nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-30 23:53:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Rename openssl-bridging functions in crypto_rsa

Browse Source 
These functions exist only to expose RSA keys to other places in Tor
that use OpenSSL; let's be specific about their purpose.
This commit is contained in:
Nick Mathewson 2018-07-19 09:07:08 -04:00
parent 38212d2e40
commit 824009cde5
5 changed files with 30 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/lib/crypt_ops/crypto_rsa.h
View File

@ -104,14 +104,16 @@ int crypto_pk_get_common_digests(crypto_pk_t *pk,
int crypto_pk_base64_encode_private(const crypto_pk_t *pk, char **priv_out); int crypto_pk_base64_encode_private(const crypto_pk_t *pk, char **priv_out);
crypto_pk_t *crypto_pk_base64_decode_private(const char *str, size_t len); crypto_pk_t *crypto_pk_base64_decode_private(const char *str, size_t len);
#ifdef ENABLE_OPENSSL
/* Prototypes for private functions only used by tortls.c, crypto.c, and the /* Prototypes for private functions only used by tortls.c, crypto.c, and the
* unit tests. */ * unit tests. */
struct rsa_st; struct rsa_st;
struct rsa_st *crypto_pk_get_rsa_(crypto_pk_t *env);
crypto_pk_t *crypto_new_pk_from_rsa_(struct rsa_st *rsa);
MOCK_DECL(struct evp_pkey_st *, crypto_pk_get_evp_pkey_,(crypto_pk_t *env,
int private));
struct evp_pkey_st; struct evp_pkey_st;
struct rsa_st *crypto_pk_get_openssl_rsa_(crypto_pk_t *env);
crypto_pk_t *crypto_new_pk_from_openssl_rsa_(struct rsa_st *rsa);
MOCK_DECL(struct evp_pkey_st *, crypto_pk_get_openssl_evp_pkey_,(
crypto_pk_t *env,int private));
#endif
#ifdef TOR_UNIT_TESTS #ifdef TOR_UNIT_TESTS
void crypto_pk_assign_(crypto_pk_t *dest, const crypto_pk_t *src); void crypto_pk_assign_(crypto_pk_t *dest, const crypto_pk_t *src);

21
src/lib/crypt_ops/crypto_rsa_openssl.c
View File

@ -58,9 +58,10 @@ crypto_pk_key_is_private(const crypto_pk_t *k)
#endif /* defined(OPENSSL_1_1_API) */ #endif /* defined(OPENSSL_1_1_API) */
} }
/** used by tortls.c: wrap an RSA* in a crypto_pk_t. */ /** used by tortls.c: wrap an RSA* in a crypto_pk_t. Takes ownership of
* its argument. */
crypto_pk_t * crypto_pk_t *
crypto_new_pk_from_rsa_(RSA *rsa) crypto_new_pk_from_openssl_rsa_(RSA *rsa)
{ {
crypto_pk_t *env; crypto_pk_t *env;
tor_assert(rsa); tor_assert(rsa);
@ -70,19 +71,19 @@ crypto_new_pk_from_rsa_(RSA *rsa)
return env; return env;
} }
/** Helper, used by tor-gencert.c. Return the RSA from a /** Helper, used by tor-gencert.c. Return a copy of the private RSA from a
* crypto_pk_t. */ * crypto_pk_t. */
RSA * RSA *
crypto_pk_get_rsa_(crypto_pk_t *env) crypto_pk_get_openssl_rsa_(crypto_pk_t *env)
{ {
return env->key; return RSA_PrivateKeyDup(env->key);
} }
/** used by tortls.c: get an equivalent EVP_PKEY* for a crypto_pk_t. Iff /** used by tortls.c: get an equivalent EVP_PKEY* for a crypto_pk_t. Iff
* private is set, include the private-key portion of the key. Return a valid * private is set, include the private-key portion of the key. Return a valid
* pointer on success, and NULL on failure. */ * pointer on success, and NULL on failure. */
MOCK_IMPL(EVP_PKEY *, MOCK_IMPL(EVP_PKEY *,
crypto_pk_get_evp_pkey_,(crypto_pk_t *env, int private)) crypto_pk_get_openssl_evp_pkey_,(crypto_pk_t *env, int private))
{ {
RSA *key = NULL; RSA *key = NULL;
EVP_PKEY *pkey = NULL; EVP_PKEY *pkey = NULL;
@ -117,7 +118,7 @@ crypto_pk_new,(void))
rsa = RSA_new(); rsa = RSA_new();
tor_assert(rsa); tor_assert(rsa);
return crypto_new_pk_from_rsa_(rsa); return crypto_new_pk_from_openssl_rsa_(rsa);
} }
/** Release a reference to an asymmetric key; when all the references /** Release a reference to an asymmetric key; when all the references
@ -556,7 +557,7 @@ crypto_pk_copy_full(crypto_pk_t *env)
/* LCOV_EXCL_STOP */ /* LCOV_EXCL_STOP */
} }
return crypto_new_pk_from_rsa_(new_key); return crypto_new_pk_from_openssl_rsa_(new_key);
} }
/** Encrypt <b>fromlen</b> bytes from <b>from</b> with the public key /** Encrypt <b>fromlen</b> bytes from <b>from</b> with the public key
@ -729,7 +730,7 @@ crypto_pk_asn1_decode(const char *str, size_t len)
crypto_openssl_log_errors(LOG_WARN,"decoding public key"); crypto_openssl_log_errors(LOG_WARN,"decoding public key");
return NULL; return NULL;
} }
return crypto_new_pk_from_rsa_(rsa); return crypto_new_pk_from_openssl_rsa_(rsa);
} }
/** Given a crypto_pk_t <b>pk</b>, allocate a new buffer containing the /** Given a crypto_pk_t <b>pk</b>, allocate a new buffer containing the
@ -789,7 +790,7 @@ crypto_pk_base64_decode_private(const char *str, size_t len)
goto out; goto out;
} }
pk = crypto_new_pk_from_rsa_(rsa); pk = crypto_new_pk_from_openssl_rsa_(rsa);
/* Make sure it's valid. */ /* Make sure it's valid. */
if (crypto_pk_check_key(pk) <= 0) { if (crypto_pk_check_key(pk) <= 0) {

14
src/lib/tls/tortls.c
View File

@ -539,9 +539,9 @@ tor_tls_create_certificate,(crypto_pk_t *rsa,
tor_assert(cname); tor_assert(cname);
tor_assert(rsa_sign); tor_assert(rsa_sign);
tor_assert(cname_sign); tor_assert(cname_sign);
if (!(sign_pkey = crypto_pk_get_evp_pkey_(rsa_sign,1))) if (!(sign_pkey = crypto_pk_get_openssl_evp_pkey_(rsa_sign,1)))
goto error; goto error;
if (!(pkey = crypto_pk_get_evp_pkey_(rsa,0))) if (!(pkey = crypto_pk_get_openssl_evp_pkey_(rsa,0)))
goto error; goto error;
if (!(x509 = X509_new())) if (!(x509 = X509_new()))
goto error; goto error;
@ -746,7 +746,7 @@ tor_x509_cert_new,(X509 *x509_cert))
if ((pkey = X509_get_pubkey(x509_cert)) && if ((pkey = X509_get_pubkey(x509_cert)) &&
(rsa = EVP_PKEY_get1_RSA(pkey))) { (rsa = EVP_PKEY_get1_RSA(pkey))) {
crypto_pk_t *pk = crypto_new_pk_from_rsa_(rsa); crypto_pk_t *pk = crypto_new_pk_from_openssl_rsa_(rsa);
if (crypto_pk_get_common_digests(pk, &cert->pkey_digests) < 0) { if (crypto_pk_get_common_digests(pk, &cert->pkey_digests) < 0) {
crypto_pk_free(pk); crypto_pk_free(pk);
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
@ -915,7 +915,7 @@ tor_tls_cert_get_key(tor_x509_cert_t *cert)
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
return NULL; return NULL;
} }
result = crypto_new_pk_from_rsa_(rsa); result = crypto_new_pk_from_openssl_rsa_(rsa);
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
return result; return result;
} }
@ -1270,7 +1270,7 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime,
SSL_CTX_set_session_cache_mode(result->ctx, SSL_SESS_CACHE_OFF); SSL_CTX_set_session_cache_mode(result->ctx, SSL_SESS_CACHE_OFF);
if (!is_client) { if (!is_client) {
tor_assert(rsa); tor_assert(rsa);
if (!(pkey = crypto_pk_get_evp_pkey_(rsa,1))) if (!(pkey = crypto_pk_get_openssl_evp_pkey_(rsa,1)))
goto error; goto error;
if (!SSL_CTX_use_PrivateKey(result->ctx, pkey)) if (!SSL_CTX_use_PrivateKey(result->ctx, pkey))
goto error; goto error;
@ -2277,7 +2277,7 @@ tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_t **identity_key)
rsa = EVP_PKEY_get1_RSA(id_pkey); rsa = EVP_PKEY_get1_RSA(id_pkey);
if (!rsa) if (!rsa)
goto done; goto done;
*identity_key = crypto_new_pk_from_rsa_(rsa); *identity_key = crypto_new_pk_from_openssl_rsa_(rsa);
r = 0; r = 0;
@ -2362,7 +2362,7 @@ tor_x509_cert_replace_expiration(const tor_x509_cert_t *inp,
{ {
X509 *newc = X509_dup(inp->cert); X509 *newc = X509_dup(inp->cert);
X509_time_adj(X509_get_notAfter(newc), 0, &new_expiration_time); X509_time_adj(X509_get_notAfter(newc), 0, &new_expiration_time);
EVP_PKEY *pk = crypto_pk_get_evp_pkey_(signing_key, 1); EVP_PKEY *pk = crypto_pk_get_openssl_evp_pkey_(signing_key, 1);
tor_assert(X509_sign(newc, pk, EVP_sha256())); tor_assert(X509_sign(newc, pk, EVP_sha256()));
EVP_PKEY_free(pk); EVP_PKEY_free(pk);
return tor_x509_cert_new(newc); return tor_x509_cert_new(newc);

6
src/test/test_tortls.c
View File

@ -690,7 +690,7 @@ test_tortls_get_my_client_auth_key(void *ignored)
RSA *k = RSA_new(); RSA *k = RSA_new();
ctx = tor_malloc_zero(sizeof(tor_tls_context_t)); ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
expected = crypto_new_pk_from_rsa_(k); expected = crypto_new_pk_from_openssl_rsa_(k);
ctx->auth_key = expected; ctx->auth_key = expected;
client_tls_context = NULL; client_tls_context = NULL;
@ -2609,7 +2609,7 @@ test_tortls_create_certificate(void *ignored)
pk1 = crypto_pk_new(); pk1 = crypto_pk_new();
pk2 = crypto_pk_new(); pk2 = crypto_pk_new();
MOCK(crypto_pk_get_evp_pkey_, fixed_crypto_pk_get_evp_pkey_); MOCK(crypto_pk_get_openssl_evp_pkey_, fixed_crypto_pk_get_evp_pkey_);
fixed_crypto_pk_get_evp_pkey_result_index = 0; fixed_crypto_pk_get_evp_pkey_result_index = 0;
fixed_crypto_pk_get_evp_pkey_result[0] = NULL; fixed_crypto_pk_get_evp_pkey_result[0] = NULL;
ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1); ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
@ -2628,7 +2628,7 @@ test_tortls_create_certificate(void *ignored)
tt_assert(!ret); tt_assert(!ret);
done: done:
UNMOCK(crypto_pk_get_evp_pkey_); UNMOCK(crypto_pk_get_openssl_evp_pkey_);
crypto_pk_free(pk1); crypto_pk_free(pk1);
crypto_pk_free(pk2); crypto_pk_free(pk2);
} }

7
src/tools/tor-gencert.c
View File

@ -239,8 +239,7 @@ generate_key(int bits)
crypto_pk_t *env = crypto_pk_new(); crypto_pk_t *env = crypto_pk_new();
if (crypto_pk_generate_key_with_bits(env,bits)<0) if (crypto_pk_generate_key_with_bits(env,bits)<0)
goto done; goto done;
rsa = crypto_pk_get_rsa_(env); rsa = crypto_pk_get_openssl_rsa_(env);
rsa = RSAPrivateKey_dup(rsa);
done: done:
crypto_pk_free(env); crypto_pk_free(env);
return rsa; return rsa;
@ -416,7 +415,7 @@ static int
get_fingerprint(EVP_PKEY *pkey, char *out) get_fingerprint(EVP_PKEY *pkey, char *out)
{ {
int r = -1; int r = -1;
crypto_pk_t *pk = crypto_new_pk_from_rsa_(EVP_PKEY_get1_RSA(pkey)); crypto_pk_t *pk = crypto_new_pk_from_openssl_rsa_(EVP_PKEY_get1_RSA(pkey));
if (pk) { if (pk) {
r = crypto_pk_get_fingerprint(pk, out, 0); r = crypto_pk_get_fingerprint(pk, out, 0);
crypto_pk_free(pk); crypto_pk_free(pk);
@ -429,7 +428,7 @@ static int
get_digest(EVP_PKEY *pkey, char *out) get_digest(EVP_PKEY *pkey, char *out)
{ {
int r = -1; int r = -1;
crypto_pk_t *pk = crypto_new_pk_from_rsa_(EVP_PKEY_get1_RSA(pkey)); crypto_pk_t *pk = crypto_new_pk_from_openssl_rsa_(EVP_PKEY_get1_RSA(pkey));
if (pk) { if (pk) {
r = crypto_pk_get_digest(pk, out); r = crypto_pk_get_digest(pk, out);
crypto_pk_free(pk); crypto_pk_free(pk);