tor-commits November 2019

tor-commits@lists.torproject.org

20 participants
2923 discussions

[stem/master] HSv3 introductory point encoding
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 0b7b6bb7a7d1b5daa5ca26c8339d9cb6b3f3d518 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Oct 30 15:55:03 2019 -0700 HSv3 introductory point encoding Now that we have the building blocks it's a simple matter for us to encode HSv3 introductory points back into strings. --- stem/descriptor/hidden_service.py | 33 ++++++++++++++++++++++++++++++- test/unit/descriptor/hidden_service_v3.py | 8 ++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index 72fc9b2b..09030ca5 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -163,7 +163,7 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s :var str enc_key_raw: base64 introduction request encryption key :var stem.certificate.Ed25519Certificate enc_key_cert: cross-certifier of the signing key by the encryption key :var str legacy_key_raw: base64 legacy introduction point RSA public key - :var str legacy_key_cert: cross-certifier of the signing key by the legacy key + :var str legacy_key_cert: base64 cross-certifier of the signing key by the legacy key """ @staticmethod @@ -204,6 +204,37 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s return IntroductionPointV3(link_specifiers, onion_key, auth_key_cert, enc_key, enc_key_cert, legacy_key, legacy_key_cert) + def encode(self): + """ + Descriptor representation of this introduction point. + + :returns: **str** for our descriptor representation + """ + + lines = [] + + link_count = stem.client.datatype.Size.CHAR.pack(len(self.link_specifiers)) + link_specifiers = link_count + ''.join([l.pack() for l in self.link_specifiers]) + lines.append('introduction-point %s' % base64.b64encode(link_specifiers)) + + if self.onion_key_raw: + lines.append('onion-key ntor %s' % self.onion_key_raw) + + lines.append('auth-key\n' + self.auth_key_cert.to_base64(pem = True)) + + if self.enc_key_raw: + lines.append('enc-key ntor %s' % self.enc_key_raw) + + lines.append('enc-key-cert\n' + self.enc_key_cert.to_base64(pem = True)) + + if self.legacy_key_raw: + lines.append('legacy-key\n' + self.legacy_key_raw) + + if self.legacy_key_cert: + lines.append('legacy-key-cert\n' + self.legacy_key_cert) + + return '\n'.join(lines) + def onion_key(self): """ Provides our ntor introduction point public key. diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py index 6f8ba69e..fb190211 100644 --- a/test/unit/descriptor/hidden_service_v3.py +++ b/test/unit/descriptor/hidden_service_v3.py @@ -284,6 +284,14 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): self.assertTrue('JAoGBAMO3' in intro_point.legacy_key_raw) self.assertTrue('Ln1ITJ0qP' in intro_point.legacy_key_cert) + def test_intro_point_encode(self): + """ + Encode an introduction point back into a string. + """ + + intro_point = IntroductionPointV3.parse(INTRO_POINT_STR) + self.assertEqual(INTRO_POINT_STR.rstrip(), intro_point.encode()) + @require_x25519 @test.require.ed25519_support def test_intro_point_crypto(self):

1 0

[stem/master] Provide unicode from to_base64()
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit c18daba11b00ce084b903a54c40551737b15bfe4 Author: Damian Johnson <atagar(a)torproject.org> Date: Fri Oct 25 14:29:24 2019 -0700 Provide unicode from to_base64() Standardizing our return type so unit tests pass with python3. --- stem/descriptor/certificate.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index 84610328..b48a0899 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -242,15 +242,15 @@ class Ed25519Certificate(object): <https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail>`_, for more information see `RFC 7468 <https://tools.ietf.org/html/rfc7468>`_ - :returns: **bytes** for our encoded certificate representation + :returns: **unicode** for our encoded certificate representation """ - encoded = '\n'.join(stem.util.str_tools._split_by_length(base64.b64encode(self.pack()), 64)) + encoded = b'\n'.join(stem.util.str_tools._split_by_length(base64.b64encode(self.pack()), 64)) if pem: - return '-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % encoded - else: - return encoded + encoded = b'-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % encoded + + return stem.util.str_tools._to_unicode(encoded) @staticmethod def _from_descriptor(keyword, attribute): @@ -307,7 +307,7 @@ class Ed25519CertificateV1(Ed25519Certificate): encoded = bytearray() encoded += Size.CHAR.pack(self.version) encoded += Size.CHAR.pack(self.type_int) - encoded += Size.LONG.pack(stem.util.datetime_to_unix(self.expiration) / 3600) + encoded += Size.LONG.pack(int(stem.util.datetime_to_unix(self.expiration) / 3600)) encoded += Size.CHAR.pack(self.key_type) encoded += self.key encoded += Size.CHAR.pack(len(self.extensions))

1 0

[stem/master] Simplify LinkSpecifier construction
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 938c397648003b15a44412bb0c97b5ad114ad9fa Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Oct 31 11:39:35 2019 -0700 Simplify LinkSpecifier construction Constructing from packed values made construction of a LinkSpecifier a pita. Taking an address/port argument instead. --- stem/client/datatype.py | 56 ++++++++++++++++++++++++++------------ test/unit/client/link_specifier.py | 10 ++++++- 2 files changed, 47 insertions(+), 19 deletions(-) diff --git a/stem/client/datatype.py b/stem/client/datatype.py index a0e59cb0..ac417b83 100644 --- a/stem/client/datatype.py +++ b/stem/client/datatype.py @@ -566,6 +566,8 @@ class LinkSpecifier(Field): `EXTEND cell specification <https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt#n975>`_. + .. versionadded:: 1.8.0 + :var int type: numeric identifier of our type :var bytes value: encoded link specification destination """ @@ -589,9 +591,9 @@ class LinkSpecifier(Field): value, packed = split(packed, value_size) if link_type == 0: - return LinkByIPv4(value), packed + return LinkByIPv4.unpack(value), packed elif link_type == 1: - return LinkByIPv6(value), packed + return LinkByIPv6.unpack(value), packed elif link_type == 2: return LinkByFingerprint(value), packed elif link_type == 3: @@ -611,46 +613,58 @@ class LinkByIPv4(LinkSpecifier): """ TLS connection to an IPv4 address. + .. versionadded:: 1.8.0 + :var str address: relay IPv4 address :var int port: relay ORPort """ - def __init__(self, value): - super(LinkByIPv4, self).__init__(0, value) + def __init__(self, address, port): + super(LinkByIPv4, self).__init__(0, _pack_ipv4_address(address) + Size.SHORT.pack(port)) + self.address = address + self.port = port + + @staticmethod + def unpack(value): if len(value) != 6: raise ValueError('IPv4 link specifiers should be six bytes, but was %i instead: %s' % (len(value), binascii.hexlify(value))) - address_bin, value = split(value, 4) - self.address = _unpack_ipv4_address(address_bin) - - self.port, _ = Size.SHORT.pop(value) + addr, port = split(value, 4) + return LinkByIPv4(_unpack_ipv4_address(addr), Size.SHORT.unpack(port)) class LinkByIPv6(LinkSpecifier): """ TLS connection to an IPv6 address. + .. versionadded:: 1.8.0 + :var str address: relay IPv6 address :var int port: relay ORPort """ - def __init__(self, value): - super(LinkByIPv6, self).__init__(1, value) + def __init__(self, address, port): + super(LinkByIPv6, self).__init__(1, _pack_ipv6_address(address) + Size.SHORT.pack(port)) + self.address = address + self.port = port + + @staticmethod + def unpack(value): if len(value) != 18: raise ValueError('IPv6 link specifiers should be eighteen bytes, but was %i instead: %s' % (len(value), binascii.hexlify(value))) - address_bin, value = split(value, 16) - self.address = _unpack_ipv6_address(address_bin) - - self.port, _ = Size.SHORT.pop(value) + addr, port = split(value, 16) + return LinkByIPv6(_unpack_ipv6_address(addr), Size.SHORT.unpack(port)) class LinkByFingerprint(LinkSpecifier): """ Connection to a SHA1 identity fingerprint. + .. versionadded:: 1.8.0 + :var str fingerprint: relay sha1 fingerprint """ @@ -667,6 +681,8 @@ class LinkByEd25519(LinkSpecifier): """ Connection to a Ed25519 identity fingerprint. + .. versionadded:: 1.8.0 + :var str fingerprint: relay ed25519 fingerprint """ @@ -713,15 +729,19 @@ class KDF(collections.namedtuple('KDF', ['key_hash', 'forward_digest', 'backward return KDF(key_hash, forward_digest, backward_digest, forward_key, backward_key) -def _unpack_ipv4_address(value): - # convert bytes to a standard IPv4 address +def _pack_ipv4_address(address): + return b''.join([Size.CHAR.pack(int(v)) for v in address.split('.')]) + +def _unpack_ipv4_address(value): return '.'.join([str(Size.CHAR.unpack(value[i:i + 1])) for i in range(4)]) -def _unpack_ipv6_address(value): - # convert bytes to a standard IPv6 address +def _pack_ipv6_address(address): + return b''.join([Size.SHORT.pack(int(v, 16)) for v in address.split(':')]) + +def _unpack_ipv6_address(value): return ':'.join(['%04x' % Size.SHORT.unpack(value[i * 2:(i + 1) * 2]) for i in range(8)]) diff --git a/test/unit/client/link_specifier.py b/test/unit/client/link_specifier.py index b42ea57c..181627de 100644 --- a/test/unit/client/link_specifier.py +++ b/test/unit/client/link_specifier.py @@ -15,7 +15,7 @@ from stem.client.datatype import ( class TestLinkSpecifier(unittest.TestCase): def test_link_by_ipv4_address(self): - destination, _ = LinkSpecifier.pop(b'\x00\x06\x01\x02\x03\x04#)') + destination = LinkSpecifier.unpack(b'\x00\x06\x01\x02\x03\x04#)') self.assertEqual(LinkByIPv4, type(destination)) self.assertEqual(0, destination.type) @@ -23,6 +23,10 @@ class TestLinkSpecifier(unittest.TestCase): self.assertEqual('1.2.3.4', destination.address) self.assertEqual(9001, destination.port) + destination = LinkByIPv4('1.2.3.4', 9001) + self.assertEqual(b'\x00\x06\x01\x02\x03\x04#)', destination.pack()) + self.assertEqual(b'\x01\x02\x03\x04#)', destination.value) + def test_link_by_ipv6_address(self): destination, _ = LinkSpecifier.pop(b'\x01\x12&\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01#)') @@ -32,6 +36,10 @@ class TestLinkSpecifier(unittest.TestCase): self.assertEqual('2600:0000:0000:0000:0000:0000:0000:0001', destination.address) self.assertEqual(9001, destination.port) + destination = LinkByIPv6('2600:0000:0000:0000:0000:0000:0000:0001', 9001) + self.assertEqual(b'\x01\x12&\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01#)', destination.pack()) + self.assertEqual(b'&\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01#)', destination.value) + def test_link_by_fingerprint(self): destination, _ = LinkSpecifier.pop(b'\x02\x14CCCCCCCCCCCCCCCCCCCC')

1 0

[stem/master] Move intro point parsing into class
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit deba20b19b742ae51f60fbff1432823abe15d4af Author: Damian Johnson <atagar(a)torproject.org> Date: Fri Oct 25 17:24:17 2019 -0700 Move intro point parsing into class IntroductionPointV3 requires an encode() method, so fitting for the class to first include its parser. --- stem/descriptor/hidden_service.py | 122 ++++++++++----------- .../descriptor/data/hidden_service_v3_intro_point | 28 +++++ test/unit/descriptor/hidden_service_v3.py | 18 +++ 3 files changed, 106 insertions(+), 62 deletions(-) diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index 1819dfc5..72fc9b2b 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -163,9 +163,47 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s :var str enc_key_raw: base64 introduction request encryption key :var stem.certificate.Ed25519Certificate enc_key_cert: cross-certifier of the signing key by the encryption key :var str legacy_key_raw: base64 legacy introduction point RSA public key - :var stem.certificate.Ed25519Certificate legacy_key_cert: cross-certifier of the signing key by the legacy key + :var str legacy_key_cert: cross-certifier of the signing key by the legacy key """ + @staticmethod + def parse(content): + """ + Parses an introduction point from its descriptor content. + + :param str content: descriptor content to parse + + :returns: :class:`~stem.descriptor.hidden_service.IntroductionPointV3` for the descriptor content + + :raises: **ValueError** if descriptor content is malformed + """ + + entry = _descriptor_components(content, False) + link_specifiers = IntroductionPointV3._parse_link_specifiers(_value('introduction-point', entry)) + + onion_key_line = _value('onion-key', entry) + onion_key = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None + + _, block_type, auth_key_cert = entry['auth-key'][0] + auth_key_cert = Ed25519Certificate.from_base64(auth_key_cert) + + if block_type != 'ED25519 CERT': + raise ValueError('Expected auth-key to have an ed25519 certificate, but was %s' % block_type) + + enc_key_line = _value('enc-key', entry) + enc_key = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None + + _, block_type, enc_key_cert = entry['enc-key-cert'][0] + enc_key_cert = Ed25519Certificate.from_base64(enc_key_cert) + + if block_type != 'ED25519 CERT': + raise ValueError('Expected enc-key-cert to have an ed25519 certificate, but was %s' % block_type) + + legacy_key = entry['legacy-key'][0][2] if 'legacy-key' in entry else None + legacy_key_cert = entry['legacy-key-cert'][0][2] if 'legacy-key-cert' in entry else None + + return IntroductionPointV3(link_specifiers, onion_key, auth_key_cert, enc_key, enc_key_cert, legacy_key, legacy_key_cert) + def onion_key(self): """ Provides our ntor introduction point public key. @@ -221,6 +259,25 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s return X25519PublicKey.from_public_bytes(base64.b64decode(value)) + @staticmethod + def _parse_link_specifiers(content): + try: + content = base64.b64decode(content) + except Exception as exc: + raise ValueError('Unable to base64 decode introduction point (%s): %s' % (exc, content)) + + link_specifiers = [] + count, content = stem.client.datatype.Size.CHAR.pop(content) + + for i in range(count): + link_specifier, content = stem.client.datatype.LinkSpecifier.pop(content) + link_specifiers.append(link_specifier) + + if content: + raise ValueError('Introduction point had excessive data (%s)' % content) + + return link_specifiers + class AlternateIntroductionPointV3(object): """ @@ -493,73 +550,14 @@ def _parse_v3_introduction_points(descriptor, entries): while remaining: div = remaining.find('\nintroduction-point ', 10) + content, remaining = (remaining[:div], remaining[div + 1:]) if div != -1 else (remaining, '') - if div == -1: - intro_point_str = remaining - remaining = '' - else: - intro_point_str = remaining[:div] - remaining = remaining[div + 1:] - - entry = _descriptor_components(intro_point_str, False) - link_specifiers = _parse_link_specifiers(_value('introduction-point', entry)) - - onion_key_line = _value('onion-key', entry) - onion_key = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None - - _, block_type, auth_key_cert = entry['auth-key'][0] - auth_key_cert = Ed25519Certificate.from_base64(auth_key_cert) - - if block_type != 'ED25519 CERT': - raise ValueError('Expected auth-key to have an ed25519 certificate, but was %s' % block_type) - - enc_key_line = _value('enc-key', entry) - enc_key = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None - - _, block_type, enc_key_cert = entry['enc-key-cert'][0] - enc_key_cert = Ed25519Certificate.from_base64(enc_key_cert) - - if block_type != 'ED25519 CERT': - raise ValueError('Expected enc-key-cert to have an ed25519 certificate, but was %s' % block_type) - - legacy_key = entry['legacy-key'][0][2] if 'legacy-key' in entry else None - legacy_key_cert = entry['legacy-key-cert'][0][2] if 'legacy-key-cert' in entry else None - - introduction_points.append( - IntroductionPointV3( - link_specifiers, - onion_key, - auth_key_cert, - enc_key, - enc_key_cert, - legacy_key, - legacy_key_cert, - ) - ) + introduction_points.append(IntroductionPointV3.parse(content)) descriptor.introduction_points = introduction_points del descriptor._unparsed_introduction_points -def _parse_link_specifiers(val): - try: - val = base64.b64decode(val) - except Exception as exc: - raise ValueError('Unable to base64 decode introduction point (%s): %s' % (exc, val)) - - link_specifiers = [] - count, val = stem.client.datatype.Size.CHAR.pop(val) - - for i in range(count): - link_specifier, val = stem.client.datatype.LinkSpecifier.pop(val) - link_specifiers.append(link_specifier) - - if val: - raise ValueError('Introduction point had excessive data (%s)' % val) - - return link_specifiers - - _parse_v2_version_line = _parse_int_line('version', 'version', allow_negative = False) _parse_rendezvous_service_descriptor_line = _parse_simple_line('rendezvous-service-descriptor', 'descriptor_id') _parse_permanent_key_line = _parse_key_block('permanent-key', 'permanent_key', 'RSA PUBLIC KEY') diff --git a/test/unit/descriptor/data/hidden_service_v3_intro_point b/test/unit/descriptor/data/hidden_service_v3_intro_point new file mode 100644 index 00000000..618d0e80 --- /dev/null +++ b/test/unit/descriptor/data/hidden_service_v3_intro_point @@ -0,0 +1,28 @@ +introduction-point AgIUQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0MABgUGBwgjKQ== +onion-key ntor AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= +auth-key +-----BEGIN ED25519 CERT----- +AQkABl60Acq8QW8O7ONgImfilmjrEIeISkZmGuedsdkZucakUBZbAQAgBACS5oD6 +V1UufUhMnSo+20b7wHblTqkLd7uE4+bVZX1Soded2A7SaJOyvI2FBNvljCNgl5T/ +eLNpci4yTizyDv2A0/QB4SyaZ2+SOM/uQn3DKKyhUwwNuaD/sSuUI25gkgY= +-----END ED25519 CERT----- +enc-key ntor AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= +enc-key-cert +-----BEGIN ED25519 CERT----- +AQsABqUQARe6uX12UazJAo5Qt2iP0rJ29hq/GEEi28dAsKqCOHa6AQAgBACS5oD6 +V1UufUhMnSo+20b7wHblTqkLd7uE4+bVZX1SoY1XfpJjLTI3tJwIrFM/JFP3XbVF +CtwFlIHgSS1/M9Rr+eznM17+5hd+0SHL4/+WV5ukxyPOWIL6X1z+KPg4hA0= +-----END ED25519 CERT----- +legacy-key +-----BEGIN RSA PUBLIC KEY----- +MIGJAoGBAMO3ZXrcA+PclKppGCh9TOG0H6mubTAgji4fLF87GelggQs5bnPdQeaS +v4HgP42J/mMinSLpbg5LhL5gd7AqwOxe9cpEhbvwrM63ot7gkj2tJqs2PLlokqSx +ZBEAssKbE/8F2iVoEWoXd8g8Pn5nG7wRKDGGQRAjintrBSncTvfRAgMBAAE= +-----END RSA PUBLIC KEY----- +legacy-key-cert +-----BEGIN CROSSCERT----- +kuaA+ldVLn1ITJ0qPttG+8B25U6pC3e7hOPm1WV9UqEABl60gH1LLE5C2kl5BBpb +E2Ajh6kJuf2fXMW7csYYNtPACZjFoG+kb16fh7y9L2pLuBFNKpkVDMsiQVcdwWWg +Nu6qpGj1vHDR1XUM7ocoXB3QMVXCIxvA9b8k3q7KFvXgImi9GZ7l1/K+emm58MYM +CxhNKazjiFgXjbs9kf+S9HxaF/Yw +-----END CROSSCERT----- diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py index b57a3ebf..6f8ba69e 100644 --- a/test/unit/descriptor/hidden_service_v3.py +++ b/test/unit/descriptor/hidden_service_v3.py @@ -17,6 +17,7 @@ from stem.descriptor.hidden_service import ( CHECKSUM_CONSTANT, REQUIRED_V3_FIELDS, X25519_AVAILABLE, + IntroductionPointV3, AlternateIntroductionPointV3, HiddenServiceDescriptorV3, OuterLayer, @@ -60,6 +61,9 @@ with open(get_resource('hidden_service_v3_outer_layer')) as outer_layer_file: with open(get_resource('hidden_service_v3_inner_layer')) as inner_layer_file: INNER_LAYER_STR = inner_layer_file.read() +with open(get_resource('hidden_service_v3_intro_point')) as intro_point_file: + INTRO_POINT_STR = intro_point_file.read() + def _pubkeys_are_equal(pubkey1, pubkey2): """ @@ -266,6 +270,20 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): self.assertRaisesWith(ValueError, "'boom.onion' isn't a valid hidden service v3 address", HiddenServiceDescriptorV3._public_key_from_address, 'boom') self.assertRaisesWith(ValueError, 'Bad checksum (expected def7 but was 842e)', HiddenServiceDescriptorV3._public_key_from_address, '5' * 56) + def test_intro_point_parse(self): + """ + Parse a v3 introduction point. + """ + + intro_point = IntroductionPointV3.parse(INTRO_POINT_STR) + + self.assertEqual('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', intro_point.onion_key_raw) + self.assertTrue('0Acq8QW8O7O' in intro_point.auth_key_cert.to_base64()) + self.assertEqual('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', intro_point.enc_key_raw) + self.assertTrue('4807i5', intro_point.enc_key_cert.to_base64()) + self.assertTrue('JAoGBAMO3' in intro_point.legacy_key_raw) + self.assertTrue('Ln1ITJ0qP' in intro_point.legacy_key_cert) + @require_x25519 @test.require.ed25519_support def test_intro_point_crypto(self):

1 0

[stem/master] Revert _decrypt_layer() crypto changes
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit c40db8f7c28e6b5b90e61317e256911fb8661dc7 Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Oct 31 15:48:07 2019 -0700 Revert _decrypt_layer() crypto changes George adjusted _decrypt_layer() to use his hsv3_crypto module. Swapping this back to what we had. --- stem/descriptor/hidden_service.py | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index bb8937d8..a490f3b7 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -36,6 +36,7 @@ import datetime import hashlib import io import os +import struct import time import stem.client.datatype @@ -213,8 +214,8 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s lines = [] link_count = stem.client.datatype.Size.CHAR.pack(len(self.link_specifiers)) - link_specifiers = link_count + ''.join([l.pack() for l in self.link_specifiers]) - lines.append('introduction-point %s' % base64.b64encode(link_specifiers)) + link_specifiers = link_count + b''.join([l.pack() for l in self.link_specifiers]) + lines.append('introduction-point %s' % stem.util.str_tools._to_unicode(base64.b64encode(link_specifiers))) if self.onion_key_raw: lines.append('onion-key ntor %s' % self.onion_key_raw) @@ -365,6 +366,9 @@ def _decrypt_layer(encrypted_block, constant, revision_counter, subcredential, b from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes from cryptography.hazmat.backends import default_backend + def pack(val): + return struct.pack('>Q', val) + if encrypted_block.startswith('-----BEGIN MESSAGE-----\n') and encrypted_block.endswith('\n-----END MESSAGE-----'): encrypted_block = encrypted_block[24:-22] @@ -380,10 +384,14 @@ def _decrypt_layer(encrypted_block, constant, revision_counter, subcredential, b ciphertext = encrypted[SALT_LEN:-MAC_LEN] expected_mac = encrypted[-MAC_LEN:] - secret_key, secret_iv, mac_key = hsv3_crypto.get_desc_keys(blinded_key, constant, - subcredential, revision_counter, salt, ) + kdf = hashlib.shake_256(blinded_key + subcredential + pack(revision_counter) + salt + constant) + keys = kdf.digest(S_KEY_LEN + S_IV_LEN + MAC_LEN) + + secret_key = keys[:S_KEY_LEN] + secret_iv = keys[S_KEY_LEN:S_KEY_LEN + S_IV_LEN] + mac_key = keys[S_KEY_LEN + S_IV_LEN:] - mac = hsv3_crypto.get_desc_encryption_mac(mac_key, salt, ciphertext) + mac = hashlib.sha3_256(pack(len(mac_key)) + mac_key + pack(len(salt)) + salt + ciphertext).digest() if mac != expected_mac: raise ValueError('Malformed mac (expected %s, but was %s)' % (expected_mac, mac))

1 0

[stem/master] Drop _get_descriptor_revision_counter() helper
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit efbf560470297414c978cba5c622eb87f6214f81 Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Oct 15 13:04:14 2019 -0700 Drop _get_descriptor_revision_counter() helper This helper didn't do anything. Originally it was an overly complicated method of getting a unix timestamp (time.time() does the trick). --- stem/descriptor/hidden_service.py | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index ede278cc..9885fe7a 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -812,11 +812,6 @@ def _get_descriptor_signing_cert(descriptor_signing_public_key, blinded_priv_key return '\n-----BEGIN %s-----\n%s\n-----END %s-----' % ('ED25519 CERT', cert_blob, 'ED25519 CERT') -def _get_descriptor_revision_counter(): - # TODO replace with OPE scheme - return int(time.time()) - - def b64_and_wrap_desc_layer(layer_bytes, prefix_bytes=b''): """ Encode the descriptor layer in 'layer_bytes' to base64, and then wrap it up @@ -1007,7 +1002,7 @@ class HiddenServiceDescriptorV3(BaseHiddenServiceDescriptor): descriptor_signing_public_key = descriptor_signing_private_key.public_key() # Get the main encrypted descriptor body - revision_counter_int = _get_descriptor_revision_counter() + revision_counter_int = int(time.time()) subcredential = hsv3_crypto.get_subcredential(public_identity_key_bytes, blinded_pubkey_bytes) # XXX It would be more elegant to have all the above variables attached to @@ -1224,7 +1219,7 @@ class InnerLayer(Descriptor): @staticmethod def _decrypt(outer_layer, revision_counter, subcredential, blinded_key): plaintext = _decrypt_layer(outer_layer.encrypted, b'hsdir-encrypted-data', revision_counter, subcredential, blinded_key) - return InnerLayer(plaintext, outer_layer = outer_layer, validate=True) + return InnerLayer(plaintext, validate = True, outer_layer = outer_layer) def __init__(self, content, validate = False, outer_layer = None): super(InnerLayer, self).__init__(content, lazy_load = not validate)

1 0

[stem/master] Fix certificate class doc links
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 3fe6d4526bde2e9fd273c85b57657b17d817fce6 Author: Damian Johnson <atagar(a)torproject.org> Date: Fri Nov 1 15:54:02 2019 -0700 Fix certificate class doc links Oops, missed the 'descriptor' module part of these pydocs. --- stem/descriptor/hidden_service.py | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index a490f3b7..9168123d 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -47,8 +47,6 @@ import stem.util.str_tools import stem.util.tor_tools from stem.descriptor import hsv3_crypto -from stem.descriptor.certificate import Ed25519Certificate - from stem.descriptor import ( PGP_BLOCK_END, @@ -159,9 +157,9 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s :var list link_specifiers: :class:`~stem.client.datatype.LinkSpecifier` where this service is reachable :var str onion_key_raw: base64 ntor introduction point public key - :var stem.certificate.Ed25519Certificate auth_key_cert: cross-certifier of the signing key with the auth key + :var stem.descriptor.certificate.Ed25519Certificate auth_key_cert: cross-certifier of the signing key with the auth key :var str enc_key_raw: base64 introduction request encryption key - :var stem.certificate.Ed25519Certificate enc_key_cert: cross-certifier of the signing key by the encryption key + :var stem.descriptor.certificate.Ed25519Certificate enc_key_cert: cross-certifier of the signing key by the encryption key :var str legacy_key_raw: base64 legacy introduction point RSA public key :var str legacy_key_cert: base64 cross-certifier of the signing key by the legacy key """ @@ -185,7 +183,7 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s onion_key = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None _, block_type, auth_key_cert = entry['auth-key'][0] - auth_key_cert = Ed25519Certificate.from_base64(auth_key_cert) + auth_key_cert = stem.descriptor.certificate.Ed25519Certificate.from_base64(auth_key_cert) if block_type != 'ED25519 CERT': raise ValueError('Expected auth-key to have an ed25519 certificate, but was %s' % block_type) @@ -194,7 +192,7 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s enc_key = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None _, block_type, enc_key_cert = entry['enc-key-cert'][0] - enc_key_cert = Ed25519Certificate.from_base64(enc_key_cert) + enc_key_cert = stem.descriptor.certificate.Ed25519Certificate.from_base64(enc_key_cert) if block_type != 'ED25519 CERT': raise ValueError('Expected enc-key-cert to have an ed25519 certificate, but was %s' % block_type) @@ -484,7 +482,7 @@ _parse_v2_signature_line = _parse_key_block('signature', 'signature', 'SIGNATURE _parse_v3_version_line = _parse_int_line('hs-descriptor', 'version', allow_negative = False) _parse_lifetime_line = _parse_int_line('descriptor-lifetime', 'lifetime', allow_negative = False) -_parse_signing_cert = Ed25519Certificate._from_descriptor('descriptor-signing-key-cert', 'signing_cert') +_parse_signing_cert = stem.descriptor.certificate.Ed25519Certificate._from_descriptor('descriptor-signing-key-cert', 'signing_cert') _parse_revision_counter_line = _parse_int_line('revision-counter', 'revision_counter', allow_negative = False) _parse_superencrypted_line = _parse_key_block('superencrypted', 'superencrypted', 'MESSAGE') _parse_v3_signature_line = _parse_simple_line('signature', 'signature') @@ -893,7 +891,7 @@ class HiddenServiceDescriptorV3(BaseHiddenServiceDescriptor): :var int version: **\\*** hidden service descriptor version :var int lifetime: **\\*** minutes after publication this descriptor is valid - :var stem.certificate.Ed25519Certificate signing_cert: **\\*** cross-certifier for the short-term descriptor signing key + :var stem.descriptor.certificate.Ed25519Certificate signing_cert: **\\*** cross-certifier for the short-term descriptor signing key :var int revision_counter: **\\*** descriptor revision number :var str superencrypted: **\\*** encrypted HS-DESC-ENC payload :var str signature: **\\*** signature of this descriptor

1 0

[stem/master] Resume test_inner_layer() checks
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 4f1fb3a9e791fdac288a683831e49ef0493a6740 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Nov 6 12:02:07 2019 -0800 Resume test_inner_layer() checks Adapting a couple checks I disabled earlier. --- test/unit/descriptor/hidden_service_v3.py | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py index 61752e11..b0f1829a 100644 --- a/test/unit/descriptor/hidden_service_v3.py +++ b/test/unit/descriptor/hidden_service_v3.py @@ -14,12 +14,6 @@ import stem.prereq import test.require -from test.unit.descriptor import ( - get_resource, - base_expect_invalid_attr, - base_expect_invalid_attr_for_text, -) - from stem.descriptor.hidden_service import ( IntroductionPointV3, HiddenServiceDescriptorV3, @@ -27,6 +21,12 @@ from stem.descriptor.hidden_service import ( InnerLayer, ) +from test.unit.descriptor import ( + get_resource, + base_expect_invalid_attr, + base_expect_invalid_attr_for_text, +) + try: # added in python 3.3 from unittest.mock import patch, Mock @@ -142,15 +142,11 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): self.assertEqual('1.2.3.4', link_specifier.address) self.assertEqual(9001, link_specifier.port) - # TODO: the following doesn't pass with recent HiddenServiceDescriptorV3 changes - - return - - self.assertEqual('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', intro_point.onion_key) - self.assertTrue('ID2l9EFNrp' in intro_point.auth_key) - self.assertEqual('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', intro_point.enc_key) + self.assertEqual('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', intro_point.onion_key_raw) + self.assertTrue('ID2l9EFNrp' in intro_point.auth_key_cert.to_base64()) + self.assertEqual('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', intro_point.enc_key_raw) self.assertTrue('ZvjPt5IfeQ', intro_point.enc_key_cert) - self.assertEqual(None, intro_point.legacy_key) + self.assertEqual(None, intro_point.legacy_key_raw) self.assertEqual(None, intro_point.legacy_key_cert) def test_required_fields(self):

1 0

[stem/master] Drop prototype classes
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 5dc1f48975b10c8ebd1712ce3e749576505bfb1f Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Oct 31 15:40:17 2019 -0700 Drop prototype classes We're now at a point where we can drop our prototype introduction point and certificate classes. Our test_encode_decode_certificate() test is redundant with test_certificate_encoding(). --- stem/descriptor/certificate.py | 106 ---------------------- stem/descriptor/hidden_service.py | 144 ++---------------------------- test/unit/descriptor/certificate.py | 29 ------ test/unit/descriptor/hidden_service_v3.py | 22 ----- 4 files changed, 7 insertions(+), 294 deletions(-) diff --git a/stem/descriptor/certificate.py b/stem/descriptor/certificate.py index 973957f1..dca54aee 100644 --- a/stem/descriptor/certificate.py +++ b/stem/descriptor/certificate.py @@ -470,109 +470,3 @@ class Ed25519CertificateV1(Ed25519Certificate): key.verify(self.signature, base64.b64decode(stem.util.str_tools._to_bytes(self.encoded))[:-ED25519_SIGNATURE_LENGTH]) except InvalidSignature: raise ValueError('Ed25519KeyCertificate signing key is invalid (signature forged or corrupt)') - - -class MyED25519Certificate(object): - """ - This class represents an ed25519 certificate and it's made for encoding it into a string. - We should merge this class with the one above. - """ - def __init__(self, cert_type, expiration_date, - cert_key_type, certified_pub_key, - signing_priv_key, include_signing_key, - version=1): - """ - :var int version - :var stem.client.datatype.CertType cert_type - :var int cert_type_int - :var datetime expiration_date - :var int cert_key_type - :var ED25519PublicKey certified_pub_key - :var ED25519PrivateKey signing_priv_key - :var bool include_signing_key - """ - self.version = version - self.cert_type, self.cert_type_int = ClientCertType.get(cert_type) - self.expiration_date = expiration_date - self.cert_key_type = cert_key_type - self.certified_pub_key = certified_pub_key - - self.signing_priv_key = signing_priv_key - self.signing_pub_key = signing_priv_key.public_key() - - self.include_signing_key = include_signing_key - # XXX validate params - - def _get_certificate_signature(self, msg_body): - return self.signing_priv_key.sign(msg_body) - - def _get_cert_extensions_bytes(self): - """ - Build the cert extensions part of the certificate - """ - - from cryptography.hazmat.primitives import serialization - n_extensions = 0 - - # If we need to include the signing key, let's create the extension body - # ExtLength [2 bytes] - # ExtType [1 byte] - # ExtFlags [1 byte] - # ExtData [ExtLength bytes] - if self.include_signing_key: - n_extensions += 1 - - signing_pubkey_bytes = self.signing_pub_key.public_bytes(encoding=serialization.Encoding.Raw, - format=serialization.PublicFormat.Raw) - - ext_length = len(signing_pubkey_bytes) - ext_type = 4 - ext_flags = 0 - ext_data = signing_pubkey_bytes - - # Now build the actual byte representation of any extensions - ext_obj = bytearray() - ext_obj += Size.CHAR.pack(n_extensions) - - if self.include_signing_key: - ext_obj += Size.SHORT.pack(ext_length) - ext_obj += Size.CHAR.pack(ext_type) - ext_obj += Size.CHAR.pack(ext_flags) - ext_obj += ext_data - - return bytes(ext_obj) - - def encode(self): - """Return a bytes representation of this certificate.""" - from cryptography.hazmat.primitives import serialization - obj = bytearray() - - obj += Size.CHAR.pack(self.version) - obj += Size.CHAR.pack(self.cert_type_int) - - # Encode EXPIRATION_DATE - expiration_seconds_since_epoch = stem.util.datetime_to_unix(self.expiration_date) - expiration_hours_since_epoch = int(expiration_seconds_since_epoch) // 3600 - obj += Size.LONG.pack(expiration_hours_since_epoch) - - # Encode CERT_KEY_TYPE - obj += Size.CHAR.pack(self.cert_key_type) - - # Encode CERTIFIED_KEY - certified_pub_key_bytes = self.certified_pub_key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) - assert(len(certified_pub_key_bytes) == 32) - obj += certified_pub_key_bytes - - # Encode N_EXTENSIONS and EXTENSIONS - obj += self._get_cert_extensions_bytes() - - # Do the signature on the body we have so far - obj += self._get_certificate_signature(bytes(obj)) - - return bytes(obj) - - def encode_for_descriptor(self): - cert_bytes = self.encode() - cert_b64 = base64.b64encode(cert_bytes) - cert_b64 = b'\n'.join(stem.util.str_tools._split_by_length(cert_b64, 64)) - return b'-----BEGIN ED25519 CERT-----\n%s\n-----END ED25519 CERT-----' % cert_b64 diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index 68d150b1..bb8937d8 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -45,7 +45,6 @@ import stem.util.connection import stem.util.str_tools import stem.util.tor_tools -from stem.client.datatype import CertType from stem.descriptor import hsv3_crypto from stem.descriptor.certificate import Ed25519Certificate @@ -310,127 +309,6 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s return link_specifiers -class AlternateIntroductionPointV3(object): - """ - Introduction point for a v3 hidden service. - - We want this class to satisfy two use cases: - - - Parsing introduction points directly from the HSv3 descriptor and saving - their data here. - - - Creating introduction points for inclusion to an HSv3 descriptor at a point - where a descriptor signing key is not yet known (because the descriptor is - not yet made). In which case, the certificates cannot be created yet and - hence need to be created at encoding time. - - .. versionadded:: 1.8.0 - - :var list link_specifiers: :class:`~stem.client.datatype.LinkSpecifier` where this service is reachable - :var X25519PublicKey onion_key: ntor introduction point public key - :var Ed25519PublicKey auth_key: ed25519 authentication key for this intro point - :var stem.certificate.Ed25519Certificate auth_key_cert: cross-certifier of the signing key with the auth key - :var X25519PublicKey enc_key: introduction request encryption key - :var stem.certificate.Ed25519Certificate enc_key_cert: cross-certifier of the signing key by the encryption key - :var XXX legacy_key: legacy introduction point RSA public key - :var stem.certificate.Ed25519Certificate legacy_key_cert: cross-certifier of the signing key by the legacy key - - :var Ed25519Certificate descriptor_signing_key: hsv3 descriptor signing key (needed to encode the intro point) - """ - def __init__(self, link_specifiers, onion_key, enc_key, auth_key=None, auth_key_cert=None, legacy_key=None, enc_key_cert=None, legacy_key_cert=None): - """ - Initialize this intro point. - - While not all attributes are mandatory, at the very least the link - specifiers, the auth key, the onion key and the encryption key need to be - provided. - - The certificates can be left out (for example in the case of creating a new - intro point), and they will be created at encode time when the - descriptor_signing_key is provided. - """ - - # if not link_specifiers or not onion_key or not enc_key: - # raise ValueError('Introduction point missing essential keys') - - if not auth_key and not auth_key_cert: - raise ValueError('Either auth key or auth key cert needs to be provided') - - # If we have an auth key cert but not an auth key, extract the key - if auth_key_cert and not auth_key and stem.prereq.is_crypto_available(ed25519 = True): - from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey - auth_key = Ed25519PublicKey.from_public_bytes(auth_key_cert.key) - - self.link_specifiers = link_specifiers - self.onion_key = enc_key - self.enc_key = enc_key - self.legacy_key = legacy_key - self.auth_key = auth_key - self.auth_key_cert = auth_key_cert - self.enc_key_cert = enc_key_cert - self.legacy_key_cert = legacy_key_cert - - def _encode_link_specifier_block(self): - """ - See BUILDING-BLOCKS in rend-spec-v3.txt - - NSPEC (Number of link specifiers) [1 byte] - NSPEC times: - LSTYPE (Link specifier type) [1 byte] - LSLEN (Link specifier length) [1 byte] - LSPEC (Link specifier) [LSLEN bytes] - """ - - ls_block = b'' - ls_block += chr(len(self.link_specifiers)) - - for ls in self.link_specifiers: - ls_block += ls.pack() - - return base64.b64encode(ls_block) - - def encode(self, descriptor_signing_privkey): - """ - Encode this introduction point into bytes - """ - - if not descriptor_signing_privkey: - raise ValueError('Cannot encode: Descriptor signing key not provided') - - from cryptography.hazmat.primitives import serialization - - cert_expiration_date = datetime.datetime.utcnow() + datetime.timedelta(hours=54) - - body = b'' - - body += b'introduction-point %s\n' % (self._encode_link_specifier_block()) - - # Onion key - onion_key_bytes = self.onion_key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) - body += b'onion-key ntor %s\n' % (base64.b64encode(onion_key_bytes)) - - # Build auth key certificate - auth_key_cert = stem.descriptor.certificate.MyED25519Certificate(cert_type = CertType.HS_V3_INTRO_AUTH, expiration_date = cert_expiration_date, cert_key_type = 1, certified_pub_key = self.auth_key, signing_priv_key = descriptor_signing_privkey, include_signing_key = True) - auth_key_cert_b64_blob = auth_key_cert.encode_for_descriptor() - body += b'auth-key\n%s\n' % (auth_key_cert_b64_blob) - - # Build enc key line - enc_key_bytes = self.enc_key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) - body += b'enc-key ntor %s\n' % (base64.b64encode(enc_key_bytes)) - - # Build enc key cert (this does not actually need to certify anything because of #29583) - enc_key_cert = stem.descriptor.certificate.MyED25519Certificate(cert_type = CertType.HS_V3_NTOR_ENC, expiration_date = cert_expiration_date, cert_key_type = 1, certified_pub_key = self.auth_key, signing_priv_key = descriptor_signing_privkey, include_signing_key = True) - enc_key_cert_b64_blob = enc_key_cert.encode_for_descriptor() - body += b'enc-key-cert\n%s\n' % (enc_key_cert_b64_blob) - - # We are called to encode legacy key, but we don't know how - # TODO do legacy keys! - if self.legacy_key or self.legacy_key_cert: - raise NotImplementedError - - return body - - class AuthorizedClient(collections.namedtuple('AuthorizedClient', ['id', 'iv', 'cookie'])): """ Client authorized to use a v3 hidden service. @@ -889,22 +767,17 @@ def _get_descriptor_signing_cert(descriptor_signing_public_key, blinded_priv_key 'blinded_priv_key' key that signs the certificate """ + from cryptography.hazmat.primitives import serialization + # 54 hours expiration date like tor does expiration_date = datetime.datetime.utcnow() + datetime.timedelta(hours=54) - desc_signing_cert = stem.descriptor.certificate.MyED25519Certificate(cert_type='HS_V3_DESC_SIGNING', - expiration_date=expiration_date, - cert_key_type=1, - certified_pub_key=descriptor_signing_public_key, - signing_priv_key=blinded_priv_key, - include_signing_key=True) - - signing_cert_bytes = desc_signing_cert.encode() + signing_key = descriptor_signing_public_key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) + extensions = [stem.descriptor.certificate.Ed25519Extension(stem.descriptor.certificate.ExtensionType.HAS_SIGNING_KEY, None, blinded_priv_key.public_key().public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw))] - cert_base64 = stem.util.str_tools._to_unicode(base64.b64encode(signing_cert_bytes)) - cert_blob = '\n'.join(stem.util.str_tools._split_by_length(cert_base64, 64)) + desc_signing_cert = stem.descriptor.certificate.Ed25519CertificateV1(stem.client.datatype.CertType.HS_V3_DESC_SIGNING, expiration_date, 1, signing_key, extensions, signing_key = blinded_priv_key) - return '\n-----BEGIN %s-----\n%s\n-----END %s-----' % ('ED25519 CERT', cert_blob, 'ED25519 CERT') + return '\n' + desc_signing_cert.to_base64(pem = True) def b64_and_wrap_desc_layer(layer_bytes, prefix_bytes=b''): @@ -935,10 +808,7 @@ def _get_inner_descriptor_layer_body(intro_points, descriptor_signing_privkey): # Now encode all the intro points for intro_point in intro_points: - if isinstance(intro_point, IntroductionPointV3): - final_body += intro_point.encode() + b'\n' - else: - final_body += intro_point.encode(descriptor_signing_privkey) + final_body += intro_point.encode() + b'\n' return final_body diff --git a/test/unit/descriptor/certificate.py b/test/unit/descriptor/certificate.py index d2b13f72..74ea0a6e 100644 --- a/test/unit/descriptor/certificate.py +++ b/test/unit/descriptor/certificate.py @@ -16,8 +16,6 @@ from stem.client.datatype import Size, CertType from stem.descriptor.certificate import ED25519_SIGNATURE_LENGTH, ExtensionType, Ed25519Certificate, Ed25519CertificateV1, Ed25519Extension from test.unit.descriptor import get_resource -from cryptography.hazmat.primitives import serialization - ED25519_CERT = """ AQQABhtZAaW2GoBED1IjY3A6f6GNqBEl5A83fD2Za9upGke51JGqAQAgBABnprVR ptIr43bWPo2fIzo3uOywfoMrryprpbm4HhCkZMaO064LP+1KNuLvlc8sGG8lTjx1 @@ -221,30 +219,3 @@ class TestEd25519Certificate(unittest.TestCase): cert = Ed25519Certificate.from_base64(certificate()) self.assertRaisesWith(ValueError, 'Ed25519KeyCertificate signing key is invalid (signature forged or corrupt)', cert.validate, desc) - - @test.require.ed25519_support - def test_encode_decode_certificate(self): - from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey - - certified_priv_key = Ed25519PrivateKey.generate() - certified_pub_key = certified_priv_key.public_key() - - signing_priv_key = Ed25519PrivateKey.generate() - - expiration_date = datetime.datetime(2037, 8, 28, 17, 0) - - my_ed_cert = stem.descriptor.certificate.MyED25519Certificate(cert_type = CertType.HS_V3_DESC_SIGNING, expiration_date = expiration_date, cert_key_type = 1, certified_pub_key = certified_pub_key, signing_priv_key = signing_priv_key, include_signing_key = True) - - ed_cert_bytes = my_ed_cert.encode() - self.assertTrue(my_ed_cert) - - # base64 the cert since that's what the parsing func expects - ed_cert_bytes_b64 = base64.b64encode(ed_cert_bytes) - - ed_cert_parsed = Ed25519Certificate.from_base64(ed_cert_bytes_b64) - - self.assertEqual(ed_cert_parsed.type, my_ed_cert.cert_type) - self.assertEqual(ed_cert_parsed.expiration, my_ed_cert.expiration_date) - self.assertEqual(ed_cert_parsed.key_type, my_ed_cert.cert_key_type) - self.assertEqual(ed_cert_parsed.key, my_ed_cert.certified_pub_key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw)) - self.assertEqual(ed_cert_parsed.signing_key(), my_ed_cert.signing_pub_key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw)) diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py index 060fa4dc..14df30ec 100644 --- a/test/unit/descriptor/hidden_service_v3.py +++ b/test/unit/descriptor/hidden_service_v3.py @@ -22,7 +22,6 @@ from stem.descriptor.hidden_service import ( REQUIRED_V3_FIELDS, X25519_AVAILABLE, IntroductionPointV3, - AlternateIntroductionPointV3, HiddenServiceDescriptorV3, OuterLayer, InnerLayer, @@ -123,27 +122,6 @@ def _helper_get_intro(): return IntroductionPointV3([LinkByIPv4('1.2.3.4', 9001)], base64.b64encode(onion_key), auth_key_cert, base64.b64encode(enc_key), enc_key_cert, None, None) -def _helper_get_intro_old(): - from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey - from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey - - link_specifiers = [] - - link1, _ = stem.client.datatype.LinkSpecifier.pop(b'\x03\x20CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC') - link_specifiers.append(link1) - - onion_privkey = X25519PrivateKey.generate() - onion_pubkey = onion_privkey.public_key() - - auth_privkey = Ed25519PrivateKey.generate() - auth_pubkey = auth_privkey.public_key() - - enc_privkey = X25519PrivateKey.generate() - enc_pubkey = enc_privkey.public_key() - - return AlternateIntroductionPointV3(link_specifiers, onion_key=onion_pubkey, enc_key=enc_pubkey, auth_key=auth_pubkey) - - class TestHiddenServiceDescriptorV3(unittest.TestCase): def test_real_descriptor(self): """

1 0

[stem/master] Simplified introduction point constructor
by atagar＠torproject.org 17 Nov '19

17 Nov '19

commit 76fe67b0f377ffe340ea77b79e1055012ed7fc56 Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Nov 4 15:39:25 2019 -0800 Simplified introduction point constructor Our test's _helper_get_intro() provided a good recipie for creating introduction points. Productionizing this into a helper we can provide to make these without worrying about too many details. --- stem/descriptor/hidden_service.py | 164 +++++++++++++++++++++++++----- stem/prereq.py | 3 + test/unit/descriptor/hidden_service_v3.py | 147 ++++++++------------------ 3 files changed, 189 insertions(+), 125 deletions(-) diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py index 9168123d..70ca6d25 100644 --- a/stem/descriptor/hidden_service.py +++ b/stem/descriptor/hidden_service.py @@ -41,12 +41,14 @@ import time import stem.client.datatype import stem.descriptor.certificate +import stem.descriptor.hsv3_crypto import stem.prereq import stem.util.connection import stem.util.str_tools import stem.util.tor_tools -from stem.descriptor import hsv3_crypto +from stem.client.datatype import CertType +from stem.descriptor.certificate import ExtensionType, Ed25519Extension, Ed25519Certificate, Ed25519CertificateV1 from stem.descriptor import ( PGP_BLOCK_END, @@ -183,7 +185,7 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s onion_key = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None _, block_type, auth_key_cert = entry['auth-key'][0] - auth_key_cert = stem.descriptor.certificate.Ed25519Certificate.from_base64(auth_key_cert) + auth_key_cert = Ed25519Certificate.from_base64(auth_key_cert) if block_type != 'ED25519 CERT': raise ValueError('Expected auth-key to have an ed25519 certificate, but was %s' % block_type) @@ -192,7 +194,7 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s enc_key = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None _, block_type, enc_key_cert = entry['enc-key-cert'][0] - enc_key_cert = stem.descriptor.certificate.Ed25519Certificate.from_base64(enc_key_cert) + enc_key_cert = Ed25519Certificate.from_base64(enc_key_cert) if block_type != 'ED25519 CERT': raise ValueError('Expected enc-key-cert to have an ed25519 certificate, but was %s' % block_type) @@ -202,6 +204,64 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s return IntroductionPointV3(link_specifiers, onion_key, auth_key_cert, enc_key, enc_key_cert, legacy_key, legacy_key_cert) + @staticmethod + def create(address, port, expiration, onion_key, enc_key, auth_key, signing_key): + """ + Simplified constructor. For more sophisticated use cases you can use this + as a template for how introduction points are properly created. + + :param str address: IPv4 or IPv6 address where the service is reachable + :param int port: port where the service is reachable + :param datetime.datetime expiration: when certificates should expire + :param str onion_key: encoded, X25519PublicKey, or X25519PrivateKey onion key + :param str enc_key: encoded, X25519PublicKey, or X25519PrivateKey encryption key + :param str auth_key: encoded, Ed25519PublicKey, or Ed25519PrivateKey authentication key + :param cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey signing_key: service signing key + + :returns: :class:`~stem.descriptor.hidden_service.IntroductionPointV3` with these attributes + + :raises: **ValueError** if the address, port, or keys are malformed + """ + + def _key_bytes(key): + class_name = type(key).__name__ + + if isinstance(key, str): + return key + elif not class_name.endswith('PublicKey') and not class_name.endswith('PrivateKey'): + raise ValueError('Key must be a string or cryptographic public/private key (was %s)' % class_name) + elif not stem.prereq.is_crypto_available(): + raise ImportError('Serializing keys requires the cryptography module') + + from cryptography.hazmat.primitives import serialization + + if class_name.endswith('PrivateKey'): + key = key.public_key() + + return key.public_bytes( + encoding = serialization.Encoding.Raw, + format = serialization.PublicFormat.Raw, + ) + + if not stem.util.connection.is_valid_port(port): + raise ValueError("'%s' is an invalid port" % port) + + if stem.util.connection.is_valid_ipv4_address(address): + link_specifiers = [stem.client.datatype.LinkByIPv4(address, port)] + elif stem.util.connection.is_valid_ipv6_address(address): + link_specifiers = [stem.client.datatype.LinkByIPv6(address, port)] + else: + raise ValueError("'%s' is not a valid IPv4 or IPv6 address" % address) + + onion_key = base64.b64encode(_key_bytes(onion_key)) + enc_key = base64.b64encode(_key_bytes(enc_key)) + + extensions = [Ed25519Extension(ExtensionType.HAS_SIGNING_KEY, None, _key_bytes(signing_key))] + auth_key_cert = Ed25519CertificateV1(CertType.HS_V3_INTRO_AUTH, expiration, 1, _key_bytes(auth_key), extensions, signing_key = signing_key) + enc_key_cert = Ed25519CertificateV1(CertType.HS_V3_NTOR_ENC, expiration, 1, _key_bytes(auth_key), extensions, signing_key = signing_key) + + return IntroductionPointV3(link_specifiers, onion_key, auth_key_cert, enc_key, enc_key_cert, None, None) + def encode(self): """ Descriptor representation of this introduction point. @@ -244,7 +304,20 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s * **EnvironmentError** if OpenSSL x25519 unsupported """ - return IntroductionPointV3._parse_key(self.onion_key_raw) + return IntroductionPointV3._key_as(self.onion_key_raw, x25519 = True) + + def auth_key(self): + """ + Provides our authentication certificate's public key. + + :returns: :class:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey` + + :raises: + * **ImportError** if required the cryptography module is unavailable + * **EnvironmentError** if OpenSSL x25519 unsupported + """ + + return IntroductionPointV3._key_as(self.auth_key_cert.key, ed25519 = True) def enc_key(self): """ @@ -257,7 +330,7 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s * **EnvironmentError** if OpenSSL x25519 unsupported """ - return IntroductionPointV3._parse_key(self.enc_key_raw) + return IntroductionPointV3._key_as(self.enc_key_raw, x25519 = True) def legacy_key(self): """ @@ -270,23 +343,31 @@ class IntroductionPointV3(collections.namedtuple('IntroductionPointV3', ['link_s * **EnvironmentError** if OpenSSL x25519 unsupported """ - return IntroductionPointV3._parse_key(self.legacy_key_raw) + return IntroductionPointV3._key_as(self.legacy_key_raw, x25519 = True) @staticmethod - def _parse_key(value): - if value is None: + def _key_as(value, x25519 = False, ed25519 = False): + if value is None or (not x25519 and not ed25519): return value elif not stem.prereq.is_crypto_available(): raise ImportError('cryptography module unavailable') - elif not X25519_AVAILABLE: - # without this the cryptography raises... - # cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL. - raise EnvironmentError('OpenSSL x25519 unsupported') + if x25519: + if not X25519_AVAILABLE: + # without this the cryptography raises... + # cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL. + + raise EnvironmentError('OpenSSL x25519 unsupported') - from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PublicKey + from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PublicKey + return X25519PublicKey.from_public_bytes(base64.b64decode(value)) - return X25519PublicKey.from_public_bytes(base64.b64decode(value)) + if ed25519: + if not stem.prereq.is_crypto_available(ed25519 = True): + raise EnvironmentError('cryptography ed25519 unsupported') + + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey + return Ed25519PublicKey.from_public_bytes(value) @staticmethod def _parse_link_specifiers(content): @@ -482,7 +563,7 @@ _parse_v2_signature_line = _parse_key_block('signature', 'signature', 'SIGNATURE _parse_v3_version_line = _parse_int_line('hs-descriptor', 'version', allow_negative = False) _parse_lifetime_line = _parse_int_line('descriptor-lifetime', 'lifetime', allow_negative = False) -_parse_signing_cert = stem.descriptor.certificate.Ed25519Certificate._from_descriptor('descriptor-signing-key-cert', 'signing_cert') +_parse_signing_cert = Ed25519Certificate._from_descriptor('descriptor-signing-key-cert', 'signing_cert') _parse_revision_counter_line = _parse_int_line('revision-counter', 'revision_counter', allow_negative = False) _parse_superencrypted_line = _parse_key_block('superencrypted', 'superencrypted', 'MESSAGE') _parse_v3_signature_line = _parse_simple_line('signature', 'signature') @@ -779,9 +860,9 @@ def _get_descriptor_signing_cert(descriptor_signing_public_key, blinded_priv_key expiration_date = datetime.datetime.utcnow() + datetime.timedelta(hours=54) signing_key = descriptor_signing_public_key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) - extensions = [stem.descriptor.certificate.Ed25519Extension(stem.descriptor.certificate.ExtensionType.HAS_SIGNING_KEY, None, blinded_priv_key.public_key().public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw))] + extensions = [Ed25519Extension(ExtensionType.HAS_SIGNING_KEY, None, blinded_priv_key.public_key().public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw))] - desc_signing_cert = stem.descriptor.certificate.Ed25519CertificateV1(stem.client.datatype.CertType.HS_V3_DESC_SIGNING, expiration_date, 1, signing_key, extensions, signing_key = blinded_priv_key) + desc_signing_cert = Ed25519CertificateV1(CertType.HS_V3_DESC_SIGNING, expiration_date, 1, signing_key, extensions, signing_key = blinded_priv_key) return '\n' + desc_signing_cert.to_base64(pem = True) @@ -864,11 +945,11 @@ def _get_superencrypted_blob(intro_points, descriptor_signing_privkey, revision_ """ inner_descriptor_layer = stem.util.str_tools._to_bytes(_get_inner_descriptor_layer_body(intro_points, descriptor_signing_privkey)) - inner_ciphertext = hsv3_crypto.encrypt_inner_layer(inner_descriptor_layer, revision_counter, blinded_key_bytes, subcredential) + inner_ciphertext = stem.descriptor.hsv3_crypto.encrypt_inner_layer(inner_descriptor_layer, revision_counter, blinded_key_bytes, subcredential) inner_ciphertext_b64 = b64_and_wrap_desc_layer(inner_ciphertext, b'encrypted') middle_descriptor_layer = _get_middle_descriptor_layer_body(inner_ciphertext_b64) - outter_ciphertext = hsv3_crypto.encrypt_outter_layer(middle_descriptor_layer, revision_counter, blinded_key_bytes, subcredential) + outter_ciphertext = stem.descriptor.hsv3_crypto.encrypt_outter_layer(middle_descriptor_layer, revision_counter, blinded_key_bytes, subcredential) return b64_and_wrap_desc_layer(outter_ciphertext) @@ -898,6 +979,8 @@ class HiddenServiceDescriptorV3(BaseHiddenServiceDescriptor): **\\*** attribute is either required when we're parsed with validation or has a default value, others are left as **None** if undefined + + .. versionadded:: 1.8.0 """ # TODO: requested this @type on https://trac.torproject.org/projects/tor/ticket/31481 @@ -973,7 +1056,7 @@ class HiddenServiceDescriptorV3(BaseHiddenServiceDescriptor): public_identity_key_bytes = public_identity_key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) # Blind the identity key to get ephemeral blinded key - blinded_privkey = hsv3_crypto.HSv3PrivateBlindedKey(ed25519_private_identity_key, blinding_param = blinding_param) + blinded_privkey = stem.descriptor.hsv3_crypto.HSv3PrivateBlindedKey(ed25519_private_identity_key, blinding_param = blinding_param) blinded_pubkey = blinded_privkey.public_key() blinded_pubkey_bytes = blinded_pubkey.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) @@ -1063,7 +1146,7 @@ class HiddenServiceDescriptorV3(BaseHiddenServiceDescriptor): if not blinded_key: raise ValueError('No signing key is present') - identity_public_key = HiddenServiceDescriptorV3._public_key_from_address(onion_address) + identity_public_key = HiddenServiceDescriptorV3.public_key_from_address(onion_address) subcredential = HiddenServiceDescriptorV3._subcredential(identity_public_key, blinded_key) outer_layer = OuterLayer._decrypt(self.superencrypted, self.revision_counter, subcredential, blinded_key) @@ -1072,8 +1155,43 @@ class HiddenServiceDescriptorV3(BaseHiddenServiceDescriptor): return self._inner_layer @staticmethod - def _public_key_from_address(onion_address): - # provides our hidden service ed25519 public key + def address_from_public_key(pubkey, suffix = True): + """ + Converts a hidden service public key into its address. + + :param bytes pubkey: hidden service public key + :param bool suffix: includes the '.onion' suffix if true, excluded otherwise + + :returns: **unicode** hidden service address + + :raises: **ImportError** if sha3 unsupported + """ + + if not stem.prereq._is_sha3_available(): + raise ImportError('Hidden service address conversion requires python 3.6+ or the pysha3 module (https://pypi.org/project/pysha3/)') + + version = stem.client.datatype.Size.CHAR.pack(3) + checksum = hashlib.sha3_256(CHECKSUM_CONSTANT + pubkey + version).digest()[:2] + onion_address = base64.b32encode(pubkey + checksum + version) + + return stem.util.str_tools._to_unicode(onion_address + b'.onion' if suffix else onion_address).lower() + + @staticmethod + def public_key_from_address(onion_address): + """ + Converts a hidden service address into its public key. + + :param str onion_address: hidden service address + + :returns: **bytes** for the hidden service's public key + + :raises: + * **ImportError** if sha3 unsupported + * **ValueError** if address malformed or checksum is invalid + """ + + if not stem.prereq._is_sha3_available(): + raise ImportError('Hidden service address conversion requires python 3.6+ or the pysha3 module (https://pypi.org/project/pysha3/)') if onion_address.endswith('.onion'): onion_address = onion_address[:-6] diff --git a/stem/prereq.py b/stem/prereq.py index 40c2f006..4af6c093 100644 --- a/stem/prereq.py +++ b/stem/prereq.py @@ -26,6 +26,9 @@ import inspect import platform import sys +# TODO: in stem 2.x consider replacing these functions with requirement +# annotations (like our tests) + CRYPTO_UNAVAILABLE = "Unable to import the cryptography module. Because of this we'll be unable to verify descriptor signature integrity. You can get cryptography from: https://pypi.org/project/cryptography/" ZSTD_UNAVAILABLE = 'ZSTD compression requires the zstandard module (https://pypi.org/project/zstandard/)' LZMA_UNAVAILABLE = 'LZMA compression requires the lzma module (https://docs.python.org/3/library/lzma.html)' diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py index 14df30ec..61752e11 100644 --- a/test/unit/descriptor/hidden_service_v3.py +++ b/test/unit/descriptor/hidden_service_v3.py @@ -5,34 +5,28 @@ Unit tests for stem.descriptor.hidden_service for version 3. import base64 import datetime import functools -import hashlib import unittest import stem.client.datatype import stem.descriptor +import stem.descriptor.hidden_service import stem.prereq import test.require -from stem.client.datatype import CertType, LinkByIPv4 -from stem.descriptor.certificate import ExtensionType, Ed25519Extension, Ed25519CertificateV1 +from test.unit.descriptor import ( + get_resource, + base_expect_invalid_attr, + base_expect_invalid_attr_for_text, +) from stem.descriptor.hidden_service import ( - CHECKSUM_CONSTANT, - REQUIRED_V3_FIELDS, - X25519_AVAILABLE, IntroductionPointV3, HiddenServiceDescriptorV3, OuterLayer, InnerLayer, ) -from test.unit.descriptor import ( - get_resource, - base_expect_invalid_attr, - base_expect_invalid_attr_for_text, -) - try: # added in python 3.3 from unittest.mock import patch, Mock @@ -40,12 +34,13 @@ except ImportError: from mock import patch, Mock require_sha3 = test.require.needs(stem.prereq._is_sha3_available, 'requires sha3') -require_x25519 = test.require.needs(lambda: X25519_AVAILABLE, 'requires openssl x5509') +require_x25519 = test.require.needs(lambda: stem.descriptor.hidden_service.X25519_AVAILABLE, 'requires openssl x5509') expect_invalid_attr = functools.partial(base_expect_invalid_attr, HiddenServiceDescriptorV3, 'version', 3) expect_invalid_attr_for_text = functools.partial(base_expect_invalid_attr_for_text, HiddenServiceDescriptorV3, 'version', 3) -HS_ADDRESS = 'sltib6sxkuxh2scmtuvd5w2g7pahnzkovefxpo4e4ptnkzl5kkq5h2ad.onion' +HS_ADDRESS = u'sltib6sxkuxh2scmtuvd5w2g7pahnzkovefxpo4e4ptnkzl5kkq5h2ad.onion' +HS_PUBKEY = b'\x92\xe6\x80\xfaWU.}HL\x9d*>\xdbF\xfb\xc0v\xe5N\xa9\x0bw\xbb\x84\xe3\xe6\xd5e}R\xa1' EXPECTED_SIGNING_CERT = """\ -----BEGIN ED25519 CERT----- @@ -68,58 +63,9 @@ with open(get_resource('hidden_service_v3_intro_point')) as intro_point_file: INTRO_POINT_STR = intro_point_file.read() -def _pubkeys_are_equal(pubkey1, pubkey2): - """ - Compare the raw bytes of the two pubkeys and return True if they are the same - """ - - from cryptography.hazmat.primitives import serialization - - pubkey1_bytes = pubkey1.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) - pubkey2_bytes = pubkey2.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) - - return pubkey1_bytes == pubkey2_bytes - - -def _encode_onion_address(ed25519_pub_key_bytes): - """ - Given the public key, return the onion address - """ - - if not stem.prereq._is_sha3_available(): - raise ImportError('Encoding onion addresses requires python 3.6+ or the pysha3 module (https://pypi.org/project/pysha3/)') - - version = 3 - checksum_body = b'%s%s%d' % (CHECKSUM_CONSTANT, ed25519_pub_key_bytes, version) - checksum = hashlib.sha3_256(checksum_body).digest()[:2] - - onion_address_bytes = b'%s%s%d' % (ed25519_pub_key_bytes, checksum, version) - onion_address = base64.b32encode(onion_address_bytes) + b'.onion' - assert(len(onion_address) == 56 + len('.onion')) - - return onion_address.lower() - - -def _helper_get_intro(): - from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey - from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey +def key_bytes(key): from cryptography.hazmat.primitives import serialization - - def public_key(key): - return key.public_key().public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) - - onion_key = public_key(X25519PrivateKey.generate()) - enc_key = public_key(X25519PrivateKey.generate()) - auth_key = public_key(Ed25519PrivateKey.generate()) - signing_key = Ed25519PrivateKey.generate() - - expiration = datetime.datetime.utcnow() + datetime.timedelta(hours = 54) - extensions = [Ed25519Extension(ExtensionType.HAS_SIGNING_KEY, None, public_key(signing_key))] - - auth_key_cert = Ed25519CertificateV1(CertType.HS_V3_INTRO_AUTH, expiration, 1, auth_key, extensions, signing_key = signing_key) - enc_key_cert = Ed25519CertificateV1(CertType.HS_V3_NTOR_ENC, expiration, 1, auth_key, extensions, signing_key = signing_key) - - return IntroductionPointV3([LinkByIPv4('1.2.3.4', 9001)], base64.b64encode(onion_key), auth_key_cert, base64.b64encode(enc_key), enc_key_cert, None, None) + return key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) class TestHiddenServiceDescriptorV3(unittest.TestCase): @@ -221,7 +167,7 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): 'signature': 'signature', } - for line in REQUIRED_V3_FIELDS: + for line in stem.descriptor.hidden_service.REQUIRED_V3_FIELDS: desc_text = HiddenServiceDescriptorV3.content(exclude = (line,)) expect_invalid_attr_for_text(self, desc_text, line_to_attr[line], None) @@ -268,11 +214,14 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): expect_invalid_attr(self, {'revision-counter': test_value}, 'revision_counter') @require_sha3 - @test.require.ed25519_support + def test_address_from_public_key(self): + self.assertEqual(HS_ADDRESS, HiddenServiceDescriptorV3.address_from_public_key(HS_PUBKEY)) + + @require_sha3 def test_public_key_from_address(self): - self.assertEqual(b'\x92\xe6\x80\xfaWU.}HL\x9d*>\xdbF\xfb\xc0v\xe5N\xa9\x0bw\xbb\x84\xe3\xe6\xd5e}R\xa1', HiddenServiceDescriptorV3._public_key_from_address(HS_ADDRESS)) - self.assertRaisesWith(ValueError, "'boom.onion' isn't a valid hidden service v3 address", HiddenServiceDescriptorV3._public_key_from_address, 'boom') - self.assertRaisesWith(ValueError, 'Bad checksum (expected def7 but was 842e)', HiddenServiceDescriptorV3._public_key_from_address, '5' * 56) + self.assertEqual(HS_PUBKEY, HiddenServiceDescriptorV3.public_key_from_address(HS_ADDRESS)) + self.assertRaisesWith(ValueError, "'boom.onion' isn't a valid hidden service v3 address", HiddenServiceDescriptorV3.public_key_from_address, 'boom') + self.assertRaisesWith(ValueError, 'Bad checksum (expected def7 but was 842e)', HiddenServiceDescriptorV3.public_key_from_address, '5' * 56) def test_intro_point_parse(self): """ @@ -304,7 +253,6 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): """ from cryptography.hazmat.backends.openssl.x25519 import X25519PublicKey - from cryptography.hazmat.primitives import serialization intro_point = InnerLayer(INNER_LAYER_STR).introduction_points[0] @@ -314,15 +262,8 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): self.assertTrue(isinstance(intro_point.onion_key(), X25519PublicKey)) self.assertTrue(isinstance(intro_point.enc_key(), X25519PublicKey)) - self.assertEqual(intro_point.onion_key_raw, base64.b64encode(intro_point.onion_key().public_bytes( - encoding = serialization.Encoding.Raw, - format = serialization.PublicFormat.Raw, - ))) - - self.assertEqual(intro_point.enc_key_raw, base64.b64encode(intro_point.enc_key().public_bytes( - encoding = serialization.Encoding.Raw, - format = serialization.PublicFormat.Raw, - ))) + self.assertEqual(intro_point.onion_key_raw, base64.b64encode(key_bytes(intro_point.onion_key()))) + self.assertEqual(intro_point.enc_key_raw, base64.b64encode(key_bytes(intro_point.enc_key()))) self.assertEqual(None, intro_point.legacy_key_raw) self.assertEqual(None, intro_point.legacy_key()) @@ -346,21 +287,28 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): making onion service descriptors. """ - from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey, Ed25519PrivateKey - from cryptography.hazmat.primitives import serialization + from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey + from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey + + onion_key = X25519PrivateKey.generate() + enc_key = X25519PrivateKey.generate() + auth_key = Ed25519PrivateKey.generate() + signing_key = Ed25519PrivateKey.generate() + + expiration = datetime.datetime.utcnow() + datetime.timedelta(hours = 54) # Build the service private_identity_key = Ed25519PrivateKey.from_private_bytes(b'a' * 32) public_identity_key = private_identity_key.public_key() - pubkey_bytes = public_identity_key.public_bytes(encoding = serialization.Encoding.Raw, format = serialization.PublicFormat.Raw) + pubkey_bytes = key_bytes(public_identity_key) - onion_address = _encode_onion_address(pubkey_bytes).decode() + onion_address = HiddenServiceDescriptorV3.address_from_public_key(pubkey_bytes) - # Build the introduction points - intro1 = _helper_get_intro() - intro2 = _helper_get_intro() - intro3 = _helper_get_intro() - intro_points = [intro1, intro2, intro3] + intro_points = [ + IntroductionPointV3.create('1.1.1.1', 9001, expiration, onion_key, enc_key, auth_key, signing_key), + IntroductionPointV3.create('2.2.2.2', 9001, expiration, onion_key, enc_key, auth_key, signing_key), + IntroductionPointV3.create('3.3.3.3', 9001, expiration, onion_key, enc_key, auth_key, signing_key), + ] # TODO: replace with bytes.fromhex() when we drop python 2.x support @@ -368,7 +316,6 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): # Build the descriptor desc_string = HiddenServiceDescriptorV3.content(ed25519_private_identity_key = private_identity_key, intro_points = intro_points, blinding_param = blind_param) - desc_string = desc_string.decode() # Parse the descriptor desc = HiddenServiceDescriptorV3.from_str(desc_string) @@ -376,17 +323,13 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase): self.assertEqual(3, len(inner_layer.introduction_points)) - # Match introduction points of the parsed descriptor and the generated - # descriptor and do some sanity checks between them to make sure that - # parsing was done right! - - for i, desc_intro in enumerate(inner_layer.introduction_points): - original_intro = intro_points[i] - - auth_key_1 = Ed25519PublicKey.from_public_bytes(desc_intro.auth_key_cert.key) - auth_key_2 = Ed25519PublicKey.from_public_bytes(original_intro.auth_key_cert.key) + for i, intro_point in enumerate(inner_layer.introduction_points): + original = intro_points[i] - self.assertTrue(_pubkeys_are_equal(desc_intro.enc_key(), original_intro.enc_key())) - self.assertTrue(_pubkeys_are_equal(desc_intro.onion_key(), original_intro.onion_key())) + self.assertEqual(original.enc_key_raw, intro_point.enc_key_raw) + self.assertEqual(original.onion_key_raw, intro_point.onion_key_raw) + self.assertEqual(original.auth_key_cert.key, intro_point.auth_key_cert.key) - self.assertTrue(_pubkeys_are_equal(auth_key_1, auth_key_2)) + self.assertEqual(intro_point.enc_key_raw, base64.b64encode(key_bytes(intro_point.enc_key()))) + self.assertEqual(intro_point.onion_key_raw, base64.b64encode(key_bytes(intro_point.onion_key()))) + self.assertEqual(intro_point.auth_key_cert.key, key_bytes(intro_point.auth_key()))

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits November 2019