[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.35 by pcg, Mon May 10 21:24:48 2004 UTC vs.
Revision 1.48 by pcg, Tue Mar 8 00:32:54 2005 UTC

…		…
1	/*	1	/*
2	connection.C -- manage a single connection	2	connection.C -- manage a single connection
3	Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>	3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
4		4
		5	This file is part of GVPE.
		6
5	This program is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify
6	it under the terms of the GNU General Public License as published by	8	it under the terms of the GNU General Public License as published by
7	the Free Software Foundation; either version 2 of the License, or	9	the Free Software Foundation; either version 2 of the License, or
8	(at your option) any later version.	10	(at your option) any later version.
9		11
10	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful,
11	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	but WITHOUT ANY WARRANTY; without even the implied warranty of
12	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	GNU General Public License for more details.	15	GNU General Public License for more details.
14		16
15	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License
16	along with this program; if not, write to the Free Software	18	along with gvpe; if not, write to the Free Software
17	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
18	*/	20	*/
19		21
20	#include "config.h"	22	#include "config.h"
21		23
476	{	478	{
477	prot_major = PROTOCOL_MAJOR;	479	prot_major = PROTOCOL_MAJOR;
478	prot_minor = PROTOCOL_MINOR;	480	prot_minor = PROTOCOL_MINOR;
479	randsize = RAND_SIZE;	481	randsize = RAND_SIZE;
480	hmaclen = HMACLENGTH;	482	hmaclen = HMACLENGTH;
481	flags = ENABLE_COMPRESSION ? 0x81 : 0x80;	483	flags = 0;
482	challengelen = sizeof (rsachallenge);	484	challengelen = sizeof (rsachallenge);
483	features = get_features ();	485	features = get_features ();
484		486
485	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));	487	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
486	digest_nid = htonl (EVP_MD_type (RSA_HASH));	488	digest_nid = htonl (EVP_MD_type (RSA_HASH));
…		…
496	slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);	498	slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
497	else if (randsize != RAND_SIZE)	499	else if (randsize != RAND_SIZE)
498	slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);	500	slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
499	else if (hmaclen != HMACLENGTH)	501	else if (hmaclen != HMACLENGTH)
500	slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);	502	slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
501	#if 0 // this implementation should handle all flag settings
502	else if (flags != curflags ())
503	slog (L_WARN, _("flag mismatch (remote %x <=> local %x)"), flags, curflags ());
504	#endif
505	else if (challengelen != sizeof (rsachallenge))	503	else if (challengelen != sizeof (rsachallenge))
506	slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));	504	slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
507	else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))	505	else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
508	slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));	506	slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
509	else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))	507	else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
…		…
589	{	587	{
590	if (ictx && octx)	588	if (ictx && octx)
591	{	589	{
592	connectmode = conf->connectmode;	590	connectmode = conf->connectmode;
593		591
		592	// make sure rekeying timeouts are slightly asymmetric
594	rekey.start (NOW + ::conf.rekey);	593	rekey.start (NOW + ::conf.rekey
		594	+ (conf->id > THISNODE->id ? 10 : 0));
595	keepalive.start (NOW + ::conf.keepalive);	595	keepalive.start (NOW + ::conf.keepalive);
596		596
597	// send queued packets	597	// send queued packets
598	if (ictx && octx)	598	if (ictx && octx)
599	{	599	{
…		…
625	protocol = best_protocol (THISNODE->protocols & conf->protocols);	625	protocol = best_protocol (THISNODE->protocols & conf->protocols);
626		626
627	// mask out protocols we cannot establish	627	// mask out protocols we cannot establish
628	if (!conf->udp_port) protocol &= ~PROT_UDPv4;	628	if (!conf->udp_port) protocol &= ~PROT_UDPv4;
629	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;	629	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
		630	if (!conf->dns_port) protocol &= ~PROT_DNSv4;
630		631
631	si.set (conf, protocol);	632	si.set (conf, protocol);
632	}	633	}
633		634
634	// ensure sockinfo is valid, forward if necessary	635	// ensure sockinfo is valid, forward if necessary
…		…
639	{	640	{
640	connection *r = vpn->find_router ();	641	connection *r = vpn->find_router ();
641		642
642	if (r)	643	if (r)
643	{	644	{
644	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"),	645	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"),
645	conf->nodename, r->conf->nodename);	646	conf->nodename, r->conf->nodename, (const char *)r->si);
646	return r->si;	647	return r->si;
647	}	648	}
648	else	649	else
649	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),	650	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),
650	conf->nodename);	651	conf->nodename);
…		…
740	&& conf != THISNODE	741	&& conf != THISNODE
741	&& connectmode != conf_node::C_NEVER	742	&& connectmode != conf_node::C_NEVER
742	&& connectmode != conf_node::C_DISABLED	743	&& connectmode != conf_node::C_DISABLED
743	&& NOW > w.at)	744	&& NOW > w.at)
744	{	745	{
745	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;	746	w.at = TSTAMP_MAX; // first disable this watcher in case of recursion
746		747
747	if (retry_int < 3600 * 8)	748	double retry_int = double (retry_cnt & 3
748	retry_cnt++;	749	? (retry_cnt & 3) + 1
749		750	: 1 << (retry_cnt >> 2));
750	w.start (NOW + retry_int);
751		751
752	reset_si ();	752	reset_si ();
		753
		754	bool slow = si.prot & PROT_SLOW;
753		755
754	if (si.prot && !si.host)	756	if (si.prot && !si.host)
755	vpn->send_connect_request (conf->id);	757	vpn->send_connect_request (conf->id);
756	else	758	else
757	{	759	{
758	const sockinfo &dsi = forward_si (si);	760	const sockinfo &dsi = forward_si (si);
		761
		762	slow = slow \|\| (dsi.prot & PROT_SLOW);
759		763
760	if (dsi.valid () && auth_rate_limiter.can (dsi))	764	if (dsi.valid () && auth_rate_limiter.can (dsi))
761	{	765	{
762	if (retry_cnt < 4)	766	if (retry_cnt < 4)
763	send_auth_request (dsi, true);	767	send_auth_request (dsi, true);
764	else	768	else
765	send_ping (dsi, 0);	769	send_ping (dsi, 0);
766	}	770	}
767	}	771	}
		772
		773	retry_int *= slow ? 3. : 0.7;
		774
		775	if (retry_int < conf->max_retry)
		776	retry_cnt++;
		777	else
		778	retry_int = conf->max_retry;
		779
		780	w.start (NOW + retry_int);
768	}	781	}
769	}	782	}
770		783
771	void	784	void
772	connection::reset_connection ()	785	connection::reset_connection ()
…		…
780	run_script (run_script_cb (this, &connection::script_node_down), false);	793	run_script (run_script_cb (this, &connection::script_node_down), false);
781	}	794	}
782		795
783	delete ictx; ictx = 0;	796	delete ictx; ictx = 0;
784	delete octx; octx = 0;	797	delete octx; octx = 0;
		798	#if ENABLE_DNS
		799	dnsv4_reset_connection ();
		800	#endif
785		801
786	si.host= 0;	802	si.host = 0;
787		803
788	last_activity = 0;	804	last_activity = 0;
789	retry_cnt = 0;	805	retry_cnt = 0;
790		806
791	rekey.stop ();	807	rekey.stop ();
…		…
928	delete octx;	944	delete octx;
929		945
930	octx = new crypto_ctx (k, 1);	946	octx = new crypto_ctx (k, 1);
931	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;	947	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;
932		948
933	// compatibility code, remove when no longer required
934	if (p->flags & 1) p->features \|= FEATURE_COMPRESSION;
935
936	conf->protocols = p->protocols;	949	conf->protocols = p->protocols;
937	features = p->features & config_packet::get_features ();	950	features = p->features & config_packet::get_features ();
938		951
939	send_auth_response (rsi, p->id, k);	952	send_auth_response (rsi, p->id, k);
940		953
…		…
1094	break;	1107	break;
1095		1108
1096	case vpn_packet::PT_CONNECT_INFO:	1109	case vpn_packet::PT_CONNECT_INFO:
1097	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1110	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1098	{	1111	{
1099	connect_info_packet p = (connect_info_packet ) pkt;	1112	connect_info_packet p = (connect_info_packet )pkt;
1100		1113
1101	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1114	if (p->id > 0 && p->id <= vpn->conns.size ()) // hmac-auth does not mean we accept anything
1102		1115	{
1103	connection *c = vpn->conns[p->id - 1];	1116	connection *c = vpn->conns[p->id - 1];
1104		1117
1105	c->conf->protocols = p->protocols;	1118	c->conf->protocols = p->protocols;
1106	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));	1119	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1107	p->si.upgrade_protocol (protocol, c->conf);	1120	p->si.upgrade_protocol (protocol, c->conf);
1108		1121
1109	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1122	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1110	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1123	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1111		1124
1112	const sockinfo &dsi = forward_si (p->si);	1125	const sockinfo &dsi = forward_si (p->si);
1113		1126
1114	if (dsi.valid ())	1127	if (dsi.valid ())
1115	c->send_auth_request (dsi, true);	1128	c->send_auth_request (dsi, true);
		1129	}
1116	}	1130	}
1117		1131
1118	break;	1132	break;
1119		1133
1120	default:	1134	default:
…		…
1184	putenv ("STATE=down");	1198	putenv ("STATE=down");
1185		1199
1186	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";	1200	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1187	}	1201	}
1188		1202
1189	connection::connection(struct vpn *vpn_)	1203	connection::connection (struct vpn vpn, conf_node conf)
1190	: vpn(vpn_)	1204	: vpn(vpn), conf(conf)
1191	, rekey (this, &connection::rekey_cb)	1205	, rekey (this, &connection::rekey_cb)
1192	, keepalive (this, &connection::keepalive_cb)	1206	, keepalive (this, &connection::keepalive_cb)
1193	, establish_connection (this, &connection::establish_connection_cb)	1207	, establish_connection (this, &connection::establish_connection_cb)
		1208	#if ENABLE_DNS
		1209	, dns (0)
		1210	#endif
1194	{	1211	{
1195	octx = ictx = 0;	1212	octx = ictx = 0;
1196	retry_cnt = 0;	1213	retry_cnt = 0;
1197		1214
		1215	if (!conf->protocols) // make sure some protocol is enabled
		1216	conf->protocols = PROT_UDPv4;
		1217
1198	connectmode = conf_node::C_ALWAYS; // initial setting	1218	connectmode = conf_node::C_ALWAYS; // initial setting
1199	reset_connection ();	1219	reset_connection ();
1200	}	1220	}
1201		1221
1202	connection::~connection ()	1222	connection::~connection ()

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.35 by pcg, Mon May 10 21:24:48 2004 UTC vs. Revision 1.48 by pcg, Tue Mar 8 00:32:54 2005 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.35 by pcg, Mon May 10 21:24:48 2004 UTC vs.
Revision 1.48 by pcg, Tue Mar 8 00:32:54 2005 UTC