X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fprotocol.c;h=97b51b4321b4196d6a50a62b7bcddc7d8ae642d1;hp=bdb78c2b41d1cfa864923714a45927d66a23cfc7;hb=d2a54597e029f9d4f7bd29837be1be33909d78b1;hpb=34b7a876c3583f7a34585cff6a694bc9e35cdc87 diff --git a/src/protocol.c b/src/protocol.c index bdb78c2b..97b51b43 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -17,7 +17,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - $Id: protocol.c,v 1.28.4.82 2001/02/26 11:37:20 guus Exp $ + $Id: protocol.c,v 1.28.4.84 2001/03/02 11:25:56 guus Exp $ */ #include "config.h" @@ -271,6 +271,88 @@ cp return send_metakey(cl); } +int ack_h(connection_t *cl) +{ + config_t const *cfg; + connection_t *old, *p; + subnet_t *subnet; + avl_node_t *node, *node2; +cp + /* Okay, before we active the connection, we check if there is another entry + in the connection list with the same name. If so, it presumably is an + old connection that has timed out but we don't know it yet. + */ + + while((old = lookup_id(cl->name))) + { + if(debug_lvl >= DEBUG_CONNECTIONS) + syslog(LOG_NOTICE, _("Removing old entry for %s at %s in favour of new connection from %s"), + cl->name, old->hostname, cl->hostname); + + terminate_connection(old); + } + + /* Activate this connection */ + + cl->allow_request = ALL; + cl->status.active = 1; + cl->nexthop = cl; + cl->cipher_pkttype = EVP_bf_cbc(); + cl->cipher_pktkeylength = cl->cipher_pkttype->key_len + cl->cipher_pkttype->iv_len; + + if(debug_lvl >= DEBUG_CONNECTIONS) + syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), cl->name, cl->hostname); + +cp + /* Check some options */ + + if((cfg = get_config_val(cl->config, config_indirectdata))) + { + if(cfg->data.val == stupid_true) + cl->options |= OPTION_INDIRECT; + } + + if((cfg = get_config_val(cl->config, config_tcponly))) + { + if(cfg->data.val == stupid_true) + cl->options |= OPTION_TCPONLY; + } + + /* Send him our subnets */ + + for(node = myself->subnet_tree->head; node; node = node->next) + { + subnet = (subnet_t *)node->data; + send_add_subnet(cl, subnet); + } + /* And send him all the hosts and their subnets we know... */ + + for(node = connection_tree->head; node; node = node->next) + { + p = (connection_t *)node->data; + + if(p != cl && p->status.active) + { + /* Notify others of this connection */ + + if(p->status.meta) + send_add_host(p, cl); + + /* Notify new connection of everything we know */ + + send_add_host(cl, p); + + for(node2 = p->subnet_tree->head; node2; node2 = node2->next) + { + subnet = (subnet_t *)node2->data; + send_add_subnet(cl, subnet); + } + } + } +cp + return 0; +} + int send_challenge(connection_t *cl) { char *buffer; @@ -439,7 +521,17 @@ cp RAND_bytes(cl->cipher_outkey, len); - cl->cipher_outkey[0] &= 0x0F; /* Make sure that the random data is smaller than the modulus of the RSA key */ + /* The message we send must be smaller than the modulus of the RSA key. + By definition, for a key of k bits, the following formula holds: + + 2^(k-1) <= modulus < 2^(k) + + Where ^ means "to the power of", not "xor". + This means that to be sure, we must choose our message < 2^(k-1). + This can be done by setting the most significant bit to zero. + */ + + cl->cipher_outkey[0] &= 0x7F; if(debug_lvl >= DEBUG_SCARY_THINGS) { @@ -448,9 +540,14 @@ cp syslog(LOG_DEBUG, _("Generated random meta key (unencrypted): %s"), buffer); } - /* Encrypt the random data */ + /* Encrypt the random data - if(RSA_public_encrypt(len, cl->cipher_outkey, buffer, cl->rsa_key, RSA_NO_PADDING) != len) /* NO_PADDING because the message size equals the RSA key size and it is totally random */ + We do not use one of the PKCS padding schemes here. + This is allowed, because we encrypt a totally random string + with a length equal to that of the modulus of the RSA key. + */ + + if(RSA_public_encrypt(len, cl->cipher_outkey, buffer, cl->rsa_key, RSA_NO_PADDING) != len) { syslog(LOG_ERR, _("Error during encryption of meta key for %s (%s)"), cl->name, cl->hostname); free(buffer); @@ -539,88 +636,6 @@ cp return send_challenge(cl); } -int ack_h(connection_t *cl) -{ - config_t const *cfg; - connection_t *old, *p; - subnet_t *subnet; - avl_node_t *node, *node2; -cp - /* Okay, before we active the connection, we check if there is another entry - in the connection list with the same name. If so, it presumably is an - old connection that has timed out but we don't know it yet. - */ - - while((old = lookup_id(cl->name))) - { - if(debug_lvl >= DEBUG_CONNECTIONS) - syslog(LOG_NOTICE, _("Removing old entry for %s at %s in favour of new connection from %s"), - cl->name, old->hostname, cl->hostname); - - terminate_connection(old); - } - - /* Activate this connection */ - - cl->allow_request = ALL; - cl->status.active = 1; - cl->nexthop = cl; - cl->cipher_pkttype = EVP_bf_cbc(); - cl->cipher_pktkeylength = cl->cipher_pkttype->key_len + cl->cipher_pkttype->iv_len; - - if(debug_lvl >= DEBUG_CONNECTIONS) - syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), cl->name, cl->hostname); - -cp - /* Check some options */ - - if((cfg = get_config_val(cl->config, config_indirectdata))) - { - if(cfg->data.val == stupid_true) - cl->options |= OPTION_INDIRECT; - } - - if((cfg = get_config_val(cl->config, config_tcponly))) - { - if(cfg->data.val == stupid_true) - cl->options |= OPTION_TCPONLY; - } - - /* Send him our subnets */ - - for(node = myself->subnet_tree->head; node; node = node->next) - { - subnet = (subnet_t *)node->data; - send_add_subnet(cl, subnet); - } - /* And send him all the hosts and their subnets we know... */ - - for(node = connection_tree->head; node; node = node->next) - { - p = (connection_t *)node->data; - - if(p != cl && p->status.active) - { - /* Notify others of this connection */ - - if(p->status.meta) - send_add_host(p, cl); - - /* Notify new connection of everything we know */ - - send_add_host(cl, p); - - for(node2 = p->subnet_tree->head; node2; node2 = node2->next) - { - subnet = (subnet_t *)node2->data; - send_add_subnet(cl, subnet); - } - } - } -cp - return 0; -} - /* Address and subnet information exchange */ int send_add_subnet(connection_t *cl, subnet_t *subnet) @@ -798,6 +813,8 @@ cp if(!(cl->options & OPTION_INDIRECT)) return send_request(cl, "%d %s %lx:%d %lx", ADD_HOST, other->name, other->address, other->port, other->options); + else + return 0; } int add_host_h(connection_t *cl) @@ -808,7 +825,7 @@ int add_host_h(connection_t *cl) cp new = new_connection(); - if(sscanf(cl->buffer, "%*d "MAX_STRING" %lx:%d %lx", name, &new->address, &new->port, &new->options) != 4) + if(sscanf(cl->buffer, "%*d "MAX_STRING" %lx:%hd %lx", name, &new->address, &new->port, &new->options) != 4) { syslog(LOG_ERR, _("Got bad ADD_HOST from %s (%s)"), cl->name, cl->hostname); return -1; @@ -890,6 +907,8 @@ cp if(!(cl->options & OPTION_INDIRECT)) return send_request(cl, "%d %s %lx:%d %lx", DEL_HOST, other->name, other->address, other->port, other->options); + else + return 0; } int del_host_h(connection_t *cl) @@ -901,7 +920,7 @@ int del_host_h(connection_t *cl) connection_t *old, *p; avl_node_t *node; cp - if(sscanf(cl->buffer, "%*d "MAX_STRING" %lx:%d %lx", name, &address, &port, &options) != 4) + if(sscanf(cl->buffer, "%*d "MAX_STRING" %lx:%hd %lx", name, &address, &port, &options) != 4) { syslog(LOG_ERR, _("Got bad DEL_HOST from %s (%s)"), cl->name, cl->hostname);