[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.49 by pcg, Sat Mar 12 18:10:40 2005 UTC vs.
Revision 1.89 by root, Thu Dec 2 08:15:09 2010 UTC

…		…
1	/*	1	/*
2	connection.C -- manage a single connection	2	connection.C -- manage a single connection
3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>	3	Copyright (C) 2003-2008,2010 Marc Lehmann <gvpe@schmorp.de>
4		4
5	This file is part of GVPE.	5	This file is part of GVPE.
6		6
7	GVPE is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
8	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
9	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
10	(at your option) any later version.	10	option) any later version.
11		11
12	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
13	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15	GNU General Public License for more details.	15	Public License for more details.
16		16
17	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
18	along with gvpe; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
20	*/	30	*/
21		31
22	#include "config.h"	32	#include "config.h"
23		33
24	#include <cassert>
25
26	#include <list>	34	#include <list>
		35	#include <queue>
		36	#include <utility>
27		37
28	#include <openssl/rand.h>	38	#include <openssl/rand.h>
29	#include <openssl/evp.h>	39	#include <openssl/evp.h>
30	#include <openssl/rsa.h>	40	#include <openssl/rsa.h>
31	#include <openssl/err.h>	41	#include <openssl/err.h>
32
33	#include "gettext.h"
34		42
35	#include "conf.h"	43	#include "conf.h"
36	#include "slog.h"	44	#include "slog.h"
37	#include "device.h"	45	#include "device.h"
38	#include "vpn.h"	46	#include "vpn.h"
42		50
43	#if !HAVE_RAND_PSEUDO_BYTES	51	#if !HAVE_RAND_PSEUDO_BYTES
44	# define RAND_pseudo_bytes RAND_bytes	52	# define RAND_pseudo_bytes RAND_bytes
45	#endif	53	#endif
46		54
47	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic	55	#define MAGIC_OLD "vped\xbd\xc6\xdb\x82" // 8 bytes of magic (still used in the protocol)
		56	#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic (understood but not generated)
48		57
49	#define ULTRA_FAST 1	58	#define ULTRA_FAST 1
50	#define HLOG 15	59	#define HLOG 15
51	#include "lzf/lzf.h"	60	#include "lzf/lzf.h"
52	#include "lzf/lzf_c.c"	61	#include "lzf/lzf_c.c"
53	#include "lzf/lzf_d.c"	62	#include "lzf/lzf_d.c"
		63
		64	//////////////////////////////////////////////////////////////////////////////
		65
		66	static std::queue< std::pair<run_script_cb , const char > > rs_queue;
		67	static ev::child rs_child_ev;
		68
		69	void // c++ requires external linkage here, apparently :(
		70	rs_child_cb (ev::child &w, int revents)
		71	{
		72	w.stop ();
		73
		74	if (rs_queue.empty ())
		75	return;
		76
		77	pid_t pid = run_script (*rs_queue.front ().first, false);
		78	if (pid)
		79	{
		80	w.set (pid);
		81	w.start ();
		82	}
		83	else
		84	slog (L_WARN, rs_queue.front ().second);
		85
		86	delete rs_queue.front ().first;
		87	rs_queue.pop ();
		88	}
		89
		90	// despite the fancy name, this is quite a hack
		91	static void
		92	run_script_queued (run_script_cb cb, const char warnmsg)
		93	{
		94	rs_queue.push (std::make_pair (cb, warnmsg));
		95
		96	if (!rs_child_ev.is_active ())
		97	{
		98	rs_child_ev.set<rs_child_cb> ();
		99	rs_child_ev ();
		100	}
		101	}
		102
		103	//////////////////////////////////////////////////////////////////////////////
54		104
55	struct crypto_ctx	105	struct crypto_ctx
56	{	106	{
57	EVP_CIPHER_CTX cctx;	107	EVP_CIPHER_CTX cctx;
58	HMAC_CTX hctx;	108	HMAC_CTX hctx;
…		…
86	require (EVP_DigestUpdate(&ctx, &id, sizeof id));	136	require (EVP_DigestUpdate(&ctx, &id, sizeof id));
87	require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0));	137	require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0));
88	EVP_MD_CTX_cleanup (&ctx);	138	EVP_MD_CTX_cleanup (&ctx);
89	}	139	}
90		140
91	struct rsa_entry {	141	struct rsa_entry
		142	{
92	tstamp expire;	143	tstamp expire;
93	rsaid id;	144	rsaid id;
94	rsachallenge chg;	145	rsachallenge chg;
95	};	146	};
96		147
97	struct rsa_cache : list<rsa_entry>	148	struct rsa_cache : list<rsa_entry>
98	{	149	{
99	void cleaner_cb (time_watcher &w); time_watcher cleaner;	150	inline void cleaner_cb (ev::timer &w, int revents); ev::timer cleaner;
100		151
101	bool find (const rsaid &id, rsachallenge &chg)	152	bool find (const rsaid &id, rsachallenge &chg)
102	{	153	{
103	for (iterator i = begin (); i != end (); ++i)	154	for (iterator i = begin (); i != end (); ++i)
104	{	155	{
105	if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW)	156	if (!memcmp (&id, &i->id, sizeof id) && i->expire > ev_now ())
106	{	157	{
107	memcpy (&chg, &i->chg, sizeof chg);	158	memcpy (&chg, &i->chg, sizeof chg);
108		159
109	erase (i);	160	erase (i);
110	return true;	161	return true;
111	}	162	}
112	}	163	}
113		164
114	if (cleaner.at < NOW)	165	if (!cleaner.is_active ())
115	cleaner.start (NOW + RSA_TTL);	166	cleaner.again ();
116		167
117	return false;	168	return false;
118	}	169	}
119		170
120	void gen (rsaid &id, rsachallenge &chg)	171	void gen (rsaid &id, rsachallenge &chg)
121	{	172	{
122	rsa_entry e;	173	rsa_entry e;
123		174
124	RAND_bytes ((unsigned char *)&id, sizeof id);	175	RAND_bytes ((unsigned char *)&id, sizeof id);
125	RAND_bytes ((unsigned char *)&chg, sizeof chg);	176	RAND_bytes ((unsigned char *)&chg, sizeof chg);
126		177
127	e.expire = NOW + RSA_TTL;	178	e.expire = ev_now () + RSA_TTL;
128	e.id = id;	179	e.id = id;
129	memcpy (&e.chg, &chg, sizeof chg);	180	memcpy (&e.chg, &chg, sizeof chg);
130		181
131	push_back (e);	182	push_back (e);
132		183
133	if (cleaner.at < NOW)	184	if (!cleaner.is_active ())
134	cleaner.start (NOW + RSA_TTL);	185	cleaner.again ();
135	}	186	}
136		187
137	rsa_cache ()	188	rsa_cache ()
138	: cleaner (this, &rsa_cache::cleaner_cb)	189	{
139	{ }	190	cleaner.set<rsa_cache, &rsa_cache::cleaner_cb> (this);
		191	cleaner.set (RSA_TTL, RSA_TTL);
		192	}
140		193
141	} rsa_cache;	194	} rsa_cache;
142		195
143	void rsa_cache::cleaner_cb (time_watcher &w)	196	void rsa_cache::cleaner_cb (ev::timer &w, int revents)
144	{	197	{
145	if (!empty ())	198	if (empty ())
		199	w.stop ();
		200	else
146	{	201	{
147	w.start (NOW + RSA_TTL);
148
149	for (iterator i = begin (); i != end (); )	202	for (iterator i = begin (); i != end (); )
150	if (i->expire <= NOW)	203	if (i->expire <= ev_now ())
151	i = erase (i);	204	i = erase (i);
152	else	205	else
153	++i;	206	++i;
154	}	207	}
155	}	208	}
156		209
157	//////////////////////////////////////////////////////////////////////////////	210	//////////////////////////////////////////////////////////////////////////////
158		211
159	void pkt_queue::put (net_packet *p)	212	pkt_queue::pkt_queue (double max_ttl, int max_queue)
		213	: max_ttl (max_ttl), max_queue (max_queue)
160	{	214	{
161	if (queue[i])	215	queue = new pkt [max_queue];
162	{
163	delete queue[i];
164	j = (j + 1) % QUEUEDEPTH;
165	}
166		216
167	queue[i] = p;
168
169	i = (i + 1) % QUEUEDEPTH;
170	}
171
172	net_packet *pkt_queue::get ()
173	{
174	net_packet *p = queue[j];
175
176	if (p)
177	{
178	queue[j] = 0;
179	j = (j + 1) % QUEUEDEPTH;
180	}
181
182	return p;
183	}
184
185	pkt_queue::pkt_queue ()
186	{
187	memset (queue, 0, sizeof (queue));
188	i = 0;	217	i = 0;
189	j = 0;	218	j = 0;
		219
		220	expire.set<pkt_queue, &pkt_queue::expire_cb> (this);
190	}	221	}
191		222
192	pkt_queue::~pkt_queue ()	223	pkt_queue::~pkt_queue ()
193	{	224	{
194	for (i = QUEUEDEPTH; --i > 0; )	225	while (net_packet *p = get ())
		226	delete p;
		227
195	delete queue[i];	228	delete [] queue;
196	}	229	}
197		230
		231	void pkt_queue::expire_cb (ev::timer &w, int revents)
		232	{
		233	ev_tstamp expire = ev_now () - max_ttl;
		234
		235	for (;;)
		236	{
		237	if (empty ())
		238	break;
		239
		240	double diff = queue[j].tstamp - expire;
		241
		242	if (diff >= 0.)
		243	{
		244	w.start (diff > 0.5 ? diff : 0.5);
		245	break;
		246	}
		247
		248	delete get ();
		249	}
		250	}
		251
		252	void pkt_queue::put (net_packet *p)
		253	{
		254	ev_tstamp now = ev_now ();
		255
		256	// start expiry timer
		257	if (empty ())
		258	expire.start (max_ttl);
		259
		260	int ni = i + 1 == max_queue ? 0 : i + 1;
		261
		262	if (ni == j)
		263	delete get ();
		264
		265	queue[i].pkt = p;
		266	queue[i].tstamp = now;
		267
		268	i = ni;
		269	}
		270
		271	net_packet *pkt_queue::get ()
		272	{
		273	if (empty ())
		274	return 0;
		275
		276	net_packet *p = queue[j].pkt;
		277	queue[j].pkt = 0;
		278
		279	j = j + 1 == max_queue ? 0 : j + 1;
		280
		281	return p;
		282	}
		283
198	struct net_rateinfo {	284	struct net_rateinfo
		285	{
199	u32 host;	286	u32 host;
200	double pcnt, diff;	287	double pcnt, diff;
201	tstamp last;	288	tstamp last;
202	};	289	};
203		290
…		…
222	iterator i;	309	iterator i;
223		310
224	for (i = begin (); i != end (); )	311	for (i = begin (); i != end (); )
225	if (i->host == host)	312	if (i->host == host)
226	break;	313	break;
227	else if (i->last < NOW - NRL_EXPIRE)	314	else if (i->last < ev_now () - NRL_EXPIRE)
228	i = erase (i);	315	i = erase (i);
229	else	316	else
230	i++;	317	i++;
231		318
232	if (i == end ())	319	if (i == end ())
…		…
234	net_rateinfo ri;	321	net_rateinfo ri;
235		322
236	ri.host = host;	323	ri.host = host;
237	ri.pcnt = 1.;	324	ri.pcnt = 1.;
238	ri.diff = NRL_MAXDIF;	325	ri.diff = NRL_MAXDIF;
239	ri.last = NOW;	326	ri.last = ev_now ();
240		327
241	push_front (ri);	328	push_front (ri);
242		329
243	return true;	330	return true;
244	}	331	}
…		…
246	{	333	{
247	net_rateinfo ri (*i);	334	net_rateinfo ri (*i);
248	erase (i);	335	erase (i);
249		336
250	ri.pcnt = ri.pcnt * NRL_ALPHA;	337	ri.pcnt = ri.pcnt * NRL_ALPHA;
251	ri.diff = ri.diff * NRL_ALPHA + (NOW - ri.last);	338	ri.diff = ri.diff * NRL_ALPHA + (ev_now () - ri.last);
252		339
253	ri.last = NOW;	340	ri.last = ev_now ();
254		341
255	double dif = ri.diff / ri.pcnt;	342	double dif = ri.diff / ri.pcnt;
256		343
257	bool send = dif > NRL_CUTOFF;	344	bool send = dif > NRL_CUTOFF;
258		345
…		…
338	ptype type = PT_DATA_UNCOMPRESSED;	425	ptype type = PT_DATA_UNCOMPRESSED;
339		426
340	#if ENABLE_COMPRESSION	427	#if ENABLE_COMPRESSION
341	u8 cdata[MAX_MTU];	428	u8 cdata[MAX_MTU];
342		429
343	if (conn->features & ENABLE_COMPRESSION)	430	if (conn->features & FEATURE_COMPRESSION)
344	{	431	{
345	u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);	432	u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
346		433
347	if (cl)	434	if (cl)
348	{	435	{
…		…
467	#if ENABLE_COMPRESSION	554	#if ENABLE_COMPRESSION
468	f \|= FEATURE_COMPRESSION;	555	f \|= FEATURE_COMPRESSION;
469	#endif	556	#endif
470	#if ENABLE_ROHC	557	#if ENABLE_ROHC
471	f \|= FEATURE_ROHC;	558	f \|= FEATURE_ROHC;
		559	#endif
		560	#if ENABLE_BRIDGING
		561	f \|= FEATURE_BRIDGING;
472	#endif	562	#endif
473	return f;	563	return f;
474	}	564	}
475	};	565	};
476		566
…		…
524	rsaencrdata encr;	614	rsaencrdata encr;
525		615
526	auth_req_packet (int dst, bool initiate_, u8 protocols_)	616	auth_req_packet (int dst, bool initiate_, u8 protocols_)
527	{	617	{
528	config_packet::setup (PT_AUTH_REQ, dst);	618	config_packet::setup (PT_AUTH_REQ, dst);
529	strncpy (magic, MAGIC, 8);	619	strncpy (magic, MAGIC_OLD, 8);
530	initiate = !!initiate_;	620	initiate = !!initiate_;
531	protocols = protocols_;	621	protocols = protocols_;
532		622
533	len = sizeof (*this) - sizeof (net_packet);	623	len = sizeof (*this) - sizeof (net_packet);
534	}	624	}
…		…
583	/////////////////////////////////////////////////////////////////////////////	673	/////////////////////////////////////////////////////////////////////////////
584		674
585	void	675	void
586	connection::connection_established ()	676	connection::connection_established ()
587	{	677	{
		678	slog (L_NOISE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);
		679
588	if (ictx && octx)	680	if (ictx && octx)
589	{	681	{
590	connectmode = conf->connectmode;
591
592	// make sure rekeying timeouts are slightly asymmetric	682	// make sure rekeying timeouts are slightly asymmetric
593	rekey.start (NOW + ::conf.rekey	683	ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
594	+ (conf->id > THISNODE->id ? 10 : 0));	684	rekey.start (rekey_interval, rekey_interval);
595	keepalive.start (NOW + ::conf.keepalive);	685	keepalive.start (::conf.keepalive);
596		686
597	// send queued packets	687	// send queued packets
598	if (ictx && octx)	688	if (ictx && octx)
599	{	689	{
600	while (tap_packet p = (tap_packet )data_queue.get ())	690	while (tap_packet p = (tap_packet )data_queue.get ())
601	{	691	{
602	send_data_packet (p);	692	if (p->len) send_data_packet (p);
603	delete p;	693	delete p;
604	}	694	}
605		695
606	while (vpn_packet p = (vpn_packet )vpn_queue.get ())	696	while (vpn_packet p = (vpn_packet )vpn_queue.get ())
607	{	697	{
608	send_vpn_packet (p, si, IPTOS_RELIABILITY);	698	if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
609	delete p;	699	delete p;
610	}	700	}
611	}	701	}
		702
		703	vpn->connection_established (this);
612	}	704	}
613	else	705	else
614	{	706	{
615	retry_cnt = 0;	707	retry_cnt = 0;
616	establish_connection.start (NOW + 5);	708	establish_connection.start (5);
617	keepalive.stop ();	709	keepalive.stop ();
618	rekey.stop ();	710	rekey.stop ();
619	}	711	}
620	}	712	}
621		713
622	void	714	void
623	connection::reset_si ()	715	connection::reset_si ()
624	{	716	{
		717	if (vpn->can_direct (THISNODE, conf))
625	protocol = best_protocol (THISNODE->protocols & conf->protocols);	718	protocol = best_protocol (THISNODE->protocols & conf->connectable_protocols ());
626		719	else
627	// mask out protocols we cannot establish	720	{
628	if (!conf->udp_port) protocol &= ~PROT_UDPv4;	721	slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
629	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;	722	protocol = 0;
630	if (!conf->dns_port) protocol &= ~PROT_DNSv4;	723	}
631		724
632	si.set (conf, protocol);	725	si.set (conf, protocol);
		726
		727	is_direct = si.valid ();
633	}	728	}
634		729
635	// ensure sockinfo is valid, forward if necessary	730	// ensure sockinfo is valid, forward if necessary
636	const sockinfo &	731	const sockinfo &
637	connection::forward_si (const sockinfo &si) const	732	connection::forward_si (const sockinfo &si) const
638	{	733	{
639	if (!si.valid ())	734	if (!si.valid ())
640	{	735	{
641	connection *r = vpn->find_router ();	736	connection *r = vpn->find_router_for (this);
642		737
643	if (r)	738	if (r)
644	{	739	{
645	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"),	740	slog (L_DEBUG, _("%s: no common protocol, trying to route through %s."),
646	conf->nodename, r->conf->nodename, (const char *)r->si);	741	conf->nodename, r->conf->nodename);
647	return r->si;	742	return r->si;
648	}	743	}
649	else	744	else
650	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),	745	slog (L_DEBUG, _("%s: node unreachable, no common protocol or no router available."),
651	conf->nodename);	746	conf->nodename);
652	}	747	}
653		748
654	return si;	749	return si;
655	}	750	}
…		…
665	connection::send_ping (const sockinfo &si, u8 pong)	760	connection::send_ping (const sockinfo &si, u8 pong)
666	{	761	{
667	ping_packet *pkt = new ping_packet;	762	ping_packet *pkt = new ping_packet;
668		763
669	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);	764	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
		765
		766	slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
		767
670	send_vpn_packet (pkt, si, IPTOS_LOWDELAY);	768	send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
671		769
672	delete pkt;	770	delete pkt;
673	}	771	}
674		772
…		…
693		791
694	rsachallenge chg;	792	rsachallenge chg;
695	rsa_cache.gen (pkt->id, chg);	793	rsa_cache.gen (pkt->id, chg);
696	rsa_encrypt (conf->rsa_key, chg, pkt->encr);	794	rsa_encrypt (conf->rsa_key, chg, pkt->encr);
697		795
698	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);	796	slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
699		797
700	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly	798	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly
701		799
702	delete pkt;	800	delete pkt;
703	}	801	}
…		…
711		809
712	rsa_hash (id, chg, pkt->response);	810	rsa_hash (id, chg, pkt->response);
713		811
714	pkt->hmac_set (octx);	812	pkt->hmac_set (octx);
715		813
716	slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);	814	slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
717		815
718	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly	816	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
719		817
720	delete pkt;	818	delete pkt;
721	}	819	}
722		820
723	void	821	void
724	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)	822	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
725	{	823	{
726	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",	824	slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s)", conf->nodename,
727	conf->id, rid, (const char *)rsi);	825	vpn->conns[rid - 1]->conf->nodename, (const char *)rsi);
728		826
729	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);	827	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
730		828
731	r->hmac_set (octx);	829	r->hmac_set (octx);
732	send_vpn_packet (r, si);	830	send_vpn_packet (r, si);
733		831
734	delete r;	832	delete r;
735	}	833	}
736		834
737	void	835	inline void
738	connection::establish_connection_cb (time_watcher &w)	836	connection::establish_connection_cb (ev::timer &w, int revents)
739	{	837	{
740	if (!ictx	838	if (!ictx
741	&& conf != THISNODE	839	&& conf != THISNODE
742	&& connectmode != conf_node::C_NEVER	840	&& connectmode != conf_node::C_NEVER
743	&& connectmode != conf_node::C_DISABLED	841	&& connectmode != conf_node::C_DISABLED
744	&& NOW > w.at)	842	&& !w.is_active ())
745	{	843	{
746	w.at = TSTAMP_MAX; // first disable this watcher in case of recursion	844	// a bit hacky, if ondemand, and packets are no longer queued, then reset the connection
		845	// and stop trying. should probably be handled by a per-connection expire handler.
		846	if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())
		847	{
		848	reset_connection ();
		849	return;
		850	}
747		851
748	double retry_int = double (retry_cnt & 3	852	last_establish_attempt = ev_now ();
		853
		854	ev::tstamp retry_int = ev::tstamp (retry_cnt & 3
749	? (retry_cnt & 3) + 1	855	? (retry_cnt & 3) + 1
750	: 1 << (retry_cnt >> 2));	856	: 1 << (retry_cnt >> 2));
751		857
752	reset_si ();	858	reset_si ();
753		859
754	bool slow = si.prot & PROT_SLOW;	860	bool slow = si.prot & PROT_SLOW;
755		861
756	if (si.prot && !si.host)	862	if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
		863	{
		864	/TODO/ /* start the timer so we don't recurse endlessly */
		865	w.start (1);
757	vpn->send_connect_request (conf->id);	866	vpn->send_connect_request (this);
		867	}
758	else	868	else
759	{	869	{
		870	if (si.valid ())
		871	slog (L_DEBUG, _("%s: sending direct connection request to %s."),
		872	conf->nodename, (const char *)si);
		873
760	const sockinfo &dsi = forward_si (si);	874	const sockinfo &dsi = forward_si (si);
761		875
762	slow = slow \|\| (dsi.prot & PROT_SLOW);	876	slow = slow \|\| (dsi.prot & PROT_SLOW);
763		877
764	if (dsi.valid () && auth_rate_limiter.can (dsi))	878	if (dsi.valid () && auth_rate_limiter.can (dsi))
…		…
768	else	882	else
769	send_ping (dsi, 0);	883	send_ping (dsi, 0);
770	}	884	}
771	}	885	}
772		886
773	retry_int *= slow ? 8. : 0.7;	887	retry_int *= slow ? 8. : 0.9;
774		888
775	if (retry_int < conf->max_retry)	889	if (retry_int < conf->max_retry)
776	retry_cnt++;	890	retry_cnt++;
777	else	891	else
778	retry_int = conf->max_retry;	892	retry_int = conf->max_retry;
779		893
780	w.start (NOW + retry_int);	894	w.start (retry_int);
781	}	895	}
782	}	896	}
783		897
784	void	898	void
785	connection::reset_connection ()	899	connection::reset_connection ()
…		…
788	{	902	{
789	slog (L_INFO, _("%s(%s): connection lost"),	903	slog (L_INFO, _("%s(%s): connection lost"),
790	conf->nodename, (const char *)si);	904	conf->nodename, (const char *)si);
791		905
792	if (::conf.script_node_down)	906	if (::conf.script_node_down)
793	run_script (run_script_cb (this, &connection::script_node_down), false);	907	{
		908	run_script_cb *cb = new run_script_cb;
		909	cb->set<connection, &connection::script_node_down> (this);
		910	run_script_queued (cb, _("node-down command execution failed, continuing."));
		911	}
794	}	912	}
795		913
796	delete ictx; ictx = 0;	914	delete ictx; ictx = 0;
797	delete octx; octx = 0;	915	delete octx; octx = 0;
798	#if ENABLE_DNS	916	#if ENABLE_DNS
799	dnsv4_reset_connection ();	917	dnsv4_reset_connection ();
800	#endif	918	#endif
801		919
802	si.host = 0;	920	si.host = 0;
803		921
804	last_activity = 0;	922	last_activity = 0.;
		923	//last_si_change = 0.;
805	retry_cnt = 0;	924	retry_cnt = 0;
806		925
807	rekey.stop ();	926	rekey.stop ();
808	keepalive.stop ();	927	keepalive.stop ();
809	establish_connection.stop ();	928	establish_connection.stop ();
…		…
816	send_reset (si);	935	send_reset (si);
817		936
818	reset_connection ();	937	reset_connection ();
819	}	938	}
820		939
821	void	940	// poor-man's rekeying
822	connection::rekey_cb (time_watcher &w)	941	inline void
		942	connection::rekey_cb (ev::timer &w, int revents)
823	{	943	{
824	reset_connection ();	944	reset_connection ();
825	establish_connection ();	945	establish_connection ();
826	}	946	}
827		947
…		…
843	if (oseqno > MAX_SEQNO)	963	if (oseqno > MAX_SEQNO)
844	rekey ();	964	rekey ();
845	}	965	}
846		966
847	void	967	void
		968	connection::post_inject_queue ()
		969	{
		970	// force a connection every now and when when packets are sent (max 1/s)
		971	if (ev_now () - last_establish_attempt >= 0.95) // arbitrary
		972	establish_connection.stop ();
		973
		974	establish_connection ();
		975	}
		976
		977	void
848	connection::inject_data_packet (tap_packet pkt, bool broadcast/TODO DDD*/)	978	connection::inject_data_packet (tap_packet *pkt)
849	{	979	{
850	if (ictx && octx)	980	if (ictx && octx)
851	send_data_packet (pkt);	981	send_data_packet (pkt);
852	else	982	else
853	{	983	{
854	if (!broadcast)//DDDD
855	data_queue.put (new tap_packet (*pkt));	984	data_queue.put (new tap_packet (*pkt));
856		985	post_inject_queue ();
857	establish_connection ();
858	}	986	}
859	}	987	}
860		988
861	void connection::inject_vpn_packet (vpn_packet *pkt, int tos)	989	void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
862	{	990	{
863	if (ictx && octx)	991	if (ictx && octx)
864	send_vpn_packet (pkt, si, tos);	992	send_vpn_packet (pkt, si, tos);
865	else	993	else
866	{	994	{
867	vpn_queue.put ((vpn_packet )new data_packet ((data_packet *)pkt));	995	vpn_queue.put ((vpn_packet )new data_packet ((data_packet *)pkt));
868		996	post_inject_queue ();
869	establish_connection ();
870	}	997	}
871	}	998	}
872		999
873	void	1000	void
874	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	1001	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
875	{	1002	{
876	last_activity = NOW;	1003	last_activity = ev_now ();
877		1004
878	slog (L_NOISE, "<<%d received packet type %d from %d to %d",	1005	slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
879	conf->id, pkt->typ (), pkt->src (), pkt->dst ());	1006	conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
		1007
		1008	if (connectmode == conf_node::C_DISABLED)
		1009	return;
880		1010
881	switch (pkt->typ ())	1011	switch (pkt->typ ())
882	{	1012	{
883	case vpn_packet::PT_PING:	1013	case vpn_packet::PT_PING:
		1014	slog (L_TRACE, "%s >> PT_PING", conf->nodename);
		1015
884	// we send pings instead of auth packets after some retries,	1016	// we send pings instead of auth packets after some retries,
885	// so reset the retry counter and establish a connection	1017	// so reset the retry counter and establish a connection
886	// when we receive a ping.	1018	// when we receive a ping.
887	if (!ictx)	1019	if (!ictx)
888	{	1020	{
889	if (auth_rate_limiter.can (rsi))	1021	if (auth_rate_limiter.can (rsi))
890	send_auth_request (rsi, true);	1022	send_auth_request (rsi, true);
891	}	1023	}
892	else	1024	else
		1025	// we would love to change the socket address here, but ping's aren't
		1026	// authenticated, so we best ignore it.
893	send_ping (rsi, 1); // pong	1027	send_ping (rsi, 1); // pong
894		1028
895	break;	1029	break;
896		1030
897	case vpn_packet::PT_PONG:	1031	case vpn_packet::PT_PONG:
		1032	slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
		1033
		1034	// a PONG might mean that the other side doesn't really know
		1035	// about our desire for communication.
		1036	establish_connection ();
898	break;	1037	break;
899		1038
900	case vpn_packet::PT_RESET:	1039	case vpn_packet::PT_RESET:
901	{	1040	{
902	reset_connection ();	1041	reset_connection ();
903		1042
904	config_packet p = (config_packet ) pkt;	1043	config_packet p = (config_packet ) pkt;
905		1044
906	if (!p->chk_config ())	1045	if (!p->chk_config ())
907	{	1046	{
908	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),	1047	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
909	conf->nodename, (const char *)rsi);	1048	conf->nodename, (const char *)rsi);
910	connectmode = conf_node::C_DISABLED;	1049	connectmode = conf_node::C_DISABLED;
911	}	1050	}
912	else if (connectmode == conf_node::C_ALWAYS)	1051	else if (connectmode == conf_node::C_ALWAYS)
913	establish_connection ();	1052	establish_connection ();
…		…
917	case vpn_packet::PT_AUTH_REQ:	1056	case vpn_packet::PT_AUTH_REQ:
918	if (auth_rate_limiter.can (rsi))	1057	if (auth_rate_limiter.can (rsi))
919	{	1058	{
920	auth_req_packet p = (auth_req_packet ) pkt;	1059	auth_req_packet p = (auth_req_packet ) pkt;
921		1060
922	slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);	1061	slog (L_TRACE, "%s >> PT_AUTH_REQ(%s)", conf->nodename, p->initiate ? "initiate" : "reply");
923		1062
924	if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))	1063	if (p->chk_config ()
		1064	&& (!strncmp (p->magic, MAGIC_OLD, 8) \|\| !strncmp (p->magic, MAGIC, 8)))
925	{	1065	{
926	if (p->prot_minor != PROTOCOL_MINOR)	1066	if (p->prot_minor != PROTOCOL_MINOR)
927	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	1067	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
928	conf->nodename, (const char *)rsi,	1068	conf->nodename, (const char *)rsi,
929	PROTOCOL_MINOR, conf->nodename, p->prot_minor);	1069	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
…		…
955		1095
956	break;	1096	break;
957	}	1097	}
958	}	1098	}
959	else	1099	else
960	slog (L_WARN, _("%s(%s): protocol mismatch"),	1100	slog (L_WARN, _("%s(%s): protocol mismatch."),
961	conf->nodename, (const char *)rsi);	1101	conf->nodename, (const char *)rsi);
962		1102
963	send_reset (rsi);	1103	send_reset (rsi);
964	}	1104	}
965		1105
966	break;	1106	break;
967		1107
968	case vpn_packet::PT_AUTH_RES:	1108	case vpn_packet::PT_AUTH_RES:
969	{	1109	{
970	auth_res_packet p = (auth_res_packet ) pkt;	1110	auth_res_packet p = (auth_res_packet )pkt;
971		1111
972	slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);	1112	slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
973		1113
974	if (p->chk_config ())	1114	if (p->chk_config ())
975	{	1115	{
976	if (p->prot_minor != PROTOCOL_MINOR)	1116	if (p->prot_minor != PROTOCOL_MINOR)
977	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	1117	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
…		…
980		1120
981	rsachallenge chg;	1121	rsachallenge chg;
982		1122
983	if (!rsa_cache.find (p->id, chg))	1123	if (!rsa_cache.find (p->id, chg))
984	{	1124	{
985	slog (L_ERR, _("%s(%s): unrequested auth response ignored"),	1125	slog (L_ERR, _("%s(%s): unrequested auth response, ignoring."),
986	conf->nodename, (const char *)rsi);	1126	conf->nodename, (const char *)rsi);
987	break;	1127	break;
988	}	1128	}
989	else	1129	else
990	{	1130	{
991	crypto_ctx *cctx = new crypto_ctx (chg, 0);	1131	crypto_ctx *cctx = new crypto_ctx (chg, 0);
992		1132
993	if (!p->hmac_chk (cctx))	1133	if (!p->hmac_chk (cctx))
994	{	1134	{
995	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"	1135	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
996	"could be an attack, or just corruption or a synchronization error"),	1136	"could be an attack, or just corruption or a synchronization error."),
997	conf->nodename, (const char *)rsi);	1137	conf->nodename, (const char *)rsi);
998	break;	1138	break;
999	}	1139	}
1000	else	1140	else
1001	{	1141	{
…		…
1012	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid	1152	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
1013		1153
1014	si = rsi;	1154	si = rsi;
1015	protocol = rsi.prot;	1155	protocol = rsi.prot;
1016		1156
		1157	slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
		1158	conf->nodename, (const char *)rsi,
		1159	is_direct ? "direct" : "forwarded",
		1160	p->prot_major, p->prot_minor);
		1161
1017	connection_established ();	1162	connection_established ();
1018		1163
1019	slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
1020	conf->nodename, (const char *)rsi,
1021	p->prot_major, p->prot_minor);
1022
1023	if (::conf.script_node_up)	1164	if (::conf.script_node_up)
1024	run_script (run_script_cb (this, &connection::script_node_up), false);	1165	{
		1166	run_script_cb *cb = new run_script_cb;
		1167	cb->set<connection, &connection::script_node_up> (this);
		1168	run_script_queued (cb, _("node-up command execution failed, continuing."));
		1169	}
1025		1170
1026	break;	1171	break;
1027	}	1172	}
1028	else	1173	else
1029	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),	1174	slog (L_ERR, _("%s(%s): sent and received challenge do not match."),
1030	conf->nodename, (const char *)rsi);	1175	conf->nodename, (const char *)rsi);
1031	}	1176	}
1032		1177
1033	delete cctx;	1178	delete cctx;
1034	}	1179	}
…		…
1050	{	1195	{
1051	vpndata_packet p = (vpndata_packet )pkt;	1196	vpndata_packet p = (vpndata_packet )pkt;
1052		1197
1053	if (!p->hmac_chk (ictx))	1198	if (!p->hmac_chk (ictx))
1054	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"	1199	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1055	"could be an attack, or just corruption or a synchronization error"),	1200	"could be an attack, or just corruption or a synchronization error."),
1056	conf->nodename, (const char *)rsi);	1201	conf->nodename, (const char *)rsi);
1057	else	1202	else
1058	{	1203	{
1059	u32 seqno;	1204	u32 seqno;
1060	tap_packet *d = p->unpack (this, seqno);	1205	tap_packet *d = p->unpack (this, seqno);
		1206	int seqclass = iseqno.seqno_classify (seqno);
1061		1207
1062	if (iseqno.recv_ok (seqno))	1208	if (seqclass == 0) // ok
1063	{	1209	{
1064	vpn->tap->send (d);	1210	vpn->tap->send (d);
1065		1211
1066	if (si != rsi)	1212	if (si != rsi)
1067	{	1213	{
1068	// fast re-sync on connection changes, useful especially for tcp/ip	1214	// fast re-sync on source address changes, useful especially for tcp/ip
		1215	//if (last_si_change < ev_now () + 5.)
1069	si = rsi;	1216	// {
1070
1071	slog (L_INFO, _("%s(%s): socket address changed to %s"),	1217	slog (L_INFO, _("%s(%s): changing socket address to %s."),
1072	conf->nodename, (const char )si, (const char )rsi);	1218	conf->nodename, (const char )si, (const char )rsi);
		1219
		1220	si = rsi;
		1221
		1222	if (::conf.script_node_change)
		1223	{
		1224	run_script_cb *cb = new run_script_cb;
		1225	cb->set<connection, &connection::script_node_change> (this);
		1226	run_script_queued (cb, _("node-change command execution failed, continuing."));
		1227	}
		1228
		1229	// }
		1230	//else
		1231	// slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
		1232	// conf->nodename, (const char )si, (const char )rsi);
1073	}	1233	}
		1234	}
		1235	else if (seqclass == 1) // far history
		1236	slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
		1237	"possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
		1238	else if (seqclass == 2) // in-window duplicate, happens often on wireless
		1239	slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
		1240	"possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
		1241	else if (seqclass == 3) // reset
		1242	{
		1243	slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
		1244	"probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
		1245	send_reset (rsi);
1074	}	1246	}
1075		1247
1076	delete d;	1248	delete d;
1077	break;	1249	break;
1078	}	1250	}
…		…
1082	break;	1254	break;
1083		1255
1084	case vpn_packet::PT_CONNECT_REQ:	1256	case vpn_packet::PT_CONNECT_REQ:
1085	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1257	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1086	{	1258	{
1087	connect_req_packet p = (connect_req_packet ) pkt;	1259	connect_req_packet p = (connect_req_packet )pkt;
1088		1260
1089	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1261	if (p->id > 0 && p->id <= vpn->conns.size ())
1090	connection *c = vpn->conns[p->id - 1];
1091	conf->protocols = p->protocols;
1092
1093	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
1094	conf->id, p->id, c->ictx && c->octx);
1095
1096	if (c->ictx && c->octx)
1097	{	1262	{
		1263	connection *c = vpn->conns[p->id - 1];
		1264	conf->protocols = p->protocols;
		1265
		1266	slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s) [%d]",
		1267	conf->nodename, vpn->conns[p->id - 1]->conf->nodename, c->ictx && c->octx);
		1268
		1269	if (c->ictx && c->octx)
		1270	{
1098	// send connect_info packets to both sides, in case one is	1271	// send connect_info packets to both sides, in case one is
1099	// behind a nat firewall (or both ;)	1272	// behind a nat firewall (or both ;)
1100	c->send_connect_info (conf->id, si, conf->protocols);	1273	c->send_connect_info (conf->id, si, conf->protocols);
1101	send_connect_info (c->conf->id, c->si, c->conf->protocols);	1274	send_connect_info (c->conf->id, c->si, c->conf->protocols);
		1275	}
		1276	else
		1277	c->establish_connection ();
1102	}	1278	}
1103	else	1279	else
1104	c->establish_connection ();	1280	slog (L_WARN,
		1281	_("received authenticated connection request from unknown node #%d, config file mismatch?"),
		1282	p->id);
1105	}	1283	}
1106		1284
1107	break;	1285	break;
1108		1286
1109	case vpn_packet::PT_CONNECT_INFO:	1287	case vpn_packet::PT_CONNECT_INFO:
1110	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1288	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1111	{	1289	{
1112	connect_info_packet p = (connect_info_packet )pkt;	1290	connect_info_packet p = (connect_info_packet )pkt;
1113		1291
1114	if (p->id > 0 && p->id <= vpn->conns.size ()) // hmac-auth does not mean we accept anything	1292	if (p->id > 0 && p->id <= vpn->conns.size ())
1115	{	1293	{
1116	connection *c = vpn->conns[p->id - 1];	1294	connection *c = vpn->conns[p->id - 1];
1117		1295
1118	c->conf->protocols = p->protocols;	1296	c->conf->protocols = p->protocols;
1119	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));	1297	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1120	p->si.upgrade_protocol (protocol, c->conf);	1298	p->si.upgrade_protocol (protocol, c->conf);
1121		1299
1122	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1300	slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s) [%d]",
		1301	conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1123	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1302	(const char *)p->si, !c->ictx && !c->octx);
1124		1303
1125	const sockinfo &dsi = forward_si (p->si);	1304	const sockinfo &dsi = forward_si (p->si);
1126		1305
1127	if (dsi.valid ())	1306	if (dsi.valid ())
1128	c->send_auth_request (dsi, true);	1307	c->send_auth_request (dsi, true);
1129	}	1308	}
		1309	else
		1310	slog (L_WARN,
		1311	_("received authenticated connection request from unknown node #%d, config file mismatch?"),
		1312	p->id);
1130	}	1313	}
1131		1314
1132	break;	1315	break;
1133		1316
1134	default:	1317	default:
1135	send_reset (rsi);	1318	send_reset (rsi);
1136	break;	1319	break;
1137	}	1320	}
1138	}	1321	}
1139		1322
1140	void connection::keepalive_cb (time_watcher &w)	1323	inline void
		1324	connection::keepalive_cb (ev::timer &w, int revents)
1141	{	1325	{
1142	if (NOW >= last_activity + ::conf.keepalive + 30)	1326	if (ev_now () >= last_activity + ::conf.keepalive + 15)
1143	{	1327	{
1144	reset_connection ();	1328	reset_connection ();
1145	establish_connection ();	1329	establish_connection ();
1146	}	1330	}
1147	else if (NOW < last_activity + ::conf.keepalive)	1331	else if (ev_now () < last_activity + ::conf.keepalive)
1148	w.start (last_activity + ::conf.keepalive);	1332	w.start (last_activity + ::conf.keepalive - ev::now ());
1149	else if (conf->connectmode != conf_node::C_ONDEMAND	1333	else if (conf->connectmode != conf_node::C_ONDEMAND
1150	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)	1334	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)
1151	{	1335	{
1152	send_ping (si);	1336	send_ping (si);
1153	w.start (NOW + 5);	1337	w.start (3);
1154	}	1338	}
1155	else if (NOW < last_activity + ::conf.keepalive + 10)	1339	else if (ev_now () < last_activity + ::conf.keepalive + 10)
1156	// hold ondemand connections implicitly a few seconds longer	1340	// hold ondemand connections implicitly a few seconds longer
1157	// should delete octx, though, or something like that ;)	1341	// should delete octx, though, or something like that ;)
1158	w.start (last_activity + ::conf.keepalive + 10);	1342	w.start (last_activity + ::conf.keepalive + 10 - ev::now ());
1159	else	1343	else
1160	reset_connection ();	1344	reset_connection ();
1161	}	1345	}
1162		1346
1163	void connection::send_connect_request (int id)	1347	void connection::send_connect_request (int id)
1164	{	1348	{
1165	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);	1349	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1166		1350
1167	slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);	1351	slog (L_TRACE, "%s << PT_CONNECT_REQ(%s)",
		1352	conf->nodename, vpn->conns[id - 1]->conf->nodename);
1168	p->hmac_set (octx);	1353	p->hmac_set (octx);
1169	send_vpn_packet (p, si);	1354	send_vpn_packet (p, si);
1170		1355
1171	delete p;	1356	delete p;
1172	}	1357	}
1173		1358
1174	void connection::script_node ()	1359	void connection::script_init_env (const char *ext)
1175	{	1360	{
1176	vpn->script_if_up ();
1177
1178	char *env;	1361	char *env;
		1362	asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
		1363	asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
		1364	asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
		1365	0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
		1366	conf->id & 0xff); putenv (env);
		1367	}
		1368
		1369	void connection::script_init_connect_env ()
		1370	{
		1371	vpn->script_init_env ();
		1372
		1373	char *env;
1179	asprintf (&env, "DESTID=%d", conf->id); putenv (env);	1374	asprintf (&env, "DESTID=%d", conf->id); putenv (env);
		1375	asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env);
1180	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);	1376	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1181	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);	1377	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1182	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);	1378	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1183	}	1379	}
1184		1380
		1381	inline const char *
1185	const char *connection::script_node_up ()	1382	connection::script_node_up ()
1186	{	1383	{
1187	script_node ();	1384	script_init_connect_env ();
1188		1385
1189	putenv ("STATE=up");	1386	putenv ((char *)"STATE=up");
1190		1387
		1388	char *filename;
		1389	asprintf (&filename,
		1390	"%s/%s",
		1391	confbase,
1191	return ::conf.script_node_up ? ::conf.script_node_up : "node-up";	1392	::conf.script_node_up ? ::conf.script_node_up : "node-up");
1192	}
1193		1393
		1394	return filename;
		1395	}
		1396
		1397	inline const char *
		1398	connection::script_node_change ()
		1399	{
		1400	script_init_connect_env ();
		1401
		1402	putenv ((char *)"STATE=change");
		1403
		1404	char *filename;
		1405	asprintf (&filename,
		1406	"%s/%s",
		1407	confbase,
		1408	::conf.script_node_change ? ::conf.script_node_change : "node-change");
		1409
		1410	return filename;
		1411	}
		1412
		1413	inline const char *
1194	const char *connection::script_node_down ()	1414	connection::script_node_down ()
1195	{	1415	{
1196	script_node ();	1416	script_init_connect_env ();
1197		1417
1198	putenv ("STATE=down");	1418	putenv ((char *)"STATE=down");
1199		1419
1200	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";	1420	char *filename;
		1421	asprintf (&filename,
		1422	"%s/%s",
		1423	confbase,
		1424	::conf.script_node_down ? ::conf.script_node_down : "node-down");
		1425
		1426	return filename;
1201	}	1427	}
1202		1428
1203	connection::connection (struct vpn vpn, conf_node conf)	1429	connection::connection (struct vpn vpn, conf_node conf)
1204	: vpn(vpn), conf(conf)	1430	: vpn(vpn), conf(conf),
1205	, rekey (this, &connection::rekey_cb)
1206	, keepalive (this, &connection::keepalive_cb)
1207	, establish_connection (this, &connection::establish_connection_cb)
1208	#if ENABLE_DNS	1431	#if ENABLE_DNS
1209	, dns (0)	1432	dns (0),
1210	#endif	1433	#endif
		1434	data_queue(conf->max_ttl, conf->max_queue + 1),
		1435	vpn_queue(conf->max_ttl, conf->max_queue + 1)
1211	{	1436	{
		1437	rekey .set<connection, &connection::rekey_cb > (this);
		1438	keepalive .set<connection, &connection::keepalive_cb > (this);
		1439	establish_connection.set<connection, &connection::establish_connection_cb> (this);
		1440
		1441	last_establish_attempt = 0.;
1212	octx = ictx = 0;	1442	octx = ictx = 0;
1213	retry_cnt = 0;
1214		1443
1215	if (!conf->protocols) // make sure some protocol is enabled	1444	if (!conf->protocols) // make sure some protocol is enabled
1216	conf->protocols = PROT_UDPv4;	1445	conf->protocols = PROT_UDPv4;
1217		1446
1218	connectmode = conf_node::C_ALWAYS; // initial setting	1447	connectmode = conf->connectmode;
		1448
		1449	// queue a dummy packet to force an initial connection attempt
		1450	if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
		1451	vpn_queue.put (new net_packet);
		1452
1219	reset_connection ();	1453	reset_connection ();
1220	}	1454	}
1221		1455
1222	connection::~connection ()	1456	connection::~connection ()
1223	{	1457	{

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.49 by pcg, Sat Mar 12 18:10:40 2005 UTC vs. Revision 1.89 by root, Thu Dec 2 08:15:09 2010 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.49 by pcg, Sat Mar 12 18:10:40 2005 UTC vs.
Revision 1.89 by root, Thu Dec 2 08:15:09 2010 UTC