ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.101 by root, Wed Jul 17 16:40:57 2013 UTC vs.
Revision 1.102 by root, Thu Jul 18 13:35:16 2013 UTC

… …
48#include "hkdf.h" 48#include "hkdf.h"
49 49
50#include "netcompat.h" 50#include "netcompat.h"
51 51
52#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic 52#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic
53#define MAGIC "PORN\xbd\xc6\xdb\x82" // 8 bytes of magic//D 53#define MAGIC "HUHN\xbd\xc6\xdb\x82" // 8 bytes of magic//D
54 54
55#define ULTRA_FAST 1 55#define ULTRA_FAST 1
56#define HLOG 15 56#define HLOG 15
57#include "lzf/lzf.h" 57#include "lzf/lzf.h"
58#include "lzf/lzf_c.c" 58#include "lzf/lzf_c.c"
… …
120 { 120 {
121 u8 mac_key[MAC_KEYSIZE]; 121 u8 mac_key[MAC_KEYSIZE];
122 static const unsigned char mac_info[] = "gvpe mac key"; 122 static const unsigned char mac_info[] = "gvpe mac key";
123 123
124 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ()); 124 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
125 kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
126 kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key)); 125 kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key));
127 kdf.extract (s, sizeof (s)); 126 kdf.extract (s, sizeof (s));
128 kdf.extract_done (HKDF_PRF_HASH ()); 127 kdf.extract_done (HKDF_PRF_HASH ());
129 kdf.expand (mac_key, sizeof (mac_key), mac_info, sizeof (mac_info)); 128 kdf.expand (mac_key, sizeof (mac_key), mac_info, sizeof (mac_info));
130 129
… …
135 { 134 {
136 u8 cipher_key[CIPHER_KEYSIZE]; 135 u8 cipher_key[CIPHER_KEYSIZE];
137 static const unsigned char cipher_info[] = "gvpe cipher key"; 136 static const unsigned char cipher_info[] = "gvpe cipher key";
138 137
139 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ()); 138 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
140 kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
141 kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key)); 139 kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key));
142 kdf.extract (s, sizeof (s)); 140 kdf.extract (s, sizeof (s));
143 kdf.extract_done (HKDF_PRF_HASH ()); 141 kdf.extract_done (HKDF_PRF_HASH ());
144 kdf.expand (cipher_key, sizeof (cipher_key), cipher_info, sizeof (cipher_info)); 142 kdf.expand (cipher_key, sizeof (cipher_key), cipher_info, sizeof (cipher_info));
145 143
… …
462 u32 seqno; 460 u32 seqno;
463 } datahdr; 461 } datahdr;
464 462
465 datahdr.seqno = ntohl (seqno); 463 datahdr.seqno = ntohl (seqno);
466#if RAND_SIZE 464#if RAND_SIZE
467 require (RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE) >= 0); 465 // NB: a constant (per session) random prefix
466 // is likely enough, but we don't take any chances.
467 conn->oiv.get (datahdr.rnd, RAND_SIZE);
468#endif 468#endif
469 469
470 require (EVP_EncryptUpdate (cctx, 470 require (EVP_EncryptUpdate (cctx,
471 (unsigned char *) data + outl, &outl2, 471 (unsigned char *) data + outl, &outl2,
472 (unsigned char *) &datahdr, DATAHDR)); 472 (unsigned char *) &datahdr, DATAHDR));
… …
702 iseqno.reset (ntohl (rcv_auth.rsa.seqno) & 0x7fffffff); 702 iseqno.reset (ntohl (rcv_auth.rsa.seqno) & 0x7fffffff);
703 703
704 delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b , 1); 704 delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b , 1);
705 oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff; 705 oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff;
706 706
707 oiv.reset ();
708
709 // make sure rekeying timeouts are slightly asymmetric
710 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
711 rekey.start (rekey_interval, rekey_interval);
712
713 keepalive.start (::conf.keepalive);
714
715 // send queued packets
707 if (ictx && octx) 716 if (ictx && octx)
708 { 717 {
709 // make sure rekeying timeouts are slightly asymmetric 718 while (tap_packet *p = (tap_packet *)data_queue.get ())
710 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
711 rekey.start (rekey_interval, rekey_interval);
712
713 keepalive.start (::conf.keepalive);
714
715 // send queued packets
716 if (ictx && octx)
717 { 719 {
718 while (tap_packet *p = (tap_packet *)data_queue.get ())
719 {
720 if (p->len) send_data_packet (p); 720 if (p->len) send_data_packet (p);
721 delete p; 721 delete p;
722 }
723
724 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
725 {
726 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
727 delete p;
728 }
729 } 722 }
730 723
724 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
725 {
726 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
727 delete p;
728 }
729 }
730
731 vpn->connection_established (this); 731 vpn->connection_established (this);
732 }
733#if 0
734 else
735 {
736 retry_cnt = 0;
737 establish_connection.start (5);
738 keepalive.stop ();
739 rekey.stop ();
740 }
741#endif
742} 732}
743 733
744void 734void
745connection::reset_si () 735connection::reset_si ()
746{ 736{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines