j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity

Forbid protocol version rollback.

Browse source 
When we know a node's ECDSA key, we only allow communication via the SPTPS
protocol.
This commit is contained in:
Guus Sliepen 2013-07-21 00:13:38 +02:00
parent fab2965d38
commit e82bec6670
1 changed files with 11 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/protocol_auth.c
View file

@ -324,7 +324,7 @@ bool id_h(connection_t *c, const char *request) {
if(c->protocol_major != myself->connection->protocol_major) {
logger(DEBUG_ALWAYS, LOG_ERR, "Peer %s (%s) uses incompatible version %d.%d",
c->name, c->hostname, c->protocol_major, c->protocol_minor);
c->name, c->hostname, c->protocol_major, c->protocol_minor);
return false;
}
@ -346,15 +346,21 @@ bool id_h(connection_t *c, const char *request) {
return false;
}
if(experimental && c->protocol_minor >= 2) {
if(!read_ecdsa_public_key(c))
return false;
}
if(experimental)
read_ecdsa_public_key(c);
} else {
if(c->protocol_minor && !ecdsa_active(c->ecdsa))
c->protocol_minor = 1;
}
/* Forbid version rollback for nodes whose ECDSA key we know */
if(ecdsa_active(c->ecdsa) && c->protocol_minor < 2) {
logger(DEBUG_ALWAYS, LOG_ERR, "Peer %s (%s) tries to roll back protocol version to %d.%d",
c->name, c->hostname, c->protocol_major, c->protocol_minor);
return false;
}
c->allow_request = METAKEY;
if(c->protocol_minor >= 2) {