X-Git-Url: http://git.meshlink.io/?a=blobdiff_plain;f=src%2Fprotocol_auth.c;h=fe87323bc8c8f9728cdd8965b654d3c45b9524f0;hb=158cbe99f972a1613b7d4d95abfe5fe48e019e67;hp=05724d6faa88059d1ece5bcfca0e6c0cb714f675;hpb=ced4c1a327b321a6d73028a3a15b41b0be64d910;p=meshlink diff --git a/src/protocol_auth.c b/src/protocol_auth.c index 05724d6f..fe87323b 100644 --- a/src/protocol_auth.c +++ b/src/protocol_auth.c @@ -1,7 +1,6 @@ /* protocol_auth.c -- handle the meta-protocol, authentication - Copyright (C) 1999-2005 Ivo Timmermans, - 2000-2013 Guus Sliepen + Copyright (C) 2014 Guus Sliepen This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -22,8 +21,6 @@ #include "conf.h" #include "connection.h" -#include "control.h" -#include "control_common.h" #include "cipher.h" #include "crypto.h" #include "digest.h" @@ -32,7 +29,6 @@ #include "graph.h" #include "logger.h" #include "meta.h" -#include "names.h" #include "net.h" #include "netutl.h" #include "node.h" @@ -174,6 +170,10 @@ static bool finalize_invitation(connection_t *c, const char *data, uint16_t len) fclose(f); logger(DEBUG_CONNECTIONS, LOG_INFO, "Key succesfully received from %s (%s)", c->name, c->hostname); + + //TODO: callback to application to inform of an accepted invitation + + sptps_send_record(&c->sptps, 2, data, 0); return true; } @@ -189,8 +189,19 @@ static bool receive_invitation_sptps(void *handle, uint8_t type, const char *dat if(type != 0 || len != 18 || c->status.invitation_used) return false; + // Recover the filename from the cookie and the key + digest_t *digest = digest_open_by_name("sha256", 18); + if(!digest) + abort(); + char *fingerprint = ecdsa_get_base64_public_key(invitation_key); + char hashbuf[18 + strlen(fingerprint)]; char cookie[25]; - b64encode_urlsafe(data, cookie, 18); + memcpy(hashbuf, data, 18); + memcpy(hashbuf + 18, fingerprint, sizeof hashbuf - 18); + digest_create(digest, hashbuf, sizeof hashbuf, cookie); + b64encode_urlsafe(cookie, cookie, 18); + digest_close(digest); + free(fingerprint); char filename[PATH_MAX], usedname[PATH_MAX]; snprintf(filename, sizeof filename, "%s" SLASH "invitations" SLASH "%s", confbase, cookie); @@ -260,18 +271,7 @@ bool id_h(connection_t *c, const char *request) { return false; } - /* Check if this is a control connection */ - - if(name[0] == '^' && !strcmp(name + 1, controlcookie)) { - c->status.control = true; - c->allow_request = CONTROL; - c->last_ping_time = now.tv_sec + 3600; - - free(c->name); - c->name = xstrdup(""); - - return send_request(c, "%d %d %d", ACK, TINC_CTL_VERSION_CURRENT, getpid()); - } + /* Check if this is an invitation */ if(name[0] == '?') { if(!invitation_key) { @@ -324,7 +324,7 @@ bool id_h(connection_t *c, const char *request) { if(c->protocol_major != myself->connection->protocol_major) { logger(DEBUG_ALWAYS, LOG_ERR, "Peer %s (%s) uses incompatible version %d.%d", - c->name, c->hostname, c->protocol_major, c->protocol_minor); + c->name, c->hostname, c->protocol_major, c->protocol_minor); return false; } @@ -346,15 +346,21 @@ bool id_h(connection_t *c, const char *request) { return false; } - if(experimental && c->protocol_minor >= 2) { - if(!read_ecdsa_public_key(c)) - return false; - } + if(experimental) + read_ecdsa_public_key(c); } else { if(c->protocol_minor && !ecdsa_active(c->ecdsa)) c->protocol_minor = 1; } + /* Forbid version rollback for nodes whose ECDSA key we know */ + + if(ecdsa_active(c->ecdsa) && c->protocol_minor < 2) { + logger(DEBUG_ALWAYS, LOG_ERR, "Peer %s (%s) tries to roll back protocol version to %d.%d", + c->name, c->hostname, c->protocol_major, c->protocol_minor); + return false; + } + c->allow_request = METAKEY; if(c->protocol_minor >= 2) { @@ -634,7 +640,8 @@ bool send_ack(connection_t *c) { if(choice) c->options |= OPTION_CLAMP_MSS; - get_config_int(lookup_config(c->config_tree, "Weight"), &c->estimated_weight); + if(!get_config_int(lookup_config(c->config_tree, "Weight"), &c->estimated_weight)) + get_config_int(lookup_config(config_tree, "Weight"), &c->estimated_weight); return send_request(c, "%d %s %d %x", ACK, myport, c->estimated_weight, (c->options & 0xffffff) | (experimental ? (PROT_MINOR << 24) : 0)); } @@ -642,6 +649,7 @@ bool send_ack(connection_t *c) { static void send_everything(connection_t *c) { /* Send all known subnets and edges */ + // TODO: remove this if(disablebuggypeers) { static struct { vpn_packet_t pkt; @@ -653,17 +661,7 @@ static void send_everything(connection_t *c) { send_tcppacket(c, &zeropkt.pkt); } - if(tunnelserver) { - for splay_each(subnet_t, s, myself->subnet_tree) - send_add_subnet(c, s); - - return; - } - for splay_each(node_t, n, node_tree) { - for splay_each(subnet_t, s, n->subnet_tree) - send_add_subnet(c, s); - for splay_each(edge_t, e, n->edge_tree) send_add_edge(c, e); } @@ -728,7 +726,7 @@ bool ack_h(connection_t *c, const char *request) { } terminate_connection(n->connection, false); - /* Run graph algorithm to purge key and make sure up/down scripts are rerun with new IP addresses and stuff */ + /* Run graph algorithm to keep things in sync */ graph(); } } @@ -782,10 +780,7 @@ bool ack_h(connection_t *c, const char *request) { /* Notify everyone of the new edge */ - if(tunnelserver) - send_add_edge(c, c->edge); - else - send_add_edge(everyone, c->edge); + send_add_edge(everyone, c->edge); /* Run MST and SSSP algorithms */