src/or/onion.c

   1 /* Copyright 2001 Matej Pfajfar.
   2  * Copyright 2001-2004 Roger Dingledine.
   3  * Copyright 2004 Roger Dingledine, Nick Mathewson. */
   4 /* See LICENSE for licensing information */
   5 /* $Id$ */
   6 const char onion_c_id[] = "$Id$";
   7
   8 /**
   9  * \file onion.c
  10  * \brief Functions to queue create cells, and handle onionskin
  11  * parsing and creation.
  12  **/
  13
  14 #include "or.h"
  15
  16 struct onion_queue_t {
  17   circuit_t *circ;
  18   struct onion_queue_t *next;
  19 };
  20
  21 /** global (within this file) variables used by the next few functions */
  22 static struct onion_queue_t *ol_list=NULL;
  23 static struct onion_queue_t *ol_tail=NULL;
  24 /** length of ol_list */
  25 static int ol_length=0;
  26
  27 /** Add <b>circ</b> to the end of ol_list and return 0, except
  28  * if ol_list is too long, in which case do nothing and return -1.
  29  */
  30 int onion_pending_add(circuit_t *circ) {
  31   struct onion_queue_t *tmp;
  32
  33   tmp = tor_malloc_zero(sizeof(struct onion_queue_t));
  34   tmp->circ = circ;
  35
  36   if (!ol_tail) {
  37     tor_assert(!ol_list);
  38     tor_assert(!ol_length);
  39     ol_list = tmp;
  40     ol_tail = tmp;
  41     ol_length++;
  42     return 0;
  43   }
  44
  45   tor_assert(ol_list);
  46   tor_assert(!ol_tail->next);
  47
  48   if (ol_length >= get_options()->MaxOnionsPending) {
  49     log_fn(LOG_NOTICE,"Already have %d onions queued. Closing.", ol_length);
  50     tor_free(tmp);
  51     return -1;
  52   }
  53
  54   ol_length++;
  55   ol_tail->next = tmp;
  56   ol_tail = tmp;
  57   return 0;
  58 }
  59
  60 /** Remove the first item from ol_list and return it, or return
  61  * NULL if the list is empty.
  62  */
  63 circuit_t *onion_next_task(void) {
  64   circuit_t *circ;
  65
  66   if (!ol_list)
  67     return NULL; /* no onions pending, we're done */
  68
  69   tor_assert(ol_list->circ);
  70   tor_assert(ol_list->circ->p_conn); /* make sure it's still valid */
  71   tor_assert(ol_length > 0);
  72   circ = ol_list->circ;
  73   onion_pending_remove(ol_list->circ);
  74   return circ;
  75 }
  76
  77 /** Go through ol_list, find the onion_queue_t element which points to
  78  * circ, remove and free that element. Leave circ itself alone.
  79  */
  80 void onion_pending_remove(circuit_t *circ) {
  81   struct onion_queue_t *tmpo, *victim;
  82
  83   if (!ol_list)
  84     return; /* nothing here. */
  85
  86   /* first check to see if it's the first entry */
  87   tmpo = ol_list;
  88   if (tmpo->circ == circ) {
  89     /* it's the first one. remove it from the list. */
  90     ol_list = tmpo->next;
  91     if (!ol_list)
  92       ol_tail = NULL;
  93     ol_length--;
  94     victim = tmpo;
  95   } else { /* we need to hunt through the rest of the list */
  96     for ( ;tmpo->next && tmpo->next->circ != circ; tmpo=tmpo->next) ;
  97     if (!tmpo->next) {
  98       log_fn(LOG_DEBUG,"circ (p_circ_id %d) not in list, probably at cpuworker.",circ->p_circ_id);
  99       return;
 100     }
 101     /* now we know tmpo->next->circ == circ */
 102     victim = tmpo->next;
 103     tmpo->next = victim->next;
 104     if (ol_tail == victim)
 105       ol_tail = tmpo;
 106     ol_length--;
 107   }
 108
 109   /* now victim points to the element that needs to be removed */
 110
 111   tor_free(victim);
 112 }
 113
 114 /*----------------------------------------------------------------------*/
 115
 116 /** Given a router's 128 byte public key,
 117  * stores the following in onion_skin_out:
 118  *   - [42 bytes] OAEP padding
 119  *   - [16 bytes] Symmetric key for encrypting blob past RSA
 120  *   - [70 bytes] g^x part 1 (inside the RSA)
 121  *   - [58 bytes] g^x part 2 (symmetrically encrypted)
 122  *
 123  * Stores the DH private key into handshake_state_out for later completion
 124  * of the handshake.
 125  *
 126  * The meeting point/cookies and auth are zeroed out for now.
 127  */
 128 int
 129 onion_skin_create(crypto_pk_env_t *dest_router_key,
 130                   crypto_dh_env_t **handshake_state_out,
 131                   char *onion_skin_out) /* Must be ONIONSKIN_CHALLENGE_LEN bytes */
 132 {
 133   char *challenge = NULL;
 134   crypto_dh_env_t *dh = NULL;
 135   int dhbytes, pkbytes;
 136
 137   *handshake_state_out = NULL;
 138   memset(onion_skin_out, 0, ONIONSKIN_CHALLENGE_LEN);
 139
 140   if (!(dh = crypto_dh_new()))
 141     goto err;
 142
 143   dhbytes = crypto_dh_get_bytes(dh);
 144   pkbytes = crypto_pk_keysize(dest_router_key);
 145   tor_assert(dhbytes == 128);
 146   tor_assert(pkbytes == 128);
 147   challenge = tor_malloc_zero(DH_KEY_LEN);
 148
 149   if (crypto_dh_get_public(dh, challenge, dhbytes))
 150     goto err;
 151
 152 #ifdef DEBUG_ONION_SKINS
 153 #define PA(a,n) \
 154   { int _i; for (_i = 0; _i<n; ++_i) printf("%02x ",((int)(a)[_i])&0xFF); }
 155
 156   printf("Client: client g^x:");
 157   PA(challenge+16,3);
 158   printf("...");
 159   PA(challenge+141,3);
 160   puts("");
 161
 162   printf("Client: client symkey:");
 163   PA(challenge+0,16);
 164   puts("");
 165 #endif
 166
 167   /* set meeting point, meeting cookie, etc here. Leave zero for now. */
 168   if (crypto_pk_public_hybrid_encrypt(dest_router_key, onion_skin_out,
 169                                       challenge, DH_KEY_LEN,
 170                                       PK_PKCS1_OAEP_PADDING, 1)<0)
 171     goto err;
 172
 173   tor_free(challenge);
 174   *handshake_state_out = dh;
 175
 176   return 0;
 177  err:
 178   tor_free(challenge);
 179   if (dh) crypto_dh_free(dh);
 180   return -1;
 181 }
 182
 183 /** Given an encrypted DH public key as generated by onion_skin_create,
 184  * and the private key for this onion router, generate the reply (128-byte
 185  * DH plus the first 20 bytes of shared key material), and store the
 186  * next key_out_len bytes of key material in key_out.
 187  */
 188 int
 189 onion_skin_server_handshake(char *onion_skin, /* ONIONSKIN_CHALLENGE_LEN bytes */
 190                             crypto_pk_env_t *private_key,
 191                             crypto_pk_env_t *prev_private_key,
 192                             char *handshake_reply_out, /* ONIONSKIN_REPLY_LEN bytes */
 193                             char *key_out,
 194                             size_t key_out_len)
 195 {
 196   char challenge[ONIONSKIN_CHALLENGE_LEN];
 197   crypto_dh_env_t *dh = NULL;
 198   int len;
 199   char *key_material=NULL;
 200   int i;
 201   crypto_pk_env_t *k;
 202
 203   len = -1;
 204   for (i=0;i<2;++i) {
 205     k = i==0?private_key:prev_private_key;
 206     if (!k)
 207       break;
 208     len = crypto_pk_private_hybrid_decrypt(k, challenge,
 209                                            onion_skin, ONIONSKIN_CHALLENGE_LEN,
 210                                            PK_PKCS1_OAEP_PADDING,0);
 211     if (len>0)
 212       break;
 213   }
 214   if (len<0) {
 215     log_fn(LOG_INFO, "Couldn't decrypt onionskin: client may be using old onion key");
 216     goto err;
 217   } else if (len != DH_KEY_LEN) {
 218     log_fn(LOG_WARN, "Unexpected onionskin length after decryption: %d",
 219            len);
 220     goto err;
 221   }
 222
 223   dh = crypto_dh_new();
 224   if (crypto_dh_get_public(dh, handshake_reply_out, DH_KEY_LEN))
 225     goto err;
 226
 227 #ifdef DEBUG_ONION_SKINS
 228   printf("Server: server g^y:");
 229   PA(handshake_reply_out+0,3);
 230   printf("...");
 231   PA(handshake_reply_out+125,3);
 232   puts("");
 233 #endif
 234
 235   key_material = tor_malloc(DIGEST_LEN+key_out_len);
 236   len = crypto_dh_compute_secret(dh, challenge, DH_KEY_LEN,
 237                                  key_material, DIGEST_LEN+key_out_len);
 238   if (len < 0)
 239     goto err;
 240
 241   /* send back H(K|0) as proof that we learned K. */
 242   memcpy(handshake_reply_out+DH_KEY_LEN, key_material, DIGEST_LEN);
 243
 244   /* use the rest of the key material for our shared keys, digests, etc */
 245   memcpy(key_out, key_material+DIGEST_LEN, key_out_len);
 246
 247 #ifdef DEBUG_ONION_SKINS
 248   printf("Server: key material:");
 249   PA(buf, DH_KEY_LEN);
 250   puts("");
 251   printf("Server: keys out:");
 252   PA(key_out, key_out_len);
 253   puts("");
 254 #endif
 255
 256   tor_free(key_material);
 257   crypto_dh_free(dh);
 258   return 0;
 259  err:
 260   tor_free(key_material);
 261   if (dh) crypto_dh_free(dh);
 262
 263   return -1;
 264 }
 265
 266 /** Finish the client side of the DH handshake.
 267  * Given the 128 byte DH reply + 20 byte hash as generated by
 268  * onion_skin_server_handshake and the handshake state generated by
 269  * onion_skin_create, verify H(K) with the first 20 bytes of shared
 270  * key material, then generate key_out_len more bytes of shared key
 271  * material and store them in key_out.
 272  *
 273  * After the invocation, call crypto_dh_free on handshake_state.
 274  */
 275 int
 276 onion_skin_client_handshake(crypto_dh_env_t *handshake_state,
 277                             char *handshake_reply, /* Must be ONIONSKIN_REPLY_LEN bytes */
 278                             char *key_out,
 279                             size_t key_out_len)
 280 {
 281   int len;
 282   char *key_material=NULL;
 283   tor_assert(crypto_dh_get_bytes(handshake_state) == DH_KEY_LEN);
 284
 285 #ifdef DEBUG_ONION_SKINS
 286   printf("Client: server g^y:");
 287   PA(handshake_reply+0,3);
 288   printf("...");
 289   PA(handshake_reply+125,3);
 290   puts("");
 291 #endif
 292
 293   key_material = tor_malloc(20+key_out_len);
 294   len = crypto_dh_compute_secret(handshake_state, handshake_reply, DH_KEY_LEN,
 295                                  key_material, 20+key_out_len);
 296   if (len < 0)
 297     return -1;
 298
 299   if (memcmp(key_material, handshake_reply+DH_KEY_LEN, 20)) {
 300     /* H(K) does *not* match. Something fishy. */
 301     tor_free(key_material);
 302     log_fn(LOG_WARN,"Digest DOES NOT MATCH on onion handshake. Bug or attack.");
 303     return -1;
 304   }
 305
 306   /* use the rest of the key material for our shared keys, digests, etc */
 307   memcpy(key_out, key_material+20, key_out_len);
 308
 309 #ifdef DEBUG_ONION_SKINS
 310   printf("Client: keys out:");
 311   PA(key_out, key_out_len);
 312   puts("");
 313 #endif
 314
 315   tor_free(key_material);
 316   return 0;
 317 }
 318