diff options
| author |   Bin Jin <bjin@ctrl-d.org> | 2017-03-13 17:41:54 +0800 |
|---|---|---|
| committer | Bin Jin <bjin@ctrl-d.org> | 2017-03-13 17:44:18 +0800 |
| commit | 041bdf8c84d141ec81fdb363e0a20f56721e31c4 (patch) | |
| tree | abbbbe3c01321c654a8e7fd1558f936317fe5b4a /src/Network | |
| parent | README: more details with stack, minor changes (diff) | |
| download | wireguard-hs-041bdf8c84d141ec81fdb363e0a20f56721e31c4.tar.xz wireguard-hs-041bdf8c84d141ec81fdb363e0a20f56721e31c4.zip | |
Use dhPubEq for publickey equality check
Dependency on the fixed cacophony commit was accidentally removed.
Diffstat (limited to 'src/Network')
| -rw-r--r-- | src/Network/WireGuard/Core.hs | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/src/Network/WireGuard/Core.hs b/src/Network/WireGuard/Core.hs index e37554b..beb4e36 100644 --- a/src/Network/WireGuard/Core.hs +++ b/src/Network/WireGuard/Core.hs @@ -14,7 +14,8 @@ import Control.Monad.STM (atomically) import Control.Monad.Trans.Except (ExceptT, runExceptT, throwE) import Crypto.Noise (HandshakeRole (..)) -import Crypto.Noise.DH (dhGenKey, dhPubToBytes) +import Crypto.Noise.DH (dhGenKey, dhPubEq, + dhPubToBytes) import qualified Data.ByteArray as BA import qualified Data.ByteString as BS import qualified Data.HashMap.Strict as HM @@ -216,11 +217,11 @@ processPacket device@Device{..} _key _psk sock PacketData{..} = do IPv4Packet src4 _ -> do peer' <- assertJust SourceAddrBlockedError $ RT.lookup (makeAddrRange src4 32) <$> liftIO (readTVarIO routeTable4) - when (remotePub peer /= remotePub peer') $ throwE SourceAddrBlockedError + unless (remotePub peer `dhPubEq` remotePub peer') $ throwE SourceAddrBlockedError IPv6Packet src6 _ -> do peer' <- assertJust SourceAddrBlockedError $ RT.lookup (makeAddrRange src6 128) <$> liftIO (readTVarIO routeTable6) - when (remotePub peer /= remotePub peer') $ throwE SourceAddrBlockedError + unless (remotePub peer `dhPubEq` remotePub peer') $ throwE SourceAddrBlockedError liftIO $ atomically $ writeTVar (lastReceiveTime peer) now liftIO $ atomically $ modifyTVar' (receivedBytes peer) (+fromIntegral (BA.length decryptedPayload)) else do @@ -281,8 +282,8 @@ checkAndTryInitiateHandshake device key psk chan peer@Peer{..} endp now = do ma <- readTVar tvar case ma of Just a | now > getStopTime a -> erase >> return False - Just _ -> return True - Nothing -> return False + Just _ -> return True + Nothing -> return False tryInitiateHandshakeIfEmpty :: Device -> KeyPair -> Maybe PresharedKey |