ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.7 by pcg, Sat Apr 5 17:54:22 2003 UTC vs.
Revision 1.10 by pcg, Sun Apr 6 18:12:18 2003 UTC

… …
197// only do action once every x seconds per host whole allowing bursts. 197// only do action once every x seconds per host whole allowing bursts.
198// this implementation ("splay list" ;) is inefficient, 198// this implementation ("splay list" ;) is inefficient,
199// but low on resources. 199// but low on resources.
200struct net_rate_limiter : list<net_rateinfo> 200struct net_rate_limiter : list<net_rateinfo>
201{ 201{
202 static const double ALPHA = 1. - 1. / 90.; // allow bursts 202 static const double ALPHA = 1. - 1. / 180.; // allow bursts
203 static const double CUTOFF = 20.; // one event every CUTOFF seconds 203 static const double CUTOFF = 10.; // one event every CUTOFF seconds
204 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 204 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
205 static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value
205 206
206 bool can (const sockinfo &si) { return can((u32)si.host); } 207 bool can (const sockinfo &si) { return can((u32)si.host); }
207 bool can (u32 host); 208 bool can (u32 host);
208}; 209};
209 210
… …
225 { 226 {
226 net_rateinfo ri; 227 net_rateinfo ri;
227 228
228 ri.host = host; 229 ri.host = host;
229 ri.pcnt = 1.; 230 ri.pcnt = 1.;
230 ri.diff = CUTOFF * (1. / (1. - ALPHA)); 231 ri.diff = MAXDIF;
231 ri.last = NOW; 232 ri.last = NOW;
232 233
233 push_front (ri); 234 push_front (ri);
234 235
235 return true; 236 return true;
… …
242 ri.pcnt = ri.pcnt * ALPHA; 243 ri.pcnt = ri.pcnt * ALPHA;
243 ri.diff = ri.diff * ALPHA + (NOW - ri.last); 244 ri.diff = ri.diff * ALPHA + (NOW - ri.last);
244 245
245 ri.last = NOW; 246 ri.last = NOW;
246 247
248 double dif = ri.diff / ri.pcnt;
249
247 bool send = ri.diff / ri.pcnt > CUTOFF; 250 bool send = dif > CUTOFF;
248 251
252 if (dif > MAXDIF)
253 {
254 ri.pcnt = 1.;
255 ri.diff = MAXDIF;
256 }
249 if (send) 257 else if (send)
250 ri.pcnt++; 258 ri.pcnt++;
251 259
252 push_front (ri); 260 push_front (ri);
253 261
254 return send; 262 return send;
… …
546}; 554};
547 555
548///////////////////////////////////////////////////////////////////////////// 556/////////////////////////////////////////////////////////////////////////////
549 557
550void 558void
559connection::connection_established ()
560{
561 if (ictx && octx)
562 {
563 connectmode = conf->connectmode;
564
565 rekey.start (NOW + ::conf.rekey);
566 keepalive.start (NOW + ::conf.keepalive);
567
568 // send queued packets
569 if (ictx && octx)
570 while (tap_packet *p = queue.get ())
571 {
572 send_data_packet (p);
573 delete p;
574 }
575 }
576 else
577 {
578 retry_cnt = 0;
579 establish_connection.start (NOW + 5);
580 keepalive.reset ();
581 rekey.reset ();
582 }
583}
584
585void
551connection::reset_dstaddr () 586connection::reset_si ()
552{ 587{
553 protocol = best_protocol (THISNODE->protocols & conf->protocols); 588 protocol = best_protocol (THISNODE->protocols & conf->protocols);
554 589
555 // mask out protocols we cannot establish 590 // mask out protocols we cannot establish
556 if (!conf->udp_port) protocol &= ~PROT_UDPv4; 591 if (!conf->udp_port) protocol &= ~PROT_UDPv4;
557 if (!conf->tcp_port) protocol &= ~PROT_TCPv4; 592 if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
558 593
559 si.set (conf, protocol); 594 si.set (conf, protocol);
560} 595}
561 596
597// ensure sockinfo is valid, forward if necessary
598const sockinfo &
599connection::forward_si (const sockinfo &si) const
600{
601 if (!si.valid ())
602 {
603 connection *r = vpn->find_router ();
604
605 if (r)
606 {
607 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"),
608 conf->nodename, r->conf->nodename);
609 return r->si;
610 }
611 else
612 slog (L_DEBUG, _("%s: node unreachable, no common protocol"),
613 conf->nodename);
614 }
615
616 return si;
617}
618
619void
620connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
621{
622 if (!vpn->send_vpn_packet (pkt, si, tos))
623 reset_connection ();
624}
625
562void 626void
563connection::send_ping (const sockinfo &si, u8 pong) 627connection::send_ping (const sockinfo &si, u8 pong)
564{ 628{
565 ping_packet *pkt = new ping_packet; 629 ping_packet *pkt = new ping_packet;
566 630
567 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 631 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
568 vpn->send_vpn_packet (pkt, si, IPTOS_LOWDELAY); 632 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
569 633
570 delete pkt; 634 delete pkt;
571} 635}
572 636
573void 637void
… …
576 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED) 640 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
577 { 641 {
578 config_packet *pkt = new config_packet; 642 config_packet *pkt = new config_packet;
579 643
580 pkt->setup (vpn_packet::PT_RESET, conf->id); 644 pkt->setup (vpn_packet::PT_RESET, conf->id);
581 vpn->send_vpn_packet (pkt, si, IPTOS_MINCOST); 645 send_vpn_packet (pkt, si, IPTOS_MINCOST);
582 646
583 delete pkt; 647 delete pkt;
584 } 648 }
585} 649}
586 650
… …
598 conf->rsa_key, RSA_PKCS1_OAEP_PADDING)) 662 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
599 fatal ("RSA_public_encrypt error"); 663 fatal ("RSA_public_encrypt error");
600 664
601 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 665 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
602 666
603 vpn->send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 667 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
604 668
605 delete pkt; 669 delete pkt;
606} 670}
607 671
608void 672void
… …
616 680
617 pkt->hmac_set (octx); 681 pkt->hmac_set (octx);
618 682
619 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si); 683 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);
620 684
621 vpn->send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 685 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
622 686
623 delete pkt; 687 delete pkt;
624} 688}
625 689
626void 690void
… …
630 conf->id, rid, (const char *)rsi); 694 conf->id, rid, (const char *)rsi);
631 695
632 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols); 696 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
633 697
634 r->hmac_set (octx); 698 r->hmac_set (octx);
635 vpn->send_vpn_packet (r, si); 699 send_vpn_packet (r, si);
636 700
637 delete r; 701 delete r;
638} 702}
639 703
640void 704void
… …
651 if (retry_int < 3600 * 8) 715 if (retry_int < 3600 * 8)
652 retry_cnt++; 716 retry_cnt++;
653 717
654 w.at = NOW + retry_int; 718 w.at = NOW + retry_int;
655 719
656 if (conf->hostname) 720 reset_si ();
721
722 if (si.prot && !si.host)
723 vpn->send_connect_request (conf->id);
724 else
657 { 725 {
658 reset_dstaddr (); 726 const sockinfo &dsi = forward_si (si);
659 727
660 if (si.valid () && auth_rate_limiter.can (si)) 728 if (dsi.valid () && auth_rate_limiter.can (dsi))
661 { 729 {
662 if (retry_cnt < 4) 730 if (retry_cnt < 4)
663 send_auth_request (si, true); 731 send_auth_request (dsi, true);
664 else 732 else
665 send_ping (si, 0); 733 send_ping (dsi, 0);
666 } 734 }
667 } 735 }
668 else
669 vpn->connect_request (conf->id);
670 } 736 }
671} 737}
672 738
673void 739void
674connection::reset_connection () 740connection::reset_connection ()
… …
723 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 789 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
724 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4 790 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
725 tos = (*pkt)[15] & IPTOS_TOS_MASK; 791 tos = (*pkt)[15] & IPTOS_TOS_MASK;
726 792
727 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 793 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
728 vpn->send_vpn_packet (p, si, tos); 794 send_vpn_packet (p, si, tos);
729 795
730 delete p; 796 delete p;
731 797
732 if (oseqno > MAX_SEQNO) 798 if (oseqno > MAX_SEQNO)
733 rekey (); 799 rekey ();
… …
743 if (!broadcast)//DDDD 809 if (!broadcast)//DDDD
744 queue.put (new tap_packet (*pkt)); 810 queue.put (new tap_packet (*pkt));
745 811
746 establish_connection (); 812 establish_connection ();
747 } 813 }
814}
815
816void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
817{
818 if (ictx && octx)
819 send_vpn_packet (pkt, si, tos);
820 else
821 establish_connection ();
748} 822}
749 823
750void 824void
751connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 825connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
752{ 826{
… …
815 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING)) 889 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
816 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 890 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
817 conf->nodename, (const char *)rsi); 891 conf->nodename, (const char *)rsi);
818 else 892 else
819 { 893 {
820 retry_cnt = 0;
821 establish_connection.start (NOW + 8); //? ;)
822 keepalive.reset ();
823 rekey.reset ();
824
825 delete ictx;
826 ictx = 0;
827
828 delete octx; 894 delete octx;
829 895
830 octx = new crypto_ctx (k, 1); 896 octx = new crypto_ctx (k, 1);
831 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 897 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
832 898
833 conf->protocols = p->protocols; 899 conf->protocols = p->protocols;
900
834 send_auth_response (rsi, p->id, k); 901 send_auth_response (rsi, p->id, k);
902
903 connection_established ();
835 904
836 break; 905 break;
837 } 906 }
838 } 907 }
839 908
… …
883 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 952 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
884 953
885 si = rsi; 954 si = rsi;
886 protocol = rsi.prot; 955 protocol = rsi.prot;
887 956
888 rekey.start (NOW + ::conf.rekey); 957 connection_established ();
889 keepalive.start (NOW + ::conf.keepalive);
890
891 // send queued packets
892 while (tap_packet *p = queue.get ())
893 {
894 send_data_packet (p);
895 delete p;
896 }
897
898 connectmode = conf->connectmode;
899 958
900 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"), 959 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
901 conf->nodename, (const char *)rsi, 960 conf->nodename, (const char *)rsi,
902 p->prot_major, p->prot_minor); 961 p->prot_major, p->prot_minor);
903 962
… …
929 988
930 if (ictx && octx) 989 if (ictx && octx)
931 { 990 {
932 vpndata_packet *p = (vpndata_packet *)pkt; 991 vpndata_packet *p = (vpndata_packet *)pkt;
933 992
934 if (rsi == si) 993 if (!p->hmac_chk (ictx))
994 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
995 "could be an attack, or just corruption or an synchronization error"),
996 conf->nodename, (const char *)rsi);
997 else
935 { 998 {
936 if (!p->hmac_chk (ictx))
937 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
938 "could be an attack, or just corruption or an synchronization error"),
939 conf->nodename, (const char *)rsi);
940 else 999 u32 seqno;
1000 tap_packet *d = p->unpack (this, seqno);
1001
1002 if (iseqno.recv_ok (seqno))
941 { 1003 {
942 u32 seqno; 1004 vpn->tap->send (d);
943 tap_packet *d = p->unpack (this, seqno);
944 1005
945 if (iseqno.recv_ok (seqno)) 1006 if (p->dst () == 0) // re-broadcast
1007 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
1008 {
1009 connection *c = *i;
1010
1011 if (c->conf != THISNODE && c->conf != conf)
1012 c->inject_data_packet (d);
1013 }
1014
1015 if (si != rsi)
946 { 1016 {
947 vpn->tap->send (d); 1017 // fast re-sync on conneciton changes, useful especially for tcp/ip
948
949 if (p->dst () == 0) // re-broadcast
950 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
951 {
952 connection *c = *i;
953
954 if (c->conf != THISNODE && c->conf != conf)
955 c->inject_data_packet (d);
956 }
957
958 delete d;
959
960 break; 1018 si = rsi;
1019
1020 slog (L_INFO, _("%s(%s): socket address changed to %s"),
1021 conf->nodename, (const char *)si, (const char *)rsi);
961 } 1022 }
1023
1024 delete d;
1025
1026 break;
962 } 1027 }
963 } 1028 }
964 else
965 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
966 } 1029 }
967 1030
968 send_reset (rsi); 1031 send_reset (rsi);
969 break; 1032 break;
970 1033
… …
1004 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf)); 1067 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1005 p->si.upgrade_protocol (protocol, c->conf); 1068 p->si.upgrade_protocol (protocol, c->conf);
1006 1069
1007 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1070 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1008 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1071 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1009 //slog (L_ERR, "%d PROTOCL(C%x,T%x,0S%x,S%x,P%x,SP%x)",
1010 // p->id, c->conf->protocols, THISNODE->protocols, p->si.supported_protocols(0), p->si.supported_protocols (c->conf),
1011 // protocol, p->si.prot);
1012 1072
1073 const sockinfo &dsi = forward_si (p->si);
1074
1075 if (dsi.valid ())
1013 c->send_auth_request (p->si, true); 1076 c->send_auth_request (dsi, true);
1014 } 1077 }
1015 1078
1016 break; 1079 break;
1017 1080
1018 default: 1081 default:
… …
1038 } 1101 }
1039 else 1102 else
1040 reset_connection (); 1103 reset_connection ();
1041} 1104}
1042 1105
1043void connection::connect_request (int id) 1106void connection::send_connect_request (int id)
1044{ 1107{
1045 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1108 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1046 1109
1047 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1110 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);
1048 p->hmac_set (octx); 1111 p->hmac_set (octx);
1049 vpn->send_vpn_packet (p, si); 1112 send_vpn_packet (p, si);
1050 1113
1051 delete p; 1114 delete p;
1052} 1115}
1053 1116
1054void connection::script_node () 1117void connection::script_node ()

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines