security/tor: add client authorization to hidden services

PR: https://github.com/opnsense/plugins/issues/307

security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/hidden_service.xml

@@ -11,4 +11,18 @@
     <type>text</type>
     <help>Enter a directory name for the hidden service. It may consist of lowercase and uppercase characters.</help>
   </field>
+  <field>
+    <id>hiddenservice.type</id>
+    <label>Authorization type</label>
+    <type>dropdown</type>
+    <help>The type can either be 'Basic' for a general-purpose authorization protocol or 'Stealth' for a less scalable protocol that also hides service activity from unauthorized clients.</help>
+  </field>
+  <field>
+    <id>hiddenservice.clients</id>
+    <label>Authorized clients</label>
+    <type>select_multiple</type>
+    <style>tokenize</style>
+    <allownew>true</allownew>
+    <help>If configured, only clients that are listed here are authorized to access the hidden service.</help>
+  </field>
 </form>

security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/HiddenService.xml

@@ -1,6 +1,7 @@
 <model>
   <mount>//OPNsense/tor/hiddenservice</mount>
   <description>Tor hidden service configuration</description>
+  <version>1.0.0</version>
   <items>
     <service type="ArrayField">
       <enabled type="BooleanField">
@@ -9,9 +10,23 @@
       </enabled>
       <name type="TextField">
         <Required>Y</Required>
-      <mask>/^[a-z0-9_-]+$/i</mask>
-      <ValidationMessage>The name should only consist of alphanumeric characters, dashes and underscores.</ValidationMessage>
+        <mask>/^[a-z0-9_-]+$/i</mask>
+        <ValidationMessage>The name should only consist of alphanumeric characters, dashes and underscores.</ValidationMessage>
       </name>
+      <type type="OptionField">
+        <default>basic</default>
+        <Required>Y</Required>
+        <OptionValues>
+            <basic>Basic</basic>
+            <stealth>Stealth</stealth>
+        </OptionValues>
+      </type>
+      <clients type="CSVListField">
+        <multiple>Y</multiple>
+        <Required>N</Required>
+        <mask>/^([a-z0-9_+-]+,)*([a-z0-9_+-]*)$/i</mask>
+        <ValidationMessage>The authorized clients should only consist of alphanumeric characters, dashes, underscores and plus sign.</ValidationMessage>
+      </clients>
     </service>
   </items>
 </model>

security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc

@@ -86,6 +86,9 @@ AutomapHostsOnResolve {{ OPNsense.tor.general.dns_map_hosts }}
 {%   if helpers.exists('OPNsense.tor.hiddenservice.service') %}
 {%     for service in helpers.toList('OPNsense.tor.hiddenservice.service') %}
 HiddenServiceDir /var/db/tor/{{ service.name }}/
+{%       if (service.clients is defined) and service.clients %}
+HiddenServiceAuthorizeClient {{ service.type }} {{ service.clients }}
+{%       endif %}
 {%       for acl in helpers.toList('OPNsense.tor.hiddenserviceacl.hiddenserviceacl') %}
 {%         if helpers.getUUID(acl.hiddenservice).name == service.name %}
 HiddenServicePort {{ acl.port}} {{ acl.target_host }}:{{ acl.target_port }}