ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.69 by pcg, Thu Aug 7 17:54:26 2008 UTC vs.
Revision 1.85 by pcg, Tue Jul 28 00:42:14 2009 UTC

… …
30*/ 30*/
31 31
32#include "config.h" 32#include "config.h"
33 33
34#include <list> 34#include <list>
35#include <queue>
36#include <utility>
35 37
36#include <openssl/rand.h> 38#include <openssl/rand.h>
37#include <openssl/evp.h> 39#include <openssl/evp.h>
38#include <openssl/rsa.h> 40#include <openssl/rsa.h>
39#include <openssl/err.h> 41#include <openssl/err.h>
… …
48 50
49#if !HAVE_RAND_PSEUDO_BYTES 51#if !HAVE_RAND_PSEUDO_BYTES
50# define RAND_pseudo_bytes RAND_bytes 52# define RAND_pseudo_bytes RAND_bytes
51#endif 53#endif
52 54
53#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 55#define MAGIC_OLD "vped\xbd\xc6\xdb\x82" // 8 bytes of magic (still used in the protocol)
56#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic (understood but not generated)
54 57
55#define ULTRA_FAST 1 58#define ULTRA_FAST 1
56#define HLOG 15 59#define HLOG 15
57#include "lzf/lzf.h" 60#include "lzf/lzf.h"
58#include "lzf/lzf_c.c" 61#include "lzf/lzf_c.c"
59#include "lzf/lzf_d.c" 62#include "lzf/lzf_d.c"
63
64//////////////////////////////////////////////////////////////////////////////
65
66static std::queue< std::pair<run_script_cb *, const char *> > rs_queue;
67static ev::child rs_child_ev;
68
69void // c++ requires external linkage here, apparently :(
70rs_child_cb (ev::child &w, int revents)
71{
72 w.stop ();
73
74 if (rs_queue.empty ())
75 return;
76
77 pid_t pid = run_script (*rs_queue.front ().first, false);
78 if (pid)
79 {
80 w.set (pid);
81 w.start ();
82 }
83 else
84 slog (L_WARN, rs_queue.front ().second);
85
86 delete rs_queue.front ().first;
87 rs_queue.pop ();
88}
89
90// despite the fancy name, this is quite a hack
91static void
92run_script_queued (run_script_cb *cb, const char *warnmsg)
93{
94 rs_queue.push (std::make_pair (cb, warnmsg));
95
96 if (!rs_child_ev.is_active ())
97 {
98 rs_child_ev.set<rs_child_cb> ();
99 rs_child_ev ();
100 }
101}
102
103//////////////////////////////////////////////////////////////////////////////
60 104
61struct crypto_ctx 105struct crypto_ctx
62{ 106{
63 EVP_CIPHER_CTX cctx; 107 EVP_CIPHER_CTX cctx;
64 HMAC_CTX hctx; 108 HMAC_CTX hctx;
… …
570 rsaencrdata encr; 614 rsaencrdata encr;
571 615
572 auth_req_packet (int dst, bool initiate_, u8 protocols_) 616 auth_req_packet (int dst, bool initiate_, u8 protocols_)
573 { 617 {
574 config_packet::setup (PT_AUTH_REQ, dst); 618 config_packet::setup (PT_AUTH_REQ, dst);
575 strncpy (magic, MAGIC, 8); 619 strncpy (magic, MAGIC_OLD, 8);
576 initiate = !!initiate_; 620 initiate = !!initiate_;
577 protocols = protocols_; 621 protocols = protocols_;
578 622
579 len = sizeof (*this) - sizeof (net_packet); 623 len = sizeof (*this) - sizeof (net_packet);
580 } 624 }
… …
629///////////////////////////////////////////////////////////////////////////// 673/////////////////////////////////////////////////////////////////////////////
630 674
631void 675void
632connection::connection_established () 676connection::connection_established ()
633{ 677{
634 slog (L_TRACE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx); 678 slog (L_NOISE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);
635 679
636 if (ictx && octx) 680 if (ictx && octx)
637 { 681 {
638 // make sure rekeying timeouts are slightly asymmetric 682 // make sure rekeying timeouts are slightly asymmetric
639 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0); 683 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
… …
653 { 697 {
654 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY); 698 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
655 delete p; 699 delete p;
656 } 700 }
657 } 701 }
702
703 vpn->connection_established (this);
658 } 704 }
659 else 705 else
660 { 706 {
661 retry_cnt = 0; 707 retry_cnt = 0;
662 establish_connection.start (5); 708 establish_connection.start (5);
… …
666} 712}
667 713
668void 714void
669connection::reset_si () 715connection::reset_si ()
670{ 716{
717 if (vpn->can_direct (THISNODE, conf))
671 protocol = best_protocol (THISNODE->protocols & conf->protocols); 718 protocol = best_protocol (THISNODE->protocols & conf->connectable_protocols ());
672 719 else
673 // mask out protocols we cannot establish
674 if (!conf->udp_port) protocol &= ~PROT_UDPv4;
675 if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
676 if (!conf->dns_port) protocol &= ~PROT_DNSv4;
677
678 if (protocol
679 && (!conf->can_direct (THISNODE)
680 || !THISNODE->can_direct (conf)))
681 { 720 {
682 slog (L_DEBUG, _("%s: direct connection denied"), conf->nodename); 721 slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
683 protocol = 0; 722 protocol = 0;
684 } 723 }
685 724
686 si.set (conf, protocol); 725 si.set (conf, protocol);
726
727 is_direct = si.valid ();
687} 728}
688 729
689// ensure sockinfo is valid, forward if necessary 730// ensure sockinfo is valid, forward if necessary
690const sockinfo & 731const sockinfo &
691connection::forward_si (const sockinfo &si) const 732connection::forward_si (const sockinfo &si) const
692{ 733{
693 if (!si.valid ()) 734 if (!si.valid ())
694 { 735 {
695 connection *r = vpn->find_router (); 736 connection *r = vpn->find_router_for (this);
696 737
697 if (r) 738 if (r)
698 { 739 {
699 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"), 740 slog (L_DEBUG, _("%s: no common protocol, trying to route through %s."),
700 conf->nodename, r->conf->nodename, (const char *)r->si); 741 conf->nodename, r->conf->nodename);
701 return r->si; 742 return r->si;
702 } 743 }
703 else 744 else
704 slog (L_DEBUG, _("%s: node unreachable, no common protocol"), 745 slog (L_DEBUG, _("%s: node unreachable, no common protocol or no router available."),
705 conf->nodename); 746 conf->nodename);
706 } 747 }
707 748
708 return si; 749 return si;
709} 750}
… …
719connection::send_ping (const sockinfo &si, u8 pong) 760connection::send_ping (const sockinfo &si, u8 pong)
720{ 761{
721 ping_packet *pkt = new ping_packet; 762 ping_packet *pkt = new ping_packet;
722 763
723 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 764 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
765
766 slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
767
724 send_vpn_packet (pkt, si, IPTOS_LOWDELAY); 768 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
725 769
726 delete pkt; 770 delete pkt;
727} 771}
728 772
… …
747 791
748 rsachallenge chg; 792 rsachallenge chg;
749 rsa_cache.gen (pkt->id, chg); 793 rsa_cache.gen (pkt->id, chg);
750 rsa_encrypt (conf->rsa_key, chg, pkt->encr); 794 rsa_encrypt (conf->rsa_key, chg, pkt->encr);
751 795
752 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 796 slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
753 797
754 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly 798 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
755 799
756 delete pkt; 800 delete pkt;
757} 801}
… …
765 809
766 rsa_hash (id, chg, pkt->response); 810 rsa_hash (id, chg, pkt->response);
767 811
768 pkt->hmac_set (octx); 812 pkt->hmac_set (octx);
769 813
770 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si); 814 slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
771 815
772 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 816 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
773 817
774 delete pkt; 818 delete pkt;
775} 819}
776 820
777void 821void
778connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols) 822connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
779{ 823{
780 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)", 824 slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s)", conf->nodename,
781 conf->id, rid, (const char *)rsi); 825 vpn->conns[rid - 1]->conf->nodename, (const char *)rsi);
782 826
783 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols); 827 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
784 828
785 r->hmac_set (octx); 829 r->hmac_set (octx);
786 send_vpn_packet (r, si); 830 send_vpn_packet (r, si);
… …
813 857
814 reset_si (); 858 reset_si ();
815 859
816 bool slow = si.prot & PROT_SLOW; 860 bool slow = si.prot & PROT_SLOW;
817 861
818 if (si.prot && !si.host) 862 if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
819 { 863 {
820 slog (L_TRACE, _("%s: connection request (indirect)"), conf->nodename);
821 /*TODO*/ /* start the timer so we don't recurse endlessly */ 864 /*TODO*/ /* start the timer so we don't recurse endlessly */
822 w.start (1); 865 w.start (1);
823 vpn->send_connect_request (conf->id); 866 vpn->send_connect_request (this);
824 } 867 }
825 else 868 else
826 { 869 {
827 slog (L_TRACE, _("%s: connection request (direct)"), conf->nodename, !!ictx, !!octx); 870 if (si.valid ())
871 slog (L_DEBUG, _("%s: sending direct connection request to %s."),
872 conf->nodename, (const char *)si);
828 873
829 const sockinfo &dsi = forward_si (si); 874 const sockinfo &dsi = forward_si (si);
830 875
831 slow = slow || (dsi.prot & PROT_SLOW); 876 slow = slow || (dsi.prot & PROT_SLOW);
832 877
… …
858 slog (L_INFO, _("%s(%s): connection lost"), 903 slog (L_INFO, _("%s(%s): connection lost"),
859 conf->nodename, (const char *)si); 904 conf->nodename, (const char *)si);
860 905
861 if (::conf.script_node_down) 906 if (::conf.script_node_down)
862 { 907 {
863 run_script_cb cb; 908 run_script_cb *cb = new run_script_cb;
864 cb.set<connection, &connection::script_node_down> (this); 909 cb->set<connection, &connection::script_node_down> (this);
865 if (!run_script (cb, false))
866 slog (L_WARN, _("node-down command execution failed, continuing.")); 910 run_script_queued (cb, _("node-down command execution failed, continuing."));
867 } 911 }
868 } 912 }
869 913
870 delete ictx; ictx = 0; 914 delete ictx; ictx = 0;
871 delete octx; octx = 0; 915 delete octx; octx = 0;
… …
873 dnsv4_reset_connection (); 917 dnsv4_reset_connection ();
874#endif 918#endif
875 919
876 si.host = 0; 920 si.host = 0;
877 921
878 last_activity = 0; 922 last_activity = 0.;
923 //last_si_change = 0.;
879 retry_cnt = 0; 924 retry_cnt = 0;
880 925
881 rekey.stop (); 926 rekey.stop ();
882 keepalive.stop (); 927 keepalive.stop ();
883 establish_connection.stop (); 928 establish_connection.stop ();
… …
890 send_reset (si); 935 send_reset (si);
891 936
892 reset_connection (); 937 reset_connection ();
893} 938}
894 939
940// poor-man's rekeying
895inline void 941inline void
896connection::rekey_cb (ev::timer &w, int revents) 942connection::rekey_cb (ev::timer &w, int revents)
897{ 943{
898 reset_connection (); 944 reset_connection ();
899 establish_connection (); 945 establish_connection ();
… …
954void 1000void
955connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 1001connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
956{ 1002{
957 last_activity = ev_now (); 1003 last_activity = ev_now ();
958 1004
959 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 1005 slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
960 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 1006 conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
961 1007
962 if (connectmode == conf_node::C_DISABLED) 1008 if (connectmode == conf_node::C_DISABLED)
963 return; 1009 return;
964 1010
965 switch (pkt->typ ()) 1011 switch (pkt->typ ())
966 { 1012 {
967 case vpn_packet::PT_PING: 1013 case vpn_packet::PT_PING:
1014 slog (L_TRACE, "%s >> PT_PING", conf->nodename);
1015
968 // we send pings instead of auth packets after some retries, 1016 // we send pings instead of auth packets after some retries,
969 // so reset the retry counter and establish a connection 1017 // so reset the retry counter and establish a connection
970 // when we receive a ping. 1018 // when we receive a ping.
971 if (!ictx) 1019 if (!ictx)
972 { 1020 {
973 if (auth_rate_limiter.can (rsi)) 1021 if (auth_rate_limiter.can (rsi))
974 send_auth_request (rsi, true); 1022 send_auth_request (rsi, true);
975 } 1023 }
976 else 1024 else
1025 // we would love to change thre socket address here, but ping's aren't
1026 // authenticated, so we best ignore it.
977 send_ping (rsi, 1); // pong 1027 send_ping (rsi, 1); // pong
978 1028
979 break; 1029 break;
980 1030
981 case vpn_packet::PT_PONG: 1031 case vpn_packet::PT_PONG:
1032 slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
982 break; 1033 break;
983 1034
984 case vpn_packet::PT_RESET: 1035 case vpn_packet::PT_RESET:
985 { 1036 {
986 reset_connection (); 1037 reset_connection ();
987 1038
988 config_packet *p = (config_packet *) pkt; 1039 config_packet *p = (config_packet *) pkt;
989 1040
990 if (!p->chk_config ()) 1041 if (!p->chk_config ())
991 { 1042 {
992 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"), 1043 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
993 conf->nodename, (const char *)rsi); 1044 conf->nodename, (const char *)rsi);
994 connectmode = conf_node::C_DISABLED; 1045 connectmode = conf_node::C_DISABLED;
995 } 1046 }
996 else if (connectmode == conf_node::C_ALWAYS) 1047 else if (connectmode == conf_node::C_ALWAYS)
997 establish_connection (); 1048 establish_connection ();
… …
1001 case vpn_packet::PT_AUTH_REQ: 1052 case vpn_packet::PT_AUTH_REQ:
1002 if (auth_rate_limiter.can (rsi)) 1053 if (auth_rate_limiter.can (rsi))
1003 { 1054 {
1004 auth_req_packet *p = (auth_req_packet *) pkt; 1055 auth_req_packet *p = (auth_req_packet *) pkt;
1005 1056
1006 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 1057 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s)", conf->nodename, p->initiate ? "initiate" : "reply");
1007 1058
1008 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 1059 if (p->chk_config ()
1060 && (!strncmp (p->magic, MAGIC_OLD, 8) || !strncmp (p->magic, MAGIC, 8)))
1009 { 1061 {
1010 if (p->prot_minor != PROTOCOL_MINOR) 1062 if (p->prot_minor != PROTOCOL_MINOR)
1011 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1063 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1012 conf->nodename, (const char *)rsi, 1064 conf->nodename, (const char *)rsi,
1013 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 1065 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
… …
1039 1091
1040 break; 1092 break;
1041 } 1093 }
1042 } 1094 }
1043 else 1095 else
1044 slog (L_WARN, _("%s(%s): protocol mismatch"), 1096 slog (L_WARN, _("%s(%s): protocol mismatch."),
1045 conf->nodename, (const char *)rsi); 1097 conf->nodename, (const char *)rsi);
1046 1098
1047 send_reset (rsi); 1099 send_reset (rsi);
1048 } 1100 }
1049 1101
1050 break; 1102 break;
1051 1103
1052 case vpn_packet::PT_AUTH_RES: 1104 case vpn_packet::PT_AUTH_RES:
1053 { 1105 {
1054 auth_res_packet *p = (auth_res_packet *) pkt; 1106 auth_res_packet *p = (auth_res_packet *)pkt;
1055 1107
1056 slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id); 1108 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
1057 1109
1058 if (p->chk_config ()) 1110 if (p->chk_config ())
1059 { 1111 {
1060 if (p->prot_minor != PROTOCOL_MINOR) 1112 if (p->prot_minor != PROTOCOL_MINOR)
1061 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1113 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
… …
1064 1116
1065 rsachallenge chg; 1117 rsachallenge chg;
1066 1118
1067 if (!rsa_cache.find (p->id, chg)) 1119 if (!rsa_cache.find (p->id, chg))
1068 { 1120 {
1069 slog (L_ERR, _("%s(%s): unrequested auth response ignored"), 1121 slog (L_ERR, _("%s(%s): unrequested auth response, ignoring."),
1070 conf->nodename, (const char *)rsi); 1122 conf->nodename, (const char *)rsi);
1071 break; 1123 break;
1072 } 1124 }
1073 else 1125 else
1074 { 1126 {
1075 crypto_ctx *cctx = new crypto_ctx (chg, 0); 1127 crypto_ctx *cctx = new crypto_ctx (chg, 0);
1076 1128
1077 if (!p->hmac_chk (cctx)) 1129 if (!p->hmac_chk (cctx))
1078 { 1130 {
1079 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 1131 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
1080 "could be an attack, or just corruption or a synchronization error"), 1132 "could be an attack, or just corruption or a synchronization error."),
1081 conf->nodename, (const char *)rsi); 1133 conf->nodename, (const char *)rsi);
1082 break; 1134 break;
1083 } 1135 }
1084 else 1136 else
1085 { 1137 {
… …
1096 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 1148 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
1097 1149
1098 si = rsi; 1150 si = rsi;
1099 protocol = rsi.prot; 1151 protocol = rsi.prot;
1100 1152
1153 slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
1154 conf->nodename, (const char *)rsi,
1155 is_direct ? "direct" : "forwarded",
1156 p->prot_major, p->prot_minor);
1157
1101 connection_established (); 1158 connection_established ();
1102
1103 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
1104 conf->nodename, (const char *)rsi,
1105 p->prot_major, p->prot_minor);
1106 1159
1107 if (::conf.script_node_up) 1160 if (::conf.script_node_up)
1108 { 1161 {
1109 run_script_cb cb; 1162 run_script_cb *cb = new run_script_cb;
1110 cb.set<connection, &connection::script_node_up> (this); 1163 cb->set<connection, &connection::script_node_up> (this);
1111 if (!run_script (cb, false))
1112 slog (L_WARN, _("node-up command execution failed, continuing.")); 1164 run_script_queued (cb, _("node-up command execution failed, continuing."));
1113 } 1165 }
1114 1166
1115 break; 1167 break;
1116 } 1168 }
1117 else 1169 else
1118 slog (L_ERR, _("%s(%s): sent and received challenge do not match"), 1170 slog (L_ERR, _("%s(%s): sent and received challenge do not match."),
1119 conf->nodename, (const char *)rsi); 1171 conf->nodename, (const char *)rsi);
1120 } 1172 }
1121 1173
1122 delete cctx; 1174 delete cctx;
1123 } 1175 }
… …
1139 { 1191 {
1140 vpndata_packet *p = (vpndata_packet *)pkt; 1192 vpndata_packet *p = (vpndata_packet *)pkt;
1141 1193
1142 if (!p->hmac_chk (ictx)) 1194 if (!p->hmac_chk (ictx))
1143 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1195 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1144 "could be an attack, or just corruption or a synchronization error"), 1196 "could be an attack, or just corruption or a synchronization error."),
1145 conf->nodename, (const char *)rsi); 1197 conf->nodename, (const char *)rsi);
1146 else 1198 else
1147 { 1199 {
1148 u32 seqno; 1200 u32 seqno;
1149 tap_packet *d = p->unpack (this, seqno); 1201 tap_packet *d = p->unpack (this, seqno);
1202 int seqclass = iseqno.seqno_classify (seqno);
1150 1203
1151 if (iseqno.recv_ok (seqno)) 1204 if (seqclass == 0) // ok
1152 { 1205 {
1153 vpn->tap->send (d); 1206 vpn->tap->send (d);
1154 1207
1155 if (si != rsi) 1208 if (si != rsi)
1156 { 1209 {
1157 // fast re-sync on source address changes, useful especially for tcp/ip 1210 // fast re-sync on source address changes, useful especially for tcp/ip
1211 //if (last_si_change < ev_now () + 5.)
1158 si = rsi; 1212 // {
1159
1160 slog (L_INFO, _("%s(%s): socket address changed to %s"), 1213 slog (L_INFO, _("%s(%s): changing socket address to %s."),
1161 conf->nodename, (const char *)si, (const char *)rsi); 1214 conf->nodename, (const char *)si, (const char *)rsi);
1215
1216 si = rsi;
1217
1218 if (::conf.script_node_change)
1219 {
1220 run_script_cb *cb = new run_script_cb;
1221 cb->set<connection, &connection::script_node_change> (this);
1222 run_script_queued (cb, _("node-change command execution failed, continuing."));
1223 }
1224
1225 // }
1226 //else
1227 // slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
1228 // conf->nodename, (const char *)si, (const char *)rsi);
1162 } 1229 }
1230 }
1231 else if (seqclass == 1) // far history
1232 slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
1233 "possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
1234 else if (seqclass == 2) // in-window duplicate, happens often on wireless
1235 slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
1236 "possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
1237 else if (seqclass == 3) // reset
1238 {
1239 slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
1240 "probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
1241 send_reset (rsi);
1163 } 1242 }
1164 1243
1165 delete d; 1244 delete d;
1166 break; 1245 break;
1167 } 1246 }
… …
1171 break; 1250 break;
1172 1251
1173 case vpn_packet::PT_CONNECT_REQ: 1252 case vpn_packet::PT_CONNECT_REQ:
1174 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1253 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1175 { 1254 {
1176 connect_req_packet *p = (connect_req_packet *) pkt; 1255 connect_req_packet *p = (connect_req_packet *)pkt;
1177 1256
1178 if (p->id > 0 && p->id <= vpn->conns.size ()) 1257 if (p->id > 0 && p->id <= vpn->conns.size ())
1179 { 1258 {
1180 connection *c = vpn->conns[p->id - 1]; 1259 connection *c = vpn->conns[p->id - 1];
1181 conf->protocols = p->protocols; 1260 conf->protocols = p->protocols;
1182 1261
1183 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]", 1262 slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s) [%d]",
1184 conf->id, p->id, c->ictx && c->octx); 1263 conf->nodename, vpn->conns[p->id - 1]->conf->nodename, c->ictx && c->octx);
1185 1264
1186 if (c->ictx && c->octx) 1265 if (c->ictx && c->octx)
1187 { 1266 {
1188 // send connect_info packets to both sides, in case one is 1267 // send connect_info packets to both sides, in case one is
1189 // behind a nat firewall (or both ;) 1268 // behind a nat firewall (or both ;)
… …
1212 1291
1213 c->conf->protocols = p->protocols; 1292 c->conf->protocols = p->protocols;
1214 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf)); 1293 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1215 p->si.upgrade_protocol (protocol, c->conf); 1294 p->si.upgrade_protocol (protocol, c->conf);
1216 1295
1217 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1296 slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s) [%d]",
1297 conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1218 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1298 (const char *)p->si, !c->ictx && !c->octx);
1219 1299
1220 const sockinfo &dsi = forward_si (p->si); 1300 const sockinfo &dsi = forward_si (p->si);
1221 1301
1222 if (dsi.valid ()) 1302 if (dsi.valid ())
1223 c->send_auth_request (dsi, true); 1303 c->send_auth_request (dsi, true);
… …
1237} 1317}
1238 1318
1239inline void 1319inline void
1240connection::keepalive_cb (ev::timer &w, int revents) 1320connection::keepalive_cb (ev::timer &w, int revents)
1241{ 1321{
1242 if (ev_now () >= last_activity + ::conf.keepalive + 30) 1322 if (ev_now () >= last_activity + ::conf.keepalive + 15)
1243 { 1323 {
1244 reset_connection (); 1324 reset_connection ();
1245 establish_connection (); 1325 establish_connection ();
1246 } 1326 }
1247 else if (ev_now () < last_activity + ::conf.keepalive) 1327 else if (ev_now () < last_activity + ::conf.keepalive)
1248 w.start (last_activity + ::conf.keepalive - ev::now ()); 1328 w.start (last_activity + ::conf.keepalive - ev::now ());
1249 else if (conf->connectmode != conf_node::C_ONDEMAND 1329 else if (conf->connectmode != conf_node::C_ONDEMAND
1250 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1330 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1251 { 1331 {
1252 send_ping (si); 1332 send_ping (si);
1253 w.start (5); 1333 w.start (3);
1254 } 1334 }
1255 else if (ev_now () < last_activity + ::conf.keepalive + 10) 1335 else if (ev_now () < last_activity + ::conf.keepalive + 10)
1256 // hold ondemand connections implicitly a few seconds longer 1336 // hold ondemand connections implicitly a few seconds longer
1257 // should delete octx, though, or something like that ;) 1337 // should delete octx, though, or something like that ;)
1258 w.start (last_activity + ::conf.keepalive + 10 - ev::now ()); 1338 w.start (last_activity + ::conf.keepalive + 10 - ev::now ());
… …
1262 1342
1263void connection::send_connect_request (int id) 1343void connection::send_connect_request (int id)
1264{ 1344{
1265 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1345 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1266 1346
1267 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1347 slog (L_TRACE, "%s << PT_CONNECT_REQ(%s)",
1348 conf->nodename, vpn->conns[id - 1]->conf->nodename);
1268 p->hmac_set (octx); 1349 p->hmac_set (octx);
1269 send_vpn_packet (p, si); 1350 send_vpn_packet (p, si);
1270 1351
1271 delete p; 1352 delete p;
1272} 1353}
1273 1354
1274void connection::script_init_env (const char *ext) 1355void connection::script_init_env (const char *ext)
1275{ 1356{
1276 char *env; 1357 char *env;
1277 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env); 1358 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
1278 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env); 1359 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
1279 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext, 1360 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
1280 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8, 1361 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
1281 conf->id & 0xff); putenv (env); 1362 conf->id & 0xff); putenv (env);
1282} 1363}
1283 1364
1284void connection::script_init_connect_env () 1365void connection::script_init_connect_env ()
1285{ 1366{
1286 vpn->script_init_env (); 1367 vpn->script_init_env ();
1287 1368
1288 char *env; 1369 char *env;
1289 asprintf (&env, "DESTID=%d", conf->id); putenv (env); 1370 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1371 asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env);
1290 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); 1372 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1291 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); 1373 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1292 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); 1374 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1293} 1375}
1294 1376
1295inline const char * 1377inline const char *
1296connection::script_node_up () 1378connection::script_node_up ()
1297{ 1379{
… …
1307 1389
1308 return filename; 1390 return filename;
1309} 1391}
1310 1392
1311inline const char * 1393inline const char *
1394connection::script_node_change ()
1395{
1396 script_init_connect_env ();
1397
1398 putenv ((char *)"STATE=change");
1399
1400 char *filename;
1401 asprintf (&filename,
1402 "%s/%s",
1403 confbase,
1404 ::conf.script_node_change ? ::conf.script_node_change : "node-change");
1405
1406 return filename;
1407}
1408
1409inline const char *
1312connection::script_node_down () 1410connection::script_node_down ()
1313{ 1411{
1314 script_init_connect_env (); 1412 script_init_connect_env ();
1315 1413
1316 putenv ((char *)"STATE=down"); 1414 putenv ((char *)"STATE=down");
… …
1327connection::connection (struct vpn *vpn, conf_node *conf) 1425connection::connection (struct vpn *vpn, conf_node *conf)
1328: vpn(vpn), conf(conf), 1426: vpn(vpn), conf(conf),
1329#if ENABLE_DNS 1427#if ENABLE_DNS
1330 dns (0), 1428 dns (0),
1331#endif 1429#endif
1332 data_queue(conf->max_ttl, conf->max_queue), 1430 data_queue(conf->max_ttl, conf->max_queue + 1),
1333 vpn_queue(conf->max_ttl, conf->max_queue) 1431 vpn_queue(conf->max_ttl, conf->max_queue + 1)
1334{ 1432{
1335 rekey .set<connection, &connection::rekey_cb > (this); 1433 rekey .set<connection, &connection::rekey_cb > (this);
1336 keepalive .set<connection, &connection::keepalive_cb > (this); 1434 keepalive .set<connection, &connection::keepalive_cb > (this);
1337 establish_connection.set<connection, &connection::establish_connection_cb> (this); 1435 establish_connection.set<connection, &connection::establish_connection_cb> (this);
1338 1436

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines