[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-commits] [stem/master] Check for openssl ed25519 support
commit f1312056f0a00132b19d247a4d0b53ff689b066d
Author: Damian Johnson <atagar@xxxxxxxxxxxxxx>
Date: Fri Oct 11 14:56:26 2019 -0700
Check for openssl ed25519 support
Unit tests fail with several errors, the most common of which for me is a lack
of ed25519 support in openssl...
======================================================================
ERROR: test_inner_layer
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/atagar/Desktop/stem/test/unit/descriptor/hidden_service_v3.py", line 119, in test_inner_layer
self.assertEqual(4, len(desc.introduction_points))
File "/home/atagar/Desktop/stem/stem/descriptor/__init__.py", line 1149, in __getattr__
parsing_function(self, self._entries)
File "/home/atagar/Desktop/stem/stem/descriptor/hidden_service.py", line 447, in _parse_v3_introduction_points
enc_key = X25519PublicKey.from_public_bytes(base64.b64decode(enc_key_b64))
File "/usr/local/lib/python3.5/dist-packages/cryptography/hazmat/primitives/asymmetric/x25519.py", line 22, in from_public_bytes
_Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM
cryptography.exceptions.UnsupportedAlgorithm: X25519 is not supported by this version of OpenSSL.
This is gonna require more work, but for the moment disabling these portions
when unavailable to cut down on test failures.
---
stem/descriptor/hidden_service.py | 42 +++++++++++++++++++------------
test/unit/descriptor/hidden_service_v3.py | 13 ++++++++++
2 files changed, 39 insertions(+), 16 deletions(-)
diff --git a/stem/descriptor/hidden_service.py b/stem/descriptor/hidden_service.py
index 5f97a25a..b6116358 100644
--- a/stem/descriptor/hidden_service.py
+++ b/stem/descriptor/hidden_service.py
@@ -409,6 +409,7 @@ def _parse_v3_inner_formats(descriptor, entries):
def _parse_v3_introduction_points(descriptor, entries):
+ from cryptography.hazmat.backends.openssl.backend import backend
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PublicKey
if hasattr(descriptor, '_unparsed_introduction_points'):
@@ -428,9 +429,12 @@ def _parse_v3_introduction_points(descriptor, entries):
entry = _descriptor_components(intro_point_str, False)
link_specifiers = _parse_link_specifiers(_value('introduction-point', entry))
- onion_key_line = _value('onion-key', entry)
- onion_key_b64 = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None
- onion_key = X25519PublicKey.from_public_bytes(base64.b64decode(onion_key_b64))
+ if backend.x25519_supported():
+ onion_key_line = _value('onion-key', entry)
+ onion_key_b64 = onion_key_line[5:] if onion_key_line.startswith('ntor ') else None
+ onion_key = X25519PublicKey.from_public_bytes(base64.b64decode(onion_key_b64))
+ else:
+ onion_key = None
_, block_type, auth_key_cert = entry['auth-key'][0]
auth_key_cert = Ed25519Certificate.parse(auth_key_cert)
@@ -438,9 +442,12 @@ def _parse_v3_introduction_points(descriptor, entries):
if block_type != 'ED25519 CERT':
raise ValueError('Expected auth-key to have an ed25519 certificate, but was %s' % block_type)
- enc_key_line = _value('enc-key', entry)
- enc_key_b64 = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None
- enc_key = X25519PublicKey.from_public_bytes(base64.b64decode(enc_key_b64))
+ if backend.x25519_supported():
+ enc_key_line = _value('enc-key', entry)
+ enc_key_b64 = enc_key_line[5:] if enc_key_line.startswith('ntor ') else None
+ enc_key = X25519PublicKey.from_public_bytes(base64.b64decode(enc_key_b64))
+ else:
+ enc_key = None
_, block_type, enc_key_cert = entry['enc-key-cert'][0]
enc_key_cert = Ed25519Certificate.parse(enc_key_cert)
@@ -1050,18 +1057,21 @@ class HiddenServiceDescriptorV3(BaseHiddenServiceDescriptor):
else:
self._entries = entries
- # Verify the signature!
- # First compute the body that was signed
- descriptor_signing_key = self.signing_cert.certified_ed25519_key()
- descriptor_body = raw_contents.split(b"signature")[0] # everything before the signature
- signature_body = b"Tor onion service descriptor sig v3" + descriptor_body
+ from cryptography.hazmat.backends.openssl.backend import backend
+
+ if backend.x25519_supported():
+ # Verify the signature!
+ # First compute the body that was signed
+ descriptor_signing_key = self.signing_cert.certified_ed25519_key()
+ descriptor_body = raw_contents.split(b"signature")[0] # everything before the signature
+ signature_body = b"Tor onion service descriptor sig v3" + descriptor_body
- # Decode base64 signature
- missing_padding = len(self.signature) % 4
- signature = base64.b64decode(self.signature + '=' * missing_padding)
+ # Decode base64 signature
+ missing_padding = len(self.signature) % 4
+ signature = base64.b64decode(self.signature + '=' * missing_padding)
- # Verify signature
- descriptor_signing_key.verify(signature, signature_body)
+ # Verify signature
+ descriptor_signing_key.verify(signature, signature_body)
def decrypt(self, onion_address):
"""
diff --git a/test/unit/descriptor/hidden_service_v3.py b/test/unit/descriptor/hidden_service_v3.py
index b2a58fbc..dbd5220e 100644
--- a/test/unit/descriptor/hidden_service_v3.py
+++ b/test/unit/descriptor/hidden_service_v3.py
@@ -5,6 +5,7 @@ Unit tests for stem.descriptor.hidden_service for version 3.
import functools
import unittest
+from cryptography.hazmat.backends.openssl.backend import backend
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
from cryptography.hazmat.primitives import serialization
@@ -142,6 +143,10 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase):
Check that we require the mandatory fields.
"""
+ if not backend.x25519_supported():
+ self.skipTest('(requires openssl ed25519 support)')
+ return
+
line_to_attr = {
'hs-descriptor': 'version',
'descriptor-lifetime': 'lifetime',
@@ -206,6 +211,9 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase):
elif not stem.prereq._is_sha3_available():
self.skipTest('(requires sha3 support)')
return
+ elif not backend.x25519_supported():
+ self.skipTest('(requires openssl ed25519 support)')
+ return
self.assertEqual(b'\x92\xe6\x80\xfaWU.}HL\x9d*>\xdbF\xfb\xc0v\xe5N\xa9\x0bw\xbb\x84\xe3\xe6\xd5e}R\xa1', HiddenServiceDescriptorV3._public_key_from_address(HS_ADDRESS))
self.assertRaisesWith(ValueError, "'boom.onion' isn't a valid hidden service v3 address", HiddenServiceDescriptorV3._public_key_from_address, 'boom')
@@ -238,6 +246,11 @@ class TestHiddenServiceDescriptorV3(unittest.TestCase):
this test generates is the data that onionbalance also has available when
making onion service descriptors.
"""
+
+ if not backend.x25519_supported():
+ self.skipTest('(requires openssl ed25519 support)')
+ return
+
# Build the service
private_identity_key = Ed25519PrivateKey.from_private_bytes(b"a"*32)
public_identity_key = private_identity_key.public_key()
_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits