[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.101 by root, Wed Jul 17 16:40:57 2013 UTC vs.
Revision 1.108 by root, Fri Oct 11 04:07:24 2013 UTC

…		…
33		33
34	#include <list>	34	#include <list>
35	#include <queue>	35	#include <queue>
36	#include <utility>	36	#include <utility>
37		37
		38	#include <openssl/opensslv.h>
38	#include <openssl/rand.h>	39	#include <openssl/rand.h>
39	#include <openssl/evp.h>	40	#include <openssl/evp.h>
40	#include <openssl/rsa.h>	41	#include <openssl/rsa.h>
41	#include <openssl/err.h>	42	#include <openssl/err.h>
		43
		44	// openssl 0.9.8 compatibility
		45	#if OPENSSL_VERSION_NUMBER < 0x10100000
		46	#define require101(exp) exp
		47	#else
		48	#define require101(exp) equire (exp)
		49	#endif
42		50
43	#include "conf.h"	51	#include "conf.h"
44	#include "slog.h"	52	#include "slog.h"
45	#include "device.h"	53	#include "device.h"
46	#include "vpn.h"	54	#include "vpn.h"
…		…
48	#include "hkdf.h"	56	#include "hkdf.h"
49		57
50	#include "netcompat.h"	58	#include "netcompat.h"
51		59
52	#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic	60	#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic
53	#define MAGIC "PORN\xbd\xc6\xdb\x82" // 8 bytes of magic//D	61	#define MAGIC "HUHN\xbd\xc6\xdb\x82" // 8 bytes of magic//D
54		62
55	#define ULTRA_FAST 1	63	#define ULTRA_FAST 1
56	#define HLOG 15	64	#define HLOG 15
57	#include "lzf/lzf.h"	65	#include "lzf/lzf.h"
58	#include "lzf/lzf_c.c"	66	#include "lzf/lzf_c.c"
…		…
120	{	128	{
121	u8 mac_key[MAC_KEYSIZE];	129	u8 mac_key[MAC_KEYSIZE];
122	static const unsigned char mac_info[] = "gvpe mac key";	130	static const unsigned char mac_info[] = "gvpe mac key";
123		131
124	hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());	132	hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
125	kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
126	kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key));	133	kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key));
127	kdf.extract (s, sizeof (s));	134	kdf.extract (s, sizeof (s));
128	kdf.extract_done (HKDF_PRF_HASH ());	135	kdf.extract_done (HKDF_PRF_HASH ());
129	kdf.expand (mac_key, sizeof (mac_key), mac_info, sizeof (mac_info));	136	kdf.expand (mac_key, sizeof (mac_key), mac_info, sizeof (mac_info));
130		137
131	HMAC_CTX_init (&hctx);	138	HMAC_CTX_init (&hctx);
132	require (HMAC_Init_ex (&hctx, mac_key, MAC_KEYSIZE, MAC_DIGEST (), 0));	139	require101 (HMAC_Init_ex (&hctx, mac_key, MAC_KEYSIZE, MAC_DIGEST (), 0));
133	}	140	}
134		141
135	{	142	{
136	u8 cipher_key[CIPHER_KEYSIZE];	143	u8 cipher_key[CIPHER_KEYSIZE];
137	static const unsigned char cipher_info[] = "gvpe cipher key";	144	static const unsigned char cipher_info[] = "gvpe cipher key";
138		145
139	hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());	146	hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
140	kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
141	kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key));	147	kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key));
142	kdf.extract (s, sizeof (s));	148	kdf.extract (s, sizeof (s));
143	kdf.extract_done (HKDF_PRF_HASH ());	149	kdf.extract_done (HKDF_PRF_HASH ());
144	kdf.expand (cipher_key, sizeof (cipher_key), cipher_info, sizeof (cipher_info));	150	kdf.expand (cipher_key, sizeof (cipher_key), cipher_info, sizeof (cipher_info));
145		151
…		…
180		186
181	return 1;	187	return 1;
182	}	188	}
183		189
184	static void	190	static void
185	auth_hash (const auth_data &auth, auth_mac &mac)	191	auth_hash (const auth_data &auth, const ecdh_key &b, auth_mac &mac)
186	{	192	{
187	HMAC_CTX ctx;	193	hkdf kdf (b, sizeof b, AUTH_DIGEST ()); // use response ecdh b as salt
188		194	kdf.extract (&auth.rsa, sizeof (auth.rsa));
189	HMAC_CTX_init (&ctx);	195	kdf.extract_done ();
190	require (HMAC_Init_ex (&ctx, auth.rsa.auth_key, sizeof (auth.rsa.auth_key), AUTH_DIGEST (), 0));	196	kdf.expand (mac, sizeof mac, auth.ecdh, sizeof (auth.ecdh)); // use challenge ecdh b as info
191	require (HMAC_Update (&ctx, (const unsigned char *)&auth, sizeof auth));
192	require (HMAC_Final (&ctx, (unsigned char *)&mac, 0));
193	HMAC_CTX_cleanup (&ctx);
194	}	197	}
195		198
196	void	199	void
197	connection::generate_auth_data ()	200	connection::generate_auth_data ()
198	{	201	{
199	if (auth_expire < ev_now ())	202	if (auth_expire < ev_now ())
200	{	203	{
201	// request data	204	// request data
202	rand_fill (snd_auth.rsa);	205	rand_fill (snd_auth.rsa);
203	curve25519_generate (snd_ecdh_a, snd_auth.ecdh);	206	curve25519_generate (snd_ecdh_a, snd_auth.ecdh);
204	auth_hash (snd_auth, snd_auth_mac);
205		207
206	// eventual response data	208	// eventual response data
207	curve25519_generate (rcv_ecdh_a, rcv_ecdh_b);	209	curve25519_generate (rcv_ecdh_a, rcv_ecdh_b);
208	}	210	}
209		211
…		…
365	}	367	}
366	}	368	}
367		369
368	/////////////////////////////////////////////////////////////////////////////	370	/////////////////////////////////////////////////////////////////////////////
369		371
370	unsigned char hmac_packet::hmac_digest[EVP_MAX_MD_SIZE];
371
372	void	372	void
373	hmac_packet::hmac_gen (crypto_ctx *ctx)	373	hmac_packet::hmac_gen (crypto_ctx ctx, u8 hmac_digest)
374	{	374	{
375	unsigned int xlen;
376
377	HMAC_CTX *hctx = &ctx->hctx;	375	HMAC_CTX *hctx = &ctx->hctx;
378		376
379	require (HMAC_Init_ex (hctx, 0, 0, 0, 0));	377	require101 (HMAC_Init_ex (hctx, 0, 0, 0, 0));
380	require (HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet),	378	require101 (HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet), len - sizeof (hmac_packet)));
381	len - sizeof (hmac_packet)));
382	require (HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen));	379	require101 (HMAC_Final (hctx, hmac_digest, 0));
383	}	380	}
384		381
385	void	382	void
386	hmac_packet::hmac_set (crypto_ctx *ctx)	383	hmac_packet::hmac_set (crypto_ctx *ctx)
387	{	384	{
388	hmac_gen (ctx);	385	unsigned char hmac_digest[EVP_MAX_MD_SIZE];
389		386	hmac_gen (ctx, hmac_digest);
390	memcpy (hmac, hmac_digest, HMACLENGTH);	387	memcpy (hmac, hmac_digest, HMACLENGTH);
391	}	388	}
392		389
393	bool	390	bool
394	hmac_packet::hmac_chk (crypto_ctx *ctx)	391	hmac_packet::hmac_chk (crypto_ctx *ctx)
395	{	392	{
396	hmac_gen (ctx);	393	unsigned char hmac_digest[EVP_MAX_MD_SIZE];
397		394	hmac_gen (ctx, hmac_digest);
398	return !memcmp (hmac, hmac_digest, HMACLENGTH);	395	return !memcmp (hmac, hmac_digest, HMACLENGTH);
399	}	396	}
400		397
401	void	398	void
402	vpn_packet::set_hdr (ptype type_, unsigned int dst)	399	vpn_packet::set_hdr (ptype type_, unsigned int dst)
…		…
462	u32 seqno;	459	u32 seqno;
463	} datahdr;	460	} datahdr;
464		461
465	datahdr.seqno = ntohl (seqno);	462	datahdr.seqno = ntohl (seqno);
466	#if RAND_SIZE	463	#if RAND_SIZE
467	require (RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE) >= 0);	464	// NB: a constant (per session) random prefix
		465	// is likely enough, but we don't take any chances.
		466	conn->oiv.get (datahdr.rnd, RAND_SIZE);
468	#endif	467	#endif
469		468
470	require (EVP_EncryptUpdate (cctx,	469	require (EVP_EncryptUpdate (cctx,
471	(unsigned char *) data + outl, &outl2,	470	(unsigned char *) data + outl, &outl2,
472	(unsigned char *) &datahdr, DATAHDR));	471	(unsigned char *) &datahdr, DATAHDR));
…		…
552	}	551	}
553	};	552	};
554		553
555	struct config_packet : vpn_packet	554	struct config_packet : vpn_packet
556	{	555	{
		556	u8 serial[SERIAL_SIZE];
557	u8 prot_major, prot_minor, randsize;	557	u8 prot_major, prot_minor, randsize;
558	u8 flags, features, pad6, pad7, pad8;	558	u8 flags, features, pad6, pad7, pad8;
559	u32 cipher_nid, mac_nid, auth_nid;	559	u32 cipher_nid, mac_nid, auth_nid;
560		560
561	void setup (ptype type, int dst);	561	void setup (ptype type, int dst);
562	bool chk_config () const;	562	bool chk_config (const conf_node *conf, const sockinfo &rsi) const;
563		563
564	static u8 get_features ()	564	static u8 get_features ()
565	{	565	{
566	u8 f = 0;	566	u8 f = 0;
567	#if ENABLE_COMPRESSION	567	#if ENABLE_COMPRESSION
…		…
584	prot_minor = PROTOCOL_MINOR;	584	prot_minor = PROTOCOL_MINOR;
585	randsize = RAND_SIZE;	585	randsize = RAND_SIZE;
586	flags = 0;	586	flags = 0;
587	features = get_features ();	587	features = get_features ();
588		588
		589	strncpy ((char *)serial, conf.serial, sizeof (serial));
		590
589	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ()));	591	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ()));
590	mac_nid = htonl (EVP_MD_type (MAC_DIGEST ()));	592	mac_nid = htonl (EVP_MD_type (MAC_DIGEST ()));
591	auth_nid = htonl (EVP_MD_type (AUTH_DIGEST ()));	593	auth_nid = htonl (EVP_MD_type (AUTH_DIGEST ()));
592		594
593	len = sizeof (*this) - sizeof (net_packet);	595	len = sizeof (*this) - sizeof (net_packet);
594	set_hdr (type, dst);	596	set_hdr (type, dst);
595	}	597	}
596		598
597	bool	599	bool
598	config_packet::chk_config () const	600	config_packet::chk_config (const conf_node *conf, const sockinfo &rsi) const
599	{	601	{
600	if (prot_major != PROTOCOL_MAJOR)	602	if (prot_major != PROTOCOL_MAJOR)
601	slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);	603	slog (L_WARN, _("%s(%s): major version mismatch (remote %d <=> local %d)"),
		604	conf->nodename, (const char *)rsi, prot_major, PROTOCOL_MAJOR);
602	else if (randsize != RAND_SIZE)	605	else if (randsize != RAND_SIZE)
603	slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);	606	slog (L_WARN, _("%s(%s): rand size mismatch (remote %d <=> local %d)"),
		607	conf->nodename, (const char *)rsi, randsize, RAND_SIZE);
604	else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ())))	608	else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ())))
605	slog (L_WARN, _("cipher algo mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));	609	slog (L_WARN, _("%s(%s): cipher algo mismatch (remote %x <=> local %x)"),
		610	conf->nodename, (const char *)rsi, ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));
606	else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ())))	611	else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ())))
607	slog (L_WARN, _("mac algo mismatch (remote %x <=> local %x)"), ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ()));	612	slog (L_WARN, _("%s(%s): mac algo mismatch (remote %x <=> local %x)"),
		613	conf->nodename, (const char *)rsi, ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ()));
608	else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ())))	614	else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ())))
609	slog (L_WARN, _("auth algo mismatch (remote %x <=> local %x)"), ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ()));	615	slog (L_WARN, _("%s(%s): auth algo mismatch (remote %x <=> local %x)"),
		616	conf->nodename, (const char *)rsi, ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ()));
610	else	617	else
		618	{
		619	int cmp = memcmp (serial, ::conf.serial, sizeof (serial));
		620
		621	if (cmp > 0)
		622	slog (L_WARN, _("%s(%s): remote serial newer than local serial - outdated config?"),
		623	conf->nodename, (const char *)rsi);
		624	else if (cmp == 0)
611	return true;	625	return true;
		626	}
612		627
613	return false;	628	return false;
614	}	629	}
615		630
616	struct auth_req_packet : config_packet // UNPROTECTED	631	struct auth_req_packet : config_packet // UNPROTECTED
…		…
630		645
631	len = sizeof (*this) - sizeof (net_packet);	646	len = sizeof (*this) - sizeof (net_packet);
632	}	647	}
633	};	648	};
634		649
635	struct auth_res_packet : config_packet // UNPROTECTED	650	struct auth_res_packet : vpn_packet // UNPROTECTED
636	{	651	{
637	auth_response response;	652	auth_response response;
638		653
639	auth_res_packet (int dst)	654	auth_res_packet (int dst)
640	{	655	{
641	config_packet::setup (PT_AUTH_RES, dst);	656	set_hdr (PT_AUTH_RES, dst);
642		657
643	len = sizeof (*this) - sizeof (net_packet);	658	len = sizeof (*this) - sizeof (net_packet);
644	}	659	}
645	};	660	};
646		661
…		…
686	si = rsi;	701	si = rsi;
687	protocol = rsi.prot;	702	protocol = rsi.prot;
688		703
689	slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),	704	slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
690	conf->nodename, (const char *)rsi,	705	conf->nodename, (const char *)rsi,
691	is_direct ? "direct" : "forwarded",	706	vpn->can_direct (THISNODE, conf) ? "direct" : "forwarded",
692	PROTOCOL_MAJOR, prot_minor);	707	PROTOCOL_MAJOR, prot_minor);
693		708
694	if (::conf.script_node_up)	709	if (::conf.script_node_up)
695	{	710	{
696	run_script_cb *cb = new run_script_cb;	711	run_script_cb *cb = new run_script_cb;
…		…
702	iseqno.reset (ntohl (rcv_auth.rsa.seqno) & 0x7fffffff);	717	iseqno.reset (ntohl (rcv_auth.rsa.seqno) & 0x7fffffff);
703		718
704	delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b , 1);	719	delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b , 1);
705	oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff;	720	oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff;
706		721
707	if (ictx && octx)	722	oiv.reset ();
708	{	723
709	// make sure rekeying timeouts are slightly asymmetric	724	// make sure rekeying timeouts are slightly asymmetric
710	ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);	725	ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
711	rekey.start (rekey_interval, rekey_interval);	726	rekey.start (rekey_interval, rekey_interval);
712		727
		728	hmac_error = 0.;
		729
713	keepalive.start (::conf.keepalive);	730	keepalive.start (::conf.keepalive);
714		731
715	// send queued packets	732	// send queued packets
716	if (ictx && octx)
717	{
718	while (tap_packet p = (tap_packet )data_queue.get ())	733	while (tap_packet p = (tap_packet )data_queue.get ())
719	{	734	{
720	if (p->len) send_data_packet (p);	735	if (p->len) send_data_packet (p);
721	delete p;	736	delete p;
722	}	737	}
723		738
724	while (vpn_packet p = (vpn_packet )vpn_queue.get ())	739	while (vpn_packet p = (vpn_packet )vpn_queue.get ())
725	{	740	{
726	if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);	741	if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
727	delete p;	742	delete p;
728	}	743	}
729	}
730		744
731	vpn->connection_established (this);	745	vpn->connection_established (this);
732	}
733	#if 0
734	else
735	{
736	retry_cnt = 0;
737	establish_connection.start (5);
738	keepalive.stop ();
739	rekey.stop ();
740	}
741	#endif
742	}	746	}
743		747
744	void	748	void
745	connection::reset_si ()	749	connection::reset_si ()
746	{	750	{
…		…
751	slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);	755	slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
752	protocol = 0;	756	protocol = 0;
753	}	757	}
754		758
755	si.set (conf, protocol);	759	si.set (conf, protocol);
756
757	is_direct = si.valid ();
758	}	760	}
759		761
760	// ensure sockinfo is valid, forward if necessary	762	// ensure sockinfo is valid, forward if necessary
761	const sockinfo &	763	const sockinfo &
762	connection::forward_si (const sockinfo &si) const	764	connection::forward_si (const sockinfo &si) const
…		…
781		783
782	void	784	void
783	connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)	785	connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
784	{	786	{
785	if (!vpn->send_vpn_packet (pkt, si, tos))	787	if (!vpn->send_vpn_packet (pkt, si, tos))
786	reset_connection ();	788	reset_connection ("packet send error");
787	}	789	}
788		790
789	void	791	void
790	connection::send_ping (const sockinfo &si, u8 pong)	792	connection::send_ping (const sockinfo &si, u8 pong)
791	{	793	{
…		…
830	void	832	void
831	connection::send_auth_response (const sockinfo &si)	833	connection::send_auth_response (const sockinfo &si)
832	{	834	{
833	auth_res_packet *pkt = new auth_res_packet (conf->id);	835	auth_res_packet *pkt = new auth_res_packet (conf->id);
834		836
835	auth_hash (rcv_auth, pkt->response.mac);
836	memcpy (pkt->response.ecdh, rcv_ecdh_b, sizeof (rcv_ecdh_b));	837	memcpy (pkt->response.ecdh, rcv_ecdh_b, sizeof rcv_ecdh_b);
		838	auth_hash (rcv_auth, rcv_ecdh_b, pkt->response.mac);
837		839
838	slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);	840	slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
839	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly	841	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
840		842
841	delete pkt;	843	delete pkt;
…		…
867	{	869	{
868	// a bit hacky, if ondemand, and packets are no longer queued, then reset the connection	870	// a bit hacky, if ondemand, and packets are no longer queued, then reset the connection
869	// and stop trying. should probably be handled by a per-connection expire handler.	871	// and stop trying. should probably be handled by a per-connection expire handler.
870	if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())	872	if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())
871	{	873	{
872	reset_connection ();	874	reset_connection ("no demand");
873	return;	875	return;
874	}	876	}
875		877
876	last_establish_attempt = ev_now ();	878	last_establish_attempt = ev_now ();
877		879
…		…
918	w.start (retry_int);	920	w.start (retry_int);
919	}	921	}
920	}	922	}
921		923
922	void	924	void
923	connection::reset_connection ()	925	connection::reset_connection (const char *reason)
924	{	926	{
925	if (ictx && octx)	927	if (ictx && octx)
926	{	928	{
927	slog (L_INFO, _("%s(%s): connection lost"),	929	slog (L_INFO, _("%s(%s): connection lost (%s)"),
928	conf->nodename, (const char *)si);	930	conf->nodename, (const char *)si, reason);
929		931
930	if (::conf.script_node_down)	932	if (::conf.script_node_down)
931	{	933	{
932	run_script_cb *cb = new run_script_cb;	934	run_script_cb *cb = new run_script_cb;
933	cb->set<connection, &connection::script_node_down> (this);	935	cb->set<connection, &connection::script_node_down> (this);
…		…
957	connection::shutdown ()	959	connection::shutdown ()
958	{	960	{
959	if (ictx && octx)	961	if (ictx && octx)
960	send_reset (si);	962	send_reset (si);
961		963
962	reset_connection ();	964	reset_connection ("shutdown");
963	}	965	}
964		966
965	// poor-man's rekeying	967	// poor-man's rekeying
966	inline void	968	inline void
967	connection::rekey_cb (ev::timer &w, int revents)	969	connection::rekey_cb (ev::timer &w, int revents)
968	{	970	{
969	reset_connection ();	971	reset_connection ("rekeying");
970	establish_connection ();	972	establish_connection ();
971	}	973	}
972		974
973	void	975	void
974	connection::send_data_packet (tap_packet *pkt)	976	connection::send_data_packet (tap_packet *pkt)
…		…
1061	// about our desire for communication.	1063	// about our desire for communication.
1062	establish_connection ();	1064	establish_connection ();
1063	break;	1065	break;
1064		1066
1065	case vpn_packet::PT_RESET:	1067	case vpn_packet::PT_RESET:
		1068	slog (L_TRACE, "%s >> PT_RESET", conf->nodename);
		1069
		1070	if (ictx && octx)
1066	{	1071	{
1067	reset_connection ();	1072	reset_connection ("remote reset");
1068		1073
1069	config_packet p = (config_packet ) pkt;	1074	config_packet p = (config_packet ) pkt;
1070		1075
1071	if (!p->chk_config ())	1076	if (p->chk_config (conf, rsi) && connectmode == conf_node::C_ALWAYS)
1072	{
1073	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
1074	conf->nodename, (const char *)rsi);
1075	connectmode = conf_node::C_DISABLED;
1076	}
1077	else if (connectmode == conf_node::C_ALWAYS)
1078	establish_connection ();	1077	establish_connection ();
1079	}	1078	}
		1079
1080	break;	1080	break;
1081		1081
1082	case vpn_packet::PT_AUTH_REQ:	1082	case vpn_packet::PT_AUTH_REQ:
1083	if (auth_rate_limiter.can (rsi))	1083	if (auth_rate_limiter.can (rsi))
1084	{	1084	{
…		…
1086		1086
1087	slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)",	1087	slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)",
1088	conf->nodename, p->initiate ? "initiate" : "reply",	1088	conf->nodename, p->initiate ? "initiate" : "reply",
1089	p->protocols, p->features);	1089	p->protocols, p->features);
1090		1090
1091	if (p->chk_config () && !memcmp (p->magic, MAGIC, 8))	1091	if (memcmp (p->magic, MAGIC, 8))
		1092	{
		1093	slog (L_WARN, _("%s(%s): protocol magic mismatch - stray packet?"),
		1094	conf->nodename, (const char *)rsi);
		1095	}
		1096	else if (p->chk_config (conf, rsi))
1092	{	1097	{
1093	if (p->prot_minor != PROTOCOL_MINOR)	1098	if (p->prot_minor != PROTOCOL_MINOR)
1094	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	1099	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1095	conf->nodename, (const char *)rsi,	1100	conf->nodename, (const char *)rsi,
1096	PROTOCOL_MINOR, conf->nodename, p->prot_minor);	1101	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
1097		1102
1098	if (p->initiate)	1103	if (p->initiate)
		1104	{
1099	send_auth_request (rsi, false);	1105	send_auth_request (rsi, false);
		1106
		1107	if (ictx && octx)
		1108	reset_connection ("reconnect");
		1109	}
1100		1110
1101	auth_data auth;	1111	auth_data auth;
1102		1112
1103	if (!auth_decrypt (::conf.rsa_key, p->encr, auth))	1113	if (!auth_decrypt (::conf.rsa_key, p->encr, auth))
1104	{	1114	{
…		…
1123	}	1133	}
1124	}	1134	}
1125		1135
1126	break;	1136	break;
1127	}	1137	}
1128	else
1129	slog (L_WARN, _("%s(%s): protocol mismatch."),
1130	conf->nodename, (const char *)rsi);
1131		1138
1132	send_reset (rsi);	1139	send_reset (rsi);
1133	}	1140	}
1134		1141
1135	break;	1142	break;
…		…
1138	{	1145	{
1139	auth_res_packet p = (auth_res_packet )pkt;	1146	auth_res_packet p = (auth_res_packet )pkt;
1140		1147
1141	slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);	1148	slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
1142		1149
1143	if (p->chk_config ())	1150	auth_mac local_mac;
		1151	auth_hash (snd_auth, p->response.ecdh, local_mac);
		1152
		1153	if (memcmp (&p->response.mac, local_mac, sizeof local_mac))
1144	{	1154	{
1145	if (memcmp (&p->response.mac, snd_auth_mac, sizeof (snd_auth_mac)))
1146	{
1147	slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),	1155	slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),
1148	conf->nodename, (const char *)rsi);	1156	conf->nodename, (const char *)rsi);
1149	}	1157	}
1150	else if (!have_snd_auth)	1158	else if (!have_snd_auth)
1151	{	1159	{
1152	if (p->prot_minor != PROTOCOL_MINOR)
1153	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1154	conf->nodename, (const char *)rsi,
1155	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
1156
1157	prot_minor = p->prot_minor;
1158	memcpy (snd_ecdh_b, p->response.ecdh, sizeof (snd_ecdh_b));	1160	memcpy (snd_ecdh_b, p->response.ecdh, sizeof snd_ecdh_b);
1159		1161
1160	have_snd_auth = true;	1162	have_snd_auth = true;
1161	connection_established (rsi);	1163	connection_established (rsi);
1162	}
1163
1164	break;
1165	}	1164	}
1166	}	1165	}
1167
1168	send_reset (rsi);
1169	break;	1166	break;
1170		1167
1171	case vpn_packet::PT_DATA_COMPRESSED:	1168	case vpn_packet::PT_DATA_COMPRESSED:
1172	#if !ENABLE_COMPRESSION	1169	#if !ENABLE_COMPRESSION
1173	send_reset (rsi);	1170	send_reset (rsi);
…		…
1179	if (ictx && octx)	1176	if (ictx && octx)
1180	{	1177	{
1181	vpndata_packet p = (vpndata_packet )pkt;	1178	vpndata_packet p = (vpndata_packet )pkt;
1182		1179
1183	if (!p->hmac_chk (ictx))	1180	if (!p->hmac_chk (ictx))
		1181	{
		1182	// rekeying often creates temporary hmac auth floods
		1183	// we assume they don't take longer than a few seconds normally,
		1184	// and suppress messages and resets during that time.
		1185	//TODO: should be done per source address
		1186	if (!hmac_error)
		1187	{
		1188	hmac_error = ev_now () + 3;
		1189	break;
		1190	}
		1191	else if (hmac_error >= ev_now ())
		1192	break; // silently suppress
		1193	else
		1194	{
1184	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"	1195	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1185	"could be an attack, or just corruption or a synchronization error."),	1196	"could be an attack, or just corruption or a synchronization error."),
1186	conf->nodename, (const char *)rsi);	1197	conf->nodename, (const char *)rsi);
		1198	// reset
		1199	}
		1200	}
1187	else	1201	else
1188	{	1202	{
1189	u32 seqno;	1203	u32 seqno;
1190	tap_packet *d = p->unpack (this, seqno);	1204	tap_packet *d = p->unpack (this, seqno);
1191	int seqclass = iseqno.seqno_classify (seqno);	1205	int seqclass = iseqno.seqno_classify (seqno);
		1206
		1207	hmac_error = 0;
1192		1208
1193	if (seqclass == 0) // ok	1209	if (seqclass == 0) // ok
1194	{	1210	{
1195	vpn->tap->send (d);	1211	vpn->tap->send (d);
1196		1212
…		…
1323		1339
1324	if (when >= 0)	1340	if (when >= 0)
1325	w.start (when);	1341	w.start (when);
1326	else if (when < -15)	1342	else if (when < -15)
1327	{	1343	{
1328	reset_connection ();	1344	reset_connection ("keepalive overdue");
1329	establish_connection ();	1345	establish_connection ();
1330	}	1346	}
1331	else if (conf->connectmode != conf_node::C_ONDEMAND	1347	else if (conf->connectmode != conf_node::C_ONDEMAND
1332	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)	1348	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)
1333	{	1349	{
…		…
1337	else if (when >= -10)	1353	else if (when >= -10)
1338	// hold ondemand connections implicitly a few seconds longer	1354	// hold ondemand connections implicitly a few seconds longer
1339	// should delete octx, though, or something like that ;)	1355	// should delete octx, though, or something like that ;)
1340	w.start (when + 10);	1356	w.start (when + 10);
1341	else	1357	else
1342	reset_connection ();	1358	reset_connection ("keepalive timeout");
1343	}	1359	}
1344		1360
1345	void	1361	void
1346	connection::send_connect_request (int id)	1362	connection::send_connect_request (int id)
1347	{	1363	{
…		…
1447		1463
1448	// queue a dummy packet to force an initial connection attempt	1464	// queue a dummy packet to force an initial connection attempt
1449	if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)	1465	if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
1450	vpn_queue.put (new net_packet);	1466	vpn_queue.put (new net_packet);
1451		1467
1452	reset_connection ();	1468	reset_connection ("startup");
1453	}	1469	}
1454		1470
1455	connection::~connection ()	1471	connection::~connection ()
1456	{	1472	{
1457	shutdown ();	1473	shutdown ();

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.101 by root, Wed Jul 17 16:40:57 2013 UTC vs. Revision 1.108 by root, Fri Oct 11 04:07:24 2013 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.101 by root, Wed Jul 17 16:40:57 2013 UTC vs.
Revision 1.108 by root, Fri Oct 11 04:07:24 2013 UTC