ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.13 by pcg, Fri Aug 8 07:52:26 2003 UTC vs.
Revision 1.21 by pcg, Thu Oct 16 02:28:36 2003 UTC

… …
35#include "slog.h" 35#include "slog.h"
36#include "device.h" 36#include "device.h"
37#include "vpn.h" 37#include "vpn.h"
38#include "connection.h" 38#include "connection.h"
39 39
40#include "netcompat.h"
41
40#if !HAVE_RAND_PSEUDO_BYTES 42#if !HAVE_RAND_PSEUDO_BYTES
41# define RAND_pseudo_bytes RAND_bytes 43# define RAND_pseudo_bytes RAND_bytes
42#endif 44#endif
43 45
44#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 46#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
… …
197// only do action once every x seconds per host whole allowing bursts. 199// only do action once every x seconds per host whole allowing bursts.
198// this implementation ("splay list" ;) is inefficient, 200// this implementation ("splay list" ;) is inefficient,
199// but low on resources. 201// but low on resources.
200struct net_rate_limiter : list<net_rateinfo> 202struct net_rate_limiter : list<net_rateinfo>
201{ 203{
202 static const double ALPHA = 1. - 1. / 180.; // allow bursts 204 static const double ALPHA = 1. - 1. / 600.; // allow bursts
203 static const double CUTOFF = 10.; // one event every CUTOFF seconds 205 static const double CUTOFF = 10.; // one event every CUTOFF seconds
204 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 206 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
205 static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value 207 static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value
206 208
207 bool can (const sockinfo &si) { return can((u32)si.host); } 209 bool can (const sockinfo &si) { return can((u32)si.host); }
208 bool can (u32 host); 210 bool can (u32 host);
209}; 211};
210 212
211net_rate_limiter auth_rate_limiter, reset_rate_limiter; 213net_rate_limiter auth_rate_limiter, reset_rate_limiter;
212 214
… …
475 set_hdr (type, dst); 477 set_hdr (type, dst);
476} 478}
477 479
478bool config_packet::chk_config () const 480bool config_packet::chk_config () const
479{ 481{
480 return prot_major == PROTOCOL_MAJOR 482 if (prot_major != PROTOCOL_MAJOR)
481 && randsize == RAND_SIZE 483 slog (L_WARN, _("major version mismatch (%d <=> %d)"), prot_major, PROTOCOL_MAJOR);
482 && hmaclen == HMACLENGTH 484 else if (randsize != RAND_SIZE)
483 && flags == curflags () 485 slog (L_WARN, _("rand size mismatch (%d <=> %d)"), randsize, RAND_SIZE);
486 else if (hmaclen != HMACLENGTH)
487 slog (L_WARN, _("hmac length mismatch (%d <=> %d)"), hmaclen, HMACLENGTH);
488 else if (flags != curflags ())
489 slog (L_WARN, _("flag mismatch (%x <=> %x)"), flags, curflags ());
484 && challengelen == sizeof (rsachallenge) 490 else if (challengelen != sizeof (rsachallenge))
491 slog (L_WARN, _("challenge length mismatch (%d <=> %d)"), challengelen, sizeof (rsachallenge));
485 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER)) 492 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
493 slog (L_WARN, _("cipher mismatch (%x <=> %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
486 && digest_nid == htonl (EVP_MD_type (RSA_HASH)) 494 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
495 slog (L_WARN, _("digest mismatch (%x <=> %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
487 && hmac_nid == htonl (EVP_MD_type (DIGEST)); 496 else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
497 slog (L_WARN, _("hmac mismatch (%x <=> %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
498 else
499 return true;
500
501 return false;
488} 502}
489 503
490struct auth_req_packet : config_packet 504struct auth_req_packet : config_packet
491{ 505{
492 char magic[8]; 506 char magic[8];
… …
786 reset_connection (); 800 reset_connection ();
787 establish_connection (); 801 establish_connection ();
788} 802}
789 803
790void 804void
791connection::send_data_packet (tap_packet *pkt, bool broadcast) 805connection::send_data_packet (tap_packet *pkt)
792{ 806{
793 vpndata_packet *p = new vpndata_packet; 807 vpndata_packet *p = new vpndata_packet;
794 int tos = 0; 808 int tos = 0;
795 809
796 // I am not hilarious about peeking into packets, but so be it. 810 // I am not hilarious about peeking into packets, but so be it.
797 if (conf->inherit_tos 811 if (conf->inherit_tos && pkt->is_ipv4 ())
798 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
799 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
800 tos = (*pkt)[15] & IPTOS_TOS_MASK; 812 tos = (*pkt)[15] & IPTOS_TOS_MASK;
801 813
802 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 814 p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
803 send_vpn_packet (p, si, tos); 815 send_vpn_packet (p, si, tos);
804 816
805 delete p; 817 delete p;
806 818
807 if (oseqno > MAX_SEQNO) 819 if (oseqno > MAX_SEQNO)
808 rekey (); 820 rekey ();
809} 821}
810 822
811void 823void
812connection::inject_data_packet (tap_packet *pkt, bool broadcast) 824connection::inject_data_packet (tap_packet *pkt, bool broadcast/*TODO DDD*/)
813{ 825{
814 if (ictx && octx) 826 if (ictx && octx)
815 send_data_packet (pkt, broadcast); 827 send_data_packet (pkt);
816 else 828 else
817 { 829 {
818 if (!broadcast)//DDDD 830 if (!broadcast)//DDDD
819 data_queue.put (new tap_packet (*pkt)); 831 data_queue.put (new tap_packet (*pkt));
820 832
… …
898 rsachallenge k; 910 rsachallenge k;
899 911
900 if (0 > RSA_private_decrypt (sizeof (p->encr), 912 if (0 > RSA_private_decrypt (sizeof (p->encr),
901 (unsigned char *)&p->encr, (unsigned char *)&k, 913 (unsigned char *)&p->encr, (unsigned char *)&k,
902 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING)) 914 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
903 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 915 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
904 conf->nodename, (const char *)rsi); 916 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
905 else 917 else
906 { 918 {
907 delete octx; 919 delete octx;
908 920
909 octx = new crypto_ctx (k, 1); 921 octx = new crypto_ctx (k, 1);
… …
916 connection_established (); 928 connection_established ();
917 929
918 break; 930 break;
919 } 931 }
920 } 932 }
933 else
934 slog (L_WARN, _("%s(%s): protocol mismatch"),
935 conf->nodename, (const char *)rsi);
921 936
922 send_reset (rsi); 937 send_reset (rsi);
923 } 938 }
924 939
925 break; 940 break;
… …
939 954
940 rsachallenge chg; 955 rsachallenge chg;
941 956
942 if (!rsa_cache.find (p->id, chg)) 957 if (!rsa_cache.find (p->id, chg))
943 { 958 {
944 slog (L_ERR, _("%s(%s): unrequested auth response"), 959 slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
945 conf->nodename, (const char *)rsi); 960 conf->nodename, (const char *)rsi);
946 break; 961 break;
947 } 962 }
948 else 963 else
949 { 964 {
950 crypto_ctx *cctx = new crypto_ctx (chg, 0); 965 crypto_ctx *cctx = new crypto_ctx (chg, 0);
951 966
952 if (!p->hmac_chk (cctx)) 967 if (!p->hmac_chk (cctx))
968 {
953 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 969 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
954 "could be an attack, or just corruption or an synchronization error"), 970 "could be an attack, or just corruption or an synchronization error"),
955 conf->nodename, (const char *)rsi); 971 conf->nodename, (const char *)rsi);
972 break;
973 }
956 else 974 else
957 { 975 {
958 rsaresponse h; 976 rsaresponse h;
959 977
960 rsa_hash (p->id, chg, h); 978 rsa_hash (p->id, chg, h);
… …
1017 1035
1018 if (iseqno.recv_ok (seqno)) 1036 if (iseqno.recv_ok (seqno))
1019 { 1037 {
1020 vpn->tap->send (d); 1038 vpn->tap->send (d);
1021 1039
1022 if (p->dst () == 0) // re-broadcast
1023 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
1024 {
1025 connection *c = *i;
1026
1027 if (c->conf != THISNODE && c->conf != conf)
1028 c->inject_data_packet (d);
1029 }
1030
1031 if (si != rsi) 1040 if (si != rsi)
1032 { 1041 {
1033 // fast re-sync on conneciton changes, useful especially for tcp/ip 1042 // fast re-sync on connection changes, useful especially for tcp/ip
1034 si = rsi; 1043 si = rsi;
1035 1044
1036 slog (L_INFO, _("%s(%s): socket address changed to %s"), 1045 slog (L_INFO, _("%s(%s): socket address changed to %s"),
1037 conf->nodename, (const char *)si, (const char *)rsi); 1046 conf->nodename, (const char *)si, (const char *)rsi);
1038 } 1047 }

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines