ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.26 by pcg, Sat Jan 17 14:08:57 2004 UTC vs.
Revision 1.30 by pcg, Thu Jan 29 19:22:05 2004 UTC

17 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 17 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
18*/ 18*/
19 19
20#include "config.h" 20#include "config.h"
21 21
22extern "C" {
23# include "lzf/lzf.h"
24}
25
26#include <cassert> 22#include <cassert>
27 23
28#include <list> 24#include <list>
29 25
30#include <openssl/rand.h> 26#include <openssl/rand.h>
46# define RAND_pseudo_bytes RAND_bytes 42# define RAND_pseudo_bytes RAND_bytes
47#endif 43#endif
48 44
49#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 45#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
50 46
47#define ULTRA_FAST 1
48#define HLOG 15
49#include "lzf/lzf.h"
50#include "lzf/lzf_c.c"
51#include "lzf/lzf_d.c"
52
51struct crypto_ctx 53struct crypto_ctx
52{ 54{
53 EVP_CIPHER_CTX cctx; 55 EVP_CIPHER_CTX cctx;
54 HMAC_CTX hctx; 56 HMAC_CTX hctx;
55 57
58}; 60};
59 61
60crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc) 62crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)
61{ 63{
62 EVP_CIPHER_CTX_init (&cctx); 64 EVP_CIPHER_CTX_init (&cctx);
63 EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc); 65 require (EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc));
64 HMAC_CTX_init (&hctx); 66 HMAC_CTX_init (&hctx);
65 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0); 67 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
66} 68}
67 69
68crypto_ctx::~crypto_ctx () 70crypto_ctx::~crypto_ctx ()
69{ 71{
70 EVP_CIPHER_CTX_cleanup (&cctx); 72 require (EVP_CIPHER_CTX_cleanup (&cctx));
71 HMAC_CTX_cleanup (&hctx); 73 HMAC_CTX_cleanup (&hctx);
72} 74}
73 75
74static void 76static void
75rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h) 77rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)
76{ 78{
77 EVP_MD_CTX ctx; 79 EVP_MD_CTX ctx;
78 80
79 EVP_MD_CTX_init (&ctx); 81 EVP_MD_CTX_init (&ctx);
80 EVP_DigestInit (&ctx, RSA_HASH); 82 require (EVP_DigestInit (&ctx, RSA_HASH));
81 EVP_DigestUpdate(&ctx, &chg, sizeof chg); 83 require (EVP_DigestUpdate(&ctx, &chg, sizeof chg));
82 EVP_DigestUpdate(&ctx, &id, sizeof id); 84 require (EVP_DigestUpdate(&ctx, &id, sizeof id));
83 EVP_DigestFinal (&ctx, (unsigned char *)&h, 0); 85 require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0));
84 EVP_MD_CTX_cleanup (&ctx); 86 EVP_MD_CTX_cleanup (&ctx);
85} 87}
86 88
87struct rsa_entry { 89struct rsa_entry {
88 tstamp expire; 90 tstamp expire;
310} 312}
311 313
312#define MAXVPNDATA (MAX_MTU - 6 - 6) 314#define MAXVPNDATA (MAX_MTU - 6 - 6)
313#define DATAHDR (sizeof (u32) + RAND_SIZE) 315#define DATAHDR (sizeof (u32) + RAND_SIZE)
314 316
315struct vpndata_packet:vpn_packet 317struct vpndata_packet : vpn_packet
316 { 318 {
317 u8 data[MAXVPNDATA + DATAHDR]; // seqno 319 u8 data[MAXVPNDATA + DATAHDR]; // seqno
318 320
319 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno); 321 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
320 tap_packet *unpack (connection *conn, u32 &seqno); 322 tap_packet *unpack (connection *conn, u32 &seqno);
347 d[0] = cl >> 8; 349 d[0] = cl >> 8;
348 d[1] = cl; 350 d[1] = cl;
349 } 351 }
350#endif 352#endif
351 353
352 EVP_EncryptInit_ex (cctx, 0, 0, 0, 0); 354 require (EVP_EncryptInit_ex (cctx, 0, 0, 0, 0));
353 355
354 struct { 356 struct {
355#if RAND_SIZE 357#if RAND_SIZE
356 u8 rnd[RAND_SIZE]; 358 u8 rnd[RAND_SIZE];
357#endif 359#endif
361 datahdr.seqno = ntohl (seqno); 363 datahdr.seqno = ntohl (seqno);
362#if RAND_SIZE 364#if RAND_SIZE
363 RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE); 365 RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);
364#endif 366#endif
365 367
366 EVP_EncryptUpdate (cctx, 368 require (EVP_EncryptUpdate (cctx,
367 (unsigned char *) data + outl, &outl2, 369 (unsigned char *) data + outl, &outl2,
368 (unsigned char *) &datahdr, DATAHDR); 370 (unsigned char *) &datahdr, DATAHDR));
369 outl += outl2; 371 outl += outl2;
370 372
371 EVP_EncryptUpdate (cctx, 373 require (EVP_EncryptUpdate (cctx,
372 (unsigned char *) data + outl, &outl2, 374 (unsigned char *) data + outl, &outl2,
373 (unsigned char *) d, l); 375 (unsigned char *) d, l));
374 outl += outl2; 376 outl += outl2;
375 377
376 EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2); 378 require (EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2));
377 outl += outl2; 379 outl += outl2;
378 380
379 len = outl + data_hdr_size (); 381 len = outl + data_hdr_size ();
380 382
381 set_hdr (type, dst); 383 set_hdr (type, dst);
390 int outl = 0, outl2; 392 int outl = 0, outl2;
391 tap_packet *p = new tap_packet; 393 tap_packet *p = new tap_packet;
392 u8 *d; 394 u8 *d;
393 u32 l = len - data_hdr_size (); 395 u32 l = len - data_hdr_size ();
394 396
395 EVP_DecryptInit_ex (cctx, 0, 0, 0, 0); 397 require (EVP_DecryptInit_ex (cctx, 0, 0, 0, 0));
396 398
397#if ENABLE_COMPRESSION 399#if ENABLE_COMPRESSION
398 u8 cdata[MAX_MTU]; 400 u8 cdata[MAX_MTU];
399 401
400 if (type == PT_DATA_COMPRESSED) 402 if (type == PT_DATA_COMPRESSED)
402 else 404 else
403#endif 405#endif
404 d = &(*p)[6 + 6 - DATAHDR]; 406 d = &(*p)[6 + 6 - DATAHDR];
405 407
406 /* this overwrites part of the src mac, but we fix that later */ 408 /* this overwrites part of the src mac, but we fix that later */
407 EVP_DecryptUpdate (cctx, 409 require (EVP_DecryptUpdate (cctx,
408 d, &outl2, 410 d, &outl2,
409 (unsigned char *)&data, len - data_hdr_size ()); 411 (unsigned char *)&data, len - data_hdr_size ()));
410 outl += outl2; 412 outl += outl2;
411 413
412 EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2); 414 require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2));
413 outl += outl2; 415 outl += outl2;
414 416
415 seqno = ntohl (*(u32 *)(d + RAND_SIZE)); 417 seqno = ntohl (*(u32 *)(d + RAND_SIZE));
416 418
417 id2mac (dst () ? dst() : THISNODE->id, p->dst); 419 id2mac (dst () ? dst() : THISNODE->id, p->dst);
504 506
505struct auth_req_packet : config_packet 507struct auth_req_packet : config_packet
506{ 508{
507 char magic[8]; 509 char magic[8];
508 u8 initiate; // false if this is just an automatic reply 510 u8 initiate; // false if this is just an automatic reply
509 u8 protocols; // supported protocols (will get patches on forward) 511 u8 protocols; // supported protocols (will be patched on forward)
510 u8 pad2, pad3; 512 u8 pad2, pad3;
511 rsaid id; 513 rsaid id;
512 rsaencrdata encr; 514 rsaencrdata encr;
513 515
514 auth_req_packet (int dst, bool initiate_, u8 protocols_) 516 auth_req_packet (int dst, bool initiate_, u8 protocols_)
832{ 834{
833 if (ictx && octx) 835 if (ictx && octx)
834 send_vpn_packet (pkt, si, tos); 836 send_vpn_packet (pkt, si, tos);
835 else 837 else
836 { 838 {
837 vpn_queue.put (new vpn_packet (*pkt)); 839 vpn_queue.put ((vpn_packet *)new data_packet (*(data_packet *)pkt));
838 840
839 establish_connection (); 841 establish_connection ();
840 } 842 }
841} 843}
842 844
960 crypto_ctx *cctx = new crypto_ctx (chg, 0); 962 crypto_ctx *cctx = new crypto_ctx (chg, 0);
961 963
962 if (!p->hmac_chk (cctx)) 964 if (!p->hmac_chk (cctx))
963 { 965 {
964 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 966 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
965 "could be an attack, or just corruption or an synchronization error"), 967 "could be an attack, or just corruption or a synchronization error"),
966 conf->nodename, (const char *)rsi); 968 conf->nodename, (const char *)rsi);
967 break; 969 break;
968 } 970 }
969 else 971 else
970 { 972 {
1019 { 1021 {
1020 vpndata_packet *p = (vpndata_packet *)pkt; 1022 vpndata_packet *p = (vpndata_packet *)pkt;
1021 1023
1022 if (!p->hmac_chk (ictx)) 1024 if (!p->hmac_chk (ictx))
1023 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1025 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1024 "could be an attack, or just corruption or an synchronization error"), 1026 "could be an attack, or just corruption or a synchronization error"),
1025 conf->nodename, (const char *)rsi); 1027 conf->nodename, (const char *)rsi);
1026 else 1028 else
1027 { 1029 {
1028 u32 seqno; 1030 u32 seqno;
1029 tap_packet *d = p->unpack (this, seqno); 1031 tap_packet *d = p->unpack (this, seqno);

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines