--- gvpe/src/connection.C	2013/07/17 04:36:03	1.99
+++ gvpe/src/connection.C	2013/07/18 17:35:10	1.103
@@ -50,6 +50,7 @@
 #include "netcompat.h"
 
 #define MAGIC     "gvpe\xbd\xc6\xdb\x82"	// 8 bytes of magic
+#define MAGIC     "HUHN\xbd\xc6\xdb\x82"	// 8 bytes of magic//D
 
 #define ULTRA_FAST 1
 #define HLOG 15
@@ -121,7 +122,6 @@
     static const unsigned char mac_info[] = "gvpe mac key";
 
     hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
-    kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
     kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key));
     kdf.extract (s, sizeof (s));
     kdf.extract_done (HKDF_PRF_HASH ());
@@ -136,7 +136,6 @@
     static const unsigned char cipher_info[] = "gvpe cipher key";
 
     hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
-    kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
     kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key));
     kdf.extract (s, sizeof (s));
     kdf.extract_done (HKDF_PRF_HASH ());
@@ -160,6 +159,8 @@
                           (unsigned char *)&auth.rsa, (unsigned char *)&encr.rsa,
                           key, RSA_PKCS1_OAEP_PADDING) < 0)
     fatal ("RSA_public_encrypt error");
+
+  memcpy (&encr.ecdh, &auth.ecdh, sizeof (encr.ecdh));
 }
 
 static inline bool
@@ -173,6 +174,7 @@
     return 0;
 
   memcpy (&auth.rsa, rsa_decrypt, sizeof (auth.rsa));
+  memcpy (&auth.ecdh, &encr.ecdh, sizeof (auth.ecdh));
 
   return 1;
 }
@@ -195,7 +197,7 @@
   if (auth_expire < ev_now ())
     {
       // request data
-      RAND_bytes ((unsigned char *)&snd_auth.rsa, sizeof snd_auth.rsa);
+      rand_fill (snd_auth.rsa);
       curve25519_generate (snd_ecdh_a, snd_auth.ecdh);
       auth_hash (snd_auth, snd_auth_mac);
 
@@ -460,7 +462,9 @@
 
   datahdr.seqno = ntohl (seqno);
 #if RAND_SIZE
-  RAND_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);
+  // NB: a constant (per session) random prefix
+  // is likely enough, but we don't take any chances.
+  conn->oiv.get (datahdr.rnd, RAND_SIZE);
 #endif
 
   require (EVP_EncryptUpdate (cctx,
@@ -501,9 +505,15 @@
     d = cdata;
   else
 #endif
-    d = &(*p)[6 + 6 - DATAHDR];
+    d = &(*p)[6 + 6] - DATAHDR;
+
+  // we play do evil games with the struct layout atm.
+  // pending better solutions, we at least do some verification.
+  // this is fine, as we left ISO territory long ago.
+  require (DATAHDR <= 16);
+  require ((u8 *)(&p->len + 1) == &(*p)[0]);
 
-  /* this overwrites part of the src mac, but we fix that later */
+  // this can overwrite the len/dst/src fields
   require (EVP_DecryptUpdate (cctx,
                      d, &outl2,
                      (unsigned char *)&data, len - data_hdr_size ()));
@@ -544,12 +554,13 @@
 
 struct config_packet : vpn_packet
 {
+  u8 serial[SERIAL_SIZE];
   u8 prot_major, prot_minor, randsize;
   u8 flags, features, pad6, pad7, pad8;
   u32 cipher_nid, mac_nid, auth_nid;
 
   void setup (ptype type, int dst);
-  bool chk_config () const;
+  bool chk_config (const conf_node *conf, const sockinfo &rsi) const;
 
   static u8 get_features ()
   {
@@ -576,6 +587,8 @@
   flags = 0;
   features = get_features ();
 
+  strncpy ((char *)serial, conf.serial, sizeof (serial));
+
   cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ()));
   mac_nid    = htonl (EVP_MD_type (MAC_DIGEST ()));
   auth_nid   = htonl (EVP_MD_type (AUTH_DIGEST ()));
@@ -585,20 +598,33 @@
 }
 
 bool
-config_packet::chk_config () const
+config_packet::chk_config (const conf_node *conf, const sockinfo &rsi) const
 {
   if (prot_major != PROTOCOL_MAJOR)
-    slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
+    slog (L_WARN, _("%s(%s): major version mismatch (remote %d <=> local %d)"),
+          conf->nodename, (const char *)rsi, prot_major, PROTOCOL_MAJOR);
   else if (randsize != RAND_SIZE)
-    slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
+    slog (L_WARN, _("%s(%s): rand size mismatch (remote %d <=> local %d)"),
+          conf->nodename, (const char *)rsi, randsize, RAND_SIZE);
   else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ())))
-    slog (L_WARN, _("cipher algo mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));
+    slog (L_WARN, _("%s(%s): cipher algo mismatch (remote %x <=> local %x)"),
+          conf->nodename, (const char *)rsi, ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));
   else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ())))
-    slog (L_WARN, _("mac algo mismatch (remote %x <=> local %x)"), ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ()));
+    slog (L_WARN, _("%s(%s): mac algo mismatch (remote %x <=> local %x)"),
+          conf->nodename, (const char *)rsi, ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ()));
   else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ())))
-    slog (L_WARN, _("auth algo mismatch (remote %x <=> local %x)"), ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ()));
+    slog (L_WARN, _("%s(%s): auth algo mismatch (remote %x <=> local %x)"),
+          conf->nodename, (const char *)rsi, ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ()));
   else
-    return true;
+    {
+      int cmp = memcmp (serial, ::conf.serial, sizeof (serial));
+
+      if (cmp > 0)
+        slog (L_WARN, _("%s(%s): remote serial newer than local serial - outdated config?"),
+              conf->nodename, (const char *)rsi);
+      else if (cmp == 0)
+        return true;
+    }
 
   return false;
 }
@@ -622,13 +648,13 @@
   }
 };
 
-struct auth_res_packet : config_packet // UNPROTECTED
+struct auth_res_packet : vpn_packet // UNPROTECTED
 {
   auth_response response;
 
   auth_res_packet (int dst)
   {
-    config_packet::setup (PT_AUTH_RES, dst);
+    set_hdr (PT_AUTH_RES, dst);
 
     len = sizeof (*this) - sizeof (net_packet);
   }
@@ -694,41 +720,31 @@
   delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b   , 1);
   oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff;
 
-  if (ictx && octx)
-    {
-      // make sure rekeying timeouts are slightly asymmetric
-      ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
-      rekey.start (rekey_interval, rekey_interval);
+  oiv.reset ();
 
-      keepalive.start (::conf.keepalive);
+  // make sure rekeying timeouts are slightly asymmetric
+  ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
+  rekey.start (rekey_interval, rekey_interval);
 
-      // send queued packets
-      if (ictx && octx)
-        {
-          while (tap_packet *p = (tap_packet *)data_queue.get ())
-            {
-              if (p->len) send_data_packet (p);
-              delete p;
-            }
+  keepalive.start (::conf.keepalive);
 
-          while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
-            {
-              if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
-              delete p;
-            }
+  // send queued packets
+  if (ictx && octx)
+    {
+      while (tap_packet *p = (tap_packet *)data_queue.get ())
+        {
+          if (p->len) send_data_packet (p);
+          delete p;
         }
 
-      vpn->connection_established (this);
-    }
-#if 0
-  else
-    {
-      retry_cnt = 0;
-      establish_connection.start (5);
-      keepalive.stop ();
-      rekey.stop ();
+      while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
+        {
+          if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
+          delete p;
+        }
     }
-#endif
+
+  vpn->connection_established (this);
 }
 
 void
@@ -1058,13 +1074,7 @@
 
           config_packet *p = (config_packet *) pkt;
 
-          if (!p->chk_config ())
-            {
-              slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
-                    conf->nodename, (const char *)rsi);
-              connectmode = conf_node::C_DISABLED;
-            }
-          else if (connectmode == conf_node::C_ALWAYS)
+          if (p->chk_config (conf, rsi) && connectmode == conf_node::C_ALWAYS)
             establish_connection ();
         }
         break;
@@ -1078,7 +1088,12 @@
                   conf->nodename, p->initiate ? "initiate" : "reply",
                   p->protocols, p->features);
 
-            if (p->chk_config () && !memcmp (p->magic, MAGIC, 8))
+            if (memcmp (p->magic, MAGIC, 8))
+              {
+                slog (L_WARN, _("%s(%s): protocol magic mismatch - stray packet?"),
+                      conf->nodename, (const char *)rsi);
+              }
+            else if (p->chk_config (conf, rsi))
               {
                 if (p->prot_minor != PROTOCOL_MINOR)
                   slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
@@ -1115,9 +1130,6 @@
 
                 break;
               }
-            else
-              slog (L_WARN, _("%s(%s): protocol mismatch."),
-                    conf->nodename, (const char *)rsi);
 
             send_reset (rsi);
           }
@@ -1130,29 +1142,20 @@
 
           slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
 
-          if (p->chk_config ())
+          if (memcmp (&p->response.mac, snd_auth_mac, sizeof (snd_auth_mac)))
             {
-              if (memcmp (&p->response.mac, snd_auth_mac, sizeof (snd_auth_mac)))
-                {
-                  slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),
-                        conf->nodename, (const char *)rsi);
-                }
-              else if (!have_snd_auth)
-                {
-                  if (p->prot_minor != PROTOCOL_MINOR)
-                    slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
-                          conf->nodename, (const char *)rsi,
-                          PROTOCOL_MINOR, conf->nodename, p->prot_minor);
-
-                  prot_minor = p->prot_minor;
-                  memcpy (snd_ecdh_b, p->response.ecdh, sizeof (snd_ecdh_b));
-
-                  have_snd_auth = true;
-                  connection_established (rsi);
-                }
+              slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),
+                    conf->nodename, (const char *)rsi);
+            }
+          else if (!have_snd_auth)
+            {
+              memcpy (snd_ecdh_b, p->response.ecdh, sizeof (snd_ecdh_b));
 
-               break;
+              have_snd_auth = true;
+              connection_established (rsi);
             }
+
+           break;
         }
 
         send_reset (rsi);