ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.4 by pcg, Wed Apr 2 21:02:25 2003 UTC vs.
Revision 1.26 by pcg, Sat Jan 17 14:08:57 2004 UTC

1/* 1/*
2 connection.C -- manage a single connection 2 connection.C -- manage a single connection
3 Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>
3 4
4 This program is free software; you can redistribute it and/or modify 5 This program is free software; you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by 6 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation; either version 2 of the License, or 7 the Free Software Foundation; either version 2 of the License, or
7 (at your option) any later version. 8 (at your option) any later version.
… …
20 21
21extern "C" { 22extern "C" {
22# include "lzf/lzf.h" 23# include "lzf/lzf.h"
23} 24}
24 25
26#include <cassert>
27
25#include <list> 28#include <list>
26 29
27#include <openssl/rand.h> 30#include <openssl/rand.h>
28#include <openssl/evp.h> 31#include <openssl/evp.h>
29#include <openssl/rsa.h> 32#include <openssl/rsa.h>
… …
34#include "conf.h" 37#include "conf.h"
35#include "slog.h" 38#include "slog.h"
36#include "device.h" 39#include "device.h"
37#include "vpn.h" 40#include "vpn.h"
38#include "connection.h" 41#include "connection.h"
42
43#include "netcompat.h"
39 44
40#if !HAVE_RAND_PSEUDO_BYTES 45#if !HAVE_RAND_PSEUDO_BYTES
41# define RAND_pseudo_bytes RAND_bytes 46# define RAND_pseudo_bytes RAND_bytes
42#endif 47#endif
43 48
… …
131 136
132} rsa_cache; 137} rsa_cache;
133 138
134void rsa_cache::cleaner_cb (time_watcher &w) 139void rsa_cache::cleaner_cb (time_watcher &w)
135{ 140{
136 if (empty ()) 141 if (!empty ())
137 w.at = TSTAMP_CANCEL;
138 else
139 { 142 {
140 w.at = NOW + RSA_TTL; 143 w.start (NOW + RSA_TTL);
141 144
142 for (iterator i = begin (); i != end (); ) 145 for (iterator i = begin (); i != end (); )
143 if (i->expire <= NOW) 146 if (i->expire <= NOW)
144 i = erase (i); 147 i = erase (i);
145 else 148 else
… …
147 } 150 }
148} 151}
149 152
150////////////////////////////////////////////////////////////////////////////// 153//////////////////////////////////////////////////////////////////////////////
151 154
152void pkt_queue::put (tap_packet *p) 155void pkt_queue::put (net_packet *p)
153{ 156{
154 if (queue[i]) 157 if (queue[i])
155 { 158 {
156 delete queue[i]; 159 delete queue[i];
157 j = (j + 1) % QUEUEDEPTH; 160 j = (j + 1) % QUEUEDEPTH;
… …
160 queue[i] = p; 163 queue[i] = p;
161 164
162 i = (i + 1) % QUEUEDEPTH; 165 i = (i + 1) % QUEUEDEPTH;
163} 166}
164 167
165tap_packet *pkt_queue::get () 168net_packet *pkt_queue::get ()
166{ 169{
167 tap_packet *p = queue[j]; 170 net_packet *p = queue[j];
168 171
169 if (p) 172 if (p)
170 { 173 {
171 queue[j] = 0; 174 queue[j] = 0;
172 j = (j + 1) % QUEUEDEPTH; 175 j = (j + 1) % QUEUEDEPTH;
… …
197// only do action once every x seconds per host whole allowing bursts. 200// only do action once every x seconds per host whole allowing bursts.
198// this implementation ("splay list" ;) is inefficient, 201// this implementation ("splay list" ;) is inefficient,
199// but low on resources. 202// but low on resources.
200struct net_rate_limiter : list<net_rateinfo> 203struct net_rate_limiter : list<net_rateinfo>
201{ 204{
202 static const double ALPHA = 1. - 1. / 90.; // allow bursts 205 static const double ALPHA = 1. - 1. / 600.; // allow bursts
203 static const double CUTOFF = 20.; // one event every CUTOFF seconds 206 static const double CUTOFF = 10.; // one event every CUTOFF seconds
204 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 207 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
208 static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value
205 209
206 bool can (const sockinfo &si) { return can((u32)si.host); } 210 bool can (const sockinfo &si) { return can((u32)si.host); }
207 bool can (u32 host); 211 bool can (u32 host);
208}; 212};
209 213
210net_rate_limiter auth_rate_limiter, reset_rate_limiter; 214net_rate_limiter auth_rate_limiter, reset_rate_limiter;
211 215
… …
225 { 229 {
226 net_rateinfo ri; 230 net_rateinfo ri;
227 231
228 ri.host = host; 232 ri.host = host;
229 ri.pcnt = 1.; 233 ri.pcnt = 1.;
230 ri.diff = CUTOFF * (1. / (1. - ALPHA)); 234 ri.diff = MAXDIF;
231 ri.last = NOW; 235 ri.last = NOW;
232 236
233 push_front (ri); 237 push_front (ri);
234 238
235 return true; 239 return true;
… …
242 ri.pcnt = ri.pcnt * ALPHA; 246 ri.pcnt = ri.pcnt * ALPHA;
243 ri.diff = ri.diff * ALPHA + (NOW - ri.last); 247 ri.diff = ri.diff * ALPHA + (NOW - ri.last);
244 248
245 ri.last = NOW; 249 ri.last = NOW;
246 250
251 double dif = ri.diff / ri.pcnt;
252
247 bool send = ri.diff / ri.pcnt > CUTOFF; 253 bool send = dif > CUTOFF;
248 254
255 if (dif > MAXDIF)
256 {
257 ri.pcnt = 1.;
258 ri.diff = MAXDIF;
259 }
249 if (send) 260 else if (send)
250 ri.pcnt++; 261 ri.pcnt++;
251 262
252 push_front (ri); 263 push_front (ri);
253 264
254 return send; 265 return send;
… …
285 hmac_gen (ctx); 296 hmac_gen (ctx);
286 297
287 return !memcmp (hmac, hmac_digest, HMACLENGTH); 298 return !memcmp (hmac, hmac_digest, HMACLENGTH);
288} 299}
289 300
290void vpn_packet::set_hdr (ptype type, unsigned int dst) 301void vpn_packet::set_hdr (ptype type_, unsigned int dst)
291{ 302{
292 this->type = type; 303 type = type_;
293 304
294 int src = THISNODE->id; 305 int src = THISNODE->id;
295 306
296 src1 = src; 307 src1 = src;
297 srcdst = ((src >> 8) << 4) | (dst >> 8); 308 srcdst = ((src >> 8) << 4) | (dst >> 8);
… …
467 set_hdr (type, dst); 478 set_hdr (type, dst);
468} 479}
469 480
470bool config_packet::chk_config () const 481bool config_packet::chk_config () const
471{ 482{
472 return prot_major == PROTOCOL_MAJOR 483 if (prot_major != PROTOCOL_MAJOR)
473 && randsize == RAND_SIZE 484 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
474 && hmaclen == HMACLENGTH 485 else if (randsize != RAND_SIZE)
475 && flags == curflags () 486 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
487 else if (hmaclen != HMACLENGTH)
488 slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
489 else if (flags != curflags ())
490 slog (L_WARN, _("flag mismatch (remote %x <=> local %x)"), flags, curflags ());
476 && challengelen == sizeof (rsachallenge) 491 else if (challengelen != sizeof (rsachallenge))
492 slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
477 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER)) 493 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
494 slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
478 && digest_nid == htonl (EVP_MD_type (RSA_HASH)) 495 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
496 slog (L_WARN, _("digest mismatch (remote %x <=> local %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
479 && hmac_nid == htonl (EVP_MD_type (DIGEST)); 497 else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
498 slog (L_WARN, _("hmac mismatch (remote %x <=> local %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
499 else
500 return true;
501
502 return false;
480} 503}
481 504
482struct auth_req_packet : config_packet 505struct auth_req_packet : config_packet
483{ 506{
484 char magic[8]; 507 char magic[8];
… …
546}; 569};
547 570
548///////////////////////////////////////////////////////////////////////////// 571/////////////////////////////////////////////////////////////////////////////
549 572
550void 573void
574connection::connection_established ()
575{
576 if (ictx && octx)
577 {
578 connectmode = conf->connectmode;
579
580 rekey.start (NOW + ::conf.rekey);
581 keepalive.start (NOW + ::conf.keepalive);
582
583 // send queued packets
584 if (ictx && octx)
585 {
586 while (tap_packet *p = (tap_packet *)data_queue.get ())
587 {
588 send_data_packet (p);
589 delete p;
590 }
591
592 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
593 {
594 send_vpn_packet (p, si, IPTOS_RELIABILITY);
595 delete p;
596 }
597 }
598 }
599 else
600 {
601 retry_cnt = 0;
602 establish_connection.start (NOW + 5);
603 keepalive.stop ();
604 rekey.stop ();
605 }
606}
607
608void
551connection::reset_dstaddr () 609connection::reset_si ()
552{ 610{
553 si.set (conf);
554}
555
556void
557connection::send_ping (const sockinfo &si, u8 pong)
558{
559 ping_packet *pkt = new ping_packet;
560
561 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
562 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
563
564 delete pkt;
565}
566
567void
568connection::send_reset (const sockinfo &si)
569{
570 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
571 {
572 config_packet *pkt = new config_packet;
573
574 pkt->setup (vpn_packet::PT_RESET, conf->id);
575 send_vpn_packet (pkt, si, IPTOS_MINCOST);
576
577 delete pkt;
578 }
579}
580
581void
582connection::send_auth_request (const sockinfo &si, bool initiate)
583{
584 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
585
586 protocol = best_protocol (THISNODE->protocols & conf->protocols); 611 protocol = best_protocol (THISNODE->protocols & conf->protocols);
587 612
588 // mask out protocols we cannot establish 613 // mask out protocols we cannot establish
589 if (!conf->udp_port) protocol &= ~PROT_UDPv4; 614 if (!conf->udp_port) protocol &= ~PROT_UDPv4;
590 if (!conf->tcp_port) protocol &= ~PROT_TCPv4; 615 if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
591 616
592 if (protocol) 617 si.set (conf, protocol);
618}
619
620// ensure sockinfo is valid, forward if necessary
621const sockinfo &
622connection::forward_si (const sockinfo &si) const
623{
624 if (!si.valid ())
625 {
626 connection *r = vpn->find_router ();
627
628 if (r)
629 {
630 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"),
631 conf->nodename, r->conf->nodename);
632 return r->si;
633 }
634 else
635 slog (L_DEBUG, _("%s: node unreachable, no common protocol"),
636 conf->nodename);
593 { 637 }
594 rsachallenge chg;
595 638
596 rsa_cache.gen (pkt->id, chg); 639 return si;
640}
597 641
598 if (0 > RSA_public_encrypt (sizeof chg, 642void
599 (unsigned char *)&chg, (unsigned char *)&pkt->encr, 643connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
600 conf->rsa_key, RSA_PKCS1_OAEP_PADDING)) 644{
601 fatal ("RSA_public_encrypt error"); 645 if (!vpn->send_vpn_packet (pkt, si, tos))
646 reset_connection ();
647}
602 648
603 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 649void
650connection::send_ping (const sockinfo &si, u8 pong)
651{
652 ping_packet *pkt = new ping_packet;
604 653
605 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 654 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
655 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
656
657 delete pkt;
658}
659
660void
661connection::send_reset (const sockinfo &si)
662{
663 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
664 {
665 config_packet *pkt = new config_packet;
666
667 pkt->setup (vpn_packet::PT_RESET, conf->id);
668 send_vpn_packet (pkt, si, IPTOS_MINCOST);
606 669
607 delete pkt; 670 delete pkt;
608 } 671 }
609 else 672}
610 ; // silently fail 673
674void
675connection::send_auth_request (const sockinfo &si, bool initiate)
676{
677 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
678
679 rsachallenge chg;
680 rsa_cache.gen (pkt->id, chg);
681 rsa_encrypt (conf->rsa_key, chg, pkt->encr);
682
683 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
684
685 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
686
687 delete pkt;
611} 688}
612 689
613void 690void
614connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg) 691connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg)
615{ 692{
… …
643} 720}
644 721
645void 722void
646connection::establish_connection_cb (time_watcher &w) 723connection::establish_connection_cb (time_watcher &w)
647{ 724{
648 if (ictx || conf == THISNODE 725 if (!ictx
726 && conf != THISNODE
649 || connectmode == conf_node::C_NEVER 727 && connectmode != conf_node::C_NEVER
650 || connectmode == conf_node::C_DISABLED) 728 && connectmode != conf_node::C_DISABLED
651 w.at = TSTAMP_CANCEL; 729 && NOW > w.at)
652 else if (w.at <= NOW)
653 { 730 {
654 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6; 731 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;
655 732
656 if (retry_int < 3600 * 8) 733 if (retry_int < 3600 * 8)
657 retry_cnt++; 734 retry_cnt++;
658 735
659 w.at = NOW + retry_int; 736 w.start (NOW + retry_int);
660 737
661 if (conf->hostname) 738 reset_si ();
739
740 if (si.prot && !si.host)
741 vpn->send_connect_request (conf->id);
742 else
662 { 743 {
663 reset_dstaddr (); 744 const sockinfo &dsi = forward_si (si);
745
664 if (si.host && auth_rate_limiter.can (si)) 746 if (dsi.valid () && auth_rate_limiter.can (dsi))
665 { 747 {
666 if (retry_cnt < 4) 748 if (retry_cnt < 4)
667 send_auth_request (si, true); 749 send_auth_request (dsi, true);
668 else 750 else
669 send_ping (si, 0); 751 send_ping (dsi, 0);
670 } 752 }
671 } 753 }
672 else
673 vpn->connect_request (conf->id);
674 } 754 }
675} 755}
676 756
677void 757void
678connection::reset_connection () 758connection::reset_connection ()
… …
692 si.host= 0; 772 si.host= 0;
693 773
694 last_activity = 0; 774 last_activity = 0;
695 retry_cnt = 0; 775 retry_cnt = 0;
696 776
697 rekey.reset (); 777 rekey.stop ();
698 keepalive.reset (); 778 keepalive.stop ();
699 establish_connection.reset (); 779 establish_connection.stop ();
700} 780}
701 781
702void 782void
703connection::shutdown () 783connection::shutdown ()
704{ 784{
… …
709} 789}
710 790
711void 791void
712connection::rekey_cb (time_watcher &w) 792connection::rekey_cb (time_watcher &w)
713{ 793{
714 w.at = TSTAMP_CANCEL;
715
716 reset_connection (); 794 reset_connection ();
717 establish_connection (); 795 establish_connection ();
718} 796}
719 797
720void 798void
721connection::send_data_packet (tap_packet *pkt, bool broadcast) 799connection::send_data_packet (tap_packet *pkt)
722{ 800{
723 vpndata_packet *p = new vpndata_packet; 801 vpndata_packet *p = new vpndata_packet;
724 int tos = 0; 802 int tos = 0;
725 803
726 if (conf->inherit_tos 804 // I am not hilarious about peeking into packets, but so be it.
727 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 805 if (conf->inherit_tos && pkt->is_ipv4 ())
728 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
729 tos = (*pkt)[15] & IPTOS_TOS_MASK; 806 tos = (*pkt)[15] & IPTOS_TOS_MASK;
730 807
731 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 808 p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
732 send_vpn_packet (p, si, tos); 809 send_vpn_packet (p, si, tos);
733 810
734 delete p; 811 delete p;
735 812
736 if (oseqno > MAX_SEQNO) 813 if (oseqno > MAX_SEQNO)
737 rekey (); 814 rekey ();
738} 815}
739 816
740void 817void
741connection::inject_data_packet (tap_packet *pkt, bool broadcast) 818connection::inject_data_packet (tap_packet *pkt, bool broadcast/*TODO DDD*/)
742{ 819{
743 if (ictx && octx) 820 if (ictx && octx)
744 send_data_packet (pkt, broadcast); 821 send_data_packet (pkt);
745 else 822 else
746 { 823 {
747 if (!broadcast)//DDDD 824 if (!broadcast)//DDDD
748 queue.put (new tap_packet (*pkt)); 825 data_queue.put (new tap_packet (*pkt));
826
827 establish_connection ();
828 }
829}
830
831void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
832{
833 if (ictx && octx)
834 send_vpn_packet (pkt, si, tos);
835 else
836 {
837 vpn_queue.put (new vpn_packet (*pkt));
749 838
750 establish_connection (); 839 establish_connection ();
751 } 840 }
752} 841}
753 842
… …
812 if (p->initiate) 901 if (p->initiate)
813 send_auth_request (rsi, false); 902 send_auth_request (rsi, false);
814 903
815 rsachallenge k; 904 rsachallenge k;
816 905
817 if (0 > RSA_private_decrypt (sizeof (p->encr), 906 if (!rsa_decrypt (::conf.rsa_key, p->encr, k))
818 (unsigned char *)&p->encr, (unsigned char *)&k, 907 {
819 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
820 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 908 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
821 conf->nodename, (const char *)rsi); 909 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
910 break;
911 }
822 else 912 else
823 { 913 {
824 retry_cnt = 0;
825 establish_connection.set (NOW + 8); //? ;)
826 keepalive.reset ();
827 rekey.reset ();
828
829 delete ictx;
830 ictx = 0;
831
832 delete octx; 914 delete octx;
833 915
834 octx = new crypto_ctx (k, 1); 916 octx = new crypto_ctx (k, 1);
835 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 917 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
836 918
837 conf->protocols = p->protocols; 919 conf->protocols = p->protocols;
920
838 send_auth_response (rsi, p->id, k); 921 send_auth_response (rsi, p->id, k);
922
923 connection_established ();
839 924
840 break; 925 break;
841 } 926 }
842 } 927 }
928 else
929 slog (L_WARN, _("%s(%s): protocol mismatch"),
930 conf->nodename, (const char *)rsi);
843 931
844 send_reset (rsi); 932 send_reset (rsi);
845 } 933 }
846 934
847 break; 935 break;
… …
860 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 948 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
861 949
862 rsachallenge chg; 950 rsachallenge chg;
863 951
864 if (!rsa_cache.find (p->id, chg)) 952 if (!rsa_cache.find (p->id, chg))
953 {
865 slog (L_ERR, _("%s(%s): unrequested auth response"), 954 slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
866 conf->nodename, (const char *)rsi); 955 conf->nodename, (const char *)rsi);
956 break;
957 }
867 else 958 else
868 { 959 {
869 crypto_ctx *cctx = new crypto_ctx (chg, 0); 960 crypto_ctx *cctx = new crypto_ctx (chg, 0);
870 961
871 if (!p->hmac_chk (cctx)) 962 if (!p->hmac_chk (cctx))
963 {
872 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 964 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
873 "could be an attack, or just corruption or an synchronization error"), 965 "could be an attack, or just corruption or an synchronization error"),
874 conf->nodename, (const char *)rsi); 966 conf->nodename, (const char *)rsi);
967 break;
968 }
875 else 969 else
876 { 970 {
877 rsaresponse h; 971 rsaresponse h;
878 972
879 rsa_hash (p->id, chg, h); 973 rsa_hash (p->id, chg, h);
… …
885 delete ictx; ictx = cctx; 979 delete ictx; ictx = cctx;
886 980
887 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 981 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
888 982
889 si = rsi; 983 si = rsi;
984 protocol = rsi.prot;
890 985
891 rekey.set (NOW + ::conf.rekey); 986 connection_established ();
892 keepalive.set (NOW + ::conf.keepalive);
893 987
894 // send queued packets
895 while (tap_packet *p = queue.get ())
896 {
897 send_data_packet (p);
898 delete p;
899 }
900
901 connectmode = conf->connectmode;
902
903 slog (L_INFO, _("%s(%s): %s connection established, protocol version %d.%d"), 988 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
904 conf->nodename, (const char *)rsi, 989 conf->nodename, (const char *)rsi,
905 strprotocol (protocol),
906 p->prot_major, p->prot_minor); 990 p->prot_major, p->prot_minor);
907 991
908 if (::conf.script_node_up) 992 if (::conf.script_node_up)
909 run_script (run_script_cb (this, &connection::script_node_up), false); 993 run_script (run_script_cb (this, &connection::script_node_up), false);
910 994
… …
933 1017
934 if (ictx && octx) 1018 if (ictx && octx)
935 { 1019 {
936 vpndata_packet *p = (vpndata_packet *)pkt; 1020 vpndata_packet *p = (vpndata_packet *)pkt;
937 1021
938 if (rsi == si) 1022 if (!p->hmac_chk (ictx))
1023 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1024 "could be an attack, or just corruption or an synchronization error"),
1025 conf->nodename, (const char *)rsi);
1026 else
939 { 1027 {
940 if (!p->hmac_chk (ictx))
941 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
942 "could be an attack, or just corruption or an synchronization error"),
943 conf->nodename, (const char *)rsi);
944 else 1028 u32 seqno;
1029 tap_packet *d = p->unpack (this, seqno);
1030
1031 if (iseqno.recv_ok (seqno))
945 { 1032 {
946 u32 seqno; 1033 vpn->tap->send (d);
947 tap_packet *d = p->unpack (this, seqno);
948 1034
949 if (iseqno.recv_ok (seqno)) 1035 if (si != rsi)
950 { 1036 {
951 vpn->tap->send (d); 1037 // fast re-sync on connection changes, useful especially for tcp/ip
952
953 if (p->dst () == 0) // re-broadcast
954 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
955 {
956 connection *c = *i;
957
958 if (c->conf != THISNODE && c->conf != conf)
959 c->inject_data_packet (d);
960 }
961
962 delete d;
963
964 break; 1038 si = rsi;
1039
1040 slog (L_INFO, _("%s(%s): socket address changed to %s"),
1041 conf->nodename, (const char *)si, (const char *)rsi);
965 } 1042 }
1043
1044 delete d;
1045
1046 break;
966 } 1047 }
967 } 1048 }
968 else
969 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
970 } 1049 }
971 1050
972 send_reset (rsi); 1051 send_reset (rsi);
973 break; 1052 break;
974 1053
… …
976 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1055 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
977 { 1056 {
978 connect_req_packet *p = (connect_req_packet *) pkt; 1057 connect_req_packet *p = (connect_req_packet *) pkt;
979 1058
980 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1059 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1060 connection *c = vpn->conns[p->id - 1];
981 conf->protocols = p->protocols; 1061 conf->protocols = p->protocols;
982 connection *c = vpn->conns[p->id - 1];
983 1062
984 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n", 1063 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
985 conf->id, p->id, c->ictx && c->octx); 1064 conf->id, p->id, c->ictx && c->octx);
986 1065
987 if (c->ictx && c->octx) 1066 if (c->ictx && c->octx)
… …
989 // send connect_info packets to both sides, in case one is 1068 // send connect_info packets to both sides, in case one is
990 // behind a nat firewall (or both ;) 1069 // behind a nat firewall (or both ;)
991 c->send_connect_info (conf->id, si, conf->protocols); 1070 c->send_connect_info (conf->id, si, conf->protocols);
992 send_connect_info (c->conf->id, c->si, c->conf->protocols); 1071 send_connect_info (c->conf->id, c->si, c->conf->protocols);
993 } 1072 }
1073 else
1074 c->establish_connection ();
994 } 1075 }
995 1076
996 break; 1077 break;
997 1078
998 case vpn_packet::PT_CONNECT_INFO: 1079 case vpn_packet::PT_CONNECT_INFO:
999 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1080 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1000 { 1081 {
1001 connect_info_packet *p = (connect_info_packet *) pkt; 1082 connect_info_packet *p = (connect_info_packet *) pkt;
1002 1083
1003 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1084 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1004 conf->protocols = p->protocols; 1085
1005 connection *c = vpn->conns[p->id - 1]; 1086 connection *c = vpn->conns[p->id - 1];
1087
1088 c->conf->protocols = p->protocols;
1089 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1090 p->si.upgrade_protocol (protocol, c->conf);
1006 1091
1007 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1092 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1008 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1093 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1009 1094
1095 const sockinfo &dsi = forward_si (p->si);
1096
1097 if (dsi.valid ())
1010 c->send_auth_request (p->si, true); 1098 c->send_auth_request (dsi, true);
1011 } 1099 }
1012 1100
1013 break; 1101 break;
1014 1102
1015 default: 1103 default:
… …
1024 { 1112 {
1025 reset_connection (); 1113 reset_connection ();
1026 establish_connection (); 1114 establish_connection ();
1027 } 1115 }
1028 else if (NOW < last_activity + ::conf.keepalive) 1116 else if (NOW < last_activity + ::conf.keepalive)
1029 w.at = last_activity + ::conf.keepalive; 1117 w.start (last_activity + ::conf.keepalive);
1030 else if (conf->connectmode != conf_node::C_ONDEMAND 1118 else if (conf->connectmode != conf_node::C_ONDEMAND
1031 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1119 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1032 { 1120 {
1033 send_ping (si); 1121 send_ping (si);
1034 w.at = NOW + 5; 1122 w.start (NOW + 5);
1035 } 1123 }
1124 else if (NOW < last_activity + ::conf.keepalive + 10)
1125 // hold ondemand connections implicitly a few seconds longer
1126 // should delete octx, though, or something like that ;)
1127 w.start (last_activity + ::conf.keepalive + 10);
1036 else 1128 else
1037 reset_connection (); 1129 reset_connection ();
1038} 1130}
1039 1131
1040void connection::connect_request (int id) 1132void connection::send_connect_request (int id)
1041{ 1133{
1042 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1134 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1043 1135
1044 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1136 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);
1045 p->hmac_set (octx); 1137 p->hmac_set (octx);
… …
1075 putenv ("STATE=down"); 1167 putenv ("STATE=down");
1076 1168
1077 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1169 return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1078} 1170}
1079 1171
1080// send a vpn packet out to other hosts
1081void
1082connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1083{
1084 switch (protocol)
1085 {
1086 case PROT_IPv4:
1087 vpn->send_ipv4_packet (pkt, si, tos);
1088 break;
1089
1090 case PROT_UDPv4:
1091 vpn->send_udpv4_packet (pkt, si, tos);
1092 break;
1093
1094 case PROT_TCPv4:
1095 vpn->send_tcpv4_packet (pkt, si, tos);
1096 break;
1097 }
1098}
1099
1100connection::connection(struct vpn *vpn_) 1172connection::connection(struct vpn *vpn_)
1101: vpn(vpn_) 1173: vpn(vpn_)
1102, rekey (this, &connection::rekey_cb) 1174, rekey (this, &connection::rekey_cb)
1103, keepalive (this, &connection::keepalive_cb) 1175, keepalive (this, &connection::keepalive_cb)
1104, establish_connection (this, &connection::establish_connection_cb) 1176, establish_connection (this, &connection::establish_connection_cb)

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines