ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.5 by pcg, Wed Apr 2 21:43:44 2003 UTC vs.
Revision 1.24 by pcg, Wed Oct 22 01:05:23 2003 UTC

1/* 1/*
2 connection.C -- manage a single connection 2 connection.C -- manage a single connection
3 Copyright (C) 2003 Marc Lehmann <pcg@goof.com>
3 4
4 This program is free software; you can redistribute it and/or modify 5 This program is free software; you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by 6 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation; either version 2 of the License, or 7 the Free Software Foundation; either version 2 of the License, or
7 (at your option) any later version. 8 (at your option) any later version.
… …
35#include "slog.h" 36#include "slog.h"
36#include "device.h" 37#include "device.h"
37#include "vpn.h" 38#include "vpn.h"
38#include "connection.h" 39#include "connection.h"
39 40
41#include "netcompat.h"
42
40#if !HAVE_RAND_PSEUDO_BYTES 43#if !HAVE_RAND_PSEUDO_BYTES
41# define RAND_pseudo_bytes RAND_bytes 44# define RAND_pseudo_bytes RAND_bytes
42#endif 45#endif
43 46
44#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 47#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
… …
147 } 150 }
148} 151}
149 152
150////////////////////////////////////////////////////////////////////////////// 153//////////////////////////////////////////////////////////////////////////////
151 154
152void pkt_queue::put (tap_packet *p) 155void pkt_queue::put (net_packet *p)
153{ 156{
154 if (queue[i]) 157 if (queue[i])
155 { 158 {
156 delete queue[i]; 159 delete queue[i];
157 j = (j + 1) % QUEUEDEPTH; 160 j = (j + 1) % QUEUEDEPTH;
… …
160 queue[i] = p; 163 queue[i] = p;
161 164
162 i = (i + 1) % QUEUEDEPTH; 165 i = (i + 1) % QUEUEDEPTH;
163} 166}
164 167
165tap_packet *pkt_queue::get () 168net_packet *pkt_queue::get ()
166{ 169{
167 tap_packet *p = queue[j]; 170 net_packet *p = queue[j];
168 171
169 if (p) 172 if (p)
170 { 173 {
171 queue[j] = 0; 174 queue[j] = 0;
172 j = (j + 1) % QUEUEDEPTH; 175 j = (j + 1) % QUEUEDEPTH;
… …
197// only do action once every x seconds per host whole allowing bursts. 200// only do action once every x seconds per host whole allowing bursts.
198// this implementation ("splay list" ;) is inefficient, 201// this implementation ("splay list" ;) is inefficient,
199// but low on resources. 202// but low on resources.
200struct net_rate_limiter : list<net_rateinfo> 203struct net_rate_limiter : list<net_rateinfo>
201{ 204{
202 static const double ALPHA = 1. - 1. / 90.; // allow bursts 205 static const double ALPHA = 1. - 1. / 600.; // allow bursts
203 static const double CUTOFF = 20.; // one event every CUTOFF seconds 206 static const double CUTOFF = 10.; // one event every CUTOFF seconds
204 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 207 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
208 static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value
205 209
206 bool can (const sockinfo &si) { return can((u32)si.host); } 210 bool can (const sockinfo &si) { return can((u32)si.host); }
207 bool can (u32 host); 211 bool can (u32 host);
208}; 212};
209 213
210net_rate_limiter auth_rate_limiter, reset_rate_limiter; 214net_rate_limiter auth_rate_limiter, reset_rate_limiter;
211 215
… …
225 { 229 {
226 net_rateinfo ri; 230 net_rateinfo ri;
227 231
228 ri.host = host; 232 ri.host = host;
229 ri.pcnt = 1.; 233 ri.pcnt = 1.;
230 ri.diff = CUTOFF * (1. / (1. - ALPHA)); 234 ri.diff = MAXDIF;
231 ri.last = NOW; 235 ri.last = NOW;
232 236
233 push_front (ri); 237 push_front (ri);
234 238
235 return true; 239 return true;
… …
242 ri.pcnt = ri.pcnt * ALPHA; 246 ri.pcnt = ri.pcnt * ALPHA;
243 ri.diff = ri.diff * ALPHA + (NOW - ri.last); 247 ri.diff = ri.diff * ALPHA + (NOW - ri.last);
244 248
245 ri.last = NOW; 249 ri.last = NOW;
246 250
251 double dif = ri.diff / ri.pcnt;
252
247 bool send = ri.diff / ri.pcnt > CUTOFF; 253 bool send = dif > CUTOFF;
248 254
255 if (dif > MAXDIF)
256 {
257 ri.pcnt = 1.;
258 ri.diff = MAXDIF;
259 }
249 if (send) 260 else if (send)
250 ri.pcnt++; 261 ri.pcnt++;
251 262
252 push_front (ri); 263 push_front (ri);
253 264
254 return send; 265 return send;
… …
285 hmac_gen (ctx); 296 hmac_gen (ctx);
286 297
287 return !memcmp (hmac, hmac_digest, HMACLENGTH); 298 return !memcmp (hmac, hmac_digest, HMACLENGTH);
288} 299}
289 300
290void vpn_packet::set_hdr (ptype type, unsigned int dst) 301void vpn_packet::set_hdr (ptype type_, unsigned int dst)
291{ 302{
292 this->type = type; 303 type = type_;
293 304
294 int src = THISNODE->id; 305 int src = THISNODE->id;
295 306
296 src1 = src; 307 src1 = src;
297 srcdst = ((src >> 8) << 4) | (dst >> 8); 308 srcdst = ((src >> 8) << 4) | (dst >> 8);
… …
467 set_hdr (type, dst); 478 set_hdr (type, dst);
468} 479}
469 480
470bool config_packet::chk_config () const 481bool config_packet::chk_config () const
471{ 482{
472 return prot_major == PROTOCOL_MAJOR 483 if (prot_major != PROTOCOL_MAJOR)
473 && randsize == RAND_SIZE 484 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
474 && hmaclen == HMACLENGTH 485 else if (randsize != RAND_SIZE)
475 && flags == curflags () 486 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
487 else if (hmaclen != HMACLENGTH)
488 slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
489 else if (flags != curflags ())
490 slog (L_WARN, _("flag mismatch (remote %x <=> local %x)"), flags, curflags ());
476 && challengelen == sizeof (rsachallenge) 491 else if (challengelen != sizeof (rsachallenge))
492 slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
477 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER)) 493 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
494 slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
478 && digest_nid == htonl (EVP_MD_type (RSA_HASH)) 495 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
496 slog (L_WARN, _("digest mismatch (remote %x <=> local %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
479 && hmac_nid == htonl (EVP_MD_type (DIGEST)); 497 else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
498 slog (L_WARN, _("hmac mismatch (remote %x <=> local %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
499 else
500 return true;
501
502 return false;
480} 503}
481 504
482struct auth_req_packet : config_packet 505struct auth_req_packet : config_packet
483{ 506{
484 char magic[8]; 507 char magic[8];
… …
546}; 569};
547 570
548///////////////////////////////////////////////////////////////////////////// 571/////////////////////////////////////////////////////////////////////////////
549 572
550void 573void
574connection::connection_established ()
575{
576 if (ictx && octx)
577 {
578 connectmode = conf->connectmode;
579
580 rekey.start (NOW + ::conf.rekey);
581 keepalive.start (NOW + ::conf.keepalive);
582
583 // send queued packets
584 if (ictx && octx)
585 {
586 while (tap_packet *p = (tap_packet *)data_queue.get ())
587 {
588 send_data_packet (p);
589 delete p;
590 }
591
592 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
593 {
594 send_vpn_packet (p, si, IPTOS_RELIABILITY);
595 delete p;
596 }
597 }
598 }
599 else
600 {
601 retry_cnt = 0;
602 establish_connection.start (NOW + 5);
603 keepalive.reset ();
604 rekey.reset ();
605 }
606}
607
608void
551connection::reset_dstaddr () 609connection::reset_si ()
552{ 610{
553 si.set (conf);
554}
555
556void
557connection::send_ping (const sockinfo &si, u8 pong)
558{
559 ping_packet *pkt = new ping_packet;
560
561 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
562 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
563
564 delete pkt;
565}
566
567void
568connection::send_reset (const sockinfo &si)
569{
570 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
571 {
572 config_packet *pkt = new config_packet;
573
574 pkt->setup (vpn_packet::PT_RESET, conf->id);
575 send_vpn_packet (pkt, si, IPTOS_MINCOST);
576
577 delete pkt;
578 }
579}
580
581void
582connection::send_auth_request (const sockinfo &si, bool initiate)
583{
584 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
585
586 protocol = best_protocol (THISNODE->protocols & conf->protocols); 611 protocol = best_protocol (THISNODE->protocols & conf->protocols);
587 612
588 // mask out protocols we cannot establish 613 // mask out protocols we cannot establish
589 if (!conf->udp_port) protocol &= ~PROT_UDPv4; 614 if (!conf->udp_port) protocol &= ~PROT_UDPv4;
590 if (!conf->tcp_port) protocol &= ~PROT_TCPv4; 615 if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
591 616
592 if (protocol) 617 si.set (conf, protocol);
618}
619
620// ensure sockinfo is valid, forward if necessary
621const sockinfo &
622connection::forward_si (const sockinfo &si) const
623{
624 if (!si.valid ())
625 {
626 connection *r = vpn->find_router ();
627
628 if (r)
629 {
630 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"),
631 conf->nodename, r->conf->nodename);
632 return r->si;
633 }
634 else
635 slog (L_DEBUG, _("%s: node unreachable, no common protocol"),
636 conf->nodename);
593 { 637 }
594 rsachallenge chg;
595 638
596 rsa_cache.gen (pkt->id, chg); 639 return si;
640}
597 641
598 if (0 > RSA_public_encrypt (sizeof chg, 642void
599 (unsigned char *)&chg, (unsigned char *)&pkt->encr, 643connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
600 conf->rsa_key, RSA_PKCS1_OAEP_PADDING)) 644{
601 fatal ("RSA_public_encrypt error"); 645 if (!vpn->send_vpn_packet (pkt, si, tos))
646 reset_connection ();
647}
602 648
603 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 649void
650connection::send_ping (const sockinfo &si, u8 pong)
651{
652 ping_packet *pkt = new ping_packet;
604 653
605 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 654 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
655 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
656
657 delete pkt;
658}
659
660void
661connection::send_reset (const sockinfo &si)
662{
663 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
664 {
665 config_packet *pkt = new config_packet;
666
667 pkt->setup (vpn_packet::PT_RESET, conf->id);
668 send_vpn_packet (pkt, si, IPTOS_MINCOST);
606 669
607 delete pkt; 670 delete pkt;
608 } 671 }
609 else 672}
610 ; // silently fail 673
674void
675connection::send_auth_request (const sockinfo &si, bool initiate)
676{
677 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
678
679 rsachallenge chg;
680 rsa_cache.gen (pkt->id, chg);
681 rsa_encrypt (conf->rsa_key, chg, pkt->encr);
682
683 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
684
685 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
686
687 delete pkt;
611} 688}
612 689
613void 690void
614connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg) 691connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg)
615{ 692{
… …
656 if (retry_int < 3600 * 8) 733 if (retry_int < 3600 * 8)
657 retry_cnt++; 734 retry_cnt++;
658 735
659 w.at = NOW + retry_int; 736 w.at = NOW + retry_int;
660 737
661 if (conf->hostname) 738 reset_si ();
739
740 if (si.prot && !si.host)
741 vpn->send_connect_request (conf->id);
742 else
662 { 743 {
663 reset_dstaddr (); 744 const sockinfo &dsi = forward_si (si);
745
664 if (si.host && auth_rate_limiter.can (si)) 746 if (dsi.valid () && auth_rate_limiter.can (dsi))
665 { 747 {
666 if (retry_cnt < 4) 748 if (retry_cnt < 4)
667 send_auth_request (si, true); 749 send_auth_request (dsi, true);
668 else 750 else
669 send_ping (si, 0); 751 send_ping (dsi, 0);
670 } 752 }
671 } 753 }
672 else
673 vpn->connect_request (conf->id);
674 } 754 }
675} 755}
676 756
677void 757void
678connection::reset_connection () 758connection::reset_connection ()
… …
716 reset_connection (); 796 reset_connection ();
717 establish_connection (); 797 establish_connection ();
718} 798}
719 799
720void 800void
721connection::send_data_packet (tap_packet *pkt, bool broadcast) 801connection::send_data_packet (tap_packet *pkt)
722{ 802{
723 vpndata_packet *p = new vpndata_packet; 803 vpndata_packet *p = new vpndata_packet;
724 int tos = 0; 804 int tos = 0;
725 805
726 if (conf->inherit_tos 806 // I am not hilarious about peeking into packets, but so be it.
727 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 807 if (conf->inherit_tos && pkt->is_ipv4 ())
728 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
729 tos = (*pkt)[15] & IPTOS_TOS_MASK; 808 tos = (*pkt)[15] & IPTOS_TOS_MASK;
730 809
731 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 810 p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
732 send_vpn_packet (p, si, tos); 811 send_vpn_packet (p, si, tos);
733 812
734 delete p; 813 delete p;
735 814
736 if (oseqno > MAX_SEQNO) 815 if (oseqno > MAX_SEQNO)
737 rekey (); 816 rekey ();
738} 817}
739 818
740void 819void
741connection::inject_data_packet (tap_packet *pkt, bool broadcast) 820connection::inject_data_packet (tap_packet *pkt, bool broadcast/*TODO DDD*/)
742{ 821{
743 if (ictx && octx) 822 if (ictx && octx)
744 send_data_packet (pkt, broadcast); 823 send_data_packet (pkt);
745 else 824 else
746 { 825 {
747 if (!broadcast)//DDDD 826 if (!broadcast)//DDDD
748 queue.put (new tap_packet (*pkt)); 827 data_queue.put (new tap_packet (*pkt));
828
829 establish_connection ();
830 }
831}
832
833void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
834{
835 if (ictx && octx)
836 send_vpn_packet (pkt, si, tos);
837 else
838 {
839 vpn_queue.put (new vpn_packet (*pkt));
749 840
750 establish_connection (); 841 establish_connection ();
751 } 842 }
752} 843}
753 844
… …
812 if (p->initiate) 903 if (p->initiate)
813 send_auth_request (rsi, false); 904 send_auth_request (rsi, false);
814 905
815 rsachallenge k; 906 rsachallenge k;
816 907
817 if (0 > RSA_private_decrypt (sizeof (p->encr), 908 if (!rsa_decrypt (::conf.rsa_key, p->encr, k))
818 (unsigned char *)&p->encr, (unsigned char *)&k, 909 {
819 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
820 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 910 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
821 conf->nodename, (const char *)rsi); 911 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
912 break;
913 }
822 else 914 else
823 { 915 {
824 retry_cnt = 0;
825 establish_connection.set (NOW + 8); //? ;)
826 keepalive.reset ();
827 rekey.reset ();
828
829 delete ictx;
830 ictx = 0;
831
832 delete octx; 916 delete octx;
833 917
834 octx = new crypto_ctx (k, 1); 918 octx = new crypto_ctx (k, 1);
835 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 919 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
836 920
837 conf->protocols = p->protocols; 921 conf->protocols = p->protocols;
922
838 send_auth_response (rsi, p->id, k); 923 send_auth_response (rsi, p->id, k);
924
925 connection_established ();
839 926
840 break; 927 break;
841 } 928 }
842 } 929 }
930 else
931 slog (L_WARN, _("%s(%s): protocol mismatch"),
932 conf->nodename, (const char *)rsi);
843 933
844 send_reset (rsi); 934 send_reset (rsi);
845 } 935 }
846 936
847 break; 937 break;
… …
860 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 950 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
861 951
862 rsachallenge chg; 952 rsachallenge chg;
863 953
864 if (!rsa_cache.find (p->id, chg)) 954 if (!rsa_cache.find (p->id, chg))
955 {
865 slog (L_ERR, _("%s(%s): unrequested auth response"), 956 slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
866 conf->nodename, (const char *)rsi); 957 conf->nodename, (const char *)rsi);
958 break;
959 }
867 else 960 else
868 { 961 {
869 crypto_ctx *cctx = new crypto_ctx (chg, 0); 962 crypto_ctx *cctx = new crypto_ctx (chg, 0);
870 963
871 if (!p->hmac_chk (cctx)) 964 if (!p->hmac_chk (cctx))
965 {
872 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 966 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
873 "could be an attack, or just corruption or an synchronization error"), 967 "could be an attack, or just corruption or an synchronization error"),
874 conf->nodename, (const char *)rsi); 968 conf->nodename, (const char *)rsi);
969 break;
970 }
875 else 971 else
876 { 972 {
877 rsaresponse h; 973 rsaresponse h;
878 974
879 rsa_hash (p->id, chg, h); 975 rsa_hash (p->id, chg, h);
… …
885 delete ictx; ictx = cctx; 981 delete ictx; ictx = cctx;
886 982
887 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 983 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
888 984
889 si = rsi; 985 si = rsi;
986 protocol = rsi.prot;
890 987
891 rekey.set (NOW + ::conf.rekey); 988 connection_established ();
892 keepalive.set (NOW + ::conf.keepalive);
893 989
894 // send queued packets
895 while (tap_packet *p = queue.get ())
896 {
897 send_data_packet (p);
898 delete p;
899 }
900
901 connectmode = conf->connectmode;
902
903 slog (L_INFO, _("%s(%s): %s connection established, protocol version %d.%d"), 990 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
904 conf->nodename, (const char *)rsi, 991 conf->nodename, (const char *)rsi,
905 strprotocol (protocol),
906 p->prot_major, p->prot_minor); 992 p->prot_major, p->prot_minor);
907 993
908 if (::conf.script_node_up) 994 if (::conf.script_node_up)
909 run_script (run_script_cb (this, &connection::script_node_up), false); 995 run_script (run_script_cb (this, &connection::script_node_up), false);
910 996
… …
933 1019
934 if (ictx && octx) 1020 if (ictx && octx)
935 { 1021 {
936 vpndata_packet *p = (vpndata_packet *)pkt; 1022 vpndata_packet *p = (vpndata_packet *)pkt;
937 1023
938 if (rsi == si) 1024 if (!p->hmac_chk (ictx))
1025 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1026 "could be an attack, or just corruption or an synchronization error"),
1027 conf->nodename, (const char *)rsi);
1028 else
939 { 1029 {
940 if (!p->hmac_chk (ictx))
941 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
942 "could be an attack, or just corruption or an synchronization error"),
943 conf->nodename, (const char *)rsi);
944 else 1030 u32 seqno;
1031 tap_packet *d = p->unpack (this, seqno);
1032
1033 if (iseqno.recv_ok (seqno))
945 { 1034 {
946 u32 seqno; 1035 vpn->tap->send (d);
947 tap_packet *d = p->unpack (this, seqno);
948 1036
949 if (iseqno.recv_ok (seqno)) 1037 if (si != rsi)
950 { 1038 {
951 vpn->tap->send (d); 1039 // fast re-sync on connection changes, useful especially for tcp/ip
952
953 if (p->dst () == 0) // re-broadcast
954 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
955 {
956 connection *c = *i;
957
958 if (c->conf != THISNODE && c->conf != conf)
959 c->inject_data_packet (d);
960 }
961
962 delete d;
963
964 break; 1040 si = rsi;
1041
1042 slog (L_INFO, _("%s(%s): socket address changed to %s"),
1043 conf->nodename, (const char *)si, (const char *)rsi);
965 } 1044 }
1045
1046 delete d;
1047
1048 break;
966 } 1049 }
967 } 1050 }
968 else
969 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
970 } 1051 }
971 1052
972 send_reset (rsi); 1053 send_reset (rsi);
973 break; 1054 break;
974 1055
… …
976 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1057 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
977 { 1058 {
978 connect_req_packet *p = (connect_req_packet *) pkt; 1059 connect_req_packet *p = (connect_req_packet *) pkt;
979 1060
980 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1061 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1062 connection *c = vpn->conns[p->id - 1];
981 conf->protocols = p->protocols; 1063 conf->protocols = p->protocols;
982 connection *c = vpn->conns[p->id - 1];
983 1064
984 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n", 1065 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
985 conf->id, p->id, c->ictx && c->octx); 1066 conf->id, p->id, c->ictx && c->octx);
986 1067
987 if (c->ictx && c->octx) 1068 if (c->ictx && c->octx)
… …
989 // send connect_info packets to both sides, in case one is 1070 // send connect_info packets to both sides, in case one is
990 // behind a nat firewall (or both ;) 1071 // behind a nat firewall (or both ;)
991 c->send_connect_info (conf->id, si, conf->protocols); 1072 c->send_connect_info (conf->id, si, conf->protocols);
992 send_connect_info (c->conf->id, c->si, c->conf->protocols); 1073 send_connect_info (c->conf->id, c->si, c->conf->protocols);
993 } 1074 }
1075 else
1076 c->establish_connection ();
994 } 1077 }
995 1078
996 break; 1079 break;
997 1080
998 case vpn_packet::PT_CONNECT_INFO: 1081 case vpn_packet::PT_CONNECT_INFO:
999 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1082 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1000 { 1083 {
1001 connect_info_packet *p = (connect_info_packet *) pkt; 1084 connect_info_packet *p = (connect_info_packet *) pkt;
1002 1085
1003 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1086 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1004 conf->protocols = p->protocols; 1087
1005 connection *c = vpn->conns[p->id - 1]; 1088 connection *c = vpn->conns[p->id - 1];
1089
1090 c->conf->protocols = p->protocols;
1091 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1092 p->si.upgrade_protocol (protocol, c->conf);
1006 1093
1007 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1094 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1008 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1095 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1009 1096
1097 const sockinfo &dsi = forward_si (p->si);
1098
1099 if (dsi.valid ())
1010 c->send_auth_request (p->si, true); 1100 c->send_auth_request (dsi, true);
1011 } 1101 }
1012 1102
1013 break; 1103 break;
1014 1104
1015 default: 1105 default:
… …
1031 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1121 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1032 { 1122 {
1033 send_ping (si); 1123 send_ping (si);
1034 w.at = NOW + 5; 1124 w.at = NOW + 5;
1035 } 1125 }
1126 else if (NOW < last_activity + ::conf.keepalive + 10)
1127 // hold ondemand connections implicitly a few seconds longer
1128 // should delete octx, though, or something like that ;)
1129 w.at = last_activity + ::conf.keepalive + 10;
1036 else 1130 else
1037 reset_connection (); 1131 reset_connection ();
1038} 1132}
1039 1133
1040void connection::connect_request (int id) 1134void connection::send_connect_request (int id)
1041{ 1135{
1042 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1136 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1043 1137
1044 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1138 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);
1045 p->hmac_set (octx); 1139 p->hmac_set (octx);
… …
1075 putenv ("STATE=down"); 1169 putenv ("STATE=down");
1076 1170
1077 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1171 return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1078} 1172}
1079 1173
1080// send a vpn packet out to other hosts
1081void
1082connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1083{
1084 switch (protocol)
1085 {
1086 case PROT_IPv4:
1087 vpn->send_ipv4_packet (pkt, si, tos);
1088 break;
1089
1090 case PROT_UDPv4:
1091 vpn->send_udpv4_packet (pkt, si, tos);
1092 break;
1093
1094#if ENABLE_TCP
1095 case PROT_TCPv4:
1096 vpn->send_tcpv4_packet (pkt, si, tos);
1097 break;
1098#endif
1099 }
1100}
1101
1102connection::connection(struct vpn *vpn_) 1174connection::connection(struct vpn *vpn_)
1103: vpn(vpn_) 1175: vpn(vpn_)
1104, rekey (this, &connection::rekey_cb) 1176, rekey (this, &connection::rekey_cb)
1105, keepalive (this, &connection::keepalive_cb) 1177, keepalive (this, &connection::keepalive_cb)
1106, establish_connection (this, &connection::establish_connection_cb) 1178, establish_connection (this, &connection::establish_connection_cb)

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines