Add configurable experation time for invitations.

diff --git a/bash_completion.d/tinc b/bash_completion.d/tinc
index dec09f84d5c773dc4bb1870bf90c6e389d430946..de2717ef8307700a552efdef8bfa84747bcad46e 100644 (file)
--- a/bash_completion.d/tinc
+++ b/bash_completion.d/tinc
@@ -4,7 +4,7 @@ _tinc() {
        cur="${COMP_WORDS[COMP_CWORD]}"
        prev="${COMP_WORDS[COMP_CWORD-1]}"
        opts="-c -d -D -K -n -o -L -R -U --config --no-detach --debug --net --option --mlock --logfile --pidfile --chroot --user --help --version"
-       confvars="Address AddressFamily BindToAddress BindToInterface Broadcast BroadcastSubnet Cipher ClampMSS Compression ConnectTo DecrementTTL Device DeviceStandby DeviceType Digest DirectOnly Ed25519PrivateKeyFile Ed25519PublicKey Ed25519PublicKeyFile ExperimentalProtocol Forwarding GraphDumpFile Hostnames IffOneQueue IndirectData Interface KeyExpire ListenAddress LocalDiscovery MACExpire MACLength MaxOutputBufferSize MaxTimeout Mode MTUInfoInterval Name PMTU PMTUDiscovery PingInterval PingTimeout Port PriorityInheritance PrivateKeyFile ProcessPriority Proxy PublicKeyFile ReplayWindow StrictSubnets Subnet TCPOnly TunnelServer UDPDiscovery UDPDiscoveryKeepaliveInterval UDPDiscoveryInterval UDPDiscoveryTimeout UDPInfoInterval UDPRcvBuf UDPSndBuf UPnP UPnPDiscoverWait UPnPRefreshPeriod VDEGroup VDEPort Weight"
+       confvars="Address AddressFamily BindToAddress BindToInterface Broadcast BroadcastSubnet Cipher ClampMSS Compression ConnectTo DecrementTTL Device DeviceStandby DeviceType Digest DirectOnly Ed25519PrivateKeyFile Ed25519PublicKey Ed25519PublicKeyFile ExperimentalProtocol Forwarding GraphDumpFile Hostnames IffOneQueue IndirectData Interface InvitationExpire KeyExpire ListenAddress LocalDiscovery MACExpire MACLength MaxOutputBufferSize MaxTimeout Mode MTUInfoInterval Name PMTU PMTUDiscovery PingInterval PingTimeout Port PriorityInheritance PrivateKeyFile ProcessPriority Proxy PublicKeyFile ReplayWindow StrictSubnets Subnet TCPOnly TunnelServer UDPDiscovery UDPDiscoveryKeepaliveInterval UDPDiscoveryInterval UDPDiscoveryTimeout UDPInfoInterval UDPRcvBuf UDPSndBuf UPnP UPnPDiscoverWait UPnPRefreshPeriod VDEGroup VDEPort Weight"
        commands="add connect debug del disconnect dump edit export export-all generate-ed25519-keys generate-keys generate-rsa-keys get help import info init invite join list log network pcap pid purge reload restart retry set sign start stop top verify version"
 
        case ${prev} in

diff --git a/doc/tinc.conf.5.in b/doc/tinc.conf.5.in
index 9365184b76eaf67198202946f835b0a3541cdeac..22b01d20cab4fcf11d5122cecffe6f74ebc73922 100644 (file)
--- a/doc/tinc.conf.5.in
+++ b/doc/tinc.conf.5.in
@@ -327,6 +327,8 @@ Under Windows, this variable is used to select which network interface will be u
 If you specified a
 .Va Device ,
 this variable is almost always already correctly set.
+.It Va InvitationExpire Li = Ar seconds Pq 604800
+This option controls the period invitations are valid.
 .It Va KeyExpire Li = Ar seconds Pq 3600
 This option controls the period the encryption keys used to encrypt the data are valid.
 It is common practice to change keys at regular intervals to make it even harder for crackers,

diff --git a/doc/tinc.texi b/doc/tinc.texi
index 29e2bdc9553950b02342b9f588c1c41add89c303..6b02f10eb19f0b38310dde0aefce56af02c79eae 100644 (file)
--- a/doc/tinc.texi
+++ b/doc/tinc.texi
@@ -1121,6 +1121,10 @@ every packet will be broadcast to the other daemons
 while no routing table is managed.
 @end table
 
+@cindex InvitationExpire
+@item InvitationExpire = <@var{seconds}> (604800)
+This option controls the time invitations are valid.
+
 @cindex KeyExpire
 @item KeyExpire = <@var{seconds}> (3600)
 This option controls the time the encryption keys used to encrypt the data

diff --git a/src/net_setup.c b/src/net_setup.c
index 6becfbb405ac29c400c92247bd281a7e41cc6c33..e164214fe4a51ce2381d3bcb7fdc2f1dd6a099a4 100644 (file)
--- a/src/net_setup.c
+++ b/src/net_setup.c
@@ -611,6 +611,9 @@ bool setup_myself_reloadable(void) {
 
        get_config_bool(lookup_config(config_tree, "DisableBuggyPeers"), &disablebuggypeers);
 
+       if(!get_config_int(lookup_config(config_tree, "InvitationExpire"), &invitation_lifetime))
+               invitation_lifetime = 604800; // 1 week
+
        read_invitation_key();
 
        return true;

diff --git a/src/protocol.h b/src/protocol.h
index dee6eb8b7404429a995158d004c1db6af7e4a965..5cb229468ab5d3f8f175f1aec348f31e05e6d426 100644 (file)
--- a/src/protocol.h
+++ b/src/protocol.h
@@ -62,6 +62,7 @@ extern bool tunnelserver;
 extern bool strictsubnets;
 extern bool experimental;
 
+extern int invitation_lifetime;
 extern ecdsa_t *invitation_key;
 
 /* Maximum size of strings in a request.

diff --git a/src/protocol_auth.c b/src/protocol_auth.c
index baf9eac188f4ca909417fd6ad00278352d3f87ff..a99e1d617e7fe675b7cf57819a063fec4719f279 100644 (file)
--- a/src/protocol_auth.c
+++ b/src/protocol_auth.c
@@ -47,6 +47,7 @@
 
 #include "ed25519/sha512.h"
 
+int invitation_lifetime;
 ecdsa_t *invitation_key = NULL;
 
 static bool send_proxyrequest(connection_t *c) {
@@ -232,6 +233,18 @@ static bool receive_invitation_sptps(void *handle, uint8_t type, const void *dat
                return false;
        }
 
+       // Check the timestamp of the invitation
+       struct stat st;
+       if(stat(usedname, &st)) {
+               logger(DEBUG_ALWAYS, LOG_ERR, "Could not stat %s", usedname);
+               return false;
+       }
+
+       if(st.st_mtime + invitation_lifetime < now.tv_sec) {
+               logger(DEBUG_ALWAYS, LOG_ERR, "Peer %s tried to use expired invitation %s", c->hostname, cookie);
+               return false;
+       }
+
        // Open the renamed file
        FILE *f = fopen(usedname, "r");
        if(!f) {

diff --git a/src/tincctl.c b/src/tincctl.c
index 6416ebe0498c67d0e6ea8017686f18a69b8f8bbe..e460784f94bb49d7565a89ac97ad006bd4953d49 100644 (file)
--- a/src/tincctl.c
+++ b/src/tincctl.c
@@ -1490,6 +1490,7 @@ const var_t variables[] = {
        {"Hostnames", VAR_SERVER},
        {"IffOneQueue", VAR_SERVER},
        {"Interface", VAR_SERVER},
+       {"InvitationExpire", VAR_SERVER},
        {"KeyExpire", VAR_SERVER},
        {"ListenAddress", VAR_SERVER | VAR_MULTIPLE},
        {"LocalDiscovery", VAR_SERVER},