X-Git-Url: https://git.distorted.org.uk/~mdw/tripe/blobdiff_plain/ef09dae1af4f84ae093aa071f475d9dd1fc6b1bc..f6994bd047a35b06aa7aed3c59487000abec2325:/server/keyexch.c diff --git a/server/keyexch.c b/server/keyexch.c index be5bc880..4a990ee7 100644 --- a/server/keyexch.c +++ b/server/keyexch.c @@ -373,6 +373,66 @@ static void rs_time(retry *rs, struct timeval *tv, const struct timeval *now) static void rs_reset(retry *rs) { rs->t = 0; } +/* --- @notice_message@ --- * + * + * Arguments: @keyexch *kx@ = pointer to key-exchange block + * + * Returns: Zero if OK; @-1@ if the public key is in a bad state. + * + * Use: Updates the key-exchange state following a received message. + * Specifically, if there's no currently active key-exchange in + * progress, and we're not in the cooling-off period, then + * commence a new one; reset the retry timers; and if we're + * corked then pop the cork so that we can reply. + */ + +static int checkpub(keyexch *kx); +static void stop(keyexch *kx); +static void start(keyexch *kx, time_t now); + +static int notice_message(keyexch *kx) +{ + struct timeval now, tv; + + gettimeofday(&now, 0); + rs_reset(&kx->rs); + if (kx->f & KXF_CORK) { + start(kx, now.tv_sec); + rs_time(&kx->rs, &tv, &now); + settimer(kx, &tv); + a_notify("KXSTART", "?PEER", kx->p, A_END); + } + if (checkpub(kx)) return (-1); + if (!VALIDP(kx, now.tv_sec)) { + stop(kx); + start(kx, now.tv_sec); + } + return (0); +} + +/* --- @update_stats_tx@, @update_stats_rx@ --- * + * + * Arguments: @keyexch *kx@ = pointer to key-exchange block + * @int ok@ = nonzero if the message was valid (for @rx@) + * @size_t sz@ = size of sent message + * + * Returns: --- + * + * Use: Records that a key-exchange message was sent to, or received + * from, the peer. + */ + +static void update_stats_tx(keyexch *kx, size_t sz) + { stats *st = p_stats(kx->p); st->n_kxout++; st->sz_kxout += sz; } + +static void update_stats_rx(keyexch *kx, int ok, size_t sz) +{ + stats *st = p_stats(kx->p); + + if (!ok) st->n_reject++; + else { st->n_kxin++; st->sz_kxin += sz; } +} + /*----- Challenge management ----------------------------------------------*/ /* --- Notes on challenge management --- * @@ -527,7 +587,6 @@ static void kxc_timer(struct timeval *tv, void *v) static void kxc_answer(keyexch *kx, kxchal *kxc) { - stats *st = p_stats(kx->p); buf *b = p_txstart(kx->p, MSG_KEYEXCH | KX_REPLY); const dhgrp *g = kx->kpriv->grp; struct timeval tv; @@ -545,8 +604,7 @@ static void kxc_answer(keyexch *kx, kxchal *kxc) /* --- Update the statistics --- */ if (BOK(b)) { - st->n_kxout++; - st->sz_kxout += BLEN(b); + update_stats_tx(kx, BLEN(b)); p_txend(kx->p); } @@ -574,7 +632,6 @@ static void kxc_answer(keyexch *kx, kxchal *kxc) static int doprechallenge(keyexch *kx, buf *b) { - stats *st = p_stats(kx->p); const dhgrp *g = kx->kpriv->grp; dhge *C = 0; ghash *h; @@ -603,8 +660,7 @@ static int doprechallenge(keyexch *kx, buf *b) hashge(h, g, C); sendchallenge(kx, b, C, GH_DONE(h, 0)); GH_DESTROY(h); - st->n_kxout++; - st->sz_kxout += BLEN(b); + update_stats_tx(kx, BLEN(b)); p_txend(kx->p); /* --- Done --- */ @@ -823,7 +879,6 @@ static void resend(keyexch *kx) { kxchal *kxc; buf bb; - stats *st = p_stats(kx->p); struct timeval tv; const dhgrp *g = kx->kpriv->grp; buf *b; @@ -863,8 +918,7 @@ static void resend(keyexch *kx) } if (BOK(b)) { - st->n_kxout++; - st->sz_kxout += BLEN(b); + update_stats_tx(kx, BLEN(b)); p_txend(kx->p); } @@ -1266,69 +1320,42 @@ void kx_start(keyexch *kx, int forcep) /* --- @kx_message@ --- * * * Arguments: @keyexch *kx@ = pointer to key exchange context + * @const addr *a@ = sender's IP address and port * @unsigned msg@ = the message code * @buf *b@ = pointer to buffer containing the packet * - * Returns: --- + * Returns: Nonzero if the sender's address was unknown. * * Use: Reads a packet containing key exchange messages and handles * it. */ -void kx_message(keyexch *kx, unsigned msg, buf *b) +int kx_message(keyexch *kx, const addr *a, unsigned msg, buf *b) { - struct timeval now, tv; - stats *st = p_stats(kx->p); size_t sz = BSZ(b); int rc; - gettimeofday(&now, 0); - rs_reset(&kx->rs); - if (kx->f & KXF_CORK) { - start(kx, now.tv_sec); - rs_time(&kx->rs, &tv, &now); - settimer(kx, &tv); - a_notify("KXSTART", "?PEER", kx->p, A_END); - } - - if (checkpub(kx)) - return; + T( trace(T_KEYEXCH, "keyexch: processing %s packet from %c%s%c", + msg < KX_NMSG ? pkname[msg] : "unknown", + kx ? '`' : '<', kx ? p_name(kx->p) : "nil", kx ? '\'' : '>'); ) - if (!VALIDP(kx, now.tv_sec)) { - stop(kx); - start(kx, now.tv_sec); - } - T( trace(T_KEYEXCH, "keyexch: processing %s packet from `%s'", - msg < KX_NMSG ? pkname[msg] : "unknown", p_name(kx->p)); ) + if (!kx) return (-1); + if (notice_message(kx)) return (0); switch (msg) { - case KX_PRECHAL: - rc = doprechallenge(kx, b); - break; - case KX_CHAL: - rc = dochallenge(kx, b); - break; - case KX_REPLY: - rc = doreply(kx, b); - break; - case KX_SWITCH: - rc = doswitch(kx, b); - break; - case KX_SWITCHOK: - rc = doswitchok(kx, b); - break; + case KX_PRECHAL: rc = doprechallenge(kx, b); break; + case KX_CHAL: rc = dochallenge(kx, b); break; + case KX_REPLY: rc = doreply(kx, b); break; + case KX_SWITCH: rc = doswitch(kx, b); break; + case KX_SWITCHOK: rc = doswitchok(kx, b); break; default: a_warn("KX", "?PEER", kx->p, "unknown-message", "0x%02x", msg, A_END); rc = -1; break; } - if (rc) - st->n_reject++; - else { - st->n_kxin++; - st->sz_kxin += sz; - } + update_stats_rx(kx, !rc, sz); + return (0); } /* --- @kx_free@ --- * @@ -1472,7 +1499,7 @@ newkeys: } } -/* --- @kx_init@ --- * +/* --- @kx_setup@ --- * * * Arguments: @keyexch *kx@ = pointer to key exchange context * @peer *p@ = pointer to peer context @@ -1486,7 +1513,7 @@ newkeys: * exchange. */ -int kx_init(keyexch *kx, peer *p, keyset **ks, unsigned f) +int kx_setup(keyexch *kx, peer *p, keyset **ks, unsigned f) { if ((kx->kpriv = km_findpriv(p_privtag(p))) == 0) goto fail_0; if ((kx->kpub = km_findpub(p_tag(p))) == 0) goto fail_1;