ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.8 by pcg, Sun Apr 6 04:17:36 2003 UTC vs.
Revision 1.69 by pcg, Thu Aug 7 17:54:26 2008 UTC

1/* 1/*
2 connection.C -- manage a single connection 2 connection.C -- manage a single connection
3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
3 4
5 This file is part of GVPE.
6
4 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
5 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
6 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
7 (at your option) any later version. 10 option) any later version.
8 11
9 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
10 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
12 GNU General Public License for more details. 15 Public License for more details.
13 16
14 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
15 along with this program; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
16 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
17*/ 30*/
18 31
19#include "config.h" 32#include "config.h"
20
21extern "C" {
22# include "lzf/lzf.h"
23}
24 33
25#include <list> 34#include <list>
26 35
27#include <openssl/rand.h> 36#include <openssl/rand.h>
28#include <openssl/evp.h> 37#include <openssl/evp.h>
29#include <openssl/rsa.h> 38#include <openssl/rsa.h>
30#include <openssl/err.h> 39#include <openssl/err.h>
31
32#include "gettext.h"
33 40
34#include "conf.h" 41#include "conf.h"
35#include "slog.h" 42#include "slog.h"
36#include "device.h" 43#include "device.h"
37#include "vpn.h" 44#include "vpn.h"
38#include "connection.h" 45#include "connection.h"
39 46
47#include "netcompat.h"
48
40#if !HAVE_RAND_PSEUDO_BYTES 49#if !HAVE_RAND_PSEUDO_BYTES
41# define RAND_pseudo_bytes RAND_bytes 50# define RAND_pseudo_bytes RAND_bytes
42#endif 51#endif
43 52
44#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 53#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
45 54
55#define ULTRA_FAST 1
56#define HLOG 15
57#include "lzf/lzf.h"
58#include "lzf/lzf_c.c"
59#include "lzf/lzf_d.c"
60
46struct crypto_ctx 61struct crypto_ctx
47{ 62{
48 EVP_CIPHER_CTX cctx; 63 EVP_CIPHER_CTX cctx;
49 HMAC_CTX hctx; 64 HMAC_CTX hctx;
50 65
… …
53}; 68};
54 69
55crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc) 70crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)
56{ 71{
57 EVP_CIPHER_CTX_init (&cctx); 72 EVP_CIPHER_CTX_init (&cctx);
58 EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc); 73 require (EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc));
59 HMAC_CTX_init (&hctx); 74 HMAC_CTX_init (&hctx);
60 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0); 75 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
61} 76}
62 77
63crypto_ctx::~crypto_ctx () 78crypto_ctx::~crypto_ctx ()
64{ 79{
65 EVP_CIPHER_CTX_cleanup (&cctx); 80 require (EVP_CIPHER_CTX_cleanup (&cctx));
66 HMAC_CTX_cleanup (&hctx); 81 HMAC_CTX_cleanup (&hctx);
67} 82}
68 83
69static void 84static void
70rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h) 85rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)
71{ 86{
72 EVP_MD_CTX ctx; 87 EVP_MD_CTX ctx;
73 88
74 EVP_MD_CTX_init (&ctx); 89 EVP_MD_CTX_init (&ctx);
75 EVP_DigestInit (&ctx, RSA_HASH); 90 require (EVP_DigestInit (&ctx, RSA_HASH));
76 EVP_DigestUpdate(&ctx, &chg, sizeof chg); 91 require (EVP_DigestUpdate(&ctx, &chg, sizeof chg));
77 EVP_DigestUpdate(&ctx, &id, sizeof id); 92 require (EVP_DigestUpdate(&ctx, &id, sizeof id));
78 EVP_DigestFinal (&ctx, (unsigned char *)&h, 0); 93 require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0));
79 EVP_MD_CTX_cleanup (&ctx); 94 EVP_MD_CTX_cleanup (&ctx);
80} 95}
81 96
82struct rsa_entry { 97struct rsa_entry
98{
83 tstamp expire; 99 tstamp expire;
84 rsaid id; 100 rsaid id;
85 rsachallenge chg; 101 rsachallenge chg;
86}; 102};
87 103
88struct rsa_cache : list<rsa_entry> 104struct rsa_cache : list<rsa_entry>
89{ 105{
90 void cleaner_cb (time_watcher &w); time_watcher cleaner; 106 inline void cleaner_cb (ev::timer &w, int revents); ev::timer cleaner;
91 107
92 bool find (const rsaid &id, rsachallenge &chg) 108 bool find (const rsaid &id, rsachallenge &chg)
93 { 109 {
94 for (iterator i = begin (); i != end (); ++i) 110 for (iterator i = begin (); i != end (); ++i)
95 { 111 {
96 if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW) 112 if (!memcmp (&id, &i->id, sizeof id) && i->expire > ev_now ())
97 { 113 {
98 memcpy (&chg, &i->chg, sizeof chg); 114 memcpy (&chg, &i->chg, sizeof chg);
99 115
100 erase (i); 116 erase (i);
101 return true; 117 return true;
102 } 118 }
103 } 119 }
104 120
105 if (cleaner.at < NOW) 121 if (!cleaner.is_active ())
106 cleaner.start (NOW + RSA_TTL); 122 cleaner.again ();
107 123
108 return false; 124 return false;
109 } 125 }
110 126
111 void gen (rsaid &id, rsachallenge &chg) 127 void gen (rsaid &id, rsachallenge &chg)
112 { 128 {
113 rsa_entry e; 129 rsa_entry e;
114 130
115 RAND_bytes ((unsigned char *)&id, sizeof id); 131 RAND_bytes ((unsigned char *)&id, sizeof id);
116 RAND_bytes ((unsigned char *)&chg, sizeof chg); 132 RAND_bytes ((unsigned char *)&chg, sizeof chg);
117 133
118 e.expire = NOW + RSA_TTL; 134 e.expire = ev_now () + RSA_TTL;
119 e.id = id; 135 e.id = id;
120 memcpy (&e.chg, &chg, sizeof chg); 136 memcpy (&e.chg, &chg, sizeof chg);
121 137
122 push_back (e); 138 push_back (e);
123 139
124 if (cleaner.at < NOW) 140 if (!cleaner.is_active ())
125 cleaner.start (NOW + RSA_TTL); 141 cleaner.again ();
126 } 142 }
127 143
128 rsa_cache () 144 rsa_cache ()
129 : cleaner (this, &rsa_cache::cleaner_cb) 145 {
130 { } 146 cleaner.set<rsa_cache, &rsa_cache::cleaner_cb> (this);
147 cleaner.set (RSA_TTL, RSA_TTL);
148 }
131 149
132} rsa_cache; 150} rsa_cache;
133 151
134void rsa_cache::cleaner_cb (time_watcher &w) 152void rsa_cache::cleaner_cb (ev::timer &w, int revents)
135{ 153{
136 if (empty ()) 154 if (empty ())
137 w.at = TSTAMP_CANCEL; 155 w.stop ();
138 else 156 else
139 { 157 {
140 w.at = NOW + RSA_TTL;
141
142 for (iterator i = begin (); i != end (); ) 158 for (iterator i = begin (); i != end (); )
143 if (i->expire <= NOW) 159 if (i->expire <= ev_now ())
144 i = erase (i); 160 i = erase (i);
145 else 161 else
146 ++i; 162 ++i;
147 } 163 }
148} 164}
149 165
150////////////////////////////////////////////////////////////////////////////// 166//////////////////////////////////////////////////////////////////////////////
151 167
152void pkt_queue::put (tap_packet *p) 168pkt_queue::pkt_queue (double max_ttl, int max_queue)
169: max_ttl (max_ttl), max_queue (max_queue)
153{ 170{
154 if (queue[i]) 171 queue = new pkt [max_queue];
155 {
156 delete queue[i];
157 j = (j + 1) % QUEUEDEPTH;
158 }
159 172
160 queue[i] = p;
161
162 i = (i + 1) % QUEUEDEPTH;
163}
164
165tap_packet *pkt_queue::get ()
166{
167 tap_packet *p = queue[j];
168
169 if (p)
170 {
171 queue[j] = 0;
172 j = (j + 1) % QUEUEDEPTH;
173 }
174
175 return p;
176}
177
178pkt_queue::pkt_queue ()
179{
180 memset (queue, 0, sizeof (queue));
181 i = 0; 173 i = 0;
182 j = 0; 174 j = 0;
175
176 expire.set<pkt_queue, &pkt_queue::expire_cb> (this);
183} 177}
184 178
185pkt_queue::~pkt_queue () 179pkt_queue::~pkt_queue ()
186{ 180{
187 for (i = QUEUEDEPTH; --i > 0; ) 181 while (net_packet *p = get ())
182 delete p;
183
188 delete queue[i]; 184 delete [] queue;
189} 185}
190 186
187void pkt_queue::expire_cb (ev::timer &w, int revents)
188{
189 ev_tstamp expire = ev_now () - max_ttl;
190
191 for (;;)
192 {
193 if (empty ())
194 break;
195
196 double diff = queue[j].tstamp - expire;
197
198 if (diff >= 0.)
199 {
200 w.start (diff > 0.5 ? diff : 0.5);
201 break;
202 }
203
204 delete get ();
205 }
206}
207
208void pkt_queue::put (net_packet *p)
209{
210 ev_tstamp now = ev_now ();
211
212 // start expiry timer
213 if (empty ())
214 expire.start (max_ttl);
215
216 int ni = i + 1 == max_queue ? 0 : i + 1;
217
218 if (ni == j)
219 delete get ();
220
221 queue[i].pkt = p;
222 queue[i].tstamp = now;
223
224 i = ni;
225}
226
227net_packet *pkt_queue::get ()
228{
229 if (empty ())
230 return 0;
231
232 net_packet *p = queue[j].pkt;
233 queue[j].pkt = 0;
234
235 j = j + 1 == max_queue ? 0 : j + 1;
236
237 return p;
238}
239
191struct net_rateinfo { 240struct net_rateinfo
241{
192 u32 host; 242 u32 host;
193 double pcnt, diff; 243 double pcnt, diff;
194 tstamp last; 244 tstamp last;
195}; 245};
196 246
197// only do action once every x seconds per host whole allowing bursts. 247// only do action once every x seconds per host whole allowing bursts.
198// this implementation ("splay list" ;) is inefficient, 248// this implementation ("splay list" ;) is inefficient,
199// but low on resources. 249// but low on resources.
200struct net_rate_limiter : list<net_rateinfo> 250struct net_rate_limiter : list<net_rateinfo>
201{ 251{
202 static const double ALPHA = 1. - 1. / 90.; // allow bursts 252# define NRL_ALPHA (1. - 1. / 600.) // allow bursts
203 static const double CUTOFF = 20.; // one event every CUTOFF seconds 253# define NRL_CUTOFF 10. // one event every CUTOFF seconds
204 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 254# define NRL_EXPIRE (NRL_CUTOFF * 30.) // expire entries after this time
255# define NRL_MAXDIF (NRL_CUTOFF * (1. / (1. - NRL_ALPHA))) // maximum diff /count value
205 256
206 bool can (const sockinfo &si) { return can((u32)si.host); } 257 bool can (const sockinfo &si) { return can((u32)si.host); }
207 bool can (u32 host); 258 bool can (u32 host);
208}; 259};
209 260
210net_rate_limiter auth_rate_limiter, reset_rate_limiter; 261net_rate_limiter auth_rate_limiter, reset_rate_limiter;
211 262
… …
214 iterator i; 265 iterator i;
215 266
216 for (i = begin (); i != end (); ) 267 for (i = begin (); i != end (); )
217 if (i->host == host) 268 if (i->host == host)
218 break; 269 break;
219 else if (i->last < NOW - EXPIRE) 270 else if (i->last < ev_now () - NRL_EXPIRE)
220 i = erase (i); 271 i = erase (i);
221 else 272 else
222 i++; 273 i++;
223 274
224 if (i == end ()) 275 if (i == end ())
225 { 276 {
226 net_rateinfo ri; 277 net_rateinfo ri;
227 278
228 ri.host = host; 279 ri.host = host;
229 ri.pcnt = 1.; 280 ri.pcnt = 1.;
230 ri.diff = CUTOFF * (1. / (1. - ALPHA)); 281 ri.diff = NRL_MAXDIF;
231 ri.last = NOW; 282 ri.last = ev_now ();
232 283
233 push_front (ri); 284 push_front (ri);
234 285
235 return true; 286 return true;
236 } 287 }
237 else 288 else
238 { 289 {
239 net_rateinfo ri (*i); 290 net_rateinfo ri (*i);
240 erase (i); 291 erase (i);
241 292
242 ri.pcnt = ri.pcnt * ALPHA; 293 ri.pcnt = ri.pcnt * NRL_ALPHA;
243 ri.diff = ri.diff * ALPHA + (NOW - ri.last); 294 ri.diff = ri.diff * NRL_ALPHA + (ev_now () - ri.last);
244 295
245 ri.last = NOW; 296 ri.last = ev_now ();
246 297
298 double dif = ri.diff / ri.pcnt;
299
247 bool send = ri.diff / ri.pcnt > CUTOFF; 300 bool send = dif > NRL_CUTOFF;
248 301
302 if (dif > NRL_MAXDIF)
303 {
304 ri.pcnt = 1.;
305 ri.diff = NRL_MAXDIF;
306 }
249 if (send) 307 else if (send)
250 ri.pcnt++; 308 ri.pcnt++;
251 309
252 push_front (ri); 310 push_front (ri);
253 311
254 return send; 312 return send;
… …
299} 357}
300 358
301#define MAXVPNDATA (MAX_MTU - 6 - 6) 359#define MAXVPNDATA (MAX_MTU - 6 - 6)
302#define DATAHDR (sizeof (u32) + RAND_SIZE) 360#define DATAHDR (sizeof (u32) + RAND_SIZE)
303 361
304struct vpndata_packet:vpn_packet 362struct vpndata_packet : vpn_packet
305 { 363 {
306 u8 data[MAXVPNDATA + DATAHDR]; // seqno 364 u8 data[MAXVPNDATA + DATAHDR]; // seqno
307 365
308 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno); 366 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
309 tap_packet *unpack (connection *conn, u32 &seqno); 367 tap_packet *unpack (connection *conn, u32 &seqno);
… …
322 int outl = 0, outl2; 380 int outl = 0, outl2;
323 ptype type = PT_DATA_UNCOMPRESSED; 381 ptype type = PT_DATA_UNCOMPRESSED;
324 382
325#if ENABLE_COMPRESSION 383#if ENABLE_COMPRESSION
326 u8 cdata[MAX_MTU]; 384 u8 cdata[MAX_MTU];
327 u32 cl;
328 385
386 if (conn->features & ENABLE_COMPRESSION)
387 {
329 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7); 388 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
389
330 if (cl) 390 if (cl)
331 { 391 {
332 type = PT_DATA_COMPRESSED; 392 type = PT_DATA_COMPRESSED;
333 d = cdata; 393 d = cdata;
334 l = cl + 2; 394 l = cl + 2;
335 395
336 d[0] = cl >> 8; 396 d[0] = cl >> 8;
337 d[1] = cl; 397 d[1] = cl;
398 }
338 } 399 }
339#endif 400#endif
340 401
341 EVP_EncryptInit_ex (cctx, 0, 0, 0, 0); 402 require (EVP_EncryptInit_ex (cctx, 0, 0, 0, 0));
342 403
343 struct { 404 struct {
344#if RAND_SIZE 405#if RAND_SIZE
345 u8 rnd[RAND_SIZE]; 406 u8 rnd[RAND_SIZE];
346#endif 407#endif
… …
350 datahdr.seqno = ntohl (seqno); 411 datahdr.seqno = ntohl (seqno);
351#if RAND_SIZE 412#if RAND_SIZE
352 RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE); 413 RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);
353#endif 414#endif
354 415
355 EVP_EncryptUpdate (cctx, 416 require (EVP_EncryptUpdate (cctx,
356 (unsigned char *) data + outl, &outl2, 417 (unsigned char *) data + outl, &outl2,
357 (unsigned char *) &datahdr, DATAHDR); 418 (unsigned char *) &datahdr, DATAHDR));
358 outl += outl2; 419 outl += outl2;
359 420
360 EVP_EncryptUpdate (cctx, 421 require (EVP_EncryptUpdate (cctx,
361 (unsigned char *) data + outl, &outl2, 422 (unsigned char *) data + outl, &outl2,
362 (unsigned char *) d, l); 423 (unsigned char *) d, l));
363 outl += outl2; 424 outl += outl2;
364 425
365 EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2); 426 require (EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2));
366 outl += outl2; 427 outl += outl2;
367 428
368 len = outl + data_hdr_size (); 429 len = outl + data_hdr_size ();
369 430
370 set_hdr (type, dst); 431 set_hdr (type, dst);
… …
379 int outl = 0, outl2; 440 int outl = 0, outl2;
380 tap_packet *p = new tap_packet; 441 tap_packet *p = new tap_packet;
381 u8 *d; 442 u8 *d;
382 u32 l = len - data_hdr_size (); 443 u32 l = len - data_hdr_size ();
383 444
384 EVP_DecryptInit_ex (cctx, 0, 0, 0, 0); 445 require (EVP_DecryptInit_ex (cctx, 0, 0, 0, 0));
385 446
386#if ENABLE_COMPRESSION 447#if ENABLE_COMPRESSION
387 u8 cdata[MAX_MTU]; 448 u8 cdata[MAX_MTU];
388 449
389 if (type == PT_DATA_COMPRESSED) 450 if (type == PT_DATA_COMPRESSED)
… …
391 else 452 else
392#endif 453#endif
393 d = &(*p)[6 + 6 - DATAHDR]; 454 d = &(*p)[6 + 6 - DATAHDR];
394 455
395 /* this overwrites part of the src mac, but we fix that later */ 456 /* this overwrites part of the src mac, but we fix that later */
396 EVP_DecryptUpdate (cctx, 457 require (EVP_DecryptUpdate (cctx,
397 d, &outl2, 458 d, &outl2,
398 (unsigned char *)&data, len - data_hdr_size ()); 459 (unsigned char *)&data, len - data_hdr_size ()));
399 outl += outl2; 460 outl += outl2;
400 461
401 EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2); 462 require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2));
402 outl += outl2; 463 outl += outl2;
403 464
404 seqno = ntohl (*(u32 *)(d + RAND_SIZE)); 465 seqno = ntohl (*(u32 *)(d + RAND_SIZE));
405 466
406 id2mac (dst () ? dst() : THISNODE->id, p->dst); 467 id2mac (dst () ? dst() : THISNODE->id, p->dst);
… …
435{ 496{
436 // actually, hmaclen cannot be checked because the hmac 497 // actually, hmaclen cannot be checked because the hmac
437 // field comes before this data, so peers with other 498 // field comes before this data, so peers with other
438 // hmacs simply will not work. 499 // hmacs simply will not work.
439 u8 prot_major, prot_minor, randsize, hmaclen; 500 u8 prot_major, prot_minor, randsize, hmaclen;
440 u8 flags, challengelen, pad2, pad3; 501 u8 flags, challengelen, features, pad3;
441 u32 cipher_nid, digest_nid, hmac_nid; 502 u32 cipher_nid, digest_nid, hmac_nid;
442
443 const u8 curflags () const
444 {
445 return 0x80
446 | (ENABLE_COMPRESSION ? 0x01 : 0x00);
447 }
448 503
449 void setup (ptype type, int dst); 504 void setup (ptype type, int dst);
450 bool chk_config () const; 505 bool chk_config () const;
506
507 static u8 get_features ()
508 {
509 u8 f = 0;
510#if ENABLE_COMPRESSION
511 f |= FEATURE_COMPRESSION;
512#endif
513#if ENABLE_ROHC
514 f |= FEATURE_ROHC;
515#endif
516#if ENABLE_BRIDGING
517 f |= FEATURE_BRIDGING;
518#endif
519 return f;
520 }
451}; 521};
452 522
453void config_packet::setup (ptype type, int dst) 523void config_packet::setup (ptype type, int dst)
454{ 524{
455 prot_major = PROTOCOL_MAJOR; 525 prot_major = PROTOCOL_MAJOR;
456 prot_minor = PROTOCOL_MINOR; 526 prot_minor = PROTOCOL_MINOR;
457 randsize = RAND_SIZE; 527 randsize = RAND_SIZE;
458 hmaclen = HMACLENGTH; 528 hmaclen = HMACLENGTH;
459 flags = curflags (); 529 flags = 0;
460 challengelen = sizeof (rsachallenge); 530 challengelen = sizeof (rsachallenge);
531 features = get_features ();
461 532
462 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER)); 533 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
463 digest_nid = htonl (EVP_MD_type (RSA_HASH)); 534 digest_nid = htonl (EVP_MD_type (RSA_HASH));
464 hmac_nid = htonl (EVP_MD_type (DIGEST)); 535 hmac_nid = htonl (EVP_MD_type (DIGEST));
465 536
… …
467 set_hdr (type, dst); 538 set_hdr (type, dst);
468} 539}
469 540
470bool config_packet::chk_config () const 541bool config_packet::chk_config () const
471{ 542{
472 return prot_major == PROTOCOL_MAJOR 543 if (prot_major != PROTOCOL_MAJOR)
473 && randsize == RAND_SIZE 544 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
474 && hmaclen == HMACLENGTH 545 else if (randsize != RAND_SIZE)
475 && flags == curflags () 546 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
547 else if (hmaclen != HMACLENGTH)
548 slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
476 && challengelen == sizeof (rsachallenge) 549 else if (challengelen != sizeof (rsachallenge))
550 slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
477 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER)) 551 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
552 slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
478 && digest_nid == htonl (EVP_MD_type (RSA_HASH)) 553 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
554 slog (L_WARN, _("digest mismatch (remote %x <=> local %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
479 && hmac_nid == htonl (EVP_MD_type (DIGEST)); 555 else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
556 slog (L_WARN, _("hmac mismatch (remote %x <=> local %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
557 else
558 return true;
559
560 return false;
480} 561}
481 562
482struct auth_req_packet : config_packet 563struct auth_req_packet : config_packet
483{ 564{
484 char magic[8]; 565 char magic[8];
485 u8 initiate; // false if this is just an automatic reply 566 u8 initiate; // false if this is just an automatic reply
486 u8 protocols; // supported protocols (will get patches on forward) 567 u8 protocols; // supported protocols (will be patched on forward)
487 u8 pad2, pad3; 568 u8 pad2, pad3;
488 rsaid id; 569 rsaid id;
489 rsaencrdata encr; 570 rsaencrdata encr;
490 571
491 auth_req_packet (int dst, bool initiate_, u8 protocols_) 572 auth_req_packet (int dst, bool initiate_, u8 protocols_)
… …
546}; 627};
547 628
548///////////////////////////////////////////////////////////////////////////// 629/////////////////////////////////////////////////////////////////////////////
549 630
550void 631void
632connection::connection_established ()
633{
634 slog (L_TRACE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);
635
636 if (ictx && octx)
637 {
638 // make sure rekeying timeouts are slightly asymmetric
639 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
640 rekey.start (rekey_interval, rekey_interval);
641 keepalive.start (::conf.keepalive);
642
643 // send queued packets
644 if (ictx && octx)
645 {
646 while (tap_packet *p = (tap_packet *)data_queue.get ())
647 {
648 if (p->len) send_data_packet (p);
649 delete p;
650 }
651
652 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
653 {
654 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
655 delete p;
656 }
657 }
658 }
659 else
660 {
661 retry_cnt = 0;
662 establish_connection.start (5);
663 keepalive.stop ();
664 rekey.stop ();
665 }
666}
667
668void
551connection::reset_si () 669connection::reset_si ()
552{ 670{
553 protocol = best_protocol (THISNODE->protocols & conf->protocols); 671 protocol = best_protocol (THISNODE->protocols & conf->protocols);
554 672
555 // mask out protocols we cannot establish 673 // mask out protocols we cannot establish
556 if (!conf->udp_port) protocol &= ~PROT_UDPv4; 674 if (!conf->udp_port) protocol &= ~PROT_UDPv4;
557 if (!conf->tcp_port) protocol &= ~PROT_TCPv4; 675 if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
676 if (!conf->dns_port) protocol &= ~PROT_DNSv4;
677
678 if (protocol
679 && (!conf->can_direct (THISNODE)
680 || !THISNODE->can_direct (conf)))
681 {
682 slog (L_DEBUG, _("%s: direct connection denied"), conf->nodename);
683 protocol = 0;
684 }
558 685
559 si.set (conf, protocol); 686 si.set (conf, protocol);
560} 687}
561 688
562// ensure sockinfo is valid, forward if necessary 689// ensure sockinfo is valid, forward if necessary
… …
567 { 694 {
568 connection *r = vpn->find_router (); 695 connection *r = vpn->find_router ();
569 696
570 if (r) 697 if (r)
571 { 698 {
572 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"), 699 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"),
573 conf->nodename, r->conf->nodename); 700 conf->nodename, r->conf->nodename, (const char *)r->si);
574 return r->si; 701 return r->si;
575 } 702 }
576 else 703 else
577 slog (L_DEBUG, _("%s: node unreachable, no common protocol"), 704 slog (L_DEBUG, _("%s: node unreachable, no common protocol"),
578 conf->nodename); 705 conf->nodename);
… …
580 707
581 return si; 708 return si;
582} 709}
583 710
584void 711void
712connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
713{
714 if (!vpn->send_vpn_packet (pkt, si, tos))
715 reset_connection ();
716}
717
718void
585connection::send_ping (const sockinfo &si, u8 pong) 719connection::send_ping (const sockinfo &si, u8 pong)
586{ 720{
587 ping_packet *pkt = new ping_packet; 721 ping_packet *pkt = new ping_packet;
588 722
589 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 723 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
590 vpn->send_vpn_packet (pkt, si, IPTOS_LOWDELAY); 724 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
591 725
592 delete pkt; 726 delete pkt;
593} 727}
594 728
595void 729void
… …
598 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED) 732 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
599 { 733 {
600 config_packet *pkt = new config_packet; 734 config_packet *pkt = new config_packet;
601 735
602 pkt->setup (vpn_packet::PT_RESET, conf->id); 736 pkt->setup (vpn_packet::PT_RESET, conf->id);
603 vpn->send_vpn_packet (pkt, si, IPTOS_MINCOST); 737 send_vpn_packet (pkt, si, IPTOS_MINCOST);
604 738
605 delete pkt; 739 delete pkt;
606 } 740 }
607} 741}
608 742
… …
610connection::send_auth_request (const sockinfo &si, bool initiate) 744connection::send_auth_request (const sockinfo &si, bool initiate)
611{ 745{
612 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols); 746 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
613 747
614 rsachallenge chg; 748 rsachallenge chg;
615
616 rsa_cache.gen (pkt->id, chg); 749 rsa_cache.gen (pkt->id, chg);
617 750 rsa_encrypt (conf->rsa_key, chg, pkt->encr);
618 if (0 > RSA_public_encrypt (sizeof chg,
619 (unsigned char *)&chg, (unsigned char *)&pkt->encr,
620 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
621 fatal ("RSA_public_encrypt error");
622 751
623 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 752 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
624 753
625 vpn->send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly 754 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
626
627 755
628 delete pkt; 756 delete pkt;
629} 757}
630 758
631void 759void
… …
639 767
640 pkt->hmac_set (octx); 768 pkt->hmac_set (octx);
641 769
642 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si); 770 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);
643 771
644 vpn->send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 772 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
645 773
646 delete pkt; 774 delete pkt;
647} 775}
648 776
649void 777void
650connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols) 778connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
651{ 779{
652 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 780 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)",
653 conf->id, rid, (const char *)rsi); 781 conf->id, rid, (const char *)rsi);
654 782
655 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols); 783 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
656 784
657 r->hmac_set (octx); 785 r->hmac_set (octx);
658 vpn->send_vpn_packet (r, si); 786 send_vpn_packet (r, si);
659 787
660 delete r; 788 delete r;
661} 789}
662 790
663void 791inline void
664connection::establish_connection_cb (time_watcher &w) 792connection::establish_connection_cb (ev::timer &w, int revents)
665{ 793{
666 if (ictx || conf == THISNODE 794 if (!ictx
795 && conf != THISNODE
667 || connectmode == conf_node::C_NEVER 796 && connectmode != conf_node::C_NEVER
668 || connectmode == conf_node::C_DISABLED) 797 && connectmode != conf_node::C_DISABLED
669 w.at = TSTAMP_CANCEL; 798 && !w.is_active ())
670 else if (w.at <= NOW)
671 { 799 {
672 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6; 800 // a bit hacky, if ondemand, and packets are no longer queued, then reset the connection
673 801 // and stop trying. should probably be handled by a per-connection expire handler.
674 if (retry_int < 3600 * 8) 802 if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())
803 {
804 reset_connection ();
675 retry_cnt++; 805 return;
806 }
676 807
677 w.at = NOW + retry_int; 808 last_establish_attempt = ev_now ();
809
810 ev::tstamp retry_int = ev::tstamp (retry_cnt & 3
811 ? (retry_cnt & 3) + 1
812 : 1 << (retry_cnt >> 2));
678 813
679 reset_si (); 814 reset_si ();
680 815
816 bool slow = si.prot & PROT_SLOW;
817
681 if (si.prot && !si.host) 818 if (si.prot && !si.host)
819 {
820 slog (L_TRACE, _("%s: connection request (indirect)"), conf->nodename);
821 /*TODO*/ /* start the timer so we don't recurse endlessly */
822 w.start (1);
682 vpn->connect_request (conf->id); 823 vpn->send_connect_request (conf->id);
824 }
683 else 825 else
684 { 826 {
827 slog (L_TRACE, _("%s: connection request (direct)"), conf->nodename, !!ictx, !!octx);
828
685 const sockinfo &dsi = forward_si (si); 829 const sockinfo &dsi = forward_si (si);
830
831 slow = slow || (dsi.prot & PROT_SLOW);
686 832
687 if (dsi.valid () && auth_rate_limiter.can (dsi)) 833 if (dsi.valid () && auth_rate_limiter.can (dsi))
688 { 834 {
689 if (retry_cnt < 4) 835 if (retry_cnt < 4)
690 send_auth_request (dsi, true); 836 send_auth_request (dsi, true);
691 else 837 else
692 send_ping (dsi, 0); 838 send_ping (dsi, 0);
693 } 839 }
694 } 840 }
841
842 retry_int *= slow ? 8. : 0.9;
843
844 if (retry_int < conf->max_retry)
845 retry_cnt++;
846 else
847 retry_int = conf->max_retry;
848
849 w.start (retry_int);
695 } 850 }
696} 851}
697 852
698void 853void
699connection::reset_connection () 854connection::reset_connection ()
… …
702 { 857 {
703 slog (L_INFO, _("%s(%s): connection lost"), 858 slog (L_INFO, _("%s(%s): connection lost"),
704 conf->nodename, (const char *)si); 859 conf->nodename, (const char *)si);
705 860
706 if (::conf.script_node_down) 861 if (::conf.script_node_down)
707 run_script (run_script_cb (this, &connection::script_node_down), false); 862 {
863 run_script_cb cb;
864 cb.set<connection, &connection::script_node_down> (this);
865 if (!run_script (cb, false))
866 slog (L_WARN, _("node-down command execution failed, continuing."));
867 }
708 } 868 }
709 869
710 delete ictx; ictx = 0; 870 delete ictx; ictx = 0;
711 delete octx; octx = 0; 871 delete octx; octx = 0;
872#if ENABLE_DNS
873 dnsv4_reset_connection ();
874#endif
712 875
713 si.host= 0; 876 si.host = 0;
714 877
715 last_activity = 0; 878 last_activity = 0;
716 retry_cnt = 0; 879 retry_cnt = 0;
717 880
718 rekey.reset (); 881 rekey.stop ();
719 keepalive.reset (); 882 keepalive.stop ();
720 establish_connection.reset (); 883 establish_connection.stop ();
721} 884}
722 885
723void 886void
724connection::shutdown () 887connection::shutdown ()
725{ 888{
… …
727 send_reset (si); 890 send_reset (si);
728 891
729 reset_connection (); 892 reset_connection ();
730} 893}
731 894
732void 895inline void
733connection::rekey_cb (time_watcher &w) 896connection::rekey_cb (ev::timer &w, int revents)
734{ 897{
735 w.at = TSTAMP_CANCEL;
736
737 reset_connection (); 898 reset_connection ();
738 establish_connection (); 899 establish_connection ();
739} 900}
740 901
741void 902void
742connection::send_data_packet (tap_packet *pkt, bool broadcast) 903connection::send_data_packet (tap_packet *pkt)
743{ 904{
744 vpndata_packet *p = new vpndata_packet; 905 vpndata_packet *p = new vpndata_packet;
745 int tos = 0; 906 int tos = 0;
746 907
747 if (conf->inherit_tos 908 // I am not hilarious about peeking into packets, but so be it.
748 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 909 if (conf->inherit_tos && pkt->is_ipv4 ())
749 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
750 tos = (*pkt)[15] & IPTOS_TOS_MASK; 910 tos = (*pkt)[15] & IPTOS_TOS_MASK;
751 911
752 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 912 p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
753 vpn->send_vpn_packet (p, si, tos); 913 send_vpn_packet (p, si, tos);
754 914
755 delete p; 915 delete p;
756 916
757 if (oseqno > MAX_SEQNO) 917 if (oseqno > MAX_SEQNO)
758 rekey (); 918 rekey ();
759} 919}
760 920
761void 921void
922connection::post_inject_queue ()
923{
924 // force a connection every now and when when packets are sent (max 1/s)
925 if (ev_now () - last_establish_attempt >= 0.95) // arbitrary
926 establish_connection.stop ();
927
928 establish_connection ();
929}
930
931void
762connection::inject_data_packet (tap_packet *pkt, bool broadcast) 932connection::inject_data_packet (tap_packet *pkt)
763{ 933{
764 if (ictx && octx) 934 if (ictx && octx)
765 send_data_packet (pkt, broadcast); 935 send_data_packet (pkt);
766 else 936 else
767 { 937 {
768 if (!broadcast)//DDDD
769 queue.put (new tap_packet (*pkt)); 938 data_queue.put (new tap_packet (*pkt));
770 939 post_inject_queue ();
771 establish_connection ();
772 } 940 }
773} 941}
774 942
775void connection::inject_vpn_packet (vpn_packet *pkt, int tos) 943void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
776{ 944{
777 if (ictx && octx) 945 if (ictx && octx)
778 vpn->send_vpn_packet (pkt, si, tos); 946 send_vpn_packet (pkt, si, tos);
779 else 947 else
780 establish_connection (); 948 {
949 vpn_queue.put ((vpn_packet *)new data_packet (*(data_packet *)pkt));
950 post_inject_queue ();
951 }
781} 952}
782 953
783void 954void
784connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 955connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
785{ 956{
786 last_activity = NOW; 957 last_activity = ev_now ();
787 958
788 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 959 slog (L_NOISE, "<<%d received packet type %d from %d to %d",
789 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 960 conf->id, pkt->typ (), pkt->src (), pkt->dst ());
961
962 if (connectmode == conf_node::C_DISABLED)
963 return;
790 964
791 switch (pkt->typ ()) 965 switch (pkt->typ ())
792 { 966 {
793 case vpn_packet::PT_PING: 967 case vpn_packet::PT_PING:
794 // we send pings instead of auth packets after some retries, 968 // we send pings instead of auth packets after some retries,
… …
841 if (p->initiate) 1015 if (p->initiate)
842 send_auth_request (rsi, false); 1016 send_auth_request (rsi, false);
843 1017
844 rsachallenge k; 1018 rsachallenge k;
845 1019
846 if (0 > RSA_private_decrypt (sizeof (p->encr), 1020 if (!rsa_decrypt (::conf.rsa_key, p->encr, k))
847 (unsigned char *)&p->encr, (unsigned char *)&k, 1021 {
848 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
849 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 1022 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
850 conf->nodename, (const char *)rsi); 1023 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
1024 break;
1025 }
851 else 1026 else
852 { 1027 {
853 retry_cnt = 0;
854 establish_connection.start (NOW + 8); //? ;)
855 keepalive.reset ();
856 rekey.reset ();
857
858 delete ictx;
859 ictx = 0;
860
861 delete octx; 1028 delete octx;
862 1029
863 octx = new crypto_ctx (k, 1); 1030 octx = new crypto_ctx (k, 1);
864 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 1031 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
865 1032
866 conf->protocols = p->protocols; 1033 conf->protocols = p->protocols;
1034 features = p->features & config_packet::get_features ();
1035
867 send_auth_response (rsi, p->id, k); 1036 send_auth_response (rsi, p->id, k);
1037
1038 connection_established ();
868 1039
869 break; 1040 break;
870 } 1041 }
871 } 1042 }
1043 else
1044 slog (L_WARN, _("%s(%s): protocol mismatch"),
1045 conf->nodename, (const char *)rsi);
872 1046
873 send_reset (rsi); 1047 send_reset (rsi);
874 } 1048 }
875 1049
876 break; 1050 break;
… …
889 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 1063 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
890 1064
891 rsachallenge chg; 1065 rsachallenge chg;
892 1066
893 if (!rsa_cache.find (p->id, chg)) 1067 if (!rsa_cache.find (p->id, chg))
1068 {
894 slog (L_ERR, _("%s(%s): unrequested auth response"), 1069 slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
895 conf->nodename, (const char *)rsi); 1070 conf->nodename, (const char *)rsi);
1071 break;
1072 }
896 else 1073 else
897 { 1074 {
898 crypto_ctx *cctx = new crypto_ctx (chg, 0); 1075 crypto_ctx *cctx = new crypto_ctx (chg, 0);
899 1076
900 if (!p->hmac_chk (cctx)) 1077 if (!p->hmac_chk (cctx))
1078 {
901 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 1079 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
902 "could be an attack, or just corruption or an synchronization error"), 1080 "could be an attack, or just corruption or a synchronization error"),
903 conf->nodename, (const char *)rsi); 1081 conf->nodename, (const char *)rsi);
1082 break;
1083 }
904 else 1084 else
905 { 1085 {
906 rsaresponse h; 1086 rsaresponse h;
907 1087
908 rsa_hash (p->id, chg, h); 1088 rsa_hash (p->id, chg, h);
… …
916 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 1096 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
917 1097
918 si = rsi; 1098 si = rsi;
919 protocol = rsi.prot; 1099 protocol = rsi.prot;
920 1100
921 rekey.start (NOW + ::conf.rekey); 1101 connection_established ();
922 keepalive.start (NOW + ::conf.keepalive);
923
924 // send queued packets
925 while (tap_packet *p = queue.get ())
926 {
927 send_data_packet (p);
928 delete p;
929 }
930
931 connectmode = conf->connectmode;
932 1102
933 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"), 1103 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
934 conf->nodename, (const char *)rsi, 1104 conf->nodename, (const char *)rsi,
935 p->prot_major, p->prot_minor); 1105 p->prot_major, p->prot_minor);
936 1106
937 if (::conf.script_node_up) 1107 if (::conf.script_node_up)
938 run_script (run_script_cb (this, &connection::script_node_up), false); 1108 {
1109 run_script_cb cb;
1110 cb.set<connection, &connection::script_node_up> (this);
1111 if (!run_script (cb, false))
1112 slog (L_WARN, _("node-up command execution failed, continuing."));
1113 }
939 1114
940 break; 1115 break;
941 } 1116 }
942 else 1117 else
943 slog (L_ERR, _("%s(%s): sent and received challenge do not match"), 1118 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
… …
962 1137
963 if (ictx && octx) 1138 if (ictx && octx)
964 { 1139 {
965 vpndata_packet *p = (vpndata_packet *)pkt; 1140 vpndata_packet *p = (vpndata_packet *)pkt;
966 1141
967 if (rsi == si) 1142 if (!p->hmac_chk (ictx))
1143 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1144 "could be an attack, or just corruption or a synchronization error"),
1145 conf->nodename, (const char *)rsi);
1146 else
968 { 1147 {
969 if (!p->hmac_chk (ictx))
970 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
971 "could be an attack, or just corruption or an synchronization error"),
972 conf->nodename, (const char *)rsi);
973 else 1148 u32 seqno;
1149 tap_packet *d = p->unpack (this, seqno);
1150
1151 if (iseqno.recv_ok (seqno))
974 { 1152 {
975 u32 seqno; 1153 vpn->tap->send (d);
976 tap_packet *d = p->unpack (this, seqno);
977 1154
978 if (iseqno.recv_ok (seqno)) 1155 if (si != rsi)
979 { 1156 {
980 vpn->tap->send (d); 1157 // fast re-sync on source address changes, useful especially for tcp/ip
981
982 if (p->dst () == 0) // re-broadcast
983 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
984 {
985 connection *c = *i;
986
987 if (c->conf != THISNODE && c->conf != conf)
988 c->inject_data_packet (d);
989 }
990
991 delete d;
992
993 break; 1158 si = rsi;
1159
1160 slog (L_INFO, _("%s(%s): socket address changed to %s"),
1161 conf->nodename, (const char *)si, (const char *)rsi);
994 } 1162 }
995 } 1163 }
1164
1165 delete d;
1166 break;
996 } 1167 }
997 else
998 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
999 } 1168 }
1000 1169
1001 send_reset (rsi); 1170 send_reset (rsi);
1002 break; 1171 break;
1003 1172
1004 case vpn_packet::PT_CONNECT_REQ: 1173 case vpn_packet::PT_CONNECT_REQ:
1005 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1174 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1006 { 1175 {
1007 connect_req_packet *p = (connect_req_packet *) pkt; 1176 connect_req_packet *p = (connect_req_packet *) pkt;
1008 1177
1009 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1178 if (p->id > 0 && p->id <= vpn->conns.size ())
1010 connection *c = vpn->conns[p->id - 1];
1011 conf->protocols = p->protocols;
1012
1013 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
1014 conf->id, p->id, c->ictx && c->octx);
1015
1016 if (c->ictx && c->octx)
1017 { 1179 {
1180 connection *c = vpn->conns[p->id - 1];
1181 conf->protocols = p->protocols;
1182
1183 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]",
1184 conf->id, p->id, c->ictx && c->octx);
1185
1186 if (c->ictx && c->octx)
1187 {
1018 // send connect_info packets to both sides, in case one is 1188 // send connect_info packets to both sides, in case one is
1019 // behind a nat firewall (or both ;) 1189 // behind a nat firewall (or both ;)
1020 c->send_connect_info (conf->id, si, conf->protocols); 1190 c->send_connect_info (conf->id, si, conf->protocols);
1021 send_connect_info (c->conf->id, c->si, c->conf->protocols); 1191 send_connect_info (c->conf->id, c->si, c->conf->protocols);
1192 }
1193 else
1194 c->establish_connection ();
1022 } 1195 }
1196 else
1197 slog (L_WARN,
1198 _("received authenticated connection request from unknown node #%d, config file mismatch?"),
1199 p->id);
1023 } 1200 }
1024 1201
1025 break; 1202 break;
1026 1203
1027 case vpn_packet::PT_CONNECT_INFO: 1204 case vpn_packet::PT_CONNECT_INFO:
1028 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1205 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1029 { 1206 {
1030 connect_info_packet *p = (connect_info_packet *) pkt; 1207 connect_info_packet *p = (connect_info_packet *)pkt;
1031 1208
1032 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1209 if (p->id > 0 && p->id <= vpn->conns.size ())
1033 1210 {
1034 connection *c = vpn->conns[p->id - 1]; 1211 connection *c = vpn->conns[p->id - 1];
1035 1212
1036 c->conf->protocols = p->protocols; 1213 c->conf->protocols = p->protocols;
1037 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf)); 1214 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1038 p->si.upgrade_protocol (protocol, c->conf); 1215 p->si.upgrade_protocol (protocol, c->conf);
1039 1216
1040 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1217 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1041 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1218 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1042 1219
1043 const sockinfo &dsi = forward_si (p->si); 1220 const sockinfo &dsi = forward_si (p->si);
1044 1221
1045 if (dsi.valid ()) 1222 if (dsi.valid ())
1046 c->send_auth_request (dsi, true); 1223 c->send_auth_request (dsi, true);
1224 }
1225 else
1226 slog (L_WARN,
1227 _("received authenticated connection request from unknown node #%d, config file mismatch?"),
1228 p->id);
1047 } 1229 }
1048 1230
1049 break; 1231 break;
1050 1232
1051 default: 1233 default:
1052 send_reset (rsi); 1234 send_reset (rsi);
1053 break; 1235 break;
1054 } 1236 }
1055} 1237}
1056 1238
1057void connection::keepalive_cb (time_watcher &w) 1239inline void
1240connection::keepalive_cb (ev::timer &w, int revents)
1058{ 1241{
1059 if (NOW >= last_activity + ::conf.keepalive + 30) 1242 if (ev_now () >= last_activity + ::conf.keepalive + 30)
1060 { 1243 {
1061 reset_connection (); 1244 reset_connection ();
1062 establish_connection (); 1245 establish_connection ();
1063 } 1246 }
1064 else if (NOW < last_activity + ::conf.keepalive) 1247 else if (ev_now () < last_activity + ::conf.keepalive)
1065 w.at = last_activity + ::conf.keepalive; 1248 w.start (last_activity + ::conf.keepalive - ev::now ());
1066 else if (conf->connectmode != conf_node::C_ONDEMAND 1249 else if (conf->connectmode != conf_node::C_ONDEMAND
1067 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1250 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1068 { 1251 {
1069 send_ping (si); 1252 send_ping (si);
1070 w.at = NOW + 5; 1253 w.start (5);
1071 } 1254 }
1255 else if (ev_now () < last_activity + ::conf.keepalive + 10)
1256 // hold ondemand connections implicitly a few seconds longer
1257 // should delete octx, though, or something like that ;)
1258 w.start (last_activity + ::conf.keepalive + 10 - ev::now ());
1072 else 1259 else
1073 reset_connection (); 1260 reset_connection ();
1074} 1261}
1075 1262
1076void connection::connect_request (int id) 1263void connection::send_connect_request (int id)
1077{ 1264{
1078 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1265 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1079 1266
1080 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1267 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);
1081 p->hmac_set (octx); 1268 p->hmac_set (octx);
1082 vpn->send_vpn_packet (p, si); 1269 send_vpn_packet (p, si);
1083 1270
1084 delete p; 1271 delete p;
1085} 1272}
1086 1273
1274void connection::script_init_env (const char *ext)
1275{
1276 char *env;
1277 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
1278 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
1279 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
1280 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
1281 conf->id & 0xff); putenv (env);
1282}
1283
1087void connection::script_node () 1284void connection::script_init_connect_env ()
1088{ 1285{
1089 vpn->script_if_up (); 1286 vpn->script_init_env ();
1090 1287
1091 char *env; 1288 char *env;
1092 asprintf (&env, "DESTID=%d", conf->id); putenv (env); 1289 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1093 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); 1290 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1094 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); 1291 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1095 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); 1292 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1096} 1293}
1097 1294
1295inline const char *
1098const char *connection::script_node_up () 1296connection::script_node_up ()
1099{ 1297{
1100 script_node (); 1298 script_init_connect_env ();
1101 1299
1102 putenv ("STATE=up"); 1300 putenv ((char *)"STATE=up");
1103 1301
1302 char *filename;
1303 asprintf (&filename,
1304 "%s/%s",
1305 confbase,
1104 return ::conf.script_node_up ? ::conf.script_node_up : "node-up"; 1306 ::conf.script_node_up ? ::conf.script_node_up : "node-up");
1105}
1106 1307
1308 return filename;
1309}
1310
1311inline const char *
1107const char *connection::script_node_down () 1312connection::script_node_down ()
1108{ 1313{
1109 script_node (); 1314 script_init_connect_env ();
1110 1315
1111 putenv ("STATE=down"); 1316 putenv ((char *)"STATE=down");
1112 1317
1113 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1318 char *filename;
1114} 1319 asprintf (&filename,
1320 "%s/%s",
1321 confbase,
1322 ::conf.script_node_down ? ::conf.script_node_down : "node-down");
1115 1323
1324 return filename;
1325}
1326
1116connection::connection(struct vpn *vpn_) 1327connection::connection (struct vpn *vpn, conf_node *conf)
1117: vpn(vpn_) 1328: vpn(vpn), conf(conf),
1118, rekey (this, &connection::rekey_cb) 1329#if ENABLE_DNS
1119, keepalive (this, &connection::keepalive_cb) 1330 dns (0),
1331#endif
1332 data_queue(conf->max_ttl, conf->max_queue),
1333 vpn_queue(conf->max_ttl, conf->max_queue)
1334{
1335 rekey .set<connection, &connection::rekey_cb > (this);
1336 keepalive .set<connection, &connection::keepalive_cb > (this);
1120, establish_connection (this, &connection::establish_connection_cb) 1337 establish_connection.set<connection, &connection::establish_connection_cb> (this);
1121{ 1338
1339 last_establish_attempt = 0.;
1122 octx = ictx = 0; 1340 octx = ictx = 0;
1123 retry_cnt = 0;
1124 1341
1125 connectmode = conf_node::C_ALWAYS; // initial setting 1342 if (!conf->protocols) // make sure some protocol is enabled
1343 conf->protocols = PROT_UDPv4;
1344
1345 connectmode = conf->connectmode;
1346
1347 // queue a dummy packet to force an initial connection attempt
1348 if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
1349 vpn_queue.put (new net_packet);
1350
1126 reset_connection (); 1351 reset_connection ();
1127} 1352}
1128 1353
1129connection::~connection () 1354connection::~connection ()
1130{ 1355{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines