X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fprotocol.c;h=1bb37346318535acdb46ce44196e13ba97f604f3;hp=3c596398e91013716a4f963e46cceebabc33ad38;hb=7398002ade1397bd857953f009f4aed65ffc9218;hpb=9f64499e40a95a8c05c82924219517aa017fc411 diff --git a/src/protocol.c b/src/protocol.c index 3c596398..1bb37346 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -17,7 +17,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - $Id: protocol.c,v 1.28.4.43 2000/10/20 15:34:37 guus Exp $ + $Id: protocol.c,v 1.28.4.48 2000/10/29 00:24:31 guus Exp $ */ #include "config.h" @@ -37,6 +37,7 @@ #include #include +#include #include "conf.h" #include "encr.h" @@ -44,6 +45,7 @@ #include "netutl.h" #include "protocol.h" #include "meta.h" +#include "connlist.h" #include "system.h" @@ -104,10 +106,11 @@ cp } else { - if(debug_lvl > DEBUG_PROTOCOL) + if(debug_lvl >= DEBUG_PROTOCOL) syslog(LOG_DEBUG, _("Got %s from %s (%s)"), request_name[request], cl->name, cl->hostname); } + if(request_handlers[request](cl)) /* Something went wrong. Probably scriptkiddies. Terminate. */ { @@ -122,6 +125,8 @@ cp cl->name, cl->hostname); return -1; } +cp + return 0; } /* Connection protocol: @@ -205,7 +210,7 @@ cp { if((old = lookup_id(cl->name))) { - if(debug_lvl > DEBUG_CONNECTIONS) + if(debug_lvl >= DEBUG_CONNECTIONS) syslog(LOG_NOTICE, _("Uplink %s (%s) is already in our connection list"), cl->name, cl->hostname); cl->status.outgoing = 0; old->status.outgoing = 1; @@ -214,19 +219,17 @@ cp } } cp - if(!(cfg = get_config_val(cl->config, publickey))) - { - syslog(LOG_ERR, _("No public key known for %s (%s)"), cl->name, cl->hostname); - return -1; - } - else + if((cfg = get_config_val(cl->config, publickey))) { -cp cl->rsa_key = RSA_new(); BN_hex2bn(&cl->rsa_key->n, cfg->data.ptr); BN_hex2bn(&cl->rsa_key->e, "FFFF"); } - + else + { + syslog(LOG_ERR, _("No public key known for %s (%s)"), cl->name, cl->hostname); + return -1; + } cp return send_challenge(cl); } @@ -247,10 +250,23 @@ cp cl->hischallenge = xmalloc(len); cp + /* Seed the PRNG with urandom (can't afford to block) */ + + RAND_load_file("/dev/urandom", 1024); + /* Copy random data to the buffer */ RAND_bytes(cl->hischallenge, len); + cl->hischallenge[0] &= 0x7F; /* Somehow if the first byte is more than 0xD0 or something like that, decryption fails... */ + + if(debug_lvl >= DEBUG_SCARY_THINGS) + { + bin2hex(cl->hischallenge, buffer, len); + buffer[len*2] = '\0'; + syslog(LOG_DEBUG, _("Generated random challenge (unencrypted): %s"), buffer); + } + /* Encrypt the random data */ if(RSA_public_encrypt(len, cl->hischallenge, buffer, cl->rsa_key, RSA_NO_PADDING) != len) /* NO_PADDING because the message size equals the RSA key size and it is totally random */ @@ -314,6 +330,13 @@ cp return -1; } + if(debug_lvl >= DEBUG_SCARY_THINGS) + { + bin2hex(cl->mychallenge, buffer, len); + buffer[len*2] = '\0'; + syslog(LOG_DEBUG, _("Received random challenge (unencrypted): %s"), buffer); + } + free(buffer); /* Rest is done by send_chal_reply() */ @@ -385,10 +408,17 @@ cp if(memcmp(hishash, myhash, SHA_DIGEST_LENGTH)) { syslog(LOG_ERR, _("Intruder: wrong challenge reply from %s (%s)"), cl->name, cl->hostname); + if(debug_lvl >= DEBUG_SCARY_THINGS) + { + bin2hex(myhash, hishash, SHA_DIGEST_LENGTH); + hishash[SHA_DIGEST_LENGTH*2] = '\0'; + syslog(LOG_DEBUG, _("Expected challenge reply: %s"), hishash); + } free(hishash); return -1; } + free(hishash); /* Identity has now been positively verified. @@ -412,7 +442,8 @@ cp int ack_h(conn_list_t *cl) { - conn_list_t *old; + conn_list_t *old, *p; + subnet_t *s; cp /* Okay, before we active the connection, we check if there is another entry in the connection list with the same name. If so, it presumably is an @@ -421,10 +452,10 @@ cp while((old = lookup_id(cl->name))) { - if(debug_lvl > DEBUG_CONNECTIONS) + if(debug_lvl >= DEBUG_CONNECTIONS) syslog(LOG_NOTICE, _("Removing old entry for %s at %s in favour of new connection from %s"), cl->name, old->hostname, cl->hostname); - old->status.active = 0; + terminate_connection(old); } @@ -432,34 +463,50 @@ cp cl->allow_request = ALL; cl->status.active = 1; + cl->nexthop = cl; - if(debug_lvl > DEBUG_CONNECTIONS) + if(debug_lvl >= DEBUG_CONNECTIONS) syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), cl->name, cl->hostname); - /* Exchange information about other tinc daemons */ +cp + if(!cl->status.outgoing) + send_ack(cl); + + /* Send him our subnets */ + + for(s = myself->subnets; s; s = s->next) + send_add_subnet(cl, s); -/* FIXME: reprogram this. - notify_others(cl, NULL, send_add_host); - notify_one(cl); -*/ - upstreamindex = 0; + /* And send him all the hosts and their subnets we know... */ + + for(p = conn_list; p; p = p->next) + if(p != cl && p->status.active) + { + /* Notify others of this connection */ + + if(p->status.meta) + send_add_host(p, cl); + + /* Notify new connection of everything we know */ + send_add_host(cl, p); + + for(s = p->subnets; s; s = s->next) + send_add_subnet(cl, s); + } cp - if(cl->status.outgoing) - return 0; - else - return send_ack(cl); + return 0; } /* Address and subnet information exchange */ -int send_add_subnet(conn_list_t *cl, conn_list_t *other, subnet_t *subnet) +int send_add_subnet(conn_list_t *cl, subnet_t *subnet) { int x; char *netstr; cp x = send_request(cl, "%d %s %s", ADD_SUBNET, - other->name, netstr = net2str(subnet)); + subnet->owner->name, netstr = net2str(subnet)); free(netstr); cp return x; @@ -469,10 +516,10 @@ int add_subnet_h(conn_list_t *cl) { char *subnetstr; char *name; - conn_list_t *owner; - subnet_t *subnet, *old; + conn_list_t *owner, *p; + subnet_t *subnet; cp - if(sscanf(cl->buffer, "%*d %as %as", &name, &subnetstr) != 3) + if(sscanf(cl->buffer, "%*d %as %as", &name, &subnetstr) != 2) { syslog(LOG_ERR, _("Got bad ADD_SUBNET from %s (%s)"), cl->name, cl->hostname); free(name); free(subnetstr); @@ -523,22 +570,34 @@ cp /* If everything is correct, add the subnet to the list of the owner */ subnet_add(owner, subnet); + + /* Tell the rest */ + + for(p = conn_list; p; p = p->next) + if(p->status.meta && p->status.active && p!= cl) + send_add_subnet(p, subnet); cp return 0; } -int send_del_subnet(conn_list_t *cl, conn_list_t *other, subnet_t *subnet) +int send_del_subnet(conn_list_t *cl, subnet_t *subnet) { + int x; + char *netstr; +cp + netstr = net2str(subnet); + x = send_request(cl, "%d %s %s", DEL_SUBNET, subnet->owner->name, netstr); + free(netstr); cp - return send_request(cl, "%d %s %s", DEL_SUBNET, other->name, net2str(subnet)); + return x; } int del_subnet_h(conn_list_t *cl) { char *subnetstr; char *name; - conn_list_t *owner; - subnet_t *subnet, *old; + conn_list_t *owner, *p; + subnet_t *subnet; cp if(sscanf(cl->buffer, "%*d %as %as", &name, &subnetstr) != 3) { @@ -591,6 +650,12 @@ cp /* If everything is correct, delete the subnet from the list of the owner */ subnet_del(subnet); + + /* Tell the rest */ + + for(p = conn_list; p; p = p->next) + if(p->status.meta && p->status.active && p!= cl) + send_del_subnet(p, subnet); cp return 0; } @@ -600,18 +665,18 @@ cp int send_add_host(conn_list_t *cl, conn_list_t *other) { cp - return send_request(cl, "%d %s %s %lx:%d %lx", ADD_HOST, - myself->name, other->name, other->address, other->port, other->options); + return send_request(cl, "%d %s %lx:%d %lx", ADD_HOST, + other->name, other->address, other->port, other->options); } int add_host_h(conn_list_t *cl) { - char *sender; - conn_list_t *old, *new, *hisuplink; + conn_list_t *old, *new; + conn_list_t *p; cp new = new_conn_list(); - if(sscanf(cl->buffer, "%*d %as %as %lx:%d %lx", &sender, &new->name, &new->address, &new->port, &new->options) != 5) + if(sscanf(cl->buffer, "%*d %as %lx:%d %lx", &new->name, &new->address, &new->port, &new->options) != 4) { syslog(LOG_ERR, _("Got bad ADD_HOST from %s (%s)"), cl->name, cl->hostname); return -1; @@ -619,10 +684,10 @@ cp /* Check if identity is a valid name */ - if(check_id(new->name) || check_id(sender)) + if(check_id(new->name)) { syslog(LOG_ERR, _("Got bad ADD_HOST from %s (%s): invalid identity name"), cl->name, cl->hostname); - free(sender); + free_conn_list(new); return -1; } @@ -632,32 +697,10 @@ cp { syslog(LOG_ERR, _("Warning: got ADD_HOST from %s (%s) for ourself, restarting"), cl->name, cl->hostname); sighup = 1; - free(sender); - return 0; - } - - /* We got an ADD_HOST from ourself!? */ - - if(!strcmp(sender, myself->name)) - { - syslog(LOG_ERR, _("Warning: got ADD_HOST from %s (%s) from ourself, restarting"), cl->name, cl->hostname); - sighup = 1; - free(sender); + free_conn_list(new); return 0; } - - /* Lookup his uplink */ - - if(!(new->hisuplink = lookup_id(sender))) - { - syslog(LOG_ERR, _("Got ADD_HOST from %s (%s) with origin %s which is not in our connection list"), - sender, cl->name, cl->hostname); - free(sender); - return -1; - } - free(sender); - /* Fill in more of the new conn_list structure */ new->hostname = hostlookup(htonl(new->address)); @@ -668,34 +711,37 @@ cp { if((new->address == old->address) && (new->port == old->port)) { - if(debug_lvl > DEBUG_CONNECTIONS) + if(debug_lvl >= DEBUG_CONNECTIONS) syslog(LOG_NOTICE, _("Got duplicate ADD_HOST for %s (%s) from %s (%s)"), old->name, old->hostname, new->name, new->hostname); + free_conn_list(new); return 0; } else { - if(debug_lvl > DEBUG_CONNECTIONS) - syslog(LOG_NOTICE, _("Removing old entry for %s (%s)"), + if(debug_lvl >= DEBUG_CONNECTIONS) + syslog(LOG_NOTICE, _("Removing old entry for %s (%s) in favour of new connection"), old->name, old->hostname); - old->status.active = 0; + terminate_connection(old); } } - /* Fill in rest of conn_list structure */ - - new->myuplink = cl; - new->status.active = 1; - /* Hook it up into the conn_list */ - conn_list_add(conn_list, new); + conn_list_add(new); /* Tell the rest about the new host */ -/* FIXME: reprogram this. - notify_others(new, cl, send_add_host); -*/ + + for(p = conn_list; p; p = p->next) + if(p->status.meta && p->status.active && p!=cl) + send_add_host(p, new); + + /* Fill in rest of conn_list structure */ + + new->nexthop = cl; + new->status.active = 1; + cp return 0; } @@ -703,21 +749,19 @@ cp int send_del_host(conn_list_t *cl, conn_list_t *other) { cp - return send_request(cl, "%d %s %s %lx:%d %lx", DEL_HOST, - myself->name, other->name, other->address, other->port, other->options); + return send_request(cl, "%d %s %lx:%d %lx", DEL_HOST, + other->name, other->address, other->port, other->options); } int del_host_h(conn_list_t *cl) { char *name; - char *sender; ip_t address; port_t port; - int options; - conn_list_t *old, *hisuplink; - + long int options; + conn_list_t *old, *p; cp - if(sscanf(cl->buffer, "%*d %as %as %lx:%d %lx", &sender, &name, &address, &port, &options) != 5) + if(sscanf(cl->buffer, "%*d %as %lx:%d %lx", &name, &address, &port, &options) != 4) { syslog(LOG_ERR, _("Got bad DEL_HOST from %s (%s)"), cl->name, cl->hostname); @@ -726,10 +770,10 @@ cp /* Check if identity is a valid name */ - if(check_id(name) || check_id(sender)) + if(check_id(name)) { syslog(LOG_ERR, _("Got bad DEL_HOST from %s (%s): invalid identity name"), cl->name, cl->hostname); - free(name); free(sender); + free(name); return -1; } @@ -739,33 +783,11 @@ cp { syslog(LOG_ERR, _("Warning: got DEL_HOST from %s (%s) for ourself, restarting"), cl->name, cl->hostname); - free(name); free(sender); - sighup = 1; - return 0; - } - - /* We got an ADD_HOST from ourself!? */ - - if(!strcmp(sender, myself->name)) - { - syslog(LOG_ERR, _("Warning: got DEL_HOST from %s (%s) from ourself, restarting"), cl->name, cl->hostname); + free(name); sighup = 1; - free(name); free(sender); return 0; } - /* Lookup his uplink */ - - if(!(hisuplink = lookup_id(sender))) - { - syslog(LOG_ERR, _("Got DEL_HOST from %s (%s) with origin %s which is not in our connection list"), - cl->name, cl->hostname, sender); - free(name); free(sender); - return -1; - } - - free(sender); - /* Check if the new host already exists in the connnection list */ if(!(old = lookup_id(name))) @@ -778,7 +800,7 @@ cp /* Check if the rest matches */ - if(address!=old->address || port!=old->port || options!=old->options || hisuplink!=old->hisuplink || cl!=old->myuplink) + if(address!=old->address || port!=old->port || options!=old->options || cl!=old->nexthop) { syslog(LOG_WARNING, _("Got DEL_HOST from %s (%s) for %s which doesn't match"), cl->name, cl->hostname, old->name); return 0; @@ -786,10 +808,14 @@ cp /* Ok, since EVERYTHING seems to check out all right, delete it */ - old->status.termreq = 1; old->status.active = 0; - terminate_connection(old); + + /* Tell the rest about the new host */ + + for(p = conn_list; p; p = p->next) + if(p->status.meta && p->status.active && p!=cl) + send_del_host(p, old); cp return 0; } @@ -817,7 +843,7 @@ cp return -1; } - if(debug_lvl > DEBUG_STATUS) + if(debug_lvl >= DEBUG_STATUS) { syslog(LOG_NOTICE, _("Status message from %s (%s): %s: %s"), cl->name, cl->hostname, status_text[statusno], statusstring); @@ -848,14 +874,13 @@ cp return -1; } - if(debug_lvl > DEBUG_ERROR) + if(debug_lvl >= DEBUG_ERROR) { syslog(LOG_NOTICE, _("Error message from %s (%s): %s: %s"), cl->name, cl->hostname, strerror(errno), errorstring); } free(errorstring); - cl->status.termreq = 1; terminate_connection(cl); cp return 0; @@ -870,7 +895,6 @@ cp int termreq_h(conn_list_t *cl) { cp - cl->status.termreq = 1; terminate_connection(cl); cp return 0; @@ -1037,6 +1061,7 @@ cp keylength = strlen(pktkey); +/* Don't do this... yet if((keylength%2) || (keylength <= 0)) { syslog(LOG_ERR, _("Got bad ANS_KEY from %s (%s) origin %s: invalid key"), @@ -1047,6 +1072,10 @@ cp keylength /= 2; hex2bin(pktkey, pktkey, keylength); BF_set_key(cl->cipher_pktkey, keylength, pktkey); +*/ + + from->status.validkey = 1; + from->status.waitingforkey = 0; } else {