- tor-commits - lists.torproject.org

[tor/master] Move crypto_get_stored_dynamic_prime() to crypto.c
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 94076d9e3b74ad1f6aee8a96f51eb4af5f5bdb64 Author: George Kadianakis <desnacked(a)gmail.com> Date: Thu Nov 24 22:59:01 2011 +0100 Move crypto_get_stored_dynamic_prime() to crypto.c --- src/common/crypto.c | 70 +++++++++++++++++++++++++++++++++++++++++++-------- src/common/crypto.h | 5 +-- src/or/config.c | 14 ++++++---- src/or/router.c | 58 ++++------------------------------------- src/or/router.h | 2 - 5 files changed, 75 insertions(+), 74 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index a3c2923..c6285e5 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1851,7 +1851,7 @@ crypto_generate_dynamic_prime(void) /** Store our dynamic prime to fname for future use. */ int -router_store_dynamic_prime(const char *fname) +crypto_store_dynamic_prime(const char *fname) { FILE *fp = NULL; int retval = -1; @@ -1889,13 +1889,61 @@ router_store_dynamic_prime(const char *fname) return retval; } +/** Return the dynamic prime stored in fname. If there is no + dynamic prime stored in fname, return NULL. */ +static BIGNUM * +crypto_get_stored_dynamic_prime(const char *fname) +{ + int retval; + char *contents = NULL; + BIGNUM *dynamic_prime = BN_new(); + + tor_assert(fname); + + if (!dynamic_prime) + goto err; + + contents = read_file_to_str(fname, RFTS_IGNORE_MISSING, NULL); + if (!contents) + goto err; + + retval = BN_hex2bn(&dynamic_prime, contents); + if (!retval) { + log_notice(LD_GENERAL, "Could not understand the dynamic prime " + "format in '%s'", fname); + goto err; + } + + { /* log the dynamic prime: */ + char *s = BN_bn2hex(dynamic_prime); + tor_assert(s); + log_info(LD_OR, "Found stored dynamic prime: [%s]", s); + OPENSSL_free(s); + } + + goto done; + + err: + if (dynamic_prime) { + BN_free(dynamic_prime); + dynamic_prime = NULL; + } + + done: + tor_free(contents); + + return dynamic_prime; +} + + /** Set the global TLS Diffie-Hellman modulus. - * If use_dynamic_primes is not set, use the prime - * modulus of mod_ssl. - * If use_dynamic_primes is set, use stored_dynamic_prime - * if it exists, otherwise generate and use a new prime modulus. */ + * If dynamic_prime_fname is set, try to read a dynamic prime + * off it and use it as the DH modulus. If that's not possible, + * generate a new dynamic prime. + * If dynamic_prime_fname is NULL, use the Apache mod_ssl DH + * modulus. */ void -crypto_set_tls_dh_prime(int use_dynamic_primes, BIGNUM *stored_dynamic_prime) +crypto_set_tls_dh_prime(const char *dynamic_prime_fname) { BIGNUM *tls_prime = NULL; int r; @@ -1906,11 +1954,11 @@ crypto_set_tls_dh_prime(int use_dynamic_primes, BIGNUM *stored_dynamic_prime) dh_param_p_tls = NULL; } - if (use_dynamic_primes) { /* use dynamic primes: */ - if (stored_dynamic_prime) { - log_info(LD_OR, "Using stored dynamic prime."); - tls_prime = stored_dynamic_prime; - } else { + if (dynamic_prime_fname) { /* use dynamic primes: */ + log_info(LD_OR, "Using stored dynamic prime."); + tls_prime = crypto_get_stored_dynamic_prime(dynamic_prime_fname); + + if (!tls_prime) { log_info(LD_OR, "Generating fresh dynamic prime."); tls_prime = crypto_generate_dynamic_prime(); } diff --git a/src/common/crypto.h b/src/common/crypto.h index 8c99dd7..20298b3 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -95,9 +95,8 @@ int crypto_global_cleanup(void); crypto_pk_env_t *crypto_new_pk_env(void); void crypto_free_pk_env(crypto_pk_env_t *env); -void crypto_set_tls_dh_prime(int use_dynamic_primes, - BIGNUM *stored_dynamic_prime); -int router_store_dynamic_prime(const char *fname); +void crypto_set_tls_dh_prime(const char *dynamic_prime_fname); +int crypto_store_dynamic_prime(const char *fname); /* convenience function: wraps crypto_create_crypto_env, set_key, and init. */ crypto_cipher_env_t *crypto_create_init_cipher(const char *key, diff --git a/src/or/config.c b/src/or/config.c index 78e91bb..e1e71b0 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1365,17 +1365,19 @@ options_act(const or_options_t *old_options) /* If needed, generate a new TLS DH prime according to the current torrc. */ if (!old_options) { if (options->DynamicPrimes) { - crypto_set_tls_dh_prime(1, router_get_stored_dynamic_prime()); + char *fname = get_datadir_fname2("keys", "dynamic_prime"); + crypto_set_tls_dh_prime(fname); + tor_free(fname); } else { - crypto_set_tls_dh_prime(0, NULL); + crypto_set_tls_dh_prime(NULL); } } else { if (options->DynamicPrimes && !old_options->DynamicPrimes) { - crypto_set_tls_dh_prime(1, router_get_stored_dynamic_prime()); + char *fname = get_datadir_fname2("keys", "dynamic_prime"); + crypto_set_tls_dh_prime(fname); + tor_free(fname); } else if (!options->DynamicPrimes && old_options->DynamicPrimes) { - crypto_set_tls_dh_prime(0, NULL); - } else { - tor_assert(crypto_get_tls_dh_prime()); + crypto_set_tls_dh_prime(NULL); } } diff --git a/src/or/router.c b/src/or/router.c index dd5b9ff..c554d5b 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -484,52 +484,6 @@ v3_authority_check_key_expiry(void) last_warned = now; } - -/** Return the dynamic prime stored in the disk. If there is no - dynamic prime stored in the disk, return NULL. */ -BIGNUM * -router_get_stored_dynamic_prime(void) -{ - int retval; - char *contents = NULL; - char *fname = get_datadir_fname2("keys", "dynamic_prime"); - BIGNUM *dynamic_prime = BN_new(); - if (!dynamic_prime) - goto err; - - contents = read_file_to_str(fname, RFTS_IGNORE_MISSING, NULL); - if (!contents) - goto err; - - retval = BN_hex2bn(&dynamic_prime, contents); - if (!retval) { - log_notice(LD_GENERAL, "Could not understand the dynamic prime " - "format in '%s'", fname); - goto err; - } - - { /* log the dynamic prime: */ - char *s = BN_bn2hex(dynamic_prime); - tor_assert(s); - log_info(LD_OR, "Found stored dynamic prime: [%s]", s); - OPENSSL_free(s); - } - - goto done; - - err: - if (dynamic_prime) { - BN_free(dynamic_prime); - dynamic_prime = NULL; - } - - done: - tor_free(fname); - tor_free(contents); - - return dynamic_prime; -} - /** Initialize all OR private keys, and the TLS context, as necessary. * On OPs, this only initializes the tls context. Return 0 on success, * or -1 if Tor should die. @@ -682,12 +636,12 @@ init_keys(void) /** 3b. If we use a dynamic prime, store it to disk. */ if (get_options()->DynamicPrimes) { - const char *fname = get_datadir_fname2("keys", "dynamic_prime"); - if (crypto_store_dynamic_prime(fname)) { - log_notice(LD_GENERAL, "Failed while storing dynamic prime. " - "Make sure your data directory is sane."); - } - tor_free(fname); + char *fname = get_datadir_fname2("keys", "dynamic_prime"); + if (crypto_store_dynamic_prime(fname)) { + log_notice(LD_GENERAL, "Failed while storing dynamic prime. " + "Make sure your data directory is sane."); + } + tor_free(fname); } /* 4. Build our router descriptor. */ diff --git a/src/or/router.h b/src/or/router.h index a998335..b9e9f2a 100644 --- a/src/or/router.h +++ b/src/or/router.h @@ -29,8 +29,6 @@ void rotate_onion_key(void); crypto_pk_env_t *init_key_from_file(const char *fname, int generate, int severity); -BIGNUM *router_get_stored_dynamic_prime(void); - void v3_authority_check_key_expiry(void); int init_keys(void);

1 0

[tor/master] Move store_dynamic_prime() to crypto.c.
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 2ef68980a778666bcc9b3b492c4acbd7af27fc28 Author: George Kadianakis <desnacked(a)gmail.com> Date: Thu Nov 24 22:32:10 2011 +0100 Move store_dynamic_prime() to crypto.c. --- src/common/crypto.c | 40 ++++++++++++++++++++++++++++++++++++-- src/common/crypto.h | 2 +- src/or/router.c | 52 +++++--------------------------------------------- src/or/router.h | 1 - 4 files changed, 44 insertions(+), 51 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 72c3dd7..a3c2923 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1849,10 +1849,44 @@ crypto_generate_dynamic_prime(void) return dynamic_prime; } -BIGNUM * -crypto_get_tls_dh_prime(void) +/** Store our dynamic prime to fname for future use. */ +int +router_store_dynamic_prime(const char *fname) { - return dh_param_p_tls; + FILE *fp = NULL; + int retval = -1; + file_status_t fname_status = file_status(fname); + + tor_assert(fname); + + if (fname_status == FN_FILE) { + /* If the fname is a file, then the dynamic prime is already stored. */ + retval = 0; + goto done; + } else if (fname_status != FN_NOENT) { + log_info(LD_GENERAL, "Dynamic prime filename is occupied."); + goto done; + } + + tor_assert(fname_status == FN_NOENT); + + if (!(fp = fopen(fname, "w"))) { + log_notice(LD_GENERAL, "Error while creating dynamic prime file."); + goto done; + } + + if (BN_print_fp(fp, dh_param_p_tls) == 0) { + log_warn(LD_GENERAL, "Error while printing dynamic prime to file."); + goto done; + } + + retval = 0; + + done: + if (fp) + fclose(fp); + + return retval; } /** Set the global TLS Diffie-Hellman modulus. diff --git a/src/common/crypto.h b/src/common/crypto.h index 5b753b8..8c99dd7 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -97,7 +97,7 @@ void crypto_free_pk_env(crypto_pk_env_t *env); void crypto_set_tls_dh_prime(int use_dynamic_primes, BIGNUM *stored_dynamic_prime); -BIGNUM * crypto_get_tls_dh_prime(void); +int router_store_dynamic_prime(const char *fname); /* convenience function: wraps crypto_create_crypto_env, set_key, and init. */ crypto_cipher_env_t *crypto_create_init_cipher(const char *key, diff --git a/src/or/router.c b/src/or/router.c index 6b38c79..dd5b9ff 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -485,46 +485,6 @@ v3_authority_check_key_expiry(void) } -/** Store dynamic_prime to disk for future use. */ -int -router_store_dynamic_prime(const BIGNUM *dynamic_prime) -{ - FILE *fp = NULL; - char *fname = get_datadir_fname2("keys", "dynamic_prime"); - int retval = -1; - file_status_t fname_status = file_status(fname); - - if (fname_status == FN_FILE) { - /* If the fname is a file, then the dynamic prime is already stored. */ - retval = 0; - goto done; - } else if (fname_status != FN_NOENT) { - log_info(LD_GENERAL, "Dynamic prime filename is occupied."); - goto done; - } - - tor_assert(fname_status == FN_NOENT); - - if (!(fp = fopen(fname, "w"))) { - log_notice(LD_GENERAL, "Error while creating dynamic prime file."); - goto done; - } - - if (BN_print_fp(fp, dynamic_prime) == 0) { - log_warn(LD_GENERAL, "Error while printing dynamic prime to file."); - goto done; - } - - retval = 0; - - done: - if (fp) - fclose(fp); - tor_free(fname); - - return retval; -} - /** Return the dynamic prime stored in the disk. If there is no dynamic prime stored in the disk, return NULL. */ BIGNUM * @@ -722,12 +682,12 @@ init_keys(void) /** 3b. If we use a dynamic prime, store it to disk. */ if (get_options()->DynamicPrimes) { - BIGNUM *dynamic_prime = crypto_get_tls_dh_prime(); - if (dynamic_prime) { - if (router_store_dynamic_prime(dynamic_prime) < 0) - log_notice(LD_GENERAL, "Failed while storing dynamic prime. " - "Make sure your data directory is sane."); - } + const char *fname = get_datadir_fname2("keys", "dynamic_prime"); + if (crypto_store_dynamic_prime(fname)) { + log_notice(LD_GENERAL, "Failed while storing dynamic prime. " + "Make sure your data directory is sane."); + } + tor_free(fname); } /* 4. Build our router descriptor. */ diff --git a/src/or/router.h b/src/or/router.h index 41ff139..a998335 100644 --- a/src/or/router.h +++ b/src/or/router.h @@ -30,7 +30,6 @@ crypto_pk_env_t *init_key_from_file(const char *fname, int generate, int severity); BIGNUM *router_get_stored_dynamic_prime(void); -int router_store_dynamic_prime(const BIGNUM *dynamic_prime); void v3_authority_check_key_expiry(void);

1 0

[tor/master] s/DynamicPrimes/DynamicDHGroups/g
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 782c907c7cbd3bf2bb75680f5d3deb2d984052de Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri Nov 25 01:00:14 2011 +0100 s/DynamicPrimes/DynamicDHGroups/g --- src/or/config.c | 10 +++++----- src/or/or.h | 2 +- src/or/router.c | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index e1e71b0..fc3cc74 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -247,7 +247,7 @@ static config_var_t _option_vars[] = { VAR("DirServer", LINELIST, DirServers, NULL), V(DisableAllSwap, BOOL, "0"), V(DisableIOCP, BOOL, "1"), - V(DynamicPrimes, BOOL, "1"), + V(DynamicDHGroups, BOOL, "1"), V(DNSPort, LINELIST, NULL), V(DNSListenAddress, LINELIST, NULL), V(DownloadExtraInfo, BOOL, "0"), @@ -1364,7 +1364,7 @@ options_act(const or_options_t *old_options) /* If needed, generate a new TLS DH prime according to the current torrc. */ if (!old_options) { - if (options->DynamicPrimes) { + if (options->DynamicDHGroups) { char *fname = get_datadir_fname2("keys", "dynamic_prime"); crypto_set_tls_dh_prime(fname); tor_free(fname); @@ -1372,11 +1372,11 @@ options_act(const or_options_t *old_options) crypto_set_tls_dh_prime(NULL); } } else { - if (options->DynamicPrimes && !old_options->DynamicPrimes) { + if (options->DynamicDHGroups && !old_options->DynamicDHGroups) { char *fname = get_datadir_fname2("keys", "dynamic_prime"); crypto_set_tls_dh_prime(fname); tor_free(fname); - } else if (!options->DynamicPrimes && old_options->DynamicPrimes) { + } else if (!options->DynamicDHGroups && old_options->DynamicDHGroups) { crypto_set_tls_dh_prime(NULL); } } @@ -4071,7 +4071,7 @@ options_transition_affects_workers(const or_options_t *old_options, { if (!opt_streq(old_options->DataDirectory, new_options->DataDirectory) || old_options->NumCPUs != new_options->NumCPUs || - old_options->DynamicPrimes != new_options->DynamicPrimes || + old_options->DynamicDHGroups != new_options->DynamicDHGroups || old_options->ORPort != new_options->ORPort || old_options->ServerDNSSearchDomains != new_options->ServerDNSSearchDomains || diff --git a/src/or/or.h b/src/or/or.h index b2ea3bc..e3feeed 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2873,7 +2873,7 @@ typedef struct { char *Address; /**< OR only: configured address for this onion router. */ char *PidFile; /**< Where to store PID of Tor process. */ - int DynamicPrimes; /**< Enable dynamic generation of primes for use in DH. */ + int DynamicDHGroups; /**< Enable dynamic generation of primes for use in DH. */ routerset_t *ExitNodes; /**< Structure containing nicknames, digests, * country codes and IP address patterns of ORs to diff --git a/src/or/router.c b/src/or/router.c index c554d5b..fa791fc 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -635,7 +635,7 @@ init_keys(void) } /** 3b. If we use a dynamic prime, store it to disk. */ - if (get_options()->DynamicPrimes) { + if (get_options()->DynamicDHGroups) { char *fname = get_datadir_fname2("keys", "dynamic_prime"); if (crypto_store_dynamic_prime(fname)) { log_notice(LD_GENERAL, "Failed while storing dynamic prime. "

1 0

[tor/master] Notify the user that her computer is generating numbers.
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit bdeb797a130c0d11dd6c1d7375eba468a09c6245 Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri Nov 25 00:59:47 2011 +0100 Notify the user that her computer is generating numbers. --- src/common/crypto.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 83f56a5..4e96fed 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1989,7 +1989,8 @@ crypto_set_tls_dh_prime(const char *dynamic_prime_fname) tls_prime = crypto_get_stored_dynamic_prime(dynamic_prime_fname); if (!tls_prime) { - log_info(LD_OR, "Generating fresh dynamic prime."); + log_notice(LD_OR, "Generating fresh dynamic prime. " + "This might take a while..."); tls_prime = crypto_generate_dynamic_prime(); } } else { /* use the static DH prime modulus used by Apache in mod_ssl: */

1 0

[tor/master] Finishing touches.
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 1d1d5ae7f8f91b62f0e86081ff1f7255c545383b Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri Nov 25 01:08:31 2011 +0100 Finishing touches. - Make check-spaces happy. - Remove a stray header from crypto.h --- src/common/crypto.c | 16 +++++++--------- src/common/crypto.h | 2 -- src/or/or.h | 2 +- src/or/router.h | 1 - 4 files changed, 8 insertions(+), 13 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 0f828db..8b0f0ef 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1862,7 +1862,7 @@ crypto_store_dynamic_dh_modulus(const char *fname) fname_status = file_status(fname); if (fname_status == FN_FILE) { - /* If the fname is a file, then the dynamic DH modulus is already stored. */ + /* If the fname is a file, then the dynamic DH modulus is already stored.*/ retval = 0; goto done; } else if (fname_status != FN_NOENT) { @@ -1939,7 +1939,6 @@ crypto_get_stored_dynamic_dh_modulus(const char *fname) "than '%d' bits.", DH_BYTES*8); goto err; } - } { /* log the dynamic DH modulus: */ @@ -1965,7 +1964,6 @@ crypto_get_stored_dynamic_dh_modulus(const char *fname) return dynamic_dh_modulus; } - /** Set the global TLS Diffie-Hellman modulus. * If dynamic_dh_modulus_fname is set, try to read a dynamic DH modulus * off it and use it as the DH modulus. If that's not possible, @@ -2001,12 +1999,12 @@ crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname) * modules/ssl/ssl_engine_dh.c; Apache also uses a generator of 2 with this * prime. */ - r = BN_hex2bn(&tls_prime, - "D67DE440CBBBDC1936D693D34AFD0AD50C84D239A45F520BB88174CB98" - "BCE951849F912E639C72FB13B4B4D7177E16D55AC179BA420B2A29FE324A" - "467A635E81FF5901377BEDDCFD33168A461AAD3B72DAE8860078045B07A7" - "DBCA7874087D1510EA9FCC9DDD330507DD62DB88AEAA747DE0F4D6E2BD68" - "B0E7393E0F24218EB3"); + r =BN_hex2bn(&tls_prime, + "D67DE440CBBBDC1936D693D34AFD0AD50C84D239A45F520BB88174CB98" + "BCE951849F912E639C72FB13B4B4D7177E16D55AC179BA420B2A29FE324A" + "467A635E81FF5901377BEDDCFD33168A461AAD3B72DAE8860078045B07A7" + "DBCA7874087D1510EA9FCC9DDD330507DD62DB88AEAA747DE0F4D6E2BD68" + "B0E7393E0F24218EB3"); tor_assert(r); } diff --git a/src/common/crypto.h b/src/common/crypto.h index 504c59b..683c8ea 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -16,8 +16,6 @@ #include <stdio.h> #include "torint.h" -#include <openssl/bn.h> - /** Length of the output of our message digest. */ #define DIGEST_LEN 20 /** Length of the output of our second (improved) message digests. (For now diff --git a/src/or/or.h b/src/or/or.h index e3feeed..ec49014 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2873,7 +2873,7 @@ typedef struct { char *Address; /**< OR only: configured address for this onion router. */ char *PidFile; /**< Where to store PID of Tor process. */ - int DynamicDHGroups; /**< Enable dynamic generation of primes for use in DH. */ + int DynamicDHGroups; /**< Dynamic generation of prime moduli for use in DH.*/ routerset_t *ExitNodes; /**< Structure containing nicknames, digests, * country codes and IP address patterns of ORs to diff --git a/src/or/router.h b/src/or/router.h index b9e9f2a..f9d156c 100644 --- a/src/or/router.h +++ b/src/or/router.h @@ -28,7 +28,6 @@ void dup_onion_keys(crypto_pk_env_t **key, crypto_pk_env_t **last); void rotate_onion_key(void); crypto_pk_env_t *init_key_from_file(const char *fname, int generate, int severity); - void v3_authority_check_key_expiry(void); int init_keys(void);

1 0

[tor/master] Rename 'dynamic prime' to 'dynamic DH modulus'.
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 7c37a664c17f4dd9748f096ea385c3627cc323fa Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri Nov 25 01:00:58 2011 +0100 Rename 'dynamic prime' to 'dynamic DH modulus'. --- src/common/crypto.c | 80 +++++++++++++++++++++++++------------------------- src/common/crypto.h | 4 +- src/or/config.c | 4 +- src/or/router.c | 4 +- 4 files changed, 46 insertions(+), 46 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 4e96fed..0f828db 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1818,15 +1818,15 @@ static BIGNUM *dh_param_g = NULL; /** Generate and return a reasonable and safe DH parameter p. */ static BIGNUM * -crypto_generate_dynamic_prime(void) +crypto_generate_dynamic_dh_modulus(void) { - BIGNUM *dynamic_prime; + BIGNUM *dynamic_dh_modulus; DH *dh_parameters; int r, dh_codes; char *s; - dynamic_prime = BN_new(); - tor_assert(dynamic_prime); + dynamic_dh_modulus = BN_new(); + tor_assert(dynamic_dh_modulus); dh_parameters = DH_generate_parameters(DH_BYTES*8, DH_GENERATOR, NULL, NULL); tor_assert(dh_parameters); @@ -1834,24 +1834,24 @@ crypto_generate_dynamic_prime(void) r = DH_check(dh_parameters, &dh_codes); tor_assert(r && !dh_codes); - BN_copy(dynamic_prime, dh_parameters->p); - tor_assert(dynamic_prime); + BN_copy(dynamic_dh_modulus, dh_parameters->p); + tor_assert(dynamic_dh_modulus); DH_free(dh_parameters); - { /* log the dynamic prime: */ - s = BN_bn2hex(dynamic_prime); + { /* log the dynamic DH modulus: */ + s = BN_bn2hex(dynamic_dh_modulus); tor_assert(s); - log_info(LD_OR, "Dynamic prime generated: [%s]", s); + log_info(LD_OR, "Dynamic DH modulus generated: [%s]", s); OPENSSL_free(s); } - return dynamic_prime; + return dynamic_dh_modulus; } -/** Store our dynamic prime to fname for future use. */ +/** Store our dynamic DH modulus to fname for future use. */ int -crypto_store_dynamic_prime(const char *fname) +crypto_store_dynamic_dh_modulus(const char *fname) { FILE *fp = NULL; int retval = -1; @@ -1862,23 +1862,23 @@ crypto_store_dynamic_prime(const char *fname) fname_status = file_status(fname); if (fname_status == FN_FILE) { - /* If the fname is a file, then the dynamic prime is already stored. */ + /* If the fname is a file, then the dynamic DH modulus is already stored. */ retval = 0; goto done; } else if (fname_status != FN_NOENT) { - log_info(LD_GENERAL, "Dynamic prime filename is occupied."); + log_info(LD_GENERAL, "Dynamic DH modulus filename is occupied."); goto done; } tor_assert(fname_status == FN_NOENT); if (!(fp = fopen(fname, "w"))) { - log_notice(LD_GENERAL, "Error while creating dynamic prime file."); + log_notice(LD_GENERAL, "Error while creating dynamic DH modulus file."); goto done; } if (BN_print_fp(fp, dh_param_p_tls) == 0) { - log_warn(LD_GENERAL, "Error while printing dynamic prime to file."); + log_warn(LD_GENERAL, "Error while printing dynamic DH modulus to file."); goto done; } @@ -1891,29 +1891,29 @@ crypto_store_dynamic_prime(const char *fname) return retval; } -/** Return the dynamic prime stored in fname. If there is no - dynamic prime stored in fname, return NULL. */ +/** Return the dynamic DH modulus stored in fname. If there is no + dynamic DH modulus stored in fname, return NULL. */ static BIGNUM * -crypto_get_stored_dynamic_prime(const char *fname) +crypto_get_stored_dynamic_dh_modulus(const char *fname) { int retval; char *contents = NULL; DH *dh = NULL; int dh_codes; - BIGNUM *dynamic_prime = BN_new(); + BIGNUM *dynamic_dh_modulus = BN_new(); tor_assert(fname); - if (!dynamic_prime) + if (!dynamic_dh_modulus) goto err; contents = read_file_to_str(fname, RFTS_IGNORE_MISSING, NULL); if (!contents) goto err; - retval = BN_hex2bn(&dynamic_prime, contents); + retval = BN_hex2bn(&dynamic_dh_modulus, contents); if (!retval) { - log_warn(LD_GENERAL, "Could not understand the dynamic prime " + log_warn(LD_GENERAL, "Could not understand the dynamic DH modulus " "format in '%s'", fname); goto err; } @@ -1923,7 +1923,7 @@ crypto_get_stored_dynamic_prime(const char *fname) if (!dh) goto err; - dh->p = BN_dup(dynamic_prime); + dh->p = BN_dup(dynamic_dh_modulus); dh->g = BN_new(); BN_set_word(dh->g, DH_GENERATOR); @@ -1942,19 +1942,19 @@ crypto_get_stored_dynamic_prime(const char *fname) } - { /* log the dynamic prime: */ - char *s = BN_bn2hex(dynamic_prime); + { /* log the dynamic DH modulus: */ + char *s = BN_bn2hex(dynamic_dh_modulus); tor_assert(s); - log_info(LD_OR, "Found stored dynamic prime: [%s]", s); + log_info(LD_OR, "Found stored dynamic DH modulus: [%s]", s); OPENSSL_free(s); } goto done; err: - if (dynamic_prime) { - BN_free(dynamic_prime); - dynamic_prime = NULL; + if (dynamic_dh_modulus) { + BN_free(dynamic_dh_modulus); + dynamic_dh_modulus = NULL; } done: @@ -1962,18 +1962,18 @@ crypto_get_stored_dynamic_prime(const char *fname) if (dh) DH_free(dh); - return dynamic_prime; + return dynamic_dh_modulus; } /** Set the global TLS Diffie-Hellman modulus. - * If dynamic_prime_fname is set, try to read a dynamic prime + * If dynamic_dh_modulus_fname is set, try to read a dynamic DH modulus * off it and use it as the DH modulus. If that's not possible, - * generate a new dynamic prime. - * If dynamic_prime_fname is NULL, use the Apache mod_ssl DH + * generate a new dynamic DH modulus. + * If dynamic_dh_modulus_fname is NULL, use the Apache mod_ssl DH * modulus. */ void -crypto_set_tls_dh_prime(const char *dynamic_prime_fname) +crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname) { BIGNUM *tls_prime = NULL; int r; @@ -1984,14 +1984,14 @@ crypto_set_tls_dh_prime(const char *dynamic_prime_fname) dh_param_p_tls = NULL; } - if (dynamic_prime_fname) { /* use dynamic primes: */ - log_info(LD_OR, "Using stored dynamic prime."); - tls_prime = crypto_get_stored_dynamic_prime(dynamic_prime_fname); + if (dynamic_dh_modulus_fname) { /* use dynamic DH moduluss: */ + log_info(LD_OR, "Using stored dynamic DH modulus."); + tls_prime = crypto_get_stored_dynamic_dh_modulus(dynamic_dh_modulus_fname); if (!tls_prime) { - log_notice(LD_OR, "Generating fresh dynamic prime. " + log_notice(LD_OR, "Generating fresh dynamic DH modulus. " "This might take a while..."); - tls_prime = crypto_generate_dynamic_prime(); + tls_prime = crypto_generate_dynamic_dh_modulus(); } } else { /* use the static DH prime modulus used by Apache in mod_ssl: */ tls_prime = BN_new(); diff --git a/src/common/crypto.h b/src/common/crypto.h index 20298b3..504c59b 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -95,8 +95,8 @@ int crypto_global_cleanup(void); crypto_pk_env_t *crypto_new_pk_env(void); void crypto_free_pk_env(crypto_pk_env_t *env); -void crypto_set_tls_dh_prime(const char *dynamic_prime_fname); -int crypto_store_dynamic_prime(const char *fname); +void crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname); +int crypto_store_dynamic_dh_modulus(const char *fname); /* convenience function: wraps crypto_create_crypto_env, set_key, and init. */ crypto_cipher_env_t *crypto_create_init_cipher(const char *key, diff --git a/src/or/config.c b/src/or/config.c index fc3cc74..d403dec 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1365,7 +1365,7 @@ options_act(const or_options_t *old_options) /* If needed, generate a new TLS DH prime according to the current torrc. */ if (!old_options) { if (options->DynamicDHGroups) { - char *fname = get_datadir_fname2("keys", "dynamic_prime"); + char *fname = get_datadir_fname2("keys", "dynamic_dh_modulus"); crypto_set_tls_dh_prime(fname); tor_free(fname); } else { @@ -1373,7 +1373,7 @@ options_act(const or_options_t *old_options) } } else { if (options->DynamicDHGroups && !old_options->DynamicDHGroups) { - char *fname = get_datadir_fname2("keys", "dynamic_prime"); + char *fname = get_datadir_fname2("keys", "dynamic_dh_modulus"); crypto_set_tls_dh_prime(fname); tor_free(fname); } else if (!options->DynamicDHGroups && old_options->DynamicDHGroups) { diff --git a/src/or/router.c b/src/or/router.c index fa791fc..963c781 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -636,8 +636,8 @@ init_keys(void) /** 3b. If we use a dynamic prime, store it to disk. */ if (get_options()->DynamicDHGroups) { - char *fname = get_datadir_fname2("keys", "dynamic_prime"); - if (crypto_store_dynamic_prime(fname)) { + char *fname = get_datadir_fname2("keys", "dynamic_dh_modulus"); + if (crypto_store_dynamic_dh_modulus(fname)) { log_notice(LD_GENERAL, "Failed while storing dynamic prime. " "Make sure your data directory is sane."); }

1 0

[tor/master] Do dynamic DH modulus storing in crypto.c.
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 4938bcc06a41b95f47def181ce03a7ade805595b Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri Nov 25 17:39:28 2011 +0100 Do dynamic DH modulus storing in crypto.c. --- src/common/crypto.c | 15 +++++++++++++-- src/common/crypto.h | 1 - src/or/router.c | 10 ---------- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 8b0f0ef..1974a39 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1850,7 +1850,7 @@ crypto_generate_dynamic_dh_modulus(void) } /** Store our dynamic DH modulus to fname for future use. */ -int +static int crypto_store_dynamic_dh_modulus(const char *fname) { FILE *fp = NULL; @@ -1974,6 +1974,7 @@ void crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname) { BIGNUM *tls_prime = NULL; + int store_dh_prime_afterwards = 0; int r; /* If the space is occupied, free the previous TLS DH prime */ @@ -1982,7 +1983,7 @@ crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname) dh_param_p_tls = NULL; } - if (dynamic_dh_modulus_fname) { /* use dynamic DH moduluss: */ + if (dynamic_dh_modulus_fname) { /* use dynamic DH modulus: */ log_info(LD_OR, "Using stored dynamic DH modulus."); tls_prime = crypto_get_stored_dynamic_dh_modulus(dynamic_dh_modulus_fname); @@ -1990,6 +1991,8 @@ crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname) log_notice(LD_OR, "Generating fresh dynamic DH modulus. " "This might take a while..."); tls_prime = crypto_generate_dynamic_dh_modulus(); + + store_dh_prime_afterwards++; } } else { /* use the static DH prime modulus used by Apache in mod_ssl: */ tls_prime = BN_new(); @@ -2011,6 +2014,14 @@ crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname) tor_assert(tls_prime); dh_param_p_tls = tls_prime; + + if (store_dh_prime_afterwards) + /* save the new dynamic DH modulus to disk. */ + if (crypto_store_dynamic_dh_modulus(dynamic_dh_modulus_fname)) { + log_notice(LD_GENERAL, "Failed while storing dynamic DH modulus. " + "Make sure your data directory is sane."); + } + } /** Initialize dh_param_p and dh_param_g if they are not already diff --git a/src/common/crypto.h b/src/common/crypto.h index 683c8ea..bac6db9 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -94,7 +94,6 @@ crypto_pk_env_t *crypto_new_pk_env(void); void crypto_free_pk_env(crypto_pk_env_t *env); void crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname); -int crypto_store_dynamic_dh_modulus(const char *fname); /* convenience function: wraps crypto_create_crypto_env, set_key, and init. */ crypto_cipher_env_t *crypto_create_init_cipher(const char *key, diff --git a/src/or/router.c b/src/or/router.c index 963c781..fdc83f5 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -634,16 +634,6 @@ init_keys(void) return -1; } - /** 3b. If we use a dynamic prime, store it to disk. */ - if (get_options()->DynamicDHGroups) { - char *fname = get_datadir_fname2("keys", "dynamic_dh_modulus"); - if (crypto_store_dynamic_dh_modulus(fname)) { - log_notice(LD_GENERAL, "Failed while storing dynamic prime. " - "Make sure your data directory is sane."); - } - tor_free(fname); - } - /* 4. Build our router descriptor. */ /* Must be called after keys are initialized. */ mydesc = router_get_my_descriptor();

1 0

[tor/master] Move broken primes to dynamic_dh_modulus.broken.
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 1df6b5a734acd381d49a57bb689c7dcd2cd66ad9 Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri Nov 25 17:39:45 2011 +0100 Move broken primes to dynamic_dh_modulus.broken. --- src/common/crypto.c | 19 +++++++++++++++++++ 1 files changed, 19 insertions(+), 0 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 1974a39..da3b80b 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1900,6 +1900,7 @@ crypto_get_stored_dynamic_dh_modulus(const char *fname) char *contents = NULL; DH *dh = NULL; int dh_codes; + char *fname_new = NULL; BIGNUM *dynamic_dh_modulus = BN_new(); tor_assert(fname); @@ -1951,6 +1952,24 @@ crypto_get_stored_dynamic_dh_modulus(const char *fname) goto done; err: + + { /* move broken prime to $filename.broken */ + + fname_new = tor_malloc(strlen(fname) + 8); + + /* no can do if these functions return error */ + strlcpy(fname_new, fname, strlen(fname) + 8); + strlcat(fname_new, ".broken", strlen(fname) + 8); + + log_warn(LD_GENERAL, "Moving broken dynamic DH prime to '%s'.", fname_new); + + if (replace_file(fname, fname_new)) + log_warn(LD_GENERAL, "Error while moving '%s' to '%s'.", fname, fname_new); + + tor_free(fname_new); + + } + if (dynamic_dh_modulus) { BN_free(dynamic_dh_modulus); dynamic_dh_modulus = NULL;

1 0

[tor/master] Move DH_GENERATOR to crypto.c.
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit b31601975b0be372f6c041868a54024a8d89ad8c Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri Nov 25 17:44:11 2011 +0100 Move DH_GENERATOR to crypto.c. --- src/common/crypto.c | 3 +++ src/common/crypto.h | 2 -- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index da3b80b..8cf6231 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1809,6 +1809,9 @@ crypto_hmac_sha256(char *hmac_out, /* DH */ +/** Our DH 'g' parameter */ +#define DH_GENERATOR 2 + /** Shared P parameter for our circuit-crypto DH key exchanges. */ static BIGNUM *dh_param_p = NULL; /** Shared P parameter for our TLS DH key exchanges. */ diff --git a/src/common/crypto.h b/src/common/crypto.h index bac6db9..771c49c 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -29,8 +29,6 @@ #define PK_BYTES (1024/8) /** Length of our DH keys. */ #define DH_BYTES (1024/8) -/** Our DH 'g' parameter */ -#define DH_GENERATOR 2 /** Length of a sha1 message digest when encoded in base64 with trailing = * signs removed. */

1 0

[tor/master] Only bother with dynamic DH moduli if we are a bridge.
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit f477ddcc20d5fc8c130b630854947a337881cd23 Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri Nov 25 17:44:43 2011 +0100 Only bother with dynamic DH moduli if we are a bridge. --- src/or/config.c | 32 ++++++++++++++++++-------------- 1 files changed, 18 insertions(+), 14 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index d403dec..a846ca9 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1363,22 +1363,26 @@ options_act(const or_options_t *old_options) } /* If needed, generate a new TLS DH prime according to the current torrc. */ - if (!old_options) { - if (options->DynamicDHGroups) { - char *fname = get_datadir_fname2("keys", "dynamic_dh_modulus"); - crypto_set_tls_dh_prime(fname); - tor_free(fname); + if (server_mode(options) && options->BridgeRelay) { + if (!old_options) { + if (options->DynamicDHGroups) { + char *fname = get_datadir_fname2("keys", "dynamic_dh_modulus"); + crypto_set_tls_dh_prime(fname); + tor_free(fname); + } else { + crypto_set_tls_dh_prime(NULL); + } } else { - crypto_set_tls_dh_prime(NULL); - } - } else { - if (options->DynamicDHGroups && !old_options->DynamicDHGroups) { - char *fname = get_datadir_fname2("keys", "dynamic_dh_modulus"); - crypto_set_tls_dh_prime(fname); - tor_free(fname); - } else if (!options->DynamicDHGroups && old_options->DynamicDHGroups) { - crypto_set_tls_dh_prime(NULL); + if (options->DynamicDHGroups && !old_options->DynamicDHGroups) { + char *fname = get_datadir_fname2("keys", "dynamic_dh_modulus"); + crypto_set_tls_dh_prime(fname); + tor_free(fname); + } else if (!options->DynamicDHGroups && old_options->DynamicDHGroups) { + crypto_set_tls_dh_prime(NULL); + } } + } else { /* clients don't need a dynamic DH prime. */ + crypto_set_tls_dh_prime(NULL); } /* We want to reinit keys as needed before we do much of anything else:

1 0