X-Git-Url: https://tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fprotocol_auth.c;h=9d61ab8fc7826b8d431f95cae3291f9bbf64436e;hb=46f3eba7755089ff68fdc137b0754cae2fa523eb;hp=68dd071712a4d5f1021fb98a0558036b2d028641;hpb=f6e87ab476a0faf8b124ecaaa27f967d825e6457;p=tinc

diff --git a/src/protocol_auth.c b/src/protocol_auth.c
index 68dd0717..9d61ab8f 100644
--- a/src/protocol_auth.c
+++ b/src/protocol_auth.c
@@ -200,7 +200,7 @@ static bool finalize_invitation(connection_t *c, const char *data, uint16_t len)
 	fprintf(f, "Ed25519PublicKey = %s\n", data);
 	fclose(f);
 
-	logger(DEBUG_CONNECTIONS, LOG_INFO, "Key succesfully received from %s (%s)", c->name, c->hostname);
+	logger(DEBUG_CONNECTIONS, LOG_INFO, "Key successfully received from %s (%s)", c->name, c->hostname);
 
 	// Call invitation-accepted script
 	environment_t env;
@@ -300,7 +300,7 @@ static bool receive_invitation_sptps(void *handle, uint8_t type, const void *dat
 
 	buf[len] = 0;
 
-	if(!*buf || !*name || strcasecmp(buf, "Name") || !check_id(name)) {
+	if(!*buf || !*name || strcasecmp(buf, "Name") || !check_id(name) || !strcmp(name, myself->name)) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Invalid invitation file %s\n", cookie);
 		fclose(f);
 		return false;
@@ -323,7 +323,7 @@ static bool receive_invitation_sptps(void *handle, uint8_t type, const void *dat
 
 	c->status.invitation_used = true;
 
-	logger(DEBUG_CONNECTIONS, LOG_INFO, "Invitation %s succesfully sent to %s (%s)", cookie, c->name, c->hostname);
+	logger(DEBUG_CONNECTIONS, LOG_INFO, "Invitation %s successfully sent to %s (%s)", cookie, c->name, c->hostname);
 	return true;
 }
 
@@ -346,6 +346,10 @@ bool id_h(connection_t *c, const char *request) {
 		free(c->name);
 		c->name = xstrdup("<control>");
 
+		if(!c->outgoing) {
+			send_id(c);
+		}
+
 		return send_request(c, "%d %d %d", ACK, TINC_CTL_VERSION_CURRENT, getpid());
 	}
 
@@ -369,6 +373,10 @@ bool id_h(connection_t *c, const char *request) {
 			return false;
 		}
 
+		if(!c->outgoing) {
+			send_id(c);
+		}
+
 		if(!send_request(c, "%d %s", ACK, mykey)) {
 			return false;
 		}
@@ -382,7 +390,7 @@ bool id_h(connection_t *c, const char *request) {
 
 	/* Check if identity is a valid name */
 
-	if(!check_id(name)) {
+	if(!check_id(name) || !strcmp(name, myself->name)) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ID", c->name,
 		       c->hostname, "invalid name");
 		return false;
@@ -418,6 +426,11 @@ bool id_h(connection_t *c, const char *request) {
 		}
 
 		c->allow_request = ACK;
+
+		if(!c->outgoing) {
+			send_id(c);
+		}
+
 		return send_ack(c);
 	}
 
@@ -428,7 +441,7 @@ bool id_h(connection_t *c, const char *request) {
 	if(!c->config_tree) {
 		init_configuration(&c->config_tree);
 
-		if(!read_host_config(c->config_tree, c->name)) {
+		if(!read_host_config(c->config_tree, c->name, false)) {
 			logger(DEBUG_ALWAYS, LOG_ERR, "Peer %s had unknown identity (%s)", c->hostname, c->name);
 			return false;
 		}
@@ -454,6 +467,10 @@ bool id_h(connection_t *c, const char *request) {
 
 	c->allow_request = METAKEY;
 
+	if(!c->outgoing) {
+		send_id(c);
+	}
+
 	if(c->protocol_minor >= 2) {
 		c->allow_request = ACK;
 		char label[25 + strlen(myself->name) + strlen(c->name)];
@@ -618,7 +635,8 @@ bool metakey_h(connection_t *c, const char *request) {
 			return false;
 		}
 	} else {
-		c->incipher = NULL;
+		logger(DEBUG_ALWAYS, LOG_ERR, "Possible intruder %s (%s): %s", c->name, c->hostname, "null cipher");
+		return false;
 	}
 
 	c->inbudget = cipher_budget(c->incipher);
@@ -629,7 +647,8 @@ bool metakey_h(connection_t *c, const char *request) {
 			return false;
 		}
 	} else {
-		c->indigest = NULL;
+		logger(DEBUG_ALWAYS, LOG_ERR, "Possible intruder %s (%s): %s", c->name, c->hostname, "null digest");
+		return false;
 	}
 
 	c->status.decryptin = true;
@@ -647,9 +666,7 @@ bool send_challenge(connection_t *c) {
 	const size_t len = rsa_size(c->rsa);
 	char buffer[len * 2 + 1];
 
-	if(!c->hischallenge) {
-		c->hischallenge = xrealloc(c->hischallenge, len);
-	}
+	c->hischallenge = xrealloc(c->hischallenge, len);
 
 	/* Copy random data to the buffer */
 
@@ -676,41 +693,59 @@ bool challenge_h(connection_t *c, const char *request) {
 
 	char buffer[MAX_STRING_SIZE];
 	const size_t len = rsa_size(myself->connection->rsa);
-	size_t digestlen = digest_length(c->indigest);
-	char digest[digestlen];
 
 	if(sscanf(request, "%*d " MAX_STRING, buffer) != 1) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "CHALLENGE", c->name, c->hostname);
 		return false;
 	}
 
-	/* Convert the challenge from hexadecimal back to binary */
-
-	int inlen = hex2bin(buffer, buffer, sizeof(buffer));
-
 	/* Check if the length of the challenge is all right */
 
-	if(inlen != len) {
+	if(strlen(buffer) != (size_t)len * 2) {
 		logger(DEBUG_ALWAYS, LOG_ERR, "Possible intruder %s (%s): %s", c->name, c->hostname, "wrong challenge length");
 		return false;
 	}
 
+	c->mychallenge = xrealloc(c->mychallenge, len);
+
+	/* Convert the challenge from hexadecimal back to binary */
+
+	hex2bin(buffer, c->mychallenge, len);
+
+	/* The rest is done by send_chal_reply() */
+
+	c->allow_request = CHAL_REPLY;
+
+	if(c->outgoing) {
+		return send_chal_reply(c);
+	} else {
+		return true;
+	}
+
+#endif
+}
+
+bool send_chal_reply(connection_t *c) {
+	const size_t len = rsa_size(myself->connection->rsa);
+	size_t digestlen = digest_length(c->indigest);
+	char digest[digestlen * 2 + 1];
+
 	/* Calculate the hash from the challenge we received */
 
-	if(!digest_create(c->indigest, buffer, len, digest)) {
+	if(!digest_create(c->indigest, c->mychallenge, len, digest)) {
 		return false;
 	}
 
+	free(c->mychallenge);
+	c->mychallenge = NULL;
+
 	/* Convert the hash to a hexadecimal formatted string */
 
-	bin2hex(digest, buffer, digestlen);
+	bin2hex(digest, digest, digestlen);
 
 	/* Send the reply */
 
-	c->allow_request = CHAL_REPLY;
-
-	return send_request(c, "%d %s", CHAL_REPLY, buffer);
-#endif
+	return send_request(c, "%d %s", CHAL_REPLY, digest);
 }
 
 bool chal_reply_h(connection_t *c, const char *request) {
@@ -752,6 +787,10 @@ bool chal_reply_h(connection_t *c, const char *request) {
 	c->hischallenge = NULL;
 	c->allow_request = ACK;
 
+	if(!c->outgoing) {
+		send_chal_reply(c);
+	}
+
 	return send_ack(c);
 #endif
 }
@@ -801,7 +840,7 @@ bool send_ack(connection_t *c) {
 		c->options |= OPTION_TCPONLY | OPTION_INDIRECT;
 	}
 
-	if(myself->options & OPTION_PMTU_DISCOVERY) {
+	if(myself->options & OPTION_PMTU_DISCOVERY && !(c->options & OPTION_TCPONLY)) {
 		c->options |= OPTION_PMTU_DISCOVERY;
 	}