tor  0.4.2.0-alpha-dev
routerkeys.c
Go to the documentation of this file.
1 /* Copyright (c) 2014-2019, The Tor Project, Inc. */
2 /* See LICENSE for licensing information */
3 
17 #include "core/or/or.h"
18 #include "app/config/config.h"
19 #include "feature/relay/router.h"
20 #include "feature/relay/routerkeys.h"
22 #include "feature/keymgt/loadkey.h"
23 #include "feature/nodelist/torcert.h"
24 
26 #include "lib/tls/tortls.h"
27 #include "lib/tls/x509.h"
28 
29 #define ENC_KEY_HEADER "Boxed Ed25519 key"
30 #define ENC_KEY_TAG "master"
31 
32 #ifdef HAVE_UNISTD_H
33 #include <unistd.h>
34 #endif
35 
36 static ed25519_keypair_t *master_identity_key = NULL;
37 static ed25519_keypair_t *master_signing_key = NULL;
38 static ed25519_keypair_t *current_auth_key = NULL;
39 static tor_cert_t *signing_key_cert = NULL;
40 static tor_cert_t *link_cert_cert = NULL;
41 static tor_cert_t *auth_key_cert = NULL;
42 
43 static uint8_t *rsa_ed_crosscert = NULL;
44 static size_t rsa_ed_crosscert_len = 0;
45 static time_t rsa_ed_crosscert_expiration = 0;
46 
54 int
55 load_ed_keys(const or_options_t *options, time_t now)
56 {
57  ed25519_keypair_t *id = NULL;
58  ed25519_keypair_t *sign = NULL;
59  ed25519_keypair_t *auth = NULL;
60  const ed25519_keypair_t *sign_signing_key_with_id = NULL;
61  const ed25519_keypair_t *use_signing = NULL;
62  const tor_cert_t *check_signing_cert = NULL;
63  tor_cert_t *sign_cert = NULL;
64  tor_cert_t *auth_cert = NULL;
65  int signing_key_changed = 0;
66 
67  // It is later than 1972, since otherwise there would be no C compilers.
68  // (Try to diagnose #22466.)
69  tor_assert_nonfatal(now >= 2 * 365 * 86400);
70 
71 #define FAIL(msg) do { \
72  log_warn(LD_OR, (msg)); \
73  goto err; \
74  } while (0)
75 #define SET_KEY(key, newval) do { \
76  if ((key) != (newval)) \
77  ed25519_keypair_free(key); \
78  key = (newval); \
79  } while (0)
80 #define SET_CERT(cert, newval) do { \
81  if ((cert) != (newval)) \
82  tor_cert_free(cert); \
83  cert = (newval); \
84  } while (0)
85 #define HAPPENS_SOON(when, interval) \
86  ((when) < now + (interval))
87 #define EXPIRES_SOON(cert, interval) \
88  (!(cert) || HAPPENS_SOON((cert)->valid_until, (interval)))
89 
90  /* XXXX support encrypted identity keys fully */
91 
92  /* First try to get the signing key to see how it is. */
93  {
94  char *fname =
95  options_get_keydir_fname(options, "ed25519_signing");
96  sign = ed_key_init_from_file(
97  fname,
98  INIT_ED_KEY_NEEDCERT|
99  INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT,
100  LOG_INFO,
101  NULL, 0, 0, CERT_TYPE_ID_SIGNING, &sign_cert, options);
102  tor_free(fname);
103  check_signing_cert = sign_cert;
104  use_signing = sign;
105  }
106 
107  if (use_signing) {
108  /* We loaded a signing key with its certificate. */
109  if (! master_signing_key) {
110  /* We didn't know one before! */
111  signing_key_changed = 1;
112  } else if (! ed25519_pubkey_eq(&use_signing->pubkey,
113  &master_signing_key->pubkey) ||
114  ! tor_memeq(use_signing->seckey.seckey,
115  master_signing_key->seckey.seckey,
116  ED25519_SECKEY_LEN)) {
117  /* We loaded a different signing key than the one we knew before. */
118  signing_key_changed = 1;
119  }
120  }
121 
122  if (!use_signing && master_signing_key) {
123  /* We couldn't load a signing key, but we already had one loaded */
124  check_signing_cert = signing_key_cert;
125  use_signing = master_signing_key;
126  }
127 
128  const int offline_master =
129  options->OfflineMasterKey && options->command != CMD_KEYGEN;
130  const int need_new_signing_key =
131  NULL == use_signing ||
132  EXPIRES_SOON(check_signing_cert, 0) ||
133  (options->command == CMD_KEYGEN && ! options->change_key_passphrase);
134  const int want_new_signing_key =
135  need_new_signing_key ||
136  EXPIRES_SOON(check_signing_cert, options->TestingSigningKeySlop);
137 
138  /* We can only create a master key if we haven't been told that the
139  * master key will always be offline. Also, if we have a signing key,
140  * then we shouldn't make a new master ID key. */
141  const int can_make_master_id_key = !offline_master &&
142  NULL == use_signing;
143 
144  if (need_new_signing_key) {
145  log_notice(LD_OR, "It looks like I need to generate and sign a new "
146  "medium-term signing key, because %s. To do that, I "
147  "need to load%s the permanent master identity key. "
148  "If the master identity key was not moved or encrypted "
149  "with a passphrase, this will be done automatically and "
150  "no further action is required. Otherwise, provide the "
151  "necessary data using 'tor --keygen' to do it manually.",
152  (NULL == use_signing) ? "I don't have one" :
153  EXPIRES_SOON(check_signing_cert, 0) ? "the one I have is expired" :
154  "you asked me to make one with --keygen",
155  can_make_master_id_key ? " (or create)" : "");
156  } else if (want_new_signing_key && !offline_master) {
157  log_notice(LD_OR, "It looks like I should try to generate and sign a "
158  "new medium-term signing key, because the one I have is "
159  "going to expire soon. To do that, I'm going to have to "
160  "try to load the permanent master identity key. "
161  "If the master identity key was not moved or encrypted "
162  "with a passphrase, this will be done automatically and "
163  "no further action is required. Otherwise, provide the "
164  "necessary data using 'tor --keygen' to do it manually.");
165  } else if (want_new_signing_key) {
166  log_notice(LD_OR, "It looks like I should try to generate and sign a "
167  "new medium-term signing key, because the one I have is "
168  "going to expire soon. But OfflineMasterKey is set, so I "
169  "won't try to load a permanent master identity key. You "
170  "will need to use 'tor --keygen' to make a new signing "
171  "key and certificate.");
172  }
173 
174  {
175  uint32_t flags =
176  (INIT_ED_KEY_SPLIT|
177  INIT_ED_KEY_EXTRA_STRONG|INIT_ED_KEY_NO_REPAIR);
178  if (can_make_master_id_key)
179  flags |= INIT_ED_KEY_CREATE;
180  if (! need_new_signing_key)
181  flags |= INIT_ED_KEY_MISSING_SECRET_OK;
182  if (! want_new_signing_key || offline_master)
183  flags |= INIT_ED_KEY_OMIT_SECRET;
184  if (offline_master)
185  flags |= INIT_ED_KEY_OFFLINE_SECRET;
186  if (options->command == CMD_KEYGEN)
187  flags |= INIT_ED_KEY_TRY_ENCRYPTED;
188 
189  /* Check/Create the key directory */
190  if (create_keys_directory(options) < 0)
191  goto err;
192 
193  char *fname;
194  if (options->master_key_fname) {
195  fname = tor_strdup(options->master_key_fname);
196  flags |= INIT_ED_KEY_EXPLICIT_FNAME;
197  } else {
198  fname = options_get_keydir_fname(options, "ed25519_master_id");
199  }
201  fname,
202  flags,
203  LOG_WARN, NULL, 0, 0, 0, NULL, options);
204  tor_free(fname);
205  if (!id) {
206  if (need_new_signing_key) {
207  if (offline_master)
208  FAIL("Can't load master identity key; OfflineMasterKey is set.");
209  else
210  FAIL("Missing identity key");
211  } else {
212  log_warn(LD_OR, "Master public key was absent; inferring from "
213  "public key in signing certificate and saving to disk.");
214  tor_assert(check_signing_cert);
215  id = tor_malloc_zero(sizeof(*id));
216  memcpy(&id->pubkey, &check_signing_cert->signing_key,
217  sizeof(ed25519_public_key_t));
218  fname = options_get_keydir_fname(options,
219  "ed25519_master_id_public_key");
220  if (ed25519_pubkey_write_to_file(&id->pubkey, fname, "type0") < 0) {
221  log_warn(LD_OR, "Error while attempting to write master public key "
222  "to disk");
223  tor_free(fname);
224  goto err;
225  }
226  tor_free(fname);
227  }
228  }
229  if (safe_mem_is_zero((char*)id->seckey.seckey, sizeof(id->seckey)))
230  sign_signing_key_with_id = NULL;
231  else
232  sign_signing_key_with_id = id;
233  }
234 
235  if (master_identity_key &&
236  !ed25519_pubkey_eq(&id->pubkey, &master_identity_key->pubkey)) {
237  FAIL("Identity key on disk does not match key we loaded earlier!");
238  }
239 
240  if (need_new_signing_key && NULL == sign_signing_key_with_id)
241  FAIL("Can't load master key make a new signing key.");
242 
243  if (sign_cert) {
244  if (! sign_cert->signing_key_included)
245  FAIL("Loaded a signing cert with no key included!");
246  if (! ed25519_pubkey_eq(&sign_cert->signing_key, &id->pubkey))
247  FAIL("The signing cert we have was not signed with the master key "
248  "we loaded!");
249  if (tor_cert_checksig(sign_cert, &id->pubkey, 0) < 0) {
250  log_warn(LD_OR, "The signing cert we loaded was not signed "
251  "correctly: %s!",
253  goto err;
254  }
255  }
256 
257  if (want_new_signing_key && sign_signing_key_with_id) {
258  uint32_t flags = (INIT_ED_KEY_CREATE|
259  INIT_ED_KEY_REPLACE|
260  INIT_ED_KEY_EXTRA_STRONG|
261  INIT_ED_KEY_NEEDCERT|
262  INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT);
263  char *fname =
264  options_get_keydir_fname(options, "ed25519_signing");
265  ed25519_keypair_free(sign);
266  tor_cert_free(sign_cert);
267  sign = ed_key_init_from_file(fname,
268  flags, LOG_WARN,
269  sign_signing_key_with_id, now,
270  options->SigningKeyLifetime,
271  CERT_TYPE_ID_SIGNING, &sign_cert, options);
272  tor_free(fname);
273  if (!sign)
274  FAIL("Missing signing key");
275  use_signing = sign;
276  signing_key_changed = 1;
277 
278  tor_assert(sign_cert->signing_key_included);
279  tor_assert(ed25519_pubkey_eq(&sign_cert->signing_key, &id->pubkey));
280  tor_assert(ed25519_pubkey_eq(&sign_cert->signed_key, &sign->pubkey));
281  } else if (want_new_signing_key) {
282  static ratelim_t missing_master = RATELIM_INIT(3600);
283  log_fn_ratelim(&missing_master, LOG_WARN, LD_OR,
284  "Signing key will expire soon, but I can't load the "
285  "master key to sign a new one!");
286  }
287 
288  tor_assert(use_signing);
289 
290  /* At this point we no longer need our secret identity key. So wipe
291  * it, if we loaded it in the first place. */
292  memwipe(id->seckey.seckey, 0, sizeof(id->seckey));
293 
294  if (options->command == CMD_KEYGEN)
295  goto end;
296 
297  if (server_mode(options) &&
298  (!rsa_ed_crosscert ||
299  HAPPENS_SOON(rsa_ed_crosscert_expiration, 30*86400))) {
300  uint8_t *crosscert;
301  time_t expiration = now+6*30*86400; /* 6 months in the future. */
302  ssize_t crosscert_len = tor_make_rsa_ed25519_crosscert(&id->pubkey,
303  get_server_identity_key(),
304  expiration,
305  &crosscert);
306  tor_free(rsa_ed_crosscert);
307  rsa_ed_crosscert_len = crosscert_len;
308  rsa_ed_crosscert = crosscert;
309  rsa_ed_crosscert_expiration = expiration;
310  }
311 
312  if (!current_auth_key ||
313  signing_key_changed ||
314  EXPIRES_SOON(auth_key_cert, options->TestingAuthKeySlop)) {
315  auth = ed_key_new(use_signing, INIT_ED_KEY_NEEDCERT,
316  now,
317  options->TestingAuthKeyLifetime,
318  CERT_TYPE_SIGNING_AUTH, &auth_cert);
319 
320  if (!auth)
321  FAIL("Can't create auth key");
322  }
323 
324  /* We've generated or loaded everything. Put them in memory. */
325 
326  end:
327  if (! master_identity_key) {
328  SET_KEY(master_identity_key, id);
329  } else {
330  tor_free(id);
331  }
332  if (sign) {
333  SET_KEY(master_signing_key, sign);
334  SET_CERT(signing_key_cert, sign_cert);
335  }
336  if (auth) {
337  SET_KEY(current_auth_key, auth);
338  SET_CERT(auth_key_cert, auth_cert);
339  }
340 
341  return signing_key_changed;
342  err:
343  ed25519_keypair_free(id);
344  ed25519_keypair_free(sign);
345  ed25519_keypair_free(auth);
346  tor_cert_free(sign_cert);
347  tor_cert_free(auth_cert);
348  return -1;
349 }
350 
364 int
365 generate_ed_link_cert(const or_options_t *options, time_t now,
366  int force)
367 {
368  const tor_x509_cert_t *link_ = NULL, *id = NULL;
369  tor_cert_t *link_cert = NULL;
370 
371  if (tor_tls_get_my_certs(1, &link_, &id) < 0 || link_ == NULL) {
372  if (!server_mode(options)) {
373  /* No need to make an Ed25519->Link cert: we are a client */
374  return 0;
375  }
376  log_warn(LD_OR, "Can't get my x509 link cert.");
377  return -1;
378  }
379 
380  const common_digests_t *digests = tor_x509_cert_get_cert_digests(link_);
381 
382  if (force == 0 &&
383  link_cert_cert &&
384  ! EXPIRES_SOON(link_cert_cert, options->TestingLinkKeySlop) &&
385  fast_memeq(digests->d[DIGEST_SHA256], link_cert_cert->signed_key.pubkey,
386  DIGEST256_LEN)) {
387  return 0;
388  }
389 
390  ed25519_public_key_t dummy_key;
391  memcpy(dummy_key.pubkey, digests->d[DIGEST_SHA256], DIGEST256_LEN);
392 
393  link_cert = tor_cert_create(get_master_signing_keypair(),
394  CERT_TYPE_SIGNING_LINK,
395  &dummy_key,
396  now,
397  options->TestingLinkCertLifetime, 0);
398 
399  if (link_cert) {
400  SET_CERT(link_cert_cert, link_cert);
401  }
402  return 0;
403 }
404 
405 #undef FAIL
406 #undef SET_KEY
407 #undef SET_CERT
408 
420 int
421 should_make_new_ed_keys(const or_options_t *options, const time_t now)
422 {
423  if (!master_identity_key ||
424  !master_signing_key ||
425  !current_auth_key ||
426  !link_cert_cert ||
427  EXPIRES_SOON(signing_key_cert, options->TestingSigningKeySlop) ||
428  EXPIRES_SOON(auth_key_cert, options->TestingAuthKeySlop) ||
429  EXPIRES_SOON(link_cert_cert, options->TestingLinkKeySlop))
430  return 1;
431 
432  const tor_x509_cert_t *link_ = NULL, *id = NULL;
433 
434  if (tor_tls_get_my_certs(1, &link_, &id) < 0 || link_ == NULL)
435  return 1;
436 
437  const common_digests_t *digests = tor_x509_cert_get_cert_digests(link_);
438 
439  if (!fast_memeq(digests->d[DIGEST_SHA256],
440  link_cert_cert->signed_key.pubkey,
441  DIGEST256_LEN)) {
442  return 1;
443  }
444 
445  return 0;
446 }
447 
448 #undef EXPIRES_SOON
449 #undef HAPPENS_SOON
450 
451 #ifdef TOR_UNIT_TESTS
452 /* Helper for unit tests: populate the ed25519 keys without saving or
453  * loading */
454 void
455 init_mock_ed_keys(const crypto_pk_t *rsa_identity_key)
456 {
457  routerkeys_free_all();
458 
459 #define MAKEKEY(k) \
460  k = tor_malloc_zero(sizeof(*k)); \
461  if (ed25519_keypair_generate(k, 0) < 0) { \
462  log_warn(LD_BUG, "Couldn't make a keypair"); \
463  goto err; \
464  }
465  MAKEKEY(master_identity_key);
466  MAKEKEY(master_signing_key);
467  MAKEKEY(current_auth_key);
468 #define MAKECERT(cert, signing, signed_, type, flags) \
469  cert = tor_cert_create(signing, \
470  type, \
471  &signed_->pubkey, \
472  time(NULL), 86400, \
473  flags); \
474  if (!cert) { \
475  log_warn(LD_BUG, "Couldn't make a %s certificate!", #cert); \
476  goto err; \
477  }
478 
479  MAKECERT(signing_key_cert,
480  master_identity_key, master_signing_key, CERT_TYPE_ID_SIGNING,
481  CERT_FLAG_INCLUDE_SIGNING_KEY);
482  MAKECERT(auth_key_cert,
483  master_signing_key, current_auth_key, CERT_TYPE_SIGNING_AUTH, 0);
484 
485  if (generate_ed_link_cert(get_options(), time(NULL), 0) < 0) {
486  log_warn(LD_BUG, "Couldn't make link certificate");
487  goto err;
488  }
489 
490  rsa_ed_crosscert_len = tor_make_rsa_ed25519_crosscert(
491  &master_identity_key->pubkey,
492  rsa_identity_key,
493  time(NULL)+86400,
494  &rsa_ed_crosscert);
495 
496  return;
497 
498  err:
499  routerkeys_free_all();
500  tor_assert_nonfatal_unreached();
501 }
502 #undef MAKEKEY
503 #undef MAKECERT
504 #endif /* defined(TOR_UNIT_TESTS) */
505 
513 static void
514 print_cert_expiration(const char *expiration,
515  const char *description)
516 {
517  fprintf(stderr, "%s-cert-expiry: %s\n", description, expiration);
518 }
519 
524 static void
526  const char *description,
527  const char *fname) {
528  char expiration[ISO_TIME_LEN+1];
529 
530  if (BUG(!cert)) { /* If the specified key hasn't been loaded */
531  log_warn(LD_OR, "No %s key loaded; can't get certificate expiration.",
532  description);
533  } else {
534  format_local_iso_time(expiration, cert->valid_until);
535  log_notice(LD_OR, "The %s certificate stored in %s is valid until %s.",
536  description, fname, expiration);
537  print_cert_expiration(expiration, description);
538  }
539 }
540 
547 static int
549 {
550  const tor_cert_t *signing_key;
551  char *fn = NULL;
552  int failed = 0;
553  time_t now = approx_time();
554 
555  fn = options_get_keydir_fname(options, "ed25519_signing_cert");
556 
557  /* Try to grab our cached copy of the key. */
558  signing_key = get_master_signing_key_cert();
559 
561 
562  /* Load our keys from disk, if necessary. */
563  if (!signing_key) {
564  failed = load_ed_keys(options, now) < 0;
565  signing_key = get_master_signing_key_cert();
566  }
567 
568  /* If we do have a signing key, log the expiration time. */
569  if (signing_key) {
570  log_ed_cert_expiration(signing_key, "signing", fn);
571  } else {
572  log_warn(LD_OR, "Could not load signing key certificate from %s, so " \
573  "we couldn't learn anything about certificate expiration.", fn);
574  }
575 
576  tor_free(fn);
577 
578  return failed;
579 }
580 
592 int
594 {
595  const or_options_t *options = get_options();
596  const char *arg = options->command_arg;
597 
598  if (!strcmp(arg, "sign")) {
600  } else {
601  fprintf(stderr, "No valid argument to --key-expiration found!\n");
602  fprintf(stderr, "Currently recognised arguments are: 'sign'\n");
603 
604  return -1;
605  }
606 }
607 
608 const ed25519_public_key_t *
609 get_master_identity_key(void)
610 {
611  if (!master_identity_key)
612  return NULL;
613  return &master_identity_key->pubkey;
614 }
615 
617 int
619 {
620  return id && master_identity_key &&
621  ed25519_pubkey_eq(id, &master_identity_key->pubkey);
622 }
623 
624 #ifdef TOR_UNIT_TESTS
625 /* only exists for the unit tests, since otherwise the identity key
626  * should be used to sign nothing but the signing key. */
627 const ed25519_keypair_t *
628 get_master_identity_keypair(void)
629 {
630  return master_identity_key;
631 }
632 #endif /* defined(TOR_UNIT_TESTS) */
633 
634 MOCK_IMPL(const ed25519_keypair_t *,
635 get_master_signing_keypair,(void))
636 {
637  return master_signing_key;
638 }
639 
640 MOCK_IMPL(const struct tor_cert_st *,
641 get_master_signing_key_cert,(void))
642 {
643  return signing_key_cert;
644 }
645 
646 const ed25519_keypair_t *
647 get_current_auth_keypair(void)
648 {
649  return current_auth_key;
650 }
651 
652 const tor_cert_t *
653 get_current_link_cert_cert(void)
654 {
655  return link_cert_cert;
656 }
657 
658 const tor_cert_t *
659 get_current_auth_key_cert(void)
660 {
661  return auth_key_cert;
662 }
663 
664 void
665 get_master_rsa_crosscert(const uint8_t **cert_out,
666  size_t *size_out)
667 {
668  *cert_out = rsa_ed_crosscert;
669  *size_out = rsa_ed_crosscert_len;
670 }
671 
675 tor_cert_t *
677  const ed25519_public_key_t *master_id_key, time_t now, time_t lifetime,
678  int *sign_out)
679 {
680  tor_cert_t *cert = NULL;
681  ed25519_keypair_t ed_onion_key;
682 
683  if (ed25519_keypair_from_curve25519_keypair(&ed_onion_key, sign_out,
684  onion_key) < 0)
685  goto end;
686 
687  cert = tor_cert_create(&ed_onion_key, CERT_TYPE_ONION_ID, master_id_key,
688  now, lifetime, 0);
689 
690  end:
691  memwipe(&ed_onion_key, 0, sizeof(ed_onion_key));
692  return cert;
693 }
694 
698 uint8_t *
700  const ed25519_public_key_t *master_id_key,
701  const crypto_pk_t *rsa_id_key,
702  int *len_out)
703 {
704  uint8_t signature[PK_BYTES];
705  uint8_t signed_data[DIGEST_LEN + ED25519_PUBKEY_LEN];
706 
707  *len_out = 0;
708  if (crypto_pk_get_digest(rsa_id_key, (char*)signed_data) < 0) {
709  log_info(LD_OR, "crypto_pk_get_digest failed in "
710  "make_tap_onion_key_crosscert!");
711  return NULL;
712  }
713  memcpy(signed_data + DIGEST_LEN, master_id_key->pubkey, ED25519_PUBKEY_LEN);
714 
715  int r = crypto_pk_private_sign(onion_key,
716  (char*)signature, sizeof(signature),
717  (const char*)signed_data, sizeof(signed_data));
718  if (r < 0) {
719  /* It's probably missing the private key */
720  log_info(LD_OR, "crypto_pk_private_sign failed in "
721  "make_tap_onion_key_crosscert!");
722  return NULL;
723  }
724 
725  *len_out = r;
726 
727  return tor_memdup(signature, r);
728 }
729 
730 void
731 routerkeys_free_all(void)
732 {
733  ed25519_keypair_free(master_identity_key);
734  ed25519_keypair_free(master_signing_key);
735  ed25519_keypair_free(current_auth_key);
736  tor_cert_free(signing_key_cert);
737  tor_cert_free(link_cert_cert);
738  tor_cert_free(auth_key_cert);
739  tor_free(rsa_ed_crosscert);
740 
741  master_identity_key = master_signing_key = NULL;
742  current_auth_key = NULL;
743  signing_key_cert = link_cert_cert = auth_key_cert = NULL;
744  rsa_ed_crosscert = NULL; // redundant
745  rsa_ed_crosscert_len = 0;
746 }
ed25519_keypair_t * ed_key_new(const ed25519_keypair_t *signing_key, uint32_t flags, time_t now, time_t lifetime, uint8_t cert_type, struct tor_cert_st **cert_out)
Definition: loadkey.c:719
int TestingLinkCertLifetime
ed25519_public_key_t signed_key
Definition: torcert.h:25
int crypto_pk_private_sign(const crypto_pk_t *env, char *to, size_t tolen, const char *from, size_t fromlen)
#define options_get_keydir_fname(options, sub1)
Definition: config.h:132
int tor_cert_checksig(tor_cert_t *cert, const ed25519_public_key_t *pubkey, time_t now)
Definition: torcert.c:244
int TestingAuthKeyLifetime
void format_local_iso_time(char *buf, time_t t)
Definition: time_fmt.c:285
int server_identity_key_is_set(void)
Definition: router.c:392
static int log_master_signing_key_cert_expiration(const or_options_t *options)
Definition: routerkeys.c:548
#define LOG_INFO
Definition: log.h:42
time_t valid_until
Definition: torcert.h:30
int ed25519_keypair_from_curve25519_keypair(ed25519_keypair_t *out, int *signbit_out, const curve25519_keypair_t *inp)
Header file for config.c.
tor_cert_t * tor_cert_create(const ed25519_keypair_t *signing_key, uint8_t cert_type, const ed25519_public_key_t *signed_key, time_t now, time_t lifetime, uint32_t flags)
Definition: torcert.c:131
ed25519_public_key_t signing_key
Definition: torcert.h:28
#define tor_free(p)
Definition: malloc.h:52
int TestingSigningKeySlop
void memwipe(void *mem, uint8_t byte, size_t sz)
Definition: crypto_util.c:57
unsigned signing_key_included
Definition: torcert.h:40
#define PK_BYTES
Definition: crypto_rsa.h:24
Header file for loadkey.c.
#define DIGEST256_LEN
Definition: digest_sizes.h:23
int ed25519_pubkey_eq(const ed25519_public_key_t *key1, const ed25519_public_key_t *key2)
Common functions for cryptographic routines.
tor_assert(buffer)
ssize_t tor_make_rsa_ed25519_crosscert(const ed25519_public_key_t *ed_key, const crypto_pk_t *rsa_key, time_t expires, uint8_t **cert)
Definition: torcert.c:331
int TestingAuthKeySlop
Header file for routermode.c.
uint8_t seckey[ED25519_SECKEY_LEN]
int tor_memeq(const void *a, const void *b, size_t sz)
Definition: di_ops.c:107
#define DIGEST_LEN
Definition: digest_sizes.h:20
int TestingLinkKeySlop
int load_ed_keys(const or_options_t *options, time_t now)
Definition: routerkeys.c:55
static void log_ed_cert_expiration(const tor_cert_t *cert, const char *description, const char *fname)
Definition: routerkeys.c:525
Master header file for Tor-specific functionality.
int should_make_new_ed_keys(const or_options_t *options, const time_t now)
Definition: routerkeys.c:421
uint8_t * make_tap_onion_key_crosscert(const crypto_pk_t *onion_key, const ed25519_public_key_t *master_id_key, const crypto_pk_t *rsa_id_key, int *len_out)
Definition: routerkeys.c:699
#define LOG_WARN
Definition: log.h:50
#define log_fn_ratelim(ratelim, severity, domain, args,...)
Definition: log.h:277
#define LD_OR
Definition: log.h:89
int router_ed25519_id_is_me(const ed25519_public_key_t *id)
Definition: routerkeys.c:618
Headers for tortls.c.
enum or_options_t::@27 command
const char * tor_cert_describe_signature_status(const tor_cert_t *cert)
Definition: torcert.c:279
const common_digests_t * tor_x509_cert_get_cert_digests(const tor_x509_cert_t *cert)
Definition: x509.c:68
int generate_ed_link_cert(const or_options_t *options, time_t now, int force)
Definition: routerkeys.c:365
tor_cert_t * make_ntor_onion_key_crosscert(const curve25519_keypair_t *onion_key, const ed25519_public_key_t *master_id_key, time_t now, time_t lifetime, int *sign_out)
Definition: routerkeys.c:676
int create_keys_directory(const or_options_t *options)
Definition: config.c:1378
int crypto_pk_get_digest(const crypto_pk_t *pk, char *digest_out)
Definition: crypto_rsa.c:356
char * command_arg
Definition: or_options_st.h:39
Header file for router.c.
int ed25519_pubkey_write_to_file(const ed25519_public_key_t *pubkey, const char *filename, const char *tag)
Headers for tortls.c.
time_t approx_time(void)
Definition: approx_time.c:32
int SigningKeyLifetime
int safe_mem_is_zero(const void *mem, size_t sz)
Definition: di_ops.c:221
int log_cert_expiration(void)
Definition: routerkeys.c:593
ed25519_keypair_t * ed_key_init_from_file(const char *fname, uint32_t flags, int severity, const ed25519_keypair_t *signing_key, time_t now, time_t lifetime, uint8_t cert_type, struct tor_cert_st **cert_out, const or_options_t *options)
Definition: loadkey.c:379
int tor_tls_get_my_certs(int server, const tor_x509_cert_t **link_cert_out, const tor_x509_cert_t **id_cert_out)
Definition: tortls.c:71
#define LD_BUG
Definition: log.h:83
static void print_cert_expiration(const char *expiration, const char *description)
Definition: routerkeys.c:514