3 * $Id: keyexch.c,v 1.3 2001/06/19 22:07:09 mdw Exp $
5 * Key exchange protocol
7 * (c) 2001 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Trivial IP Encryption (TrIPE).
14 * TrIPE is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * TrIPE is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with TrIPE; if not, write to the Free Software Foundation,
26 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 /*----- Revision history --------------------------------------------------*
32 * Revision 1.3 2001/06/19 22:07:09 mdw
35 * Revision 1.2 2001/02/16 21:24:27 mdw
36 * Rewrite for new key exchange protocol.
38 * Revision 1.1 2001/02/03 20:26:37 mdw
43 /*----- Header files ------------------------------------------------------*/
47 /*----- Tunable parameters ------------------------------------------------*/
49 #define T_VALID MIN(2)
50 #define T_RETRY SEC(10)
52 #define ISVALID(kx, now) ((now) < (kx)->t_valid)
54 /*----- Various utilities -------------------------------------------------*/
58 * Arguments: @HASH_CTX *r@ = pointer to hash context
59 * @mp *m@ = pointer to multiprecision integer
63 * Use: Adds the hash of a multiprecision integer to the context.
67 static void hashmp(HASH_CTX *r, mp *m)
70 buf_init(&b, buf_t, sizeof(buf_t));
73 HASH(r, BBASE(&b), BLEN(&b));
78 * Arguments: @struct timeval *tv@ = the current time
79 * @void *v@ = pointer to key exchange context
83 * Use: Acts when the key exchange timer goes off.
86 static void timer(struct timeval *tv, void *v)
90 T( trace(T_KEYEXCH, "keyexch: timer has popped"); )
94 /* --- @settimer@ --- *
96 * Arguments: @keyexch *kx@ = pointer to key exchange context
97 * @time_t t@ = when to set the timer for
101 * Use: Sets the timer for the next key exchange attempt.
104 static void settimer(keyexch *kx, time_t t)
107 if (kx->f & KXF_TIMER)
111 sel_addtimer(&sel, &kx->t, &tv, timer, kx);
115 /*----- Challenge management ----------------------------------------------*/
117 /* --- Notes on challenge management --- *
119 * We may get multiple different replies to our key exchange; some will be
120 * correct, some inserted by attackers. Up until @KX_THRESH@, all challenges
121 * received will be added to the table and given a full response. After
122 * @KX_THRESH@ distinct challenges are received, we return only a `cookie':
123 * our existing challenge, followed by a hash of the sender's challenge. We
124 * do %%\emph{not}%% give a bare challenge a reply slot at this stage. All
125 * properly-formed cookies are assigned a table slot: if none is spare, a
126 * used slot is randomly selected and destroyed. A cookie always receives a
130 /* --- @kxc_destroy@ --- *
132 * Arguments: @kxchal *kxc@ = pointer to the challenge block
136 * Use: Disposes of a challenge block.
139 static void kxc_destroy(kxchal *kxc)
141 if (kxc->f & KXF_TIMER)
142 sel_rmtimer(&kxc->t);
149 /* --- @kxc_stoptimer@ --- *
151 * Arguments: @kxchal *kxc@ = pointer to the challenge block
155 * Use: Stops the challenge's retry timer from sending messages.
156 * Useful when the state machine is in the endgame of the
160 static void kxc_stoptimer(kxchal *kxc)
162 if (kxc->f & KXF_TIMER)
163 sel_rmtimer(&kxc->t);
166 /* --- @kxc_new@ --- *
168 * Arguments: @keyexch *kx@ = pointer to key exchange block
170 * Returns: A pointer to the challenge block.
172 * Use: Returns a pointer to a new challenge block to fill in.
175 static kxchal *kxc_new(keyexch *kx)
180 /* --- If we're over reply threshold, discard one at random --- */
182 if (kx->nr < KX_NCHAL)
185 i = rand_global.ops->range(&rand_global, KX_NCHAL);
186 kxc_destroy(kx->r[i]);
189 /* --- Fill in the new structure --- */
191 kxc = CREATE(kxchal);
201 /* --- @kxc_bychal@ --- *
203 * Arguments: @keyexch *kx@ = pointer to key exchange block
204 * @mp *c@ = challenge from remote host
206 * Returns: Pointer to the challenge block, or null.
208 * Use: Finds a challenge block, given its challenge.
211 static kxchal *kxc_bychal(keyexch *kx, mp *c)
215 for (i = 0; i < kx->nr; i++) {
216 if (MP_EQ(c, kx->r[i]->c))
222 /* --- @kxc_byhc@ --- *
224 * Arguments: @keyexch *kx@ = pointer to key exchange block
225 * @const octet *hc@ = challenge hash from remote host
227 * Returns: Pointer to the challenge block, or null.
229 * Use: Finds a challenge block, given a hash of its challenge.
232 static kxchal *kxc_byhc(keyexch *kx, const octet *hc)
236 for (i = 0; i < kx->nr; i++) {
237 if (memcmp(hc, kx->r[i]->hc, HASHSZ) == 0)
243 /* --- @kxc_answer@ --- *
245 * Arguments: @keyexch *kx@ = pointer to key exchange block
246 * @kxchal *kxc@ = pointer to challenge block
250 * Use: Sends a reply to the remote host, according to the data in
251 * this challenge block.
254 static void kxc_answer(keyexch *kx, kxchal *kxc);
256 static void kxc_timer(struct timeval *tv, void *v)
259 kxc->f &= ~KXF_TIMER;
260 kxc_answer(kxc->kx, kxc);
263 static void kxc_answer(keyexch *kx, kxchal *kxc)
265 stats *st = p_stats(kx->p);
266 buf *b = p_txstart(kx->p, MSG_KEYEXCH | (kxc->r ? KX_REPLY : KX_CHAL));
270 /* --- Build the reply packet --- */
275 buf_put(b, kx->hc, HASHSZ);
276 buf_put(b, kxc->hc, HASHSZ);
277 buf_put(b, kxc->hrx, HASHSZ);
279 /* --- Maybe send an actual reply, if we have one --- */
282 T( trace(T_KEYEXCH, "keyexch: resending challenge to `%s'",
285 T( trace(T_KEYEXCH, "keyexch: sending reply to `%s'", p_name(kx->p)); )
286 buf_init(&bb, buf_i, sizeof(buf_i));
287 buf_putmp(&bb, kxc->r);
289 ks_encrypt(kxc->ks, &bb, b);
292 /* --- Update the statistics --- */
296 st->sz_kxout += BLEN(b);
300 /* --- Schedule another resend --- */
302 if (kxc->f & KXF_TIMER)
303 sel_rmtimer(&kxc->t);
304 gettimeofday(&tv, 0);
305 tv.tv_sec += T_RETRY;
306 sel_addtimer(&sel, &kxc->t, &tv, kxc_timer, kxc);
310 /*----- Individual message handlers ---------------------------------------*/
312 /* --- @getreply@ --- *
314 * Arguments: @keyexch *kx@ = pointer to key exchange context
315 * @mp *c@ = a challenge
316 * @const octet *hrx@ = the supplied expected-reply hash
318 * Returns: A pointer to the reply, or null if the reply-hash was wrong.
320 * Use: Computes replies to challenges.
323 static mp *getreply(keyexch *kx, mp *c, const octet *hrx)
325 mp *r = mpmont_exp(&mg, MP_NEW, c, kpriv.x);
330 HASH_STRING(&h, "tripe-expected-reply");
335 IF_TRACING(T_KEYEXCH, IF_TRACING(T_CRYPTO, {
336 trace(T_CRYPTO, "crypto: computed reply = %s", mpstr(r));
337 trace_block(T_CRYPTO, "crypto: computed reply hash", buf, HASHSZ);
339 if (memcmp(buf, hrx, HASHSZ) != 0) {
340 a_warn("invalid expected-reply hash from `%s'", p_name(kx->p));
347 /* --- @dochallenge@ --- *
349 * Arguments: @keyexch *kx@ = pointer to key exchange block
350 * @unsigned msg@ = message code for the packet
351 * @buf *b@ = buffer containing the packet
353 * Returns: Zero if OK, nonzero if the packet was rejected.
355 * Use: Processes a packet containing a challenge.
358 static int dochallenge(keyexch *kx, unsigned msg, buf *b)
361 const octet *hc = 0, *hrx = 0;
365 /* --- Ensure that we're in a sensible state --- */
367 if (kx->s != KXS_CHAL) {
368 a_warn("unexpected challenge from `%s'", p_name(kx->p));
372 /* --- Unpack the packet --- */
374 if ((c = buf_getmp(b)) == 0 ||
375 (msg >= KX_COOKIE && (hc = buf_get(b, HASHSZ)) == 0) ||
376 (msg >= KX_CHAL && (hrx = buf_get(b, HASHSZ)) == 0) ||
378 a_warn("malformed packet from `%s'", p_name(kx->p));
382 IF_TRACING(T_KEYEXCH, IF_TRACING(T_CRYPTO, {
383 trace(T_CRYPTO, "crypto: challenge = %s", mpstr(c));
384 if (hc) trace_block(T_CRYPTO, "crypto: cookie", hc, HASHSZ);
385 if (hrx) trace_block(T_CRYPTO, "crypto: response hash", hrx, HASHSZ);
388 /* --- First, handle a bare challenge --- *
390 * If the table is heavily loaded, just emit a cookie and return.
393 if (!hc && kx->nr >= KX_THRESH) {
394 T( trace(T_KEYEXCH, "keyexch: too many challenges -- sending cookie"); )
395 b = p_txstart(kx->p, MSG_KEYEXCH | KX_COOKIE);
398 HASH_STRING(&h, "tripe-cookie");
400 HASH_DONE(&h, buf_get(b, HASHSZ));
405 /* --- Discard a packet with an invalid cookie --- */
407 if (hc && memcmp(hc, kx->hc, HASHSZ) != 0) {
408 a_warn("incorrect cookie from `%s'", p_name(kx->p));
412 /* --- Find a challenge block for this packet --- *
414 * If there isn't one already, create a new one.
417 if ((kxc = kxc_bychal(kx, c)) == 0) {
421 /* --- Be careful here --- *
423 * If this is a full challenge, and it's the first time I've seen it, I
424 * want to be able to throw it away before committing a table entry to
431 if ((r = getreply(kx, c, hrx)) == 0)
438 /* --- Work out the cookie for this challenge --- */
441 HASH_STRING(&h, "tripe-cookie");
443 HASH_DONE(&h, kxc->hc);
445 /* --- Compute the expected-reply hash --- */
448 HASH_STRING(&h, "tripe-expected-reply");
452 HASH_DONE(&h, kxc->hrx);
454 /* --- Work out the shared key --- */
456 r = mpmont_exp(&mg, MP_NEW, c, kx->alpha);
458 /* --- Compute the switch messages --- */
460 HASH_INIT(&h); HASH_STRING(&h, "tripe-switch-request");
461 hashmp(&h, kx->c); hashmp(&h, kxc->c);
462 HASH_DONE(&h, kxc->hswrq_out);
463 HASH_INIT(&h); HASH_STRING(&h, "tripe-switch-confirm");
464 hashmp(&h, kx->c); hashmp(&h, kxc->c);
465 HASH_DONE(&h, kxc->hswok_out);
467 HASH_INIT(&h); HASH_STRING(&h, "tripe-switch-request");
468 hashmp(&h, kxc->c); hashmp(&h, kx->c);
469 HASH_DONE(&h, kxc->hswrq_in);
470 HASH_INIT(&h); HASH_STRING(&h, "tripe-switch-confirm");
471 hashmp(&h, kxc->c); hashmp(&h, kx->c);
472 HASH_DONE(&h, kxc->hswok_in);
474 IF_TRACING(T_KEYEXCH, IF_TRACING(T_CRYPTO, {
475 trace_block(T_CRYPTO, "crypto: computed cookie", kxc->hc, HASHSZ);
476 trace_block(T_CRYPTO, "crypto: my reply hash", kxc->hrx, HASHSZ);
477 trace(T_CRYPTO, "crypto: shared secret = %s", mpstr(r));
478 trace_block(T_CRYPTO, "crypto: outbound switch request",
479 kxc->hswrq_out, HASHSZ);
480 trace_block(T_CRYPTO, "crypto: outbound switch confirm",
481 kxc->hswok_out, HASHSZ);
482 trace_block(T_CRYPTO, "crypto: inbound switch request",
483 kxc->hswrq_in, HASHSZ);
484 trace_block(T_CRYPTO, "crypto: inbound switch confirm",
485 kxc->hswok_in, HASHSZ);
488 /* --- Create a new symmetric keyset --- */
490 buf_init(b, buf_o, sizeof(buf_o));
491 buf_putmp(b, kx->c); x = BLEN(b);
492 buf_putmp(b, kxc->c); y = BLEN(b);
493 buf_putmp(b, r); z = BLEN(b);
496 kxc->ks = ks_gen(BBASE(b), x, y, z);
500 /* --- Answer the challenge if we need to --- */
502 if (hrx && !kxc->r) {
504 if ((r = getreply(kx, c, hrx)) == 0)
511 /* --- Tidy up and go home --- */
522 /* --- @resend@ --- *
524 * Arguments: @keyexch *kx@ = pointer to key exchange context
528 * Use: Sends the next message for a key exchange.
531 static void resend(keyexch *kx)
535 stats *st = p_stats(kx->p);
540 T( trace(T_KEYEXCH, "sending prechallenge to `%s'", p_name(kx->p)); )
541 b = p_txstart(kx->p, MSG_KEYEXCH | KX_PRECHAL);
545 T( trace(T_KEYEXCH, "sending switch request to `%s'", p_name(kx->p)); )
547 b = p_txstart(kx->p, MSG_KEYEXCH | KX_SWITCH);
548 buf_put(b, kx->hc, HASHSZ);
549 buf_put(b, kxc->hc, HASHSZ);
550 buf_init(&bb, buf_i, sizeof(buf_i));
551 buf_putmp(&bb, kxc->r);
552 buf_put(&bb, kxc->hswrq_out, HASHSZ);
554 ks_encrypt(kxc->ks, &bb, b);
557 T( trace(T_KEYEXCH, "sending switch confirmation to `%s'",
560 b = p_txstart(kx->p, MSG_KEYEXCH | KX_SWITCHOK);
561 buf_init(&bb, buf_i, sizeof(buf_i));
562 buf_put(&bb, kxc->hswok_out, HASHSZ);
564 ks_encrypt(kxc->ks, &bb, b);
572 st->sz_kxout += BLEN(b);
576 if (kx->s < KXS_SWITCH)
577 settimer(kx, time(0) + T_RETRY);
580 /* --- @matchreply@ --- *
582 * Arguments: @keyexch *kx@ = pointer to key exchange context
583 * @const octet *hc_in@ = a hash of his challenge
584 * @const octet *hc_out@ = a hash of my challenge (cookie)
585 * @const octet *krx@ = his expected-reply hash (optional)
586 * @buf *b@ = encrypted remainder of the packet
588 * Returns: A pointer to the challenge block if OK, or null on failure.
590 * Use: Checks a reply or switch packet, ensuring that its contents
591 * are sensible and correct. If they are, @*b@ is set to point
592 * to the remainder of the encrypted data, and the correct
593 * challenge is returned.
596 static kxchal *matchreply(keyexch *kx, const octet *hc_in,
597 const octet *hc_out, const octet *hrx, buf *b)
603 /* --- Check the plaintext portions of the data --- */
605 IF_TRACING(T_KEYEXCH, IF_TRACING(T_CRYPTO, {
606 trace_block(T_CRYPTO, "crypto: challenge", hc_in, HASHSZ);
607 trace_block(T_CRYPTO, "crypto: cookie", hc_out, HASHSZ);
608 if (hrx) trace_block(T_CRYPTO, "crypto: response hash", hrx, HASHSZ);
610 if (memcmp(hc_out, kx->hc, HASHSZ) != 0) {
611 a_warn("incorrect cookie from `%s'", p_name(kx->p));
614 if ((kxc = kxc_byhc(kx, hc_in)) == 0) {
615 a_warn("received reply for unknown challenge from `%s'", p_name(kx->p));
619 /* --- Maybe compute a reply for the challenge --- */
623 a_warn("unexpected switch request from `%s'", p_name(kx->p));
626 if ((r = getreply(kx, kxc->c, hrx)) == 0)
632 /* --- Decrypt the rest of the packet --- */
634 buf_init(&bb, buf_o, sizeof(buf_o));
635 if (ks_decrypt(kxc->ks, b, &bb)) {
636 a_warn("failed to decrypt reply from `%s'", p_name(kx->p));
639 buf_init(b, BBASE(&bb), BLEN(&bb));
640 if ((r = buf_getmp(b)) == 0) {
641 a_warn("invalid reply packet from `%s'", p_name(kx->p));
644 IF_TRACING(T_KEYEXCH, IF_TRACING(T_CRYPTO, {
645 trace(T_CRYPTO, "crypto: reply = %s", mpstr(r));
647 if (!mp_eq(r, kx->rx)) {
648 a_warn("incorrect reply from `%s'", p_name(kx->p));
662 /* --- @commit@ --- *
664 * Arguments: @keyexch *kx@ = pointer to key exchange context
665 * @kxchal *kxc@ = pointer to challenge to commit to
669 * Use: Commits to a particular challenge as being the `right' one,
670 * since a reply has arrived for it.
673 static void commit(keyexch *kx, kxchal *kxc)
677 for (i = 0; i < kx->nr; i++) {
679 kxc_destroy(kx->r[i]);
684 ksl_link(kx->ks, kxc->ks);
687 /* --- @doreply@ --- *
689 * Arguments: @keyexch *kx@ = pointer to key exchange context
690 * @buf *b@ = buffer containing packet
692 * Returns: Zero if OK, nonzero if the packet was rejected.
694 * Use: Handles a reply packet. This doesn't handle the various
695 * switch packets: they're rather too different.
698 static int doreply(keyexch *kx, buf *b)
700 const octet *hc_in, *hc_out, *hrx;
703 if (kx->s != KXS_CHAL && kx->s != KXS_COMMIT) {
704 a_warn("unexpected reply from `%s'", p_name(kx->p));
707 if ((hc_in = buf_get(b, HASHSZ)) == 0 ||
708 (hc_out = buf_get(b, HASHSZ)) == 0 ||
709 (hrx = buf_get(b, HASHSZ)) == 0) {
710 a_warn("invalid reply packet from `%s'", p_name(kx->p));
713 if ((kxc = matchreply(kx, hc_in, hc_out, hrx, b)) == 0)
716 a_warn("invalid reply packet from `%s'", p_name(kx->p));
719 if (kx->s == KXS_CHAL) {
730 /* --- @doswitch@ --- *
732 * Arguments: @keyexch *kx@ = pointer to key exchange block
733 * @buf *b@ = pointer to buffer containing packet
735 * Returns: Zero if OK, nonzero if the packet was rejected.
737 * Use: Handles a reply with a switch request bolted onto it.
740 static int doswitch(keyexch *kx, buf *b)
742 const octet *hc_in, *hc_out, *hswrq;
745 if ((hc_in = buf_get(b, HASHSZ)) == 0 ||
746 (hc_out = buf_get(b, HASHSZ)) == 0) {
747 a_warn("invalid switch request from `%s'", p_name(kx->p));
750 if ((kxc = matchreply(kx, hc_in, hc_out, 0, b)) == 0)
752 if ((hswrq = buf_get(b, HASHSZ)) == 0 || BLEFT(b)) {
753 a_warn("invalid switch request from `%s'", p_name(kx->p));
756 IF_TRACING(T_KEYEXCH, {
757 trace_block(T_CRYPTO, "crypto: switch request hash", hswrq, HASHSZ);
759 if (memcmp(hswrq, kxc->hswrq_in, HASHSZ) != 0) {
760 a_warn("incorrect switch request hash from `%s'", p_name(kx->p));
767 ks_activate(kxc->ks);
768 settimer(kx, ks_tregen(kxc->ks));
779 /* --- @doswitchok@ --- *
781 * Arguments: @keyexch *kx@ = pointer to key exchange block
782 * @buf *b@ = pointer to buffer containing packet
784 * Returns: Zero if OK, nonzero if the packet was rejected.
786 * Use: Handles a reply with a switch request bolted onto it.
789 static int doswitchok(keyexch *kx, buf *b)
795 if (kx->s < KXS_COMMIT) {
796 a_warn("unexpected switch confirmation from `%s'", p_name(kx->p));
800 buf_init(&bb, buf_o, sizeof(buf_o));
801 if (ks_decrypt(kxc->ks, b, &bb)) {
802 a_warn("failed to decrypt switch confirmation from `%s'", p_name(kx->p));
805 buf_init(b, BBASE(&bb), BLEN(&bb));
806 if ((hswok = buf_get(b, HASHSZ)) == 0 || BLEFT(b)) {
807 a_warn("invalid switch confirmation from `%s'", p_name(kx->p));
810 IF_TRACING(T_KEYEXCH, {
811 trace_block(T_CRYPTO, "crypto: switch confirmation hash", hswok, HASHSZ);
813 if (memcmp(hswok, kxc->hswok_in, HASHSZ) != 0) {
814 a_warn("incorrect switch confirmation hash from `%s'", p_name(kx->p));
817 if (kx->s < KXS_SWITCH) {
818 ks_activate(kxc->ks);
819 settimer(kx, ks_tregen(kxc->ks));
828 /*----- Main code ---------------------------------------------------------*/
832 * Arguments: @keyexch *kx@ = pointer to key exchange context
836 * Use: Stops a key exchange dead in its tracks. Throws away all of
837 * the context information. The context is left in an
838 * inconsistent state. The only functions which understand this
839 * state are @kx_free@ and @kx_init@ (which cause it internally
840 * it), and @start@ (which expects it to be the prevailing
844 static void stop(keyexch *kx)
848 if (kx->f & KXF_TIMER)
850 for (i = 0; i < kx->nr; i++)
851 kxc_destroy(kx->r[i]);
859 * Arguments: @keyexch *kx@ = pointer to key exchange context
860 * @time_t now@ = the current time
864 * Use: Starts a new key exchange with the peer. The context must be
865 * in the bizarre state left by @stop@ or @kx_init@.
868 static void start(keyexch *kx, time_t now)
874 kx->alpha = mprand_range(MP_NEW, kpriv.dp.q, &rand_global, 0);
875 kx->c = mpmont_exp(&mg, MP_NEW, kpriv.dp.g, kx->alpha);
876 kx->rx = mpmont_exp(&mg, MP_NEW, kx->kpub.y, kx->alpha);
878 kx->t_valid = now + T_VALID;
881 HASH_STRING(&h, "tripe-cookie");
883 HASH_DONE(&h, kx->hc);
885 IF_TRACING(T_KEYEXCH, {
886 trace(T_KEYEXCH, "keyexch: creating new challenge");
887 IF_TRACING(T_CRYPTO, {
888 trace(T_CRYPTO, "crypto: secret = %s", mpstr(kx->alpha));
889 trace(T_CRYPTO, "crypto: challenge = %s", mpstr(kx->c));
890 trace(T_CRYPTO, "crypto: expected response = %s", mpstr(kx->rx));
891 trace_block(T_CRYPTO, "crypto: challenge cookie", kx->hc, HASHSZ);
896 /* --- @kx_start@ --- *
898 * Arguments: @keyexch *kx@ = pointer to key exchange context
902 * Use: Stimulates a key exchange. If a key exchage is in progress,
903 * a new challenge is sent (unless the quiet timer forbids
904 * this); if no exchange is in progress, one is commenced.
907 void kx_start(keyexch *kx)
909 time_t now = time(0);
911 if (!ISVALID(kx, now)) {
918 /* --- @kx_message@ --- *
920 * Arguments: @keyexch *kx@ = pointer to key exchange context
921 * @unsigned msg@ = the message code
922 * @buf *b@ = pointer to buffer containing the packet
926 * Use: Reads a packet containing key exchange messages and handles
930 void kx_message(keyexch *kx, unsigned msg, buf *b)
932 time_t now = time(0);
933 stats *st = p_stats(kx->p);
938 static const char *const pkname[] = {
939 "prechallenge", "cookie", "challenge",
940 "reply", "switch request", "switch confirmation"
944 if (!ISVALID(kx, now)) {
949 T( trace(T_KEYEXCH, "keyexch: processing %s packet from `%s'",
950 msg < KX_NMSG ? pkname[msg] : "unknown", p_name(kx->p)); )
956 rc = dochallenge(kx, msg, b);
962 rc = doswitch(kx, b);
965 rc = doswitchok(kx, b);
968 a_warn("unexpected key exchange message type %u from `%p'",
982 /* --- @kx_free@ --- *
984 * Arguments: @keyexch *kx@ = pointer to key exchange context
988 * Use: Frees everything in a key exchange context.
991 void kx_free(keyexch *kx)
994 dh_pubfree(&kx->kpub);
997 /* --- @kx_newkeys@ --- *
999 * Arguments: @keyexch *kx@ = pointer to key exchange context
1003 * Use: Informs the key exchange module that its keys may have
1004 * changed. If fetching the new keys fails, the peer will be
1005 * destroyed, we log messages and struggle along with the old
1009 void kx_newkeys(keyexch *kx)
1013 if (km_getpubkey(p_name(kx->p), &dp))
1015 dh_pubfree(&kx->kpub);
1017 if (kx->s != KXS_SWITCH) {
1018 T( trace(T_KEYEXCH, "keyexch: restarting key negotiation with `%s'",
1025 /* --- @kx_init@ --- *
1027 * Arguments: @keyexch *kx@ = pointer to key exchange context
1028 * @peer *p@ = pointer to peer context
1029 * @keyset **ks@ = pointer to keyset list
1031 * Returns: Zero if OK, nonzero if it failed.
1033 * Use: Initializes a key exchange module. The module currently
1034 * contains no keys, and will attempt to initiate a key
1038 int kx_init(keyexch *kx, peer *p, keyset **ks)
1042 if (km_getpubkey(p_name(p), &kx->kpub))
1049 /*----- That's all, folks -------------------------------------------------*/