// Executes the server side authentication and returns either the agreed secret // session key or the a failure reason. func (l *Listener) serverAuth(strm *stream.Stream, req *authRequest) ([]byte, error) { // Create a new STS session stsSess, err := sts.New(rand.Reader, config.StsGroup, config.StsGenerator, config.StsCipher, config.StsCipherBits, config.StsSigHash) if err != nil { return nil, fmt.Errorf("failed to create STS session: %v", err) } // Accept the incoming key exchange request and send back own exp + auth token exp, token, err := stsSess.Accept(rand.Reader, l.key, req.Exp) if err != nil { return nil, fmt.Errorf("failed to accept incoming exchange: %v", err) } if err = strm.Send(authChallenge{exp, token}); err != nil { return nil, fmt.Errorf("failed to encode auth challenge: %v", err) } if err = strm.Flush(); err != nil { return nil, fmt.Errorf("failed to flush auth challenge: %v", err) } // Receive the foreign auth token and if verifies conclude session resp := new(authResponse) if err = strm.Recv(resp); err != nil { return nil, fmt.Errorf("failed to decode auth response: %v", err) } if err = stsSess.Finalize(&l.key.PublicKey, resp.Token); err != nil { return nil, fmt.Errorf("failed to finalize exchange: %v", err) } return stsSess.Secret() }
// Initializes a stream into an encrypted tunnel link. func (c *Connection) initClientTunnel(strm *stream.Stream, remote uint64, id uint64, key []byte, deadline time.Time) (*link.Link, error) { // Set a socket deadline for finishing the handshake strm.Sock().SetDeadline(deadline) defer strm.Sock().SetDeadline(time.Time{}) // Send the unencrypted tunnel id to associate with the remote tunnel init := &initPacket{ConnId: remote, TunId: id} if err := strm.Send(init); err != nil { return nil, err } // Create the encrypted link and authorize it hasher := func() hash.Hash { return config.HkdfHash.New() } hkdf := hkdf.New(hasher, key, config.HkdfSalt, config.HkdfInfo) conn := link.New(strm, hkdf, false) // Send and retrieve an authorization to verify both directions auth := &proto.Message{ Head: proto.Header{ Meta: &authPacket{Id: id}, }, } if err := conn.SendDirect(auth); err != nil { return nil, err } if msg, err := conn.RecvDirect(); err != nil { return nil, err } else if auth, ok := msg.Head.Meta.(*authPacket); !ok || auth.Id != id { return nil, errors.New("protocol violation") } conn.Start(config.IrisTunnelBuffer) // Return the initialized link return conn, nil }
// Client side of the STS session negotiation. func clientAuth(strm *stream.Stream, key *rsa.PrivateKey) ([]byte, error) { // Set an overall time limit for the handshake to complete strm.Sock().SetDeadline(time.Now().Add(config.SessionShakeTimeout)) defer strm.Sock().SetDeadline(time.Time{}) // Create a new empty session stsSess, err := sts.New(rand.Reader, config.StsGroup, config.StsGenerator, config.StsCipher, config.StsCipherBits, config.StsSigHash) if err != nil { return nil, fmt.Errorf("failed to create new session: %v", err) } // Initiate a key exchange, send the exponential exp, err := stsSess.Initiate() if err != nil { return nil, fmt.Errorf("failed to initiate key exchange: %v", err) } req := &initRequest{ Auth: &authRequest{exp}, } if err = strm.Send(req); err != nil { return nil, fmt.Errorf("failed to send auth request: %v", err) } if err = strm.Flush(); err != nil { return nil, fmt.Errorf("failed to flush auth request: %v", err) } // Receive the foreign exponential and auth token and if verifies, send own auth chall := new(authChallenge) if err = strm.Recv(chall); err != nil { return nil, fmt.Errorf("failed to receive auth challenge: %v", err) } token, err := stsSess.Verify(rand.Reader, key, &key.PublicKey, chall.Exp, chall.Token) if err != nil { return nil, fmt.Errorf("failed to verify acceptor auth token: %v", err) } if err = strm.Send(authResponse{token}); err != nil { return nil, fmt.Errorf("failed to send auth response: %v", err) } if err = strm.Flush(); err != nil { return nil, fmt.Errorf("failed to flush auth response: %v", err) } return stsSess.Secret() }