</b> to
1003 * serve as a rendezvous end-to-end circuit between the client and the
1004 * service. If <b>is_service_side</b> is set, then we are the hidden service
1005 * and the other side is the client.
1007 * Return 0 if the operation went well; in case of error return -1. */
1009 hs_circuit_setup_e2e_rend_circ(origin_circuit_t
*circ
,
1010 const uint8_t *ntor_key_seed
, size_t seed_len
,
1011 int is_service_side
)
1013 if (BUG(!circuit_purpose_is_correct_for_rend(TO_CIRCUIT(circ
)->purpose
,
1014 is_service_side
))) {
1018 crypt_path_t
*hop
= create_rend_cpath(ntor_key_seed
, seed_len
,
1021 log_warn(LD_REND
, "Couldn't get v3 %s cpath!",
1022 is_service_side
? "service-side" : "client-side");
1026 finalize_rend_circuit(circ
, hop
, is_service_side
);
1031 /* We are a v2 legacy HS client and we just received a RENDEZVOUS1 cell
1032 * <b>rend_cell_body</b> on <b>circ</b>. Finish up the DH key exchange and then
1033 * extend the crypt path of <b>circ</b> so that the hidden service is on the
1036 hs_circuit_setup_e2e_rend_circ_legacy_client(origin_circuit_t
*circ
,
1037 const uint8_t *rend_cell_body
)
1040 if (BUG(!circuit_purpose_is_correct_for_rend(
1041 TO_CIRCUIT(circ
)->purpose
, 0))) {
1045 crypt_path_t
*hop
= create_rend_cpath_legacy(circ
, rend_cell_body
);
1047 log_warn(LD_GENERAL
, "Couldn't get v2 cpath.");
1051 finalize_rend_circuit(circ
, hop
, 0);
1056 /* Given the introduction circuit intro_circ, the rendezvous circuit
1057 * rend_circ, a descriptor intro point object ip and the service's
1058 * subcredential, send an INTRODUCE1 cell on intro_circ.
1060 * This will also setup the circuit identifier on rend_circ containing the key
1061 * material for the handshake and e2e encryption. Return 0 on success else
1062 * negative value. Because relay_send_command_from_edge() closes the circuit
1063 * on error, it is possible that intro_circ is closed on error. */
1065 hs_circ_send_introduce1(origin_circuit_t
*intro_circ
,
1066 origin_circuit_t
*rend_circ
,
1067 const hs_desc_intro_point_t
*ip
,
1068 const uint8_t *subcredential
)
1071 ssize_t payload_len
;
1072 uint8_t payload
[RELAY_PAYLOAD_SIZE
] = {0};
1073 hs_cell_introduce1_data_t intro1_data
;
1075 tor_assert(intro_circ
);
1076 tor_assert(rend_circ
);
1078 tor_assert(subcredential
);
1080 /* This takes various objects in order to populate the introduce1 data
1081 * object which is used to build the content of the cell. */
1082 setup_introduce1_data(ip
, rend_circ
->build_state
->chosen_exit
,
1083 subcredential
, &intro1_data
);
1084 /* If we didn't get any link specifiers, it's because our extend info was
1086 if (BUG(!intro1_data
.link_specifiers
) ||
1087 !smartlist_len(intro1_data
.link_specifiers
)) {
1088 log_warn(LD_REND
, "Unable to get link specifiers for INTRODUCE1 cell on "
1089 "circuit %u.", TO_CIRCUIT(intro_circ
)->n_circ_id
);
1093 /* Final step before we encode a cell, we setup the circuit identifier which
1094 * will generate both the rendezvous cookie and client keypair for this
1095 * connection. Those are put in the ident. */
1096 intro1_data
.rendezvous_cookie
= rend_circ
->hs_ident
->rendezvous_cookie
;
1097 intro1_data
.client_kp
= &rend_circ
->hs_ident
->rendezvous_client_kp
;
1099 memcpy(intro_circ
->hs_ident
->rendezvous_cookie
,
1100 rend_circ
->hs_ident
->rendezvous_cookie
,
1101 sizeof(intro_circ
->hs_ident
->rendezvous_cookie
));
1103 /* From the introduce1 data object, this will encode the INTRODUCE1 cell
1104 * into payload which is then ready to be sent as is. */
1105 payload_len
= hs_cell_build_introduce1(&intro1_data
, payload
);
1106 if (BUG(payload_len
< 0)) {
1110 if (relay_send_command_from_edge(CONTROL_CELL_ID
, TO_CIRCUIT(intro_circ
),
1111 RELAY_COMMAND_INTRODUCE1
,
1112 (const char *) payload
, payload_len
,
1113 intro_circ
->cpath
->prev
) < 0) {
1114 /* On error, circuit is closed. */
1115 log_warn(LD_REND
, "Unable to send INTRODUCE1 cell on circuit %u.",
1116 TO_CIRCUIT(intro_circ
)->n_circ_id
);
1125 hs_cell_introduce1_data_clear(&intro1_data
);
1126 memwipe(payload
, 0, sizeof(payload
));
1130 /* Send an ESTABLISH_RENDEZVOUS cell along the rendezvous circuit circ. On
1131 * success, 0 is returned else -1 and the circuit is marked for close. */
1133 hs_circ_send_establish_rendezvous(origin_circuit_t
*circ
)
1135 ssize_t cell_len
= 0;
1136 uint8_t cell
[RELAY_PAYLOAD_SIZE
] = {0};
1139 tor_assert(TO_CIRCUIT(circ
)->purpose
== CIRCUIT_PURPOSE_C_ESTABLISH_REND
);
1141 log_info(LD_REND
, "Send an ESTABLISH_RENDEZVOUS cell on circuit %u",
1142 TO_CIRCUIT(circ
)->n_circ_id
);
1144 /* Set timestamp_dirty, because circuit_expire_building expects it,
1145 * and the rend cookie also means we've used the circ. */
1146 TO_CIRCUIT(circ
)->timestamp_dirty
= time(NULL
);
1148 /* We've attempted to use this circuit. Probe it if we fail */
1149 pathbias_count_use_attempt(circ
);
1151 /* Generate the RENDEZVOUS_COOKIE and place it in the identifier so we can
1152 * complete the handshake when receiving the acknowledgement. */
1153 crypto_rand((char *) circ
->hs_ident
->rendezvous_cookie
, HS_REND_COOKIE_LEN
);
1154 /* Generate the client keypair. No need to be extra strong, not long term */
1155 curve25519_keypair_generate(&circ
->hs_ident
->rendezvous_client_kp
, 0);
1158 hs_cell_build_establish_rendezvous(circ
->hs_ident
->rendezvous_cookie
,
1160 if (BUG(cell_len
< 0)) {
1164 if (relay_send_command_from_edge(CONTROL_CELL_ID
, TO_CIRCUIT(circ
),
1165 RELAY_COMMAND_ESTABLISH_RENDEZVOUS
,
1166 (const char *) cell
, cell_len
,
1167 circ
->cpath
->prev
) < 0) {
1168 /* Circuit has been marked for close */
1169 log_warn(LD_REND
, "Unable to send ESTABLISH_RENDEZVOUS cell on "
1170 "circuit %u", TO_CIRCUIT(circ
)->n_circ_id
);
1171 memwipe(cell
, 0, cell_len
);
1175 memwipe(cell
, 0, cell_len
);