[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.36 by pcg, Sun May 30 17:36:00 2004 UTC vs.
Revision 1.49 by pcg, Sat Mar 12 18:10:40 2005 UTC

…		…
1	/*	1	/*
2	connection.C -- manage a single connection	2	connection.C -- manage a single connection
3	Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>	3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
4		4
		5	This file is part of GVPE.
		6
5	This program is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify
6	it under the terms of the GNU General Public License as published by	8	it under the terms of the GNU General Public License as published by
7	the Free Software Foundation; either version 2 of the License, or	9	the Free Software Foundation; either version 2 of the License, or
8	(at your option) any later version.	10	(at your option) any later version.
9		11
10	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful,
11	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	but WITHOUT ANY WARRANTY; without even the implied warranty of
12	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	GNU General Public License for more details.	15	GNU General Public License for more details.
14		16
15	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License
16	along with this program; if not, write to the Free Software	18	along with gvpe; if not, write to the Free Software
17	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
18	*/	20	*/
19		21
20	#include "config.h"	22	#include "config.h"
21		23
476	{	478	{
477	prot_major = PROTOCOL_MAJOR;	479	prot_major = PROTOCOL_MAJOR;
478	prot_minor = PROTOCOL_MINOR;	480	prot_minor = PROTOCOL_MINOR;
479	randsize = RAND_SIZE;	481	randsize = RAND_SIZE;
480	hmaclen = HMACLENGTH;	482	hmaclen = HMACLENGTH;
481	flags = ENABLE_COMPRESSION ? 0x81 : 0x80;	483	flags = 0;
482	challengelen = sizeof (rsachallenge);	484	challengelen = sizeof (rsachallenge);
483	features = get_features ();	485	features = get_features ();
484		486
485	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));	487	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
486	digest_nid = htonl (EVP_MD_type (RSA_HASH));	488	digest_nid = htonl (EVP_MD_type (RSA_HASH));
…		…
496	slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);	498	slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
497	else if (randsize != RAND_SIZE)	499	else if (randsize != RAND_SIZE)
498	slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);	500	slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
499	else if (hmaclen != HMACLENGTH)	501	else if (hmaclen != HMACLENGTH)
500	slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);	502	slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
501	#if 0 // this implementation should handle all flag settings
502	else if (flags != curflags ())
503	slog (L_WARN, _("flag mismatch (remote %x <=> local %x)"), flags, curflags ());
504	#endif
505	else if (challengelen != sizeof (rsachallenge))	503	else if (challengelen != sizeof (rsachallenge))
506	slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));	504	slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
507	else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))	505	else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
508	slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));	506	slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
509	else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))	507	else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
…		…
627	protocol = best_protocol (THISNODE->protocols & conf->protocols);	625	protocol = best_protocol (THISNODE->protocols & conf->protocols);
628		626
629	// mask out protocols we cannot establish	627	// mask out protocols we cannot establish
630	if (!conf->udp_port) protocol &= ~PROT_UDPv4;	628	if (!conf->udp_port) protocol &= ~PROT_UDPv4;
631	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;	629	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
		630	if (!conf->dns_port) protocol &= ~PROT_DNSv4;
632		631
633	si.set (conf, protocol);	632	si.set (conf, protocol);
634	}	633	}
635		634
636	// ensure sockinfo is valid, forward if necessary	635	// ensure sockinfo is valid, forward if necessary
…		…
641	{	640	{
642	connection *r = vpn->find_router ();	641	connection *r = vpn->find_router ();
643		642
644	if (r)	643	if (r)
645	{	644	{
646	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"),	645	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"),
647	conf->nodename, r->conf->nodename);	646	conf->nodename, r->conf->nodename, (const char *)r->si);
648	return r->si;	647	return r->si;
649	}	648	}
650	else	649	else
651	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),	650	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),
652	conf->nodename);	651	conf->nodename);
…		…
742	&& conf != THISNODE	741	&& conf != THISNODE
743	&& connectmode != conf_node::C_NEVER	742	&& connectmode != conf_node::C_NEVER
744	&& connectmode != conf_node::C_DISABLED	743	&& connectmode != conf_node::C_DISABLED
745	&& NOW > w.at)	744	&& NOW > w.at)
746	{	745	{
747	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;	746	w.at = TSTAMP_MAX; // first disable this watcher in case of recursion
748		747
749	if (retry_int < 3600 * 8)	748	double retry_int = double (retry_cnt & 3
750	retry_cnt++;	749	? (retry_cnt & 3) + 1
751		750	: 1 << (retry_cnt >> 2));
752	w.start (NOW + retry_int);
753		751
754	reset_si ();	752	reset_si ();
		753
		754	bool slow = si.prot & PROT_SLOW;
755		755
756	if (si.prot && !si.host)	756	if (si.prot && !si.host)
757	vpn->send_connect_request (conf->id);	757	vpn->send_connect_request (conf->id);
758	else	758	else
759	{	759	{
760	const sockinfo &dsi = forward_si (si);	760	const sockinfo &dsi = forward_si (si);
		761
		762	slow = slow \|\| (dsi.prot & PROT_SLOW);
761		763
762	if (dsi.valid () && auth_rate_limiter.can (dsi))	764	if (dsi.valid () && auth_rate_limiter.can (dsi))
763	{	765	{
764	if (retry_cnt < 4)	766	if (retry_cnt < 4)
765	send_auth_request (dsi, true);	767	send_auth_request (dsi, true);
766	else	768	else
767	send_ping (dsi, 0);	769	send_ping (dsi, 0);
768	}	770	}
769	}	771	}
		772
		773	retry_int *= slow ? 8. : 0.7;
		774
		775	if (retry_int < conf->max_retry)
		776	retry_cnt++;
		777	else
		778	retry_int = conf->max_retry;
		779
		780	w.start (NOW + retry_int);
770	}	781	}
771	}	782	}
772		783
773	void	784	void
774	connection::reset_connection ()	785	connection::reset_connection ()
…		…
782	run_script (run_script_cb (this, &connection::script_node_down), false);	793	run_script (run_script_cb (this, &connection::script_node_down), false);
783	}	794	}
784		795
785	delete ictx; ictx = 0;	796	delete ictx; ictx = 0;
786	delete octx; octx = 0;	797	delete octx; octx = 0;
		798	#if ENABLE_DNS
		799	dnsv4_reset_connection ();
		800	#endif
787		801
788	si.host= 0;	802	si.host = 0;
789		803
790	last_activity = 0;	804	last_activity = 0;
791	retry_cnt = 0;	805	retry_cnt = 0;
792		806
793	rekey.stop ();	807	rekey.stop ();
…		…
930	delete octx;	944	delete octx;
931		945
932	octx = new crypto_ctx (k, 1);	946	octx = new crypto_ctx (k, 1);
933	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;	947	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;
934		948
935	// compatibility code, remove when no longer required
936	if (p->flags & 1) p->features \|= FEATURE_COMPRESSION;
937
938	conf->protocols = p->protocols;	949	conf->protocols = p->protocols;
939	features = p->features & config_packet::get_features ();	950	features = p->features & config_packet::get_features ();
940		951
941	send_auth_response (rsi, p->id, k);	952	send_auth_response (rsi, p->id, k);
942		953
…		…
1096	break;	1107	break;
1097		1108
1098	case vpn_packet::PT_CONNECT_INFO:	1109	case vpn_packet::PT_CONNECT_INFO:
1099	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1110	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1100	{	1111	{
1101	connect_info_packet p = (connect_info_packet ) pkt;	1112	connect_info_packet p = (connect_info_packet )pkt;
1102		1113
1103	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1114	if (p->id > 0 && p->id <= vpn->conns.size ()) // hmac-auth does not mean we accept anything
1104		1115	{
1105	connection *c = vpn->conns[p->id - 1];	1116	connection *c = vpn->conns[p->id - 1];
1106		1117
1107	c->conf->protocols = p->protocols;	1118	c->conf->protocols = p->protocols;
1108	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));	1119	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1109	p->si.upgrade_protocol (protocol, c->conf);	1120	p->si.upgrade_protocol (protocol, c->conf);
1110		1121
1111	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1122	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1112	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1123	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1113		1124
1114	const sockinfo &dsi = forward_si (p->si);	1125	const sockinfo &dsi = forward_si (p->si);
1115		1126
1116	if (dsi.valid ())	1127	if (dsi.valid ())
1117	c->send_auth_request (dsi, true);	1128	c->send_auth_request (dsi, true);
		1129	}
1118	}	1130	}
1119		1131
1120	break;	1132	break;
1121		1133
1122	default:	1134	default:
…		…
1186	putenv ("STATE=down");	1198	putenv ("STATE=down");
1187		1199
1188	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";	1200	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1189	}	1201	}
1190		1202
1191	connection::connection(struct vpn *vpn_)	1203	connection::connection (struct vpn vpn, conf_node conf)
1192	: vpn(vpn_)	1204	: vpn(vpn), conf(conf)
1193	, rekey (this, &connection::rekey_cb)	1205	, rekey (this, &connection::rekey_cb)
1194	, keepalive (this, &connection::keepalive_cb)	1206	, keepalive (this, &connection::keepalive_cb)
1195	, establish_connection (this, &connection::establish_connection_cb)	1207	, establish_connection (this, &connection::establish_connection_cb)
		1208	#if ENABLE_DNS
		1209	, dns (0)
		1210	#endif
1196	{	1211	{
1197	octx = ictx = 0;	1212	octx = ictx = 0;
1198	retry_cnt = 0;	1213	retry_cnt = 0;
1199		1214
		1215	if (!conf->protocols) // make sure some protocol is enabled
		1216	conf->protocols = PROT_UDPv4;
		1217
1200	connectmode = conf_node::C_ALWAYS; // initial setting	1218	connectmode = conf_node::C_ALWAYS; // initial setting
1201	reset_connection ();	1219	reset_connection ();
1202	}	1220	}
1203		1221
1204	connection::~connection ()	1222	connection::~connection ()

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.36 by pcg, Sun May 30 17:36:00 2004 UTC vs. Revision 1.49 by pcg, Sat Mar 12 18:10:40 2005 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.36 by pcg, Sun May 30 17:36:00 2004 UTC vs.
Revision 1.49 by pcg, Sat Mar 12 18:10:40 2005 UTC