routerkeys.c 36 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147
  1. /* Copyright (c) 2014-2016, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /**
  4. * \file routerkeys.c
  5. *
  6. * \brief Functions and structures to handle generating and maintaining the
  7. * set of keypairs necessary to be an OR. (Some of the code in router.c
  8. * belongs here.)
  9. */
  10. #include "or.h"
  11. #include "config.h"
  12. #include "router.h"
  13. #include "crypto_pwbox.h"
  14. #include "routerkeys.h"
  15. #include "torcert.h"
  16. #define ENC_KEY_HEADER "Boxed Ed25519 key"
  17. #define ENC_KEY_TAG "master"
  18. static ssize_t
  19. do_getpass(const char *prompt, char *buf, size_t buflen,
  20. int twice, const or_options_t *options)
  21. {
  22. if (options->keygen_force_passphrase == FORCE_PASSPHRASE_OFF) {
  23. tor_assert(buflen);
  24. buf[0] = 0;
  25. return 0;
  26. }
  27. char *prompt2 = NULL;
  28. char *buf2 = NULL;
  29. int fd = -1;
  30. ssize_t length = -1;
  31. if (options->use_keygen_passphrase_fd) {
  32. twice = 0;
  33. fd = options->keygen_passphrase_fd;
  34. length = read_all(fd, buf, buflen-1, 0);
  35. if (length >= 0)
  36. buf[length] = 0;
  37. goto done_reading;
  38. }
  39. if (twice) {
  40. const char msg[] = "One more time:";
  41. size_t p2len = strlen(prompt) + 1;
  42. if (p2len < sizeof(msg))
  43. p2len = sizeof(msg);
  44. prompt2 = tor_malloc(strlen(prompt)+1);
  45. memset(prompt2, ' ', p2len);
  46. memcpy(prompt2 + p2len - sizeof(msg), msg, sizeof(msg));
  47. buf2 = tor_malloc_zero(buflen);
  48. }
  49. while (1) {
  50. length = tor_getpass(prompt, buf, buflen);
  51. if (length < 0)
  52. goto done_reading;
  53. if (! twice)
  54. break;
  55. ssize_t length2 = tor_getpass(prompt2, buf2, buflen);
  56. if (length != length2 || tor_memneq(buf, buf2, length)) {
  57. fprintf(stderr, "That didn't match.\n");
  58. } else {
  59. break;
  60. }
  61. }
  62. done_reading:
  63. if (twice) {
  64. tor_free(prompt2);
  65. memwipe(buf2, 0, buflen);
  66. tor_free(buf2);
  67. }
  68. if (options->keygen_force_passphrase == FORCE_PASSPHRASE_ON && length == 0)
  69. return -1;
  70. return length;
  71. }
  72. int
  73. read_encrypted_secret_key(ed25519_secret_key_t *out,
  74. const char *fname)
  75. {
  76. int r = -1;
  77. uint8_t *secret = NULL;
  78. size_t secret_len = 0;
  79. char pwbuf[256];
  80. uint8_t encrypted_key[256];
  81. char *tag = NULL;
  82. int saved_errno = 0;
  83. ssize_t encrypted_len = crypto_read_tagged_contents_from_file(fname,
  84. ENC_KEY_HEADER,
  85. &tag,
  86. encrypted_key,
  87. sizeof(encrypted_key));
  88. if (encrypted_len < 0) {
  89. saved_errno = errno;
  90. log_info(LD_OR, "%s is missing", fname);
  91. r = 0;
  92. goto done;
  93. }
  94. if (strcmp(tag, ENC_KEY_TAG)) {
  95. saved_errno = EINVAL;
  96. goto done;
  97. }
  98. while (1) {
  99. ssize_t pwlen =
  100. do_getpass("Enter pasphrase for master key:", pwbuf, sizeof(pwbuf), 0,
  101. get_options());
  102. if (pwlen < 0) {
  103. saved_errno = EINVAL;
  104. goto done;
  105. }
  106. const int r = crypto_unpwbox(&secret, &secret_len,
  107. encrypted_key, encrypted_len,
  108. pwbuf, pwlen);
  109. if (r == UNPWBOX_CORRUPTED) {
  110. log_err(LD_OR, "%s is corrupted.", fname);
  111. saved_errno = EINVAL;
  112. goto done;
  113. } else if (r == UNPWBOX_OKAY) {
  114. break;
  115. }
  116. /* Otherwise, passphrase is bad, so try again till user does ctrl-c or gets
  117. * it right. */
  118. }
  119. if (secret_len != ED25519_SECKEY_LEN) {
  120. log_err(LD_OR, "%s is corrupted.", fname);
  121. saved_errno = EINVAL;
  122. goto done;
  123. }
  124. memcpy(out->seckey, secret, ED25519_SECKEY_LEN);
  125. r = 1;
  126. done:
  127. memwipe(encrypted_key, 0, sizeof(encrypted_key));
  128. memwipe(pwbuf, 0, sizeof(pwbuf));
  129. tor_free(tag);
  130. if (secret) {
  131. memwipe(secret, 0, secret_len);
  132. tor_free(secret);
  133. }
  134. if (saved_errno)
  135. errno = saved_errno;
  136. return r;
  137. }
  138. int
  139. write_encrypted_secret_key(const ed25519_secret_key_t *key,
  140. const char *fname)
  141. {
  142. int r = -1;
  143. char pwbuf0[256];
  144. uint8_t *encrypted_key = NULL;
  145. size_t encrypted_len = 0;
  146. if (do_getpass("Enter new passphrase:", pwbuf0, sizeof(pwbuf0), 1,
  147. get_options()) < 0) {
  148. log_warn(LD_OR, "NO/failed passphrase");
  149. return -1;
  150. }
  151. if (strlen(pwbuf0) == 0) {
  152. if (get_options()->keygen_force_passphrase == FORCE_PASSPHRASE_ON)
  153. return -1;
  154. else
  155. return 0;
  156. }
  157. if (crypto_pwbox(&encrypted_key, &encrypted_len,
  158. key->seckey, sizeof(key->seckey),
  159. pwbuf0, strlen(pwbuf0), 0) < 0) {
  160. log_warn(LD_OR, "crypto_pwbox failed!?");
  161. goto done;
  162. }
  163. if (crypto_write_tagged_contents_to_file(fname,
  164. ENC_KEY_HEADER,
  165. ENC_KEY_TAG,
  166. encrypted_key, encrypted_len) < 0)
  167. goto done;
  168. r = 1;
  169. done:
  170. if (encrypted_key) {
  171. memwipe(encrypted_key, 0, encrypted_len);
  172. tor_free(encrypted_key);
  173. }
  174. memwipe(pwbuf0, 0, sizeof(pwbuf0));
  175. return r;
  176. }
  177. static int
  178. write_secret_key(const ed25519_secret_key_t *key, int encrypted,
  179. const char *fname,
  180. const char *fname_tag,
  181. const char *encrypted_fname)
  182. {
  183. if (encrypted) {
  184. int r = write_encrypted_secret_key(key, encrypted_fname);
  185. if (r == 1) {
  186. /* Success! */
  187. /* Try to unlink the unencrypted key, if any existed before */
  188. if (strcmp(fname, encrypted_fname))
  189. unlink(fname);
  190. return r;
  191. } else if (r != 0) {
  192. /* Unrecoverable failure! */
  193. return r;
  194. }
  195. fprintf(stderr, "Not encrypting the secret key.\n");
  196. }
  197. return ed25519_seckey_write_to_file(key, fname, fname_tag);
  198. }
  199. /**
  200. * Read an ed25519 key and associated certificates from files beginning with
  201. * <b>fname</b>, with certificate type <b>cert_type</b>. On failure, return
  202. * NULL; on success return the keypair.
  203. *
  204. * If INIT_ED_KEY_CREATE is set in <b>flags</b>, then create the key (and
  205. * certificate if requested) if it doesn't exist, and save it to disk.
  206. *
  207. * If INIT_ED_KEY_NEEDCERT is set in <b>flags</b>, load/create a certificate
  208. * too and store it in *<b>cert_out</b>. Fail if the cert can't be
  209. * found/created. To create a certificate, <b>signing_key</b> must be set to
  210. * the key that should sign it; <b>now</b> to the current time, and
  211. * <b>lifetime</b> to the lifetime of the key.
  212. *
  213. * If INIT_ED_KEY_REPLACE is set in <b>flags</b>, then create and save new key
  214. * whether we can read the old one or not.
  215. *
  216. * If INIT_ED_KEY_EXTRA_STRONG is set in <b>flags</b>, set the extra_strong
  217. * flag when creating the secret key.
  218. *
  219. * If INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT is set in <b>flags</b>, and
  220. * we create a new certificate, create it with the signing key embedded.
  221. *
  222. * If INIT_ED_KEY_SPLIT is set in <b>flags</b>, and we create a new key,
  223. * store the public key in a separate file from the secret key.
  224. *
  225. * If INIT_ED_KEY_MISSING_SECRET_OK is set in <b>flags</b>, and we find a
  226. * public key file but no secret key file, return successfully anyway.
  227. *
  228. * If INIT_ED_KEY_OMIT_SECRET is set in <b>flags</b>, do not try to load a
  229. * secret key unless no public key is found. Do not return a secret key. (but
  230. * create and save one if needed).
  231. *
  232. * If INIT_ED_KEY_NO_LOAD_SECRET is set in <b>flags</b>, don't try to load
  233. * a secret key, no matter what.
  234. *
  235. * If INIT_ED_KEY_TRY_ENCRYPTED is set, we look for an encrypted secret key
  236. * and consider encrypting any new secret key.
  237. *
  238. * If INIT_ED_KEY_NO_REPAIR is set, and there is any issue loading the keys
  239. * from disk _other than their absence_ (full or partial), we do not try to
  240. * replace them.
  241. *
  242. * If INIT_ED_KEY_SUGGEST_KEYGEN is set, have log messages about failures
  243. * refer to the --keygen option.
  244. *
  245. * If INIT_ED_KEY_EXPLICIT_FNAME is set, use the provided file name for the
  246. * secret key file, encrypted or not.
  247. */
  248. ed25519_keypair_t *
  249. ed_key_init_from_file(const char *fname, uint32_t flags,
  250. int severity,
  251. const ed25519_keypair_t *signing_key,
  252. time_t now,
  253. time_t lifetime,
  254. uint8_t cert_type,
  255. struct tor_cert_st **cert_out)
  256. {
  257. char *secret_fname = NULL;
  258. char *encrypted_secret_fname = NULL;
  259. char *public_fname = NULL;
  260. char *cert_fname = NULL;
  261. const char *loaded_secret_fname = NULL;
  262. int created_pk = 0, created_sk = 0, created_cert = 0;
  263. const int try_to_load = ! (flags & INIT_ED_KEY_REPLACE);
  264. const int encrypt_key = !! (flags & INIT_ED_KEY_TRY_ENCRYPTED);
  265. const int norepair = !! (flags & INIT_ED_KEY_NO_REPAIR);
  266. const int split = !! (flags & INIT_ED_KEY_SPLIT);
  267. const int omit_secret = !! (flags & INIT_ED_KEY_OMIT_SECRET);
  268. const int offline_secret = !! (flags & INIT_ED_KEY_OFFLINE_SECRET);
  269. const int explicit_fname = !! (flags & INIT_ED_KEY_EXPLICIT_FNAME);
  270. /* we don't support setting both of these flags at once. */
  271. tor_assert((flags & (INIT_ED_KEY_NO_REPAIR|INIT_ED_KEY_NEEDCERT)) !=
  272. (INIT_ED_KEY_NO_REPAIR|INIT_ED_KEY_NEEDCERT));
  273. char tag[8];
  274. tor_snprintf(tag, sizeof(tag), "type%d", (int)cert_type);
  275. tor_cert_t *cert = NULL;
  276. char *got_tag = NULL;
  277. ed25519_keypair_t *keypair = tor_malloc_zero(sizeof(ed25519_keypair_t));
  278. if (explicit_fname) {
  279. secret_fname = tor_strdup(fname);
  280. encrypted_secret_fname = tor_strdup(fname);
  281. } else {
  282. tor_asprintf(&secret_fname, "%s_secret_key", fname);
  283. tor_asprintf(&encrypted_secret_fname, "%s_secret_key_encrypted", fname);
  284. }
  285. tor_asprintf(&public_fname, "%s_public_key", fname);
  286. tor_asprintf(&cert_fname, "%s_cert", fname);
  287. /* Try to read the secret key. */
  288. int have_secret = 0;
  289. int load_secret = try_to_load &&
  290. !offline_secret &&
  291. (!omit_secret || file_status(public_fname)==FN_NOENT);
  292. if (load_secret) {
  293. int rv = ed25519_seckey_read_from_file(&keypair->seckey,
  294. &got_tag, secret_fname);
  295. if (rv == 0) {
  296. have_secret = 1;
  297. loaded_secret_fname = secret_fname;
  298. tor_assert(got_tag);
  299. } else {
  300. if (errno != ENOENT && norepair) {
  301. tor_log(severity, LD_OR, "Unable to read %s: %s", secret_fname,
  302. strerror(errno));
  303. goto err;
  304. }
  305. }
  306. }
  307. /* Should we try for an encrypted key? */
  308. int have_encrypted_secret_file = 0;
  309. if (!have_secret && try_to_load && encrypt_key) {
  310. int r = read_encrypted_secret_key(&keypair->seckey,
  311. encrypted_secret_fname);
  312. if (r > 0) {
  313. have_secret = 1;
  314. have_encrypted_secret_file = 1;
  315. tor_free(got_tag); /* convince coverity we aren't leaking */
  316. got_tag = tor_strdup(tag);
  317. loaded_secret_fname = encrypted_secret_fname;
  318. } else if (errno != ENOENT && norepair) {
  319. tor_log(severity, LD_OR, "Unable to read %s: %s",
  320. encrypted_secret_fname, strerror(errno));
  321. goto err;
  322. }
  323. } else {
  324. if (try_to_load) {
  325. /* Check if it's there anyway, so we don't replace it. */
  326. if (file_status(encrypted_secret_fname) != FN_NOENT)
  327. have_encrypted_secret_file = 1;
  328. }
  329. }
  330. if (have_secret) {
  331. if (strcmp(got_tag, tag)) {
  332. tor_log(severity, LD_OR, "%s has wrong tag", loaded_secret_fname);
  333. goto err;
  334. }
  335. /* Derive the public key */
  336. if (ed25519_public_key_generate(&keypair->pubkey, &keypair->seckey)<0) {
  337. tor_log(severity, LD_OR, "%s can't produce a public key",
  338. loaded_secret_fname);
  339. goto err;
  340. }
  341. }
  342. /* If we do split keys here, try to read the pubkey. */
  343. int found_public = 0;
  344. if (try_to_load && (!have_secret || split)) {
  345. ed25519_public_key_t pubkey_tmp;
  346. tor_free(got_tag);
  347. found_public = ed25519_pubkey_read_from_file(&pubkey_tmp,
  348. &got_tag, public_fname) == 0;
  349. if (!found_public && errno != ENOENT && norepair) {
  350. tor_log(severity, LD_OR, "Unable to read %s: %s", public_fname,
  351. strerror(errno));
  352. goto err;
  353. }
  354. if (found_public && strcmp(got_tag, tag)) {
  355. tor_log(severity, LD_OR, "%s has wrong tag", public_fname);
  356. goto err;
  357. }
  358. if (found_public) {
  359. if (have_secret) {
  360. /* If we have a secret key and we're reloading the public key,
  361. * the key must match! */
  362. if (! ed25519_pubkey_eq(&keypair->pubkey, &pubkey_tmp)) {
  363. tor_log(severity, LD_OR, "%s does not match %s! If you are trying "
  364. "to restore from backup, make sure you didn't mix up the "
  365. "key files. If you are absolutely sure that %s is the right "
  366. "key for this relay, delete %s or move it out of the way.",
  367. public_fname, loaded_secret_fname,
  368. loaded_secret_fname, public_fname);
  369. goto err;
  370. }
  371. } else {
  372. /* We only have the public key; better use that. */
  373. tor_assert(split);
  374. memcpy(&keypair->pubkey, &pubkey_tmp, sizeof(pubkey_tmp));
  375. }
  376. } else {
  377. /* We have no public key file, but we do have a secret key, make the
  378. * public key file! */
  379. if (have_secret) {
  380. if (ed25519_pubkey_write_to_file(&keypair->pubkey, public_fname, tag)
  381. < 0) {
  382. tor_log(severity, LD_OR, "Couldn't repair %s", public_fname);
  383. goto err;
  384. } else {
  385. tor_log(LOG_NOTICE, LD_OR,
  386. "Found secret key but not %s. Regenerating.",
  387. public_fname);
  388. }
  389. }
  390. }
  391. }
  392. /* If the secret key is absent and it's not allowed to be, fail. */
  393. if (!have_secret && found_public &&
  394. !(flags & INIT_ED_KEY_MISSING_SECRET_OK)) {
  395. if (have_encrypted_secret_file) {
  396. tor_log(severity, LD_OR, "We needed to load a secret key from %s, "
  397. "but it was encrypted. Try 'tor --keygen' instead, so you "
  398. "can enter the passphrase.",
  399. secret_fname);
  400. } else if (offline_secret) {
  401. tor_log(severity, LD_OR, "We wanted to load a secret key from %s, "
  402. "but you're keeping it offline. (OfflineMasterKey is set.)",
  403. secret_fname);
  404. } else {
  405. tor_log(severity, LD_OR, "We needed to load a secret key from %s, "
  406. "but couldn't find it. %s", secret_fname,
  407. (flags & INIT_ED_KEY_SUGGEST_KEYGEN) ?
  408. "If you're keeping your master secret key offline, you will "
  409. "need to run 'tor --keygen' to generate new signing keys." :
  410. "Did you forget to copy it over when you copied the rest of the "
  411. "signing key material?");
  412. }
  413. goto err;
  414. }
  415. /* If it's absent, and we're not supposed to make a new keypair, fail. */
  416. if (!have_secret && !found_public && !(flags & INIT_ED_KEY_CREATE)) {
  417. if (split) {
  418. tor_log(severity, LD_OR, "No key found in %s or %s.",
  419. secret_fname, public_fname);
  420. } else {
  421. tor_log(severity, LD_OR, "No key found in %s.", secret_fname);
  422. }
  423. goto err;
  424. }
  425. /* If the secret key is absent, but the encrypted key would be present,
  426. * that's an error */
  427. if (!have_secret && !found_public && have_encrypted_secret_file) {
  428. tor_assert(!encrypt_key);
  429. tor_log(severity, LD_OR, "Found an encrypted secret key, "
  430. "but not public key file %s!", public_fname);
  431. goto err;
  432. }
  433. /* if it's absent, make a new keypair... */
  434. if (!have_secret && !found_public) {
  435. tor_free(keypair);
  436. keypair = ed_key_new(signing_key, flags, now, lifetime,
  437. cert_type, &cert);
  438. if (!keypair) {
  439. tor_log(severity, LD_OR, "Couldn't create keypair");
  440. goto err;
  441. }
  442. created_pk = created_sk = created_cert = 1;
  443. }
  444. /* Write it to disk if we're supposed to do with a new passphrase, or if
  445. * we just created it. */
  446. if (created_sk || (have_secret && get_options()->change_key_passphrase)) {
  447. if (write_secret_key(&keypair->seckey,
  448. encrypt_key,
  449. secret_fname, tag, encrypted_secret_fname) < 0
  450. ||
  451. (split &&
  452. ed25519_pubkey_write_to_file(&keypair->pubkey, public_fname, tag) < 0)
  453. ||
  454. (cert &&
  455. crypto_write_tagged_contents_to_file(cert_fname, "ed25519v1-cert",
  456. tag, cert->encoded, cert->encoded_len) < 0)) {
  457. tor_log(severity, LD_OR, "Couldn't write keys or cert to file.");
  458. goto err;
  459. }
  460. goto done;
  461. }
  462. /* If we're not supposed to get a cert, we're done. */
  463. if (! (flags & INIT_ED_KEY_NEEDCERT))
  464. goto done;
  465. /* Read a cert. */
  466. tor_free(got_tag);
  467. uint8_t certbuf[256];
  468. ssize_t cert_body_len = crypto_read_tagged_contents_from_file(
  469. cert_fname, "ed25519v1-cert",
  470. &got_tag, certbuf, sizeof(certbuf));
  471. if (cert_body_len >= 0 && !strcmp(got_tag, tag))
  472. cert = tor_cert_parse(certbuf, cert_body_len);
  473. /* If we got it, check it to the extent we can. */
  474. int bad_cert = 0;
  475. if (! cert) {
  476. tor_log(severity, LD_OR, "Cert was unparseable");
  477. bad_cert = 1;
  478. } else if (!tor_memeq(cert->signed_key.pubkey, keypair->pubkey.pubkey,
  479. ED25519_PUBKEY_LEN)) {
  480. tor_log(severity, LD_OR, "Cert was for wrong key");
  481. bad_cert = 1;
  482. } else if (signing_key &&
  483. tor_cert_checksig(cert, &signing_key->pubkey, now) < 0) {
  484. tor_log(severity, LD_OR, "Can't check certificate");
  485. bad_cert = 1;
  486. } else if (cert->cert_expired) {
  487. tor_log(severity, LD_OR, "Certificate is expired");
  488. bad_cert = 1;
  489. } else if (signing_key && cert->signing_key_included &&
  490. ! ed25519_pubkey_eq(&signing_key->pubkey, &cert->signing_key)) {
  491. tor_log(severity, LD_OR, "Certificate signed by unexpectd key!");
  492. bad_cert = 1;
  493. }
  494. if (bad_cert) {
  495. tor_cert_free(cert);
  496. cert = NULL;
  497. }
  498. /* If we got a cert, we're done. */
  499. if (cert)
  500. goto done;
  501. /* If we didn't get a cert, and we're not supposed to make one, fail. */
  502. if (!signing_key || !(flags & INIT_ED_KEY_CREATE)) {
  503. tor_log(severity, LD_OR, "Without signing key, can't create certificate");
  504. goto err;
  505. }
  506. /* We have keys but not a certificate, so make one. */
  507. uint32_t cert_flags = 0;
  508. if (flags & INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT)
  509. cert_flags |= CERT_FLAG_INCLUDE_SIGNING_KEY;
  510. cert = tor_cert_create(signing_key, cert_type,
  511. &keypair->pubkey,
  512. now, lifetime,
  513. cert_flags);
  514. if (! cert) {
  515. tor_log(severity, LD_OR, "Couldn't create certificate");
  516. goto err;
  517. }
  518. /* Write it to disk. */
  519. created_cert = 1;
  520. if (crypto_write_tagged_contents_to_file(cert_fname, "ed25519v1-cert",
  521. tag, cert->encoded, cert->encoded_len) < 0) {
  522. tor_log(severity, LD_OR, "Couldn't write cert to disk.");
  523. goto err;
  524. }
  525. done:
  526. if (cert_out)
  527. *cert_out = cert;
  528. else
  529. tor_cert_free(cert);
  530. goto cleanup;
  531. err:
  532. if (keypair)
  533. memwipe(keypair, 0, sizeof(*keypair));
  534. tor_free(keypair);
  535. tor_cert_free(cert);
  536. if (cert_out)
  537. *cert_out = NULL;
  538. if (created_sk)
  539. unlink(secret_fname);
  540. if (created_pk)
  541. unlink(public_fname);
  542. if (created_cert)
  543. unlink(cert_fname);
  544. cleanup:
  545. tor_free(encrypted_secret_fname);
  546. tor_free(secret_fname);
  547. tor_free(public_fname);
  548. tor_free(cert_fname);
  549. tor_free(got_tag);
  550. return keypair;
  551. }
  552. /**
  553. * Create a new signing key and (optionally) certficiate; do not read or write
  554. * from disk. See ed_key_init_from_file() for more information.
  555. */
  556. ed25519_keypair_t *
  557. ed_key_new(const ed25519_keypair_t *signing_key,
  558. uint32_t flags,
  559. time_t now,
  560. time_t lifetime,
  561. uint8_t cert_type,
  562. struct tor_cert_st **cert_out)
  563. {
  564. if (cert_out)
  565. *cert_out = NULL;
  566. const int extra_strong = !! (flags & INIT_ED_KEY_EXTRA_STRONG);
  567. ed25519_keypair_t *keypair = tor_malloc_zero(sizeof(ed25519_keypair_t));
  568. if (ed25519_keypair_generate(keypair, extra_strong) < 0)
  569. goto err;
  570. if (! (flags & INIT_ED_KEY_NEEDCERT))
  571. return keypair;
  572. tor_assert(signing_key);
  573. tor_assert(cert_out);
  574. uint32_t cert_flags = 0;
  575. if (flags & INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT)
  576. cert_flags |= CERT_FLAG_INCLUDE_SIGNING_KEY;
  577. tor_cert_t *cert = tor_cert_create(signing_key, cert_type,
  578. &keypair->pubkey,
  579. now, lifetime,
  580. cert_flags);
  581. if (! cert)
  582. goto err;
  583. *cert_out = cert;
  584. return keypair;
  585. err:
  586. tor_free(keypair);
  587. return NULL;
  588. }
  589. static ed25519_keypair_t *master_identity_key = NULL;
  590. static ed25519_keypair_t *master_signing_key = NULL;
  591. static ed25519_keypair_t *current_auth_key = NULL;
  592. static tor_cert_t *signing_key_cert = NULL;
  593. static tor_cert_t *link_cert_cert = NULL;
  594. static tor_cert_t *auth_key_cert = NULL;
  595. static uint8_t *rsa_ed_crosscert = NULL;
  596. static size_t rsa_ed_crosscert_len = 0;
  597. /**
  598. * Running as a server: load, reload, or refresh our ed25519 keys and
  599. * certificates, creating and saving new ones as needed.
  600. */
  601. int
  602. load_ed_keys(const or_options_t *options, time_t now)
  603. {
  604. ed25519_keypair_t *id = NULL;
  605. ed25519_keypair_t *sign = NULL;
  606. ed25519_keypair_t *auth = NULL;
  607. const ed25519_keypair_t *sign_signing_key_with_id = NULL;
  608. const ed25519_keypair_t *use_signing = NULL;
  609. const tor_cert_t *check_signing_cert = NULL;
  610. tor_cert_t *sign_cert = NULL;
  611. tor_cert_t *auth_cert = NULL;
  612. #define FAIL(msg) do { \
  613. log_warn(LD_OR, (msg)); \
  614. goto err; \
  615. } while (0)
  616. #define SET_KEY(key, newval) do { \
  617. if ((key) != (newval)) \
  618. ed25519_keypair_free(key); \
  619. key = (newval); \
  620. } while (0)
  621. #define SET_CERT(cert, newval) do { \
  622. if ((cert) != (newval)) \
  623. tor_cert_free(cert); \
  624. cert = (newval); \
  625. } while (0)
  626. #define EXPIRES_SOON(cert, interval) \
  627. (!(cert) || (cert)->valid_until < now + (interval))
  628. /* XXXX support encrypted identity keys fully */
  629. /* First try to get the signing key to see how it is. */
  630. {
  631. char *fname =
  632. options_get_datadir_fname2(options, "keys", "ed25519_signing");
  633. sign = ed_key_init_from_file(
  634. fname,
  635. INIT_ED_KEY_NEEDCERT|
  636. INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT,
  637. LOG_INFO,
  638. NULL, 0, 0, CERT_TYPE_ID_SIGNING, &sign_cert);
  639. tor_free(fname);
  640. check_signing_cert = sign_cert;
  641. use_signing = sign;
  642. }
  643. if (!use_signing && master_signing_key) {
  644. check_signing_cert = signing_key_cert;
  645. use_signing = master_signing_key;
  646. }
  647. const int offline_master =
  648. options->OfflineMasterKey && options->command != CMD_KEYGEN;
  649. const int need_new_signing_key =
  650. NULL == use_signing ||
  651. EXPIRES_SOON(check_signing_cert, 0) ||
  652. (options->command == CMD_KEYGEN && ! options->change_key_passphrase);
  653. const int want_new_signing_key =
  654. need_new_signing_key ||
  655. EXPIRES_SOON(check_signing_cert, options->TestingSigningKeySlop);
  656. /* We can only create a master key if we haven't been told that the
  657. * master key will always be offline. Also, if we have a signing key,
  658. * then we shouldn't make a new master ID key. */
  659. const int can_make_master_id_key = !offline_master &&
  660. NULL == use_signing;
  661. if (need_new_signing_key) {
  662. log_notice(LD_OR, "It looks like I need to generate and sign a new "
  663. "medium-term signing key, because %s. To do that, I need to "
  664. "load%s the permanent master identity key.",
  665. (NULL == use_signing) ? "I don't have one" :
  666. EXPIRES_SOON(check_signing_cert, 0) ? "the one I have is expired" :
  667. "you asked me to make one with --keygen",
  668. can_make_master_id_key ? " (or create)" : "");
  669. } else if (want_new_signing_key && !offline_master) {
  670. log_notice(LD_OR, "It looks like I should try to generate and sign a "
  671. "new medium-term signing key, because the one I have is "
  672. "going to expire soon. To do that, I'm going to have to try to "
  673. "load the permanent master identity key.");
  674. } else if (want_new_signing_key) {
  675. log_notice(LD_OR, "It looks like I should try to generate and sign a "
  676. "new medium-term signing key, because the one I have is "
  677. "going to expire soon. But OfflineMasterKey is set, so I "
  678. "won't try to load a permanent master identity key is set. "
  679. "You will need to use 'tor --keygen' make a new signing key "
  680. "and certificate.");
  681. }
  682. {
  683. uint32_t flags =
  684. (INIT_ED_KEY_SPLIT|
  685. INIT_ED_KEY_EXTRA_STRONG|INIT_ED_KEY_NO_REPAIR);
  686. if (can_make_master_id_key)
  687. flags |= INIT_ED_KEY_CREATE;
  688. if (! need_new_signing_key)
  689. flags |= INIT_ED_KEY_MISSING_SECRET_OK;
  690. if (! want_new_signing_key || offline_master)
  691. flags |= INIT_ED_KEY_OMIT_SECRET;
  692. if (offline_master)
  693. flags |= INIT_ED_KEY_OFFLINE_SECRET;
  694. if (options->command == CMD_KEYGEN)
  695. flags |= INIT_ED_KEY_TRY_ENCRYPTED;
  696. /* Check the key directory */
  697. if (check_private_dir(options->DataDirectory, CPD_CREATE, options->User)) {
  698. log_err(LD_OR, "Can't create/check datadirectory %s",
  699. options->DataDirectory);
  700. goto err;
  701. }
  702. char *fname = get_datadir_fname("keys");
  703. if (check_private_dir(fname, CPD_CREATE, options->User) < 0) {
  704. log_err(LD_OR, "Problem creating/checking key directory %s", fname);
  705. tor_free(fname);
  706. goto err;
  707. }
  708. tor_free(fname);
  709. if (options->master_key_fname) {
  710. fname = tor_strdup(options->master_key_fname);
  711. flags |= INIT_ED_KEY_EXPLICIT_FNAME;
  712. } else {
  713. fname = options_get_datadir_fname2(options, "keys", "ed25519_master_id");
  714. }
  715. id = ed_key_init_from_file(
  716. fname,
  717. flags,
  718. LOG_WARN, NULL, 0, 0, 0, NULL);
  719. tor_free(fname);
  720. if (!id) {
  721. if (need_new_signing_key) {
  722. if (offline_master)
  723. FAIL("Can't load master identity key; OfflineMasterKey is set.");
  724. else
  725. FAIL("Missing identity key");
  726. } else {
  727. log_warn(LD_OR, "Master public key was absent; inferring from "
  728. "public key in signing certificate and saving to disk.");
  729. tor_assert(check_signing_cert);
  730. id = tor_malloc_zero(sizeof(*id));
  731. memcpy(&id->pubkey, &check_signing_cert->signing_key,
  732. sizeof(ed25519_public_key_t));
  733. fname = options_get_datadir_fname2(options, "keys",
  734. "ed25519_master_id_public_key");
  735. if (ed25519_pubkey_write_to_file(&id->pubkey, fname, "type0") < 0) {
  736. log_warn(LD_OR, "Error while attempting to write master public key "
  737. "to disk");
  738. tor_free(fname);
  739. goto err;
  740. }
  741. tor_free(fname);
  742. }
  743. }
  744. if (tor_mem_is_zero((char*)id->seckey.seckey, sizeof(id->seckey)))
  745. sign_signing_key_with_id = NULL;
  746. else
  747. sign_signing_key_with_id = id;
  748. }
  749. if (master_identity_key &&
  750. !ed25519_pubkey_eq(&id->pubkey, &master_identity_key->pubkey)) {
  751. FAIL("Identity key on disk does not match key we loaded earlier!");
  752. }
  753. if (need_new_signing_key && NULL == sign_signing_key_with_id)
  754. FAIL("Can't load master key make a new signing key.");
  755. if (sign_cert) {
  756. if (! sign_cert->signing_key_included)
  757. FAIL("Loaded a signing cert with no key included!");
  758. if (! ed25519_pubkey_eq(&sign_cert->signing_key, &id->pubkey))
  759. FAIL("The signing cert we have was not signed with the master key "
  760. "we loaded!");
  761. if (tor_cert_checksig(sign_cert, &id->pubkey, 0) < 0)
  762. FAIL("The signing cert we loaded was not signed correctly!");
  763. }
  764. if (want_new_signing_key && sign_signing_key_with_id) {
  765. uint32_t flags = (INIT_ED_KEY_CREATE|
  766. INIT_ED_KEY_REPLACE|
  767. INIT_ED_KEY_EXTRA_STRONG|
  768. INIT_ED_KEY_NEEDCERT|
  769. INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT);
  770. char *fname =
  771. options_get_datadir_fname2(options, "keys", "ed25519_signing");
  772. ed25519_keypair_free(sign);
  773. tor_cert_free(sign_cert);
  774. sign = ed_key_init_from_file(fname,
  775. flags, LOG_WARN,
  776. sign_signing_key_with_id, now,
  777. options->SigningKeyLifetime,
  778. CERT_TYPE_ID_SIGNING, &sign_cert);
  779. tor_free(fname);
  780. if (!sign)
  781. FAIL("Missing signing key");
  782. use_signing = sign;
  783. tor_assert(sign_cert->signing_key_included);
  784. tor_assert(ed25519_pubkey_eq(&sign_cert->signing_key, &id->pubkey));
  785. tor_assert(ed25519_pubkey_eq(&sign_cert->signed_key, &sign->pubkey));
  786. } else if (want_new_signing_key) {
  787. static ratelim_t missing_master = RATELIM_INIT(3600);
  788. log_fn_ratelim(&missing_master, LOG_WARN, LD_OR,
  789. "Signing key will expire soon, but I can't load the "
  790. "master key to sign a new one!");
  791. }
  792. tor_assert(use_signing);
  793. /* At this point we no longer need our secret identity key. So wipe
  794. * it, if we loaded it in the first place. */
  795. memwipe(id->seckey.seckey, 0, sizeof(id->seckey));
  796. if (options->command == CMD_KEYGEN)
  797. goto end;
  798. if (!rsa_ed_crosscert && server_mode(options)) {
  799. uint8_t *crosscert;
  800. ssize_t crosscert_len = tor_make_rsa_ed25519_crosscert(&id->pubkey,
  801. get_server_identity_key(),
  802. now+10*365*86400,/*XXXX*/
  803. &crosscert);
  804. rsa_ed_crosscert_len = crosscert_len;
  805. rsa_ed_crosscert = crosscert;
  806. }
  807. if (!current_auth_key ||
  808. EXPIRES_SOON(auth_key_cert, options->TestingAuthKeySlop)) {
  809. auth = ed_key_new(use_signing, INIT_ED_KEY_NEEDCERT,
  810. now,
  811. options->TestingAuthKeyLifetime,
  812. CERT_TYPE_SIGNING_AUTH, &auth_cert);
  813. if (!auth)
  814. FAIL("Can't create auth key");
  815. }
  816. /* We've generated or loaded everything. Put them in memory. */
  817. end:
  818. if (! master_identity_key) {
  819. SET_KEY(master_identity_key, id);
  820. } else {
  821. tor_free(id);
  822. }
  823. if (sign) {
  824. SET_KEY(master_signing_key, sign);
  825. SET_CERT(signing_key_cert, sign_cert);
  826. }
  827. if (auth) {
  828. SET_KEY(current_auth_key, auth);
  829. SET_CERT(auth_key_cert, auth_cert);
  830. }
  831. return 0;
  832. err:
  833. ed25519_keypair_free(id);
  834. ed25519_keypair_free(sign);
  835. ed25519_keypair_free(auth);
  836. tor_cert_free(sign_cert);
  837. tor_cert_free(auth_cert);
  838. return -1;
  839. }
  840. /* DOCDOC */
  841. int
  842. generate_ed_link_cert(const or_options_t *options, time_t now)
  843. {
  844. const tor_x509_cert_t *link = NULL, *id = NULL;
  845. tor_cert_t *link_cert = NULL;
  846. if (tor_tls_get_my_certs(1, &link, &id) < 0 || link == NULL) {
  847. log_warn(LD_OR, "Can't get my x509 link cert.");
  848. return -1;
  849. }
  850. const common_digests_t *digests = tor_x509_cert_get_cert_digests(link);
  851. if (link_cert_cert &&
  852. ! EXPIRES_SOON(link_cert_cert, options->TestingLinkKeySlop) &&
  853. fast_memeq(digests->d[DIGEST_SHA256], link_cert_cert->signed_key.pubkey,
  854. DIGEST256_LEN)) {
  855. return 0;
  856. }
  857. ed25519_public_key_t dummy_key;
  858. memcpy(dummy_key.pubkey, digests->d[DIGEST_SHA256], DIGEST256_LEN);
  859. link_cert = tor_cert_create(get_master_signing_keypair(),
  860. CERT_TYPE_SIGNING_LINK,
  861. &dummy_key,
  862. now,
  863. options->TestingLinkCertLifetime, 0);
  864. if (link_cert) {
  865. SET_CERT(link_cert_cert, link_cert);
  866. }
  867. return 0;
  868. }
  869. #undef FAIL
  870. #undef SET_KEY
  871. #undef SET_CERT
  872. int
  873. should_make_new_ed_keys(const or_options_t *options, const time_t now)
  874. {
  875. if (!master_identity_key ||
  876. !master_signing_key ||
  877. !current_auth_key ||
  878. !link_cert_cert ||
  879. EXPIRES_SOON(signing_key_cert, options->TestingSigningKeySlop) ||
  880. EXPIRES_SOON(auth_key_cert, options->TestingAuthKeySlop) ||
  881. EXPIRES_SOON(link_cert_cert, options->TestingLinkKeySlop))
  882. return 1;
  883. const tor_x509_cert_t *link = NULL, *id = NULL;
  884. if (tor_tls_get_my_certs(1, &link, &id) < 0 || link == NULL)
  885. return 1;
  886. const common_digests_t *digests = tor_x509_cert_get_cert_digests(link);
  887. if (!fast_memeq(digests->d[DIGEST_SHA256],
  888. link_cert_cert->signed_key.pubkey,
  889. DIGEST256_LEN)) {
  890. return 1;
  891. }
  892. return 0;
  893. }
  894. #undef EXPIRES_SOON
  895. const ed25519_public_key_t *
  896. get_master_identity_key(void)
  897. {
  898. if (!master_identity_key)
  899. return NULL;
  900. return &master_identity_key->pubkey;
  901. }
  902. const ed25519_keypair_t *
  903. get_master_signing_keypair(void)
  904. {
  905. return master_signing_key;
  906. }
  907. const struct tor_cert_st *
  908. get_master_signing_key_cert(void)
  909. {
  910. return signing_key_cert;
  911. }
  912. const ed25519_keypair_t *
  913. get_current_auth_keypair(void)
  914. {
  915. return current_auth_key;
  916. }
  917. const tor_cert_t *
  918. get_current_link_cert_cert(void)
  919. {
  920. return link_cert_cert;
  921. }
  922. const tor_cert_t *
  923. get_current_auth_key_cert(void)
  924. {
  925. return auth_key_cert;
  926. }
  927. void
  928. get_master_rsa_crosscert(const uint8_t **cert_out,
  929. size_t *size_out)
  930. {
  931. *cert_out = rsa_ed_crosscert;
  932. *size_out = rsa_ed_crosscert_len;
  933. }
  934. /** Construct cross-certification for the master identity key with
  935. * the ntor onion key. Store the sign of the corresponding ed25519 public key
  936. * in *<b>sign_out</b>. */
  937. tor_cert_t *
  938. make_ntor_onion_key_crosscert(const curve25519_keypair_t *onion_key,
  939. const ed25519_public_key_t *master_id_key, time_t now, time_t lifetime,
  940. int *sign_out)
  941. {
  942. tor_cert_t *cert = NULL;
  943. ed25519_keypair_t ed_onion_key;
  944. if (ed25519_keypair_from_curve25519_keypair(&ed_onion_key, sign_out,
  945. onion_key) < 0)
  946. goto end;
  947. cert = tor_cert_create(&ed_onion_key, CERT_TYPE_ONION_ID, master_id_key,
  948. now, lifetime, 0);
  949. end:
  950. memwipe(&ed_onion_key, 0, sizeof(ed_onion_key));
  951. return cert;
  952. }
  953. /** Construct and return an RSA signature for the TAP onion key to
  954. * cross-certify the RSA and Ed25519 identity keys. Set <b>len_out</b> to its
  955. * length. */
  956. uint8_t *
  957. make_tap_onion_key_crosscert(const crypto_pk_t *onion_key,
  958. const ed25519_public_key_t *master_id_key,
  959. const crypto_pk_t *rsa_id_key,
  960. int *len_out)
  961. {
  962. uint8_t signature[PK_BYTES];
  963. uint8_t signed_data[DIGEST_LEN + ED25519_PUBKEY_LEN];
  964. *len_out = 0;
  965. crypto_pk_get_digest(rsa_id_key, (char*)signed_data);
  966. memcpy(signed_data + DIGEST_LEN, master_id_key->pubkey, ED25519_PUBKEY_LEN);
  967. int r = crypto_pk_private_sign(onion_key,
  968. (char*)signature, sizeof(signature),
  969. (const char*)signed_data, sizeof(signed_data));
  970. if (r < 0)
  971. return NULL;
  972. *len_out = r;
  973. return tor_memdup(signature, r);
  974. }
  975. /** Check whether an RSA-TAP cross-certification is correct. Return 0 if it
  976. * is, -1 if it isn't. */
  977. int
  978. check_tap_onion_key_crosscert(const uint8_t *crosscert,
  979. int crosscert_len,
  980. const crypto_pk_t *onion_pkey,
  981. const ed25519_public_key_t *master_id_pkey,
  982. const uint8_t *rsa_id_digest)
  983. {
  984. uint8_t *cc = tor_malloc(crypto_pk_keysize(onion_pkey));
  985. int cc_len =
  986. crypto_pk_public_checksig(onion_pkey,
  987. (char*)cc,
  988. crypto_pk_keysize(onion_pkey),
  989. (const char*)crosscert,
  990. crosscert_len);
  991. if (cc_len < 0) {
  992. goto err;
  993. }
  994. if (cc_len < DIGEST_LEN + ED25519_PUBKEY_LEN) {
  995. log_warn(LD_DIR, "Short signature on cross-certification with TAP key");
  996. goto err;
  997. }
  998. if (tor_memneq(cc, rsa_id_digest, DIGEST_LEN) ||
  999. tor_memneq(cc + DIGEST_LEN, master_id_pkey->pubkey,
  1000. ED25519_PUBKEY_LEN)) {
  1001. log_warn(LD_DIR, "Incorrect cross-certification with TAP key");
  1002. goto err;
  1003. }
  1004. tor_free(cc);
  1005. return 0;
  1006. err:
  1007. tor_free(cc);
  1008. return -1;
  1009. }
  1010. void
  1011. routerkeys_free_all(void)
  1012. {
  1013. ed25519_keypair_free(master_identity_key);
  1014. ed25519_keypair_free(master_signing_key);
  1015. ed25519_keypair_free(current_auth_key);
  1016. tor_cert_free(signing_key_cert);
  1017. tor_cert_free(link_cert_cert);
  1018. tor_cert_free(auth_key_cert);
  1019. master_identity_key = master_signing_key = NULL;
  1020. current_auth_key = NULL;
  1021. signing_key_cert = link_cert_cert = auth_key_cert = NULL;
  1022. }