123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326 |
- /* Copyright 2001,2002,2003 Roger Dingledine, Matej Pfajfar. */
- /* See LICENSE for licensing information */
- /* $Id$ */
- /**
- * \file onion.c
- * \brief Functions to queue create cells, and handle onionskin
- * parsing and creation.
- **/
- #include "or.h"
- extern or_options_t options; /**< command-line and config-file options */
- struct onion_queue_t {
- circuit_t *circ;
- struct onion_queue_t *next;
- };
- /** global (within this file) variables used by the next few functions */
- static struct onion_queue_t *ol_list=NULL;
- static struct onion_queue_t *ol_tail=NULL;
- /** length of ol_list */
- static int ol_length=0;
- /** Add <b>circ</b> to the end of ol_list and return 0, except
- * if ol_list is too long, in which case do nothing and return -1.
- */
- int onion_pending_add(circuit_t *circ) {
- struct onion_queue_t *tmp;
- tmp = tor_malloc(sizeof(struct onion_queue_t));
- tmp->circ = circ;
- tmp->next = NULL;
- if(!ol_tail) {
- tor_assert(!ol_list);
- tor_assert(!ol_length);
- ol_list = tmp;
- ol_tail = tmp;
- ol_length++;
- return 0;
- }
- tor_assert(ol_list);
- tor_assert(!ol_tail->next);
- if(ol_length >= options.MaxOnionsPending) {
- log_fn(LOG_WARN,"Already have %d onions queued. Closing.", ol_length);
- free(tmp);
- return -1;
- }
- ol_length++;
- ol_tail->next = tmp;
- ol_tail = tmp;
- return 0;
- }
- /** Remove the first item from ol_list and return it, or return
- * NULL if the list is empty.
- */
- circuit_t *onion_next_task(void) {
- circuit_t *circ;
- if(!ol_list)
- return NULL; /* no onions pending, we're done */
- tor_assert(ol_list->circ);
- tor_assert(ol_list->circ->p_conn); /* make sure it's still valid */
- tor_assert(ol_length > 0);
- circ = ol_list->circ;
- onion_pending_remove(ol_list->circ);
- return circ;
- }
- /** Go through ol_list, find the onion_queue_t element which points to
- * circ, remove and free that element. Leave circ itself alone.
- */
- void onion_pending_remove(circuit_t *circ) {
- struct onion_queue_t *tmpo, *victim;
- if(!ol_list)
- return; /* nothing here. */
- /* first check to see if it's the first entry */
- tmpo = ol_list;
- if(tmpo->circ == circ) {
- /* it's the first one. remove it from the list. */
- ol_list = tmpo->next;
- if(!ol_list)
- ol_tail = NULL;
- ol_length--;
- victim = tmpo;
- } else { /* we need to hunt through the rest of the list */
- for( ;tmpo->next && tmpo->next->circ != circ; tmpo=tmpo->next) ;
- if(!tmpo->next) {
- log_fn(LOG_DEBUG,"circ (p_circ_id %d) not in list, probably at cpuworker.",circ->p_circ_id);
- return;
- }
- /* now we know tmpo->next->circ == circ */
- victim = tmpo->next;
- tmpo->next = victim->next;
- if(ol_tail == victim)
- ol_tail = tmpo;
- ol_length--;
- }
- /* now victim points to the element that needs to be removed */
- free(victim);
- }
- /*----------------------------------------------------------------------*/
- /** Given a router's 128 byte public key,
- * stores the following in onion_skin_out:
- * - [42 bytes] OAEP padding
- * - [16 bytes] Symmetric key for encrypting blob past RSA
- * - [70 bytes] g^x part 1 (inside the RSA)
- * - [58 bytes] g^x part 2 (symmetrically encrypted)
- *
- * Stores the DH private key into handshake_state_out for later completion
- * of the handshake.
- *
- * The meeting point/cookies and auth are zeroed out for now.
- */
- int
- onion_skin_create(crypto_pk_env_t *dest_router_key,
- crypto_dh_env_t **handshake_state_out,
- char *onion_skin_out) /* Must be ONIONSKIN_CHALLENGE_LEN bytes */
- {
- char *challenge = NULL;
- crypto_dh_env_t *dh = NULL;
- int dhbytes, pkbytes;
- *handshake_state_out = NULL;
- memset(onion_skin_out, 0, ONIONSKIN_CHALLENGE_LEN);
- if (!(dh = crypto_dh_new()))
- goto err;
- dhbytes = crypto_dh_get_bytes(dh);
- pkbytes = crypto_pk_keysize(dest_router_key);
- tor_assert(dhbytes == 128);
- tor_assert(pkbytes == 128);
- challenge = tor_malloc_zero(DH_KEY_LEN);
- if (crypto_dh_get_public(dh, challenge, dhbytes))
- goto err;
- #ifdef DEBUG_ONION_SKINS
- #define PA(a,n) \
- { int _i; for (_i = 0; _i<n; ++_i) printf("%02x ",((int)(a)[_i])&0xFF); }
- printf("Client: client g^x:");
- PA(challenge+16,3);
- printf("...");
- PA(challenge+141,3);
- puts("");
- printf("Client: client symkey:");
- PA(challenge+0,16);
- puts("");
- #endif
- /* set meeting point, meeting cookie, etc here. Leave zero for now. */
- if (crypto_pk_public_hybrid_encrypt(dest_router_key, challenge,
- DH_KEY_LEN,
- onion_skin_out, PK_PKCS1_OAEP_PADDING, 1)<0)
- goto err;
- tor_free(challenge);
- *handshake_state_out = dh;
- return 0;
- err:
- tor_free(challenge);
- if (dh) crypto_dh_free(dh);
- return -1;
- }
- /** Given an encrypted DH public key as generated by onion_skin_create,
- * and the private key for this onion router, generate the reply (128-byte
- * DH plus the first 20 bytes of shared key material), and store the
- * next key_out_len bytes of key material in key_out.
- */
- int
- onion_skin_server_handshake(char *onion_skin, /* ONIONSKIN_CHALLENGE_LEN bytes */
- crypto_pk_env_t *private_key,
- crypto_pk_env_t *prev_private_key,
- char *handshake_reply_out, /* ONIONSKIN_REPLY_LEN bytes */
- char *key_out,
- int key_out_len)
- {
- char challenge[ONIONSKIN_CHALLENGE_LEN];
- crypto_dh_env_t *dh = NULL;
- int len;
- char *key_material=NULL;
- int i;
- crypto_pk_env_t *k;
- len = -1;
- for (i=0;i<2;++i) {
- k = i==0?private_key:prev_private_key;
- if (!k)
- break;
- len = crypto_pk_private_hybrid_decrypt(k,
- onion_skin, ONIONSKIN_CHALLENGE_LEN,
- challenge, PK_PKCS1_OAEP_PADDING,0);
- if (len>0)
- break;
- }
- if (len<0) {
- log_fn(LOG_WARN, "Couldn't decrypt onionskin: client may be using old onion key");
- goto err;
- } else if (len != DH_KEY_LEN) {
- log_fn(LOG_WARN, "Unexpected onionskin length after decryption: %d",
- len);
- goto err;
- }
- dh = crypto_dh_new();
- if (crypto_dh_get_public(dh, handshake_reply_out, DH_KEY_LEN))
- goto err;
- #ifdef DEBUG_ONION_SKINS
- printf("Server: server g^y:");
- PA(handshake_reply_out+0,3);
- printf("...");
- PA(handshake_reply_out+125,3);
- puts("");
- #endif
- key_material = tor_malloc(DIGEST_LEN+key_out_len);
- len = crypto_dh_compute_secret(dh, challenge, DH_KEY_LEN,
- key_material, DIGEST_LEN+key_out_len);
- if (len < 0)
- goto err;
- /* send back H(K|0) as proof that we learned K. */
- memcpy(handshake_reply_out+DH_KEY_LEN, key_material, DIGEST_LEN);
- /* use the rest of the key material for our shared keys, digests, etc */
- memcpy(key_out, key_material+DIGEST_LEN, key_out_len);
- #ifdef DEBUG_ONION_SKINS
- printf("Server: key material:");
- PA(buf, DH_KEY_LEN);
- puts("");
- printf("Server: keys out:");
- PA(key_out, key_out_len);
- puts("");
- #endif
- tor_free(key_material);
- crypto_dh_free(dh);
- return 0;
- err:
- tor_free(key_material);
- if (dh) crypto_dh_free(dh);
- return -1;
- }
- /** Finish the client side of the DH handshake.
- * Given the 128 byte DH reply + 20 byte hash as generated by
- * onion_skin_server_handshake and the handshake state generated by
- * onion_skin_create, verify H(K) with the first 20 bytes of shared
- * key material, then generate key_out_len more bytes of shared key
- * material and store them in key_out.
- *
- * After the invocation, call crypto_dh_free on handshake_state.
- */
- int
- onion_skin_client_handshake(crypto_dh_env_t *handshake_state,
- char *handshake_reply, /* Must be ONIONSKIN_REPLY_LEN bytes */
- char *key_out,
- int key_out_len)
- {
- int len;
- char *key_material=NULL;
- tor_assert(crypto_dh_get_bytes(handshake_state) == DH_KEY_LEN);
- #ifdef DEBUG_ONION_SKINS
- printf("Client: server g^y:");
- PA(handshake_reply+0,3);
- printf("...");
- PA(handshake_reply+125,3);
- puts("");
- #endif
- key_material = tor_malloc(20+key_out_len);
- len = crypto_dh_compute_secret(handshake_state, handshake_reply, DH_KEY_LEN,
- key_material, 20+key_out_len);
- if (len < 0)
- return -1;
- if(memcmp(key_material, handshake_reply+DH_KEY_LEN, 20)) {
- /* H(K) does *not* match. Something fishy. */
- tor_free(key_material);
- log_fn(LOG_WARN,"Digest DOES NOT MATCH on onion handshake. Bug or attack.");
- return -1;
- }
- /* use the rest of the key material for our shared keys, digests, etc */
- memcpy(key_out, key_material+20, key_out_len);
- #ifdef DEBUG_ONION_SKINS
- printf("Client: keys out:");
- PA(key_out, key_out_len);
- puts("");
- #endif
- tor_free(key_material);
- return 0;
- }
- /*
- Local Variables:
- mode:c
- indent-tabs-mode:nil
- c-basic-offset:2
- End:
- */
|