|
@@ -1440,100 +1440,8 @@ typedef struct connection_t {
|
|
|
* signs. */
|
|
|
#define V3_AUTH_BODY_LEN (V3_AUTH_FIXED_PART_LEN + 8 + 16)
|
|
|
|
|
|
-/** Structure to hold all the certificates we've received on an OR connection
|
|
|
- */
|
|
|
-typedef struct or_handshake_certs_t {
|
|
|
- /** True iff we originated this connection. */
|
|
|
- int started_here;
|
|
|
- /** The cert for the 'auth' RSA key that's supposed to sign the AUTHENTICATE
|
|
|
- * cell. Signed with the RSA identity key. */
|
|
|
- tor_x509_cert_t *auth_cert;
|
|
|
- /** The cert for the 'link' RSA key that was used to negotiate the TLS
|
|
|
- * connection. Signed with the RSA identity key. */
|
|
|
- tor_x509_cert_t *link_cert;
|
|
|
- /** A self-signed identity certificate: the RSA identity key signed
|
|
|
- * with itself. */
|
|
|
- tor_x509_cert_t *id_cert;
|
|
|
- /** The Ed25519 signing key, signed with the Ed25519 identity key. */
|
|
|
- struct tor_cert_st *ed_id_sign;
|
|
|
- /** A digest of the X509 link certificate for the TLS connection, signed
|
|
|
- * with the Ed25519 siging key. */
|
|
|
- struct tor_cert_st *ed_sign_link;
|
|
|
- /** The Ed25519 authentication key (that's supposed to sign an AUTHENTICATE
|
|
|
- * cell) , signed with the Ed25519 siging key. */
|
|
|
- struct tor_cert_st *ed_sign_auth;
|
|
|
- /** The Ed25519 identity key, crosssigned with the RSA identity key. */
|
|
|
- uint8_t *ed_rsa_crosscert;
|
|
|
- /** The length of <b>ed_rsa_crosscert</b> in bytes */
|
|
|
- size_t ed_rsa_crosscert_len;
|
|
|
-} or_handshake_certs_t;
|
|
|
-
|
|
|
-/** Stores flags and information related to the portion of a v2/v3 Tor OR
|
|
|
- * connection handshake that happens after the TLS handshake is finished.
|
|
|
- */
|
|
|
-typedef struct or_handshake_state_t {
|
|
|
- /** When was the VERSIONS cell sent on this connection? Used to get
|
|
|
- * an estimate of the skew in the returning NETINFO reply. */
|
|
|
- time_t sent_versions_at;
|
|
|
- /** True iff we originated this connection */
|
|
|
- unsigned int started_here : 1;
|
|
|
- /** True iff we have received and processed a VERSIONS cell. */
|
|
|
- unsigned int received_versions : 1;
|
|
|
- /** True iff we have received and processed an AUTH_CHALLENGE cell */
|
|
|
- unsigned int received_auth_challenge : 1;
|
|
|
- /** True iff we have received and processed a CERTS cell. */
|
|
|
- unsigned int received_certs_cell : 1;
|
|
|
- /** True iff we have received and processed an AUTHENTICATE cell */
|
|
|
- unsigned int received_authenticate : 1;
|
|
|
-
|
|
|
- /* True iff we've received valid authentication to some identity. */
|
|
|
- unsigned int authenticated : 1;
|
|
|
- unsigned int authenticated_rsa : 1;
|
|
|
- unsigned int authenticated_ed25519 : 1;
|
|
|
-
|
|
|
- /* True iff we have sent a netinfo cell */
|
|
|
- unsigned int sent_netinfo : 1;
|
|
|
-
|
|
|
- /** The signing->ed25519 link certificate corresponding to the x509
|
|
|
- * certificate we used on the TLS connection (if this is a server-side
|
|
|
- * connection). We make a copy of this here to prevent a race condition
|
|
|
- * caused by TLS context rotation. */
|
|
|
- struct tor_cert_st *own_link_cert;
|
|
|
-
|
|
|
- /** True iff we should feed outgoing cells into digest_sent and
|
|
|
- * digest_received respectively.
|
|
|
- *
|
|
|
- * From the server's side of the v3 handshake, we want to capture everything
|
|
|
- * from the VERSIONS cell through and including the AUTH_CHALLENGE cell.
|
|
|
- * From the client's, we want to capture everything from the VERSIONS cell
|
|
|
- * through but *not* including the AUTHENTICATE cell.
|
|
|
- *
|
|
|
- * @{ */
|
|
|
- unsigned int digest_sent_data : 1;
|
|
|
- unsigned int digest_received_data : 1;
|
|
|
- /**@}*/
|
|
|
-
|
|
|
- /** Identity RSA digest that we have received and authenticated for our peer
|
|
|
- * on this connection. */
|
|
|
- uint8_t authenticated_rsa_peer_id[DIGEST_LEN];
|
|
|
- /** Identity Ed25519 public key that we have received and authenticated for
|
|
|
- * our peer on this connection. */
|
|
|
- ed25519_public_key_t authenticated_ed25519_peer_id;
|
|
|
-
|
|
|
- /** Digests of the cells that we have sent or received as part of a V3
|
|
|
- * handshake. Used for making and checking AUTHENTICATE cells.
|
|
|
- *
|
|
|
- * @{
|
|
|
- */
|
|
|
- crypto_digest_t *digest_sent;
|
|
|
- crypto_digest_t *digest_received;
|
|
|
- /** @} */
|
|
|
-
|
|
|
- /** Certificates that a connection initiator sent us in a CERTS cell; we're
|
|
|
- * holding on to them until we get an AUTHENTICATE cell.
|
|
|
- */
|
|
|
- or_handshake_certs_t *certs;
|
|
|
-} or_handshake_state_t;
|
|
|
+typedef struct or_handshake_certs_t or_handshake_certs_t;
|
|
|
+typedef struct or_handshake_state_t or_handshake_state_t;
|
|
|
|
|
|
/** Length of Extended ORPort connection identifier. */
|
|
|
#define EXT_OR_CONN_ID_LEN DIGEST_LEN /* 20 */
|