toni/baalvpn
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

check inner packet srcIP against server-verified srcIP, Windows support

Browse Source
This commit is contained in:
Antoni Piasecki
2026-07-24 23:49:42 +02:00
parent 48811df6ed
commit 2b1de6460a
8 changed files with 219 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
server/main.go
View File

@@ -217,7 +217,7 @@ func handleReq(req []byte, addr *net.UDPAddr) {
log.Println(srcIP + " -/> " + destIP + " (unrecognized IP)")
}
case shared.BROADCAST_PKT:
if len(req) <= 36 {
if len(req) <= 52 {
log.Println("BROADCAST_PKT packet too short")
return
}
@@ -227,6 +227,12 @@ func handleReq(req []byte, addr *net.UDPAddr) {
return
}
srcIP := net.IP(req[36:52]).String()
if srcIP != peer.InternalIP {
log.Println("rejected spoofed srcIP in BROADCAST_PKT")
return
}
mac := hmac.New(sha256.New, peer.AuthSecret)
mac.Write(req[36:])
if !hmac.Equal(mac.Sum(nil), req[4:36]) {
@@ -241,17 +247,23 @@ func handleReq(req []byte, addr *net.UDPAddr) {
log.Println("REQ_GET_PUBKEY packet too short")
return
}
peerIP := net.IP(req[36:52]).String()
peer := peersByInternal.Get(peerIP)
if peer != nil {
mac := hmac.New(sha256.New, peer.AuthSecret)
mac.Write(req[36:])
if !hmac.Equal(mac.Sum(nil), req[4:36]) {
log.Println("failed to authenticate REQ_GET_PUBKEY")
return
}
pubKey, err := hex.DecodeString(peer.HexPublicKey)
peer := peers.Get(addr.String())
if peer == nil {
log.Println("REQ_GET_PUBKEY from unregistered peer:", addr.String())
return
}
mac := hmac.New(sha256.New, peer.AuthSecret)
mac.Write(req[36:])
if !hmac.Equal(mac.Sum(nil), req[4:36]) {
log.Println("failed to authenticate REQ_GET_PUBKEY")
return
}
peerIP := net.IP(req[36:52]).String()
targetPeer := peersByInternal.Get(peerIP)
if targetPeer != nil {
pubKey, err := hex.DecodeString(targetPeer.HexPublicKey)
if err != nil {
panic(err) // should never happen
}