This file is part of GNUnet.
Copyright (C) 2009-2013, 2016 GNUnet e.V.
- GNUnet is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published
- by the Free Software Foundation; either version 3, or (at your
- option) any later version.
+ GNUnet is free software: you can redistribute it and/or modify it
+ under the terms of the GNU Affero General Public License as published
+ by the Free Software Foundation, either version 3 of the License,
+ or (at your option) any later version.
GNUnet is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with GNUnet; see the file COPYING. If not, write to the
- Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- Boston, MA 02110-1301, USA.
+ Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/**
#include "gnunet_protocols.h"
#include "core.h"
+/**
+ * Enable expensive (and possibly problematic for privacy!) logging of KX.
+ */
+#define DEBUG_KX 0
/**
* How long do we wait for SET_KEY confirmation initially?
*/
struct GNUNET_MQ_Handle *mq;
+ /**
+ * Our message stream tokenizer (for encrypted payload).
+ */
+ struct GNUNET_MessageStreamTokenizer *mst;
+
/**
* PING message we transmit to the other peer.
*/
*/
static struct EphemeralKeyMessage current_ekm;
-/**
- * Our message stream tokenizer (for encrypted payload).
- */
-static struct GNUNET_SERVER_MessageStreamTokenizer *mst;
-
/**
* DLL head.
*/
uint32_t seed)
{
static const char ctx[] = "authentication key";
-
- GNUNET_CRYPTO_hmac_derive_key (akey, skey,
+#if DEBUG_KX
+ struct GNUNET_HashCode sh;
+
+ GNUNET_CRYPTO_hash (skey,
+ sizeof (*skey),
+ &sh);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Deriving Auth key from SKEY %s and seed %u\n",
+ GNUNET_h2s (&sh),
+ (unsigned int) seed);
+#endif
+ GNUNET_CRYPTO_hmac_derive_key (akey,
+ skey,
&seed, sizeof (seed),
skey, sizeof (struct GNUNET_CRYPTO_SymmetricSessionKey),
ctx, sizeof (ctx),
const struct GNUNET_PeerIdentity *identity)
{
static const char ctx[] = "initialization vector";
-
- GNUNET_CRYPTO_symmetric_derive_iv (iv, skey,
+#if DEBUG_KX
+ struct GNUNET_HashCode sh;
+
+ GNUNET_CRYPTO_hash (skey,
+ sizeof (*skey),
+ &sh);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Deriving IV from SKEY %s and seed %u for peer %s\n",
+ GNUNET_h2s (&sh),
+ (unsigned int) seed,
+ GNUNET_i2s (identity));
+#endif
+ GNUNET_CRYPTO_symmetric_derive_iv (iv,
+ skey,
&seed, sizeof (seed),
identity,
sizeof (struct GNUNET_PeerIdentity), ctx,
const struct GNUNET_PeerIdentity *identity)
{
static const char ctx[] = "pong initialization vector";
-
- GNUNET_CRYPTO_symmetric_derive_iv (iv, skey,
+#if DEBUG_KX
+ struct GNUNET_HashCode sh;
+
+ GNUNET_CRYPTO_hash (skey,
+ sizeof (*skey),
+ &sh);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Deriving PONG IV from SKEY %s and seed %u/%u for %s\n",
+ GNUNET_h2s (&sh),
+ (unsigned int) seed,
+ (unsigned int) challenge,
+ GNUNET_i2s (identity));
+#endif
+ GNUNET_CRYPTO_symmetric_derive_iv (iv,
+ skey,
&seed, sizeof (seed),
identity,
sizeof (struct GNUNET_PeerIdentity),
struct GNUNET_CRYPTO_SymmetricSessionKey *skey)
{
static const char ctx[] = "aes key generation vector";
-
+#if DEBUG_KX
+ struct GNUNET_HashCode sh;
+
+ GNUNET_CRYPTO_hash (skey,
+ sizeof (*skey),
+ &sh);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Deriving AES Keys for %s to %s from %s\n",
+ GNUNET_i2s (sender),
+ GNUNET_i2s2 (receiver),
+ GNUNET_h2s (key_material));
+#endif
GNUNET_CRYPTO_kdf (skey, sizeof (struct GNUNET_CRYPTO_SymmetricSessionKey),
ctx, sizeof (ctx),
key_material, sizeof (struct GNUNET_HashCode),
GNUNET_NO);
/* the following is too sensitive to write to log files by accident,
so we require manual intervention to get this one... */
-#if 0
+#if DEBUG_KX
GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Encrypted %u bytes for `%s' using key %u, IV %u\n",
(unsigned int) size,
GNUNET_NO);
/* the following is too sensitive to write to log files by accident,
so we require manual intervention to get this one... */
-#if 0
+#if DEBUG_KX
GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Decrypted %u bytes from `%s' using key %u, IV %u\n",
(unsigned int) size,
}
+/**
+ * Deliver P2P message to interested clients. Invokes send twice,
+ * once for clients that want the full message, and once for clients
+ * that only want the header
+ *
+ * @param cls the `struct GSC_KeyExchangeInfo`
+ * @param m the message
+ * @return #GNUNET_OK on success,
+ * #GNUNET_NO to stop further processing (no error)
+ * #GNUNET_SYSERR to stop further processing with error
+ */
+static int
+deliver_message (void *cls,
+ const struct GNUNET_MessageHeader *m)
+{
+ struct GSC_KeyExchangeInfo *kx = cls;
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Decrypted message of type %d from %s\n",
+ ntohs (m->type),
+ GNUNET_i2s (kx->peer));
+ if (GNUNET_CORE_KX_STATE_UP != kx->status)
+ {
+ GNUNET_STATISTICS_update (GSC_stats,
+ gettext_noop ("# PAYLOAD dropped (out of order)"),
+ 1,
+ GNUNET_NO);
+ return GNUNET_OK;
+ }
+ switch (ntohs (m->type))
+ {
+ case GNUNET_MESSAGE_TYPE_CORE_BINARY_TYPE_MAP:
+ case GNUNET_MESSAGE_TYPE_CORE_COMPRESSED_TYPE_MAP:
+ GSC_SESSIONS_set_typemap (kx->peer, m);
+ return GNUNET_OK;
+ case GNUNET_MESSAGE_TYPE_CORE_CONFIRM_TYPE_MAP:
+ GSC_SESSIONS_confirm_typemap (kx->peer, m);
+ return GNUNET_OK;
+ default:
+ GSC_CLIENTS_deliver_message (kx->peer,
+ m,
+ ntohs (m->size),
+ GNUNET_CORE_OPTION_SEND_FULL_INBOUND);
+ GSC_CLIENTS_deliver_message (kx->peer,
+ m,
+ sizeof (struct GNUNET_MessageHeader),
+ GNUNET_CORE_OPTION_SEND_HDR_INBOUND);
+ }
+ return GNUNET_OK;
+}
+
+
/**
* Function called by transport to notify us that
* a peer connected to us (on the network level).
1,
GNUNET_NO);
kx = GNUNET_new (struct GSC_KeyExchangeInfo);
+ kx->mst = GNUNET_MST_create (&deliver_message,
+ kx);
kx->mq = mq;
kx->peer = pid;
kx->set_key_retry_frequency = INITIAL_SET_KEY_RETRY_FREQUENCY;
GNUNET_CONTAINER_DLL_remove (kx_head,
kx_tail,
kx);
+ GNUNET_MST_destroy (kx->mst);
GNUNET_free (kx);
}
{
GNUNET_STATISTICS_update (GSC_stats,
gettext_noop ("# old ephemeral keys ignored"),
- 1, GNUNET_NO);
+ 1,
+ GNUNET_NO);
+ GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+ "Received expired EPHEMERAL_KEY from %s\n",
+ GNUNET_i2s (&m->origin_identity));
+ return;
+ }
+ if (0 == memcmp (&m->ephemeral_key,
+ &kx->other_ephemeral_key,
+ sizeof (m->ephemeral_key)))
+ {
+ GNUNET_STATISTICS_update (GSC_stats,
+ gettext_noop ("# duplicate ephemeral keys ignored"),
+ 1,
+ GNUNET_NO);
+ GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+ "Ignoring duplicate EPHEMERAL_KEY from %s\n",
+ GNUNET_i2s (&m->origin_identity));
return;
}
- start_t = GNUNET_TIME_absolute_ntoh (m->creation_time);
-
- GNUNET_STATISTICS_update (GSC_stats,
- gettext_noop ("# ephemeral keys received"),
- 1, GNUNET_NO);
-
if (0 !=
memcmp (&m->origin_identity,
kx->peer,
sizeof (struct GNUNET_PeerIdentity)))
{
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+ GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
"Received EPHEMERAL_KEY from %s, but expected %s\n",
GNUNET_i2s (&m->origin_identity),
GNUNET_i2s_full (kx->peer));
GNUNET_break_op (0);
return;
}
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Core service receives EPHEMERAL_KEY request from `%s'.\n",
- GNUNET_i2s (kx->peer));
if ((ntohl (m->purpose.size) !=
sizeof (struct GNUNET_CRYPTO_EccSignaturePurpose) +
sizeof (struct GNUNET_TIME_AbsoluteNBO) +
{
/* invalid signature */
GNUNET_break_op (0);
+ GNUNET_STATISTICS_update (GSC_stats,
+ gettext_noop ("# EPHEMERAL_KEYs rejected (bad signature)"),
+ 1,
+ GNUNET_NO);
+ GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+ "Received EPHEMERAL_KEY from %s with bad signature\n",
+ GNUNET_i2s (&m->origin_identity));
return;
}
now = GNUNET_TIME_absolute_get ();
+ start_t = GNUNET_TIME_absolute_ntoh (m->creation_time);
if ( (end_t.abs_value_us < GNUNET_TIME_absolute_subtract (now, REKEY_TOLERANCE).abs_value_us) ||
(start_t.abs_value_us > GNUNET_TIME_absolute_add (now, REKEY_TOLERANCE).abs_value_us) )
{
GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
- _("Ephemeral key message from peer `%s' rejected as its validity range does not match our system time (%llu not in [%llu,%llu]).\n"),
+ _("EPHEMERAL_KEY from peer `%s' rejected as its validity range does not match our system time (%llu not in [%llu,%llu]).\n"),
GNUNET_i2s (kx->peer),
(unsigned long long) now.abs_value_us,
(unsigned long long) start_t.abs_value_us,
(unsigned long long) end_t.abs_value_us);
+ GNUNET_STATISTICS_update (GSC_stats,
+ gettext_noop ("# EPHEMERAL_KEY messages rejected due to time"),
+ 1,
+ GNUNET_NO);
return;
}
+#if DEBUG_KX
+ {
+ struct GNUNET_HashCode eh;
+
+ GNUNET_CRYPTO_hash (&m->ephemeral_key,
+ sizeof (m->ephemeral_key),
+ &eh);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Received valid EPHEMERAL_KEY `%s' from `%s' in state %d.\n",
+ GNUNET_h2s (&eh),
+ GNUNET_i2s (kx->peer),
+ kx->status);
+ }
+#endif
+ GNUNET_STATISTICS_update (GSC_stats,
+ gettext_noop ("# valid ephemeral keys received"),
+ 1,
+ GNUNET_NO);
kx->other_ephemeral_key = m->ephemeral_key;
kx->foreign_key_expires = end_t;
derive_session_keys (kx);
- GNUNET_STATISTICS_update (GSC_stats,
- gettext_noop ("# EPHEMERAL_KEY messages received"), 1,
- GNUNET_NO);
/* check if we still need to send the sender our key */
sender_status = (enum GNUNET_CORE_KxState) ntohl (m->sender_status);
{
if (GNUNET_CORE_KX_STATE_REKEY_SENT != kx->status)
GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
- "Decryption of PING from peer `%s' failed\n",
- GNUNET_i2s (kx->peer));
+ "Decryption of PING from peer `%s' failed, PING for `%s'?\n",
+ GNUNET_i2s (kx->peer),
+ GNUNET_i2s2 (&t.target));
else
GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
"Decryption of PING from peer `%s' failed after rekey (harmless)\n",
return;
}
GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Received PONG from `%s'\n",
+ "Received valid PONG from `%s'\n",
GNUNET_i2s (kx->peer));
/* no need to resend key any longer */
if (NULL != kx->retry_set_key_task)
kx->retry_set_key_task = NULL;
}
/* always update sender status in SET KEY message */
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Sending key to `%s' (my status: %d)\n",
- GNUNET_i2s (kx->peer),
- kx->status);
+#if DEBUG_KX
+ {
+ struct GNUNET_HashCode hc;
+
+ GNUNET_CRYPTO_hash (¤t_ekm.ephemeral_key,
+ sizeof (current_ekm.ephemeral_key),
+ &hc);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Sending EPHEMERAL_KEY %s to `%s' (my status: %d)\n",
+ GNUNET_h2s (&hc),
+ GNUNET_i2s (kx->peer),
+ kx->status);
+ }
+#endif
current_ekm.sender_status = htonl ((int32_t) (kx->status));
env = GNUNET_MQ_msg_copy (¤t_ekm.header);
GNUNET_MQ_send (kx->mq,
&ph->sequence_number,
&em->sequence_number,
used - ENCRYPTED_HEADER_SIZE));
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Encrypted %u bytes for %s\n",
- (unsigned int) (used - ENCRYPTED_HEADER_SIZE),
- GNUNET_i2s (kx->peer));
+#if DEBUG_KX
+ {
+ struct GNUNET_HashCode hc;
+
+ GNUNET_CRYPTO_hash (&ph->sequence_number,
+ used - ENCRYPTED_HEADER_SIZE,
+ &hc);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Encrypted payload `%s' of %u bytes for %s\n",
+ GNUNET_h2s (&hc),
+ (unsigned int) (used - ENCRYPTED_HEADER_SIZE),
+ GNUNET_i2s (kx->peer));
+ }
+#endif
derive_auth_key (&auth_key,
&kx->encrypt_key,
ph->iv_seed);
&em->sequence_number,
used - ENCRYPTED_HEADER_SIZE,
&em->hmac);
+#if DEBUG_KX
+ {
+ struct GNUNET_HashCode hc;
+
+ GNUNET_CRYPTO_hash (&auth_key,
+ sizeof (auth_key),
+ &hc);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "For peer %s, used AC %s to create hmac %s\n",
+ GNUNET_i2s (kx->peer),
+ GNUNET_h2s (&hc),
+ GNUNET_h2s2 (&em->hmac));
+ }
+#endif
kx->has_excess_bandwidth = GNUNET_NO;
GNUNET_MQ_send (kx->mq,
env);
}
-/**
- * Closure for #deliver_message()
- */
-struct DeliverMessageContext
-{
-
- /**
- * Key exchange context.
- */
- struct GSC_KeyExchangeInfo *kx;
-
- /**
- * Sender of the message.
- */
- const struct GNUNET_PeerIdentity *peer;
-};
-
-
/**
* We received an encrypted message. Check that it is
* well-formed (size-wise).
struct GNUNET_TIME_Absolute t;
struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
struct GNUNET_CRYPTO_AuthKey auth_key;
- struct DeliverMessageContext dmc;
uint16_t size = ntohs (m->header.size);
char buf[size] GNUNET_ALIGN;
}
/* validate hash */
+#if DEBUG_KX
+ {
+ struct GNUNET_HashCode hc;
+
+ GNUNET_CRYPTO_hash (&m->sequence_number,
+ size - ENCRYPTED_HEADER_SIZE,
+ &hc);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Received encrypted payload `%s' of %u bytes from %s\n",
+ GNUNET_h2s (&hc),
+ (unsigned int) (size - ENCRYPTED_HEADER_SIZE),
+ GNUNET_i2s (kx->peer));
+ }
+#endif
derive_auth_key (&auth_key,
&kx->decrypt_key,
m->iv_seed);
&m->sequence_number,
size - ENCRYPTED_HEADER_SIZE,
&ph);
+#if DEBUG_KX
+ {
+ struct GNUNET_HashCode hc;
+
+ GNUNET_CRYPTO_hash (&auth_key,
+ sizeof (auth_key),
+ &hc);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "For peer %s, used AC %s to verify hmac %s\n",
+ GNUNET_i2s (kx->peer),
+ GNUNET_h2s (&hc),
+ GNUNET_h2s2 (&m->hmac));
+ }
+#endif
if (0 != memcmp (&ph,
&m->hmac,
sizeof (struct GNUNET_HashCode)))
gettext_noop ("# bytes of payload decrypted"),
size - sizeof (struct EncryptedMessage),
GNUNET_NO);
- dmc.kx = kx;
- dmc.peer = kx->peer;
if (GNUNET_OK !=
- GNUNET_SERVER_mst_receive (mst,
- &dmc,
- &buf[sizeof (struct EncryptedMessage)],
- size - sizeof (struct EncryptedMessage),
- GNUNET_YES,
- GNUNET_NO))
+ GNUNET_MST_from_buffer (kx->mst,
+ &buf[sizeof (struct EncryptedMessage)],
+ size - sizeof (struct EncryptedMessage),
+ GNUNET_YES,
+ GNUNET_NO))
GNUNET_break_op (0);
}
}
-/**
- * Deliver P2P message to interested clients. Invokes send twice,
- * once for clients that want the full message, and once for clients
- * that only want the header
- *
- * @param cls always NULL
- * @param client who sent us the message (struct GSC_KeyExchangeInfo)
- * @param m the message
- */
-static int
-deliver_message (void *cls,
- void *client,
- const struct GNUNET_MessageHeader *m)
-{
- struct DeliverMessageContext *dmc = client;
-
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Decrypted message of type %d from %s\n",
- ntohs (m->type),
- GNUNET_i2s (dmc->peer));
- if (GNUNET_CORE_KX_STATE_UP != dmc->kx->status)
- {
- GNUNET_STATISTICS_update (GSC_stats,
- gettext_noop ("# PAYLOAD dropped (out of order)"),
- 1,
- GNUNET_NO);
- return GNUNET_OK;
- }
- switch (ntohs (m->type))
- {
- case GNUNET_MESSAGE_TYPE_CORE_BINARY_TYPE_MAP:
- case GNUNET_MESSAGE_TYPE_CORE_COMPRESSED_TYPE_MAP:
- GSC_SESSIONS_set_typemap (dmc->peer, m);
- return GNUNET_OK;
- case GNUNET_MESSAGE_TYPE_CORE_CONFIRM_TYPE_MAP:
- GSC_SESSIONS_confirm_typemap (dmc->peer, m);
- return GNUNET_OK;
- default:
- GSC_CLIENTS_deliver_message (dmc->peer,
- m,
- ntohs (m->size),
- GNUNET_CORE_OPTION_SEND_FULL_INBOUND);
- GSC_CLIENTS_deliver_message (dmc->peer,
- m,
- sizeof (struct GNUNET_MessageHeader),
- GNUNET_CORE_OPTION_SEND_HDR_INBOUND);
- }
- return GNUNET_OK;
-}
-
-
/**
* Setup the message that links the ephemeral key to our persistent
* public key and generate the appropriate signature.
NULL);
if (NULL != my_ephemeral_key)
GNUNET_free (my_ephemeral_key);
- GNUNET_log (GNUNET_ERROR_TYPE_INFO,
- "Rekeying\n");
my_ephemeral_key = GNUNET_CRYPTO_ecdhe_key_create ();
GNUNET_assert (NULL != my_ephemeral_key);
sign_ephemeral_key ();
+ {
+ struct GNUNET_HashCode eh;
+
+ GNUNET_CRYPTO_hash (¤t_ekm.ephemeral_key,
+ sizeof (current_ekm.ephemeral_key),
+ &eh);
+ GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ "Rekeying to %s\n",
+ GNUNET_h2s (&eh));
+ }
for (pos = kx_head; NULL != pos; pos = pos->next)
{
if (GNUNET_CORE_KX_STATE_UP == pos->status)
return GNUNET_SYSERR;
}
sign_ephemeral_key ();
+ {
+ struct GNUNET_HashCode eh;
+
+ GNUNET_CRYPTO_hash (¤t_ekm.ephemeral_key,
+ sizeof (current_ekm.ephemeral_key),
+ &eh);
+ GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ "Starting with ephemeral key %s\n",
+ GNUNET_h2s (&eh));
+ }
+
nc = GNUNET_notification_context_create (1);
rekey_task = GNUNET_SCHEDULER_add_delayed (REKEY_FREQUENCY,
&do_rekey,
NULL);
- mst = GNUNET_SERVER_mst_create (&deliver_message,
- NULL);
transport
= GNUNET_TRANSPORT_core_connect (GSC_cfg,
&GSC_my_identity,
GNUNET_free (my_private_key);
my_private_key = NULL;
}
- if (NULL != mst)
- {
- GNUNET_SERVER_mst_destroy (mst);
- mst = NULL;
- }
if (NULL != nc)
{
GNUNET_notification_context_destroy (nc);