onion.c 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326
  1. /* Copyright 2001,2002,2003 Roger Dingledine, Matej Pfajfar. */
  2. /* See LICENSE for licensing information */
  3. /* $Id$ */
  4. /**
  5. * \file onion.c
  6. * \brief Functions to queue create cells, and handle onionskin
  7. * parsing and creation.
  8. **/
  9. #include "or.h"
  10. extern or_options_t options; /**< command-line and config-file options */
  11. struct onion_queue_t {
  12. circuit_t *circ;
  13. struct onion_queue_t *next;
  14. };
  15. /** global (within this file) variables used by the next few functions */
  16. static struct onion_queue_t *ol_list=NULL;
  17. static struct onion_queue_t *ol_tail=NULL;
  18. /** length of ol_list */
  19. static int ol_length=0;
  20. /** Add <b>circ</b> to the end of ol_list and return 0, except
  21. * if ol_list is too long, in which case do nothing and return -1.
  22. */
  23. int onion_pending_add(circuit_t *circ) {
  24. struct onion_queue_t *tmp;
  25. tmp = tor_malloc(sizeof(struct onion_queue_t));
  26. tmp->circ = circ;
  27. tmp->next = NULL;
  28. if(!ol_tail) {
  29. tor_assert(!ol_list);
  30. tor_assert(!ol_length);
  31. ol_list = tmp;
  32. ol_tail = tmp;
  33. ol_length++;
  34. return 0;
  35. }
  36. tor_assert(ol_list);
  37. tor_assert(!ol_tail->next);
  38. if(ol_length >= options.MaxOnionsPending) {
  39. log_fn(LOG_WARN,"Already have %d onions queued. Closing.", ol_length);
  40. free(tmp);
  41. return -1;
  42. }
  43. ol_length++;
  44. ol_tail->next = tmp;
  45. ol_tail = tmp;
  46. return 0;
  47. }
  48. /** Remove the first item from ol_list and return it, or return
  49. * NULL if the list is empty.
  50. */
  51. circuit_t *onion_next_task(void) {
  52. circuit_t *circ;
  53. if(!ol_list)
  54. return NULL; /* no onions pending, we're done */
  55. tor_assert(ol_list->circ);
  56. tor_assert(ol_list->circ->p_conn); /* make sure it's still valid */
  57. tor_assert(ol_length > 0);
  58. circ = ol_list->circ;
  59. onion_pending_remove(ol_list->circ);
  60. return circ;
  61. }
  62. /** Go through ol_list, find the onion_queue_t element which points to
  63. * circ, remove and free that element. Leave circ itself alone.
  64. */
  65. void onion_pending_remove(circuit_t *circ) {
  66. struct onion_queue_t *tmpo, *victim;
  67. if(!ol_list)
  68. return; /* nothing here. */
  69. /* first check to see if it's the first entry */
  70. tmpo = ol_list;
  71. if(tmpo->circ == circ) {
  72. /* it's the first one. remove it from the list. */
  73. ol_list = tmpo->next;
  74. if(!ol_list)
  75. ol_tail = NULL;
  76. ol_length--;
  77. victim = tmpo;
  78. } else { /* we need to hunt through the rest of the list */
  79. for( ;tmpo->next && tmpo->next->circ != circ; tmpo=tmpo->next) ;
  80. if(!tmpo->next) {
  81. log_fn(LOG_DEBUG,"circ (p_circ_id %d) not in list, probably at cpuworker.",circ->p_circ_id);
  82. return;
  83. }
  84. /* now we know tmpo->next->circ == circ */
  85. victim = tmpo->next;
  86. tmpo->next = victim->next;
  87. if(ol_tail == victim)
  88. ol_tail = tmpo;
  89. ol_length--;
  90. }
  91. /* now victim points to the element that needs to be removed */
  92. free(victim);
  93. }
  94. /*----------------------------------------------------------------------*/
  95. /** Given a router's 128 byte public key,
  96. * stores the following in onion_skin_out:
  97. * - [42 bytes] OAEP padding
  98. * - [16 bytes] Symmetric key for encrypting blob past RSA
  99. * - [70 bytes] g^x part 1 (inside the RSA)
  100. * - [58 bytes] g^x part 2 (symmetrically encrypted)
  101. *
  102. * Stores the DH private key into handshake_state_out for later completion
  103. * of the handshake.
  104. *
  105. * The meeting point/cookies and auth are zeroed out for now.
  106. */
  107. int
  108. onion_skin_create(crypto_pk_env_t *dest_router_key,
  109. crypto_dh_env_t **handshake_state_out,
  110. char *onion_skin_out) /* Must be ONIONSKIN_CHALLENGE_LEN bytes */
  111. {
  112. char *challenge = NULL;
  113. crypto_dh_env_t *dh = NULL;
  114. int dhbytes, pkbytes;
  115. *handshake_state_out = NULL;
  116. memset(onion_skin_out, 0, ONIONSKIN_CHALLENGE_LEN);
  117. if (!(dh = crypto_dh_new()))
  118. goto err;
  119. dhbytes = crypto_dh_get_bytes(dh);
  120. pkbytes = crypto_pk_keysize(dest_router_key);
  121. tor_assert(dhbytes == 128);
  122. tor_assert(pkbytes == 128);
  123. challenge = tor_malloc_zero(DH_KEY_LEN);
  124. if (crypto_dh_get_public(dh, challenge, dhbytes))
  125. goto err;
  126. #ifdef DEBUG_ONION_SKINS
  127. #define PA(a,n) \
  128. { int _i; for (_i = 0; _i<n; ++_i) printf("%02x ",((int)(a)[_i])&0xFF); }
  129. printf("Client: client g^x:");
  130. PA(challenge+16,3);
  131. printf("...");
  132. PA(challenge+141,3);
  133. puts("");
  134. printf("Client: client symkey:");
  135. PA(challenge+0,16);
  136. puts("");
  137. #endif
  138. /* set meeting point, meeting cookie, etc here. Leave zero for now. */
  139. if (crypto_pk_public_hybrid_encrypt(dest_router_key, challenge,
  140. DH_KEY_LEN,
  141. onion_skin_out, PK_PKCS1_OAEP_PADDING, 1)<0)
  142. goto err;
  143. tor_free(challenge);
  144. *handshake_state_out = dh;
  145. return 0;
  146. err:
  147. tor_free(challenge);
  148. if (dh) crypto_dh_free(dh);
  149. return -1;
  150. }
  151. /** Given an encrypted DH public key as generated by onion_skin_create,
  152. * and the private key for this onion router, generate the reply (128-byte
  153. * DH plus the first 20 bytes of shared key material), and store the
  154. * next key_out_len bytes of key material in key_out.
  155. */
  156. int
  157. onion_skin_server_handshake(char *onion_skin, /* ONIONSKIN_CHALLENGE_LEN bytes */
  158. crypto_pk_env_t *private_key,
  159. crypto_pk_env_t *prev_private_key,
  160. char *handshake_reply_out, /* ONIONSKIN_REPLY_LEN bytes */
  161. char *key_out,
  162. int key_out_len)
  163. {
  164. char challenge[ONIONSKIN_CHALLENGE_LEN];
  165. crypto_dh_env_t *dh = NULL;
  166. int len;
  167. char *key_material=NULL;
  168. int i;
  169. crypto_pk_env_t *k;
  170. len = -1;
  171. for (i=0;i<2;++i) {
  172. k = i==0?private_key:prev_private_key;
  173. if (!k)
  174. break;
  175. len = crypto_pk_private_hybrid_decrypt(k,
  176. onion_skin, ONIONSKIN_CHALLENGE_LEN,
  177. challenge, PK_PKCS1_OAEP_PADDING,0);
  178. if (len>0)
  179. break;
  180. }
  181. if (len<0) {
  182. log_fn(LOG_WARN, "Couldn't decrypt onionskin: client may be using old onion key");
  183. goto err;
  184. } else if (len != DH_KEY_LEN) {
  185. log_fn(LOG_WARN, "Unexpected onionskin length after decryption: %d",
  186. len);
  187. goto err;
  188. }
  189. dh = crypto_dh_new();
  190. if (crypto_dh_get_public(dh, handshake_reply_out, DH_KEY_LEN))
  191. goto err;
  192. #ifdef DEBUG_ONION_SKINS
  193. printf("Server: server g^y:");
  194. PA(handshake_reply_out+0,3);
  195. printf("...");
  196. PA(handshake_reply_out+125,3);
  197. puts("");
  198. #endif
  199. key_material = tor_malloc(DIGEST_LEN+key_out_len);
  200. len = crypto_dh_compute_secret(dh, challenge, DH_KEY_LEN,
  201. key_material, DIGEST_LEN+key_out_len);
  202. if (len < 0)
  203. goto err;
  204. /* send back H(K|0) as proof that we learned K. */
  205. memcpy(handshake_reply_out+DH_KEY_LEN, key_material, DIGEST_LEN);
  206. /* use the rest of the key material for our shared keys, digests, etc */
  207. memcpy(key_out, key_material+DIGEST_LEN, key_out_len);
  208. #ifdef DEBUG_ONION_SKINS
  209. printf("Server: key material:");
  210. PA(buf, DH_KEY_LEN);
  211. puts("");
  212. printf("Server: keys out:");
  213. PA(key_out, key_out_len);
  214. puts("");
  215. #endif
  216. tor_free(key_material);
  217. crypto_dh_free(dh);
  218. return 0;
  219. err:
  220. tor_free(key_material);
  221. if (dh) crypto_dh_free(dh);
  222. return -1;
  223. }
  224. /** Finish the client side of the DH handshake.
  225. * Given the 128 byte DH reply + 20 byte hash as generated by
  226. * onion_skin_server_handshake and the handshake state generated by
  227. * onion_skin_create, verify H(K) with the first 20 bytes of shared
  228. * key material, then generate key_out_len more bytes of shared key
  229. * material and store them in key_out.
  230. *
  231. * After the invocation, call crypto_dh_free on handshake_state.
  232. */
  233. int
  234. onion_skin_client_handshake(crypto_dh_env_t *handshake_state,
  235. char *handshake_reply, /* Must be ONIONSKIN_REPLY_LEN bytes */
  236. char *key_out,
  237. int key_out_len)
  238. {
  239. int len;
  240. char *key_material=NULL;
  241. tor_assert(crypto_dh_get_bytes(handshake_state) == DH_KEY_LEN);
  242. #ifdef DEBUG_ONION_SKINS
  243. printf("Client: server g^y:");
  244. PA(handshake_reply+0,3);
  245. printf("...");
  246. PA(handshake_reply+125,3);
  247. puts("");
  248. #endif
  249. key_material = tor_malloc(20+key_out_len);
  250. len = crypto_dh_compute_secret(handshake_state, handshake_reply, DH_KEY_LEN,
  251. key_material, 20+key_out_len);
  252. if (len < 0)
  253. return -1;
  254. if(memcmp(key_material, handshake_reply+DH_KEY_LEN, 20)) {
  255. /* H(K) does *not* match. Something fishy. */
  256. tor_free(key_material);
  257. log_fn(LOG_WARN,"Digest DOES NOT MATCH on onion handshake. Bug or attack.");
  258. return -1;
  259. }
  260. /* use the rest of the key material for our shared keys, digests, etc */
  261. memcpy(key_out, key_material+20, key_out_len);
  262. #ifdef DEBUG_ONION_SKINS
  263. printf("Client: keys out:");
  264. PA(key_out, key_out_len);
  265. puts("");
  266. #endif
  267. tor_free(key_material);
  268. return 0;
  269. }
  270. /*
  271. Local Variables:
  272. mode:c
  273. indent-tabs-mode:nil
  274. c-basic-offset:2
  275. End:
  276. */