routerkeys.c 45 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411
  1. /* Copyright (c) 2014-2017, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /**
  4. * \file routerkeys.c
  5. *
  6. * \brief Functions and structures to handle generating and maintaining the
  7. * set of keypairs necessary to be an OR.
  8. *
  9. * The keys handled here now are the Ed25519 keys that Tor relays use to sign
  10. * descriptors, authenticate themselves on links, and identify one another
  11. * uniquely. Other keys are maintained in router.c and rendservice.c.
  12. *
  13. * (TODO: The keys in router.c should go here too.)
  14. */
  15. #include "or.h"
  16. #include "config.h"
  17. #include "router.h"
  18. #include "crypto_pwbox.h"
  19. #include "routerkeys.h"
  20. #include "torcert.h"
  21. #define ENC_KEY_HEADER "Boxed Ed25519 key"
  22. #define ENC_KEY_TAG "master"
  23. /* DOCDOC */
  24. static ssize_t
  25. do_getpass(const char *prompt, char *buf, size_t buflen,
  26. int twice, const or_options_t *options)
  27. {
  28. if (options->keygen_force_passphrase == FORCE_PASSPHRASE_OFF) {
  29. tor_assert(buflen);
  30. buf[0] = 0;
  31. return 0;
  32. }
  33. char *prompt2 = NULL;
  34. char *buf2 = NULL;
  35. int fd = -1;
  36. ssize_t length = -1;
  37. if (options->use_keygen_passphrase_fd) {
  38. twice = 0;
  39. fd = options->keygen_passphrase_fd;
  40. length = read_all(fd, buf, buflen-1, 0);
  41. if (length >= 0)
  42. buf[length] = 0;
  43. goto done_reading;
  44. }
  45. if (twice) {
  46. const char msg[] = "One more time:";
  47. size_t p2len = strlen(prompt) + 1;
  48. if (p2len < sizeof(msg))
  49. p2len = sizeof(msg);
  50. prompt2 = tor_malloc(p2len);
  51. memset(prompt2, ' ', p2len);
  52. memcpy(prompt2 + p2len - sizeof(msg), msg, sizeof(msg));
  53. buf2 = tor_malloc_zero(buflen);
  54. }
  55. while (1) {
  56. length = tor_getpass(prompt, buf, buflen);
  57. if (length < 0)
  58. goto done_reading;
  59. if (! twice)
  60. break;
  61. ssize_t length2 = tor_getpass(prompt2, buf2, buflen);
  62. if (length != length2 || tor_memneq(buf, buf2, length)) {
  63. fprintf(stderr, "That didn't match.\n");
  64. } else {
  65. break;
  66. }
  67. }
  68. done_reading:
  69. if (twice) {
  70. tor_free(prompt2);
  71. memwipe(buf2, 0, buflen);
  72. tor_free(buf2);
  73. }
  74. if (options->keygen_force_passphrase == FORCE_PASSPHRASE_ON && length == 0)
  75. return -1;
  76. return length;
  77. }
  78. /* DOCDOC */
  79. int
  80. read_encrypted_secret_key(ed25519_secret_key_t *out,
  81. const char *fname)
  82. {
  83. int r = -1;
  84. uint8_t *secret = NULL;
  85. size_t secret_len = 0;
  86. char pwbuf[256];
  87. uint8_t encrypted_key[256];
  88. char *tag = NULL;
  89. int saved_errno = 0;
  90. ssize_t encrypted_len = crypto_read_tagged_contents_from_file(fname,
  91. ENC_KEY_HEADER,
  92. &tag,
  93. encrypted_key,
  94. sizeof(encrypted_key));
  95. if (encrypted_len < 0) {
  96. saved_errno = errno;
  97. log_info(LD_OR, "%s is missing", fname);
  98. r = 0;
  99. goto done;
  100. }
  101. if (strcmp(tag, ENC_KEY_TAG)) {
  102. saved_errno = EINVAL;
  103. goto done;
  104. }
  105. while (1) {
  106. ssize_t pwlen =
  107. do_getpass("Enter passphrase for master key:", pwbuf, sizeof(pwbuf), 0,
  108. get_options());
  109. if (pwlen < 0) {
  110. saved_errno = EINVAL;
  111. goto done;
  112. }
  113. const int r_unbox = crypto_unpwbox(&secret, &secret_len,
  114. encrypted_key, encrypted_len,
  115. pwbuf, pwlen);
  116. if (r_unbox == UNPWBOX_CORRUPTED) {
  117. log_err(LD_OR, "%s is corrupted.", fname);
  118. saved_errno = EINVAL;
  119. goto done;
  120. } else if (r_unbox == UNPWBOX_OKAY) {
  121. break;
  122. }
  123. /* Otherwise, passphrase is bad, so try again till user does ctrl-c or gets
  124. * it right. */
  125. }
  126. if (secret_len != ED25519_SECKEY_LEN) {
  127. log_err(LD_OR, "%s is corrupted.", fname);
  128. saved_errno = EINVAL;
  129. goto done;
  130. }
  131. memcpy(out->seckey, secret, ED25519_SECKEY_LEN);
  132. r = 1;
  133. done:
  134. memwipe(encrypted_key, 0, sizeof(encrypted_key));
  135. memwipe(pwbuf, 0, sizeof(pwbuf));
  136. tor_free(tag);
  137. if (secret) {
  138. memwipe(secret, 0, secret_len);
  139. tor_free(secret);
  140. }
  141. if (saved_errno)
  142. errno = saved_errno;
  143. return r;
  144. }
  145. /* DOCDOC */
  146. int
  147. write_encrypted_secret_key(const ed25519_secret_key_t *key,
  148. const char *fname)
  149. {
  150. int r = -1;
  151. char pwbuf0[256];
  152. uint8_t *encrypted_key = NULL;
  153. size_t encrypted_len = 0;
  154. if (do_getpass("Enter new passphrase:", pwbuf0, sizeof(pwbuf0), 1,
  155. get_options()) < 0) {
  156. log_warn(LD_OR, "NO/failed passphrase");
  157. return -1;
  158. }
  159. if (strlen(pwbuf0) == 0) {
  160. if (get_options()->keygen_force_passphrase == FORCE_PASSPHRASE_ON)
  161. return -1;
  162. else
  163. return 0;
  164. }
  165. if (crypto_pwbox(&encrypted_key, &encrypted_len,
  166. key->seckey, sizeof(key->seckey),
  167. pwbuf0, strlen(pwbuf0), 0) < 0) {
  168. log_warn(LD_OR, "crypto_pwbox failed!?");
  169. goto done;
  170. }
  171. if (crypto_write_tagged_contents_to_file(fname,
  172. ENC_KEY_HEADER,
  173. ENC_KEY_TAG,
  174. encrypted_key, encrypted_len) < 0)
  175. goto done;
  176. r = 1;
  177. done:
  178. if (encrypted_key) {
  179. memwipe(encrypted_key, 0, encrypted_len);
  180. tor_free(encrypted_key);
  181. }
  182. memwipe(pwbuf0, 0, sizeof(pwbuf0));
  183. return r;
  184. }
  185. /* DOCDOC */
  186. static int
  187. write_secret_key(const ed25519_secret_key_t *key, int encrypted,
  188. const char *fname,
  189. const char *fname_tag,
  190. const char *encrypted_fname)
  191. {
  192. if (encrypted) {
  193. int r = write_encrypted_secret_key(key, encrypted_fname);
  194. if (r == 1) {
  195. /* Success! */
  196. /* Try to unlink the unencrypted key, if any existed before */
  197. if (strcmp(fname, encrypted_fname))
  198. unlink(fname);
  199. return r;
  200. } else if (r != 0) {
  201. /* Unrecoverable failure! */
  202. return r;
  203. }
  204. fprintf(stderr, "Not encrypting the secret key.\n");
  205. }
  206. return ed25519_seckey_write_to_file(key, fname, fname_tag);
  207. }
  208. /**
  209. * Read an ed25519 key and associated certificates from files beginning with
  210. * <b>fname</b>, with certificate type <b>cert_type</b>. On failure, return
  211. * NULL; on success return the keypair.
  212. *
  213. * If INIT_ED_KEY_CREATE is set in <b>flags</b>, then create the key (and
  214. * certificate if requested) if it doesn't exist, and save it to disk.
  215. *
  216. * If INIT_ED_KEY_NEEDCERT is set in <b>flags</b>, load/create a certificate
  217. * too and store it in *<b>cert_out</b>. Fail if the cert can't be
  218. * found/created. To create a certificate, <b>signing_key</b> must be set to
  219. * the key that should sign it; <b>now</b> to the current time, and
  220. * <b>lifetime</b> to the lifetime of the key.
  221. *
  222. * If INIT_ED_KEY_REPLACE is set in <b>flags</b>, then create and save new key
  223. * whether we can read the old one or not.
  224. *
  225. * If INIT_ED_KEY_EXTRA_STRONG is set in <b>flags</b>, set the extra_strong
  226. * flag when creating the secret key.
  227. *
  228. * If INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT is set in <b>flags</b>, and
  229. * we create a new certificate, create it with the signing key embedded.
  230. *
  231. * If INIT_ED_KEY_SPLIT is set in <b>flags</b>, and we create a new key,
  232. * store the public key in a separate file from the secret key.
  233. *
  234. * If INIT_ED_KEY_MISSING_SECRET_OK is set in <b>flags</b>, and we find a
  235. * public key file but no secret key file, return successfully anyway.
  236. *
  237. * If INIT_ED_KEY_OMIT_SECRET is set in <b>flags</b>, do not try to load a
  238. * secret key unless no public key is found. Do not return a secret key. (but
  239. * create and save one if needed).
  240. *
  241. * If INIT_ED_KEY_NO_LOAD_SECRET is set in <b>flags</b>, don't try to load
  242. * a secret key, no matter what.
  243. *
  244. * If INIT_ED_KEY_TRY_ENCRYPTED is set, we look for an encrypted secret key
  245. * and consider encrypting any new secret key.
  246. *
  247. * If INIT_ED_KEY_NO_REPAIR is set, and there is any issue loading the keys
  248. * from disk _other than their absence_ (full or partial), we do not try to
  249. * replace them.
  250. *
  251. * If INIT_ED_KEY_SUGGEST_KEYGEN is set, have log messages about failures
  252. * refer to the --keygen option.
  253. *
  254. * If INIT_ED_KEY_EXPLICIT_FNAME is set, use the provided file name for the
  255. * secret key file, encrypted or not.
  256. */
  257. ed25519_keypair_t *
  258. ed_key_init_from_file(const char *fname, uint32_t flags,
  259. int severity,
  260. const ed25519_keypair_t *signing_key,
  261. time_t now,
  262. time_t lifetime,
  263. uint8_t cert_type,
  264. struct tor_cert_st **cert_out)
  265. {
  266. char *secret_fname = NULL;
  267. char *encrypted_secret_fname = NULL;
  268. char *public_fname = NULL;
  269. char *cert_fname = NULL;
  270. const char *loaded_secret_fname = NULL;
  271. int created_pk = 0, created_sk = 0, created_cert = 0;
  272. const int try_to_load = ! (flags & INIT_ED_KEY_REPLACE);
  273. const int encrypt_key = !! (flags & INIT_ED_KEY_TRY_ENCRYPTED);
  274. const int norepair = !! (flags & INIT_ED_KEY_NO_REPAIR);
  275. const int split = !! (flags & INIT_ED_KEY_SPLIT);
  276. const int omit_secret = !! (flags & INIT_ED_KEY_OMIT_SECRET);
  277. const int offline_secret = !! (flags & INIT_ED_KEY_OFFLINE_SECRET);
  278. const int explicit_fname = !! (flags & INIT_ED_KEY_EXPLICIT_FNAME);
  279. /* we don't support setting both of these flags at once. */
  280. tor_assert((flags & (INIT_ED_KEY_NO_REPAIR|INIT_ED_KEY_NEEDCERT)) !=
  281. (INIT_ED_KEY_NO_REPAIR|INIT_ED_KEY_NEEDCERT));
  282. char tag[8];
  283. tor_snprintf(tag, sizeof(tag), "type%d", (int)cert_type);
  284. tor_cert_t *cert = NULL;
  285. char *got_tag = NULL;
  286. ed25519_keypair_t *keypair = tor_malloc_zero(sizeof(ed25519_keypair_t));
  287. if (explicit_fname) {
  288. secret_fname = tor_strdup(fname);
  289. encrypted_secret_fname = tor_strdup(fname);
  290. } else {
  291. tor_asprintf(&secret_fname, "%s_secret_key", fname);
  292. tor_asprintf(&encrypted_secret_fname, "%s_secret_key_encrypted", fname);
  293. }
  294. tor_asprintf(&public_fname, "%s_public_key", fname);
  295. tor_asprintf(&cert_fname, "%s_cert", fname);
  296. /* Try to read the secret key. */
  297. int have_secret = 0;
  298. int load_secret = try_to_load &&
  299. !offline_secret &&
  300. (!omit_secret || file_status(public_fname)==FN_NOENT);
  301. if (load_secret) {
  302. int rv = ed25519_seckey_read_from_file(&keypair->seckey,
  303. &got_tag, secret_fname);
  304. if (rv == 0) {
  305. have_secret = 1;
  306. loaded_secret_fname = secret_fname;
  307. tor_assert(got_tag);
  308. } else {
  309. if (errno != ENOENT && norepair) {
  310. tor_log(severity, LD_OR, "Unable to read %s: %s", secret_fname,
  311. strerror(errno));
  312. goto err;
  313. }
  314. }
  315. }
  316. /* Should we try for an encrypted key? */
  317. int have_encrypted_secret_file = 0;
  318. if (!have_secret && try_to_load && encrypt_key) {
  319. int r = read_encrypted_secret_key(&keypair->seckey,
  320. encrypted_secret_fname);
  321. if (r > 0) {
  322. have_secret = 1;
  323. have_encrypted_secret_file = 1;
  324. tor_free(got_tag); /* convince coverity we aren't leaking */
  325. got_tag = tor_strdup(tag);
  326. loaded_secret_fname = encrypted_secret_fname;
  327. } else if (errno != ENOENT && norepair) {
  328. tor_log(severity, LD_OR, "Unable to read %s: %s",
  329. encrypted_secret_fname, strerror(errno));
  330. goto err;
  331. }
  332. } else {
  333. if (try_to_load) {
  334. /* Check if it's there anyway, so we don't replace it. */
  335. if (file_status(encrypted_secret_fname) != FN_NOENT)
  336. have_encrypted_secret_file = 1;
  337. }
  338. }
  339. if (have_secret) {
  340. if (strcmp(got_tag, tag)) {
  341. tor_log(severity, LD_OR, "%s has wrong tag", loaded_secret_fname);
  342. goto err;
  343. }
  344. /* Derive the public key */
  345. if (ed25519_public_key_generate(&keypair->pubkey, &keypair->seckey)<0) {
  346. tor_log(severity, LD_OR, "%s can't produce a public key",
  347. loaded_secret_fname);
  348. goto err;
  349. }
  350. }
  351. /* If we do split keys here, try to read the pubkey. */
  352. int found_public = 0;
  353. if (try_to_load && (!have_secret || split)) {
  354. ed25519_public_key_t pubkey_tmp;
  355. tor_free(got_tag);
  356. found_public = ed25519_pubkey_read_from_file(&pubkey_tmp,
  357. &got_tag, public_fname) == 0;
  358. if (!found_public && errno != ENOENT && norepair) {
  359. tor_log(severity, LD_OR, "Unable to read %s: %s", public_fname,
  360. strerror(errno));
  361. goto err;
  362. }
  363. if (found_public && strcmp(got_tag, tag)) {
  364. tor_log(severity, LD_OR, "%s has wrong tag", public_fname);
  365. goto err;
  366. }
  367. if (found_public) {
  368. if (have_secret) {
  369. /* If we have a secret key and we're reloading the public key,
  370. * the key must match! */
  371. if (! ed25519_pubkey_eq(&keypair->pubkey, &pubkey_tmp)) {
  372. tor_log(severity, LD_OR, "%s does not match %s! If you are trying "
  373. "to restore from backup, make sure you didn't mix up the "
  374. "key files. If you are absolutely sure that %s is the right "
  375. "key for this relay, delete %s or move it out of the way.",
  376. public_fname, loaded_secret_fname,
  377. loaded_secret_fname, public_fname);
  378. goto err;
  379. }
  380. } else {
  381. /* We only have the public key; better use that. */
  382. tor_assert(split);
  383. memcpy(&keypair->pubkey, &pubkey_tmp, sizeof(pubkey_tmp));
  384. }
  385. } else {
  386. /* We have no public key file, but we do have a secret key, make the
  387. * public key file! */
  388. if (have_secret) {
  389. if (ed25519_pubkey_write_to_file(&keypair->pubkey, public_fname, tag)
  390. < 0) {
  391. tor_log(severity, LD_OR, "Couldn't repair %s", public_fname);
  392. goto err;
  393. } else {
  394. tor_log(LOG_NOTICE, LD_OR,
  395. "Found secret key but not %s. Regenerating.",
  396. public_fname);
  397. }
  398. }
  399. }
  400. }
  401. /* If the secret key is absent and it's not allowed to be, fail. */
  402. if (!have_secret && found_public &&
  403. !(flags & INIT_ED_KEY_MISSING_SECRET_OK)) {
  404. if (have_encrypted_secret_file) {
  405. tor_log(severity, LD_OR, "We needed to load a secret key from %s, "
  406. "but it was encrypted. Try 'tor --keygen' instead, so you "
  407. "can enter the passphrase.",
  408. secret_fname);
  409. } else if (offline_secret) {
  410. tor_log(severity, LD_OR, "We wanted to load a secret key from %s, "
  411. "but you're keeping it offline. (OfflineMasterKey is set.)",
  412. secret_fname);
  413. } else {
  414. tor_log(severity, LD_OR, "We needed to load a secret key from %s, "
  415. "but couldn't find it. %s", secret_fname,
  416. (flags & INIT_ED_KEY_SUGGEST_KEYGEN) ?
  417. "If you're keeping your master secret key offline, you will "
  418. "need to run 'tor --keygen' to generate new signing keys." :
  419. "Did you forget to copy it over when you copied the rest of the "
  420. "signing key material?");
  421. }
  422. goto err;
  423. }
  424. /* If it's absent, and we're not supposed to make a new keypair, fail. */
  425. if (!have_secret && !found_public && !(flags & INIT_ED_KEY_CREATE)) {
  426. if (split) {
  427. tor_log(severity, LD_OR, "No key found in %s or %s.",
  428. secret_fname, public_fname);
  429. } else {
  430. tor_log(severity, LD_OR, "No key found in %s.", secret_fname);
  431. }
  432. goto err;
  433. }
  434. /* If the secret key is absent, but the encrypted key would be present,
  435. * that's an error */
  436. if (!have_secret && !found_public && have_encrypted_secret_file) {
  437. tor_assert(!encrypt_key);
  438. tor_log(severity, LD_OR, "Found an encrypted secret key, "
  439. "but not public key file %s!", public_fname);
  440. goto err;
  441. }
  442. /* if it's absent, make a new keypair... */
  443. if (!have_secret && !found_public) {
  444. tor_free(keypair);
  445. keypair = ed_key_new(signing_key, flags, now, lifetime,
  446. cert_type, &cert);
  447. if (!keypair) {
  448. tor_log(severity, LD_OR, "Couldn't create keypair");
  449. goto err;
  450. }
  451. created_pk = created_sk = created_cert = 1;
  452. }
  453. /* Write it to disk if we're supposed to do with a new passphrase, or if
  454. * we just created it. */
  455. if (created_sk || (have_secret && get_options()->change_key_passphrase)) {
  456. if (write_secret_key(&keypair->seckey,
  457. encrypt_key,
  458. secret_fname, tag, encrypted_secret_fname) < 0
  459. ||
  460. (split &&
  461. ed25519_pubkey_write_to_file(&keypair->pubkey, public_fname, tag) < 0)
  462. ||
  463. (cert &&
  464. crypto_write_tagged_contents_to_file(cert_fname, "ed25519v1-cert",
  465. tag, cert->encoded, cert->encoded_len) < 0)) {
  466. tor_log(severity, LD_OR, "Couldn't write keys or cert to file.");
  467. goto err;
  468. }
  469. goto done;
  470. }
  471. /* If we're not supposed to get a cert, we're done. */
  472. if (! (flags & INIT_ED_KEY_NEEDCERT))
  473. goto done;
  474. /* Read a cert. */
  475. tor_free(got_tag);
  476. uint8_t certbuf[256];
  477. ssize_t cert_body_len = crypto_read_tagged_contents_from_file(
  478. cert_fname, "ed25519v1-cert",
  479. &got_tag, certbuf, sizeof(certbuf));
  480. if (cert_body_len >= 0 && !strcmp(got_tag, tag))
  481. cert = tor_cert_parse(certbuf, cert_body_len);
  482. /* If we got it, check it to the extent we can. */
  483. int bad_cert = 0;
  484. if (! cert) {
  485. tor_log(severity, LD_OR, "Cert was unparseable");
  486. bad_cert = 1;
  487. } else if (!tor_memeq(cert->signed_key.pubkey, keypair->pubkey.pubkey,
  488. ED25519_PUBKEY_LEN)) {
  489. tor_log(severity, LD_OR, "Cert was for wrong key");
  490. bad_cert = 1;
  491. } else if (signing_key &&
  492. tor_cert_checksig(cert, &signing_key->pubkey, now) < 0) {
  493. tor_log(severity, LD_OR, "Can't check certificate");
  494. bad_cert = 1;
  495. } else if (cert->cert_expired) {
  496. tor_log(severity, LD_OR, "Certificate is expired");
  497. bad_cert = 1;
  498. } else if (signing_key && cert->signing_key_included &&
  499. ! ed25519_pubkey_eq(&signing_key->pubkey, &cert->signing_key)) {
  500. tor_log(severity, LD_OR, "Certificate signed by unexpectd key!");
  501. bad_cert = 1;
  502. }
  503. if (bad_cert) {
  504. tor_cert_free(cert);
  505. cert = NULL;
  506. }
  507. /* If we got a cert, we're done. */
  508. if (cert)
  509. goto done;
  510. /* If we didn't get a cert, and we're not supposed to make one, fail. */
  511. if (!signing_key || !(flags & INIT_ED_KEY_CREATE)) {
  512. tor_log(severity, LD_OR, "Without signing key, can't create certificate");
  513. goto err;
  514. }
  515. /* We have keys but not a certificate, so make one. */
  516. uint32_t cert_flags = 0;
  517. if (flags & INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT)
  518. cert_flags |= CERT_FLAG_INCLUDE_SIGNING_KEY;
  519. cert = tor_cert_create(signing_key, cert_type,
  520. &keypair->pubkey,
  521. now, lifetime,
  522. cert_flags);
  523. if (! cert) {
  524. tor_log(severity, LD_OR, "Couldn't create certificate");
  525. goto err;
  526. }
  527. /* Write it to disk. */
  528. created_cert = 1;
  529. if (crypto_write_tagged_contents_to_file(cert_fname, "ed25519v1-cert",
  530. tag, cert->encoded, cert->encoded_len) < 0) {
  531. tor_log(severity, LD_OR, "Couldn't write cert to disk.");
  532. goto err;
  533. }
  534. done:
  535. if (cert_out)
  536. *cert_out = cert;
  537. else
  538. tor_cert_free(cert);
  539. goto cleanup;
  540. err:
  541. if (keypair)
  542. memwipe(keypair, 0, sizeof(*keypair));
  543. tor_free(keypair);
  544. tor_cert_free(cert);
  545. if (cert_out)
  546. *cert_out = NULL;
  547. if (created_sk)
  548. unlink(secret_fname);
  549. if (created_pk)
  550. unlink(public_fname);
  551. if (created_cert)
  552. unlink(cert_fname);
  553. cleanup:
  554. tor_free(encrypted_secret_fname);
  555. tor_free(secret_fname);
  556. tor_free(public_fname);
  557. tor_free(cert_fname);
  558. tor_free(got_tag);
  559. return keypair;
  560. }
  561. /**
  562. * Create a new signing key and (optionally) certficiate; do not read or write
  563. * from disk. See ed_key_init_from_file() for more information.
  564. */
  565. ed25519_keypair_t *
  566. ed_key_new(const ed25519_keypair_t *signing_key,
  567. uint32_t flags,
  568. time_t now,
  569. time_t lifetime,
  570. uint8_t cert_type,
  571. struct tor_cert_st **cert_out)
  572. {
  573. if (cert_out)
  574. *cert_out = NULL;
  575. const int extra_strong = !! (flags & INIT_ED_KEY_EXTRA_STRONG);
  576. ed25519_keypair_t *keypair = tor_malloc_zero(sizeof(ed25519_keypair_t));
  577. if (ed25519_keypair_generate(keypair, extra_strong) < 0)
  578. goto err;
  579. if (! (flags & INIT_ED_KEY_NEEDCERT))
  580. return keypair;
  581. tor_assert(signing_key);
  582. tor_assert(cert_out);
  583. uint32_t cert_flags = 0;
  584. if (flags & INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT)
  585. cert_flags |= CERT_FLAG_INCLUDE_SIGNING_KEY;
  586. tor_cert_t *cert = tor_cert_create(signing_key, cert_type,
  587. &keypair->pubkey,
  588. now, lifetime,
  589. cert_flags);
  590. if (! cert)
  591. goto err;
  592. *cert_out = cert;
  593. return keypair;
  594. err:
  595. tor_free(keypair);
  596. return NULL;
  597. }
  598. static ed25519_keypair_t *master_identity_key = NULL;
  599. static ed25519_keypair_t *master_signing_key = NULL;
  600. static ed25519_keypair_t *current_auth_key = NULL;
  601. static tor_cert_t *signing_key_cert = NULL;
  602. static tor_cert_t *link_cert_cert = NULL;
  603. static tor_cert_t *auth_key_cert = NULL;
  604. static uint8_t *rsa_ed_crosscert = NULL;
  605. static size_t rsa_ed_crosscert_len = 0;
  606. static time_t rsa_ed_crosscert_expiration = 0;
  607. /**
  608. * Running as a server: load, reload, or refresh our ed25519 keys and
  609. * certificates, creating and saving new ones as needed.
  610. *
  611. * Return -1 on failure; 0 on success if the signing key was not replaced;
  612. * and 1 on success if the signing key was replaced.
  613. */
  614. int
  615. load_ed_keys(const or_options_t *options, time_t now)
  616. {
  617. ed25519_keypair_t *id = NULL;
  618. ed25519_keypair_t *sign = NULL;
  619. ed25519_keypair_t *auth = NULL;
  620. const ed25519_keypair_t *sign_signing_key_with_id = NULL;
  621. const ed25519_keypair_t *use_signing = NULL;
  622. const tor_cert_t *check_signing_cert = NULL;
  623. tor_cert_t *sign_cert = NULL;
  624. tor_cert_t *auth_cert = NULL;
  625. int signing_key_changed = 0;
  626. // It is later than 1972, since otherwise there would be no C compilers.
  627. // (Try to diagnose #22466.)
  628. tor_assert_nonfatal(now >= 2 * 365 * 86400);
  629. #define FAIL(msg) do { \
  630. log_warn(LD_OR, (msg)); \
  631. goto err; \
  632. } while (0)
  633. #define SET_KEY(key, newval) do { \
  634. if ((key) != (newval)) \
  635. ed25519_keypair_free(key); \
  636. key = (newval); \
  637. } while (0)
  638. #define SET_CERT(cert, newval) do { \
  639. if ((cert) != (newval)) \
  640. tor_cert_free(cert); \
  641. cert = (newval); \
  642. } while (0)
  643. #define HAPPENS_SOON(when, interval) \
  644. ((when) < now + (interval))
  645. #define EXPIRES_SOON(cert, interval) \
  646. (!(cert) || HAPPENS_SOON((cert)->valid_until, (interval)))
  647. /* XXXX support encrypted identity keys fully */
  648. /* First try to get the signing key to see how it is. */
  649. {
  650. char *fname =
  651. options_get_datadir_fname2(options, "keys", "ed25519_signing");
  652. sign = ed_key_init_from_file(
  653. fname,
  654. INIT_ED_KEY_NEEDCERT|
  655. INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT,
  656. LOG_INFO,
  657. NULL, 0, 0, CERT_TYPE_ID_SIGNING, &sign_cert);
  658. tor_free(fname);
  659. check_signing_cert = sign_cert;
  660. use_signing = sign;
  661. }
  662. if (use_signing) {
  663. /* We loaded a signing key with its certificate. */
  664. if (! master_signing_key) {
  665. /* We didn't know one before! */
  666. signing_key_changed = 1;
  667. } else if (! ed25519_pubkey_eq(&use_signing->pubkey,
  668. &master_signing_key->pubkey) ||
  669. ! tor_memeq(use_signing->seckey.seckey,
  670. master_signing_key->seckey.seckey,
  671. ED25519_SECKEY_LEN)) {
  672. /* We loaded a different signing key than the one we knew before. */
  673. signing_key_changed = 1;
  674. }
  675. }
  676. if (!use_signing && master_signing_key) {
  677. /* We couldn't load a signing key, but we already had one loaded */
  678. check_signing_cert = signing_key_cert;
  679. use_signing = master_signing_key;
  680. }
  681. const int offline_master =
  682. options->OfflineMasterKey && options->command != CMD_KEYGEN;
  683. const int need_new_signing_key =
  684. NULL == use_signing ||
  685. EXPIRES_SOON(check_signing_cert, 0) ||
  686. (options->command == CMD_KEYGEN && ! options->change_key_passphrase);
  687. const int want_new_signing_key =
  688. need_new_signing_key ||
  689. EXPIRES_SOON(check_signing_cert, options->TestingSigningKeySlop);
  690. /* We can only create a master key if we haven't been told that the
  691. * master key will always be offline. Also, if we have a signing key,
  692. * then we shouldn't make a new master ID key. */
  693. const int can_make_master_id_key = !offline_master &&
  694. NULL == use_signing;
  695. if (need_new_signing_key) {
  696. log_notice(LD_OR, "It looks like I need to generate and sign a new "
  697. "medium-term signing key, because %s. To do that, I "
  698. "need to load%s the permanent master identity key. "
  699. "If the master identity key was not moved or encrypted "
  700. "with a passphrase, this will be done automatically and "
  701. "no further action is required. Otherwise, provide the "
  702. "necessary data using 'tor --keygen' to do it manually.",
  703. (NULL == use_signing) ? "I don't have one" :
  704. EXPIRES_SOON(check_signing_cert, 0) ? "the one I have is expired" :
  705. "you asked me to make one with --keygen",
  706. can_make_master_id_key ? " (or create)" : "");
  707. } else if (want_new_signing_key && !offline_master) {
  708. log_notice(LD_OR, "It looks like I should try to generate and sign a "
  709. "new medium-term signing key, because the one I have is "
  710. "going to expire soon. To do that, I'm going to have to "
  711. "try to load the permanent master identity key. "
  712. "If the master identity key was not moved or encrypted "
  713. "with a passphrase, this will be done automatically and "
  714. "no further action is required. Otherwise, provide the "
  715. "necessary data using 'tor --keygen' to do it manually.");
  716. } else if (want_new_signing_key) {
  717. log_notice(LD_OR, "It looks like I should try to generate and sign a "
  718. "new medium-term signing key, because the one I have is "
  719. "going to expire soon. But OfflineMasterKey is set, so I "
  720. "won't try to load a permanent master identity key. You "
  721. "will need to use 'tor --keygen' to make a new signing "
  722. "key and certificate.");
  723. }
  724. {
  725. uint32_t flags =
  726. (INIT_ED_KEY_SPLIT|
  727. INIT_ED_KEY_EXTRA_STRONG|INIT_ED_KEY_NO_REPAIR);
  728. if (can_make_master_id_key)
  729. flags |= INIT_ED_KEY_CREATE;
  730. if (! need_new_signing_key)
  731. flags |= INIT_ED_KEY_MISSING_SECRET_OK;
  732. if (! want_new_signing_key || offline_master)
  733. flags |= INIT_ED_KEY_OMIT_SECRET;
  734. if (offline_master)
  735. flags |= INIT_ED_KEY_OFFLINE_SECRET;
  736. if (options->command == CMD_KEYGEN)
  737. flags |= INIT_ED_KEY_TRY_ENCRYPTED;
  738. /* Check/Create the key directory */
  739. cpd_check_t cpd_opts = CPD_CREATE;
  740. if (options->DataDirectoryGroupReadable)
  741. cpd_opts |= CPD_GROUP_READ;
  742. if (check_private_dir(options->DataDirectory, cpd_opts, options->User)) {
  743. log_err(LD_OR, "Can't create/check datadirectory %s",
  744. options->DataDirectory);
  745. goto err;
  746. }
  747. char *fname = get_datadir_fname("keys");
  748. if (check_private_dir(fname, CPD_CREATE, options->User) < 0) {
  749. log_err(LD_OR, "Problem creating/checking key directory %s", fname);
  750. tor_free(fname);
  751. goto err;
  752. }
  753. tor_free(fname);
  754. if (options->master_key_fname) {
  755. fname = tor_strdup(options->master_key_fname);
  756. flags |= INIT_ED_KEY_EXPLICIT_FNAME;
  757. } else {
  758. fname = options_get_datadir_fname2(options, "keys", "ed25519_master_id");
  759. }
  760. id = ed_key_init_from_file(
  761. fname,
  762. flags,
  763. LOG_WARN, NULL, 0, 0, 0, NULL);
  764. tor_free(fname);
  765. if (!id) {
  766. if (need_new_signing_key) {
  767. if (offline_master)
  768. FAIL("Can't load master identity key; OfflineMasterKey is set.");
  769. else
  770. FAIL("Missing identity key");
  771. } else {
  772. log_warn(LD_OR, "Master public key was absent; inferring from "
  773. "public key in signing certificate and saving to disk.");
  774. tor_assert(check_signing_cert);
  775. id = tor_malloc_zero(sizeof(*id));
  776. memcpy(&id->pubkey, &check_signing_cert->signing_key,
  777. sizeof(ed25519_public_key_t));
  778. fname = options_get_datadir_fname2(options, "keys",
  779. "ed25519_master_id_public_key");
  780. if (ed25519_pubkey_write_to_file(&id->pubkey, fname, "type0") < 0) {
  781. log_warn(LD_OR, "Error while attempting to write master public key "
  782. "to disk");
  783. tor_free(fname);
  784. goto err;
  785. }
  786. tor_free(fname);
  787. }
  788. }
  789. if (tor_mem_is_zero((char*)id->seckey.seckey, sizeof(id->seckey)))
  790. sign_signing_key_with_id = NULL;
  791. else
  792. sign_signing_key_with_id = id;
  793. }
  794. if (master_identity_key &&
  795. !ed25519_pubkey_eq(&id->pubkey, &master_identity_key->pubkey)) {
  796. FAIL("Identity key on disk does not match key we loaded earlier!");
  797. }
  798. if (need_new_signing_key && NULL == sign_signing_key_with_id)
  799. FAIL("Can't load master key make a new signing key.");
  800. if (sign_cert) {
  801. if (! sign_cert->signing_key_included)
  802. FAIL("Loaded a signing cert with no key included!");
  803. if (! ed25519_pubkey_eq(&sign_cert->signing_key, &id->pubkey))
  804. FAIL("The signing cert we have was not signed with the master key "
  805. "we loaded!");
  806. if (tor_cert_checksig(sign_cert, &id->pubkey, 0) < 0)
  807. FAIL("The signing cert we loaded was not signed correctly!");
  808. }
  809. if (want_new_signing_key && sign_signing_key_with_id) {
  810. uint32_t flags = (INIT_ED_KEY_CREATE|
  811. INIT_ED_KEY_REPLACE|
  812. INIT_ED_KEY_EXTRA_STRONG|
  813. INIT_ED_KEY_NEEDCERT|
  814. INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT);
  815. char *fname =
  816. options_get_datadir_fname2(options, "keys", "ed25519_signing");
  817. ed25519_keypair_free(sign);
  818. tor_cert_free(sign_cert);
  819. sign = ed_key_init_from_file(fname,
  820. flags, LOG_WARN,
  821. sign_signing_key_with_id, now,
  822. options->SigningKeyLifetime,
  823. CERT_TYPE_ID_SIGNING, &sign_cert);
  824. tor_free(fname);
  825. if (!sign)
  826. FAIL("Missing signing key");
  827. use_signing = sign;
  828. signing_key_changed = 1;
  829. tor_assert(sign_cert->signing_key_included);
  830. tor_assert(ed25519_pubkey_eq(&sign_cert->signing_key, &id->pubkey));
  831. tor_assert(ed25519_pubkey_eq(&sign_cert->signed_key, &sign->pubkey));
  832. } else if (want_new_signing_key) {
  833. static ratelim_t missing_master = RATELIM_INIT(3600);
  834. log_fn_ratelim(&missing_master, LOG_WARN, LD_OR,
  835. "Signing key will expire soon, but I can't load the "
  836. "master key to sign a new one!");
  837. }
  838. tor_assert(use_signing);
  839. /* At this point we no longer need our secret identity key. So wipe
  840. * it, if we loaded it in the first place. */
  841. memwipe(id->seckey.seckey, 0, sizeof(id->seckey));
  842. if (options->command == CMD_KEYGEN)
  843. goto end;
  844. if (server_mode(options) &&
  845. (!rsa_ed_crosscert ||
  846. HAPPENS_SOON(rsa_ed_crosscert_expiration, 30*86400))) {
  847. uint8_t *crosscert;
  848. time_t expiration = now+6*30*86400; /* 6 months in the future. */
  849. ssize_t crosscert_len = tor_make_rsa_ed25519_crosscert(&id->pubkey,
  850. get_server_identity_key(),
  851. expiration,
  852. &crosscert);
  853. tor_free(rsa_ed_crosscert);
  854. rsa_ed_crosscert_len = crosscert_len;
  855. rsa_ed_crosscert = crosscert;
  856. rsa_ed_crosscert_expiration = expiration;
  857. }
  858. if (!current_auth_key ||
  859. signing_key_changed ||
  860. EXPIRES_SOON(auth_key_cert, options->TestingAuthKeySlop)) {
  861. auth = ed_key_new(use_signing, INIT_ED_KEY_NEEDCERT,
  862. now,
  863. options->TestingAuthKeyLifetime,
  864. CERT_TYPE_SIGNING_AUTH, &auth_cert);
  865. if (!auth)
  866. FAIL("Can't create auth key");
  867. }
  868. /* We've generated or loaded everything. Put them in memory. */
  869. end:
  870. if (! master_identity_key) {
  871. SET_KEY(master_identity_key, id);
  872. } else {
  873. tor_free(id);
  874. }
  875. if (sign) {
  876. SET_KEY(master_signing_key, sign);
  877. SET_CERT(signing_key_cert, sign_cert);
  878. }
  879. if (auth) {
  880. SET_KEY(current_auth_key, auth);
  881. SET_CERT(auth_key_cert, auth_cert);
  882. }
  883. return signing_key_changed;
  884. err:
  885. ed25519_keypair_free(id);
  886. ed25519_keypair_free(sign);
  887. ed25519_keypair_free(auth);
  888. tor_cert_free(sign_cert);
  889. tor_cert_free(auth_cert);
  890. return -1;
  891. }
  892. /**
  893. * Retrieve our currently-in-use Ed25519 link certificate and id certificate,
  894. * and, if they would expire soon (based on the time <b>now</b>, generate new
  895. * certificates (without embedding the public part of the signing key inside).
  896. * If <b>force</b> is true, always generate a new certificate.
  897. *
  898. * The signed_key from the current id->signing certificate will be used to
  899. * sign the new key within newly generated X509 certificate.
  900. *
  901. * Returns -1 upon error. Otherwise, returns 0 upon success (either when the
  902. * current certificate is still valid, or when a new certificate was
  903. * successfully generated, or no certificate was needed).
  904. */
  905. int
  906. generate_ed_link_cert(const or_options_t *options, time_t now,
  907. int force)
  908. {
  909. const tor_x509_cert_t *link_ = NULL, *id = NULL;
  910. tor_cert_t *link_cert = NULL;
  911. if (tor_tls_get_my_certs(1, &link_, &id) < 0 || link_ == NULL) {
  912. if (!server_mode(options)) {
  913. /* No need to make an Ed25519->Link cert: we are a client */
  914. return 0;
  915. }
  916. log_warn(LD_OR, "Can't get my x509 link cert.");
  917. return -1;
  918. }
  919. const common_digests_t *digests = tor_x509_cert_get_cert_digests(link_);
  920. if (force == 0 &&
  921. link_cert_cert &&
  922. ! EXPIRES_SOON(link_cert_cert, options->TestingLinkKeySlop) &&
  923. fast_memeq(digests->d[DIGEST_SHA256], link_cert_cert->signed_key.pubkey,
  924. DIGEST256_LEN)) {
  925. return 0;
  926. }
  927. ed25519_public_key_t dummy_key;
  928. memcpy(dummy_key.pubkey, digests->d[DIGEST_SHA256], DIGEST256_LEN);
  929. link_cert = tor_cert_create(get_master_signing_keypair(),
  930. CERT_TYPE_SIGNING_LINK,
  931. &dummy_key,
  932. now,
  933. options->TestingLinkCertLifetime, 0);
  934. if (link_cert) {
  935. SET_CERT(link_cert_cert, link_cert);
  936. }
  937. return 0;
  938. }
  939. #undef FAIL
  940. #undef SET_KEY
  941. #undef SET_CERT
  942. /**
  943. * Return 1 if any of the following are true:
  944. *
  945. * - if one of our Ed25519 signing, auth, or link certificates would expire
  946. * soon w.r.t. the time <b>now</b>,
  947. * - if we do not currently have a link certificate, or
  948. * - if our cached Ed25519 link certificate is not same as the one we're
  949. * currently using.
  950. *
  951. * Otherwise, returns 0.
  952. */
  953. int
  954. should_make_new_ed_keys(const or_options_t *options, const time_t now)
  955. {
  956. if (!master_identity_key ||
  957. !master_signing_key ||
  958. !current_auth_key ||
  959. !link_cert_cert ||
  960. EXPIRES_SOON(signing_key_cert, options->TestingSigningKeySlop) ||
  961. EXPIRES_SOON(auth_key_cert, options->TestingAuthKeySlop) ||
  962. EXPIRES_SOON(link_cert_cert, options->TestingLinkKeySlop))
  963. return 1;
  964. const tor_x509_cert_t *link_ = NULL, *id = NULL;
  965. if (tor_tls_get_my_certs(1, &link_, &id) < 0 || link_ == NULL)
  966. return 1;
  967. const common_digests_t *digests = tor_x509_cert_get_cert_digests(link_);
  968. if (!fast_memeq(digests->d[DIGEST_SHA256],
  969. link_cert_cert->signed_key.pubkey,
  970. DIGEST256_LEN)) {
  971. return 1;
  972. }
  973. return 0;
  974. }
  975. #undef EXPIRES_SOON
  976. #undef HAPPENS_SOON
  977. #ifdef TOR_UNIT_TESTS
  978. /* Helper for unit tests: populate the ed25519 keys without saving or
  979. * loading */
  980. void
  981. init_mock_ed_keys(const crypto_pk_t *rsa_identity_key)
  982. {
  983. routerkeys_free_all();
  984. #define MAKEKEY(k) \
  985. k = tor_malloc_zero(sizeof(*k)); \
  986. if (ed25519_keypair_generate(k, 0) < 0) { \
  987. log_warn(LD_BUG, "Couldn't make a keypair"); \
  988. goto err; \
  989. }
  990. MAKEKEY(master_identity_key);
  991. MAKEKEY(master_signing_key);
  992. MAKEKEY(current_auth_key);
  993. #define MAKECERT(cert, signing, signed_, type, flags) \
  994. cert = tor_cert_create(signing, \
  995. type, \
  996. &signed_->pubkey, \
  997. time(NULL), 86400, \
  998. flags); \
  999. if (!cert) { \
  1000. log_warn(LD_BUG, "Couldn't make a %s certificate!", #cert); \
  1001. goto err; \
  1002. }
  1003. MAKECERT(signing_key_cert,
  1004. master_identity_key, master_signing_key, CERT_TYPE_ID_SIGNING,
  1005. CERT_FLAG_INCLUDE_SIGNING_KEY);
  1006. MAKECERT(auth_key_cert,
  1007. master_signing_key, current_auth_key, CERT_TYPE_SIGNING_AUTH, 0);
  1008. if (generate_ed_link_cert(get_options(), time(NULL), 0) < 0) {
  1009. log_warn(LD_BUG, "Couldn't make link certificate");
  1010. goto err;
  1011. }
  1012. rsa_ed_crosscert_len = tor_make_rsa_ed25519_crosscert(
  1013. &master_identity_key->pubkey,
  1014. rsa_identity_key,
  1015. time(NULL)+86400,
  1016. &rsa_ed_crosscert);
  1017. return;
  1018. err:
  1019. routerkeys_free_all();
  1020. tor_assert_nonfatal_unreached();
  1021. }
  1022. #undef MAKEKEY
  1023. #undef MAKECERT
  1024. #endif /* defined(TOR_UNIT_TESTS) */
  1025. /**
  1026. * Print the ISO8601-formated <b>expiration</b> for a certificate with
  1027. * some <b>description</b> to stdout.
  1028. *
  1029. * For example, for a signing certificate, this might print out:
  1030. * signing-cert-expiry: 2017-07-25 08:30:15 UTC
  1031. */
  1032. static void
  1033. print_cert_expiration(const char *expiration,
  1034. const char *description)
  1035. {
  1036. fprintf(stderr, "%s-cert-expiry: %s\n", description, expiration);
  1037. }
  1038. /**
  1039. * Log when a certificate, <b>cert</b>, with some <b>description</b> and
  1040. * stored in a file named <b>fname</b>, is going to expire.
  1041. */
  1042. static void
  1043. log_ed_cert_expiration(const tor_cert_t *cert,
  1044. const char *description,
  1045. const char *fname) {
  1046. char expiration[ISO_TIME_LEN+1];
  1047. if (BUG(!cert)) { /* If the specified key hasn't been loaded */
  1048. log_warn(LD_OR, "No %s key loaded; can't get certificate expiration.",
  1049. description);
  1050. } else {
  1051. format_local_iso_time(expiration, cert->valid_until);
  1052. log_notice(LD_OR, "The %s certificate stored in %s is valid until %s.",
  1053. description, fname, expiration);
  1054. print_cert_expiration(expiration, description);
  1055. }
  1056. }
  1057. /**
  1058. * Log when our master signing key certificate expires. Used when tor is given
  1059. * the --key-expiration command-line option.
  1060. *
  1061. * Returns 0 on success and 1 on failure.
  1062. */
  1063. static int
  1064. log_master_signing_key_cert_expiration(const or_options_t *options)
  1065. {
  1066. const tor_cert_t *signing_key;
  1067. char *fn = NULL;
  1068. int failed = 0;
  1069. time_t now = approx_time();
  1070. fn = options_get_datadir_fname2(options, "keys", "ed25519_signing_cert");
  1071. /* Try to grab our cached copy of the key. */
  1072. signing_key = get_master_signing_key_cert();
  1073. tor_assert(server_identity_key_is_set());
  1074. /* Load our keys from disk, if necessary. */
  1075. if (!signing_key) {
  1076. failed = load_ed_keys(options, now) < 0;
  1077. signing_key = get_master_signing_key_cert();
  1078. }
  1079. /* If we do have a signing key, log the expiration time. */
  1080. if (signing_key) {
  1081. log_ed_cert_expiration(signing_key, "signing", fn);
  1082. } else {
  1083. log_warn(LD_OR, "Could not load signing key certificate from %s, so " \
  1084. "we couldn't learn anything about certificate expiration.", fn);
  1085. }
  1086. tor_free(fn);
  1087. return failed;
  1088. }
  1089. /**
  1090. * Log when a key certificate expires. Used when tor is given the
  1091. * --key-expiration command-line option.
  1092. *
  1093. * If an command argument is given, which should specify the type of
  1094. * key to get expiry information about (currently supported arguments
  1095. * are "sign"), get info about that type of certificate. Otherwise,
  1096. * print info about the supported arguments.
  1097. *
  1098. * Returns 0 on success and -1 on failure.
  1099. */
  1100. int
  1101. log_cert_expiration(void)
  1102. {
  1103. const or_options_t *options = get_options();
  1104. const char *arg = options->command_arg;
  1105. if (!strcmp(arg, "sign")) {
  1106. return log_master_signing_key_cert_expiration(options);
  1107. } else {
  1108. fprintf(stderr, "No valid argument to --key-expiration found!\n");
  1109. fprintf(stderr, "Currently recognised arguments are: 'sign'\n");
  1110. return -1;
  1111. }
  1112. }
  1113. const ed25519_public_key_t *
  1114. get_master_identity_key(void)
  1115. {
  1116. if (!master_identity_key)
  1117. return NULL;
  1118. return &master_identity_key->pubkey;
  1119. }
  1120. /** Return true iff <b>id</b> is our Ed25519 master identity key. */
  1121. int
  1122. router_ed25519_id_is_me(const ed25519_public_key_t *id)
  1123. {
  1124. return id && master_identity_key &&
  1125. ed25519_pubkey_eq(id, &master_identity_key->pubkey);
  1126. }
  1127. #ifdef TOR_UNIT_TESTS
  1128. /* only exists for the unit tests, since otherwise the identity key
  1129. * should be used to sign nothing but the signing key. */
  1130. const ed25519_keypair_t *
  1131. get_master_identity_keypair(void)
  1132. {
  1133. return master_identity_key;
  1134. }
  1135. #endif /* defined(TOR_UNIT_TESTS) */
  1136. const ed25519_keypair_t *
  1137. get_master_signing_keypair(void)
  1138. {
  1139. return master_signing_key;
  1140. }
  1141. const struct tor_cert_st *
  1142. get_master_signing_key_cert(void)
  1143. {
  1144. return signing_key_cert;
  1145. }
  1146. const ed25519_keypair_t *
  1147. get_current_auth_keypair(void)
  1148. {
  1149. return current_auth_key;
  1150. }
  1151. const tor_cert_t *
  1152. get_current_link_cert_cert(void)
  1153. {
  1154. return link_cert_cert;
  1155. }
  1156. const tor_cert_t *
  1157. get_current_auth_key_cert(void)
  1158. {
  1159. return auth_key_cert;
  1160. }
  1161. void
  1162. get_master_rsa_crosscert(const uint8_t **cert_out,
  1163. size_t *size_out)
  1164. {
  1165. *cert_out = rsa_ed_crosscert;
  1166. *size_out = rsa_ed_crosscert_len;
  1167. }
  1168. /** Construct cross-certification for the master identity key with
  1169. * the ntor onion key. Store the sign of the corresponding ed25519 public key
  1170. * in *<b>sign_out</b>. */
  1171. tor_cert_t *
  1172. make_ntor_onion_key_crosscert(const curve25519_keypair_t *onion_key,
  1173. const ed25519_public_key_t *master_id_key, time_t now, time_t lifetime,
  1174. int *sign_out)
  1175. {
  1176. tor_cert_t *cert = NULL;
  1177. ed25519_keypair_t ed_onion_key;
  1178. if (ed25519_keypair_from_curve25519_keypair(&ed_onion_key, sign_out,
  1179. onion_key) < 0)
  1180. goto end;
  1181. cert = tor_cert_create(&ed_onion_key, CERT_TYPE_ONION_ID, master_id_key,
  1182. now, lifetime, 0);
  1183. end:
  1184. memwipe(&ed_onion_key, 0, sizeof(ed_onion_key));
  1185. return cert;
  1186. }
  1187. /** Construct and return an RSA signature for the TAP onion key to
  1188. * cross-certify the RSA and Ed25519 identity keys. Set <b>len_out</b> to its
  1189. * length. */
  1190. uint8_t *
  1191. make_tap_onion_key_crosscert(const crypto_pk_t *onion_key,
  1192. const ed25519_public_key_t *master_id_key,
  1193. const crypto_pk_t *rsa_id_key,
  1194. int *len_out)
  1195. {
  1196. uint8_t signature[PK_BYTES];
  1197. uint8_t signed_data[DIGEST_LEN + ED25519_PUBKEY_LEN];
  1198. *len_out = 0;
  1199. if (crypto_pk_get_digest(rsa_id_key, (char*)signed_data) < 0) {
  1200. return NULL;
  1201. }
  1202. memcpy(signed_data + DIGEST_LEN, master_id_key->pubkey, ED25519_PUBKEY_LEN);
  1203. int r = crypto_pk_private_sign(onion_key,
  1204. (char*)signature, sizeof(signature),
  1205. (const char*)signed_data, sizeof(signed_data));
  1206. if (r < 0)
  1207. return NULL;
  1208. *len_out = r;
  1209. return tor_memdup(signature, r);
  1210. }
  1211. /** Check whether an RSA-TAP cross-certification is correct. Return 0 if it
  1212. * is, -1 if it isn't. */
  1213. MOCK_IMPL(int,
  1214. check_tap_onion_key_crosscert,(const uint8_t *crosscert,
  1215. int crosscert_len,
  1216. const crypto_pk_t *onion_pkey,
  1217. const ed25519_public_key_t *master_id_pkey,
  1218. const uint8_t *rsa_id_digest))
  1219. {
  1220. uint8_t *cc = tor_malloc(crypto_pk_keysize(onion_pkey));
  1221. int cc_len =
  1222. crypto_pk_public_checksig(onion_pkey,
  1223. (char*)cc,
  1224. crypto_pk_keysize(onion_pkey),
  1225. (const char*)crosscert,
  1226. crosscert_len);
  1227. if (cc_len < 0) {
  1228. goto err;
  1229. }
  1230. if (cc_len < DIGEST_LEN + ED25519_PUBKEY_LEN) {
  1231. log_warn(LD_DIR, "Short signature on cross-certification with TAP key");
  1232. goto err;
  1233. }
  1234. if (tor_memneq(cc, rsa_id_digest, DIGEST_LEN) ||
  1235. tor_memneq(cc + DIGEST_LEN, master_id_pkey->pubkey,
  1236. ED25519_PUBKEY_LEN)) {
  1237. log_warn(LD_DIR, "Incorrect cross-certification with TAP key");
  1238. goto err;
  1239. }
  1240. tor_free(cc);
  1241. return 0;
  1242. err:
  1243. tor_free(cc);
  1244. return -1;
  1245. }
  1246. void
  1247. routerkeys_free_all(void)
  1248. {
  1249. ed25519_keypair_free(master_identity_key);
  1250. ed25519_keypair_free(master_signing_key);
  1251. ed25519_keypair_free(current_auth_key);
  1252. tor_cert_free(signing_key_cert);
  1253. tor_cert_free(link_cert_cert);
  1254. tor_cert_free(auth_key_cert);
  1255. tor_free(rsa_ed_crosscert);
  1256. master_identity_key = master_signing_key = NULL;
  1257. current_auth_key = NULL;
  1258. signing_key_cert = link_cert_cert = auth_key_cert = NULL;
  1259. rsa_ed_crosscert = NULL; // redundant
  1260. rsa_ed_crosscert_len = 0;
  1261. }