ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.19 by pcg, Tue Oct 14 03:22:09 2003 UTC vs.
Revision 1.25 by pcg, Sat Jan 17 01:18:36 2004 UTC

1/* 1/*
2 connection.C -- manage a single connection 2 connection.C -- manage a single connection
3 Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>
3 4
4 This program is free software; you can redistribute it and/or modify 5 This program is free software; you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by 6 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation; either version 2 of the License, or 7 the Free Software Foundation; either version 2 of the License, or
7 (at your option) any later version. 8 (at your option) any later version.
… …
20 21
21extern "C" { 22extern "C" {
22# include "lzf/lzf.h" 23# include "lzf/lzf.h"
23} 24}
24 25
26#include <cassert>
27
25#include <list> 28#include <list>
26 29
27#include <openssl/rand.h> 30#include <openssl/rand.h>
28#include <openssl/evp.h> 31#include <openssl/evp.h>
29#include <openssl/rsa.h> 32#include <openssl/rsa.h>
… …
35#include "slog.h" 38#include "slog.h"
36#include "device.h" 39#include "device.h"
37#include "vpn.h" 40#include "vpn.h"
38#include "connection.h" 41#include "connection.h"
39 42
40#include <sys/socket.h> 43#include "netcompat.h"
41#ifdef HAVE_NETINET_IN_H
42# include <netinet/in.h>
43#endif
44#include <arpa/inet.h>
45#include <net/if.h>
46#ifdef HAVE_NETINET_IN_SYSTM_H
47# include <netinet/in_systm.h>
48#endif
49#ifdef HAVE_NETINET_IP_H
50# include <netinet/ip.h>
51#endif
52
53#ifndef IPTOS_TOS_MASK
54# define IPTOS_TOS_MASK (IPTOS_LOWDELAY | IPTOS_THROUGHPUT | IPTOS_RELIABILITY | IPTOS_MINCOST)
55#endif
56 44
57#if !HAVE_RAND_PSEUDO_BYTES 45#if !HAVE_RAND_PSEUDO_BYTES
58# define RAND_pseudo_bytes RAND_bytes 46# define RAND_pseudo_bytes RAND_bytes
59#endif 47#endif
60 48
… …
148 136
149} rsa_cache; 137} rsa_cache;
150 138
151void rsa_cache::cleaner_cb (time_watcher &w) 139void rsa_cache::cleaner_cb (time_watcher &w)
152{ 140{
153 if (empty ()) 141 if (!empty ())
154 w.at = TSTAMP_CANCEL;
155 else
156 { 142 {
157 w.at = NOW + RSA_TTL; 143 w.start (NOW + RSA_TTL);
158 144
159 for (iterator i = begin (); i != end (); ) 145 for (iterator i = begin (); i != end (); )
160 if (i->expire <= NOW) 146 if (i->expire <= NOW)
161 i = erase (i); 147 i = erase (i);
162 else 148 else
… …
493} 479}
494 480
495bool config_packet::chk_config () const 481bool config_packet::chk_config () const
496{ 482{
497 if (prot_major != PROTOCOL_MAJOR) 483 if (prot_major != PROTOCOL_MAJOR)
498 slog (L_WARN, _("major version mismatch (%d <=> %d)"), prot_major, PROTOCOL_MAJOR); 484 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
499 else if (randsize != RAND_SIZE) 485 else if (randsize != RAND_SIZE)
500 slog (L_WARN, _("rand size mismatch (%d <=> %d)"), randsize, RAND_SIZE); 486 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
501 else if (hmaclen != HMACLENGTH) 487 else if (hmaclen != HMACLENGTH)
502 slog (L_WARN, _("hmac length mismatch (%d <=> %d)"), hmaclen, HMACLENGTH); 488 slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
503 else if (flags != curflags ()) 489 else if (flags != curflags ())
504 slog (L_WARN, _("flag mismatch (%x <=> %x)"), flags, curflags ()); 490 slog (L_WARN, _("flag mismatch (remote %x <=> local %x)"), flags, curflags ());
505 else if (challengelen != sizeof (rsachallenge)) 491 else if (challengelen != sizeof (rsachallenge))
506 slog (L_WARN, _("challenge length mismatch (%d <=> %d)"), challengelen, sizeof (rsachallenge)); 492 slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
507 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER))) 493 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
508 slog (L_WARN, _("cipher mismatch (%x <=> %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER)); 494 slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
509 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH))) 495 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
510 slog (L_WARN, _("digest mismatch (%x <=> %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH)); 496 slog (L_WARN, _("digest mismatch (remote %x <=> local %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
511 else if (hmac_nid != htonl (EVP_MD_type (DIGEST))) 497 else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
512 slog (L_WARN, _("hmac mismatch (%x <=> %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST)); 498 slog (L_WARN, _("hmac mismatch (remote %x <=> local %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
513 else 499 else
514 return true; 500 return true;
515 501
516 return false; 502 return false;
517} 503}
… …
612 } 598 }
613 else 599 else
614 { 600 {
615 retry_cnt = 0; 601 retry_cnt = 0;
616 establish_connection.start (NOW + 5); 602 establish_connection.start (NOW + 5);
617 keepalive.reset (); 603 keepalive.stop ();
618 rekey.reset (); 604 rekey.stop ();
619 } 605 }
620} 606}
621 607
622void 608void
623connection::reset_si () 609connection::reset_si ()
… …
689connection::send_auth_request (const sockinfo &si, bool initiate) 675connection::send_auth_request (const sockinfo &si, bool initiate)
690{ 676{
691 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols); 677 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
692 678
693 rsachallenge chg; 679 rsachallenge chg;
694
695 rsa_cache.gen (pkt->id, chg); 680 rsa_cache.gen (pkt->id, chg);
696 681 rsa_encrypt (conf->rsa_key, chg, pkt->encr);
697 if (0 > RSA_public_encrypt (sizeof chg,
698 (unsigned char *)&chg, (unsigned char *)&pkt->encr,
699 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
700 fatal ("RSA_public_encrypt error");
701 682
702 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 683 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
703 684
704 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly 685 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
705 686
… …
739} 720}
740 721
741void 722void
742connection::establish_connection_cb (time_watcher &w) 723connection::establish_connection_cb (time_watcher &w)
743{ 724{
744 if (ictx || conf == THISNODE 725 if (!ictx
726 && conf != THISNODE
745 || connectmode == conf_node::C_NEVER 727 && connectmode != conf_node::C_NEVER
746 || connectmode == conf_node::C_DISABLED) 728 && connectmode != conf_node::C_DISABLED
747 w.at = TSTAMP_CANCEL; 729 && w.at <= NOW)
748 else if (w.at <= NOW)
749 { 730 {
750 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6; 731 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;
751 732
752 if (retry_int < 3600 * 8) 733 if (retry_int < 3600 * 8)
753 retry_cnt++; 734 retry_cnt++;
754 735
755 w.at = NOW + retry_int; 736 w.start (NOW + retry_int);
756 737
757 reset_si (); 738 reset_si ();
758 739
759 if (si.prot && !si.host) 740 if (si.prot && !si.host)
760 vpn->send_connect_request (conf->id); 741 vpn->send_connect_request (conf->id);
… …
791 si.host= 0; 772 si.host= 0;
792 773
793 last_activity = 0; 774 last_activity = 0;
794 retry_cnt = 0; 775 retry_cnt = 0;
795 776
796 rekey.reset (); 777 rekey.stop ();
797 keepalive.reset (); 778 keepalive.stop ();
798 establish_connection.reset (); 779 establish_connection.stop ();
799} 780}
800 781
801void 782void
802connection::shutdown () 783connection::shutdown ()
803{ 784{
… …
808} 789}
809 790
810void 791void
811connection::rekey_cb (time_watcher &w) 792connection::rekey_cb (time_watcher &w)
812{ 793{
813 w.at = TSTAMP_CANCEL;
814
815 reset_connection (); 794 reset_connection ();
816 establish_connection (); 795 establish_connection ();
817} 796}
818 797
819void 798void
820connection::send_data_packet (tap_packet *pkt, bool broadcast) 799connection::send_data_packet (tap_packet *pkt)
821{ 800{
822 vpndata_packet *p = new vpndata_packet; 801 vpndata_packet *p = new vpndata_packet;
823 int tos = 0; 802 int tos = 0;
824 803
825 // I am not hilarious about peeking into packets, but so be it. 804 // I am not hilarious about peeking into packets, but so be it.
826 if (conf->inherit_tos 805 if (conf->inherit_tos && pkt->is_ipv4 ())
827 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
828 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
829 tos = (*pkt)[15] & IPTOS_TOS_MASK; 806 tos = (*pkt)[15] & IPTOS_TOS_MASK;
830 807
831 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 808 p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
832 send_vpn_packet (p, si, tos); 809 send_vpn_packet (p, si, tos);
833 810
834 delete p; 811 delete p;
835 812
836 if (oseqno > MAX_SEQNO) 813 if (oseqno > MAX_SEQNO)
837 rekey (); 814 rekey ();
838} 815}
839 816
840void 817void
841connection::inject_data_packet (tap_packet *pkt, bool broadcast) 818connection::inject_data_packet (tap_packet *pkt, bool broadcast/*TODO DDD*/)
842{ 819{
843 if (ictx && octx) 820 if (ictx && octx)
844 send_data_packet (pkt, broadcast); 821 send_data_packet (pkt);
845 else 822 else
846 { 823 {
847 if (!broadcast)//DDDD 824 if (!broadcast)//DDDD
848 data_queue.put (new tap_packet (*pkt)); 825 data_queue.put (new tap_packet (*pkt));
849 826
… …
924 if (p->initiate) 901 if (p->initiate)
925 send_auth_request (rsi, false); 902 send_auth_request (rsi, false);
926 903
927 rsachallenge k; 904 rsachallenge k;
928 905
929 if (0 > RSA_private_decrypt (sizeof (p->encr), 906 if (!rsa_decrypt (::conf.rsa_key, p->encr, k))
930 (unsigned char *)&p->encr, (unsigned char *)&k, 907 {
931 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
932 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"), 908 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
933 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0)); 909 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
910 break;
911 }
934 else 912 else
935 { 913 {
936 delete octx; 914 delete octx;
937 915
938 octx = new crypto_ctx (k, 1); 916 octx = new crypto_ctx (k, 1);
… …
1052 1030
1053 if (iseqno.recv_ok (seqno)) 1031 if (iseqno.recv_ok (seqno))
1054 { 1032 {
1055 vpn->tap->send (d); 1033 vpn->tap->send (d);
1056 1034
1057 if (p->dst () == 0) // re-broadcast
1058 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
1059 {
1060 connection *c = *i;
1061
1062 if (c->conf != THISNODE && c->conf != conf)
1063 c->inject_data_packet (d);
1064 }
1065
1066 if (si != rsi) 1035 if (si != rsi)
1067 { 1036 {
1068 // fast re-sync on connection changes, useful especially for tcp/ip 1037 // fast re-sync on connection changes, useful especially for tcp/ip
1069 si = rsi; 1038 si = rsi;
1070 1039
… …
1143 { 1112 {
1144 reset_connection (); 1113 reset_connection ();
1145 establish_connection (); 1114 establish_connection ();
1146 } 1115 }
1147 else if (NOW < last_activity + ::conf.keepalive) 1116 else if (NOW < last_activity + ::conf.keepalive)
1148 w.at = last_activity + ::conf.keepalive; 1117 w.start (last_activity + ::conf.keepalive);
1149 else if (conf->connectmode != conf_node::C_ONDEMAND 1118 else if (conf->connectmode != conf_node::C_ONDEMAND
1150 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1119 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1151 { 1120 {
1152 send_ping (si); 1121 send_ping (si);
1153 w.at = NOW + 5; 1122 w.start (NOW + 5);
1154 } 1123 }
1155 else if (NOW < last_activity + ::conf.keepalive + 10) 1124 else if (NOW < last_activity + ::conf.keepalive + 10)
1156 // hold ondemand connections implicitly a few seconds longer 1125 // hold ondemand connections implicitly a few seconds longer
1157 // should delete octx, though, or something like that ;) 1126 // should delete octx, though, or something like that ;)
1158 w.at = last_activity + ::conf.keepalive + 10; 1127 w.start (last_activity + ::conf.keepalive + 10);
1159 else 1128 else
1160 reset_connection (); 1129 reset_connection ();
1161} 1130}
1162 1131
1163void connection::send_connect_request (int id) 1132void connection::send_connect_request (int id)

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines