ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.44 by pcg, Fri Mar 4 08:15:04 2005 UTC vs.
Revision 1.98 by root, Tue Jul 16 16:44:36 2013 UTC

1/* 1/*
2 connection.C -- manage a single connection 2 connection.C -- manage a single connection
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <cassert>
25
26#include <list> 34#include <list>
35#include <queue>
36#include <utility>
27 37
28#include <openssl/rand.h> 38#include <openssl/rand.h>
29#include <openssl/evp.h> 39#include <openssl/evp.h>
30#include <openssl/rsa.h> 40#include <openssl/rsa.h>
31#include <openssl/err.h> 41#include <openssl/err.h>
32
33#include "gettext.h"
34 42
35#include "conf.h" 43#include "conf.h"
36#include "slog.h" 44#include "slog.h"
37#include "device.h" 45#include "device.h"
38#include "vpn.h" 46#include "vpn.h"
39#include "connection.h" 47#include "connection.h"
48#include "hkdf.h"
40 49
41#include "netcompat.h" 50#include "netcompat.h"
42 51
43#if !HAVE_RAND_PSEUDO_BYTES
44# define RAND_pseudo_bytes RAND_bytes
45#endif
46
47#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 52#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic
48 53
49#define ULTRA_FAST 1 54#define ULTRA_FAST 1
50#define HLOG 15 55#define HLOG 15
51#include "lzf/lzf.h" 56#include "lzf/lzf.h"
52#include "lzf/lzf_c.c" 57#include "lzf/lzf_c.c"
53#include "lzf/lzf_d.c" 58#include "lzf/lzf_d.c"
54 59
60//////////////////////////////////////////////////////////////////////////////
61
62static std::queue< std::pair<run_script_cb *, const char *> > rs_queue;
63static ev::child rs_child_ev;
64
65namespace
66{
67 void // c++ requires external linkage here, apparently :(
68 rs_child_cb (ev::child &w, int revents)
69 {
70 w.stop ();
71
72 if (rs_queue.empty ())
73 return;
74
75 pid_t pid = run_script (*rs_queue.front ().first, false);
76 if (pid)
77 {
78 w.set (pid);
79 w.start ();
80 }
81 else
82 slog (L_WARN, rs_queue.front ().second);
83
84 delete rs_queue.front ().first;
85 rs_queue.pop ();
86 }
87};
88
89// despite the fancy name, this is quite a hack
90static void
91run_script_queued (run_script_cb *cb, const char *warnmsg)
92{
93 rs_queue.push (std::make_pair (cb, warnmsg));
94
95 if (!rs_child_ev.is_active ())
96 {
97 rs_child_ev.set<rs_child_cb> ();
98 rs_child_ev ();
99 }
100}
101
102//////////////////////////////////////////////////////////////////////////////
103
55struct crypto_ctx 104struct crypto_ctx
56{ 105{
57 EVP_CIPHER_CTX cctx; 106 EVP_CIPHER_CTX cctx;
58 HMAC_CTX hctx; 107 HMAC_CTX hctx;
59 108
60 crypto_ctx (const rsachallenge &challenge, int enc); 109 crypto_ctx (const auth_data &auth1, const auth_data &auth2, const ecdh_key &a, const ecdh_key &b, int enc);
61 ~crypto_ctx (); 110 ~crypto_ctx ();
62}; 111};
63 112
64crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc) 113crypto_ctx::crypto_ctx (const auth_data &auth1, const auth_data &auth2, const ecdh_key &a, const ecdh_key &b, int enc)
65{ 114{
115 ecdh_key s;
116
117 curve25519_combine (a, b, s);
118
119 {
120 u8 mac_key[MAC_KEYSIZE];
121 static const unsigned char mac_info[] = "gvpe mac key";
122
123 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt));
124 kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
125 kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key));
126 kdf.extract (s, sizeof (s));
127 kdf.extract_done ();
128 kdf.expand (mac_key, sizeof (mac_key), mac_info, sizeof (mac_info));
129
130 HMAC_CTX_init (&hctx);
131 require (HMAC_Init_ex (&hctx, mac_key, MAC_KEYSIZE, MAC_DIGEST (), 0));
132 }
133
134 {
135 u8 cipher_key[CIPHER_KEYSIZE];
136 static const unsigned char cipher_info[] = "gvpe cipher key";
137
138 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt));
139 kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
140 kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key));
141 kdf.extract (s, sizeof (s));
142 kdf.extract_done ();
143 kdf.expand (cipher_key, sizeof (cipher_key), cipher_info, sizeof (cipher_info));
144
66 EVP_CIPHER_CTX_init (&cctx); 145 EVP_CIPHER_CTX_init (&cctx);
67 require (EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc)); 146 require (EVP_CipherInit_ex (&cctx, CIPHER (), 0, cipher_key, 0, enc));
68 HMAC_CTX_init (&hctx); 147 }
69 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
70} 148}
71 149
72crypto_ctx::~crypto_ctx () 150crypto_ctx::~crypto_ctx ()
73{ 151{
74 require (EVP_CIPHER_CTX_cleanup (&cctx)); 152 require (EVP_CIPHER_CTX_cleanup (&cctx));
75 HMAC_CTX_cleanup (&hctx); 153 HMAC_CTX_cleanup (&hctx);
76} 154}
77 155
156static inline void
157auth_encrypt (RSA *key, const auth_data &auth, auth_encr &encr)
158{
159 if (RSA_public_encrypt (sizeof (auth.rsa),
160 (unsigned char *)&auth.rsa, (unsigned char *)&encr.rsa,
161 key, RSA_PKCS1_OAEP_PADDING) < 0)
162 fatal ("RSA_public_encrypt error");
163}
164
165static inline bool
166auth_decrypt (RSA *key, const auth_encr &encr, auth_data &auth)
167{
168 u8 rsa_decrypt[RSA_KEYLEN];
169
170 if (RSA_private_decrypt (sizeof (encr.rsa),
171 (const unsigned char *)&encr.rsa, (unsigned char *)rsa_decrypt,
172 key, RSA_PKCS1_OAEP_PADDING) != sizeof (auth.rsa))
173 return 0;
174
175 memcpy (&auth.rsa, rsa_decrypt, sizeof (auth.rsa));
176
177 return 1;
178}
179
78static void 180static void
79rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h) 181auth_hash (const auth_data &auth, auth_mac &mac)
80{ 182{
81 EVP_MD_CTX ctx; 183 HMAC_CTX ctx;
82 184
83 EVP_MD_CTX_init (&ctx); 185 HMAC_CTX_init (&ctx);
84 require (EVP_DigestInit (&ctx, RSA_HASH)); 186 require (HMAC_Init_ex (&ctx, auth.rsa.auth_key, sizeof (auth.rsa.auth_key), AUTH_DIGEST (), 0));
85 require (EVP_DigestUpdate(&ctx, &chg, sizeof chg)); 187 require (HMAC_Update (&ctx, (const unsigned char *)&auth, sizeof auth));
86 require (EVP_DigestUpdate(&ctx, &id, sizeof id));
87 require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0)); 188 require (HMAC_Final (&ctx, (unsigned char *)&mac, 0));
88 EVP_MD_CTX_cleanup (&ctx); 189 HMAC_CTX_cleanup (&ctx);
89} 190}
90 191
91struct rsa_entry { 192void
92 tstamp expire; 193connection::generate_auth_data ()
93 rsaid id;
94 rsachallenge chg;
95};
96
97struct rsa_cache : list<rsa_entry>
98{ 194{
99 void cleaner_cb (time_watcher &w); time_watcher cleaner; 195 if (auth_expire < ev_now ())
100
101 bool find (const rsaid &id, rsachallenge &chg)
102 {
103 for (iterator i = begin (); i != end (); ++i)
104 {
105 if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW)
106 {
107 memcpy (&chg, &i->chg, sizeof chg);
108
109 erase (i);
110 return true;
111 }
112 }
113
114 if (cleaner.at < NOW)
115 cleaner.start (NOW + RSA_TTL);
116
117 return false;
118 }
119
120 void gen (rsaid &id, rsachallenge &chg)
121 {
122 rsa_entry e;
123
124 RAND_bytes ((unsigned char *)&id, sizeof id);
125 RAND_bytes ((unsigned char *)&chg, sizeof chg);
126
127 e.expire = NOW + RSA_TTL;
128 e.id = id;
129 memcpy (&e.chg, &chg, sizeof chg);
130
131 push_back (e);
132
133 if (cleaner.at < NOW)
134 cleaner.start (NOW + RSA_TTL);
135 }
136
137 rsa_cache ()
138 : cleaner (this, &rsa_cache::cleaner_cb)
139 { } 196 {
197 // request data
198 RAND_pseudo_bytes ((unsigned char *)&snd_auth.rsa, sizeof snd_auth.rsa);
199 curve25519_generate (snd_ecdh_a, snd_auth.ecdh);
200 auth_hash (snd_auth, snd_auth_mac);
140 201
141} rsa_cache; 202 // eventual response data
142 203 curve25519_generate (rcv_ecdh_a, rcv_ecdh_b);
143void rsa_cache::cleaner_cb (time_watcher &w)
144{
145 if (!empty ())
146 { 204 }
147 w.start (NOW + RSA_TTL);
148 205
149 for (iterator i = begin (); i != end (); ) 206 // every use prolongs the expiry
150 if (i->expire <= NOW) 207 auth_expire = ev_now () + AUTH_TTL;
151 i = erase (i);
152 else
153 ++i;
154 }
155} 208}
156 209
157////////////////////////////////////////////////////////////////////////////// 210//////////////////////////////////////////////////////////////////////////////
158 211
159void pkt_queue::put (net_packet *p) 212pkt_queue::pkt_queue (double max_ttl, int max_queue)
213: max_ttl (max_ttl), max_queue (max_queue)
160{ 214{
161 if (queue[i]) 215 queue = new pkt [max_queue];
162 {
163 delete queue[i];
164 j = (j + 1) % QUEUEDEPTH;
165 }
166 216
167 queue[i] = p;
168
169 i = (i + 1) % QUEUEDEPTH;
170}
171
172net_packet *pkt_queue::get ()
173{
174 net_packet *p = queue[j];
175
176 if (p)
177 {
178 queue[j] = 0;
179 j = (j + 1) % QUEUEDEPTH;
180 }
181
182 return p;
183}
184
185pkt_queue::pkt_queue ()
186{
187 memset (queue, 0, sizeof (queue));
188 i = 0; 217 i = 0;
189 j = 0; 218 j = 0;
219
220 expire.set<pkt_queue, &pkt_queue::expire_cb> (this);
190} 221}
191 222
192pkt_queue::~pkt_queue () 223pkt_queue::~pkt_queue ()
193{ 224{
194 for (i = QUEUEDEPTH; --i > 0; ) 225 while (net_packet *p = get ())
226 delete p;
227
195 delete queue[i]; 228 delete [] queue;
196} 229}
197 230
231void
232pkt_queue::expire_cb (ev::timer &w, int revents)
233{
234 ev_tstamp expire = ev_now () - max_ttl;
235
236 for (;;)
237 {
238 if (empty ())
239 break;
240
241 double diff = queue[j].tstamp - expire;
242
243 if (diff >= 0.)
244 {
245 w.start (diff > 0.5 ? diff : 0.5);
246 break;
247 }
248
249 delete get ();
250 }
251}
252
253void
254pkt_queue::put (net_packet *p)
255{
256 ev_tstamp now = ev_now ();
257
258 // start expiry timer
259 if (empty ())
260 expire.start (max_ttl);
261
262 int ni = i + 1 == max_queue ? 0 : i + 1;
263
264 if (ni == j)
265 delete get ();
266
267 queue[i].pkt = p;
268 queue[i].tstamp = now;
269
270 i = ni;
271}
272
273net_packet *
274pkt_queue::get ()
275{
276 if (empty ())
277 return 0;
278
279 net_packet *p = queue[j].pkt;
280 queue[j].pkt = 0;
281
282 j = j + 1 == max_queue ? 0 : j + 1;
283
284 return p;
285}
286
198struct net_rateinfo { 287struct net_rateinfo
288{
199 u32 host; 289 u32 host;
200 double pcnt, diff; 290 double pcnt, diff;
201 tstamp last; 291 tstamp last;
202}; 292};
203 293
… …
213 303
214 bool can (const sockinfo &si) { return can((u32)si.host); } 304 bool can (const sockinfo &si) { return can((u32)si.host); }
215 bool can (u32 host); 305 bool can (u32 host);
216}; 306};
217 307
218net_rate_limiter auth_rate_limiter, reset_rate_limiter; 308static net_rate_limiter auth_rate_limiter, reset_rate_limiter;
219 309
310bool
220bool net_rate_limiter::can (u32 host) 311net_rate_limiter::can (u32 host)
221{ 312{
222 iterator i; 313 iterator i;
223 314
224 for (i = begin (); i != end (); ) 315 for (i = begin (); i != end (); )
225 if (i->host == host) 316 if (i->host == host)
226 break; 317 break;
227 else if (i->last < NOW - NRL_EXPIRE) 318 else if (i->last < ev_now () - NRL_EXPIRE)
228 i = erase (i); 319 i = erase (i);
229 else 320 else
230 i++; 321 i++;
231 322
232 if (i == end ()) 323 if (i == end ())
… …
234 net_rateinfo ri; 325 net_rateinfo ri;
235 326
236 ri.host = host; 327 ri.host = host;
237 ri.pcnt = 1.; 328 ri.pcnt = 1.;
238 ri.diff = NRL_MAXDIF; 329 ri.diff = NRL_MAXDIF;
239 ri.last = NOW; 330 ri.last = ev_now ();
240 331
241 push_front (ri); 332 push_front (ri);
242 333
243 return true; 334 return true;
244 } 335 }
… …
246 { 337 {
247 net_rateinfo ri (*i); 338 net_rateinfo ri (*i);
248 erase (i); 339 erase (i);
249 340
250 ri.pcnt = ri.pcnt * NRL_ALPHA; 341 ri.pcnt = ri.pcnt * NRL_ALPHA;
251 ri.diff = ri.diff * NRL_ALPHA + (NOW - ri.last); 342 ri.diff = ri.diff * NRL_ALPHA + (ev_now () - ri.last);
252 343
253 ri.last = NOW; 344 ri.last = ev_now ();
254 345
255 double dif = ri.diff / ri.pcnt; 346 double dif = ri.diff / ri.pcnt;
256 347
257 bool send = dif > NRL_CUTOFF; 348 bool send = dif > NRL_CUTOFF;
258 349
… …
272 363
273///////////////////////////////////////////////////////////////////////////// 364/////////////////////////////////////////////////////////////////////////////
274 365
275unsigned char hmac_packet::hmac_digest[EVP_MAX_MD_SIZE]; 366unsigned char hmac_packet::hmac_digest[EVP_MAX_MD_SIZE];
276 367
368void
277void hmac_packet::hmac_gen (crypto_ctx *ctx) 369hmac_packet::hmac_gen (crypto_ctx *ctx)
278{ 370{
279 unsigned int xlen; 371 unsigned int xlen;
280 372
281 HMAC_CTX *hctx = &ctx->hctx; 373 HMAC_CTX *hctx = &ctx->hctx;
282 374
283 HMAC_Init_ex (hctx, 0, 0, 0, 0); 375 require (HMAC_Init_ex (hctx, 0, 0, 0, 0));
284 HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet), 376 require (HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet),
285 len - sizeof (hmac_packet)); 377 len - sizeof (hmac_packet)));
286 HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen); 378 require (HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen));
287} 379}
288 380
289void 381void
290hmac_packet::hmac_set (crypto_ctx *ctx) 382hmac_packet::hmac_set (crypto_ctx *ctx)
291{ 383{
… …
300 hmac_gen (ctx); 392 hmac_gen (ctx);
301 393
302 return !memcmp (hmac, hmac_digest, HMACLENGTH); 394 return !memcmp (hmac, hmac_digest, HMACLENGTH);
303} 395}
304 396
397void
305void vpn_packet::set_hdr (ptype type_, unsigned int dst) 398vpn_packet::set_hdr (ptype type_, unsigned int dst)
306{ 399{
307 type = type_; 400 type = type_;
308 401
309 int src = THISNODE->id; 402 int src = THISNODE->id;
310 403
… …
315 408
316#define MAXVPNDATA (MAX_MTU - 6 - 6) 409#define MAXVPNDATA (MAX_MTU - 6 - 6)
317#define DATAHDR (sizeof (u32) + RAND_SIZE) 410#define DATAHDR (sizeof (u32) + RAND_SIZE)
318 411
319struct vpndata_packet : vpn_packet 412struct vpndata_packet : vpn_packet
413{
414 u8 data[MAXVPNDATA + DATAHDR]; // seqno
415
416 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
417 tap_packet *unpack (connection *conn, u32 &seqno);
418
419private:
420 const u32 data_hdr_size () const
320 { 421 {
321 u8 data[MAXVPNDATA + DATAHDR]; // seqno
322
323 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
324 tap_packet *unpack (connection *conn, u32 &seqno);
325private:
326
327 const u32 data_hdr_size () const
328 {
329 return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR; 422 return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR;
330 }
331 }; 423 }
424};
332 425
333void 426void
334vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno) 427vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno)
335{ 428{
336 EVP_CIPHER_CTX *cctx = &conn->octx->cctx; 429 EVP_CIPHER_CTX *cctx = &conn->octx->cctx;
… …
338 ptype type = PT_DATA_UNCOMPRESSED; 431 ptype type = PT_DATA_UNCOMPRESSED;
339 432
340#if ENABLE_COMPRESSION 433#if ENABLE_COMPRESSION
341 u8 cdata[MAX_MTU]; 434 u8 cdata[MAX_MTU];
342 435
343 if (conn->features & ENABLE_COMPRESSION) 436 if (conn->features & FEATURE_COMPRESSION)
344 { 437 {
345 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7); 438 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
346 439
347 if (cl) 440 if (cl)
348 { 441 {
… …
354 d[1] = cl; 447 d[1] = cl;
355 } 448 }
356 } 449 }
357#endif 450#endif
358 451
359 require (EVP_EncryptInit_ex (cctx, 0, 0, 0, 0)); 452 require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 1));
360 453
361 struct { 454 struct {
362#if RAND_SIZE 455#if RAND_SIZE
363 u8 rnd[RAND_SIZE]; 456 u8 rnd[RAND_SIZE];
364#endif 457#endif
… …
397 int outl = 0, outl2; 490 int outl = 0, outl2;
398 tap_packet *p = new tap_packet; 491 tap_packet *p = new tap_packet;
399 u8 *d; 492 u8 *d;
400 u32 l = len - data_hdr_size (); 493 u32 l = len - data_hdr_size ();
401 494
402 require (EVP_DecryptInit_ex (cctx, 0, 0, 0, 0)); 495 require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 0));
403 496
404#if ENABLE_COMPRESSION 497#if ENABLE_COMPRESSION
405 u8 cdata[MAX_MTU]; 498 u8 cdata[MAX_MTU];
406 499
407 if (type == PT_DATA_COMPRESSED) 500 if (type == PT_DATA_COMPRESSED)
… …
449 } 542 }
450}; 543};
451 544
452struct config_packet : vpn_packet 545struct config_packet : vpn_packet
453{ 546{
454 // actually, hmaclen cannot be checked because the hmac
455 // field comes before this data, so peers with other
456 // hmacs simply will not work.
457 u8 prot_major, prot_minor, randsize, hmaclen; 547 u8 prot_major, prot_minor, randsize;
458 u8 flags, challengelen, features, pad3; 548 u8 flags, features, pad6, pad7, pad8;
459 u32 cipher_nid, digest_nid, hmac_nid; 549 u32 cipher_nid, mac_nid, auth_nid;
460 550
461 void setup (ptype type, int dst); 551 void setup (ptype type, int dst);
462 bool chk_config () const; 552 bool chk_config () const;
463 553
464 static u8 get_features () 554 static u8 get_features ()
… …
468 f |= FEATURE_COMPRESSION; 558 f |= FEATURE_COMPRESSION;
469#endif 559#endif
470#if ENABLE_ROHC 560#if ENABLE_ROHC
471 f |= FEATURE_ROHC; 561 f |= FEATURE_ROHC;
472#endif 562#endif
563#if ENABLE_BRIDGING
564 f |= FEATURE_BRIDGING;
565#endif
473 return f; 566 return f;
474 } 567 }
475}; 568};
476 569
570void
477void config_packet::setup (ptype type, int dst) 571config_packet::setup (ptype type, int dst)
478{ 572{
479 prot_major = PROTOCOL_MAJOR; 573 prot_major = PROTOCOL_MAJOR;
480 prot_minor = PROTOCOL_MINOR; 574 prot_minor = PROTOCOL_MINOR;
481 randsize = RAND_SIZE; 575 randsize = RAND_SIZE;
482 hmaclen = HMACLENGTH; 576 flags = 0;
483 flags = ENABLE_COMPRESSION ? 0x81 : 0x80;
484 challengelen = sizeof (rsachallenge);
485 features = get_features (); 577 features = get_features ();
486 578
487 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER)); 579 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ()));
488 digest_nid = htonl (EVP_MD_type (RSA_HASH));
489 hmac_nid = htonl (EVP_MD_type (DIGEST)); 580 mac_nid = htonl (EVP_MD_type (MAC_DIGEST ()));
581 auth_nid = htonl (EVP_MD_type (AUTH_DIGEST ()));
490 582
491 len = sizeof (*this) - sizeof (net_packet); 583 len = sizeof (*this) - sizeof (net_packet);
492 set_hdr (type, dst); 584 set_hdr (type, dst);
493} 585}
494 586
587bool
495bool config_packet::chk_config () const 588config_packet::chk_config () const
496{ 589{
497 if (prot_major != PROTOCOL_MAJOR) 590 if (prot_major != PROTOCOL_MAJOR)
498 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR); 591 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
499 else if (randsize != RAND_SIZE) 592 else if (randsize != RAND_SIZE)
500 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE); 593 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
501 else if (hmaclen != HMACLENGTH)
502 slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
503#if 0 // this implementation should handle all flag settings
504 else if (flags != curflags ())
505 slog (L_WARN, _("flag mismatch (remote %x <=> local %x)"), flags, curflags ());
506#endif
507 else if (challengelen != sizeof (rsachallenge))
508 slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
509 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER))) 594 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ())))
510 slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER)); 595 slog (L_WARN, _("cipher algo mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));
511 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
512 slog (L_WARN, _("digest mismatch (remote %x <=> local %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
513 else if (hmac_nid != htonl (EVP_MD_type (DIGEST))) 596 else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ())))
514 slog (L_WARN, _("hmac mismatch (remote %x <=> local %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST)); 597 slog (L_WARN, _("mac algo mismatch (remote %x <=> local %x)"), ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ()));
598 else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ())))
599 slog (L_WARN, _("auth algo mismatch (remote %x <=> local %x)"), ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ()));
515 else 600 else
516 return true; 601 return true;
517 602
518 return false; 603 return false;
519} 604}
520 605
521struct auth_req_packet : config_packet 606struct auth_req_packet : config_packet // UNPROTECTED
522{ 607{
523 char magic[8]; 608 char magic[8];
524 u8 initiate; // false if this is just an automatic reply 609 u8 initiate; // false if this is just an automatic reply
525 u8 protocols; // supported protocols (will be patched on forward) 610 u8 protocols; // supported protocols (will be patched on forward)
526 u8 pad2, pad3; 611 u8 pad2, pad3;
527 rsaid id; 612 auth_encr encr;
528 rsaencrdata encr;
529 613
530 auth_req_packet (int dst, bool initiate_, u8 protocols_) 614 auth_req_packet (int dst, bool initiate_, u8 protocols_)
531 { 615 {
532 config_packet::setup (PT_AUTH_REQ, dst); 616 config_packet::setup (PT_AUTH_REQ, dst);
533 strncpy (magic, MAGIC, 8); 617 memcpy (magic, MAGIC, 8);
534 initiate = !!initiate_; 618 initiate = !!initiate_;
535 protocols = protocols_; 619 protocols = protocols_;
536 620
537 len = sizeof (*this) - sizeof (net_packet); 621 len = sizeof (*this) - sizeof (net_packet);
538 } 622 }
539}; 623};
540 624
541struct auth_res_packet : config_packet 625struct auth_res_packet : config_packet // UNPROTECTED
542{ 626{
543 rsaid id;
544 u8 pad1, pad2, pad3;
545 u8 response_len; // encrypted length
546 rsaresponse response; 627 auth_response response;
547 628
548 auth_res_packet (int dst) 629 auth_res_packet (int dst)
549 { 630 {
550 config_packet::setup (PT_AUTH_RES, dst); 631 config_packet::setup (PT_AUTH_RES, dst);
551 632
… …
585}; 666};
586 667
587///////////////////////////////////////////////////////////////////////////// 668/////////////////////////////////////////////////////////////////////////////
588 669
589void 670void
590connection::connection_established () 671connection::connection_established (const sockinfo &rsi)
591{ 672{
673 if (!have_snd_auth || !have_rcv_auth)
674 return;
675
676 si = rsi;
677 protocol = rsi.prot;
678
679 slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
680 conf->nodename, (const char *)rsi,
681 is_direct ? "direct" : "forwarded",
682 PROTOCOL_MAJOR, prot_minor);
683
684 if (::conf.script_node_up)
685 {
686 run_script_cb *cb = new run_script_cb;
687 cb->set<connection, &connection::script_node_up> (this);
688 run_script_queued (cb, _("node-up command execution failed, continuing."));
689 }
690
691 delete ictx; ictx = new crypto_ctx (rcv_auth, snd_auth, rcv_ecdh_a, rcv_auth.ecdh, 0);
692 iseqno.reset (ntohl (rcv_auth.rsa.seqno) & 0x7fffffff);
693
694 delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b , 1);
695 oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff;
696
592 if (ictx && octx) 697 if (ictx && octx)
593 { 698 {
594 connectmode = conf->connectmode;
595
596 // make sure rekeying timeouts are slightly asymmetric 699 // make sure rekeying timeouts are slightly asymmetric
597 rekey.start (NOW + ::conf.rekey 700 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
598 + (conf->id > THISNODE->id ? 10 : 0)); 701 rekey.start (rekey_interval, rekey_interval);
702
599 keepalive.start (NOW + ::conf.keepalive); 703 keepalive.start (::conf.keepalive);
600 704
601 // send queued packets 705 // send queued packets
602 if (ictx && octx) 706 if (ictx && octx)
603 { 707 {
604 while (tap_packet *p = (tap_packet *)data_queue.get ()) 708 while (tap_packet *p = (tap_packet *)data_queue.get ())
605 { 709 {
606 send_data_packet (p); 710 if (p->len) send_data_packet (p);
607 delete p; 711 delete p;
608 } 712 }
609 713
610 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ()) 714 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
611 { 715 {
612 send_vpn_packet (p, si, IPTOS_RELIABILITY); 716 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
613 delete p; 717 delete p;
614 } 718 }
615 } 719 }
720
721 vpn->connection_established (this);
616 } 722 }
723#if 0
617 else 724 else
618 { 725 {
619 retry_cnt = 0; 726 retry_cnt = 0;
620 establish_connection.start (NOW + 5); 727 establish_connection.start (5);
621 keepalive.stop (); 728 keepalive.stop ();
622 rekey.stop (); 729 rekey.stop ();
623 } 730 }
731#endif
624} 732}
625 733
626void 734void
627connection::reset_si () 735connection::reset_si ()
628{ 736{
737 if (vpn->can_direct (THISNODE, conf))
629 protocol = best_protocol (THISNODE->protocols & conf->protocols); 738 protocol = best_protocol (THISNODE->protocols & conf->connectable_protocols ());
630 739 else
631 // mask out protocols we cannot establish 740 {
632 if (!conf->udp_port) protocol &= ~PROT_UDPv4; 741 slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
633 if (!conf->tcp_port) protocol &= ~PROT_TCPv4; 742 protocol = 0;
634 if (!conf->dns_port) protocol &= ~PROT_DNSv4; 743 }
635 744
636 si.set (conf, protocol); 745 si.set (conf, protocol);
746
747 is_direct = si.valid ();
637} 748}
638 749
639// ensure sockinfo is valid, forward if necessary 750// ensure sockinfo is valid, forward if necessary
640const sockinfo & 751const sockinfo &
641connection::forward_si (const sockinfo &si) const 752connection::forward_si (const sockinfo &si) const
642{ 753{
643 if (!si.valid ()) 754 if (!si.valid ())
644 { 755 {
645 connection *r = vpn->find_router (); 756 connection *r = vpn->find_router_for (this);
646 757
647 if (r) 758 if (r)
648 { 759 {
649 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"), 760 slog (L_DEBUG, _("%s: no common protocol, trying to route through %s."),
650 conf->nodename, r->conf->nodename); 761 conf->nodename, r->conf->nodename);
651 return r->si; 762 return r->si;
652 } 763 }
653 else 764 else
654 slog (L_DEBUG, _("%s: node unreachable, no common protocol"), 765 slog (L_DEBUG, _("%s: node unreachable, no common protocol or no router available."),
655 conf->nodename); 766 conf->nodename);
656 } 767 }
657 768
658 return si; 769 return si;
659} 770}
660 771
661void 772void
662connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 773connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
663{ 774{
664 bool ok; 775 if (!vpn->send_vpn_packet (pkt, si, tos))
665
666 switch (si.prot)
667 {
668 case PROT_IPv4:
669 ok = vpn->send_ipv4_packet (pkt, si, tos); break;
670 case PROT_UDPv4:
671 ok = vpn->send_udpv4_packet (pkt, si, tos); break;
672#if ENABLE_TCP
673 case PROT_TCPv4:
674 ok = vpn->send_tcpv4_packet (pkt, si, tos); break;
675#endif
676#if ENABLE_ICMP
677 case PROT_ICMPv4:
678 ok = vpn->send_icmpv4_packet (pkt, si, tos); break;
679#endif
680#if ENABLE_DNS
681 case PROT_DNSv4:
682 ok = send_dnsv4_packet (pkt, si, tos); break;
683#endif
684
685 default:
686 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);
687 ok = false;
688 }
689
690 if (!ok)
691 reset_connection (); 776 reset_connection ();
692} 777}
693 778
694void 779void
695connection::send_ping (const sockinfo &si, u8 pong) 780connection::send_ping (const sockinfo &si, u8 pong)
696{ 781{
697 ping_packet *pkt = new ping_packet; 782 ping_packet *pkt = new ping_packet;
698 783
699 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 784 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
785
786 slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
700 send_vpn_packet (pkt, si, IPTOS_LOWDELAY); 787 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
701 788
702 delete pkt; 789 delete pkt;
703} 790}
704 791
… …
719void 806void
720connection::send_auth_request (const sockinfo &si, bool initiate) 807connection::send_auth_request (const sockinfo &si, bool initiate)
721{ 808{
722 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols); 809 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
723 810
724 rsachallenge chg; 811 generate_auth_data ();
725 rsa_cache.gen (pkt->id, chg);
726 rsa_encrypt (conf->rsa_key, chg, pkt->encr); 812 auth_encrypt (conf->rsa_key, snd_auth, pkt->encr);
727 813
728 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 814 slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
729
730 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly 815 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
731 816
732 delete pkt; 817 delete pkt;
733} 818}
734 819
735void 820void
736connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg) 821connection::send_auth_response (const sockinfo &si)
737{ 822{
738 auth_res_packet *pkt = new auth_res_packet (conf->id); 823 auth_res_packet *pkt = new auth_res_packet (conf->id);
739 824
740 pkt->id = id; 825 auth_hash (rcv_auth, pkt->response.mac);
826 memcpy (pkt->response.ecdh, rcv_ecdh_b, sizeof (rcv_ecdh_b));
741 827
742 rsa_hash (id, chg, pkt->response);
743
744 pkt->hmac_set (octx);
745
746 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si); 828 slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
747
748 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 829 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
749 830
750 delete pkt; 831 delete pkt;
751} 832}
752 833
753void 834void
754connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols) 835connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
755{ 836{
756 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 837 slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s,p%02x)", conf->nodename,
757 conf->id, rid, (const char *)rsi); 838 vpn->conns[rid - 1]->conf->nodename, (const char *)rsi,
839 conf->protocols);
758 840
759 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols); 841 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
760 842
761 r->hmac_set (octx); 843 r->hmac_set (octx);
762 send_vpn_packet (r, si); 844 send_vpn_packet (r, si);
763 845
764 delete r; 846 delete r;
765} 847}
766 848
767void 849inline void
768connection::establish_connection_cb (time_watcher &w) 850connection::establish_connection_cb (ev::timer &w, int revents)
769{ 851{
770 if (!ictx 852 if (!(ictx && octx)
771 && conf != THISNODE 853 && conf != THISNODE
772 && connectmode != conf_node::C_NEVER 854 && connectmode != conf_node::C_NEVER
773 && connectmode != conf_node::C_DISABLED 855 && connectmode != conf_node::C_DISABLED
774 && NOW > w.at) 856 && !w.is_active ())
775 { 857 {
776 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6; 858 // a bit hacky, if ondemand, and packets are no longer queued, then reset the connection
777 859 // and stop trying. should probably be handled by a per-connection expire handler.
778 if (retry_int < conf->max_retry) 860 if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())
861 {
862 reset_connection ();
779 retry_cnt++; 863 return;
780 else 864 }
781 retry_int = conf->max_retry;
782 865
783 w.start (NOW + retry_int); 866 last_establish_attempt = ev_now ();
867
868 ev::tstamp retry_int = ev::tstamp (retry_cnt & 3
869 ? (retry_cnt & 3) + 1
870 : 1 << (retry_cnt >> 2));
784 871
785 reset_si (); 872 reset_si ();
786 873
787 if (si.prot && !si.host) 874 bool slow = si.prot & PROT_SLOW;
875
876 if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
877 {
878 /*TODO*/ /* start the timer so we don't recurse endlessly */
879 w.start (1);
788 vpn->send_connect_request (conf->id); 880 vpn->send_connect_request (this);
881 }
789 else 882 else
790 { 883 {
884 if (si.valid ())
885 slog (L_DEBUG, _("%s: sending direct connection request to %s."),
886 conf->nodename, (const char *)si);
887
791 const sockinfo &dsi = forward_si (si); 888 const sockinfo &dsi = forward_si (si);
889
890 slow = slow || (dsi.prot & PROT_SLOW);
792 891
793 if (dsi.valid () && auth_rate_limiter.can (dsi)) 892 if (dsi.valid () && auth_rate_limiter.can (dsi))
794 { 893 {
795 if (retry_cnt < 4) 894 if (retry_cnt < 4)
796 send_auth_request (dsi, true); 895 send_auth_request (dsi, true);
797 else 896 else
798 send_ping (dsi, 0); 897 send_ping (dsi, 0);
799 } 898 }
800 } 899 }
900
901 retry_int *= slow ? 8. : 0.9;
902
903 if (retry_int < conf->max_retry)
904 retry_cnt++;
905 else
906 retry_int = conf->max_retry;
907
908 w.start (retry_int);
801 } 909 }
802} 910}
803 911
804void 912void
805connection::reset_connection () 913connection::reset_connection ()
… …
808 { 916 {
809 slog (L_INFO, _("%s(%s): connection lost"), 917 slog (L_INFO, _("%s(%s): connection lost"),
810 conf->nodename, (const char *)si); 918 conf->nodename, (const char *)si);
811 919
812 if (::conf.script_node_down) 920 if (::conf.script_node_down)
813 run_script (run_script_cb (this, &connection::script_node_down), false); 921 {
922 run_script_cb *cb = new run_script_cb;
923 cb->set<connection, &connection::script_node_down> (this);
924 run_script_queued (cb, _("node-down command execution failed, continuing."));
925 }
814 } 926 }
815 927
816 delete ictx; ictx = 0; 928 delete ictx; ictx = 0;
817 delete octx; octx = 0; 929 delete octx; octx = 0;
818#if ENABLE_DNS
819 delete dns; dns = 0;
820#endif
821 930
822 si.host = 0; 931 si.host = 0;
823 932
933 have_snd_auth = false;
934 have_rcv_auth = false;
935 auth_expire = 0.;
936
824 last_activity = 0; 937 last_activity = 0.;
938 //last_si_change = 0.;
825 retry_cnt = 0; 939 retry_cnt = 0;
826 940
827 rekey.stop (); 941 rekey.stop ();
828 keepalive.stop (); 942 keepalive.stop ();
829 establish_connection.stop (); 943 establish_connection.stop ();
… …
836 send_reset (si); 950 send_reset (si);
837 951
838 reset_connection (); 952 reset_connection ();
839} 953}
840 954
841void 955// poor-man's rekeying
842connection::rekey_cb (time_watcher &w) 956inline void
957connection::rekey_cb (ev::timer &w, int revents)
843{ 958{
844 reset_connection (); 959 reset_connection ();
845 establish_connection (); 960 establish_connection ();
846} 961}
847 962
… …
863 if (oseqno > MAX_SEQNO) 978 if (oseqno > MAX_SEQNO)
864 rekey (); 979 rekey ();
865} 980}
866 981
867void 982void
983connection::post_inject_queue ()
984{
985 // force a connection every now and when when packets are sent (max 1/s)
986 if (ev_now () - last_establish_attempt >= 0.95) // arbitrary
987 establish_connection.stop ();
988
989 establish_connection ();
990}
991
992void
868connection::inject_data_packet (tap_packet *pkt, bool broadcast/*TODO DDD*/) 993connection::inject_data_packet (tap_packet *pkt)
869{ 994{
870 if (ictx && octx) 995 if (ictx && octx)
871 send_data_packet (pkt); 996 send_data_packet (pkt);
872 else 997 else
873 { 998 {
874 if (!broadcast)//DDDD
875 data_queue.put (new tap_packet (*pkt)); 999 data_queue.put (new tap_packet (*pkt));
876 1000 post_inject_queue ();
877 establish_connection ();
878 } 1001 }
879} 1002}
880 1003
1004void
881void connection::inject_vpn_packet (vpn_packet *pkt, int tos) 1005connection::inject_vpn_packet (vpn_packet *pkt, int tos)
882{ 1006{
883 if (ictx && octx) 1007 if (ictx && octx)
884 send_vpn_packet (pkt, si, tos); 1008 send_vpn_packet (pkt, si, tos);
885 else 1009 else
886 { 1010 {
887 vpn_queue.put ((vpn_packet *)new data_packet (*(data_packet *)pkt)); 1011 vpn_queue.put ((vpn_packet *)new data_packet (*(data_packet *)pkt));
888 1012 post_inject_queue ();
889 establish_connection ();
890 } 1013 }
891} 1014}
892 1015
893void 1016void
894connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 1017connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
895{ 1018{
896 last_activity = NOW; 1019 last_activity = ev_now ();
897 1020
898 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 1021 slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
899 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 1022 conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
1023
1024 if (connectmode == conf_node::C_DISABLED)
1025 return;
900 1026
901 switch (pkt->typ ()) 1027 switch (pkt->typ ())
902 { 1028 {
903 case vpn_packet::PT_PING: 1029 case vpn_packet::PT_PING:
1030 slog (L_TRACE, "%s >> PT_PING", conf->nodename);
1031
904 // we send pings instead of auth packets after some retries, 1032 // we send pings instead of auth packets after some retries,
905 // so reset the retry counter and establish a connection 1033 // so reset the retry counter and establish a connection
906 // when we receive a ping. 1034 // when we receive a ping.
907 if (!ictx) 1035 if (!ictx)
908 { 1036 {
909 if (auth_rate_limiter.can (rsi)) 1037 if (auth_rate_limiter.can (rsi))
910 send_auth_request (rsi, true); 1038 send_auth_request (rsi, true);
911 } 1039 }
912 else 1040 else
1041 // we would love to change the socket address here, but ping's aren't
1042 // authenticated, so we best ignore it.
913 send_ping (rsi, 1); // pong 1043 send_ping (rsi, 1); // pong
914 1044
915 break; 1045 break;
916 1046
917 case vpn_packet::PT_PONG: 1047 case vpn_packet::PT_PONG:
1048 slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
1049
1050 // a PONG might mean that the other side doesn't really know
1051 // about our desire for communication.
1052 establish_connection ();
918 break; 1053 break;
919 1054
920 case vpn_packet::PT_RESET: 1055 case vpn_packet::PT_RESET:
921 { 1056 {
922 reset_connection (); 1057 reset_connection ();
923 1058
924 config_packet *p = (config_packet *) pkt; 1059 config_packet *p = (config_packet *) pkt;
925 1060
926 if (!p->chk_config ()) 1061 if (!p->chk_config ())
927 { 1062 {
928 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"), 1063 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
929 conf->nodename, (const char *)rsi); 1064 conf->nodename, (const char *)rsi);
930 connectmode = conf_node::C_DISABLED; 1065 connectmode = conf_node::C_DISABLED;
931 } 1066 }
932 else if (connectmode == conf_node::C_ALWAYS) 1067 else if (connectmode == conf_node::C_ALWAYS)
933 establish_connection (); 1068 establish_connection ();
… …
935 break; 1070 break;
936 1071
937 case vpn_packet::PT_AUTH_REQ: 1072 case vpn_packet::PT_AUTH_REQ:
938 if (auth_rate_limiter.can (rsi)) 1073 if (auth_rate_limiter.can (rsi))
939 { 1074 {
940 auth_req_packet *p = (auth_req_packet *) pkt; 1075 auth_req_packet *p = (auth_req_packet *)pkt;
941 1076
942 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 1077 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)",
1078 conf->nodename, p->initiate ? "initiate" : "reply",
1079 p->protocols, p->features);
943 1080
944 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 1081 if (p->chk_config () && !memcmp (p->magic, MAGIC, 8))
945 { 1082 {
946 if (p->prot_minor != PROTOCOL_MINOR) 1083 if (p->prot_minor != PROTOCOL_MINOR)
947 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1084 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
948 conf->nodename, (const char *)rsi, 1085 conf->nodename, (const char *)rsi,
949 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 1086 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
950 1087
951 if (p->initiate) 1088 if (p->initiate)
952 send_auth_request (rsi, false); 1089 send_auth_request (rsi, false);
953 1090
954 rsachallenge k; 1091 auth_data auth;
955 1092
956 if (!rsa_decrypt (::conf.rsa_key, p->encr, k)) 1093 if (!auth_decrypt (::conf.rsa_key, p->encr, auth))
957 { 1094 {
958 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"), 1095 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
959 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0)); 1096 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
960 break;
961 } 1097 }
962 else 1098 else
963 { 1099 {
964 delete octx; 1100 bool chg = !have_rcv_auth || memcmp (&rcv_auth, &auth, sizeof auth);
965 1101
966 octx = new crypto_ctx (k, 1); 1102 rcv_auth = auth;
967 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 1103 have_rcv_auth = true;
968 1104
969 // compatibility code, remove when no longer required 1105 send_auth_response (rsi);
970 if (p->flags & 1) p->features |= FEATURE_COMPRESSION;
971 1106
1107 if (chg)
1108 {
972 conf->protocols = p->protocols; 1109 conf->protocols = p->protocols;
973 features = p->features & config_packet::get_features (); 1110 features = p->features & config_packet::get_features ();
974 1111
975 send_auth_response (rsi, p->id, k);
976
977 connection_established (); 1112 connection_established (rsi);
978
979 break; 1113 }
980 } 1114 }
1115
1116 break;
981 } 1117 }
982 else 1118 else
983 slog (L_WARN, _("%s(%s): protocol mismatch"), 1119 slog (L_WARN, _("%s(%s): protocol mismatch."),
984 conf->nodename, (const char *)rsi); 1120 conf->nodename, (const char *)rsi);
985 1121
986 send_reset (rsi); 1122 send_reset (rsi);
987 } 1123 }
988 1124
989 break; 1125 break;
990 1126
991 case vpn_packet::PT_AUTH_RES: 1127 case vpn_packet::PT_AUTH_RES:
992 { 1128 {
993 auth_res_packet *p = (auth_res_packet *) pkt; 1129 auth_res_packet *p = (auth_res_packet *)pkt;
994 1130
995 slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id); 1131 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
996 1132
997 if (p->chk_config ()) 1133 if (p->chk_config ())
998 { 1134 {
999 if (p->prot_minor != PROTOCOL_MINOR) 1135 if (memcmp (&p->response.mac, snd_auth_mac, sizeof (snd_auth_mac)))
1000 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1001 conf->nodename, (const char *)rsi,
1002 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
1003
1004 rsachallenge chg;
1005
1006 if (!rsa_cache.find (p->id, chg))
1007 { 1136 {
1008 slog (L_ERR, _("%s(%s): unrequested auth response ignored"), 1137 slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),
1009 conf->nodename, (const char *)rsi); 1138 conf->nodename, (const char *)rsi);
1010 break;
1011 } 1139 }
1012 else 1140 else if (!have_snd_auth)
1013 { 1141 {
1014 crypto_ctx *cctx = new crypto_ctx (chg, 0); 1142 if (p->prot_minor != PROTOCOL_MINOR)
1015 1143 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1016 if (!p->hmac_chk (cctx))
1017 {
1018 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
1019 "could be an attack, or just corruption or a synchronization error"),
1020 conf->nodename, (const char *)rsi); 1144 conf->nodename, (const char *)rsi,
1021 break; 1145 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
1022 }
1023 else
1024 {
1025 rsaresponse h;
1026 1146
1027 rsa_hash (p->id, chg, h);
1028
1029 if (!memcmp ((u8 *)&h, (u8 *)p->response, sizeof h))
1030 {
1031 prot_minor = p->prot_minor; 1147 prot_minor = p->prot_minor;
1148 memcpy (snd_ecdh_b, p->response.ecdh, sizeof (snd_ecdh_b));
1032 1149
1033 delete ictx; ictx = cctx; 1150 have_snd_auth = true;
1034
1035 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
1036
1037 si = rsi;
1038 protocol = rsi.prot;
1039
1040 connection_established (); 1151 connection_established (rsi);
1041
1042 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
1043 conf->nodename, (const char *)rsi,
1044 p->prot_major, p->prot_minor);
1045
1046 if (::conf.script_node_up)
1047 run_script (run_script_cb (this, &connection::script_node_up), false);
1048
1049 break;
1050 }
1051 else
1052 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
1053 conf->nodename, (const char *)rsi);
1054 }
1055
1056 delete cctx;
1057 } 1152 }
1153
1154 break;
1058 } 1155 }
1059 } 1156 }
1060 1157
1061 send_reset (rsi); 1158 send_reset (rsi);
1062 break; 1159 break;
… …
1073 { 1170 {
1074 vpndata_packet *p = (vpndata_packet *)pkt; 1171 vpndata_packet *p = (vpndata_packet *)pkt;
1075 1172
1076 if (!p->hmac_chk (ictx)) 1173 if (!p->hmac_chk (ictx))
1077 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1174 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1078 "could be an attack, or just corruption or a synchronization error"), 1175 "could be an attack, or just corruption or a synchronization error."),
1079 conf->nodename, (const char *)rsi); 1176 conf->nodename, (const char *)rsi);
1080 else 1177 else
1081 { 1178 {
1082 u32 seqno; 1179 u32 seqno;
1083 tap_packet *d = p->unpack (this, seqno); 1180 tap_packet *d = p->unpack (this, seqno);
1181 int seqclass = iseqno.seqno_classify (seqno);
1084 1182
1085 if (iseqno.recv_ok (seqno)) 1183 if (seqclass == 0) // ok
1086 { 1184 {
1087 vpn->tap->send (d); 1185 vpn->tap->send (d);
1088 1186
1089 if (si != rsi) 1187 if (si != rsi)
1090 { 1188 {
1091 // fast re-sync on connection changes, useful especially for tcp/ip 1189 // fast re-sync on source address changes, useful especially for tcp/ip
1190 //if (last_si_change < ev_now () + 5.)
1092 si = rsi; 1191 // {
1093
1094 slog (L_INFO, _("%s(%s): socket address changed to %s"), 1192 slog (L_INFO, _("%s(%s): changing socket address to %s."),
1095 conf->nodename, (const char *)si, (const char *)rsi); 1193 conf->nodename, (const char *)si, (const char *)rsi);
1194
1195 si = rsi;
1196
1197 if (::conf.script_node_change)
1198 {
1199 run_script_cb *cb = new run_script_cb;
1200 cb->set<connection, &connection::script_node_change> (this);
1201 run_script_queued (cb, _("node-change command execution failed, continuing."));
1202 }
1203
1204 // }
1205 //else
1206 // slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
1207 // conf->nodename, (const char *)si, (const char *)rsi);
1096 } 1208 }
1209 }
1210 else if (seqclass == 1) // far history
1211 slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
1212 "possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
1213 else if (seqclass == 2) // in-window duplicate, happens often on wireless
1214 slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
1215 "possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
1216 else if (seqclass == 3) // reset
1217 {
1218 slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
1219 "probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
1220 send_reset (rsi);
1097 } 1221 }
1098 1222
1099 delete d; 1223 delete d;
1100 break; 1224 break;
1101 } 1225 }
… …
1105 break; 1229 break;
1106 1230
1107 case vpn_packet::PT_CONNECT_REQ: 1231 case vpn_packet::PT_CONNECT_REQ:
1108 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1232 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1109 { 1233 {
1110 connect_req_packet *p = (connect_req_packet *) pkt; 1234 connect_req_packet *p = (connect_req_packet *)pkt;
1111 1235
1112 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1236 if (p->id > 0 && p->id <= vpn->conns.size ())
1113 connection *c = vpn->conns[p->id - 1];
1114 conf->protocols = p->protocols;
1115
1116 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
1117 conf->id, p->id, c->ictx && c->octx);
1118
1119 if (c->ictx && c->octx)
1120 { 1237 {
1238 connection *c = vpn->conns[p->id - 1];
1239 conf->protocols = p->protocols;
1240
1241 slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s,p%02x) [%d]",
1242 conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1243 p->protocols,
1244 c->ictx && c->octx);
1245
1246 if (c->ictx && c->octx)
1247 {
1121 // send connect_info packets to both sides, in case one is 1248 // send connect_info packets to both sides, in case one is
1122 // behind a nat firewall (or both ;) 1249 // behind a nat firewall (or both ;)
1123 c->send_connect_info (conf->id, si, conf->protocols); 1250 c->send_connect_info (conf->id, si, conf->protocols);
1124 send_connect_info (c->conf->id, c->si, c->conf->protocols); 1251 send_connect_info (c->conf->id, c->si, c->conf->protocols);
1252 }
1253 else
1254 c->establish_connection ();
1125 } 1255 }
1126 else 1256 else
1127 c->establish_connection (); 1257 slog (L_WARN,
1258 _("received authenticated connection request from unknown node #%d, config file mismatch?"),
1259 p->id);
1128 } 1260 }
1129 1261
1130 break; 1262 break;
1131 1263
1132 case vpn_packet::PT_CONNECT_INFO: 1264 case vpn_packet::PT_CONNECT_INFO:
1133 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1265 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1134 { 1266 {
1135 connect_info_packet *p = (connect_info_packet *)pkt; 1267 connect_info_packet *p = (connect_info_packet *)pkt;
1136 1268
1137 if (p->id > 0 && p->id <= vpn->conns.size ()) // hmac-auth does not mean we accept anything 1269 if (p->id > 0 && p->id <= vpn->conns.size ())
1138 { 1270 {
1139 connection *c = vpn->conns[p->id - 1]; 1271 connection *c = vpn->conns[p->id - 1];
1140 1272
1141 c->conf->protocols = p->protocols; 1273 c->conf->protocols = p->protocols;
1142 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf)); 1274 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1143 p->si.upgrade_protocol (protocol, c->conf); 1275 p->si.upgrade_protocol (protocol, c->conf);
1144 1276
1145 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1277 slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s,protocols=%02x,protocol=%02x,upgradable=%02x) [%d]",
1146 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1278 conf->nodename,
1279 vpn->conns[p->id - 1]->conf->nodename,
1280 (const char *)p->si,
1281 p->protocols,
1282 protocol,
1283 p->si.supported_protocols (c->conf),
1284 !c->ictx && !c->octx);
1147 1285
1148 const sockinfo &dsi = forward_si (p->si); 1286 const sockinfo &dsi = forward_si (p->si);
1149 1287
1150 if (dsi.valid ()) 1288 if (dsi.valid ())
1151 c->send_auth_request (dsi, true); 1289 c->send_auth_request (dsi, true);
1290 else
1291 slog (L_INFO, "connect info for %s received (%s), but still unable to contact.",
1292 vpn->conns[p->id - 1]->conf->nodename,
1293 (const char *)p->si);
1152 } 1294 }
1295 else
1296 slog (L_WARN,
1297 _("received authenticated connection request from unknown node #%d, config file mismatch?"),
1298 p->id);
1153 } 1299 }
1154 1300
1155 break; 1301 break;
1156 1302
1157 default: 1303 default:
1158 send_reset (rsi); 1304 send_reset (rsi);
1159 break; 1305 break;
1160 } 1306 }
1161} 1307}
1162 1308
1163void connection::keepalive_cb (time_watcher &w) 1309inline void
1310connection::keepalive_cb (ev::timer &w, int revents)
1164{ 1311{
1165 if (NOW >= last_activity + ::conf.keepalive + 30) 1312 ev_tstamp when = last_activity + ::conf.keepalive - ev::now ();
1313
1314 if (when >= 0)
1315 w.start (when);
1316 else if (when < -15)
1166 { 1317 {
1167 reset_connection (); 1318 reset_connection ();
1168 establish_connection (); 1319 establish_connection ();
1169 } 1320 }
1170 else if (NOW < last_activity + ::conf.keepalive)
1171 w.start (last_activity + ::conf.keepalive);
1172 else if (conf->connectmode != conf_node::C_ONDEMAND 1321 else if (conf->connectmode != conf_node::C_ONDEMAND
1173 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1322 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1174 { 1323 {
1324 w.start (3);
1175 send_ping (si); 1325 send_ping (si);
1176 w.start (NOW + 5);
1177 } 1326 }
1178 else if (NOW < last_activity + ::conf.keepalive + 10) 1327 else if (when >= -10)
1179 // hold ondemand connections implicitly a few seconds longer 1328 // hold ondemand connections implicitly a few seconds longer
1180 // should delete octx, though, or something like that ;) 1329 // should delete octx, though, or something like that ;)
1181 w.start (last_activity + ::conf.keepalive + 10); 1330 w.start (when + 10);
1182 else 1331 else
1183 reset_connection (); 1332 reset_connection ();
1184} 1333}
1185 1334
1335void
1186void connection::send_connect_request (int id) 1336connection::send_connect_request (int id)
1187{ 1337{
1188 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1338 connect_req_packet *p = new connect_req_packet (conf->id, id, THISNODE->protocols);
1189 1339
1190 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1340 slog (L_TRACE, "%s << PT_CONNECT_REQ(%s,p%02x)",
1341 conf->nodename, vpn->conns[id - 1]->conf->nodename,
1342 THISNODE->protocols);
1191 p->hmac_set (octx); 1343 p->hmac_set (octx);
1192 send_vpn_packet (p, si); 1344 send_vpn_packet (p, si);
1193 1345
1194 delete p; 1346 delete p;
1195} 1347}
1196 1348
1197void connection::script_node () 1349void
1350connection::script_init_env (const char *ext)
1198{ 1351{
1199 vpn->script_if_up ();
1200
1201 char *env; 1352 char *env;
1353 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
1354 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
1355 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
1356 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
1357 conf->id & 0xff); putenv (env);
1358}
1359
1360void
1361connection::script_init_connect_env ()
1362{
1363 vpn->script_init_env ();
1364
1365 char *env;
1202 asprintf (&env, "DESTID=%d", conf->id); putenv (env); 1366 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1367 asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env);
1203 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); 1368 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1204 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); 1369 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1205 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); 1370 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1206} 1371}
1207 1372
1373inline const char *
1208const char *connection::script_node_up () 1374connection::script_node_up ()
1209{ 1375{
1210 script_node (); 1376 script_init_connect_env ();
1211 1377
1212 putenv ("STATE=up"); 1378 putenv ((char *)"STATE=up");
1213 1379
1380 char *filename;
1381 asprintf (&filename,
1382 "%s/%s",
1383 confbase,
1214 return ::conf.script_node_up ? ::conf.script_node_up : "node-up"; 1384 ::conf.script_node_up ? ::conf.script_node_up : "node-up");
1215}
1216 1385
1386 return filename;
1387}
1388
1389inline const char *
1390connection::script_node_change ()
1391{
1392 script_init_connect_env ();
1393
1394 putenv ((char *)"STATE=change");
1395
1396 char *filename;
1397 asprintf (&filename,
1398 "%s/%s",
1399 confbase,
1400 ::conf.script_node_change ? ::conf.script_node_change : "node-change");
1401
1402 return filename;
1403}
1404
1405inline const char *
1217const char *connection::script_node_down () 1406connection::script_node_down ()
1218{ 1407{
1219 script_node (); 1408 script_init_connect_env ();
1220 1409
1221 putenv ("STATE=down"); 1410 putenv ((char *)"STATE=down");
1222 1411
1223 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1412 char *filename;
1413 asprintf (&filename,
1414 "%s/%s",
1415 confbase,
1416 ::conf.script_node_down ? ::conf.script_node_down : "node-down");
1417
1418 return filename;
1224} 1419}
1225 1420
1226connection::connection (struct vpn *vpn, conf_node *conf) 1421connection::connection (struct vpn *vpn, conf_node *conf)
1227: vpn(vpn), conf(conf) 1422: vpn(vpn), conf(conf),
1228, rekey (this, &connection::rekey_cb)
1229, keepalive (this, &connection::keepalive_cb)
1230, establish_connection (this, &connection::establish_connection_cb)
1231#if ENABLE_DNS 1423#if ENABLE_DNS
1232, dns (0) 1424 dns (0),
1233#endif 1425#endif
1426 data_queue(conf->max_ttl, conf->max_queue + 1),
1427 vpn_queue(conf->max_ttl, conf->max_queue + 1)
1234{ 1428{
1429 rekey .set<connection, &connection::rekey_cb > (this);
1430 keepalive .set<connection, &connection::keepalive_cb > (this);
1431 establish_connection.set<connection, &connection::establish_connection_cb> (this);
1432
1433 last_establish_attempt = 0.;
1235 octx = ictx = 0; 1434 octx = ictx = 0;
1236 retry_cnt = 0;
1237 1435
1238 if (!conf->protocols) // make sure some protocol is enabled 1436 connectmode = conf->connectmode;
1239 conf->protocols = PROT_UDPv4;
1240 1437
1241 connectmode = conf_node::C_ALWAYS; // initial setting 1438 // queue a dummy packet to force an initial connection attempt
1439 if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
1440 vpn_queue.put (new net_packet);
1441
1242 reset_connection (); 1442 reset_connection ();
1243} 1443}
1244 1444
1245connection::~connection () 1445connection::~connection ()
1246{ 1446{
1247 shutdown (); 1447 shutdown ();
1248} 1448}
1249 1449
1450void
1250void connection_init () 1451connection_init ()
1251{ 1452{
1252 auth_rate_limiter.clear (); 1453 auth_rate_limiter.clear ();
1253 reset_rate_limiter.clear (); 1454 reset_rate_limiter.clear ();
1254} 1455}
1255 1456

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines