nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-24 04:13:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'tor-gitlab/mr/145'

Browse Source
This commit is contained in:
David Goulet 2020-09-22 13:39:55 -04:00
commit 4dbbc000b5
11 changed files with 46 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changes/ticket40124 Normal file
View File

@ -0,0 +1,3 @@
o Minor bugfixes (spec conformance):
- Use the correct key type when generating signing->link
certificates. Fixes bug 40124; bugfix on 0.2.7.2-alpha.

9
src/feature/hs/hs_service.c
View File

@ -1587,7 +1587,7 @@ setup_desc_intro_point(const ed25519_keypair_t *signing_kp,
memcpy(&desc_ip->onion_key, &ip->onion_key, sizeof(desc_ip->onion_key));
/* Key and certificate material. */
desc_ip->auth_key_cert = tor_cert_create(signing_kp,
desc_ip->auth_key_cert = tor_cert_create_ed25519(signing_kp,
CERT_TYPE_AUTH_HS_IP_KEY,
&ip->auth_key_kp.pubkey,
nearest_hour,
@ -1638,7 +1638,7 @@ setup_desc_intro_point(const ed25519_keypair_t *signing_kp,
ed25519_public_key_from_curve25519_public_key(&ed25519_pubkey,
&ip->enc_key_kp.pubkey,
0);
desc_ip->enc_key_cert = tor_cert_create(signing_kp,
desc_ip->enc_key_cert = tor_cert_create_ed25519(signing_kp,
CERT_TYPE_CROSS_HS_IP_KEYS,
&ed25519_pubkey, nearest_hour,
HS_DESC_CERT_LIFETIME,
@ -1712,12 +1712,13 @@ build_desc_signing_key_cert(hs_service_descriptor_t *desc, time_t now)
/* Fresh certificate for the signing key. */
plaintext->signing_key_cert =
tor_cert_create(&desc->blinded_kp, CERT_TYPE_SIGNING_HS_DESC,
tor_cert_create_ed25519(&desc->blinded_kp, CERT_TYPE_SIGNING_HS_DESC,
&desc->signing_kp.pubkey, now, HS_DESC_CERT_LIFETIME,
CERT_FLAG_INCLUDE_SIGNING_KEY);
/* If the cert creation fails, the descriptor encoding will fail and thus
* ultimately won't be uploaded. We'll get a stack trace to help us learn
* where the call came from and the tor_cert_create() will log the error. */
* where the call came from and the tor_cert_create_ed25519() will log the
* error. */
tor_assert_nonfatal(plaintext->signing_key_cert);
}

4
src/feature/keymgt/loadkey.c
View File

@ -661,7 +661,7 @@ ed_key_init_from_file(const char *fname, uint32_t flags,
uint32_t cert_flags = 0;
if (flags & INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT)
cert_flags |= CERT_FLAG_INCLUDE_SIGNING_KEY;
cert = tor_cert_create(signing_key, cert_type,
cert = tor_cert_create_ed25519(signing_key, cert_type,
&keypair->pubkey,
now, lifetime,
cert_flags);
@ -739,7 +739,7 @@ ed_key_new(const ed25519_keypair_t *signing_key,
uint32_t cert_flags = 0;
if (flags & INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT)
cert_flags |= CERT_FLAG_INCLUDE_SIGNING_KEY;
tor_cert_t *cert = tor_cert_create(signing_key, cert_type,
tor_cert_t *cert = tor_cert_create_ed25519(signing_key, cert_type,
&keypair->pubkey,
now, lifetime,
cert_flags);

12
src/feature/nodelist/torcert.c
View File

@ -37,11 +37,11 @@
#include "core/or/or_handshake_certs_st.h"
/** Helper for tor_cert_create(): signs any 32 bytes, not just an ed25519
* key.
/** As tor_cert_create(), but accept an arbitrary signed_key_type as the
* subject key -- not just an ed25519 key.
*/
static tor_cert_t *
tor_cert_sign_impl(const ed25519_keypair_t *signing_key,
tor_cert_t *
tor_cert_create_raw(const ed25519_keypair_t *signing_key,
uint8_t cert_type,
uint8_t signed_key_type,
const uint8_t signed_key_info[32],
@ -128,13 +128,13 @@ tor_cert_sign_impl(const ed25519_keypair_t *signing_key,
* the public part of <b>signing_key</b> in the certificate.
*/
tor_cert_t *
tor_cert_create(const ed25519_keypair_t *signing_key,
tor_cert_create_ed25519(const ed25519_keypair_t *signing_key,
uint8_t cert_type,
const ed25519_public_key_t *signed_key,
time_t now, time_t lifetime,
uint32_t flags)
{
return tor_cert_sign_impl(signing_key, cert_type,
return tor_cert_create_raw(signing_key, cert_type,
SIGNED_KEY_TYPE_ED25519, signed_key->pubkey,
now, lifetime, flags);
}

12
src/feature/nodelist/torcert.h
View File

@ -11,7 +11,9 @@
#include "lib/crypt_ops/crypto_ed25519.h"
#define SIGNED_KEY_TYPE_ED25519 0x01
#define SIGNED_KEY_TYPE_ED25519 0x01
#define SIGNED_KEY_TYPE_SHA256_OF_RSA 0x02
#define SIGNED_KEY_TYPE_SHA256_OF_X509 0x03
#define CERT_TYPE_ID_SIGNING 0x04
#define CERT_TYPE_SIGNING_LINK 0x05
@ -56,11 +58,17 @@ typedef struct tor_cert_st {
struct tor_tls_t;
tor_cert_t *tor_cert_create(const ed25519_keypair_t *signing_key,
tor_cert_t *tor_cert_create_ed25519(const ed25519_keypair_t *signing_key,
uint8_t cert_type,
const ed25519_public_key_t *signed_key,
time_t now, time_t lifetime,
uint32_t flags);
tor_cert_t * tor_cert_create_raw(const ed25519_keypair_t *signing_key,
uint8_t cert_type,
uint8_t signed_key_type,
const uint8_t signed_key_info[32],
time_t now, time_t lifetime,
uint32_t flags);
tor_cert_t *tor_cert_parse(const uint8_t *cert, size_t certlen);

14
src/feature/relay/routerkeys.c
View File

@ -387,12 +387,10 @@ generate_ed_link_cert(const or_options_t *options, time_t now,
return 0;
}
ed25519_public_key_t dummy_key;
memcpy(dummy_key.pubkey, digests->d[DIGEST_SHA256], DIGEST256_LEN);
link_cert = tor_cert_create(get_master_signing_keypair(),
link_cert = tor_cert_create_raw(get_master_signing_keypair(),
CERT_TYPE_SIGNING_LINK,
&dummy_key,
SIGNED_KEY_TYPE_SHA256_OF_X509,
(const uint8_t*)digests->d[DIGEST_SHA256],
now,
options->TestingLinkCertLifetime, 0);
@ -466,7 +464,7 @@ init_mock_ed_keys(const crypto_pk_t *rsa_identity_key)
MAKEKEY(master_signing_key);
MAKEKEY(current_auth_key);
#define MAKECERT(cert, signing, signed_, type, flags) \
cert = tor_cert_create(signing, \
cert = tor_cert_create_ed25519(signing, \
type, \
&signed_->pubkey, \
time(NULL), 86400, \
@ -699,8 +697,8 @@ make_ntor_onion_key_crosscert(const curve25519_keypair_t *onion_key,
onion_key) < 0)
goto end;
cert = tor_cert_create(&ed_onion_key, CERT_TYPE_ONION_ID, master_id_key,
now, lifetime, 0);
cert = tor_cert_create_ed25519(&ed_onion_key, CERT_TYPE_ONION_ID,
master_id_key, now, lifetime, 0);
end:
memwipe(&ed_onion_key, 0, sizeof(ed_onion_key));

8
src/test/hs_test_helpers.c
View File

@ -75,7 +75,8 @@ hs_helper_build_intro_point(const ed25519_keypair_t *signing_kp, time_t now,
ret = ed25519_keypair_generate(&auth_kp, 0);
tt_int_op(ret, OP_EQ, 0);
}
ip->auth_key_cert = tor_cert_create(signing_kp, CERT_TYPE_AUTH_HS_IP_KEY,
ip->auth_key_cert = tor_cert_create_ed25519(signing_kp,
CERT_TYPE_AUTH_HS_IP_KEY,
&auth_kp.pubkey, now,
HS_DESC_CERT_LIFETIME,
CERT_FLAG_INCLUDE_SIGNING_KEY);
@ -110,7 +111,8 @@ hs_helper_build_intro_point(const ed25519_keypair_t *signing_kp, time_t now,
}
ed25519_keypair_from_curve25519_keypair(&ed25519_kp, &signbit,
&curve25519_kp);
cross_cert = tor_cert_create(signing_kp, CERT_TYPE_CROSS_HS_IP_KEYS,
cross_cert = tor_cert_create_ed25519(signing_kp,
CERT_TYPE_CROSS_HS_IP_KEYS,
&ed25519_kp.pubkey, time(NULL),
HS_DESC_CERT_LIFETIME,
CERT_FLAG_INCLUDE_SIGNING_KEY);
@ -155,7 +157,7 @@ hs_helper_build_hs_desc_impl(unsigned int no_ip,
sizeof(ed25519_public_key_t));
desc->plaintext_data.signing_key_cert =
tor_cert_create(&blinded_kp, CERT_TYPE_SIGNING_HS_DESC,
tor_cert_create_ed25519(&blinded_kp, CERT_TYPE_SIGNING_HS_DESC,
&signing_kp->pubkey, now, 3600,
CERT_FLAG_INCLUDE_SIGNING_KEY);
tt_assert(desc->plaintext_data.signing_key_cert);

4
src/test/test_dir.c
View File

@ -943,7 +943,7 @@ test_dir_formats_rsa_ed25519(void *arg)
ed25519_secret_key_from_seed(&kp2.seckey,
(const uint8_t*)"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX");
ed25519_public_key_generate(&kp2.pubkey, &kp2.seckey);
r2->cache_info.signing_key_cert = tor_cert_create(&kp1,
r2->cache_info.signing_key_cert = tor_cert_create_ed25519(&kp1,
CERT_TYPE_ID_SIGNING,
&kp2.pubkey,
now, 86400,
@ -7290,7 +7290,7 @@ test_dir_dirserv_router_get_status(void *arg)
ed25519_secret_key_from_seed(&kp2.seckey,
(const uint8_t*)"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX");
ed25519_public_key_generate(&kp2.pubkey, &kp2.seckey);
ri->cache_info.signing_key_cert = tor_cert_create(&kp1,
ri->cache_info.signing_key_cert = tor_cert_create_ed25519(&kp1,
CERT_TYPE_ID_SIGNING,
&kp2.pubkey,
now, 86400,

9
src/test/test_hs_descriptor.c
View File

@ -56,7 +56,7 @@ test_cert_encoding(void *arg)
ret = ed25519_public_key_generate(&signed_key, &secret_key);
tt_int_op(ret, == , 0);
cert = tor_cert_create(&kp, CERT_TYPE_SIGNING_AUTH, &signed_key,
cert = tor_cert_create_ed25519(&kp, CERT_TYPE_SIGNING_AUTH, &signed_key,
now, 3600 * 2, CERT_FLAG_INCLUDE_SIGNING_KEY);
tt_assert(cert);
@ -706,7 +706,7 @@ test_validate_cert(void *arg)
tt_int_op(ret, OP_EQ, 0);
/* Cert of type CERT_TYPE_AUTH_HS_IP_KEY. */
cert = tor_cert_create(&kp, CERT_TYPE_AUTH_HS_IP_KEY,
cert = tor_cert_create_ed25519(&kp, CERT_TYPE_AUTH_HS_IP_KEY,
&kp.pubkey, now, 3600,
CERT_FLAG_INCLUDE_SIGNING_KEY);
tt_assert(cert);
@ -726,8 +726,9 @@ test_validate_cert(void *arg)
tor_cert_free(cert);
/* Try a cert without including the signing key. */
cert = tor_cert_create(&kp, CERT_TYPE_AUTH_HS_IP_KEY, &kp.pubkey, now,
3600, 0);
cert = tor_cert_create_ed25519(&kp, CERT_TYPE_AUTH_HS_IP_KEY,
&kp.pubkey, now, 3600, 0);
tt_assert(cert);
/* Test with a bad type. */
ret = cert_is_valid(cert, CERT_TYPE_AUTH_HS_IP_KEY, "unicorn");

2
src/test/test_link_handshake.c
View File

@ -710,7 +710,7 @@ CERTS_FAIL(missing_signing_key, /* ed25519 */
* signing key. */
const ed25519_keypair_t *mk = get_master_identity_keypair();
const ed25519_keypair_t *sk = get_master_signing_keypair();
tor_cert_t *bad_cert = tor_cert_create(mk, CERT_TYPE_ID_SIGNING,
tor_cert_t *bad_cert = tor_cert_create_ed25519(mk, CERT_TYPE_ID_SIGNING,
&sk->pubkey, time(NULL), 86400,
0 /* don't include signer */);
certs_cell_cert_setlen_body(cert, bad_cert->encoded_len);

2
src/test/test_routerkeys.c
View File

@ -151,7 +151,7 @@ test_routerkeys_ed_certs(void *args)
for (int i = 0; i <= 1; ++i) {
uint32_t flags = i ? CERT_FLAG_INCLUDE_SIGNING_KEY : 0;
cert[i] = tor_cert_create(&kp1, 5, &kp2.pubkey, now, 10000, flags);
cert[i] = tor_cert_create_ed25519(&kp1, 5, &kp2.pubkey, now, 10000, flags);
tt_assert(cert[i]);
tt_uint_op(cert[i]->sig_bad, OP_EQ, 0);