add hmac to REQ_GET_PUBKEY

client/main.go

@@ -118,13 +118,7 @@ func receivePackets() {
 }
 
 func handleIncomingPkt(pkt []byte) {
-	defer func() {
-		if r := recover(); r != nil {
-			log.Printf("recovered from panic while handling a packet: %v\n", r)
-		}
-	}()
-
-	if len(pkt) < 4 {
+	if len(pkt) <= 4 {
 		log.Println("packet too short")
 		return
 	}
@@ -138,13 +132,13 @@ func handleIncomingPkt(pkt []byte) {
 
 	switch pktType {
 	case shared.RESP_GET_CHALLENGE:
-		if !verifyPacket(pkt) {
+		if !verifyPkt(pkt) {
 			log.Println("failed to verify signature")
 			return
 		}
 		challengeCh <- pkt[2424:]
 	case shared.RESP_REGISTER:
-		if !verifyPacket(pkt) {
+		if !verifyPkt(pkt) {
 			log.Println("failed to verify signature")
 			return
 		}
@@ -183,7 +177,7 @@ func handleIncomingPkt(pkt []byte) {
 			log.Println(err)
 		}
 	case shared.RESP_GET_PUBKEY:
-		if !verifyPacket(pkt) {
+		if !verifyPkt(pkt) {
 			log.Println("failed to verify signature")
 			return
 		}
@@ -239,7 +233,7 @@ func getOrEstablishSessionKey(ip string) []byte {
 		time.Sleep(50 * time.Millisecond)
 		peerPubKey, ok := peerPubKeys.GetOK(ip)
 		if !ok {
-			send(shared.BuildPkt(shared.REQ_GET_PUBKEY, net.ParseIP(ip)))
+			send(buildAuthPkt(shared.REQ_GET_PUBKEY, net.ParseIP(ip)))
 			continue
 		}
 
@@ -329,6 +323,7 @@ func relayPackets() {
 func buildAuthPkt(pktType uint16, parts ...[]byte) []byte {
 	pkt := shared.BuildPkt(pktType, parts...)
 	mac := hmac.New(sha256.New, authSecret)
+	// this ignores version and packet type, fine for now
 	mac.Write(pkt[4:])
 	return append(pkt[:4], append(mac.Sum(nil), pkt[4:]...)...)
 }
@@ -339,15 +334,16 @@ func send(req []byte) {
 	}
 }
 
-func verifyPacket(pkt []byte) bool {
+func verifyPkt(pkt []byte) bool {
 	pubKeyBytes, err := hex.DecodeString(SERVER_PUBKEY)
 	if err != nil {
-		panic(err)
+		panic(err) // fatal misconfiguration
 	}
 	var pubKey mldsa44.PublicKey
 	if err := pubKey.UnmarshalBinary(pubKeyBytes); err != nil {
-		panic(err)
+		panic(err) // fatal misconfiguration
 	}
 
+	// this ignores version and packet type, fine for now
 	return mldsa44.Verify(&pubKey, pkt[2424:], nil, pkt[4:2424])
 }