[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.10 by pcg, Sun Apr 6 18:12:18 2003 UTC vs.
Revision 1.23 by pcg, Wed Oct 22 00:42:53 2003 UTC

 /*
     connection.C -- manage a single connection
+    Copyright (C) 2003 Marc Lehmann <pcg@goof.com>
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
     the Free Software Foundation; either version 2 of the License, or
     (at your option) any later version.
 #include "slog.h"
 #include "device.h"
 #include "vpn.h"
 #include "connection.h"
+#include "netcompat.h"
 #if !HAVE_RAND_PSEUDO_BYTES
 # define  RAND_pseudo_bytes RAND_bytes
 #endif
 #define MAGIC "vped\xbd\xc6\xdb\x82"	// 8 bytes of magic
     }
 }
 //////////////////////////////////////////////////////////////////////////////
-void pkt_queue::put (tap_packet *p)
+void pkt_queue::put (net_packet *p)
 {
   if (queue[i])
     {
       delete queue[i];
       j = (j + 1) % QUEUEDEPTH;
   queue[i] = p;
   i = (i + 1) % QUEUEDEPTH;
 }
-tap_packet *pkt_queue::get ()
+net_packet *pkt_queue::get ()
 {
-  tap_packet *p = queue[j];
+  net_packet *p = queue[j];
   if (p)
     {
       queue[j] = 0;
       j = (j + 1) % QUEUEDEPTH;
 // only do action once every x seconds per host whole allowing bursts.
 // this implementation ("splay list" ;) is inefficient,
 // but low on resources.
 struct net_rate_limiter : list<net_rateinfo>
 {
-  static const double ALPHA  = 1. - 1. / 180.; // allow bursts
+  static const double ALPHA  = 1. - 1. / 600.; // allow bursts
   static const double CUTOFF = 10.;            // one event every CUTOFF seconds
   static const double EXPIRE = CUTOFF * 30.;   // expire entries after this time
   static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value
-  bool can (const sockinfo &si) { return can((u32)si.host);             }
+  bool can (const sockinfo &si) { return can((u32)si.host); }
   bool can (u32 host);
 };
 net_rate_limiter auth_rate_limiter, reset_rate_limiter;
   set_hdr (type, dst);
 }
 bool config_packet::chk_config () const
 {
-  return prot_major == PROTOCOL_MAJOR
+  if (prot_major != PROTOCOL_MAJOR)
-         && randsize == RAND_SIZE
+    slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
-         && hmaclen == HMACLENGTH
+  else if (randsize != RAND_SIZE)
-         && flags == curflags ()
+    slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
+  else if (hmaclen != HMACLENGTH)
+    slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
+  else if (flags != curflags ())
+    slog (L_WARN, _("flag mismatch (remote %x <=> local %x)"), flags, curflags ());
-         && challengelen == sizeof (rsachallenge)
+  else if (challengelen != sizeof (rsachallenge))
+    slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
-         && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
+  else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
+    slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
-         && digest_nid == htonl (EVP_MD_type (RSA_HASH))
+  else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
+    slog (L_WARN, _("digest mismatch (remote %x <=> local %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
-         && hmac_nid   == htonl (EVP_MD_type (DIGEST));
+  else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
+    slog (L_WARN, _("hmac mismatch (remote %x <=> local %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
+  else
+    return true;
+  return false;
 }
 struct auth_req_packet : config_packet
 {
   char magic[8];
       rekey.start (NOW + ::conf.rekey);
       keepalive.start (NOW + ::conf.keepalive);
       // send queued packets
       if (ictx && octx)
+        {
-        while (tap_packet *p = queue.get ())
+          while (tap_packet *p = (tap_packet *)data_queue.get ())
-          {
+            {
-            send_data_packet (p);
+              send_data_packet (p);
-            delete p;
+              delete p;
-          }
+            }
+          while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
+            {
+              send_vpn_packet (p, si, IPTOS_RELIABILITY);
+              delete p;
+            }
+        }
     }
   else
     {
       retry_cnt = 0;
       establish_connection.start (NOW + 5);
   reset_connection ();
   establish_connection ();
 }
 void
-connection::send_data_packet (tap_packet *pkt, bool broadcast)
+connection::send_data_packet (tap_packet *pkt)
 {
   vpndata_packet *p = new vpndata_packet;
   int tos = 0;
-  if (conf->inherit_tos
+  // I am not hilarious about peeking into packets, but so be it.
-      && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
+  if (conf->inherit_tos && pkt->is_ipv4 ())
-      && ((*pkt)[14] & 0xf0) == 0x40)             // IPv4
     tos = (*pkt)[15] & IPTOS_TOS_MASK;
-  p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
+  p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
   send_vpn_packet (p, si, tos);
   delete p;
   if (oseqno > MAX_SEQNO)
     rekey ();
 }
 void
-connection::inject_data_packet (tap_packet *pkt, bool broadcast)
+connection::inject_data_packet (tap_packet *pkt, bool broadcast/*TODO DDD*/)
 {
   if (ictx && octx)
-    send_data_packet (pkt, broadcast);
+    send_data_packet (pkt);
   else
     {
       if (!broadcast)//DDDD
-        queue.put (new tap_packet (*pkt));
+        data_queue.put (new tap_packet (*pkt));
       establish_connection ();
     }
 }
 void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
 {
   if (ictx && octx)
     send_vpn_packet (pkt, si, tos);
   else
+    {
+      vpn_queue.put (new vpn_packet (*pkt));
-    establish_connection ();
+      establish_connection ();
+    }
 }
 void
 connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
 {
                 rsachallenge k;
                 if (0 > RSA_private_decrypt (sizeof (p->encr),
                                              (unsigned char *)&p->encr, (unsigned char *)&k,
                                              ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
+                  {
-                  slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
+                    slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
-                        conf->nodename, (const char *)rsi);
+                          conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
+                    break;
+                  }
                 else
                   {
                     delete octx;
                     octx   = new crypto_ctx (k, 1);
                     connection_established ();
                     break;
                   }
               }
+            else
+              slog (L_WARN, _("%s(%s): protocol mismatch"),
+                    conf->nodename, (const char *)rsi);
             send_reset (rsi);
           }
         break;
                       PROTOCOL_MINOR, conf->nodename, p->prot_minor);
               rsachallenge chg;
               if (!rsa_cache.find (p->id, chg))
+                {
-                slog (L_ERR, _("%s(%s): unrequested auth response"),
+                  slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
-                      conf->nodename, (const char *)rsi);
+                        conf->nodename, (const char *)rsi);
+                  break;
+                }
               else
                 {
                   crypto_ctx *cctx = new crypto_ctx (chg, 0);
                   if (!p->hmac_chk (cctx))
+                    {
-                    slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
+                      slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
-                                   "could be an attack, or just corruption or an synchronization error"),
+                                     "could be an attack, or just corruption or an synchronization error"),
-                          conf->nodename, (const char *)rsi);
+                            conf->nodename, (const char *)rsi);
+                      break;
+                    }
                   else
                     {
                       rsaresponse h;
                       rsa_hash (p->id, chg, h);
                 if (iseqno.recv_ok (seqno))
                   {
                     vpn->tap->send (d);
-                    if (p->dst () == 0) // re-broadcast
-                      for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
-                        {
-                          connection *c = *i;
-                          if (c->conf != THISNODE && c->conf != conf)
-                            c->inject_data_packet (d);
-                        }
                     if (si != rsi)
                       {
-                        // fast re-sync on conneciton changes, useful especially for tcp/ip
+                        // fast re-sync on connection changes, useful especially for tcp/ip
                         si = rsi;
                         slog (L_INFO, _("%s(%s): socket address changed to %s"),
                               conf->nodename, (const char *)si, (const char *)rsi);
                       }
                 // send connect_info packets to both sides, in case one is
                 // behind a nat firewall (or both ;)
                 c->send_connect_info (conf->id, si, conf->protocols);
                 send_connect_info (c->conf->id, c->si, c->conf->protocols);
               }
+            else
+              c->establish_connection ();
           }
         break;
       case vpn_packet::PT_CONNECT_INFO:
            || THISNODE->connectmode != conf_node::C_ONDEMAND)
     {
       send_ping (si);
       w.at = NOW + 5;
     }
+  else if (NOW < last_activity + ::conf.keepalive + 10)
+    // hold ondemand connections implicitly a few seconds longer
+    // should delete octx, though, or something like that ;)
+    w.at = last_activity + ::conf.keepalive + 10;
   else
     reset_connection ();
 }
 void connection::send_connect_request (int id)

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.10 by pcg, Sun Apr 6 18:12:18 2003 UTC vs. Revision 1.23 by pcg, Wed Oct 22 00:42:53 2003 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.10 by pcg, Sun Apr 6 18:12:18 2003 UTC vs.
Revision 1.23 by pcg, Wed Oct 22 00:42:53 2003 UTC