tor-commits November 2019

tor-commits@lists.torproject.org

20 participants
2923 discussions

[stem/master] Parse Ed25519CertificateV1 using Size class
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 492e3cf3f24be483aeb409f3ee46e9f54bef4c9d Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Oct 23 14:59:06 2019 -0700 Parse Ed25519CertificateV1 using Size class Our stem.client.datatype's packing/unpacking is considerably more readable than what I implemented here. We need packing support anyway, so modeling unpacking after the datatype module's pattern. --- stem/descriptor/certificate.py | 65 ++++++++++++++++++------------------- test/unit/descriptor/certificate.py | 30 ++++++++--------- 2 files changed, 46 insertions(+), 49 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index ba2d1d55..92f75719 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -83,13 +83,14 @@ import stem.prereq import stem.util.enum import stem.util.str_tools -from stem.client.datatype import Size +from stem.client.datatype import Size, split # TODO: Importing under an alternate name until we can deprecate our redundant # CertType enum in Stem 2.x. from stem.client.datatype import CertType as ClientCertType +ED25519_KEY_LENGTH = 32 ED25519_HEADER_LENGTH = 40 ED25519_SIGNATURE_LENGTH = 64 @@ -223,6 +224,13 @@ class Ed25519CertificateV1(Ed25519Certificate): self.extensions = extensions self.signature = signature + if self.type in (ClientCertType.LINK, ClientCertType.IDENTITY, ClientCertType.AUTHENTICATE): + raise ValueError('Ed25519 certificate cannot have a type of %i. This is reserved for CERTS cells.' % self.type_int) + elif self.type == ClientCertType.ED25519_IDENTITY: + raise ValueError('Ed25519 certificate cannot have a type of 7. This is reserved for RSA identity cross-certification.') + elif self.type == ClientCertType.UNKNOWN: + raise ValueError('Ed25519 certificate type %i is unrecognized' % self.type_int) + def to_base64(self, pem = False): if pem: return '-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % self.encoded @@ -247,40 +255,33 @@ class Ed25519CertificateV1(Ed25519Certificate): if len(decoded) < ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH: raise ValueError('Ed25519 certificate was %i bytes, but should be at least %i' % (len(decoded), ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH)) - type_enum, type_int = ClientCertType.get(stem.util.str_tools._to_int(decoded[1:2])) - - if type_enum in (ClientCertType.LINK, ClientCertType.IDENTITY, ClientCertType.AUTHENTICATE): - raise ValueError('Ed25519 certificate cannot have a type of %i. This is reserved for CERTS cells.' % type_int) - elif type_enum == ClientCertType.ED25519_IDENTITY: - raise ValueError('Ed25519 certificate cannot have a type of 7. This is reserved for RSA identity cross-certification.') - elif type_enum == ClientCertType.UNKNOWN: - raise ValueError('Ed25519 certificate type %i is unrecognized' % type_int) + header, signature = split(decoded, len(decoded) - ED25519_SIGNATURE_LENGTH) - # expiration time is in hours since epoch - try: - expiration = datetime.datetime.utcfromtimestamp(stem.util.str_tools._to_int(decoded[2:6]) * 3600) - except ValueError as exc: - raise ValueError('Invalid expiration timestamp (%s): %s' % (exc, stem.util.str_tools._to_int(decoded[2:6]) * 3600)) + version, header = Size.CHAR.pop(header) + cert_type, header = Size.CHAR.pop(header) + expiration_hours, header = Size.LONG.pop(header) + key_type, header = Size.CHAR.pop(header) + key, header = split(header, ED25519_KEY_LENGTH) + extension_count, extension_data = Size.CHAR.pop(header) - key_type = stem.util.str_tools._to_int(decoded[6:7]) - key = decoded[7:39] - signature = decoded[-ED25519_SIGNATURE_LENGTH:] + if version != 1: + raise ValueError('Ed25519 v1 parser cannot read version %i certificates' % version) extensions = [] - extension_count = stem.util.str_tools._to_int(decoded[39:40]) - remaining_data = decoded[40:-ED25519_SIGNATURE_LENGTH] for i in range(extension_count): - if len(remaining_data) < 4: + if len(extension_data) < 4: raise ValueError('Ed25519 extension is missing header field data') - extension_length = stem.util.str_tools._to_int(remaining_data[:2]) - extension_type = stem.util.str_tools._to_int(remaining_data[2:3]) - extension_flags = stem.util.str_tools._to_int(remaining_data[3:4]) - extension_data = remaining_data[4:4 + extension_length] + extension_length, extension_data = Size.SHORT.pop(extension_data) + extension_type, extension_data = Size.CHAR.pop(extension_data) + extension_flags, extension_data = Size.CHAR.pop(extension_data) + extension_value, extension_data = split(extension_data, extension_length) - if extension_length != len(extension_data): - raise ValueError("Ed25519 extension is truncated. It should have %i bytes of data but there's only %i." % (extension_length, len(extension_data))) + if extension_length != len(extension_value): + raise ValueError("Ed25519 extension is truncated. It should have %i bytes of data but there's only %i." % (extension_length, len(extension_value))) + elif extension_type == ExtensionType.HAS_SIGNING_KEY and len(extension_value) != 32: + raise ValueError('Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was %i.' % len(extension_value)) flags, remaining_flags = [], extension_flags @@ -291,16 +292,12 @@ class Ed25519CertificateV1(Ed25519Certificate): if remaining_flags: flags.append(ExtensionFlag.UNKNOWN) - if extension_type == ExtensionType.HAS_SIGNING_KEY and len(extension_data) != 32: - raise ValueError('Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was %i.' % len(extension_data)) - - extensions.append(Ed25519Extension(extension_type, flags, extension_flags, extension_data)) - remaining_data = remaining_data[4 + extension_length:] + extensions.append(Ed25519Extension(extension_type, flags, extension_flags, extension_value)) - if remaining_data: - raise ValueError('Ed25519 certificate had %i bytes of unused extension data' % len(remaining_data)) + if extension_data: + raise ValueError('Ed25519 certificate had %i bytes of unused extension data' % len(extension_data)) - instance = Ed25519CertificateV1(type_int, expiration, key_type, key, extensions, signature) + instance = Ed25519CertificateV1(cert_type, datetime.datetime.utcfromtimestamp(expiration_hours * 3600), key_type, key, extensions, signature) instance.encoded = content return instance diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index 26e091c1..7fd5e731 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -57,7 +57,7 @@ class TestEd25519Certificate(unittest.TestCase): signing_key = b'\x11' * 32 cert_bytes = certificate(extension_data = [b'\x00\x20\x04\x07' + signing_key, b'\x00\x00\x05\x04']) - cert = Ed25519Certificate.parse(cert_bytes) + cert = Ed25519Certificate.from_base64(cert_bytes) self.assertEqual(Ed25519CertificateV1, type(cert)) self.assertEqual(1, cert.version) @@ -81,7 +81,7 @@ class TestEd25519Certificate(unittest.TestCase): Parse a certificate from a real server descriptor. """ - cert = Ed25519Certificate.parse(ED25519_CERT) + cert = Ed25519Certificate.from_base64(ED25519_CERT) self.assertEqual(Ed25519CertificateV1, type(cert)) self.assertEqual(1, cert.version) @@ -99,7 +99,7 @@ class TestEd25519Certificate(unittest.TestCase): """ exc_msg = re.escape("Ed25519 certificate wasn't propoerly base64 encoded (Incorrect padding):") - self.assertRaisesRegexp(ValueError, exc_msg, Ed25519Certificate.parse, '\x02\x0323\x04') + self.assertRaisesRegexp(ValueError, exc_msg, Ed25519Certificate.from_base64, '\x02\x0323\x04') def test_too_short(self): """ @@ -107,10 +107,10 @@ class TestEd25519Certificate(unittest.TestCase): """ exc_msg = "Ed25519 certificate wasn't propoerly base64 encoded (empty):" - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, '') + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, '') exc_msg = 'Ed25519 certificate was 18 bytes, but should be at least 104' - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, 'AQQABhtZAaW2GoBED1IjY3A6') + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, 'AQQABhtZAaW2GoBED1IjY3A6') def test_with_invalid_version(self): """ @@ -119,7 +119,7 @@ class TestEd25519Certificate(unittest.TestCase): """ exc_msg = 'Ed25519 certificate is version 2. Parser presently only supports version 1.' - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, certificate(version = 2)) + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, certificate(version = 2)) def test_with_invalid_cert_type(self): """ @@ -128,13 +128,13 @@ class TestEd25519Certificate(unittest.TestCase): """ exc_msg = 'Ed25519 certificate type 0 is unrecognized' - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, certificate(cert_type = 0)) + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, certificate(cert_type = 0)) exc_msg = 'Ed25519 certificate cannot have a type of 1. This is reserved for CERTS cells.' - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, certificate(cert_type = 1)) + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, certificate(cert_type = 1)) exc_msg = 'Ed25519 certificate cannot have a type of 7. This is reserved for RSA identity cross-certification.' - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, certificate(cert_type = 7)) + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, certificate(cert_type = 7)) def test_truncated_extension(self): """ @@ -142,10 +142,10 @@ class TestEd25519Certificate(unittest.TestCase): """ exc_msg = 'Ed25519 extension is missing header field data' - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, certificate(extension_data = [b''])) + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, certificate(extension_data = [b''])) exc_msg = "Ed25519 extension is truncated. It should have 20480 bytes of data but there's only 2." - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, certificate(extension_data = [b'\x50\x00\x00\x00\x15\x12'])) + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, certificate(extension_data = [b'\x50\x00\x00\x00\x15\x12'])) def test_extra_extension_data(self): """ @@ -153,7 +153,7 @@ class TestEd25519Certificate(unittest.TestCase): """ exc_msg = 'Ed25519 certificate had 1 bytes of unused extension data' - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, certificate(extension_data = [b'\x00\x01\x00\x00\x15\x12'])) + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, certificate(extension_data = [b'\x00\x01\x00\x00\x15\x12'])) def test_truncated_signing_key(self): """ @@ -161,7 +161,7 @@ class TestEd25519Certificate(unittest.TestCase): """ exc_msg = 'Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was 2.' - self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.parse, certificate(extension_data = [b'\x00\x02\x04\x07\11\12'])) + self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, certificate(extension_data = [b'\x00\x02\x04\x07\11\12'])) @test.require.ed25519_support def test_validation_with_descriptor_key(self): @@ -197,7 +197,7 @@ class TestEd25519Certificate(unittest.TestCase): with open(get_resource('server_descriptor_with_ed25519'), 'rb') as descriptor_file: desc = next(stem.descriptor.parse_file(descriptor_file, validate = False)) - cert = Ed25519Certificate.parse(certificate()) + cert = Ed25519Certificate.from_base64(certificate()) self.assertRaisesWith(ValueError, 'Ed25519KeyCertificate signing key is invalid (signature forged or corrupt)', cert.validate, desc) @test.require.ed25519_support @@ -219,7 +219,7 @@ class TestEd25519Certificate(unittest.TestCase): # base64 the cert since that's what the parsing func expects ed_cert_bytes_b64 = base64.b64encode(ed_cert_bytes) - ed_cert_parsed = stem.descriptor.certificate.Ed25519Certificate.parse(ed_cert_bytes_b64) + ed_cert_parsed = Ed25519Certificate.from_base64(ed_cert_bytes_b64) self.assertEqual(ed_cert_parsed.type, my_ed_cert.cert_type) self.assertEqual(ed_cert_parsed.expiration, my_ed_cert.expiration_date)

1 0

[stem/master] Convert Ed25519Extension to a field
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 064336ee318cd1e8201184400f04ad1af27ebe92 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Oct 23 15:23:42 2019 -0700 Convert Ed25519Extension to a field So much cleaner! Moving unpacking into this class simplifies Ed25519CertificateV1's from_base64(), and lays the groundwork for packing. --- stem/descriptor/certificate.py | 66 ++++++++++++++++++++++--------------- test/unit/descriptor/certificate.py | 10 +++--- 2 files changed, 44 insertions(+), 32 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index 92f75719..dcf0c227 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -72,7 +72,6 @@ used to for a variety of purposes... import base64 import binascii -import collections import datetime import hashlib import re @@ -83,7 +82,7 @@ import stem.prereq import stem.util.enum import stem.util.str_tools -from stem.client.datatype import Size, split +from stem.client.datatype import Field, Size, split # TODO: Importing under an alternate name until we can deprecate our redundant # CertType enum in Stem 2.x. @@ -107,16 +106,50 @@ ExtensionType = stem.util.enum.Enum(('HAS_SIGNING_KEY', 4),) ExtensionFlag = stem.util.enum.UppercaseEnum('AFFECTS_VALIDATION', 'UNKNOWN') -class Ed25519Extension(collections.namedtuple('Ed25519Extension', ['type', 'flags', 'flag_int', 'data'])): +class Ed25519Extension(Field): """ Extension within an Ed25519 certificate. - :var int type: extension type + :var stem.descriptor.certificate.ExtensionType type: extension type :var list flags: extension attribute flags :var int flag_int: integer encoding of the extension attribute flags :var bytes data: data the extension concerns """ + def __init__(self, ext_type, flag_val, data): + self.type = ext_type + self.flags = [] + self.flag_int = flag_val + self.data = data + + if flag_val % 2 == 1: + self.flags.append(ExtensionFlag.AFFECTS_VALIDATION) + flag_val -= 1 + + if flag_val: + self.flags.append(ExtensionFlag.UNKNOWN) + + if ext_type == ExtensionType.HAS_SIGNING_KEY and len(data) != 32: + raise ValueError('Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was %i.' % len(data)) + + @staticmethod + def pop(content): + if len(content) < 4: + raise ValueError('Ed25519 extension is missing header fields') + + data_size, content = Size.SHORT.pop(content) + ext_type, content = Size.CHAR.pop(content) + flags, content = Size.CHAR.pop(content) + data, content = split(content, data_size) + + if len(data) != data_size: + raise ValueError("Ed25519 extension is truncated. It should have %i bytes of data but there's only %i." % (data_size, len(data))) + + return Ed25519Extension(ext_type, flags, data), content + + def __hash__(self): + return stem.util._hash_attr(self, 'type', 'flag_int', 'data', cache = True) + class Ed25519Certificate(object): """ @@ -270,29 +303,8 @@ class Ed25519CertificateV1(Ed25519Certificate): extensions = [] for i in range(extension_count): - if len(extension_data) < 4: - raise ValueError('Ed25519 extension is missing header field data') - - extension_length, extension_data = Size.SHORT.pop(extension_data) - extension_type, extension_data = Size.CHAR.pop(extension_data) - extension_flags, extension_data = Size.CHAR.pop(extension_data) - extension_value, extension_data = split(extension_data, extension_length) - - if extension_length != len(extension_value): - raise ValueError("Ed25519 extension is truncated. It should have %i bytes of data but there's only %i." % (extension_length, len(extension_value))) - elif extension_type == ExtensionType.HAS_SIGNING_KEY and len(extension_value) != 32: - raise ValueError('Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was %i.' % len(extension_value)) - - flags, remaining_flags = [], extension_flags - - if remaining_flags % 2 == 1: - flags.append(ExtensionFlag.AFFECTS_VALIDATION) - remaining_flags -= 1 - - if remaining_flags: - flags.append(ExtensionFlag.UNKNOWN) - - extensions.append(Ed25519Extension(extension_type, flags, extension_flags, extension_value)) + extension, extension_data = Ed25519Extension.pop(extension_data) + extensions.append(extension) if extension_data: raise ValueError('Ed25519 certificate had %i bytes of unused extension data' % len(extension_data)) diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index 7fd5e731..dc7ff184 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -13,7 +13,7 @@ import stem.prereq import test.require from stem.client.datatype import CertType -from stem.descriptor.certificate import ED25519_SIGNATURE_LENGTH, ExtensionType, ExtensionFlag, Ed25519Certificate, Ed25519CertificateV1, Ed25519Extension +from stem.descriptor.certificate import ED25519_SIGNATURE_LENGTH, ExtensionType, Ed25519Certificate, Ed25519CertificateV1, Ed25519Extension from test.unit.descriptor import get_resource from cryptography.hazmat.primitives import serialization @@ -69,8 +69,8 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(b'\x01' * ED25519_SIGNATURE_LENGTH, cert.signature) self.assertEqual([ - Ed25519Extension(type = ExtensionType.HAS_SIGNING_KEY, flags = [ExtensionFlag.AFFECTS_VALIDATION, ExtensionFlag.UNKNOWN], flag_int = 7, data = signing_key), - Ed25519Extension(type = 5, flags = [ExtensionFlag.UNKNOWN], flag_int = 4, data = b''), + Ed25519Extension(ExtensionType.HAS_SIGNING_KEY, 7, signing_key), + Ed25519Extension(5, 4, b''), ], cert.extensions) self.assertEqual(ExtensionType.HAS_SIGNING_KEY, cert.extensions[0].type) @@ -90,7 +90,7 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual(datetime.datetime(2015, 8, 28, 17, 0), cert.expiration) self.assertEqual(1, cert.key_type) self.assertEqual(EXPECTED_CERT_KEY, cert.key) - self.assertEqual([Ed25519Extension(type = 4, flags = [], flag_int = 0, data = EXPECTED_EXTENSION_DATA)], cert.extensions) + self.assertEqual([Ed25519Extension(4, 0, EXPECTED_EXTENSION_DATA)], cert.extensions) self.assertEqual(EXPECTED_SIGNATURE, cert.signature) def test_non_base64(self): @@ -141,7 +141,7 @@ class TestEd25519Certificate(unittest.TestCase): Include an extension without as much data as it specifies. """ - exc_msg = 'Ed25519 extension is missing header field data' + exc_msg = 'Ed25519 extension is missing header fields' self.assertRaisesWith(ValueError, exc_msg, Ed25519Certificate.from_base64, certificate(extension_data = [b''])) exc_msg = "Ed25519 extension is truncated. It should have 20480 bytes of data but there's only 2."

1 0

[stem/master] Subclass LinkSpecifier under Field
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit c64d058c2fb5f646ad62863a7123f4e452c16777 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Oct 20 17:39:10 2019 -0700 Subclass LinkSpecifier under Field We already implement its interface, so why not? Functionally subclassing doesn't provide much (adds unpack() and equality check), but clearly this should be a Field. --- stem/client/datatype.py | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/stem/client/datatype.py b/stem/client/datatype.py index 73def712..a0e59cb0 100644 --- a/stem/client/datatype.py +++ b/stem/client/datatype.py @@ -17,6 +17,12 @@ users.** See our :class:`~stem.client.Relay` the API you probably want. LinkProtocol - ORPort protocol version. Field - Packable and unpackable datatype. + |- LinkSpecifier - Communication method relays in a circuit. + | |- LinkByIPv4 - TLS connection to an IPv4 address. + | |- LinkByIPv6 - TLS connection to an IPv6 address. + | |- LinkByFingerprint - SHA1 identity fingerprint. + | +- LinkByEd25519 - Ed25519 identity fingerprint. + | |- Size - Field of a static size. |- Address - Relay address. |- Certificate - Relay certificate. @@ -25,12 +31,6 @@ users.** See our :class:`~stem.client.Relay` the API you probably want. |- unpack - decodes content +- pop - decodes content with remainder - LinkSpecifier - Communication method relays in a circuit. - |- LinkByIPv4 - TLS connection to an IPv4 address. - |- LinkByIPv6 - TLS connection to an IPv6 address. - |- LinkByFingerprint - SHA1 identity fingerprint. - +- LinkByEd25519 - Ed25519 identity fingerprint. - KDF - KDF-TOR derivatived attributes +- from_value - parses key material @@ -559,7 +559,7 @@ class Certificate(Field): return stem.util._hash_attr(self, 'type_int', 'value') -class LinkSpecifier(object): +class LinkSpecifier(Field): """ Method of communicating with a circuit's relay. Recognized link specification types are an instantiation of a subclass. For more information see the @@ -575,29 +575,29 @@ class LinkSpecifier(object): self.value = value @staticmethod - def pop(content): + def pop(packed): # LSTYPE (Link specifier type) [1 byte] # LSLEN (Link specifier length) [1 byte] # LSPEC (Link specifier) [LSLEN bytes] - link_type, content = Size.CHAR.pop(content) - value_size, content = Size.CHAR.pop(content) + link_type, packed = Size.CHAR.pop(packed) + value_size, packed = Size.CHAR.pop(packed) - if value_size > len(content): - raise ValueError('Link specifier should have %i bytes, but only had %i remaining' % (value_size, len(content))) + if value_size > len(packed): + raise ValueError('Link specifier should have %i bytes, but only had %i remaining' % (value_size, len(packed))) - value, content = split(content, value_size) + value, packed = split(packed, value_size) if link_type == 0: - return LinkByIPv4(value), content + return LinkByIPv4(value), packed elif link_type == 1: - return LinkByIPv6(value), content + return LinkByIPv6(value), packed elif link_type == 2: - return LinkByFingerprint(value), content + return LinkByFingerprint(value), packed elif link_type == 3: - return LinkByEd25519(value), content + return LinkByEd25519(value), packed else: - return LinkSpecifier(link_type, value), content # unrecognized type + return LinkSpecifier(link_type, value), packed # unrecognized type def pack(self): cell = bytearray()

1 0

[stem/master] Stub certificate encoding/decoding methods
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 95f00b4fe19ac22abee90aec02498ffc6d56b76b Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Oct 20 17:11:57 2019 -0700 Stub certificate encoding/decoding methods Finally settled on to_base64() and from_base64() methods. Not implemented yet, just stubbing the API I think we'll want. --- stem/descriptor/certificate.py | 95 +++++++++++++++++++++++++++--------- stem/descriptor/hidden_service.py | 4 +- stem/descriptor/server_descriptor.py | 2 +- 3 files changed, 76 insertions(+), 25 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index 042687e3..ba2d1d55 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -19,9 +19,11 @@ used to for a variety of purposes... Ed25519Certificate - Ed25519 signing key certificate | +- Ed25519CertificateV1 - version 1 Ed25519 certificate | |- is_expired - checks if certificate is presently expired - | +- validate - validates signature of a server descriptor + | |- signing_key - certificate signing key + | +- validate - validates a descriptor's signature | - +- parse - reads base64 encoded certificate data + |- from_base64 - decodes base64 encoded certificate data + +- to_base64 - encodes base64 encoded certificate data Ed25519Extension - extension included within an Ed25519Certificate @@ -123,12 +125,12 @@ class Ed25519Certificate(object): :var unicode encoded: base64 encoded ed25519 certificate """ - def __init__(self, version, encoded): + def __init__(self, version): self.version = version - self.encoded = encoded + self.encoded = None # TODO: remove in stem 2.x @staticmethod - def parse(content): + def from_base64(content): """ Parses the given base64 encoded data as an Ed25519 certificate. @@ -148,10 +150,23 @@ class Ed25519Certificate(object): version = stem.util.str_tools._to_int(Ed25519Certificate._b64_decode(content)[0:1]) if version == 1: - return Ed25519CertificateV1(content) + return Ed25519CertificateV1.from_base64(content) else: raise ValueError('Ed25519 certificate is version %i. Parser presently only supports version 1.' % version) + def to_base64(self, pem = False): + """ + Base64 encoded certificate data. + + :param bool pem: include `PEM header/footer + <https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail>`_, for more + information see `RFC 7468 <https://tools.ietf.org/html/rfc7468>`_ + + :returns: **bytes** for our encoded certificate representation + """ + + raise NotImplementedError('Certificate encoding has not been implemented for %s' % type(self).__name__) + @staticmethod def _from_descriptor(keyword, attribute): def _parse(descriptor, entries): @@ -160,7 +175,7 @@ class Ed25519Certificate(object): if not block_contents or block_type != 'ED25519 CERT': raise ValueError("'%s' should be followed by a ED25519 CERT block, but was a %s" % (keyword, block_type)) - setattr(descriptor, attribute, Ed25519Certificate.parse(block_contents)) + setattr(descriptor, attribute, Ed25519Certificate.from_base64(block_contents)) return _parse @@ -177,7 +192,11 @@ class Ed25519Certificate(object): raise ValueError("Ed25519 certificate wasn't propoerly base64 encoded (%s):\n%s" % (exc, content)) def __str__(self): - return '-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % self.encoded + return self.to_base64(pem = True) + + @staticmethod + def parse(content): + return Ed25519Certificate.from_base64(content) # TODO: drop this alias in stem 2.x class Ed25519CertificateV1(Ed25519Certificate): @@ -194,33 +213,60 @@ class Ed25519CertificateV1(Ed25519Certificate): :var bytes signature: certificate signature """ - def __init__(self, content): - super(Ed25519CertificateV1, self).__init__(1, content) + def __init__(self, type_int, expiration, key_type, key, extensions, signature): + super(Ed25519CertificateV1, self).__init__(1) + + self.type, self.type_int = ClientCertType.get(type_int) + self.expiration = expiration + self.key_type = key_type + self.key = key + self.extensions = extensions + self.signature = signature + + def to_base64(self, pem = False): + if pem: + return '-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % self.encoded + else: + return self.encoded + + @staticmethod + def from_base64(content): + """ + Parses the given base64 encoded data as a version 1 Ed25519 certificate. + + :param str content: base64 encoded certificate + + :returns: :class:`~stem.descriptor.certificate.Ed25519CertificateV1` for + this content + + :raises: **ValueError** if certificate is malformed + """ + decoded = Ed25519Certificate._b64_decode(content) if len(decoded) < ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH: raise ValueError('Ed25519 certificate was %i bytes, but should be at least %i' % (len(decoded), ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH)) - self.type, self.type_int = ClientCertType.get(stem.util.str_tools._to_int(decoded[1:2])) + type_enum, type_int = ClientCertType.get(stem.util.str_tools._to_int(decoded[1:2])) - if self.type in (ClientCertType.LINK, ClientCertType.IDENTITY, ClientCertType.AUTHENTICATE): - raise ValueError('Ed25519 certificate cannot have a type of %i. This is reserved for CERTS cells.' % self.type_int) - elif self.type == ClientCertType.ED25519_IDENTITY: + if type_enum in (ClientCertType.LINK, ClientCertType.IDENTITY, ClientCertType.AUTHENTICATE): + raise ValueError('Ed25519 certificate cannot have a type of %i. This is reserved for CERTS cells.' % type_int) + elif type_enum == ClientCertType.ED25519_IDENTITY: raise ValueError('Ed25519 certificate cannot have a type of 7. This is reserved for RSA identity cross-certification.') - elif self.type == ClientCertType.UNKNOWN: - raise ValueError('Ed25519 certificate type %i is unrecognized' % self.type_int) + elif type_enum == ClientCertType.UNKNOWN: + raise ValueError('Ed25519 certificate type %i is unrecognized' % type_int) # expiration time is in hours since epoch try: - self.expiration = datetime.datetime.utcfromtimestamp(stem.util.str_tools._to_int(decoded[2:6]) * 3600) + expiration = datetime.datetime.utcfromtimestamp(stem.util.str_tools._to_int(decoded[2:6]) * 3600) except ValueError as exc: raise ValueError('Invalid expiration timestamp (%s): %s' % (exc, stem.util.str_tools._to_int(decoded[2:6]) * 3600)) - self.key_type = stem.util.str_tools._to_int(decoded[6:7]) - self.key = decoded[7:39] - self.signature = decoded[-ED25519_SIGNATURE_LENGTH:] + key_type = stem.util.str_tools._to_int(decoded[6:7]) + key = decoded[7:39] + signature = decoded[-ED25519_SIGNATURE_LENGTH:] - self.extensions = [] + extensions = [] extension_count = stem.util.str_tools._to_int(decoded[39:40]) remaining_data = decoded[40:-ED25519_SIGNATURE_LENGTH] @@ -248,12 +294,17 @@ class Ed25519CertificateV1(Ed25519Certificate): if extension_type == ExtensionType.HAS_SIGNING_KEY and len(extension_data) != 32: raise ValueError('Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was %i.' % len(extension_data)) - self.extensions.append(Ed25519Extension(extension_type, flags, extension_flags, extension_data)) + extensions.append(Ed25519Extension(extension_type, flags, extension_flags, extension_data)) remaining_data = remaining_data[4 + extension_length:] if remaining_data: raise ValueError('Ed25519 certificate had %i bytes of unused extension data' % len(remaining_data)) + instance = Ed25519CertificateV1(type_int, expiration, key_type, key, extensions, signature) + instance.encoded = content + + return instance + def is_expired(self): """ Checks if this certificate is presently expired or not. diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index c2673fb3..1819dfc5 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -508,7 +508,7 @@ def _parse_v3_introduction_points(descriptor, entries): onion_key = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None _, block_type, auth_key_cert = entry['auth-key'][0] - auth_key_cert = Ed25519Certificate.parse(auth_key_cert) + auth_key_cert = Ed25519Certificate.from_base64(auth_key_cert) if block_type != 'ED25519 CERT': raise ValueError('Expected auth-key to have an ed25519 certificate, but was %s' % block_type) @@ -517,7 +517,7 @@ def _parse_v3_introduction_points(descriptor, entries): enc_key = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None _, block_type, enc_key_cert = entry['enc-key-cert'][0] - enc_key_cert = Ed25519Certificate.parse(enc_key_cert) + enc_key_cert = Ed25519Certificate.from_base64(enc_key_cert) if block_type != 'ED25519 CERT': raise ValueError('Expected enc-key-cert to have an ed25519 certificate, but was %s' % block_type) diff --git a/stem/descriptor/server_descriptor.py b/stem/descriptor/server_descriptor.py index a2be8483..9c29164b 100644 --- a/stem/descriptor/server_descriptor.py +++ b/stem/descriptor/server_descriptor.py @@ -406,7 +406,7 @@ def _parse_identity_ed25519_line(descriptor, entries): _parse_key_block('identity-ed25519', 'ed25519_certificate', 'ED25519 CERT')(descriptor, entries) if descriptor.ed25519_certificate: - descriptor.certificate = stem.descriptor.certificate.Ed25519Certificate.parse(descriptor.ed25519_certificate) + descriptor.certificate = stem.descriptor.certificate.Ed25519Certificate.from_base64(descriptor.ed25519_certificate) _parse_master_key_ed25519_line = _parse_simple_line('master-key-ed25519', 'ed25519_master_key')

1 0

[stem/master] Pack/unpack methods on Ed25519CertificateV1
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 1e515a27d3e4f038876891251b49fe6048b26998 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Oct 23 16:45:19 2019 -0700 Pack/unpack methods on Ed25519CertificateV1 On reflection working with bytes rather than base64 within our child class makes us more consistent with other parsers. Our parent class can provide base64 counterparts. --- stem/descriptor/certificate.py | 122 +++++++++++++++++++----------------- test/unit/descriptor/certificate.py | 6 +- 2 files changed, 68 insertions(+), 60 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index 855f1262..84610328 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -22,8 +22,11 @@ used to for a variety of purposes... | |- signing_key - certificate signing key | +- validate - validates a descriptor's signature | - |- from_base64 - decodes base64 encoded certificate data - +- to_base64 - encodes base64 encoded certificate data + |- from_base64 - decodes a base64 encoded certificate + |- to_base64 - base64 encoding of this certificate + | + |- unpack - decodes a byte encoded certificate + +- pack - byte encoding of this certificate Ed25519Extension - extension included within an Ed25519Certificate @@ -173,9 +176,29 @@ class Ed25519Certificate(object): self.encoded = None # TODO: remove in stem 2.x @staticmethod + def unpack(content): + """ + Parses a byte encoded ED25519 certificate. + + :param bytes content: encoded certificate + + :returns: :class:`~stem.descriptor.certificate.Ed25519Certificate` subclsss + for the given certificate + + :raises: **ValueError** if certificate is malformed + """ + + version = Size.CHAR.pop(content)[0] + + if version == 1: + return Ed25519CertificateV1.unpack(content) + else: + raise ValueError('Ed25519 certificate is version %i. Parser presently only supports version 1.' % version) + + @staticmethod def from_base64(content): """ - Parses the given base64 encoded data as an Ed25519 certificate. + Parses a base64 encoded ED25519 certificate. :param str content: base64 encoded certificate @@ -190,12 +213,26 @@ class Ed25519Certificate(object): if content.startswith('-----BEGIN ED25519 CERT-----\n') and content.endswith('\n-----END ED25519 CERT-----'): content = content[29:-27] - version = stem.util.str_tools._to_int(Ed25519Certificate._b64_decode(content)[0:1]) + try: + decoded = base64.b64decode(content) - if version == 1: - return Ed25519CertificateV1.from_base64(content) - else: - raise ValueError('Ed25519 certificate is version %i. Parser presently only supports version 1.' % version) + if not decoded: + raise TypeError('empty') + + instance = Ed25519Certificate.unpack(decoded) + instance.encoded = content + return instance + except (TypeError, binascii.Error) as exc: + raise ValueError("Ed25519 certificate wasn't propoerly base64 encoded (%s):\n%s" % (exc, content)) + + def pack(self): + """ + Encoded byte representation of our certificate. + + :returns: **bytes** for our encoded certificate representation + """ + + raise NotImplementedError('Certificate encoding has not been implemented for %s' % type(self).__name__) def to_base64(self, pem = False): """ @@ -208,7 +245,12 @@ class Ed25519Certificate(object): :returns: **bytes** for our encoded certificate representation """ - raise NotImplementedError('Certificate encoding has not been implemented for %s' % type(self).__name__) + encoded = '\n'.join(stem.util.str_tools._split_by_length(base64.b64encode(self.pack()), 64)) + + if pem: + return '-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % encoded + else: + return encoded @staticmethod def _from_descriptor(keyword, attribute): @@ -222,18 +264,6 @@ class Ed25519Certificate(object): return _parse - @staticmethod - def _b64_decode(content): - try: - decoded = base64.b64decode(content) - - if not decoded: - raise TypeError('empty') - - return decoded - except (TypeError, binascii.Error) as exc: - raise ValueError("Ed25519 certificate wasn't propoerly base64 encoded (%s):\n%s" % (exc, content)) - def __str__(self): return self.to_base64(pem = True) @@ -273,45 +303,26 @@ class Ed25519CertificateV1(Ed25519Certificate): elif self.type == ClientCertType.UNKNOWN: raise ValueError('Ed25519 certificate type %i is unrecognized' % self.type_int) - def to_base64(self, pem = False): - if self.encoded is None: - encoded = bytearray() - encoded += Size.CHAR.pack(self.version) - encoded += Size.CHAR.pack(self.type_int) - encoded += Size.LONG.pack(stem.util.datetime_to_unix(self.expiration) / 3600) - encoded += Size.CHAR.pack(self.key_type) - encoded += self.key - encoded += Size.CHAR.pack(len(self.extensions)) - - for extension in self.extensions: - encoded += extension.pack() + def pack(self): + encoded = bytearray() + encoded += Size.CHAR.pack(self.version) + encoded += Size.CHAR.pack(self.type_int) + encoded += Size.LONG.pack(stem.util.datetime_to_unix(self.expiration) / 3600) + encoded += Size.CHAR.pack(self.key_type) + encoded += self.key + encoded += Size.CHAR.pack(len(self.extensions)) - self.encoded = '\n'.join(stem.util.str_tools._split_by_length(base64.b64encode(bytes(encoded + self.signature)), 64)) + for extension in self.extensions: + encoded += extension.pack() - if pem: - return '-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % self.encoded - else: - return self.encoded + return bytes(encoded + self.signature) @staticmethod - def from_base64(content): - """ - Parses the given base64 encoded data as a version 1 Ed25519 certificate. - - :param str content: base64 encoded certificate - - :returns: :class:`~stem.descriptor.certificate.Ed25519CertificateV1` for - this content - - :raises: **ValueError** if certificate is malformed - """ - - decoded = Ed25519Certificate._b64_decode(content) - - if len(decoded) < ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH: - raise ValueError('Ed25519 certificate was %i bytes, but should be at least %i' % (len(decoded), ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH)) + def unpack(content): + if len(content) < ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH: + raise ValueError('Ed25519 certificate was %i bytes, but should be at least %i' % (len(content), ED25519_HEADER_LENGTH + ED25519_SIGNATURE_LENGTH)) - header, signature = split(decoded, len(decoded) - ED25519_SIGNATURE_LENGTH) + header, signature = split(content, len(content) - ED25519_SIGNATURE_LENGTH) version, header = Size.CHAR.pop(header) cert_type, header = Size.CHAR.pop(header) @@ -333,7 +344,6 @@ class Ed25519CertificateV1(Ed25519Certificate): raise ValueError('Ed25519 certificate had %i bytes of unused extension data' % len(extension_data)) instance = Ed25519CertificateV1(cert_type, datetime.datetime.utcfromtimestamp(expiration_hours * 3600), key_type, key, extensions, signature) - instance.encoded = content return instance diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index a5f7837a..d2b13f72 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -112,10 +112,8 @@ class TestEd25519Certificate(unittest.TestCase): """ cert = Ed25519Certificate.from_base64(ED25519_CERT) - self.assertEqual(ED25519_CERT, cert.encoded) - - cert.encoded = None # clear cached encoding - self.assertEqual(ED25519_CERT, cert.to_base64()) + self.assertEqual(ED25519_CERT, cert.encoded) # read base64 encoding (getting removed in stem 2.x) + self.assertEqual(ED25519_CERT, cert.to_base64()) # computed base64 encoding def test_non_base64(self): """

1 0

[stem/master] Implement certificate encoding
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 0d726d07e7d8cf0226d2b5a74c24b6f9181493a4 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Oct 23 16:28:35 2019 -0700 Implement certificate encoding There we go. Now that we parse certificates and extensions like datatypes we can implement their packing methods. --- stem/descriptor/certificate.py | 23 +++++++++++++++++++++++ test/unit/descriptor/certificate.py | 26 +++++++++++++++++++++++++- 2 files changed, 48 insertions(+), 1 deletion(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index dcf0c227..855f1262 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -79,6 +79,7 @@ import re import stem.descriptor.hidden_service import stem.descriptor.server_descriptor import stem.prereq +import stem.util import stem.util.enum import stem.util.str_tools @@ -132,6 +133,14 @@ class Ed25519Extension(Field): if ext_type == ExtensionType.HAS_SIGNING_KEY and len(data) != 32: raise ValueError('Ed25519 HAS_SIGNING_KEY extension must be 32 bytes, but was %i.' % len(data)) + def pack(self): + encoded = bytearray() + encoded += Size.SHORT.pack(len(self.data)) + encoded += Size.CHAR.pack(self.type) + encoded += Size.CHAR.pack(self.flag_int) + encoded += self.data + return bytes(encoded) + @staticmethod def pop(content): if len(content) < 4: @@ -265,6 +274,20 @@ class Ed25519CertificateV1(Ed25519Certificate): raise ValueError('Ed25519 certificate type %i is unrecognized' % self.type_int) def to_base64(self, pem = False): + if self.encoded is None: + encoded = bytearray() + encoded += Size.CHAR.pack(self.version) + encoded += Size.CHAR.pack(self.type_int) + encoded += Size.LONG.pack(stem.util.datetime_to_unix(self.expiration) / 3600) + encoded += Size.CHAR.pack(self.key_type) + encoded += self.key + encoded += Size.CHAR.pack(len(self.extensions)) + + for extension in self.extensions: + encoded += extension.pack() + + self.encoded = '\n'.join(stem.util.str_tools._split_by_length(base64.b64encode(bytes(encoded + self.signature)), 64)) + if pem: return '-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % self.encoded else: diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index dc7ff184..a5f7837a 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -12,7 +12,7 @@ import stem.util.str_tools import stem.prereq import test.require -from stem.client.datatype import CertType +from stem.client.datatype import Size, CertType from stem.descriptor.certificate import ED25519_SIGNATURE_LENGTH, ExtensionType, Ed25519Certificate, Ed25519CertificateV1, Ed25519Extension from test.unit.descriptor import get_resource @@ -93,6 +93,30 @@ class TestEd25519Certificate(unittest.TestCase): self.assertEqual([Ed25519Extension(4, 0, EXPECTED_EXTENSION_DATA)], cert.extensions) self.assertEqual(EXPECTED_SIGNATURE, cert.signature) + def test_extension_encoding(self): + """ + Pack an extension back into what we read. + """ + + extension = Ed25519Certificate.from_base64(ED25519_CERT).extensions[0] + expected = Size.SHORT.pack(len(EXPECTED_EXTENSION_DATA)) + Size.CHAR.pack(4) + Size.CHAR.pack(0) + EXPECTED_EXTENSION_DATA + + self.assertEqual(4, extension.type) + self.assertEqual(0, extension.flag_int) + self.assertEqual(EXPECTED_EXTENSION_DATA, extension.data) + self.assertEqual(expected, extension.pack()) + + def test_certificate_encoding(self): + """ + Pack a certificate back into what we read. + """ + + cert = Ed25519Certificate.from_base64(ED25519_CERT) + self.assertEqual(ED25519_CERT, cert.encoded) + + cert.encoded = None # clear cached encoding + self.assertEqual(ED25519_CERT, cert.to_base64()) + def test_non_base64(self): """ Parse data that isn't base64 encoded.

1 0

[stem/master] Test using new IntroductionPoint class
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit a67425403fd90dd0b0e7b55161c8345091dfd36b Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Oct 31 14:50:08 2019 -0700 Test using new IntroductionPoint class Adjusting our test_encode_decode_descriptor() test to use our present IntroductionPoint class rather than the prototype. --- stem/descriptor/certificate.py | 29 +++++++++++++++++++++----- stem/descriptor/hidden_service.py | 9 +++++--- test/unit/descriptor/hidden_service_v3.py | 34 +++++++++++++++++++++++++++---- 3 files changed, 60 insertions(+), 12 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index b48a0899..973957f1 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -123,10 +123,10 @@ class Ed25519Extension(Field): def __init__(self, ext_type, flag_val, data): self.type = ext_type self.flags = [] - self.flag_int = flag_val + self.flag_int = flag_val if flag_val else 0 self.data = data - if flag_val % 2 == 1: + if flag_val and flag_val % 2 == 1: self.flags.append(ExtensionFlag.AFFECTS_VALIDATION) flag_val -= 1 @@ -284,18 +284,34 @@ class Ed25519CertificateV1(Ed25519Certificate): :var bytes key: key content :var list extensions: :class:`~stem.descriptor.certificate.Ed25519Extension` in this certificate :var bytes signature: certificate signature + + :param bytes signature: pre-calculated certificate signature + :param cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey: certificate signing key """ - def __init__(self, type_int, expiration, key_type, key, extensions, signature): + def __init__(self, cert_type, expiration, key_type, key, extensions, signature = None, signing_key = None): super(Ed25519CertificateV1, self).__init__(1) - self.type, self.type_int = ClientCertType.get(type_int) + if not signature and not signing_key: + raise ValueError('Certificate signature or signing key is required') + + self.type, self.type_int = ClientCertType.get(cert_type) self.expiration = expiration self.key_type = key_type self.key = key self.extensions = extensions self.signature = signature + if signing_key: + calculated_sig = signing_key.sign(self.pack()) + + # if caller provides both signing key *and* signature then ensure they match + + if self.signature and self.signature != calculated_sig: + raise ValueError("Signature calculated from its key (%s) mismatches '%s'" % (calculated_sig, self.signature)) + + self.signature = calculated_sig + if self.type in (ClientCertType.LINK, ClientCertType.IDENTITY, ClientCertType.AUTHENTICATE): raise ValueError('Ed25519 certificate cannot have a type of %i. This is reserved for CERTS cells.' % self.type_int) elif self.type == ClientCertType.ED25519_IDENTITY: @@ -315,7 +331,10 @@ class Ed25519CertificateV1(Ed25519Certificate): for extension in self.extensions: encoded += extension.pack() - return bytes(encoded + self.signature) + if self.signature: + encoded += self.signature + + return bytes(encoded) @staticmethod def unpack(content): diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index 09030ca5..68d150b1 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -935,7 +935,10 @@ def _get_inner_descriptor_layer_body(intro_points, descriptor_signing_privkey): # Now encode all the intro points for intro_point in intro_points: - final_body += intro_point.encode(descriptor_signing_privkey) + if isinstance(intro_point, IntroductionPointV3): + final_body += intro_point.encode() + b'\n' + else: + final_body += intro_point.encode(descriptor_signing_privkey) return final_body @@ -984,7 +987,7 @@ def _get_superencrypted_blob(intro_points, descriptor_signing_privkey, revision_ should be attached to the descriptor """ - inner_descriptor_layer = _get_inner_descriptor_layer_body(intro_points, descriptor_signing_privkey) + inner_descriptor_layer = stem.util.str_tools._to_bytes(_get_inner_descriptor_layer_body(intro_points, descriptor_signing_privkey)) inner_ciphertext = hsv3_crypto.encrypt_inner_layer(inner_descriptor_layer, revision_counter, blinded_key_bytes, subcredential) inner_ciphertext_b64 = b64_and_wrap_desc_layer(inner_ciphertext, b'encrypted') @@ -1179,7 +1182,7 @@ class HiddenServiceDescriptorV3(BaseHiddenServiceDescriptor): raise ImportError('Hidden service descriptor decryption requires python 3.6+ or the pysha3 module (https://pypi.org/project/pysha3/)') if self._inner_layer is None: - blinded_key = self.signing_cert.signing_key() + blinded_key = self.signing_cert.signing_key() if self.signing_cert else None if not blinded_key: raise ValueError('No signing key is present') diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py index fb190211..060fa4dc 100644 --- a/test/unit/descriptor/hidden_service_v3.py +++ b/test/unit/descriptor/hidden_service_v3.py @@ -3,6 +3,7 @@ Unit tests for stem.descriptor.hidden_service for version 3. """ import base64 +import datetime import functools import hashlib import unittest @@ -13,6 +14,9 @@ import stem.prereq import test.require +from stem.client.datatype import CertType, LinkByIPv4 +from stem.descriptor.certificate import ExtensionType, Ed25519Extension, Ed25519CertificateV1 + from stem.descriptor.hidden_service import ( CHECKSUM_CONSTANT, REQUIRED_V3_FIELDS, @@ -100,6 +104,28 @@ def _encode_onion_address(ed25519_pub_key_bytes): def _helper_get_intro(): from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey + from cryptography.hazmat.primitives import serialization + + def public_key(key): + return key.public_key().public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) + + onion_key = public_key(X25519PrivateKey.generate()) + enc_key = public_key(X25519PrivateKey.generate()) + auth_key = public_key(Ed25519PrivateKey.generate()) + signing_key = Ed25519PrivateKey.generate() + + expiration = datetime.datetime.utcnow() + datetime.timedelta(hours = 54) + extensions = [Ed25519Extension(ExtensionType.HAS_SIGNING_KEY, None, public_key(signing_key))] + + auth_key_cert = Ed25519CertificateV1(CertType.HS_V3_INTRO_AUTH, expiration, 1, auth_key, extensions, signing_key = signing_key) + enc_key_cert = Ed25519CertificateV1(CertType.HS_V3_NTOR_ENC, expiration, 1, auth_key, extensions, signing_key = signing_key) + + return IntroductionPointV3([LinkByIPv4('1.2.3.4', 9001)], base64.b64encode(onion_key), auth_key_cert, base64.b64encode(enc_key), enc_key_cert, None, None) + + +def _helper_get_intro_old(): + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey link_specifiers = [] @@ -370,7 +396,7 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): desc = HiddenServiceDescriptorV3.from_str(desc_string) inner_layer = desc.decrypt(onion_address) - self.assertEqual(len(inner_layer.introduction_points), 3) + self.assertEqual(3, len(inner_layer.introduction_points)) # Match introduction points of the parsed descriptor and the generated # descriptor and do some sanity checks between them to make sure that @@ -380,9 +406,9 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): original_intro = intro_points[i] auth_key_1 = Ed25519PublicKey.from_public_bytes(desc_intro.auth_key_cert.key) - auth_key_2 = original_intro.auth_key + auth_key_2 = Ed25519PublicKey.from_public_bytes(original_intro.auth_key_cert.key) - self.assertTrue(_pubkeys_are_equal(desc_intro.enc_key(), original_intro.enc_key)) - self.assertTrue(_pubkeys_are_equal(desc_intro.onion_key(), original_intro.onion_key)) + self.assertTrue(_pubkeys_are_equal(desc_intro.enc_key(), original_intro.enc_key())) + self.assertTrue(_pubkeys_are_equal(desc_intro.onion_key(), original_intro.onion_key())) self.assertTrue(_pubkeys_are_equal(auth_key_1, auth_key_2))

1 0

[stem/master] Match introduction points by index
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 8dfa8904287f4c0070848308e12101fae4bc3015 Author: Damian Johnson <atagar(a)torproject.org> Date: Fri Oct 25 14:52:54 2019 -0700 Match introduction points by index We retain introduction point ordering so there's no need to iterate over the original to match. --- test/unit/descriptor/hidden_service_v3.py | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py index 203cd3c3..b57a3ebf 100644 --- a/test/unit/descriptor/hidden_service_v3.py +++ b/test/unit/descriptor/hidden_service_v3.py @@ -350,18 +350,13 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): # descriptor and do some sanity checks between them to make sure that # parsing was done right! - for desc_intro in inner_layer.introduction_points: - original_found = False # Make sure we found all the intro points + for i, desc_intro in enumerate(inner_layer.introduction_points): + original_intro = intro_points[i] - for original_intro in intro_points: - # Match intro points + auth_key_1 = Ed25519PublicKey.from_public_bytes(desc_intro.auth_key_cert.key) + auth_key_2 = original_intro.auth_key - auth_key_1 = Ed25519PublicKey.from_public_bytes(desc_intro.auth_key_cert.key) - auth_key_2 = original_intro.auth_key + self.assertTrue(_pubkeys_are_equal(desc_intro.enc_key(), original_intro.enc_key)) + self.assertTrue(_pubkeys_are_equal(desc_intro.onion_key(), original_intro.onion_key)) - if _pubkeys_are_equal(auth_key_1, auth_key_2): - original_found = True - self.assertTrue(_pubkeys_are_equal(desc_intro.enc_key(), original_intro.enc_key)) - self.assertTrue(_pubkeys_are_equal(desc_intro.onion_key(), original_intro.onion_key)) - - self.assertTrue(original_found) + self.assertTrue(_pubkeys_are_equal(auth_key_1, auth_key_2))

1 0

[stem/master] IntroductionPointV3 key methods
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit a13cafd79f40433c1692ce925fc6418b33eed507 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Oct 19 13:32:03 2019 -0700 IntroductionPointV3 key methods Simple helpers for cryptographic keys and a few tests. George's test still passes, but I haven't yet added the encoding support his class has. --- stem/descriptor/hidden_service.py | 111 ++++++++++++++++++++++-------- test/unit/descriptor/hidden_service_v3.py | 63 +++++++++++++++-- 2 files changed, 140 insertions(+), 34 deletions(-) diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index cfa20d09..c2673fb3 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -73,6 +73,13 @@ if stem.prereq._is_lru_cache_available(): else: from stem.util.lru_cache import lru_cache +try: + from cryptography.hazmat.backends.openssl.backend import backend + X25519_AVAILABLE = backend.x25519_supported() +except ImportError: + X25519_AVAILABLE = False + + REQUIRED_V2_FIELDS = ( 'rendezvous-service-descriptor', 'version', @@ -144,21 +151,76 @@ class IntroductionPoints(collections.namedtuple('IntroductionPoints', INTRODUCTI """ -class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_specifiers', 'onion_key', 'auth_key', 'enc_key', 'enc_key_cert', 'legacy_key', 'legacy_key_cert'])): +class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_specifiers', 'onion_key_raw', 'auth_key_cert', 'enc_key_raw', 'enc_key_cert', 'legacy_key_raw', 'legacy_key_cert'])): """ Introduction point for a v3 hidden service. .. versionadded:: 1.8.0 :var list link_specifiers: :class:`~stem.client.datatype.LinkSpecifier` where this service is reachable - :var str onion_key: ntor introduction point public key - :var str auth_key: cross-certifier of the signing key - :var str enc_key: introduction request encryption key - :var str enc_key_cert: cross-certifier of the signing key by the encryption key - :var str legacy_key: legacy introduction point RSA public key - :var str legacy_key_cert: cross-certifier of the signing key by the legacy key + :var str onion_key_raw: base64 ntor introduction point public key + :var stem.certificate.Ed25519Certificate auth_key_cert: cross-certifier of the signing key with the auth key + :var str enc_key_raw: base64 introduction request encryption key + :var stem.certificate.Ed25519Certificate enc_key_cert: cross-certifier of the signing key by the encryption key + :var str legacy_key_raw: base64 legacy introduction point RSA public key + :var stem.certificate.Ed25519Certificate legacy_key_cert: cross-certifier of the signing key by the legacy key """ + def onion_key(self): + """ + Provides our ntor introduction point public key. + + :returns: ntor :class:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey` + + :raises: + * **ImportError** if required the cryptography module is unavailable + * **EnvironmentError** if OpenSSL x25519 unsupported + """ + + return IntroductionPointV3._parse_key(self.onion_key_raw) + + def enc_key(self): + """ + Provides our encryption key. + + :returns: encryption :class:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey` + + :raises: + * **ImportError** if required the cryptography module is unavailable + * **EnvironmentError** if OpenSSL x25519 unsupported + """ + + return IntroductionPointV3._parse_key(self.enc_key_raw) + + def legacy_key(self): + """ + Provides our legacy introduction point public key. + + :returns: legacy :class:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey` + + :raises: + * **ImportError** if required the cryptography module is unavailable + * **EnvironmentError** if OpenSSL x25519 unsupported + """ + + return IntroductionPointV3._parse_key(self.legacy_key_raw) + + @staticmethod + def _parse_key(value): + if value is None: + return value + elif not stem.prereq.is_crypto_available(): + raise ImportError('cryptography module unavailable') + elif not X25519_AVAILABLE: + # without this the cryptography raises... + # cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL. + + raise EnvironmentError('OpenSSL x25519 unsupported') + + from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PublicKey + + return X25519PublicKey.from_public_bytes(base64.b64decode(value)) + class AlternateIntroductionPointV3(object): """ @@ -425,9 +487,6 @@ def _parse_v3_inner_formats(descriptor, entries): def _parse_v3_introduction_points(descriptor, entries): - from cryptography.hazmat.backends.openssl.backend import backend - from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PublicKey - if hasattr(descriptor, '_unparsed_introduction_points'): introduction_points = [] remaining = descriptor._unparsed_introduction_points @@ -445,12 +504,8 @@ def _parse_v3_introduction_points(descriptor, entries): entry = _descriptor_components(intro_point_str, False) link_specifiers = _parse_link_specifiers(_value('introduction-point', entry)) - if backend.x25519_supported(): - onion_key_line = _value('onion-key', entry) - onion_key_b64 = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None - onion_key = X25519PublicKey.from_public_bytes(base64.b64decode(onion_key_b64)) - else: - onion_key = None + onion_key_line = _value('onion-key', entry) + onion_key = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None _, block_type, auth_key_cert = entry['auth-key'][0] auth_key_cert = Ed25519Certificate.parse(auth_key_cert) @@ -458,12 +513,8 @@ def _parse_v3_introduction_points(descriptor, entries): if block_type != 'ED25519 CERT': raise ValueError('Expected auth-key to have an ed25519 certificate, but was %s' % block_type) - if backend.x25519_supported(): - enc_key_line = _value('enc-key', entry) - enc_key_b64 = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None - enc_key = X25519PublicKey.from_public_bytes(base64.b64decode(enc_key_b64)) - else: - enc_key = None + enc_key_line = _value('enc-key', entry) + enc_key = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None _, block_type, enc_key_cert = entry['enc-key-cert'][0] enc_key_cert = Ed25519Certificate.parse(enc_key_cert) @@ -475,14 +526,14 @@ def _parse_v3_introduction_points(descriptor, entries): legacy_key_cert = entry['legacy-key-cert'][0][2] if 'legacy-key-cert' in entry else None introduction_points.append( - AlternateIntroductionPointV3( - link_specifiers = link_specifiers, - onion_key = onion_key, - auth_key_cert = auth_key_cert, - enc_key = enc_key, - enc_key_cert = enc_key_cert, - legacy_key = legacy_key, - legacy_key_cert = legacy_key_cert, + IntroductionPointV3( + link_specifiers, + onion_key, + auth_key_cert, + enc_key, + enc_key_cert, + legacy_key, + legacy_key_cert, ) ) diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py index 7e87668d..499064f9 100644 --- a/test/unit/descriptor/hidden_service_v3.py +++ b/test/unit/descriptor/hidden_service_v3.py @@ -14,6 +14,7 @@ import stem.prereq from stem.descriptor.hidden_service import ( CHECKSUM_CONSTANT, REQUIRED_V3_FIELDS, + X25519_AVAILABLE, AlternateIntroductionPointV3, HiddenServiceDescriptorV3, OuterLayer, @@ -26,6 +27,12 @@ from test.unit.descriptor import ( base_expect_invalid_attr_for_text, ) +try: + # added in python 3.3 + from unittest.mock import patch, Mock, MagicMock +except ImportError: + from mock import patch, Mock, MagicMock + expect_invalid_attr = functools.partial(base_expect_invalid_attr, HiddenServiceDescriptorV3, 'version', 3) expect_invalid_attr_for_text = functools.partial(base_expect_invalid_attr_for_text, HiddenServiceDescriptorV3, 'version', 3) @@ -264,6 +271,51 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): self.assertRaisesWith(ValueError, "'boom.onion' isn't a valid hidden service v3 address", HiddenServiceDescriptorV3._public_key_from_address, 'boom') self.assertRaisesWith(ValueError, 'Bad checksum (expected def7 but was 842e)', HiddenServiceDescriptorV3._public_key_from_address, '5' * 56) + def test_intro_point_crypto(self): + """ + Retrieve IntroductionPointV3 cryptographic materials. + """ + + if not stem.prereq.is_crypto_available(): + self.skipTest('(requires cryptography support)') + return + elif not X25519_AVAILABLE: + self.skipTest('(openssl requires X25519 support)') + return + + from cryptography.hazmat.backends.openssl.x25519 import X25519PublicKey + from cryptography.hazmat.primitives import serialization + + intro_point = InnerLayer(INNER_LAYER_STR).introduction_points[0] + + self.assertEqual('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', intro_point.onion_key_raw) + self.assertEqual('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', intro_point.enc_key_raw) + + self.assertTrue(isinstance(intro_point.onion_key(), X25519PublicKey)) + self.assertTrue(isinstance(intro_point.enc_key(), X25519PublicKey)) + + self.assertEqual(intro_point.onion_key_raw, base64.b64encode(intro_point.onion_key().public_bytes( + encoding = serialization.Encoding.Raw, + format = serialization.PublicFormat.Raw, + ))) + + self.assertEqual(intro_point.enc_key_raw, base64.b64encode(intro_point.enc_key().public_bytes( + encoding = serialization.Encoding.Raw, + format = serialization.PublicFormat.Raw, + ))) + + self.assertEqual(None, intro_point.legacy_key_raw) + self.assertEqual(None, intro_point.legacy_key()) + + @patch('stem.prereq.is_crypto_available', Mock(return_value = False)) + def test_intro_point_crypto_without_prereq(self): + """ + Fetch cryptographic materials when the module is unavailable. + """ + + intro_point = InnerLayer(INNER_LAYER_STR).introduction_points[0] + self.assertRaisesWith(ImportError, 'cryptography module unavailable', intro_point.onion_key) + def test_encode_decode_descriptor(self): """ Encode an HSv3 descriptor and then decode it and make sure you get the intended results. @@ -277,7 +329,7 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): self.skipTest('(requires cryptography ed25519 support)') return - from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey, Ed25519PrivateKey from cryptography.hazmat.primitives import serialization # Build the service @@ -317,9 +369,12 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): for original_intro in intro_points: # Match intro points - if _pubkeys_are_equal(desc_intro.auth_key, original_intro.auth_key): + auth_key_1 = Ed25519PublicKey.from_public_bytes(desc_intro.auth_key_cert.key) + auth_key_2 = original_intro.auth_key + + if _pubkeys_are_equal(auth_key_1, auth_key_2): original_found = True - self.assertTrue(_pubkeys_are_equal(desc_intro.enc_key, original_intro.enc_key)) - self.assertTrue(_pubkeys_are_equal(desc_intro.onion_key, original_intro.onion_key)) + self.assertTrue(_pubkeys_are_equal(desc_intro.enc_key(), original_intro.enc_key)) + self.assertTrue(_pubkeys_are_equal(desc_intro.onion_key(), original_intro.onion_key)) self.assertTrue(original_found)

1 0

[stem/master] Test requirement annotations
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 632ba7f66e0174de392227e85b4be08f01626789 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Oct 20 14:55:10 2019 -0700 Test requirement annotations Oops, forgot that we have these test requirement annotations. --- test/require.py | 1 + test/unit/descriptor/hidden_service_v3.py | 41 +++++++++++-------------------- 2 files changed, 15 insertions(+), 27 deletions(-) diff --git a/test/require.py b/test/require.py index af33359f..ca5fe3ea 100644 --- a/test/require.py +++ b/test/require.py @@ -12,6 +12,7 @@ run. |- needs - skips the test unless a requirement is met | |- cryptography - skips test unless the cryptography module is present + |- ed25519_support - skips test unless cryptography has ed25519 support |- command - requires a command to be on the path |- proc - requires the platform to have recognized /proc contents | diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py index 499064f9..203cd3c3 100644 --- a/test/unit/descriptor/hidden_service_v3.py +++ b/test/unit/descriptor/hidden_service_v3.py @@ -11,6 +11,8 @@ import stem.client.datatype import stem.descriptor import stem.prereq +import test.require + from stem.descriptor.hidden_service import ( CHECKSUM_CONSTANT, REQUIRED_V3_FIELDS, @@ -29,9 +31,12 @@ from test.unit.descriptor import ( try: # added in python 3.3 - from unittest.mock import patch, Mock, MagicMock + from unittest.mock import patch, Mock except ImportError: - from mock import patch, Mock, MagicMock + from mock import patch, Mock + +require_sha3 = test.require.needs(stem.prereq._is_sha3_available, 'requires sha3') +require_x25519 = test.require.needs(lambda: X25519_AVAILABLE, 'requires openssl x5509') expect_invalid_attr = functools.partial(base_expect_invalid_attr, HiddenServiceDescriptorV3, 'version', 3) expect_invalid_attr_for_text = functools.partial(base_expect_invalid_attr_for_text, HiddenServiceDescriptorV3, 'version', 3) @@ -127,18 +132,13 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): self.assertTrue('eaH8VdaTKS' in desc.superencrypted) self.assertEqual('aglChCQF+lbzKgyxJJTpYGVShV/GMDRJ4+cRGCp+a2y/yX/tLSh7hzqI7rVZrUoGj74Xr1CLMYO3fXYCS+DPDQ', desc.signature) + @require_sha3 + @test.require.ed25519_support def test_decryption(self): """ Decrypt our descriptor and validate its content. """ - if not stem.prereq.is_crypto_available(ed25519 = True): - self.skipTest('(requires cryptography ed25519 support)') - return - elif not stem.prereq._is_sha3_available(): - self.skipTest('(requires sha3 support)') - return - desc = HiddenServiceDescriptorV3.from_str(HS_DESC_STR) inner_layer = desc.decrypt(HS_ADDRESS) @@ -259,30 +259,20 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): for test_value in test_values: expect_invalid_attr(self, {'revision-counter': test_value}, 'revision_counter') + @require_sha3 + @test.require.ed25519_support def test_public_key_from_address(self): - if not stem.prereq.is_crypto_available(ed25519 = True): - self.skipTest('(requires cryptography ed25519 support)') - return - elif not stem.prereq._is_sha3_available(): - self.skipTest('(requires sha3 support)') - return - self.assertEqual(b'\x92\xe6\x80\xfaWU.}HL\x9d*>\xdbF\xfb\xc0v\xe5N\xa9\x0bw\xbb\x84\xe3\xe6\xd5e}R\xa1', HiddenServiceDescriptorV3._public_key_from_address(HS_ADDRESS)) self.assertRaisesWith(ValueError, "'boom.onion' isn't a valid hidden service v3 address", HiddenServiceDescriptorV3._public_key_from_address, 'boom') self.assertRaisesWith(ValueError, 'Bad checksum (expected def7 but was 842e)', HiddenServiceDescriptorV3._public_key_from_address, '5' * 56) + @require_x25519 + @test.require.ed25519_support def test_intro_point_crypto(self): """ Retrieve IntroductionPointV3 cryptographic materials. """ - if not stem.prereq.is_crypto_available(): - self.skipTest('(requires cryptography support)') - return - elif not X25519_AVAILABLE: - self.skipTest('(openssl requires X25519 support)') - return - from cryptography.hazmat.backends.openssl.x25519 import X25519PublicKey from cryptography.hazmat.primitives import serialization @@ -316,6 +306,7 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): intro_point = InnerLayer(INNER_LAYER_STR).introduction_points[0] self.assertRaisesWith(ImportError, 'cryptography module unavailable', intro_point.onion_key) + @test.require.ed25519_support def test_encode_decode_descriptor(self): """ Encode an HSv3 descriptor and then decode it and make sure you get the intended results. @@ -325,10 +316,6 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): making onion service descriptors. """ - if not stem.prereq.is_crypto_available(ed25519 = True): - self.skipTest('(requires cryptography ed25519 support)') - return - from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey, Ed25519PrivateKey from cryptography.hazmat.primitives import serialization

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits November 2019