r16432@catbus: nickm | 2007-11-05 14:18:57 -0500

 Send and parse link_auth cells properly.


svn:r12386

3 files changed, 63 insertions, 7 deletions

diff --git a/src/or/command.c b/src/or/command.c
index dcb713f73c..e33fe8036b 100644
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -432,15 +432,22 @@ command_process_versions_cell(cell_t *cell, or_connection_t *conn)
   if (!highest_supported_version) {
     log_fn(LOG_PROTOCOL_WARN, LD_OR,
            "Couldn't find a version in common; defaulting to v1.");
-    /*XXXX020 just break the connection?*/
+    /*XXXX020 just break the connection! */
     conn->link_proto = 1;
     return;
   }
   conn->link_proto = highest_supported_version;
   conn->handshake_state->received_versions = 1;
 
-  if (highest_supported_version >= 2)
+  if (highest_supported_version >= 2) {
+    /*XXXX020 check return values. */
     connection_or_send_netinfo(conn);
+    connection_or_send_cert(conn);
+    if (conn->handshake_state->started_here)
+      connection_or_send_link_auth(conn);
+  } else {
+    /* XXXX020 finish v1 verification. */
+  }
 }
 
 /** Process a 'netinfo' cell. DOCDOC say more. */
@@ -576,6 +583,7 @@ command_process_link_auth_cell(cell_t *cell, or_connection_t *conn)
 {
   or_handshake_state_t *s;
   char hmac[DIGEST_LEN];
+  uint16 len;
   size_t sig_len;
   const char *sig;
   char *checked = NULL;
@@ -599,7 +607,13 @@ command_process_link_auth_cell(cell_t *cell, or_connection_t *conn)
            "closing the connection");
     goto err;
   }
-  if (cell->payload[0] != 0x00) {
+  len = ntohs(get_uint16(cell.payload));
+  if (len < 2 || 2+len > CELL_PAYLOAD_SIZE) {
+    log_fn(LOG_PROTOCOL_WARN, LD_OR, "Bad length field (%d) on LINK_AUTH cell;"
+           " closing the connection", (int)len);
+    goto err;
+  }
+  if (cell->payload[2] != 0x00) {
     log_fn(LOG_PROTOCOL_WARN, LD_OR, "Unrecognized LINK_AUTH signature "
            "version; closing the connection");
     goto err;
@@ -608,9 +622,8 @@ command_process_link_auth_cell(cell_t *cell, or_connection_t *conn)
 
   tor_assert(s->signing_key);
 
-  /*XXXX020 these two are wrong; fix when protocol is revised. */
-  sig = cell->payload+1;
-  sig_len = 128;
+  sig = cell->payload+3;
+  sig_len = len-1;
   checked = tor_malloc(crypto_pk_keysize(s->signing_key));
   checked_len = crypto_pk_public_checksig(s->signing_key,checked,sig,sig_len);
   if (checked_len < 0) {
diff --git a/src/or/connection_or.c b/src/or/connection_or.c
index a75d6df7d8..93f4d5d7b1 100644
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@ -980,4 +980,47 @@ connection_or_compute_link_auth_hmac(or_connection_t *conn,
   return 0;
 }
 
+/**DOCDOC*/
+int
+connection_or_send_cert(or_connection_t *conn)
+{
+  (void)conn;
+  /*XXX020 implement.*/
+  return 0;
+}
+
+/**DOCDOC*/
+int
+connection_or_send_link_auth(or_connection_t *conn)
+{
+  cell_t cell;
+  char hmac[DIGEST_LEN];
+  crypto_pk_env_t *key;
+  int r, len;
 
+  tor_assert(conn);
+  tor_assert(conn->tls);
+  tor_assert(conn->handshake_state);
+  tor_assert(conn->handshake_state->started_here == 1);
+  tor_assert(conn->handshake_state->received_certs == 1);
+
+  memset(&cell, 0, sizeof(cell));
+  cell.command = CELL_LINK_AUTH;
+  key = tor_tls_dup_private_key(conn->tls);
+  connection_or_compute_link_auth_hmac(conn, hmac);
+
+  cell.payload[2] = 0x00; /* Signature version */
+  r = crypto_pk_private_sign(key, cell.payload+3, hmac, sizeof(hmac));
+  crypto_free_pk_env(key);
+  if (r<0)
+    return -1;
+  len = r + 1;
+
+  set_uint16(cell.payload, htons(len));
+
+  connection_or_write_cell_to_buf(&cell, conn);
+
+  /* XXXX020 at this point, as a client, we can consider ourself
+   * authenticated. */
+  return 0;
+}
diff --git a/src/or/or.h b/src/or/or.h
index 87914e3c3c..8dd6dc806c 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -2780,7 +2780,7 @@ void connection_or_write_cell_to_buf(const cell_t *cell,
 int connection_or_send_destroy(uint16_t circ_id, or_connection_t *conn,
                                int reason);
 int connection_or_send_netinfo(or_connection_t *conn);
-int connection_or_send_certs(or_connection_t *conn);
+int connection_or_send_cert(or_connection_t *conn);
 int connection_or_send_link_auth(or_connection_t *conn);
 int connection_or_compute_link_auth_hmac(or_connection_t *conn,
                                          char *hmac_out);