[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[or-cvs] r13429: Change DNs in x509 certificates to be harder to fingerprint. (in tor/trunk: . doc src/common src/or)
Author: nickm
Date: 2008-02-08 16:13:12 -0500 (Fri, 08 Feb 2008)
New Revision: 13429
Modified:
tor/trunk/
tor/trunk/ChangeLog
tor/trunk/doc/TODO
tor/trunk/src/common/crypto.c
tor/trunk/src/common/crypto.h
tor/trunk/src/common/tortls.c
tor/trunk/src/common/tortls.h
tor/trunk/src/or/dns.c
tor/trunk/src/or/main.c
tor/trunk/src/or/router.c
Log:
r14062@tombo: nickm | 2008-02-08 15:17:07 -0500
Change DNs in x509 certificates to be harder to fingerprint. Raise common code. Refactor random hostname generation into crypto.c
Property changes on: tor/trunk
___________________________________________________________________
svk:merge ticket from /tor/trunk [r14062] on 49666b30-7950-49c5-bedf-9dc8f3168102
Modified: tor/trunk/ChangeLog
===================================================================
--- tor/trunk/ChangeLog 2008-02-08 21:13:08 UTC (rev 13428)
+++ tor/trunk/ChangeLog 2008-02-08 21:13:12 UTC (rev 13429)
@@ -18,6 +18,8 @@
o Minor features (security):
- Be slightly more paranoid about overwriting sensitive memory on free,
as a defensive programming tactic to ensure forward secrecy.
+ - Do not include recognizeable strings in the commonname part of
+ Tor's x509 certificates.
o Deprecated features (controller):
- The status/version/num-versioning and status/version/num-concurring
Modified: tor/trunk/doc/TODO
===================================================================
--- tor/trunk/doc/TODO 2008-02-08 21:13:08 UTC (rev 13428)
+++ tor/trunk/doc/TODO 2008-02-08 21:13:12 UTC (rev 13429)
@@ -75,6 +75,7 @@
cert, they adust the client ID.
o Detect.
o Adjust.
+ o Better cname and organizationName generation.
. New revised handshake: post-TLS:
o start by sending VERSIONS cells
o once we have a version, send a netinfo and become open
Modified: tor/trunk/src/common/crypto.c
===================================================================
--- tor/trunk/src/common/crypto.c 2008-02-08 21:13:08 UTC (rev 13428)
+++ tor/trunk/src/common/crypto.c 2008-02-08 21:13:12 UTC (rev 13429)
@@ -1768,6 +1768,37 @@
}
}
+/** Generate and return a new random hostname starting with prefix, ending
+ * with suffix, and containing between min_rand_len and max_rand_len random
+ * base32 characters between. */
+char *
+crypto_random_hostname(int min_rand_len, int max_rand_len, const char *prefix,
+ const char *suffix)
+{
+ char *result, *rand_bytes;
+ int randlen, resultlen, rand_bytes_len, prefixlen;
+
+ tor_assert(max_rand_len >= min_rand_len);
+ randlen = min_rand_len + crypto_rand_int(max_rand_len - min_rand_len + 1);
+ prefixlen = strlen(prefix);
+ resultlen = prefixlen + strlen(suffix) + randlen + 16;
+
+ rand_bytes_len = ((randlen*5)+7)/8;
+ if (rand_bytes_len % 5)
+ rand_bytes_len += 5 - (rand_bytes_len%5);
+ rand_bytes = tor_malloc(rand_bytes_len);
+ crypto_rand(rand_bytes, rand_bytes_len);
+
+ result = tor_malloc(resultlen);
+ memcpy(result, prefix, prefixlen);
+ base32_encode(result+prefixlen, resultlen-prefixlen,
+ rand_bytes, rand_bytes_len);
+ tor_free(rand_bytes);
+ strlcpy(result+prefixlen+randlen, suffix, resultlen-(prefixlen+randlen));
+
+ return result;
+}
+
/** Return a randomly chosen element of sl; or NULL if sl is empty.
*/
void *
Modified: tor/trunk/src/common/crypto.h
===================================================================
--- tor/trunk/src/common/crypto.h 2008-02-08 21:13:08 UTC (rev 13428)
+++ tor/trunk/src/common/crypto.h 2008-02-08 21:13:12 UTC (rev 13429)
@@ -171,6 +171,9 @@
int crypto_rand_int(unsigned int max);
uint64_t crypto_rand_uint64(uint64_t max);
+char *crypto_random_hostname(int min_rand_len, int max_rand_len,
+ const char *prefix, const char *suffix);
+
struct smartlist_t;
void *smartlist_choose(const struct smartlist_t *sl);
void smartlist_shuffle(struct smartlist_t *sl);
Modified: tor/trunk/src/common/tortls.c
===================================================================
--- tor/trunk/src/common/tortls.c 2008-02-08 21:13:08 UTC (rev 13428)
+++ tor/trunk/src/common/tortls.c 2008-02-08 21:13:12 UTC (rev 13429)
@@ -322,6 +322,24 @@
return 1;
}
+/** Return a newly allocated X509 name with commonName <b>cname</b> */
+static X509_NAME *
+tor_x509_name_new(const char *cname)
+{
+ int nid;
+ X509_NAME *name;
+ if (!(name = X509_NAME_new()))
+ return NULL;
+ if ((nid = OBJ_txt2nid("commonName")) == NID_undef) goto error;
+ if (!(X509_NAME_add_entry_by_NID(name, nid, MBSTRING_ASC,
+ (unsigned char*)cname, -1, -1, 0)))
+ goto error;
+ return name;
+ error:
+ X509_NAME_free(name);
+ return NULL;
+}
+
/** Generate and sign an X509 certificate with the public key <b>rsa</b>,
* signed by the private key <b>rsa_sign</b>. The commonName of the
* certificate will be <b>cname</b>; the commonName of the issuer will be
@@ -340,7 +358,6 @@
EVP_PKEY *sign_pkey = NULL, *pkey=NULL;
X509 *x509 = NULL;
X509_NAME *name = NULL, *name_issuer=NULL;
- int nid;
tor_tls_init();
@@ -361,31 +378,12 @@
if (!(ASN1_INTEGER_set(X509_get_serialNumber(x509), (long)start_time)))
goto error;
- if (!(name = X509_NAME_new()))
+ if (!(name = tor_x509_name_new(cname)))
goto error;
- if ((nid = OBJ_txt2nid("organizationName")) == NID_undef)
- goto error;
- if (!(X509_NAME_add_entry_by_NID(name, nid, MBSTRING_ASC,
- (unsigned char*)"t o r", -1, -1, 0)))
- goto error;
- if ((nid = OBJ_txt2nid("commonName")) == NID_undef) goto error;
- if (!(X509_NAME_add_entry_by_NID(name, nid, MBSTRING_ASC,
- (unsigned char*)cname, -1, -1, 0)))
- goto error;
if (!(X509_set_subject_name(x509, name)))
goto error;
-
- if (!(name_issuer = X509_NAME_new()))
+ if (!(name_issuer = tor_x509_name_new(cname_sign)))
goto error;
- if ((nid = OBJ_txt2nid("organizationName")) == NID_undef)
- goto error;
- if (!(X509_NAME_add_entry_by_NID(name_issuer, nid, MBSTRING_ASC,
- (unsigned char*)"t o r", -1, -1, 0)))
- goto error;
- if ((nid = OBJ_txt2nid("commonName")) == NID_undef) goto error;
- if (!(X509_NAME_add_entry_by_NID(name_issuer, nid, MBSTRING_ASC,
- (unsigned char*)cname_sign, -1, -1, 0)))
- goto error;
if (!(X509_set_issuer_name(x509, name_issuer)))
goto error;
@@ -509,20 +507,19 @@
* the new SSL context.
*/
int
-tor_tls_context_new(crypto_pk_env_t *identity, const char *nickname,
- unsigned int key_lifetime)
+tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime)
{
crypto_pk_env_t *rsa = NULL;
crypto_dh_env_t *dh = NULL;
EVP_PKEY *pkey = NULL;
tor_tls_context_t *result = NULL;
X509 *cert = NULL, *idcert = NULL;
- char nn2[128];
- if (!nickname)
- nickname = "null";
- tor_snprintf(nn2, sizeof(nn2), "%s <signing>", nickname);
+ char *nickname = NULL, *nn2 = NULL;
tor_tls_init();
+ nickname = crypto_random_hostname(8, 20, "www.", ".net");
+ nn2 = crypto_random_hostname(8, 20, "www.", ".net");
+ log_notice(LD_NET, "<%s> <%s>", nickname, nn2);
/* Generate short-term RSA key. */
if (!(rsa = crypto_new_pk_env()))
@@ -594,10 +591,14 @@
global_tls_context = result;
if (rsa)
crypto_free_pk_env(rsa);
+ tor_free(nickname);
+ tor_free(nn2);
return 0;
error:
tls_log_errors(LOG_WARN, "creating TLS context");
+ tor_free(nickname);
+ tor_free(nn2);
if (pkey)
EVP_PKEY_free(pkey);
if (rsa)
Modified: tor/trunk/src/common/tortls.h
===================================================================
--- tor/trunk/src/common/tortls.h 2008-02-08 21:13:08 UTC (rev 13428)
+++ tor/trunk/src/common/tortls.h 2008-02-08 21:13:12 UTC (rev 13429)
@@ -47,8 +47,7 @@
const char *tor_tls_err_to_string(int err);
void tor_tls_free_all(void);
-int tor_tls_context_new(crypto_pk_env_t *rsa,
- const char *nickname, unsigned int key_lifetime);
+int tor_tls_context_new(crypto_pk_env_t *rsa, unsigned int key_lifetime);
tor_tls_t *tor_tls_new(int sock, int is_server);
void tor_tls_set_renegotiate_callback(tor_tls_t *tls,
void (*cb)(tor_tls_t *, void *arg),
Modified: tor/trunk/src/or/dns.c
===================================================================
--- tor/trunk/src/or/dns.c 2008-02-08 21:13:08 UTC (rev 13428)
+++ tor/trunk/src/or/dns.c 2008-02-08 21:13:12 UTC (rev 13429)
@@ -1418,22 +1418,14 @@
static void
launch_wildcard_check(int min_len, int max_len, const char *suffix)
{
- char random_bytes[20], name[64], *addr;
- size_t len;
+ char *addr;
int r;
- len = min_len + crypto_rand_int(max_len-min_len+1);
- if (crypto_rand(random_bytes, sizeof(random_bytes)) < 0)
- return;
- base32_encode(name, sizeof(name), random_bytes, sizeof(random_bytes));
- name[len] = '\0';
- strlcat(name, suffix, sizeof(name));
-
+ addr = crypto_random_hostname(min_len, max_len, "", suffix);
log_info(LD_EXIT, "Testing whether our DNS server is hijacking nonexistent "
- "domains with request for bogus hostname \"%s\"", name);
+ "domains with request for bogus hostname \"%s\"", addr);
- addr = tor_strdup(name);
- r = evdns_resolve_ipv4(name, DNS_QUERY_NO_SEARCH,
+ r = evdns_resolve_ipv4(addr, DNS_QUERY_NO_SEARCH,
evdns_wildcard_check_callback, addr);
if (r)
tor_free(addr);
Modified: tor/trunk/src/or/main.c
===================================================================
--- tor/trunk/src/or/main.c 2008-02-08 21:13:08 UTC (rev 13428)
+++ tor/trunk/src/or/main.c 2008-02-08 21:13:12 UTC (rev 13429)
@@ -886,8 +886,7 @@
last_rotated_x509_certificate = now;
if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME < now) {
log_info(LD_GENERAL,"Rotating tls context.");
- if (tor_tls_context_new(get_identity_key(), options->Nickname,
- MAX_SSL_KEY_LIFETIME) < 0) {
+ if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) {
log_warn(LD_BUG, "Error reinitializing TLS context");
/* XXX is it a bug here, that we just keep going? -RD */
}
Modified: tor/trunk/src/or/router.c
===================================================================
--- tor/trunk/src/or/router.c 2008-02-08 21:13:08 UTC (rev 13428)
+++ tor/trunk/src/or/router.c 2008-02-08 21:13:12 UTC (rev 13429)
@@ -403,9 +403,7 @@
}
set_identity_key(prkey);
/* Create a TLS context; default the client nickname to "client". */
- if (tor_tls_context_new(get_identity_key(),
- options->Nickname ? options->Nickname : "client",
- MAX_SSL_KEY_LIFETIME) < 0) {
+ if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) {
log_err(LD_GENERAL,"Error creating TLS context for Tor client.");
return -1;
}
@@ -483,8 +481,7 @@
tor_free(keydir);
/* 3. Initialize link key and TLS context. */
- if (tor_tls_context_new(get_identity_key(), options->Nickname,
- MAX_SSL_KEY_LIFETIME) < 0) {
+ if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) {
log_err(LD_GENERAL,"Error initializing TLS context");
return -1;
}