17 #include "testsupport.h" 20 typedef struct tor_tls_t tor_tls_t;
23 typedef struct tor_x509_cert_t tor_x509_cert_t;
26 #define MIN_TOR_TLS_ERROR_VAL_ -9 27 #define TOR_TLS_ERROR_MISC -9 29 #define TOR_TLS_ERROR_IO -8 30 #define TOR_TLS_ERROR_CONNREFUSED -7 31 #define TOR_TLS_ERROR_CONNRESET -6 32 #define TOR_TLS_ERROR_NO_ROUTE -5 33 #define TOR_TLS_ERROR_TIMEOUT -4 34 #define TOR_TLS_CLOSE -3 35 #define TOR_TLS_WANTREAD -2 36 #define TOR_TLS_WANTWRITE -1 37 #define TOR_TLS_DONE 0 41 #define CASE_TOR_TLS_ERROR_ANY_NONIO \ 42 case TOR_TLS_ERROR_MISC: \ 43 case TOR_TLS_ERROR_CONNREFUSED: \ 44 case TOR_TLS_ERROR_CONNRESET: \ 45 case TOR_TLS_ERROR_NO_ROUTE: \ 46 case TOR_TLS_ERROR_TIMEOUT 50 #define CASE_TOR_TLS_ERROR_ANY \ 51 CASE_TOR_TLS_ERROR_ANY_NONIO: \ 54 #define TOR_TLS_IS_ERROR(rv) ((rv) < TOR_TLS_CLOSE) 57 #define TOR_TLS_MAGIC 0x71571571 60 TOR_TLS_ST_HANDSHAKE, TOR_TLS_ST_OPEN, TOR_TLS_ST_GOTCLOSE,
61 TOR_TLS_ST_SENTCLOSE, TOR_TLS_ST_CLOSED, TOR_TLS_ST_RENEGOTIATE,
62 TOR_TLS_ST_BUFFEREVENT
64 #define tor_tls_state_bitfield_t ENUM_BF(tor_tls_state_t) 69 struct ssl_session_st;
74 typedef struct tor_tls_context_t {
76 struct ssl_ctx_st *ctx;
77 tor_x509_cert_t *my_link_cert;
78 tor_x509_cert_t *my_id_cert;
79 tor_x509_cert_t *my_auth_cert;
85 struct tor_x509_cert_t {
89 unsigned pkey_digests_set : 1;
99 tor_tls_context_t *context;
103 tor_tls_state_bitfield_t state : 3;
106 unsigned int isServer:1;
107 unsigned int wasV2Handshake:1;
113 unsigned int got_renegotiate:1;
116 int8_t client_cipher_list_type;
118 uint8_t server_handshake_count;
124 unsigned long last_write_count;
125 unsigned long last_read_count;
128 void (*negotiated_callback)(tor_tls_t *tls,
void *arg);
135 const char *doing,
int severity,
int domain);
138 #ifdef TORTLS_OPENSSL_PRIVATE 141 STACK_OF(SSL_CIPHER) *peer_ciphers);
144 MOCK_DECL(STATIC
void, try_to_extract_certs_from_tls,
145 (
int severity, tor_tls_t *tls,
struct x509_st **cert_out,
146 struct x509_st **id_cert_out));
147 #ifndef HAVE_SSL_SESSION_GET_MASTER_KEY 148 STATIC
size_t SSL_SESSION_get_master_key(
struct ssl_session_st *s,
156 #ifdef TORTLS_OPENSSL_PRIVATE 159 STACK_OF(SSL_CIPHER) *peer_ciphers,
160 CONST_IF_OPENSSL_1_1_API SSL_CIPHER **cipher,
165 MOCK_DECL(STATIC
struct x509_st *, tor_tls_create_certificate,
169 const char *cname_sign,
170 unsigned int cert_lifetime));
172 unsigned int key_lifetime,
unsigned flags,
int is_client);
173 MOCK_DECL(STATIC tor_x509_cert_t *, tor_x509_cert_new,
174 (
struct x509_st *x509_cert));
177 unsigned int key_lifetime,
180 STATIC
void tls_log_errors(tor_tls_t *tls,
int severity,
int domain,
183 #ifdef TOR_UNIT_TESTS 186 extern tor_tls_context_t *client_tls_context;
187 extern uint16_t v2_cipher_list[];
191 STATIC tor_x509_cert_t *tor_x509_cert_replace_expiration(
192 const tor_x509_cert_t *inp,
193 time_t new_expiration_time,
205 #define TOR_TLS_CTX_IS_PUBLIC_SERVER (1u<<0) 206 #define TOR_TLS_CTX_USE_ECDHE_P256 (1u<<1) 207 #define TOR_TLS_CTX_USE_ECDHE_P224 (1u<<2) 212 unsigned int key_lifetime);
216 void (*cb)(tor_tls_t *,
void *arg),
220 #define tor_tls_free(tls) FREE_AND_NULL(tor_tls_t, tor_tls_free_, (tls)) 222 MOCK_DECL(tor_x509_cert_t *,tor_tls_get_peer_cert,(tor_tls_t *tls));
223 MOCK_DECL(tor_x509_cert_t *,tor_tls_get_own_cert,(tor_tls_t *tls));
226 tor_tls_t *tls, time_t now,
228 int future_tolerance);
229 MOCK_DECL(
int, tor_tls_read, (tor_tls_t *tls,
char *cp,
size_t len));
241 size_t *n_read,
size_t *n_written);
244 size_t *rbuf_capacity,
size_t *rbuf_bytes,
245 size_t *wbuf_capacity,
size_t *wbuf_bytes);
247 MOCK_DECL(
double, tls_get_write_overhead_ratio, (
void));
252 MOCK_DECL(
int,tor_tls_get_tlssecrets,(tor_tls_t *tls, uint8_t *secrets_out));
253 MOCK_DECL(
int,tor_tls_export_key_material,(
254 tor_tls_t *tls, uint8_t *secrets_out,
255 const uint8_t *context,
261 #define check_no_tls_errors() check_no_tls_errors_(__FILE__,__LINE__) 265 int severity,
int domain,
const char *doing);
268 #define tor_x509_cert_free(c) \ 269 FREE_AND_NULL(tor_x509_cert_t, tor_x509_cert_free_, (c)) 271 size_t certificate_len);
273 const uint8_t **encoded_out,
size_t *size_out);
275 const tor_x509_cert_t *cert);
277 const tor_x509_cert_t *cert);
279 const tor_x509_cert_t **link_cert_out,
280 const tor_x509_cert_t **id_cert_out);
283 MOCK_DECL(
int,tor_tls_cert_matches_key,(
const tor_tls_t *tls,
284 const tor_x509_cert_t *cert));
286 const tor_x509_cert_t *cert,
287 const tor_x509_cert_t *signing_cert,
290 const char *tor_tls_get_ciphersuite_name(tor_tls_t *tls);
void tor_tls_block_renegotiation(tor_tls_t *tls)
Definition: tortls.c:1806
STATIC int tor_tls_context_init_one(tor_tls_context_t **ppcontext, crypto_pk_t *identity, unsigned int key_lifetime, unsigned int flags, int is_client)
Definition: tortls.c:1085
void check_no_tls_errors_(const char *fname, int line)
Definition: tortls.c:2443
STATIC tor_tls_context_t * server_tls_context
Definition: tortls.c:164
tor_x509_cert_t * tor_x509_cert_dup(const tor_x509_cert_t *cert)
Definition: tortls.c:764
Definition: crypto_digest.h:74
int tor_tls_check_lifetime(int severity, tor_tls_t *tls, time_t now, int past_tolerance, int future_tolerance)
Definition: tortls.c:2295
int evaluate_ecgroup_for_tls(const char *ecgroup)
Definition: tortls.c:2642
STATIC int tor_tls_session_secret_cb(SSL *ssl, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, CONST_IF_OPENSSL_1_1_API SSL_CIPHER **cipher, void *arg)
Definition: tortls.c:1645
STATIC int find_cipher_by_id(const SSL *ssl, const SSL_METHOD *m, uint16_t cipher)
Definition: tortls.c:1387
int tor_tls_shutdown(tor_tls_t *tls)
Definition: tortls.c:2037
tor_tls_t * tor_tls_new(int sock, int is_server)
Definition: tortls.c:1675
STATIC int tor_errno_to_tls_error(int e)
Definition: tortls.c:274
void tor_x509_cert_free_(tor_x509_cert_t *cert)
Definition: tortls.c:693
void tor_x509_cert_get_der(const tor_x509_cert_t *cert, const uint8_t **encoded_out, size_t *size_out)
Definition: tortls.c:813
int tor_tls_get_buffer_sizes(tor_tls_t *tls, size_t *rbuf_capacity, size_t *rbuf_bytes, size_t *wbuf_capacity, size_t *wbuf_bytes)
Definition: tortls.c:2611
crypto_pk_t * tor_tls_cert_get_key(tor_x509_cert_t *cert)
Definition: tortls.c:897
STATIC void tor_tls_debug_state_callback(const SSL *ssl, int type, int val)
Definition: tortls.c:1331
Headers for crypto_rsa.c.
STATIC int tor_tls_object_ex_data_index
Definition: tortls.c:129
tor_x509_cert_t * tor_x509_cert_decode(const uint8_t *certificate, size_t certificate_len)
Definition: tortls.c:775
MOCK_DECL(int, router_have_minimum_dir_info,(void))
STATIC void tor_tls_server_info_callback(const SSL *ssl, int type, int val)
Definition: tortls.c:1579
crypto_pk_t * tor_tls_get_my_client_auth_key(void)
Definition: tortls.c:885
int tor_tls_context_init(unsigned flags, crypto_pk_t *client_identity, crypto_pk_t *server_identity, unsigned int key_lifetime)
Definition: tortls.c:1021
STATIC tor_tls_t * tor_tls_get_by_ssl(const SSL *ssl)
Definition: tortls.c:145
int tor_tls_server_got_renegotiate(tor_tls_t *tls)
Definition: tortls.c:2471
STATIC void tor_tls_allocate_tor_tls_object_ex_data_index(void)
Definition: tortls.c:133
void tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls)
Definition: tortls.c:1817
int tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_t **identity)
Definition: tortls.c:2242
void tor_tls_get_state_description(tor_tls_t *tls, char *buf, size_t sz)
Definition: tortls.c:178
void tor_tls_free_all(void)
Definition: tortls.c:424
int tor_tls_used_v1_handshake(tor_tls_t *tls)
Definition: tortls.c:2455
const common_digests_t * tor_x509_cert_get_cert_digests(const tor_x509_cert_t *cert)
Definition: tortls.c:836
STATIC uint64_t total_bytes_written_by_tls
Definition: tortls.c:1904
void tor_tls_unblock_renegotiation(tor_tls_t *tls)
Definition: tortls.c:1793
void tor_tls_set_renegotiate_callback(tor_tls_t *tls, void(*cb)(tor_tls_t *, void *arg), void *arg)
Definition: tortls.c:1775
void tor_tls_free_(tor_tls_t *tls)
Definition: tortls.c:1841
int tor_tls_handshake(tor_tls_t *tls)
Definition: tortls.c:1946
int tor_tls_finish_handshake(tor_tls_t *tls)
Definition: tortls.c:1997
STATIC uint64_t total_bytes_written_over_tls
Definition: tortls.c:1901
int tor_tls_get_num_server_handshakes(tor_tls_t *tls)
Definition: tortls.c:2463
void tor_tls_log_one_error(tor_tls_t *tls, unsigned long err, int severity, int domain, const char *doing)
Definition: tortls.c:213
void tor_tls_set_logged_address(tor_tls_t *tls, const char *address)
Definition: tortls.c:1763
int tor_tls_peer_has_cert(tor_tls_t *tls)
Definition: tortls.c:2098
Definition: crypto_rsa.c:41
STATIC void tls_log_errors(tor_tls_t *tls, int severity, int domain, const char *doing)
Definition: tortls.c:262
STATIC int tor_tls_client_is_using_v2_ciphers(const SSL *ssl)
Definition: tortls.c:1555
int tor_tls_is_server(tor_tls_t *tls)
Definition: tortls.c:1831
STATIC tor_tls_context_t * tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, unsigned flags, int is_client)
Definition: tortls.c:1121
size_t tor_tls_get_forced_write_size(tor_tls_t *tls)
Definition: tortls.c:2375
STATIC int tor_tls_get_error(tor_tls_t *tls, int r, int extra, const char *doing, int severity, int domain)
Definition: tortls.c:325
int tor_tls_write(tor_tls_t *tls, const char *cp, size_t n)
Definition: tortls.c:1912
void tor_tls_get_n_raw_bytes(tor_tls_t *tls, size_t *n_read, size_t *n_written)
Definition: tortls.c:2384
int tor_tls_get_pending_bytes(tor_tls_t *tls)
Definition: tortls.c:2366
int tor_tls_get_my_certs(int server, const tor_x509_cert_t **link_cert_out, const tor_x509_cert_t **id_cert_out)
Definition: tortls.c:866
const common_digests_t * tor_x509_cert_get_id_digests(const tor_x509_cert_t *cert)
Definition: tortls.c:826
const char * tor_tls_err_to_string(int err)
Definition: tortls.c:293
int tor_tls_cert_is_valid(int severity, const tor_x509_cert_t *cert, const tor_x509_cert_t *signing_cert, time_t now, int check_rsa_1024)
Definition: tortls.c:946
STATIC int always_accept_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
Definition: tortls.c:445
compatibility definitions for working with different openssl forks
STATIC int tor_tls_classify_client_ciphers(const SSL *ssl, STACK_OF(SSL_CIPHER) *peer_ciphers)
Definition: tortls.c:1473