[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.1 by pcg, Wed Apr 2 03:06:22 2003 UTC vs.
Revision 1.19 by pcg, Tue Oct 14 03:22:09 2003 UTC

…		…
22	# include "lzf/lzf.h"	22	# include "lzf/lzf.h"
23	}	23	}
24		24
25	#include <list>	25	#include <list>
26		26
		27	#include <openssl/rand.h>
		28	#include <openssl/evp.h>
		29	#include <openssl/rsa.h>
		30	#include <openssl/err.h>
		31
27	#include "gettext.h"	32	#include "gettext.h"
28		33
29	#include "conf.h"	34	#include "conf.h"
30	#include "slog.h"	35	#include "slog.h"
31	#include "device.h"	36	#include "device.h"
32	#include "protocol.h"	37	#include "vpn.h"
33	#include "connection.h"	38	#include "connection.h"
		39
		40	#include <sys/socket.h>
		41	#ifdef HAVE_NETINET_IN_H
		42	# include <netinet/in.h>
		43	#endif
		44	#include <arpa/inet.h>
		45	#include <net/if.h>
		46	#ifdef HAVE_NETINET_IN_SYSTM_H
		47	# include <netinet/in_systm.h>
		48	#endif
		49	#ifdef HAVE_NETINET_IP_H
		50	# include <netinet/ip.h>
		51	#endif
		52
		53	#ifndef IPTOS_TOS_MASK
		54	# define IPTOS_TOS_MASK (IPTOS_LOWDELAY \| IPTOS_THROUGHPUT \| IPTOS_RELIABILITY \| IPTOS_MINCOST)
		55	#endif
34		56
35	#if !HAVE_RAND_PSEUDO_BYTES	57	#if !HAVE_RAND_PSEUDO_BYTES
36	# define RAND_pseudo_bytes RAND_bytes	58	# define RAND_pseudo_bytes RAND_bytes
37	#endif	59	#endif
38		60
…		…
80	rsachallenge chg;	102	rsachallenge chg;
81	};	103	};
82		104
83	struct rsa_cache : list<rsa_entry>	105	struct rsa_cache : list<rsa_entry>
84	{	106	{
85	void cleaner_cb (tstamp &ts); time_watcher cleaner;	107	void cleaner_cb (time_watcher &w); time_watcher cleaner;
86		108
87	bool find (const rsaid &id, rsachallenge &chg)	109	bool find (const rsaid &id, rsachallenge &chg)
88	{	110	{
89	for (iterator i = begin (); i != end (); ++i)	111	for (iterator i = begin (); i != end (); ++i)
90	{	112	{
…		…
124	: cleaner (this, &rsa_cache::cleaner_cb)	146	: cleaner (this, &rsa_cache::cleaner_cb)
125	{ }	147	{ }
126		148
127	} rsa_cache;	149	} rsa_cache;
128		150
129	void rsa_cache::cleaner_cb (tstamp &ts)	151	void rsa_cache::cleaner_cb (time_watcher &w)
130	{	152	{
131	if (empty ())	153	if (empty ())
132	ts = TSTAMP_CANCEL;	154	w.at = TSTAMP_CANCEL;
133	else	155	else
134	{	156	{
135	ts = NOW + RSA_TTL;	157	w.at = NOW + RSA_TTL;
136		158
137	for (iterator i = begin (); i != end (); )	159	for (iterator i = begin (); i != end (); )
138	if (i->expire <= NOW)	160	if (i->expire <= NOW)
139	i = erase (i);	161	i = erase (i);
140	else	162	else
…		…
142	}	164	}
143	}	165	}
144		166
145	//////////////////////////////////////////////////////////////////////////////	167	//////////////////////////////////////////////////////////////////////////////
146		168
147	void pkt_queue::put (tap_packet *p)	169	void pkt_queue::put (net_packet *p)
148	{	170	{
149	if (queue[i])	171	if (queue[i])
150	{	172	{
151	delete queue[i];	173	delete queue[i];
152	j = (j + 1) % QUEUEDEPTH;	174	j = (j + 1) % QUEUEDEPTH;
…		…
155	queue[i] = p;	177	queue[i] = p;
156		178
157	i = (i + 1) % QUEUEDEPTH;	179	i = (i + 1) % QUEUEDEPTH;
158	}	180	}
159		181
160	tap_packet *pkt_queue::get ()	182	net_packet *pkt_queue::get ()
161	{	183	{
162	tap_packet *p = queue[j];	184	net_packet *p = queue[j];
163		185
164	if (p)	186	if (p)
165	{	187	{
166	queue[j] = 0;	188	queue[j] = 0;
167	j = (j + 1) % QUEUEDEPTH;	189	j = (j + 1) % QUEUEDEPTH;
…		…
192	// only do action once every x seconds per host whole allowing bursts.	214	// only do action once every x seconds per host whole allowing bursts.
193	// this implementation ("splay list" ;) is inefficient,	215	// this implementation ("splay list" ;) is inefficient,
194	// but low on resources.	216	// but low on resources.
195	struct net_rate_limiter : list<net_rateinfo>	217	struct net_rate_limiter : list<net_rateinfo>
196	{	218	{
197	static const double ALPHA = 1. - 1. / 90.; // allow bursts	219	static const double ALPHA = 1. - 1. / 600.; // allow bursts
198	static const double CUTOFF = 20.; // one event every CUTOFF seconds	220	static const double CUTOFF = 10.; // one event every CUTOFF seconds
199	static const double EXPIRE = CUTOFF * 30.; // expire entries after this time	221	static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
		222	static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value
200		223
201	bool can (const sockinfo &si) { return can((u32)si.host); }	224	bool can (const sockinfo &si) { return can((u32)si.host); }
202	bool can (u32 host);	225	bool can (u32 host);
203	};	226	};
204		227
205	net_rate_limiter auth_rate_limiter, reset_rate_limiter;	228	net_rate_limiter auth_rate_limiter, reset_rate_limiter;
206		229
…		…
220	{	243	{
221	net_rateinfo ri;	244	net_rateinfo ri;
222		245
223	ri.host = host;	246	ri.host = host;
224	ri.pcnt = 1.;	247	ri.pcnt = 1.;
225	ri.diff = CUTOFF * (1. / (1. - ALPHA));	248	ri.diff = MAXDIF;
226	ri.last = NOW;	249	ri.last = NOW;
227		250
228	push_front (ri);	251	push_front (ri);
229		252
230	return true;	253	return true;
…		…
237	ri.pcnt = ri.pcnt * ALPHA;	260	ri.pcnt = ri.pcnt * ALPHA;
238	ri.diff = ri.diff * ALPHA + (NOW - ri.last);	261	ri.diff = ri.diff * ALPHA + (NOW - ri.last);
239		262
240	ri.last = NOW;	263	ri.last = NOW;
241		264
		265	double dif = ri.diff / ri.pcnt;
		266
242	bool send = ri.diff / ri.pcnt > CUTOFF;	267	bool send = dif > CUTOFF;
243		268
		269	if (dif > MAXDIF)
		270	{
		271	ri.pcnt = 1.;
		272	ri.diff = MAXDIF;
		273	}
244	if (send)	274	else if (send)
245	ri.pcnt++;	275	ri.pcnt++;
246		276
247	push_front (ri);	277	push_front (ri);
248		278
249	return send;	279	return send;
…		…
280	hmac_gen (ctx);	310	hmac_gen (ctx);
281		311
282	return !memcmp (hmac, hmac_digest, HMACLENGTH);	312	return !memcmp (hmac, hmac_digest, HMACLENGTH);
283	}	313	}
284		314
285	void vpn_packet::set_hdr (ptype type, unsigned int dst)	315	void vpn_packet::set_hdr (ptype type_, unsigned int dst)
286	{	316	{
287	this->type = type;	317	type = type_;
288		318
289	int src = THISNODE->id;	319	int src = THISNODE->id;
290		320
291	src1 = src;	321	src1 = src;
292	srcdst = ((src >> 8) << 4) \| (dst >> 8);	322	srcdst = ((src >> 8) << 4) \| (dst >> 8);
…		…
462	set_hdr (type, dst);	492	set_hdr (type, dst);
463	}	493	}
464		494
465	bool config_packet::chk_config () const	495	bool config_packet::chk_config () const
466	{	496	{
467	return prot_major == PROTOCOL_MAJOR	497	if (prot_major != PROTOCOL_MAJOR)
468	&& randsize == RAND_SIZE	498	slog (L_WARN, _("major version mismatch (%d <=> %d)"), prot_major, PROTOCOL_MAJOR);
469	&& hmaclen == HMACLENGTH	499	else if (randsize != RAND_SIZE)
470	&& flags == curflags ()	500	slog (L_WARN, _("rand size mismatch (%d <=> %d)"), randsize, RAND_SIZE);
		501	else if (hmaclen != HMACLENGTH)
		502	slog (L_WARN, _("hmac length mismatch (%d <=> %d)"), hmaclen, HMACLENGTH);
		503	else if (flags != curflags ())
		504	slog (L_WARN, _("flag mismatch (%x <=> %x)"), flags, curflags ());
471	&& challengelen == sizeof (rsachallenge)	505	else if (challengelen != sizeof (rsachallenge))
		506	slog (L_WARN, _("challenge length mismatch (%d <=> %d)"), challengelen, sizeof (rsachallenge));
472	&& cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))	507	else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
		508	slog (L_WARN, _("cipher mismatch (%x <=> %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
473	&& digest_nid == htonl (EVP_MD_type (RSA_HASH))	509	else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
		510	slog (L_WARN, _("digest mismatch (%x <=> %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
474	&& hmac_nid == htonl (EVP_MD_type (DIGEST));	511	else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
		512	slog (L_WARN, _("hmac mismatch (%x <=> %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
		513	else
		514	return true;
		515
		516	return false;
475	}	517	}
476		518
477	struct auth_req_packet : config_packet	519	struct auth_req_packet : config_packet
478	{	520	{
479	char magic[8];	521	char magic[8];
…		…
541	};	583	};
542		584
543	/////////////////////////////////////////////////////////////////////////////	585	/////////////////////////////////////////////////////////////////////////////
544		586
545	void	587	void
		588	connection::connection_established ()
		589	{
		590	if (ictx && octx)
		591	{
		592	connectmode = conf->connectmode;
		593
		594	rekey.start (NOW + ::conf.rekey);
		595	keepalive.start (NOW + ::conf.keepalive);
		596
		597	// send queued packets
		598	if (ictx && octx)
		599	{
		600	while (tap_packet p = (tap_packet )data_queue.get ())
		601	{
		602	send_data_packet (p);
		603	delete p;
		604	}
		605
		606	while (vpn_packet p = (vpn_packet )vpn_queue.get ())
		607	{
		608	send_vpn_packet (p, si, IPTOS_RELIABILITY);
		609	delete p;
		610	}
		611	}
		612	}
		613	else
		614	{
		615	retry_cnt = 0;
		616	establish_connection.start (NOW + 5);
		617	keepalive.reset ();
		618	rekey.reset ();
		619	}
		620	}
		621
		622	void
546	connection::reset_dstaddr ()	623	connection::reset_si ()
547	{	624	{
		625	protocol = best_protocol (THISNODE->protocols & conf->protocols);
		626
		627	// mask out protocols we cannot establish
		628	if (!conf->udp_port) protocol &= ~PROT_UDPv4;
		629	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
		630
548	si.set (conf);	631	si.set (conf, protocol);
		632	}
		633
		634	// ensure sockinfo is valid, forward if necessary
		635	const sockinfo &
		636	connection::forward_si (const sockinfo &si) const
		637	{
		638	if (!si.valid ())
		639	{
		640	connection *r = vpn->find_router ();
		641
		642	if (r)
		643	{
		644	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"),
		645	conf->nodename, r->conf->nodename);
		646	return r->si;
		647	}
		648	else
		649	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),
		650	conf->nodename);
		651	}
		652
		653	return si;
		654	}
		655
		656	void
		657	connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
		658	{
		659	if (!vpn->send_vpn_packet (pkt, si, tos))
		660	reset_connection ();
549	}	661	}
550		662
551	void	663	void
552	connection::send_ping (const sockinfo &si, u8 pong)	664	connection::send_ping (const sockinfo &si, u8 pong)
553	{	665	{
…		…
575		687
576	void	688	void
577	connection::send_auth_request (const sockinfo &si, bool initiate)	689	connection::send_auth_request (const sockinfo &si, bool initiate)
578	{	690	{
579	auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);	691	auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
580
581	protocol = best_protocol (THISNODE->protocols & conf->protocols);
582		692
583	rsachallenge chg;	693	rsachallenge chg;
584		694
585	rsa_cache.gen (pkt->id, chg);	695	rsa_cache.gen (pkt->id, chg);
586		696
…		…
589	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))	699	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
590	fatal ("RSA_public_encrypt error");	700	fatal ("RSA_public_encrypt error");
591		701
592	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);	702	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
593		703
594	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly	704	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly
595		705
596	delete pkt;	706	delete pkt;
597	}	707	}
598		708
599	void	709	void
…		…
627		737
628	delete r;	738	delete r;
629	}	739	}
630		740
631	void	741	void
632	connection::establish_connection_cb (tstamp &ts)	742	connection::establish_connection_cb (time_watcher &w)
633	{	743	{
634	if (ictx \|\| conf == THISNODE	744	if (ictx \|\| conf == THISNODE
635	\|\| connectmode == conf_node::C_NEVER	745	\|\| connectmode == conf_node::C_NEVER
636	\|\| connectmode == conf_node::C_DISABLED)	746	\|\| connectmode == conf_node::C_DISABLED)
637	ts = TSTAMP_CANCEL;	747	w.at = TSTAMP_CANCEL;
638	else if (ts <= NOW)	748	else if (w.at <= NOW)
639	{	749	{
640	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;	750	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;
641		751
642	if (retry_int < 3600 * 8)	752	if (retry_int < 3600 * 8)
643	retry_cnt++;	753	retry_cnt++;
644		754
645	ts = NOW + retry_int;	755	w.at = NOW + retry_int;
646		756
647	if (conf->hostname)	757	reset_si ();
		758
		759	if (si.prot && !si.host)
		760	vpn->send_connect_request (conf->id);
		761	else
648	{	762	{
649	reset_dstaddr ();	763	const sockinfo &dsi = forward_si (si);
		764
650	if (si.host && auth_rate_limiter.can (si))	765	if (dsi.valid () && auth_rate_limiter.can (dsi))
651	{	766	{
652	if (retry_cnt < 4)	767	if (retry_cnt < 4)
653	send_auth_request (si, true);	768	send_auth_request (dsi, true);
654	else	769	else
655	send_ping (si, 0);	770	send_ping (dsi, 0);
656	}	771	}
657	}	772	}
658	else
659	vpn->connect_request (conf->id);
660	}	773	}
661	}	774	}
662		775
663	void	776	void
664	connection::reset_connection ()	777	connection::reset_connection ()
…		…
693		806
694	reset_connection ();	807	reset_connection ();
695	}	808	}
696		809
697	void	810	void
698	connection::rekey_cb (tstamp &ts)	811	connection::rekey_cb (time_watcher &w)
699	{	812	{
700	ts = TSTAMP_CANCEL;	813	w.at = TSTAMP_CANCEL;
701		814
702	reset_connection ();	815	reset_connection ();
703	establish_connection ();	816	establish_connection ();
704	}	817	}
705		818
…		…
707	connection::send_data_packet (tap_packet *pkt, bool broadcast)	820	connection::send_data_packet (tap_packet *pkt, bool broadcast)
708	{	821	{
709	vpndata_packet *p = new vpndata_packet;	822	vpndata_packet *p = new vpndata_packet;
710	int tos = 0;	823	int tos = 0;
711		824
		825	// I am not hilarious about peeking into packets, but so be it.
712	if (conf->inherit_tos	826	if (conf->inherit_tos
713	&& (pkt)[12] == 0x08 && (pkt)[13] == 0x00 // IP	827	&& (pkt)[12] == 0x08 && (pkt)[13] == 0x00 // IP
714	&& ((*pkt)[14] & 0xf0) == 0x40) // IPv4	828	&& ((*pkt)[14] & 0xf0) == 0x40) // IPv4
715	tos = (*pkt)[15] & IPTOS_TOS_MASK;	829	tos = (*pkt)[15] & IPTOS_TOS_MASK;
716		830
…		…
729	if (ictx && octx)	843	if (ictx && octx)
730	send_data_packet (pkt, broadcast);	844	send_data_packet (pkt, broadcast);
731	else	845	else
732	{	846	{
733	if (!broadcast)//DDDD	847	if (!broadcast)//DDDD
734	queue.put (new tap_packet (*pkt));	848	data_queue.put (new tap_packet (*pkt));
		849
		850	establish_connection ();
		851	}
		852	}
		853
		854	void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
		855	{
		856	if (ictx && octx)
		857	send_vpn_packet (pkt, si, tos);
		858	else
		859	{
		860	vpn_queue.put (new vpn_packet (*pkt));
735		861
736	establish_connection ();	862	establish_connection ();
737	}	863	}
738	}	864	}
739		865
…		…
745	slog (L_NOISE, "<<%d received packet type %d from %d to %d",	871	slog (L_NOISE, "<<%d received packet type %d from %d to %d",
746	conf->id, pkt->typ (), pkt->src (), pkt->dst ());	872	conf->id, pkt->typ (), pkt->src (), pkt->dst ());
747		873
748	switch (pkt->typ ())	874	switch (pkt->typ ())
749	{	875	{
750	case vpn_packet::PT_PING:	876	case vpn_packet::PT_PING:
751	// we send pings instead of auth packets after some retries,	877	// we send pings instead of auth packets after some retries,
752	// so reset the retry counter and establish a connection	878	// so reset the retry counter and establish a connection
753	// when we receive a ping.	879	// when we receive a ping.
754	if (!ictx)	880	if (!ictx)
		881	{
		882	if (auth_rate_limiter.can (rsi))
		883	send_auth_request (rsi, true);
		884	}
		885	else
		886	send_ping (rsi, 1); // pong
		887
		888	break;
		889
		890	case vpn_packet::PT_PONG:
		891	break;
		892
		893	case vpn_packet::PT_RESET:
755	{	894	{
756	if (auth_rate_limiter.can (rsi))	895	reset_connection ();
757	send_auth_request (rsi, true);	896
		897	config_packet p = (config_packet ) pkt;
		898
		899	if (!p->chk_config ())
		900	{
		901	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
		902	conf->nodename, (const char *)rsi);
		903	connectmode = conf_node::C_DISABLED;
		904	}
		905	else if (connectmode == conf_node::C_ALWAYS)
		906	establish_connection ();
758	}	907	}
759	else
760	send_ping (rsi, 1); // pong
761
762	break;	908	break;
763		909
764	case vpn_packet::PT_PONG:
765	break;
766
767	case vpn_packet::PT_RESET:	910	case vpn_packet::PT_AUTH_REQ:
768	{	911	if (auth_rate_limiter.can (rsi))
769	reset_connection ();
770
771	config_packet p = (config_packet ) pkt;
772
773	if (!p->chk_config ())
774	{	912	{
		913	auth_req_packet p = (auth_req_packet ) pkt;
		914
		915	slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);
		916
		917	if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
		918	{
		919	if (p->prot_minor != PROTOCOL_MINOR)
		920	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
		921	conf->nodename, (const char *)rsi,
		922	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
		923
		924	if (p->initiate)
		925	send_auth_request (rsi, false);
		926
		927	rsachallenge k;
		928
		929	if (0 > RSA_private_decrypt (sizeof (p->encr),
		930	(unsigned char )&p->encr, (unsigned char )&k,
		931	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
		932	slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
		933	conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
		934	else
		935	{
		936	delete octx;
		937
		938	octx = new crypto_ctx (k, 1);
		939	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;
		940
		941	conf->protocols = p->protocols;
		942
		943	send_auth_response (rsi, p->id, k);
		944
		945	connection_established ();
		946
		947	break;
		948	}
		949	}
		950	else
775	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),	951	slog (L_WARN, _("%s(%s): protocol mismatch"),
776	conf->nodename, (const char *)rsi);	952	conf->nodename, (const char *)rsi);
777	connectmode = conf_node::C_DISABLED;	953
		954	send_reset (rsi);
778	}	955	}
779	else if (connectmode == conf_node::C_ALWAYS)	956
780	establish_connection ();
781	}
782	break;	957	break;
783		958
784	case vpn_packet::PT_AUTH_REQ:	959	case vpn_packet::PT_AUTH_RES:
785	if (auth_rate_limiter.can (rsi))
786	{	960	{
787	auth_req_packet p = (auth_req_packet ) pkt;	961	auth_res_packet p = (auth_res_packet ) pkt;
788		962
789	slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);	963	slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);
790		964
791	if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))	965	if (p->chk_config ())
792	{	966	{
793	if (p->prot_minor != PROTOCOL_MINOR)	967	if (p->prot_minor != PROTOCOL_MINOR)
794	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	968	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
795	conf->nodename, (const char *)rsi,	969	conf->nodename, (const char *)rsi,
796	PROTOCOL_MINOR, conf->nodename, p->prot_minor);	970	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
797		971
798	if (p->initiate)
799	send_auth_request (rsi, false);
800
801	rsachallenge k;	972	rsachallenge chg;
802		973
803	if (0 > RSA_private_decrypt (sizeof (p->encr),	974	if (!rsa_cache.find (p->id, chg))
804	(unsigned char )&p->encr, (unsigned char )&k,	975	{
805	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))	976	slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
806	slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
807	conf->nodename, (const char *)rsi);	977	conf->nodename, (const char *)rsi);
		978	break;
		979	}
808	else	980	else
809	{	981	{
810	retry_cnt = 0;	982	crypto_ctx *cctx = new crypto_ctx (chg, 0);
811	establish_connection.set (NOW + 8); //? ;)	983
812	keepalive.reset ();	984	if (!p->hmac_chk (cctx))
		985	{
		986	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
		987	"could be an attack, or just corruption or an synchronization error"),
		988	conf->nodename, (const char *)rsi);
		989	break;
		990	}
813	rekey.reset ();	991	else
		992	{
		993	rsaresponse h;
814		994
		995	rsa_hash (p->id, chg, h);
		996
		997	if (!memcmp ((u8 )&h, (u8 )p->response, sizeof h))
		998	{
		999	prot_minor = p->prot_minor;
		1000
		1001	delete ictx; ictx = cctx;
		1002
		1003	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
		1004
		1005	si = rsi;
		1006	protocol = rsi.prot;
		1007
		1008	connection_established ();
		1009
		1010	slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
		1011	conf->nodename, (const char *)rsi,
		1012	p->prot_major, p->prot_minor);
		1013
		1014	if (::conf.script_node_up)
		1015	run_script (run_script_cb (this, &connection::script_node_up), false);
		1016
		1017	break;
		1018	}
		1019	else
		1020	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
		1021	conf->nodename, (const char *)rsi);
		1022	}
		1023
815	delete ictx;	1024	delete cctx;
816	ictx = 0;
817
818	delete octx;
819
820	octx = new crypto_ctx (k, 1);
821	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;
822
823	conf->protocols = p->protocols;
824	send_auth_response (rsi, p->id, k);
825
826	break;
827	}	1025	}
828	}	1026	}
829
830	send_reset (rsi);
831	}	1027	}
832		1028
		1029	send_reset (rsi);
833	break;	1030	break;
834		1031
835	case vpn_packet::PT_AUTH_RES:	1032	case vpn_packet::PT_DATA_COMPRESSED:
836	{	1033	#if !ENABLE_COMPRESSION
837	auth_res_packet p = (auth_res_packet ) pkt;	1034	send_reset (rsi);
		1035	break;
		1036	#endif
838		1037
839	slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);	1038	case vpn_packet::PT_DATA_UNCOMPRESSED:
840		1039
841	if (p->chk_config ())	1040	if (ictx && octx)
842	{	1041	{
843	if (p->prot_minor != PROTOCOL_MINOR)	1042	vpndata_packet p = (vpndata_packet )pkt;
844	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
845	conf->nodename, (const char *)rsi,
846	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
847		1043
848	rsachallenge chg;	1044	if (!p->hmac_chk (ictx))
849		1045	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
850	if (!rsa_cache.find (p->id, chg))	1046	"could be an attack, or just corruption or an synchronization error"),
851	slog (L_ERR, _("%s(%s): unrequested auth response"),
852	conf->nodename, (const char *)rsi);	1047	conf->nodename, (const char *)rsi);
853	else	1048	else
854	{	1049	{
855	crypto_ctx *cctx = new crypto_ctx (chg, 0);
856
857	if (!p->hmac_chk (cctx))
858	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
859	"could be an attack, or just corruption or an synchronization error"),
860	conf->nodename, (const char *)rsi);
861	else	1050	u32 seqno;
		1051	tap_packet *d = p->unpack (this, seqno);
		1052
		1053	if (iseqno.recv_ok (seqno))
862	{	1054	{
863	rsaresponse h;	1055	vpn->tap->send (d);
864		1056
865	rsa_hash (p->id, chg, h);	1057	if (p->dst () == 0) // re-broadcast
		1058	for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
		1059	{
		1060	connection c = i;
866		1061
867	if (!memcmp ((u8 )&h, (u8 )p->response, sizeof h))	1062	if (c->conf != THISNODE && c->conf != conf)
		1063	c->inject_data_packet (d);
		1064	}
		1065
		1066	if (si != rsi)
868	{	1067	{
869	prot_minor = p->prot_minor;	1068	// fast re-sync on connection changes, useful especially for tcp/ip
870
871	delete ictx; ictx = cctx;
872
873	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
874
875	si = rsi;	1069	si = rsi;
876		1070
877	rekey.set (NOW + ::conf.rekey);	1071	slog (L_INFO, _("%s(%s): socket address changed to %s"),
878	keepalive.set (NOW + ::conf.keepalive);
879
880	// send queued packets
881	while (tap_packet *p = queue.get ())
882	{
883	send_data_packet (p);
884	delete p;
885	}
886
887	connectmode = conf->connectmode;
888
889	slog (L_INFO, _("%s(%s): %s connection established, protocol version %d.%d"),
890	conf->nodename, (const char *)rsi,	1072	conf->nodename, (const char )si, (const char )rsi);
891	strprotocol (protocol),
892	p->prot_major, p->prot_minor);
893
894	if (::conf.script_node_up)
895	run_script (run_script_cb (this, &connection::script_node_up), false);
896
897	break;
898	}	1073	}
		1074
899	else	1075	delete d;
900	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),	1076
901	conf->nodename, (const char *)rsi);	1077	break;
902	}	1078	}
903
904	delete cctx;
905	}	1079	}
906	}	1080	}
907	}
908		1081
909	send_reset (rsi);	1082	send_reset (rsi);
910	break;	1083	break;
911		1084
912	case vpn_packet::PT_DATA_COMPRESSED:
913	#if !ENABLE_COMPRESSION
914	send_reset (rsi);
915	break;
916	#endif
917
918	case vpn_packet::PT_DATA_UNCOMPRESSED:
919
920	if (ictx && octx)
921	{
922	vpndata_packet p = (vpndata_packet )pkt;
923
924	if (rsi == si)
925	{
926	if (!p->hmac_chk (ictx))
927	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
928	"could be an attack, or just corruption or an synchronization error"),
929	conf->nodename, (const char *)rsi);
930	else
931	{
932	u32 seqno;
933	tap_packet *d = p->unpack (this, seqno);
934
935	if (iseqno.recv_ok (seqno))
936	{
937	vpn->tap->send (d);
938
939	if (p->dst () == 0) // re-broadcast
940	for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
941	{
942	connection c = i;
943
944	if (c->conf != THISNODE && c->conf != conf)
945	c->inject_data_packet (d);
946	}
947
948	delete d;
949
950	break;
951	}
952	}
953	}
954	else
955	slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
956	}
957
958	send_reset (rsi);
959	break;
960
961	case vpn_packet::PT_CONNECT_REQ:	1085	case vpn_packet::PT_CONNECT_REQ:
962	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1086	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
963	{	1087	{
964	connect_req_packet p = (connect_req_packet ) pkt;	1088	connect_req_packet p = (connect_req_packet ) pkt;
965		1089
966	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1090	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
967	conf->protocols = p->protocols;
968	connection *c = vpn->conns[p->id - 1];	1091	connection *c = vpn->conns[p->id - 1];
		1092	conf->protocols = p->protocols;
969		1093
970	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",	1094	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
971	conf->id, p->id, c->ictx && c->octx);	1095	conf->id, p->id, c->ictx && c->octx);
972		1096
973	if (c->ictx && c->octx)	1097	if (c->ictx && c->octx)
974	{	1098	{
975	// send connect_info packets to both sides, in case one is	1099	// send connect_info packets to both sides, in case one is
976	// behind a nat firewall (or both ;)	1100	// behind a nat firewall (or both ;)
977	c->send_connect_info (conf->id, si, conf->protocols);	1101	c->send_connect_info (conf->id, si, conf->protocols);
978	send_connect_info (c->conf->id, c->si, c->conf->protocols);	1102	send_connect_info (c->conf->id, c->si, c->conf->protocols);
979	}	1103	}
		1104	else
		1105	c->establish_connection ();
980	}	1106	}
981		1107
982	break;	1108	break;
983		1109
984	case vpn_packet::PT_CONNECT_INFO:	1110	case vpn_packet::PT_CONNECT_INFO:
985	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1111	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
986	{	1112	{
987	connect_info_packet p = (connect_info_packet ) pkt;	1113	connect_info_packet p = (connect_info_packet ) pkt;
988		1114
989	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1115	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
990	conf->protocols = p->protocols;	1116
991	connection *c = vpn->conns[p->id - 1];	1117	connection *c = vpn->conns[p->id - 1];
992		1118
		1119	c->conf->protocols = p->protocols;
		1120	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
		1121	p->si.upgrade_protocol (protocol, c->conf);
		1122
993	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1123	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
994	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1124	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
995		1125
		1126	const sockinfo &dsi = forward_si (p->si);
		1127
		1128	if (dsi.valid ())
996	c->send_auth_request (p->si, true);	1129	c->send_auth_request (dsi, true);
997	}	1130	}
998		1131
999	break;	1132	break;
1000		1133
1001	default:	1134	default:
1002	send_reset (rsi);	1135	send_reset (rsi);
1003	break;	1136	break;
1004
1005	}	1137	}
1006	}	1138	}
1007		1139
1008	void connection::keepalive_cb (tstamp &ts)	1140	void connection::keepalive_cb (time_watcher &w)
1009	{	1141	{
1010	if (NOW >= last_activity + ::conf.keepalive + 30)	1142	if (NOW >= last_activity + ::conf.keepalive + 30)
1011	{	1143	{
1012	reset_connection ();	1144	reset_connection ();
1013	establish_connection ();	1145	establish_connection ();
1014	}	1146	}
1015	else if (NOW < last_activity + ::conf.keepalive)	1147	else if (NOW < last_activity + ::conf.keepalive)
1016	ts = last_activity + ::conf.keepalive;	1148	w.at = last_activity + ::conf.keepalive;
1017	else if (conf->connectmode != conf_node::C_ONDEMAND	1149	else if (conf->connectmode != conf_node::C_ONDEMAND
1018	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)	1150	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)
1019	{	1151	{
1020	send_ping (si);	1152	send_ping (si);
1021	ts = NOW + 5;	1153	w.at = NOW + 5;
1022	}	1154	}
		1155	else if (NOW < last_activity + ::conf.keepalive + 10)
		1156	// hold ondemand connections implicitly a few seconds longer
		1157	// should delete octx, though, or something like that ;)
		1158	w.at = last_activity + ::conf.keepalive + 10;
1023	else	1159	else
1024	reset_connection ();	1160	reset_connection ();
1025	}	1161	}
1026		1162
1027	void connection::connect_request (int id)	1163	void connection::send_connect_request (int id)
1028	{	1164	{
1029	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);	1165	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1030		1166
1031	slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);	1167	slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);
1032	p->hmac_set (octx);	1168	p->hmac_set (octx);
…		…
1035	delete p;	1171	delete p;
1036	}	1172	}
1037		1173
1038	void connection::script_node ()	1174	void connection::script_node ()
1039	{	1175	{
1040	vpn->script_if_up (0);	1176	vpn->script_if_up ();
1041		1177
1042	char *env;	1178	char *env;
1043	asprintf (&env, "DESTID=%d", conf->id); putenv (env);	1179	asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1044	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);	1180	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1045	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);	1181	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1046	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);	1182	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1047	}	1183	}
1048		1184
1049	const char *connection::script_node_up (int)	1185	const char *connection::script_node_up ()
1050	{	1186	{
1051	script_node ();	1187	script_node ();
1052		1188
1053	putenv ("STATE=up");	1189	putenv ("STATE=up");
1054		1190
1055	return ::conf.script_node_up ? ::conf.script_node_up : "node-up";	1191	return ::conf.script_node_up ? ::conf.script_node_up : "node-up";
1056	}	1192	}
1057		1193
1058	const char *connection::script_node_down (int)	1194	const char *connection::script_node_down ()
1059	{	1195	{
1060	script_node ();	1196	script_node ();
1061		1197
1062	putenv ("STATE=down");	1198	putenv ("STATE=down");
1063		1199
1064	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";	1200	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1065	}
1066
1067	// send a vpn packet out to other hosts
1068	void
1069	connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1070	{
1071	if (protocol & PROT_IPv4)
1072	vpn->send_ipv4_packet (pkt, si, tos);
1073	else
1074	vpn->send_udpv4_packet (pkt, si, tos);
1075	}	1201	}
1076		1202
1077	connection::connection(struct vpn *vpn_)	1203	connection::connection(struct vpn *vpn_)
1078	: vpn(vpn_)	1204	: vpn(vpn_)
1079	, rekey (this, &connection::rekey_cb)	1205	, rekey (this, &connection::rekey_cb)

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.1 by pcg, Wed Apr 2 03:06:22 2003 UTC vs. Revision 1.19 by pcg, Tue Oct 14 03:22:09 2003 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.1 by pcg, Wed Apr 2 03:06:22 2003 UTC vs.
Revision 1.19 by pcg, Tue Oct 14 03:22:09 2003 UTC