From 507b7381ed764262e78d6c8135781c24493da28b Mon Sep 17 00:00:00 2001
From: David du Colombier <0intro@gmail.com>
Date: Sat, 2 Feb 2002 00:00:00 +0000
Subject: [PATCH] Plan 9 from Bell Labs 2002-02-02

---
 port/devcap.c | 22 ++++++++++++++++------
 port/devtls.c |  2 +-
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/port/devcap.c b/port/devcap.c
index 4ed100a6b4bc935f4989407026fc00991c75f212..313e3c426a2ba359d157c6270a4f11195dfc3b8b 100644
--- a/port/devcap.c
+++ b/port/devcap.c
@@ -192,7 +192,7 @@ capwrite(Chan *c, void *va, long n, vlong)
 	Caphash *p;
 	char *cp;
 	uchar hash[Hashlen];
-	char *key, *user;
+	char *key, *from, *to;
 	char err[256];
 
 	switch((ulong)c->qid.path){
@@ -214,22 +214,32 @@ capwrite(Chan *c, void *va, long n, vlong)
 		memmove(cp, va, n);
 		cp[n] = 0;
 
-		user = cp;
-		key = strchr(cp, '@');
+		from = cp;
+		key = strrchr(cp, '@');
 		if(key == nil)
 			error(Eshort);
 		*key++ = 0;
 
-		hmac_sha1((uchar*)user, strlen(user), (uchar*)key, strlen(key), hash, nil);
+		hmac_sha1((uchar*)from, strlen(from), (uchar*)key, strlen(key), hash, nil);
 
 		p = remcap(hash);
 		if(p == nil){
-			snprint(err, sizeof err, "invalid capability %s@%s", user, key);
+			snprint(err, sizeof err, "invalid capability %s@%s", from, key);
 			error(err);
 		}
 
+		/* if a from user is supplied, make sure it matches */
+		to = strchr(from, '@');
+		if(to == nil){
+			to = from;
+		} else {
+			*to++ = 0;
+			if(strcmp(from, up->user) != 0)
+				error("capability must match user");
+		}
+
 		/* set user id */
-		kstrdup(&up->user, user);
+		kstrdup(&up->user, to);
 		up->basepri = PriNormal;
 
 		free(p);
diff --git a/port/devtls.c b/port/devtls.c
index 51f99e4139ed79106dc5d9f8d874e3d69dbb7543..d06065f4e793c8f36d199038a5f427a21c2752a1 100644
--- a/port/devtls.c
+++ b/port/devtls.c
@@ -164,7 +164,7 @@ static TlsErrs tlserrs[] = {
 	{EDecodeError,			EIllegalParameter,		EDecodeError,			1, "error decoding message"},
 	{EDecryptError,			EIllegalParameter,		EDecryptError,			1, "error decrypting message"},
 	{EExportRestriction,		EHandshakeFailure,		EExportRestriction,		1, "export restriction violated"},
-	{EProtocolVersion,		EIllegalParameter,		EProtocolVersion,		1, "protocol version not supported"},
+	{EProtocolVersion,		EIllegalParameter,		EProtocolVersion,		0, "protocol version not supported"},
 	{EInsufficientSecurity,	EHandshakeFailure,		EInsufficientSecurity,	1, "stronger security routines required"},
 	{EInternalError,			EHandshakeFailure,		EInternalError,			1, "internal error"},
 	{EUserCanceled,		ECloseNotify,			EUserCanceled,			0, "handshake canceled by user"},