From 672620901b43ee7f895ef2a01f058eeb5dffe399 Mon Sep 17 00:00:00 2001 From: David Goulet Date: Mon, 10 Sep 2018 15:04:22 -0400 Subject: [PATCH 1/3] hs-v3: Silence some logging for client authorization If a tor client gets a descriptor that it can't decrypt, chances are that the onion requires client authorization. If a tor client is configured with client authorization for an onion but decryption fails, it means that the configured keys aren't working anymore. In both cases, we'll log notice the former and log warn the latter and the rest of the decryption errors are now at info level. Two logs statement have been removed because it was redundant and printing the fetched descriptor in the logs when 80% of it is encrypted wat not helping. Fixes #27550 Signed-off-by: David Goulet --- src/feature/dircache/directory.c | 2 +- src/feature/hs/hs_client.c | 4 ---- src/feature/hs/hs_descriptor.c | 22 ++++++++++++++++++---- 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/src/feature/dircache/directory.c b/src/feature/dircache/directory.c index de0bcdbfa7..1f33f38c97 100644 --- a/src/feature/dircache/directory.c +++ b/src/feature/dircache/directory.c @@ -3124,7 +3124,7 @@ handle_response_fetch_hsdesc_v3(dir_connection_t *conn, case 200: /* We got something: Try storing it in the cache. */ if (hs_cache_store_as_client(body, &conn->hs_ident->identity_pk) < 0) { - log_warn(LD_REND, "Failed to store hidden service descriptor"); + log_info(LD_REND, "Failed to store hidden service descriptor"); /* Fire control port FAILED event. */ hs_control_desc_event_failed(conn->hs_ident, conn->identity_digest, "BAD_DESC"); diff --git a/src/feature/hs/hs_client.c b/src/feature/hs/hs_client.c index 6f031eb3b9..7002cafae0 100644 --- a/src/feature/hs/hs_client.c +++ b/src/feature/hs/hs_client.c @@ -1258,10 +1258,6 @@ hs_client_decode_descriptor(const char *desc_str, client_auht_sk, desc); memwipe(subcredential, 0, sizeof(subcredential)); if (ret < 0) { - log_warn(LD_GENERAL, "Could not parse received descriptor as client."); - if (get_options()->SafeLogging_ == SAFELOG_SCRUB_NONE) { - log_warn(LD_GENERAL, "%s", escaped(desc_str)); - } goto err; } diff --git a/src/feature/hs/hs_descriptor.c b/src/feature/hs/hs_descriptor.c index d0cdffdf10..9c85a729e9 100644 --- a/src/feature/hs/hs_descriptor.c +++ b/src/feature/hs/hs_descriptor.c @@ -1389,7 +1389,7 @@ encrypted_data_length_is_valid(size_t len) /* Make sure there is enough data for the salt and the mac. The equality is there to ensure that there is at least one byte of encrypted data. */ if (len <= HS_DESC_ENCRYPTED_SALT_LEN + DIGEST256_LEN) { - log_warn(LD_REND, "Length of descriptor's encrypted data is too small. " + log_info(LD_REND, "Length of descriptor's encrypted data is too small. " "Got %lu but minimum value is %d", (unsigned long)len, HS_DESC_ENCRYPTED_SALT_LEN + DIGEST256_LEN); goto err; @@ -1540,7 +1540,7 @@ decrypt_desc_layer,(const hs_descriptor_t *desc, * This is a critical check that is making sure the computed MAC matches the * one in the descriptor. */ if (!tor_memeq(our_mac, desc_mac, sizeof(our_mac))) { - log_warn(LD_REND, "Encrypted service descriptor MAC check failed"); + log_info(LD_REND, "Encrypted service descriptor MAC check failed"); goto err; } @@ -1662,7 +1662,6 @@ desc_decrypt_encrypted(const hs_descriptor_t *desc, desc->superencrypted_data.encrypted_blob_size, descriptor_cookie, 0, &encrypted_plaintext); if (!encrypted_len) { - log_warn(LD_REND, "Decrypting encrypted desc failed."); goto err; } tor_assert(encrypted_plaintext); @@ -2272,7 +2271,22 @@ desc_decode_encrypted_v3(const hs_descriptor_t *desc, * in the descriptor as a blob of bytes. */ message_len = desc_decrypt_encrypted(desc, client_auth_sk, &message); if (!message_len) { - log_warn(LD_REND, "Service descriptor decryption failed."); + /* Two possible situation here. Either we have a client authorization + * configured that didn't work or we do not have any configured for this + * onion address so likely the descriptor is for authorized client only, + * we are not. */ + if (client_auth_sk) { + /* At warning level so the client can notice that its client + * authorization is failing. */ + log_warn(LD_REND, "Client authorization for requested onion address " + "is invalid. Can't decrypt the descriptor."); + } else { + /* Inform at notice level that the onion address requested can't be + * reached without client authorization most likely. */ + log_notice(LD_REND, "Fail to decrypt descriptor for requested onion " + "address. It is likely requiring client " + "authorization."); + } goto err; } tor_assert(message); From 49e4bda50bdf723d6cdc8e7a0fb24619fded5f2c Mon Sep 17 00:00:00 2001 From: David Goulet Date: Fri, 21 Sep 2018 08:52:47 -0400 Subject: [PATCH 2/3] fixup! hs-v3: Silence some logging for client authorization --- src/feature/hs/hs_descriptor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/feature/hs/hs_descriptor.c b/src/feature/hs/hs_descriptor.c index 9c85a729e9..b9a0c0ef1f 100644 --- a/src/feature/hs/hs_descriptor.c +++ b/src/feature/hs/hs_descriptor.c @@ -1389,7 +1389,7 @@ encrypted_data_length_is_valid(size_t len) /* Make sure there is enough data for the salt and the mac. The equality is there to ensure that there is at least one byte of encrypted data. */ if (len <= HS_DESC_ENCRYPTED_SALT_LEN + DIGEST256_LEN) { - log_info(LD_REND, "Length of descriptor's encrypted data is too small. " + log_warn(LD_REND, "Length of descriptor's encrypted data is too small. " "Got %lu but minimum value is %d", (unsigned long)len, HS_DESC_ENCRYPTED_SALT_LEN + DIGEST256_LEN); goto err; From 36be6f0d2d9a518ebd1d914e70b07c1967bf235e Mon Sep 17 00:00:00 2001 From: David Goulet Date: Fri, 21 Sep 2018 09:39:21 -0400 Subject: [PATCH 3/3] fixup! hs-v3: Silence some logging for client authorization --- changes/ticket27550 | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 changes/ticket27550 diff --git a/changes/ticket27550 b/changes/ticket27550 new file mode 100644 index 0000000000..87f9b5cbe9 --- /dev/null +++ b/changes/ticket27550 @@ -0,0 +1,5 @@ + o Minor bugfixes (hidden service v3): + - Don't warn so loudly when tor is unable to decode a descriptor. This can + now happen as a normal use case if a client gets a descriptor with + client authorization but the client is not authorized. Fixes bug 27550; + bugfix on 0.3.5.1-alpha.