apps/silcd/protocol.c

   1 /*
   2
   3   protocol.c
   4
   5   Author: Pekka Riikonen <priikone@poseidon.pspt.fi>
   6
   7   Copyright (C) 1997 - 2001 Pekka Riikonen
   8
   9   This program is free software; you can redistribute it and/or modify
  10   it under the terms of the GNU General Public License as published by
  11   the Free Software Foundation; either version 2 of the License, or
  12   (at your option) any later version.
  13
  14   This program is distributed in the hope that it will be useful,
  15   but WITHOUT ANY WARRANTY; without even the implied warranty of
  16   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17   GNU General Public License for more details.
  18
  19 */
  20 /*
  21  * Server side of the protocols.
  22  */
  23 /* $Id$ */
  24
  25 #include "serverincludes.h"
  26 #include "server_internal.h"
  27
  28 SILC_TASK_CALLBACK(silc_server_protocol_connection_auth);
  29 SILC_TASK_CALLBACK(silc_server_protocol_key_exchange);
  30
  31 extern char *silc_version_string;
  32
  33 /*
  34  * Key Exhange protocol functions
  35  */
  36
  37 /* Packet sending callback. This function is provided as packet sending
  38    routine to the Key Exchange functions. */
  39
  40 static void silc_server_protocol_ke_send_packet(SilcSKE ske,
  41                                                 SilcBuffer packet,
  42                                                 SilcPacketType type,
  43                                                 void *context)
  44 {
  45   SilcProtocol protocol = (SilcProtocol)context;
  46   SilcServerKEInternalContext *ctx =
  47     (SilcServerKEInternalContext *)protocol->context;
  48   SilcServer server = (SilcServer)ctx->server;
  49
  50   /* Send the packet immediately */
  51   silc_server_packet_send(server, ske->sock,
  52                           type, 0, packet->data, packet->len, TRUE);
  53 }
  54
  55 /* Sets the negotiated key material into use for particular connection. */
  56
  57 int silc_server_protocol_ke_set_keys(SilcSKE ske,
  58                                      SilcSocketConnection sock,
  59                                      SilcSKEKeyMaterial *keymat,
  60                                      SilcCipher cipher,
  61                                      SilcPKCS pkcs,
  62                                      SilcHash hash,
  63                                      SilcHmac hmac,
  64                                      int is_responder)
  65 {
  66   SilcUnknownEntry conn_data;
  67   SilcIDListData idata;
  68
  69   SILC_LOG_DEBUG(("Setting new key into use"));
  70
  71   conn_data = silc_calloc(1, sizeof(*conn_data));
  72   idata = (SilcIDListData)conn_data;
  73
  74   /* Allocate cipher to be used in the communication */
  75   if (!silc_cipher_alloc(cipher->cipher->name, &idata->send_key)) {
  76     silc_free(conn_data);
  77     return FALSE;
  78   }
  79   if (!silc_cipher_alloc(cipher->cipher->name, &idata->receive_key)) {
  80     silc_free(conn_data);
  81     return FALSE;
  82   }
  83
  84   if (is_responder == TRUE) {
  85     idata->send_key->cipher->set_key(idata->send_key->context,
  86                                      keymat->receive_enc_key,
  87                                      keymat->enc_key_len);
  88     idata->send_key->set_iv(idata->send_key, keymat->receive_iv);
  89     idata->receive_key->cipher->set_key(idata->receive_key->context,
  90                                         keymat->send_enc_key,
  91                                         keymat->enc_key_len);
  92     idata->receive_key->set_iv(idata->receive_key, keymat->send_iv);
  93
  94   } else {
  95     idata->send_key->cipher->set_key(idata->send_key->context,
  96                                      keymat->send_enc_key,
  97                                      keymat->enc_key_len);
  98     idata->send_key->set_iv(idata->send_key, keymat->send_iv);
  99     idata->receive_key->cipher->set_key(idata->receive_key->context,
 100                                         keymat->receive_enc_key,
 101                                         keymat->enc_key_len);
 102     idata->receive_key->set_iv(idata->receive_key, keymat->receive_iv);
 103   }
 104
 105   /* Save the hash */
 106   if (!silc_hash_alloc(hash->hash->name, &idata->hash)) {
 107     silc_cipher_free(idata->send_key);
 108     silc_cipher_free(idata->receive_key);
 109     silc_free(conn_data);
 110     return FALSE;
 111   }
 112
 113   /* Save HMAC key to be used in the communication. */
 114   if (!silc_hmac_alloc(hmac->hmac->name, NULL, &idata->hmac)) {
 115     silc_cipher_free(idata->send_key);
 116     silc_cipher_free(idata->receive_key);
 117     silc_hash_free(idata->hash);
 118     silc_free(conn_data);
 119     return FALSE;
 120   }
 121   silc_hmac_set_key(idata->hmac, keymat->hmac_key, keymat->hmac_key_len);
 122
 123   sock->user_data = (void *)conn_data;
 124
 125   return TRUE;
 126 }
 127
 128 /* Check remote host version string */
 129
 130 SilcSKEStatus silc_ske_check_version(SilcSKE ske, unsigned char *version,
 131                                      unsigned int len)
 132 {
 133   SilcSKEStatus status = SILC_SKE_STATUS_OK;
 134
 135   SILC_LOG_INFO(("%s (%s) is version %s", ske->sock->hostname,
 136                  ske->sock->ip, version));
 137
 138   /* Check for initial version string */
 139   if (!strstr(version, "SILC-1.0-"))
 140     status = SILC_SKE_STATUS_BAD_VERSION;
 141
 142   /* Check software version */
 143
 144   if (len < strlen(silc_version_string))
 145     status = SILC_SKE_STATUS_BAD_VERSION;
 146
 147   /* XXX for now there is no other tests due to the abnormal version
 148      string that is used */
 149
 150   return status;
 151 }
 152
 153 /* Performs key exchange protocol. This is used for both initiator
 154    and responder key exchange. This is performed always when accepting
 155    new connection to the server. This may be called recursively. */
 156
 157 SILC_TASK_CALLBACK(silc_server_protocol_key_exchange)
 158 {
 159   SilcProtocol protocol = (SilcProtocol)context;
 160   SilcServerKEInternalContext *ctx =
 161     (SilcServerKEInternalContext *)protocol->context;
 162   SilcServer server = (SilcServer)ctx->server;
 163   SilcSKEStatus status = 0;
 164
 165   SILC_LOG_DEBUG(("Start"));
 166
 167   if (protocol->state == SILC_PROTOCOL_STATE_UNKNOWN)
 168     protocol->state = SILC_PROTOCOL_STATE_START;
 169
 170   SILC_LOG_DEBUG(("State=%d", protocol->state));
 171
 172   switch(protocol->state) {
 173   case SILC_PROTOCOL_STATE_START:
 174     {
 175       /*
 176        * Start protocol
 177        */
 178       SilcSKE ske;
 179
 180       /* Allocate Key Exchange object */
 181       ske = silc_ske_alloc();
 182       ctx->ske = ske;
 183       ske->rng = server->rng;
 184
 185       if (ctx->responder == TRUE) {
 186         /* Start the key exchange by processing the received security
 187            properties packet from initiator. */
 188         status = silc_ske_responder_start(ske, ctx->rng, ctx->sock,
 189                                           silc_version_string,
 190                                           ctx->packet->buffer, NULL, NULL);
 191       } else {
 192         SilcSKEStartPayload *start_payload;
 193
 194         /* Assemble security properties. */
 195         silc_ske_assemble_security_properties(ske, SILC_SKE_SP_FLAG_NONE,
 196                                               silc_version_string,
 197                                               &start_payload);
 198
 199         /* Start the key exchange by sending our security properties
 200            to the remote end. */
 201         status = silc_ske_initiator_start(ske, ctx->rng, ctx->sock,
 202                                           start_payload,
 203                                           silc_server_protocol_ke_send_packet,
 204                                           context);
 205       }
 206
 207       if (status != SILC_SKE_STATUS_OK) {
 208         SILC_LOG_WARNING(("Error (type %d) during Key Exchange protocol",
 209                           status));
 210         SILC_LOG_DEBUG(("Error (type %d) during Key Exchange protocol",
 211                         status));
 212
 213         protocol->state = SILC_PROTOCOL_STATE_ERROR;
 214         protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 300000);
 215         return;
 216       }
 217
 218       /* Advance protocol state and call the next state if we are responder */
 219       protocol->state++;
 220       if (ctx->responder == TRUE)
 221         protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 100000);
 222     }
 223     break;
 224   case 2:
 225     {
 226       /*
 227        * Phase 1
 228        */
 229       if (ctx->responder == TRUE) {
 230         /* Sends the selected security properties to the initiator. */
 231         status =
 232           silc_ske_responder_phase_1(ctx->ske,
 233                                      ctx->ske->start_payload,
 234                                      silc_server_protocol_ke_send_packet,
 235                                      context);
 236       } else {
 237         /* Call Phase-1 function. This processes the Key Exchange Start
 238            paylaod reply we just got from the responder. The callback
 239            function will receive the processed payload where we will
 240            save it. */
 241         status = silc_ske_initiator_phase_1(ctx->ske, ctx->packet->buffer,
 242                                             NULL, NULL);
 243       }
 244
 245       if (status != SILC_SKE_STATUS_OK) {
 246         SILC_LOG_WARNING(("Error (type %d) during Key Exchange protocol",
 247                           status));
 248         SILC_LOG_DEBUG(("Error (type %d) during Key Exchange protocol",
 249                         status));
 250
 251         protocol->state = SILC_PROTOCOL_STATE_ERROR;
 252         protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 300000);
 253         return;
 254       }
 255
 256       /* Advance protocol state and call next state if we are initiator */
 257       protocol->state++;
 258       if (ctx->responder == FALSE)
 259         protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 100000);
 260     }
 261     break;
 262   case 3:
 263     {
 264       /*
 265        * Phase 2
 266        */
 267       if (ctx->responder == TRUE) {
 268         /* Process the received Key Exchange 1 Payload packet from
 269            the initiator. This also creates our parts of the Diffie
 270            Hellman algorithm. */
 271         status = silc_ske_responder_phase_2(ctx->ske, ctx->packet->buffer,
 272                                             NULL, NULL);
 273       } else {
 274         /* Call the Phase-2 function. This creates Diffie Hellman
 275            key exchange parameters and sends our public part inside
 276            Key Exhange 1 Payload to the responder. */
 277         status =
 278           silc_ske_initiator_phase_2(ctx->ske,
 279                                      server->public_key,
 280                                      silc_server_protocol_ke_send_packet,
 281                                      context);
 282       }
 283
 284       if (status != SILC_SKE_STATUS_OK) {
 285         SILC_LOG_WARNING(("Error (type %d) during Key Exchange protocol",
 286                           status));
 287         SILC_LOG_DEBUG(("Error (type %d) during Key Exchange protocol",
 288                         status));
 289
 290         protocol->state = SILC_PROTOCOL_STATE_ERROR;
 291         protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 300000);
 292         return;
 293       }
 294
 295       /* Advance protocol state and call the next state if we are responder */
 296       protocol->state++;
 297       if (ctx->responder == TRUE)
 298         protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 100000);
 299     }
 300     break;
 301   case 4:
 302     {
 303       /*
 304        * Finish protocol
 305        */
 306       if (ctx->responder == TRUE) {
 307         /* This creates the key exchange material and sends our
 308            public parts to the initiator inside Key Exchange 2 Payload. */
 309         status =
 310           silc_ske_responder_finish(ctx->ske,
 311                                     server->public_key, server->private_key,
 312                                     SILC_SKE_PK_TYPE_SILC,
 313                                     silc_server_protocol_ke_send_packet,
 314                                     context);
 315       } else {
 316         /* Finish the protocol. This verifies the Key Exchange 2 payload
 317            sent by responder. */
 318         status = silc_ske_initiator_finish(ctx->ske, ctx->packet->buffer,
 319                                            NULL, NULL, NULL, NULL);
 320       }
 321
 322       if (status != SILC_SKE_STATUS_OK) {
 323         SILC_LOG_WARNING(("Error (type %d) during Key Exchange protocol",
 324                           status));
 325         SILC_LOG_DEBUG(("Error (type %d) during Key Exchange protocol",
 326                         status));
 327
 328         protocol->state = SILC_PROTOCOL_STATE_ERROR;
 329         protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 300000);
 330         return;
 331       }
 332
 333       /* Send Ok to the other end. We will end the protocol as responder
 334          sends Ok to us when we will take the new keys into use. */
 335       if (ctx->responder == FALSE)
 336         silc_ske_end(ctx->ske, silc_server_protocol_ke_send_packet, context);
 337
 338       /* End the protocol on the next round */
 339       protocol->state = SILC_PROTOCOL_STATE_END;
 340     }
 341     break;
 342
 343   case SILC_PROTOCOL_STATE_END:
 344     {
 345       /*
 346        * End protocol
 347        */
 348       SilcSKEKeyMaterial *keymat;
 349       int key_len = silc_cipher_get_key_len(ctx->ske->prop->cipher);
 350       int hash_len = ctx->ske->prop->hash->hash->hash_len;
 351
 352       /* Process the key material */
 353       keymat = silc_calloc(1, sizeof(*keymat));
 354       status = silc_ske_process_key_material(ctx->ske, 16, key_len, hash_len,
 355                                              keymat);
 356       if (status != SILC_SKE_STATUS_OK) {
 357         protocol->state = SILC_PROTOCOL_STATE_ERROR;
 358         protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 300000);
 359         silc_ske_free_key_material(keymat);
 360         return;
 361       }
 362       ctx->keymat = keymat;
 363
 364       /* Send Ok to the other end if we are responder. If we are initiator
 365          we have sent this already. */
 366       if (ctx->responder == TRUE)
 367         silc_ske_end(ctx->ske, silc_server_protocol_ke_send_packet, context);
 368
 369       /* Unregister the timeout task since the protocol has ended.
 370          This was the timeout task to be executed if the protocol is
 371          not completed fast enough. */
 372       if (ctx->timeout_task)
 373         silc_task_unregister(server->timeout_queue, ctx->timeout_task);
 374
 375       /* Call the final callback */
 376       if (protocol->final_callback)
 377         protocol->execute_final(server->timeout_queue, 0, protocol, fd);
 378       else
 379         silc_protocol_free(protocol);
 380     }
 381     break;
 382
 383   case SILC_PROTOCOL_STATE_ERROR:
 384     /*
 385      * Error occured
 386      */
 387
 388     /* Send abort notification */
 389     silc_ske_abort(ctx->ske, ctx->ske->status,
 390                    silc_server_protocol_ke_send_packet,
 391                    context);
 392
 393     /* Unregister the timeout task since the protocol has ended.
 394        This was the timeout task to be executed if the protocol is
 395        not completed fast enough. */
 396     if (ctx->timeout_task)
 397       silc_task_unregister(server->timeout_queue, ctx->timeout_task);
 398
 399     /* On error the final callback is always called. */
 400     if (protocol->final_callback)
 401       protocol->execute_final(server->timeout_queue, 0, protocol, fd);
 402     else
 403       silc_protocol_free(protocol);
 404     break;
 405
 406   case SILC_PROTOCOL_STATE_FAILURE:
 407     /*
 408      * We have received failure from remote
 409      */
 410
 411     /* Unregister the timeout task since the protocol has ended.
 412        This was the timeout task to be executed if the protocol is
 413        not completed fast enough. */
 414     if (ctx->timeout_task)
 415       silc_task_unregister(server->timeout_queue, ctx->timeout_task);
 416
 417     /* On error the final callback is always called. */
 418     if (protocol->final_callback)
 419       protocol->execute_final(server->timeout_queue, 0, protocol, fd);
 420     else
 421       silc_protocol_free(protocol);
 422     break;
 423
 424   case SILC_PROTOCOL_STATE_UNKNOWN:
 425     break;
 426   }
 427 }
 428
 429 /*
 430  * Connection Authentication protocol functions
 431  */
 432
 433 static int
 434 silc_server_password_authentication(SilcServer server, char *auth1,
 435                                     char *auth2)
 436 {
 437   if (!auth1 || !auth2)
 438     return FALSE;
 439
 440   if (!memcmp(auth1, auth2, strlen(auth1)))
 441     return TRUE;
 442
 443   return FALSE;
 444 }
 445
 446 static int
 447 silc_server_public_key_authentication(SilcServer server,
 448                                       SilcPublicKey pub_key,
 449                                       unsigned char *sign,
 450                                       unsigned int sign_len,
 451                                       SilcSKE ske)
 452 {
 453   SilcPKCS pkcs;
 454   int len;
 455   SilcBuffer auth;
 456
 457   if (!pub_key || !sign)
 458     return FALSE;
 459
 460   silc_pkcs_alloc(pub_key->name, &pkcs);
 461   if (!silc_pkcs_public_key_set(pkcs, pub_key)) {
 462     silc_pkcs_free(pkcs);
 463     return FALSE;
 464   }
 465
 466   /* Make the authentication data. Protocol says it is HASH plus
 467      KE Start Payload. */
 468   len = ske->hash_len + ske->start_payload_copy->len;
 469   auth = silc_buffer_alloc(len);
 470   silc_buffer_pull_tail(auth, len);
 471   silc_buffer_format(auth,
 472                      SILC_STR_UI_XNSTRING(ske->hash, ske->hash_len),
 473                      SILC_STR_UI_XNSTRING(ske->start_payload_copy->data,
 474                                           ske->start_payload_copy->len),
 475                      SILC_STR_END);
 476
 477   /* Verify signature */
 478   if (silc_pkcs_verify(pkcs, sign, sign_len, auth->data, auth->len)) {
 479     silc_pkcs_free(pkcs);
 480     silc_buffer_free(auth);
 481     return TRUE;
 482   }
 483
 484   silc_pkcs_free(pkcs);
 485   silc_buffer_free(auth);
 486   return FALSE;
 487 }
 488
 489 static int
 490 silc_server_get_public_key_auth(SilcServer server,
 491                                 SilcPublicKey pub_key,
 492                                 unsigned char *auth_data,
 493                                 unsigned int *auth_data_len,
 494                                 SilcSKE ske)
 495 {
 496   int len;
 497   SilcPKCS pkcs;
 498   SilcBuffer auth;
 499
 500   if (!pub_key)
 501     return FALSE;
 502
 503   silc_pkcs_alloc(pub_key->name, &pkcs);
 504   if (!silc_pkcs_public_key_set(pkcs, pub_key)) {
 505     silc_pkcs_free(pkcs);
 506     return FALSE;
 507   }
 508
 509   /* Make the authentication data. Protocol says it is HASH plus
 510      KE Start Payload. */
 511   len = ske->hash_len + ske->start_payload_copy->len;
 512   auth = silc_buffer_alloc(len);
 513   silc_buffer_pull_tail(auth, len);
 514   silc_buffer_format(auth,
 515                      SILC_STR_UI_XNSTRING(ske->hash, ske->hash_len),
 516                      SILC_STR_UI_XNSTRING(ske->start_payload_copy->data,
 517                                           ske->start_payload_copy->len),
 518                      SILC_STR_END);
 519
 520   if (silc_pkcs_sign(pkcs, auth->data, auth->len, auth_data, auth_data_len)) {
 521     silc_pkcs_free(pkcs);
 522     silc_buffer_free(auth);
 523     return TRUE;
 524   }
 525
 526   silc_pkcs_free(pkcs);
 527   silc_buffer_free(auth);
 528   return FALSE;
 529 }
 530
 531 /* Performs connection authentication protocol. If responder, we
 532    authenticate the remote data received. If initiator, we will send
 533    authentication data to the remote end. */
 534
 535 SILC_TASK_CALLBACK(silc_server_protocol_connection_auth)
 536 {
 537   SilcProtocol protocol = (SilcProtocol)context;
 538   SilcServerConnAuthInternalContext *ctx =
 539     (SilcServerConnAuthInternalContext *)protocol->context;
 540   SilcServer server = (SilcServer)ctx->server;
 541
 542   SILC_LOG_DEBUG(("Start"));
 543
 544   if (protocol->state == SILC_PROTOCOL_STATE_UNKNOWN)
 545     protocol->state = SILC_PROTOCOL_STATE_START;
 546
 547   SILC_LOG_DEBUG(("State=%d", protocol->state));
 548
 549   switch(protocol->state) {
 550   case SILC_PROTOCOL_STATE_START:
 551     {
 552       /*
 553        * Start protocol.
 554        */
 555
 556       if (ctx->responder == TRUE) {
 557         /*
 558          * We are receiving party
 559          */
 560         int ret;
 561         unsigned short payload_len;
 562         unsigned short conn_type;
 563         unsigned char *auth_data = NULL;
 564
 565         SILC_LOG_INFO(("Performing authentication protocol for %s (%s)",
 566                        ctx->sock->hostname, ctx->sock->ip));
 567
 568         /* Parse the received authentication data packet. The received
 569            payload is Connection Auth Payload. */
 570         ret = silc_buffer_unformat(ctx->packet->buffer,
 571                                    SILC_STR_UI_SHORT(&payload_len),
 572                                    SILC_STR_UI_SHORT(&conn_type),
 573                                    SILC_STR_END);
 574         if (ret == -1) {
 575           SILC_LOG_DEBUG(("Bad payload in authentication packet"));
 576           protocol->state = SILC_PROTOCOL_STATE_ERROR;
 577           protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 300000);
 578           return;
 579         }
 580
 581         if (payload_len != ctx->packet->buffer->len) {
 582           SILC_LOG_DEBUG(("Bad payload in authentication packet"));
 583           protocol->state = SILC_PROTOCOL_STATE_ERROR;
 584           protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 300000);
 585           return;
 586         }
 587
 588         payload_len -= 4;
 589
 590         if (conn_type < SILC_SOCKET_TYPE_CLIENT ||
 591             conn_type > SILC_SOCKET_TYPE_ROUTER) {
 592           SILC_LOG_ERROR(("Bad connection type %d", conn_type));
 593           protocol->state = SILC_PROTOCOL_STATE_ERROR;
 594           protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 300000);
 595           return;
 596         }
 597
 598         if (payload_len > 0) {
 599           /* Get authentication data */
 600           silc_buffer_pull(ctx->packet->buffer, 4);
 601           ret = silc_buffer_unformat(ctx->packet->buffer,
 602                                      SILC_STR_UI_XNSTRING(&auth_data,
 603                                                           payload_len),
 604                                      SILC_STR_END);
 605           if (ret == -1) {
 606             SILC_LOG_DEBUG(("Bad payload in authentication packet"));
 607             protocol->state = SILC_PROTOCOL_STATE_ERROR;
 608             protocol->execute(server->timeout_queue, 0,
 609                               protocol, fd, 0, 300000);
 610             return;
 611           }
 612         }
 613
 614         /*
 615          * Check the remote connection type and make sure that we have
 616          * configured this connection. If we haven't allowed this connection
 617          * the authentication must be failed.
 618          */
 619
 620         SILC_LOG_DEBUG(("Remote connection type %d", conn_type));
 621
 622         /* Remote end is client */
 623         if (conn_type == SILC_SOCKET_TYPE_CLIENT) {
 624           SilcServerConfigSectionClientConnection *client = NULL;
 625           client = silc_server_config_find_client_conn(server->config,
 626                                                        ctx->sock->ip,
 627                                                        ctx->sock->port);
 628           if (!client)
 629             client = silc_server_config_find_client_conn(server->config,
 630                                                          ctx->sock->hostname,
 631                                                          ctx->sock->port);
 632
 633           if (client) {
 634             switch(client->auth_meth) {
 635             case SILC_AUTH_NONE:
 636               /* No authentication required */
 637               SILC_LOG_DEBUG(("No authentication required"));
 638               break;
 639
 640             case SILC_AUTH_PASSWORD:
 641               /* Password authentication */
 642               SILC_LOG_DEBUG(("Password authentication"));
 643               ret = silc_server_password_authentication(server, auth_data,
 644                                                         client->auth_data);
 645
 646               if (ret)
 647                 break;
 648
 649               /* Authentication failed */
 650               SILC_LOG_ERROR(("Authentication failed"));
 651               SILC_LOG_DEBUG(("Authentication failed"));
 652               protocol->state = SILC_PROTOCOL_STATE_ERROR;
 653               protocol->execute(server->timeout_queue, 0,
 654                                 protocol, fd, 0, 300000);
 655               return;
 656               break;
 657
 658             case SILC_AUTH_PUBLIC_KEY:
 659               /* Public key authentication */
 660               SILC_LOG_DEBUG(("Public key authentication"));
 661               ret = silc_server_public_key_authentication(server,
 662                                                           client->auth_data,
 663                                                           auth_data,
 664                                                           payload_len,
 665                                                           ctx->ske);
 666
 667               if (ret)
 668                 break;
 669
 670               SILC_LOG_ERROR(("Authentication failed"));
 671               SILC_LOG_DEBUG(("Authentication failed"));
 672               protocol->state = SILC_PROTOCOL_STATE_ERROR;
 673               protocol->execute(server->timeout_queue, 0,
 674                                 protocol, fd, 0, 300000);
 675               return;
 676             }
 677           } else {
 678             SILC_LOG_DEBUG(("No configuration for remote connection"));
 679             SILC_LOG_ERROR(("Remote connection not configured"));
 680             SILC_LOG_ERROR(("Authentication failed"));
 681             protocol->state = SILC_PROTOCOL_STATE_ERROR;
 682             protocol->execute(server->timeout_queue, 0,
 683                               protocol, fd, 0, 300000);
 684             return;
 685           }
 686         }
 687
 688         /* Remote end is server */
 689         if (conn_type == SILC_SOCKET_TYPE_SERVER) {
 690           SilcServerConfigSectionServerConnection *serv = NULL;
 691           serv = silc_server_config_find_server_conn(server->config,
 692                                                      ctx->sock->ip,
 693                                                      ctx->sock->port);
 694           if (!serv)
 695             serv = silc_server_config_find_server_conn(server->config,
 696                                                        ctx->sock->hostname,
 697                                                        ctx->sock->port);
 698
 699           if (serv) {
 700             switch(serv->auth_meth) {
 701             case SILC_AUTH_NONE:
 702               /* No authentication required */
 703               SILC_LOG_DEBUG(("No authentication required"));
 704               break;
 705
 706             case SILC_AUTH_PASSWORD:
 707               /* Password authentication */
 708               SILC_LOG_DEBUG(("Password authentication"));
 709               ret = silc_server_password_authentication(server, auth_data,
 710                                                         serv->auth_data);
 711
 712               if (ret)
 713                 break;
 714
 715               /* Authentication failed */
 716               SILC_LOG_ERROR(("Authentication failed"));
 717               SILC_LOG_DEBUG(("Authentication failed"));
 718               protocol->state = SILC_PROTOCOL_STATE_ERROR;
 719               protocol->execute(server->timeout_queue, 0,
 720                                 protocol, fd, 0, 300000);
 721               return;
 722               break;
 723
 724             case SILC_AUTH_PUBLIC_KEY:
 725               /* Public key authentication */
 726               SILC_LOG_DEBUG(("Public key authentication"));
 727               ret = silc_server_public_key_authentication(server,
 728                                                           serv->auth_data,
 729                                                           auth_data,
 730                                                           payload_len,
 731                                                           ctx->ske);
 732
 733               if (ret)
 734                 break;
 735
 736               SILC_LOG_ERROR(("Authentication failed"));
 737               SILC_LOG_DEBUG(("Authentication failed"));
 738               protocol->state = SILC_PROTOCOL_STATE_ERROR;
 739               protocol->execute(server->timeout_queue, 0,
 740                                 protocol, fd, 0, 300000);
 741               return;
 742             }
 743           } else {
 744             SILC_LOG_DEBUG(("No configuration for remote connection"));
 745             SILC_LOG_ERROR(("Remote connection not configured"));
 746             SILC_LOG_ERROR(("Authentication failed"));
 747             protocol->state = SILC_PROTOCOL_STATE_ERROR;
 748             protocol->execute(server->timeout_queue, 0,
 749                               protocol, fd, 0, 300000);
 750             return;
 751           }
 752         }
 753
 754         /* Remote end is router */
 755         if (conn_type == SILC_SOCKET_TYPE_ROUTER) {
 756           SilcServerConfigSectionServerConnection *serv = NULL;
 757           serv = silc_server_config_find_router_conn(server->config,
 758                                                      ctx->sock->ip,
 759                                                      ctx->sock->port);
 760           if (!serv)
 761             serv = silc_server_config_find_router_conn(server->config,
 762                                                        ctx->sock->hostname,
 763                                                        ctx->sock->port);
 764
 765           if (serv) {
 766             switch(serv->auth_meth) {
 767             case SILC_AUTH_NONE:
 768               /* No authentication required */
 769               SILC_LOG_DEBUG(("No authentication required"));
 770               break;
 771
 772             case SILC_AUTH_PASSWORD:
 773               /* Password authentication */
 774               SILC_LOG_DEBUG(("Password authentication"));
 775               ret = silc_server_password_authentication(server, auth_data,
 776                                                         serv->auth_data);
 777
 778               if (ret)
 779                 break;
 780
 781               /* Authentication failed */
 782               SILC_LOG_ERROR(("Authentication failed"));
 783               SILC_LOG_DEBUG(("Authentication failed"));
 784               protocol->state = SILC_PROTOCOL_STATE_ERROR;
 785               protocol->execute(server->timeout_queue, 0,
 786                                 protocol, fd, 0, 300000);
 787               return;
 788               break;
 789
 790             case SILC_AUTH_PUBLIC_KEY:
 791               /* Public key authentication */
 792               SILC_LOG_DEBUG(("Public key authentication"));
 793               ret = silc_server_public_key_authentication(server,
 794                                                           serv->auth_data,
 795                                                           auth_data,
 796                                                           payload_len,
 797                                                           ctx->ske);
 798
 799               if (ret)
 800                 break;
 801
 802               SILC_LOG_ERROR(("Authentication failed"));
 803               SILC_LOG_DEBUG(("Authentication failed"));
 804               protocol->state = SILC_PROTOCOL_STATE_ERROR;
 805               protocol->execute(server->timeout_queue, 0,
 806                                 protocol, fd, 0, 300000);
 807               return;
 808             }
 809           } else {
 810             SILC_LOG_DEBUG(("No configuration for remote connection"));
 811             SILC_LOG_ERROR(("Remote connection not configured"));
 812             SILC_LOG_ERROR(("Authentication failed"));
 813             protocol->state = SILC_PROTOCOL_STATE_ERROR;
 814             protocol->execute(server->timeout_queue, 0,
 815                               protocol, fd, 0, 300000);
 816             return;
 817           }
 818         }
 819
 820         /* Save connection type. This is later used to create the
 821            ID for the connection. */
 822         ctx->conn_type = conn_type;
 823
 824         /* Advance protocol state. */
 825         protocol->state = SILC_PROTOCOL_STATE_END;
 826         protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 0);
 827
 828       } else {
 829         /*
 830          * We are initiator. We are authenticating ourselves to a
 831          * remote server. We will send the authentication data to the
 832          * other end for verify.
 833          */
 834         SilcBuffer packet;
 835         int payload_len = 0;
 836         unsigned char *auth_data = NULL;
 837         unsigned int auth_data_len = 0;
 838
 839         switch(ctx->auth_meth) {
 840         case SILC_AUTH_NONE:
 841           /* No authentication required */
 842           break;
 843
 844         case SILC_AUTH_PASSWORD:
 845           /* Password authentication */
 846           if (ctx->auth_data && ctx->auth_data_len) {
 847             auth_data = strdup(ctx->auth_data);
 848             auth_data_len = ctx->auth_data_len;
 849             break;
 850           }
 851           break;
 852
 853         case SILC_AUTH_PUBLIC_KEY:
 854           {
 855             unsigned char sign[1024];
 856
 857             /* Public key authentication */
 858             silc_server_get_public_key_auth(server, ctx->auth_data,
 859                                             sign, &auth_data_len,
 860                                             ctx->ske);
 861             break;
 862           }
 863         }
 864
 865         payload_len = 4 + auth_data_len;
 866         packet = silc_buffer_alloc(payload_len);
 867         silc_buffer_pull_tail(packet, SILC_BUFFER_END(packet));
 868         silc_buffer_format(packet,
 869                            SILC_STR_UI_SHORT(payload_len),
 870                            SILC_STR_UI_SHORT(server->server_type
 871                                               == SILC_SERVER ?
 872                                               SILC_SOCKET_TYPE_SERVER :
 873                                               SILC_SOCKET_TYPE_ROUTER),
 874                            SILC_STR_UI_XNSTRING(auth_data, auth_data_len),
 875                            SILC_STR_END);
 876
 877         /* Send the packet to server */
 878         silc_server_packet_send(server, ctx->sock,
 879                                 SILC_PACKET_CONNECTION_AUTH, 0,
 880                                 packet->data, packet->len, TRUE);
 881
 882         if (auth_data) {
 883           memset(auth_data, 0, auth_data_len);
 884           silc_free(auth_data);
 885         }
 886         silc_buffer_free(packet);
 887
 888         /* Next state is end of protocol */
 889         protocol->state = SILC_PROTOCOL_STATE_END;
 890       }
 891     }
 892     break;
 893
 894   case SILC_PROTOCOL_STATE_END:
 895     {
 896       /*
 897        * End protocol
 898        */
 899       unsigned char ok[4];
 900
 901       SILC_PUT32_MSB(SILC_AUTH_OK, ok);
 902
 903       /* Authentication failed */
 904       silc_server_packet_send(server, ctx->sock, SILC_PACKET_SUCCESS,
 905                               0, ok, 4, TRUE);
 906
 907       /* Unregister the timeout task since the protocol has ended.
 908          This was the timeout task to be executed if the protocol is
 909          not completed fast enough. */
 910       if (ctx->timeout_task)
 911         silc_task_unregister(server->timeout_queue, ctx->timeout_task);
 912
 913       /* Protocol has ended, call the final callback */
 914       if (protocol->final_callback)
 915         protocol->execute_final(server->timeout_queue, 0, protocol, fd);
 916       else
 917         silc_protocol_free(protocol);
 918     }
 919     break;
 920   case SILC_PROTOCOL_STATE_ERROR:
 921     {
 922       /*
 923        * Error. Send notify to remote.
 924        */
 925       unsigned char error[4];
 926
 927       SILC_PUT32_MSB(SILC_AUTH_FAILED, error);
 928
 929       /* Authentication failed */
 930       silc_server_packet_send(server, ctx->sock, SILC_PACKET_FAILURE,
 931                               0, error, 4, TRUE);
 932
 933       /* Unregister the timeout task since the protocol has ended.
 934          This was the timeout task to be executed if the protocol is
 935          not completed fast enough. */
 936       if (ctx->timeout_task)
 937         silc_task_unregister(server->timeout_queue, ctx->timeout_task);
 938
 939       /* On error the final callback is always called. */
 940       if (protocol->final_callback)
 941         protocol->execute_final(server->timeout_queue, 0, protocol, fd);
 942       else
 943         silc_protocol_free(protocol);
 944     }
 945     break;
 946
 947   case SILC_PROTOCOL_STATE_FAILURE:
 948     /*
 949      * We have received failure from remote
 950      */
 951
 952     /* Unregister the timeout task since the protocol has ended.
 953        This was the timeout task to be executed if the protocol is
 954        not completed fast enough. */
 955     if (ctx->timeout_task)
 956       silc_task_unregister(server->timeout_queue, ctx->timeout_task);
 957
 958     /* On error the final callback is always called. */
 959     if (protocol->final_callback)
 960       protocol->execute_final(server->timeout_queue, 0, protocol, fd);
 961     else
 962       silc_protocol_free(protocol);
 963     break;
 964
 965   case SILC_PROTOCOL_STATE_UNKNOWN:
 966     break;
 967   }
 968 }
 969
 970 /* Registers protocols used in server. */
 971
 972 void silc_server_protocols_register(void)
 973 {
 974   silc_protocol_register(SILC_PROTOCOL_SERVER_CONNECTION_AUTH,
 975                          silc_server_protocol_connection_auth);
 976   silc_protocol_register(SILC_PROTOCOL_SERVER_KEY_EXCHANGE,
 977                          silc_server_protocol_key_exchange);
 978 }
 979
 980 /* Unregisters protocols */
 981
 982 void silc_server_protocols_unregister(void)
 983 {
 984   silc_protocol_unregister(SILC_PROTOCOL_SERVER_CONNECTION_AUTH,
 985                            silc_server_protocol_connection_auth);
 986   silc_protocol_unregister(SILC_PROTOCOL_SERVER_KEY_EXCHANGE,
 987                            silc_server_protocol_key_exchange);
 988 }