From 6dc272ceb8e3089cd88fe9813b50449327a3218e Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Fri, 6 Oct 2017 07:12:11 +0000
Subject: [PATCH] security/tor: add client authorization to hidden services

PR: https://github.com/opnsense/plugins/issues/307
---
 .../OPNsense/Tor/forms/hidden_service.xml     | 14 ++++++++++++++
 .../app/models/OPNsense/Tor/HiddenService.xml | 19 +++++++++++++++++--
 .../service/templates/OPNsense/Tor/torrc      |  3 +++
 3 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/hidden_service.xml b/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/hidden_service.xml
index b1827ad43..5b2900614 100644
--- a/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/hidden_service.xml
+++ b/security/tor/src/opnsense/mvc/app/controllers/OPNsense/Tor/forms/hidden_service.xml
@@ -11,4 +11,18 @@
     <type>text</type>
     <help>Enter a directory name for the hidden service. It may consist of lowercase and uppercase characters.</help>
   </field>
+  <field>
+    <id>hiddenservice.type</id>
+    <label>Authorization type</label>
+    <type>dropdown</type>
+    <help>The type can either be 'Basic' for a general-purpose authorization protocol or 'Stealth' for a less scalable protocol that also hides service activity from unauthorized clients.</help>
+  </field>
+  <field>
+    <id>hiddenservice.clients</id>
+    <label>Authorized clients</label>
+    <type>select_multiple</type>
+    <style>tokenize</style>
+    <allownew>true</allownew>
+    <help>If configured, only clients that are listed here are authorized to access the hidden service.</help>
+  </field>
 </form>
diff --git a/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/HiddenService.xml b/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/HiddenService.xml
index cda02738e..01d47e089 100644
--- a/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/HiddenService.xml
+++ b/security/tor/src/opnsense/mvc/app/models/OPNsense/Tor/HiddenService.xml
@@ -1,6 +1,7 @@
 <model>
   <mount>//OPNsense/tor/hiddenservice</mount>
   <description>Tor hidden service configuration</description>
+  <version>1.0.0</version>
   <items>
     <service type="ArrayField">
       <enabled type="BooleanField">
@@ -9,9 +10,23 @@
       </enabled>
       <name type="TextField">
         <Required>Y</Required>
-      <mask>/^[a-z0-9_-]+$/i</mask>
-      <ValidationMessage>The name should only consist of alphanumeric characters, dashes and underscores.</ValidationMessage>
+        <mask>/^[a-z0-9_-]+$/i</mask>
+        <ValidationMessage>The name should only consist of alphanumeric characters, dashes and underscores.</ValidationMessage>
       </name>
+      <type type="OptionField">
+        <default>basic</default>
+        <Required>Y</Required>
+        <OptionValues>
+            <basic>Basic</basic>
+            <stealth>Stealth</stealth>
+        </OptionValues>
+      </type>
+      <clients type="CSVListField">
+        <multiple>Y</multiple>
+        <Required>N</Required>
+        <mask>/^([a-z0-9_+-]+,)*([a-z0-9_+-]*)$/i</mask>
+        <ValidationMessage>The authorized clients should only consist of alphanumeric characters, dashes, underscores and plus sign.</ValidationMessage>
+      </clients>
     </service>
   </items>
 </model>
diff --git a/security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc b/security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc
index 6e55f4c6d..5a0d5619f 100644
--- a/security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc
+++ b/security/tor/src/opnsense/service/templates/OPNsense/Tor/torrc
@@ -86,6 +86,9 @@ AutomapHostsOnResolve {{ OPNsense.tor.general.dns_map_hosts }}
 {%   if helpers.exists('OPNsense.tor.hiddenservice.service') %}
 {%     for service in helpers.toList('OPNsense.tor.hiddenservice.service') %}
 HiddenServiceDir /var/db/tor/{{ service.name }}/
+{%       if (service.clients is defined) and service.clients %}
+HiddenServiceAuthorizeClient {{ service.type }} {{ service.clients }}
+{%       endif %}
 {%       for acl in helpers.toList('OPNsense.tor.hiddenserviceacl.hiddenserviceacl') %}
 {%         if helpers.getUUID(acl.hiddenservice).name == service.name %}
 HiddenServicePort {{ acl.port}} {{ acl.target_host }}:{{ acl.target_port }}