X-Git-Url: https://tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fprotocol_auth.c;h=33341296187ac941d50459b736dc44690794a129;hb=3a149f7521dfff67e6a790c1a830afc649ae083e;hp=68dd071712a4d5f1021fb98a0558036b2d028641;hpb=f6e87ab476a0faf8b124ecaaa27f967d825e6457;p=tinc diff --git a/src/protocol_auth.c b/src/protocol_auth.c index 68dd0717..33341296 100644 --- a/src/protocol_auth.c +++ b/src/protocol_auth.c @@ -26,7 +26,6 @@ #include "control_common.h" #include "cipher.h" #include "crypto.h" -#include "device.h" #include "digest.h" #include "ecdsa.h" #include "edge.h" @@ -37,7 +36,6 @@ #include "net.h" #include "netutl.h" #include "node.h" -#include "prf.h" #include "protocol.h" #include "rsa.h" #include "script.h" @@ -46,6 +44,7 @@ #include "xalloc.h" #include "ed25519/sha512.h" +#include "keys.h" int invitation_lifetime; ecdsa_t *invitation_key = NULL; @@ -69,7 +68,7 @@ static bool send_proxyrequest(connection_t *c) { return false; } - char s4req[9 + (proxyuser ? strlen(proxyuser) : 0)]; + uint8_t s4req[9 + (proxyuser ? strlen(proxyuser) : 0)]; s4req[0] = 4; s4req[1] = 1; memcpy(s4req + 2, &c->address.in.sin_port, 2); @@ -85,15 +84,15 @@ static bool send_proxyrequest(connection_t *c) { } case PROXY_SOCKS5: { - int len = 3 + 6 + (c->address.sa.sa_family == AF_INET ? 4 : 16); + size_t len = 3 + 6 + (c->address.sa.sa_family == AF_INET ? 4 : 16); c->tcplen = 2; if(proxypass) { len += 3 + strlen(proxyuser) + strlen(proxypass); } - char s5req[len]; - int i = 0; + uint8_t s5req[len]; + size_t i = 0; s5req[i++] = 5; s5req[i++] = 1; @@ -160,7 +159,7 @@ bool send_id(connection_t *c) { int minor = 0; if(experimental) { - if(c->outgoing && !read_ecdsa_public_key(c)) { + if(c->outgoing && !read_ecdsa_public_key(&c->ecdsa, &c->config_tree, c->name)) { minor = 1; } else { minor = myself->connection->protocol_minor; @@ -176,6 +175,8 @@ bool send_id(connection_t *c) { } static bool finalize_invitation(connection_t *c, const char *data, uint16_t len) { + (void)len; + if(strchr(data, '\n')) { logger(DEBUG_ALWAYS, LOG_ERR, "Received invalid key from invited node %s (%s)!\n", c->name, c->hostname); return false; @@ -200,7 +201,7 @@ static bool finalize_invitation(connection_t *c, const char *data, uint16_t len) fprintf(f, "Ed25519PublicKey = %s\n", data); fclose(f); - logger(DEBUG_CONNECTIONS, LOG_INFO, "Key succesfully received from %s (%s)", c->name, c->hostname); + logger(DEBUG_CONNECTIONS, LOG_INFO, "Key successfully received from %s (%s)", c->name, c->hostname); // Call invitation-accepted script environment_t env; @@ -212,6 +213,9 @@ static bool finalize_invitation(connection_t *c, const char *data, uint16_t len) environment_add(&env, "REMOTEADDRESS=%s", address); environment_add(&env, "NAME=%s", myself->name); + free(address); + free(port); + execute_script("invitation-accepted", &env); environment_exit(&env); @@ -282,13 +286,16 @@ static bool receive_invitation_sptps(void *handle, uint8_t type, const void *dat } // Read the new node's Name from the file - char buf[1024]; + char buf[1024] = ""; fgets(buf, sizeof(buf), f); + size_t buflen = strlen(buf); - if(*buf) { - buf[strlen(buf) - 1] = 0; + // Strip whitespace at the end + while(buflen && strchr(" \t\r\n", buf[buflen - 1])) { + buf[--buflen] = 0; } + // Split the first line into variable and value len = strcspn(buf, " \t="); char *name = buf + len; name += strspn(name, " \t"); @@ -300,7 +307,8 @@ static bool receive_invitation_sptps(void *handle, uint8_t type, const void *dat buf[len] = 0; - if(!*buf || !*name || strcasecmp(buf, "Name") || !check_id(name)) { + // Check that it is a valid Name + if(!*buf || !*name || strcasecmp(buf, "Name") || !check_id(name) || !strcmp(name, myself->name)) { logger(DEBUG_ALWAYS, LOG_ERR, "Invalid invitation file %s\n", cookie); fclose(f); return false; @@ -323,7 +331,7 @@ static bool receive_invitation_sptps(void *handle, uint8_t type, const void *dat c->status.invitation_used = true; - logger(DEBUG_CONNECTIONS, LOG_INFO, "Invitation %s succesfully sent to %s (%s)", cookie, c->name, c->hostname); + logger(DEBUG_CONNECTIONS, LOG_INFO, "Invitation %s successfully sent to %s (%s)", cookie, c->name, c->hostname); return true; } @@ -346,6 +354,10 @@ bool id_h(connection_t *c, const char *request) { free(c->name); c->name = xstrdup(""); + if(!c->outgoing) { + send_id(c); + } + return send_request(c, "%d %d %d", ACK, TINC_CTL_VERSION_CURRENT, getpid()); } @@ -369,6 +381,10 @@ bool id_h(connection_t *c, const char *request) { return false; } + if(!c->outgoing) { + send_id(c); + } + if(!send_request(c, "%d %s", ACK, mykey)) { return false; } @@ -382,7 +398,7 @@ bool id_h(connection_t *c, const char *request) { /* Check if identity is a valid name */ - if(!check_id(name)) { + if(!check_id(name) || !strcmp(name, myself->name)) { logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ID", c->name, c->hostname, "invalid name"); return false; @@ -397,10 +413,7 @@ bool id_h(connection_t *c, const char *request) { return false; } } else { - if(c->name) { - free(c->name); - } - + free(c->name); c->name = xstrdup(name); } @@ -414,10 +427,15 @@ bool id_h(connection_t *c, const char *request) { if(bypass_security) { if(!c->config_tree) { - init_configuration(&c->config_tree); + c->config_tree = create_configuration(); } c->allow_request = ACK; + + if(!c->outgoing) { + send_id(c); + } + return send_ack(c); } @@ -426,15 +444,15 @@ bool id_h(connection_t *c, const char *request) { } if(!c->config_tree) { - init_configuration(&c->config_tree); + c->config_tree = create_configuration(); - if(!read_host_config(c->config_tree, c->name)) { + if(!read_host_config(c->config_tree, c->name, false)) { logger(DEBUG_ALWAYS, LOG_ERR, "Peer %s had unknown identity (%s)", c->hostname, c->name); return false; } if(experimental) { - read_ecdsa_public_key(c); + read_ecdsa_public_key(&c->ecdsa, &c->config_tree, c->name); } /* Ignore failures if no key known yet */ @@ -454,6 +472,10 @@ bool id_h(connection_t *c, const char *request) { c->allow_request = METAKEY; + if(!c->outgoing) { + send_id(c); + } + if(c->protocol_minor >= 2) { c->allow_request = ACK; char label[25 + strlen(myself->name) + strlen(c->name)]; @@ -470,17 +492,14 @@ bool id_h(connection_t *c, const char *request) { } } +#ifndef DISABLE_LEGACY bool send_metakey(connection_t *c) { -#ifdef DISABLE_LEGACY - return false; -#else - if(!myself->connection->rsa) { logger(DEBUG_CONNECTIONS, LOG_ERR, "Peer %s (%s) uses legacy protocol which we don't support", c->name, c->hostname); return false; } - if(!read_rsa_public_key(c)) { + if(!read_rsa_public_key(&c->rsa, c->config_tree, c->name)) { return false; } @@ -489,7 +508,7 @@ bool send_metakey(connection_t *c) { by Cipher. */ - int keylen = cipher_keylength(myself->incipher); + size_t keylen = cipher_keylength(myself->incipher); if(keylen <= 16) { c->outcipher = cipher_open_by_name("aes-128-cfb"); @@ -499,13 +518,9 @@ bool send_metakey(connection_t *c) { c->outcipher = cipher_open_by_name("aes-256-cfb"); } - if(!c) { - return false; - } - c->outbudget = cipher_budget(c->outcipher); - if(!(c->outdigest = digest_open_by_name("sha256", -1))) { + if(!(c->outdigest = digest_open_by_name("sha256", DIGEST_ALGO_SIZE))) { return false; } @@ -564,14 +579,9 @@ bool send_metakey(connection_t *c) { c->status.encryptout = true; return result; -#endif } bool metakey_h(connection_t *c, const char *request) { -#ifdef DISABLE_LEGACY - return false; -#else - if(!myself->connection->rsa) { return false; } @@ -589,7 +599,7 @@ bool metakey_h(connection_t *c, const char *request) { /* Convert the challenge from hexadecimal back to binary */ - int inlen = hex2bin(hexkey, enckey, sizeof(enckey)); + size_t inlen = hex2bin(hexkey, enckey, sizeof(enckey)); /* Check if the length of the meta key is all right */ @@ -618,18 +628,20 @@ bool metakey_h(connection_t *c, const char *request) { return false; } } else { - c->incipher = NULL; + logger(DEBUG_ALWAYS, LOG_ERR, "Possible intruder %s (%s): %s", c->name, c->hostname, "null cipher"); + return false; } c->inbudget = cipher_budget(c->incipher); if(digest) { - if(!(c->indigest = digest_open_by_nid(digest, -1))) { + if(!(c->indigest = digest_open_by_nid(digest, DIGEST_ALGO_SIZE))) { logger(DEBUG_ALWAYS, LOG_ERR, "Error during initialisation of digest from %s (%s)", c->name, c->hostname); return false; } } else { - c->indigest = NULL; + logger(DEBUG_ALWAYS, LOG_ERR, "Possible intruder %s (%s): %s", c->name, c->hostname, "null digest"); + return false; } c->status.decryptin = true; @@ -637,19 +649,13 @@ bool metakey_h(connection_t *c, const char *request) { c->allow_request = CHALLENGE; return send_challenge(c); -#endif } bool send_challenge(connection_t *c) { -#ifdef DISABLE_LEGACY - return false; -#else const size_t len = rsa_size(c->rsa); char buffer[len * 2 + 1]; - if(!c->hischallenge) { - c->hischallenge = xrealloc(c->hischallenge, len); - } + c->hischallenge = xrealloc(c->hischallenge, len); /* Copy random data to the buffer */ @@ -662,61 +668,69 @@ bool send_challenge(connection_t *c) { /* Send the challenge */ return send_request(c, "%d %s", CHALLENGE, buffer); -#endif } bool challenge_h(connection_t *c, const char *request) { -#ifdef DISABLE_LEGACY - return false; -#else - if(!myself->connection->rsa) { return false; } char buffer[MAX_STRING_SIZE]; const size_t len = rsa_size(myself->connection->rsa); - size_t digestlen = digest_length(c->indigest); - char digest[digestlen]; if(sscanf(request, "%*d " MAX_STRING, buffer) != 1) { logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "CHALLENGE", c->name, c->hostname); return false; } - /* Convert the challenge from hexadecimal back to binary */ - - int inlen = hex2bin(buffer, buffer, sizeof(buffer)); - /* Check if the length of the challenge is all right */ - if(inlen != len) { + if(strlen(buffer) != (size_t)len * 2) { logger(DEBUG_ALWAYS, LOG_ERR, "Possible intruder %s (%s): %s", c->name, c->hostname, "wrong challenge length"); return false; } + c->mychallenge = xrealloc(c->mychallenge, len); + + /* Convert the challenge from hexadecimal back to binary */ + + hex2bin(buffer, c->mychallenge, len); + + /* The rest is done by send_chal_reply() */ + + c->allow_request = CHAL_REPLY; + + if(c->outgoing) { + return send_chal_reply(c); + } else { + return true; + } +} + +bool send_chal_reply(connection_t *c) { + const size_t len = rsa_size(myself->connection->rsa); + size_t digestlen = digest_length(c->indigest); + char digest[digestlen * 2 + 1]; + /* Calculate the hash from the challenge we received */ - if(!digest_create(c->indigest, buffer, len, digest)) { + if(!digest_create(c->indigest, c->mychallenge, len, digest)) { return false; } + free(c->mychallenge); + c->mychallenge = NULL; + /* Convert the hash to a hexadecimal formatted string */ - bin2hex(digest, buffer, digestlen); + bin2hex(digest, digest, digestlen); /* Send the reply */ - c->allow_request = CHAL_REPLY; - - return send_request(c, "%d %s", CHAL_REPLY, buffer); -#endif + return send_request(c, "%d %s", CHAL_REPLY, digest); } bool chal_reply_h(connection_t *c, const char *request) { -#ifdef DISABLE_LEGACY - return false; -#else char hishash[MAX_STRING_SIZE]; if(sscanf(request, "%*d " MAX_STRING, hishash) != 1) { @@ -727,7 +741,7 @@ bool chal_reply_h(connection_t *c, const char *request) { /* Convert the hash to binary format */ - int inlen = hex2bin(hishash, hishash, sizeof(hishash)); + size_t inlen = hex2bin(hishash, hishash, sizeof(hishash)); /* Check if the length of the hash is all right */ @@ -752,14 +766,14 @@ bool chal_reply_h(connection_t *c, const char *request) { c->hischallenge = NULL; c->allow_request = ACK; + if(!c->outgoing) { + send_chal_reply(c); + } + return send_ack(c); -#endif } static bool send_upgrade(connection_t *c) { -#ifdef DISABLE_LEGACY - return false; -#else /* Special case when protocol_minor is 1: the other end is Ed25519 capable, * but doesn't know our key yet. So send it now. */ @@ -772,8 +786,46 @@ static bool send_upgrade(connection_t *c) { bool result = send_request(c, "%d %s", ACK, pubkey); free(pubkey); return result; -#endif } +#else +bool send_metakey(connection_t *c) { + (void)c; + return false; +} + +bool metakey_h(connection_t *c, const char *request) { + (void)c; + (void)request; + return false; +} + +bool send_challenge(connection_t *c) { + (void)c; + return false; +} + +bool challenge_h(connection_t *c, const char *request) { + (void)c; + (void)request; + return false; +} + +bool send_chal_reply(connection_t *c) { + (void)c; + return false; +} + +bool chal_reply_h(connection_t *c, const char *request) { + (void)c; + (void)request; + return false; +} + +static bool send_upgrade(connection_t *c) { + (void)c; + return false; +} +#endif bool send_ack(connection_t *c) { if(c->protocol_minor == 1) { @@ -789,7 +841,7 @@ bool send_ack(connection_t *c) { /* Estimate weight */ gettimeofday(&now, NULL); - c->estimated_weight = (now.tv_sec - c->start.tv_sec) * 1000 + (now.tv_usec - c->start.tv_usec) / 1000; + c->estimated_weight = (int)((now.tv_sec - c->start.tv_sec) * 1000 + (now.tv_usec - c->start.tv_usec) / 1000); /* Check some options */ @@ -801,7 +853,7 @@ bool send_ack(connection_t *c) { c->options |= OPTION_TCPONLY | OPTION_INDIRECT; } - if(myself->options & OPTION_PMTU_DISCOVERY) { + if(myself->options & OPTION_PMTU_DISCOVERY && !(c->options & OPTION_TCPONLY)) { c->options |= OPTION_PMTU_DISCOVERY; } @@ -813,7 +865,7 @@ bool send_ack(connection_t *c) { } if(!get_config_int(lookup_config(c->config_tree, "Weight"), &c->estimated_weight)) { - get_config_int(lookup_config(config_tree, "Weight"), &c->estimated_weight); + get_config_int(lookup_config(&config_tree, "Weight"), &c->estimated_weight); } return send_request(c, "%d %s %d %x", ACK, myport, c->estimated_weight, (c->options & 0xffffff) | (experimental ? (PROT_MINOR << 24) : 0)); @@ -841,7 +893,7 @@ static void send_everything(connection_t *c) { return; } - for splay_each(node_t, n, node_tree) { + for splay_each(node_t, n, &node_tree) { for splay_each(subnet_t, s, n->subnet_tree) { send_add_subnet(c, s); } @@ -860,7 +912,7 @@ static bool upgrade_h(connection_t *c, const char *request) { return false; } - if(ecdsa_active(c->ecdsa) || read_ecdsa_public_key(c)) { + if(ecdsa_active(c->ecdsa) || read_ecdsa_public_key(&c->ecdsa, &c->config_tree, c->name)) { char *knownkey = ecdsa_get_base64_public_key(c->ecdsa); bool different = strcmp(knownkey, pubkey); free(knownkey); @@ -953,7 +1005,7 @@ bool ack_h(connection_t *c, const char *request) { n->mtu = mtu; } - if(get_config_int(lookup_config(config_tree, "PMTU"), &mtu) && mtu < n->mtu) { + if(get_config_int(lookup_config(&config_tree, "PMTU"), &mtu) && mtu < n->mtu) { n->mtu = mtu; }