ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.57 by pcg, Thu Jul 7 14:41:51 2005 UTC vs.
Revision 1.101 by root, Wed Jul 17 16:40:57 2013 UTC

1/* 1/*
2 connection.C -- manage a single connection 2 connection.C -- manage a single connection
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
35#include <queue>
36#include <utility>
25 37
26#include <openssl/rand.h> 38#include <openssl/rand.h>
27#include <openssl/evp.h> 39#include <openssl/evp.h>
28#include <openssl/rsa.h> 40#include <openssl/rsa.h>
29#include <openssl/err.h> 41#include <openssl/err.h>
… …
31#include "conf.h" 43#include "conf.h"
32#include "slog.h" 44#include "slog.h"
33#include "device.h" 45#include "device.h"
34#include "vpn.h" 46#include "vpn.h"
35#include "connection.h" 47#include "connection.h"
48#include "hkdf.h"
36 49
37#include "netcompat.h" 50#include "netcompat.h"
38 51
39#if !HAVE_RAND_PSEUDO_BYTES
40# define RAND_pseudo_bytes RAND_bytes
41#endif
42
43#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 52#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic
53#define MAGIC "PORN\xbd\xc6\xdb\x82" // 8 bytes of magic//D
44 54
45#define ULTRA_FAST 1 55#define ULTRA_FAST 1
46#define HLOG 15 56#define HLOG 15
47#include "lzf/lzf.h" 57#include "lzf/lzf.h"
48#include "lzf/lzf_c.c" 58#include "lzf/lzf_c.c"
49#include "lzf/lzf_d.c" 59#include "lzf/lzf_d.c"
50 60
61//////////////////////////////////////////////////////////////////////////////
62
63static std::queue< std::pair<run_script_cb *, const char *> > rs_queue;
64static ev::child rs_child_ev;
65
66namespace
67{
68 void // c++ requires external linkage here, apparently :(
69 rs_child_cb (ev::child &w, int revents)
70 {
71 w.stop ();
72
73 if (rs_queue.empty ())
74 return;
75
76 pid_t pid = run_script (*rs_queue.front ().first, false);
77 if (pid)
78 {
79 w.set (pid);
80 w.start ();
81 }
82 else
83 slog (L_WARN, rs_queue.front ().second);
84
85 delete rs_queue.front ().first;
86 rs_queue.pop ();
87 }
88};
89
90// despite the fancy name, this is quite a hack
91static void
92run_script_queued (run_script_cb *cb, const char *warnmsg)
93{
94 rs_queue.push (std::make_pair (cb, warnmsg));
95
96 if (!rs_child_ev.is_active ())
97 {
98 rs_child_ev.set<rs_child_cb> ();
99 rs_child_ev ();
100 }
101}
102
103//////////////////////////////////////////////////////////////////////////////
104
51struct crypto_ctx 105struct crypto_ctx
52{ 106{
53 EVP_CIPHER_CTX cctx; 107 EVP_CIPHER_CTX cctx;
54 HMAC_CTX hctx; 108 HMAC_CTX hctx;
55 109
56 crypto_ctx (const rsachallenge &challenge, int enc); 110 crypto_ctx (const auth_data &auth1, const auth_data &auth2, const ecdh_key &a, const ecdh_key &b, int enc);
57 ~crypto_ctx (); 111 ~crypto_ctx ();
58}; 112};
59 113
60crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc) 114crypto_ctx::crypto_ctx (const auth_data &auth1, const auth_data &auth2, const ecdh_key &a, const ecdh_key &b, int enc)
61{ 115{
116 ecdh_key s;
117
118 curve25519_combine (a, b, s);
119
120 {
121 u8 mac_key[MAC_KEYSIZE];
122 static const unsigned char mac_info[] = "gvpe mac key";
123
124 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
125 kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
126 kdf.extract (auth1.rsa.mac_key, sizeof (auth1.rsa.mac_key));
127 kdf.extract (s, sizeof (s));
128 kdf.extract_done (HKDF_PRF_HASH ());
129 kdf.expand (mac_key, sizeof (mac_key), mac_info, sizeof (mac_info));
130
131 HMAC_CTX_init (&hctx);
132 require (HMAC_Init_ex (&hctx, mac_key, MAC_KEYSIZE, MAC_DIGEST (), 0));
133 }
134
135 {
136 u8 cipher_key[CIPHER_KEYSIZE];
137 static const unsigned char cipher_info[] = "gvpe cipher key";
138
139 hkdf kdf (auth2.rsa.hkdf_salt, sizeof (auth2.rsa.hkdf_salt), HKDF_XTR_HASH ());
140 kdf.extract (auth2.rsa.ikm, sizeof (auth2.rsa.ikm));
141 kdf.extract (auth1.rsa.cipher_key, sizeof (auth1.rsa.cipher_key));
142 kdf.extract (s, sizeof (s));
143 kdf.extract_done (HKDF_PRF_HASH ());
144 kdf.expand (cipher_key, sizeof (cipher_key), cipher_info, sizeof (cipher_info));
145
62 EVP_CIPHER_CTX_init (&cctx); 146 EVP_CIPHER_CTX_init (&cctx);
63 require (EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc)); 147 require (EVP_CipherInit_ex (&cctx, CIPHER (), 0, cipher_key, 0, enc));
64 HMAC_CTX_init (&hctx); 148 }
65 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
66} 149}
67 150
68crypto_ctx::~crypto_ctx () 151crypto_ctx::~crypto_ctx ()
69{ 152{
70 require (EVP_CIPHER_CTX_cleanup (&cctx)); 153 require (EVP_CIPHER_CTX_cleanup (&cctx));
71 HMAC_CTX_cleanup (&hctx); 154 HMAC_CTX_cleanup (&hctx);
72} 155}
73 156
157static inline void
158auth_encrypt (RSA *key, const auth_data &auth, auth_encr &encr)
159{
160 if (RSA_public_encrypt (sizeof (auth.rsa),
161 (unsigned char *)&auth.rsa, (unsigned char *)&encr.rsa,
162 key, RSA_PKCS1_OAEP_PADDING) < 0)
163 fatal ("RSA_public_encrypt error");
164
165 memcpy (&encr.ecdh, &auth.ecdh, sizeof (encr.ecdh));
166}
167
168static inline bool
169auth_decrypt (RSA *key, const auth_encr &encr, auth_data &auth)
170{
171 u8 rsa_decrypt[RSA_KEYLEN];
172
173 if (RSA_private_decrypt (sizeof (encr.rsa),
174 (const unsigned char *)&encr.rsa, (unsigned char *)rsa_decrypt,
175 key, RSA_PKCS1_OAEP_PADDING) != sizeof (auth.rsa))
176 return 0;
177
178 memcpy (&auth.rsa, rsa_decrypt, sizeof (auth.rsa));
179 memcpy (&auth.ecdh, &encr.ecdh, sizeof (auth.ecdh));
180
181 return 1;
182}
183
74static void 184static void
75rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h) 185auth_hash (const auth_data &auth, auth_mac &mac)
76{ 186{
77 EVP_MD_CTX ctx; 187 HMAC_CTX ctx;
78 188
79 EVP_MD_CTX_init (&ctx); 189 HMAC_CTX_init (&ctx);
80 require (EVP_DigestInit (&ctx, RSA_HASH)); 190 require (HMAC_Init_ex (&ctx, auth.rsa.auth_key, sizeof (auth.rsa.auth_key), AUTH_DIGEST (), 0));
81 require (EVP_DigestUpdate(&ctx, &chg, sizeof chg)); 191 require (HMAC_Update (&ctx, (const unsigned char *)&auth, sizeof auth));
82 require (EVP_DigestUpdate(&ctx, &id, sizeof id));
83 require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0)); 192 require (HMAC_Final (&ctx, (unsigned char *)&mac, 0));
84 EVP_MD_CTX_cleanup (&ctx); 193 HMAC_CTX_cleanup (&ctx);
85} 194}
86 195
87struct rsa_entry { 196void
88 tstamp expire; 197connection::generate_auth_data ()
89 rsaid id;
90 rsachallenge chg;
91};
92
93struct rsa_cache : list<rsa_entry>
94{ 198{
95 void cleaner_cb (time_watcher &w); time_watcher cleaner; 199 if (auth_expire < ev_now ())
96
97 bool find (const rsaid &id, rsachallenge &chg)
98 {
99 for (iterator i = begin (); i != end (); ++i)
100 { 200 {
101 if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW) 201 // request data
102 { 202 rand_fill (snd_auth.rsa);
103 memcpy (&chg, &i->chg, sizeof chg); 203 curve25519_generate (snd_ecdh_a, snd_auth.ecdh);
204 auth_hash (snd_auth, snd_auth_mac);
104 205
105 erase (i); 206 // eventual response data
106 return true; 207 curve25519_generate (rcv_ecdh_a, rcv_ecdh_b);
107 }
108 } 208 }
109 209
110 if (cleaner.at < NOW) 210 // every use prolongs the expiry
111 cleaner.start (NOW + RSA_TTL); 211 auth_expire = ev_now () + AUTH_TTL;
112
113 return false;
114 }
115
116 void gen (rsaid &id, rsachallenge &chg)
117 {
118 rsa_entry e;
119
120 RAND_bytes ((unsigned char *)&id, sizeof id);
121 RAND_bytes ((unsigned char *)&chg, sizeof chg);
122
123 e.expire = NOW + RSA_TTL;
124 e.id = id;
125 memcpy (&e.chg, &chg, sizeof chg);
126
127 push_back (e);
128
129 if (cleaner.at < NOW)
130 cleaner.start (NOW + RSA_TTL);
131 }
132
133 rsa_cache ()
134 : cleaner (this, &rsa_cache::cleaner_cb)
135 { }
136
137} rsa_cache;
138
139void rsa_cache::cleaner_cb (time_watcher &w)
140{
141 if (!empty ())
142 {
143 w.start (NOW + RSA_TTL);
144
145 for (iterator i = begin (); i != end (); )
146 if (i->expire <= NOW)
147 i = erase (i);
148 else
149 ++i;
150 }
151} 212}
152 213
153////////////////////////////////////////////////////////////////////////////// 214//////////////////////////////////////////////////////////////////////////////
154 215
155void pkt_queue::put (net_packet *p) 216pkt_queue::pkt_queue (double max_ttl, int max_queue)
217: max_ttl (max_ttl), max_queue (max_queue)
156{ 218{
157 if (queue[i]) 219 queue = new pkt [max_queue];
158 {
159 delete queue[i];
160 j = (j + 1) % QUEUEDEPTH;
161 }
162 220
163 queue[i] = p;
164
165 i = (i + 1) % QUEUEDEPTH;
166}
167
168net_packet *pkt_queue::get ()
169{
170 net_packet *p = queue[j];
171
172 if (p)
173 {
174 queue[j] = 0;
175 j = (j + 1) % QUEUEDEPTH;
176 }
177
178 return p;
179}
180
181pkt_queue::pkt_queue ()
182{
183 memset (queue, 0, sizeof (queue));
184 i = 0; 221 i = 0;
185 j = 0; 222 j = 0;
223
224 expire.set<pkt_queue, &pkt_queue::expire_cb> (this);
186} 225}
187 226
188pkt_queue::~pkt_queue () 227pkt_queue::~pkt_queue ()
189{ 228{
190 for (i = QUEUEDEPTH; --i > 0; ) 229 while (net_packet *p = get ())
230 delete p;
231
191 delete queue[i]; 232 delete [] queue;
192} 233}
193 234
235void
236pkt_queue::expire_cb (ev::timer &w, int revents)
237{
238 ev_tstamp expire = ev_now () - max_ttl;
239
240 for (;;)
241 {
242 if (empty ())
243 break;
244
245 double diff = queue[j].tstamp - expire;
246
247 if (diff >= 0.)
248 {
249 w.start (diff > 0.5 ? diff : 0.5);
250 break;
251 }
252
253 delete get ();
254 }
255}
256
257void
258pkt_queue::put (net_packet *p)
259{
260 ev_tstamp now = ev_now ();
261
262 // start expiry timer
263 if (empty ())
264 expire.start (max_ttl);
265
266 int ni = i + 1 == max_queue ? 0 : i + 1;
267
268 if (ni == j)
269 delete get ();
270
271 queue[i].pkt = p;
272 queue[i].tstamp = now;
273
274 i = ni;
275}
276
277net_packet *
278pkt_queue::get ()
279{
280 if (empty ())
281 return 0;
282
283 net_packet *p = queue[j].pkt;
284 queue[j].pkt = 0;
285
286 j = j + 1 == max_queue ? 0 : j + 1;
287
288 return p;
289}
290
194struct net_rateinfo { 291struct net_rateinfo
292{
195 u32 host; 293 u32 host;
196 double pcnt, diff; 294 double pcnt, diff;
197 tstamp last; 295 tstamp last;
198}; 296};
199 297
… …
209 307
210 bool can (const sockinfo &si) { return can((u32)si.host); } 308 bool can (const sockinfo &si) { return can((u32)si.host); }
211 bool can (u32 host); 309 bool can (u32 host);
212}; 310};
213 311
214net_rate_limiter auth_rate_limiter, reset_rate_limiter; 312static net_rate_limiter auth_rate_limiter, reset_rate_limiter;
215 313
314bool
216bool net_rate_limiter::can (u32 host) 315net_rate_limiter::can (u32 host)
217{ 316{
218 iterator i; 317 iterator i;
219 318
220 for (i = begin (); i != end (); ) 319 for (i = begin (); i != end (); )
221 if (i->host == host) 320 if (i->host == host)
222 break; 321 break;
223 else if (i->last < NOW - NRL_EXPIRE) 322 else if (i->last < ev_now () - NRL_EXPIRE)
224 i = erase (i); 323 i = erase (i);
225 else 324 else
226 i++; 325 i++;
227 326
228 if (i == end ()) 327 if (i == end ())
… …
230 net_rateinfo ri; 329 net_rateinfo ri;
231 330
232 ri.host = host; 331 ri.host = host;
233 ri.pcnt = 1.; 332 ri.pcnt = 1.;
234 ri.diff = NRL_MAXDIF; 333 ri.diff = NRL_MAXDIF;
235 ri.last = NOW; 334 ri.last = ev_now ();
236 335
237 push_front (ri); 336 push_front (ri);
238 337
239 return true; 338 return true;
240 } 339 }
… …
242 { 341 {
243 net_rateinfo ri (*i); 342 net_rateinfo ri (*i);
244 erase (i); 343 erase (i);
245 344
246 ri.pcnt = ri.pcnt * NRL_ALPHA; 345 ri.pcnt = ri.pcnt * NRL_ALPHA;
247 ri.diff = ri.diff * NRL_ALPHA + (NOW - ri.last); 346 ri.diff = ri.diff * NRL_ALPHA + (ev_now () - ri.last);
248 347
249 ri.last = NOW; 348 ri.last = ev_now ();
250 349
251 double dif = ri.diff / ri.pcnt; 350 double dif = ri.diff / ri.pcnt;
252 351
253 bool send = dif > NRL_CUTOFF; 352 bool send = dif > NRL_CUTOFF;
254 353
… …
268 367
269///////////////////////////////////////////////////////////////////////////// 368/////////////////////////////////////////////////////////////////////////////
270 369
271unsigned char hmac_packet::hmac_digest[EVP_MAX_MD_SIZE]; 370unsigned char hmac_packet::hmac_digest[EVP_MAX_MD_SIZE];
272 371
372void
273void hmac_packet::hmac_gen (crypto_ctx *ctx) 373hmac_packet::hmac_gen (crypto_ctx *ctx)
274{ 374{
275 unsigned int xlen; 375 unsigned int xlen;
276 376
277 HMAC_CTX *hctx = &ctx->hctx; 377 HMAC_CTX *hctx = &ctx->hctx;
278 378
279 HMAC_Init_ex (hctx, 0, 0, 0, 0); 379 require (HMAC_Init_ex (hctx, 0, 0, 0, 0));
280 HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet), 380 require (HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet),
281 len - sizeof (hmac_packet)); 381 len - sizeof (hmac_packet)));
282 HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen); 382 require (HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen));
283} 383}
284 384
285void 385void
286hmac_packet::hmac_set (crypto_ctx *ctx) 386hmac_packet::hmac_set (crypto_ctx *ctx)
287{ 387{
… …
296 hmac_gen (ctx); 396 hmac_gen (ctx);
297 397
298 return !memcmp (hmac, hmac_digest, HMACLENGTH); 398 return !memcmp (hmac, hmac_digest, HMACLENGTH);
299} 399}
300 400
401void
301void vpn_packet::set_hdr (ptype type_, unsigned int dst) 402vpn_packet::set_hdr (ptype type_, unsigned int dst)
302{ 403{
303 type = type_; 404 type = type_;
304 405
305 int src = THISNODE->id; 406 int src = THISNODE->id;
306 407
… …
311 412
312#define MAXVPNDATA (MAX_MTU - 6 - 6) 413#define MAXVPNDATA (MAX_MTU - 6 - 6)
313#define DATAHDR (sizeof (u32) + RAND_SIZE) 414#define DATAHDR (sizeof (u32) + RAND_SIZE)
314 415
315struct vpndata_packet : vpn_packet 416struct vpndata_packet : vpn_packet
417{
418 u8 data[MAXVPNDATA + DATAHDR]; // seqno
419
420 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
421 tap_packet *unpack (connection *conn, u32 &seqno);
422
423private:
424 const u32 data_hdr_size () const
316 { 425 {
317 u8 data[MAXVPNDATA + DATAHDR]; // seqno
318
319 void setup (connection *conn, int dst, u8 *d, u32 len, u32 seqno);
320 tap_packet *unpack (connection *conn, u32 &seqno);
321private:
322
323 const u32 data_hdr_size () const
324 {
325 return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR; 426 return sizeof (vpndata_packet) - sizeof (net_packet) - MAXVPNDATA - DATAHDR;
326 }
327 }; 427 }
428};
328 429
329void 430void
330vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno) 431vpndata_packet::setup (connection *conn, int dst, u8 *d, u32 l, u32 seqno)
331{ 432{
332 EVP_CIPHER_CTX *cctx = &conn->octx->cctx; 433 EVP_CIPHER_CTX *cctx = &conn->octx->cctx;
… …
334 ptype type = PT_DATA_UNCOMPRESSED; 435 ptype type = PT_DATA_UNCOMPRESSED;
335 436
336#if ENABLE_COMPRESSION 437#if ENABLE_COMPRESSION
337 u8 cdata[MAX_MTU]; 438 u8 cdata[MAX_MTU];
338 439
339 if (conn->features & ENABLE_COMPRESSION) 440 if (conn->features & FEATURE_COMPRESSION)
340 { 441 {
341 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7); 442 u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
342 443
343 if (cl) 444 if (cl)
344 { 445 {
… …
350 d[1] = cl; 451 d[1] = cl;
351 } 452 }
352 } 453 }
353#endif 454#endif
354 455
355 require (EVP_EncryptInit_ex (cctx, 0, 0, 0, 0)); 456 require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 1));
356 457
357 struct { 458 struct {
358#if RAND_SIZE 459#if RAND_SIZE
359 u8 rnd[RAND_SIZE]; 460 u8 rnd[RAND_SIZE];
360#endif 461#endif
361 u32 seqno; 462 u32 seqno;
362 } datahdr; 463 } datahdr;
363 464
364 datahdr.seqno = ntohl (seqno); 465 datahdr.seqno = ntohl (seqno);
365#if RAND_SIZE 466#if RAND_SIZE
366 RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE); 467 require (RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE) >= 0);
367#endif 468#endif
368 469
369 require (EVP_EncryptUpdate (cctx, 470 require (EVP_EncryptUpdate (cctx,
370 (unsigned char *) data + outl, &outl2, 471 (unsigned char *) data + outl, &outl2,
371 (unsigned char *) &datahdr, DATAHDR)); 472 (unsigned char *) &datahdr, DATAHDR));
… …
393 int outl = 0, outl2; 494 int outl = 0, outl2;
394 tap_packet *p = new tap_packet; 495 tap_packet *p = new tap_packet;
395 u8 *d; 496 u8 *d;
396 u32 l = len - data_hdr_size (); 497 u32 l = len - data_hdr_size ();
397 498
398 require (EVP_DecryptInit_ex (cctx, 0, 0, 0, 0)); 499 require (EVP_CipherInit_ex (cctx, 0, 0, 0, 0, 0));
399 500
400#if ENABLE_COMPRESSION 501#if ENABLE_COMPRESSION
401 u8 cdata[MAX_MTU]; 502 u8 cdata[MAX_MTU];
402 503
403 if (type == PT_DATA_COMPRESSED) 504 if (type == PT_DATA_COMPRESSED)
404 d = cdata; 505 d = cdata;
405 else 506 else
406#endif 507#endif
407 d = &(*p)[6 + 6 - DATAHDR]; 508 d = &(*p)[6 + 6] - DATAHDR;
408 509
409 /* this overwrites part of the src mac, but we fix that later */ 510 // we play do evil games with the struct layout atm.
511 // pending better solutions, we at least do some verification.
512 // this is fine, as we left ISO territory long ago.
513 require (DATAHDR <= 16);
514 require ((u8 *)(&p->len + 1) == &(*p)[0]);
515
516 // this can overwrite the len/dst/src fields
410 require (EVP_DecryptUpdate (cctx, 517 require (EVP_DecryptUpdate (cctx,
411 d, &outl2, 518 d, &outl2,
412 (unsigned char *)&data, len - data_hdr_size ())); 519 (unsigned char *)&data, len - data_hdr_size ()));
413 outl += outl2; 520 outl += outl2;
414 521
… …
445 } 552 }
446}; 553};
447 554
448struct config_packet : vpn_packet 555struct config_packet : vpn_packet
449{ 556{
450 // actually, hmaclen cannot be checked because the hmac
451 // field comes before this data, so peers with other
452 // hmacs simply will not work.
453 u8 prot_major, prot_minor, randsize, hmaclen; 557 u8 prot_major, prot_minor, randsize;
454 u8 flags, challengelen, features, pad3; 558 u8 flags, features, pad6, pad7, pad8;
455 u32 cipher_nid, digest_nid, hmac_nid; 559 u32 cipher_nid, mac_nid, auth_nid;
456 560
457 void setup (ptype type, int dst); 561 void setup (ptype type, int dst);
458 bool chk_config () const; 562 bool chk_config () const;
459 563
460 static u8 get_features () 564 static u8 get_features ()
… …
464 f |= FEATURE_COMPRESSION; 568 f |= FEATURE_COMPRESSION;
465#endif 569#endif
466#if ENABLE_ROHC 570#if ENABLE_ROHC
467 f |= FEATURE_ROHC; 571 f |= FEATURE_ROHC;
468#endif 572#endif
573#if ENABLE_BRIDGING
574 f |= FEATURE_BRIDGING;
575#endif
469 return f; 576 return f;
470 } 577 }
471}; 578};
472 579
580void
473void config_packet::setup (ptype type, int dst) 581config_packet::setup (ptype type, int dst)
474{ 582{
475 prot_major = PROTOCOL_MAJOR; 583 prot_major = PROTOCOL_MAJOR;
476 prot_minor = PROTOCOL_MINOR; 584 prot_minor = PROTOCOL_MINOR;
477 randsize = RAND_SIZE; 585 randsize = RAND_SIZE;
478 hmaclen = HMACLENGTH;
479 flags = 0; 586 flags = 0;
480 challengelen = sizeof (rsachallenge);
481 features = get_features (); 587 features = get_features ();
482 588
483 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER)); 589 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER ()));
484 digest_nid = htonl (EVP_MD_type (RSA_HASH));
485 hmac_nid = htonl (EVP_MD_type (DIGEST)); 590 mac_nid = htonl (EVP_MD_type (MAC_DIGEST ()));
591 auth_nid = htonl (EVP_MD_type (AUTH_DIGEST ()));
486 592
487 len = sizeof (*this) - sizeof (net_packet); 593 len = sizeof (*this) - sizeof (net_packet);
488 set_hdr (type, dst); 594 set_hdr (type, dst);
489} 595}
490 596
597bool
491bool config_packet::chk_config () const 598config_packet::chk_config () const
492{ 599{
493 if (prot_major != PROTOCOL_MAJOR) 600 if (prot_major != PROTOCOL_MAJOR)
494 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR); 601 slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
495 else if (randsize != RAND_SIZE) 602 else if (randsize != RAND_SIZE)
496 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE); 603 slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
497 else if (hmaclen != HMACLENGTH)
498 slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
499 else if (challengelen != sizeof (rsachallenge))
500 slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
501 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER))) 604 else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER ())))
502 slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER)); 605 slog (L_WARN, _("cipher algo mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER ()));
503 else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
504 slog (L_WARN, _("digest mismatch (remote %x <=> local %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
505 else if (hmac_nid != htonl (EVP_MD_type (DIGEST))) 606 else if (mac_nid != htonl (EVP_MD_type (MAC_DIGEST ())))
506 slog (L_WARN, _("hmac mismatch (remote %x <=> local %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST)); 607 slog (L_WARN, _("mac algo mismatch (remote %x <=> local %x)"), ntohl (mac_nid), EVP_MD_type (MAC_DIGEST ()));
608 else if (auth_nid != htonl (EVP_MD_type (AUTH_DIGEST ())))
609 slog (L_WARN, _("auth algo mismatch (remote %x <=> local %x)"), ntohl (auth_nid), EVP_MD_type (AUTH_DIGEST ()));
507 else 610 else
508 return true; 611 return true;
509 612
510 return false; 613 return false;
511} 614}
512 615
513struct auth_req_packet : config_packet 616struct auth_req_packet : config_packet // UNPROTECTED
514{ 617{
515 char magic[8]; 618 char magic[8];
516 u8 initiate; // false if this is just an automatic reply 619 u8 initiate; // false if this is just an automatic reply
517 u8 protocols; // supported protocols (will be patched on forward) 620 u8 protocols; // supported protocols (will be patched on forward)
518 u8 pad2, pad3; 621 u8 pad2, pad3;
519 rsaid id; 622 auth_encr encr;
520 rsaencrdata encr;
521 623
522 auth_req_packet (int dst, bool initiate_, u8 protocols_) 624 auth_req_packet (int dst, bool initiate_, u8 protocols_)
523 { 625 {
524 config_packet::setup (PT_AUTH_REQ, dst); 626 config_packet::setup (PT_AUTH_REQ, dst);
525 strncpy (magic, MAGIC, 8); 627 memcpy (magic, MAGIC, 8);
526 initiate = !!initiate_; 628 initiate = !!initiate_;
527 protocols = protocols_; 629 protocols = protocols_;
528 630
529 len = sizeof (*this) - sizeof (net_packet); 631 len = sizeof (*this) - sizeof (net_packet);
530 } 632 }
531}; 633};
532 634
533struct auth_res_packet : config_packet 635struct auth_res_packet : config_packet // UNPROTECTED
534{ 636{
535 rsaid id;
536 u8 pad1, pad2, pad3;
537 u8 response_len; // encrypted length
538 rsaresponse response; 637 auth_response response;
539 638
540 auth_res_packet (int dst) 639 auth_res_packet (int dst)
541 { 640 {
542 config_packet::setup (PT_AUTH_RES, dst); 641 config_packet::setup (PT_AUTH_RES, dst);
543 642
… …
577}; 676};
578 677
579///////////////////////////////////////////////////////////////////////////// 678/////////////////////////////////////////////////////////////////////////////
580 679
581void 680void
582connection::connection_established () 681connection::connection_established (const sockinfo &rsi)
583{ 682{
683 if (!have_snd_auth || !have_rcv_auth)
684 return;
685
686 si = rsi;
687 protocol = rsi.prot;
688
689 slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
690 conf->nodename, (const char *)rsi,
691 is_direct ? "direct" : "forwarded",
692 PROTOCOL_MAJOR, prot_minor);
693
694 if (::conf.script_node_up)
695 {
696 run_script_cb *cb = new run_script_cb;
697 cb->set<connection, &connection::script_node_up> (this);
698 run_script_queued (cb, _("node-up command execution failed, continuing."));
699 }
700
701 delete ictx; ictx = new crypto_ctx (rcv_auth, snd_auth, rcv_ecdh_a, rcv_auth.ecdh, 0);
702 iseqno.reset (ntohl (rcv_auth.rsa.seqno) & 0x7fffffff);
703
704 delete octx; octx = new crypto_ctx (snd_auth, rcv_auth, snd_ecdh_a, snd_ecdh_b , 1);
705 oseqno = ntohl (snd_auth.rsa.seqno) & 0x7fffffff;
706
584 if (ictx && octx) 707 if (ictx && octx)
585 { 708 {
586 connectmode = conf->connectmode;
587
588 // make sure rekeying timeouts are slightly asymmetric 709 // make sure rekeying timeouts are slightly asymmetric
589 rekey.start (NOW + ::conf.rekey 710 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
590 + (conf->id > THISNODE->id ? 10 : 0)); 711 rekey.start (rekey_interval, rekey_interval);
712
591 keepalive.start (NOW + ::conf.keepalive); 713 keepalive.start (::conf.keepalive);
592 714
593 // send queued packets 715 // send queued packets
594 if (ictx && octx) 716 if (ictx && octx)
595 { 717 {
596 while (tap_packet *p = (tap_packet *)data_queue.get ()) 718 while (tap_packet *p = (tap_packet *)data_queue.get ())
597 { 719 {
598 send_data_packet (p); 720 if (p->len) send_data_packet (p);
599 delete p; 721 delete p;
600 } 722 }
601 723
602 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ()) 724 while (vpn_packet *p = (vpn_packet *)vpn_queue.get ())
603 { 725 {
604 send_vpn_packet (p, si, IPTOS_RELIABILITY); 726 if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
605 delete p; 727 delete p;
606 } 728 }
607 } 729 }
730
731 vpn->connection_established (this);
608 } 732 }
733#if 0
609 else 734 else
610 { 735 {
611 retry_cnt = 0; 736 retry_cnt = 0;
612 establish_connection.start (NOW + 5); 737 establish_connection.start (5);
613 keepalive.stop (); 738 keepalive.stop ();
614 rekey.stop (); 739 rekey.stop ();
615 } 740 }
741#endif
616} 742}
617 743
618void 744void
619connection::reset_si () 745connection::reset_si ()
620{ 746{
747 if (vpn->can_direct (THISNODE, conf))
621 protocol = best_protocol (THISNODE->protocols & conf->protocols); 748 protocol = best_protocol (THISNODE->protocols & conf->connectable_protocols ());
622 749 else
623 // mask out protocols we cannot establish 750 {
624 if (!conf->udp_port) protocol &= ~PROT_UDPv4; 751 slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
625 if (!conf->tcp_port) protocol &= ~PROT_TCPv4; 752 protocol = 0;
626 if (!conf->dns_port) protocol &= ~PROT_DNSv4; 753 }
627 754
628 si.set (conf, protocol); 755 si.set (conf, protocol);
756
757 is_direct = si.valid ();
629} 758}
630 759
631// ensure sockinfo is valid, forward if necessary 760// ensure sockinfo is valid, forward if necessary
632const sockinfo & 761const sockinfo &
633connection::forward_si (const sockinfo &si) const 762connection::forward_si (const sockinfo &si) const
634{ 763{
635 if (!si.valid ()) 764 if (!si.valid ())
636 { 765 {
637 connection *r = vpn->find_router (); 766 connection *r = vpn->find_router_for (this);
638 767
639 if (r) 768 if (r)
640 { 769 {
641 slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"), 770 slog (L_DEBUG, _("%s: no common protocol, trying to route through %s."),
642 conf->nodename, r->conf->nodename, (const char *)r->si); 771 conf->nodename, r->conf->nodename);
643 return r->si; 772 return r->si;
644 } 773 }
645 else 774 else
646 slog (L_DEBUG, _("%s: node unreachable, no common protocol"), 775 slog (L_DEBUG, _("%s: node unreachable, no common protocol or no router available."),
647 conf->nodename); 776 conf->nodename);
648 } 777 }
649 778
650 return si; 779 return si;
651} 780}
… …
661connection::send_ping (const sockinfo &si, u8 pong) 790connection::send_ping (const sockinfo &si, u8 pong)
662{ 791{
663 ping_packet *pkt = new ping_packet; 792 ping_packet *pkt = new ping_packet;
664 793
665 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 794 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
795
796 slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
666 send_vpn_packet (pkt, si, IPTOS_LOWDELAY); 797 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
667 798
668 delete pkt; 799 delete pkt;
669} 800}
670 801
… …
685void 816void
686connection::send_auth_request (const sockinfo &si, bool initiate) 817connection::send_auth_request (const sockinfo &si, bool initiate)
687{ 818{
688 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols); 819 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
689 820
690 rsachallenge chg; 821 generate_auth_data ();
691 rsa_cache.gen (pkt->id, chg);
692 rsa_encrypt (conf->rsa_key, chg, pkt->encr); 822 auth_encrypt (conf->rsa_key, snd_auth, pkt->encr);
693 823
694 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 824 slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
695
696 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly 825 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
697 826
698 delete pkt; 827 delete pkt;
699} 828}
700 829
701void 830void
702connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg) 831connection::send_auth_response (const sockinfo &si)
703{ 832{
704 auth_res_packet *pkt = new auth_res_packet (conf->id); 833 auth_res_packet *pkt = new auth_res_packet (conf->id);
705 834
706 pkt->id = id; 835 auth_hash (rcv_auth, pkt->response.mac);
836 memcpy (pkt->response.ecdh, rcv_ecdh_b, sizeof (rcv_ecdh_b));
707 837
708 rsa_hash (id, chg, pkt->response);
709
710 pkt->hmac_set (octx);
711
712 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si); 838 slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
713
714 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 839 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
715 840
716 delete pkt; 841 delete pkt;
717} 842}
718 843
719void 844void
720connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols) 845connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
721{ 846{
722 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 847 slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s,p%02x)", conf->nodename,
723 conf->id, rid, (const char *)rsi); 848 vpn->conns[rid - 1]->conf->nodename, (const char *)rsi,
849 conf->protocols);
724 850
725 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols); 851 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
726 852
727 r->hmac_set (octx); 853 r->hmac_set (octx);
728 send_vpn_packet (r, si); 854 send_vpn_packet (r, si);
729 855
730 delete r; 856 delete r;
731} 857}
732 858
733void 859inline void
734connection::establish_connection_cb (time_watcher &w) 860connection::establish_connection_cb (ev::timer &w, int revents)
735{ 861{
736 if (!ictx 862 if (!(ictx && octx)
737 && conf != THISNODE 863 && conf != THISNODE
738 && connectmode != conf_node::C_NEVER 864 && connectmode != conf_node::C_NEVER
739 && connectmode != conf_node::C_DISABLED 865 && connectmode != conf_node::C_DISABLED
740 && NOW > w.at) 866 && !w.is_active ())
741 { 867 {
742 w.at = TSTAMP_MAX; // first disable this watcher in case of recursion 868 // a bit hacky, if ondemand, and packets are no longer queued, then reset the connection
869 // and stop trying. should probably be handled by a per-connection expire handler.
870 if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())
871 {
872 reset_connection ();
873 return;
874 }
743 875
744 double retry_int = double (retry_cnt & 3 876 last_establish_attempt = ev_now ();
877
878 ev::tstamp retry_int = ev::tstamp (retry_cnt & 3
745 ? (retry_cnt & 3) + 1 879 ? (retry_cnt & 3) + 1
746 : 1 << (retry_cnt >> 2)); 880 : 1 << (retry_cnt >> 2));
747 881
748 reset_si (); 882 reset_si ();
749 883
750 bool slow = si.prot & PROT_SLOW; 884 bool slow = si.prot & PROT_SLOW;
751 885
752 if (si.prot && !si.host) 886 if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
887 {
888 /*TODO*/ /* start the timer so we don't recurse endlessly */
889 w.start (1);
753 vpn->send_connect_request (conf->id); 890 vpn->send_connect_request (this);
891 }
754 else 892 else
755 { 893 {
894 if (si.valid ())
895 slog (L_DEBUG, _("%s: sending direct connection request to %s."),
896 conf->nodename, (const char *)si);
897
756 const sockinfo &dsi = forward_si (si); 898 const sockinfo &dsi = forward_si (si);
757 899
758 slow = slow || (dsi.prot & PROT_SLOW); 900 slow = slow || (dsi.prot & PROT_SLOW);
759 901
760 if (dsi.valid () && auth_rate_limiter.can (dsi)) 902 if (dsi.valid () && auth_rate_limiter.can (dsi))
… …
764 else 906 else
765 send_ping (dsi, 0); 907 send_ping (dsi, 0);
766 } 908 }
767 } 909 }
768 910
769 retry_int *= slow ? 8. : 0.7; 911 retry_int *= slow ? 8. : 0.9;
770 912
771 if (retry_int < conf->max_retry) 913 if (retry_int < conf->max_retry)
772 retry_cnt++; 914 retry_cnt++;
773 else 915 else
774 retry_int = conf->max_retry; 916 retry_int = conf->max_retry;
775 917
776 w.start (NOW + retry_int); 918 w.start (retry_int);
777 } 919 }
778} 920}
779 921
780void 922void
781connection::reset_connection () 923connection::reset_connection ()
… …
784 { 926 {
785 slog (L_INFO, _("%s(%s): connection lost"), 927 slog (L_INFO, _("%s(%s): connection lost"),
786 conf->nodename, (const char *)si); 928 conf->nodename, (const char *)si);
787 929
788 if (::conf.script_node_down) 930 if (::conf.script_node_down)
789 if (!run_script (run_script_cb (this, &connection::script_node_down), false)) 931 {
932 run_script_cb *cb = new run_script_cb;
933 cb->set<connection, &connection::script_node_down> (this);
790 slog (L_WARN, _("node-down command execution failed, continuing.")); 934 run_script_queued (cb, _("node-down command execution failed, continuing."));
935 }
791 } 936 }
792 937
793 delete ictx; ictx = 0; 938 delete ictx; ictx = 0;
794 delete octx; octx = 0; 939 delete octx; octx = 0;
795#if ENABLE_DNS
796 dnsv4_reset_connection ();
797#endif
798 940
799 si.host = 0; 941 si.host = 0;
800 942
943 have_snd_auth = false;
944 have_rcv_auth = false;
945 auth_expire = 0.;
946
801 last_activity = 0; 947 last_activity = 0.;
948 //last_si_change = 0.;
802 retry_cnt = 0; 949 retry_cnt = 0;
803 950
804 rekey.stop (); 951 rekey.stop ();
805 keepalive.stop (); 952 keepalive.stop ();
806 establish_connection.stop (); 953 establish_connection.stop ();
… …
813 send_reset (si); 960 send_reset (si);
814 961
815 reset_connection (); 962 reset_connection ();
816} 963}
817 964
818void 965// poor-man's rekeying
819connection::rekey_cb (time_watcher &w) 966inline void
967connection::rekey_cb (ev::timer &w, int revents)
820{ 968{
821 reset_connection (); 969 reset_connection ();
822 establish_connection (); 970 establish_connection ();
823} 971}
824 972
… …
840 if (oseqno > MAX_SEQNO) 988 if (oseqno > MAX_SEQNO)
841 rekey (); 989 rekey ();
842} 990}
843 991
844void 992void
993connection::post_inject_queue ()
994{
995 // force a connection every now and when when packets are sent (max 1/s)
996 if (ev_now () - last_establish_attempt >= 0.95) // arbitrary
997 establish_connection.stop ();
998
999 establish_connection ();
1000}
1001
1002void
845connection::inject_data_packet (tap_packet *pkt, bool broadcast/*TODO DDD*/) 1003connection::inject_data_packet (tap_packet *pkt)
846{ 1004{
847 if (ictx && octx) 1005 if (ictx && octx)
848 send_data_packet (pkt); 1006 send_data_packet (pkt);
849 else 1007 else
850 { 1008 {
851 if (!broadcast)
852 data_queue.put (new tap_packet (*pkt)); 1009 data_queue.put (new tap_packet (*pkt));
853 1010 post_inject_queue ();
854 establish_connection ();
855 } 1011 }
856} 1012}
857 1013
1014void
858void connection::inject_vpn_packet (vpn_packet *pkt, int tos) 1015connection::inject_vpn_packet (vpn_packet *pkt, int tos)
859{ 1016{
860 if (ictx && octx) 1017 if (ictx && octx)
861 send_vpn_packet (pkt, si, tos); 1018 send_vpn_packet (pkt, si, tos);
862 else 1019 else
863 { 1020 {
864 vpn_queue.put ((vpn_packet *)new data_packet (*(data_packet *)pkt)); 1021 vpn_queue.put ((vpn_packet *)new data_packet (*(data_packet *)pkt));
865 1022 post_inject_queue ();
866 establish_connection ();
867 } 1023 }
868} 1024}
869 1025
870void 1026void
871connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 1027connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
872{ 1028{
873 last_activity = NOW; 1029 last_activity = ev_now ();
874 1030
875 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 1031 slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
876 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 1032 conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
1033
1034 if (connectmode == conf_node::C_DISABLED)
1035 return;
877 1036
878 switch (pkt->typ ()) 1037 switch (pkt->typ ())
879 { 1038 {
880 case vpn_packet::PT_PING: 1039 case vpn_packet::PT_PING:
1040 slog (L_TRACE, "%s >> PT_PING", conf->nodename);
1041
881 // we send pings instead of auth packets after some retries, 1042 // we send pings instead of auth packets after some retries,
882 // so reset the retry counter and establish a connection 1043 // so reset the retry counter and establish a connection
883 // when we receive a ping. 1044 // when we receive a ping.
884 if (!ictx) 1045 if (!ictx)
885 { 1046 {
886 if (auth_rate_limiter.can (rsi)) 1047 if (auth_rate_limiter.can (rsi))
887 send_auth_request (rsi, true); 1048 send_auth_request (rsi, true);
888 } 1049 }
889 else 1050 else
1051 // we would love to change the socket address here, but ping's aren't
1052 // authenticated, so we best ignore it.
890 send_ping (rsi, 1); // pong 1053 send_ping (rsi, 1); // pong
891 1054
892 break; 1055 break;
893 1056
894 case vpn_packet::PT_PONG: 1057 case vpn_packet::PT_PONG:
1058 slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
1059
1060 // a PONG might mean that the other side doesn't really know
1061 // about our desire for communication.
1062 establish_connection ();
895 break; 1063 break;
896 1064
897 case vpn_packet::PT_RESET: 1065 case vpn_packet::PT_RESET:
898 { 1066 {
899 reset_connection (); 1067 reset_connection ();
900 1068
901 config_packet *p = (config_packet *) pkt; 1069 config_packet *p = (config_packet *) pkt;
902 1070
903 if (!p->chk_config ()) 1071 if (!p->chk_config ())
904 { 1072 {
905 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"), 1073 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
906 conf->nodename, (const char *)rsi); 1074 conf->nodename, (const char *)rsi);
907 connectmode = conf_node::C_DISABLED; 1075 connectmode = conf_node::C_DISABLED;
908 } 1076 }
909 else if (connectmode == conf_node::C_ALWAYS) 1077 else if (connectmode == conf_node::C_ALWAYS)
910 establish_connection (); 1078 establish_connection ();
… …
912 break; 1080 break;
913 1081
914 case vpn_packet::PT_AUTH_REQ: 1082 case vpn_packet::PT_AUTH_REQ:
915 if (auth_rate_limiter.can (rsi)) 1083 if (auth_rate_limiter.can (rsi))
916 { 1084 {
917 auth_req_packet *p = (auth_req_packet *) pkt; 1085 auth_req_packet *p = (auth_req_packet *)pkt;
918 1086
919 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 1087 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s,p%02x,f%02x)",
1088 conf->nodename, p->initiate ? "initiate" : "reply",
1089 p->protocols, p->features);
920 1090
921 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 1091 if (p->chk_config () && !memcmp (p->magic, MAGIC, 8))
922 { 1092 {
923 if (p->prot_minor != PROTOCOL_MINOR) 1093 if (p->prot_minor != PROTOCOL_MINOR)
924 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1094 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
925 conf->nodename, (const char *)rsi, 1095 conf->nodename, (const char *)rsi,
926 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 1096 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
927 1097
928 if (p->initiate) 1098 if (p->initiate)
929 send_auth_request (rsi, false); 1099 send_auth_request (rsi, false);
930 1100
931 rsachallenge k; 1101 auth_data auth;
932 1102
933 if (!rsa_decrypt (::conf.rsa_key, p->encr, k)) 1103 if (!auth_decrypt (::conf.rsa_key, p->encr, auth))
934 { 1104 {
935 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"), 1105 slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
936 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0)); 1106 conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
937 break;
938 } 1107 }
939 else 1108 else
940 { 1109 {
941 delete octx; 1110 bool chg = !have_rcv_auth || memcmp (&rcv_auth, &auth, sizeof auth);
942 1111
943 octx = new crypto_ctx (k, 1); 1112 rcv_auth = auth;
944 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 1113 have_rcv_auth = true;
945 1114
1115 send_auth_response (rsi);
1116
1117 if (chg)
1118 {
946 conf->protocols = p->protocols; 1119 conf->protocols = p->protocols;
947 features = p->features & config_packet::get_features (); 1120 features = p->features & config_packet::get_features ();
948 1121
949 send_auth_response (rsi, p->id, k);
950
951 connection_established (); 1122 connection_established (rsi);
952
953 break; 1123 }
954 } 1124 }
1125
1126 break;
955 } 1127 }
956 else 1128 else
957 slog (L_WARN, _("%s(%s): protocol mismatch"), 1129 slog (L_WARN, _("%s(%s): protocol mismatch."),
958 conf->nodename, (const char *)rsi); 1130 conf->nodename, (const char *)rsi);
959 1131
960 send_reset (rsi); 1132 send_reset (rsi);
961 } 1133 }
962 1134
963 break; 1135 break;
964 1136
965 case vpn_packet::PT_AUTH_RES: 1137 case vpn_packet::PT_AUTH_RES:
966 { 1138 {
967 auth_res_packet *p = (auth_res_packet *) pkt; 1139 auth_res_packet *p = (auth_res_packet *)pkt;
968 1140
969 slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id); 1141 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
970 1142
971 if (p->chk_config ()) 1143 if (p->chk_config ())
972 { 1144 {
973 if (p->prot_minor != PROTOCOL_MINOR) 1145 if (memcmp (&p->response.mac, snd_auth_mac, sizeof (snd_auth_mac)))
974 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
975 conf->nodename, (const char *)rsi,
976 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
977
978 rsachallenge chg;
979
980 if (!rsa_cache.find (p->id, chg))
981 { 1146 {
982 slog (L_ERR, _("%s(%s): unrequested auth response ignored"), 1147 slog (L_ERR, _("%s(%s): unrequested or outdated auth response, ignoring."),
983 conf->nodename, (const char *)rsi); 1148 conf->nodename, (const char *)rsi);
984 break;
985 } 1149 }
986 else 1150 else if (!have_snd_auth)
987 { 1151 {
988 crypto_ctx *cctx = new crypto_ctx (chg, 0); 1152 if (p->prot_minor != PROTOCOL_MINOR)
989 1153 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
990 if (!p->hmac_chk (cctx))
991 {
992 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
993 "could be an attack, or just corruption or a synchronization error"),
994 conf->nodename, (const char *)rsi); 1154 conf->nodename, (const char *)rsi,
995 break; 1155 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
996 }
997 else
998 {
999 rsaresponse h;
1000 1156
1001 rsa_hash (p->id, chg, h);
1002
1003 if (!memcmp ((u8 *)&h, (u8 *)p->response, sizeof h))
1004 {
1005 prot_minor = p->prot_minor; 1157 prot_minor = p->prot_minor;
1158 memcpy (snd_ecdh_b, p->response.ecdh, sizeof (snd_ecdh_b));
1006 1159
1007 delete ictx; ictx = cctx; 1160 have_snd_auth = true;
1008
1009 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
1010
1011 si = rsi;
1012 protocol = rsi.prot;
1013
1014 connection_established (); 1161 connection_established (rsi);
1015
1016 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
1017 conf->nodename, (const char *)rsi,
1018 p->prot_major, p->prot_minor);
1019
1020 if (::conf.script_node_up)
1021 if (!run_script (run_script_cb (this, &connection::script_node_up), false))
1022 slog (L_WARN, _("node-up command execution failed, continuing."));
1023
1024 break;
1025 }
1026 else
1027 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
1028 conf->nodename, (const char *)rsi);
1029 }
1030
1031 delete cctx;
1032 } 1162 }
1163
1164 break;
1033 } 1165 }
1034 } 1166 }
1035 1167
1036 send_reset (rsi); 1168 send_reset (rsi);
1037 break; 1169 break;
… …
1048 { 1180 {
1049 vpndata_packet *p = (vpndata_packet *)pkt; 1181 vpndata_packet *p = (vpndata_packet *)pkt;
1050 1182
1051 if (!p->hmac_chk (ictx)) 1183 if (!p->hmac_chk (ictx))
1052 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1184 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1053 "could be an attack, or just corruption or a synchronization error"), 1185 "could be an attack, or just corruption or a synchronization error."),
1054 conf->nodename, (const char *)rsi); 1186 conf->nodename, (const char *)rsi);
1055 else 1187 else
1056 { 1188 {
1057 u32 seqno; 1189 u32 seqno;
1058 tap_packet *d = p->unpack (this, seqno); 1190 tap_packet *d = p->unpack (this, seqno);
1191 int seqclass = iseqno.seqno_classify (seqno);
1059 1192
1060 if (iseqno.recv_ok (seqno)) 1193 if (seqclass == 0) // ok
1061 { 1194 {
1062 vpn->tap->send (d); 1195 vpn->tap->send (d);
1063 1196
1064 if (si != rsi) 1197 if (si != rsi)
1065 { 1198 {
1066 // fast re-sync on source address changes, useful especially for tcp/ip 1199 // fast re-sync on source address changes, useful especially for tcp/ip
1200 //if (last_si_change < ev_now () + 5.)
1067 si = rsi; 1201 // {
1068
1069 slog (L_INFO, _("%s(%s): socket address changed to %s"), 1202 slog (L_INFO, _("%s(%s): changing socket address to %s."),
1070 conf->nodename, (const char *)si, (const char *)rsi); 1203 conf->nodename, (const char *)si, (const char *)rsi);
1204
1205 si = rsi;
1206
1207 if (::conf.script_node_change)
1208 {
1209 run_script_cb *cb = new run_script_cb;
1210 cb->set<connection, &connection::script_node_change> (this);
1211 run_script_queued (cb, _("node-change command execution failed, continuing."));
1212 }
1213
1214 // }
1215 //else
1216 // slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
1217 // conf->nodename, (const char *)si, (const char *)rsi);
1071 } 1218 }
1219 }
1220 else if (seqclass == 1) // far history
1221 slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
1222 "possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
1223 else if (seqclass == 2) // in-window duplicate, happens often on wireless
1224 slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
1225 "possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
1226 else if (seqclass == 3) // reset
1227 {
1228 slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
1229 "probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
1230 send_reset (rsi);
1072 } 1231 }
1073 1232
1074 delete d; 1233 delete d;
1075 break; 1234 break;
1076 } 1235 }
… …
1080 break; 1239 break;
1081 1240
1082 case vpn_packet::PT_CONNECT_REQ: 1241 case vpn_packet::PT_CONNECT_REQ:
1083 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1242 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1084 { 1243 {
1085 connect_req_packet *p = (connect_req_packet *) pkt; 1244 connect_req_packet *p = (connect_req_packet *)pkt;
1086 1245
1087 if (p->id > 0 && p->id <= vpn->conns.size ()) 1246 if (p->id > 0 && p->id <= vpn->conns.size ())
1088 { 1247 {
1089 connection *c = vpn->conns[p->id - 1]; 1248 connection *c = vpn->conns[p->id - 1];
1090 conf->protocols = p->protocols; 1249 conf->protocols = p->protocols;
1091 1250
1092 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n", 1251 slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s,p%02x) [%d]",
1252 conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1253 p->protocols,
1093 conf->id, p->id, c->ictx && c->octx); 1254 c->ictx && c->octx);
1094 1255
1095 if (c->ictx && c->octx) 1256 if (c->ictx && c->octx)
1096 { 1257 {
1097 // send connect_info packets to both sides, in case one is 1258 // send connect_info packets to both sides, in case one is
1098 // behind a nat firewall (or both ;) 1259 // behind a nat firewall (or both ;)
… …
1121 1282
1122 c->conf->protocols = p->protocols; 1283 c->conf->protocols = p->protocols;
1123 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf)); 1284 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1124 p->si.upgrade_protocol (protocol, c->conf); 1285 p->si.upgrade_protocol (protocol, c->conf);
1125 1286
1126 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1287 slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s,protocols=%02x,protocol=%02x,upgradable=%02x) [%d]",
1127 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1288 conf->nodename,
1289 vpn->conns[p->id - 1]->conf->nodename,
1290 (const char *)p->si,
1291 p->protocols,
1292 protocol,
1293 p->si.supported_protocols (c->conf),
1294 !c->ictx && !c->octx);
1128 1295
1129 const sockinfo &dsi = forward_si (p->si); 1296 const sockinfo &dsi = forward_si (p->si);
1130 1297
1131 if (dsi.valid ()) 1298 if (dsi.valid ())
1132 c->send_auth_request (dsi, true); 1299 c->send_auth_request (dsi, true);
1300 else
1301 slog (L_INFO, "connect info for %s received (%s), but still unable to contact.",
1302 vpn->conns[p->id - 1]->conf->nodename,
1303 (const char *)p->si);
1133 } 1304 }
1134 else 1305 else
1135 slog (L_WARN, 1306 slog (L_WARN,
1136 _("received authenticated connection request from unknown node #%d, config file mismatch?"), 1307 _("received authenticated connection request from unknown node #%d, config file mismatch?"),
1137 p->id); 1308 p->id);
… …
1143 send_reset (rsi); 1314 send_reset (rsi);
1144 break; 1315 break;
1145 } 1316 }
1146} 1317}
1147 1318
1148void connection::keepalive_cb (time_watcher &w) 1319inline void
1320connection::keepalive_cb (ev::timer &w, int revents)
1149{ 1321{
1150 if (NOW >= last_activity + ::conf.keepalive + 30) 1322 ev_tstamp when = last_activity + ::conf.keepalive - ev::now ();
1323
1324 if (when >= 0)
1325 w.start (when);
1326 else if (when < -15)
1151 { 1327 {
1152 reset_connection (); 1328 reset_connection ();
1153 establish_connection (); 1329 establish_connection ();
1154 } 1330 }
1155 else if (NOW < last_activity + ::conf.keepalive)
1156 w.start (last_activity + ::conf.keepalive);
1157 else if (conf->connectmode != conf_node::C_ONDEMAND 1331 else if (conf->connectmode != conf_node::C_ONDEMAND
1158 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1332 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1159 { 1333 {
1334 w.start (3);
1160 send_ping (si); 1335 send_ping (si);
1161 w.start (NOW + 5);
1162 } 1336 }
1163 else if (NOW < last_activity + ::conf.keepalive + 10) 1337 else if (when >= -10)
1164 // hold ondemand connections implicitly a few seconds longer 1338 // hold ondemand connections implicitly a few seconds longer
1165 // should delete octx, though, or something like that ;) 1339 // should delete octx, though, or something like that ;)
1166 w.start (last_activity + ::conf.keepalive + 10); 1340 w.start (when + 10);
1167 else 1341 else
1168 reset_connection (); 1342 reset_connection ();
1169} 1343}
1170 1344
1345void
1171void connection::send_connect_request (int id) 1346connection::send_connect_request (int id)
1172{ 1347{
1173 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1348 connect_req_packet *p = new connect_req_packet (conf->id, id, THISNODE->protocols);
1174 1349
1175 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1350 slog (L_TRACE, "%s << PT_CONNECT_REQ(%s,p%02x)",
1351 conf->nodename, vpn->conns[id - 1]->conf->nodename,
1352 THISNODE->protocols);
1176 p->hmac_set (octx); 1353 p->hmac_set (octx);
1177 send_vpn_packet (p, si); 1354 send_vpn_packet (p, si);
1178 1355
1179 delete p; 1356 delete p;
1180} 1357}
1181 1358
1359void
1182void connection::script_init_env (const char *ext) 1360connection::script_init_env (const char *ext)
1183{ 1361{
1184 char *env; 1362 char *env;
1185 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env); 1363 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
1186 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env); 1364 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
1187 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext, 1365 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
1188 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8, 1366 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
1189 conf->id & 0xff); putenv (env); 1367 conf->id & 0xff); putenv (env);
1190} 1368}
1191 1369
1370void
1192void connection::script_init_connect_env () 1371connection::script_init_connect_env ()
1193{ 1372{
1194 vpn->script_init_env (); 1373 vpn->script_init_env ();
1195 1374
1196 char *env; 1375 char *env;
1197 asprintf (&env, "DESTID=%d", conf->id); putenv (env); 1376 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1377 asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env);
1198 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); 1378 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1199 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); 1379 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1200 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); 1380 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1201} 1381}
1202 1382
1383inline const char *
1203const char *connection::script_node_up () 1384connection::script_node_up ()
1204{ 1385{
1205 script_init_connect_env (); 1386 script_init_connect_env ();
1206 1387
1207 putenv ("STATE=up"); 1388 putenv ((char *)"STATE=up");
1208 1389
1209 char *filename; 1390 char *filename;
1210 asprintf (&filename, 1391 asprintf (&filename,
1211 "%s/%s", 1392 "%s/%s",
1212 confbase, 1393 confbase,
1213 ::conf.script_node_up ? ::conf.script_node_up : "node-up"); 1394 ::conf.script_node_up ? ::conf.script_node_up : "node-up");
1214 1395
1215 return filename; 1396 return filename;
1216} 1397}
1217 1398
1218const char *connection::script_node_down () 1399inline const char *
1400connection::script_node_change ()
1219{ 1401{
1220 script_init_connect_env (); 1402 script_init_connect_env ();
1221 1403
1404 putenv ((char *)"STATE=change");
1405
1406 char *filename;
1407 asprintf (&filename,
1408 "%s/%s",
1409 confbase,
1410 ::conf.script_node_change ? ::conf.script_node_change : "node-change");
1411
1412 return filename;
1413}
1414
1415inline const char *
1416connection::script_node_down ()
1417{
1418 script_init_connect_env ();
1419
1222 putenv ("STATE=down"); 1420 putenv ((char *)"STATE=down");
1223 1421
1224 char *filename; 1422 char *filename;
1225 asprintf (&filename, 1423 asprintf (&filename,
1226 "%s/%s", 1424 "%s/%s",
1227 confbase, 1425 confbase,
… …
1229 1427
1230 return filename; 1428 return filename;
1231} 1429}
1232 1430
1233connection::connection (struct vpn *vpn, conf_node *conf) 1431connection::connection (struct vpn *vpn, conf_node *conf)
1234: vpn(vpn), conf(conf) 1432: vpn(vpn), conf(conf),
1235, rekey (this, &connection::rekey_cb)
1236, keepalive (this, &connection::keepalive_cb)
1237, establish_connection (this, &connection::establish_connection_cb)
1238#if ENABLE_DNS 1433#if ENABLE_DNS
1239, dns (0) 1434 dns (0),
1240#endif 1435#endif
1436 data_queue(conf->max_ttl, conf->max_queue + 1),
1437 vpn_queue(conf->max_ttl, conf->max_queue + 1)
1241{ 1438{
1439 rekey .set<connection, &connection::rekey_cb > (this);
1440 keepalive .set<connection, &connection::keepalive_cb > (this);
1441 establish_connection.set<connection, &connection::establish_connection_cb> (this);
1442
1443 last_establish_attempt = 0.;
1242 octx = ictx = 0; 1444 octx = ictx = 0;
1243 retry_cnt = 0;
1244 1445
1245 if (!conf->protocols) // make sure some protocol is enabled 1446 connectmode = conf->connectmode;
1246 conf->protocols = PROT_UDPv4;
1247 1447
1248 connectmode = conf_node::C_ALWAYS; // initial setting 1448 // queue a dummy packet to force an initial connection attempt
1449 if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
1450 vpn_queue.put (new net_packet);
1451
1249 reset_connection (); 1452 reset_connection ();
1250} 1453}
1251 1454
1252connection::~connection () 1455connection::~connection ()
1253{ 1456{
1254 shutdown (); 1457 shutdown ();
1255} 1458}
1256 1459
1460void
1257void connection_init () 1461connection_init ()
1258{ 1462{
1259 auth_rate_limiter.clear (); 1463 auth_rate_limiter.clear ();
1260 reset_rate_limiter.clear (); 1464 reset_rate_limiter.clear ();
1261} 1465}
1262 1466

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines