--- gvpe/src/connection.C	2013/10/11 04:07:24	1.108
+++ gvpe/src/connection.C	2015/01/29 00:21:39	1.113
@@ -45,7 +45,7 @@
 #if OPENSSL_VERSION_NUMBER < 0x10100000
   #define require101(exp) exp
 #else
-  #define require101(exp) equire (exp)
+  #define require101(exp) require (exp)
 #endif
 
 #include "conf.h"
@@ -58,7 +58,6 @@
 #include "netcompat.h"
 
 #define MAGIC     "gvpe\xbd\xc6\xdb\x82"	// 8 bytes of magic
-#define MAGIC     "HUHN\xbd\xc6\xdb\x82"	// 8 bytes of magic//D
 
 #define ULTRA_FAST 1
 #define HLOG 15
@@ -392,7 +391,7 @@
 {
   unsigned char hmac_digest[EVP_MAX_MD_SIZE];
   hmac_gen (ctx, hmac_digest);
-  return !memcmp (hmac, hmac_digest, HMACLENGTH);
+  return slow_memeq (hmac, hmac_digest, HMACLENGTH);
 }
 
 void
@@ -408,11 +407,11 @@
 }
 
 #define MAXVPNDATA (MAX_MTU - 6 - 6)
-#define DATAHDR (sizeof (u32) + RAND_SIZE)
 
 struct vpndata_packet : vpn_packet
 {
-  u8 data[MAXVPNDATA + DATAHDR]; // seqno
+  u32 ctr; // seqno
+  u8 data[MAXVPNDATA];
 
   void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
   tap_packet *unpack (connection *conn, u32 &seqno);
@@ -420,10 +419,33 @@
 private:
   const u32 data_hdr_size () const
   {
-    return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR;
+    // the distance from beginning of packet to data member
+    return data - at (0);
   }
 };
 
+// expands packet counter (unlike seqno, in network byte order) to counter mode IV
+static unsigned char *
+expand_iv (u32 ctr)
+{
+  static u32 iv[IV_SIZE (CIPHER) / 4];
+
+  require (sizeof (iv) == 4 * 4);
+  require (IV_SIZE (CIPHER) % 4 == 0);
+
+  iv[0] =
+  iv[1] =
+  iv[2] = ctr;
+
+  // I would reuse ctr here to to avoid potential endianness issues,
+  // but it seems openssl wraps around. While this would be still ok,
+  // and I don't even know if its true, let's play safe and initialise
+  // to 0.
+  iv[3] = 0;
+
+  return (unsigned char *)iv;
+}
+
 void
 vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno)
 {
@@ -450,36 +472,20 @@
     }
 #endif
 
-  require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 1));
+  ctr = htonl (seqno);
 
-  struct {
-#if RAND_SIZE
-    u8 rnd[RAND_SIZE];
-#endif
-    u32 seqno;
-  } datahdr;
-
-  datahdr.seqno = ntohl (seqno);
-#if RAND_SIZE
-  // NB: a constant (per session) random prefix
-  // is likely enough, but we don't take any chances.
-  conn->oiv.get (datahdr.rnd, RAND_SIZE);
-#endif
+  require (EVP_EncryptInit_ex (cctx, 0, 0, 0, expand_iv (ctr)));
 
   require (EVP_EncryptUpdate (cctx,
-                     (unsigned char *) data + outl, &outl2,
-                     (unsigned char *) &datahdr, DATAHDR));
+                     (unsigned char *)data + outl, &outl2,
+                     (unsigned char *)d, l));
   outl += outl2;
 
-  require (EVP_EncryptUpdate (cctx,
-                     (unsigned char *) data + outl, &outl2,
-                     (unsigned char *) d, l));
+  // it seems this is a nop for us, but we do it anyways
+  require (EVP_EncryptFinal_ex (cctx, (unsigned char *)data + outl, &outl2));
   outl += outl2;
 
-  require (EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2));
-  outl += outl2;
-
-  len = outl + data_hdr_size ();
+  len = data_hdr_size () + outl;
 
   set_hdr (type, dst);
 
@@ -493,9 +499,10 @@
   int outl = 0, outl2;
   tap_packet *p = new tap_packet;
   u8 *d;
-  u32 l = len - data_hdr_size ();
 
-  require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 0));
+  seqno = ntohl (ctr);
+
+  require (EVP_DecryptInit_ex (cctx, 0, 0, 0, expand_iv (ctr)));
 
 #if ENABLE_COMPRESSION
   u8 cdata[MAX_MTU];
@@ -504,13 +511,7 @@
     d = cdata;
   else
 #endif
-    d = &(*p)[6 + 6] - DATAHDR;
-
-  // we play do evil games with the struct layout atm.
-  // pending better solutions, we at least do some verification.
-  // this is fine, as we left ISO territory long ago.
-  require (DATAHDR <= 16);
-  require ((u8 *)(&p->len + 1) == &(*p)[0]);
+    d = &(*p)[6 + 6];
 
   // this can overwrite the len/dst/src fields
   require (EVP_DecryptUpdate (cctx,
@@ -518,25 +519,24 @@
                      (unsigned char *)&data, len - data_hdr_size ()));
   outl += outl2;
 
+  // it seems this is a nop for us, but we do it anyways
   require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2));
   outl += outl2;
   
-  seqno = ntohl (*(u32 *)(d + RAND_SIZE));
-
   id2mac (dst () ? dst() : THISNODE->id, p->dst);
   id2mac (src (),                        p->src);
 
 #if ENABLE_COMPRESSION
   if (type == PT_DATA_COMPRESSED)
     {
-      u32 cl = (d[DATAHDR] << 8) | d[DATAHDR + 1];
+      u32 cl = (d[0] << 8) | d[1];
 
-      p->len = lzf_decompress (d + DATAHDR + 2, cl < MAX_MTU ? cl : 0,
+      p->len = lzf_decompress (d + 2, cl < MAX_MTU - 2 ? cl : 0,
                                &(*p)[6 + 6], MAX_MTU)
                + 6 + 6;
     }
   else
-    p->len = outl + (6 + 6 - DATAHDR);
+    p->len = outl + (6 + 6);
 #endif
 
   return p;
@@ -582,7 +582,6 @@
 {
   prot_major = PROTOCOL_MAJOR;
   prot_minor = PROTOCOL_MINOR;
-  randsize = RAND_SIZE;
   flags = 0;
   features = get_features ();
 
@@ -602,9 +601,6 @@
   if (prot_major != PROTOCOL_MAJOR)
     slog (L_WARN, _("%s(%s): major version mismatch (remote %d <=> local %d)"),
           conf->nodename, (const char *)rsi, prot_major, PROTOCOL_MAJOR);
-  else if (randsize != RAND_SIZE)
-    slog (L_WARN, _("%s(%s): rand size mismatch (remote %d <=> local %d)"),
-          conf->nodename, (const char *)rsi, randsize, RAND_SIZE);
   else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ())))
     slog (L_WARN, _("%s(%s): cipher algo mismatch (remote %x <=> local %x)"),
           conf->nodename, (const char *)rsi, ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));
@@ -719,8 +715,6 @@
   delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b   , 1);
   oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff;
 
-  oiv.reset ();
-
   // make sure rekeying timeouts are slightly asymmetric
   ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
   rekey.start (rekey_interval, rekey_interval);
@@ -883,7 +877,7 @@
 
       reset_si ();
 
-      bool slow = si.prot & PROT_SLOW;
+      bool slow = (si.prot & PROT_SLOW) || (conf->low_power || THISNODE->low_power);
 
       if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
         {
@@ -903,14 +897,17 @@
 
           if (dsi.valid () && auth_rate_limiter.can (dsi))
             {
-              if (retry_cnt < 4)
+              // use ping after the first few retries
+              // TODO: on rekeys, the other node might not interpret ping correctly,
+              // TODO: as it will still have a valid connection
+              if (retry_cnt < 4 && (!conf->low_power || THISNODE->low_power))
                 send_auth_request (dsi, true);
               else
                 send_ping (dsi, 0);
             }
         }
 
-      retry_int *= slow ? 8. : 0.9;
+      retry_int *= slow ? 4. : 0.9;
 
       if (retry_int < conf->max_retry)
         retry_cnt++;
@@ -995,7 +992,7 @@
 connection::post_inject_queue ()
 {
   // force a connection every now and when when packets are sent (max 1/s)
-  if (ev_now () - last_establish_attempt >= 0.95) // arbitrary
+  if (ev_now () - last_establish_attempt >= (conf->low_power || THISNODE->low_power ? 2.95 : 0.95)) // arbitrary
     establish_connection.stop ();
 
   establish_connection ();
@@ -1117,7 +1114,7 @@
                   }
                 else
                   {
-                    bool chg = !have_rcv_auth || memcmp (&rcv_auth, &auth, sizeof auth);
+                    bool chg = !have_rcv_auth || !slow_memeq (&rcv_auth, &auth, sizeof auth);
 
                     rcv_auth = auth;
                     have_rcv_auth = true;
@@ -1150,7 +1147,7 @@
           auth_mac local_mac;
           auth_hash (snd_auth, p->response.ecdh, local_mac);
 
-          if (memcmp (&p->response.mac, local_mac, sizeof local_mac))
+          if (!slow_memeq (&p->response.mac, local_mac, sizeof local_mac))
             {
               slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),
                     conf->nodename, (const char *)rsi);