ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.1 by pcg, Wed Apr 2 03:06:22 2003 UTC vs.
Revision 1.20 by pcg, Tue Oct 14 15:48:15 2003 UTC

… …
22# include "lzf/lzf.h" 22# include "lzf/lzf.h"
23} 23}
24 24
25#include <list> 25#include <list>
26 26
27#include <openssl/rand.h>
28#include <openssl/evp.h>
29#include <openssl/rsa.h>
30#include <openssl/err.h>
31
27#include "gettext.h" 32#include "gettext.h"
28 33
29#include "conf.h" 34#include "conf.h"
30#include "slog.h" 35#include "slog.h"
31#include "device.h" 36#include "device.h"
32#include "protocol.h" 37#include "vpn.h"
33#include "connection.h" 38#include "connection.h"
39
40#include "netcompat.h"
34 41
35#if !HAVE_RAND_PSEUDO_BYTES 42#if !HAVE_RAND_PSEUDO_BYTES
36# define RAND_pseudo_bytes RAND_bytes 43# define RAND_pseudo_bytes RAND_bytes
37#endif 44#endif
38 45
… …
80 rsachallenge chg; 87 rsachallenge chg;
81}; 88};
82 89
83struct rsa_cache : list<rsa_entry> 90struct rsa_cache : list<rsa_entry>
84{ 91{
85 void cleaner_cb (tstamp &ts); time_watcher cleaner; 92 void cleaner_cb (time_watcher &w); time_watcher cleaner;
86 93
87 bool find (const rsaid &id, rsachallenge &chg) 94 bool find (const rsaid &id, rsachallenge &chg)
88 { 95 {
89 for (iterator i = begin (); i != end (); ++i) 96 for (iterator i = begin (); i != end (); ++i)
90 { 97 {
… …
124 : cleaner (this, &rsa_cache::cleaner_cb) 131 : cleaner (this, &rsa_cache::cleaner_cb)
125 { } 132 { }
126 133
127} rsa_cache; 134} rsa_cache;
128 135
129void rsa_cache::cleaner_cb (tstamp &ts) 136void rsa_cache::cleaner_cb (time_watcher &w)
130{ 137{
131 if (empty ()) 138 if (empty ())
132 ts = TSTAMP_CANCEL; 139 w.at = TSTAMP_CANCEL;
133 else 140 else
134 { 141 {
135 ts = NOW + RSA_TTL; 142 w.at = NOW + RSA_TTL;
136 143
137 for (iterator i = begin (); i != end (); ) 144 for (iterator i = begin (); i != end (); )
138 if (i->expire <= NOW) 145 if (i->expire <= NOW)
139 i = erase (i); 146 i = erase (i);
140 else 147 else
… …
142 } 149 }
143} 150}
144 151
145////////////////////////////////////////////////////////////////////////////// 152//////////////////////////////////////////////////////////////////////////////
146 153
147void pkt_queue::put (tap_packet *p) 154void pkt_queue::put (net_packet *p)
148{ 155{
149 if (queue[i]) 156 if (queue[i])
150 { 157 {
151 delete queue[i]; 158 delete queue[i];
152 j = (j + 1) % QUEUEDEPTH; 159 j = (j + 1) % QUEUEDEPTH;
… …
155 queue[i] = p; 162 queue[i] = p;
156 163
157 i = (i + 1) % QUEUEDEPTH; 164 i = (i + 1) % QUEUEDEPTH;
158} 165}
159 166
160tap_packet *pkt_queue::get () 167net_packet *pkt_queue::get ()
161{ 168{
162 tap_packet *p = queue[j]; 169 net_packet *p = queue[j];
163 170
164 if (p) 171 if (p)
165 { 172 {
166 queue[j] = 0; 173 queue[j] = 0;
167 j = (j + 1) % QUEUEDEPTH; 174 j = (j + 1) % QUEUEDEPTH;
… …
192// only do action once every x seconds per host whole allowing bursts. 199// only do action once every x seconds per host whole allowing bursts.
193// this implementation ("splay list" ;) is inefficient, 200// this implementation ("splay list" ;) is inefficient,
194// but low on resources. 201// but low on resources.
195struct net_rate_limiter : list<net_rateinfo> 202struct net_rate_limiter : list<net_rateinfo>
196{ 203{
197 static const double ALPHA = 1. - 1. / 90.; // allow bursts 204 static const double ALPHA = 1. - 1. / 600.; // allow bursts
198 static const double CUTOFF = 20.; // one event every CUTOFF seconds 205 static const double CUTOFF = 10.; // one event every CUTOFF seconds
199 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 206 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
207 static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value
200 208
201 bool can (const sockinfo &si) { return can((u32)si.host); } 209 bool can (const sockinfo &si) { return can((u32)si.host); }
202 bool can (u32 host); 210 bool can (u32 host);
203}; 211};
204 212
205net_rate_limiter auth_rate_limiter, reset_rate_limiter; 213net_rate_limiter auth_rate_limiter, reset_rate_limiter;
206 214
… …
220 { 228 {
221 net_rateinfo ri; 229 net_rateinfo ri;
222 230
223 ri.host = host; 231 ri.host = host;
224 ri.pcnt = 1.; 232 ri.pcnt = 1.;
225 ri.diff = CUTOFF * (1. / (1. - ALPHA)); 233 ri.diff = MAXDIF;
226 ri.last = NOW; 234 ri.last = NOW;
227 235
228 push_front (ri); 236 push_front (ri);
229 237
230 return true; 238 return true;
… …
237 ri.pcnt = ri.pcnt * ALPHA; 245 ri.pcnt = ri.pcnt * ALPHA;
238 ri.diff = ri.diff * ALPHA + (NOW - ri.last); 246 ri.diff = ri.diff * ALPHA + (NOW - ri.last);
239 247
240 ri.last = NOW; 248 ri.last = NOW;
241 249
250 double dif = ri.diff / ri.pcnt;
251
242 bool send = ri.diff / ri.pcnt > CUTOFF; 252 bool send = dif > CUTOFF;
243 253
254 if (dif > MAXDIF)
255 {
256 ri.pcnt = 1.;
257 ri.diff = MAXDIF;
258 }
244 if (send) 259 else if (send)
245 ri.pcnt++; 260 ri.pcnt++;
246 261
247 push_front (ri); 262 push_front (ri);
248 263
249 return send; 264 return send;
… …
280 hmac_gen (ctx); 295 hmac_gen (ctx);
281 296
282 return !memcmp (hmac, hmac_digest, HMACLENGTH); 297 return !memcmp (hmac, hmac_digest, HMACLENGTH);
283} 298}
284 299
285void vpn_packet::set_hdr (ptype type, unsigned int dst) 300void vpn_packet::set_hdr (ptype type_, unsigned int dst)
286{ 301{
287 this->type = type; 302 type = type_;
288 303
289 int src = THISNODE->id; 304 int src = THISNODE->id;
290 305
291 src1 = src; 306 src1 = src;
292 srcdst = ((src >> 8) << 4) | (dst >> 8); 307 srcdst = ((src >> 8) << 4) | (dst >> 8);
… …
462 set_hdr (type, dst); 477 set_hdr (type, dst);
463} 478}
464 479
465bool config_packet::chk_config () const 480bool config_packet::chk_config () const
466{ 481{
467 return prot_major == PROTOCOL_MAJOR 482 if (prot_major != PROTOCOL_MAJOR)
468 && randsize == RAND_SIZE 483 slog (L_WARN, _("major version mismatch (%d <=> %d)"), prot_major, PROTOCOL_MAJOR);
469 && hmaclen == HMACLENGTH 484 else if (randsize != RAND_SIZE)
470 && flags == curflags () 485 slog (L_WARN, _("rand size mismatch (%d <=> %d)"), randsize, RAND_SIZE);
486 else if (hmaclen != HMACLENGTH)
487 slog (L_WARN, _("hmac length mismatch (%d <=> %d)"), hmaclen, HMACLENGTH);
488 else if (flags != curflags ())
489 slog (L_WARN, _("flag mismatch (%x <=> %x)"), flags, curflags ());
471 && challengelen == sizeof (rsachallenge) 490 else if (challengelen != sizeof (rsachallenge))
491 slog (L_WARN, _("challenge length mismatch (%d <=> %d)"), challengelen, sizeof (rsachallenge));
472 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER)) 492 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
493 slog (L_WARN, _("cipher mismatch (%x <=> %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
473 && digest_nid == htonl (EVP_MD_type (RSA_HASH)) 494 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
495 slog (L_WARN, _("digest mismatch (%x <=> %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
474 && hmac_nid == htonl (EVP_MD_type (DIGEST)); 496 else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
497 slog (L_WARN, _("hmac mismatch (%x <=> %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
498 else
499 return true;
500
501 return false;
475} 502}
476 503
477struct auth_req_packet : config_packet 504struct auth_req_packet : config_packet
478{ 505{
479 char magic[8]; 506 char magic[8];
… …
541}; 568};
542 569
543///////////////////////////////////////////////////////////////////////////// 570/////////////////////////////////////////////////////////////////////////////
544 571
545void 572void
573connection::connection_established ()
574{
575 if (ictx && octx)
576 {
577 connectmode = conf->connectmode;
578
579 rekey.start (NOW + ::conf.rekey);
580 keepalive.start (NOW + ::conf.keepalive);
581
582 // send queued packets
583 if (ictx && octx)
584 {
585 while (tap_packet *p = (tap_packet *)data_queue.get ())
586 {
587 send_data_packet (p);
588 delete p;
589 }
590
591 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
592 {
593 send_vpn_packet (p, si, IPTOS_RELIABILITY);
594 delete p;
595 }
596 }
597 }
598 else
599 {
600 retry_cnt = 0;
601 establish_connection.start (NOW + 5);
602 keepalive.reset ();
603 rekey.reset ();
604 }
605}
606
607void
546connection::reset_dstaddr () 608connection::reset_si ()
547{ 609{
610 protocol = best_protocol (THISNODE->protocols & conf->protocols);
611
612 // mask out protocols we cannot establish
613 if (!conf->udp_port) protocol &= ~PROT_UDPv4;
614 if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
615
548 si.set (conf); 616 si.set (conf, protocol);
617}
618
619// ensure sockinfo is valid, forward if necessary
620const sockinfo &
621connection::forward_si (const sockinfo &si) const
622{
623 if (!si.valid ())
624 {
625 connection *r = vpn->find_router ();
626
627 if (r)
628 {
629 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"),
630 conf->nodename, r->conf->nodename);
631 return r->si;
632 }
633 else
634 slog (L_DEBUG, _("%s: node unreachable, no common protocol"),
635 conf->nodename);
636 }
637
638 return si;
639}
640
641void
642connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
643{
644 if (!vpn->send_vpn_packet (pkt, si, tos))
645 reset_connection ();
549} 646}
550 647
551void 648void
552connection::send_ping (const sockinfo &si, u8 pong) 649connection::send_ping (const sockinfo &si, u8 pong)
553{ 650{
… …
575 672
576void 673void
577connection::send_auth_request (const sockinfo &si, bool initiate) 674connection::send_auth_request (const sockinfo &si, bool initiate)
578{ 675{
579 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols); 676 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
580
581 protocol = best_protocol (THISNODE->protocols & conf->protocols);
582 677
583 rsachallenge chg; 678 rsachallenge chg;
584 679
585 rsa_cache.gen (pkt->id, chg); 680 rsa_cache.gen (pkt->id, chg);
586 681
… …
589 conf->rsa_key, RSA_PKCS1_OAEP_PADDING)) 684 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
590 fatal ("RSA_public_encrypt error"); 685 fatal ("RSA_public_encrypt error");
591 686
592 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 687 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
593 688
594 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 689 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
595 690
596 delete pkt; 691 delete pkt;
597} 692}
598 693
599void 694void
… …
627 722
628 delete r; 723 delete r;
629} 724}
630 725
631void 726void
632connection::establish_connection_cb (tstamp &ts) 727connection::establish_connection_cb (time_watcher &w)
633{ 728{
634 if (ictx || conf == THISNODE 729 if (ictx || conf == THISNODE
635 || connectmode == conf_node::C_NEVER 730 || connectmode == conf_node::C_NEVER
636 || connectmode == conf_node::C_DISABLED) 731 || connectmode == conf_node::C_DISABLED)
637 ts = TSTAMP_CANCEL; 732 w.at = TSTAMP_CANCEL;
638 else if (ts <= NOW) 733 else if (w.at <= NOW)
639 { 734 {
640 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6; 735 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;
641 736
642 if (retry_int < 3600 * 8) 737 if (retry_int < 3600 * 8)
643 retry_cnt++; 738 retry_cnt++;
644 739
645 ts = NOW + retry_int; 740 w.at = NOW + retry_int;
646 741
647 if (conf->hostname) 742 reset_si ();
743
744 if (si.prot && !si.host)
745 vpn->send_connect_request (conf->id);
746 else
648 { 747 {
649 reset_dstaddr (); 748 const sockinfo &dsi = forward_si (si);
749
650 if (si.host && auth_rate_limiter.can (si)) 750 if (dsi.valid () && auth_rate_limiter.can (dsi))
651 { 751 {
652 if (retry_cnt < 4) 752 if (retry_cnt < 4)
653 send_auth_request (si, true); 753 send_auth_request (dsi, true);
654 else 754 else
655 send_ping (si, 0); 755 send_ping (dsi, 0);
656 } 756 }
657 } 757 }
658 else
659 vpn->connect_request (conf->id);
660 } 758 }
661} 759}
662 760
663void 761void
664connection::reset_connection () 762connection::reset_connection ()
… …
693 791
694 reset_connection (); 792 reset_connection ();
695} 793}
696 794
697void 795void
698connection::rekey_cb (tstamp &ts) 796connection::rekey_cb (time_watcher &w)
699{ 797{
700 ts = TSTAMP_CANCEL; 798 w.at = TSTAMP_CANCEL;
701 799
702 reset_connection (); 800 reset_connection ();
703 establish_connection (); 801 establish_connection ();
704} 802}
705 803
… …
707connection::send_data_packet (tap_packet *pkt, bool broadcast) 805connection::send_data_packet (tap_packet *pkt, bool broadcast)
708{ 806{
709 vpndata_packet *p = new vpndata_packet; 807 vpndata_packet *p = new vpndata_packet;
710 int tos = 0; 808 int tos = 0;
711 809
810 // I am not hilarious about peeking into packets, but so be it.
712 if (conf->inherit_tos 811 if (conf->inherit_tos
713 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 812 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
714 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4 813 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
715 tos = (*pkt)[15] & IPTOS_TOS_MASK; 814 tos = (*pkt)[15] & IPTOS_TOS_MASK;
716 815
… …
729 if (ictx && octx) 828 if (ictx && octx)
730 send_data_packet (pkt, broadcast); 829 send_data_packet (pkt, broadcast);
731 else 830 else
732 { 831 {
733 if (!broadcast)//DDDD 832 if (!broadcast)//DDDD
734 queue.put (new tap_packet (*pkt)); 833 data_queue.put (new tap_packet (*pkt));
834
835 establish_connection ();
836 }
837}
838
839void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
840{
841 if (ictx && octx)
842 send_vpn_packet (pkt, si, tos);
843 else
844 {
845 vpn_queue.put (new vpn_packet (*pkt));
735 846
736 establish_connection (); 847 establish_connection ();
737 } 848 }
738} 849}
739 850
… …
745 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 856 slog (L_NOISE, "<<%d received packet type %d from %d to %d",
746 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 857 conf->id, pkt->typ (), pkt->src (), pkt->dst ());
747 858
748 switch (pkt->typ ()) 859 switch (pkt->typ ())
749 { 860 {
750 case vpn_packet::PT_PING: 861 case vpn_packet::PT_PING:
751 // we send pings instead of auth packets after some retries, 862 // we send pings instead of auth packets after some retries,
752 // so reset the retry counter and establish a connection 863 // so reset the retry counter and establish a connection
753 // when we receive a ping. 864 // when we receive a ping.
754 if (!ictx) 865 if (!ictx)
866 {
867 if (auth_rate_limiter.can (rsi))
868 send_auth_request (rsi, true);
869 }
870 else
871 send_ping (rsi, 1); // pong
872
873 break;
874
875 case vpn_packet::PT_PONG:
876 break;
877
878 case vpn_packet::PT_RESET:
755 { 879 {
756 if (auth_rate_limiter.can (rsi)) 880 reset_connection ();
757 send_auth_request (rsi, true); 881
882 config_packet *p = (config_packet *) pkt;
883
884 if (!p->chk_config ())
885 {
886 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
887 conf->nodename, (const char *)rsi);
888 connectmode = conf_node::C_DISABLED;
889 }
890 else if (connectmode == conf_node::C_ALWAYS)
891 establish_connection ();
758 } 892 }
759 else
760 send_ping (rsi, 1); // pong
761
762 break; 893 break;
763 894
764 case vpn_packet::PT_PONG:
765 break;
766
767 case vpn_packet::PT_RESET: 895 case vpn_packet::PT_AUTH_REQ:
768 { 896 if (auth_rate_limiter.can (rsi))
769 reset_connection ();
770
771 config_packet *p = (config_packet *) pkt;
772
773 if (!p->chk_config ())
774 { 897 {
898 auth_req_packet *p = (auth_req_packet *) pkt;
899
900 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);
901
902 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
903 {
904 if (p->prot_minor != PROTOCOL_MINOR)
905 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
906 conf->nodename, (const char *)rsi,
907 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
908
909 if (p->initiate)
910 send_auth_request (rsi, false);
911
912 rsachallenge k;
913
914 if (0 > RSA_private_decrypt (sizeof (p->encr),
915 (unsigned char *)&p->encr, (unsigned char *)&k,
916 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
917 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
918 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
919 else
920 {
921 delete octx;
922
923 octx = new crypto_ctx (k, 1);
924 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
925
926 conf->protocols = p->protocols;
927
928 send_auth_response (rsi, p->id, k);
929
930 connection_established ();
931
932 break;
933 }
934 }
935 else
775 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"), 936 slog (L_WARN, _("%s(%s): protocol mismatch"),
776 conf->nodename, (const char *)rsi); 937 conf->nodename, (const char *)rsi);
777 connectmode = conf_node::C_DISABLED; 938
939 send_reset (rsi);
778 } 940 }
779 else if (connectmode == conf_node::C_ALWAYS) 941
780 establish_connection ();
781 }
782 break; 942 break;
783 943
784 case vpn_packet::PT_AUTH_REQ: 944 case vpn_packet::PT_AUTH_RES:
785 if (auth_rate_limiter.can (rsi))
786 { 945 {
787 auth_req_packet *p = (auth_req_packet *) pkt; 946 auth_res_packet *p = (auth_res_packet *) pkt;
788 947
789 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 948 slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);
790 949
791 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 950 if (p->chk_config ())
792 { 951 {
793 if (p->prot_minor != PROTOCOL_MINOR) 952 if (p->prot_minor != PROTOCOL_MINOR)
794 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 953 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
795 conf->nodename, (const char *)rsi, 954 conf->nodename, (const char *)rsi,
796 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 955 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
797 956
798 if (p->initiate)
799 send_auth_request (rsi, false);
800
801 rsachallenge k; 957 rsachallenge chg;
802 958
803 if (0 > RSA_private_decrypt (sizeof (p->encr), 959 if (!rsa_cache.find (p->id, chg))
804 (unsigned char *)&p->encr, (unsigned char *)&k, 960 {
805 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING)) 961 slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
806 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
807 conf->nodename, (const char *)rsi); 962 conf->nodename, (const char *)rsi);
963 break;
964 }
808 else 965 else
809 { 966 {
810 retry_cnt = 0; 967 crypto_ctx *cctx = new crypto_ctx (chg, 0);
811 establish_connection.set (NOW + 8); //? ;) 968
812 keepalive.reset (); 969 if (!p->hmac_chk (cctx))
970 {
971 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
972 "could be an attack, or just corruption or an synchronization error"),
973 conf->nodename, (const char *)rsi);
974 break;
975 }
813 rekey.reset (); 976 else
977 {
978 rsaresponse h;
814 979
980 rsa_hash (p->id, chg, h);
981
982 if (!memcmp ((u8 *)&h, (u8 *)p->response, sizeof h))
983 {
984 prot_minor = p->prot_minor;
985
986 delete ictx; ictx = cctx;
987
988 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
989
990 si = rsi;
991 protocol = rsi.prot;
992
993 connection_established ();
994
995 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
996 conf->nodename, (const char *)rsi,
997 p->prot_major, p->prot_minor);
998
999 if (::conf.script_node_up)
1000 run_script (run_script_cb (this, &connection::script_node_up), false);
1001
1002 break;
1003 }
1004 else
1005 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
1006 conf->nodename, (const char *)rsi);
1007 }
1008
815 delete ictx; 1009 delete cctx;
816 ictx = 0;
817
818 delete octx;
819
820 octx = new crypto_ctx (k, 1);
821 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
822
823 conf->protocols = p->protocols;
824 send_auth_response (rsi, p->id, k);
825
826 break;
827 } 1010 }
828 } 1011 }
829
830 send_reset (rsi);
831 } 1012 }
832 1013
1014 send_reset (rsi);
833 break; 1015 break;
834 1016
835 case vpn_packet::PT_AUTH_RES: 1017 case vpn_packet::PT_DATA_COMPRESSED:
836 { 1018#if !ENABLE_COMPRESSION
837 auth_res_packet *p = (auth_res_packet *) pkt; 1019 send_reset (rsi);
1020 break;
1021#endif
838 1022
839 slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id); 1023 case vpn_packet::PT_DATA_UNCOMPRESSED:
840 1024
841 if (p->chk_config ()) 1025 if (ictx && octx)
842 { 1026 {
843 if (p->prot_minor != PROTOCOL_MINOR) 1027 vpndata_packet *p = (vpndata_packet *)pkt;
844 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
845 conf->nodename, (const char *)rsi,
846 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
847 1028
848 rsachallenge chg; 1029 if (!p->hmac_chk (ictx))
849 1030 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
850 if (!rsa_cache.find (p->id, chg)) 1031 "could be an attack, or just corruption or an synchronization error"),
851 slog (L_ERR, _("%s(%s): unrequested auth response"),
852 conf->nodename, (const char *)rsi); 1032 conf->nodename, (const char *)rsi);
853 else 1033 else
854 { 1034 {
855 crypto_ctx *cctx = new crypto_ctx (chg, 0);
856
857 if (!p->hmac_chk (cctx))
858 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
859 "could be an attack, or just corruption or an synchronization error"),
860 conf->nodename, (const char *)rsi);
861 else 1035 u32 seqno;
1036 tap_packet *d = p->unpack (this, seqno);
1037
1038 if (iseqno.recv_ok (seqno))
862 { 1039 {
863 rsaresponse h; 1040 vpn->tap->send (d);
864 1041
865 rsa_hash (p->id, chg, h); 1042 if (p->dst () == 0) // re-broadcast
1043 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
1044 {
1045 connection *c = *i;
866 1046
867 if (!memcmp ((u8 *)&h, (u8 *)p->response, sizeof h)) 1047 if (c->conf != THISNODE && c->conf != conf)
1048 c->inject_data_packet (d);
1049 }
1050
1051 if (si != rsi)
868 { 1052 {
869 prot_minor = p->prot_minor; 1053 // fast re-sync on connection changes, useful especially for tcp/ip
870
871 delete ictx; ictx = cctx;
872
873 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
874
875 si = rsi; 1054 si = rsi;
876 1055
877 rekey.set (NOW + ::conf.rekey); 1056 slog (L_INFO, _("%s(%s): socket address changed to %s"),
878 keepalive.set (NOW + ::conf.keepalive);
879
880 // send queued packets
881 while (tap_packet *p = queue.get ())
882 {
883 send_data_packet (p);
884 delete p;
885 }
886
887 connectmode = conf->connectmode;
888
889 slog (L_INFO, _("%s(%s): %s connection established, protocol version %d.%d"),
890 conf->nodename, (const char *)rsi, 1057 conf->nodename, (const char *)si, (const char *)rsi);
891 strprotocol (protocol),
892 p->prot_major, p->prot_minor);
893
894 if (::conf.script_node_up)
895 run_script (run_script_cb (this, &connection::script_node_up), false);
896
897 break;
898 } 1058 }
1059
899 else 1060 delete d;
900 slog (L_ERR, _("%s(%s): sent and received challenge do not match"), 1061
901 conf->nodename, (const char *)rsi); 1062 break;
902 } 1063 }
903
904 delete cctx;
905 } 1064 }
906 } 1065 }
907 }
908 1066
909 send_reset (rsi); 1067 send_reset (rsi);
910 break; 1068 break;
911 1069
912 case vpn_packet::PT_DATA_COMPRESSED:
913#if !ENABLE_COMPRESSION
914 send_reset (rsi);
915 break;
916#endif
917
918 case vpn_packet::PT_DATA_UNCOMPRESSED:
919
920 if (ictx && octx)
921 {
922 vpndata_packet *p = (vpndata_packet *)pkt;
923
924 if (rsi == si)
925 {
926 if (!p->hmac_chk (ictx))
927 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
928 "could be an attack, or just corruption or an synchronization error"),
929 conf->nodename, (const char *)rsi);
930 else
931 {
932 u32 seqno;
933 tap_packet *d = p->unpack (this, seqno);
934
935 if (iseqno.recv_ok (seqno))
936 {
937 vpn->tap->send (d);
938
939 if (p->dst () == 0) // re-broadcast
940 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
941 {
942 connection *c = *i;
943
944 if (c->conf != THISNODE && c->conf != conf)
945 c->inject_data_packet (d);
946 }
947
948 delete d;
949
950 break;
951 }
952 }
953 }
954 else
955 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
956 }
957
958 send_reset (rsi);
959 break;
960
961 case vpn_packet::PT_CONNECT_REQ: 1070 case vpn_packet::PT_CONNECT_REQ:
962 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1071 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
963 { 1072 {
964 connect_req_packet *p = (connect_req_packet *) pkt; 1073 connect_req_packet *p = (connect_req_packet *) pkt;
965 1074
966 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1075 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
967 conf->protocols = p->protocols;
968 connection *c = vpn->conns[p->id - 1]; 1076 connection *c = vpn->conns[p->id - 1];
1077 conf->protocols = p->protocols;
969 1078
970 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n", 1079 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
971 conf->id, p->id, c->ictx && c->octx); 1080 conf->id, p->id, c->ictx && c->octx);
972 1081
973 if (c->ictx && c->octx) 1082 if (c->ictx && c->octx)
974 { 1083 {
975 // send connect_info packets to both sides, in case one is 1084 // send connect_info packets to both sides, in case one is
976 // behind a nat firewall (or both ;) 1085 // behind a nat firewall (or both ;)
977 c->send_connect_info (conf->id, si, conf->protocols); 1086 c->send_connect_info (conf->id, si, conf->protocols);
978 send_connect_info (c->conf->id, c->si, c->conf->protocols); 1087 send_connect_info (c->conf->id, c->si, c->conf->protocols);
979 } 1088 }
1089 else
1090 c->establish_connection ();
980 } 1091 }
981 1092
982 break; 1093 break;
983 1094
984 case vpn_packet::PT_CONNECT_INFO: 1095 case vpn_packet::PT_CONNECT_INFO:
985 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1096 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
986 { 1097 {
987 connect_info_packet *p = (connect_info_packet *) pkt; 1098 connect_info_packet *p = (connect_info_packet *) pkt;
988 1099
989 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1100 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
990 conf->protocols = p->protocols; 1101
991 connection *c = vpn->conns[p->id - 1]; 1102 connection *c = vpn->conns[p->id - 1];
992 1103
1104 c->conf->protocols = p->protocols;
1105 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1106 p->si.upgrade_protocol (protocol, c->conf);
1107
993 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1108 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
994 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1109 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
995 1110
1111 const sockinfo &dsi = forward_si (p->si);
1112
1113 if (dsi.valid ())
996 c->send_auth_request (p->si, true); 1114 c->send_auth_request (dsi, true);
997 } 1115 }
998 1116
999 break; 1117 break;
1000 1118
1001 default: 1119 default:
1002 send_reset (rsi); 1120 send_reset (rsi);
1003 break; 1121 break;
1004
1005 } 1122 }
1006} 1123}
1007 1124
1008void connection::keepalive_cb (tstamp &ts) 1125void connection::keepalive_cb (time_watcher &w)
1009{ 1126{
1010 if (NOW >= last_activity + ::conf.keepalive + 30) 1127 if (NOW >= last_activity + ::conf.keepalive + 30)
1011 { 1128 {
1012 reset_connection (); 1129 reset_connection ();
1013 establish_connection (); 1130 establish_connection ();
1014 } 1131 }
1015 else if (NOW < last_activity + ::conf.keepalive) 1132 else if (NOW < last_activity + ::conf.keepalive)
1016 ts = last_activity + ::conf.keepalive; 1133 w.at = last_activity + ::conf.keepalive;
1017 else if (conf->connectmode != conf_node::C_ONDEMAND 1134 else if (conf->connectmode != conf_node::C_ONDEMAND
1018 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1135 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1019 { 1136 {
1020 send_ping (si); 1137 send_ping (si);
1021 ts = NOW + 5; 1138 w.at = NOW + 5;
1022 } 1139 }
1140 else if (NOW < last_activity + ::conf.keepalive + 10)
1141 // hold ondemand connections implicitly a few seconds longer
1142 // should delete octx, though, or something like that ;)
1143 w.at = last_activity + ::conf.keepalive + 10;
1023 else 1144 else
1024 reset_connection (); 1145 reset_connection ();
1025} 1146}
1026 1147
1027void connection::connect_request (int id) 1148void connection::send_connect_request (int id)
1028{ 1149{
1029 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1150 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1030 1151
1031 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1152 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);
1032 p->hmac_set (octx); 1153 p->hmac_set (octx);
… …
1035 delete p; 1156 delete p;
1036} 1157}
1037 1158
1038void connection::script_node () 1159void connection::script_node ()
1039{ 1160{
1040 vpn->script_if_up (0); 1161 vpn->script_if_up ();
1041 1162
1042 char *env; 1163 char *env;
1043 asprintf (&env, "DESTID=%d", conf->id); putenv (env); 1164 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1044 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); 1165 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1045 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); 1166 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1046 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); 1167 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1047} 1168}
1048 1169
1049const char *connection::script_node_up (int) 1170const char *connection::script_node_up ()
1050{ 1171{
1051 script_node (); 1172 script_node ();
1052 1173
1053 putenv ("STATE=up"); 1174 putenv ("STATE=up");
1054 1175
1055 return ::conf.script_node_up ? ::conf.script_node_up : "node-up"; 1176 return ::conf.script_node_up ? ::conf.script_node_up : "node-up";
1056} 1177}
1057 1178
1058const char *connection::script_node_down (int) 1179const char *connection::script_node_down ()
1059{ 1180{
1060 script_node (); 1181 script_node ();
1061 1182
1062 putenv ("STATE=down"); 1183 putenv ("STATE=down");
1063 1184
1064 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1185 return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1065}
1066
1067// send a vpn packet out to other hosts
1068void
1069connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1070{
1071 if (protocol & PROT_IPv4)
1072 vpn->send_ipv4_packet (pkt, si, tos);
1073 else
1074 vpn->send_udpv4_packet (pkt, si, tos);
1075} 1186}
1076 1187
1077connection::connection(struct vpn *vpn_) 1188connection::connection(struct vpn *vpn_)
1078: vpn(vpn_) 1189: vpn(vpn_)
1079, rekey (this, &connection::rekey_cb) 1190, rekey (this, &connection::rekey_cb)

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines