nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-11 05:33:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Rename openssl-bridging functions in crypto_rsa

Browse Source 
These functions exist only to expose RSA keys to other places in Tor
that use OpenSSL; let's be specific about their purpose.
This commit is contained in:
Nick Mathewson 2018-07-19 09:07:08 -04:00
parent 38212d2e40
commit 824009cde5
5 changed files with 30 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/lib/crypt_ops/crypto_rsa.h
View File

@ -104,14 +104,16 @@ int crypto_pk_get_common_digests(crypto_pk_t *pk,
int crypto_pk_base64_encode_private(const crypto_pk_t *pk, char **priv_out);
crypto_pk_t *crypto_pk_base64_decode_private(const char *str, size_t len);
#ifdef ENABLE_OPENSSL
/* Prototypes for private functions only used by tortls.c, crypto.c, and the
* unit tests. */
struct rsa_st;
struct rsa_st *crypto_pk_get_rsa_(crypto_pk_t *env);
crypto_pk_t *crypto_new_pk_from_rsa_(struct rsa_st *rsa);
MOCK_DECL(struct evp_pkey_st *, crypto_pk_get_evp_pkey_,(crypto_pk_t *env,
int private));
struct evp_pkey_st;
struct rsa_st *crypto_pk_get_openssl_rsa_(crypto_pk_t *env);
crypto_pk_t *crypto_new_pk_from_openssl_rsa_(struct rsa_st *rsa);
MOCK_DECL(struct evp_pkey_st *, crypto_pk_get_openssl_evp_pkey_,(
crypto_pk_t *env,int private));
#endif
#ifdef TOR_UNIT_TESTS
void crypto_pk_assign_(crypto_pk_t *dest, const crypto_pk_t *src);

21
src/lib/crypt_ops/crypto_rsa_openssl.c
View File

@ -58,9 +58,10 @@ crypto_pk_key_is_private(const crypto_pk_t *k)
#endif /* defined(OPENSSL_1_1_API) */
}
/** used by tortls.c: wrap an RSA* in a crypto_pk_t. */
/** used by tortls.c: wrap an RSA* in a crypto_pk_t. Takes ownership of
* its argument. */
crypto_pk_t *
crypto_new_pk_from_rsa_(RSA *rsa)
crypto_new_pk_from_openssl_rsa_(RSA *rsa)
{
crypto_pk_t *env;
tor_assert(rsa);
@ -70,19 +71,19 @@ crypto_new_pk_from_rsa_(RSA *rsa)
return env;
}
/** Helper, used by tor-gencert.c. Return the RSA from a
/** Helper, used by tor-gencert.c. Return a copy of the private RSA from a
* crypto_pk_t. */
RSA *
crypto_pk_get_rsa_(crypto_pk_t *env)
crypto_pk_get_openssl_rsa_(crypto_pk_t *env)
{
return env->key;
return RSA_PrivateKeyDup(env->key);
}
/** used by tortls.c: get an equivalent EVP_PKEY* for a crypto_pk_t. Iff
* private is set, include the private-key portion of the key. Return a valid
* pointer on success, and NULL on failure. */
MOCK_IMPL(EVP_PKEY *,
crypto_pk_get_evp_pkey_,(crypto_pk_t *env, int private))
crypto_pk_get_openssl_evp_pkey_,(crypto_pk_t *env, int private))
{
RSA *key = NULL;
EVP_PKEY *pkey = NULL;
@ -117,7 +118,7 @@ crypto_pk_new,(void))
rsa = RSA_new();
tor_assert(rsa);
return crypto_new_pk_from_rsa_(rsa);
return crypto_new_pk_from_openssl_rsa_(rsa);
}
/** Release a reference to an asymmetric key; when all the references
@ -556,7 +557,7 @@ crypto_pk_copy_full(crypto_pk_t *env)
/* LCOV_EXCL_STOP */
}
return crypto_new_pk_from_rsa_(new_key);
return crypto_new_pk_from_openssl_rsa_(new_key);
}
/** Encrypt <b>fromlen</b> bytes from <b>from</b> with the public key
@ -729,7 +730,7 @@ crypto_pk_asn1_decode(const char *str, size_t len)
crypto_openssl_log_errors(LOG_WARN,"decoding public key");
return NULL;
}
return crypto_new_pk_from_rsa_(rsa);
return crypto_new_pk_from_openssl_rsa_(rsa);
}
/** Given a crypto_pk_t <b>pk</b>, allocate a new buffer containing the
@ -789,7 +790,7 @@ crypto_pk_base64_decode_private(const char *str, size_t len)
goto out;
}
pk = crypto_new_pk_from_rsa_(rsa);
pk = crypto_new_pk_from_openssl_rsa_(rsa);
/* Make sure it's valid. */
if (crypto_pk_check_key(pk) <= 0) {

14
src/lib/tls/tortls.c
View File

@ -539,9 +539,9 @@ tor_tls_create_certificate,(crypto_pk_t *rsa,
tor_assert(cname);
tor_assert(rsa_sign);
tor_assert(cname_sign);
if (!(sign_pkey = crypto_pk_get_evp_pkey_(rsa_sign,1)))
if (!(sign_pkey = crypto_pk_get_openssl_evp_pkey_(rsa_sign,1)))
goto error;
if (!(pkey = crypto_pk_get_evp_pkey_(rsa,0)))
if (!(pkey = crypto_pk_get_openssl_evp_pkey_(rsa,0)))
goto error;
if (!(x509 = X509_new()))
goto error;
@ -746,7 +746,7 @@ tor_x509_cert_new,(X509 *x509_cert))
if ((pkey = X509_get_pubkey(x509_cert)) &&
(rsa = EVP_PKEY_get1_RSA(pkey))) {
crypto_pk_t *pk = crypto_new_pk_from_rsa_(rsa);
crypto_pk_t *pk = crypto_new_pk_from_openssl_rsa_(rsa);
if (crypto_pk_get_common_digests(pk, &cert->pkey_digests) < 0) {
crypto_pk_free(pk);
EVP_PKEY_free(pkey);
@ -915,7 +915,7 @@ tor_tls_cert_get_key(tor_x509_cert_t *cert)
EVP_PKEY_free(pkey);
return NULL;
}
result = crypto_new_pk_from_rsa_(rsa);
result = crypto_new_pk_from_openssl_rsa_(rsa);
EVP_PKEY_free(pkey);
return result;
}
@ -1270,7 +1270,7 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime,
SSL_CTX_set_session_cache_mode(result->ctx, SSL_SESS_CACHE_OFF);
if (!is_client) {
tor_assert(rsa);
if (!(pkey = crypto_pk_get_evp_pkey_(rsa,1)))
if (!(pkey = crypto_pk_get_openssl_evp_pkey_(rsa,1)))
goto error;
if (!SSL_CTX_use_PrivateKey(result->ctx, pkey))
goto error;
@ -2277,7 +2277,7 @@ tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_t **identity_key)
rsa = EVP_PKEY_get1_RSA(id_pkey);
if (!rsa)
goto done;
*identity_key = crypto_new_pk_from_rsa_(rsa);
*identity_key = crypto_new_pk_from_openssl_rsa_(rsa);
r = 0;
@ -2362,7 +2362,7 @@ tor_x509_cert_replace_expiration(const tor_x509_cert_t *inp,
{
X509 *newc = X509_dup(inp->cert);
X509_time_adj(X509_get_notAfter(newc), 0, &new_expiration_time);
EVP_PKEY *pk = crypto_pk_get_evp_pkey_(signing_key, 1);
EVP_PKEY *pk = crypto_pk_get_openssl_evp_pkey_(signing_key, 1);
tor_assert(X509_sign(newc, pk, EVP_sha256()));
EVP_PKEY_free(pk);
return tor_x509_cert_new(newc);

6
src/test/test_tortls.c
View File

@ -690,7 +690,7 @@ test_tortls_get_my_client_auth_key(void *ignored)
RSA *k = RSA_new();
ctx = tor_malloc_zero(sizeof(tor_tls_context_t));
expected = crypto_new_pk_from_rsa_(k);
expected = crypto_new_pk_from_openssl_rsa_(k);
ctx->auth_key = expected;
client_tls_context = NULL;
@ -2609,7 +2609,7 @@ test_tortls_create_certificate(void *ignored)
pk1 = crypto_pk_new();
pk2 = crypto_pk_new();
MOCK(crypto_pk_get_evp_pkey_, fixed_crypto_pk_get_evp_pkey_);
MOCK(crypto_pk_get_openssl_evp_pkey_, fixed_crypto_pk_get_evp_pkey_);
fixed_crypto_pk_get_evp_pkey_result_index = 0;
fixed_crypto_pk_get_evp_pkey_result[0] = NULL;
ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1);
@ -2628,7 +2628,7 @@ test_tortls_create_certificate(void *ignored)
tt_assert(!ret);
done:
UNMOCK(crypto_pk_get_evp_pkey_);
UNMOCK(crypto_pk_get_openssl_evp_pkey_);
crypto_pk_free(pk1);
crypto_pk_free(pk2);
}

7
src/tools/tor-gencert.c
View File

@ -239,8 +239,7 @@ generate_key(int bits)
crypto_pk_t *env = crypto_pk_new();
if (crypto_pk_generate_key_with_bits(env,bits)<0)
goto done;
rsa = crypto_pk_get_rsa_(env);
rsa = RSAPrivateKey_dup(rsa);
rsa = crypto_pk_get_openssl_rsa_(env);
done:
crypto_pk_free(env);
return rsa;
@ -416,7 +415,7 @@ static int
get_fingerprint(EVP_PKEY *pkey, char *out)
{
int r = -1;
crypto_pk_t *pk = crypto_new_pk_from_rsa_(EVP_PKEY_get1_RSA(pkey));
crypto_pk_t *pk = crypto_new_pk_from_openssl_rsa_(EVP_PKEY_get1_RSA(pkey));
if (pk) {
r = crypto_pk_get_fingerprint(pk, out, 0);
crypto_pk_free(pk);
@ -429,7 +428,7 @@ static int
get_digest(EVP_PKEY *pkey, char *out)
{
int r = -1;
crypto_pk_t *pk = crypto_new_pk_from_rsa_(EVP_PKEY_get1_RSA(pkey));
crypto_pk_t *pk = crypto_new_pk_from_openssl_rsa_(EVP_PKEY_get1_RSA(pkey));
if (pk) {
r = crypto_pk_get_digest(pk, out);
crypto_pk_free(pk);