X-Git-Url: http://git.meshlink.io/?a=blobdiff_plain;f=src%2Fprotocol_key.c;h=b1be1866e7c1e9f0e3ed1f972f769bf24b3e5a13;hb=a1b50920b9a52f86ca6e33fcb24d7fa34313a1ee;hp=115845a0e206777e13df93aba2455feb4a5e3636;hpb=cc3c69c892b0dad9a6ece0a0f4ccd429a22fcbff;p=meshlink diff --git a/src/protocol_key.c b/src/protocol_key.c index 115845a0..b1be1866 100644 --- a/src/protocol_key.c +++ b/src/protocol_key.c @@ -1,7 +1,6 @@ /* protocol_key.c -- handle the meta-protocol, key exchange - Copyright (C) 1999-2005 Ivo Timmermans, - 2000-2013 Guus Sliepen + Copyright (C) 2014 Guus Sliepen This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -20,10 +19,9 @@ #include "system.h" -#include "cipher.h" #include "connection.h" -#include "crypto.h" #include "logger.h" +#include "meshlink_internal.h" #include "net.h" #include "netutl.h" #include "node.h" @@ -35,25 +33,17 @@ static bool mykeyused = false; -void send_key_changed(void) { - send_request(everyone, "%d %x %s", KEY_CHANGED, rand(), myself->name); - - /* Immediately send new keys to directly connected nodes to keep UDP mappings alive */ - - for list_each(connection_t, c, connection_list) - if(c->status.active && c->node && c->node->status.reachable && !c->node->status.sptps) - send_ans_key(c->node); +void send_key_changed(meshlink_handle_t *mesh) { + send_request(mesh, mesh->everyone, "%d %x %s", KEY_CHANGED, rand(), mesh->self->name); /* Force key exchange for connections using SPTPS */ - if(experimental) { - for splay_each(node_t, n, node_tree) - if(n->status.reachable && n->status.validkey && n->status.sptps) - sptps_force_kex(&n->sptps); - } + for splay_each(node_t, n, mesh->nodes) + if(n->status.reachable && n->status.validkey) + sptps_force_kex(&n->sptps); } -bool key_changed_h(connection_t *c, const char *request) { +bool key_changed_h(meshlink_handle_t *mesh, connection_t *c, const char *request) { char name[MAX_STRING_SIZE]; node_t *n; @@ -63,10 +53,10 @@ bool key_changed_h(connection_t *c, const char *request) { return false; } - if(seen_request(request)) + if(seen_request(mesh, request)) return true; - n = lookup_node(name); + n = lookup_node(mesh, name); if(!n) { logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist", @@ -74,83 +64,74 @@ bool key_changed_h(connection_t *c, const char *request) { return true; } - if(!n->status.sptps) { - n->status.validkey = false; - n->last_req_key = 0; - } - /* Tell the others */ - if(!tunnelserver) - forward_request(c, request); + forward_request(mesh, c, request); return true; } static bool send_initial_sptps_data(void *handle, uint8_t type, const char *data, size_t len) { node_t *to = handle; + meshlink_handle_t *mesh = to->mesh; to->sptps.send_data = send_sptps_data; char buf[len * 4 / 3 + 5]; b64encode(data, buf, len); - return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_KEY, buf); + return send_request(mesh, to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, mesh->self->name, to->name, REQ_KEY, buf); } -bool send_req_key(node_t *to) { - if(to->status.sptps) { - if(!node_read_ecdsa_public_key(to)) { - logger(DEBUG_PROTOCOL, LOG_DEBUG, "No ECDSA key known for %s (%s)", to->name, to->hostname); - send_request(to->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, to->name, REQ_PUBKEY); - return true; - } - - if(to->sptps.label) - logger(DEBUG_ALWAYS, LOG_DEBUG, "send_req_key(%s) called while sptps->label != NULL!", to->name); - - char label[25 + strlen(myself->name) + strlen(to->name)]; - snprintf(label, sizeof label, "tinc UDP key expansion %s %s", myself->name, to->name); - sptps_stop(&to->sptps); - to->status.validkey = false; - to->status.waitingforkey = true; - to->last_req_key = time(NULL); - to->incompression = myself->incompression; - return sptps_start(&to->sptps, to, true, true, myself->connection->ecdsa, to->ecdsa, label, sizeof label, send_initial_sptps_data, receive_sptps_record); +bool send_req_key(meshlink_handle_t *mesh, node_t *to) { + if(!node_read_ecdsa_public_key(mesh, to)) { + logger(DEBUG_PROTOCOL, LOG_DEBUG, "No ECDSA key known for %s (%s)", to->name, to->hostname); + send_request(mesh, to->nexthop->connection, "%d %s %s %d", REQ_KEY, mesh->self->name, to->name, REQ_PUBKEY); + return true; } - return send_request(to->nexthop->connection, "%d %s %s", REQ_KEY, myself->name, to->name); + if(to->sptps.label) + logger(DEBUG_ALWAYS, LOG_DEBUG, "send_req_key(%s) called while sptps->label != NULL!", to->name); + + char label[25 + strlen(mesh->self->name) + strlen(to->name)]; + snprintf(label, sizeof label, "tinc UDP key expansion %s %s", mesh->self->name, to->name); + sptps_stop(&to->sptps); + to->status.validkey = false; + to->status.waitingforkey = true; + to->last_req_key = mesh->loop.now.tv_sec; + to->incompression = mesh->self->incompression; + return sptps_start(&to->sptps, to, true, true, mesh->self->connection->ecdsa, to->ecdsa, label, sizeof label, send_initial_sptps_data, receive_sptps_record); } /* REQ_KEY is overloaded to allow arbitrary requests to be routed between two nodes. */ -static bool req_key_ext_h(connection_t *c, const char *request, node_t *from, int reqno) { +static bool req_key_ext_h(meshlink_handle_t *mesh, connection_t *c, const char *request, node_t *from, int reqno) { switch(reqno) { case REQ_PUBKEY: { - char *pubkey = ecdsa_get_base64_public_key(&myself->connection->ecdsa); - send_request(from->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, from->name, ANS_PUBKEY, pubkey); + char *pubkey = ecdsa_get_base64_public_key(mesh->self->connection->ecdsa); + send_request(mesh, from->nexthop->connection, "%d %s %s %d %s", REQ_KEY, mesh->self->name, from->name, ANS_PUBKEY, pubkey); free(pubkey); return true; } case ANS_PUBKEY: { - if(node_read_ecdsa_public_key(from)) { + if(node_read_ecdsa_public_key(mesh, from)) { logger(DEBUG_PROTOCOL, LOG_WARNING, "Got ANS_PUBKEY from %s (%s) even though we already have his pubkey", from->name, from->hostname); return true; } char pubkey[MAX_STRING_SIZE]; - if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, pubkey) != 1 || !ecdsa_set_base64_public_key(&from->ecdsa, pubkey)) { + if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, pubkey) != 1 || !(from->ecdsa = ecdsa_set_base64_public_key(pubkey))) { logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ANS_PUBKEY", from->name, from->hostname, "invalid pubkey"); return true; } logger(DEBUG_PROTOCOL, LOG_INFO, "Learned ECDSA public key from %s (%s)", from->name, from->hostname); - append_config_file(from->name, "ECDSAPublicKey", pubkey); + append_config_file(mesh, from->name, "ECDSAPublicKey", pubkey); return true; } case REQ_KEY: { - if(!node_read_ecdsa_public_key(from)) { + if(!node_read_ecdsa_public_key(mesh, from)) { logger(DEBUG_PROTOCOL, LOG_DEBUG, "No ECDSA key known for %s (%s)", from->name, from->hostname); - send_request(from->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, from->name, REQ_PUBKEY); + send_request(mesh, from->nexthop->connection, "%d %s %s %d", REQ_KEY, mesh->self->name, from->name, REQ_PUBKEY); return true; } @@ -158,19 +139,20 @@ static bool req_key_ext_h(connection_t *c, const char *request, node_t *from, in logger(DEBUG_ALWAYS, LOG_DEBUG, "Got REQ_KEY from %s while we already started a SPTPS session!", from->name); char buf[MAX_STRING_SIZE]; - if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1) { + int len; + + if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode(buf, buf, strlen(buf)))) { logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_SPTPS_START", from->name, from->hostname, "invalid SPTPS data"); return true; } - int len = b64decode(buf, buf, strlen(buf)); - char label[25 + strlen(from->name) + strlen(myself->name)]; - snprintf(label, sizeof label, "tinc UDP key expansion %s %s", from->name, myself->name); + char label[25 + strlen(from->name) + strlen(mesh->self->name)]; + snprintf(label, sizeof label, "tinc UDP key expansion %s %s", from->name, mesh->self->name); sptps_stop(&from->sptps); from->status.validkey = false; from->status.waitingforkey = true; - from->last_req_key = time(NULL); - sptps_start(&from->sptps, from, false, true, myself->connection->ecdsa, from->ecdsa, label, sizeof label, send_sptps_data, receive_sptps_record); + from->last_req_key = mesh->loop.now.tv_sec; + sptps_start(&from->sptps, from, false, true, mesh->self->connection->ecdsa, from->ecdsa, label, sizeof label, send_sptps_data, receive_sptps_record); sptps_receive_data(&from->sptps, buf, len); return true; } @@ -182,11 +164,11 @@ static bool req_key_ext_h(connection_t *c, const char *request, node_t *from, in } char buf[MAX_STRING_SIZE]; - if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1) { + int len; + if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode(buf, buf, strlen(buf)))) { logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_SPTPS", from->name, from->hostname, "invalid SPTPS data"); return true; } - int len = b64decode(buf, buf, strlen(buf)); sptps_receive_data(&from->sptps, buf, len); return true; } @@ -197,7 +179,7 @@ static bool req_key_ext_h(connection_t *c, const char *request, node_t *from, in } } -bool req_key_h(connection_t *c, const char *request) { +bool req_key_h(meshlink_handle_t *mesh, connection_t *c, const char *request) { char from_name[MAX_STRING_SIZE]; char to_name[MAX_STRING_SIZE]; node_t *from, *to; @@ -214,7 +196,7 @@ bool req_key_h(connection_t *c, const char *request) { return false; } - from = lookup_node(from_name); + from = lookup_node(mesh, from_name); if(!from) { logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list", @@ -222,7 +204,7 @@ bool req_key_h(connection_t *c, const char *request) { return true; } - to = lookup_node(to_name); + to = lookup_node(mesh, to_name); if(!to) { logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list", @@ -232,64 +214,31 @@ bool req_key_h(connection_t *c, const char *request) { /* Check if this key request is for us */ - if(to == myself) { /* Yes */ + if(to == mesh->self) { /* Yes */ /* Is this an extended REQ_KEY message? */ - if(experimental && reqno) - return req_key_ext_h(c, request, from, reqno); + if(reqno) + return req_key_ext_h(mesh, c, request, from, reqno); /* No, just send our key back */ - send_ans_key(from); + send_ans_key(mesh, from); } else { - if(tunnelserver) - return true; - if(!to->status.reachable) { logger(DEBUG_PROTOCOL, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable", "REQ_KEY", c->name, c->hostname, to_name); return true; } - send_request(to->nexthop->connection, "%s", request); + send_request(mesh, to->nexthop->connection, "%s", request); } return true; } -bool send_ans_key(node_t *to) { - if(to->status.sptps) - abort(); - - size_t keylen = cipher_keylength(&myself->incipher); - char key[keylen * 2 + 1]; - - cipher_close(&to->incipher); - digest_close(&to->indigest); - - cipher_open_by_nid(&to->incipher, cipher_get_nid(&myself->incipher)); - digest_open_by_nid(&to->indigest, digest_get_nid(&myself->indigest), digest_length(&myself->indigest)); - to->incompression = myself->incompression; - - randomize(key, keylen); - cipher_set_key(&to->incipher, key, false); - digest_set_key(&to->indigest, key, keylen); - - bin2hex(key, key, keylen); - - // Reset sequence number and late packet window - mykeyused = true; - to->received_seqno = 0; - to->received = 0; - if(replaywin) memset(to->late, 0, replaywin); - - return send_request(to->nexthop->connection, "%d %s %s %s %d %d %d %d", ANS_KEY, - myself->name, to->name, key, - cipher_get_nid(&to->incipher), - digest_get_nid(&to->indigest), - (int)digest_length(&to->indigest), - to->incompression); +bool send_ans_key(meshlink_handle_t *mesh, node_t *to) { + abort(); } -bool ans_key_h(connection_t *c, const char *request) { +bool ans_key_h(meshlink_handle_t *mesh, connection_t *c, const char *request) { char from_name[MAX_STRING_SIZE]; char to_name[MAX_STRING_SIZE]; char key[MAX_STRING_SIZE]; @@ -311,7 +260,7 @@ bool ans_key_h(connection_t *c, const char *request) { return false; } - from = lookup_node(from_name); + from = lookup_node(mesh, from_name); if(!from) { logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list", @@ -319,7 +268,7 @@ bool ans_key_h(connection_t *c, const char *request) { return true; } - to = lookup_node(to_name); + to = lookup_node(mesh, to_name); if(!to) { logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list", @@ -329,10 +278,7 @@ bool ans_key_h(connection_t *c, const char *request) { /* Forward it if necessary */ - if(to != myself) { - if(tunnelserver) - return true; - + if(to != mesh->self) { if(!to->status.reachable) { logger(DEBUG_ALWAYS, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable", "ANS_KEY", c->name, c->hostname, to_name); @@ -343,18 +289,16 @@ bool ans_key_h(connection_t *c, const char *request) { char *address, *port; logger(DEBUG_PROTOCOL, LOG_DEBUG, "Appending reflexive UDP address to ANS_KEY from %s to %s", from->name, to->name); sockaddr2str(&from->address, &address, &port); - send_request(to->nexthop->connection, "%s %s %s", request, address, port); + send_request(mesh, to->nexthop->connection, "%s %s %s", request, address, port); free(address); free(port); return true; } - return send_request(to->nexthop->connection, "%s", request); + return send_request(mesh, to->nexthop->connection, "%s", request); } /* Don't use key material until every check has passed. */ - cipher_close(&from->outcipher); - digest_close(&from->outdigest); from->status.validkey = false; if(compression < 0 || compression > 11) { @@ -366,69 +310,22 @@ bool ans_key_h(connection_t *c, const char *request) { /* SPTPS or old-style key exchange? */ - if(from->status.sptps) { - char buf[strlen(key)]; - int len = b64decode(key, buf, strlen(key)); + char buf[strlen(key)]; + int len = b64decode(key, buf, strlen(key)); - if(!sptps_receive_data(&from->sptps, buf, len)) - logger(DEBUG_ALWAYS, LOG_ERR, "Error processing SPTPS data from %s (%s)", from->name, from->hostname); - - if(from->status.validkey) { - if(*address && *port) { - logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port); - sockaddr_t sa = str2sockaddr(address, port); - update_node_udp(from, &sa); - } + if(!len || !sptps_receive_data(&from->sptps, buf, len)) + logger(DEBUG_ALWAYS, LOG_ERR, "Error processing SPTPS data from %s (%s)", from->name, from->hostname); - if(from->options & OPTION_PMTU_DISCOVERY) - send_mtu_probe(from); + if(from->status.validkey) { + if(*address && *port) { + logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port); + sockaddr_t sa = str2sockaddr(address, port); + update_node_udp(mesh, from, &sa); } - return true; - } - - /* Check and lookup cipher and digest algorithms */ - - if(!cipher_open_by_nid(&from->outcipher, cipher)) { - logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown cipher!", from->name, from->hostname); - return false; - } - - if(!digest_open_by_nid(&from->outdigest, digest, maclength)) { - logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown digest!", from->name, from->hostname); - return false; - } - - if(maclength != digest_length(&from->outdigest)) { - logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus MAC length!", from->name, from->hostname); - return false; + if(from->options & OPTION_PMTU_DISCOVERY && !(from->options & OPTION_TCPONLY)) + send_mtu_probe(mesh, from); } - /* Process key */ - - keylen = hex2bin(key, key, sizeof key); - - if(keylen != cipher_keylength(&from->outcipher)) { - logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses wrong keylength!", from->name, from->hostname); - return true; - } - - /* Update our copy of the origin's packet key */ - - cipher_set_key(&from->outcipher, key, true); - digest_set_key(&from->outdigest, key, keylen); - - from->status.validkey = true; - from->sent_seqno = 0; - - if(*address && *port) { - logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port); - sockaddr_t sa = str2sockaddr(address, port); - update_node_udp(from, &sa); - } - - if(from->options & OPTION_PMTU_DISCOVERY) - send_mtu_probe(from); - return true; }