www.tinc-vpn.org Git - tinc/blob - src/protocol_key.c

   1 /*
   2     protocol_key.c -- handle the meta-protocol, key exchange
   3     Copyright (C) 1999-2005 Ivo Timmermans,
   4                   2000-2017 Guus Sliepen <guus@tinc-vpn.org>
   5
   6     This program is free software; you can redistribute it and/or modify
   7     it under the terms of the GNU General Public License as published by
   8     the Free Software Foundation; either version 2 of the License, or
   9     (at your option) any later version.
  10
  11     This program is distributed in the hope that it will be useful,
  12     but WITHOUT ANY WARRANTY; without even the implied warranty of
  13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14     GNU General Public License for more details.
  15
  16     You should have received a copy of the GNU General Public License along
  17     with this program; if not, write to the Free Software Foundation, Inc.,
  18     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  19 */
  20
  21 #include "system.h"
  22
  23 #include "cipher.h"
  24 #include "connection.h"
  25 #include "crypto.h"
  26 #include "logger.h"
  27 #include "net.h"
  28 #include "netutl.h"
  29 #include "node.h"
  30 #include "protocol.h"
  31 #include "route.h"
  32 #include "sptps.h"
  33 #include "utils.h"
  34 #include "compression.h"
  35 #include "random.h"
  36 #include "legacy.h"
  37
  38 void send_key_changed(void) {
  39 #ifndef DISABLE_LEGACY
  40         send_request(everyone, "%d %x %s", KEY_CHANGED, prng(UINT32_MAX), myself->name);
  41
  42         /* Immediately send new keys to directly connected nodes to keep UDP mappings alive */
  43
  44         for list_each(connection_t, c, &connection_list) {
  45                 if(c->edge && c->node && c->node->status.reachable && !c->node->status.sptps) {
  46                         send_ans_key(c->node);
  47                 }
  48         }
  49
  50 #endif
  51
  52         /* Force key exchange for connections using SPTPS */
  53
  54         if(experimental) {
  55                 for splay_each(node_t, n, &node_tree) {
  56                         if(n->status.reachable && n->status.validkey && n->status.sptps) {
  57                                 sptps_force_kex(&n->sptps);
  58                         }
  59                 }
  60         }
  61 }
  62
  63 bool key_changed_h(connection_t *c, const char *request) {
  64         char name[MAX_STRING_SIZE];
  65         node_t *n;
  66
  67         if(sscanf(request, "%*d %*x " MAX_STRING, name) != 1) {
  68                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "KEY_CHANGED",
  69                        c->name, c->hostname);
  70                 return false;
  71         }
  72
  73         if(seen_request(request)) {
  74                 return true;
  75         }
  76
  77         n = lookup_node(name);
  78
  79         if(!n) {
  80                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist",
  81                        "KEY_CHANGED", c->name, c->hostname, name);
  82                 return true;
  83         }
  84
  85         if(!n->status.sptps) {
  86                 n->status.validkey = false;
  87                 n->last_req_key = 0;
  88         }
  89
  90         /* Tell the others */
  91
  92         if(!tunnelserver) {
  93                 forward_request(c, request);
  94         }
  95
  96         return true;
  97 }
  98
  99 static bool send_sptps_data_myself(void *handle, uint8_t type, const void *data, size_t len) {
 100         return send_sptps_data(handle, myself, type, data, len);
 101 }
 102
 103 static bool send_initial_sptps_data(void *handle, uint8_t type, const void *data, size_t len) {
 104         (void)type;
 105         node_t *to = handle;
 106         to->sptps.send_data = send_sptps_data_myself;
 107
 108         char *buf = alloca(B64_SIZE(len));
 109         b64encode_tinc(data, buf, len);
 110
 111         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_KEY, buf);
 112 }
 113
 114 bool send_req_key(node_t *to) {
 115         if(to->status.sptps) {
 116                 if(!node_read_ecdsa_public_key(to)) {
 117                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "No Ed25519 key known for %s (%s)", to->name, to->hostname);
 118                         send_request(to->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, to->name, REQ_PUBKEY);
 119                         return true;
 120                 }
 121
 122                 const size_t labellen = 25 + strlen(myself->name) + strlen(to->name);
 123                 char *label = alloca(labellen);
 124                 snprintf(label, labellen, "tinc UDP key expansion %s %s", myself->name, to->name);
 125
 126                 sptps_stop(&to->sptps);
 127                 to->status.validkey = false;
 128                 to->status.waitingforkey = true;
 129                 to->last_req_key = now.tv_sec;
 130                 to->incompression = myself->incompression;
 131                 return sptps_start(&to->sptps, to, true, true, myself->connection->ecdsa, to->ecdsa, label, labellen, send_initial_sptps_data, receive_sptps_record);
 132         }
 133
 134         return send_request(to->nexthop->connection, "%d %s %s", REQ_KEY, myself->name, to->name);
 135 }
 136
 137 /* REQ_KEY is overloaded to allow arbitrary requests to be routed between two nodes. */
 138
 139 static bool req_key_ext_h(connection_t *c, const char *request, node_t *from, node_t *to, int reqno) {
 140         (void)c;
 141
 142         /* If this is a SPTPS packet, see if sending UDP info helps.
 143            Note that we only do this if we're the destination or the static relay;
 144            otherwise every hop would initiate its own UDP info message, resulting in elevated chatter. */
 145         if((reqno == REQ_KEY || reqno == SPTPS_PACKET) && to->via == myself) {
 146                 send_udp_info(myself, from);
 147         }
 148
 149         if(reqno == SPTPS_PACKET) {
 150                 /* This is a SPTPS data packet. */
 151
 152                 char buf[MAX_STRING_SIZE];
 153                 size_t len;
 154
 155                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode_tinc(buf, buf, strlen(buf)))) {
 156                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s) to %s (%s): %s", "SPTPS_PACKET", from->name, from->hostname, to->name, to->hostname, "invalid SPTPS data");
 157                         return true;
 158                 }
 159
 160                 if(to != myself) {
 161                         /* We don't just forward the request, because we want to use UDP if it's available. */
 162                         if(forwarding_mode == FMODE_INTERNAL) {
 163                                 send_sptps_data(to, from, 0, buf, len);
 164                                 try_tx(to, true);
 165                         }
 166                 } else {
 167                         /* The packet is for us */
 168                         if(!sptps_receive_data(&from->sptps, buf, len)) {
 169                                 /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
 170                                    so let's restart SPTPS in case that helps. But don't do that too often
 171                                    to prevent storms. */
 172                                 if(from->last_req_key < now.tv_sec - 10) {
 173                                         logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname);
 174                                         send_req_key(from);
 175                                 }
 176
 177                                 return true;
 178                         }
 179
 180                         send_mtu_info(myself, from, MTU);
 181                 }
 182
 183                 return true;
 184         }
 185
 186         /* Requests that are not SPTPS data packets are forwarded as-is. */
 187
 188         if(to != myself) {
 189                 return send_request(to->nexthop->connection, "%s", request);
 190         }
 191
 192         /* The request is for us */
 193
 194         switch(reqno) {
 195         case REQ_PUBKEY: {
 196                 if(!node_read_ecdsa_public_key(from)) {
 197                         /* Request their key *before* we send our key back. Otherwise the first SPTPS packet from them will get dropped. */
 198                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "Preemptively requesting Ed25519 key for %s (%s)", from->name, from->hostname);
 199                         send_request(from->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, from->name, REQ_PUBKEY);
 200                 }
 201
 202                 char *pubkey = ecdsa_get_base64_public_key(myself->connection->ecdsa);
 203                 send_request(from->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, from->name, ANS_PUBKEY, pubkey);
 204                 free(pubkey);
 205                 return true;
 206         }
 207
 208         case ANS_PUBKEY: {
 209                 if(node_read_ecdsa_public_key(from)) {
 210                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Got ANS_PUBKEY from %s (%s) even though we already have his pubkey", from->name, from->hostname);
 211                         return true;
 212                 }
 213
 214                 char pubkey[MAX_STRING_SIZE];
 215
 216                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, pubkey) != 1 || !(from->ecdsa = ecdsa_set_base64_public_key(pubkey))) {
 217                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ANS_PUBKEY", from->name, from->hostname, "invalid pubkey");
 218                         return true;
 219                 }
 220
 221                 logger(DEBUG_PROTOCOL, LOG_INFO, "Learned Ed25519 public key from %s (%s)", from->name, from->hostname);
 222                 append_config_file(from->name, "Ed25519PublicKey", pubkey);
 223                 return true;
 224         }
 225
 226         case REQ_KEY: {
 227                 if(!node_read_ecdsa_public_key(from)) {
 228                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "No Ed25519 key known for %s (%s)", from->name, from->hostname);
 229                         send_request(from->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, from->name, REQ_PUBKEY);
 230                         return true;
 231                 }
 232
 233                 if(from->sptps.label) {
 234                         logger(DEBUG_ALWAYS, LOG_DEBUG, "Got REQ_KEY from %s while we already started a SPTPS session!", from->name);
 235                 }
 236
 237                 char buf[MAX_STRING_SIZE];
 238                 size_t len;
 239
 240                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode_tinc(buf, buf, strlen(buf)))) {
 241                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_SPTPS_START", from->name, from->hostname, "invalid SPTPS data");
 242                         return true;
 243                 }
 244
 245                 const size_t labellen = 25 + strlen(from->name) + strlen(myself->name);
 246                 char *label = alloca(labellen);
 247                 snprintf(label, labellen, "tinc UDP key expansion %s %s", from->name, myself->name);
 248                 sptps_stop(&from->sptps);
 249                 from->status.validkey = false;
 250                 from->status.waitingforkey = true;
 251                 from->last_req_key = now.tv_sec;
 252                 sptps_start(&from->sptps, from, false, true, myself->connection->ecdsa, from->ecdsa, label, labellen, send_sptps_data_myself, receive_sptps_record);
 253                 sptps_receive_data(&from->sptps, buf, len);
 254                 send_mtu_info(myself, from, MTU);
 255                 return true;
 256         }
 257
 258         default:
 259                 logger(DEBUG_ALWAYS, LOG_ERR, "Unknown extended REQ_KEY request from %s (%s): %s", from->name, from->hostname, request);
 260                 return true;
 261         }
 262 }
 263
 264 bool req_key_h(connection_t *c, const char *request) {
 265         char from_name[MAX_STRING_SIZE];
 266         char to_name[MAX_STRING_SIZE];
 267         node_t *from, *to;
 268         int reqno = 0;
 269
 270         if(sscanf(request, "%*d " MAX_STRING " " MAX_STRING " %d", from_name, to_name, &reqno) < 2) {
 271                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "REQ_KEY", c->name,
 272                        c->hostname);
 273                 return false;
 274         }
 275
 276         if(!check_id(from_name) || !check_id(to_name)) {
 277                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_KEY", c->name, c->hostname, "invalid name");
 278                 return false;
 279         }
 280
 281         from = lookup_node(from_name);
 282
 283         if(!from) {
 284                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list",
 285                        "REQ_KEY", c->name, c->hostname, from_name);
 286                 return true;
 287         }
 288
 289         to = lookup_node(to_name);
 290
 291         if(!to) {
 292                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list",
 293                        "REQ_KEY", c->name, c->hostname, to_name);
 294                 return true;
 295         }
 296
 297         /* Check if this key request is for us */
 298
 299         if(to == myself) {                      /* Yes */
 300                 if(!from->status.reachable) {
 301                         logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which is not reachable",
 302                                "REQ_KEY", c->name, c->hostname, from_name);
 303                         return true;
 304                 }
 305
 306                 /* Is this an extended REQ_KEY message? */
 307                 if(experimental && reqno) {
 308                         return req_key_ext_h(c, request, from, to, reqno);
 309                 }
 310
 311                 /* No, just send our key back */
 312                 send_ans_key(from);
 313         } else {
 314                 if(tunnelserver) {
 315                         return true;
 316                 }
 317
 318                 if(!to->status.reachable) {
 319                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable",
 320                                "REQ_KEY", c->name, c->hostname, to_name);
 321                         return true;
 322                 }
 323
 324                 /* Is this an extended REQ_KEY message? */
 325                 if(experimental && reqno) {
 326                         return req_key_ext_h(c, request, from, to, reqno);
 327                 }
 328
 329                 send_request(to->nexthop->connection, "%s", request);
 330         }
 331
 332         return true;
 333 }
 334
 335 bool send_ans_key(node_t *to) {
 336         if(to->status.sptps) {
 337                 abort();
 338         }
 339
 340 #ifdef DISABLE_LEGACY
 341         return false;
 342 #else
 343         size_t keylen = myself->incipher ? cipher_keylength(myself->incipher) : 1;
 344         char *key = alloca(keylen * 2 + 1);
 345
 346         randomize(key, keylen);
 347
 348         cipher_free(&to->incipher);
 349         digest_free(&to->indigest);
 350
 351         if(myself->incipher) {
 352                 to->incipher = cipher_alloc();
 353
 354                 if(!cipher_open_by_nid(to->incipher, cipher_get_nid(myself->incipher))) {
 355                         abort();
 356                 }
 357
 358                 if(!cipher_set_key(to->incipher, key, false)) {
 359                         abort();
 360                 }
 361         }
 362
 363         if(myself->indigest) {
 364                 to->indigest = digest_alloc();
 365
 366                 if(!digest_open_by_nid(to->indigest,
 367                                        digest_get_nid(myself->indigest),
 368                                        digest_length(myself->indigest))) {
 369                         abort();
 370                 }
 371
 372                 if(!digest_set_key(to->indigest, key, keylen)) {
 373                         abort();
 374                 }
 375         }
 376
 377         to->incompression = myself->incompression;
 378
 379         bin2hex(key, key, keylen);
 380
 381         // Reset sequence number and late packet window
 382         to->received_seqno = 0;
 383         to->received = 0;
 384
 385         if(replaywin) {
 386                 memset(to->late, 0, replaywin);
 387         }
 388
 389         to->status.validkey_in = true;
 390
 391         return send_request(to->nexthop->connection, "%d %s %s %s %d %d %lu %d", ANS_KEY,
 392                             myself->name, to->name, key,
 393                             cipher_get_nid(to->incipher),
 394                             digest_get_nid(to->indigest),
 395                             (unsigned long)digest_length(to->indigest),
 396                             to->incompression);
 397 #endif
 398 }
 399
 400 bool ans_key_h(connection_t *c, const char *request) {
 401         char from_name[MAX_STRING_SIZE];
 402         char to_name[MAX_STRING_SIZE];
 403         char key[MAX_STRING_SIZE];
 404         char address[MAX_STRING_SIZE] = "";
 405         char port[MAX_STRING_SIZE] = "";
 406         int cipher, digest;
 407         unsigned long maclength;
 408         int compression;
 409         node_t *from, *to;
 410
 411         if(sscanf(request, "%*d "MAX_STRING" "MAX_STRING" "MAX_STRING" %d %d %lu %d "MAX_STRING" "MAX_STRING,
 412                         from_name, to_name, key, &cipher, &digest, &maclength,
 413                         &compression, address, port) < 7) {
 414                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "ANS_KEY", c->name,
 415                        c->hostname);
 416                 return false;
 417         }
 418
 419         if(!check_id(from_name) || !check_id(to_name)) {
 420                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ANS_KEY", c->name, c->hostname, "invalid name");
 421                 return false;
 422         }
 423
 424         from = lookup_node(from_name);
 425
 426         if(!from) {
 427                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list",
 428                        "ANS_KEY", c->name, c->hostname, from_name);
 429                 return true;
 430         }
 431
 432         to = lookup_node(to_name);
 433
 434         if(!to) {
 435                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list",
 436                        "ANS_KEY", c->name, c->hostname, to_name);
 437                 return true;
 438         }
 439
 440         /* Forward it if necessary */
 441
 442         if(to != myself) {
 443                 if(tunnelserver) {
 444                         return true;
 445                 }
 446
 447                 if(!to->status.reachable) {
 448                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable",
 449                                "ANS_KEY", c->name, c->hostname, to_name);
 450                         return true;
 451                 }
 452
 453                 if(!*address && from->address.sa.sa_family != AF_UNSPEC && to->minmtu) {
 454                         char *address, *port;
 455                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "Appending reflexive UDP address to ANS_KEY from %s to %s", from->name, to->name);
 456                         sockaddr2str(&from->address, &address, &port);
 457                         send_request(to->nexthop->connection, "%s %s %s", request, address, port);
 458                         free(address);
 459                         free(port);
 460                         return true;
 461                 }
 462
 463                 return send_request(to->nexthop->connection, "%s", request);
 464         }
 465
 466 #ifndef DISABLE_LEGACY
 467         /* Don't use key material until every check has passed. */
 468         cipher_free(&from->outcipher);
 469         digest_free(&from->outdigest);
 470 #endif
 471
 472         if(!from->status.sptps) {
 473                 from->status.validkey = false;
 474         }
 475
 476         switch(compression) {
 477         case COMPRESS_LZ4:
 478 #ifdef HAVE_LZ4
 479                 break;
 480 #else
 481                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 482                 logger(DEBUG_ALWAYS, LOG_ERR, "LZ4 compression is unavailable on this node.");
 483                 return true;
 484 #endif
 485
 486         case COMPRESS_LZO_HI:
 487         case COMPRESS_LZO_LO:
 488 #ifdef HAVE_LZO
 489                 break;
 490 #else
 491                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 492                 logger(DEBUG_ALWAYS, LOG_ERR, "LZO compression is unavailable on this node.");
 493                 return true;
 494 #endif
 495
 496         case COMPRESS_ZLIB_9:
 497         case COMPRESS_ZLIB_8:
 498         case COMPRESS_ZLIB_7:
 499         case COMPRESS_ZLIB_6:
 500         case COMPRESS_ZLIB_5:
 501         case COMPRESS_ZLIB_4:
 502         case COMPRESS_ZLIB_3:
 503         case COMPRESS_ZLIB_2:
 504         case COMPRESS_ZLIB_1:
 505 #ifdef HAVE_ZLIB
 506                 break;
 507 #else
 508                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 509                 logger(DEBUG_ALWAYS, LOG_ERR, "ZLIB compression is unavailable on this node.");
 510                 return true;
 511 #endif
 512
 513         case COMPRESS_NONE:
 514                 break;
 515
 516         default:
 517                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 518                 logger(DEBUG_ALWAYS, LOG_ERR, "Compression level %i is unrecognized by this node.", compression);
 519                 return true;
 520         }
 521
 522         from->outcompression = compression;
 523
 524         /* SPTPS or old-style key exchange? */
 525
 526         if(from->status.sptps) {
 527                 const size_t buflen = strlen(key);
 528                 uint8_t *buf = alloca(buflen);
 529                 size_t len = b64decode_tinc(key, buf, buflen);
 530
 531                 if(!len || !sptps_receive_data(&from->sptps, buf, len)) {
 532                         /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
 533                            so let's restart SPTPS in case that helps. But don't do that too often
 534                            to prevent storms.
 535                            Note that simply relying on handshake timeout is not enough, because
 536                            that doesn't apply to key regeneration. */
 537                         if(from->last_req_key < now.tv_sec - 10) {
 538                                 logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode handshake TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname);
 539                                 send_req_key(from);
 540                         }
 541
 542                         return true;
 543                 }
 544
 545                 if(from->status.validkey) {
 546                         if(*address && *port) {
 547                                 logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port);
 548                                 sockaddr_t sa = str2sockaddr(address, port);
 549                                 update_node_udp(from, &sa);
 550                         }
 551                 }
 552
 553                 send_mtu_info(myself, from, MTU);
 554
 555                 return true;
 556         }
 557
 558 #ifdef DISABLE_LEGACY
 559         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses legacy protocol!", from->name, from->hostname);
 560         return false;
 561 #else
 562         /* Check and lookup cipher and digest algorithms */
 563
 564         if(cipher) {
 565                 from->outcipher = cipher_alloc();
 566
 567                 if(!cipher_open_by_nid(from->outcipher, cipher)) {
 568                         cipher_free(&from->outcipher);
 569                         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown cipher!", from->name, from->hostname);
 570                         return false;
 571                 }
 572         } else {
 573                 from->outcipher = NULL;
 574         }
 575
 576         if(digest) {
 577                 from->outdigest = digest_alloc();
 578
 579                 if(!digest_open_by_nid(from->outdigest, digest, maclength)) {
 580                         digest_free(&from->outdigest);
 581                         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown digest!", from->name, from->hostname);
 582                         return false;
 583                 }
 584         } else {
 585                 from->outdigest = NULL;
 586         }
 587
 588         if(maclength != digest_length(from->outdigest)) {
 589                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus MAC length!", from->name, from->hostname);
 590                 return false;
 591         }
 592
 593         /* Process key */
 594
 595         size_t keylen = hex2bin(key, key, sizeof(key));
 596
 597         if(keylen != (from->outcipher ? cipher_keylength(from->outcipher) : 1)) {
 598                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses wrong keylength!", from->name, from->hostname);
 599                 return true;
 600         }
 601
 602         /* Update our copy of the origin's packet key */
 603
 604         if(from->outcipher && !cipher_set_key(from->outcipher, key, true)) {
 605                 return false;
 606         }
 607
 608         if(from->outdigest && !digest_set_key(from->outdigest, key, keylen)) {
 609                 return false;
 610         }
 611
 612         from->status.validkey = true;
 613         from->sent_seqno = 0;
 614
 615         if(*address && *port) {
 616                 logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port);
 617                 sockaddr_t sa = str2sockaddr(address, port);
 618                 update_node_udp(from, &sa);
 619         }
 620
 621         return true;
 622 #endif
 623 }