ssize_t ed25519_cert_extension_parse(ed25519_cert_extension_t **output, const uint8_t *input, const size_t len_in) { ssize_t result; *output = ed25519_cert_extension_new(); if (NULL == *output) return -1; result = ed25519_cert_extension_parse_into(*output, input, len_in); if (result < 0) { ed25519_cert_extension_free(*output); *output = NULL; } return result; }
/** Helper for tor_cert_create(): signs any 32 bytes, not just an ed25519 * key. */ static tor_cert_t * tor_cert_sign_impl(const ed25519_keypair_t *signing_key, uint8_t cert_type, uint8_t signed_key_type, const uint8_t signed_key_info[32], time_t now, time_t lifetime, uint32_t flags) { tor_cert_t *torcert = NULL; ed25519_cert_t *cert = ed25519_cert_new(); cert->cert_type = cert_type; cert->exp_field = (uint32_t) CEIL_DIV(now + lifetime, 3600); cert->cert_key_type = signed_key_type; memcpy(cert->certified_key, signed_key_info, 32); if (flags & CERT_FLAG_INCLUDE_SIGNING_KEY) { ed25519_cert_extension_t *ext = ed25519_cert_extension_new(); ext->ext_type = CERTEXT_SIGNED_WITH_KEY; memcpy(ext->un_signing_key, signing_key->pubkey.pubkey, 32); ed25519_cert_add_ext(cert, ext); ++cert->n_extensions; } const ssize_t alloc_len = ed25519_cert_encoded_len(cert); tor_assert(alloc_len > 0); uint8_t *encoded = tor_malloc(alloc_len); const ssize_t real_len = ed25519_cert_encode(encoded, alloc_len, cert); if (real_len < 0) goto err; tor_assert(real_len == alloc_len); tor_assert(real_len > ED25519_SIG_LEN); uint8_t *sig = encoded + (real_len - ED25519_SIG_LEN); tor_assert(tor_mem_is_zero((char*)sig, ED25519_SIG_LEN)); ed25519_signature_t signature; if (ed25519_sign(&signature, encoded, real_len-ED25519_SIG_LEN, signing_key)<0) { log_warn(LD_BUG, "Can't sign certificate"); goto err; } memcpy(sig, signature.sig, ED25519_SIG_LEN); torcert = tor_cert_parse(encoded, real_len); if (! torcert) { log_warn(LD_BUG, "Generated a certificate we cannot parse"); goto err; } if (tor_cert_checksig(torcert, &signing_key->pubkey, now) < 0) { log_warn(LD_BUG, "Generated a certificate whose signature we can't check"); goto err; } tor_free(encoded); goto done; err: tor_cert_free(torcert); torcert = NULL; done: ed25519_cert_free(cert); tor_free(encoded); return torcert; }