[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.24 by pcg, Wed Oct 22 01:05:23 2003 UTC vs.
Revision 1.35 by pcg, Mon May 10 21:24:48 2004 UTC

 /*
     connection.C -- manage a single connection
-    Copyright (C) 2003 Marc Lehmann <pcg@goof.com>
+    Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
     the Free Software Foundation; either version 2 of the License, or
     (at your option) any later version.
     Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #include "config.h"
-extern "C" {
+#include <cassert>
-# include "lzf/lzf.h"
-}
 #include <list>
 #include <openssl/rand.h>
 #include <openssl/evp.h>
 # define  RAND_pseudo_bytes RAND_bytes
 #endif
 #define MAGIC "vped\xbd\xc6\xdb\x82"	// 8 bytes of magic
+#define ULTRA_FAST 1
+#define HLOG 15
+#include "lzf/lzf.h"
+#include "lzf/lzf_c.c"
+#include "lzf/lzf_d.c"
 struct crypto_ctx
 {
   EVP_CIPHER_CTX cctx;
   HMAC_CTX hctx;
 };
 crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)
 {
   EVP_CIPHER_CTX_init (&cctx);
-  EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc);
+  require (EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc));
   HMAC_CTX_init (&hctx);
   HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
 }
 crypto_ctx::~crypto_ctx ()
 {
-  EVP_CIPHER_CTX_cleanup (&cctx);
+  require (EVP_CIPHER_CTX_cleanup (&cctx));
   HMAC_CTX_cleanup (&hctx);
 }
 static void
 rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)
 {
   EVP_MD_CTX ctx;
   EVP_MD_CTX_init (&ctx);
-  EVP_DigestInit (&ctx, RSA_HASH);
+  require (EVP_DigestInit (&ctx, RSA_HASH));
-  EVP_DigestUpdate(&ctx, &chg, sizeof chg);
+  require (EVP_DigestUpdate(&ctx, &chg, sizeof chg));
-  EVP_DigestUpdate(&ctx, &id, sizeof id);
+  require (EVP_DigestUpdate(&ctx, &id, sizeof id));
-  EVP_DigestFinal (&ctx, (unsigned char *)&h, 0);
+  require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0));
   EVP_MD_CTX_cleanup (&ctx);
 }
 struct rsa_entry {
   tstamp expire;
 } rsa_cache;
 void rsa_cache::cleaner_cb (time_watcher &w)
 {
-  if (empty ())
+  if (!empty ())
-    w.at = TSTAMP_CANCEL;
-  else
     {
-      w.at = NOW + RSA_TTL;
+      w.start (NOW + RSA_TTL);
       for (iterator i = begin (); i != end (); )
         if (i->expire <= NOW)
           i = erase (i);
         else
 // only do action once every x seconds per host whole allowing bursts.
 // this implementation ("splay list" ;) is inefficient,
 // but low on resources.
 struct net_rate_limiter : list<net_rateinfo>
 {
-  static const double ALPHA  = 1. - 1. / 600.; // allow bursts
+# define NRL_ALPHA  (1. - 1. / 600.)     // allow bursts
-  static const double CUTOFF = 10.;            // one event every CUTOFF seconds
+# define NRL_CUTOFF 10.                  // one event every CUTOFF seconds
-  static const double EXPIRE = CUTOFF * 30.;   // expire entries after this time
+# define NRL_EXPIRE (NRL_CUTOFF * 30.)   // expire entries after this time
-  static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value
+# define NRL_MAXDIF (NRL_CUTOFF * (1. / (1. - NRL_ALPHA))) // maximum diff /count value
   bool can (const sockinfo &si) { return can((u32)si.host); }
   bool can (u32 host);
 };
   iterator i;
   for (i = begin (); i != end (); )
     if (i->host == host)
       break;
-    else if (i->last < NOW - EXPIRE)
+    else if (i->last < NOW - NRL_EXPIRE)
       i = erase (i);
     else
       i++;
   if (i == end ())
     {
       net_rateinfo ri;
       ri.host = host;
       ri.pcnt = 1.;
-      ri.diff = MAXDIF;
+      ri.diff = NRL_MAXDIF;
       ri.last = NOW;
       push_front (ri);
       return true;
   else
     {
       net_rateinfo ri (*i);
       erase (i);
-      ri.pcnt = ri.pcnt * ALPHA;
+      ri.pcnt = ri.pcnt * NRL_ALPHA;
-      ri.diff = ri.diff * ALPHA + (NOW - ri.last);
+      ri.diff = ri.diff * NRL_ALPHA + (NOW - ri.last);
       ri.last = NOW;
       double dif = ri.diff / ri.pcnt;
-      bool send = dif > CUTOFF;
+      bool send = dif > NRL_CUTOFF;
-      if (dif > MAXDIF)
+      if (dif > NRL_MAXDIF)
         {
           ri.pcnt = 1.;
-          ri.diff = MAXDIF;
+          ri.diff = NRL_MAXDIF;
         }
       else if (send)
         ri.pcnt++;
       push_front (ri);
 }
 #define MAXVPNDATA (MAX_MTU - 6 - 6)
 #define DATAHDR (sizeof (u32) + RAND_SIZE)
-struct vpndata_packet:vpn_packet
+struct vpndata_packet : vpn_packet
   {
     u8 data[MAXVPNDATA + DATAHDR]; // seqno
     void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
     tap_packet *unpack (connection *conn, u32 &seqno);
   int outl = 0, outl2;
   ptype type = PT_DATA_UNCOMPRESSED;
 #if ENABLE_COMPRESSION
   u8 cdata[MAX_MTU];
-  u32 cl;
+  if (conn->features & ENABLE_COMPRESSION)
+    {
-  cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
+      u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
-  if (cl)
+      if (cl)
-    {
+        {
-      type = PT_DATA_COMPRESSED;
+          type = PT_DATA_COMPRESSED;
-      d = cdata;
+          d = cdata;
-      l = cl + 2;
+          l = cl + 2;
-      d[0] = cl >> 8;
+          d[0] = cl >> 8;
-      d[1] = cl;
+          d[1] = cl;
+        }
     }
 #endif
-  EVP_EncryptInit_ex (cctx, 0, 0, 0, 0);
+  require (EVP_EncryptInit_ex (cctx, 0, 0, 0, 0));
   struct {
 #if RAND_SIZE
     u8 rnd[RAND_SIZE];
 #endif
   datahdr.seqno = ntohl (seqno);
 #if RAND_SIZE
   RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);
 #endif
-  EVP_EncryptUpdate (cctx,
+  require (EVP_EncryptUpdate (cctx,
                      (unsigned char *) data + outl, &outl2,
-                     (unsigned char *) &datahdr, DATAHDR);
+                     (unsigned char *) &datahdr, DATAHDR));
   outl += outl2;
-  EVP_EncryptUpdate (cctx,
+  require (EVP_EncryptUpdate (cctx,
                      (unsigned char *) data + outl, &outl2,
-                     (unsigned char *) d, l);
+                     (unsigned char *) d, l));
   outl += outl2;
-  EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2);
+  require (EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2));
   outl += outl2;
   len = outl + data_hdr_size ();
   set_hdr (type, dst);
   int outl = 0, outl2;
   tap_packet *p = new tap_packet;
   u8 *d;
   u32 l = len - data_hdr_size ();
-  EVP_DecryptInit_ex (cctx, 0, 0, 0, 0);
+  require (EVP_DecryptInit_ex (cctx, 0, 0, 0, 0));
 #if ENABLE_COMPRESSION
   u8 cdata[MAX_MTU];
   if (type == PT_DATA_COMPRESSED)
   else
 #endif
     d = &(*p)[6 + 6 - DATAHDR];
   /* this overwrites part of the src mac, but we fix that later */
-  EVP_DecryptUpdate (cctx,
+  require (EVP_DecryptUpdate (cctx,
                      d, &outl2,
-                     (unsigned char *)&data, len - data_hdr_size ());
+                     (unsigned char *)&data, len - data_hdr_size ()));
   outl += outl2;
-  EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2);
+  require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2));
   outl += outl2;
   seqno = ntohl (*(u32 *)(d + RAND_SIZE));
   id2mac (dst () ? dst() : THISNODE->id, p->dst);
 {
   // actually, hmaclen cannot be checked because the hmac
   // field comes before this data, so peers with other
   // hmacs simply will not work.
   u8 prot_major, prot_minor, randsize, hmaclen;
-  u8 flags, challengelen, pad2, pad3;
+  u8 flags, challengelen, features, pad3;
   u32 cipher_nid, digest_nid, hmac_nid;
-  const u8 curflags () const
-  {
-    return 0x80
-           | (ENABLE_COMPRESSION ? 0x01 : 0x00);
-  }
   void setup (ptype type, int dst);
   bool chk_config () const;
+  static u8 get_features ()
+  {
+    u8 f = 0;
+#if ENABLE_COMPRESSION
+    f |= FEATURE_COMPRESSION;
+#endif
+#if ENABLE_ROHC
+    f |= FEATURE_ROHC;
+#endif
+    return f;
+  }
 };
 void config_packet::setup (ptype type, int dst)
 {
   prot_major = PROTOCOL_MAJOR;
   prot_minor = PROTOCOL_MINOR;
   randsize = RAND_SIZE;
   hmaclen = HMACLENGTH;
-  flags = curflags ();
+  flags = ENABLE_COMPRESSION ? 0x81 : 0x80;
   challengelen = sizeof (rsachallenge);
+  features = get_features ();
   cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
   digest_nid = htonl (EVP_MD_type (RSA_HASH));
   hmac_nid   = htonl (EVP_MD_type (DIGEST));
     slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
   else if (randsize != RAND_SIZE)
     slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
   else if (hmaclen != HMACLENGTH)
     slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
+#if 0 // this implementation should handle all flag settings
   else if (flags != curflags ())
     slog (L_WARN, _("flag mismatch (remote %x <=> local %x)"), flags, curflags ());
+#endif
   else if (challengelen != sizeof (rsachallenge))
     slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
   else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
     slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
   else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
 struct auth_req_packet : config_packet
 {
   char magic[8];
   u8 initiate; // false if this is just an automatic reply
-  u8 protocols; // supported protocols (will get patches on forward)
+  u8 protocols; // supported protocols (will be patched on forward)
   u8 pad2, pad3;
   rsaid id;
   rsaencrdata encr;
   auth_req_packet (int dst, bool initiate_, u8 protocols_)
     }
   else
     {
       retry_cnt = 0;
       establish_connection.start (NOW + 5);
-      keepalive.reset ();
+      keepalive.stop ();
-      rekey.reset ();
+      rekey.stop ();
     }
 }
 void
 connection::reset_si ()
 }
 void
 connection::establish_connection_cb (time_watcher &w)
 {
-  if (ictx || conf == THISNODE
+  if (!ictx
+      && conf != THISNODE
-      || connectmode == conf_node::C_NEVER
+      && connectmode != conf_node::C_NEVER
-      || connectmode == conf_node::C_DISABLED)
+      && connectmode != conf_node::C_DISABLED
-    w.at = TSTAMP_CANCEL;
+      && NOW > w.at)
-  else if (w.at <= NOW)
     {
       double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;
       if (retry_int < 3600 * 8)
         retry_cnt++;
-      w.at = NOW + retry_int;
+      w.start (NOW + retry_int);
       reset_si ();
       if (si.prot && !si.host)
         vpn->send_connect_request (conf->id);
   si.host= 0;
   last_activity = 0;
   retry_cnt = 0;
-  rekey.reset ();
+  rekey.stop ();
-  keepalive.reset ();
+  keepalive.stop ();
-  establish_connection.reset ();
+  establish_connection.stop ();
 }
 void
 connection::shutdown ()
 {
 }
 void
 connection::rekey_cb (time_watcher &w)
 {
-  w.at = TSTAMP_CANCEL;
   reset_connection ();
   establish_connection ();
 }
 void
 {
   if (ictx && octx)
     send_vpn_packet (pkt, si, tos);
   else
     {
-      vpn_queue.put (new vpn_packet (*pkt));
+      vpn_queue.put ((vpn_packet *)new data_packet (*(data_packet *)pkt));
       establish_connection ();
     }
 }
                     delete octx;
                     octx   = new crypto_ctx (k, 1);
                     oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
+                    // compatibility code, remove when no longer required
+                    if (p->flags & 1) p->features |= FEATURE_COMPRESSION;
                     conf->protocols = p->protocols;
+                    features = p->features & config_packet::get_features ();
                     send_auth_response (rsi, p->id, k);
                     connection_established ();
                   crypto_ctx *cctx = new crypto_ctx (chg, 0);
                   if (!p->hmac_chk (cctx))
                     {
                       slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
-                                     "could be an attack, or just corruption or an synchronization error"),
+                                     "could be an attack, or just corruption or a synchronization error"),
                             conf->nodename, (const char *)rsi);
                       break;
                     }
                   else
                     {
           {
             vpndata_packet *p = (vpndata_packet *)pkt;
             if (!p->hmac_chk (ictx))
               slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
-                             "could be an attack, or just corruption or an synchronization error"),
+                             "could be an attack, or just corruption or a synchronization error"),
                     conf->nodename, (const char *)rsi);
             else
               {
                 u32 seqno;
                 tap_packet *d = p->unpack (this, seqno);
                         si = rsi;
                         slog (L_INFO, _("%s(%s): socket address changed to %s"),
                               conf->nodename, (const char *)si, (const char *)rsi);
                       }
-                    delete d;
-                    break;
                   }
+                delete d;
+                break;
               }
           }
         send_reset (rsi);
         break;
     {
       reset_connection ();
       establish_connection ();
     }
   else if (NOW < last_activity + ::conf.keepalive)
-    w.at = last_activity + ::conf.keepalive;
+    w.start (last_activity + ::conf.keepalive);
   else if (conf->connectmode != conf_node::C_ONDEMAND
            || THISNODE->connectmode != conf_node::C_ONDEMAND)
     {
       send_ping (si);
-      w.at = NOW + 5;
+      w.start (NOW + 5);
     }
   else if (NOW < last_activity + ::conf.keepalive + 10)
     // hold ondemand connections implicitly a few seconds longer
     // should delete octx, though, or something like that ;)
-    w.at = last_activity + ::conf.keepalive + 10;
+    w.start (last_activity + ::conf.keepalive + 10);
   else
     reset_connection ();
 }
 void connection::send_connect_request (int id)

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.24 by pcg, Wed Oct 22 01:05:23 2003 UTC vs. Revision 1.35 by pcg, Mon May 10 21:24:48 2004 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.24 by pcg, Wed Oct 22 01:05:23 2003 UTC vs.
Revision 1.35 by pcg, Mon May 10 21:24:48 2004 UTC