- tor-commits - lists.torproject.org

[tor/master] Changes file for prop176 branch
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit cc07b5a12936f0cd8c5791c94f66c20e1929b0ab Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 10 23:06:25 2011 -0400 Changes file for prop176 branch --- changes/prop176 | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/changes/prop176 b/changes/prop176 new file mode 100644 index 0000000..faedc1a --- /dev/null +++ b/changes/prop176 @@ -0,0 +1,8 @@ + o Major features + - Implement a new handshake protocol for authenticating Tors to + each other over TLS. It should be more resistant to fingerprinting + than previous protocols, and should require less TLS hacking for + future Tor implementations. Implements Proposal 185. + - Allow variable-length padding cells to disguise the length of + Tor's TLS records. Implements part of Proposal 184. +

1 0

[tor/master] Merge branch 'prop176-v2'
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit 3b704fd16667007d49223e1ae555eb7bd03092b3 Merge: bc2d935 8af0cfc Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 10 23:22:25 2011 -0400 Merge branch 'prop176-v2' changes/prop176 | 8 + src/common/crypto.c | 97 ++++++++- src/common/crypto.h | 4 + src/common/tortls.c | 511 +++++++++++++++++++++++++++++++++++++-- src/common/tortls.h | 22 ++ src/or/buffers.c | 38 +++- src/or/command.c | 620 ++++++++++++++++++++++++++++++++++++++++++++++-- src/or/connection.c | 9 +- src/or/connection_or.c | 605 +++++++++++++++++++++++++++++++++++++++++------ src/or/connection_or.h | 25 ++ src/or/or.h | 120 ++++++++- src/test/test_crypto.c | 71 ++++++- 12 files changed, 1976 insertions(+), 154 deletions(-)

1 0

[tor/master] Add some points to make it easy to turn off v3 support
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit 8af0cfc10d33186adaa114f215e8fa69af91a84a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 10 23:12:29 2011 -0400 Add some points to make it easy to turn off v3 support --- src/common/tortls.c | 9 +++++++++ src/or/command.c | 7 +++++++ 2 files changed, 16 insertions(+), 0 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index b393bfd..9a3c02b 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1095,7 +1095,11 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) tor_tls_init(); nickname = crypto_random_hostname(8, 20, "www.", ".net"); +#ifdef DISABLE_V3_LINKPROTO_SERVERSIDE + nn2 = crypto_random_hostname(8, 20, "www.", ".net"); +#else nn2 = crypto_random_hostname(8, 20, "www.", ".com"); +#endif /* Generate short-term RSA key for use with TLS. */ if (!(rsa = crypto_new_pk_env())) @@ -2183,6 +2187,10 @@ tor_tls_used_v1_handshake(tor_tls_t *tls) static int dn_indicates_v3_cert(X509_NAME *name) { +#ifdef DISABLE_V3_LINKPROTO_CLIENTSIDE + (void)name; + return 0; +#else X509_NAME_ENTRY *entry; int n_entries; ASN1_OBJECT *obj; @@ -2206,6 +2214,7 @@ dn_indicates_v3_cert(X509_NAME *name) r = fast_memneq(s + len - 4, ".net", 4); OPENSSL_free(s); return r; +#endif } /** Return true iff the peer certificate we're received on tls diff --git a/src/or/command.c b/src/or/command.c index 738bf35..a511156 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -689,6 +689,13 @@ command_process_versions_cell(var_cell_t *cell, or_connection_t *conn) send_chall ? " AUTH_CHALLENGE" : "", send_netinfo ? " NETINFO" : ""); +#ifdef DISABLE_V3_LINKPROTO_SERVERSIDE + if (1) { + connection_mark_for_close(TO_CONN(conn)); + return; + } +#endif + if (send_versions) { if (connection_or_send_versions(conn, 1) < 0) { log_warn(LD_OR, "Couldn't send versions cell");

1 0

[tor/master] Function to return peer cert as tor_tls_cert
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit e48e47fa03fa09d89527c1bbfaee4c9d7d3eee6e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Sep 22 11:01:14 2011 -0400 Function to return peer cert as tor_tls_cert --- src/common/tortls.c | 12 ++++++++++++ src/common/tortls.h | 1 + 2 files changed, 13 insertions(+), 0 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index e275307..aa90f18 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1856,6 +1856,18 @@ tor_tls_peer_has_cert(tor_tls_t *tls) return 1; } +/** Return the peer certificate, or NULL if there isn't one. */ +tor_cert_t * +tor_tls_get_peer_cert(tor_tls_t *tls) +{ + X509 *cert; + cert = SSL_get_peer_certificate(tls->ssl); + tls_log_errors(tls, LOG_WARN, LD_HANDSHAKE, "getting peer certificate"); + if (!cert) + return NULL; + return tor_cert_new(cert); +} + /** Warn that a certificate lifetime extends through a certain range. */ static void log_cert_lifetime(const X509 *cert, const char *problem) diff --git a/src/common/tortls.h b/src/common/tortls.h index b522dd1..00bf406 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -66,6 +66,7 @@ void tor_tls_set_renegotiate_callback(tor_tls_t *tls, int tor_tls_is_server(tor_tls_t *tls); void tor_tls_free(tor_tls_t *tls); int tor_tls_peer_has_cert(tor_tls_t *tls); +tor_cert_t *tor_tls_get_peer_cert(tor_tls_t *tls); int tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_env_t **identity); int tor_tls_check_lifetime(tor_tls_t *tls, int tolerance); int tor_tls_read(tor_tls_t *tls, char *cp, size_t len);

1 0

[tor/master] Basic function to write authenticate cells
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit 81024f43ec3a3ab32683764cb925606bfcb603d7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 14 14:44:42 2011 -0400 Basic function to write authenticate cells Also, tweak the cert cell code to send auth certs --- src/or/connection_or.c | 195 +++++++++++++++++++++++++++++++++++++++++++++++- src/or/connection_or.h | 5 + 2 files changed, 197 insertions(+), 3 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index dcb838b..c72d89d 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -1776,13 +1776,14 @@ connection_or_send_cert_cell(or_connection_t *conn) var_cell_t *cell; size_t cell_len; int pos; + int server_mode; tor_assert(conn->_base.state == OR_CONN_STATE_OR_HANDSHAKING_V3); if (! conn->handshake_state) return -1; - if (tor_tls_get_my_certs(! conn->handshake_state->started_here, - &link_cert, &id_cert) < 0) + server_mode = ! conn->handshake_state->started_here; + if (tor_tls_get_my_certs(server_mode, &link_cert, &id_cert) < 0) return -1; tor_cert_get_der(link_cert, &link_encoded, &link_len); tor_cert_get_der(id_cert, &id_encoded, &id_len); @@ -1795,7 +1796,10 @@ connection_or_send_cert_cell(or_connection_t *conn) cell->payload[0] = 2; pos = 1; - cell->payload[pos] = OR_CERT_TYPE_TLS_LINK; /* Link cert */ + if (server_mode) + cell->payload[pos] = OR_CERT_TYPE_TLS_LINK; /* Link cert */ + else + cell->payload[pos] = OR_CERT_TYPE_AUTH_1024; /* client authentication */ set_uint16(&cell->payload[pos+1], htons(link_len)); memcpy(&cell->payload[pos+3], link_encoded, link_len); pos += 3 + link_len; @@ -1842,3 +1846,188 @@ connection_or_send_auth_challenge_cell(or_connection_t *conn) return 0; } +/** DOCDOC */ +#define V3_HS_AUTH_FIXED_PART_LEN (8+(32*6)) +#define V3_HS_AUTH_BODY_LEN (V3_HS_AUTH_FIXED_PART_LEN + 8 + 16) + +#define AUTHTYPE_RSA_SHA256_TLSSECRET 1 + +/** Compute the main body of an AUTHENTICATE cell that a client can use + * to authenticate itself on a v3 handshake for conn. Write it to the + * outlen-byte buffer at out. + * + * If server is true, only calculate the first + * V3_HS_AUTH_FIXED_PART_LEN bytes -- the part of the authenticator that's + * determined by the rest of the handshake, and which match the provided value + * exactly. + * + * If server is false and signing_key is NULL, calculate the + * first V3_HS_AUTH_BODY_LEN bytes of the authenticator (that is, everything + * that should be signed), but don't actually sign it. + * + * If server is false and signing_key is provided, calculate the + * entire authenticator, signed with signing_key. + */ +int +connection_or_compute_authenticate_cell_body(or_connection_t *conn, + uint8_t *out, size_t outlen, + crypto_pk_env_t *signing_key, + int server) +{ + uint8_t *ptr; + + /* assert state is reasonable XXXX */ + + if (outlen < V3_HS_AUTH_FIXED_PART_LEN || + (!server && outlen < V3_HS_AUTH_BODY_LEN)) + return -1; + + ptr = out; + + /* Type: 8 bytes. */ + memcpy(ptr, "AUTH0001", 8); + ptr += 8; + + { + const tor_cert_t *id_cert=NULL, *link_cert=NULL; + const uint8_t *my_id, *their_id, *client_id, *server_id; + if (tor_tls_get_my_certs(0, &link_cert, &id_cert)) + return -1; + my_id = (uint8_t*)tor_cert_get_id_digests(id_cert)->d[DIGEST_SHA256]; + their_id = (uint8_t*) + tor_cert_get_id_digests(conn->handshake_state->id_cert)->d[DIGEST_SHA256]; + client_id = server ? their_id : my_id; + server_id = server ? my_id : their_id; + + /* Client ID digest: 32 octets. */ + memcpy(ptr, client_id, 32); + ptr += 32; + + /* Server ID digest: 32 octets. */ + memcpy(ptr, server_id, 32); + ptr += 32; + } + + { + crypto_digest_env_t *server_d, *client_d; + if (server) { + server_d = conn->handshake_state->digest_sent; + client_d = conn->handshake_state->digest_received; + } else { + client_d = conn->handshake_state->digest_sent; + server_d = conn->handshake_state->digest_received; + } + + /* Server log digest : 32 octets */ + crypto_digest_get_digest(server_d, (char*)ptr, 32); + ptr += 32; + + /* Client log digest : 32 octets */ + crypto_digest_get_digest(client_d, (char*)ptr, 32); + ptr += 32; + } + + { + /* Digest of cert used on TLS link : 32 octets. */ + const tor_cert_t *cert = NULL; + tor_cert_t *freecert = NULL; + if (server) { + tor_tls_get_my_certs(1, &cert, NULL); + } else { + freecert = tor_tls_get_peer_cert(conn->tls); + cert = freecert; + } + if (!cert) + return -1; + memcpy(ptr, tor_cert_get_cert_digests(cert)->d[DIGEST_SHA256], 32); + + if (freecert) + tor_cert_free(freecert); + ptr += 32; + } + + /* HMAC of clientrandom and serverrandom using master key : 32 octets */ + tor_tls_get_tlssecrets(conn->tls, ptr); + ptr += 32; + + tor_assert(ptr - out == V3_HS_AUTH_FIXED_PART_LEN); + + if (server) + return ptr-out; + + /* Time: 8 octets. */ + { + uint64_t now = time(NULL); + if ((time_t)now < 0) + return -1; + set_uint32(ptr, htonl((uint32_t)(now>>32))); + set_uint32(ptr+4, htonl((uint32_t)now)); + ptr += 8; + } + + /* Nonce: 16 octets. */ + crypto_rand((char*)ptr, 16); + ptr += 16; + + tor_assert(ptr - out == V3_HS_AUTH_BODY_LEN); + + if (!signing_key) + return ptr - out; + + { + int siglen; + char d[32]; + crypto_digest256(d, (char*)out, ptr-out, DIGEST_SHA256); + siglen = crypto_pk_private_sign(signing_key, + (char*)ptr, outlen - (ptr-out), + d, 32); + if (siglen < 0) + return -1; + + ptr += siglen; + tor_assert(ptr <= out+outlen); + return ptr - out; + } +} + +/** Send an AUTHENTICATE cell on the connection conn. Return 0 on + * success, -1 on failure */ +int +connection_or_send_authenticate_cell(or_connection_t *conn) +{ + var_cell_t *cell; + crypto_pk_env_t *pk = tor_tls_get_my_client_auth_key(); + int authlen; + int cell_maxlen; + /* XXXX make sure we're actually supposed to send this! */ + + if (!pk) + return -1;/*XXXX log*/ + cell_maxlen = 4 + /* overhead */ + V3_HS_AUTH_BODY_LEN + /* Authentication body */ + crypto_pk_keysize(pk) + /* Max signature length */ + 16 /* just in case XXXX */ ; + + cell = var_cell_new(cell_maxlen); + set_uint16(cell->payload, htons(AUTHTYPE_RSA_SHA256_TLSSECRET)); + /* skip over length ; we don't know that yet. */ + + authlen = connection_or_compute_authenticate_cell_body(conn, + cell->payload+4, + cell_maxlen-4, + pk, + 0 /* not server */); + if (authlen < 0) { + /* XXXX log */ + var_cell_free(cell); + return -1; + } + tor_assert(authlen + 4 <= cell->payload_len); + set_uint16(cell->payload+2, htons(authlen)); + cell->payload_len = authlen + 4; + + connection_or_write_var_cell_to_buf(cell, conn); + var_cell_free(cell); + + return 0; +} diff --git a/src/or/connection_or.h b/src/or/connection_or.h index 6e50e29..ba441c4 100644 --- a/src/or/connection_or.h +++ b/src/or/connection_or.h @@ -52,6 +52,11 @@ int connection_or_send_destroy(circid_t circ_id, or_connection_t *conn, int connection_or_send_netinfo(or_connection_t *conn); int connection_or_send_cert_cell(or_connection_t *conn); int connection_or_send_auth_challenge_cell(or_connection_t *conn); +int connection_or_compute_authenticate_cell_body(or_connection_t *conn, + uint8_t *out, size_t outlen, + crypto_pk_env_t *signing_key, + int server); +int connection_or_send_authenticate_cell(or_connection_t *conn); int is_or_protocol_version_known(uint16_t version);

1 0

[tor/master] New functions to record digests of cells during v3 handshake
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit 3f22ec179c6f90b9c2af9483e2c8000132d2f33e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 16 18:32:11 2011 -0400 New functions to record digests of cells during v3 handshake Also, free all of the new fields in or_handshake_state_t --- src/or/connection_or.c | 64 ++++++++++++++++++++++++++++++++++++++++++++++++ src/or/connection_or.h | 7 +++++ 2 files changed, 71 insertions(+), 0 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 93b0b3a..4caa3d3 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -1504,10 +1504,74 @@ or_handshake_state_free(or_handshake_state_t *state) { if (!state) return; + crypto_free_digest_env(state->digest_sent); + crypto_free_digest_env(state->digest_received); + tor_cert_free(state->auth_cert); + tor_cert_free(state->id_cert); memset(state, 0xBE, sizeof(or_handshake_state_t)); tor_free(state); } +/** + * Remember that cell has been transmitted (if incoming is + * false) or received (if incoming is true) during a V3 handshake using + * state. + * + * (We don't record the cell, but we keep a digest of everything sent or + * received during the v3 handshake, and the client signs it in an + * authenticate cell.) + */ +void +or_handshake_state_record_cell(or_handshake_state_t *state, + const cell_t *cell, + int incoming) +{ + crypto_digest_env_t *d, **dptr; + packed_cell_t packed; + if (!incoming) { + log_warn(LD_BUG, "We shouldn't be sending any non-variable-length cells " + "whilemaking a handshake digest. But we think we are."); + } + dptr = incoming ? &state->digest_received : &state->digest_sent; + if (! *dptr) + *dptr = crypto_new_digest256_env(DIGEST_SHA256); + + d = *dptr; + /* Re-packing like this is a little inefficient, but we don't have to do + this very often at all. */ + cell_pack(&packed, cell); + crypto_digest_add_bytes(d, packed.body, sizeof(packed.body)); + memset(&packed, 0, sizeof(packed)); +} + +/** Remember that a variable-length cell has been transmitted (if + * incoming is false) or received (if incoming is true) during a V3 + * handshake using state. + * + * (We don't record the cell, but we keep a digest of everything sent or + * received during the v3 handshake, and the client signs it in an + * authenticate cell.) + */ +void +or_handshake_state_record_var_cell(or_handshake_state_t *state, + const var_cell_t *cell, + int incoming) +{ + crypto_digest_env_t *d, **dptr; + char buf[VAR_CELL_HEADER_SIZE]; + dptr = incoming ? &state->digest_received : &state->digest_sent; + if (! *dptr) + *dptr = crypto_new_digest256_env(DIGEST_SHA256); + + d = *dptr; + + var_cell_pack_header(cell, buf); + crypto_digest_add_bytes(d, buf, sizeof(buf)); + crypto_digest_add_bytes(d, (const char *)cell->payload, cell->payload_len); + + memset(buf, 0, sizeof(buf)); +} + /** Set conn's state to OR_CONN_STATE_OPEN, and tell other subsystems * as appropriate. Called when we are done with all TLS and OR handshaking. */ diff --git a/src/or/connection_or.h b/src/or/connection_or.h index ba441c4..a4d3be0 100644 --- a/src/or/connection_or.h +++ b/src/or/connection_or.h @@ -42,6 +42,13 @@ int connection_tls_start_handshake(or_connection_t *conn, int receiving); int connection_tls_continue_handshake(or_connection_t *conn); void or_handshake_state_free(or_handshake_state_t *state); +void or_handshake_state_record_cell(or_handshake_state_t *state, + const cell_t *cell, + int incoming); +void or_handshake_state_record_var_cell(or_handshake_state_t *state, + const var_cell_t *cell, + int incoming); + int connection_or_set_state_open(or_connection_t *conn); void connection_or_write_cell_to_buf(const cell_t *cell, or_connection_t *conn);

1 0

[tor/master] Remove a no-longer-relevant comment
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit 445f94789039bf2d25800741b1ad77c99ab4044d Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 26 11:41:23 2011 -0400 Remove a no-longer-relevant comment --- src/common/crypto.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index c397199..0076c1d 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1206,9 +1206,6 @@ crypto_pk_asn1_decode(const char *str, size_t len) { RSA *rsa; unsigned char *buf; - /* This ifdef suppresses a type warning. Take out the first case once - * everybody is using OpenSSL 0.9.7 or later. - */ const unsigned char *cp; cp = buf = tor_malloc(len); memcpy(buf,str,len);

1 0

[tor/master] Make tor_tls_cert_is_valid check key lengths
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit 9a77ebc794cff2df50bb2d47788461864f4bc8c9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Sep 22 10:01:41 2011 -0400 Make tor_tls_cert_is_valid check key lengths --- src/common/tortls.c | 34 +++++++++++++++++++++++++++++----- src/common/tortls.h | 3 ++- src/or/command.c | 8 ++++---- 3 files changed, 35 insertions(+), 10 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index aa90f18..01a0f8e 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -928,14 +928,18 @@ tor_tls_cert_matches_key(const tor_tls_t *tls, const tor_cert_t *cert) } /** Check wither cert is well-formed, currently live, and correctly - * signed by the public key in signing_cert. Return 0 if the cert is - * good, and -1 if it's bad or we couldn't check it. */ + * signed by the public key in signing_cert. If check_rsa_1024, + * make sure that it has an RSA key with 1024 bits; otherwise, just check that + * the key is long enough. Return 1 if the cert is good, and 0 if it's bad or + * we couldn't check it. */ int tor_tls_cert_is_valid(const tor_cert_t *cert, - const tor_cert_t *signing_cert) + const tor_cert_t *signing_cert, + int check_rsa_1024) { + EVP_PKEY *cert_key; EVP_PKEY *signing_key = X509_get_pubkey(signing_cert->cert); - int r; + int r, key_ok = 0; if (!signing_key) return 0; r = X509_verify(cert->cert, signing_key); @@ -949,9 +953,29 @@ tor_tls_cert_is_valid(const tor_cert_t *cert, if (check_cert_lifetime_internal(cert->cert, 60*60) < 0) return 0; + cert_key = X509_get_pubkey(cert->cert); + if (check_rsa_1024 && cert_key) { + RSA *rsa = EVP_PKEY_get1_RSA(cert_key); + if (rsa && BN_num_bits(rsa->n) == 1024) + key_ok = 1; + if (rsa) + RSA_free(rsa); + } else if (cert_key) { + int min_bits = 1024; +#ifdef EVP_PKEY_EC + if (EVP_PKEY_type(cert_key->type) == EVP_PKEY_EC) + min_bits = 128; +#endif + if (EVP_PKEY_bits(cert_key) >= min_bits) + key_ok = 1; + } + EVP_PKEY_free(cert_key); + if (!key_ok) + return 0; + /* XXXX compare DNs or anything? */ - return -1; + return 1; } /** Increase the reference count of ctx. */ diff --git a/src/common/tortls.h b/src/common/tortls.h index 00bf406..90e76e4 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -123,7 +123,8 @@ crypto_pk_env_t *tor_tls_get_my_client_auth_key(void); crypto_pk_env_t *tor_tls_cert_get_key(tor_cert_t *cert); int tor_tls_cert_matches_key(const tor_tls_t *tls, const tor_cert_t *cert); int tor_tls_cert_is_valid(const tor_cert_t *cert, - const tor_cert_t *signing_cert); + const tor_cert_t *signing_cert, + int check_rsa_1024); #endif diff --git a/src/or/command.c b/src/or/command.c index aad971f..a32671f 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -745,9 +745,9 @@ command_process_cert_cell(var_cell_t *cell, or_connection_t *conn) if (! tor_tls_cert_matches_key(conn->tls, link_cert)) { ERR("The link certificate didn't match the TLS public key"); } - if (! tor_tls_cert_is_valid(link_cert, id_cert)) + if (! tor_tls_cert_is_valid(link_cert, id_cert, 0)) ERR("The link certificate was not valid"); - if (! tor_tls_cert_is_valid(id_cert, id_cert)) + if (! tor_tls_cert_is_valid(id_cert, id_cert, 1)) ERR("The ID certificate was not valid"); /* XXXX okay, we just got authentication. Do something about that. */ @@ -761,9 +761,9 @@ command_process_cert_cell(var_cell_t *cell, or_connection_t *conn) /* Remember these certificates so we can check an AUTHENTICATE cell */ conn->handshake_state->id_cert = id_cert; conn->handshake_state->auth_cert = auth_cert; - if (! tor_tls_cert_is_valid(auth_cert, id_cert)) + if (! tor_tls_cert_is_valid(auth_cert, id_cert, 1)) ERR("The authentication certificate was not valid"); - if (! tor_tls_cert_is_valid(id_cert, id_cert)) + if (! tor_tls_cert_is_valid(id_cert, id_cert, 1)) ERR("The ID certificate was not valid"); /* XXXX check more stuff? */

1 0

[tor/master] Implement cert/auth cell reading
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit 6c7f28454e80da733e3bfb4f71101faf09b7ac24 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 13 16:24:49 2011 -0400 Implement cert/auth cell reading --- src/or/command.c | 278 ++++++++++++++++++++++++++++++++++++++++++++++++ src/or/connection_or.c | 24 ++--- src/or/or.h | 53 +++++++++ 3 files changed, 338 insertions(+), 17 deletions(-) diff --git a/src/or/command.c b/src/or/command.c index 72d8cd7..aad971f 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -660,3 +660,281 @@ command_process_netinfo_cell(cell_t *cell, or_connection_t *conn) assert_connection_ok(TO_CONN(conn),time(NULL)); } +/** Process a CERT cell from an OR connection. + * + * If the other side should not have sent us a CERT cell, or the cell is + * malformed, or it is supposed to authenticate the TLS key but it doesn't, + * then mark the connection. + * + * If the cell has a good cert chain and we're doing a v3 handshake, then + * store the certificates in or_handshake_state. If this is the client side + * of the connection, we then authenticate the server or mark the connection. + * If it's the server side, wait for an AUTHENTICATE cell. + */ +static void +command_process_cert_cell(var_cell_t *cell, or_connection_t *conn) +{ +#define ERR(s) \ + do { \ + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, \ + "Received a bad CERT cell from %s:%d: %s", \ + conn->_base.address, conn->_base.port, (s)); \ + connection_mark_for_close(TO_CONN(conn)); \ + goto err; \ + } while (0) + + tor_cert_t *link_cert = NULL; + tor_cert_t *id_cert = NULL; + tor_cert_t *auth_cert = NULL; + + uint8_t *ptr; + int n_certs, i; + + if (conn->_base.state != OR_CONN_STATE_OR_HANDSHAKING_V3) + ERR("We're not doing a v3 handshake!"); + if (conn->handshake_state->received_cert_cell) + ERR("We already got one"); + if (cell->payload_len < 1) + ERR("It had no body"); + if (cell->circ_id) + ERR("It had a nonzero circuit ID"); + + n_certs = cell->payload[0]; + ptr = cell->payload + 1; + for (i = 0; i < n_certs; ++i) { + uint8_t cert_type; + uint16_t cert_len; + if (ptr + 3 > cell->payload + cell->payload_len) { + goto truncated; + } + cert_type = *ptr; + cert_len = ntohs(get_uint16(ptr+1)); + if (ptr + 3 + cert_len > cell->payload + cell->payload_len) { + goto truncated; + } + if (cert_type == OR_CERT_TYPE_TLS_LINK || + cert_type == OR_CERT_TYPE_ID_1024 || + cert_type == OR_CERT_TYPE_AUTH_1024) { + tor_cert_t *cert = tor_cert_decode(ptr + 3, cert_len); + if (!cert) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Received undecodable certificate in CERT cell from %s:%d", + conn->_base.address, conn->_base.port); + } else { + if (cert_type == OR_CERT_TYPE_TLS_LINK && !link_cert) + link_cert = cert; + else if (cert_type == OR_CERT_TYPE_ID_1024 && !id_cert) + id_cert = cert; + else if (cert_type == OR_CERT_TYPE_AUTH_1024 && !auth_cert) + auth_cert = cert; + else + tor_cert_free(cert); + } + } + ptr += 3 + cert_len; + continue; + + truncated: + ERR("It ends in the middle of a certificate"); + } + + if (conn->handshake_state->started_here) { + if (! (id_cert && link_cert)) + ERR("The certs we wanted were missing"); + /* Okay. We should be able to check the certificates now. */ + if (! tor_tls_cert_matches_key(conn->tls, link_cert)) { + ERR("The link certificate didn't match the TLS public key"); + } + if (! tor_tls_cert_is_valid(link_cert, id_cert)) + ERR("The link certificate was not valid"); + if (! tor_tls_cert_is_valid(id_cert, id_cert)) + ERR("The ID certificate was not valid"); + + /* XXXX okay, we just got authentication. Do something about that. */ + + conn->handshake_state->id_cert = id_cert; + id_cert = NULL; + } else { + if (! (id_cert && auth_cert)) + ERR("The certs we wanted were missing"); + + /* Remember these certificates so we can check an AUTHENTICATE cell */ + conn->handshake_state->id_cert = id_cert; + conn->handshake_state->auth_cert = auth_cert; + if (! tor_tls_cert_is_valid(auth_cert, id_cert)) + ERR("The authentication certificate was not valid"); + if (! tor_tls_cert_is_valid(id_cert, id_cert)) + ERR("The ID certificate was not valid"); + + /* XXXX check more stuff? */ + + id_cert = auth_cert = NULL; + } + + conn->handshake_state->received_cert_cell = 1; +err: + tor_cert_free(id_cert); + tor_cert_free(link_cert); + tor_cert_free(auth_cert); +#undef ERR +} + +/** Process an AUTH_CHALLENGE cell from an OR connection. + * + * If we weren't supposed to get one (for example, because we're not the + * originator of the connection), or it's ill-formed, or we aren't doing a v3 + * handshake, mark the connection. If the cell is well-formed but we don't + * want to authenticate, just drop it. If the cell is well-formed *and* we + * want to authenticate, send an AUTHENTICATE cell. */ +static void +command_process_auth_challenge_cell(var_cell_t *cell, or_connection_t *conn) +{ + int n_types, i, use_type = -1; + uint8_t *cp; + +#define ERR(s) \ + do { \ + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, \ + "Received a bad AUTH_CHALLENGE cell from %s:%d: %s", \ + conn->_base.address, conn->_base.port, (s)); \ + connection_mark_for_close(TO_CONN(conn)); \ + return; \ + } while (0) + + if (conn->_base.state != OR_CONN_STATE_OR_HANDSHAKING_V3) + ERR("We're not currently doing a v3 handshake"); + if (! conn->handshake_state->started_here) + ERR("We didn't originate this connection"); + if (conn->handshake_state->received_auth_challenge) + ERR("We already received one"); + if (cell->payload_len < OR_AUTH_CHALLENGE_LEN + 2) + ERR("It was too short"); + if (cell->circ_id) + ERR("It had a nonzero circuit ID"); + + n_types = ntohs(get_uint16(cell->payload + OR_AUTH_CHALLENGE_LEN)); + if (cell->payload_len < OR_AUTH_CHALLENGE_LEN + 2 + 2*n_types) + ERR("It looks truncated"); + + memcpy(conn->handshake_state->auth_challenge, cell->payload, + OR_AUTH_CHALLENGE_LEN); + + /* Now see if there is an authentication type we can use */ + cp=cell->payload+OR_AUTH_CHALLENGE_LEN+2; + for (i=0; i < n_types; ++i, cp += 2) { + uint16_t authtype = ntohs(get_uint16(cp)); + if (authtype == AUTHTYPE_RSA_SHA256_TLSSECRET) + use_type = authtype; + } + + conn->handshake_state->received_auth_challenge = 1; + + /* Send back authentication if we want, and if use_type is set */ +#undef ERR +} + +/** Process an AUTHENTICATE cell from an OR connection. + * + * If it's ill-formed or we weren't supposed to get one or we're not doing a + * v3 handshake, then mark the connection. If it does not authenticate the + * other side of the connection successfully (because it isn't signed right, + * we didn't get a CERT cell, etc) mark the connection. Otherwise, accept + * the identity of the router on the other side of the connection. + */ +static void +command_process_authenticate_cell(or_connection_t *conn, var_cell_t *cell) +{ + uint8_t expected[V3_AUTH_FIXED_PART_LEN]; + const uint8_t *auth; + int authlen; + +#define ERR(s) \ + do { \ + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, \ + "Received a bad AUTHETNICATE cell from %s:%d: %s", \ + conn->_base.address, conn->_base.port, (s)); \ + connection_mark_for_close(TO_CONN(conn)); \ + return; \ + } while (0) + + if (conn->_base.state != OR_CONN_STATE_OR_HANDSHAKING_V3) + ERR("We're not doing a v3 handshake"); + if (! conn->handshake_state->started_here) + ERR("We originated this connection"); + if (conn->handshake_state->received_authenticate) + ERR("We already got one!"); + if (conn->handshake_state->auth_cert == NULL) + ERR("We never got an authentication certificate"); + if (cell->payload_len < 4) + ERR("Cell was way too short"); + + auth = cell->payload; + { + uint16_t type = ntohs(get_uint16(auth)); + uint16_t len = ntohs(get_uint16(auth+2)); + if (4 + len > cell->payload_len) + ERR("Authenticator was truncated"); + + if (type != AUTHTYPE_RSA_SHA256_TLSSECRET) + ERR("Authenticator type was not recognized"); + + auth += 4; + authlen = len; + } + + if (authlen < V3_AUTH_BODY_LEN + 1) + ERR("Authenticator was too short"); + + if (connection_or_compute_authenticate_cell_body( + conn, expected, sizeof(expected), NULL, 1) < 0) + ERR("Couldn't compute expected AUTHENTICATE cell body"); + + if (tor_memneq(expected, auth, sizeof(expected))) + ERR("Some field in the AUTHENTICATE cell body was not as expected"); + + { + crypto_pk_env_t *pk = tor_tls_cert_get_key( + conn->handshake_state->auth_cert); + char d[DIGEST256_LEN]; + char *signed_data; + size_t keysize; + int signed_len; + + crypto_digest256(d, (char*)auth, V3_AUTH_BODY_LEN, DIGEST_SHA256); + + keysize = crypto_pk_keysize(pk); + signed_data = tor_malloc(keysize); + signed_len = crypto_pk_public_checksig(pk, signed_data, keysize, + (char*)auth + V3_AUTH_BODY_LEN, + authlen - V3_AUTH_BODY_LEN); + if (signed_len < 0) { + tor_free(signed_data); + ERR("Signature wasn't valid"); + } + if (signed_len < DIGEST256_LEN) { + tor_free(signed_data); + ERR("Not enough data was signed"); + } + if (tor_memneq(signed_data, d, DIGEST256_LEN)) { + tor_free(signed_data); + ERR("Signature did not match data to be signed."); + } + tor_free(signed_data); + } + + /* XXXX we're authenticated. Now remember the fact, and remember whom we're + authenticated to. */ + + conn->handshake_state->received_authenticate = 1; +#undef ERR +} + + +void dummy_function(void); +void dummy_function(void) +{ + /* this is only here to avoid 'static function isn't used' warnings */ + command_process_auth_challenge_cell(NULL, NULL); + command_process_cert_cell(NULL, NULL); + command_process_authenticate_cell(NULL, NULL); +} diff --git a/src/or/connection_or.c b/src/or/connection_or.c index c72d89d..93b0b3a 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -1761,10 +1761,6 @@ connection_or_send_netinfo(or_connection_t *conn) return 0; } -/** DOCDOC */ -#define OR_CERT_TYPE_TLS_LINK 1 -#define OR_CERT_TYPE_ID_1024 2 - /** Send a CERT cell on the connection conn. Return 0 on success, -1 * on failure. */ int @@ -1846,23 +1842,17 @@ connection_or_send_auth_challenge_cell(or_connection_t *conn) return 0; } -/** DOCDOC */ -#define V3_HS_AUTH_FIXED_PART_LEN (8+(32*6)) -#define V3_HS_AUTH_BODY_LEN (V3_HS_AUTH_FIXED_PART_LEN + 8 + 16) - -#define AUTHTYPE_RSA_SHA256_TLSSECRET 1 - /** Compute the main body of an AUTHENTICATE cell that a client can use * to authenticate itself on a v3 handshake for conn. Write it to the * outlen-byte buffer at out. * * If server is true, only calculate the first - * V3_HS_AUTH_FIXED_PART_LEN bytes -- the part of the authenticator that's + * V3_AUTH_FIXED_PART_LEN bytes -- the part of the authenticator that's * determined by the rest of the handshake, and which match the provided value * exactly. * * If server is false and signing_key is NULL, calculate the - * first V3_HS_AUTH_BODY_LEN bytes of the authenticator (that is, everything + * first V3_AUTH_BODY_LEN bytes of the authenticator (that is, everything * that should be signed), but don't actually sign it. * * If server is false and signing_key is provided, calculate the @@ -1878,8 +1868,8 @@ connection_or_compute_authenticate_cell_body(or_connection_t *conn, /* assert state is reasonable XXXX */ - if (outlen < V3_HS_AUTH_FIXED_PART_LEN || - (!server && outlen < V3_HS_AUTH_BODY_LEN)) + if (outlen < V3_AUTH_FIXED_PART_LEN || + (!server && outlen < V3_AUTH_BODY_LEN)) return -1; ptr = out; @@ -1950,7 +1940,7 @@ connection_or_compute_authenticate_cell_body(or_connection_t *conn, tor_tls_get_tlssecrets(conn->tls, ptr); ptr += 32; - tor_assert(ptr - out == V3_HS_AUTH_FIXED_PART_LEN); + tor_assert(ptr - out == V3_AUTH_FIXED_PART_LEN); if (server) return ptr-out; @@ -1969,7 +1959,7 @@ connection_or_compute_authenticate_cell_body(or_connection_t *conn, crypto_rand((char*)ptr, 16); ptr += 16; - tor_assert(ptr - out == V3_HS_AUTH_BODY_LEN); + tor_assert(ptr - out == V3_AUTH_BODY_LEN); if (!signing_key) return ptr - out; @@ -2004,7 +1994,7 @@ connection_or_send_authenticate_cell(or_connection_t *conn) if (!pk) return -1;/*XXXX log*/ cell_maxlen = 4 + /* overhead */ - V3_HS_AUTH_BODY_LEN + /* Authentication body */ + V3_AUTH_BODY_LEN + /* Authentication body */ crypto_pk_keysize(pk) + /* Max signature length */ 16 /* just in case XXXX */ ; diff --git a/src/or/or.h b/src/or/or.h index ebf9ab5..a40598f 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1087,6 +1087,43 @@ typedef struct listener_connection_t { /** Minimum length of the random part of an AUTH_CHALLENGE cell. */ #define OR_AUTH_CHALLENGE_LEN 32 +/** + * @name Certificate types for CERT cells. + * + * These values are defined by the protocol, and affect how an X509 + * certificate in a CERT cell is interpreted and used. + * + * @{ */ +/** A certificate that authenticates a TLS link key. The subject key + * must match the key used in the TLS handshake; it must be signed by + * the identity key. */ +#define OR_CERT_TYPE_TLS_LINK 1 +/** A self-signed identity certificate. The subject key must be a + * 1024-bit RSA key. */ +#define OR_CERT_TYPE_ID_1024 2 +/** A certificate that authenticates a key used in an AUTHENTICATE cell + * in the v3 handshake. The subject key must be a 1024-bit RSA key; it + * must be signed by the identity key */ +#define OR_CERT_TYPE_AUTH_1024 3 +/**@}*/ + +/** The one currently supported type of AUTHENTICATE cell. It contains + * a bunch of structures signed with an RSA1024 key. The signed + * structures include a HMAC using negotiated TLS secrets, and a digest + * of all cells sent or received before the AUTHENTICATE cell (including + * the random server-generated AUTH_CHALLENGE cell). + */ +#define AUTHTYPE_RSA_SHA256_TLSSECRET 1 + +/** The length of the part of the AUTHENTICATE cell body that the client and + * server can generate independently (when using RSA_SHA256_TLSSECRET). It + * contains everything except the client's timestamp, the client's randomly + * generated nonce, and the signature. */ +#define V3_AUTH_FIXED_PART_LEN (8+(32*6)) +/** The length of the part of the AUTHENTICATE cell body that the client + * signs. */ +#define V3_AUTH_BODY_LEN (V3_AUTH_FIXED_PART_LEN + 8 + 16) + /** Stores flags and information related to the portion of a v2/v3 Tor OR * connection handshake that happens after the TLS handshake is finished. */ @@ -1098,6 +1135,12 @@ typedef struct or_handshake_state_t { unsigned int started_here : 1; /** True iff we have received and processed a VERSIONS cell. */ unsigned int received_versions : 1; + /** True iff we have received and processed an AUTH_CHALLENGE cell */ + unsigned int received_auth_challenge : 1; + /** True iff we have received and processed a CERT cell. */ + unsigned int received_cert_cell : 1; + /** True iff we have received and processed an AUTHENTICATE cell */ + unsigned int received_authenticate : 1; /** Digests of the cells that we have sent or received as part of a V3 * handshake. Used for making and checking AUTHENTICATE cells. @@ -1108,6 +1151,16 @@ typedef struct or_handshake_state_t { crypto_digest_env_t *digest_received; /** @} */ + /** Certificates that a connection initiator sent us in a CERT cell; we're + * holding on to them until we get an AUTHENTICATE cell. + * + * @{ + */ + /** The cert for the key that's supposed to sign the AUTHENTICATE cell */ + tor_cert_t *auth_cert; + /** A self-signed identity certificate */ + tor_cert_t *id_cert; + /**@}*/ } or_handshake_state_t; /** Subtype of connection_t for an "OR connection" -- that is, one that speaks

1 0

[tor/master] Allow "finished flushing" during v3 handshake
by nickm＠torproject.org 11 Oct '11

11 Oct '11

commit 7935c4bdfab55dfa3e87345f84b73772dbc50110 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 27 13:40:39 2011 -0400 Allow "finished flushing" during v3 handshake --- src/or/connection_or.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index a391ca7..ecd4af3 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -439,6 +439,7 @@ connection_or_finished_flushing(or_connection_t *conn) case OR_CONN_STATE_PROXY_HANDSHAKING: case OR_CONN_STATE_OPEN: case OR_CONN_STATE_OR_HANDSHAKING_V2: + case OR_CONN_STATE_OR_HANDSHAKING_V3: break; default: log_err(LD_BUG,"Called in unexpected state %d.", conn->_base.state);

1 0