ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.12 by pcg, Sun Apr 13 16:53:36 2003 UTC vs.
Revision 1.20 by pcg, Tue Oct 14 15:48:15 2003 UTC

… …
35#include "slog.h" 35#include "slog.h"
36#include "device.h" 36#include "device.h"
37#include "vpn.h" 37#include "vpn.h"
38#include "connection.h" 38#include "connection.h"
39 39
40#include "netcompat.h"
41
40#if !HAVE_RAND_PSEUDO_BYTES 42#if !HAVE_RAND_PSEUDO_BYTES
41# define RAND_pseudo_bytes RAND_bytes 43# define RAND_pseudo_bytes RAND_bytes
42#endif 44#endif
43 45
44#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 46#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
… …
197// only do action once every x seconds per host whole allowing bursts. 199// only do action once every x seconds per host whole allowing bursts.
198// this implementation ("splay list" ;) is inefficient, 200// this implementation ("splay list" ;) is inefficient,
199// but low on resources. 201// but low on resources.
200struct net_rate_limiter : list<net_rateinfo> 202struct net_rate_limiter : list<net_rateinfo>
201{ 203{
202 static const double ALPHA = 1. - 1. / 180.; // allow bursts 204 static const double ALPHA = 1. - 1. / 600.; // allow bursts
203 static const double CUTOFF = 10.; // one event every CUTOFF seconds 205 static const double CUTOFF = 10.; // one event every CUTOFF seconds
204 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 206 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
205 static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value 207 static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value
206 208
207 bool can (const sockinfo &si) { return can((u32)si.host); } 209 bool can (const sockinfo &si) { return can((u32)si.host); }
208 bool can (u32 host); 210 bool can (u32 host);
209}; 211};
210 212
211net_rate_limiter auth_rate_limiter, reset_rate_limiter; 213net_rate_limiter auth_rate_limiter, reset_rate_limiter;
212 214
… …
475 set_hdr (type, dst); 477 set_hdr (type, dst);
476} 478}
477 479
478bool config_packet::chk_config () const 480bool config_packet::chk_config () const
479{ 481{
480 return prot_major == PROTOCOL_MAJOR 482 if (prot_major != PROTOCOL_MAJOR)
481 && randsize == RAND_SIZE 483 slog (L_WARN, _("major version mismatch (%d <=> %d)"), prot_major, PROTOCOL_MAJOR);
482 && hmaclen == HMACLENGTH 484 else if (randsize != RAND_SIZE)
483 && flags == curflags () 485 slog (L_WARN, _("rand size mismatch (%d <=> %d)"), randsize, RAND_SIZE);
486 else if (hmaclen != HMACLENGTH)
487 slog (L_WARN, _("hmac length mismatch (%d <=> %d)"), hmaclen, HMACLENGTH);
488 else if (flags != curflags ())
489 slog (L_WARN, _("flag mismatch (%x <=> %x)"), flags, curflags ());
484 && challengelen == sizeof (rsachallenge) 490 else if (challengelen != sizeof (rsachallenge))
491 slog (L_WARN, _("challenge length mismatch (%d <=> %d)"), challengelen, sizeof (rsachallenge));
485 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER)) 492 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
493 slog (L_WARN, _("cipher mismatch (%x <=> %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
486 && digest_nid == htonl (EVP_MD_type (RSA_HASH)) 494 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
495 slog (L_WARN, _("digest mismatch (%x <=> %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
487 && hmac_nid == htonl (EVP_MD_type (DIGEST)); 496 else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
497 slog (L_WARN, _("hmac mismatch (%x <=> %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
498 else
499 return true;
500
501 return false;
488} 502}
489 503
490struct auth_req_packet : config_packet 504struct auth_req_packet : config_packet
491{ 505{
492 char magic[8]; 506 char magic[8];
… …
898 rsachallenge k; 912 rsachallenge k;
899 913
900 if (0 > RSA_private_decrypt (sizeof (p->encr), 914 if (0 > RSA_private_decrypt (sizeof (p->encr),
901 (unsigned char *)&p->encr, (unsigned char *)&k, 915 (unsigned char *)&p->encr, (unsigned char *)&k,
902 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING)) 916 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
903 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 917 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
904 conf->nodename, (const char *)rsi); 918 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
905 else 919 else
906 { 920 {
907 delete octx; 921 delete octx;
908 922
909 octx = new crypto_ctx (k, 1); 923 octx = new crypto_ctx (k, 1);
… …
916 connection_established (); 930 connection_established ();
917 931
918 break; 932 break;
919 } 933 }
920 } 934 }
935 else
936 slog (L_WARN, _("%s(%s): protocol mismatch"),
937 conf->nodename, (const char *)rsi);
921 938
922 send_reset (rsi); 939 send_reset (rsi);
923 } 940 }
924 941
925 break; 942 break;
… …
938 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 955 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
939 956
940 rsachallenge chg; 957 rsachallenge chg;
941 958
942 if (!rsa_cache.find (p->id, chg)) 959 if (!rsa_cache.find (p->id, chg))
960 {
943 slog (L_ERR, _("%s(%s): unrequested auth response"), 961 slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
944 conf->nodename, (const char *)rsi); 962 conf->nodename, (const char *)rsi);
963 break;
964 }
945 else 965 else
946 { 966 {
947 crypto_ctx *cctx = new crypto_ctx (chg, 0); 967 crypto_ctx *cctx = new crypto_ctx (chg, 0);
948 968
949 if (!p->hmac_chk (cctx)) 969 if (!p->hmac_chk (cctx))
970 {
950 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 971 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
951 "could be an attack, or just corruption or an synchronization error"), 972 "could be an attack, or just corruption or an synchronization error"),
952 conf->nodename, (const char *)rsi); 973 conf->nodename, (const char *)rsi);
974 break;
975 }
953 else 976 else
954 { 977 {
955 rsaresponse h; 978 rsaresponse h;
956 979
957 rsa_hash (p->id, chg, h); 980 rsa_hash (p->id, chg, h);
… …
1025 c->inject_data_packet (d); 1048 c->inject_data_packet (d);
1026 } 1049 }
1027 1050
1028 if (si != rsi) 1051 if (si != rsi)
1029 { 1052 {
1030 // fast re-sync on conneciton changes, useful especially for tcp/ip 1053 // fast re-sync on connection changes, useful especially for tcp/ip
1031 si = rsi; 1054 si = rsi;
1032 1055
1033 slog (L_INFO, _("%s(%s): socket address changed to %s"), 1056 slog (L_INFO, _("%s(%s): socket address changed to %s"),
1034 conf->nodename, (const char *)si, (const char *)rsi); 1057 conf->nodename, (const char *)si, (const char *)rsi);
1035 } 1058 }

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines