X-Git-Url: http://git.meshlink.io/?p=meshlink;a=blobdiff_plain;f=src%2Fprotocol_key.c;h=60e9d73691b7c6993effaf99ca317bcadf11a3a4;hp=7ae98036a26036e82bd4a9f4ce5b13dbd008fa97;hb=075e6828a7533e7daa790225f17aa6bb39703278;hpb=b5ccce296848aab72d574ca3de14af5fdf3efa4d diff --git a/src/protocol_key.c b/src/protocol_key.c index 7ae98036..60e9d736 100644 --- a/src/protocol_key.c +++ b/src/protocol_key.c @@ -22,12 +22,10 @@ #include "system.h" -#include -#include -#include - -#include "avl_tree.h" +#include "splay_tree.h" +#include "cipher.h" #include "connection.h" +#include "crypto.h" #include "logger.h" #include "net.h" #include "netutl.h" @@ -36,10 +34,9 @@ #include "utils.h" #include "xalloc.h" -bool mykeyused = false; +static bool mykeyused = false; -bool send_key_changed() -{ +bool send_key_changed() { cp(); /* Only send this message if some other daemon requested our key previously. @@ -52,20 +49,19 @@ bool send_key_changed() return send_request(broadcast, "%d %x %s", KEY_CHANGED, rand(), myself->name); } -bool key_changed_h(connection_t *c) -{ +bool key_changed_h(connection_t *c, char *request) { char name[MAX_STRING_SIZE]; node_t *n; cp(); - if(sscanf(c->buffer, "%*d %*x " MAX_STRING, name) != 1) { + if(sscanf(request, "%*d %*x " MAX_STRING, name) != 1) { logger(LOG_ERR, _("Got bad %s from %s (%s)"), "KEY_CHANGED", c->name, c->hostname); return false; } - if(seen_request(c->buffer)) + if(seen_request(request)) return true; n = lookup_node(name); @@ -82,27 +78,25 @@ bool key_changed_h(connection_t *c) /* Tell the others */ if(!tunnelserver) - forward_request(c); + forward_request(c, request); return true; } -bool send_req_key(node_t *to) -{ +bool send_req_key(node_t *to) { cp(); return send_request(to->nexthop->connection, "%d %s %s", REQ_KEY, myself->name, to->name); } -bool req_key_h(connection_t *c) -{ +bool req_key_h(connection_t *c, char *request) { char from_name[MAX_STRING_SIZE]; char to_name[MAX_STRING_SIZE]; node_t *from, *to; cp(); - if(sscanf(c->buffer, "%*d " MAX_STRING " " MAX_STRING, from_name, to_name) != 2) { + if(sscanf(request, "%*d " MAX_STRING " " MAX_STRING, from_name, to_name) != 2) { logger(LOG_ERR, _("Got bad %s from %s (%s)"), "REQ_KEY", c->name, c->hostname); return false; @@ -127,6 +121,7 @@ bool req_key_h(connection_t *c) /* Check if this key request is for us */ if(to == myself) { /* Yes, send our own key back */ + send_ans_key(from); } else { if(tunnelserver) @@ -138,52 +133,42 @@ bool req_key_h(connection_t *c) return true; } - send_request(to->nexthop->connection, "%s", c->buffer); + send_request(to->nexthop->connection, "%s", request); } return true; } -bool send_ans_key(node_t *to) -{ - char *key; +bool send_ans_key(node_t *to) { + size_t keylen = cipher_keylength(&myself->incipher); + char key[keylen * 2 + 1]; cp(); - // Set key parameters - to->incipher = myself->incipher; - to->inkeylength = myself->inkeylength; - to->indigest = myself->indigest; - to->inmaclength = myself->inmaclength; + cipher_open_by_nid(&to->incipher, cipher_get_nid(&myself->incipher)); + digest_open_by_nid(&to->indigest, digest_get_nid(&myself->indigest), digest_length(&myself->indigest)); to->incompression = myself->incompression; - // Allocate memory for key - to->inkey = xrealloc(to->inkey, to->inkeylength); + randomize(key, keylen); + cipher_set_key(&to->incipher, key, true); - // Create a new key - RAND_pseudo_bytes((unsigned char *)to->inkey, to->inkeylength); - if(to->incipher) - EVP_DecryptInit_ex(&to->inctx, to->incipher, NULL, (unsigned char *)to->inkey, (unsigned char *)to->inkey + to->incipher->key_len); + bin2hex(key, key, keylen); + key[keylen * 2] = '\0'; // Reset sequence number and late packet window mykeyused = true; to->received_seqno = 0; memset(to->late, 0, sizeof(to->late)); - // Convert to hexadecimal and send - key = alloca(2 * to->inkeylength + 1); - bin2hex(to->inkey, key, to->inkeylength); - key[to->inkeylength * 2] = '\0'; - return send_request(to->nexthop->connection, "%d %s %s %s %d %d %d %d", ANS_KEY, - myself->name, to->name, key, - to->incipher ? to->incipher->nid : 0, - to->indigest ? to->indigest->type : 0, to->inmaclength, - to->incompression); + myself->name, to->name, key, + cipher_get_nid(&to->incipher), + digest_get_nid(&to->indigest), + digest_length(&to->indigest), + to->incompression); } -bool ans_key_h(connection_t *c) -{ +bool ans_key_h(connection_t *c, char *request) { char from_name[MAX_STRING_SIZE]; char to_name[MAX_STRING_SIZE]; char key[MAX_STRING_SIZE]; @@ -192,7 +177,7 @@ bool ans_key_h(connection_t *c) cp(); - if(sscanf(c->buffer, "%*d "MAX_STRING" "MAX_STRING" "MAX_STRING" %d %d %d %d", + if(sscanf(request, "%*d "MAX_STRING" "MAX_STRING" "MAX_STRING" %d %d %d %d", from_name, to_name, key, &cipher, &digest, &maclength, &compression) != 7) { logger(LOG_ERR, _("Got bad %s from %s (%s)"), "ANS_KEY", c->name, @@ -224,59 +209,33 @@ bool ans_key_h(connection_t *c) if(!to->status.reachable) { logger(LOG_WARNING, _("Got %s from %s (%s) destination %s which is not reachable"), - "ANS_KEY", c->name, c->hostname, to_name); + "ANS_KEY", c->name, c->hostname, to_name); return true; } - return send_request(to->nexthop->connection, "%s", c->buffer); + return send_request(to->nexthop->connection, "%s", request); } - /* Update our copy of the origin's packet key */ - from->outkey = xrealloc(from->outkey, strlen(key) / 2); - - from->outkey = xstrdup(key); - from->outkeylength = strlen(key) / 2; - hex2bin(key, from->outkey, from->outkeylength); - - from->status.waitingforkey = false; /* Check and lookup cipher and digest algorithms */ - if(cipher) { - from->outcipher = EVP_get_cipherbynid(cipher); - - if(!from->outcipher) { - logger(LOG_ERR, _("Node %s (%s) uses unknown cipher!"), from->name, - from->hostname); - return false; - } - - if(from->outkeylength != from->outcipher->key_len + from->outcipher->iv_len) { - logger(LOG_ERR, _("Node %s (%s) uses wrong keylength!"), from->name, - from->hostname); - return false; - } - } else { - from->outcipher = NULL; + if(!cipher_open_by_nid(&from->outcipher, cipher)) { + logger(LOG_ERR, _("Node %s (%s) uses unknown cipher!"), from->name, from->hostname); + return false; } - from->outmaclength = maclength; - - if(digest) { - from->outdigest = EVP_get_digestbynid(digest); + if(strlen(key) / 2 != cipher_keylength(&from->outcipher)) { + logger(LOG_ERR, _("Node %s (%s) uses wrong keylength!"), from->name, from->hostname); + return false; + } - if(!from->outdigest) { - logger(LOG_ERR, _("Node %s (%s) uses unknown digest!"), from->name, - from->hostname); - return false; - } + if(!digest_open_by_nid(&from->outdigest, digest, maclength)) { + logger(LOG_ERR, _("Node %s (%s) uses unknown digest!"), from->name, from->hostname); + return false; + } - if(from->outmaclength > from->outdigest->md_size || from->outmaclength < 0) { - logger(LOG_ERR, _("Node %s (%s) uses bogus MAC length!"), - from->name, from->hostname); - return false; - } - } else { - from->outdigest = NULL; + if(maclength != digest_length(&from->outdigest)) { + logger(LOG_ERR, _("Node %s (%s) uses bogus MAC length!"), from->name, from->hostname); + return false; } if(compression < 0 || compression > 11) { @@ -286,14 +245,13 @@ bool ans_key_h(connection_t *c) from->outcompression = compression; - if(from->outcipher) - if(!EVP_EncryptInit_ex(&from->outctx, from->outcipher, NULL, (unsigned char *)from->outkey, (unsigned char *)from->outkey + from->outcipher->key_len)) { - logger(LOG_ERR, _("Error during initialisation of key from %s (%s): %s"), - from->name, from->hostname, ERR_error_string(ERR_get_error(), NULL)); - return false; - } + /* Update our copy of the origin's packet key */ + + hex2bin(key, key, cipher_keylength(&from->outcipher)); + cipher_set_key(&from->outcipher, key, false); from->status.validkey = true; + from->status.waitingforkey = false; from->sent_seqno = 0; if(from->options & OPTION_PMTU_DISCOVERY && !from->mtuprobes)