control/noise: include the protocol version in the Noise prologue.

Signed-off-by: David Anderson <danderson@tailscale.com>
pull/3293/head
David Anderson 3 years ago committed by Dave Anderson
parent 5e005a658f
commit 89a68a4c22

@ -24,6 +24,11 @@ import (
const (
protocolName = "Noise_IK_25519_ChaChaPoly_BLAKE2s"
// protocolVersion is the version string that gets included as the
// Noise "prologue" in the handshake. It exists so that we can
// ensure that peer have agreed on the protocol version they're
// executing, to defeat some MITM protocol downgrade attacks.
protocolVersion = "Tailscale Control Protocol v1"
invalidNonce = ^uint64(0)
)
@ -227,8 +232,7 @@ func (s *symmetricState) Initialize() {
s.k = [chp.KeySize]byte{}
s.n = invalidNonce
s.mixer = newBLAKE2s()
// Mix in an empty prologue.
s.MixHash(nil)
s.MixHash([]byte(protocolVersion))
}
// MixHash updates s.h to be BLAKE2s(s.h || data), where || is

@ -120,7 +120,7 @@ func noiseExplorerClient(conn net.Conn, controlKey key.Public, machineKey key.Pr
private_key: machineKey,
public_key: machineKey.Public(),
}
session := InitSession(true, nil, mk, controlKey)
session := InitSession(true, []byte(protocolVersion), mk, controlKey)
_, msg1 := SendMessage(&session, nil)
if _, err := conn.Write(msg1.ne[:]); err != nil {
@ -182,7 +182,7 @@ func noiseExplorerServer(conn net.Conn, controlKey key.Private, wantMachineKey k
private_key: controlKey,
public_key: controlKey.Public(),
}
session := InitSession(false, nil, mk, [32]byte{})
session := InitSession(false, []byte(protocolVersion), mk, [32]byte{})
var buf [1024]byte
if _, err := io.ReadFull(conn, buf[:96]); err != nil {

Loading…
Cancel
Save