nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 13:13:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use the correct SIGNED_KEY_TYPE value for signing->link certs

Browse Source 
Our code was using [01] as for the key type of signed->link certs,
which was incorrect.  The value should be [03], to indicate that the
value as the SHA256 of an x.509 cert.

Fortunately, nothing cares about this value, so there shouldn't be
compatibility issues.

Fixes bug 40124; bugfix on 0.2.7.2-alpha.
This commit is contained in:
Nick Mathewson 2020-09-17 08:42:25 -04:00
parent 22643272d2
commit 5d1d7afcd3
4 changed files with 20 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
changes/ticket40124 Normal file
View File

@ -0,0 +1,3 @@
o Minor bugfixes (spec conformance):
- Use the correct key type when generating signing->link
certificates. Fixes bug 40124; bugfix on 0.2.7.2-alpha.

10
src/feature/nodelist/torcert.c
View File

@ -37,11 +37,11 @@
#include "core/or/or_handshake_certs_st.h"
/** Helper for tor_cert_create_*(): signs any 32 bytes, not just an ed25519
* key.
/** As tor_cert_create(), but accept an arbitrary signed_key_type as the
* subject key -- not just an ed25519 key.
*/
static tor_cert_t *
tor_cert_sign_impl(const ed25519_keypair_t *signing_key,
tor_cert_t *
tor_cert_create_raw(const ed25519_keypair_t *signing_key,
uint8_t cert_type,
uint8_t signed_key_type,
const uint8_t signed_key_info[32],
@ -134,7 +134,7 @@ tor_cert_create_ed25519(const ed25519_keypair_t *signing_key,
time_t now, time_t lifetime,
uint32_t flags)
{
return tor_cert_sign_impl(signing_key, cert_type,
return tor_cert_create_raw(signing_key, cert_type,
SIGNED_KEY_TYPE_ED25519, signed_key->pubkey,
now, lifetime, flags);
}

8
src/feature/nodelist/torcert.h
View File

@ -12,6 +12,8 @@
#include "lib/crypt_ops/crypto_ed25519.h"
#define SIGNED_KEY_TYPE_ED25519 0x01
#define SIGNED_KEY_TYPE_SHA256_OF_RSA 0x02
#define SIGNED_KEY_TYPE_SHA256_OF_X509 0x03
#define CERT_TYPE_ID_SIGNING 0x04
#define CERT_TYPE_SIGNING_LINK 0x05
@ -61,6 +63,12 @@ tor_cert_t *tor_cert_create_ed25519(const ed25519_keypair_t *signing_key,
const ed25519_public_key_t *signed_key,
time_t now, time_t lifetime,
uint32_t flags);
tor_cert_t * tor_cert_create_raw(const ed25519_keypair_t *signing_key,
uint8_t cert_type,
uint8_t signed_key_type,
const uint8_t signed_key_info[32],
time_t now, time_t lifetime,
uint32_t flags);
tor_cert_t *tor_cert_parse(const uint8_t *cert, size_t certlen);

8
src/feature/relay/routerkeys.c
View File

@ -387,12 +387,10 @@ generate_ed_link_cert(const or_options_t *options, time_t now,
return 0;
}
ed25519_public_key_t dummy_key;
memcpy(dummy_key.pubkey, digests->d[DIGEST_SHA256], DIGEST256_LEN);
link_cert = tor_cert_create_ed25519(get_master_signing_keypair(),
link_cert = tor_cert_create_raw(get_master_signing_keypair(),
CERT_TYPE_SIGNING_LINK,
&dummy_key,
SIGNED_KEY_TYPE_SHA256_OF_X509,
(const uint8_t*)digests->d[DIGEST_SHA256],
now,
options->TestingLinkCertLifetime, 0);