Reopen logfiles on receipt of @SIGHUP@ (not done very well). Don't

[tripe] / keyexch.c

/* -*-c-*-
 *
 * $Id: keyexch.c,v 1.1 2001/02/03 20:26:37 mdw Exp $
 *
 * Key exchange protocol
 *
 * (c) 2001 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------* 
 *
 * This file is part of Trivial IP Encryption (TrIPE).
 *
 * TrIPE is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 * 
 * TrIPE is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with TrIPE; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------* 
 *
 * $Log: keyexch.c,v $
 * Revision 1.1  2001/02/03 20:26:37  mdw
 * Initial checkin.
 *
 */

/*----- Header files ------------------------------------------------------*/

#include "tripe.h"

/*----- Tunable parameters ------------------------------------------------*/

#define T_VALID MIN(2)
#define T_QUIET SEC(5)
#define T_RETRY SEC(10)
#define T_NEWCHAL SEC(5)

/*----- Handy macros ------------------------------------------------------*/

#define FREECTX(kx) do {						\
  keyexch *_kkx = (kx);							\
  if (_kkx->f & KXF_INIT) {						\
    mp_drop(_kkx->my_x); mp_drop(_kkx->my_gx); mp_drop(_kkx->my_gxy);	\
    mp_drop(_kkx->your_gx); mp_drop(_kkx->your_gxy);			\
  }									\
} while (0)

#define INITCTX(kx, now) do {						\
  keyexch *_kx = (kx);							\
  time_t _now = (now);							\
  FREECTX(_kx);								\
  kx->my_x = kx->my_gx = kx->my_gxy = 0;				\
  kx->your_gx = kx->your_gxy = 0;					\
  kx->t_valid = _now + T_VALID;						\
  kx->t_qchal = kx->t_qresp = 0;					\
  kx->t_newchal = 0;							\
  kx->f = (kx->f | KXF_INIT) & ~(KXF_MYH | KXF_YOURH |			\
				 KXF_REPLY | KXF_DONE);			\
} while (0)

#define NEWCHAL(kx) do {						\
  kx->f &= ~(KXF_YOURH | KXF_MYH);					\
  mp_drop(kx->your_gx); kx->your_gx = 0;				\
  mp_drop(kx->your_gxy); kx->your_gxy = 0;				\
} while (0)

#define ISVALID(kx, now) ((kx)->t_valid > (now))
#define ISQ_CHAL(kx, now) ((kx)->t_qchal > (now))
#define ISQ_RESP(kx, now) ((kx)->t_qresp > (now))
#define ISNEWCHAL(kx, now) ((kx)->t_newchal > (now))

/*----- Main code ---------------------------------------------------------*/

/* --- @hashmp@ --- *
 *
 * Arguments:	@rmd160_ctx *r@ = pointer to hash context
 *		@mp *m@ = pointer to multiprecision integer
 *
 * Returns:	---
 *
 * Use:		Adds the hash of a multiprecision integer to the context.
 *		Corrupts @buf_o@.
 */

static void hashmp(rmd160_ctx *r, mp *m)
{
  buf b;
  buf_init(&b, buf_o, sizeof(buf_o));
  buf_putmp(&b, m);
  assert(BOK(&b));
  rmd160_hash(r, BBASE(&b), BLEN(&b));
}

/* --- @timer@ --- *
 *
 * Arguments:	@struct timeval *tv@ = the current time
 *		@void *v@ = pointer to key exchange context
 *
 * Returns:	---
 *
 * Use:		Acts when the key exchange timer goes off.
 */

static void timer(struct timeval *tv, void *v)
{
  keyexch *kx = v;
  kx->f &= ~KXF_TIMER;
  T( trace(T_KEYEXCH, "keyexch: timer has popped"); )
  kx_start(kx);
}

/* --- @settimer@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exchange context
 *		@time_t t@ = when to set the timer for
 *
 * Returns:	---
 *
 * Use:		Sets the timer for the next key exchange attempt.
 */

static void settimer(keyexch *kx, time_t t)
{
  struct timeval tv;
  if (kx->f & KXF_TIMER)
    sel_rmtimer(&kx->t);
  tv.tv_sec = t;
  tv.tv_usec = 0;
  sel_addtimer(&sel, &kx->t, &tv, timer, kx);
  kx->f |= KXF_TIMER;
}

/* --- @update@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exchange context
 *
 * Returns:	---
 *
 * Use:		Updates the information in the key exchange context.  Call
 *		this after new information has arrived.  Expects that the
 *		context is actually valid.  Doesn't send any packets.
 *		Assumes that everything in the context is known to be
 *		correct.
 */

static void update(keyexch *kx)
{
  rmd160_ctx r;
  octet h[RMD160_HASHSZ];
  mp *k_shared;
  buf b;

  /* --- Give up if there's nothing more to do --- */

  if (kx->f & KXF_DONE)
    return;

  /* --- If we've just started, generate a new challenge --- */

  if (!kx->my_x) {
    T( trace(T_KEYEXCH, "keyexch: generating new challenge"); )
    kx->my_x = mprand_range(MP_NEWSEC, kx->kpub.dp.q, &rand_global, 0);
    kx->my_gx = mpmont_exp(&mg, MP_NEW, kx->kpub.dp.g, kx->my_x);
    kx->my_gxy = mpmont_exp(&mg, MP_NEW, kx->kpub.y, kx->my_x);
    IF_TRACING(T_KEYEXCH, IF_TRACING(T_CRYPTO, {
      trace(T_CRYPTO, "crypto: secret = %s", mpstr(kx->my_x));
      trace(T_CRYPTO, "crypto: public value = %s", mpstr(kx->my_gx));
      trace(T_CRYPTO, "crypto: expected reply = %s", mpstr(kx->my_gxy));
    }))
  }

  /* --- If I don't have your challenge, I can't do anything more --- */

  if (!kx->your_gx)
    return;

  /* --- If I've not computed my hash, I should do that --- */

  if (!(kx->f & KXF_MYH)) {    
    T( trace(T_KEYEXCH, "keyexch: computing my hash"); )
    rmd160_init(&r);
    hashmp(&r, kx->my_gx);
    hashmp(&r, kx->your_gx);
    hashmp(&r, kx->my_gxy);
    rmd160_done(&r, kx->my_h);
    IF_TRACING(T_KEYEXCH, trace_block(T_CRYPTO, "crypto: my hash",
				      kx->my_h, sizeof(kx->my_h)); )
    kx->f |= KXF_MYH;
  }

  /* --- If I've received a full challenge, answer it --- *
   *
   * If it turns out to be wrong, clear the appropriate bits of data.
   */

  if ((kx->f & KXF_YOURH) && !kx->your_gxy) {
    kx->your_gxy = mpmont_exp(&mg, MP_NEW, kx->your_gx, kpriv.x);
    rmd160_init(&r);
    hashmp(&r, kx->your_gx);
    hashmp(&r, kx->my_gx);
    hashmp(&r, kx->your_gxy);
    rmd160_done(&r, h);
    IF_TRACING(T_KEYEXCH, trace_block(T_CRYPTO, "crypto: computed hash",
				      h, sizeof(h)); )
    if (memcmp(h, kx->your_h, sizeof(h)) != 0) {
      IF_TRACING(T_KEYEXCH, {
	trace_block(T_CRYPTO, "crypto: expected hash",
		    kx->your_h, sizeof(kx->your_h));
	trace(T_KEYEXCH, "keyexch: hashes don't match: botched");
      })
      NEWCHAL(kx);
      return;
    }
  }

  /* --- If I have a good reply, compute a shared key --- */

  if ((kx->f & KXF_YOURH) && (kx->f & KXF_REPLY)) {
    k_shared = mpmont_exp(&mg, MP_NEW, kx->your_gx, kx->my_x);
    IF_TRACING(T_KEYEXCH, {
      trace(T_KEYEXCH, "keyexch: computed shared key");
      trace(T_CRYPTO, "crypto: shared key = %s", mpstr(k_shared));
    })
    buf_init(&b, buf_o, sizeof(buf_o));
    buf_putmp(&b, k_shared); assert(BOK(&b));
    settimer(kx, ks_gen(kx->ks, BBASE(&b), BLEN(&b)));
    mp_drop(k_shared);
    BURN(buf_o);
    kx->f |= KXF_DONE;
  }
}

/* --- @resend_chal@, @resent_resp@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exchange context
 *		@time_t now@ = the time right now
 *
 * Returns:	---
 *
 * Use:		Sends packets to the remote host, according to the various
 *		timers and information available.
 */

void resend_chal(keyexch *kx, time_t now)
{
  buf *b;

  if (kx->f & KXF_DONE)
    return;
  if (ISQ_CHAL(kx, now)) {
    T( trace(T_KEYEXCH, "keyexch: not sending a new challenge yet"); )
    return;
  }
  if (!kx->your_gx) {
    T( trace(T_KEYEXCH, "keyexch: sending prechallenge"); )
    b = p_txstart(kx->p, MSG_PRECHALLENGE);
  } else {
    T( trace(T_KEYEXCH, "keyexch: sending challenge"); )
    b = p_txstart(kx->p, MSG_CHALLENGE);
    buf_put(b, kx->my_h, sizeof(kx->my_h));
  }
  buf_putmp(b, kx->my_gx);
  p_txend(kx->p);
  kx->t_qchal = now + T_QUIET;
  settimer(kx, now + T_RETRY);
}

void resend_resp(keyexch *kx, time_t now)
{
  buf *b;

  if (!kx->your_gxy)
    return;
  if (ISQ_RESP(kx, now)) {
    T( trace(T_KEYEXCH, "keyexch: not sending a new response yet"); )
    return;
  }
  T( trace(T_KEYEXCH, "keyexch: sending response"); )
  b = p_txstart(kx->p, MSG_RESPONSE);
  buf_putmp(b, kx->your_gxy);
  p_txend(kx->p);
  kx->t_qresp = now + T_QUIET;
}

/* --- @kx_start@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exchange context
 *
 * Returns:	---
 *
 * Use:		Stimulates a key exchange.  If a key exchage is in progress,
 *		a new challenge is sent (unless the quiet timer forbids
 *		this); if no exchange is in progress, one is commenced.
 */

void kx_start(keyexch *kx)
{
  time_t now = time(0);

  if (!ISVALID(kx, now))
    INITCTX(kx, now);
  update(kx);
  resend_chal(kx, now);
}

/* --- @dochallenge@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exchange context
 *		@time_t now@ = the current time
 *		@mp *m@ = new challenge received
 *		@const octet *h@ = challenge hash (if any)
 *
 * Returns:	---
 *
 * Use:		Common code for handling challenge messages.  The caller
 *		should have successfullly unpacked the challenge structure.
 */

static void dochallenge(keyexch *kx, time_t now, mp *m, const octet *h)
{
  unsigned f = 0;
#define f_newchal 1u
#define f_newhash 2u
#define f_new (f_newchal | f_newhash)
#define f_match 4u
#define f_good (f_new | f_match)
#define f_ignore 8u
#define f_reset 16u
#define f_change (f_new | f_reset)

  /* --- Restart the process if necessary --- */

  if (!ISVALID(kx, now))
    INITCTX(kx, now);
  if (!ISNEWCHAL(kx, now))
    f |= f_ignore;

  /* --- Sort out what to actually do --- */
  
  if (!kx->your_gx) {
    f |= f_newchal;
    if (h)
      f |= f_newhash;
  } else if (mp_eq(kx->your_gx, m)) {
    if (!h || memcmp(h, kx->your_h, sizeof(kx->your_h)) == 0)
      f |= f_match;
    else if (!(kx->f & KXF_YOURH))
      f |= f_newhash;
  }

  /* --- Update the values in the context --- */

  if (f & f_good)
    f &= ~f_ignore;
  else if (!(f & f_ignore)) {
    NEWCHAL(kx);
    f |= f_reset;
  }
  if (f & (f_newchal | f_reset))
    kx->your_gx = MP_COPY(m);
  if (f & (f_newhash | f_reset)) {
    memcpy(kx->your_h, h, sizeof(kx->your_h));
    kx->f |= KXF_YOURH;  
  }
  if (f & f_new)
    kx->t_qchal = 0;    

  if (!(f & f_good)) {
    a_warn("%s nonmatching challenge from `%s'",
	   (f & f_ignore) ? "rejecting" : "accepting", p_name(kx->p));
  } else {
    T( trace(T_KEYEXCH, "keyexch: good challenge (%s, %s) from `%s'",
	     (f & f_newchal) ? "new gxy" : "match gxy",
	     (f & f_newhash) ? "new hash" : "match hash", p_name(kx->p)); )
  }
  if (f & f_change)
    update(kx);

  if (f & f_new)
    resend_chal(kx, now);
#undef f_newchal
#undef f_newhash
#undef f_new
#undef f_match
#undef f_good
#undef f_ignore
#undef f_change
}

/* --- @kx_prechallenge@, @kx_challenge@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exhange context
 *		@buf *b@ = pointer to buffer containing the packet
 *
 * Returns:	---
 *
 * Use:		Handle prechallenges and challenges.
 */

void kx_prechallenge(keyexch *kx, buf *b)
{
  time_t now = time(0);
  mp *m;

  if ((m = buf_getmp(b, MP_NEW)) == 0 || BLEFT(b)) {
    a_warn("malformed prechallenge from `%s'", p_name(kx->p));
    goto tidy;
  }
  dochallenge(kx, now, m, 0);
tidy:
  mp_drop(m);
}

void kx_challenge(keyexch *kx, buf *b)
{
  time_t now = time(0);
  mp *m = 0;
  const octet *h;

  if (buf_ensure(b, RMD160_HASHSZ) ||
      (h = BCUR(b), BSTEP(b, RMD160_HASHSZ), 
       (m = buf_getmp(b, MP_NEW)) == 0 || BLEFT(b))) {
    a_warn("malformed challenge from `%s'", p_name(kx->p));
    goto tidy;
  }
  dochallenge(kx, now, m, h);
  resend_resp(kx, now);
tidy:
  mp_drop(m);
}

/* --- @kx_response@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exchange context
 *		@buf *b@ = a buffer containing the packet to read
 *
 * Returns:	---
 *
 * Use:		Reads a response from the buffer and handles it.
 */

void kx_response(keyexch *kx, buf *b)
{
  time_t now = time(0);
  mp *m;

  if ((m = buf_getmp(b, MP_NEW)) == 0 || BLEFT(b)) {
    a_warn("malformed response from `%s'", p_name(kx->p));
    goto tidy;
  }
  if (!ISVALID(kx, now))
    INITCTX(kx, now);
  if (!(kx->f & KXF_MYH)) {
    a_warn("premature response from `%s'", p_name(kx->p));
    goto tidy;
  }
  if (!mp_eq(m, kx->my_gxy)) {
    a_warn("incorrect response from `%s'", p_name(kx->p));
    goto tidy;
  }
  T( trace(T_KEYEXCH, "keyexch: valid response from `%s'", p_name(kx->p)); )
  kx->f |= KXF_REPLY;
  update(kx);

tidy:
  mp_drop(m);
}

/* --- @kx_free@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exchange context
 *
 * Returns:	---
 *
 * Use:		Frees everything in a key exchange context.
 */

void kx_free(keyexch *kx)
{
  if (kx->f & KXF_TIMER)
    sel_rmtimer(&kx->t);
  FREECTX(kx);
  dh_pubfree(&kx->kpub);
}

/* --- @kx_newkeys@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exchange context
 *
 * Returns:	---
 *
 * Use:		Informs the key exchange module that its keys may have
 *		changed.  If fetching the new keys fails, the peer will be
 *		destroyed, we log messages and struggle along with the old
 *		keys.
 */

void kx_newkeys(keyexch *kx)
{
  dh_pub dp;

  if (km_getpubkey(p_name(kx->p), &dp))
    return;
  dh_pubfree(&kx->kpub);
  kx->kpub = dp;
  if (!(kx->f & KXF_DONE)) {
    T( trace(T_KEYEXCH, "keyexch: restarting key negotiation with `%s'",
	     p_name(kx->p)); )
    INITCTX(kx, time(0));
  }
}

/* --- @kx_init@ --- *
 *
 * Arguments:	@keyexch *kx@ = pointer to key exchange context
 *		@peer *p@ = pointer to peer context
 *		@keyset **ks@ = pointer to keyset list
 *
 * Returns:	Zero if OK, nonzero if it failed.
 *
 * Use:		Initializes a key exchange module.  The module currently
 *		contains no keys, and will attempt to initiate a key
 *		exchange.
 */

int kx_init(keyexch *kx, peer *p, keyset **ks)
{
  kx->ks = ks;
  kx->p = p;
  kx->f = 0;
  if (km_getpubkey(p_name(p), &kx->kpub))
    return (-1);
  kx->t_valid = 0;
  kx_start(kx);
  return (0);
}

/*----- That's all, folks -------------------------------------------------*/