Changeset 040e092

Timestamp:

May 29, 2019 7:08:33 PM (11 months ago)

Author:

zzz <zzz@…>

Branches:

master

Children:

16ac93c

Parents:

098bde2

Message:

Blinding:

• Fix bugs with lookup password
• Log tweaks

Files:

• apps/i2ptunnel/jsp/editServer.jsi (modified) (2 diffs)
• apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHandler.java (modified) (1 diff)
• core/java/src/net/i2p/client/impl/RequestLeaseSetMessageHandler.java (modified) (2 diffs)
• core/java/src/net/i2p/client/impl/RequestVariableLeaseSetMessageHandler.java (modified) (1 diff)
• core/java/src/net/i2p/crypto/Blinding.java (modified) (1 diff)
• core/java/src/net/i2p/data/EncryptedLeaseSet.java (modified) (12 diffs)
• history.txt (modified) (1 diff)
• router/java/src/net/i2p/router/RouterVersion.java (modified) (1 diff)
• router/java/src/net/i2p/router/client/ClientMessageEventListener.java (modified) (2 diffs)
• router/java/src/net/i2p/router/networkdb/kademlia/KademliaNetworkDatabaseFacade.java (modified) (2 diffs)

apps/i2ptunnel/jsp/editServer.jsi

@@ -524 +524 @@
                         if (!clientAuths.isEmpty()) {
 %>
-        <tr><td><b><%=intl._t("Revoke?")%>&nbsp;&nbsp;&nbsp;&nbsp;<%=intl._t("Client Name")%></b></td><td><b><%=intl._t("Client Key")%></b></td></tr>
+        <tr><td><b><%=intl._t("Revoke")%>&nbsp;&nbsp;&nbsp;&nbsp;<%=intl._t("Client Name")%></b></td><td><b><%=intl._t("Client Key")%></b></td></tr>
 <%
                             int i = 0;
@@ -553 +553 @@
                         } // isEmpty
 %>
-        <tr><td><b><%=intl._t("Add?")%>&nbsp;&nbsp;&nbsp;&nbsp;<%=intl._t("Client Name")%></b></td><td>
+        <tr><td><b><%=intl._t("Add")%>&nbsp;&nbsp;&nbsp;&nbsp;<%=intl._t("Client Name")%></b></td><td>
 <%
                             if (dhClient) {

apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigKeyringHandler.java

@@ -154 +154 @@
                     }
                     if (bdold != null) {
-                        // debug
-                        addFormNotice("already cached: " + bdold);
+                        if (_log.shouldDebug())
+                            _log.debug("already cached: " + bdold);
                     }
                     try {

core/java/src/net/i2p/client/impl/RequestLeaseSetMessageHandler.java

@@ -131 +131 @@
                 leaseSet = new LeaseSet2();
             } else if (_ls2Type == DatabaseEntry.KEY_TYPE_ENCRYPTED_LS2) {
-                EncryptedLeaseSet encls2 = new EncryptedLeaseSet();
-                String secret = session.getOptions().getProperty(PROP_SECRET);
-                if (secret != null) {
-                    secret = DataHelper.getUTF8(Base64.decode(secret));
-                    encls2.setSecret(secret);
-                }
-                leaseSet = encls2;
+                leaseSet = new EncryptedLeaseSet();
             } else if (_ls2Type == DatabaseEntry.KEY_TYPE_META_LS2) {
                 leaseSet = new MetaLeaseSet();
@@ -175 +169 @@
      */
     protected synchronized void signLeaseSet(LeaseSet leaseSet, boolean isLS2, I2PSessionImpl session) {
+        // must be before setDestination()
+        if (isLS2 && _ls2Type == DatabaseEntry.KEY_TYPE_ENCRYPTED_LS2) {
+            String secret = session.getOptions().getProperty(PROP_SECRET);
+            if (secret != null) {
+                EncryptedLeaseSet encls2 = (EncryptedLeaseSet) leaseSet;
+                secret = DataHelper.getUTF8(Base64.decode(secret));
+                encls2.setSecret(secret);
+            }
+        }
         Destination dest = session.getMyDestination();
         // also, if this session is connected to multiple routers, include other leases here

core/java/src/net/i2p/client/impl/RequestVariableLeaseSetMessageHandler.java

@@ -59 +59 @@
             leaseSet = new LeaseSet();
         }
-        // Full Meta and Encrypted support TODO
+        // Full Meta support TODO
         for (int i = 0; i < msg.getEndpoints(); i++) {
             Lease lease;

core/java/src/net/i2p/crypto/Blinding.java

@@ -328 +328 @@
         I2PAppContext ctx = I2PAppContext.getGlobalContext();
         //String b32 = encode(pub, null);
-        String b32 = encode(pub, "foobarbaz");
+        String b32 = encode(pub, true, false);
         System.out.println("pub b32 is " + b32);
         BlindData bd = decode(ctx, b32);

core/java/src/net/i2p/data/EncryptedLeaseSet.java

@@ -43 +43 @@
     private PrivateKey _clientPrivateKey;
     private final Log _log;
+    // debug
+    private int _authType, _numKeys;
 
     private static final int MIN_ENCRYPTED_SIZE = 8 + 16;
@@ -75 +77 @@
     /**
      *  Must be set before sign or verify.
+     *  Must be called before setDestination() or setSigningKey(), or alpha will be wrong.
      *
      *  @param secret null or "" for none (default)
@@ -80 +83 @@
      */
     public void setSecret(String secret) {
+        if (_signingKey != null && !DataHelper.eq(secret, _secret)) {
+            if (_log.shouldWarn())
+                _log.warn("setSecret() after setSigningKey()" +
+                          " was: " + _secret + " now: " + secret);
+        }
         _secret = secret;
     }
@@ -129 +137 @@
 
     /**
-     * Overridden to set the blinded key
+     * Overridden to set the blinded key.
+     * setSecret() MUST be called before this for non-null secret, or alpha will be wrong.
      *
      * @param dest non-null, must be EdDSA_SHA512_Ed25519 or RedDSA_SHA512_Ed25519
@@ -148 +157 @@
 
     /**
-     * Overridden to set the blinded key
+     * Overridden to set the blinded key.
+     * setSecret() MUST be called before this for non-null secret, or alpha will be wrong.
      *
      * @param spk unblinded key non-null, must be EdDSA_SHA512_Ed25519 or RedDSA_SHA512_Ed25519
@@ -157 +167 @@
     @Override
     public void setSigningKey(SigningPublicKey spk) {
-        // TODO already-set checks
         SigType type = spk.getType();
         if (type != SigType.EdDSA_SHA512_Ed25519 &&
@@ -193 +202 @@
             _log.debug("Blind:" +
                        "\norig:    " + spk +
+                       "\nsecret:  " + _secret +
                        "\nalpha:   " + _alpha +
                        "\nblinded: " + rv);
@@ -416 +426 @@
         byte[] iv = new byte[32];
         int authLen;
+        _authType = authType;  // debug
         if (authType == BlindData.AUTH_NONE) {
             authLen = 1;
@@ -422 +433 @@
             if (clientKeys == null || clientKeys.isEmpty())
                 throw new IllegalArgumentException("No client keys provided");
+            _numKeys = clientKeys.size();  // debug
             authLen = 1 + SALT_LEN + 2 + (clientKeys.size() * CLIENT_LEN);
         } else {
@@ -610 +622 @@
 
         int authType = plaintext[0] & 0x0f;
+        _authType = authType;  // debug
         int authLen;
         if (authType == BlindData.AUTH_NONE) {
@@ -623 +636 @@
             System.arraycopy(plaintext, 1, seed, 0, 32);
             int count = (int) DataHelper.fromLong(plaintext, 33, 2);
+            _numKeys = count;  // debug
             if (count == 0)
                 throw new DataFormatException("No client entries");
@@ -949 +963 @@
         buf.append("\n\tPublished: ").append(new java.util.Date(_published));
         buf.append("\n\tExpires: ").append(new java.util.Date(_expires));
+        buf.append("\n\tAuth Type: ").append(_authType);
+        buf.append("\n\tClient Keys: ").append(_numKeys);
         if (_decryptedLS2 != null) {
+            if (_secret != null)
+                buf.append("\n\tSecret: ").append(_secret);
+            if (_clientPrivateKey != null)
+                buf.append("\n\tClient Private Key: ").append(_clientPrivateKey.toBase64());
             buf.append("\n\tDecrypted LS:\n").append(_decryptedLS2);
         } else if (_destination != null) {

history.txt

@@ +1 @@
+2019-05-29 zzz
+ * I2CP: Fix bugs with lookup password
+ * Util: Store save time in config files
+
+2019-05-28 zzz
+ * Console: Form handling on /configkeyring for LS2
+
+2019-05-27 zzz
+ * Console: Start rework of /configkeyring for LS2
+
+2019-05-26 zzz
+ * I2CP: Add per-client auth to generated leaseset
+
 2019-05-24 zzz
  * i2ptunnel:

router/java/src/net/i2p/router/RouterVersion.java

@@ -19 +19 @@
     public final static String ID = "Monotone";
     public final static String VERSION = CoreVersion.VERSION;
-    public final static long BUILD = 6;
+    public final static long BUILD = 7;
 
     /** for example "-test" */

router/java/src/net/i2p/router/client/ClientMessageEventListener.java

@@ -552 +552 @@
         if (type == DatabaseEntry.KEY_TYPE_ENCRYPTED_LS2) {
             // so we can decrypt it
+            // secret must be set before destination
+            String secret = cfg.getOptions().getProperty("i2cp.leaseSetSecret");
+            if (secret != null) {
+                EncryptedLeaseSet encls = (EncryptedLeaseSet) ls;
+                secret = DataHelper.getUTF8(Base64.decode(secret));
+                encls.setSecret(secret);
+            }
             try {
                 ls.setDestination(dest);
@@ -653 +660 @@
                     return;
                 }
-                String secret = cfg.getOptions().getProperty("i2cp.leaseSetSecret");
-                if (secret != null) {
-                    EncryptedLeaseSet encls = (EncryptedLeaseSet) ls;
-                    secret = DataHelper.getUTF8(Base64.decode(secret));
-                    encls.setSecret(secret);
-                }
             }
             if (_log.shouldDebug())

router/java/src/net/i2p/router/networkdb/kademlia/KademliaNetworkDatabaseFacade.java

@@ -947 +947 @@
                     _log.warn("Found blind data for encls: " + bd);
                 encls = (EncryptedLeaseSet) leaseSet;
+                // secret must be set before destination
+                String secret = bd.getSecret();
+                if (secret != null)
+                    encls.setSecret(secret);
                 Destination dest = bd.getDestination();
                 if (dest != null) {
@@ -953 +957 @@
                     encls.setSigningKey(bd.getUnblindedPubKey());
                 }
-                // secret
-                String secret = bd.getSecret();
-                if (secret != null)
-                    encls.setSecret(secret);
                 // per-client auth
                 if (bd.getAuthType() != BlindData.AUTH_NONE)