March 2017 - tor-commits - lists.torproject.org

[stem/master] Adding _to_int() helper to str_tools
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit 15ed89f92087d50c0646b373e8c43153948550e9 Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Mar 21 21:40:51 2017 +0100 Adding _to_int() helper to str_tools Replacing our cert module's _bytes_to_long() helper with a tested counterpart in str_tools. Not sure if it matters but should be more efficient. Rather than doing a 'unicode => bytes => hex => int' conversion we directly convert to the integer representation. --- stem/descriptor/certificate.py | 18 ++++++------------ stem/util/str_tools.py | 16 ++++++++++++++++ test/unit/util/str_tools.py | 17 +++++++++++++++++ 3 files changed, 39 insertions(+), 12 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index 528d594..191e87e 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -2,8 +2,8 @@ # See LICENSE for licensing information """ -Parsing for the Tor server descriptor Ed25519 Certificates, which is used to -validate the Ed25519 key used to sign the relay descriptor. +Parsing for Tor Ed25519 certificates, which is used to validate the key used to +sign server descriptors. Certificates can optionally contain CertificateExtension objects depending on their type and purpose. Currently Ed25519KeyCertificate certificates will @@ -41,16 +41,9 @@ CERTIFICATE_FLAGS_LENGTH = 4 ED25519_ROUTER_SIGNATURE_PREFIX = b'Tor router descriptor signature v1' -def _bytes_to_long(b): - if stem.prereq.is_python_3(): - return int(binascii.hexlify(stem.util.str_tools._to_bytes(b)), 16) - else: - return long(binascii.hexlify(b), 16) - - def _parse_long_offset(offset, length): def _parse(raw_contents): - return _bytes_to_long(raw_contents[offset:(offset + length)]) + return stem.util.str_tools._to_int(raw_contents[offset:(offset + length)]) return _parse @@ -82,7 +75,8 @@ def _parse_certificate(raw_contents, master_key_bytes, validate = False): def _parse_extensions(raw_contents): - n_extensions = _bytes_to_long(raw_contents[39:40]) + n_extensions = stem.util.str_tools._to_int(raw_contents[39:40]) + if n_extensions == 0: return [] @@ -90,7 +84,7 @@ def _parse_extensions(raw_contents): extension_bytes = raw_contents[STANDARD_ATTRIBUTES_LENGTH:-SIGNATURE_LENGTH] while len(extension_bytes) > 0: - ext_length = _bytes_to_long(extension_bytes[0:2]) + ext_length = stem.util.str_tools._to_int(extension_bytes[0:2]) ext_type = extension_bytes[2:3] ext_flags = extension_bytes[3:CERTIFICATE_FLAGS_LENGTH] ext_data = extension_bytes[CERTIFICATE_FLAGS_LENGTH:(CERTIFICATE_FLAGS_LENGTH + ext_length)] diff --git a/stem/util/str_tools.py b/stem/util/str_tools.py index 0fbdf38..8c6463a 100644 --- a/stem/util/str_tools.py +++ b/stem/util/str_tools.py @@ -117,6 +117,22 @@ def _to_unicode(msg): return _to_unicode_impl(msg) +def _to_int(msg): + """ + Serializes a string to a number. + + :param str msg: string to be serialized + + :returns: **int** representation of the string + """ + + if stem.prereq.is_python_3() and isinstance(msg, bytes): + # iterating over bytes in python3 provides ints rather than characters + return sum([pow(256, (len(msg) - i - 1)) * c for (i, c) in enumerate(msg)]) + else: + return sum([pow(256, (len(msg) - i - 1)) * ord(c) for (i, c) in enumerate(msg)]) + + def _to_camel_case(label, divider = '_', joiner = ' '): """ Converts the given string to camel case, ie: diff --git a/test/unit/util/str_tools.py b/test/unit/util/str_tools.py index 3d0936f..00e5c55 100644 --- a/test/unit/util/str_tools.py +++ b/test/unit/util/str_tools.py @@ -9,6 +9,23 @@ from stem.util import str_tools class TestStrTools(unittest.TestCase): + def test_to_int(self): + """ + Checks the _to_int() function. + """ + + test_inputs = { + '': 0, + 'h': 104, + 'hi': 26729, + 'hello': 448378203247, + str_tools._to_bytes('hello'): 448378203247, + str_tools._to_unicode('hello'): 448378203247, + } + + for arg, expected in test_inputs.items(): + self.assertEqual(expected, str_tools._to_int(arg)) + def test_to_camel_case(self): """ Checks the _to_camel_case() function.

1 0

[stem/master] Change extension flags to an enum list
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit ff1641d5d27deaa735ffd78727922bcfa6f3e1a0 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Mar 26 16:29:42 2017 +0200 Change extension flags to an enum list Seems they're going for unix permission style flag encoding in the int so we should include a proper splitting of the attributes. We can't know yet what future flags will be so gotta keep the int around too. --- stem/descriptor/certificate.py | 28 +++++++++++++++++++++++++--- test/unit/descriptor/certificate.py | 10 +++++----- 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index 52bb33b..e1d75bb 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -26,6 +26,17 @@ to sign server descriptors. **LINK_CERT** TLS link certificate signed with ed25519 signing key **AUTH** authentication key signed with ed25519 signing key ============== =========== + +.. data::ExtensionFlag (enum) + + Flags that can be assigned to Ed25519 certificate extensions. + + ==================== =========== + ExtensionFlag Description + ==================== =========== + AFFECTS_VALIDATION extension affects whether the certificate is valid + UNKNOWN extension includes flags not yet recognized by stem + ==================== =========== """ import base64 @@ -38,6 +49,7 @@ ED25519_HEADER_LENGTH = 40 ED25519_SIGNATURE_LENGTH = 64 CertType = enum.UppercaseEnum('SIGNING', 'LINK_CERT', 'AUTH') +ExtensionFlag = enum.UppercaseEnum('AFFECTS_VALIDATION', 'UNKNOWN') class Ed25519Certificate(object): @@ -138,19 +150,29 @@ class Ed25519CertificateV1(Ed25519Certificate): if extension_length != len(extension_data): raise ValueError("Ed25519 extension is truncated. It should have %i bytes of data but there's only %i." % (extension_length, len(extension_data))) - self.extensions.append(Ed25519Extension(extension_type, extension_flags, extension_data)) + flags, remaining_flags = [], extension_flags + + if remaining_flags % 2 == 1: + flags.append(ExtensionFlag.AFFECTS_VALIDATION) + remaining_flags -= 1 + + if remaining_flags: + flags.append(ExtensionFlag.UNKNOWN) + + self.extensions.append(Ed25519Extension(extension_type, flags, extension_flags, extension_data)) remaining_data = remaining_data[4 + extension_length:] if remaining_data: raise ValueError('Ed25519 certificate had %i bytes of unused extension data' % len(remaining_data)) -class Ed25519Extension(collections.namedtuple('Ed25519Extension', ['extension_type', 'flags', 'data'])): +class Ed25519Extension(collections.namedtuple('Ed25519Extension', ['extension_type', 'flags', 'flag_int', 'data'])): """ Extension within an Ed25519 certificate. :var int extension_type: extension type - :var int flags: extension attributes + :var list flags: extension attribute flags + :var int flag_int: integer encoding of the extension attribute flags :var bytes data: data the extension concerns """ diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index fde7fa3..5728711 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -11,7 +11,7 @@ import stem.descriptor.certificate import stem.prereq import test.runner -from stem.descriptor.certificate import ED25519_SIGNATURE_LENGTH, CertType, Ed25519Certificate, Ed25519CertificateV1, Ed25519Extension +from stem.descriptor.certificate import ED25519_SIGNATURE_LENGTH, CertType, ExtensionFlag, Ed25519Certificate, Ed25519CertificateV1, Ed25519Extension ED25519_CERT = """ AQQABhtZAaW2GoBED1IjY3A6f6GNqBEl5A83fD2Za9upGke51JGqAQAgBABnprVR @@ -41,7 +41,7 @@ class TestEd25519Certificate(unittest.TestCase): self.assertRaisesRegexp(ValueError, re.escape(exc_msg), Ed25519Certificate.parse, parse_arg) def test_basic_parsing(self): - cert_bytes = certificate(extension_data = [b'\x00\x02\x04\x07\x15\x12', b'\x00\x00\x05\x03']) + cert_bytes = certificate(extension_data = [b'\x00\x02\x04\x07\x15\x12', b'\x00\x00\x05\x04']) cert = Ed25519Certificate.parse(cert_bytes) self.assertEqual(Ed25519CertificateV1, type(cert)) @@ -54,8 +54,8 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(b'\x01' * ED25519_SIGNATURE_LENGTH, cert.signature) self.assertEqual([ - Ed25519Extension(extension_type = 4, flags = 7, data = b'\x15\x12'), - Ed25519Extension(extension_type = 5, flags = 3, data = b''), + Ed25519Extension(extension_type = 4, flags = [ExtensionFlag.AFFECTS_VALIDATION, ExtensionFlag.UNKNOWN], flag_int = 7, data = b'\x15\x12'), + Ed25519Extension(extension_type = 5, flags = [ExtensionFlag.UNKNOWN], flag_int = 4, data = b''), ], cert.extensions) def test_with_real_cert(self): @@ -68,7 +68,7 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(datetime.datetime(2015, 8, 28, 19, 0), cert.expiration) self.assertEqual(1, cert.key_type) self.assertEqual(EXPECTED_CERT_KEY, cert.key) - self.assertEqual([Ed25519Extension(extension_type = 4, flags = 0, data = EXPECTED_EXTENSION_DATA)], cert.extensions) + self.assertEqual([Ed25519Extension(extension_type = 4, flags = [], flag_int = 0, data = EXPECTED_EXTENSION_DATA)], cert.extensions) self.assertEqual(EXPECTED_SIGNATURE, cert.signature) def test_non_base64(self):

1 0

[stem/master] Support Ed25519 extensions
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit 1423b6d5d714b9ce08eb5096dd3a6dbd6c6e5e5d Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Mar 26 15:57:26 2017 +0200 Support Ed25519 extensions Adding support for Ed25519 extension fields along with a few more tests. --- stem/descriptor/certificate.py | 31 +++++++++++++++++++++++++++++++ test/unit/descriptor/certificate.py | 36 +++++++++++++++++++++++++++--------- 2 files changed, 58 insertions(+), 9 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index f9fb6ec..52bb33b 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -29,6 +29,7 @@ to sign server descriptors. """ import base64 +import collections import datetime from stem.util import enum @@ -89,6 +90,8 @@ class Ed25519CertificateV1(Ed25519Certificate): :var datetime expiration: expiration of the certificate :var int key_type: format of the key :var bytes key: key content + :var list extensions: :class:`~stem.descriptor.certificate.Ed25519Extension` in this certificate + :var bytes signature: certificate signature """ def __init__(self, version, encoded, decoded): @@ -117,11 +120,39 @@ class Ed25519CertificateV1(Ed25519Certificate): self.key_type = stem.util.str_tools._to_int(decoded[6]) self.key = decoded[7:39] + self.signature = decoded[-ED25519_SIGNATURE_LENGTH:] + self.extensions = [] + extension_count = stem.util.str_tools._to_int(decoded[39]) + remaining_data = decoded[40:-ED25519_SIGNATURE_LENGTH] + for i in range(extension_count): + if len(remaining_data) < 4: + raise ValueError('Ed25519 extension is missing header field data') + extension_length = stem.util.str_tools._to_int(remaining_data[:2]) + extension_type = stem.util.str_tools._to_int(remaining_data[2]) + extension_flags = stem.util.str_tools._to_int(remaining_data[3]) + extension_data = remaining_data[4:4 + extension_length] + if extension_length != len(extension_data): + raise ValueError("Ed25519 extension is truncated. It should have %i bytes of data but there's only %i." % (extension_length, len(extension_data))) + self.extensions.append(Ed25519Extension(extension_type, extension_flags, extension_data)) + remaining_data = remaining_data[4 + extension_length:] + + if remaining_data: + raise ValueError('Ed25519 certificate had %i bytes of unused extension data' % len(remaining_data)) + + +class Ed25519Extension(collections.namedtuple('Ed25519Extension', ['extension_type', 'flags', 'data'])): + """ + Extension within an Ed25519 certificate. + + :var int extension_type: extension type + :var int flags: extension attributes + :var bytes data: data the extension concerns + """ diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index 5297579..fde7fa3 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -11,7 +11,7 @@ import stem.descriptor.certificate import stem.prereq import test.runner -from stem.descriptor.certificate import ED25519_SIGNATURE_LENGTH, CertType, Ed25519Certificate, Ed25519CertificateV1 +from stem.descriptor.certificate import ED25519_SIGNATURE_LENGTH, CertType, Ed25519Certificate, Ed25519CertificateV1, Ed25519Extension ED25519_CERT = """ AQQABhtZAaW2GoBED1IjY3A6f6GNqBEl5A83fD2Za9upGke51JGqAQAgBABnprVR @@ -19,15 +19,21 @@ ptIr43bWPo2fIzo3uOywfoMrryprpbm4HhCkZMaO064LP+1KNuLvlc8sGG8lTjx1 g4k3ELuWYgHYWU5rAia7nl4gUfBZOEfHAfKES7l3d63dBEjEX98Ljhdp2w4= """.strip() +EXPECTED_CERT_KEY = '\xa5\xb6\x1a\x80D\x0fR#cp:\x7f\xa1\x8d\xa8\x11%\xe4\x0f7|=\x99k\xdb\xa9\x1aG\xb9\xd4\x91\xaa' +EXPECTED_EXTENSION_DATA = 'g\xa6\xb5Q\xa6\xd2+\xe3v\xd6>\x8d\x9f#:7\xb8\xec\xb0~\x83+\xaf*k\xa5\xb9\xb8\x1e\x10\xa4d' +EXPECTED_SIGNATURE = '\xc6\x8e\xd3\xae\x0b?\xedJ6\xe2\xef\x95\xcf,\x18o%N<u\x83\x897\x10\xbb\x96b\x01\xd8YNk\x02&\xbb\x9e^ Q\xf0Y8G\xc7\x01\xf2\x84K\xb9ww\xad\xdd\x04H\xc4_\xdf\x0b\x8e\x17i\xdb\x0e' -def certificate(version = 1, cert_type = 4): + +def certificate(version = 1, cert_type = 4, extension_data = []): return base64.b64encode(''.join([ chr(version), chr(cert_type), - b'\x00' * 4, # expiration date, leaving this as the epoch - b'\x01', # key type - b'\x03' * 32, # key - b'\x00' + b'\x00' * ED25519_SIGNATURE_LENGTH])) + b'\x00' * 4, # expiration date, leaving this as the epoch + b'\x01', # key type + b'\x03' * 32, # key + chr(len(extension_data)), # extension count + b''.join(extension_data), + b'\x01' * ED25519_SIGNATURE_LENGTH])) class TestEd25519Certificate(unittest.TestCase): @@ -35,7 +41,7 @@ class TestEd25519Certificate(unittest.TestCase): self.assertRaisesRegexp(ValueError, re.escape(exc_msg), Ed25519Certificate.parse, parse_arg) def test_basic_parsing(self): - cert_bytes = certificate() + cert_bytes = certificate(extension_data = [b'\x00\x02\x04\x07\x15\x12', b'\x00\x00\x05\x03']) cert = Ed25519Certificate.parse(cert_bytes) self.assertEqual(Ed25519CertificateV1, type(cert)) @@ -45,6 +51,12 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(datetime.datetime(1970, 1, 1, 1, 0), cert.expiration) self.assertEqual(1, cert.key_type) self.assertEqual(b'\x03' * 32, cert.key) + self.assertEqual(b'\x01' * ED25519_SIGNATURE_LENGTH, cert.signature) + + self.assertEqual([ + Ed25519Extension(extension_type = 4, flags = 7, data = b'\x15\x12'), + Ed25519Extension(extension_type = 5, flags = 3, data = b''), + ], cert.extensions) def test_with_real_cert(self): cert = Ed25519Certificate.parse(ED25519_CERT) @@ -55,7 +67,9 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(CertType.SIGNING, cert.cert_type) self.assertEqual(datetime.datetime(2015, 8, 28, 19, 0), cert.expiration) self.assertEqual(1, cert.key_type) - self.assertEqual('\xa5\xb6\x1a\x80D\x0fR#cp:\x7f\xa1\x8d\xa8\x11%\xe4\x0f7|=\x99k\xdb\xa9\x1aG\xb9\xd4\x91\xaa', cert.key) + self.assertEqual(EXPECTED_CERT_KEY, cert.key) + self.assertEqual([Ed25519Extension(extension_type = 4, flags = 0, data = EXPECTED_EXTENSION_DATA)], cert.extensions) + self.assertEqual(EXPECTED_SIGNATURE, cert.signature) def test_non_base64(self): self.assert_raises('\x02\x0323\x04', "Ed25519 certificate wasn't propoerly base64 encoded (Incorrect padding):") @@ -71,8 +85,12 @@ class TestEd25519Certificate(unittest.TestCase): self.assert_raises(certificate(cert_type = 0), 'Ed25519 certificate cannot have a type of 0. This is reserved to avoid conflicts with tor CERTS cells.') self.assert_raises(certificate(cert_type = 7), 'Ed25519 certificate cannot have a type of 7. This is reserved for RSA identity cross-certification.') + def test_truncated_extension(self): + self.assert_raises(certificate(extension_data = [b'']), 'Ed25519 extension is missing header field data') + self.assert_raises(certificate(extension_data = [b'\x50\x00\x00\x00\x15\x12']), "Ed25519 extension is truncated. It should have 20480 bytes of data but there's only 2.") - + def test_extra_extension_data(self): + self.assert_raises(certificate(extension_data = [b'\x00\x01\x00\x00\x15\x12']), "Ed25519 certificate had 1 bytes of unused extension data")

1 0

[stem/master] Standardize on hexlify() and unhexlify()
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit 9311858f3aa5a10c05dc3143ab925b1ed29324da Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Mar 21 21:46:29 2017 +0100 Standardize on hexlify() and unhexlify() The binascii module have both these and aliases. Simpler if we standardize our codebase on using one. --- stem/descriptor/router_status_entry.py | 2 +- stem/response/authchallenge.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/stem/descriptor/router_status_entry.py b/stem/descriptor/router_status_entry.py index 880051b..3cdb4ed 100644 --- a/stem/descriptor/router_status_entry.py +++ b/stem/descriptor/router_status_entry.py @@ -368,7 +368,7 @@ def _base64_to_hex(identity, check_if_fingerprint = True): except (TypeError, binascii.Error): raise ValueError("Unable to decode identity string '%s'" % identity) - fingerprint = binascii.b2a_hex(identity_decoded).upper() + fingerprint = binascii.hexlify(identity_decoded).upper() if stem.prereq.is_python_3(): fingerprint = stem.util.str_tools._to_unicode(fingerprint) diff --git a/stem/response/authchallenge.py b/stem/response/authchallenge.py index d77fd81..94e406f 100644 --- a/stem/response/authchallenge.py +++ b/stem/response/authchallenge.py @@ -41,7 +41,7 @@ class AuthChallengeResponse(stem.response.ControlMessage): if not stem.util.tor_tools.is_hex_digits(value, 64): raise stem.ProtocolError('SERVERHASH has an invalid value: %s' % value) - self.server_hash = binascii.a2b_hex(stem.util.str_tools._to_bytes(value)) + self.server_hash = binascii.unhexlify(stem.util.str_tools._to_bytes(value)) else: raise stem.ProtocolError('Missing SERVERHASH mapping: %s' % line) @@ -51,6 +51,6 @@ class AuthChallengeResponse(stem.response.ControlMessage): if not stem.util.tor_tools.is_hex_digits(value, 64): raise stem.ProtocolError('SERVERNONCE has an invalid value: %s' % value) - self.server_nonce = binascii.a2b_hex(stem.util.str_tools._to_bytes(value)) + self.server_nonce = binascii.unhexlify(stem.util.str_tools._to_bytes(value)) else: raise stem.ProtocolError('Missing SERVERNONCE mapping: %s' % line)

1 0

[stem/master] Check signing key length
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit ba932a1200b8b8507b01dd70f3c94e1ada9f63ff Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Mar 29 19:00:10 2017 +0200 Check signing key length Ed25519 signing keys are documented as being 32 bytes. Might as well check for this. --- stem/descriptor/certificate.py | 3 +++ test/unit/descriptor/certificate.py | 8 ++++++-- test/unit/descriptor/server_descriptor.py | 1 + 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index e29a079..bab0a44 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -172,6 +172,9 @@ class Ed25519CertificateV1(Ed25519Certificate): if remaining_flags: flags.append(ExtensionFlag.UNKNOWN) + if extension_type == ExtensionType.HAS_SIGNING_KEY and len(extension_data) != 32: + raise ValueError('Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was %i.' % len(extension_data)) + self.extensions.append(Ed25519Extension(extension_type, flags, extension_flags, extension_data)) remaining_data = remaining_data[4 + extension_length:] diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index 57f6643..f46965a 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -41,7 +41,8 @@ class TestEd25519Certificate(unittest.TestCase): self.assertRaisesRegexp(ValueError, re.escape(exc_msg), Ed25519Certificate.parse, parse_arg) def test_basic_parsing(self): - cert_bytes = certificate(extension_data = [b'\x00\x02\x04\x07\x15\x12', b'\x00\x00\x05\x04']) + signing_key = b'\x11' * 32 + cert_bytes = certificate(extension_data = [b'\x00\x20\x04\x07' + signing_key, b'\x00\x00\x05\x04']) cert = Ed25519Certificate.parse(cert_bytes) self.assertEqual(Ed25519CertificateV1, type(cert)) @@ -54,7 +55,7 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(b'\x01' * ED25519_SIGNATURE_LENGTH, cert.signature) self.assertEqual([ - Ed25519Extension(type = 4, flags = [ExtensionFlag.AFFECTS_VALIDATION, ExtensionFlag.UNKNOWN], flag_int = 7, data = b'\x15\x12'), + Ed25519Extension(type = ExtensionType.HAS_SIGNING_KEY, flags = [ExtensionFlag.AFFECTS_VALIDATION, ExtensionFlag.UNKNOWN], flag_int = 7, data = signing_key), Ed25519Extension(type = 5, flags = [ExtensionFlag.UNKNOWN], flag_int = 4, data = b''), ], cert.extensions) @@ -92,6 +93,9 @@ class TestEd25519Certificate(unittest.TestCase): self.assert_raises(certificate(extension_data = [b'']), 'Ed25519 extension is missing header field data') self.assert_raises(certificate(extension_data = [b'\x50\x00\x00\x00\x15\x12']), "Ed25519 extension is truncated. It should have 20480 bytes of data but there's only 2.") + def test_truncated_signing_key(self): + self.assert_raises(certificate(extension_data = [b'\x00\x02\x04\x07\11\12']), "Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was 2.") + def test_extra_extension_data(self): self.assert_raises(certificate(extension_data = [b'\x00\x01\x00\x00\x15\x12']), "Ed25519 certificate had 1 bytes of unused extension data") diff --git a/test/unit/descriptor/server_descriptor.py b/test/unit/descriptor/server_descriptor.py index 5a1d94f..8af55c6 100644 --- a/test/unit/descriptor/server_descriptor.py +++ b/test/unit/descriptor/server_descriptor.py @@ -9,6 +9,7 @@ import tarfile import time import unittest +import stem.descriptor import stem.descriptor.server_descriptor import stem.exit_policy import stem.prereq

1 0

[stem/master] Unit tests for ed25519 crypto validation
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit ee2330f349d038e9961d7f9afa528dd6c890bf86 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Mar 29 19:43:57 2017 +0200 Unit tests for ed25519 crypto validation A server descriptor unit test indirectly provides some coverage, but adding three tests that specifically focus on the validate() method. Also adding some quick docs. --- stem/descriptor/certificate.py | 3 ++ test/unit/descriptor/certificate.py | 96 ++++++++++++++++++++++++++++++++++++- 2 files changed, 97 insertions(+), 2 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index bab0a44..d49df50 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -231,6 +231,9 @@ class Ed25519CertificateV1(Ed25519Certificate): # ed25519 signature validates descriptor content up until the signature itself + if b'router-sig-ed25519 ' not in descriptor_content: + raise ValueError("Descriptor doesn't have a router-sig-ed25519 entry.") + signed_content = descriptor_content[:descriptor_content.index(b'router-sig-ed25519 ') + 19] descriptor_sha256_digest = hashlib.sha256(ED25519_ROUTER_SIGNATURE_PREFIX + signed_content).digest() diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index f46965a..9226f30 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -12,6 +12,7 @@ import stem.prereq import test.runner from stem.descriptor.certificate import ED25519_SIGNATURE_LENGTH, CertType, ExtensionType, ExtensionFlag, Ed25519Certificate, Ed25519CertificateV1, Ed25519Extension +from test.unit.descriptor import get_resource ED25519_CERT = """ AQQABhtZAaW2GoBED1IjY3A6f6GNqBEl5A83fD2Za9upGke51JGqAQAgBABnprVR @@ -25,6 +26,14 @@ EXPECTED_SIGNATURE = '\xc6\x8e\xd3\xae\x0b?\xedJ6\xe2\xef\x95\xcf,\x18o%N<u\x83\ def certificate(version = 1, cert_type = 4, extension_data = []): + """ + Provides base64 encoded Ed25519 certifificate content. + + :param int version: certificate version + :param int cert_type: certificate type + :param list extension_data: extensions to embed within the certificate + """ + return base64.b64encode(''.join([ chr(version), chr(cert_type), @@ -41,6 +50,10 @@ class TestEd25519Certificate(unittest.TestCase): self.assertRaisesRegexp(ValueError, re.escape(exc_msg), Ed25519Certificate.parse, parse_arg) def test_basic_parsing(self): + """ + Parse a basic test certificate. + """ + signing_key = b'\x11' * 32 cert_bytes = certificate(extension_data = [b'\x00\x20\x04\x07' + signing_key, b'\x00\x00\x05\x04']) cert = Ed25519Certificate.parse(cert_bytes) @@ -63,6 +76,10 @@ class TestEd25519Certificate(unittest.TestCase): self.assertTrue(cert.is_expired()) def test_with_real_cert(self): + """ + Parse a certificate from a real server descriptor. + """ + cert = Ed25519Certificate.parse(ED25519_CERT) self.assertEqual(Ed25519CertificateV1, type(cert)) @@ -76,29 +93,104 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(EXPECTED_SIGNATURE, cert.signature) def test_non_base64(self): + """ + Parse data that isn't base64 encoded. + """ + self.assert_raises('\x02\x0323\x04', "Ed25519 certificate wasn't propoerly base64 encoded (Incorrect padding):") def test_too_short(self): + """ + Parse data that's too short to be a valid certificate. + """ + self.assert_raises('', "Ed25519 certificate wasn't propoerly base64 encoded (empty):") self.assert_raises('AQQABhtZAaW2GoBED1IjY3A6', 'Ed25519 certificate was 18 bytes, but should be at least 104') def test_with_invalid_version(self): + """ + We cannot support other certificate versions until they're documented. + Assert we raise if we don't handle a cert version yet. + """ + self.assert_raises(certificate(version = 2), 'Ed25519 certificate is version 2. Parser presently only supports version 1.') def test_with_invalid_cert_type(self): + """ + Provide an invalid certificate version. Tor specifies a couple ranges that + are reserved. + """ + self.assert_raises(certificate(cert_type = 0), 'Ed25519 certificate cannot have a type of 0. This is reserved to avoid conflicts with tor CERTS cells.') self.assert_raises(certificate(cert_type = 7), 'Ed25519 certificate cannot have a type of 7. This is reserved for RSA identity cross-certification.') def test_truncated_extension(self): + """ + Include an extension without as much data as it specifies. + """ + self.assert_raises(certificate(extension_data = [b'']), 'Ed25519 extension is missing header field data') self.assert_raises(certificate(extension_data = [b'\x50\x00\x00\x00\x15\x12']), "Ed25519 extension is truncated. It should have 20480 bytes of data but there's only 2.") + def test_extra_extension_data(self): + """ + Include an extension with more data than it specifies. + """ + + self.assert_raises(certificate(extension_data = [b'\x00\x01\x00\x00\x15\x12']), "Ed25519 certificate had 1 bytes of unused extension data") + def test_truncated_signing_key(self): + """ + Include an extension with an incorrect signing key size. + """ + self.assert_raises(certificate(extension_data = [b'\x00\x02\x04\x07\11\12']), "Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was 2.") - def test_extra_extension_data(self): - self.assert_raises(certificate(extension_data = [b'\x00\x01\x00\x00\x15\x12']), "Ed25519 certificate had 1 bytes of unused extension data") + def test_validation_with_descriptor_key(self): + """ + Validate a descriptor signature using the ed25519 master key within the + descriptor. + """ + + if not stem.prereq._is_pynacl_available(): + test.runner.skip(self, '(requires pynacl module)') + return + + with open(get_resource('server_descriptor_with_ed25519'), 'rb') as descriptor_file: + desc = next(stem.descriptor.parse_file(descriptor_file, validate = False)) + + desc.certificate.validate(desc) + + def test_validation_with_embedded_key(self): + """ + Validate a descriptor signature using the signing key within the ed25519 + certificate. + """ + + if not stem.prereq._is_pynacl_available(): + test.runner.skip(self, '(requires pynacl module)') + return + + with open(get_resource('server_descriptor_with_ed25519'), 'rb') as descriptor_file: + desc = next(stem.descriptor.parse_file(descriptor_file, validate = False)) + + desc.ed25519_master_key = None + desc.certificate.validate(desc) + + def test_validation_with_invalid_descriptor(self): + """ + Validate a descriptor without a valid signature. + """ + + if not stem.prereq._is_pynacl_available(): + test.runner.skip(self, '(requires pynacl module)') + return + + with open(get_resource('server_descriptor_with_ed25519'), 'rb') as descriptor_file: + desc = next(stem.descriptor.parse_file(descriptor_file, validate = False)) + cert = Ed25519Certificate.parse(certificate()) + self.assertRaisesRegexp(ValueError, re.escape('Ed25519KeyCertificate signing key is invalid (Signature was forged or corrupt)'), cert.validate, desc) class TestCertificate(unittest.TestCase):

1 0

[stem/master] Drop previous ed25519 certificate implementation
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit 000e48aa900e38994c3443773addd08017c3c91b Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Mar 30 04:18:34 2017 +0200 Drop previous ed25519 certificate implementation Now that we support everything it did time to drop the prior implementation. --- stem/descriptor/certificate.py | 256 ++++-------------------------------- test/unit/descriptor/certificate.py | 65 --------- 2 files changed, 24 insertions(+), 297 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index d49df50..4a279a3 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -13,8 +13,14 @@ used to validate the key used to sign server descriptors. :: Ed25519Certificate - Ed25519 signing key certificate + | +- Ed25519CertificateV1 - version 1 Ed25519 certificate + | |- is_expired - checks if certificate is presently expired + | +- validate - validates signature of a server descriptor + | +- parse - reads base64 encoded certificate data + Ed25519Extension - extension included within an Ed25519Certificate + .. data:: CertType (enum) Purpose of Ed25519 certificate. As new certificate versions are added this @@ -53,16 +59,30 @@ used to validate the key used to sign server descriptors. import base64 import collections import datetime +import hashlib -from stem.util import enum +import stem.prereq +import stem.util.enum +import stem.util.str_tools ED25519_HEADER_LENGTH = 40 ED25519_SIGNATURE_LENGTH = 64 ED25519_ROUTER_SIGNATURE_PREFIX = b'Tor router descriptor signature v1' -CertType = enum.UppercaseEnum('SIGNING', 'LINK_CERT', 'AUTH') -ExtensionType = enum.Enum(('HAS_SIGNING_KEY', 4),) -ExtensionFlag = enum.UppercaseEnum('AFFECTS_VALIDATION', 'UNKNOWN') +CertType = stem.util.enum.UppercaseEnum('SIGNING', 'LINK_CERT', 'AUTH') +ExtensionType = stem.util.enum.Enum(('HAS_SIGNING_KEY', 4),) +ExtensionFlag = stem.util.enum.UppercaseEnum('AFFECTS_VALIDATION', 'UNKNOWN') + + +class Ed25519Extension(collections.namedtuple('Ed25519Extension', ['type', 'flags', 'flag_int', 'data'])): + """ + Extension within an Ed25519 certificate. + + :var int type: extension type + :var list flags: extension attribute flags + :var int flag_int: integer encoding of the extension attribute flags + :var bytes data: data the extension concerns + """ class Ed25519Certificate(object): @@ -245,231 +265,3 @@ class Ed25519CertificateV1(Ed25519Certificate): verify_key.verify(descriptor_sha256_digest, signature_bytes) except BadSignatureError as exc: raise ValueError('Descriptor Ed25519 certificate signature invalid (%s)' % exc) - - -class Ed25519Extension(collections.namedtuple('Ed25519Extension', ['type', 'flags', 'flag_int', 'data'])): - """ - Extension within an Ed25519 certificate. - - :var int type: extension type - :var list flags: extension attribute flags - :var int flag_int: integer encoding of the extension attribute flags - :var bytes data: data the extension concerns - """ - - - - - - - -""" -Certificates can optionally contain CertificateExtension objects depending on -their type and purpose. Currently Ed25519KeyCertificate certificates will -contain one SignedWithEd25519KeyCertificateExtension. - - Certificate - Tor Certificate - +- Ed25519KeyCertificate - Certificate for Ed25519 signing key - +- verify_descriptor_signature - verify a relay descriptor against a signature - - CertificateExtension - Certificate extension - +- SignedWithEd25519KeyCertificateExtension - Ed25519 signing key extension -""" - -import binascii -import hashlib -import time - -import stem.prereq -import stem.util.str_tools - -try: - # added in python 2.7 - from collections import OrderedDict -except ImportError: - from stem.util.ordereddict import OrderedDict - -SIGNATURE_LENGTH = 64 -STANDARD_ATTRIBUTES_LENGTH = 40 -CERTIFICATE_FLAGS_LENGTH = 4 -ED25519_ROUTER_SIGNATURE_PREFIX = b'Tor router descriptor signature v1' - - -def _parse_long_offset(offset, length): - def _parse(raw_contents): - return stem.util.str_tools._to_int(raw_contents[offset:(offset + length)]) - - return _parse - - -def _parse_offset(offset, length): - def _parse(raw_contents): - return raw_contents[offset:(offset + length)] - - return _parse - - -def _parse_certificate(raw_contents, master_key_bytes, validate = False): - version = raw_contents[0:1] - cert_type = raw_contents[1:2] - - if version == b'\x01': - if cert_type == b'\x04': - return Ed25519KeyCertificate(raw_contents, master_key_bytes, validate = validate) - elif cert_type == b'\x05': - # TLS link certificated signed with ed25519 signing key - pass - elif cert_type == b'\x06': - # Ed25519 authentication signed with ed25519 signing key - pass - else: - raise ValueError('Unknown Certificate type %s' % binascii.hexlify(cert_type)) - else: - raise ValueError('Unknown Certificate version %s' % binascii.hexlify(version)) - - -def _parse_extensions(raw_contents): - n_extensions = stem.util.str_tools._to_int(raw_contents[39:40]) - - if n_extensions == 0: - return [] - - extensions = [] - extension_bytes = raw_contents[STANDARD_ATTRIBUTES_LENGTH:-SIGNATURE_LENGTH] - - while len(extension_bytes) > 0: - ext_length = stem.util.str_tools._to_int(extension_bytes[0:2]) - ext_type = extension_bytes[2:3] - ext_flags = extension_bytes[3:CERTIFICATE_FLAGS_LENGTH] - ext_data = extension_bytes[CERTIFICATE_FLAGS_LENGTH:(CERTIFICATE_FLAGS_LENGTH + ext_length)] - if len(ext_type) == 0 or len(ext_flags) == 0 or len(ext_data) == 0: - raise ValueError('Certificate contained truncated extension') - - if ext_type == SignedWithEd25519KeyCertificateExtension.TYPE: - extension = SignedWithEd25519KeyCertificateExtension(ext_type, ext_flags, ext_data) - else: - raise ValueError('Invalid certificate extension type: %s' % binascii.hexlify(ext_type)) - - extensions.append(extension) - extension_bytes = extension_bytes[CERTIFICATE_FLAGS_LENGTH + ext_length:] - - if len(extensions) != n_extensions: - raise ValueError('n_extensions was %d but parsed %d' % (n_extensions, len(extensions))) - - return extensions - - -def _parse_signature(cert): - return cert[-SIGNATURE_LENGTH:] - - -class Certificate(object): - """ - See proposal #220 <https://gitweb.torproject.org/torspec.git/tree/proposals/220-ecc-id-keys.txt> - """ - - ATTRIBUTES = { - 'version': _parse_offset(0, 1), - 'cert_type': _parse_offset(1, 1), - 'expiration_date': _parse_long_offset(2, 4), - 'cert_key_type': _parse_offset(6, 1), - 'certified_key': _parse_offset(7, 32), - 'n_extensions': _parse_long_offset(39, 1), - 'extensions': _parse_extensions, - 'signature': _parse_signature - } - - def __init__(self, raw_contents, identity_key, validate = False): - self.certificate_bytes = raw_contents - - if type(identity_key) == bytes: - self.identity_key = stem.util.str_tools._to_unicode(identity_key) - else: - self.identity_key = identity_key - - self.__set_certificate_entries(raw_contents) - - def __set_certificate_entries(self, raw_contents): - entries = OrderedDict() - for key, func in Certificate.ATTRIBUTES.items(): - try: - entries[key] = func(raw_contents) - except IndexError: - raise ValueError('Unable to get bytes for %s from certificate' % key) - - for key, value in entries.items(): - setattr(self, key, value) - - -class Ed25519KeyCertificate(Certificate): - def __init__(self, raw_contents, identity_key, validate = False): - super(Ed25519KeyCertificate, self).__init__(raw_contents, identity_key, validate = False) - - if validate: - if len(self.extensions) == 0: - raise ValueError('Ed25519KeyCertificate missing SignedWithEd25519KeyCertificateExtension extension') - - self._verify_signature() - - if (self.expiration_date * 3600) < int(time.time()): - raise ValueError('Expired Ed25519KeyCertificate') - - def verify_descriptor_signature(self, descriptor, signature): - if not stem.prereq._is_pynacl_available(): - raise ValueError('Certificate validation requires the pynacl module') - - import nacl.signing - from nacl.exceptions import BadSignatureError - - missing_padding = len(signature) % 4 - signature_bytes = base64.b64decode(stem.util.str_tools._to_bytes(signature) + b'=' * missing_padding) - verify_key = nacl.signing.VerifyKey(self.certified_key) - - signed_part = descriptor[:descriptor.index(b'router-sig-ed25519 ') + len('router-sig-ed25519 ')] - descriptor_with_prefix = ED25519_ROUTER_SIGNATURE_PREFIX + signed_part - descriptor_sha256_digest = hashlib.sha256(descriptor_with_prefix).digest() - - try: - verify_key.verify(descriptor_sha256_digest, signature_bytes) - except BadSignatureError: - raise ValueError('Descriptor Ed25519 certificate signature invalid') - - def _verify_signature(self): - if not stem.prereq._is_pynacl_available(): - raise ValueError('Certificate validation requires the pynacl module') - - import nacl.signing - import nacl.encoding - from nacl.exceptions import BadSignatureError - - if self.identity_key: - verify_key = nacl.signing.VerifyKey(self.identity_key + '=', encoder=nacl.encoding.Base64Encoder) - else: - verify_key = nacl.singing.VerifyKey(self.extensions[0].ext_data) - - try: - verify_key.verify(self.certificate_bytes[:-SIGNATURE_LENGTH], self.signature) - except BadSignatureError: - raise ValueError('Ed25519KeyCertificate signature invalid') - - -class CertificateExtension(object): - KNOWN_TYPES = [b'\x04'] - - def __init__(self, ext_type, ext_flags, ext_data): - self.ext_type = ext_type - self.ext_flags = ext_flags - self.ext_data = ext_data - - def is_known_type(self): - return self.ext_type in CertificateExtension.KNOWN_TYPES - - def affects_validation(self): - return self.ext_flags == b'\x01' - - -class SignedWithEd25519KeyCertificateExtension(CertificateExtension): - TYPE = b'\x04' - - def __init__(self, ext_type, ext_flags, ext_data): - super(SignedWithEd25519KeyCertificateExtension, self).__init__(ext_type, ext_flags, ext_data) diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index 9226f30..6cbc3b2 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -191,68 +191,3 @@ class TestEd25519Certificate(unittest.TestCase): cert = Ed25519Certificate.parse(certificate()) self.assertRaisesRegexp(ValueError, re.escape('Ed25519KeyCertificate signing key is invalid (Signature was forged or corrupt)'), cert.validate, desc) - - -class TestCertificate(unittest.TestCase): - def test_with_invalid_version(self): - cert_bytes = b'\x02\x04' - self.assertRaisesRegexp(ValueError, 'Unknown Certificate version', stem.descriptor.certificate._parse_certificate, cert_bytes, None) - - def test_with_invalid_type(self): - cert_bytes = b'\x01\x07' - self.assertRaisesRegexp(ValueError, 'Unknown Certificate type', stem.descriptor.certificate._parse_certificate, cert_bytes, None) - - def test_parse_extensions_truncated_extension(self): - cert_bytes = b'\x00' * 39 # First 40 bytes are standard fields - cert_bytes += b'\x01' # n_extensions = 1 - cert_bytes += b'\x00\x08' # extension length = 8 bytes - cert_bytes += b'\x04' # ext_type = 0x04 - cert_bytes += stem.descriptor.certificate.SIGNATURE_LENGTH * b'\x00' # pad empty signature block - - self.assertRaisesRegexp(ValueError, 'Certificate contained truncated extension', stem.descriptor.certificate._parse_extensions, cert_bytes) - - def test_parse_extensions_invalid_certificate_extension_type(self): - cert_bytes = b'\x00' * 39 # First 40 bytes are standard fields - cert_bytes += b'\x01' # n_extensions = 1 - cert_bytes += b'\x00\x08' # extension length = 8 bytes - cert_bytes += b'\x00' * 6 # pad out to 8 bytes - cert_bytes += stem.descriptor.certificate.SIGNATURE_LENGTH * b'\x00' # pad empty signature block - - self.assertRaisesRegexp(ValueError, 'Invalid certificate extension type:', stem.descriptor.certificate._parse_extensions, cert_bytes) - - def test_parse_extensions_invalid_n_extensions_count(self): - cert_bytes = b'\x00' * 39 # First 40 bytes are standard fields - cert_bytes += b'\x02' # n_extensions = 2 - cert_bytes += b'\x00\x08' # extension length = 8 bytes - cert_bytes += b'\x04' # certificate type - cert_bytes += b'\x00' * 5 # pad out to 8 bytes - cert_bytes += stem.descriptor.certificate.SIGNATURE_LENGTH * b'\x00' # pad empty signature block - - self.assertRaisesRegexp(ValueError, 'n_extensions was 2 but parsed 1', stem.descriptor.certificate._parse_extensions, cert_bytes) - - def test_ed25519_key_certificate_without_extensions(self): - cert_bytes = b'\x01\x04' + b'\x00' * 37 # First 40 bytes are standard fields - cert_bytes += b'\x00' # n_extensions = 0 - cert_bytes += stem.descriptor.certificate.SIGNATURE_LENGTH * b'\x00' # pad empty signature block - - exc_msg = 'Ed25519KeyCertificate missing SignedWithEd25519KeyCertificateExtension extension' - self.assertRaisesRegexp(ValueError, exc_msg, stem.descriptor.certificate._parse_certificate, cert_bytes, None, validate = True) - - def test_certificate_with_invalid_signature(self): - if not stem.prereq._is_pynacl_available(): - test.runner.skip(self, '(requires pynacl module)') - return - - import nacl.signing - import nacl.encoding - - master_key = nacl.signing.SigningKey.generate() - master_key_base64 = master_key.encode(nacl.encoding.Base64Encoder) - - cert_bytes = b'\x01\x04' + b'\x00' * 37 # 40 byte preamble of standard fields - cert_bytes += b'\x01' # n_extensions = 1 - cert_bytes += b'\x00\x08' # extentsion length = 8 bytes - cert_bytes += b'\x04' + b'\x00' * 5 # certificate type + padding out to 8 bytes - cert_bytes += stem.descriptor.certificate.SIGNATURE_LENGTH * b'\x00' # empty signature block - - self.assertRaisesRegexp(ValueError, 'Ed25519KeyCertificate signature invalid', stem.descriptor.certificate._parse_certificate, cert_bytes, master_key_base64, validate = True)

1 0

[stem/master] Use UTC timestamp for expiration timestamp
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit 5b730b96e1e7354cf09861b24581df1e3b4a0881 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Mar 29 20:17:30 2017 -0700 Use UTC timestamp for expiration timestamp Oops, don't want this to be local time. Found when unit tests failed on a system with a different timezone. --- stem/descriptor/certificate.py | 2 +- test/unit/descriptor/certificate.py | 4 ++-- test/unit/descriptor/server_descriptor.py | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index 4a279a3..d9a36f3 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -161,7 +161,7 @@ class Ed25519CertificateV1(Ed25519Certificate): raise ValueError("BUG: Ed25519 certificate type is decoded from one byte. It shouldn't be possible to have a value of %i." % cert_type) # expiration time is in hours since epoch - self.expiration = datetime.datetime.fromtimestamp(stem.util.str_tools._to_int(decoded[2:6]) * 3600) + self.expiration = datetime.datetime.utcfromtimestamp(stem.util.str_tools._to_int(decoded[2:6]) * 3600) self.key_type = stem.util.str_tools._to_int(decoded[6]) self.key = decoded[7:39] diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index 6cbc3b2..a3bea04 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -62,7 +62,7 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(1, cert.version) self.assertEqual(cert_bytes, cert.encoded) self.assertEqual(CertType.SIGNING, cert.type) - self.assertEqual(datetime.datetime(1970, 1, 1, 1, 0), cert.expiration) + self.assertEqual(datetime.datetime(1970, 1, 1, 0, 0), cert.expiration) self.assertEqual(1, cert.key_type) self.assertEqual(b'\x03' * 32, cert.key) self.assertEqual(b'\x01' * ED25519_SIGNATURE_LENGTH, cert.signature) @@ -86,7 +86,7 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(1, cert.version) self.assertEqual(ED25519_CERT, cert.encoded) self.assertEqual(CertType.SIGNING, cert.type) - self.assertEqual(datetime.datetime(2015, 8, 28, 19, 0), cert.expiration) + self.assertEqual(datetime.datetime(2015, 8, 28, 17, 0), cert.expiration) self.assertEqual(1, cert.key_type) self.assertEqual(EXPECTED_CERT_KEY, cert.key) self.assertEqual([Ed25519Extension(type = 4, flags = [], flag_int = 0, data = EXPECTED_EXTENSION_DATA)], cert.extensions) diff --git a/test/unit/descriptor/server_descriptor.py b/test/unit/descriptor/server_descriptor.py index 8af55c6..38dcdce 100644 --- a/test/unit/descriptor/server_descriptor.py +++ b/test/unit/descriptor/server_descriptor.py @@ -268,7 +268,7 @@ Qlx9HNCqCY877ztFRC624ja2ql6A2hBcuoYMbkHjcQ4= self.assertEqual(1, desc.certificate.version) self.assertEqual(CertType.SIGNING, desc.certificate.type) - self.assertEqual(datetime.datetime(2015, 8, 28, 19, 0, 0), desc.certificate.expiration) + self.assertEqual(datetime.datetime(2015, 8, 28, 17, 0, 0), desc.certificate.expiration) self.assertEqual(1, desc.certificate.key_type) self.assertTrue(desc.certificate.key.startswith('\xa5\xb6\x1a\x80D\x0f')) self.assertTrue(desc.certificate.signature.startswith('\xc6\x8e\xd3\xae\x0b'))

1 0

[stem/master] Python3 support for ed25519
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit 7bac71f5952a36ba4a2dffcc20c7a79f4fb7d7be Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Mar 29 20:57:31 2017 -0700 Python3 support for ed25519 Handful of tweaks to get this working with python3. --- stem/descriptor/certificate.py | 21 +++++++++++---------- stem/descriptor/server_descriptor.py | 2 +- test/unit/descriptor/certificate.py | 15 ++++++++------- test/unit/descriptor/server_descriptor.py | 6 +++--- 4 files changed, 23 insertions(+), 21 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index d9a36f3..cd7710c 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -57,6 +57,7 @@ used to validate the key used to sign server descriptors. """ import base64 +import binascii import collections import datetime import hashlib @@ -111,14 +112,14 @@ class Ed25519Certificate(object): """ try: - decoded = base64.b64decode(content) + decoded = base64.b64decode(stem.util.str_tools._to_bytes(content)) if not decoded: raise TypeError('empty') - except TypeError as exc: + except (TypeError, binascii.Error) as exc: raise ValueError("Ed25519 certificate wasn't propoerly base64 encoded (%s):\n%s" % (exc, content)) - version = stem.util.str_tools._to_int(decoded[0]) + version = stem.util.str_tools._to_int(decoded[0:1]) if version == 1: return Ed25519CertificateV1(version, content, decoded) @@ -145,7 +146,7 @@ class Ed25519CertificateV1(Ed25519Certificate): if len(decoded) < ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH: raise ValueError('Ed25519 certificate was %i bytes, but should be at least %i' % (len(decoded), ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH)) - cert_type = stem.util.str_tools._to_int(decoded[1]) + cert_type = stem.util.str_tools._to_int(decoded[1:2]) if cert_type in (0, 1, 2, 3): raise ValueError('Ed25519 certificate cannot have a type of %i. This is reserved to avoid conflicts with tor CERTS cells.' % cert_type) @@ -163,12 +164,12 @@ class Ed25519CertificateV1(Ed25519Certificate): # expiration time is in hours since epoch self.expiration = datetime.datetime.utcfromtimestamp(stem.util.str_tools._to_int(decoded[2:6]) * 3600) - self.key_type = stem.util.str_tools._to_int(decoded[6]) + self.key_type = stem.util.str_tools._to_int(decoded[6:7]) self.key = decoded[7:39] self.signature = decoded[-ED25519_SIGNATURE_LENGTH:] self.extensions = [] - extension_count = stem.util.str_tools._to_int(decoded[39]) + extension_count = stem.util.str_tools._to_int(decoded[39:40]) remaining_data = decoded[40:-ED25519_SIGNATURE_LENGTH] for i in range(extension_count): @@ -176,8 +177,8 @@ class Ed25519CertificateV1(Ed25519Certificate): raise ValueError('Ed25519 extension is missing header field data') extension_length = stem.util.str_tools._to_int(remaining_data[:2]) - extension_type = stem.util.str_tools._to_int(remaining_data[2]) - extension_flags = stem.util.str_tools._to_int(remaining_data[3]) + extension_type = stem.util.str_tools._to_int(remaining_data[2:3]) + extension_flags = stem.util.str_tools._to_int(remaining_data[3:4]) extension_data = remaining_data[4:4 + extension_length] if extension_length != len(extension_data): @@ -234,7 +235,7 @@ class Ed25519CertificateV1(Ed25519Certificate): signing_key = None if server_descriptor.ed25519_master_key: - signing_key = nacl.signing.VerifyKey(server_descriptor.ed25519_master_key + '=', encoder = nacl.encoding.Base64Encoder) + signing_key = nacl.signing.VerifyKey(stem.util.str_tools._to_bytes(server_descriptor.ed25519_master_key) + b'=', encoder = nacl.encoding.Base64Encoder) else: for extension in self.extensions: if extension.type == ExtensionType.HAS_SIGNING_KEY: @@ -245,7 +246,7 @@ class Ed25519CertificateV1(Ed25519Certificate): raise ValueError('Server descriptor missing an ed25519 signing key') try: - signing_key.verify(base64.b64decode(self.encoded)[:-ED25519_SIGNATURE_LENGTH], self.signature) + signing_key.verify(base64.b64decode(stem.util.str_tools._to_bytes(self.encoded))[:-ED25519_SIGNATURE_LENGTH], self.signature) except BadSignatureError as exc: raise ValueError('Ed25519KeyCertificate signing key is invalid (%s)' % exc) diff --git a/stem/descriptor/server_descriptor.py b/stem/descriptor/server_descriptor.py index 35b1303..1cedbe5 100644 --- a/stem/descriptor/server_descriptor.py +++ b/stem/descriptor/server_descriptor.py @@ -811,7 +811,7 @@ class RelayDescriptor(ServerDescriptor): """ signing_key_digest = hashlib.sha1(_bytes_for_block(self.signing_key)).digest() - data = signing_key_digest + base64.b64decode(self.ed25519_master_key + '=') + data = signing_key_digest + base64.b64decode(stem.util.str_tools._to_bytes(self.ed25519_master_key) + b'=') return stem.util.str_tools._to_unicode(binascii.hexlify(data).upper()) def _compare(self, other, method): diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index a3bea04..669d9ad 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -8,6 +8,7 @@ import re import unittest import stem.descriptor.certificate +import stem.util.str_tools import stem.prereq import test.runner @@ -20,9 +21,9 @@ ptIr43bWPo2fIzo3uOywfoMrryprpbm4HhCkZMaO064LP+1KNuLvlc8sGG8lTjx1 g4k3ELuWYgHYWU5rAia7nl4gUfBZOEfHAfKES7l3d63dBEjEX98Ljhdp2w4= """.strip() -EXPECTED_CERT_KEY = '\xa5\xb6\x1a\x80D\x0fR#cp:\x7f\xa1\x8d\xa8\x11%\xe4\x0f7|=\x99k\xdb\xa9\x1aG\xb9\xd4\x91\xaa' -EXPECTED_EXTENSION_DATA = 'g\xa6\xb5Q\xa6\xd2+\xe3v\xd6>\x8d\x9f#:7\xb8\xec\xb0~\x83+\xaf*k\xa5\xb9\xb8\x1e\x10\xa4d' -EXPECTED_SIGNATURE = '\xc6\x8e\xd3\xae\x0b?\xedJ6\xe2\xef\x95\xcf,\x18o%N<u\x83\x897\x10\xbb\x96b\x01\xd8YNk\x02&\xbb\x9e^ Q\xf0Y8G\xc7\x01\xf2\x84K\xb9ww\xad\xdd\x04H\xc4_\xdf\x0b\x8e\x17i\xdb\x0e' +EXPECTED_CERT_KEY = b'\xa5\xb6\x1a\x80D\x0fR#cp:\x7f\xa1\x8d\xa8\x11%\xe4\x0f7|=\x99k\xdb\xa9\x1aG\xb9\xd4\x91\xaa' +EXPECTED_EXTENSION_DATA = b'g\xa6\xb5Q\xa6\xd2+\xe3v\xd6>\x8d\x9f#:7\xb8\xec\xb0~\x83+\xaf*k\xa5\xb9\xb8\x1e\x10\xa4d' +EXPECTED_SIGNATURE = b'\xc6\x8e\xd3\xae\x0b?\xedJ6\xe2\xef\x95\xcf,\x18o%N<u\x83\x897\x10\xbb\x96b\x01\xd8YNk\x02&\xbb\x9e^ Q\xf0Y8G\xc7\x01\xf2\x84K\xb9ww\xad\xdd\x04H\xc4_\xdf\x0b\x8e\x17i\xdb\x0e' def certificate(version = 1, cert_type = 4, extension_data = []): @@ -34,13 +35,13 @@ def certificate(version = 1, cert_type = 4, extension_data = []): :param list extension_data: extensions to embed within the certificate """ - return base64.b64encode(''.join([ - chr(version), - chr(cert_type), + return base64.b64encode(b''.join([ + stem.util.str_tools._to_bytes(chr(version)), + stem.util.str_tools._to_bytes(chr(cert_type)), b'\x00' * 4, # expiration date, leaving this as the epoch b'\x01', # key type b'\x03' * 32, # key - chr(len(extension_data)), # extension count + stem.util.str_tools._to_bytes(chr(len(extension_data))), # extension count b''.join(extension_data), b'\x01' * ED25519_SIGNATURE_LENGTH])) diff --git a/test/unit/descriptor/server_descriptor.py b/test/unit/descriptor/server_descriptor.py index 38dcdce..42fa392 100644 --- a/test/unit/descriptor/server_descriptor.py +++ b/test/unit/descriptor/server_descriptor.py @@ -270,8 +270,8 @@ Qlx9HNCqCY877ztFRC624ja2ql6A2hBcuoYMbkHjcQ4= self.assertEqual(CertType.SIGNING, desc.certificate.type) self.assertEqual(datetime.datetime(2015, 8, 28, 17, 0, 0), desc.certificate.expiration) self.assertEqual(1, desc.certificate.key_type) - self.assertTrue(desc.certificate.key.startswith('\xa5\xb6\x1a\x80D\x0f')) - self.assertTrue(desc.certificate.signature.startswith('\xc6\x8e\xd3\xae\x0b')) + self.assertTrue(desc.certificate.key.startswith(b'\xa5\xb6\x1a\x80D\x0f')) + self.assertTrue(desc.certificate.signature.startswith(b'\xc6\x8e\xd3\xae\x0b')) self.assertEqual(1, len(desc.certificate.extensions)) self.assertTrue('bWPo2fIzo3uOywfoM' in desc.certificate.encoded) @@ -279,7 +279,7 @@ Qlx9HNCqCY877ztFRC624ja2ql6A2hBcuoYMbkHjcQ4= self.assertEqual(ExtensionType.HAS_SIGNING_KEY, extension.type) self.assertEqual([], extension.flags) self.assertEqual(0, extension.flag_int) - self.assertTrue(extension.data.startswith('g\xa6\xb5Q\xa6\xd2')) + self.assertTrue(extension.data.startswith(b'g\xa6\xb5Q\xa6\xd2')) self.assertEqual('destiny', desc.nickname) self.assertEqual('F65E0196C94DFFF48AFBF2F5F9E3E19AAE583FD0', desc.fingerprint)

1 0

[stem/master] Support Ed25519 certificates
by atagar＠torproject.org 30 Mar '17

30 Mar '17

commit 727e14b9570ce3881228503ee04ace491de62009 Merge: 67252eb db601c3 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Mar 29 21:21:02 2017 -0700 Support Ed25519 certificates Parsing and validation of server descriptors via their ed25519 certificate. Validation requires pynacl to do the cryptographic checks (if not present they're skipped)... https://trac.torproject.org/projects/tor/ticket/21558 https://gitweb.torproject.org/torspec.git/tree/cert-spec.txt docs/api.rst | 1 + docs/api/descriptor/certificate.rst | 5 + docs/change_log.rst | 1 + docs/contents.rst | 1 + docs/faq.rst | 18 +- requirements.txt | 1 + run_tests.py | 1 + stem/descriptor/certificate.py | 268 ++++++++++++++++++++++ stem/descriptor/hidden_service_descriptor.py | 2 +- stem/descriptor/router_status_entry.py | 2 +- stem/descriptor/server_descriptor.py | 56 ++++- stem/prereq.py | 21 ++ stem/response/authchallenge.py | 4 +- stem/util/str_tools.py | 16 ++ stem/util/test_tools.py | 12 + test/integ/control/controller.py | 24 +- test/integ/process.py | 23 +- test/integ/util/system.py | 6 +- test/settings.cfg | 5 + test/unit/control/controller.py | 15 +- test/unit/descriptor/certificate.py | 194 ++++++++++++++++ test/unit/descriptor/extrainfo_descriptor.py | 10 +- test/unit/descriptor/microdescriptor.py | 7 +- test/unit/descriptor/networkstatus/document_v3.py | 9 +- test/unit/descriptor/server_descriptor.py | 44 +++- test/unit/manual.py | 43 ++-- test/unit/response/add_onion.py | 16 +- test/unit/util/proc.py | 9 +- test/unit/util/str_tools.py | 17 ++ test/util.py | 13 +- 30 files changed, 712 insertions(+), 132 deletions(-)

1 0