501            if ((i = m.find("ServiceID")) != m.end())
502                m_service_id = i->second;
503            if ((i = m.find("PrivateKey")) != m.end())
504                m_private_key = i->second;
505        }
506        if (m_service_id.empty()) {
507            LogWarning("tor: Error parsing ADD_ONION parameters:");
508            for (const std::string &s : reply.lines) {
509                LogWarning("    %s", SanitizeString(s));
510            }
511            return;
512        }
513        m_service = LookupNumeric(std::string(m_service_id+".onion"), Params().GetDefaultPort());
514        LogInfo("Got tor service ID %s, advertising service %s", m_service_id, m_service.ToStringAddrPort());
515        if (WriteBinaryFile(GetPrivateKeyFile(), m_private_key)) {
516            LogDebug(BCLog::TOR, "Cached service private key to %s", fs::PathToString(GetPrivateKeyFile()));
517        } else {
518            LogWarning("tor: Error writing service private key to %s", fs::PathToString(GetPrivateKeyFile()));
519        }
520        AddLocal(m_service, LOCAL_MANUAL);
521        // ... onion requested - keep connection open
522    } else if (reply.code == TOR_REPLY_UNRECOGNIZED) {
523        LogWarning("tor: Add onion failed with unrecognized command (You probably need to upgrade Tor)");
524    } else if (pow_was_enabled && reply.code == TOR_REPLY_SYNTAX_ERROR) {
525        LogDebug(BCLog::TOR, "ADD_ONION failed with PoW defenses, retrying without");
526        _conn.Command(MakeAddOnionCmd(m_private_key, m_target.ToStringAddrPort(), /*enable_pow=*/false),
527                      [this](TorControlConnection& conn, const TorControlReply& reply) {
528                          add_onion_cb(conn, reply, /*pow_was_enabled=*/false);
529                      });
530    } else {
531        LogWarning("tor: Add onion failed; error code %d", reply.code);
532    }
533}
534
535void TorController::auth_cb(TorControlConnection& _conn, const TorControlReply& reply)
536{
537    if (reply.code == TOR_REPLY_OK) {
538        LogDebug(BCLog::TOR, "Authentication successful");
539
540        // Now that we know Tor is running setup the proxy for onion addresses
541        // if -onion isn't set to something else.
542        if (gArgs.GetArg("-onion", "") == "") {
543            _conn.Command("GETINFO net/listeners/socks", std::bind_front(&TorController::get_socks_cb, this));
544        }
545
546        // Finally - now create the service
547        if (m_private_key.empty()) { // No private key, generate one
548            m_private_key = "NEW:ED25519-V3"; // Explicitly request key type - see issue #9214
549        }
550        // Request onion service, redirect port.
551        _conn.Command(MakeAddOnionCmd(m_private_key, m_target.ToStringAddrPort(), /*enable_pow=*/true),
552                      [this](TorControlConnection& conn, const TorControlReply& reply) {
553                          add_onion_cb(conn, reply, /*pow_was_enabled=*/true);
554                      });
555    } else {
556        LogWarning("tor: Authentication failed");
557    }
558}
559
560/** Compute Tor SAFECOOKIE response.
561 *
562 *    ServerHash is computed as:
563 *      HMAC-SHA256("Tor safe cookie authentication server-to-controller hash",
564 *                  CookieString | ClientNonce | ServerNonce)
565 *    (with the HMAC key as its first argument)
566 *
567 *    After a controller sends a successful AUTHCHALLENGE command, the
568 *    next command sent on the connection must be an AUTHENTICATE command,
569 *    and the only authentication string which that AUTHENTICATE command
570 *    will accept is:
571 *
572 *      HMAC-SHA256("Tor safe cookie authentication controller-to-server hash",
573 *                  CookieString | ClientNonce | ServerNonce)
574 *
575 */
576static std::vector<uint8_t> ComputeResponse(std::string_view key, std::span<const uint8_t> cookie, std::span<const uint8_t> client_nonce, std::span<const uint8_t> server_nonce)
577{
578    CHMAC_SHA256 computeHash((const uint8_t*)key.data(), key.size());
579    std::vector<uint8_t> computedHash(CHMAC_SHA256::OUTPUT_SIZE, 0);
580    computeHash.Write(cookie.data(), cookie.size());
581    computeHash.Write(client_nonce.data(), client_nonce.size());
582    computeHash.Write(server_nonce.data(), server_nonce.size());
583    computeHash.Finalize(computedHash.data());
584    return computedHash;
585}
586
587void TorController::authchallenge_cb(TorControlConnection& _conn, const TorControlReply& reply)
588{
589    if (reply.code == TOR_REPLY_OK) {
590        LogDebug(BCLog::TOR, "SAFECOOKIE authentication challenge successful");
591        if (reply.lines.empty()) {
592            LogWarning("tor: AUTHCHALLENGE reply was empty");
593            return;
594        }
595        std::pair<std::string,std::string> l = SplitTorReplyLine(reply.lines[0]);
596        if (l.first == "AUTHCHALLENGE") {
597            std::map<std::string,std::string> m = ParseTorReplyMapping(l.second);
598            if (m.empty()) {
599                LogWarning("tor: Error parsing AUTHCHALLENGE parameters: %s", SanitizeString(l.second));
600                return;
601            }
602            std::vector<uint8_t> server_hash = ParseHex(m["SERVERHASH"]);
603            std::vector<uint8_t> server_nonce = ParseHex(m["SERVERNONCE"]);
604            LogDebug(BCLog::TOR, "AUTHCHALLENGE ServerHash %s ServerNonce %s", HexStr(server_hash), HexStr(server_nonce));
605            if (server_nonce.size() != 32) {
606                LogWarning("tor: ServerNonce is not 32 bytes, as required by spec");
607                return;
608            }
609
610            std::vector<uint8_t> computed_server_hash = ComputeResponse(TOR_SAFE_SERVERKEY, m_cookie, m_client_nonce, server_nonce);
611            if (computed_server_hash != server_hash) {
612                LogWarning("tor: ServerHash %s does not match expected ServerHash %s", HexStr(server_hash), HexStr(computed_server_hash));
613                return;
614            }
615
616            std::vector<uint8_t> computedClientHash = ComputeResponse(TOR_SAFE_CLIENTKEY, m_cookie, m_client_nonce, server_nonce);
617            _conn.Command("AUTHENTICATE " + HexStr(computedClientHash), std::bind_front(&TorController::auth_cb, this));
618        } else {
619            LogWarning("tor: Invalid reply to AUTHCHALLENGE");
620        }
621    } else {
622        LogWarning("tor: SAFECOOKIE authentication challenge failed");
623    }
624}
625
626void TorController::protocolinfo_cb(TorControlConnection& _conn, const TorControlReply& reply)
627{
628    if (reply.code == TOR_REPLY_OK) {
629        std::set<std::string> methods;
630        std::string cookiefile;
631        /*
632         * 250-AUTH METHODS=COOKIE,SAFECOOKIE COOKIEFILE="/home/x/.tor/control_auth_cookie"
633         * 250-AUTH METHODS=NULL
634         * 250-AUTH METHODS=HASHEDPASSWORD
635         */
636        for (const std::string &s : reply.lines) {
637            std::pair<std::string,std::string> l = SplitTorReplyLine(s);
638            if (l.first == "AUTH") {
639                std::map<std::string,std::string> m = ParseTorReplyMapping(l.second);
640                std::map<std::string,std::string>::iterator i;
641                if ((i = m.find("METHODS")) != m.end()) {
642                    std::vector<std::string> m_vec = SplitString(i->second, ',');
643                    methods = std::set<std::string>(m_vec.begin(), m_vec.end());
644                }
645                if ((i = m.find("COOKIEFILE")) != m.end())
646                    cookiefile = i->second;
647            } else if (l.first == "VERSION") {
648                std::map<std::string,std::string> m = ParseTorReplyMapping(l.second);
649                std::map<std::string,std::string>::iterator i;
650                if ((i = m.find("Tor")) != m.end()) {
651                    LogDebug(BCLog::TOR, "Connected to Tor version %s", i->second);
652                }
653            }
654        }
655        for (const std::string &s : methods) {
656            LogDebug(BCLog::TOR, "Supported authentication method: %s", s);
657        }
658        // Prefer NULL, otherwise SAFECOOKIE. If a password is provided, use HASHEDPASSWORD
659        /* Authentication:
660         *   cookie:   hex-encoded ~/.tor/control_auth_cookie
661         *   password: "password"
662         */
663        std::string torpassword = gArgs.GetArg("-torpassword", "");
664        if (!torpassword.empty()) {
665            if (methods.contains("HASHEDPASSWORD")) {
666                LogDebug(BCLog::TOR, "Using HASHEDPASSWORD authentication");
667                ReplaceAll(torpassword, "\"", "\\\"");
668                _conn.Command("AUTHENTICATE \"" + torpassword + "\"", std::bind_front(&TorController::auth_cb, this));
669            } else {
670                LogWarning("tor: Password provided with -torpassword, but HASHEDPASSWORD authentication is not available");
671            }
672        } else if (methods.contains("NULL")) {
673            LogDebug(BCLog::TOR, "Using NULL authentication");
674            _conn.Command("AUTHENTICATE", std::bind_front(&TorController::auth_cb, this));
675        } else if (methods.contains("SAFECOOKIE")) {
676            // Cookie: hexdump -e '32/1 "%02x""\n"'  ~/.tor/control_auth_cookie
677            LogDebug(BCLog::TOR, "Using SAFECOOKIE authentication, reading cookie authentication from %s", cookiefile);
678            std::pair<bool,std::string> status_cookie = ReadBinaryFile(fs::PathFromString(cookiefile), TOR_COOKIE_SIZE);
679            if (status_cookie.first && status_cookie.second.size() == TOR_COOKIE_SIZE) {
680                // _conn.Command("AUTHENTICATE " + HexStr(status_cookie.second), std::bind_front(&TorController::auth_cb, this));
681                m_cookie = std::vector<uint8_t>(status_cookie.second.begin(), status_cookie.second.end());
682                m_client_nonce = std::vector<uint8_t>(TOR_NONCE_SIZE, 0);
683                GetRandBytes(m_client_nonce);
684                _conn.Command("AUTHCHALLENGE SAFECOOKIE " + HexStr(m_client_nonce), std::bind_front(&TorController::authchallenge_cb, this));
685            } else {
686                if (status_cookie.first) {
687                    LogWarning("tor: Authentication cookie %s is not exactly %i bytes, as is required by the spec", cookiefile, TOR_COOKIE_SIZE);
688                } else {
689                    LogWarning("tor: Authentication cookie %s could not be opened (check permissions)", cookiefile);
690                }
691            }
692        } else if (methods.contains("HASHEDPASSWORD")) {
693            LogWarning("tor: The only supported authentication mechanism left is password, but no password provided with -torpassword");
694        } else {
695            LogWarning("tor: No supported authentication method");
696        }
697    } else {
698        LogWarning("tor: Requesting protocol info failed");
699    }
700}
701
702void TorController::connected_cb(TorControlConnection& _conn)
703{
704    m_reconnect_timeout = RECONNECT_TIMEOUT_START;
705    // First send a PROTOCOLINFO command to figure out what authentication is expected
706    if (!_conn.Command("PROTOCOLINFO 1", std::bind_front(&TorController::protocolinfo_cb, this)))
707        LogWarning("tor: Error sending initial protocolinfo command");
708}
709
710void TorController::disconnected_cb(TorControlConnection& _conn)
711{
712    // Stop advertising service when disconnected
713    if (m_service.IsValid())
714        RemoveLocal(m_service);
715    m_service = CService();
716    if (!m_reconnect)
717        return;
718
719    LogDebug(BCLog::TOR, "Not connected to Tor control port %s, retrying in %.2f s",
720             m_tor_control_center, m_reconnect_timeout.count());
721    _conn.Disconnect();
722
723    m_interrupt.sleep_for(std::chrono::duration_cast<std::chrono::milliseconds>(m_reconnect_timeout));
724    m_reconnect_timeout = std::min(m_reconnect_timeout * RECONNECT_TIMEOUT_EXP, RECONNECT_TIMEOUT_MAX);
725}
726
727fs::path TorController::GetPrivateKeyFile()
728{
729    return gArgs.GetDataDirNet() / "onion_v3_private_key";
730}
731
732CService DefaultOnionServiceTarget(uint16_t port)
733{
734    struct in_addr onion_service_target;
735    onion_service_target.s_addr = htonl(INADDR_LOOPBACK);
736    return {onion_service_target, port};
737}
738