ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.4 by pcg, Wed Apr 2 21:02:25 2003 UTC vs.
Revision 1.105 by root, Fri Jul 19 18:22:54 2013 UTC

1/* 1/*
2 connection.C -- manage a single connection 2 connection.C -- manage a single connection
3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
3 4
5 This file is part of GVPE.
6
4 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
5 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
6 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
7 (at your option) any later version. 10 option) any later version.
8 11
9 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
10 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
12 GNU General Public License for more details. 15 Public License for more details.
13 16
14 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
15 along with this program; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
16 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
17*/ 30*/
18 31
19#include "config.h" 32#include "config.h"
20 33
21extern "C" {
22# include "lzf/lzf.h"
23}
24
25#include <list> 34#include <list>
35#include <queue>
36#include <utility>
26 37
27#include <openssl/rand.h> 38#include <openssl/rand.h>
28#include <openssl/evp.h> 39#include <openssl/evp.h>
29#include <openssl/rsa.h> 40#include <openssl/rsa.h>
30#include <openssl/err.h> 41#include <openssl/err.h>
31
32#include "gettext.h"
33 42
34#include "conf.h" 43#include "conf.h"
35#include "slog.h" 44#include "slog.h"
36#include "device.h" 45#include "device.h"
37#include "vpn.h" 46#include "vpn.h"
38#include "connection.h" 47#include "connection.h"
48#include "hkdf.h"
39 49
40#if !HAVE_RAND_PSEUDO_BYTES 50#include "netcompat.h"
41# define RAND_pseudo_bytes RAND_bytes
42#endif
43 51
44#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 52#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic
53#define MAGIC "HUHN\xbd\xc6\xdb\x82" // 8 bytes of magic//D
54
55#define ULTRA_FAST 1
56#define HLOG 15
57#include "lzf/lzf.h"
58#include "lzf/lzf_c.c"
59#include "lzf/lzf_d.c"
60
61//////////////////////////////////////////////////////////////////////////////
62
63static std::queue< std::pair<run_script_cb *, const char *> > rs_queue;
64static ev::child rs_child_ev;
65
66namespace
67{
68 void // c++ requires external linkage here, apparently :(
69 rs_child_cb (ev::child &w, int revents)
70 {
71 w.stop ();
72
73 if (rs_queue.empty ())
74 return;
75
76 pid_t pid = run_script (*rs_queue.front ().first, false);
77 if (pid)
78 {
79 w.set (pid);
80 w.start ();
81 }
82 else
83 slog (L_WARN, rs_queue.front ().second);
84
85 delete rs_queue.front ().first;
86 rs_queue.pop ();
87 }
88};
89
90// despite the fancy name, this is quite a hack
91static void
92run_script_queued (run_script_cb *cb, const char *warnmsg)
93{
94 rs_queue.push (std::make_pair (cb, warnmsg));
95
96 if (!rs_child_ev.is_active ())
97 {
98 rs_child_ev.set<rs_child_cb> ();
99 rs_child_ev ();
100 }
101}
102
103//////////////////////////////////////////////////////////////////////////////
45 104
46struct crypto_ctx 105struct crypto_ctx
47{ 106{
48 EVP_CIPHER_CTX cctx; 107 EVP_CIPHER_CTX cctx;
49 HMAC_CTX hctx; 108 HMAC_CTX hctx;
50 109
51 crypto_ctx (const rsachallenge &challenge, int enc); 110 crypto_ctx (const auth_data &auth1, const auth_data &auth2, const ecdh_key &a, const ecdh_key &b, int enc);
52 ~crypto_ctx (); 111 ~crypto_ctx ();
53}; 112};
54 113
55crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc) 114crypto_ctx::crypto_ctx (const auth_data &auth1, const auth_data &auth2, const ecdh_key &a, const ecdh_key &b, int enc)
56{ 115{
116 ecdh_key s;
117
118 curve25519_combine (a, b, s);
119
120 {
121 u8 mac_key[MAC_KEYSIZE];
122 static const unsigned char mac_info[] = "gvpe mac key";
123
124 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
125 kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key));
126 kdf.extract (s, sizeof (s));
127 kdf.extract_done (HKDF_PRF_HASH ());
128 kdf.expand (mac_key, sizeof (mac_key), mac_info, sizeof (mac_info));
129
130 HMAC_CTX_init (&hctx);
131 require (HMAC_Init_ex (&hctx, mac_key, MAC_KEYSIZE, MAC_DIGEST (), 0));
132 }
133
134 {
135 u8 cipher_key[CIPHER_KEYSIZE];
136 static const unsigned char cipher_info[] = "gvpe cipher key";
137
138 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
139 kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key));
140 kdf.extract (s, sizeof (s));
141 kdf.extract_done (HKDF_PRF_HASH ());
142 kdf.expand (cipher_key, sizeof (cipher_key), cipher_info, sizeof (cipher_info));
143
57 EVP_CIPHER_CTX_init (&cctx); 144 EVP_CIPHER_CTX_init (&cctx);
58 EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc); 145 require (EVP_CipherInit_ex (&cctx, CIPHER (), 0, cipher_key, 0, enc));
59 HMAC_CTX_init (&hctx); 146 }
60 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
61} 147}
62 148
63crypto_ctx::~crypto_ctx () 149crypto_ctx::~crypto_ctx ()
64{ 150{
65 EVP_CIPHER_CTX_cleanup (&cctx); 151 require (EVP_CIPHER_CTX_cleanup (&cctx));
66 HMAC_CTX_cleanup (&hctx); 152 HMAC_CTX_cleanup (&hctx);
67} 153}
68 154
155static inline void
156auth_encrypt (RSA *key, const auth_data &auth, auth_encr &encr)
157{
158 if (RSA_public_encrypt (sizeof (auth.rsa),
159 (unsigned char *)&auth.rsa, (unsigned char *)&encr.rsa,
160 key, RSA_PKCS1_OAEP_PADDING) < 0)
161 fatal ("RSA_public_encrypt error");
162
163 memcpy (&encr.ecdh, &auth.ecdh, sizeof (encr.ecdh));
164}
165
166static inline bool
167auth_decrypt (RSA *key, const auth_encr &encr, auth_data &auth)
168{
169 u8 rsa_decrypt[RSA_KEYLEN];
170
171 if (RSA_private_decrypt (sizeof (encr.rsa),
172 (const unsigned char *)&encr.rsa, (unsigned char *)rsa_decrypt,
173 key, RSA_PKCS1_OAEP_PADDING) != sizeof (auth.rsa))
174 return 0;
175
176 memcpy (&auth.rsa, rsa_decrypt, sizeof (auth.rsa));
177 memcpy (&auth.ecdh, &encr.ecdh, sizeof (auth.ecdh));
178
179 return 1;
180}
181
69static void 182static void
70rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h) 183auth_hash (const auth_data &auth, const ecdh_key &b, auth_mac &mac)
71{ 184{
72 EVP_MD_CTX ctx; 185 hkdf kdf (&auth.ecdh, sizeof (auth.ecdh), AUTH_DIGEST ()); // use remote ecdh b as salt
73 186 kdf.extract (&auth.rsa, sizeof (auth.rsa));
74 EVP_MD_CTX_init (&ctx); 187 kdf.extract_done ();
75 EVP_DigestInit (&ctx, RSA_HASH); 188 kdf.expand (mac, sizeof mac, b, sizeof b); // use response ecdh b as info
76 EVP_DigestUpdate(&ctx, &chg, sizeof chg);
77 EVP_DigestUpdate(&ctx, &id, sizeof id);
78 EVP_DigestFinal (&ctx, (unsigned char *)&h, 0);
79 EVP_MD_CTX_cleanup (&ctx);
80} 189}
81 190
82struct rsa_entry { 191void
83 tstamp expire; 192connection::generate_auth_data ()
84 rsaid id;
85 rsachallenge chg;
86};
87
88struct rsa_cache : list<rsa_entry>
89{ 193{
90 void cleaner_cb (time_watcher &w); time_watcher cleaner; 194 if (auth_expire < ev_now ())
91
92 bool find (const rsaid &id, rsachallenge &chg)
93 {
94 for (iterator i = begin (); i != end (); ++i)
95 {
96 if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW)
97 {
98 memcpy (&chg, &i->chg, sizeof chg);
99
100 erase (i);
101 return true;
102 }
103 }
104
105 if (cleaner.at < NOW)
106 cleaner.start (NOW + RSA_TTL);
107
108 return false;
109 }
110
111 void gen (rsaid &id, rsachallenge &chg)
112 {
113 rsa_entry e;
114
115 RAND_bytes ((unsigned char *)&id, sizeof id);
116 RAND_bytes ((unsigned char *)&chg, sizeof chg);
117
118 e.expire = NOW + RSA_TTL;
119 e.id = id;
120 memcpy (&e.chg, &chg, sizeof chg);
121
122 push_back (e);
123
124 if (cleaner.at < NOW)
125 cleaner.start (NOW + RSA_TTL);
126 }
127
128 rsa_cache ()
129 : cleaner (this, &rsa_cache::cleaner_cb)
130 { } 195 {
196 // request data
197 rand_fill (snd_auth.rsa);
198 curve25519_generate (snd_ecdh_a, snd_auth.ecdh);
131 199
132} rsa_cache; 200 // eventual response data
133 201 curve25519_generate (rcv_ecdh_a, rcv_ecdh_b);
134void rsa_cache::cleaner_cb (time_watcher &w)
135{
136 if (empty ())
137 w.at = TSTAMP_CANCEL;
138 else
139 { 202 }
140 w.at = NOW + RSA_TTL;
141 203
142 for (iterator i = begin (); i != end (); ) 204 // every use prolongs the expiry
143 if (i->expire <= NOW) 205 auth_expire = ev_now () + AUTH_TTL;
144 i = erase (i);
145 else
146 ++i;
147 }
148} 206}
149 207
150////////////////////////////////////////////////////////////////////////////// 208//////////////////////////////////////////////////////////////////////////////
151 209
152void pkt_queue::put (tap_packet *p) 210pkt_queue::pkt_queue (double max_ttl, int max_queue)
211: max_ttl (max_ttl), max_queue (max_queue)
153{ 212{
154 if (queue[i]) 213 queue = new pkt [max_queue];
155 {
156 delete queue[i];
157 j = (j + 1) % QUEUEDEPTH;
158 }
159 214
160 queue[i] = p;
161
162 i = (i + 1) % QUEUEDEPTH;
163}
164
165tap_packet *pkt_queue::get ()
166{
167 tap_packet *p = queue[j];
168
169 if (p)
170 {
171 queue[j] = 0;
172 j = (j + 1) % QUEUEDEPTH;
173 }
174
175 return p;
176}
177
178pkt_queue::pkt_queue ()
179{
180 memset (queue, 0, sizeof (queue));
181 i = 0; 215 i = 0;
182 j = 0; 216 j = 0;
217
218 expire.set<pkt_queue, &pkt_queue::expire_cb> (this);
183} 219}
184 220
185pkt_queue::~pkt_queue () 221pkt_queue::~pkt_queue ()
186{ 222{
187 for (i = QUEUEDEPTH; --i > 0; ) 223 while (net_packet *p = get ())
224 delete p;
225
188 delete queue[i]; 226 delete [] queue;
189} 227}
190 228
229void
230pkt_queue::expire_cb (ev::timer &w, int revents)
231{
232 ev_tstamp expire = ev_now () - max_ttl;
233
234 for (;;)
235 {
236 if (empty ())
237 break;
238
239 double diff = queue[j].tstamp - expire;
240
241 if (diff >= 0.)
242 {
243 w.start (diff > 0.5 ? diff : 0.5);
244 break;
245 }
246
247 delete get ();
248 }
249}
250
251void
252pkt_queue::put (net_packet *p)
253{
254 ev_tstamp now = ev_now ();
255
256 // start expiry timer
257 if (empty ())
258 expire.start (max_ttl);
259
260 int ni = i + 1 == max_queue ? 0 : i + 1;
261
262 if (ni == j)
263 delete get ();
264
265 queue[i].pkt = p;
266 queue[i].tstamp = now;
267
268 i = ni;
269}
270
271net_packet *
272pkt_queue::get ()
273{
274 if (empty ())
275 return 0;
276
277 net_packet *p = queue[j].pkt;
278 queue[j].pkt = 0;
279
280 j = j + 1 == max_queue ? 0 : j + 1;
281
282 return p;
283}
284
191struct net_rateinfo { 285struct net_rateinfo
286{
192 u32 host; 287 u32 host;
193 double pcnt, diff; 288 double pcnt, diff;
194 tstamp last; 289 tstamp last;
195}; 290};
196 291
197// only do action once every x seconds per host whole allowing bursts. 292// only do action once every x seconds per host whole allowing bursts.
198// this implementation ("splay list" ;) is inefficient, 293// this implementation ("splay list" ;) is inefficient,
199// but low on resources. 294// but low on resources.
200struct net_rate_limiter : list<net_rateinfo> 295struct net_rate_limiter : list<net_rateinfo>
201{ 296{
202 static const double ALPHA = 1. - 1. / 90.; // allow bursts 297# define NRL_ALPHA (1. - 1. / 600.) // allow bursts
203 static const double CUTOFF = 20.; // one event every CUTOFF seconds 298# define NRL_CUTOFF 10. // one event every CUTOFF seconds
204 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 299# define NRL_EXPIRE (NRL_CUTOFF * 30.) // expire entries after this time
300# define NRL_MAXDIF (NRL_CUTOFF * (1. / (1. - NRL_ALPHA))) // maximum diff /count value
205 301
206 bool can (const sockinfo &si) { return can((u32)si.host); } 302 bool can (const sockinfo &si) { return can((u32)si.host); }
207 bool can (u32 host); 303 bool can (u32 host);
208}; 304};
209 305
210net_rate_limiter auth_rate_limiter, reset_rate_limiter; 306static net_rate_limiter auth_rate_limiter, reset_rate_limiter;
211 307
308bool
212bool net_rate_limiter::can (u32 host) 309net_rate_limiter::can (u32 host)
213{ 310{
214 iterator i; 311 iterator i;
215 312
216 for (i = begin (); i != end (); ) 313 for (i = begin (); i != end (); )
217 if (i->host == host) 314 if (i->host == host)
218 break; 315 break;
219 else if (i->last < NOW - EXPIRE) 316 else if (i->last < ev_now () - NRL_EXPIRE)
220 i = erase (i); 317 i = erase (i);
221 else 318 else
222 i++; 319 i++;
223 320
224 if (i == end ()) 321 if (i == end ())
225 { 322 {
226 net_rateinfo ri; 323 net_rateinfo ri;
227 324
228 ri.host = host; 325 ri.host = host;
229 ri.pcnt = 1.; 326 ri.pcnt = 1.;
230 ri.diff = CUTOFF * (1. / (1. - ALPHA)); 327 ri.diff = NRL_MAXDIF;
231 ri.last = NOW; 328 ri.last = ev_now ();
232 329
233 push_front (ri); 330 push_front (ri);
234 331
235 return true; 332 return true;
236 } 333 }
237 else 334 else
238 { 335 {
239 net_rateinfo ri (*i); 336 net_rateinfo ri (*i);
240 erase (i); 337 erase (i);
241 338
242 ri.pcnt = ri.pcnt * ALPHA; 339 ri.pcnt = ri.pcnt * NRL_ALPHA;
243 ri.diff = ri.diff * ALPHA + (NOW - ri.last); 340 ri.diff = ri.diff * NRL_ALPHA + (ev_now () - ri.last);
244 341
245 ri.last = NOW; 342 ri.last = ev_now ();
246 343
344 double dif = ri.diff / ri.pcnt;
345
247 bool send = ri.diff / ri.pcnt > CUTOFF; 346 bool send = dif > NRL_CUTOFF;
248 347
348 if (dif > NRL_MAXDIF)
349 {
350 ri.pcnt = 1.;
351 ri.diff = NRL_MAXDIF;
352 }
249 if (send) 353 else if (send)
250 ri.pcnt++; 354 ri.pcnt++;
251 355
252 push_front (ri); 356 push_front (ri);
253 357
254 return send; 358 return send;
255 } 359 }
256} 360}
257 361
258///////////////////////////////////////////////////////////////////////////// 362/////////////////////////////////////////////////////////////////////////////
259 363
260unsigned char hmac_packet::hmac_digest[EVP_MAX_MD_SIZE]; 364void
261
262void hmac_packet::hmac_gen (crypto_ctx *ctx) 365hmac_packet::hmac_gen (crypto_ctx *ctx, u8 *hmac_digest)
263{ 366{
264 unsigned int xlen;
265
266 HMAC_CTX *hctx = &ctx->hctx; 367 HMAC_CTX *hctx = &ctx->hctx;
267 368
268 HMAC_Init_ex (hctx, 0, 0, 0, 0); 369 require (HMAC_Init_ex (hctx, 0, 0, 0, 0));
269 HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet), 370 require (HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet), len - sizeof (hmac_packet)));
270 len - sizeof (hmac_packet)); 371 require (HMAC_Final (hctx, hmac_digest, 0));
271 HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen);
272} 372}
273 373
274void 374void
275hmac_packet::hmac_set (crypto_ctx *ctx) 375hmac_packet::hmac_set (crypto_ctx *ctx)
276{ 376{
277 hmac_gen (ctx); 377 unsigned char hmac_digest[EVP_MAX_MD_SIZE];
278 378 hmac_gen (ctx, hmac_digest);
279 memcpy (hmac, hmac_digest, HMACLENGTH); 379 memcpy (hmac, hmac_digest, HMACLENGTH);
280} 380}
281 381
282bool 382bool
283hmac_packet::hmac_chk (crypto_ctx *ctx) 383hmac_packet::hmac_chk (crypto_ctx *ctx)
284{ 384{
285 hmac_gen (ctx); 385 unsigned char hmac_digest[EVP_MAX_MD_SIZE];
286 386 hmac_gen (ctx, hmac_digest);
287 return !memcmp (hmac, hmac_digest, HMACLENGTH); 387 return !memcmp (hmac, hmac_digest, HMACLENGTH);
288} 388}
289 389
390void
290void vpn_packet::set_hdr (ptype type, unsigned int dst) 391vpn_packet::set_hdr (ptype type_, unsigned int dst)
291{ 392{
292 this->type = type; 393 type = type_;
293 394
294 int src = THISNODE->id; 395 int src = THISNODE->id;
295 396
296 src1 = src; 397 src1 = src;
297 srcdst = ((src >> 8) << 4) | (dst >> 8); 398 srcdst = ((src >> 8) << 4) | (dst >> 8);
299} 400}
300 401
301#define MAXVPNDATA (MAX_MTU - 6 - 6) 402#define MAXVPNDATA (MAX_MTU - 6 - 6)
302#define DATAHDR (sizeof (u32) + RAND_SIZE) 403#define DATAHDR (sizeof (u32) + RAND_SIZE)
303 404
304struct vpndata_packet:vpn_packet 405struct vpndata_packet : vpn_packet
406{
407 u8 data[MAXVPNDATA + DATAHDR]; // seqno
408
409 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
410 tap_packet *unpack (connection *conn, u32 &seqno);
411
412private:
413 const u32 data_hdr_size () const
305 { 414 {
306 u8 data[MAXVPNDATA + DATAHDR]; // seqno
307
308 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
309 tap_packet *unpack (connection *conn, u32 &seqno);
310private:
311
312 const u32 data_hdr_size () const
313 {
314 return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR; 415 return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR;
315 }
316 }; 416 }
417};
317 418
318void 419void
319vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno) 420vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno)
320{ 421{
321 EVP_CIPHER_CTX *cctx = &conn->octx->cctx; 422 EVP_CIPHER_CTX *cctx = &conn->octx->cctx;
322 int outl = 0, outl2; 423 int outl = 0, outl2;
323 ptype type = PT_DATA_UNCOMPRESSED; 424 ptype type = PT_DATA_UNCOMPRESSED;
324 425
325#if ENABLE_COMPRESSION 426#if ENABLE_COMPRESSION
326 u8 cdata[MAX_MTU]; 427 u8 cdata[MAX_MTU];
327 u32 cl;
328 428
429 if (conn->features & FEATURE_COMPRESSION)
430 {
329 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7); 431 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
432
330 if (cl) 433 if (cl)
331 { 434 {
332 type = PT_DATA_COMPRESSED; 435 type = PT_DATA_COMPRESSED;
333 d = cdata; 436 d = cdata;
334 l = cl + 2; 437 l = cl + 2;
335 438
336 d[0] = cl >> 8; 439 d[0] = cl >> 8;
337 d[1] = cl; 440 d[1] = cl;
441 }
338 } 442 }
339#endif 443#endif
340 444
341 EVP_EncryptInit_ex (cctx, 0, 0, 0, 0); 445 require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 1));
342 446
343 struct { 447 struct {
344#if RAND_SIZE 448#if RAND_SIZE
345 u8 rnd[RAND_SIZE]; 449 u8 rnd[RAND_SIZE];
346#endif 450#endif
347 u32 seqno; 451 u32 seqno;
348 } datahdr; 452 } datahdr;
349 453
350 datahdr.seqno = ntohl (seqno); 454 datahdr.seqno = ntohl (seqno);
351#if RAND_SIZE 455#if RAND_SIZE
352 RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE); 456 // NB: a constant (per session) random prefix
457 // is likely enough, but we don't take any chances.
458 conn->oiv.get (datahdr.rnd, RAND_SIZE);
353#endif 459#endif
354 460
355 EVP_EncryptUpdate (cctx, 461 require (EVP_EncryptUpdate (cctx,
356 (unsigned char *) data + outl, &outl2, 462 (unsigned char *) data + outl, &outl2,
357 (unsigned char *) &datahdr, DATAHDR); 463 (unsigned char *) &datahdr, DATAHDR));
358 outl += outl2; 464 outl += outl2;
359 465
360 EVP_EncryptUpdate (cctx, 466 require (EVP_EncryptUpdate (cctx,
361 (unsigned char *) data + outl, &outl2, 467 (unsigned char *) data + outl, &outl2,
362 (unsigned char *) d, l); 468 (unsigned char *) d, l));
363 outl += outl2; 469 outl += outl2;
364 470
365 EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2); 471 require (EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2));
366 outl += outl2; 472 outl += outl2;
367 473
368 len = outl + data_hdr_size (); 474 len = outl + data_hdr_size ();
369 475
370 set_hdr (type, dst); 476 set_hdr (type, dst);
379 int outl = 0, outl2; 485 int outl = 0, outl2;
380 tap_packet *p = new tap_packet; 486 tap_packet *p = new tap_packet;
381 u8 *d; 487 u8 *d;
382 u32 l = len - data_hdr_size (); 488 u32 l = len - data_hdr_size ();
383 489
384 EVP_DecryptInit_ex (cctx, 0, 0, 0, 0); 490 require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 0));
385 491
386#if ENABLE_COMPRESSION 492#if ENABLE_COMPRESSION
387 u8 cdata[MAX_MTU]; 493 u8 cdata[MAX_MTU];
388 494
389 if (type == PT_DATA_COMPRESSED) 495 if (type == PT_DATA_COMPRESSED)
390 d = cdata; 496 d = cdata;
391 else 497 else
392#endif 498#endif
393 d = &(*p)[6 + 6 - DATAHDR]; 499 d = &(*p)[6 + 6] - DATAHDR;
394 500
395 /* this overwrites part of the src mac, but we fix that later */ 501 // we play do evil games with the struct layout atm.
502 // pending better solutions, we at least do some verification.
503 // this is fine, as we left ISO territory long ago.
504 require (DATAHDR <= 16);
505 require ((u8 *)(&p->len + 1) == &(*p)[0]);
506
507 // this can overwrite the len/dst/src fields
396 EVP_DecryptUpdate (cctx, 508 require (EVP_DecryptUpdate (cctx,
397 d, &outl2, 509 d, &outl2,
398 (unsigned char *)&data, len - data_hdr_size ()); 510 (unsigned char *)&data, len - data_hdr_size ()));
399 outl += outl2; 511 outl += outl2;
400 512
401 EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2); 513 require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2));
402 outl += outl2; 514 outl += outl2;
403 515
404 seqno = ntohl (*(u32 *)(d + RAND_SIZE)); 516 seqno = ntohl (*(u32 *)(d + RAND_SIZE));
405 517
406 id2mac (dst () ? dst() : THISNODE->id, p->dst); 518 id2mac (dst () ? dst() : THISNODE->id, p->dst);
431 } 543 }
432}; 544};
433 545
434struct config_packet : vpn_packet 546struct config_packet : vpn_packet
435{ 547{
436 // actually, hmaclen cannot be checked because the hmac 548 u8 serial[SERIAL_SIZE];
437 // field comes before this data, so peers with other
438 // hmacs simply will not work.
439 u8 prot_major, prot_minor, randsize, hmaclen; 549 u8 prot_major, prot_minor, randsize;
440 u8 flags, challengelen, pad2, pad3; 550 u8 flags, features, pad6, pad7, pad8;
441 u32 cipher_nid, digest_nid, hmac_nid; 551 u32 cipher_nid, mac_nid, auth_nid;
442 552
443 const u8 curflags () const 553 void setup (ptype type, int dst);
554 bool chk_config (const conf_node *conf, const sockinfo &rsi) const;
555
556 static u8 get_features ()
444 { 557 {
558 u8 f = 0;
559#if ENABLE_COMPRESSION
560 f |= FEATURE_COMPRESSION;
561#endif
562#if ENABLE_ROHC
563 f |= FEATURE_ROHC;
564#endif
565#if ENABLE_BRIDGING
566 f |= FEATURE_BRIDGING;
567#endif
445 return 0x80 568 return f;
446 | (ENABLE_COMPRESSION ? 0x01 : 0x00);
447 } 569 }
448
449 void setup (ptype type, int dst);
450 bool chk_config () const;
451}; 570};
452 571
572void
453void config_packet::setup (ptype type, int dst) 573config_packet::setup (ptype type, int dst)
454{ 574{
455 prot_major = PROTOCOL_MAJOR; 575 prot_major = PROTOCOL_MAJOR;
456 prot_minor = PROTOCOL_MINOR; 576 prot_minor = PROTOCOL_MINOR;
457 randsize = RAND_SIZE; 577 randsize = RAND_SIZE;
458 hmaclen = HMACLENGTH; 578 flags = 0;
459 flags = curflags (); 579 features = get_features ();
460 challengelen = sizeof (rsachallenge);
461 580
581 strncpy ((char *)serial, conf.serial, sizeof (serial));
582
462 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER)); 583 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ()));
463 digest_nid = htonl (EVP_MD_type (RSA_HASH));
464 hmac_nid = htonl (EVP_MD_type (DIGEST)); 584 mac_nid = htonl (EVP_MD_type (MAC_DIGEST ()));
585 auth_nid = htonl (EVP_MD_type (AUTH_DIGEST ()));
465 586
466 len = sizeof (*this) - sizeof (net_packet); 587 len = sizeof (*this) - sizeof (net_packet);
467 set_hdr (type, dst); 588 set_hdr (type, dst);
468} 589}
469 590
470bool config_packet::chk_config () const 591bool
592config_packet::chk_config (const conf_node *conf, const sockinfo &rsi) const
471{ 593{
472 return prot_major == PROTOCOL_MAJOR 594 if (prot_major != PROTOCOL_MAJOR)
473 && randsize == RAND_SIZE 595 slog (L_WARN, _("%s(%s): major version mismatch (remote %d <=> local %d)"),
474 && hmaclen == HMACLENGTH 596 conf->nodename, (const char *)rsi, prot_major, PROTOCOL_MAJOR);
475 && flags == curflags () 597 else if (randsize != RAND_SIZE)
476 && challengelen == sizeof (rsachallenge) 598 slog (L_WARN, _("%s(%s): rand size mismatch (remote %d <=> local %d)"),
599 conf->nodename, (const char *)rsi, randsize, RAND_SIZE);
477 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER)) 600 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ())))
478 && digest_nid == htonl (EVP_MD_type (RSA_HASH)) 601 slog (L_WARN, _("%s(%s): cipher algo mismatch (remote %x <=> local %x)"),
479 && hmac_nid == htonl (EVP_MD_type (DIGEST)); 602 conf->nodename, (const char *)rsi, ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));
480} 603 else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ())))
604 slog (L_WARN, _("%s(%s): mac algo mismatch (remote %x <=> local %x)"),
605 conf->nodename, (const char *)rsi, ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ()));
606 else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ())))
607 slog (L_WARN, _("%s(%s): auth algo mismatch (remote %x <=> local %x)"),
608 conf->nodename, (const char *)rsi, ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ()));
609 else
610 {
611 int cmp = memcmp (serial, ::conf.serial, sizeof (serial));
481 612
613 if (cmp > 0)
614 slog (L_WARN, _("%s(%s): remote serial newer than local serial - outdated config?"),
615 conf->nodename, (const char *)rsi);
616 else if (cmp == 0)
617 return true;
618 }
619
620 return false;
621}
622
482struct auth_req_packet : config_packet 623struct auth_req_packet : config_packet // UNPROTECTED
483{ 624{
484 char magic[8]; 625 char magic[8];
485 u8 initiate; // false if this is just an automatic reply 626 u8 initiate; // false if this is just an automatic reply
486 u8 protocols; // supported protocols (will get patches on forward) 627 u8 protocols; // supported protocols (will be patched on forward)
487 u8 pad2, pad3; 628 u8 pad2, pad3;
488 rsaid id; 629 auth_encr encr;
489 rsaencrdata encr;
490 630
491 auth_req_packet (int dst, bool initiate_, u8 protocols_) 631 auth_req_packet (int dst, bool initiate_, u8 protocols_)
492 { 632 {
493 config_packet::setup (PT_AUTH_REQ, dst); 633 config_packet::setup (PT_AUTH_REQ, dst);
494 strncpy (magic, MAGIC, 8); 634 memcpy (magic, MAGIC, 8);
495 initiate = !!initiate_; 635 initiate = !!initiate_;
496 protocols = protocols_; 636 protocols = protocols_;
497 637
498 len = sizeof (*this) - sizeof (net_packet); 638 len = sizeof (*this) - sizeof (net_packet);
499 } 639 }
500}; 640};
501 641
502struct auth_res_packet : config_packet 642struct auth_res_packet : vpn_packet // UNPROTECTED
503{ 643{
504 rsaid id;
505 u8 pad1, pad2, pad3;
506 u8 response_len; // encrypted length
507 rsaresponse response; 644 auth_response response;
508 645
509 auth_res_packet (int dst) 646 auth_res_packet (int dst)
510 { 647 {
511 config_packet::setup (PT_AUTH_RES, dst); 648 set_hdr (PT_AUTH_RES, dst);
512 649
513 len = sizeof (*this) - sizeof (net_packet); 650 len = sizeof (*this) - sizeof (net_packet);
514 } 651 }
515}; 652};
516 653
546}; 683};
547 684
548///////////////////////////////////////////////////////////////////////////// 685/////////////////////////////////////////////////////////////////////////////
549 686
550void 687void
688connection::connection_established (const sockinfo &rsi)
689{
690 if (!have_snd_auth || !have_rcv_auth)
691 return;
692
693 si = rsi;
694 protocol = rsi.prot;
695
696 slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
697 conf->nodename, (const char *)rsi,
698 is_direct ? "direct" : "forwarded",
699 PROTOCOL_MAJOR, prot_minor);
700
701 if (::conf.script_node_up)
702 {
703 run_script_cb *cb = new run_script_cb;
704 cb->set<connection, &connection::script_node_up> (this);
705 run_script_queued (cb, _("node-up command execution failed, continuing."));
706 }
707
708 delete ictx; ictx = new crypto_ctx (rcv_auth, snd_auth, rcv_ecdh_a, rcv_auth.ecdh, 0);
709 iseqno.reset (ntohl (rcv_auth.rsa.seqno) & 0x7fffffff);
710
711 delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b , 1);
712 oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff;
713
714 oiv.reset ();
715
716 // make sure rekeying timeouts are slightly asymmetric
717 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
718 rekey.start (rekey_interval, rekey_interval);
719
720 keepalive.start (::conf.keepalive);
721
722 // send queued packets
723 if (ictx && octx)
724 {
725 while (tap_packet *p = (tap_packet *)data_queue.get ())
726 {
727 if (p->len) send_data_packet (p);
728 delete p;
729 }
730
731 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
732 {
733 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
734 delete p;
735 }
736 }
737
738 vpn->connection_established (this);
739}
740
741void
551connection::reset_dstaddr () 742connection::reset_si ()
552{ 743{
744 if (vpn->can_direct (THISNODE, conf))
745 protocol = best_protocol (THISNODE->protocols & conf->connectable_protocols ());
746 else
747 {
748 slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
749 protocol = 0;
750 }
751
553 si.set (conf); 752 si.set (conf, protocol);
753
754 is_direct = si.valid ();
755}
756
757// ensure sockinfo is valid, forward if necessary
758const sockinfo &
759connection::forward_si (const sockinfo &si) const
760{
761 if (!si.valid ())
762 {
763 connection *r = vpn->find_router_for (this);
764
765 if (r)
766 {
767 slog (L_DEBUG, _("%s: no common protocol, trying to route through %s."),
768 conf->nodename, r->conf->nodename);
769 return r->si;
770 }
771 else
772 slog (L_DEBUG, _("%s: node unreachable, no common protocol or no router available."),
773 conf->nodename);
774 }
775
776 return si;
777}
778
779void
780connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
781{
782 if (!vpn->send_vpn_packet (pkt, si, tos))
783 reset_connection ();
554} 784}
555 785
556void 786void
557connection::send_ping (const sockinfo &si, u8 pong) 787connection::send_ping (const sockinfo &si, u8 pong)
558{ 788{
559 ping_packet *pkt = new ping_packet; 789 ping_packet *pkt = new ping_packet;
560 790
561 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 791 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
792
793 slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
562 send_vpn_packet (pkt, si, IPTOS_LOWDELAY); 794 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
563 795
564 delete pkt; 796 delete pkt;
565} 797}
566 798
581void 813void
582connection::send_auth_request (const sockinfo &si, bool initiate) 814connection::send_auth_request (const sockinfo &si, bool initiate)
583{ 815{
584 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols); 816 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
585 817
586 protocol = best_protocol (THISNODE->protocols & conf->protocols); 818 generate_auth_data ();
819 auth_encrypt (conf->rsa_key, snd_auth, pkt->encr);
587 820
588 // mask out protocols we cannot establish
589 if (!conf->udp_port) protocol &= ~PROT_UDPv4;
590 if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
591
592 if (protocol)
593 {
594 rsachallenge chg;
595
596 rsa_cache.gen (pkt->id, chg);
597
598 if (0 > RSA_public_encrypt (sizeof chg,
599 (unsigned char *)&chg, (unsigned char *)&pkt->encr,
600 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
601 fatal ("RSA_public_encrypt error");
602
603 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 821 slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
604
605 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 822 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
606 823
607 delete pkt; 824 delete pkt;
608 }
609 else
610 ; // silently fail
611} 825}
612 826
613void 827void
614connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg) 828connection::send_auth_response (const sockinfo &si)
615{ 829{
616 auth_res_packet *pkt = new auth_res_packet (conf->id); 830 auth_res_packet *pkt = new auth_res_packet (conf->id);
617 831
618 pkt->id = id; 832 memcpy (pkt->response.ecdh, rcv_ecdh_b, sizeof rcv_ecdh_b);
833 auth_hash (rcv_auth, rcv_ecdh_b, pkt->response.mac);
619 834
620 rsa_hash (id, chg, pkt->response);
621
622 pkt->hmac_set (octx);
623
624 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si); 835 slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
625
626 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 836 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
627 837
628 delete pkt; 838 delete pkt;
629} 839}
630 840
631void 841void
632connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols) 842connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
633{ 843{
634 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 844 slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s,p%02x)", conf->nodename,
635 conf->id, rid, (const char *)rsi); 845 vpn->conns[rid - 1]->conf->nodename, (const char *)rsi,
846 conf->protocols);
636 847
637 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols); 848 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
638 849
639 r->hmac_set (octx); 850 r->hmac_set (octx);
640 send_vpn_packet (r, si); 851 send_vpn_packet (r, si);
641 852
642 delete r; 853 delete r;
643} 854}
644 855
645void 856inline void
646connection::establish_connection_cb (time_watcher &w) 857connection::establish_connection_cb (ev::timer &w, int revents)
647{ 858{
648 if (ictx || conf == THISNODE 859 if (!(ictx && octx)
860 && conf != THISNODE
649 || connectmode == conf_node::C_NEVER 861 && connectmode != conf_node::C_NEVER
650 || connectmode == conf_node::C_DISABLED) 862 && connectmode != conf_node::C_DISABLED
651 w.at = TSTAMP_CANCEL; 863 && !w.is_active ())
652 else if (w.at <= NOW)
653 { 864 {
654 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6; 865 // a bit hacky, if ondemand, and packets are no longer queued, then reset the connection
655 866 // and stop trying. should probably be handled by a per-connection expire handler.
656 if (retry_int < 3600 * 8) 867 if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())
657 retry_cnt++;
658
659 w.at = NOW + retry_int;
660
661 if (conf->hostname)
662 { 868 {
663 reset_dstaddr (); 869 reset_connection ();
664 if (si.host && auth_rate_limiter.can (si)) 870 return;
665 {
666 if (retry_cnt < 4)
667 send_auth_request (si, true);
668 else
669 send_ping (si, 0);
670 } 871 }
872
873 last_establish_attempt = ev_now ();
874
875 ev::tstamp retry_int = ev::tstamp (retry_cnt & 3
876 ? (retry_cnt & 3) + 1
877 : 1 << (retry_cnt >> 2));
878
879 reset_si ();
880
881 bool slow = si.prot & PROT_SLOW;
882
883 if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
884 {
885 /*TODO*/ /* start the timer so we don't recurse endlessly */
886 w.start (1);
887 vpn->send_connect_request (this);
671 } 888 }
672 else 889 else
673 vpn->connect_request (conf->id); 890 {
891 if (si.valid ())
892 slog (L_DEBUG, _("%s: sending direct connection request to %s."),
893 conf->nodename, (const char *)si);
894
895 const sockinfo &dsi = forward_si (si);
896
897 slow = slow || (dsi.prot & PROT_SLOW);
898
899 if (dsi.valid () && auth_rate_limiter.can (dsi))
900 {
901 if (retry_cnt < 4)
902 send_auth_request (dsi, true);
903 else
904 send_ping (dsi, 0);
905 }
906 }
907
908 retry_int *= slow ? 8. : 0.9;
909
910 if (retry_int < conf->max_retry)
911 retry_cnt++;
912 else
913 retry_int = conf->max_retry;
914
915 w.start (retry_int);
674 } 916 }
675} 917}
676 918
677void 919void
678connection::reset_connection () 920connection::reset_connection ()
681 { 923 {
682 slog (L_INFO, _("%s(%s): connection lost"), 924 slog (L_INFO, _("%s(%s): connection lost"),
683 conf->nodename, (const char *)si); 925 conf->nodename, (const char *)si);
684 926
685 if (::conf.script_node_down) 927 if (::conf.script_node_down)
686 run_script (run_script_cb (this, &connection::script_node_down), false); 928 {
929 run_script_cb *cb = new run_script_cb;
930 cb->set<connection, &connection::script_node_down> (this);
931 run_script_queued (cb, _("node-down command execution failed, continuing."));
932 }
687 } 933 }
688 934
689 delete ictx; ictx = 0; 935 delete ictx; ictx = 0;
690 delete octx; octx = 0; 936 delete octx; octx = 0;
691 937
692 si.host= 0; 938 si.host = 0;
693 939
940 have_snd_auth = false;
941 have_rcv_auth = false;
942 auth_expire = 0.;
943
694 last_activity = 0; 944 last_activity = 0.;
945 //last_si_change = 0.;
695 retry_cnt = 0; 946 retry_cnt = 0;
696 947
697 rekey.reset (); 948 rekey.stop ();
698 keepalive.reset (); 949 keepalive.stop ();
699 establish_connection.reset (); 950 establish_connection.stop ();
700} 951}
701 952
702void 953void
703connection::shutdown () 954connection::shutdown ()
704{ 955{
706 send_reset (si); 957 send_reset (si);
707 958
708 reset_connection (); 959 reset_connection ();
709} 960}
710 961
711void 962// poor-man's rekeying
712connection::rekey_cb (time_watcher &w) 963inline void
964connection::rekey_cb (ev::timer &w, int revents)
713{ 965{
714 w.at = TSTAMP_CANCEL;
715
716 reset_connection (); 966 reset_connection ();
717 establish_connection (); 967 establish_connection ();
718} 968}
719 969
720void 970void
721connection::send_data_packet (tap_packet *pkt, bool broadcast) 971connection::send_data_packet (tap_packet *pkt)
722{ 972{
723 vpndata_packet *p = new vpndata_packet; 973 vpndata_packet *p = new vpndata_packet;
724 int tos = 0; 974 int tos = 0;
725 975
726 if (conf->inherit_tos 976 // I am not hilarious about peeking into packets, but so be it.
727 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 977 if (conf->inherit_tos && pkt->is_ipv4 ())
728 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
729 tos = (*pkt)[15] & IPTOS_TOS_MASK; 978 tos = (*pkt)[15] & IPTOS_TOS_MASK;
730 979
731 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 980 p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
732 send_vpn_packet (p, si, tos); 981 send_vpn_packet (p, si, tos);
733 982
734 delete p; 983 delete p;
735 984
736 if (oseqno > MAX_SEQNO) 985 if (oseqno > MAX_SEQNO)
737 rekey (); 986 rekey ();
738} 987}
739 988
740void 989void
990connection::post_inject_queue ()
991{
992 // force a connection every now and when when packets are sent (max 1/s)
993 if (ev_now () - last_establish_attempt >= 0.95) // arbitrary
994 establish_connection.stop ();
995
996 establish_connection ();
997}
998
999void
741connection::inject_data_packet (tap_packet *pkt, bool broadcast) 1000connection::inject_data_packet (tap_packet *pkt)
742{ 1001{
743 if (ictx && octx) 1002 if (ictx && octx)
744 send_data_packet (pkt, broadcast); 1003 send_data_packet (pkt);
745 else 1004 else
746 { 1005 {
747 if (!broadcast)//DDDD
748 queue.put (new tap_packet (*pkt)); 1006 data_queue.put (new tap_packet (*pkt));
1007 post_inject_queue ();
1008 }
1009}
749 1010
750 establish_connection (); 1011void
1012connection::inject_vpn_packet (vpn_packet *pkt, int tos)
1013{
1014 if (ictx && octx)
1015 send_vpn_packet (pkt, si, tos);
1016 else
1017 {
1018 vpn_queue.put ((vpn_packet *)new data_packet (*(data_packet *)pkt));
1019 post_inject_queue ();
751 } 1020 }
752} 1021}
753 1022
754void 1023void
755connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 1024connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
756{ 1025{
757 last_activity = NOW; 1026 last_activity = ev_now ();
758 1027
759 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 1028 slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
760 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 1029 conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
1030
1031 if (connectmode == conf_node::C_DISABLED)
1032 return;
761 1033
762 switch (pkt->typ ()) 1034 switch (pkt->typ ())
763 { 1035 {
764 case vpn_packet::PT_PING: 1036 case vpn_packet::PT_PING:
1037 slog (L_TRACE, "%s >> PT_PING", conf->nodename);
1038
765 // we send pings instead of auth packets after some retries, 1039 // we send pings instead of auth packets after some retries,
766 // so reset the retry counter and establish a connection 1040 // so reset the retry counter and establish a connection
767 // when we receive a ping. 1041 // when we receive a ping.
768 if (!ictx) 1042 if (!ictx)
769 { 1043 {
770 if (auth_rate_limiter.can (rsi)) 1044 if (auth_rate_limiter.can (rsi))
771 send_auth_request (rsi, true); 1045 send_auth_request (rsi, true);
772 } 1046 }
773 else 1047 else
1048 // we would love to change the socket address here, but ping's aren't
1049 // authenticated, so we best ignore it.
774 send_ping (rsi, 1); // pong 1050 send_ping (rsi, 1); // pong
775 1051
776 break; 1052 break;
777 1053
778 case vpn_packet::PT_PONG: 1054 case vpn_packet::PT_PONG:
1055 slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
1056
1057 // a PONG might mean that the other side doesn't really know
1058 // about our desire for communication.
1059 establish_connection ();
779 break; 1060 break;
780 1061
781 case vpn_packet::PT_RESET: 1062 case vpn_packet::PT_RESET:
782 { 1063 {
783 reset_connection (); 1064 reset_connection ();
784 1065
785 config_packet *p = (config_packet *) pkt; 1066 config_packet *p = (config_packet *) pkt;
786 1067
787 if (!p->chk_config ()) 1068 if (p->chk_config (conf, rsi) && connectmode == conf_node::C_ALWAYS)
788 {
789 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
790 conf->nodename, (const char *)rsi);
791 connectmode = conf_node::C_DISABLED;
792 }
793 else if (connectmode == conf_node::C_ALWAYS)
794 establish_connection (); 1069 establish_connection ();
795 } 1070 }
796 break; 1071 break;
797 1072
798 case vpn_packet::PT_AUTH_REQ: 1073 case vpn_packet::PT_AUTH_REQ:
799 if (auth_rate_limiter.can (rsi)) 1074 if (auth_rate_limiter.can (rsi))
800 { 1075 {
801 auth_req_packet *p = (auth_req_packet *) pkt; 1076 auth_req_packet *p = (auth_req_packet *)pkt;
802 1077
803 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 1078 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)",
1079 conf->nodename, p->initiate ? "initiate" : "reply",
1080 p->protocols, p->features);
804 1081
805 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 1082 if (memcmp (p->magic, MAGIC, 8))
1083 {
1084 slog (L_WARN, _("%s(%s): protocol magic mismatch - stray packet?"),
1085 conf->nodename, (const char *)rsi);
1086 }
1087 else if (p->chk_config (conf, rsi))
806 { 1088 {
807 if (p->prot_minor != PROTOCOL_MINOR) 1089 if (p->prot_minor != PROTOCOL_MINOR)
808 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1090 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
809 conf->nodename, (const char *)rsi, 1091 conf->nodename, (const char *)rsi,
810 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 1092 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
811 1093
812 if (p->initiate) 1094 if (p->initiate)
813 send_auth_request (rsi, false); 1095 send_auth_request (rsi, false);
814 1096
815 rsachallenge k; 1097 auth_data auth;
816 1098
817 if (0 > RSA_private_decrypt (sizeof (p->encr), 1099 if (!auth_decrypt (::conf.rsa_key, p->encr, auth))
818 (unsigned char *)&p->encr, (unsigned char *)&k, 1100 {
819 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
820 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 1101 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
821 conf->nodename, (const char *)rsi); 1102 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
1103 }
822 else 1104 else
823 { 1105 {
824 retry_cnt = 0; 1106 bool chg = !have_rcv_auth || memcmp (&rcv_auth, &auth, sizeof auth);
825 establish_connection.set (NOW + 8); //? ;)
826 keepalive.reset ();
827 rekey.reset ();
828 1107
829 delete ictx;
830 ictx = 0; 1108 rcv_auth = auth;
1109 have_rcv_auth = true;
831 1110
832 delete octx; 1111 send_auth_response (rsi);
833 1112
834 octx = new crypto_ctx (k, 1); 1113 if (chg)
835 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 1114 {
836
837 conf->protocols = p->protocols; 1115 conf->protocols = p->protocols;
838 send_auth_response (rsi, p->id, k); 1116 features = p->features & config_packet::get_features ();
839 1117
1118 connection_established (rsi);
840 break; 1119 }
841 } 1120 }
1121
1122 break;
842 } 1123 }
843 1124
844 send_reset (rsi); 1125 send_reset (rsi);
845 } 1126 }
846 1127
847 break; 1128 break;
848 1129
849 case vpn_packet::PT_AUTH_RES: 1130 case vpn_packet::PT_AUTH_RES:
850 { 1131 {
851 auth_res_packet *p = (auth_res_packet *) pkt; 1132 auth_res_packet *p = (auth_res_packet *)pkt;
852 1133
853 slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id); 1134 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
854 1135
855 if (p->chk_config ()) 1136 auth_mac local_mac;
1137 auth_hash (snd_auth, p->response.ecdh, local_mac);
1138
1139 if (memcmp (&p->response.mac, local_mac, sizeof local_mac))
856 { 1140 {
857 if (p->prot_minor != PROTOCOL_MINOR)
858 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
859 conf->nodename, (const char *)rsi,
860 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
861
862 rsachallenge chg;
863
864 if (!rsa_cache.find (p->id, chg))
865 slog (L_ERR, _("%s(%s): unrequested auth response"), 1141 slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),
866 conf->nodename, (const char *)rsi); 1142 conf->nodename, (const char *)rsi);
867 else
868 {
869 crypto_ctx *cctx = new crypto_ctx (chg, 0);
870
871 if (!p->hmac_chk (cctx))
872 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
873 "could be an attack, or just corruption or an synchronization error"),
874 conf->nodename, (const char *)rsi);
875 else
876 {
877 rsaresponse h;
878
879 rsa_hash (p->id, chg, h);
880
881 if (!memcmp ((u8 *)&h, (u8 *)p->response, sizeof h))
882 {
883 prot_minor = p->prot_minor;
884
885 delete ictx; ictx = cctx;
886
887 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
888
889 si = rsi;
890
891 rekey.set (NOW + ::conf.rekey);
892 keepalive.set (NOW + ::conf.keepalive);
893
894 // send queued packets
895 while (tap_packet *p = queue.get ())
896 {
897 send_data_packet (p);
898 delete p;
899 }
900
901 connectmode = conf->connectmode;
902
903 slog (L_INFO, _("%s(%s): %s connection established, protocol version %d.%d"),
904 conf->nodename, (const char *)rsi,
905 strprotocol (protocol),
906 p->prot_major, p->prot_minor);
907
908 if (::conf.script_node_up)
909 run_script (run_script_cb (this, &connection::script_node_up), false);
910
911 break;
912 }
913 else
914 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
915 conf->nodename, (const char *)rsi);
916 }
917
918 delete cctx;
919 } 1143 }
1144 else if (!have_snd_auth)
1145 {
1146 memcpy (snd_ecdh_b, p->response.ecdh, sizeof snd_ecdh_b);
1147
1148 have_snd_auth = true;
1149 connection_established (rsi);
920 } 1150 }
921 } 1151 }
922
923 send_reset (rsi);
924 break; 1152 break;
925 1153
926 case vpn_packet::PT_DATA_COMPRESSED: 1154 case vpn_packet::PT_DATA_COMPRESSED:
927#if !ENABLE_COMPRESSION 1155#if !ENABLE_COMPRESSION
928 send_reset (rsi); 1156 send_reset (rsi);
933 1161
934 if (ictx && octx) 1162 if (ictx && octx)
935 { 1163 {
936 vpndata_packet *p = (vpndata_packet *)pkt; 1164 vpndata_packet *p = (vpndata_packet *)pkt;
937 1165
938 if (rsi == si) 1166 if (!p->hmac_chk (ictx))
1167 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1168 "could be an attack, or just corruption or a synchronization error."),
1169 conf->nodename, (const char *)rsi);
1170 else
939 { 1171 {
940 if (!p->hmac_chk (ictx))
941 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
942 "could be an attack, or just corruption or an synchronization error"),
943 conf->nodename, (const char *)rsi);
944 else 1172 u32 seqno;
1173 tap_packet *d = p->unpack (this, seqno);
1174 int seqclass = iseqno.seqno_classify (seqno);
1175
1176 if (seqclass == 0) // ok
945 { 1177 {
946 u32 seqno; 1178 vpn->tap->send (d);
947 tap_packet *d = p->unpack (this, seqno);
948 1179
949 if (iseqno.recv_ok (seqno)) 1180 if (si != rsi)
950 { 1181 {
951 vpn->tap->send (d); 1182 // fast re-sync on source address changes, useful especially for tcp/ip
1183 //if (last_si_change < ev_now () + 5.)
1184 // {
1185 slog (L_INFO, _("%s(%s): changing socket address to %s."),
1186 conf->nodename, (const char *)si, (const char *)rsi);
952 1187
953 if (p->dst () == 0) // re-broadcast 1188 si = rsi;
954 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i) 1189
1190 if (::conf.script_node_change)
955 { 1191 {
956 connection *c = *i; 1192 run_script_cb *cb = new run_script_cb;
957 1193 cb->set<connection, &connection::script_node_change> (this);
958 if (c->conf != THISNODE && c->conf != conf) 1194 run_script_queued (cb, _("node-change command execution failed, continuing."));
959 c->inject_data_packet (d);
960 } 1195 }
961 1196
1197 // }
962 delete d; 1198 //else
963 1199 // slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
964 break; 1200 // conf->nodename, (const char *)si, (const char *)rsi);
965 } 1201 }
966 } 1202 }
1203 else if (seqclass == 1) // far history
1204 slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
1205 "possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
1206 else if (seqclass == 2) // in-window duplicate, happens often on wireless
1207 slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
1208 "possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
1209 else if (seqclass == 3) // reset
1210 {
1211 slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
1212 "probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
1213 send_reset (rsi);
1214 }
1215
1216 delete d;
1217 break;
967 } 1218 }
968 else
969 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
970 } 1219 }
971 1220
972 send_reset (rsi); 1221 send_reset (rsi);
973 break; 1222 break;
974 1223
975 case vpn_packet::PT_CONNECT_REQ: 1224 case vpn_packet::PT_CONNECT_REQ:
976 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1225 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
977 { 1226 {
978 connect_req_packet *p = (connect_req_packet *) pkt; 1227 connect_req_packet *p = (connect_req_packet *)pkt;
979 1228
980 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1229 if (p->id > 0 && p->id <= vpn->conns.size ())
981 conf->protocols = p->protocols;
982 connection *c = vpn->conns[p->id - 1];
983
984 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
985 conf->id, p->id, c->ictx && c->octx);
986
987 if (c->ictx && c->octx)
988 { 1230 {
1231 connection *c = vpn->conns[p->id - 1];
1232 conf->protocols = p->protocols;
1233
1234 slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s,p%02x) [%d]",
1235 conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1236 p->protocols,
1237 c->ictx && c->octx);
1238
1239 if (c->ictx && c->octx)
1240 {
989 // send connect_info packets to both sides, in case one is 1241 // send connect_info packets to both sides, in case one is
990 // behind a nat firewall (or both ;) 1242 // behind a nat firewall (or both ;)
991 c->send_connect_info (conf->id, si, conf->protocols); 1243 c->send_connect_info (conf->id, si, conf->protocols);
992 send_connect_info (c->conf->id, c->si, c->conf->protocols); 1244 send_connect_info (c->conf->id, c->si, c->conf->protocols);
1245 }
1246 else
1247 c->establish_connection ();
993 } 1248 }
1249 else
1250 slog (L_WARN,
1251 _("received authenticated connection request from unknown node #%d, config file mismatch?"),
1252 p->id);
994 } 1253 }
995 1254
996 break; 1255 break;
997 1256
998 case vpn_packet::PT_CONNECT_INFO: 1257 case vpn_packet::PT_CONNECT_INFO:
999 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1258 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1000 { 1259 {
1001 connect_info_packet *p = (connect_info_packet *) pkt; 1260 connect_info_packet *p = (connect_info_packet *)pkt;
1002 1261
1003 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1262 if (p->id > 0 && p->id <= vpn->conns.size ())
1004 conf->protocols = p->protocols; 1263 {
1005 connection *c = vpn->conns[p->id - 1]; 1264 connection *c = vpn->conns[p->id - 1];
1006 1265
1007 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1266 c->conf->protocols = p->protocols;
1008 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1267 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1268 p->si.upgrade_protocol (protocol, c->conf);
1009 1269
1270 slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s,protocols=%02x,protocol=%02x,upgradable=%02x) [%d]",
1271 conf->nodename,
1272 vpn->conns[p->id - 1]->conf->nodename,
1273 (const char *)p->si,
1274 p->protocols,
1275 protocol,
1276 p->si.supported_protocols (c->conf),
1277 !c->ictx && !c->octx);
1278
1279 const sockinfo &dsi = forward_si (p->si);
1280
1281 if (dsi.valid ())
1010 c->send_auth_request (p->si, true); 1282 c->send_auth_request (dsi, true);
1283 else
1284 slog (L_INFO, "connect info for %s received (%s), but still unable to contact.",
1285 vpn->conns[p->id - 1]->conf->nodename,
1286 (const char *)p->si);
1287 }
1288 else
1289 slog (L_WARN,
1290 _("received authenticated connection request from unknown node #%d, config file mismatch?"),
1291 p->id);
1011 } 1292 }
1012 1293
1013 break; 1294 break;
1014 1295
1015 default: 1296 default:
1016 send_reset (rsi); 1297 send_reset (rsi);
1017 break; 1298 break;
1018 } 1299 }
1019} 1300}
1020 1301
1021void connection::keepalive_cb (time_watcher &w) 1302inline void
1303connection::keepalive_cb (ev::timer &w, int revents)
1022{ 1304{
1023 if (NOW >= last_activity + ::conf.keepalive + 30) 1305 ev_tstamp when = last_activity + ::conf.keepalive - ev::now ();
1306
1307 if (when >= 0)
1308 w.start (when);
1309 else if (when < -15)
1024 { 1310 {
1025 reset_connection (); 1311 reset_connection ();
1026 establish_connection (); 1312 establish_connection ();
1027 } 1313 }
1028 else if (NOW < last_activity + ::conf.keepalive)
1029 w.at = last_activity + ::conf.keepalive;
1030 else if (conf->connectmode != conf_node::C_ONDEMAND 1314 else if (conf->connectmode != conf_node::C_ONDEMAND
1031 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1315 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1032 { 1316 {
1317 w.start (3);
1033 send_ping (si); 1318 send_ping (si);
1034 w.at = NOW + 5;
1035 } 1319 }
1320 else if (when >= -10)
1321 // hold ondemand connections implicitly a few seconds longer
1322 // should delete octx, though, or something like that ;)
1323 w.start (when + 10);
1036 else 1324 else
1037 reset_connection (); 1325 reset_connection ();
1038} 1326}
1039 1327
1328void
1040void connection::connect_request (int id) 1329connection::send_connect_request (int id)
1041{ 1330{
1042 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1331 connect_req_packet *p = new connect_req_packet (conf->id, id, THISNODE->protocols);
1043 1332
1044 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1333 slog (L_TRACE, "%s << PT_CONNECT_REQ(%s,p%02x)",
1334 conf->nodename, vpn->conns[id - 1]->conf->nodename,
1335 THISNODE->protocols);
1045 p->hmac_set (octx); 1336 p->hmac_set (octx);
1046 send_vpn_packet (p, si); 1337 send_vpn_packet (p, si);
1047 1338
1048 delete p; 1339 delete p;
1049} 1340}
1050 1341
1051void connection::script_node () 1342void
1343connection::script_init_env (const char *ext)
1052{ 1344{
1053 vpn->script_if_up ();
1054
1055 char *env; 1345 char *env;
1346 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
1347 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
1348 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
1349 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
1350 conf->id & 0xff); putenv (env);
1351}
1352
1353void
1354connection::script_init_connect_env ()
1355{
1356 vpn->script_init_env ();
1357
1358 char *env;
1056 asprintf (&env, "DESTID=%d", conf->id); putenv (env); 1359 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1360 asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env);
1057 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); 1361 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1058 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); 1362 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1059 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); 1363 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1060} 1364}
1061 1365
1366inline const char *
1062const char *connection::script_node_up () 1367connection::script_node_up ()
1063{ 1368{
1064 script_node (); 1369 script_init_connect_env ();
1065 1370
1066 putenv ("STATE=up"); 1371 putenv ((char *)"STATE=up");
1067 1372
1373 char *filename;
1374 asprintf (&filename,
1375 "%s/%s",
1376 confbase,
1068 return ::conf.script_node_up ? ::conf.script_node_up : "node-up"; 1377 ::conf.script_node_up ? ::conf.script_node_up : "node-up");
1069}
1070 1378
1379 return filename;
1380}
1381
1382inline const char *
1383connection::script_node_change ()
1384{
1385 script_init_connect_env ();
1386
1387 putenv ((char *)"STATE=change");
1388
1389 char *filename;
1390 asprintf (&filename,
1391 "%s/%s",
1392 confbase,
1393 ::conf.script_node_change ? ::conf.script_node_change : "node-change");
1394
1395 return filename;
1396}
1397
1398inline const char *
1071const char *connection::script_node_down () 1399connection::script_node_down ()
1072{ 1400{
1073 script_node (); 1401 script_init_connect_env ();
1074 1402
1075 putenv ("STATE=down"); 1403 putenv ((char *)"STATE=down");
1076 1404
1077 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1405 char *filename;
1078} 1406 asprintf (&filename,
1407 "%s/%s",
1408 confbase,
1409 ::conf.script_node_down ? ::conf.script_node_down : "node-down");
1079 1410
1080// send a vpn packet out to other hosts 1411 return filename;
1081void
1082connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1083{
1084 switch (protocol)
1085 {
1086 case PROT_IPv4:
1087 vpn->send_ipv4_packet (pkt, si, tos);
1088 break;
1089
1090 case PROT_UDPv4:
1091 vpn->send_udpv4_packet (pkt, si, tos);
1092 break;
1093
1094 case PROT_TCPv4:
1095 vpn->send_tcpv4_packet (pkt, si, tos);
1096 break;
1097 }
1098} 1412}
1099 1413
1100connection::connection(struct vpn *vpn_) 1414connection::connection (struct vpn *vpn, conf_node *conf)
1101: vpn(vpn_) 1415: vpn(vpn), conf(conf),
1102, rekey (this, &connection::rekey_cb) 1416#if ENABLE_DNS
1103, keepalive (this, &connection::keepalive_cb) 1417 dns (0),
1418#endif
1419 data_queue(conf->max_ttl, conf->max_queue + 1),
1420 vpn_queue(conf->max_ttl, conf->max_queue + 1)
1421{
1422 rekey .set<connection, &connection::rekey_cb > (this);
1423 keepalive .set<connection, &connection::keepalive_cb > (this);
1104, establish_connection (this, &connection::establish_connection_cb) 1424 establish_connection.set<connection, &connection::establish_connection_cb> (this);
1105{ 1425
1426 last_establish_attempt = 0.;
1106 octx = ictx = 0; 1427 octx = ictx = 0;
1107 retry_cnt = 0;
1108 1428
1109 connectmode = conf_node::C_ALWAYS; // initial setting 1429 connectmode = conf->connectmode;
1430
1431 // queue a dummy packet to force an initial connection attempt
1432 if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
1433 vpn_queue.put (new net_packet);
1434
1110 reset_connection (); 1435 reset_connection ();
1111} 1436}
1112 1437
1113connection::~connection () 1438connection::~connection ()
1114{ 1439{
1115 shutdown (); 1440 shutdown ();
1116} 1441}
1117 1442
1443void
1118void connection_init () 1444connection_init ()
1119{ 1445{
1120 auth_rate_limiter.clear (); 1446 auth_rate_limiter.clear ();
1121 reset_rate_limiter.clear (); 1447 reset_rate_limiter.clear ();
1122} 1448}
1123 1449

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines