tinc-vpn.org Git - tinc/blob - src/protocol_key.c

   1 /*
   2     protocol_key.c -- handle the meta-protocol, key exchange
   3     Copyright (C) 1999-2005 Ivo Timmermans,
   4                   2000-2017 Guus Sliepen <guus@tinc-vpn.org>
   5
   6     This program is free software; you can redistribute it and/or modify
   7     it under the terms of the GNU General Public License as published by
   8     the Free Software Foundation; either version 2 of the License, or
   9     (at your option) any later version.
  10
  11     This program is distributed in the hope that it will be useful,
  12     but WITHOUT ANY WARRANTY; without even the implied warranty of
  13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14     GNU General Public License for more details.
  15
  16     You should have received a copy of the GNU General Public License along
  17     with this program; if not, write to the Free Software Foundation, Inc.,
  18     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  19 */
  20
  21 #include "system.h"
  22
  23 #include "cipher.h"
  24 #include "connection.h"
  25 #include "crypto.h"
  26 #include "logger.h"
  27 #include "net.h"
  28 #include "netutl.h"
  29 #include "node.h"
  30 #include "prf.h"
  31 #include "protocol.h"
  32 #include "route.h"
  33 #include "sptps.h"
  34 #include "utils.h"
  35 #include "xalloc.h"
  36
  37 #ifndef DISABLE_LEGACY
  38 static bool mykeyused = false;
  39 #endif
  40
  41 void send_key_changed(void) {
  42 #ifndef DISABLE_LEGACY
  43         send_request(everyone, "%d %x %s", KEY_CHANGED, rand(), myself->name);
  44
  45         /* Immediately send new keys to directly connected nodes to keep UDP mappings alive */
  46
  47         for list_each(connection_t, c, connection_list)
  48                 if(c->edge && c->node && c->node->status.reachable && !c->node->status.sptps) {
  49                         send_ans_key(c->node);
  50                 }
  51
  52 #endif
  53
  54         /* Force key exchange for connections using SPTPS */
  55
  56         if(experimental) {
  57                 for splay_each(node_t, n, node_tree)
  58                         if(n->status.reachable && n->status.validkey && n->status.sptps) {
  59                                 sptps_force_kex(&n->sptps);
  60                         }
  61         }
  62 }
  63
  64 bool key_changed_h(connection_t *c, const char *request) {
  65         char name[MAX_STRING_SIZE];
  66         node_t *n;
  67
  68         if(sscanf(request, "%*d %*x " MAX_STRING, name) != 1) {
  69                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "KEY_CHANGED",
  70                        c->name, c->hostname);
  71                 return false;
  72         }
  73
  74         if(seen_request(request)) {
  75                 return true;
  76         }
  77
  78         n = lookup_node(name);
  79
  80         if(!n) {
  81                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist",
  82                        "KEY_CHANGED", c->name, c->hostname, name);
  83                 return true;
  84         }
  85
  86         if(!n->status.sptps) {
  87                 n->status.validkey = false;
  88                 n->last_req_key = 0;
  89         }
  90
  91         /* Tell the others */
  92
  93         if(!tunnelserver) {
  94                 forward_request(c, request);
  95         }
  96
  97         return true;
  98 }
  99
 100 static bool send_sptps_data_myself(void *handle, uint8_t type, const void *data, size_t len) {
 101         return send_sptps_data(handle, myself, type, data, len);
 102 }
 103
 104 static bool send_initial_sptps_data(void *handle, uint8_t type, const void *data, size_t len) {
 105         (void)type;
 106         node_t *to = handle;
 107         to->sptps.send_data = send_sptps_data_myself;
 108         char buf[len * 4 / 3 + 5];
 109
 110         b64encode(data, buf, len);
 111
 112         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_KEY, buf);
 113 }
 114
 115 bool send_req_key(node_t *to) {
 116         if(to->status.sptps) {
 117                 if(!node_read_ecdsa_public_key(to)) {
 118                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "No Ed25519 key known for %s (%s)", to->name, to->hostname);
 119                         send_request(to->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, to->name, REQ_PUBKEY);
 120                         return true;
 121                 }
 122
 123                 char label[25 + strlen(myself->name) + strlen(to->name)];
 124                 snprintf(label, sizeof(label), "tinc UDP key expansion %s %s", myself->name, to->name);
 125                 sptps_stop(&to->sptps);
 126                 to->status.validkey = false;
 127                 to->status.waitingforkey = true;
 128                 to->last_req_key = now.tv_sec;
 129                 to->incompression = myself->incompression;
 130                 return sptps_start(&to->sptps, to, true, true, myself->connection->ecdsa, to->ecdsa, label, sizeof(label), send_initial_sptps_data, receive_sptps_record);
 131         }
 132
 133         return send_request(to->nexthop->connection, "%d %s %s", REQ_KEY, myself->name, to->name);
 134 }
 135
 136 /* REQ_KEY is overloaded to allow arbitrary requests to be routed between two nodes. */
 137
 138 static bool req_key_ext_h(connection_t *c, const char *request, node_t *from, node_t *to, int reqno) {
 139         (void)c;
 140
 141         /* If this is a SPTPS packet, see if sending UDP info helps.
 142            Note that we only do this if we're the destination or the static relay;
 143            otherwise every hop would initiate its own UDP info message, resulting in elevated chatter. */
 144         if((reqno == REQ_KEY || reqno == SPTPS_PACKET) && to->via == myself) {
 145                 send_udp_info(myself, from);
 146         }
 147
 148         if(reqno == SPTPS_PACKET) {
 149                 /* This is a SPTPS data packet. */
 150
 151                 char buf[MAX_STRING_SIZE];
 152                 int len;
 153
 154                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode(buf, buf, strlen(buf)))) {
 155                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s) to %s (%s): %s", "SPTPS_PACKET", from->name, from->hostname, to->name, to->hostname, "invalid SPTPS data");
 156                         return true;
 157                 }
 158
 159                 if(to != myself) {
 160                         /* We don't just forward the request, because we want to use UDP if it's available. */
 161                         if(forwarding_mode == FMODE_INTERNAL) {
 162                                 send_sptps_data(to, from, 0, buf, len);
 163                                 try_tx(to, true);
 164                         }
 165                 } else {
 166                         /* The packet is for us */
 167                         if(!sptps_receive_data(&from->sptps, buf, len)) {
 168                                 /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
 169                                    so let's restart SPTPS in case that helps. But don't do that too often
 170                                    to prevent storms. */
 171                                 if(from->last_req_key < now.tv_sec - 10) {
 172                                         logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname);
 173                                         send_req_key(from);
 174                                 }
 175
 176                                 return true;
 177                         }
 178
 179                         send_mtu_info(myself, from, MTU);
 180                 }
 181
 182                 return true;
 183         }
 184
 185         /* Requests that are not SPTPS data packets are forwarded as-is. */
 186
 187         if(to != myself) {
 188                 return send_request(to->nexthop->connection, "%s", request);
 189         }
 190
 191         /* The request is for us */
 192
 193         switch(reqno) {
 194         case REQ_PUBKEY: {
 195                 if(!node_read_ecdsa_public_key(from)) {
 196                         /* Request their key *before* we send our key back. Otherwise the first SPTPS packet from them will get dropped. */
 197                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "Preemptively requesting Ed25519 key for %s (%s)", from->name, from->hostname);
 198                         send_request(from->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, from->name, REQ_PUBKEY);
 199                 }
 200
 201                 char *pubkey = ecdsa_get_base64_public_key(myself->connection->ecdsa);
 202                 send_request(from->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, from->name, ANS_PUBKEY, pubkey);
 203                 free(pubkey);
 204                 return true;
 205         }
 206
 207         case ANS_PUBKEY: {
 208                 if(node_read_ecdsa_public_key(from)) {
 209                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Got ANS_PUBKEY from %s (%s) even though we already have his pubkey", from->name, from->hostname);
 210                         return true;
 211                 }
 212
 213                 char pubkey[MAX_STRING_SIZE];
 214
 215                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, pubkey) != 1 || !(from->ecdsa = ecdsa_set_base64_public_key(pubkey))) {
 216                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ANS_PUBKEY", from->name, from->hostname, "invalid pubkey");
 217                         return true;
 218                 }
 219
 220                 logger(DEBUG_PROTOCOL, LOG_INFO, "Learned Ed25519 public key from %s (%s)", from->name, from->hostname);
 221                 append_config_file(from->name, "Ed25519PublicKey", pubkey);
 222                 return true;
 223         }
 224
 225         case REQ_KEY: {
 226                 if(!node_read_ecdsa_public_key(from)) {
 227                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "No Ed25519 key known for %s (%s)", from->name, from->hostname);
 228                         send_request(from->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, from->name, REQ_PUBKEY);
 229                         return true;
 230                 }
 231
 232                 if(from->sptps.label) {
 233                         logger(DEBUG_ALWAYS, LOG_DEBUG, "Got REQ_KEY from %s while we already started a SPTPS session!", from->name);
 234                 }
 235
 236                 char buf[MAX_STRING_SIZE];
 237                 size_t len;
 238
 239                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode(buf, buf, strlen(buf)))) {
 240                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_SPTPS_START", from->name, from->hostname, "invalid SPTPS data");
 241                         return true;
 242                 }
 243
 244                 char label[25 + strlen(from->name) + strlen(myself->name)];
 245                 snprintf(label, sizeof(label), "tinc UDP key expansion %s %s", from->name, myself->name);
 246                 sptps_stop(&from->sptps);
 247                 from->status.validkey = false;
 248                 from->status.waitingforkey = true;
 249                 from->last_req_key = now.tv_sec;
 250                 sptps_start(&from->sptps, from, false, true, myself->connection->ecdsa, from->ecdsa, label, sizeof(label), send_sptps_data_myself, receive_sptps_record);
 251                 sptps_receive_data(&from->sptps, buf, len);
 252                 send_mtu_info(myself, from, MTU);
 253                 return true;
 254         }
 255
 256         default:
 257                 logger(DEBUG_ALWAYS, LOG_ERR, "Unknown extended REQ_KEY request from %s (%s): %s", from->name, from->hostname, request);
 258                 return true;
 259         }
 260 }
 261
 262 bool req_key_h(connection_t *c, const char *request) {
 263         char from_name[MAX_STRING_SIZE];
 264         char to_name[MAX_STRING_SIZE];
 265         node_t *from, *to;
 266         int reqno = 0;
 267
 268         if(sscanf(request, "%*d " MAX_STRING " " MAX_STRING " %d", from_name, to_name, &reqno) < 2) {
 269                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "REQ_KEY", c->name,
 270                        c->hostname);
 271                 return false;
 272         }
 273
 274         if(!check_id(from_name) || !check_id(to_name)) {
 275                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_KEY", c->name, c->hostname, "invalid name");
 276                 return false;
 277         }
 278
 279         from = lookup_node(from_name);
 280
 281         if(!from) {
 282                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list",
 283                        "REQ_KEY", c->name, c->hostname, from_name);
 284                 return true;
 285         }
 286
 287         to = lookup_node(to_name);
 288
 289         if(!to) {
 290                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list",
 291                        "REQ_KEY", c->name, c->hostname, to_name);
 292                 return true;
 293         }
 294
 295         /* Check if this key request is for us */
 296
 297         if(to == myself) {                      /* Yes */
 298                 /* Is this an extended REQ_KEY message? */
 299                 if(experimental && reqno) {
 300                         return req_key_ext_h(c, request, from, to, reqno);
 301                 }
 302
 303                 /* No, just send our key back */
 304                 send_ans_key(from);
 305         } else {
 306                 if(tunnelserver) {
 307                         return true;
 308                 }
 309
 310                 if(!to->status.reachable) {
 311                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable",
 312                                "REQ_KEY", c->name, c->hostname, to_name);
 313                         return true;
 314                 }
 315
 316                 /* Is this an extended REQ_KEY message? */
 317                 if(experimental && reqno) {
 318                         return req_key_ext_h(c, request, from, to, reqno);
 319                 }
 320
 321                 send_request(to->nexthop->connection, "%s", request);
 322         }
 323
 324         return true;
 325 }
 326
 327 bool send_ans_key(node_t *to) {
 328         if(to->status.sptps) {
 329                 abort();
 330         }
 331
 332 #ifdef DISABLE_LEGACY
 333         return false;
 334 #else
 335         size_t keylen = myself->incipher ? cipher_keylength(myself->incipher) : 1;
 336         char key[keylen * 2 + 1];
 337
 338         randomize(key, keylen);
 339
 340         cipher_close(to->incipher);
 341         digest_close(to->indigest);
 342
 343         if(myself->incipher) {
 344                 to->incipher = cipher_open_by_nid(cipher_get_nid(myself->incipher));
 345
 346                 if(!to->incipher) {
 347                         abort();
 348                 }
 349
 350                 if(!cipher_set_key(to->incipher, key, false)) {
 351                         abort();
 352                 }
 353         }
 354
 355         if(myself->indigest) {
 356                 to->indigest = digest_open_by_nid(digest_get_nid(myself->indigest), digest_length(myself->indigest));
 357
 358                 if(!to->indigest) {
 359                         abort();
 360                 }
 361
 362                 if(!digest_set_key(to->indigest, key, keylen)) {
 363                         abort();
 364                 }
 365         }
 366
 367         to->incompression = myself->incompression;
 368
 369         bin2hex(key, key, keylen);
 370
 371         // Reset sequence number and late packet window
 372         mykeyused = true;
 373         to->received_seqno = 0;
 374         to->received = 0;
 375
 376         if(replaywin) {
 377                 memset(to->late, 0, replaywin);
 378         }
 379
 380         to->status.validkey_in = true;
 381
 382         return send_request(to->nexthop->connection, "%d %s %s %s %d %d %d %d", ANS_KEY,
 383                             myself->name, to->name, key,
 384                             cipher_get_nid(to->incipher),
 385                             digest_get_nid(to->indigest),
 386                             (int)digest_length(to->indigest),
 387                             to->incompression);
 388 #endif
 389 }
 390
 391 bool ans_key_h(connection_t *c, const char *request) {
 392         char from_name[MAX_STRING_SIZE];
 393         char to_name[MAX_STRING_SIZE];
 394         char key[MAX_STRING_SIZE];
 395         char address[MAX_STRING_SIZE] = "";
 396         char port[MAX_STRING_SIZE] = "";
 397         int cipher, digest, maclength, compression;
 398         node_t *from, *to;
 399
 400         if(sscanf(request, "%*d "MAX_STRING" "MAX_STRING" "MAX_STRING" %d %d %d %d "MAX_STRING" "MAX_STRING,
 401                         from_name, to_name, key, &cipher, &digest, &maclength,
 402                         &compression, address, port) < 7) {
 403                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "ANS_KEY", c->name,
 404                        c->hostname);
 405                 return false;
 406         }
 407
 408         if(!check_id(from_name) || !check_id(to_name)) {
 409                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ANS_KEY", c->name, c->hostname, "invalid name");
 410                 return false;
 411         }
 412
 413         from = lookup_node(from_name);
 414
 415         if(!from) {
 416                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list",
 417                        "ANS_KEY", c->name, c->hostname, from_name);
 418                 return true;
 419         }
 420
 421         to = lookup_node(to_name);
 422
 423         if(!to) {
 424                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list",
 425                        "ANS_KEY", c->name, c->hostname, to_name);
 426                 return true;
 427         }
 428
 429         /* Forward it if necessary */
 430
 431         if(to != myself) {
 432                 if(tunnelserver) {
 433                         return true;
 434                 }
 435
 436                 if(!to->status.reachable) {
 437                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable",
 438                                "ANS_KEY", c->name, c->hostname, to_name);
 439                         return true;
 440                 }
 441
 442                 if(!*address && from->address.sa.sa_family != AF_UNSPEC && to->minmtu) {
 443                         char *address, *port;
 444                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "Appending reflexive UDP address to ANS_KEY from %s to %s", from->name, to->name);
 445                         sockaddr2str(&from->address, &address, &port);
 446                         send_request(to->nexthop->connection, "%s %s %s", request, address, port);
 447                         free(address);
 448                         free(port);
 449                         return true;
 450                 }
 451
 452                 return send_request(to->nexthop->connection, "%s", request);
 453         }
 454
 455 #ifndef DISABLE_LEGACY
 456         /* Don't use key material until every check has passed. */
 457         cipher_close(from->outcipher);
 458         digest_close(from->outdigest);
 459 #endif
 460
 461         if(!from->status.sptps) {
 462                 from->status.validkey = false;
 463         }
 464
 465         switch(compression) {
 466         case 12:
 467 #ifdef HAVE_LZ4
 468                 break;
 469 #else
 470                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 471                 logger(DEBUG_ALWAYS, LOG_ERR, "LZ4 compression is unavailable on this node.");
 472                 return true;
 473 #endif
 474
 475         case 11:
 476         case 10:
 477 #ifdef HAVE_LZO
 478                 break;
 479 #else
 480                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 481                 logger(DEBUG_ALWAYS, LOG_ERR, "LZO compression is unavailable on this node.");
 482                 return true;
 483 #endif
 484
 485         case 9:
 486         case 8:
 487         case 7:
 488         case 6:
 489         case 5:
 490         case 4:
 491         case 3:
 492         case 2:
 493         case 1:
 494 #ifdef HAVE_ZLIB
 495                 break;
 496 #else
 497                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 498                 logger(DEBUG_ALWAYS, LOG_ERR, "ZLIB compression is unavailable on this node.");
 499                 return true;
 500 #endif
 501
 502         case 0:
 503                 break;
 504
 505         default:
 506                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 507                 logger(DEBUG_ALWAYS, LOG_ERR, "Compression level %i is unrecognized by this node.", compression);
 508                 return true;
 509         }
 510
 511         from->outcompression = compression;
 512
 513         /* SPTPS or old-style key exchange? */
 514
 515         if(from->status.sptps) {
 516                 char buf[strlen(key)];
 517                 size_t len = b64decode(key, buf, strlen(key));
 518
 519                 if(!len || !sptps_receive_data(&from->sptps, buf, len)) {
 520                         /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
 521                            so let's restart SPTPS in case that helps. But don't do that too often
 522                            to prevent storms.
 523                            Note that simply relying on handshake timeout is not enough, because
 524                            that doesn't apply to key regeneration. */
 525                         if(from->last_req_key < now.tv_sec - 10) {
 526                                 logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode handshake TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname);
 527                                 send_req_key(from);
 528                         }
 529
 530                         return true;
 531                 }
 532
 533                 if(from->status.validkey) {
 534                         if(*address && *port) {
 535                                 logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port);
 536                                 sockaddr_t sa = str2sockaddr(address, port);
 537                                 update_node_udp(from, &sa);
 538                         }
 539                 }
 540
 541                 send_mtu_info(myself, from, MTU);
 542
 543                 return true;
 544         }
 545
 546 #ifdef DISABLE_LEGACY
 547         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses legacy protocol!", from->name, from->hostname);
 548         return false;
 549 #else
 550         /* Check and lookup cipher and digest algorithms */
 551
 552         if(cipher) {
 553                 if(!(from->outcipher = cipher_open_by_nid(cipher))) {
 554                         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown cipher!", from->name, from->hostname);
 555                         return false;
 556                 }
 557         } else {
 558                 from->outcipher = NULL;
 559         }
 560
 561         if(digest) {
 562                 if(!(from->outdigest = digest_open_by_nid(digest, maclength))) {
 563                         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown digest!", from->name, from->hostname);
 564                         return false;
 565                 }
 566         } else {
 567                 from->outdigest = NULL;
 568         }
 569
 570         if((size_t)maclength != digest_length(from->outdigest)) {
 571                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus MAC length!", from->name, from->hostname);
 572                 return false;
 573         }
 574
 575         /* Process key */
 576
 577         size_t keylen = hex2bin(key, key, sizeof(key));
 578
 579         if(keylen != (from->outcipher ? cipher_keylength(from->outcipher) : 1)) {
 580                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses wrong keylength!", from->name, from->hostname);
 581                 return true;
 582         }
 583
 584         /* Update our copy of the origin's packet key */
 585
 586         if(from->outcipher && !cipher_set_key(from->outcipher, key, true)) {
 587                 return false;
 588         }
 589
 590         if(from->outdigest && !digest_set_key(from->outdigest, key, keylen)) {
 591                 return false;
 592         }
 593
 594         from->status.validkey = true;
 595         from->sent_seqno = 0;
 596
 597         if(*address && *port) {
 598                 logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port);
 599                 sockaddr_t sa = str2sockaddr(address, port);
 600                 update_node_udp(from, &sa);
 601         }
 602
 603         return true;
 604 #endif
 605 }