2 protocol.c -- handle the meta-protocol
3 Copyright (C) 1999,2000 Ivo Timmermans <itimmermans@bigfoot.com>,
4 2000 Guus Sliepen <guus@sliepen.warande.net>
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, write to the Free Software
18 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 $Id: protocol.c,v 1.28.4.53 2000/10/29 22:55:14 guus Exp $
25 #include <sys/types.h>
30 #include <sys/socket.h>
37 #include <netinet/in.h>
39 #include <openssl/sha.h>
40 #include <openssl/rand.h>
41 #include <openssl/evp.h>
52 int check_id(char *id)
56 for (i = 0; i < strlen(id); i++)
57 if(!isalnum(id[i]) && id[i] != '_')
63 /* Generic request routines - takes care of logging and error detection as well */
65 int send_request(conn_list_t *cl, const char *format, ...)
68 char buffer[MAXBUFSIZE];
72 /* Use vsnprintf instead of vasprintf: faster, no memory fragmentation, cleanup is automatic,
73 and there is a limit on the input buffer anyway */
75 va_start(args, format);
76 len = vsnprintf(buffer, MAXBUFSIZE, format, args);
77 request = va_arg(args, int);
80 if(len < 0 || len > MAXBUFSIZE-1)
82 syslog(LOG_ERR, _("Output buffer overflow while sending %s to %s (%s)"), request_name[request], cl->name, cl->hostname);
88 if(debug_lvl >= DEBUG_PROTOCOL)
89 syslog(LOG_DEBUG, _("Sending %s to %s (%s)"), request_name[request], cl->name, cl->hostname);
92 return send_meta(cl, buffer, len);
95 int receive_request(conn_list_t *cl)
99 if(sscanf(cl->buffer, "%d", &request) == 1)
101 if((request < 0) || (request > 255) || (request_handlers[request] == NULL))
103 syslog(LOG_ERR, _("Unknown request from %s (%s)"),
104 cl->name, cl->hostname);
109 if(debug_lvl >= DEBUG_PROTOCOL)
110 syslog(LOG_DEBUG, _("Got %s from %s (%s)"),
111 request_name[request], cl->name, cl->hostname);
114 if((cl->allow_request != ALL) && (cl->allow_request != request))
116 syslog(LOG_ERR, _("Unauthorized request from %s (%s)"), cl->name, cl->hostname);
120 if(request_handlers[request](cl))
121 /* Something went wrong. Probably scriptkiddies. Terminate. */
123 syslog(LOG_ERR, _("Error while processing %s from %s (%s)"),
124 request_name[request], cl->name, cl->hostname);
130 syslog(LOG_ERR, _("Bogus data received from %s (%s)"),
131 cl->name, cl->hostname);
138 /* Connection protocol:
147 ---------------------------------------
150 ---------------------------------------
153 ---------------------------------------
159 (E) Encrypted with symmetric cipher.
161 Part of the challenge is directly used to set the symmetric cipher key and the initial vector.
162 Since a man-in-the-middle cannot decrypt the RSA challenges, this means that he cannot get or
163 forge the key for the symmetric cipher.
166 int send_id(conn_list_t *cl)
169 cl->allow_request = CHALLENGE;
171 return send_request(cl, "%d %s %d %lx %hd", ID, myself->name, myself->protocol_version, myself->options, myself->port);
174 int id_h(conn_list_t *cl)
179 if(sscanf(cl->buffer, "%*d %as %d %lx %hd", &cl->name, &cl->protocol_version, &cl->options, &cl->port) != 4)
181 syslog(LOG_ERR, _("Got bad ID from %s"), cl->hostname);
185 /* Check if version matches */
187 if(cl->protocol_version != myself->protocol_version)
189 syslog(LOG_ERR, _("Peer %s (%s) uses incompatible version %d"),
190 cl->name, cl->hostname, cl->protocol_version);
194 /* Check if identity is a valid name */
196 if(check_id(cl->name))
198 syslog(LOG_ERR, _("Peer %s uses invalid identity name"), cl->hostname);
202 /* Load information about peer */
204 if(read_host_config(cl))
206 syslog(LOG_ERR, _("Peer %s had unknown identity (%s)"), cl->hostname, cl->name);
210 /* First check if the host we connected to is already in our
211 connection list. If so, we are probably making a loop, which
215 if(cl->status.outgoing)
217 if((old = lookup_id(cl->name)))
219 if(debug_lvl >= DEBUG_CONNECTIONS)
220 syslog(LOG_NOTICE, _("Uplink %s (%s) is already in our connection list"), cl->name, cl->hostname);
221 cl->status.outgoing = 0;
222 old->status.outgoing = 1;
223 terminate_connection(cl);
228 if((cfg = get_config_val(cl->config, publickey)))
230 cl->rsa_key = RSA_new();
231 BN_hex2bn(&cl->rsa_key->n, cfg->data.ptr);
232 BN_hex2bn(&cl->rsa_key->e, "FFFF");
236 syslog(LOG_ERR, _("No public key known for %s (%s)"), cl->name, cl->hostname);
240 return send_challenge(cl);
243 int send_challenge(conn_list_t *cl)
248 len = RSA_size(cl->rsa_key);
250 /* Allocate buffers for the challenge */
252 buffer = xmalloc(len*2+1);
255 free(cl->hischallenge);
257 cl->hischallenge = xmalloc(len);
259 /* Copy random data to the buffer */
261 RAND_bytes(cl->hischallenge, len);
263 cl->hischallenge[0] &= 0x7F; /* Somehow if the first byte is more than 0xD0 or something like that, decryption fails... */
265 if(debug_lvl >= DEBUG_SCARY_THINGS)
267 bin2hex(cl->hischallenge, buffer, len);
268 buffer[len*2] = '\0';
269 syslog(LOG_DEBUG, _("Generated random challenge (unencrypted): %s"), buffer);
272 /* Encrypt the random data */
274 if(RSA_public_encrypt(len, cl->hischallenge, buffer, cl->rsa_key, RSA_NO_PADDING) != len) /* NO_PADDING because the message size equals the RSA key size and it is totally random */
276 syslog(LOG_ERR, _("Error during encryption of challenge for %s (%s)"), cl->name, cl->hostname);
281 /* Convert the encrypted random data to a hexadecimal formatted string */
283 bin2hex(buffer, buffer, len);
284 buffer[len*2] = '\0';
286 /* Send the challenge */
288 cl->allow_request = CHAL_REPLY;
289 x = send_request(cl, "%d %s", CHALLENGE, buffer);
295 int challenge_h(conn_list_t *cl)
300 if(sscanf(cl->buffer, "%*d %as", &buffer) != 1)
302 syslog(LOG_ERR, _("Got bad CHALLENGE from %s (%s)"), cl->name, cl->hostname);
306 len = RSA_size(myself->rsa_key);
308 /* Check if the length of the challenge is all right */
310 if(strlen(buffer) != len*2)
312 syslog(LOG_ERR, _("Intruder: wrong challenge length from %s (%s)"), cl->name, cl->hostname);
317 /* Allocate buffers for the challenge */
320 cl->mychallenge = xmalloc(len);
322 /* Convert the challenge from hexadecimal back to binary */
324 hex2bin(buffer,buffer,len);
326 /* Decrypt the challenge */
328 if(RSA_private_decrypt(len, buffer, cl->mychallenge, myself->rsa_key, RSA_NO_PADDING) != len) /* See challenge() */
330 syslog(LOG_ERR, _("Error during encryption of challenge for %s (%s)"), cl->name, cl->hostname);
335 if(debug_lvl >= DEBUG_SCARY_THINGS)
337 bin2hex(cl->mychallenge, buffer, len);
338 buffer[len*2] = '\0';
339 syslog(LOG_DEBUG, _("Received random challenge (unencrypted): %s"), buffer);
344 /* Rest is done by send_chal_reply() */
346 return send_chal_reply(cl);
349 int send_chal_reply(conn_list_t *cl)
351 char hash[SHA_DIGEST_LENGTH*2+1];
355 syslog(LOG_ERR, _("Trying to send CHAL_REPLY to %s (%s) without a valid CHALLENGE"), cl->name, cl->hostname);
359 /* Calculate the hash from the challenge we received */
361 SHA1(cl->mychallenge, RSA_size(myself->rsa_key), hash);
363 /* Convert the hash to a hexadecimal formatted string */
365 bin2hex(hash,hash,SHA_DIGEST_LENGTH);
366 hash[SHA_DIGEST_LENGTH*2] = '\0';
370 if(cl->status.outgoing)
371 cl->allow_request = ID;
373 cl->allow_request = METAKEY;
376 return send_request(cl, "%d %s", CHAL_REPLY, hash);
379 int chal_reply_h(conn_list_t *cl)
382 char myhash[SHA_DIGEST_LENGTH];
384 if(sscanf(cl->buffer, "%*d %as", &hishash) != 1)
386 syslog(LOG_ERR, _("Got bad CHAL_REPLY from %s (%s)"), cl->name, cl->hostname);
391 /* Check if the length of the hash is all right */
393 if(strlen(hishash) != SHA_DIGEST_LENGTH*2)
395 syslog(LOG_ERR, _("Intruder: wrong challenge reply length from %s (%s)"), cl->name, cl->hostname);
400 /* Convert the hash to binary format */
402 hex2bin(hishash, hishash, SHA_DIGEST_LENGTH);
404 /* Calculate the hash from the challenge we sent */
406 SHA1(cl->hischallenge, RSA_size(cl->rsa_key), myhash);
408 /* Verify the incoming hash with the calculated hash */
410 if(memcmp(hishash, myhash, SHA_DIGEST_LENGTH))
412 syslog(LOG_ERR, _("Intruder: wrong challenge reply from %s (%s)"), cl->name, cl->hostname);
413 if(debug_lvl >= DEBUG_SCARY_THINGS)
415 bin2hex(myhash, hishash, SHA_DIGEST_LENGTH);
416 hishash[SHA_DIGEST_LENGTH*2] = '\0';
417 syslog(LOG_DEBUG, _("Expected challenge reply: %s"), hishash);
426 /* Identity has now been positively verified.
427 If we are accepting this new connection, then send our identity,
428 if we are making this connecting, acknowledge.
431 if(cl->status.outgoing)
432 return send_metakey(cl);
437 int send_metakey(conn_list_t *cl)
442 len = RSA_size(cl->rsa_key);
444 /* Allocate buffers for the meta key */
446 buffer = xmalloc(len*2+1);
448 if(!cl->cipher_outkey)
449 cl->cipher_outkey = xmalloc(len);
451 if(!cl->cipher_outctx)
452 cl->cipher_outctx = xmalloc(sizeof(*cl->cipher_outctx));
454 /* Copy random data to the buffer */
456 RAND_bytes(cl->cipher_outkey, len);
458 cl->cipher_outkey[0] &= 0x7F; /* FIXME: Somehow if the first byte is more than 0xD0 or something like that, decryption fails... */
460 if(debug_lvl >= DEBUG_SCARY_THINGS)
462 bin2hex(cl->cipher_outkey, buffer, len);
463 buffer[len*2] = '\0';
464 syslog(LOG_DEBUG, _("Generated random meta key (unencrypted): %s"), buffer);
467 /* Encrypt the random data */
469 if(RSA_public_encrypt(len, cl->cipher_outkey, buffer, cl->rsa_key, RSA_NO_PADDING) != len) /* NO_PADDING because the message size equals the RSA key size and it is totally random */
471 syslog(LOG_ERR, _("Error during encryption of meta key for %s (%s)"), cl->name, cl->hostname);
476 /* Convert the encrypted random data to a hexadecimal formatted string */
478 bin2hex(buffer, buffer, len);
479 buffer[len*2] = '\0';
481 /* Send the meta key */
483 if(cl->status.outgoing)
484 cl->allow_request = METAKEY;
486 cl->allow_request = ACK;
488 x = send_request(cl, "%d %s", METAKEY, buffer);
491 EVP_EncryptInit(cl->cipher_outctx, EVP_bf_cfb(), cl->cipher_outkey, cl->cipher_outkey + EVP_bf_cfb()->key_len);
496 int metakey_h(conn_list_t *cl)
501 if(sscanf(cl->buffer, "%*d %as", &buffer) != 1)
503 syslog(LOG_ERR, _("Got bad METAKEY from %s (%s)"), cl->name, cl->hostname);
507 len = RSA_size(myself->rsa_key);
509 /* Check if the length of the meta key is all right */
511 if(strlen(buffer) != len*2)
513 syslog(LOG_ERR, _("Intruder: wrong meta key length from %s (%s)"), cl->name, cl->hostname);
518 /* Allocate buffers for the meta key */
520 if(!cl->cipher_inkey)
521 cl->cipher_inkey = xmalloc(len);
523 if(!cl->cipher_inctx)
524 cl->cipher_inctx = xmalloc(sizeof(*cl->cipher_inctx));
526 /* Convert the challenge from hexadecimal back to binary */
528 hex2bin(buffer,buffer,len);
530 /* Decrypt the meta key */
532 if(RSA_private_decrypt(len, buffer, cl->cipher_inkey, myself->rsa_key, RSA_NO_PADDING) != len) /* See challenge() */
534 syslog(LOG_ERR, _("Error during encryption of meta key for %s (%s)"), cl->name, cl->hostname);
539 if(debug_lvl >= DEBUG_SCARY_THINGS)
541 bin2hex(cl->cipher_inkey, buffer, len);
542 buffer[len*2] = '\0';
543 syslog(LOG_DEBUG, _("Received random meta key (unencrypted): %s"), buffer);
548 EVP_DecryptInit(cl->cipher_inctx, EVP_bf_cfb(), cl->cipher_inkey, cl->cipher_inkey + EVP_bf_cfb()->key_len);
551 if(cl->status.outgoing)
554 return send_metakey(cl);
557 int send_ack(conn_list_t *cl)
561 if(cl->status.outgoing)
562 cl->allow_request = ACK;
564 x = send_request(cl, "%d", ACK);
565 cl->status.encryptout = 1;
570 int ack_h(conn_list_t *cl)
572 conn_list_t *old, *p;
575 /* Okay, before we active the connection, we check if there is another entry
576 in the connection list with the same name. If so, it presumably is an
577 old connection that has timed out but we don't know it yet.
580 while((old = lookup_id(cl->name)))
582 if(debug_lvl >= DEBUG_CONNECTIONS)
583 syslog(LOG_NOTICE, _("Removing old entry for %s at %s in favour of new connection from %s"),
584 cl->name, old->hostname, cl->hostname);
586 terminate_connection(old);
589 /* Activate this connection */
591 cl->allow_request = ALL;
592 cl->status.active = 1;
593 cl->status.decryptin = 1;
595 cl->cipher_pkttype = EVP_bf_cfb();
596 cl->cipher_pktkeylength = cl->cipher_pkttype->key_len + cl->cipher_pkttype->iv_len;
598 if(debug_lvl >= DEBUG_CONNECTIONS)
599 syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), cl->name, cl->hostname);
602 if(!cl->status.outgoing)
605 /* Send him our subnets */
607 for(s = myself->subnets; s; s = s->next)
608 send_add_subnet(cl, s);
610 /* And send him all the hosts and their subnets we know... */
612 for(p = conn_list; p; p = p->next)
613 if(p != cl && p->status.active)
615 /* Notify others of this connection */
618 send_add_host(p, cl);
620 /* Notify new connection of everything we know */
622 send_add_host(cl, p);
624 for(s = p->subnets; s; s = s->next)
625 send_add_subnet(cl, s);
631 /* Address and subnet information exchange */
633 int send_add_subnet(conn_list_t *cl, subnet_t *subnet)
638 x = send_request(cl, "%d %s %s", ADD_SUBNET,
639 subnet->owner->name, netstr = net2str(subnet));
645 int add_subnet_h(conn_list_t *cl)
649 conn_list_t *owner, *p;
652 if(sscanf(cl->buffer, "%*d %as %as", &name, &subnetstr) != 2)
654 syslog(LOG_ERR, _("Got bad ADD_SUBNET from %s (%s)"), cl->name, cl->hostname);
655 free(name); free(subnetstr);
659 /* Check if owner name is a valid */
663 syslog(LOG_ERR, _("Got bad ADD_SUBNET from %s (%s): invalid identity name"), cl->name, cl->hostname);
664 free(name); free(subnetstr);
668 /* Check if subnet string is valid */
670 if(!(subnet = str2net(subnetstr)))
672 syslog(LOG_ERR, _("Got bad ADD_SUBNET from %s (%s): invalid subnet string"), cl->name, cl->hostname);
673 free(name); free(subnetstr);
679 /* Check if somebody tries to add a subnet of ourself */
681 if(!strcmp(name, myself->name))
683 syslog(LOG_ERR, _("Warning: got ADD_SUBNET from %s (%s) for ourself, restarting"),
684 cl->name, cl->hostname);
690 /* Check if the owner of the new subnet is in the connection list */
692 if(!(owner = lookup_id(name)))
694 syslog(LOG_ERR, _("Got ADD_SUBNET for %s from %s (%s) which is not in our connection list"),
695 name, cl->name, cl->hostname);
700 /* If everything is correct, add the subnet to the list of the owner */
702 subnet_add(owner, subnet);
706 for(p = conn_list; p; p = p->next)
707 if(p->status.meta && p->status.active && p!= cl)
708 send_add_subnet(p, subnet);
713 int send_del_subnet(conn_list_t *cl, subnet_t *subnet)
718 netstr = net2str(subnet);
719 x = send_request(cl, "%d %s %s", DEL_SUBNET, subnet->owner->name, netstr);
725 int del_subnet_h(conn_list_t *cl)
729 conn_list_t *owner, *p;
732 if(sscanf(cl->buffer, "%*d %as %as", &name, &subnetstr) != 3)
734 syslog(LOG_ERR, _("Got bad DEL_SUBNET from %s (%s)"), cl->name, cl->hostname);
735 free(name); free(subnetstr);
739 /* Check if owner name is a valid */
743 syslog(LOG_ERR, _("Got bad DEL_SUBNET from %s (%s): invalid identity name"), cl->name, cl->hostname);
744 free(name); free(subnetstr);
748 /* Check if subnet string is valid */
750 if(!(subnet = str2net(subnetstr)))
752 syslog(LOG_ERR, _("Got bad DEL_SUBNET from %s (%s): invalid subnet string"), cl->name, cl->hostname);
753 free(name); free(subnetstr);
759 /* Check if somebody tries to add a subnet of ourself */
761 if(!strcmp(name, myself->name))
763 syslog(LOG_ERR, _("Warning: got DEL_SUBNET from %s (%s) for ourself, restarting"),
764 cl->name, cl->hostname);
770 /* Check if the owner of the new subnet is in the connection list */
772 if(!(owner = lookup_id(name)))
774 syslog(LOG_ERR, _("Got DEL_SUBNET for %s from %s (%s) which is not in our connection list"),
775 name, cl->name, cl->hostname);
780 /* If everything is correct, delete the subnet from the list of the owner */
786 for(p = conn_list; p; p = p->next)
787 if(p->status.meta && p->status.active && p!= cl)
788 send_del_subnet(p, subnet);
793 /* New and closed connections notification */
795 int send_add_host(conn_list_t *cl, conn_list_t *other)
798 return send_request(cl, "%d %s %lx:%d %lx", ADD_HOST,
799 other->name, other->address, other->port, other->options);
802 int add_host_h(conn_list_t *cl)
804 conn_list_t *old, *new;
807 new = new_conn_list();
809 if(sscanf(cl->buffer, "%*d %as %lx:%d %lx", &new->name, &new->address, &new->port, &new->options) != 4)
811 syslog(LOG_ERR, _("Got bad ADD_HOST from %s (%s)"), cl->name, cl->hostname);
815 /* Check if identity is a valid name */
817 if(check_id(new->name))
819 syslog(LOG_ERR, _("Got bad ADD_HOST from %s (%s): invalid identity name"), cl->name, cl->hostname);
824 /* Check if somebody tries to add ourself */
826 if(!strcmp(new->name, myself->name))
828 syslog(LOG_ERR, _("Warning: got ADD_HOST from %s (%s) for ourself, restarting"), cl->name, cl->hostname);
834 /* Fill in more of the new conn_list structure */
836 new->hostname = hostlookup(htonl(new->address));
838 /* Check if the new host already exists in the connnection list */
840 if((old = lookup_id(new->name)))
842 if((new->address == old->address) && (new->port == old->port))
844 if(debug_lvl >= DEBUG_CONNECTIONS)
845 syslog(LOG_NOTICE, _("Got duplicate ADD_HOST for %s (%s) from %s (%s)"),
846 old->name, old->hostname, new->name, new->hostname);
852 if(debug_lvl >= DEBUG_CONNECTIONS)
853 syslog(LOG_NOTICE, _("Removing old entry for %s (%s) in favour of new connection"),
854 old->name, old->hostname);
856 terminate_connection(old);
860 /* Hook it up into the conn_list */
864 /* Tell the rest about the new host */
866 for(p = conn_list; p; p = p->next)
867 if(p->status.meta && p->status.active && p!=cl)
868 send_add_host(p, new);
870 /* Fill in rest of conn_list structure */
873 new->status.active = 1;
879 int send_del_host(conn_list_t *cl, conn_list_t *other)
882 return send_request(cl, "%d %s %lx:%d %lx", DEL_HOST,
883 other->name, other->address, other->port, other->options);
886 int del_host_h(conn_list_t *cl)
892 conn_list_t *old, *p;
894 if(sscanf(cl->buffer, "%*d %as %lx:%d %lx", &name, &address, &port, &options) != 4)
896 syslog(LOG_ERR, _("Got bad DEL_HOST from %s (%s)"),
897 cl->name, cl->hostname);
901 /* Check if identity is a valid name */
905 syslog(LOG_ERR, _("Got bad DEL_HOST from %s (%s): invalid identity name"), cl->name, cl->hostname);
910 /* Check if somebody tries to delete ourself */
912 if(!strcmp(name, myself->name))
914 syslog(LOG_ERR, _("Warning: got DEL_HOST from %s (%s) for ourself, restarting"),
915 cl->name, cl->hostname);
921 /* Check if the new host already exists in the connnection list */
923 if(!(old = lookup_id(name)))
925 syslog(LOG_ERR, _("Got DEL_HOST from %s (%s) for %s which is not in our connection list"),
926 name, cl->name, cl->hostname);
931 /* Check if the rest matches */
933 if(address!=old->address || port!=old->port || options!=old->options || cl!=old->nexthop)
935 syslog(LOG_WARNING, _("Got DEL_HOST from %s (%s) for %s which doesn't match"), cl->name, cl->hostname, old->name);
939 /* Ok, since EVERYTHING seems to check out all right, delete it */
941 old->status.active = 0;
942 terminate_connection(old);
944 /* Tell the rest about the new host */
946 for(p = conn_list; p; p = p->next)
947 if(p->status.meta && p->status.active && p!=cl)
948 send_del_host(p, old);
953 /* Status and error notification routines */
955 int send_status(conn_list_t *cl, int statusno, char *statusstring)
959 statusstring = status_text[statusno];
961 return send_request(cl, "%d %d %s", STATUS, statusno, statusstring);
964 int status_h(conn_list_t *cl)
969 if(sscanf(cl->buffer, "%*d %d %as", &statusno, &statusstring) != 2)
971 syslog(LOG_ERR, _("Got bad STATUS from %s (%s)"),
972 cl->name, cl->hostname);
976 if(debug_lvl >= DEBUG_STATUS)
978 syslog(LOG_NOTICE, _("Status message from %s (%s): %s: %s"),
979 cl->name, cl->hostname, status_text[statusno], statusstring);
987 int send_error(conn_list_t *cl, int errno, char *errstring)
991 errstring = strerror(errno);
992 return send_request(cl, "%d %d %s", ERROR, errno, errstring);
995 int error_h(conn_list_t *cl)
1000 if(sscanf(cl->buffer, "%*d %d %as", &errno, &errorstring) != 2)
1002 syslog(LOG_ERR, _("Got bad ERROR from %s (%s)"),
1003 cl->name, cl->hostname);
1007 if(debug_lvl >= DEBUG_ERROR)
1009 syslog(LOG_NOTICE, _("Error message from %s (%s): %s: %s"),
1010 cl->name, cl->hostname, strerror(errno), errorstring);
1014 terminate_connection(cl);
1019 int send_termreq(conn_list_t *cl)
1022 return send_request(cl, "%d", TERMREQ);
1025 int termreq_h(conn_list_t *cl)
1028 terminate_connection(cl);
1033 /* Keepalive routines - FIXME: needs a closer look */
1035 int send_ping(conn_list_t *cl)
1037 cl->status.pinged = 1;
1039 return send_request(cl, "%d", PING);
1042 int ping_h(conn_list_t *cl)
1045 return send_pong(cl);
1048 int send_pong(conn_list_t *cl)
1051 return send_request(cl, "%d", PONG);
1054 int pong_h(conn_list_t *cl)
1057 cl->status.got_pong = 1;
1064 int send_key_changed(conn_list_t *from, conn_list_t *cl)
1068 for(p = conn_list; p != NULL; p = p->next)
1070 if(p!=cl && p->status.meta && p->status.active)
1071 send_request(p, "%d %s", KEY_CHANGED,
1078 int key_changed_h(conn_list_t *cl)
1083 if(sscanf(cl->buffer, "%*d %as", &from_id) != 1)
1085 syslog(LOG_ERR, _("Got bad KEY_CHANGED from %s (%s)"),
1086 cl->name, cl->hostname);
1090 if(!(from = lookup_id(from_id)))
1092 syslog(LOG_ERR, _("Got KEY_CHANGED from %s (%s) origin %s which does not exist in our connection list"),
1093 cl->name, cl->hostname, from_id);
1100 from->status.validkey = 0;
1101 from->status.waitingforkey = 0;
1103 send_key_changed(from, cl);
1108 int send_req_key(conn_list_t *from, conn_list_t *to)
1111 return send_request(to->nexthop, "%d %s %s", REQ_KEY,
1112 from->name, to->name);
1115 int req_key_h(conn_list_t *cl)
1117 char *from_id, *to_id;
1118 conn_list_t *from, *to;
1121 if(sscanf(cl->buffer, "%*d %as %as", &from_id, &to_id) != 2)
1123 syslog(LOG_ERR, _("Got bad REQ_KEY from %s (%s)"),
1124 cl->name, cl->hostname);
1128 if(!(from = lookup_id(from_id)))
1130 syslog(LOG_ERR, _("Got REQ_KEY from %s (%s) origin %s which does not exist in our connection list"),
1131 cl->name, cl->hostname, from_id);
1132 free(from_id); free(to_id);
1136 /* Check if this key request is for us */
1138 if(!strcmp(to_id, myself->name))
1140 bin2hex(myself->cipher_pktkey, pktkey, myself->cipher_pktkeylength);
1141 pktkey[myself->cipher_pktkeylength*2] = '\0';
1142 send_ans_key(myself, from, pktkey);
1146 if(!(to = lookup_id(to_id)))
1148 syslog(LOG_ERR, _("Got REQ_KEY from %s (%s) destination %s which does not exist in our connection list"),
1149 cl->name, cl->hostname, to_id);
1150 free(from_id); free(to_id);
1154 if(to->status.validkey) /* Proxy keys */
1156 bin2hex(to->cipher_pktkey, pktkey, to->cipher_pktkeylength);
1157 pktkey[to->cipher_pktkeylength*2] = '\0';
1158 send_ans_key(to, from, pktkey);
1161 send_req_key(from, to);
1164 free(from_id); free(to_id);
1169 int send_ans_key(conn_list_t *from, conn_list_t *to, char *pktkey)
1172 return send_request(to->nexthop, "%d %s %s %s", ANS_KEY,
1173 from->name, to->name, pktkey);
1176 int ans_key_h(conn_list_t *cl)
1178 char *from_id, *to_id, *pktkey;
1180 conn_list_t *from, *to;
1182 if(sscanf(cl->buffer, "%*d %as %as %as", &from_id, &to_id, &pktkey) != 3)
1184 syslog(LOG_ERR, _("Got bad ANS_KEY from %s (%s)"),
1185 cl->name, cl->hostname);
1189 if(!(from = lookup_id(from_id)))
1191 syslog(LOG_ERR, _("Got ANS_KEY from %s (%s) origin %s which does not exist in our connection list"),
1192 cl->name, cl->hostname, from_id);
1193 free(from_id); free(to_id); free(pktkey);
1197 /* Update origin's packet key */
1199 keylength = strlen(pktkey);
1201 if(keylength != from->cipher_pktkeylength*2)
1203 syslog(LOG_ERR, _("Got bad ANS_KEY from %s (%s) origin %s: invalid key length"),
1204 cl->name, cl->hostname, from->name);
1205 free(from_id); free(to_id); free(pktkey);
1209 if(from->cipher_pktkey)
1210 free(from->cipher_pktkey);
1213 hex2bin(pktkey, pktkey, keylength);
1214 pktkey[keylength] = '\0';
1215 from->cipher_pktkey = pktkey;
1217 from->status.validkey = 1;
1218 from->status.waitingforkey = 0;
1220 if(strcmp(to_id, myself->name))
1222 if(!(to = lookup_id(to_id)))
1224 syslog(LOG_ERR, _("Got ANS_KEY from %s (%s) destination %s which does not exist in our connection list"),
1225 cl->name, cl->hostname, to_id);
1226 free(from_id); free(to_id);
1229 send_ans_key(from, to, pktkey);
1232 free(from_id); free(to_id);
1237 /* Jumptable for the request handlers */
1239 int (*request_handlers[])(conn_list_t*) = {
1240 id_h, challenge_h, chal_reply_h, metakey_h, ack_h,
1241 status_h, error_h, termreq_h,
1243 add_host_h, del_host_h,
1244 add_subnet_h, del_subnet_h,
1245 key_changed_h, req_key_h, ans_key_h,
1250 char (*request_name[]) = {
1251 "ID", "CHALLENGE", "CHAL_REPLY", "METAKEY", "ACK",
1252 "STATUS", "ERROR", "TERMREQ",
1254 "ADD_HOST", "DEL_HOST",
1255 "ADD_SUBNET", "DEL_SUBNET",
1256 "KEY_CHANGED", "REQ_KEY", "ANS_KEY",
1259 /* Status strings */
1261 char (*status_text[]) = {
1267 char (*error_text[]) = {