ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.102 by root, Thu Jul 18 13:35:16 2013 UTC vs.
Revision 1.103 by root, Thu Jul 18 17:35:10 2013 UTC

… …
552 } 552 }
553}; 553};
554 554
555struct config_packet : vpn_packet 555struct config_packet : vpn_packet
556{ 556{
557 u8 serial[SERIAL_SIZE];
557 u8 prot_major, prot_minor, randsize; 558 u8 prot_major, prot_minor, randsize;
558 u8 flags, features, pad6, pad7, pad8; 559 u8 flags, features, pad6, pad7, pad8;
559 u32 cipher_nid, mac_nid, auth_nid; 560 u32 cipher_nid, mac_nid, auth_nid;
560 561
561 void setup (ptype type, int dst); 562 void setup (ptype type, int dst);
562 bool chk_config () const; 563 bool chk_config (const conf_node *conf, const sockinfo &rsi) const;
563 564
564 static u8 get_features () 565 static u8 get_features ()
565 { 566 {
566 u8 f = 0; 567 u8 f = 0;
567#if ENABLE_COMPRESSION 568#if ENABLE_COMPRESSION
… …
584 prot_minor = PROTOCOL_MINOR; 585 prot_minor = PROTOCOL_MINOR;
585 randsize = RAND_SIZE; 586 randsize = RAND_SIZE;
586 flags = 0; 587 flags = 0;
587 features = get_features (); 588 features = get_features ();
588 589
590 strncpy ((char *)serial, conf.serial, sizeof (serial));
591
589 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ())); 592 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ()));
590 mac_nid = htonl (EVP_MD_type (MAC_DIGEST ())); 593 mac_nid = htonl (EVP_MD_type (MAC_DIGEST ()));
591 auth_nid = htonl (EVP_MD_type (AUTH_DIGEST ())); 594 auth_nid = htonl (EVP_MD_type (AUTH_DIGEST ()));
592 595
593 len = sizeof (*this) - sizeof (net_packet); 596 len = sizeof (*this) - sizeof (net_packet);
594 set_hdr (type, dst); 597 set_hdr (type, dst);
595} 598}
596 599
597bool 600bool
598config_packet::chk_config () const 601config_packet::chk_config (const conf_node *conf, const sockinfo &rsi) const
599{ 602{
600 if (prot_major != PROTOCOL_MAJOR) 603 if (prot_major != PROTOCOL_MAJOR)
601 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR); 604 slog (L_WARN, _("%s(%s): major version mismatch (remote %d <=> local %d)"),
605 conf->nodename, (const char *)rsi, prot_major, PROTOCOL_MAJOR);
602 else if (randsize != RAND_SIZE) 606 else if (randsize != RAND_SIZE)
603 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE); 607 slog (L_WARN, _("%s(%s): rand size mismatch (remote %d <=> local %d)"),
608 conf->nodename, (const char *)rsi, randsize, RAND_SIZE);
604 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ()))) 609 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ())))
605 slog (L_WARN, _("cipher algo mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ())); 610 slog (L_WARN, _("%s(%s): cipher algo mismatch (remote %x <=> local %x)"),
611 conf->nodename, (const char *)rsi, ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));
606 else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ()))) 612 else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ())))
607 slog (L_WARN, _("mac algo mismatch (remote %x <=> local %x)"), ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ())); 613 slog (L_WARN, _("%s(%s): mac algo mismatch (remote %x <=> local %x)"),
614 conf->nodename, (const char *)rsi, ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ()));
608 else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ()))) 615 else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ())))
609 slog (L_WARN, _("auth algo mismatch (remote %x <=> local %x)"), ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ())); 616 slog (L_WARN, _("%s(%s): auth algo mismatch (remote %x <=> local %x)"),
617 conf->nodename, (const char *)rsi, ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ()));
610 else 618 else
619 {
620 int cmp = memcmp (serial, ::conf.serial, sizeof (serial));
621
622 if (cmp > 0)
623 slog (L_WARN, _("%s(%s): remote serial newer than local serial - outdated config?"),
624 conf->nodename, (const char *)rsi);
625 else if (cmp == 0)
611 return true; 626 return true;
627 }
612 628
613 return false; 629 return false;
614} 630}
615 631
616struct auth_req_packet : config_packet // UNPROTECTED 632struct auth_req_packet : config_packet // UNPROTECTED
… …
630 646
631 len = sizeof (*this) - sizeof (net_packet); 647 len = sizeof (*this) - sizeof (net_packet);
632 } 648 }
633}; 649};
634 650
635struct auth_res_packet : config_packet // UNPROTECTED 651struct auth_res_packet : vpn_packet // UNPROTECTED
636{ 652{
637 auth_response response; 653 auth_response response;
638 654
639 auth_res_packet (int dst) 655 auth_res_packet (int dst)
640 { 656 {
641 config_packet::setup (PT_AUTH_RES, dst); 657 set_hdr (PT_AUTH_RES, dst);
642 658
643 len = sizeof (*this) - sizeof (net_packet); 659 len = sizeof (*this) - sizeof (net_packet);
644 } 660 }
645}; 661};
646 662
… …
1056 { 1072 {
1057 reset_connection (); 1073 reset_connection ();
1058 1074
1059 config_packet *p = (config_packet *) pkt; 1075 config_packet *p = (config_packet *) pkt;
1060 1076
1061 if (!p->chk_config ()) 1077 if (p->chk_config (conf, rsi) && connectmode == conf_node::C_ALWAYS)
1062 {
1063 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
1064 conf->nodename, (const char *)rsi);
1065 connectmode = conf_node::C_DISABLED;
1066 }
1067 else if (connectmode == conf_node::C_ALWAYS)
1068 establish_connection (); 1078 establish_connection ();
1069 } 1079 }
1070 break; 1080 break;
1071 1081
1072 case vpn_packet::PT_AUTH_REQ: 1082 case vpn_packet::PT_AUTH_REQ:
… …
1076 1086
1077 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)", 1087 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)",
1078 conf->nodename, p->initiate ? "initiate" : "reply", 1088 conf->nodename, p->initiate ? "initiate" : "reply",
1079 p->protocols, p->features); 1089 p->protocols, p->features);
1080 1090
1081 if (p->chk_config () && !memcmp (p->magic, MAGIC, 8)) 1091 if (memcmp (p->magic, MAGIC, 8))
1092 {
1093 slog (L_WARN, _("%s(%s): protocol magic mismatch - stray packet?"),
1094 conf->nodename, (const char *)rsi);
1095 }
1096 else if (p->chk_config (conf, rsi))
1082 { 1097 {
1083 if (p->prot_minor != PROTOCOL_MINOR) 1098 if (p->prot_minor != PROTOCOL_MINOR)
1084 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1099 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1085 conf->nodename, (const char *)rsi, 1100 conf->nodename, (const char *)rsi,
1086 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 1101 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
… …
1113 } 1128 }
1114 } 1129 }
1115 1130
1116 break; 1131 break;
1117 } 1132 }
1118 else
1119 slog (L_WARN, _("%s(%s): protocol mismatch."),
1120 conf->nodename, (const char *)rsi);
1121 1133
1122 send_reset (rsi); 1134 send_reset (rsi);
1123 } 1135 }
1124 1136
1125 break; 1137 break;
… …
1128 { 1140 {
1129 auth_res_packet *p = (auth_res_packet *)pkt; 1141 auth_res_packet *p = (auth_res_packet *)pkt;
1130 1142
1131 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename); 1143 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
1132 1144
1133 if (p->chk_config ()) 1145 if (memcmp (&p->response.mac, snd_auth_mac, sizeof (snd_auth_mac)))
1134 { 1146 {
1135 if (memcmp (&p->response.mac, snd_auth_mac, sizeof (snd_auth_mac)))
1136 {
1137 slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."), 1147 slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),
1138 conf->nodename, (const char *)rsi); 1148 conf->nodename, (const char *)rsi);
1139 }
1140 else if (!have_snd_auth)
1141 {
1142 if (p->prot_minor != PROTOCOL_MINOR)
1143 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1144 conf->nodename, (const char *)rsi,
1145 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
1146
1147 prot_minor = p->prot_minor;
1148 memcpy (snd_ecdh_b, p->response.ecdh, sizeof (snd_ecdh_b));
1149
1150 have_snd_auth = true;
1151 connection_established (rsi);
1152 }
1153
1154 break;
1155 } 1149 }
1150 else if (!have_snd_auth)
1151 {
1152 memcpy (snd_ecdh_b, p->response.ecdh, sizeof (snd_ecdh_b));
1153
1154 have_snd_auth = true;
1155 connection_established (rsi);
1156 }
1157
1158 break;
1156 } 1159 }
1157 1160
1158 send_reset (rsi); 1161 send_reset (rsi);
1159 break; 1162 break;
1160 1163

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines