51#include "trunnel/congestion_control.h"
52#include "trunnel/extension.h"
54static const uint8_t NTOR3_CIRC_VERIFICATION[] =
"circuit extend";
55static const size_t NTOR3_CIRC_VERIFICATION_LEN = 14;
57#define NTOR3_VERIFICATION_ARGS \
58 NTOR3_CIRC_VERIFICATION, NTOR3_CIRC_VERIFICATION_LEN
67 if (!get_master_identity_key())
86 crypto_pk_free(keys->onion_key);
87 crypto_pk_free(keys->last_onion_key);
88 ntor_key_map_free(keys->curve25519_key_map);
100 case ONION_HANDSHAKE_TYPE_TAP:
101 crypto_dh_free(state->u.tap);
104 case ONION_HANDSHAKE_TYPE_FAST:
105 fast_handshake_state_free(state->u.fast);
106 state->u.fast = NULL;
108 case ONION_HANDSHAKE_TYPE_NTOR:
109 ntor_handshake_state_free(state->u.ntor);
110 state->u.ntor = NULL;
112 case ONION_HANDSHAKE_TYPE_NTOR_V3:
113 ntor3_handshake_state_free(state->u.ntor3);
118 log_warn(
LD_BUG,
"called with unknown handshake state type %d",
135 uint8_t *onion_skin_out,
136 size_t onion_skin_out_maxlen)
141 case ONION_HANDSHAKE_TYPE_TAP:
142 if (onion_skin_out_maxlen < TAP_ONIONSKIN_CHALLENGE_LEN)
149 (
char*)onion_skin_out) < 0)
152 r = TAP_ONIONSKIN_CHALLENGE_LEN;
154 case ONION_HANDSHAKE_TYPE_FAST:
160 case ONION_HANDSHAKE_TYPE_NTOR:
163 if (!extend_info_supports_ntor(node))
173 case ONION_HANDSHAKE_TYPE_NTOR_V3:
182 uint8_t *onion_skin = NULL;
183 size_t onion_skin_len = 0;
187 NTOR3_VERIFICATION_ARGS,
190 &onion_skin, &onion_skin_len);
195 if (onion_skin_len > onion_skin_out_maxlen) {
199 memcpy(onion_skin_out, onion_skin, onion_skin_len);
201 r = (int) onion_skin_len;
207 log_warn(
LD_BUG,
"called with unknown handshake state type %d", type);
214 state_out->
tag = (uint16_t) type;
232 size_t param_request_len,
235 uint8_t **resp_msg_out,
236 size_t *resp_msg_len_out)
250 resp_msg_out, resp_msg_len_out);
266#define MAX_KEYS_TMP_LEN 128
277 const uint8_t *onion_skin,
size_t onionskin_len,
281 size_t reply_out_maxlen,
282 uint8_t *keys_out,
size_t keys_out_len,
283 uint8_t *rend_nonce_out,
287 memset(params_out, 0,
sizeof(*params_out));
290 case ONION_HANDSHAKE_TYPE_TAP:
291 if (reply_out_maxlen < TAP_ONIONSKIN_REPLY_LEN)
293 if (onionskin_len != TAP_ONIONSKIN_CHALLENGE_LEN)
296 keys->onion_key, keys->last_onion_key,
298 (
char*)keys_out, keys_out_len)<0)
300 r = TAP_ONIONSKIN_REPLY_LEN;
303 case ONION_HANDSHAKE_TYPE_FAST:
304 if (reply_out_maxlen < CREATED_FAST_LEN)
306 if (onionskin_len != CREATE_FAST_LEN)
310 r = CREATED_FAST_LEN;
313 case ONION_HANDSHAKE_TYPE_NTOR:
319 size_t keys_tmp_len = keys_out_len +
DIGEST_LEN;
321 uint8_t keys_tmp[MAX_KEYS_TMP_LEN];
324 onion_skin, keys->curve25519_key_map,
327 reply_out, keys_tmp, keys_tmp_len)<0) {
332 memcpy(keys_out, keys_tmp, keys_out_len);
333 memcpy(rend_nonce_out, keys_tmp+keys_out_len,
DIGEST_LEN);
334 memwipe(keys_tmp, 0,
sizeof(keys_tmp));
338 case ONION_HANDSHAKE_TYPE_NTOR_V3: {
339 size_t keys_tmp_len = keys_out_len +
DIGEST_LEN;
341 uint8_t keys_tmp[MAX_KEYS_TMP_LEN];
342 uint8_t *client_msg = NULL;
343 size_t client_msg_len = 0;
344 uint8_t *reply_msg = NULL;
345 size_t reply_msg_len = 0;
350 keys->curve25519_key_map,
352 &keys->my_ed_identity,
353 onion_skin, onionskin_len,
354 NTOR3_VERIFICATION_ARGS,
355 &client_msg, &client_msg_len,
365 &reply_msg_len) < 0) {
366 ntor3_server_handshake_state_free(state);
372 uint8_t *server_handshake = NULL;
373 size_t server_handshake_len = 0;
376 NTOR3_VERIFICATION_ARGS,
377 reply_msg, reply_msg_len,
378 &server_handshake, &server_handshake_len,
379 keys_tmp, keys_tmp_len) < 0) {
381 ntor3_server_handshake_state_free(state);
386 if (server_handshake_len > reply_out_maxlen) {
388 ntor3_server_handshake_state_free(state);
392 memcpy(keys_out, keys_tmp, keys_out_len);
393 memcpy(rend_nonce_out, keys_tmp+keys_out_len,
DIGEST_LEN);
394 memcpy(reply_out, server_handshake, server_handshake_len);
395 memwipe(keys_tmp, 0, keys_tmp_len);
396 memwipe(server_handshake, 0, server_handshake_len);
398 ntor3_server_handshake_state_free(state);
400 r = (int) server_handshake_len;
406 log_warn(
LD_BUG,
"called with unknown handshake state type %d", type);
424 size_t param_response_len,
464 const uint8_t *reply,
size_t reply_len,
465 uint8_t *keys_out,
size_t keys_out_len,
466 uint8_t *rend_authenticator_out,
468 const char **msg_out)
470 if (handshake_state->
tag != type)
473 memset(params_out, 0,
sizeof(*params_out));
476 case ONION_HANDSHAKE_TYPE_TAP:
477 if (reply_len != TAP_ONIONSKIN_REPLY_LEN) {
479 *msg_out =
"TAP reply was not of the correct length.";
484 (
char *)keys_out, keys_out_len,
491 case ONION_HANDSHAKE_TYPE_FAST:
492 if (reply_len != CREATED_FAST_LEN) {
494 *msg_out =
"TAP reply was not of the correct length.";
498 keys_out, keys_out_len, msg_out) < 0)
503 case ONION_HANDSHAKE_TYPE_NTOR:
506 *msg_out =
"ntor reply was not of the correct length.";
510 size_t keys_tmp_len = keys_out_len +
DIGEST_LEN;
511 uint8_t *keys_tmp = tor_malloc(keys_tmp_len);
514 keys_tmp, keys_tmp_len, msg_out) < 0) {
518 memcpy(keys_out, keys_tmp, keys_out_len);
519 memcpy(rend_authenticator_out, keys_tmp + keys_out_len,
DIGEST_LEN);
520 memwipe(keys_tmp, 0, keys_tmp_len);
524 case ONION_HANDSHAKE_TYPE_NTOR_V3: {
525 size_t keys_tmp_len = keys_out_len +
DIGEST_LEN;
526 uint8_t *keys_tmp = tor_malloc(keys_tmp_len);
527 uint8_t *server_msg = NULL;
528 size_t server_msg_len = 0;
530 handshake_state->u.ntor3,
532 NTOR3_VERIFICATION_ARGS,
533 keys_tmp, keys_tmp_len,
534 &server_msg, &server_msg_len);
550 memcpy(keys_out, keys_tmp, keys_out_len);
551 memcpy(rend_authenticator_out, keys_tmp + keys_out_len,
DIGEST_LEN);
552 memwipe(keys_tmp, 0, keys_tmp_len);
558 log_warn(
LD_BUG,
"called with unknown handshake state type %d", type);
int client_circ_negotiation_message(const extend_info_t *ei, uint8_t **msg_out, size_t *msg_len_out)
Header file for circuitbuild.c.
int congestion_control_build_ext_response(const circuit_params_t *our_params, const circuit_params_t *circ_params, uint8_t **msg_out, size_t *msg_len_out)
int congestion_control_parse_ext_request(const uint8_t *msg, const size_t msg_len)
int congestion_control_parse_ext_response(const uint8_t *msg, const size_t msg_len, circuit_params_t *params_out)
bool congestion_control_enabled(void)
Public APIs for congestion control.
Path structures for origin circuits.
int curve25519_keypair_generate(curve25519_keypair_t *keypair_out, int extra_strong)
void ed25519_pubkey_copy(ed25519_public_key_t *dest, const ed25519_public_key_t *src)
int ed25519_public_key_is_zero(const ed25519_public_key_t *pubkey)
void memwipe(void *mem, uint8_t byte, size_t sz)
Common functions for cryptographic routines.
int extend_info_supports_ntor_v3(const extend_info_t *ei)
Header for core/or/extendinfo.c.
int onion_skin_client_handshake(int type, const onion_handshake_state_t *handshake_state, const uint8_t *reply, size_t reply_len, uint8_t *keys_out, size_t keys_out_len, uint8_t *rend_authenticator_out, circuit_params_t *params_out, const char **msg_out)
static int negotiate_v3_ntor_client_circ_params(const uint8_t *param_response_msg, size_t param_response_len, circuit_params_t *params_out)
int onion_skin_create(int type, const extend_info_t *node, onion_handshake_state_t *state_out, uint8_t *onion_skin_out, size_t onion_skin_out_maxlen)
int onion_skin_server_handshake(int type, const uint8_t *onion_skin, size_t onionskin_len, const server_onion_keys_t *keys, const circuit_params_t *our_ns_params, uint8_t *reply_out, size_t reply_out_maxlen, uint8_t *keys_out, size_t keys_out_len, uint8_t *rend_nonce_out, circuit_params_t *params_out)
void server_onion_keys_free_(server_onion_keys_t *keys)
void onion_handshake_state_release(onion_handshake_state_t *state)
static int negotiate_v3_ntor_server_circ_params(const uint8_t *param_request_msg, size_t param_request_len, const circuit_params_t *our_ns_params, circuit_params_t *params_out, uint8_t **resp_msg_out, size_t *resp_msg_len_out)
server_onion_keys_t * server_onion_keys_new(void)
Header file for onion_crypto.c.
int fast_client_handshake(const fast_handshake_state_t *handshake_state, const uint8_t *handshake_reply_out, uint8_t *key_out, size_t key_out_len, const char **msg_out)
int fast_server_handshake(const uint8_t *key_in, uint8_t *handshake_reply_out, uint8_t *key_out, size_t key_out_len)
int fast_onionskin_create(fast_handshake_state_t **handshake_state_out, uint8_t *handshake_out)
Header file for onion_fast.c.
int onion_skin_ntor_client_handshake(const ntor_handshake_state_t *handshake_state, const uint8_t *handshake_reply, uint8_t *key_out, size_t key_out_len, const char **msg_out)
int onion_skin_ntor_server_handshake(const uint8_t *onion_skin, const di_digest256_map_t *private_keys, const curve25519_keypair_t *junk_keys, const uint8_t *my_node_id, uint8_t *handshake_reply_out, uint8_t *key_out, size_t key_out_len)
int onion_skin_ntor_create(const uint8_t *router_id, const curve25519_public_key_t *router_key, ntor_handshake_state_t **handshake_state_out, uint8_t *onion_skin_out)
#define NTOR_ONIONSKIN_LEN
int onion_ntor3_client_handshake(const ntor3_handshake_state_t *handshake_state, const uint8_t *handshake_reply, size_t reply_len, const uint8_t *verification, size_t verification_len, uint8_t *keys_out, size_t keys_out_len, uint8_t **message_out, size_t *message_len_out)
int onion_skin_ntor3_server_handshake_part1(const di_digest256_map_t *private_keys, const curve25519_keypair_t *junk_key, const ed25519_public_key_t *my_id, const uint8_t *client_handshake, size_t client_handshake_len, const uint8_t *verification, size_t verification_len, uint8_t **client_message_out, size_t *client_message_len_out, ntor3_server_handshake_state_t **state_out)
int onion_skin_ntor3_create(const ed25519_public_key_t *relay_id, const curve25519_public_key_t *relay_key, const uint8_t *verification, const size_t verification_len, const uint8_t *message, const size_t message_len, ntor3_handshake_state_t **handshake_state_out, uint8_t **onion_skin_out, size_t *onion_skin_len_out)
int onion_skin_ntor3_server_handshake_part2(const ntor3_server_handshake_state_t *state, const uint8_t *verification, size_t verification_len, const uint8_t *server_message, size_t server_message_len, uint8_t **handshake_out, size_t *handshake_len_out, uint8_t *keys_out, size_t keys_out_len)
Header for core/crypto/onion_ntor_v3.c.
struct ntor3_server_handshake_state_t ntor3_server_handshake_state_t
int onion_skin_TAP_client_handshake(crypto_dh_t *handshake_state, const char *handshake_reply, char *key_out, size_t key_out_len, const char **msg_out)
int onion_skin_TAP_create(crypto_pk_t *dest_router_key, crypto_dh_t **handshake_state_out, char *onion_skin_out)
int onion_skin_TAP_server_handshake(const char *onion_skin, crypto_pk_t *private_key, crypto_pk_t *prev_private_key, char *handshake_reply_out, char *key_out, size_t key_out_len)
Header file for onion_tap.c.
Master header file for Tor-specific functionality.
const uint8_t * router_get_my_id_digest(void)
void dup_onion_keys(crypto_pk_t **key, crypto_pk_t **last)
di_digest256_map_t * construct_ntor_key_map(void)
Header file for router.c.
ed25519_public_key_t ed_identity
char identity_digest[DIGEST_LEN]
curve25519_public_key_t curve25519_onion_key
#define tor_fragile_assert()