Commit 8f15423b authored by Nick Mathewson's avatar Nick Mathewson 🦀
Browse files

Do not allocate our ed-link crosscert till after tls ctx 

We need this to prevent some annoying chutney crash-at-starts
parent 3bee74c6

src/or/router.c

+8 −2
Original line number Diff line number Diff line
@@ -866,8 +866,7 @@ init_keys(void) 
  }



  /* 1d. Load all ed25519 keys */

  if (load_ed_keys(options,now) < 0 ||

      generate_ed_link_cert(options,now))

  if (load_ed_keys(options,now) < 0)

    return -1;



  /* 2. Read onion key.  Make it if none is found. */
@@ -935,6 +934,13 @@ init_keys(void) 
    return -1;

  }



  /* 3b. Get an ed25519 link certificate.  Note that we need to do this

   * after we set up the TLS context */

  if (generate_ed_link_cert(options, now) < 0) {

    log_err(LD_GENERAL,"Couldn't make link cert");

    return -1;

  }



  /* 4. Build our router descriptor. */

  /* Must be called after keys are initialized. */

  mydesc = router_get_my_descriptor();

src/or/routerkeys.c

+3 −4
Original line number Diff line number Diff line
@@ -418,9 +418,6 @@ load_ed_keys(const or_options_t *options, time_t now) 
    SET_CERT(auth_key_cert, auth_cert);

  }



  if (generate_ed_link_cert(options, now) < 0)

    FAIL("Couldn't make link cert");



  return 0;

 err:

  ed25519_keypair_free(id);
@@ -438,8 +435,10 @@ generate_ed_link_cert(const or_options_t *options, time_t now) 
  const tor_x509_cert_t *link = NULL, *id = NULL;

  tor_cert_t *link_cert = NULL;



  if (tor_tls_get_my_certs(1, &link, &id) < 0 || link == NULL)

  if (tor_tls_get_my_certs(1, &link, &id) < 0 || link == NULL) {

    log_warn(LD_OR, "Can't get my x509 link cert.");

    return -1;

  }



  const digests_t *digests = tor_x509_cert_get_cert_digests(link);

src/test/test_routerkeys.c

+6 −0
Original line number Diff line number Diff line
@@ -446,6 +446,7 @@ test_routerkeys_ed_keys_init_all(void *arg) 
  options->DataDirectory = dir;



  tt_int_op(0, ==, load_ed_keys(options, now));

  tt_int_op(0, ==, generate_ed_link_cert(options, now));

  tt_assert(get_master_identity_key());

  tt_assert(get_master_identity_key());

  tt_assert(get_master_signing_keypair());
@@ -460,6 +461,7 @@ test_routerkeys_ed_keys_init_all(void *arg) 


  /* Call load_ed_keys again, but nothing has changed. */

  tt_int_op(0, ==, load_ed_keys(options, now));

  tt_int_op(0, ==, generate_ed_link_cert(options, now));

  tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));

  tt_mem_op(&sign, ==, get_master_signing_keypair(), sizeof(sign));

  tt_mem_op(&auth, ==, get_current_auth_keypair(), sizeof(auth));
@@ -468,6 +470,7 @@ test_routerkeys_ed_keys_init_all(void *arg) 
  /* Force a reload: we make new link/auth keys. */

  routerkeys_free_all();

  tt_int_op(0, ==, load_ed_keys(options, now));

  tt_int_op(0, ==, generate_ed_link_cert(options, now));

  tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));

  tt_mem_op(&sign, ==, get_master_signing_keypair(), sizeof(sign));

  tt_assert(tor_cert_eq(link_cert, get_current_link_cert_cert()));
@@ -481,6 +484,7 @@ test_routerkeys_ed_keys_init_all(void *arg) 


  /* Force a link/auth-key regeneration by advancing time. */

  tt_int_op(0, ==, load_ed_keys(options, now+3*86400));

  tt_int_op(0, ==, generate_ed_link_cert(options, now+3*86400));

  tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));

  tt_mem_op(&sign, ==, get_master_signing_keypair(), sizeof(sign));

  tt_assert(! tor_cert_eq(link_cert, get_current_link_cert_cert()));
@@ -494,6 +498,7 @@ test_routerkeys_ed_keys_init_all(void *arg) 


  /* Force a signing-key regeneration by advancing time. */

  tt_int_op(0, ==, load_ed_keys(options, now+100*86400));

  tt_int_op(0, ==, generate_ed_link_cert(options, now+100*86400));

  tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));

  tt_mem_op(&sign, !=, get_master_signing_keypair(), sizeof(sign));

  tt_assert(! tor_cert_eq(link_cert, get_current_link_cert_cert()));
@@ -511,6 +516,7 @@ test_routerkeys_ed_keys_init_all(void *arg) 
  unlink(get_fname("test_ed_keys_init_all/keys/"

                   "ed25519_master_id_secret_key"));

  tt_int_op(0, ==, load_ed_keys(options, now));

  tt_int_op(0, ==, generate_ed_link_cert(options, now));

  tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));

  tt_mem_op(&sign, ==, get_master_signing_keypair(), sizeof(sign));

  tt_assert(! tor_cert_eq(link_cert, get_current_link_cert_cert()));