ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.102 by root, Thu Jul 18 13:35:16 2013 UTC vs.
Revision 1.116 by root, Mon Apr 1 03:10:26 2019 UTC

1/* 1/*
2 connection.C -- manage a single connection 2 connection.C -- manage a single connection
3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013,2016 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify it 7 GVPE is free software; you can redistribute it and/or modify it
8 under the terms of the GNU General Public License as published by the 8 under the terms of the GNU General Public License as published by the
… …
33 33
34#include <list> 34#include <list>
35#include <queue> 35#include <queue>
36#include <utility> 36#include <utility>
37 37
38#include <openssl/opensslv.h>
38#include <openssl/rand.h> 39#include <openssl/rand.h>
39#include <openssl/evp.h> 40#include <openssl/evp.h>
40#include <openssl/rsa.h> 41#include <openssl/rsa.h>
41#include <openssl/err.h> 42#include <openssl/err.h>
42 43
43#include "conf.h" 44#include "conf.h"
44#include "slog.h" 45#include "slog.h"
46#include "crypto.h"
45#include "device.h" 47#include "device.h"
46#include "vpn.h" 48#include "vpn.h"
47#include "connection.h" 49#include "connection.h"
48#include "hkdf.h" 50#include "hkdf.h"
49 51
50#include "netcompat.h" 52#include "netcompat.h"
51 53
52#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic 54#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic
53#define MAGIC "HUHN\xbd\xc6\xdb\x82" // 8 bytes of magic//D
54 55
56#define LZF_STATE_ARG 1
55#define ULTRA_FAST 1 57#define ULTRA_FAST 1
56#define HLOG 15 58#define HLOG 15
57#include "lzf/lzf.h" 59#define INIT_HTAB 0
58#include "lzf/lzf_c.c" 60#include "lzf/lzf_c.c"
59#include "lzf/lzf_d.c" 61#include "lzf/lzf_d.c"
60 62
61////////////////////////////////////////////////////////////////////////////// 63//////////////////////////////////////////////////////////////////////////////
62 64
… …
102 104
103////////////////////////////////////////////////////////////////////////////// 105//////////////////////////////////////////////////////////////////////////////
104 106
105struct crypto_ctx 107struct crypto_ctx
106{ 108{
107 EVP_CIPHER_CTX cctx; 109 cipher cctx;
108 HMAC_CTX hctx; 110 hmac hctx;
109 111
110 crypto_ctx (const auth_data &auth1, const auth_data &auth2, const ecdh_key &a, const ecdh_key &b, int enc); 112 crypto_ctx (const auth_data &auth1, const auth_data &auth2, const ecdh_key &a, const ecdh_key &b, int enc);
111 ~crypto_ctx (); 113 ~crypto_ctx ();
112}; 114};
113 115
… …
125 kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key)); 127 kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key));
126 kdf.extract (s, sizeof (s)); 128 kdf.extract (s, sizeof (s));
127 kdf.extract_done (HKDF_PRF_HASH ()); 129 kdf.extract_done (HKDF_PRF_HASH ());
128 kdf.expand (mac_key, sizeof (mac_key), mac_info, sizeof (mac_info)); 130 kdf.expand (mac_key, sizeof (mac_key), mac_info, sizeof (mac_info));
129 131
130 HMAC_CTX_init (&hctx); 132 hctx.init (mac_key, MAC_KEYSIZE, MAC_DIGEST ());
131 require (HMAC_Init_ex (&hctx, mac_key, MAC_KEYSIZE, MAC_DIGEST (), 0));
132 } 133 }
133 134
134 { 135 {
135 u8 cipher_key[CIPHER_KEYSIZE]; 136 u8 cipher_key[CIPHER_KEYSIZE];
136 static const unsigned char cipher_info[] = "gvpe cipher key"; 137 static const unsigned char cipher_info[] = "gvpe cipher key";
… …
139 kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key)); 140 kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key));
140 kdf.extract (s, sizeof (s)); 141 kdf.extract (s, sizeof (s));
141 kdf.extract_done (HKDF_PRF_HASH ()); 142 kdf.extract_done (HKDF_PRF_HASH ());
142 kdf.expand (cipher_key, sizeof (cipher_key), cipher_info, sizeof (cipher_info)); 143 kdf.expand (cipher_key, sizeof (cipher_key), cipher_info, sizeof (cipher_info));
143 144
144 EVP_CIPHER_CTX_init (&cctx); 145 EVP_CIPHER_CTX_init (cctx);
145 require (EVP_CipherInit_ex (&cctx, CIPHER (), 0, cipher_key, 0, enc)); 146 require (EVP_CipherInit_ex (cctx, CIPHER (), 0, cipher_key, 0, enc));
146 } 147 }
147} 148}
148 149
149crypto_ctx::~crypto_ctx () 150crypto_ctx::~crypto_ctx ()
150{ 151{
151 require (EVP_CIPHER_CTX_cleanup (&cctx)); 152 require (EVP_CIPHER_CTX_cleanup (cctx));
152 HMAC_CTX_cleanup (&hctx);
153} 153}
154 154
155static inline void 155static inline void
156auth_encrypt (RSA *key, const auth_data &auth, auth_encr &encr) 156auth_encrypt (RSA *key, const auth_data &auth, auth_encr &encr)
157{ 157{
… …
178 178
179 return 1; 179 return 1;
180} 180}
181 181
182static void 182static void
183auth_hash (const auth_data &auth, auth_mac &mac) 183auth_hash (const auth_data &auth, const ecdh_key &b, auth_mac &mac)
184{ 184{
185 HMAC_CTX ctx; 185 hkdf kdf (b, sizeof b, AUTH_DIGEST ()); // use response ecdh b as salt
186 186 kdf.extract (&auth.rsa, sizeof (auth.rsa));
187 HMAC_CTX_init (&ctx); 187 kdf.extract_done ();
188 require (HMAC_Init_ex (&ctx, auth.rsa.auth_key, sizeof (auth.rsa.auth_key), AUTH_DIGEST (), 0)); 188 kdf.expand (mac, sizeof mac, auth.ecdh, sizeof (auth.ecdh)); // use challenge ecdh b as info
189 require (HMAC_Update (&ctx, (const unsigned char *)&auth, sizeof auth));
190 require (HMAC_Final (&ctx, (unsigned char *)&mac, 0));
191 HMAC_CTX_cleanup (&ctx);
192} 189}
193 190
194void 191void
195connection::generate_auth_data () 192connection::generate_auth_data ()
196{ 193{
197 if (auth_expire < ev_now ()) 194 if (auth_expire < ev_now ())
198 { 195 {
199 // request data 196 // request data
200 rand_fill (snd_auth.rsa); 197 rand_fill (snd_auth.rsa);
201 curve25519_generate (snd_ecdh_a, snd_auth.ecdh); 198 curve25519_generate (snd_ecdh_a, snd_auth.ecdh);
202 auth_hash (snd_auth, snd_auth_mac);
203 199
204 // eventual response data 200 // eventual response data
205 curve25519_generate (rcv_ecdh_a, rcv_ecdh_b); 201 curve25519_generate (rcv_ecdh_a, rcv_ecdh_b);
206 } 202 }
207 203
… …
363 } 359 }
364} 360}
365 361
366///////////////////////////////////////////////////////////////////////////// 362/////////////////////////////////////////////////////////////////////////////
367 363
368unsigned char hmac_packet::hmac_digest[EVP_MAX_MD_SIZE];
369
370void 364void
371hmac_packet::hmac_gen (crypto_ctx *ctx) 365hmac_packet::hmac_gen (crypto_ctx *ctx, u8 *hmac_digest)
372{ 366{
373 unsigned int xlen; 367 ctx->hctx.init ();
374 368 ctx->hctx.add (((unsigned char *) this) + sizeof (hmac_packet), len - sizeof (hmac_packet));
375 HMAC_CTX *hctx = &ctx->hctx; 369 ctx->hctx.digest (hmac_digest);
376
377 require (HMAC_Init_ex (hctx, 0, 0, 0, 0));
378 require (HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet),
379 len - sizeof (hmac_packet)));
380 require (HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen));
381} 370}
382 371
383void 372void
384hmac_packet::hmac_set (crypto_ctx *ctx) 373hmac_packet::hmac_set (crypto_ctx *ctx)
385{ 374{
386 hmac_gen (ctx); 375 unsigned char hmac_digest[EVP_MAX_MD_SIZE];
387 376 hmac_gen (ctx, hmac_digest);
388 memcpy (hmac, hmac_digest, HMACLENGTH); 377 memcpy (hmac, hmac_digest, HMACLENGTH);
389} 378}
390 379
391bool 380bool
392hmac_packet::hmac_chk (crypto_ctx *ctx) 381hmac_packet::hmac_chk (crypto_ctx *ctx)
393{ 382{
394 hmac_gen (ctx); 383 unsigned char hmac_digest[EVP_MAX_MD_SIZE];
395 384 hmac_gen (ctx, hmac_digest);
396 return !memcmp (hmac, hmac_digest, HMACLENGTH); 385 return slow_memeq (hmac, hmac_digest, HMACLENGTH);
397} 386}
398 387
399void 388void
400vpn_packet::set_hdr (ptype type_, unsigned int dst) 389vpn_packet::set_hdr (ptype type_, unsigned int dst)
401{ 390{
… …
407 srcdst = ((src >> 8) << 4) | (dst >> 8); 396 srcdst = ((src >> 8) << 4) | (dst >> 8);
408 dst1 = dst; 397 dst1 = dst;
409} 398}
410 399
411#define MAXVPNDATA (MAX_MTU - 6 - 6) 400#define MAXVPNDATA (MAX_MTU - 6 - 6)
412#define DATAHDR (sizeof (u32) + RAND_SIZE)
413 401
414struct vpndata_packet : vpn_packet 402struct vpndata_packet : vpn_packet
415{ 403{
416 u8 data[MAXVPNDATA + DATAHDR]; // seqno 404 u32 ctr; // seqno
405 u8 data[MAXVPNDATA];
417 406
418 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno); 407 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
419 tap_packet *unpack (connection *conn, u32 &seqno); 408 tap_packet *unpack (connection *conn, u32 &seqno);
420 409
421private: 410private:
422 const u32 data_hdr_size () const 411 const u32 data_hdr_size () const
423 { 412 {
424 return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR; 413 // the distance from beginning of packet to data member
414 return data - at (0);
425 } 415 }
426}; 416};
427 417
418// expands packet counter (unlike seqno, in network byte order) to counter mode IV
419static unsigned char *
420expand_iv (u32 ctr)
421{
422 static u32 iv[IV_SIZE (CIPHER) / 4];
423
424 require (sizeof (iv) == 4 * 4);
425 require (IV_SIZE (CIPHER) % 4 == 0);
426
427 iv[0] =
428 iv[1] =
429 iv[2] = ctr;
430
431 // I would reuse ctr here to to avoid potential endianness issues,
432 // but it seems openssl wraps around. While this would be still ok,
433 // and I don't even know if its true, let's play safe and initialise
434 // to 0.
435 iv[3] = 0;
436
437 return (unsigned char *)iv;
438}
439
428void 440void
429vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno) 441vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno)
430{ 442{
431 EVP_CIPHER_CTX *cctx = &conn->octx->cctx; 443 EVP_CIPHER_CTX *cctx = conn->octx->cctx;
432 int outl = 0, outl2; 444 int outl = 0, outl2;
433 ptype type = PT_DATA_UNCOMPRESSED; 445 ptype type = PT_DATA_UNCOMPRESSED;
434 446
435#if ENABLE_COMPRESSION 447#if ENABLE_COMPRESSION
436 u8 cdata[MAX_MTU]; 448 u8 cdata[MAX_MTU];
437 449
438 if (conn->features & FEATURE_COMPRESSION) 450 if (conn->features & FEATURE_COMPRESSION)
439 { 451 {
452 static LZF_STATE lzf_state;
440 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7); 453 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7, lzf_state);
441 454
442 if (cl) 455 if (cl)
443 { 456 {
444 type = PT_DATA_COMPRESSED; 457 type = PT_DATA_COMPRESSED;
445 d = cdata; 458 d = cdata;
… …
449 d[1] = cl; 462 d[1] = cl;
450 } 463 }
451 } 464 }
452#endif 465#endif
453 466
454 require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 1)); 467 ctr = htonl (seqno);
455 468
456 struct { 469 require (EVP_EncryptInit_ex (cctx, 0, 0, 0, expand_iv (ctr)));
457#if RAND_SIZE
458 u8 rnd[RAND_SIZE];
459#endif
460 u32 seqno;
461 } datahdr;
462
463 datahdr.seqno = ntohl (seqno);
464#if RAND_SIZE
465 // NB: a constant (per session) random prefix
466 // is likely enough, but we don't take any chances.
467 conn->oiv.get (datahdr.rnd, RAND_SIZE);
468#endif
469 470
470 require (EVP_EncryptUpdate (cctx, 471 require (EVP_EncryptUpdate (cctx,
471 (unsigned char *) data + outl, &outl2, 472 (unsigned char *)data + outl, &outl2,
472 (unsigned char *) &datahdr, DATAHDR)); 473 (unsigned char *)d, l));
473 outl += outl2; 474 outl += outl2;
474 475
475 require (EVP_EncryptUpdate (cctx, 476 // it seems this is a nop for us, but we do it anyways
476 (unsigned char *) data + outl, &outl2, 477 require (EVP_EncryptFinal_ex (cctx, (unsigned char *)data + outl, &outl2));
477 (unsigned char *) d, l));
478 outl += outl2; 478 outl += outl2;
479 479
480 require (EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2));
481 outl += outl2;
482
483 len = outl + data_hdr_size (); 480 len = data_hdr_size () + outl;
484 481
485 set_hdr (type, dst); 482 set_hdr (type, dst);
486 483
487 hmac_set (conn->octx); 484 hmac_set (conn->octx);
488} 485}
489 486
490tap_packet * 487tap_packet *
491vpndata_packet::unpack (connection *conn, u32 &seqno) 488vpndata_packet::unpack (connection *conn, u32 &seqno)
492{ 489{
493 EVP_CIPHER_CTX *cctx = &conn->ictx->cctx; 490 EVP_CIPHER_CTX *cctx = conn->ictx->cctx;
494 int outl = 0, outl2; 491 int outl = 0, outl2;
495 tap_packet *p = new tap_packet; 492 tap_packet *p = new tap_packet;
496 u8 *d; 493 u8 *d;
497 u32 l = len - data_hdr_size ();
498 494
499 require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 0)); 495 seqno = ntohl (ctr);
496
497 require (EVP_DecryptInit_ex (cctx, 0, 0, 0, expand_iv (ctr)));
500 498
501#if ENABLE_COMPRESSION 499#if ENABLE_COMPRESSION
502 u8 cdata[MAX_MTU]; 500 u8 cdata[MAX_MTU];
503 501
504 if (type == PT_DATA_COMPRESSED) 502 if (type == PT_DATA_COMPRESSED)
505 d = cdata; 503 d = cdata;
506 else 504 else
507#endif 505#endif
508 d = &(*p)[6 + 6] - DATAHDR; 506 d = &(*p)[6 + 6];
509
510 // we play do evil games with the struct layout atm.
511 // pending better solutions, we at least do some verification.
512 // this is fine, as we left ISO territory long ago.
513 require (DATAHDR <= 16);
514 require ((u8 *)(&p->len + 1) == &(*p)[0]);
515 507
516 // this can overwrite the len/dst/src fields 508 // this can overwrite the len/dst/src fields
517 require (EVP_DecryptUpdate (cctx, 509 require (EVP_DecryptUpdate (cctx,
518 d, &outl2, 510 d, &outl2,
519 (unsigned char *)&data, len - data_hdr_size ())); 511 (unsigned char *)&data, len - data_hdr_size ()));
520 outl += outl2; 512 outl += outl2;
521 513
514 // it seems this is a nop for us, but we do it anyways
522 require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2)); 515 require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2));
523 outl += outl2; 516 outl += outl2;
524 517
525 seqno = ntohl (*(u32 *)(d + RAND_SIZE));
526
527 id2mac (dst () ? dst() : THISNODE->id, p->dst); 518 id2mac (dst () ? dst() : THISNODE->id, p->dst);
528 id2mac (src (), p->src); 519 id2mac (src (), p->src);
529 520
530#if ENABLE_COMPRESSION 521#if ENABLE_COMPRESSION
531 if (type == PT_DATA_COMPRESSED) 522 if (type == PT_DATA_COMPRESSED)
532 { 523 {
533 u32 cl = (d[DATAHDR] << 8) | d[DATAHDR + 1]; 524 u32 cl = (d[0] << 8) | d[1];
534 525
535 p->len = lzf_decompress (d + DATAHDR + 2, cl < MAX_MTU ? cl : 0, 526 p->len = lzf_decompress (d + 2, cl < MAX_MTU - 2 ? cl : 0,
536 &(*p)[6 + 6], MAX_MTU) 527 &(*p)[6 + 6], MAX_MTU)
537 + 6 + 6; 528 + 6 + 6;
538 } 529 }
539 else 530 else
540 p->len = outl + (6 + 6 - DATAHDR); 531 p->len = outl + (6 + 6);
541#endif 532#endif
542 533
543 return p; 534 return p;
544} 535}
545 536
… …
552 } 543 }
553}; 544};
554 545
555struct config_packet : vpn_packet 546struct config_packet : vpn_packet
556{ 547{
548 u8 serial[SERIAL_SIZE];
557 u8 prot_major, prot_minor, randsize; 549 u8 prot_major, prot_minor, randsize;
558 u8 flags, features, pad6, pad7, pad8; 550 u8 flags, features, pad6, pad7, pad8;
559 u32 cipher_nid, mac_nid, auth_nid; 551 u32 cipher_nid, mac_nid, auth_nid;
560 552
561 void setup (ptype type, int dst); 553 void setup (ptype type, int dst);
562 bool chk_config () const; 554 bool chk_config (const conf_node *conf, const sockinfo &rsi) const;
563 555
564 static u8 get_features () 556 static u8 get_features ()
565 { 557 {
566 u8 f = 0; 558 u8 f = 0;
567#if ENABLE_COMPRESSION 559#if ENABLE_COMPRESSION
… …
580void 572void
581config_packet::setup (ptype type, int dst) 573config_packet::setup (ptype type, int dst)
582{ 574{
583 prot_major = PROTOCOL_MAJOR; 575 prot_major = PROTOCOL_MAJOR;
584 prot_minor = PROTOCOL_MINOR; 576 prot_minor = PROTOCOL_MINOR;
585 randsize = RAND_SIZE;
586 flags = 0; 577 flags = 0;
587 features = get_features (); 578 features = get_features ();
579
580 strncpy ((char *)serial, conf.serial, sizeof (serial));
588 581
589 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ())); 582 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ()));
590 mac_nid = htonl (EVP_MD_type (MAC_DIGEST ())); 583 mac_nid = htonl (EVP_MD_type (MAC_DIGEST ()));
591 auth_nid = htonl (EVP_MD_type (AUTH_DIGEST ())); 584 auth_nid = htonl (EVP_MD_type (AUTH_DIGEST ()));
592 585
593 len = sizeof (*this) - sizeof (net_packet); 586 len = sizeof (*this) - sizeof (net_packet);
594 set_hdr (type, dst); 587 set_hdr (type, dst);
595} 588}
596 589
597bool 590bool
598config_packet::chk_config () const 591config_packet::chk_config (const conf_node *conf, const sockinfo &rsi) const
599{ 592{
600 if (prot_major != PROTOCOL_MAJOR) 593 if (prot_major != PROTOCOL_MAJOR)
601 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR); 594 slog (L_WARN, _("%s(%s): major version mismatch (remote %d <=> local %d)"),
602 else if (randsize != RAND_SIZE) 595 conf->nodename, (const char *)rsi, prot_major, PROTOCOL_MAJOR);
603 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
604 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ()))) 596 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ())))
605 slog (L_WARN, _("cipher algo mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ())); 597 slog (L_WARN, _("%s(%s): cipher algo mismatch (remote %x <=> local %x)"),
598 conf->nodename, (const char *)rsi, ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));
606 else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ()))) 599 else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ())))
607 slog (L_WARN, _("mac algo mismatch (remote %x <=> local %x)"), ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ())); 600 slog (L_WARN, _("%s(%s): mac algo mismatch (remote %x <=> local %x)"),
601 conf->nodename, (const char *)rsi, ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ()));
608 else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ()))) 602 else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ())))
609 slog (L_WARN, _("auth algo mismatch (remote %x <=> local %x)"), ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ())); 603 slog (L_WARN, _("%s(%s): auth algo mismatch (remote %x <=> local %x)"),
604 conf->nodename, (const char *)rsi, ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ()));
610 else 605 else
606 {
607 int cmp = memcmp (serial, ::conf.serial, sizeof (serial));
608
609 if (cmp > 0)
610 slog (L_WARN, _("%s(%s): remote serial newer than local serial - outdated config?"),
611 conf->nodename, (const char *)rsi);
612 else if (cmp == 0)
611 return true; 613 return true;
614 }
612 615
613 return false; 616 return false;
614} 617}
615 618
616struct auth_req_packet : config_packet // UNPROTECTED 619struct auth_req_packet : config_packet // UNPROTECTED
… …
630 633
631 len = sizeof (*this) - sizeof (net_packet); 634 len = sizeof (*this) - sizeof (net_packet);
632 } 635 }
633}; 636};
634 637
635struct auth_res_packet : config_packet // UNPROTECTED 638struct auth_res_packet : vpn_packet // UNPROTECTED
636{ 639{
637 auth_response response; 640 auth_response response;
638 641
639 auth_res_packet (int dst) 642 auth_res_packet (int dst)
640 { 643 {
641 config_packet::setup (PT_AUTH_RES, dst); 644 set_hdr (PT_AUTH_RES, dst);
642 645
643 len = sizeof (*this) - sizeof (net_packet); 646 len = sizeof (*this) - sizeof (net_packet);
644 } 647 }
645}; 648};
646 649
… …
686 si = rsi; 689 si = rsi;
687 protocol = rsi.prot; 690 protocol = rsi.prot;
688 691
689 slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."), 692 slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
690 conf->nodename, (const char *)rsi, 693 conf->nodename, (const char *)rsi,
691 is_direct ? "direct" : "forwarded", 694 vpn->can_direct (THISNODE, conf) ? "direct" : "forwarded",
692 PROTOCOL_MAJOR, prot_minor); 695 PROTOCOL_MAJOR, prot_minor);
693 696
694 if (::conf.script_node_up) 697 if (::conf.script_node_up)
695 { 698 {
696 run_script_cb *cb = new run_script_cb; 699 run_script_cb *cb = new run_script_cb;
… …
702 iseqno.reset (ntohl (rcv_auth.rsa.seqno) & 0x7fffffff); 705 iseqno.reset (ntohl (rcv_auth.rsa.seqno) & 0x7fffffff);
703 706
704 delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b , 1); 707 delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b , 1);
705 oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff; 708 oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff;
706 709
707 oiv.reset ();
708
709 // make sure rekeying timeouts are slightly asymmetric 710 // make sure rekeying timeouts are slightly asymmetric
710 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0); 711 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
711 rekey.start (rekey_interval, rekey_interval); 712 rekey.start (rekey_interval, rekey_interval);
712 713
714 hmac_error = 0.;
715
713 keepalive.start (::conf.keepalive); 716 keepalive.start (::conf.keepalive);
714 717
715 // send queued packets 718 // send queued packets
716 if (ictx && octx)
717 {
718 while (tap_packet *p = (tap_packet *)data_queue.get ()) 719 while (tap_packet *p = (tap_packet *)data_queue.get ())
719 { 720 {
720 if (p->len) send_data_packet (p); 721 if (p->len) send_data_packet (p);
721 delete p; 722 delete p;
722 } 723 }
723 724
724 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ()) 725 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
725 { 726 {
726 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY); 727 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
727 delete p; 728 delete p;
728 }
729 } 729 }
730 730
731 vpn->connection_established (this); 731 vpn->connection_established (this);
732} 732}
733 733
… …
741 slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename); 741 slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
742 protocol = 0; 742 protocol = 0;
743 } 743 }
744 744
745 si.set (conf, protocol); 745 si.set (conf, protocol);
746
747 is_direct = si.valid ();
748} 746}
749 747
750// ensure sockinfo is valid, forward if necessary 748// ensure sockinfo is valid, forward if necessary
751const sockinfo & 749const sockinfo &
752connection::forward_si (const sockinfo &si) const 750connection::forward_si (const sockinfo &si) const
… …
771 769
772void 770void
773connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 771connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
774{ 772{
775 if (!vpn->send_vpn_packet (pkt, si, tos)) 773 if (!vpn->send_vpn_packet (pkt, si, tos))
776 reset_connection (); 774 reset_connection ("packet send error");
777} 775}
778 776
779void 777void
780connection::send_ping (const sockinfo &si, u8 pong) 778connection::send_ping (const sockinfo &si, u8 pong)
781{ 779{
… …
820void 818void
821connection::send_auth_response (const sockinfo &si) 819connection::send_auth_response (const sockinfo &si)
822{ 820{
823 auth_res_packet *pkt = new auth_res_packet (conf->id); 821 auth_res_packet *pkt = new auth_res_packet (conf->id);
824 822
825 auth_hash (rcv_auth, pkt->response.mac);
826 memcpy (pkt->response.ecdh, rcv_ecdh_b, sizeof (rcv_ecdh_b)); 823 memcpy (pkt->response.ecdh, rcv_ecdh_b, sizeof rcv_ecdh_b);
824 auth_hash (rcv_auth, rcv_ecdh_b, pkt->response.mac);
827 825
828 slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si); 826 slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
829 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 827 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
830 828
831 delete pkt; 829 delete pkt;
… …
857 { 855 {
858 // a bit hacky, if ondemand, and packets are no longer queued, then reset the connection 856 // a bit hacky, if ondemand, and packets are no longer queued, then reset the connection
859 // and stop trying. should probably be handled by a per-connection expire handler. 857 // and stop trying. should probably be handled by a per-connection expire handler.
860 if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ()) 858 if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())
861 { 859 {
862 reset_connection (); 860 reset_connection ("no demand");
863 return; 861 return;
864 } 862 }
865 863
866 last_establish_attempt = ev_now (); 864 last_establish_attempt = ev_now ();
867 865
… …
869 ? (retry_cnt & 3) + 1 867 ? (retry_cnt & 3) + 1
870 : 1 << (retry_cnt >> 2)); 868 : 1 << (retry_cnt >> 2));
871 869
872 reset_si (); 870 reset_si ();
873 871
874 bool slow = si.prot & PROT_SLOW; 872 bool slow = (si.prot & PROT_SLOW) || (conf->low_power || THISNODE->low_power);
875 873
876 if (si.prot && !si.host && vpn->can_direct (THISNODE, conf)) 874 if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
877 { 875 {
878 /*TODO*/ /* start the timer so we don't recurse endlessly */ 876 /*TODO*/ /* start the timer so we don't recurse endlessly */
879 w.start (1); 877 w.start (1);
… …
889 887
890 slow = slow || (dsi.prot & PROT_SLOW); 888 slow = slow || (dsi.prot & PROT_SLOW);
891 889
892 if (dsi.valid () && auth_rate_limiter.can (dsi)) 890 if (dsi.valid () && auth_rate_limiter.can (dsi))
893 { 891 {
894 if (retry_cnt < 4) 892 // use ping after the first few retries
893 // TODO: on rekeys, the other node might not interpret ping correctly,
894 // TODO: as it will still have a valid connection
895 if (retry_cnt < 4 && (!conf->low_power || THISNODE->low_power))
895 send_auth_request (dsi, true); 896 send_auth_request (dsi, true);
896 else 897 else
897 send_ping (dsi, 0); 898 send_ping (dsi, 0);
898 } 899 }
899 } 900 }
900 901
901 retry_int *= slow ? 8. : 0.9; 902 retry_int *= slow ? 4. : 0.9;
902 903
903 if (retry_int < conf->max_retry) 904 if (retry_int < conf->max_retry)
904 retry_cnt++; 905 retry_cnt++;
905 else 906 else
906 retry_int = conf->max_retry; 907 retry_int = conf->max_retry;
… …
908 w.start (retry_int); 909 w.start (retry_int);
909 } 910 }
910} 911}
911 912
912void 913void
913connection::reset_connection () 914connection::reset_connection (const char *reason)
914{ 915{
915 if (ictx && octx) 916 if (ictx && octx)
916 { 917 {
917 slog (L_INFO, _("%s(%s): connection lost"), 918 slog (L_INFO, _("%s(%s): connection lost (%s)"),
918 conf->nodename, (const char *)si); 919 conf->nodename, (const char *)si, reason);
919 920
920 if (::conf.script_node_down) 921 if (::conf.script_node_down)
921 { 922 {
922 run_script_cb *cb = new run_script_cb; 923 run_script_cb *cb = new run_script_cb;
923 cb->set<connection, &connection::script_node_down> (this); 924 cb->set<connection, &connection::script_node_down> (this);
… …
947connection::shutdown () 948connection::shutdown ()
948{ 949{
949 if (ictx && octx) 950 if (ictx && octx)
950 send_reset (si); 951 send_reset (si);
951 952
952 reset_connection (); 953 reset_connection ("shutdown");
953} 954}
954 955
955// poor-man's rekeying 956// poor-man's rekeying
956inline void 957inline void
957connection::rekey_cb (ev::timer &w, int revents) 958connection::rekey_cb (ev::timer &w, int revents)
958{ 959{
959 reset_connection (); 960 reset_connection ("rekeying");
960 establish_connection (); 961 establish_connection ();
961} 962}
962 963
963void 964void
964connection::send_data_packet (tap_packet *pkt) 965connection::send_data_packet (tap_packet *pkt)
… …
981 982
982void 983void
983connection::post_inject_queue () 984connection::post_inject_queue ()
984{ 985{
985 // force a connection every now and when when packets are sent (max 1/s) 986 // force a connection every now and when when packets are sent (max 1/s)
986 if (ev_now () - last_establish_attempt >= 0.95) // arbitrary 987 if (ev_now () - last_establish_attempt >= (conf->low_power || THISNODE->low_power ? 2.95 : 0.95)) // arbitrary
987 establish_connection.stop (); 988 establish_connection.stop ();
988 989
989 establish_connection (); 990 establish_connection ();
990} 991}
991 992
… …
1051 // about our desire for communication. 1052 // about our desire for communication.
1052 establish_connection (); 1053 establish_connection ();
1053 break; 1054 break;
1054 1055
1055 case vpn_packet::PT_RESET: 1056 case vpn_packet::PT_RESET:
1057 slog (L_TRACE, "%s >> PT_RESET", conf->nodename);
1058
1059 if (ictx && octx)
1056 { 1060 {
1057 reset_connection (); 1061 reset_connection ("remote reset");
1058 1062
1059 config_packet *p = (config_packet *) pkt; 1063 config_packet *p = (config_packet *) pkt;
1060 1064
1061 if (!p->chk_config ()) 1065 if (p->chk_config (conf, rsi) && connectmode == conf_node::C_ALWAYS)
1062 {
1063 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
1064 conf->nodename, (const char *)rsi);
1065 connectmode = conf_node::C_DISABLED;
1066 }
1067 else if (connectmode == conf_node::C_ALWAYS)
1068 establish_connection (); 1066 establish_connection ();
1069 } 1067 }
1068
1070 break; 1069 break;
1071 1070
1072 case vpn_packet::PT_AUTH_REQ: 1071 case vpn_packet::PT_AUTH_REQ:
1073 if (auth_rate_limiter.can (rsi)) 1072 if (auth_rate_limiter.can (rsi))
1074 { 1073 {
… …
1076 1075
1077 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)", 1076 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)",
1078 conf->nodename, p->initiate ? "initiate" : "reply", 1077 conf->nodename, p->initiate ? "initiate" : "reply",
1079 p->protocols, p->features); 1078 p->protocols, p->features);
1080 1079
1081 if (p->chk_config () && !memcmp (p->magic, MAGIC, 8)) 1080 if (memcmp (p->magic, MAGIC, 8))
1081 {
1082 slog (L_WARN, _("%s(%s): protocol magic mismatch - stray packet?"),
1083 conf->nodename, (const char *)rsi);
1084 }
1085 else if (p->chk_config (conf, rsi))
1082 { 1086 {
1083 if (p->prot_minor != PROTOCOL_MINOR) 1087 if (p->prot_minor != PROTOCOL_MINOR)
1084 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1088 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1085 conf->nodename, (const char *)rsi, 1089 conf->nodename, (const char *)rsi,
1086 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 1090 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
1087 1091
1088 if (p->initiate) 1092 if (p->initiate)
1093 {
1089 send_auth_request (rsi, false); 1094 send_auth_request (rsi, false);
1095
1096 if (ictx && octx)
1097 reset_connection ("reconnect");
1098 }
1090 1099
1091 auth_data auth; 1100 auth_data auth;
1092 1101
1093 if (!auth_decrypt (::conf.rsa_key, p->encr, auth)) 1102 if (!auth_decrypt (::conf.rsa_key, p->encr, auth))
1094 { 1103 {
1095 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"), 1104 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
1096 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0)); 1105 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
1097 } 1106 }
1098 else 1107 else
1099 { 1108 {
1100 bool chg = !have_rcv_auth || memcmp (&rcv_auth, &auth, sizeof auth); 1109 bool chg = !have_rcv_auth || !slow_memeq (&rcv_auth, &auth, sizeof auth);
1101 1110
1102 rcv_auth = auth; 1111 rcv_auth = auth;
1103 have_rcv_auth = true; 1112 have_rcv_auth = true;
1104 1113
1105 send_auth_response (rsi); 1114 send_auth_response (rsi);
… …
1113 } 1122 }
1114 } 1123 }
1115 1124
1116 break; 1125 break;
1117 } 1126 }
1118 else
1119 slog (L_WARN, _("%s(%s): protocol mismatch."),
1120 conf->nodename, (const char *)rsi);
1121 1127
1122 send_reset (rsi); 1128 send_reset (rsi);
1123 } 1129 }
1124 1130
1125 break; 1131 break;
… …
1128 { 1134 {
1129 auth_res_packet *p = (auth_res_packet *)pkt; 1135 auth_res_packet *p = (auth_res_packet *)pkt;
1130 1136
1131 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename); 1137 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
1132 1138
1133 if (p->chk_config ()) 1139 auth_mac local_mac;
1140 auth_hash (snd_auth, p->response.ecdh, local_mac);
1141
1142 if (!slow_memeq (&p->response.mac, local_mac, sizeof local_mac))
1134 { 1143 {
1135 if (memcmp (&p->response.mac, snd_auth_mac, sizeof (snd_auth_mac)))
1136 {
1137 slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."), 1144 slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),
1138 conf->nodename, (const char *)rsi); 1145 conf->nodename, (const char *)rsi);
1139 } 1146 }
1140 else if (!have_snd_auth) 1147 else if (!have_snd_auth)
1141 { 1148 {
1142 if (p->prot_minor != PROTOCOL_MINOR)
1143 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1144 conf->nodename, (const char *)rsi,
1145 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
1146
1147 prot_minor = p->prot_minor;
1148 memcpy (snd_ecdh_b, p->response.ecdh, sizeof (snd_ecdh_b)); 1149 memcpy (snd_ecdh_b, p->response.ecdh, sizeof snd_ecdh_b);
1149 1150
1150 have_snd_auth = true; 1151 have_snd_auth = true;
1151 connection_established (rsi); 1152 connection_established (rsi);
1152 }
1153
1154 break;
1155 } 1153 }
1156 } 1154 }
1157
1158 send_reset (rsi);
1159 break; 1155 break;
1160 1156
1161 case vpn_packet::PT_DATA_COMPRESSED: 1157 case vpn_packet::PT_DATA_COMPRESSED:
1162#if !ENABLE_COMPRESSION 1158#if !ENABLE_COMPRESSION
1163 send_reset (rsi); 1159 send_reset (rsi);
… …
1169 if (ictx && octx) 1165 if (ictx && octx)
1170 { 1166 {
1171 vpndata_packet *p = (vpndata_packet *)pkt; 1167 vpndata_packet *p = (vpndata_packet *)pkt;
1172 1168
1173 if (!p->hmac_chk (ictx)) 1169 if (!p->hmac_chk (ictx))
1170 {
1171 // rekeying often creates temporary hmac auth floods
1172 // we assume they don't take longer than a few seconds normally,
1173 // and suppress messages and resets during that time.
1174 //TODO: should be done per source address
1175 if (!hmac_error)
1176 {
1177 hmac_error = ev_now () + 3;
1178 break;
1179 }
1180 else if (hmac_error >= ev_now ())
1181 break; // silently suppress
1182 else
1183 {
1174 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1184 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1175 "could be an attack, or just corruption or a synchronization error."), 1185 "could be an attack, or just corruption or a synchronization error."),
1176 conf->nodename, (const char *)rsi); 1186 conf->nodename, (const char *)rsi);
1187 // reset
1188 }
1189 }
1177 else 1190 else
1178 { 1191 {
1179 u32 seqno; 1192 u32 seqno;
1180 tap_packet *d = p->unpack (this, seqno); 1193 tap_packet *d = p->unpack (this, seqno);
1181 int seqclass = iseqno.seqno_classify (seqno); 1194 int seqclass = iseqno.seqno_classify (seqno);
1195
1196 hmac_error = 0;
1182 1197
1183 if (seqclass == 0) // ok 1198 if (seqclass == 0) // ok
1184 { 1199 {
1185 vpn->tap->send (d); 1200 vpn->tap->send (d);
1186 1201
… …
1313 1328
1314 if (when >= 0) 1329 if (when >= 0)
1315 w.start (when); 1330 w.start (when);
1316 else if (when < -15) 1331 else if (when < -15)
1317 { 1332 {
1318 reset_connection (); 1333 reset_connection ("keepalive overdue");
1319 establish_connection (); 1334 establish_connection ();
1320 } 1335 }
1321 else if (conf->connectmode != conf_node::C_ONDEMAND 1336 else if (conf->connectmode != conf_node::C_ONDEMAND
1322 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1337 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1323 { 1338 {
… …
1327 else if (when >= -10) 1342 else if (when >= -10)
1328 // hold ondemand connections implicitly a few seconds longer 1343 // hold ondemand connections implicitly a few seconds longer
1329 // should delete octx, though, or something like that ;) 1344 // should delete octx, though, or something like that ;)
1330 w.start (when + 10); 1345 w.start (when + 10);
1331 else 1346 else
1332 reset_connection (); 1347 reset_connection ("keepalive timeout");
1333} 1348}
1334 1349
1335void 1350void
1336connection::send_connect_request (int id) 1351connection::send_connect_request (int id)
1337{ 1352{
… …
1437 1452
1438 // queue a dummy packet to force an initial connection attempt 1453 // queue a dummy packet to force an initial connection attempt
1439 if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED) 1454 if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
1440 vpn_queue.put (new net_packet); 1455 vpn_queue.put (new net_packet);
1441 1456
1442 reset_connection (); 1457 reset_connection ("startup");
1443} 1458}
1444 1459
1445connection::~connection () 1460connection::~connection ()
1446{ 1461{
1447 shutdown (); 1462 shutdown ();

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines