| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| ... | |
| |
|
|
|
| |
This resolves some TODO HS items now that we are confident we want
to have these actual examples in our tests.
|
| |
|
|
|
|
|
|
|
|
| |
For higher-level HsDesc-related functions, this type indicates where
exactly an error occurred. It lets us distinguish decryption errors
from parsing errors, and attribute responsibility to the hsdir, the
onion service, or the user's lack of encryption.
This lets us remove some just-introduced complexity in
tor-hsclient.
|
| |
|
|
|
|
| |
The last piece here is removing some needless keygen from the
tests. This causes the test output (using the deterministic PRNG)
to change.
|
| | |
|
| |
|
|
|
| |
The value here is 32 bytes; I'm adding it to to the specification
as torspec!141
|
| | |
|
| |
|
|
|
| |
(I doubt that there is a viable side channel here, but still we
might as well get in the habit of doing these things properly.)
|
| | |
|
| |
|
|
| |
I'm using HSS for hs-service features.
|
| | |
|
| |
|
|
|
|
| |
Fortunately, these are all in experimental code.
Closes #798
|
| | |
|
| |
|
|
| |
The `new` function is deprecated in x25519-dalek 2.0.0-rc.2
|
| |
|
|
|
|
|
|
|
|
|
| |
`ParseErrorSource` was originally meant to represent a parsing error,
this enum has since gained some variants that aren't really parsing
related (`Signature`, `CertSignature`, `UntimelyDescriptor`).
Since this error type is now used for general-purpose netdoc errors,
let's rename `ParseError{Kind, Source}` to `NetdocError{Kind, Source}`.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |\
| |
| |
| |
| | |
Remove misleading TODO.
See merge request tpo/core/arti!1130
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The `superencrypted` blob is, in fact, followed by a newline.
See [core/torspec!122].
[core/torspec!122]: https://gitlab.torproject.org/tpo/core/torspec/-/merge_requests/122
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |/
|
|
|
|
|
|
|
|
|
|
| |
1. Abbreviate the link text, and don't have it contain `crate`
which is not really great in docs.
2. Use `super::` for the link target, to find the right thing.
(`crate` doesn't seem to work in rustdoc, perhaps deliberately,
although the error messages are ridiculous and claim the
nonexistence of intermediate modules.)
3. Wrap the lines a bit more.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Fixes
cargo +stable test --locked --offline F -p tor-netdoc
cargo +stable clippy -p tor-netdoc F --all-targets
for values of F including
--all-features
--features=hs-client
--features=hs-common
--features=hs-service
(nothing)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Previously, to build descriptors for hidden services with client auth
enabled, in addition to the list of authorized clients, users of
`HsDescBuilder` were required to also provide a descriptor encryption
keypair and a descriptor cookie. This was potentially dangerous and/or
error-prone, because the ephemeral encryption key and the descriptor
cookie are expected to be randomly generated and unique for each
descriptor.
This change makes `ClientAuth` private to the `hsdesc::build` module and
updates `HsDescBuilder` to build `ClientAuth`s internally. Users now
only need to provide the list of authorized client public keys.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
|
|
| |
It's not really needed, it can just be generated at (test) runtime.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
|
|
|
| |
This adds a test for an `encode -> decode -> encode` flow for a hidden
service descriptor with client authorization enabled.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
| |
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
`AuthClient`s were originally meant to represent parsed `auth-client`
lines. In !1070, this struct was repurposed for representing individual
authorized clients in the HS descriptor encoder. However, hidden
services will likely use a list of public keys to represent the
authorized clients rather than a list of `AuthClient`s, as the
information from an `AuthClient` (`client_id`, `iv`, `encrypted_cookie`)
likely won't be immediately available to the hidden service.
This change updates the HS descriptor encoder to represent authorized
clients as a list of `curve25519::PublicKey`s. As such, it is now the
responsibility of the encoder to create the `client_id`, `iv`, and
`encrypted_cookie` using the available keys, the unencrypted descriptor
cookie, and HS subcredential.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |\
| |
| |
| |
| | |
Fix broken doc link.
See merge request tpo/core/arti!1082
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This fixes a broken doc link I introduced in !1070:
```
error: unresolved link to `crate::doc::hsdesc::build::inner::HsDescInnerBuilder`
--> crates/tor-netdoc/src/doc/hsdesc/build/middle.rs:34:11
|
34 | /// [`crate::doc::hsdesc::build::inner::HsDescInnerBuilder`] as described in sections
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ no item named `HsDescInnerBuilder` in module `inner`
|
= note: `-D rustdoc::broken-intra-doc-links` implied by `-D warnings`
error: could not document `tor-netdoc`
```
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| | |
| |
| |
| |
| |
| | |
We can use a deterministic rng to generate predictable keypairs instead.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| | |
| |
| |
| |
| |
| |
| | |
This makes it possible to plug in a deterministic randomness source for
testing.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |/
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Hidden services use blinded singing keys derived from the identity key
to sign descriptor signing keys.
Before this patch, the hidden descriptor builder represented its blinded
signing keys (`blinded_id`) as plain `ed25519::Keypair`s. This was not
ideal, as there was nothing preventing the caller from accidentally
initializing `blinded_id` with an unblinded keypair.
This introduces a new `HsBlindKeypair` type to represent blinded
keypairs.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
|
|
|
|
| |
The consensus seems to be the builders don't add much value, see [this comment].
[this comment]: https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/1070#note_2889488
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
| |
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
|
|
|
|
| |
`NetdocText` is a wrapper around a `String` and a type marker. The type
annotation proved of limited use, and made the netdoc builder API
somewhat awkward to use.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
| |
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Unlike `hsdesc::IntroPointDesc`, `hsdesc::build::IntroPointDesc`
represents link specifiers as `LinkSpec`s rather than
`UnparsedLinkSpec`s.
Since this is a general-purpose representation of an introduction point
and not merely an intermediate representation for decoding/encoding, it
will probably need to be factored out of `tor-netdoc` at some point.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
This introduces the `NetdocBuilder` trait described in
`netdoc-builder.md` and a new `tor-netdoc::doc::hsdesc::build` module,
which exports the `HsDescBuilder`. Hidden services will use
`HsDescBuilder` to build and encode hidden service descriptors.
There are several TODOs in the code that I'm planning to address
separately.
Partially addresses #745.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
|
|
|
| |
These are used in multiple places (and will also be used by the HS
descriptor encoder later on), so let's make them named constants.
Signed-off-by: Gabriela Moldovan <[email protected]>
|
| |
|
|
| |
TODO HS is blocking for HS release, but not for CI.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
This makes our implementation behave the same as the C tor
implementation, by validating all of the expiration and signatures
on the certificates in the inner document.
(It is still not semantically necessary to check these certs: the
document in which they appear is already signed by the key with
which they are allegedly signed.)
Closes #744
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It said to check whether C enforces an absence of extraneous bytes
at the end of the link specifiers. It does, in
`hs_desc.c:decode_link_specifiers()`, where it says:
```
if (link_specifier_list_parse(&specs, decoded,
(size_t) decoded_len) < decoded_len) {
goto err;
}
```
The comparison with "decoded_len" checks whether all the bytes were
decoded.
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
We want to fuzz these parsers, but there's no currently way to get
at the parsers for inner documents without going through a lot of
encryption. (Coverage-guided fuzzers are powerful, but they
can't find SHA3 preimages.)
|
| |
|
|
|
|
|
|
| |
As per
https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/1016#note_2877759
"_prefixed" becomes "_with_header". That mirrors the returned struct
which is nice.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
