X-Git-Url: https://www.tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fprotocol.c;h=fe0d180e20fa56a3b186db2fd647828ebe70a613;hp=e26978bd1f7d6c773efcf836d64d04716bdd1fdf;hb=9c2f805255fa36b05e8fe9391f639581d938b653;hpb=6e39481d8f2406e60b5e329ace08b5a005d5cc43 diff --git a/src/protocol.c b/src/protocol.c index e26978bd..fe0d180e 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -17,7 +17,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - $Id: protocol.c,v 1.28.4.37 2000/10/11 13:42:52 guus Exp $ + $Id: protocol.c,v 1.28.4.45 2000/10/24 15:46:17 guus Exp $ */ #include "config.h" @@ -52,42 +52,42 @@ int check_id(char *id) int i; for (i = 0; i < strlen(id); i++) - { - if(!isalpha(id[i]) && id[i] != '_') - { - return 0; - } - } - - return 1; + if(!isalnum(id[i]) && id[i] != '_') + return -1; + + return 0; } /* Generic request routines - takes care of logging and error detection as well */ -int send_request(conn_list_t *cl, const char *format, int request, /*args*/ ...) +int send_request(conn_list_t *cl, const char *format, ...) { va_list args; - char buffer[MAXBUFSIZE+1]; - int len; + char buffer[MAXBUFSIZE]; + int len, request; cp /* Use vsnprintf instead of vasprintf: faster, no memory fragmentation, cleanup is automatic, and there is a limit on the input buffer anyway */ - va_start(args, request); - len = vsnprintf(buffer, MAXBUFSIZE+1, format, args); + va_start(args, format); + len = vsnprintf(buffer, MAXBUFSIZE, format, args); + request = va_arg(args, int); va_end(args); - if(len < 0 || len > MAXBUFSIZE) + if(len < 0 || len > MAXBUFSIZE-1) { syslog(LOG_ERR, _("Output buffer overflow while sending %s to %s (%s)"), request_name[request], cl->name, cl->hostname); return -1; } + len++; + if(debug_lvl >= DEBUG_PROTOCOL) syslog(LOG_DEBUG, _("Sending %s to %s (%s)"), request_name[request], cl->name, cl->hostname); + cp - return send_meta(cl, buffer, length); + return send_meta(cl, buffer, len); } int receive_request(conn_list_t *cl) @@ -104,7 +104,7 @@ cp } else { - if(debug_lvl > DEBUG_PROTOCOL) + if(debug_lvl >= DEBUG_PROTOCOL) syslog(LOG_DEBUG, _("Got %s from %s (%s)"), request_name[request], cl->name, cl->hostname); } @@ -155,14 +155,17 @@ cp int send_id(conn_list_t *cl) { cp - return send_request(cl, "%d %s %d %lx", ID, myself->name, myself->protocol_version, myself->options); + cl->allow_request = CHALLENGE; +cp + return send_request(cl, "%d %s %d %lx %hd", ID, myself->name, myself->protocol_version, myself->options, myself->port); } int id_h(conn_list_t *cl) { conn_list_t *old; + config_t *cfg; cp - if(sscanf(cl->buffer, "%*d %as %d %lx", &cl->name, &cl->protocol_version, &cl->options) != 3) + if(sscanf(cl->buffer, "%*d %as %d %lx %hd", &cl->name, &cl->protocol_version, &cl->options, &cl->port) != 4) { syslog(LOG_ERR, _("Got bad ID from %s"), cl->hostname); return -1; @@ -179,31 +182,30 @@ cp /* Check if identity is a valid name */ - if(!check_id(cl->name)) + if(check_id(cl->name)) { syslog(LOG_ERR, _("Peer %s uses invalid identity name"), cl->hostname); return -1; } /* Load information about peer */ - - if(!read_host_config(cl)) +cp + if(read_host_config(cl)) { syslog(LOG_ERR, _("Peer %s had unknown identity (%s)"), cl->hostname, cl->name); return -1; } - /* First check if the host we connected to is already in our connection list. If so, we are probably making a loop, which is not desirable. */ - +cp if(cl->status.outgoing) { if((old = lookup_id(cl->name))) { - if(debug_lvl > DEBUG_CONNECTIONS) + if(debug_lvl >= DEBUG_CONNECTIONS) syslog(LOG_NOTICE, _("Uplink %s (%s) is already in our connection list"), cl->name, cl->hostname); cl->status.outgoing = 0; old->status.outgoing = 1; @@ -211,42 +213,84 @@ cp return 0; } } +cp + if(!(cfg = get_config_val(cl->config, publickey))) + { + syslog(LOG_ERR, _("No public key known for %s (%s)"), cl->name, cl->hostname); + return -1; + } + else + { +cp + cl->rsa_key = RSA_new(); + BN_hex2bn(&cl->rsa_key->n, cfg->data.ptr); + BN_hex2bn(&cl->rsa_key->e, "FFFF"); + } - /* Send a challenge to verify the identity */ - - cl->allow_request = CHAL_REPLY; cp return send_challenge(cl); } int send_challenge(conn_list_t *cl) { - char buffer[CHAL_LENGTH*2+1]; + char *buffer; + int len, x; cp + len = RSA_size(cl->rsa_key); + /* Allocate buffers for the challenge */ - if(!cl->hischallenge) - cl->hischallenge = xmalloc(CHAL_LENGTH); + buffer = xmalloc(len*2+1); + + if(cl->hischallenge) + free(cl->hischallenge); + + cl->hischallenge = xmalloc(len); +cp + /* Seed the PRNG with urandom (can't afford to block) */ + + RAND_load_file("/dev/urandom", 1024); /* Copy random data to the buffer */ - RAND_bytes(cl->hischallenge, CHAL_LENGTH); + RAND_bytes(cl->hischallenge, len); + + cl->hischallenge[0] &= 0x7F; /* Somehow if the first byte is more than 0xD0 or something like that, decryption fails... */ + + if(debug_lvl >= DEBUG_SCARY_THINGS) + { + bin2hex(cl->hischallenge, buffer, len); + buffer[len*2] = '\0'; + syslog(LOG_DEBUG, _("Generated random challenge (unencrypted): %s"), buffer); + } - /* Convert the random data to a hexadecimal formatted string */ + /* Encrypt the random data */ + + if(RSA_public_encrypt(len, cl->hischallenge, buffer, cl->rsa_key, RSA_NO_PADDING) != len) /* NO_PADDING because the message size equals the RSA key size and it is totally random */ + { + syslog(LOG_ERR, _("Error during encryption of challenge for %s (%s)"), cl->name, cl->hostname); + free(buffer); + return -1; + } +cp + /* Convert the encrypted random data to a hexadecimal formatted string */ - bin2hex(cl->hischallenge,buffer,CHAL_LENGTH); - buffer[keylength*2] = '\0'; + bin2hex(buffer, buffer, len); + buffer[len*2] = '\0'; /* Send the challenge */ cl->allow_request = CHAL_REPLY; + x = send_request(cl, "%d %s", CHALLENGE, buffer); + free(buffer); cp - return send_request(cl, "%d %s", CHALLENGE, buffer); + return x; } int challenge_h(conn_list_t *cl) { char *buffer; + int len; cp if(sscanf(cl->buffer, "%*d %as", &buffer) != 1) { @@ -254,9 +298,11 @@ cp return -1; } + len = RSA_size(myself->rsa_key); + /* Check if the length of the challenge is all right */ - if(strlen(buffer) != CHAL_LENGTH*2) + if(strlen(buffer) != len*2) { syslog(LOG_ERR, _("Intruder: wrong challenge length from %s (%s)"), cl->name, cl->hostname); free(buffer); @@ -266,11 +312,28 @@ cp /* Allocate buffers for the challenge */ if(!cl->mychallenge) - cl->mychallenge = xmalloc(CHAL_LENGTH); + cl->mychallenge = xmalloc(len); /* Convert the challenge from hexadecimal back to binary */ - hex2bin(buffer,cl->mychallenge,CHAL_LENGTH); + hex2bin(buffer,buffer,len); + + /* Decrypt the challenge */ + + if(RSA_private_decrypt(len, buffer, cl->mychallenge, myself->rsa_key, RSA_NO_PADDING) != len) /* See challenge() */ + { + syslog(LOG_ERR, _("Error during encryption of challenge for %s (%s)"), cl->name, cl->hostname); + free(buffer); + return -1; + } + + if(debug_lvl >= DEBUG_SCARY_THINGS) + { + bin2hex(cl->mychallenge, buffer, len); + buffer[len*2] = '\0'; + syslog(LOG_DEBUG, _("Received random challenge (unencrypted): %s"), buffer); + } + free(buffer); /* Rest is done by send_chal_reply() */ @@ -290,7 +353,7 @@ cp /* Calculate the hash from the challenge we received */ - SHA1(cl->mychallenge, CHAL_LENGTH, hash); + SHA1(cl->mychallenge, RSA_size(myself->rsa_key), hash); /* Convert the hash to a hexadecimal formatted string */ @@ -313,7 +376,7 @@ int chal_reply_h(conn_list_t *cl) char *hishash; char myhash[SHA_DIGEST_LENGTH]; cp - if(sscanf(cl->buffer, "%*d %as", &hishash) != 2) + if(sscanf(cl->buffer, "%*d %as", &hishash) != 1) { syslog(LOG_ERR, _("Got bad CHAL_REPLY from %s (%s)"), cl->name, cl->hostname); free(hishash); @@ -335,17 +398,24 @@ cp /* Calculate the hash from the challenge we sent */ - SHA1(cl->hischallenge, CHAL_LENGTH, myhash); + SHA1(cl->hischallenge, RSA_size(cl->rsa_key), myhash); /* Verify the incoming hash with the calculated hash */ - if(!memcmp(hishash, myhash, SHA_DIGEST_LENGTH)) + if(memcmp(hishash, myhash, SHA_DIGEST_LENGTH)) { syslog(LOG_ERR, _("Intruder: wrong challenge reply from %s (%s)"), cl->name, cl->hostname); + if(debug_lvl >= DEBUG_SCARY_THINGS) + { + bin2hex(myhash, hishash, SHA_DIGEST_LENGTH); + hishash[SHA_DIGEST_LENGTH*2] = '\0'; + syslog(LOG_DEBUG, _("Expected challenge reply: %s"), hishash); + } free(hishash); return -1; } + free(hishash); /* Identity has now been positively verified. @@ -354,19 +424,15 @@ cp */ cp if(cl->status.outgoing) - { - cl->allow_request = ACK; return send_ack(cl); - } else - { - cl->allow_request = CHALLENGE; return send_id(cl); - } } int send_ack(conn_list_t *cl) { +cp + cl->allow_request = ACK; cp return send_request(cl, "%d", ACK); } @@ -382,7 +448,7 @@ cp while((old = lookup_id(cl->name))) { - if(debug_lvl > DEBUG_CONNECTIONS) + if(debug_lvl >= DEBUG_CONNECTIONS) syslog(LOG_NOTICE, _("Removing old entry for %s at %s in favour of new connection from %s"), cl->name, old->hostname, cl->hostname); old->status.active = 0; @@ -394,15 +460,15 @@ cp cl->allow_request = ALL; cl->status.active = 1; - if(debug_lvl > DEBUG_CONNECTIONS) + if(debug_lvl >= DEBUG_CONNECTIONS) syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), cl->name, cl->hostname); /* Exchange information about other tinc daemons */ +/* FIXME: reprogram this. notify_others(cl, NULL, send_add_host); notify_one(cl); - - upstreamindex = 0; +*/ cp if(cl->status.outgoing) @@ -441,7 +507,7 @@ cp /* Check if owner name is a valid */ - if(!check_id(name)) + if(check_id(name)) { syslog(LOG_ERR, _("Got bad ADD_SUBNET from %s (%s): invalid identity name"), cl->name, cl->hostname); free(name); free(subnetstr); @@ -450,7 +516,7 @@ cp /* Check if subnet string is valid */ - if((subnet = str2net(subnetstr)) == -1) + if(!(subnet = str2net(subnetstr))) { syslog(LOG_ERR, _("Got bad ADD_SUBNET from %s (%s): invalid subnet string"), cl->name, cl->hostname); free(name); free(subnetstr); @@ -472,7 +538,7 @@ cp /* Check if the owner of the new subnet is in the connection list */ - if(!(owner = lookup_id(name)) + if(!(owner = lookup_id(name))) { syslog(LOG_ERR, _("Got ADD_SUBNET for %s from %s (%s) which is not in our connection list"), name, cl->name, cl->hostname); @@ -481,8 +547,10 @@ cp } /* If everything is correct, add the subnet to the list of the owner */ + + subnet_add(owner, subnet); cp - return subnet_add(owner, subnet); + return 0; } int send_del_subnet(conn_list_t *cl, conn_list_t *other, subnet_t *subnet) @@ -507,7 +575,7 @@ cp /* Check if owner name is a valid */ - if(!check_id(name)) + if(check_id(name)) { syslog(LOG_ERR, _("Got bad DEL_SUBNET from %s (%s): invalid identity name"), cl->name, cl->hostname); free(name); free(subnetstr); @@ -516,7 +584,7 @@ cp /* Check if subnet string is valid */ - if((subnet = str2net(subnetstr)) == -1) + if(!(subnet = str2net(subnetstr))) { syslog(LOG_ERR, _("Got bad DEL_SUBNET from %s (%s): invalid subnet string"), cl->name, cl->hostname); free(name); free(subnetstr); @@ -538,7 +606,7 @@ cp /* Check if the owner of the new subnet is in the connection list */ - if(!(owner = lookup_id(name)) + if(!(owner = lookup_id(name))) { syslog(LOG_ERR, _("Got DEL_SUBNET for %s from %s (%s) which is not in our connection list"), name, cl->name, cl->hostname); @@ -546,9 +614,11 @@ cp return -1; } - /* If everything is correct, add the subnet to the list of the owner */ + /* If everything is correct, delete the subnet from the list of the owner */ + + subnet_del(subnet); cp - return subnet_del(owner, subnet); + return 0; } /* New and closed connections notification */ @@ -557,7 +627,7 @@ int send_add_host(conn_list_t *cl, conn_list_t *other) { cp return send_request(cl, "%d %s %s %lx:%d %lx", ADD_HOST, - myself->name, other->name, other->real_ip, other->port, other->options); + myself->name, other->name, other->address, other->port, other->options); } int add_host_h(conn_list_t *cl) @@ -575,7 +645,7 @@ cp /* Check if identity is a valid name */ - if(!check_id(new->name) || !check_id(sender)) + if(check_id(new->name) || check_id(sender)) { syslog(LOG_ERR, _("Got bad ADD_HOST from %s (%s): invalid identity name"), cl->name, cl->hostname); free(sender); @@ -604,7 +674,7 @@ cp /* Lookup his uplink */ - if(!(new->hisuplink = lookup_id(sender)) + if(!(new->hisuplink = lookup_id(sender))) { syslog(LOG_ERR, _("Got ADD_HOST from %s (%s) with origin %s which is not in our connection list"), sender, cl->name, cl->hostname); @@ -616,22 +686,22 @@ cp /* Fill in more of the new conn_list structure */ - new->hostname = hostlookup(htonl(new->real_ip)); + new->hostname = hostlookup(htonl(new->address)); /* Check if the new host already exists in the connnection list */ if((old = lookup_id(new->name))) { - if((new->real_ip == old->real_ip) && (new->port == old->port)) + if((new->address == old->address) && (new->port == old->port)) { - if(debug_lvl > DEBUG_CONNECTIONS) + if(debug_lvl >= DEBUG_CONNECTIONS) syslog(LOG_NOTICE, _("Got duplicate ADD_HOST for %s (%s) from %s (%s)"), old->name, old->hostname, new->name, new->hostname); return 0; } else { - if(debug_lvl > DEBUG_CONNECTIONS) + if(debug_lvl >= DEBUG_CONNECTIONS) syslog(LOG_NOTICE, _("Removing old entry for %s (%s)"), old->name, old->hostname); old->status.active = 0; @@ -649,9 +719,9 @@ cp conn_list_add(conn_list, new); /* Tell the rest about the new host */ - +/* FIXME: reprogram this. notify_others(new, cl, send_add_host); - +*/ cp return 0; } @@ -660,7 +730,7 @@ int send_del_host(conn_list_t *cl, conn_list_t *other) { cp return send_request(cl, "%d %s %s %lx:%d %lx", DEL_HOST, - myself->name, other->name, other->real_ip, other->port, other->options); + myself->name, other->name, other->address, other->port, other->options); } int del_host_h(conn_list_t *cl) @@ -682,7 +752,7 @@ cp /* Check if identity is a valid name */ - if(!check_id(name) || !check_id(sender)) + if(check_id(name) || check_id(sender)) { syslog(LOG_ERR, _("Got bad DEL_HOST from %s (%s): invalid identity name"), cl->name, cl->hostname); free(name); free(sender); @@ -712,7 +782,7 @@ cp /* Lookup his uplink */ - if(!(hisuplink = lookup_id(sender)) + if(!(hisuplink = lookup_id(sender))) { syslog(LOG_ERR, _("Got DEL_HOST from %s (%s) with origin %s which is not in our connection list"), cl->name, cl->hostname, sender); @@ -773,7 +843,7 @@ cp return -1; } - if(debug_lvl > DEBUG_STATUS) + if(debug_lvl >= DEBUG_STATUS) { syslog(LOG_NOTICE, _("Status message from %s (%s): %s: %s"), cl->name, cl->hostname, status_text[statusno], statusstring); @@ -799,12 +869,12 @@ int error_h(conn_list_t *cl) cp if(sscanf(cl->buffer, "%*d %d %as", &errno, &errorstring) != 2) { - syslog(LOG_ERR, _("Got bad error from %s (%s)"), + syslog(LOG_ERR, _("Got bad ERROR from %s (%s)"), cl->name, cl->hostname); return -1; } - if(debug_lvl > DEBUG_error) + if(debug_lvl >= DEBUG_ERROR) { syslog(LOG_NOTICE, _("Error message from %s (%s): %s: %s"), cl->name, cl->hostname, strerror(errno), errorstring); @@ -938,7 +1008,7 @@ cp if(!strcmp(to_id, myself->name)) { - send_ans_key(myself, from, myself->datakey->key); + send_ans_key(myself, from, myself->cipher_pktkey); } else { @@ -957,20 +1027,20 @@ cp return 0; } -int send_ans_key(conn_list_t *from, conn_list_t *to, char *datakey) +int send_ans_key(conn_list_t *from, conn_list_t *to, char *pktkey) { cp return send_request(to->nexthop, "%d %s %s %s", ANS_KEY, - from->name, to->name, datakey); + from->name, to->name, pktkey); } int ans_key_h(conn_list_t *cl) { - char *from_id, *to_id, *datakey; + char *from_id, *to_id, *pktkey; int keylength; conn_list_t *from, *to; cp - if(sscanf(cl->buffer, "%*d %as %as %as", &from_id, &to_id, &datakey) != 3) + if(sscanf(cl->buffer, "%*d %as %as %as", &from_id, &to_id, &pktkey) != 3) { syslog(LOG_ERR, _("Got bad ANS_KEY from %s (%s)"), cl->name, cl->hostname); @@ -981,7 +1051,7 @@ cp { syslog(LOG_ERR, _("Got ANS_KEY from %s (%s) origin %s which does not exist in our connection list"), cl->name, cl->hostname, from_id); - free(from_id); free(to_id); free(datakey); + free(from_id); free(to_id); free(pktkey); return -1; } @@ -991,18 +1061,18 @@ cp { /* It is for us, convert it to binary and set the key with it. */ - keylength = strlen(datakey); + keylength = strlen(pktkey); if((keylength%2) || (keylength <= 0)) { syslog(LOG_ERR, _("Got bad ANS_KEY from %s (%s) origin %s: invalid key"), cl->name, cl->hostname, from->name); - free(from_id); free(to_id); free(datakey); + free(from_id); free(to_id); free(pktkey); return -1; } keylength /= 2; - hex2bin(datakey, datakey, keylength); - BF_set_key(cl->datakey, keylength, datakey); + hex2bin(pktkey, pktkey, keylength); + BF_set_key(cl->cipher_pktkey, keylength, pktkey); } else { @@ -1010,13 +1080,13 @@ cp { syslog(LOG_ERR, _("Got ANS_KEY from %s (%s) destination %s which does not exist in our connection list"), cl->name, cl->hostname, to_id); - free(from_id); free(to_id); free(datakey); + free(from_id); free(to_id); free(pktkey); return -1; } - send_ans_key(from, to, datakey); + send_ans_key(from, to, pktkey); } - free(from_id); free(to_id); free(datakey); + free(from_id); free(to_id); free(pktkey); cp return 0; } @@ -1042,3 +1112,15 @@ char (*request_name[]) = { "ADD_SUBNET", "DEL_SUBNET", "KEY_CHANGED", "REQ_KEY", "ANS_KEY", }; + +/* Status strings */ + +char (*status_text[]) = { + "Warning", +}; + +/* Error strings */ + +char (*error_text[]) = { + "Error", +};