ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.16 by pcg, Mon Sep 1 15:52:03 2003 UTC vs.
Revision 1.21 by pcg, Thu Oct 16 02:28:36 2003 UTC

… …
34#include "conf.h" 34#include "conf.h"
35#include "slog.h" 35#include "slog.h"
36#include "device.h" 36#include "device.h"
37#include "vpn.h" 37#include "vpn.h"
38#include "connection.h" 38#include "connection.h"
39
40#include "netcompat.h"
39 41
40#if !HAVE_RAND_PSEUDO_BYTES 42#if !HAVE_RAND_PSEUDO_BYTES
41# define RAND_pseudo_bytes RAND_bytes 43# define RAND_pseudo_bytes RAND_bytes
42#endif 44#endif
43 45
… …
798 reset_connection (); 800 reset_connection ();
799 establish_connection (); 801 establish_connection ();
800} 802}
801 803
802void 804void
803connection::send_data_packet (tap_packet *pkt, bool broadcast) 805connection::send_data_packet (tap_packet *pkt)
804{ 806{
805 vpndata_packet *p = new vpndata_packet; 807 vpndata_packet *p = new vpndata_packet;
806 int tos = 0; 808 int tos = 0;
807 809
808 // I am not hilarious about peeking into packets, but so be it. 810 // I am not hilarious about peeking into packets, but so be it.
809 if (conf->inherit_tos 811 if (conf->inherit_tos && pkt->is_ipv4 ())
810 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
811 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
812 tos = (*pkt)[15] & IPTOS_TOS_MASK; 812 tos = (*pkt)[15] & IPTOS_TOS_MASK;
813 813
814 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 814 p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
815 send_vpn_packet (p, si, tos); 815 send_vpn_packet (p, si, tos);
816 816
817 delete p; 817 delete p;
818 818
819 if (oseqno > MAX_SEQNO) 819 if (oseqno > MAX_SEQNO)
820 rekey (); 820 rekey ();
821} 821}
822 822
823void 823void
824connection::inject_data_packet (tap_packet *pkt, bool broadcast) 824connection::inject_data_packet (tap_packet *pkt, bool broadcast/*TODO DDD*/)
825{ 825{
826 if (ictx && octx) 826 if (ictx && octx)
827 send_data_packet (pkt, broadcast); 827 send_data_packet (pkt);
828 else 828 else
829 { 829 {
830 if (!broadcast)//DDDD 830 if (!broadcast)//DDDD
831 data_queue.put (new tap_packet (*pkt)); 831 data_queue.put (new tap_packet (*pkt));
832 832
… …
910 rsachallenge k; 910 rsachallenge k;
911 911
912 if (0 > RSA_private_decrypt (sizeof (p->encr), 912 if (0 > RSA_private_decrypt (sizeof (p->encr),
913 (unsigned char *)&p->encr, (unsigned char *)&k, 913 (unsigned char *)&p->encr, (unsigned char *)&k,
914 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING)) 914 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
915 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 915 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
916 conf->nodename, (const char *)rsi); 916 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
917 else 917 else
918 { 918 {
919 delete octx; 919 delete octx;
920 920
921 octx = new crypto_ctx (k, 1); 921 octx = new crypto_ctx (k, 1);
… …
954 954
955 rsachallenge chg; 955 rsachallenge chg;
956 956
957 if (!rsa_cache.find (p->id, chg)) 957 if (!rsa_cache.find (p->id, chg))
958 { 958 {
959 slog (L_ERR, _("%s(%s): unrequested auth response"), 959 slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
960 conf->nodename, (const char *)rsi); 960 conf->nodename, (const char *)rsi);
961 break; 961 break;
962 } 962 }
963 else 963 else
964 { 964 {
965 crypto_ctx *cctx = new crypto_ctx (chg, 0); 965 crypto_ctx *cctx = new crypto_ctx (chg, 0);
966 966
967 if (!p->hmac_chk (cctx)) 967 if (!p->hmac_chk (cctx))
968 {
968 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 969 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
969 "could be an attack, or just corruption or an synchronization error"), 970 "could be an attack, or just corruption or an synchronization error"),
970 conf->nodename, (const char *)rsi); 971 conf->nodename, (const char *)rsi);
972 break;
973 }
971 else 974 else
972 { 975 {
973 rsaresponse h; 976 rsaresponse h;
974 977
975 rsa_hash (p->id, chg, h); 978 rsa_hash (p->id, chg, h);
… …
1031 tap_packet *d = p->unpack (this, seqno); 1034 tap_packet *d = p->unpack (this, seqno);
1032 1035
1033 if (iseqno.recv_ok (seqno)) 1036 if (iseqno.recv_ok (seqno))
1034 { 1037 {
1035 vpn->tap->send (d); 1038 vpn->tap->send (d);
1036
1037 if (p->dst () == 0) // re-broadcast
1038 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
1039 {
1040 connection *c = *i;
1041
1042 if (c->conf != THISNODE && c->conf != conf)
1043 c->inject_data_packet (d);
1044 }
1045 1039
1046 if (si != rsi) 1040 if (si != rsi)
1047 { 1041 {
1048 // fast re-sync on connection changes, useful especially for tcp/ip 1042 // fast re-sync on connection changes, useful especially for tcp/ip
1049 si = rsi; 1043 si = rsi;

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines