From 8c585cce3987b04335acc6eebaa9ded3216b6e13 Mon Sep 17 00:00:00 2001 From: Nathan Freitas Date: Tue, 29 Sep 2009 00:44:39 -0400 Subject: [PATCH 1/5] Include util.h and log.h as relative paths. This shouldn't be necessary, but apparently the Android cross-compiler doesn't respect -I as well as it should. (-I is supposed to add to the *front* of the search path. Android's gcc wrapper apparently likes to add to the end. This is broken, but we need to work around it.) --- src/common/crypto.c | 4 ++-- src/or/buffers.c | 2 ++ src/or/eventdns.c | 1 + src/or/or.h | 2 +- src/tools/tor-checkkey.c | 2 +- src/tools/tor-gencert.c | 4 ++-- src/tools/tor-resolve.c | 4 ++-- 7 files changed, 11 insertions(+), 8 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 4a61d3faf3..2927aa2b5b 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -50,9 +50,9 @@ #define CRYPTO_PRIVATE #include "crypto.h" -#include "log.h" +#include "../common/log.h" #include "aes.h" -#include "util.h" +#include "../common/util.h" #include "container.h" #include "compat.h" diff --git a/src/or/buffers.c b/src/or/buffers.c index e5123732cf..1a1b2077cc 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -12,6 +12,8 @@ **/ #define BUFFERS_PRIVATE #include "or.h" +#include "../common/util.h" +#include "../common/log.h" #ifdef HAVE_UNISTD_H #include #endif diff --git a/src/or/eventdns.c b/src/or/eventdns.c index edccb4bfa6..83bff671aa 100644 --- a/src/or/eventdns.c +++ b/src/or/eventdns.c @@ -31,6 +31,7 @@ */ #include "eventdns_tor.h" +#include "../common/util.h" #include /* #define NDEBUG */ diff --git a/src/or/or.h b/src/or/or.h index 0162e31f01..613de1ab03 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -82,7 +82,7 @@ #include "crypto.h" #include "tortls.h" -#include "log.h" +#include "../common/log.h" #include "compat.h" #include "container.h" #include "util.h" diff --git a/src/tools/tor-checkkey.c b/src/tools/tor-checkkey.c index 6416dbfbb3..739f7332df 100644 --- a/src/tools/tor-checkkey.c +++ b/src/tools/tor-checkkey.c @@ -7,7 +7,7 @@ #include #include "crypto.h" #include "log.h" -#include "util.h" +#include "../common/util.h" #include "compat.h" #include #include diff --git a/src/tools/tor-gencert.c b/src/tools/tor-gencert.c index 2ae4cc22ec..9ade76397a 100644 --- a/src/tools/tor-gencert.c +++ b/src/tools/tor-gencert.c @@ -27,8 +27,8 @@ #define CRYPTO_PRIVATE #include "compat.h" -#include "util.h" -#include "log.h" +#include "../common/util.h" +#include "../common/log.h" #include "crypto.h" #include "address.h" diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index f12c3d8dd3..fe7f793dbb 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -6,9 +6,9 @@ #include "orconfig.h" #include "compat.h" -#include "util.h" +#include "../common/util.h" #include "address.h" -#include "log.h" +#include "../common/log.h" #include #include From 76d26ae52d655e9fd0549eacbba9c7e2d5c05cc4 Mon Sep 17 00:00:00 2001 From: Nathan Freitas Date: Tue, 29 Sep 2009 00:46:53 -0400 Subject: [PATCH 2/5] Disable OpenSSL engines when building for Android. Apparently the Android developers dumped OpenSSL's support for hardware acceleration in order to save some memory, so you can't build programs using engines on Android. [Patch revised by nickm] --- src/common/crypto.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/common/crypto.c b/src/common/crypto.c index 2927aa2b5b..e9333bca2b 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -62,6 +62,11 @@ #include +#ifdef ANDROID +/* Android's OpenSSL seems to have removed all of its Engine support. */ +#define DISABLE_ENGINES +#endif + #if OPENSSL_VERSION_NUMBER < 0x00908000l /* On OpenSSL versions before 0.9.8, there is no working SHA256 * implementation, so we use Tom St Denis's nice speedy one, slightly adapted @@ -174,6 +179,7 @@ crypto_log_errors(int severity, const char *doing) } } +#ifndef DISABLE_ENGINES /** Log any OpenSSL engines we're using at NOTICE. */ static void log_engine(const char *fn, ENGINE *e) @@ -188,7 +194,9 @@ log_engine(const char *fn, ENGINE *e) log(LOG_INFO, LD_CRYPTO, "Using default implementation for %s", fn); } } +#endif +#ifndef DISABLE_ENGINES /** Try to load an engine in a shared library via fully qualified path. */ static ENGINE * @@ -206,6 +214,7 @@ try_load_engine(const char *path, const char *engine) } return e; } +#endif /** Initialize the crypto library. Return 0 on success, -1 on failure. */ @@ -218,10 +227,17 @@ crypto_global_init(int useAccel, const char *accelName, const char *accelDir) _crypto_global_initialized = 1; setup_openssl_threading(); if (useAccel > 0) { +#ifdef DISABLE_ENGINES + (void)accelName; + (void)accelDir; + log_warn(LD_CRYPTO, "No OpenSSL hardware acceleration support enabled."); +#else ENGINE *e = NULL; + log_info(LD_CRYPTO, "Initializing OpenSSL engine support."); ENGINE_load_builtin_engines(); ENGINE_register_all_complete(); + if (accelName) { if (accelDir) { log_info(LD_CRYPTO, "Trying to load dynamic OpenSSL engine \"%s\"" @@ -251,6 +267,7 @@ crypto_global_init(int useAccel, const char *accelName, const char *accelDir) log_engine("SHA1", ENGINE_get_digest_engine(NID_sha1)); log_engine("3DES", ENGINE_get_cipher_engine(NID_des_ede3_ecb)); log_engine("AES", ENGINE_get_cipher_engine(NID_aes_128_ecb)); +#endif } else { log_info(LD_CRYPTO, "NOT using OpenSSL engine support."); } @@ -274,7 +291,11 @@ crypto_global_cleanup(void) EVP_cleanup(); ERR_remove_state(0); ERR_free_strings(); + +#ifndef DISABLE_ENGINES ENGINE_cleanup(); +#endif + CONF_modules_unload(1); CRYPTO_cleanup_all_ex_data(); #ifdef TOR_IS_MULTITHREADED From cfba9c01bf37a3c2f67b18275522df81c081e898 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Tue, 29 Sep 2009 00:48:45 -0400 Subject: [PATCH 3/5] Alter keygen function to generate keys of different lengths. --- src/common/crypto.c | 13 +++++++------ src/common/crypto.h | 4 +++- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index e9333bca2b..581d1ba5a0 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -337,7 +337,8 @@ _crypto_new_pk_env_evp_pkey(EVP_PKEY *pkey) return _crypto_new_pk_env_rsa(rsa); } -/** Helper, used by tor-checkkey.c. Return the RSA from a crypto_pk_env_t. */ +/** Helper, used by tor-checkkey.c and tor-gencert.c. Return the RSA from a + * crypto_pk_env_t. */ RSA * _crypto_pk_env_get_rsa(crypto_pk_env_t *env) { @@ -472,11 +473,11 @@ crypto_free_cipher_env(crypto_cipher_env_t *env) /* public key crypto */ -/** Generate a new public/private keypair in env. Return 0 on - * success, -1 on failure. +/** Generate a bits-bit new public/private keypair in env. + * Return 0 on success, -1 on failure. */ int -crypto_pk_generate_key(crypto_pk_env_t *env) +crypto_pk_generate_key_with_bits(crypto_pk_env_t *env, int bits) { tor_assert(env); @@ -484,7 +485,7 @@ crypto_pk_generate_key(crypto_pk_env_t *env) RSA_free(env->key); #if OPENSSL_VERSION_NUMBER < 0x00908000l /* In OpenSSL 0.9.7, RSA_generate_key is all we have. */ - env->key = RSA_generate_key(PK_BYTES*8,65537, NULL, NULL); + env->key = RSA_generate_key(bits, 65537, NULL, NULL); #else /* In OpenSSL 0.9.8, RSA_generate_key is deprecated. */ { @@ -497,7 +498,7 @@ crypto_pk_generate_key(crypto_pk_env_t *env) r = RSA_new(); if (!r) goto done; - if (RSA_generate_key_ex(r, PK_BYTES*8, e, NULL) == -1) + if (RSA_generate_key_ex(r, bits, e, NULL) == -1) goto done; env->key = r; diff --git a/src/common/crypto.h b/src/common/crypto.h index 515b870f3d..f0958a8073 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -86,7 +86,9 @@ crypto_cipher_env_t *crypto_new_cipher_env(void); void crypto_free_cipher_env(crypto_cipher_env_t *env); /* public key crypto */ -int crypto_pk_generate_key(crypto_pk_env_t *env); +int crypto_pk_generate_key_with_bits(crypto_pk_env_t *env, int bits); +#define crypto_pk_generate_key(env) \ + crypto_pk_generate_key_with_bits((env), (PK_BYTES*8)) int crypto_pk_read_private_key_from_filename(crypto_pk_env_t *env, const char *keyfile); From d4717957646d9a2f97dd3ca6139e13f67b9b5ff0 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Tue, 29 Sep 2009 00:49:43 -0400 Subject: [PATCH 4/5] Make tor-gencert build on Android Previously, tor-gencert would call RSA_generate_key() directly. This won't work on Android, which removes the (deprecated since OpenSSL 0.9.8) function. We can't call RSA_generate_key_ex() unconditionally either, since that didn't exist before 0.9.8. Instead, we must call our own crypto_pk_generate_key_with_bits, which knows how to call RSA_generate_key or RSA_generate_key_ex as appropriate. [Based on patch by Nathan Freitas] --- src/tools/tor-gencert.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/tools/tor-gencert.c b/src/tools/tor-gencert.c index 9ade76397a..04d53be072 100644 --- a/src/tools/tor-gencert.c +++ b/src/tools/tor-gencert.c @@ -13,6 +13,7 @@ #include #include +#include #include #include #include @@ -218,6 +219,20 @@ parse_commandline(int argc, char **argv) return 0; } +static RSA * +generate_key(int bits) +{ + RSA *rsa = NULL; + crypto_pk_env_t *env = crypto_new_pk_env(); + if (crypto_pk_generate_key_with_bits(env,bits)<0) + goto done; + rsa = _crypto_pk_env_get_rsa(env); + rsa = RSAPrivateKey_dup(rsa); + done: + crypto_free_pk_env(env); + return rsa; +} + /** Try to read the identity key from identity_key_file. If no such * file exists and create_identity_key is set, make a new identity key and * store it. Return 0 on success, nonzero on failure. @@ -238,7 +253,7 @@ load_identity_key(void) } log_notice(LD_GENERAL, "Generating %d-bit RSA identity key.", IDENTITY_KEY_BITS); - if (!(key = RSA_generate_key(IDENTITY_KEY_BITS, 65537, NULL, NULL))) { + if (!(key = generate_key(IDENTITY_KEY_BITS))) { log_err(LD_GENERAL, "Couldn't generate identity key."); crypto_log_errors(LOG_ERR, "Generating identity key"); return 1; @@ -323,7 +338,7 @@ generate_signing_key(void) RSA *key; log_notice(LD_GENERAL, "Generating %d-bit RSA signing key.", SIGNING_KEY_BITS); - if (!(key = RSA_generate_key(SIGNING_KEY_BITS, 65537, NULL, NULL))) { + if (!(key = generate_key(SIGNING_KEY_BITS))) { log_err(LD_GENERAL, "Couldn't generate signing key."); crypto_log_errors(LOG_ERR, "Generating signing key"); return 1; From 1707b338ee481bafdff443f15c65f422e8065518 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Tue, 29 Sep 2009 01:01:28 -0400 Subject: [PATCH 5/5] Add changelog entry for Android work. --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index c79c865efa..a354cac78d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -13,6 +13,8 @@ Changes in version 0.2.2.4-alpha - 2009-??-?? can run tests in their own processes, have smarter setup/teardown code, and so on. The unit test code has moved to its own subdirectory, and has been split into multiple modules. + - Numerous fixes from Nathan Freitas so that Tor can build correctly for + Android phones. o Minor bugfixes: - Fix a couple of smaller issues with gathering statistics. Bugfixes