ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.69 by pcg, Thu Aug 7 17:54:26 2008 UTC vs.
Revision 1.93 by root, Tue Feb 15 13:31:23 2011 UTC

1/* 1/*
2 connection.C -- manage a single connection 2 connection.C -- manage a single connection
3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify it 7 GVPE is free software; you can redistribute it and/or modify it
8 under the terms of the GNU General Public License as published by the 8 under the terms of the GNU General Public License as published by the
… …
30*/ 30*/
31 31
32#include "config.h" 32#include "config.h"
33 33
34#include <list> 34#include <list>
35#include <queue>
36#include <utility>
35 37
36#include <openssl/rand.h> 38#include <openssl/rand.h>
37#include <openssl/evp.h> 39#include <openssl/evp.h>
38#include <openssl/rsa.h> 40#include <openssl/rsa.h>
39#include <openssl/err.h> 41#include <openssl/err.h>
… …
48 50
49#if !HAVE_RAND_PSEUDO_BYTES 51#if !HAVE_RAND_PSEUDO_BYTES
50# define RAND_pseudo_bytes RAND_bytes 52# define RAND_pseudo_bytes RAND_bytes
51#endif 53#endif
52 54
53#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 55#define MAGIC_OLD "vped\xbd\xc6\xdb\x82" // 8 bytes of magic (still used in the protocol)
56#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic (understood but not generated)
54 57
55#define ULTRA_FAST 1 58#define ULTRA_FAST 1
56#define HLOG 15 59#define HLOG 15
57#include "lzf/lzf.h" 60#include "lzf/lzf.h"
58#include "lzf/lzf_c.c" 61#include "lzf/lzf_c.c"
59#include "lzf/lzf_d.c" 62#include "lzf/lzf_d.c"
63
64//////////////////////////////////////////////////////////////////////////////
65
66static std::queue< std::pair<run_script_cb *, const char *> > rs_queue;
67static ev::child rs_child_ev;
68
69namespace
70{
71 void // c++ requires external linkage here, apparently :(
72 rs_child_cb (ev::child &w, int revents)
73 {
74 w.stop ();
75
76 if (rs_queue.empty ())
77 return;
78
79 pid_t pid = run_script (*rs_queue.front ().first, false);
80 if (pid)
81 {
82 w.set (pid);
83 w.start ();
84 }
85 else
86 slog (L_WARN, rs_queue.front ().second);
87
88 delete rs_queue.front ().first;
89 rs_queue.pop ();
90 }
91};
92
93// despite the fancy name, this is quite a hack
94static void
95run_script_queued (run_script_cb *cb, const char *warnmsg)
96{
97 rs_queue.push (std::make_pair (cb, warnmsg));
98
99 if (!rs_child_ev.is_active ())
100 {
101 rs_child_ev.set<rs_child_cb> ();
102 rs_child_ev ();
103 }
104}
105
106//////////////////////////////////////////////////////////////////////////////
60 107
61struct crypto_ctx 108struct crypto_ctx
62{ 109{
63 EVP_CIPHER_CTX cctx; 110 EVP_CIPHER_CTX cctx;
64 HMAC_CTX hctx; 111 HMAC_CTX hctx;
… …
147 cleaner.set (RSA_TTL, RSA_TTL); 194 cleaner.set (RSA_TTL, RSA_TTL);
148 } 195 }
149 196
150} rsa_cache; 197} rsa_cache;
151 198
199void
152void rsa_cache::cleaner_cb (ev::timer &w, int revents) 200rsa_cache::cleaner_cb (ev::timer &w, int revents)
153{ 201{
154 if (empty ()) 202 if (empty ())
155 w.stop (); 203 w.stop ();
156 else 204 else
157 { 205 {
… …
182 delete p; 230 delete p;
183 231
184 delete [] queue; 232 delete [] queue;
185} 233}
186 234
235void
187void pkt_queue::expire_cb (ev::timer &w, int revents) 236pkt_queue::expire_cb (ev::timer &w, int revents)
188{ 237{
189 ev_tstamp expire = ev_now () - max_ttl; 238 ev_tstamp expire = ev_now () - max_ttl;
190 239
191 for (;;) 240 for (;;)
192 { 241 {
… …
203 252
204 delete get (); 253 delete get ();
205 } 254 }
206} 255}
207 256
257void
208void pkt_queue::put (net_packet *p) 258pkt_queue::put (net_packet *p)
209{ 259{
210 ev_tstamp now = ev_now (); 260 ev_tstamp now = ev_now ();
211 261
212 // start expiry timer 262 // start expiry timer
213 if (empty ()) 263 if (empty ())
… …
222 queue[i].tstamp = now; 272 queue[i].tstamp = now;
223 273
224 i = ni; 274 i = ni;
225} 275}
226 276
227net_packet *pkt_queue::get () 277net_packet *
278pkt_queue::get ()
228{ 279{
229 if (empty ()) 280 if (empty ())
230 return 0; 281 return 0;
231 282
232 net_packet *p = queue[j].pkt; 283 net_packet *p = queue[j].pkt;
… …
256 307
257 bool can (const sockinfo &si) { return can((u32)si.host); } 308 bool can (const sockinfo &si) { return can((u32)si.host); }
258 bool can (u32 host); 309 bool can (u32 host);
259}; 310};
260 311
261net_rate_limiter auth_rate_limiter, reset_rate_limiter; 312static net_rate_limiter auth_rate_limiter, reset_rate_limiter;
262 313
314bool
263bool net_rate_limiter::can (u32 host) 315net_rate_limiter::can (u32 host)
264{ 316{
265 iterator i; 317 iterator i;
266 318
267 for (i = begin (); i != end (); ) 319 for (i = begin (); i != end (); )
268 if (i->host == host) 320 if (i->host == host)
… …
315 367
316///////////////////////////////////////////////////////////////////////////// 368/////////////////////////////////////////////////////////////////////////////
317 369
318unsigned char hmac_packet::hmac_digest[EVP_MAX_MD_SIZE]; 370unsigned char hmac_packet::hmac_digest[EVP_MAX_MD_SIZE];
319 371
372void
320void hmac_packet::hmac_gen (crypto_ctx *ctx) 373hmac_packet::hmac_gen (crypto_ctx *ctx)
321{ 374{
322 unsigned int xlen; 375 unsigned int xlen;
323 376
324 HMAC_CTX *hctx = &ctx->hctx; 377 HMAC_CTX *hctx = &ctx->hctx;
325 378
… …
343 hmac_gen (ctx); 396 hmac_gen (ctx);
344 397
345 return !memcmp (hmac, hmac_digest, HMACLENGTH); 398 return !memcmp (hmac, hmac_digest, HMACLENGTH);
346} 399}
347 400
401void
348void vpn_packet::set_hdr (ptype type_, unsigned int dst) 402vpn_packet::set_hdr (ptype type_, unsigned int dst)
349{ 403{
350 type = type_; 404 type = type_;
351 405
352 int src = THISNODE->id; 406 int src = THISNODE->id;
353 407
… …
358 412
359#define MAXVPNDATA (MAX_MTU - 6 - 6) 413#define MAXVPNDATA (MAX_MTU - 6 - 6)
360#define DATAHDR (sizeof (u32) + RAND_SIZE) 414#define DATAHDR (sizeof (u32) + RAND_SIZE)
361 415
362struct vpndata_packet : vpn_packet 416struct vpndata_packet : vpn_packet
417{
418 u8 data[MAXVPNDATA + DATAHDR]; // seqno
419
420 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
421 tap_packet *unpack (connection *conn, u32 &seqno);
422
423private:
424 const u32 data_hdr_size () const
363 { 425 {
364 u8 data[MAXVPNDATA + DATAHDR]; // seqno
365
366 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
367 tap_packet *unpack (connection *conn, u32 &seqno);
368private:
369
370 const u32 data_hdr_size () const
371 {
372 return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR; 426 return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR;
373 }
374 }; 427 }
428};
375 429
376void 430void
377vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno) 431vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno)
378{ 432{
379 EVP_CIPHER_CTX *cctx = &conn->octx->cctx; 433 EVP_CIPHER_CTX *cctx = &conn->octx->cctx;
… …
381 ptype type = PT_DATA_UNCOMPRESSED; 435 ptype type = PT_DATA_UNCOMPRESSED;
382 436
383#if ENABLE_COMPRESSION 437#if ENABLE_COMPRESSION
384 u8 cdata[MAX_MTU]; 438 u8 cdata[MAX_MTU];
385 439
386 if (conn->features & ENABLE_COMPRESSION) 440 if (conn->features & FEATURE_COMPRESSION)
387 { 441 {
388 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7); 442 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
389 443
390 if (cl) 444 if (cl)
391 { 445 {
… …
518#endif 572#endif
519 return f; 573 return f;
520 } 574 }
521}; 575};
522 576
577void
523void config_packet::setup (ptype type, int dst) 578config_packet::setup (ptype type, int dst)
524{ 579{
525 prot_major = PROTOCOL_MAJOR; 580 prot_major = PROTOCOL_MAJOR;
526 prot_minor = PROTOCOL_MINOR; 581 prot_minor = PROTOCOL_MINOR;
527 randsize = RAND_SIZE; 582 randsize = RAND_SIZE;
528 hmaclen = HMACLENGTH; 583 hmaclen = HMACLENGTH;
… …
536 591
537 len = sizeof (*this) - sizeof (net_packet); 592 len = sizeof (*this) - sizeof (net_packet);
538 set_hdr (type, dst); 593 set_hdr (type, dst);
539} 594}
540 595
596bool
541bool config_packet::chk_config () const 597config_packet::chk_config () const
542{ 598{
543 if (prot_major != PROTOCOL_MAJOR) 599 if (prot_major != PROTOCOL_MAJOR)
544 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR); 600 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
545 else if (randsize != RAND_SIZE) 601 else if (randsize != RAND_SIZE)
546 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE); 602 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
… …
570 rsaencrdata encr; 626 rsaencrdata encr;
571 627
572 auth_req_packet (int dst, bool initiate_, u8 protocols_) 628 auth_req_packet (int dst, bool initiate_, u8 protocols_)
573 { 629 {
574 config_packet::setup (PT_AUTH_REQ, dst); 630 config_packet::setup (PT_AUTH_REQ, dst);
575 strncpy (magic, MAGIC, 8); 631 strncpy (magic, MAGIC_OLD, 8);
576 initiate = !!initiate_; 632 initiate = !!initiate_;
577 protocols = protocols_; 633 protocols = protocols_;
578 634
579 len = sizeof (*this) - sizeof (net_packet); 635 len = sizeof (*this) - sizeof (net_packet);
580 } 636 }
… …
629///////////////////////////////////////////////////////////////////////////// 685/////////////////////////////////////////////////////////////////////////////
630 686
631void 687void
632connection::connection_established () 688connection::connection_established ()
633{ 689{
634 slog (L_TRACE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx); 690 slog (L_NOISE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);
635 691
636 if (ictx && octx) 692 if (ictx && octx)
637 { 693 {
638 // make sure rekeying timeouts are slightly asymmetric 694 // make sure rekeying timeouts are slightly asymmetric
639 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0); 695 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
… …
653 { 709 {
654 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY); 710 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
655 delete p; 711 delete p;
656 } 712 }
657 } 713 }
714
715 vpn->connection_established (this);
658 } 716 }
659 else 717 else
660 { 718 {
661 retry_cnt = 0; 719 retry_cnt = 0;
662 establish_connection.start (5); 720 establish_connection.start (5);
… …
666} 724}
667 725
668void 726void
669connection::reset_si () 727connection::reset_si ()
670{ 728{
729 if (vpn->can_direct (THISNODE, conf))
671 protocol = best_protocol (THISNODE->protocols & conf->protocols); 730 protocol = best_protocol (THISNODE->protocols & conf->connectable_protocols ());
672 731 else
673 // mask out protocols we cannot establish
674 if (!conf->udp_port) protocol &= ~PROT_UDPv4;
675 if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
676 if (!conf->dns_port) protocol &= ~PROT_DNSv4;
677
678 if (protocol
679 && (!conf->can_direct (THISNODE)
680 || !THISNODE->can_direct (conf)))
681 { 732 {
682 slog (L_DEBUG, _("%s: direct connection denied"), conf->nodename); 733 slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
683 protocol = 0; 734 protocol = 0;
684 } 735 }
685 736
686 si.set (conf, protocol); 737 si.set (conf, protocol);
738
739 is_direct = si.valid ();
687} 740}
688 741
689// ensure sockinfo is valid, forward if necessary 742// ensure sockinfo is valid, forward if necessary
690const sockinfo & 743const sockinfo &
691connection::forward_si (const sockinfo &si) const 744connection::forward_si (const sockinfo &si) const
692{ 745{
693 if (!si.valid ()) 746 if (!si.valid ())
694 { 747 {
695 connection *r = vpn->find_router (); 748 connection *r = vpn->find_router_for (this);
696 749
697 if (r) 750 if (r)
698 { 751 {
699 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"), 752 slog (L_DEBUG, _("%s: no common protocol, trying to route through %s."),
700 conf->nodename, r->conf->nodename, (const char *)r->si); 753 conf->nodename, r->conf->nodename);
701 return r->si; 754 return r->si;
702 } 755 }
703 else 756 else
704 slog (L_DEBUG, _("%s: node unreachable, no common protocol"), 757 slog (L_DEBUG, _("%s: node unreachable, no common protocol or no router available."),
705 conf->nodename); 758 conf->nodename);
706 } 759 }
707 760
708 return si; 761 return si;
709} 762}
… …
719connection::send_ping (const sockinfo &si, u8 pong) 772connection::send_ping (const sockinfo &si, u8 pong)
720{ 773{
721 ping_packet *pkt = new ping_packet; 774 ping_packet *pkt = new ping_packet;
722 775
723 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 776 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
777
778 slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
779
724 send_vpn_packet (pkt, si, IPTOS_LOWDELAY); 780 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
725 781
726 delete pkt; 782 delete pkt;
727} 783}
728 784
… …
747 803
748 rsachallenge chg; 804 rsachallenge chg;
749 rsa_cache.gen (pkt->id, chg); 805 rsa_cache.gen (pkt->id, chg);
750 rsa_encrypt (conf->rsa_key, chg, pkt->encr); 806 rsa_encrypt (conf->rsa_key, chg, pkt->encr);
751 807
752 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 808 slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
753 809
754 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly 810 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
755 811
756 delete pkt; 812 delete pkt;
757} 813}
… …
765 821
766 rsa_hash (id, chg, pkt->response); 822 rsa_hash (id, chg, pkt->response);
767 823
768 pkt->hmac_set (octx); 824 pkt->hmac_set (octx);
769 825
770 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si); 826 slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
771 827
772 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 828 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
773 829
774 delete pkt; 830 delete pkt;
775} 831}
776 832
777void 833void
778connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols) 834connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
779{ 835{
780 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)", 836 slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s,p%02x)", conf->nodename,
781 conf->id, rid, (const char *)rsi); 837 vpn->conns[rid - 1]->conf->nodename, (const char *)rsi,
838 conf->protocols);
782 839
783 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols); 840 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
784 841
785 r->hmac_set (octx); 842 r->hmac_set (octx);
786 send_vpn_packet (r, si); 843 send_vpn_packet (r, si);
… …
789} 846}
790 847
791inline void 848inline void
792connection::establish_connection_cb (ev::timer &w, int revents) 849connection::establish_connection_cb (ev::timer &w, int revents)
793{ 850{
794 if (!ictx 851 if (!(ictx && octx)
795 && conf != THISNODE 852 && conf != THISNODE
796 && connectmode != conf_node::C_NEVER 853 && connectmode != conf_node::C_NEVER
797 && connectmode != conf_node::C_DISABLED 854 && connectmode != conf_node::C_DISABLED
798 && !w.is_active ()) 855 && !w.is_active ())
799 { 856 {
… …
813 870
814 reset_si (); 871 reset_si ();
815 872
816 bool slow = si.prot & PROT_SLOW; 873 bool slow = si.prot & PROT_SLOW;
817 874
818 if (si.prot && !si.host) 875 if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
819 { 876 {
820 slog (L_TRACE, _("%s: connection request (indirect)"), conf->nodename);
821 /*TODO*/ /* start the timer so we don't recurse endlessly */ 877 /*TODO*/ /* start the timer so we don't recurse endlessly */
822 w.start (1); 878 w.start (1);
823 vpn->send_connect_request (conf->id); 879 vpn->send_connect_request (this);
824 } 880 }
825 else 881 else
826 { 882 {
827 slog (L_TRACE, _("%s: connection request (direct)"), conf->nodename, !!ictx, !!octx); 883 if (si.valid ())
884 slog (L_DEBUG, _("%s: sending direct connection request to %s."),
885 conf->nodename, (const char *)si);
828 886
829 const sockinfo &dsi = forward_si (si); 887 const sockinfo &dsi = forward_si (si);
830 888
831 slow = slow || (dsi.prot & PROT_SLOW); 889 slow = slow || (dsi.prot & PROT_SLOW);
832 890
… …
858 slog (L_INFO, _("%s(%s): connection lost"), 916 slog (L_INFO, _("%s(%s): connection lost"),
859 conf->nodename, (const char *)si); 917 conf->nodename, (const char *)si);
860 918
861 if (::conf.script_node_down) 919 if (::conf.script_node_down)
862 { 920 {
863 run_script_cb cb; 921 run_script_cb *cb = new run_script_cb;
864 cb.set<connection, &connection::script_node_down> (this); 922 cb->set<connection, &connection::script_node_down> (this);
865 if (!run_script (cb, false))
866 slog (L_WARN, _("node-down command execution failed, continuing.")); 923 run_script_queued (cb, _("node-down command execution failed, continuing."));
867 } 924 }
868 } 925 }
869 926
870 delete ictx; ictx = 0; 927 delete ictx; ictx = 0;
871 delete octx; octx = 0; 928 delete octx; octx = 0;
… …
873 dnsv4_reset_connection (); 930 dnsv4_reset_connection ();
874#endif 931#endif
875 932
876 si.host = 0; 933 si.host = 0;
877 934
878 last_activity = 0; 935 last_activity = 0.;
936 //last_si_change = 0.;
879 retry_cnt = 0; 937 retry_cnt = 0;
880 938
881 rekey.stop (); 939 rekey.stop ();
882 keepalive.stop (); 940 keepalive.stop ();
883 establish_connection.stop (); 941 establish_connection.stop ();
… …
890 send_reset (si); 948 send_reset (si);
891 949
892 reset_connection (); 950 reset_connection ();
893} 951}
894 952
953// poor-man's rekeying
895inline void 954inline void
896connection::rekey_cb (ev::timer &w, int revents) 955connection::rekey_cb (ev::timer &w, int revents)
897{ 956{
898 reset_connection (); 957 reset_connection ();
899 establish_connection (); 958 establish_connection ();
… …
938 data_queue.put (new tap_packet (*pkt)); 997 data_queue.put (new tap_packet (*pkt));
939 post_inject_queue (); 998 post_inject_queue ();
940 } 999 }
941} 1000}
942 1001
1002void
943void connection::inject_vpn_packet (vpn_packet *pkt, int tos) 1003connection::inject_vpn_packet (vpn_packet *pkt, int tos)
944{ 1004{
945 if (ictx && octx) 1005 if (ictx && octx)
946 send_vpn_packet (pkt, si, tos); 1006 send_vpn_packet (pkt, si, tos);
947 else 1007 else
948 { 1008 {
… …
954void 1014void
955connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 1015connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
956{ 1016{
957 last_activity = ev_now (); 1017 last_activity = ev_now ();
958 1018
959 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 1019 slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
960 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 1020 conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
961 1021
962 if (connectmode == conf_node::C_DISABLED) 1022 if (connectmode == conf_node::C_DISABLED)
963 return; 1023 return;
964 1024
965 switch (pkt->typ ()) 1025 switch (pkt->typ ())
966 { 1026 {
967 case vpn_packet::PT_PING: 1027 case vpn_packet::PT_PING:
1028 slog (L_TRACE, "%s >> PT_PING", conf->nodename);
1029
968 // we send pings instead of auth packets after some retries, 1030 // we send pings instead of auth packets after some retries,
969 // so reset the retry counter and establish a connection 1031 // so reset the retry counter and establish a connection
970 // when we receive a ping. 1032 // when we receive a ping.
971 if (!ictx) 1033 if (!ictx)
972 { 1034 {
973 if (auth_rate_limiter.can (rsi)) 1035 if (auth_rate_limiter.can (rsi))
974 send_auth_request (rsi, true); 1036 send_auth_request (rsi, true);
975 } 1037 }
976 else 1038 else
1039 // we would love to change the socket address here, but ping's aren't
1040 // authenticated, so we best ignore it.
977 send_ping (rsi, 1); // pong 1041 send_ping (rsi, 1); // pong
978 1042
979 break; 1043 break;
980 1044
981 case vpn_packet::PT_PONG: 1045 case vpn_packet::PT_PONG:
1046 slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
1047
1048 // a PONG might mean that the other side doesn't really know
1049 // about our desire for communication.
1050 establish_connection ();
982 break; 1051 break;
983 1052
984 case vpn_packet::PT_RESET: 1053 case vpn_packet::PT_RESET:
985 { 1054 {
986 reset_connection (); 1055 reset_connection ();
987 1056
988 config_packet *p = (config_packet *) pkt; 1057 config_packet *p = (config_packet *) pkt;
989 1058
990 if (!p->chk_config ()) 1059 if (!p->chk_config ())
991 { 1060 {
992 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"), 1061 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
993 conf->nodename, (const char *)rsi); 1062 conf->nodename, (const char *)rsi);
994 connectmode = conf_node::C_DISABLED; 1063 connectmode = conf_node::C_DISABLED;
995 } 1064 }
996 else if (connectmode == conf_node::C_ALWAYS) 1065 else if (connectmode == conf_node::C_ALWAYS)
997 establish_connection (); 1066 establish_connection ();
… …
999 break; 1068 break;
1000 1069
1001 case vpn_packet::PT_AUTH_REQ: 1070 case vpn_packet::PT_AUTH_REQ:
1002 if (auth_rate_limiter.can (rsi)) 1071 if (auth_rate_limiter.can (rsi))
1003 { 1072 {
1004 auth_req_packet *p = (auth_req_packet *) pkt; 1073 auth_req_packet *p = (auth_req_packet *)pkt;
1005 1074
1006 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 1075 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)",
1076 conf->nodename, p->initiate ? "initiate" : "reply",
1077 p->protocols, p->features);
1007 1078
1008 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 1079 if (p->chk_config ()
1080 && (!memcmp (p->magic, MAGIC_OLD, 8) || !memcmp (p->magic, MAGIC, 8)))
1009 { 1081 {
1010 if (p->prot_minor != PROTOCOL_MINOR) 1082 if (p->prot_minor != PROTOCOL_MINOR)
1011 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1083 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1012 conf->nodename, (const char *)rsi, 1084 conf->nodename, (const char *)rsi,
1013 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 1085 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
… …
1039 1111
1040 break; 1112 break;
1041 } 1113 }
1042 } 1114 }
1043 else 1115 else
1044 slog (L_WARN, _("%s(%s): protocol mismatch"), 1116 slog (L_WARN, _("%s(%s): protocol mismatch."),
1045 conf->nodename, (const char *)rsi); 1117 conf->nodename, (const char *)rsi);
1046 1118
1047 send_reset (rsi); 1119 send_reset (rsi);
1048 } 1120 }
1049 1121
1050 break; 1122 break;
1051 1123
1052 case vpn_packet::PT_AUTH_RES: 1124 case vpn_packet::PT_AUTH_RES:
1053 { 1125 {
1054 auth_res_packet *p = (auth_res_packet *) pkt; 1126 auth_res_packet *p = (auth_res_packet *)pkt;
1055 1127
1056 slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id); 1128 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
1057 1129
1058 if (p->chk_config ()) 1130 if (p->chk_config ())
1059 { 1131 {
1060 if (p->prot_minor != PROTOCOL_MINOR) 1132 if (p->prot_minor != PROTOCOL_MINOR)
1061 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1133 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
… …
1064 1136
1065 rsachallenge chg; 1137 rsachallenge chg;
1066 1138
1067 if (!rsa_cache.find (p->id, chg)) 1139 if (!rsa_cache.find (p->id, chg))
1068 { 1140 {
1069 slog (L_ERR, _("%s(%s): unrequested auth response ignored"), 1141 slog (L_ERR, _("%s(%s): unrequested auth response, ignoring."),
1070 conf->nodename, (const char *)rsi); 1142 conf->nodename, (const char *)rsi);
1071 break; 1143 break;
1072 } 1144 }
1073 else 1145 else
1074 { 1146 {
1075 crypto_ctx *cctx = new crypto_ctx (chg, 0); 1147 crypto_ctx *cctx = new crypto_ctx (chg, 0);
1076 1148
1077 if (!p->hmac_chk (cctx)) 1149 if (!p->hmac_chk (cctx))
1078 { 1150 {
1079 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 1151 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
1080 "could be an attack, or just corruption or a synchronization error"), 1152 "could be an attack, or just corruption or a synchronization error."),
1081 conf->nodename, (const char *)rsi); 1153 conf->nodename, (const char *)rsi);
1082 break; 1154 break;
1083 } 1155 }
1084 else 1156 else
1085 { 1157 {
… …
1096 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 1168 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
1097 1169
1098 si = rsi; 1170 si = rsi;
1099 protocol = rsi.prot; 1171 protocol = rsi.prot;
1100 1172
1173 slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
1174 conf->nodename, (const char *)rsi,
1175 is_direct ? "direct" : "forwarded",
1176 p->prot_major, p->prot_minor);
1177
1101 connection_established (); 1178 connection_established ();
1102
1103 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
1104 conf->nodename, (const char *)rsi,
1105 p->prot_major, p->prot_minor);
1106 1179
1107 if (::conf.script_node_up) 1180 if (::conf.script_node_up)
1108 { 1181 {
1109 run_script_cb cb; 1182 run_script_cb *cb = new run_script_cb;
1110 cb.set<connection, &connection::script_node_up> (this); 1183 cb->set<connection, &connection::script_node_up> (this);
1111 if (!run_script (cb, false))
1112 slog (L_WARN, _("node-up command execution failed, continuing.")); 1184 run_script_queued (cb, _("node-up command execution failed, continuing."));
1113 } 1185 }
1114 1186
1115 break; 1187 break;
1116 } 1188 }
1117 else 1189 else
1118 slog (L_ERR, _("%s(%s): sent and received challenge do not match"), 1190 slog (L_ERR, _("%s(%s): sent and received challenge do not match."),
1119 conf->nodename, (const char *)rsi); 1191 conf->nodename, (const char *)rsi);
1120 } 1192 }
1121 1193
1122 delete cctx; 1194 delete cctx;
1123 } 1195 }
… …
1139 { 1211 {
1140 vpndata_packet *p = (vpndata_packet *)pkt; 1212 vpndata_packet *p = (vpndata_packet *)pkt;
1141 1213
1142 if (!p->hmac_chk (ictx)) 1214 if (!p->hmac_chk (ictx))
1143 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1215 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1144 "could be an attack, or just corruption or a synchronization error"), 1216 "could be an attack, or just corruption or a synchronization error."),
1145 conf->nodename, (const char *)rsi); 1217 conf->nodename, (const char *)rsi);
1146 else 1218 else
1147 { 1219 {
1148 u32 seqno; 1220 u32 seqno;
1149 tap_packet *d = p->unpack (this, seqno); 1221 tap_packet *d = p->unpack (this, seqno);
1222 int seqclass = iseqno.seqno_classify (seqno);
1150 1223
1151 if (iseqno.recv_ok (seqno)) 1224 if (seqclass == 0) // ok
1152 { 1225 {
1153 vpn->tap->send (d); 1226 vpn->tap->send (d);
1154 1227
1155 if (si != rsi) 1228 if (si != rsi)
1156 { 1229 {
1157 // fast re-sync on source address changes, useful especially for tcp/ip 1230 // fast re-sync on source address changes, useful especially for tcp/ip
1231 //if (last_si_change < ev_now () + 5.)
1158 si = rsi; 1232 // {
1159
1160 slog (L_INFO, _("%s(%s): socket address changed to %s"), 1233 slog (L_INFO, _("%s(%s): changing socket address to %s."),
1161 conf->nodename, (const char *)si, (const char *)rsi); 1234 conf->nodename, (const char *)si, (const char *)rsi);
1235
1236 si = rsi;
1237
1238 if (::conf.script_node_change)
1239 {
1240 run_script_cb *cb = new run_script_cb;
1241 cb->set<connection, &connection::script_node_change> (this);
1242 run_script_queued (cb, _("node-change command execution failed, continuing."));
1243 }
1244
1245 // }
1246 //else
1247 // slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
1248 // conf->nodename, (const char *)si, (const char *)rsi);
1162 } 1249 }
1250 }
1251 else if (seqclass == 1) // far history
1252 slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
1253 "possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
1254 else if (seqclass == 2) // in-window duplicate, happens often on wireless
1255 slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
1256 "possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
1257 else if (seqclass == 3) // reset
1258 {
1259 slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
1260 "probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
1261 send_reset (rsi);
1163 } 1262 }
1164 1263
1165 delete d; 1264 delete d;
1166 break; 1265 break;
1167 } 1266 }
… …
1171 break; 1270 break;
1172 1271
1173 case vpn_packet::PT_CONNECT_REQ: 1272 case vpn_packet::PT_CONNECT_REQ:
1174 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1273 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1175 { 1274 {
1176 connect_req_packet *p = (connect_req_packet *) pkt; 1275 connect_req_packet *p = (connect_req_packet *)pkt;
1177 1276
1178 if (p->id > 0 && p->id <= vpn->conns.size ()) 1277 if (p->id > 0 && p->id <= vpn->conns.size ())
1179 { 1278 {
1180 connection *c = vpn->conns[p->id - 1]; 1279 connection *c = vpn->conns[p->id - 1];
1181 conf->protocols = p->protocols; 1280 conf->protocols = p->protocols;
1182 1281
1183 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]", 1282 slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s,p%02x) [%d]",
1283 conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1284 p->protocols,
1184 conf->id, p->id, c->ictx && c->octx); 1285 c->ictx && c->octx);
1185 1286
1186 if (c->ictx && c->octx) 1287 if (c->ictx && c->octx)
1187 { 1288 {
1188 // send connect_info packets to both sides, in case one is 1289 // send connect_info packets to both sides, in case one is
1189 // behind a nat firewall (or both ;) 1290 // behind a nat firewall (or both ;)
… …
1212 1313
1213 c->conf->protocols = p->protocols; 1314 c->conf->protocols = p->protocols;
1214 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf)); 1315 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1215 p->si.upgrade_protocol (protocol, c->conf); 1316 p->si.upgrade_protocol (protocol, c->conf);
1216 1317
1217 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1318 slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s,p%02x) [%d]",
1218 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1319 conf->nodename,
1320 vpn->conns[p->id - 1]->conf->nodename,
1321 (const char *)p->si,
1322 p->protocols,
1323 !c->ictx && !c->octx);
1219 1324
1220 const sockinfo &dsi = forward_si (p->si); 1325 const sockinfo &dsi = forward_si (p->si);
1221 1326
1222 if (dsi.valid ()) 1327 if (dsi.valid ())
1223 c->send_auth_request (dsi, true); 1328 c->send_auth_request (dsi, true);
… …
1237} 1342}
1238 1343
1239inline void 1344inline void
1240connection::keepalive_cb (ev::timer &w, int revents) 1345connection::keepalive_cb (ev::timer &w, int revents)
1241{ 1346{
1242 if (ev_now () >= last_activity + ::conf.keepalive + 30) 1347 if (ev_now () >= last_activity + ::conf.keepalive + 15)
1243 { 1348 {
1244 reset_connection (); 1349 reset_connection ();
1245 establish_connection (); 1350 establish_connection ();
1246 } 1351 }
1247 else if (ev_now () < last_activity + ::conf.keepalive) 1352 else if (ev_now () < last_activity + ::conf.keepalive)
1248 w.start (last_activity + ::conf.keepalive - ev::now ()); 1353 w.start (last_activity + ::conf.keepalive - ev::now ());
1249 else if (conf->connectmode != conf_node::C_ONDEMAND 1354 else if (conf->connectmode != conf_node::C_ONDEMAND
1250 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1355 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1251 { 1356 {
1252 send_ping (si); 1357 send_ping (si);
1253 w.start (5); 1358 w.start (3);
1254 } 1359 }
1255 else if (ev_now () < last_activity + ::conf.keepalive + 10) 1360 else if (ev_now () < last_activity + ::conf.keepalive + 10)
1256 // hold ondemand connections implicitly a few seconds longer 1361 // hold ondemand connections implicitly a few seconds longer
1257 // should delete octx, though, or something like that ;) 1362 // should delete octx, though, or something like that ;)
1258 w.start (last_activity + ::conf.keepalive + 10 - ev::now ()); 1363 w.start (last_activity + ::conf.keepalive + 10 - ev::now ());
1259 else 1364 else
1260 reset_connection (); 1365 reset_connection ();
1261} 1366}
1262 1367
1368void
1263void connection::send_connect_request (int id) 1369connection::send_connect_request (int id)
1264{ 1370{
1265 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1371 connect_req_packet *p = new connect_req_packet (conf->id, id, THISNODE->protocols);
1266 1372
1267 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1373 slog (L_TRACE, "%s << PT_CONNECT_REQ(%s,p%02x)",
1374 conf->nodename, vpn->conns[id - 1]->conf->nodename,
1375 THISNODE->protocols);
1268 p->hmac_set (octx); 1376 p->hmac_set (octx);
1269 send_vpn_packet (p, si); 1377 send_vpn_packet (p, si);
1270 1378
1271 delete p; 1379 delete p;
1272} 1380}
1273 1381
1382void
1274void connection::script_init_env (const char *ext) 1383connection::script_init_env (const char *ext)
1275{ 1384{
1276 char *env; 1385 char *env;
1277 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env); 1386 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
1278 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env); 1387 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
1279 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext, 1388 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
1280 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8, 1389 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
1281 conf->id & 0xff); putenv (env); 1390 conf->id & 0xff); putenv (env);
1282} 1391}
1283 1392
1393void
1284void connection::script_init_connect_env () 1394connection::script_init_connect_env ()
1285{ 1395{
1286 vpn->script_init_env (); 1396 vpn->script_init_env ();
1287 1397
1288 char *env; 1398 char *env;
1289 asprintf (&env, "DESTID=%d", conf->id); putenv (env); 1399 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1400 asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env);
1290 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); 1401 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1291 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); 1402 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1292 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); 1403 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1293} 1404}
1294 1405
1295inline const char * 1406inline const char *
1296connection::script_node_up () 1407connection::script_node_up ()
1297{ 1408{
… …
1307 1418
1308 return filename; 1419 return filename;
1309} 1420}
1310 1421
1311inline const char * 1422inline const char *
1423connection::script_node_change ()
1424{
1425 script_init_connect_env ();
1426
1427 putenv ((char *)"STATE=change");
1428
1429 char *filename;
1430 asprintf (&filename,
1431 "%s/%s",
1432 confbase,
1433 ::conf.script_node_change ? ::conf.script_node_change : "node-change");
1434
1435 return filename;
1436}
1437
1438inline const char *
1312connection::script_node_down () 1439connection::script_node_down ()
1313{ 1440{
1314 script_init_connect_env (); 1441 script_init_connect_env ();
1315 1442
1316 putenv ((char *)"STATE=down"); 1443 putenv ((char *)"STATE=down");
… …
1327connection::connection (struct vpn *vpn, conf_node *conf) 1454connection::connection (struct vpn *vpn, conf_node *conf)
1328: vpn(vpn), conf(conf), 1455: vpn(vpn), conf(conf),
1329#if ENABLE_DNS 1456#if ENABLE_DNS
1330 dns (0), 1457 dns (0),
1331#endif 1458#endif
1332 data_queue(conf->max_ttl, conf->max_queue), 1459 data_queue(conf->max_ttl, conf->max_queue + 1),
1333 vpn_queue(conf->max_ttl, conf->max_queue) 1460 vpn_queue(conf->max_ttl, conf->max_queue + 1)
1334{ 1461{
1335 rekey .set<connection, &connection::rekey_cb > (this); 1462 rekey .set<connection, &connection::rekey_cb > (this);
1336 keepalive .set<connection, &connection::keepalive_cb > (this); 1463 keepalive .set<connection, &connection::keepalive_cb > (this);
1337 establish_connection.set<connection, &connection::establish_connection_cb> (this); 1464 establish_connection.set<connection, &connection::establish_connection_cb> (this);
1338 1465
1339 last_establish_attempt = 0.; 1466 last_establish_attempt = 0.;
1340 octx = ictx = 0; 1467 octx = ictx = 0;
1341 1468
1342 if (!conf->protocols) // make sure some protocol is enabled
1343 conf->protocols = PROT_UDPv4;
1344
1345 connectmode = conf->connectmode; 1469 connectmode = conf->connectmode;
1346 1470
1347 // queue a dummy packet to force an initial connection attempt 1471 // queue a dummy packet to force an initial connection attempt
1348 if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED) 1472 if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
1349 vpn_queue.put (new net_packet); 1473 vpn_queue.put (new net_packet);
… …
1354connection::~connection () 1478connection::~connection ()
1355{ 1479{
1356 shutdown (); 1480 shutdown ();
1357} 1481}
1358 1482
1483void
1359void connection_init () 1484connection_init ()
1360{ 1485{
1361 auth_rate_limiter.clear (); 1486 auth_rate_limiter.clear ();
1362 reset_rate_limiter.clear (); 1487 reset_rate_limiter.clear ();
1363} 1488}
1364 1489

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines