X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fprotocol_auth.c;h=e54fe231ac39c70bed677ea2d339c37640aa1a4d;hp=06735dcf87c27e4db30a096dd1a27d5eb3586ffc;hb=776dbf88df1911ec379c2fece0089fd2f5c71021;hpb=40d91ff619a6ea24a2a35c9d934bcc6bace27e24 diff --git a/src/protocol_auth.c b/src/protocol_auth.c index 06735dcf..e54fe231 100644 --- a/src/protocol_auth.c +++ b/src/protocol_auth.c @@ -1,7 +1,7 @@ /* protocol_auth.c -- handle the meta-protocol, authentication Copyright (C) 1999-2005 Ivo Timmermans, - 2000-2010 Guus Sliepen + 2000-2014 Guus Sliepen This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -31,14 +31,20 @@ #include "edge.h" #include "graph.h" #include "logger.h" +#include "meta.h" #include "net.h" #include "netutl.h" #include "node.h" #include "protocol.h" +#include "proxy.h" #include "utils.h" #include "xalloc.h" bool send_id(connection_t *c) { + if(proxytype && c->outgoing) + if(!send_proxyrequest(c)) + return false; + return send_request(c, "%d %s %d", ID, myself->connection->name, myself->connection->protocol_version); } @@ -109,15 +115,13 @@ bool id_h(connection_t *c) { } bool send_metakey(connection_t *c) { - char *buffer; - int len; bool x; - len = RSA_size(c->rsa_key); + int len = RSA_size(c->rsa_key); /* Allocate buffers for the meta key */ - buffer = alloca(2 * len + 1); + char buffer[2 * len + 1]; c->outkey = xrealloc(c->outkey, len); @@ -126,7 +130,12 @@ bool send_metakey(connection_t *c) { /* Copy random data to the buffer */ - RAND_pseudo_bytes((unsigned char *)c->outkey, len); + if (1 != RAND_bytes((unsigned char *)c->outkey, len)) { + int err = ERR_get_error(); + logger(LOG_ERR, "Failed to generate meta key (%s)", ERR_error_string(err, NULL)); + return false; + } + /* The message we send must be smaller than the modulus of the RSA key. By definition, for a key of k bits, the following formula holds: @@ -155,8 +164,8 @@ bool send_metakey(connection_t *c) { */ if(RSA_public_encrypt(len, (unsigned char *)c->outkey, (unsigned char *)buffer, c->rsa_key, RSA_NO_PADDING) != len) { - logger(LOG_ERR, "Error during encryption of meta key for %s (%s)", - c->name, c->hostname); + logger(LOG_ERR, "Error during encryption of meta key for %s (%s): %s", + c->name, c->hostname, ERR_error_string(ERR_get_error(), NULL)); return false; } @@ -219,13 +228,16 @@ bool metakey_h(connection_t *c) { /* Convert the challenge from hexadecimal back to binary */ - hex2bin(buffer, buffer, len); + if(!hex2bin(buffer, buffer, len)) { + logger(LOG_ERR, "Got bad %s from %s(%s): %s", "METAKEY", c->name, c->hostname, "invalid key"); + return false; + } /* Decrypt the meta key */ if(RSA_private_decrypt(len, (unsigned char *)buffer, (unsigned char *)c->inkey, myself->connection->rsa_key, RSA_NO_PADDING) != len) { /* See challenge() */ - logger(LOG_ERR, "Error during decryption of meta key for %s (%s)", - c->name, c->hostname); + logger(LOG_ERR, "Error during decryption of meta key for %s (%s): %s", + c->name, c->hostname, ERR_error_string(ERR_get_error(), NULL)); return false; } @@ -287,22 +299,23 @@ bool metakey_h(connection_t *c) { } bool send_challenge(connection_t *c) { - char *buffer; - int len; - /* CHECKME: what is most reasonable value for len? */ - len = RSA_size(c->rsa_key); + int len = RSA_size(c->rsa_key); /* Allocate buffers for the challenge */ - buffer = alloca(2 * len + 1); + char buffer[2 * len + 1]; c->hischallenge = xrealloc(c->hischallenge, len); /* Copy random data to the buffer */ - RAND_pseudo_bytes((unsigned char *)c->hischallenge, len); + if (1 != RAND_bytes((unsigned char *)c->hischallenge, len)) { + int err = ERR_get_error(); + logger(LOG_ERR, "Failed to generate challenge (%s)", ERR_error_string(err, NULL)); + return false; // Do not send predictable challenges, let connection attempt fail. + } /* Convert to hex */ @@ -340,7 +353,10 @@ bool challenge_h(connection_t *c) { /* Convert the challenge from hexadecimal back to binary */ - hex2bin(buffer, c->mychallenge, len); + if(!hex2bin(buffer, c->mychallenge, len)) { + logger(LOG_ERR, "Got bad %s from %s(%s): %s", "CHALLENGE", c->name, c->hostname, "invalid challenge"); + return false; + } c->allow_request = CHAL_REPLY; @@ -394,7 +410,10 @@ bool chal_reply_h(connection_t *c) { /* Convert the hash to binary format */ - hex2bin(hishash, hishash, c->outdigest->md_size); + if(!hex2bin(hishash, hishash, c->outdigest->md_size)) { + logger(LOG_ERR, "Got bad %s from %s(%s): %s", "CHAL_REPLY", c->name, c->hostname, "invalid hash"); + return false; + } /* Calculate the hash from the challenge we sent */ @@ -497,7 +516,7 @@ static void send_everything(connection_t *c) { bool ack_h(connection_t *c) { char hisport[MAX_STRING_SIZE]; - char *hisaddress, *dummy; + char *hisaddress; int weight, mtu; uint32_t options; node_t *n; @@ -539,7 +558,7 @@ bool ack_h(connection_t *c) { if(get_config_int(lookup_config(c->config_tree, "PMTU"), &mtu) && mtu < n->mtu) n->mtu = mtu; - if(get_config_int(lookup_config(myself->connection->config_tree, "PMTU"), &mtu) && mtu < n->mtu) + if(get_config_int(lookup_config(config_tree, "PMTU"), &mtu) && mtu < n->mtu) n->mtu = mtu; if(get_config_bool(lookup_config(c->config_tree, "ClampMSS"), &choice)) { @@ -566,10 +585,9 @@ bool ack_h(connection_t *c) { c->edge = new_edge(); c->edge->from = myself; c->edge->to = n; - sockaddr2str(&c->address, &hisaddress, &dummy); + sockaddr2str(&c->address, &hisaddress, NULL); c->edge->address = str2sockaddr(hisaddress, hisport); free(hisaddress); - free(dummy); c->edge->weight = (weight + c->estimated_weight) / 2; c->edge->connection = c; c->edge->options = c->options; @@ -581,7 +599,7 @@ bool ack_h(connection_t *c) { if(tunnelserver) send_add_edge(c, c->edge); else - send_add_edge(broadcast, c->edge); + send_add_edge(everyone, c->edge); /* Run MST and SSSP algorithms */