X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fprotocol_auth.c;h=4456ea599b90d930224c8b73ce5ea7f429b2f24e;hp=8541d3da743ce712cfefbc79e9f79b202847dd5a;hb=8b2b67e26c5b971761f5015764d5e188f6343bc4;hpb=c2b9c06062d36bde859b630b99a08c7b7428e721 diff --git a/src/protocol_auth.c b/src/protocol_auth.c index 8541d3da..4456ea59 100644 --- a/src/protocol_auth.c +++ b/src/protocol_auth.c @@ -1,7 +1,7 @@ /* protocol_auth.c -- handle the meta-protocol, authentication - Copyright (C) 1999-2002 Ivo Timmermans , - 2000-2002 Guus Sliepen + Copyright (C) 1999-2002 Ivo Timmermans , + 2000-2002 Guus Sliepen This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -17,7 +17,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - $Id: protocol_auth.c,v 1.1.4.2 2002/02/18 16:25:16 guus Exp $ + $Id: protocol_auth.c,v 1.1.4.14 2002/09/04 16:26:45 guus Exp $ */ #include "config.h" @@ -195,15 +195,20 @@ cp /* Send the meta key */ - x = send_request(c, "%d %s", METAKEY, buffer); + x = send_request(c, "%d %d %d %d %d %s", METAKEY, + c->outcipher?c->outcipher->nid:0, c->outdigest?c->outdigest->type:0, + c->outmaclength, c->outcompression, buffer); /* Further outgoing requests are encrypted with the key we just generated */ - EVP_EncryptInit(c->outctx, EVP_bf_cfb(), - c->outkey + len - EVP_bf_cfb()->key_len, - c->outkey + len - EVP_bf_cfb()->key_len - EVP_bf_cfb()->iv_len); + if(c->outcipher) + { + EVP_EncryptInit(c->outctx, c->outcipher, + c->outkey + len - c->outcipher->key_len, + c->outkey + len - c->outcipher->key_len - c->outcipher->iv_len); - c->status.encryptout = 1; + c->status.encryptout = 1; + } cp return x; } @@ -211,9 +216,10 @@ cp int metakey_h(connection_t *c) { char buffer[MAX_STRING_SIZE]; + int cipher, digest, maclength, compression; int len; cp - if(sscanf(c->buffer, "%*d "MAX_STRING, buffer) != 1) + if(sscanf(c->buffer, "%*d %d %d %d %d "MAX_STRING, &cipher, &digest, &maclength, &compression, buffer) != 5) { syslog(LOG_ERR, _("Got bad %s from %s (%s)"), "METAKEY", c->name, c->hostname); return -1; @@ -258,11 +264,51 @@ cp /* All incoming requests will now be encrypted. */ cp - EVP_DecryptInit(c->inctx, EVP_bf_cfb(), - c->inkey + len - EVP_bf_cfb()->key_len, - c->inkey + len - EVP_bf_cfb()->key_len - EVP_bf_cfb()->iv_len); - - c->status.decryptin = 1; + /* Check and lookup cipher and digest algorithms */ + + if(cipher) + { + c->incipher = EVP_get_cipherbynid(cipher); + if(!c->incipher) + { + syslog(LOG_ERR, _("%s (%s) uses unknown cipher!"), c->name, c->hostname); + return -1; + } + + EVP_DecryptInit(c->inctx, c->incipher, + c->inkey + len - c->incipher->key_len, + c->inkey + len - c->incipher->key_len - c->incipher->iv_len); + + c->status.decryptin = 1; + } + else + { + c->incipher = NULL; + } + + c->inmaclength = maclength; + + if(digest) + { + c->indigest = EVP_get_digestbynid(digest); + if(!c->indigest) + { + syslog(LOG_ERR, _("Node %s (%s) uses unknown digest!"), c->name, c->hostname); + return -1; + } + + if(c->inmaclength > c->indigest->md_size || c->inmaclength < 0) + { + syslog(LOG_ERR, _("%s (%s) uses bogus MAC length!"), c->name, c->hostname); + return -1; + } + } + else + { + c->indigest = NULL; + } + + c->incompression = compression; c->allow_request = CHALLENGE; cp @@ -340,16 +386,19 @@ cp int send_chal_reply(connection_t *c) { - char hash[SHA_DIGEST_LENGTH*2+1]; + char hash[EVP_MAX_MD_SIZE*2+1]; + EVP_MD_CTX ctx; cp /* Calculate the hash from the challenge we received */ - SHA1(c->mychallenge, RSA_size(myself->connection->rsa_key), hash); + EVP_DigestInit(&ctx, c->indigest); + EVP_DigestUpdate(&ctx, c->mychallenge, RSA_size(myself->connection->rsa_key)); + EVP_DigestFinal(&ctx, hash, NULL); /* Convert the hash to a hexadecimal formatted string */ - bin2hex(hash,hash,SHA_DIGEST_LENGTH); - hash[SHA_DIGEST_LENGTH*2] = '\0'; + bin2hex(hash,hash,c->indigest->md_size); + hash[c->indigest->md_size*2] = '\0'; /* Send the reply */ @@ -360,7 +409,8 @@ cp int chal_reply_h(connection_t *c) { char hishash[MAX_STRING_SIZE]; - char myhash[SHA_DIGEST_LENGTH]; + char myhash[EVP_MAX_MD_SIZE]; + EVP_MD_CTX ctx; cp if(sscanf(c->buffer, "%*d "MAX_STRING, hishash) != 1) { @@ -370,7 +420,7 @@ cp /* Check if the length of the hash is all right */ - if(strlen(hishash) != SHA_DIGEST_LENGTH*2) + if(strlen(hishash) != c->outdigest->md_size*2) { syslog(LOG_ERR, _("Possible intruder %s (%s): %s"), c->name, c->hostname, _("wrong challenge reply length")); return -1; @@ -378,15 +428,17 @@ cp /* Convert the hash to binary format */ - hex2bin(hishash, hishash, SHA_DIGEST_LENGTH); + hex2bin(hishash, hishash, c->outdigest->md_size); /* Calculate the hash from the challenge we sent */ - SHA1(c->hischallenge, RSA_size(c->rsa_key), myhash); + EVP_DigestInit(&ctx, c->outdigest); + EVP_DigestUpdate(&ctx, c->hischallenge, RSA_size(c->rsa_key)); + EVP_DigestFinal(&ctx, myhash, NULL); /* Verify the incoming hash with the calculated hash */ - if(memcmp(hishash, myhash, SHA_DIGEST_LENGTH)) + if(memcmp(hishash, myhash, c->outdigest->md_size)) { syslog(LOG_ERR, _("Possible intruder %s (%s): %s"), c->name, c->hostname, _("wrong challenge reply")); if(debug_lvl >= DEBUG_SCARY_THINGS) @@ -413,17 +465,13 @@ int send_ack(connection_t *c) to create node_t and edge_t structures. */ int x; - char *address, *port; struct timeval now; cp /* Estimate weight */ gettimeofday(&now, NULL); c->estimated_weight = (now.tv_sec - c->start.tv_sec) * 1000 + (now.tv_usec - c->start.tv_usec) / 1000; - sockaddr2str(&c->address, &address, &port); - x = send_request(c, "%d %s %s %s %d %d", ACK, myport, address, port, c->estimated_weight, c->options); - free(address); - free(port); + x = send_request(c, "%d %s %d %lx", ACK, myport, c->estimated_weight, c->options); cp return x; } @@ -435,7 +483,7 @@ void send_everything(connection_t *c) subnet_t *s; edge_t *e; - /* Send all known subnets */ + /* Send all known subnets and edges */ for(node = node_tree->head; node; node = node->next) { @@ -446,34 +494,24 @@ void send_everything(connection_t *c) s = (subnet_t *)node2->data; send_add_subnet(c, s); } - } - - /* Send all known edges */ - for(node = edge_tree->head; node; node = node->next) - { - e = (edge_t *)node->data; - - if(e == c->edge) - continue; - - send_add_edge(c, e); + for(node2 = n->edge_tree->head; node2; node2 = node2->next) + { + e = (edge_t *)node2->data; + send_add_edge(c, e); + } } } int ack_h(connection_t *c) { - char address[MAX_STRING_SIZE]; - char port[MAX_STRING_SIZE]; char hisport[MAX_STRING_SIZE]; char *hisaddress, *dummy; int weight; - int options; + long int options; node_t *n; - connection_t *other; - avl_node_t *node; cp - if(sscanf(c->buffer, "%*d "MAX_STRING" "MAX_STRING" "MAX_STRING" %d %d", hisport, address, port, &weight, &options) != 5) + if(sscanf(c->buffer, "%*d "MAX_STRING" %d %lx", hisport, &weight, &options) != 3) { syslog(LOG_ERR, _("Got bad %s from %s (%s)"), "ACK", c->name, c->hostname); return -1; @@ -498,25 +536,32 @@ cp syslog(LOG_DEBUG, _("Established a second connection with %s (%s), closing old connection"), n->name, n->hostname); terminate_connection(n->connection, 0); } - - /* FIXME: check if information in existing node matches that of the other end of this connection */ } n->connection = c; c->node = n; c->options |= options; + /* Activate this connection */ + + c->allow_request = ALL; + c->status.active = 1; + + if(debug_lvl >= DEBUG_CONNECTIONS) + syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), c->name, c->hostname); + + /* Send him everything we know */ + + send_everything(c); + /* Create an edge_t for this connection */ c->edge = new_edge(); cp - c->edge->from.node = myself; - c->edge->from.tcpaddress = str2sockaddr(address, port); - c->edge->from.udpaddress = str2sockaddr(address, myport); - c->edge->to.node = n; - c->edge->to.tcpaddress = c->address; + c->edge->from = myself; + c->edge->to = n; sockaddr2str(&c->address, &hisaddress, &dummy); - c->edge->to.udpaddress = str2sockaddr(hisaddress, hisport); + c->edge->address = str2sockaddr(hisaddress, hisport); free(hisaddress); free(dummy); c->edge->weight = (weight + c->estimated_weight) / 2; @@ -525,37 +570,14 @@ cp cp edge_add(c->edge); - /* Activate this connection */ - - c->allow_request = ALL; - c->status.active = 1; - - if(debug_lvl >= DEBUG_CONNECTIONS) - syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), c->name, c->hostname); - cp - /* Send him everything we know */ - - send_everything(c); + /* Notify everyone of the new edge */ - /* Notify others of this connection */ - - for(node = connection_tree->head; node; node = node->next) - { - other = (connection_t *)node->data; - - if(other->status.active && other != c) - send_add_edge(other, c->edge); - } + send_add_edge(broadcast, c->edge); /* Run MST and SSSP algorithms */ graph(); - - /* Succesful connection, reset timeout if this is an outgoing connection. */ - - if(c->outgoing) - c->outgoing->timeout = 0; cp return 0; }