}
/* Save HMAC key to be used in the communication. */
- if (!silc_hmac_alloc(hmac->hmac->name, NULL, &idata->hmac)) {
+ if (!silc_hmac_alloc(hmac->hmac->name, NULL, &idata->hmac_send)) {
silc_cipher_free(idata->send_key);
silc_cipher_free(idata->receive_key);
silc_hash_free(idata->hash);
silc_free(conn_data);
return FALSE;
}
- silc_hmac_set_key(idata->hmac, keymat->hmac_key, keymat->hmac_key_len);
+ silc_hmac_set_key(idata->hmac_send, keymat->hmac_key, keymat->hmac_key_len);
+ idata->hmac_receive = idata->hmac_send;
sock->user_data = (void *)conn_data;
uint32 len)
{
SilcSKEStatus status = SILC_SKE_STATUS_OK;
+ char *cp;
+ int maj = 0, min = 0, build = 0, maj2 = 0, min2 = 0, build2 = 0;
SILC_LOG_INFO(("%s (%s) is version %s", ske->sock->hostname,
ske->sock->ip, version));
/* Check software version */
- if (len < strlen(silc_version_string))
+ cp = version + 9;
+ if (!cp)
status = SILC_SKE_STATUS_BAD_VERSION;
- /* XXX for now there is no other tests due to the abnormal version
- string that is used */
+ maj = atoi(cp);
+ cp = strchr(cp, '.');
+ if (cp) {
+ min = atoi(cp + 1);
+ cp++;
+ }
+ if (cp) {
+ cp = strchr(cp, '.');
+ if (cp)
+ build = atoi(cp + 1);
+ }
+
+ cp = silc_version_string + 9;
+ if (!cp)
+ status = SILC_SKE_STATUS_BAD_VERSION;
+
+ maj2 = atoi(cp);
+ cp = strchr(cp, '.');
+ if (cp) {
+ min2 = atoi(cp + 1);
+ cp++;
+ }
+ if (cp) {
+ cp = strchr(cp, '.');
+ if (cp)
+ build2 = atoi(cp + 1);
+ }
+
+ if (maj != maj2)
+ status = SILC_SKE_STATUS_BAD_VERSION;
+ if (min < min2)
+ status = SILC_SKE_STATUS_BAD_VERSION;
return status;
}
+/* Callback that is called by the SKE to indicate that it is safe to
+ continue the execution of the protocol. This is used only if we are
+ initiator. Is given as argument to the silc_ske_initiator_finish
+ function. This is called due to the fact that the public key verification
+ process is asynchronous and we must not continue the protocl until
+ the public key has been verified and this callback is called. */
+
+static void silc_server_protocol_ke_finish(SilcSKE ske, void *context)
+{
+ SilcProtocol protocol = (SilcProtocol)context;
+ SilcServerKEInternalContext *ctx =
+ (SilcServerKEInternalContext *)protocol->context;
+ SilcServer server = (SilcServer)ctx->server;
+
+ SILC_LOG_DEBUG(("Start"));
+
+ if (ske->status != SILC_SKE_STATUS_OK) {
+ SILC_LOG_WARNING(("Error (type %d) during Key Exchange protocol",
+ ske->status));
+ SILC_LOG_DEBUG(("Error (type %d) during Key Exchange protocol",
+ ske->status));
+
+ protocol->state = SILC_PROTOCOL_STATE_ERROR;
+ protocol->execute(server->timeout_queue, 0, protocol, 0, 0, 300000);
+ return;
+ }
+
+ /* Send Ok to the other end. We will end the protocol as responder
+ sends Ok to us when we will take the new keys into use. */
+ if (ctx->responder == FALSE)
+ silc_ske_end(ctx->ske, silc_server_protocol_ke_send_packet, context);
+
+ /* End the protocol on the next round */
+ protocol->state = SILC_PROTOCOL_STATE_END;
+}
+
/* Performs key exchange protocol. This is used for both initiator
and responder key exchange. This is performed always when accepting
new connection to the server. This may be called recursively. */
SilcServerKEInternalContext *ctx =
(SilcServerKEInternalContext *)protocol->context;
SilcServer server = (SilcServer)ctx->server;
- SilcSKEStatus status = 0;
+ SilcSKEStatus status = SILC_SKE_STATUS_OK;
SILC_LOG_DEBUG(("Start"));
context);
}
+ /* Return now if the procedure is pending. */
+ if (status == SILC_SKE_STATUS_PENDING)
+ return;
+
if (status != SILC_SKE_STATUS_OK) {
SILC_LOG_WARNING(("Error (type %d) during Key Exchange protocol",
status));
NULL, NULL);
}
+ /* Return now if the procedure is pending. */
+ if (status == SILC_SKE_STATUS_PENDING)
+ return;
+
if (status != SILC_SKE_STATUS_OK) {
SILC_LOG_WARNING(("Error (type %d) during Key Exchange protocol",
status));
/* Process the received Key Exchange 1 Payload packet from
the initiator. This also creates our parts of the Diffie
Hellman algorithm. */
+ /* XXX TODO: If mutual authentication flag is set then the
+ verify_key callback should be set to verify the remote ends
+ public key!! */
+ /* XXX TODO: when the verify_key is set then the `callback'
+ must be set as well as the verify_key is asynchronous
+ (take a look to silc_ske_initiator_finish for example. */
status = silc_ske_responder_phase_2(ctx->ske, ctx->packet->buffer,
NULL, NULL, NULL, NULL);
} else {
context);
}
+ /* Return now if the procedure is pending. */
+ if (status == SILC_SKE_STATUS_PENDING)
+ return;
+
if (status != SILC_SKE_STATUS_OK) {
SILC_LOG_WARNING(("Error (type %d) during Key Exchange protocol",
status));
SILC_SKE_PK_TYPE_SILC,
silc_server_protocol_ke_send_packet,
context);
+
+ /* End the protocol on the next round */
+ protocol->state = SILC_PROTOCOL_STATE_END;
} else {
/* Finish the protocol. This verifies the Key Exchange 2 payload
sent by responder. */
+ /* XXX TODO: the verify_key callback is not set!!! */
status = silc_ske_initiator_finish(ctx->ske, ctx->packet->buffer,
- NULL, NULL, NULL, NULL);
+ NULL, NULL,
+ silc_server_protocol_ke_finish,
+ context);
}
+ /* Return now if the procedure is pending. */
+ if (status == SILC_SKE_STATUS_PENDING)
+ return;
+
if (status != SILC_SKE_STATUS_OK) {
SILC_LOG_WARNING(("Error (type %d) during Key Exchange protocol",
status));
protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 300000);
return;
}
-
- /* Send Ok to the other end. We will end the protocol as responder
- sends Ok to us when we will take the new keys into use. */
- if (ctx->responder == FALSE)
- silc_ske_end(ctx->ske, silc_server_protocol_ke_send_packet, context);
-
- /* End the protocol on the next round */
- protocol->state = SILC_PROTOCOL_STATE_END;
}
break;
/* Remote end is client */
if (conn_type == SILC_SOCKET_TYPE_CLIENT) {
- SilcServerConfigSectionClientConnection *client = NULL;
- client = silc_server_config_find_client_conn(server->config,
- ctx->sock->ip,
- ctx->sock->port);
- if (!client)
- client = silc_server_config_find_client_conn(server->config,
- ctx->sock->hostname,
- ctx->sock->port);
+ SilcServerConfigSectionClientConnection *client = ctx->cconfig;
if (client) {
switch(client->auth_meth) {
/* Remote end is server */
if (conn_type == SILC_SOCKET_TYPE_SERVER) {
- SilcServerConfigSectionServerConnection *serv = NULL;
- serv = silc_server_config_find_server_conn(server->config,
- ctx->sock->ip,
- ctx->sock->port);
- if (!serv)
- serv = silc_server_config_find_server_conn(server->config,
- ctx->sock->hostname,
- ctx->sock->port);
-
+ SilcServerConfigSectionServerConnection *serv = ctx->sconfig;
+
if (serv) {
switch(serv->auth_meth) {
case SILC_AUTH_NONE:
/* Remote end is router */
if (conn_type == SILC_SOCKET_TYPE_ROUTER) {
- SilcServerConfigSectionServerConnection *serv = NULL;
- serv = silc_server_config_find_router_conn(server->config,
- ctx->sock->ip,
- ctx->sock->port);
- if (!serv)
- serv = silc_server_config_find_router_conn(server->config,
- ctx->sock->hostname,
- ctx->sock->port);
-
+ SilcServerConfigSectionServerConnection *serv = ctx->rconfig;
+
if (serv) {
switch(serv->auth_meth) {
case SILC_AUTH_NONE:
silc_server_protocol_rekey_validate(SilcServer server,
SilcServerRekeyInternalContext *ctx,
SilcIDListData idata,
- SilcSKEKeyMaterial *keymat)
+ SilcSKEKeyMaterial *keymat,
+ bool send)
{
if (ctx->responder == TRUE) {
- silc_cipher_set_key(idata->send_key, keymat->receive_enc_key,
- keymat->enc_key_len);
- silc_cipher_set_iv(idata->send_key, keymat->receive_iv);
- silc_cipher_set_key(idata->receive_key, keymat->send_enc_key,
- keymat->enc_key_len);
- silc_cipher_set_iv(idata->receive_key, keymat->send_iv);
+ if (send) {
+ silc_cipher_set_key(idata->send_key, keymat->receive_enc_key,
+ keymat->enc_key_len);
+ silc_cipher_set_iv(idata->send_key, keymat->receive_iv);
+ } else {
+ silc_cipher_set_key(idata->receive_key, keymat->send_enc_key,
+ keymat->enc_key_len);
+ silc_cipher_set_iv(idata->receive_key, keymat->send_iv);
+ }
} else {
- silc_cipher_set_key(idata->send_key, keymat->send_enc_key,
- keymat->enc_key_len);
- silc_cipher_set_iv(idata->send_key, keymat->send_iv);
- silc_cipher_set_key(idata->receive_key, keymat->receive_enc_key,
- keymat->enc_key_len);
- silc_cipher_set_iv(idata->receive_key, keymat->receive_iv);
+ if (send) {
+ silc_cipher_set_key(idata->send_key, keymat->send_enc_key,
+ keymat->enc_key_len);
+ silc_cipher_set_iv(idata->send_key, keymat->send_iv);
+ } else {
+ silc_cipher_set_key(idata->receive_key, keymat->receive_enc_key,
+ keymat->enc_key_len);
+ silc_cipher_set_iv(idata->receive_key, keymat->receive_iv);
+ }
}
- silc_hmac_set_key(idata->hmac, keymat->hmac_key, keymat->hmac_key_len);
+ if (send) {
+ silc_hmac_alloc(idata->hmac_send->hmac->name, NULL, &idata->hmac_send);
+ silc_hmac_set_key(idata->hmac_send, keymat->hmac_key,
+ keymat->hmac_key_len);
+ } else {
+ silc_hmac_free(idata->hmac_receive);
+ idata->hmac_receive = idata->hmac_send;
+ }
/* Save the current sending encryption key */
- memset(idata->rekey->send_enc_key, 0, idata->rekey->enc_key_len);
- silc_free(idata->rekey->send_enc_key);
- idata->rekey->send_enc_key =
- silc_calloc(keymat->enc_key_len / 8,
- sizeof(*idata->rekey->send_enc_key));
- memcpy(idata->rekey->send_enc_key, keymat->send_enc_key,
- keymat->enc_key_len / 8);
- idata->rekey->enc_key_len = keymat->enc_key_len / 8;
+ if (!send) {
+ memset(idata->rekey->send_enc_key, 0, idata->rekey->enc_key_len);
+ silc_free(idata->rekey->send_enc_key);
+ idata->rekey->send_enc_key =
+ silc_calloc(keymat->enc_key_len / 8,
+ sizeof(*idata->rekey->send_enc_key));
+ memcpy(idata->rekey->send_enc_key, keymat->send_enc_key,
+ keymat->enc_key_len / 8);
+ idata->rekey->enc_key_len = keymat->enc_key_len / 8;
+ }
}
/* This function actually re-generates (when not using PFS) the keys and
takes them into use. */
void silc_server_protocol_rekey_generate(SilcServer server,
- SilcServerRekeyInternalContext *ctx)
+ SilcServerRekeyInternalContext *ctx,
+ bool send)
{
SilcIDListData idata = (SilcIDListData)ctx->sock->user_data;
SilcSKEKeyMaterial *keymat;
uint32 key_len = silc_cipher_get_key_len(idata->send_key);
uint32 hash_len = idata->hash->hash->hash_len;
- SILC_LOG_DEBUG(("Generating new session keys (no PFS)"));
+ SILC_LOG_DEBUG(("Generating new %s session keys (no PFS)",
+ send ? "sending" : "receiving"));
/* Generate the new key */
keymat = silc_calloc(1, sizeof(*keymat));
idata->hash, keymat);
/* Set the keys into use */
- silc_server_protocol_rekey_validate(server, ctx, idata, keymat);
+ silc_server_protocol_rekey_validate(server, ctx, idata, keymat, send);
silc_ske_free_key_material(keymat);
}
void
silc_server_protocol_rekey_generate_pfs(SilcServer server,
- SilcServerRekeyInternalContext *ctx)
+ SilcServerRekeyInternalContext *ctx,
+ bool send)
{
SilcIDListData idata = (SilcIDListData)ctx->sock->user_data;
SilcSKEKeyMaterial *keymat;
unsigned char *tmpbuf;
uint32 klen;
- SILC_LOG_DEBUG(("Generating new session keys (with PFS)"));
+ SILC_LOG_DEBUG(("Generating new %s session keys (with PFS)",
+ send ? "sending" : "receiving"));
/* Encode KEY to binary data */
tmpbuf = silc_mp_mp2bin(ctx->ske->KEY, 0, &klen);
idata->hash, keymat);
/* Set the keys into use */
- silc_server_protocol_rekey_validate(server, ctx, idata, keymat);
+ silc_server_protocol_rekey_validate(server, ctx, idata, keymat, send);
memset(tmpbuf, 0, klen);
silc_free(tmpbuf);
silc_server_packet_send(server, ctx->sock, SILC_PACKET_REKEY_DONE,
0, NULL, 0, FALSE);
+ /* After we send REKEY_DONE we must set the sending encryption
+ key to the new key since all packets after this packet must
+ encrypted with the new key. */
+ silc_server_protocol_rekey_generate(server, ctx, TRUE);
+
/* The protocol ends in next stage. */
protocol->state = SILC_PROTOCOL_STATE_END;
}
silc_server_packet_send(server, ctx->sock, SILC_PACKET_REKEY_DONE,
0, NULL, 0, FALSE);
+ /* After we send REKEY_DONE we must set the sending encryption
+ key to the new key since all packets after this packet must
+ encrypted with the new key. */
+ silc_server_protocol_rekey_generate(server, ctx, TRUE);
+
/* The protocol ends in next stage. */
protocol->state = SILC_PROTOCOL_STATE_END;
}
silc_server_packet_send(server, ctx->sock, SILC_PACKET_REKEY_DONE,
0, NULL, 0, FALSE);
+ /* After we send REKEY_DONE we must set the sending encryption
+ key to the new key since all packets after this packet must
+ encrypted with the new key. */
+ silc_server_protocol_rekey_generate_pfs(server, ctx, TRUE);
+
/* The protocol ends in next stage. */
protocol->state = SILC_PROTOCOL_STATE_END;
break;
protocol->execute(server->timeout_queue, 0, protocol, fd, 0, 0);
}
+ /* We received the REKEY_DONE packet and all packets after this is
+ encrypted with the new key so set the decryption key to the new key */
+ silc_server_protocol_rekey_generate(server, ctx, FALSE);
+
/* Protocol has ended, call the final callback */
if (protocol->final_callback)
protocol->execute_final(server->timeout_queue, 0, protocol, fd);
projects / silc.git / blobdiff