[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.10 by pcg, Sun Apr 6 18:12:18 2003 UTC vs.
Revision 1.61 by pcg, Sat Nov 10 19:43:37 2007 UTC

…		…
1	/*	1	/*
2	connection.C -- manage a single connection	2	connection.C -- manage a single connection
		3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
3		4
		5	This file is part of GVPE.
		6
4	This program is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify
5	it under the terms of the GNU General Public License as published by	8	it under the terms of the GNU General Public License as published by
6	the Free Software Foundation; either version 2 of the License, or	9	the Free Software Foundation; either version 2 of the License, or
7	(at your option) any later version.	10	(at your option) any later version.
8		11
9	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful,
10	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	but WITHOUT ANY WARRANTY; without even the implied warranty of
11	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12	GNU General Public License for more details.	15	GNU General Public License for more details.
13		16
14	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License
15	along with this program; if not, write to the Free Software	18	along with gvpe; if not, write to the Free Software
16	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19	Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17	*/	20	*/
18		21
19	#include "config.h"	22	#include "config.h"
20
21	extern "C" {
22	# include "lzf/lzf.h"
23	}
24		23
25	#include <list>	24	#include <list>
26		25
27	#include <openssl/rand.h>	26	#include <openssl/rand.h>
28	#include <openssl/evp.h>	27	#include <openssl/evp.h>
29	#include <openssl/rsa.h>	28	#include <openssl/rsa.h>
30	#include <openssl/err.h>	29	#include <openssl/err.h>
31
32	#include "gettext.h"
33		30
34	#include "conf.h"	31	#include "conf.h"
35	#include "slog.h"	32	#include "slog.h"
36	#include "device.h"	33	#include "device.h"
37	#include "vpn.h"	34	#include "vpn.h"
38	#include "connection.h"	35	#include "connection.h"
39		36
		37	#include "netcompat.h"
		38
40	#if !HAVE_RAND_PSEUDO_BYTES	39	#if !HAVE_RAND_PSEUDO_BYTES
41	# define RAND_pseudo_bytes RAND_bytes	40	# define RAND_pseudo_bytes RAND_bytes
42	#endif	41	#endif
43		42
44	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic	43	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
45		44
		45	#define ULTRA_FAST 1
		46	#define HLOG 15
		47	#include "lzf/lzf.h"
		48	#include "lzf/lzf_c.c"
		49	#include "lzf/lzf_d.c"
		50
46	struct crypto_ctx	51	struct crypto_ctx
47	{	52	{
48	EVP_CIPHER_CTX cctx;	53	EVP_CIPHER_CTX cctx;
49	HMAC_CTX hctx;	54	HMAC_CTX hctx;
50		55
53	};	58	};
54		59
55	crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)	60	crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)
56	{	61	{
57	EVP_CIPHER_CTX_init (&cctx);	62	EVP_CIPHER_CTX_init (&cctx);
58	EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc);	63	require (EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc));
59	HMAC_CTX_init (&hctx);	64	HMAC_CTX_init (&hctx);
60	HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);	65	HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
61	}	66	}
62		67
63	crypto_ctx::~crypto_ctx ()	68	crypto_ctx::~crypto_ctx ()
64	{	69	{
65	EVP_CIPHER_CTX_cleanup (&cctx);	70	require (EVP_CIPHER_CTX_cleanup (&cctx));
66	HMAC_CTX_cleanup (&hctx);	71	HMAC_CTX_cleanup (&hctx);
67	}	72	}
68		73
69	static void	74	static void
70	rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)	75	rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)
71	{	76	{
72	EVP_MD_CTX ctx;	77	EVP_MD_CTX ctx;
73		78
74	EVP_MD_CTX_init (&ctx);	79	EVP_MD_CTX_init (&ctx);
75	EVP_DigestInit (&ctx, RSA_HASH);	80	require (EVP_DigestInit (&ctx, RSA_HASH));
76	EVP_DigestUpdate(&ctx, &chg, sizeof chg);	81	require (EVP_DigestUpdate(&ctx, &chg, sizeof chg));
77	EVP_DigestUpdate(&ctx, &id, sizeof id);	82	require (EVP_DigestUpdate(&ctx, &id, sizeof id));
78	EVP_DigestFinal (&ctx, (unsigned char *)&h, 0);	83	require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0));
79	EVP_MD_CTX_cleanup (&ctx);	84	EVP_MD_CTX_cleanup (&ctx);
80	}	85	}
81		86
82	struct rsa_entry {	87	struct rsa_entry {
83	tstamp expire;	88	tstamp expire;
…		…
85	rsachallenge chg;	90	rsachallenge chg;
86	};	91	};
87		92
88	struct rsa_cache : list<rsa_entry>	93	struct rsa_cache : list<rsa_entry>
89	{	94	{
90	void cleaner_cb (time_watcher &w); time_watcher cleaner;	95	void cleaner_cb (ev::timer &w, int revents); ev::timer cleaner;
91		96
92	bool find (const rsaid &id, rsachallenge &chg)	97	bool find (const rsaid &id, rsachallenge &chg)
93	{	98	{
94	for (iterator i = begin (); i != end (); ++i)	99	for (iterator i = begin (); i != end (); ++i)
95	{	100	{
96	if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW)	101	if (!memcmp (&id, &i->id, sizeof id) && i->expire > ev::ev_now ())
97	{	102	{
98	memcpy (&chg, &i->chg, sizeof chg);	103	memcpy (&chg, &i->chg, sizeof chg);
99		104
100	erase (i);	105	erase (i);
101	return true;	106	return true;
102	}	107	}
103	}	108	}
104		109
105	if (cleaner.at < NOW)	110	if (!cleaner.is_active ())
106	cleaner.start (NOW + RSA_TTL);	111	cleaner.again ();
107		112
108	return false;	113	return false;
109	}	114	}
110		115
111	void gen (rsaid &id, rsachallenge &chg)	116	void gen (rsaid &id, rsachallenge &chg)
112	{	117	{
113	rsa_entry e;	118	rsa_entry e;
114		119
115	RAND_bytes ((unsigned char *)&id, sizeof id);	120	RAND_bytes ((unsigned char *)&id, sizeof id);
116	RAND_bytes ((unsigned char *)&chg, sizeof chg);	121	RAND_bytes ((unsigned char *)&chg, sizeof chg);
117		122
118	e.expire = NOW + RSA_TTL;	123	e.expire = ev::ev_now () + RSA_TTL;
119	e.id = id;	124	e.id = id;
120	memcpy (&e.chg, &chg, sizeof chg);	125	memcpy (&e.chg, &chg, sizeof chg);
121		126
122	push_back (e);	127	push_back (e);
123		128
124	if (cleaner.at < NOW)	129	if (!cleaner.is_active ())
125	cleaner.start (NOW + RSA_TTL);	130	cleaner.again ();
126	}	131	}
127		132
128	rsa_cache ()	133	rsa_cache ()
129	: cleaner (this, &rsa_cache::cleaner_cb)	134	: cleaner (this, &rsa_cache::cleaner_cb)
130	{ }	135	{
		136	cleaner.set (RSA_TTL, RSA_TTL);
		137	}
131		138
132	} rsa_cache;	139	} rsa_cache;
133		140
134	void rsa_cache::cleaner_cb (time_watcher &w)	141	void rsa_cache::cleaner_cb (ev::timer &w, int revents)
135	{	142	{
136	if (empty ())	143	if (empty ())
137	w.at = TSTAMP_CANCEL;	144	w.stop ();
138	else	145	else
139	{	146	{
140	w.at = NOW + RSA_TTL;
141
142	for (iterator i = begin (); i != end (); )	147	for (iterator i = begin (); i != end (); )
143	if (i->expire <= NOW)	148	if (i->expire <= ev::ev_now ())
144	i = erase (i);	149	i = erase (i);
145	else	150	else
146	++i;	151	++i;
147	}	152	}
148	}	153	}
149		154
150	//////////////////////////////////////////////////////////////////////////////	155	//////////////////////////////////////////////////////////////////////////////
151		156
152	void pkt_queue::put (tap_packet *p)	157	void pkt_queue::put (net_packet *p)
153	{	158	{
154	if (queue[i])	159	if (queue[i])
155	{	160	{
156	delete queue[i];	161	delete queue[i];
157	j = (j + 1) % QUEUEDEPTH;	162	j = (j + 1) % QUEUEDEPTH;
…		…
160	queue[i] = p;	165	queue[i] = p;
161		166
162	i = (i + 1) % QUEUEDEPTH;	167	i = (i + 1) % QUEUEDEPTH;
163	}	168	}
164		169
165	tap_packet *pkt_queue::get ()	170	net_packet *pkt_queue::get ()
166	{	171	{
167	tap_packet *p = queue[j];	172	net_packet *p = queue[j];
168		173
169	if (p)	174	if (p)
170	{	175	{
171	queue[j] = 0;	176	queue[j] = 0;
172	j = (j + 1) % QUEUEDEPTH;	177	j = (j + 1) % QUEUEDEPTH;
…		…
197	// only do action once every x seconds per host whole allowing bursts.	202	// only do action once every x seconds per host whole allowing bursts.
198	// this implementation ("splay list" ;) is inefficient,	203	// this implementation ("splay list" ;) is inefficient,
199	// but low on resources.	204	// but low on resources.
200	struct net_rate_limiter : list<net_rateinfo>	205	struct net_rate_limiter : list<net_rateinfo>
201	{	206	{
202	static const double ALPHA = 1. - 1. / 180.; // allow bursts	207	# define NRL_ALPHA (1. - 1. / 600.) // allow bursts
203	static const double CUTOFF = 10.; // one event every CUTOFF seconds	208	# define NRL_CUTOFF 10. // one event every CUTOFF seconds
204	static const double EXPIRE = CUTOFF * 30.; // expire entries after this time	209	# define NRL_EXPIRE (NRL_CUTOFF * 30.) // expire entries after this time
205	static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value	210	# define NRL_MAXDIF (NRL_CUTOFF * (1. / (1. - NRL_ALPHA))) // maximum diff /count value
206		211
207	bool can (const sockinfo &si) { return can((u32)si.host); }	212	bool can (const sockinfo &si) { return can((u32)si.host); }
208	bool can (u32 host);	213	bool can (u32 host);
209	};	214	};
210		215
211	net_rate_limiter auth_rate_limiter, reset_rate_limiter;	216	net_rate_limiter auth_rate_limiter, reset_rate_limiter;
212		217
…		…
215	iterator i;	220	iterator i;
216		221
217	for (i = begin (); i != end (); )	222	for (i = begin (); i != end (); )
218	if (i->host == host)	223	if (i->host == host)
219	break;	224	break;
220	else if (i->last < NOW - EXPIRE)	225	else if (i->last < ev::ev_now () - NRL_EXPIRE)
221	i = erase (i);	226	i = erase (i);
222	else	227	else
223	i++;	228	i++;
224		229
225	if (i == end ())	230	if (i == end ())
226	{	231	{
227	net_rateinfo ri;	232	net_rateinfo ri;
228		233
229	ri.host = host;	234	ri.host = host;
230	ri.pcnt = 1.;	235	ri.pcnt = 1.;
231	ri.diff = MAXDIF;	236	ri.diff = NRL_MAXDIF;
232	ri.last = NOW;	237	ri.last = ev::ev_now ();
233		238
234	push_front (ri);	239	push_front (ri);
235		240
236	return true;	241	return true;
237	}	242	}
238	else	243	else
239	{	244	{
240	net_rateinfo ri (*i);	245	net_rateinfo ri (*i);
241	erase (i);	246	erase (i);
242		247
243	ri.pcnt = ri.pcnt * ALPHA;	248	ri.pcnt = ri.pcnt * NRL_ALPHA;
244	ri.diff = ri.diff * ALPHA + (NOW - ri.last);	249	ri.diff = ri.diff * NRL_ALPHA + (ev::ev_now () - ri.last);
245		250
246	ri.last = NOW;	251	ri.last = ev::ev_now ();
247		252
248	double dif = ri.diff / ri.pcnt;	253	double dif = ri.diff / ri.pcnt;
249		254
250	bool send = dif > CUTOFF;	255	bool send = dif > NRL_CUTOFF;
251		256
252	if (dif > MAXDIF)	257	if (dif > NRL_MAXDIF)
253	{	258	{
254	ri.pcnt = 1.;	259	ri.pcnt = 1.;
255	ri.diff = MAXDIF;	260	ri.diff = NRL_MAXDIF;
256	}	261	}
257	else if (send)	262	else if (send)
258	ri.pcnt++;	263	ri.pcnt++;
259		264
260	push_front (ri);	265	push_front (ri);
…		…
307	}	312	}
308		313
309	#define MAXVPNDATA (MAX_MTU - 6 - 6)	314	#define MAXVPNDATA (MAX_MTU - 6 - 6)
310	#define DATAHDR (sizeof (u32) + RAND_SIZE)	315	#define DATAHDR (sizeof (u32) + RAND_SIZE)
311		316
312	struct vpndata_packet:vpn_packet	317	struct vpndata_packet : vpn_packet
313	{	318	{
314	u8 data[MAXVPNDATA + DATAHDR]; // seqno	319	u8 data[MAXVPNDATA + DATAHDR]; // seqno
315		320
316	void setup (connection conn, int dst, u8 d, u32 len, u32 seqno);	321	void setup (connection conn, int dst, u8 d, u32 len, u32 seqno);
317	tap_packet unpack (connection conn, u32 &seqno);	322	tap_packet unpack (connection conn, u32 &seqno);
…		…
330	int outl = 0, outl2;	335	int outl = 0, outl2;
331	ptype type = PT_DATA_UNCOMPRESSED;	336	ptype type = PT_DATA_UNCOMPRESSED;
332		337
333	#if ENABLE_COMPRESSION	338	#if ENABLE_COMPRESSION
334	u8 cdata[MAX_MTU];	339	u8 cdata[MAX_MTU];
335	u32 cl;
336		340
		341	if (conn->features & ENABLE_COMPRESSION)
		342	{
337	cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);	343	u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
		344
338	if (cl)	345	if (cl)
339	{	346	{
340	type = PT_DATA_COMPRESSED;	347	type = PT_DATA_COMPRESSED;
341	d = cdata;	348	d = cdata;
342	l = cl + 2;	349	l = cl + 2;
343		350
344	d[0] = cl >> 8;	351	d[0] = cl >> 8;
345	d[1] = cl;	352	d[1] = cl;
		353	}
346	}	354	}
347	#endif	355	#endif
348		356
349	EVP_EncryptInit_ex (cctx, 0, 0, 0, 0);	357	require (EVP_EncryptInit_ex (cctx, 0, 0, 0, 0));
350		358
351	struct {	359	struct {
352	#if RAND_SIZE	360	#if RAND_SIZE
353	u8 rnd[RAND_SIZE];	361	u8 rnd[RAND_SIZE];
354	#endif	362	#endif
…		…
358	datahdr.seqno = ntohl (seqno);	366	datahdr.seqno = ntohl (seqno);
359	#if RAND_SIZE	367	#if RAND_SIZE
360	RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);	368	RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);
361	#endif	369	#endif
362		370
363	EVP_EncryptUpdate (cctx,	371	require (EVP_EncryptUpdate (cctx,
364	(unsigned char *) data + outl, &outl2,	372	(unsigned char *) data + outl, &outl2,
365	(unsigned char *) &datahdr, DATAHDR);	373	(unsigned char *) &datahdr, DATAHDR));
366	outl += outl2;	374	outl += outl2;
367		375
368	EVP_EncryptUpdate (cctx,	376	require (EVP_EncryptUpdate (cctx,
369	(unsigned char *) data + outl, &outl2,	377	(unsigned char *) data + outl, &outl2,
370	(unsigned char *) d, l);	378	(unsigned char *) d, l));
371	outl += outl2;	379	outl += outl2;
372		380
373	EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2);	381	require (EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2));
374	outl += outl2;	382	outl += outl2;
375		383
376	len = outl + data_hdr_size ();	384	len = outl + data_hdr_size ();
377		385
378	set_hdr (type, dst);	386	set_hdr (type, dst);
…		…
387	int outl = 0, outl2;	395	int outl = 0, outl2;
388	tap_packet *p = new tap_packet;	396	tap_packet *p = new tap_packet;
389	u8 *d;	397	u8 *d;
390	u32 l = len - data_hdr_size ();	398	u32 l = len - data_hdr_size ();
391		399
392	EVP_DecryptInit_ex (cctx, 0, 0, 0, 0);	400	require (EVP_DecryptInit_ex (cctx, 0, 0, 0, 0));
393		401
394	#if ENABLE_COMPRESSION	402	#if ENABLE_COMPRESSION
395	u8 cdata[MAX_MTU];	403	u8 cdata[MAX_MTU];
396		404
397	if (type == PT_DATA_COMPRESSED)	405	if (type == PT_DATA_COMPRESSED)
…		…
399	else	407	else
400	#endif	408	#endif
401	d = &(*p)[6 + 6 - DATAHDR];	409	d = &(*p)[6 + 6 - DATAHDR];
402		410
403	/* this overwrites part of the src mac, but we fix that later */	411	/* this overwrites part of the src mac, but we fix that later */
404	EVP_DecryptUpdate (cctx,	412	require (EVP_DecryptUpdate (cctx,
405	d, &outl2,	413	d, &outl2,
406	(unsigned char *)&data, len - data_hdr_size ());	414	(unsigned char *)&data, len - data_hdr_size ()));
407	outl += outl2;	415	outl += outl2;
408		416
409	EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2);	417	require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2));
410	outl += outl2;	418	outl += outl2;
411		419
412	seqno = ntohl ((u32 )(d + RAND_SIZE));	420	seqno = ntohl ((u32 )(d + RAND_SIZE));
413		421
414	id2mac (dst () ? dst() : THISNODE->id, p->dst);	422	id2mac (dst () ? dst() : THISNODE->id, p->dst);
…		…
443	{	451	{
444	// actually, hmaclen cannot be checked because the hmac	452	// actually, hmaclen cannot be checked because the hmac
445	// field comes before this data, so peers with other	453	// field comes before this data, so peers with other
446	// hmacs simply will not work.	454	// hmacs simply will not work.
447	u8 prot_major, prot_minor, randsize, hmaclen;	455	u8 prot_major, prot_minor, randsize, hmaclen;
448	u8 flags, challengelen, pad2, pad3;	456	u8 flags, challengelen, features, pad3;
449	u32 cipher_nid, digest_nid, hmac_nid;	457	u32 cipher_nid, digest_nid, hmac_nid;
450
451	const u8 curflags () const
452	{
453	return 0x80
454	\| (ENABLE_COMPRESSION ? 0x01 : 0x00);
455	}
456		458
457	void setup (ptype type, int dst);	459	void setup (ptype type, int dst);
458	bool chk_config () const;	460	bool chk_config () const;
		461
		462	static u8 get_features ()
		463	{
		464	u8 f = 0;
		465	#if ENABLE_COMPRESSION
		466	f \|= FEATURE_COMPRESSION;
		467	#endif
		468	#if ENABLE_ROHC
		469	f \|= FEATURE_ROHC;
		470	#endif
		471	#if ENABLE_BRIDGING
		472	f \|= FEATURE_BRIDGING;
		473	#endif
		474	return f;
		475	}
459	};	476	};
460		477
461	void config_packet::setup (ptype type, int dst)	478	void config_packet::setup (ptype type, int dst)
462	{	479	{
463	prot_major = PROTOCOL_MAJOR;	480	prot_major = PROTOCOL_MAJOR;
464	prot_minor = PROTOCOL_MINOR;	481	prot_minor = PROTOCOL_MINOR;
465	randsize = RAND_SIZE;	482	randsize = RAND_SIZE;
466	hmaclen = HMACLENGTH;	483	hmaclen = HMACLENGTH;
467	flags = curflags ();	484	flags = 0;
468	challengelen = sizeof (rsachallenge);	485	challengelen = sizeof (rsachallenge);
		486	features = get_features ();
469		487
470	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));	488	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
471	digest_nid = htonl (EVP_MD_type (RSA_HASH));	489	digest_nid = htonl (EVP_MD_type (RSA_HASH));
472	hmac_nid = htonl (EVP_MD_type (DIGEST));	490	hmac_nid = htonl (EVP_MD_type (DIGEST));
473		491
…		…
475	set_hdr (type, dst);	493	set_hdr (type, dst);
476	}	494	}
477		495
478	bool config_packet::chk_config () const	496	bool config_packet::chk_config () const
479	{	497	{
480	return prot_major == PROTOCOL_MAJOR	498	if (prot_major != PROTOCOL_MAJOR)
481	&& randsize == RAND_SIZE	499	slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
482	&& hmaclen == HMACLENGTH	500	else if (randsize != RAND_SIZE)
483	&& flags == curflags ()	501	slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
		502	else if (hmaclen != HMACLENGTH)
		503	slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
484	&& challengelen == sizeof (rsachallenge)	504	else if (challengelen != sizeof (rsachallenge))
		505	slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
485	&& cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))	506	else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
		507	slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
486	&& digest_nid == htonl (EVP_MD_type (RSA_HASH))	508	else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
		509	slog (L_WARN, _("digest mismatch (remote %x <=> local %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
487	&& hmac_nid == htonl (EVP_MD_type (DIGEST));	510	else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
		511	slog (L_WARN, _("hmac mismatch (remote %x <=> local %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
		512	else
		513	return true;
		514
		515	return false;
488	}	516	}
489		517
490	struct auth_req_packet : config_packet	518	struct auth_req_packet : config_packet
491	{	519	{
492	char magic[8];	520	char magic[8];
493	u8 initiate; // false if this is just an automatic reply	521	u8 initiate; // false if this is just an automatic reply
494	u8 protocols; // supported protocols (will get patches on forward)	522	u8 protocols; // supported protocols (will be patched on forward)
495	u8 pad2, pad3;	523	u8 pad2, pad3;
496	rsaid id;	524	rsaid id;
497	rsaencrdata encr;	525	rsaencrdata encr;
498		526
499	auth_req_packet (int dst, bool initiate_, u8 protocols_)	527	auth_req_packet (int dst, bool initiate_, u8 protocols_)
…		…
556	/////////////////////////////////////////////////////////////////////////////	584	/////////////////////////////////////////////////////////////////////////////
557		585
558	void	586	void
559	connection::connection_established ()	587	connection::connection_established ()
560	{	588	{
		589	slog (L_TRACE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);
		590
561	if (ictx && octx)	591	if (ictx && octx)
562	{	592	{
563	connectmode = conf->connectmode;	593	connectmode = conf->connectmode;
564		594
565	rekey.start (NOW + ::conf.rekey);	595	// make sure rekeying timeouts are slightly asymmetric
		596	ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
		597	rekey.start (rekey_interval, rekey_interval);
566	keepalive.start (NOW + ::conf.keepalive);	598	keepalive.start (::conf.keepalive);
567		599
568	// send queued packets	600	// send queued packets
569	if (ictx && octx)	601	if (ictx && octx)
		602	{
570	while (tap_packet *p = queue.get ())	603	while (tap_packet p = (tap_packet )data_queue.get ())
571	{	604	{
572	send_data_packet (p);	605	send_data_packet (p);
573	delete p;	606	delete p;
574	}	607	}
		608
		609	while (vpn_packet p = (vpn_packet )vpn_queue.get ())
		610	{
		611	send_vpn_packet (p, si, IPTOS_RELIABILITY);
		612	delete p;
		613	}
		614	}
575	}	615	}
576	else	616	else
577	{	617	{
578	retry_cnt = 0;	618	retry_cnt = 0;
579	establish_connection.start (NOW + 5);	619	establish_connection.start (5);
580	keepalive.reset ();	620	keepalive.stop ();
581	rekey.reset ();	621	rekey.stop ();
582	}	622	}
583	}	623	}
584		624
585	void	625	void
586	connection::reset_si ()	626	connection::reset_si ()
…		…
588	protocol = best_protocol (THISNODE->protocols & conf->protocols);	628	protocol = best_protocol (THISNODE->protocols & conf->protocols);
589		629
590	// mask out protocols we cannot establish	630	// mask out protocols we cannot establish
591	if (!conf->udp_port) protocol &= ~PROT_UDPv4;	631	if (!conf->udp_port) protocol &= ~PROT_UDPv4;
592	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;	632	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
		633	if (!conf->dns_port) protocol &= ~PROT_DNSv4;
		634
		635	if (protocol
		636	&& (!conf->can_direct (THISNODE)
		637	\|\| !THISNODE->can_direct (conf)))
		638	{
		639	slog (L_DEBUG, _("%s: direct connection denied"), conf->nodename);
		640	protocol = 0;
		641	}
593		642
594	si.set (conf, protocol);	643	si.set (conf, protocol);
595	}	644	}
596		645
597	// ensure sockinfo is valid, forward if necessary	646	// ensure sockinfo is valid, forward if necessary
…		…
602	{	651	{
603	connection *r = vpn->find_router ();	652	connection *r = vpn->find_router ();
604		653
605	if (r)	654	if (r)
606	{	655	{
607	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"),	656	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"),
608	conf->nodename, r->conf->nodename);	657	conf->nodename, r->conf->nodename, (const char *)r->si);
609	return r->si;	658	return r->si;
610	}	659	}
611	else	660	else
612	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),	661	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),
613	conf->nodename);	662	conf->nodename);
…		…
652	connection::send_auth_request (const sockinfo &si, bool initiate)	701	connection::send_auth_request (const sockinfo &si, bool initiate)
653	{	702	{
654	auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);	703	auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
655		704
656	rsachallenge chg;	705	rsachallenge chg;
657
658	rsa_cache.gen (pkt->id, chg);	706	rsa_cache.gen (pkt->id, chg);
659		707	rsa_encrypt (conf->rsa_key, chg, pkt->encr);
660	if (0 > RSA_public_encrypt (sizeof chg,
661	(unsigned char )&chg, (unsigned char )&pkt->encr,
662	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
663	fatal ("RSA_public_encrypt error");
664		708
665	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);	709	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
666		710
667	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly	711	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly
668		712
…		…
688	}	732	}
689		733
690	void	734	void
691	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)	735	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
692	{	736	{
693	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",	737	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)",
694	conf->id, rid, (const char *)rsi);	738	conf->id, rid, (const char *)rsi);
695		739
696	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);	740	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
697		741
698	r->hmac_set (octx);	742	r->hmac_set (octx);
…		…
700		744
701	delete r;	745	delete r;
702	}	746	}
703		747
704	void	748	void
705	connection::establish_connection_cb (time_watcher &w)	749	connection::establish_connection_cb (ev::timer &w, int revents)
706	{	750	{
707	if (ictx \|\| conf == THISNODE	751	if (!ictx
		752	&& conf != THISNODE
708	\|\| connectmode == conf_node::C_NEVER	753	&& connectmode != conf_node::C_NEVER
709	\|\| connectmode == conf_node::C_DISABLED)	754	&& connectmode != conf_node::C_DISABLED
710	w.at = TSTAMP_CANCEL;	755	&& !w.is_active ())
711	else if (w.at <= NOW)
712	{	756	{
713	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;	757	ev::tstamp retry_int = ev::tstamp (retry_cnt & 3
714		758	? (retry_cnt & 3) + 1
715	if (retry_int < 3600 * 8)	759	: 1 << (retry_cnt >> 2));
716	retry_cnt++;
717
718	w.at = NOW + retry_int;
719		760
720	reset_si ();	761	reset_si ();
721		762
		763	bool slow = si.prot & PROT_SLOW;
		764
722	if (si.prot && !si.host)	765	if (si.prot && !si.host)
		766	{
		767	slog (L_TRACE, _("%s: connection request (indirect)"), conf->nodename);
		768	/TODO/ /* start the timer so we don't recurse endlessly */
		769	w.start (1);
723	vpn->send_connect_request (conf->id);	770	vpn->send_connect_request (conf->id);
		771	}
724	else	772	else
725	{	773	{
		774	slog (L_TRACE, _("%s: connection request (direct)"), conf->nodename, !!ictx, !!octx);
		775
726	const sockinfo &dsi = forward_si (si);	776	const sockinfo &dsi = forward_si (si);
		777
		778	slow = slow \|\| (dsi.prot & PROT_SLOW);
727		779
728	if (dsi.valid () && auth_rate_limiter.can (dsi))	780	if (dsi.valid () && auth_rate_limiter.can (dsi))
729	{	781	{
730	if (retry_cnt < 4)	782	if (retry_cnt < 4)
731	send_auth_request (dsi, true);	783	send_auth_request (dsi, true);
732	else	784	else
733	send_ping (dsi, 0);	785	send_ping (dsi, 0);
734	}	786	}
735	}	787	}
		788
		789	retry_int *= slow ? 8. : 0.7;
		790
		791	if (retry_int < conf->max_retry)
		792	retry_cnt++;
		793	else
		794	retry_int = conf->max_retry;
		795
		796	w.start (retry_int);
736	}	797	}
737	}	798	}
738		799
739	void	800	void
740	connection::reset_connection ()	801	connection::reset_connection ()
…		…
743	{	804	{
744	slog (L_INFO, _("%s(%s): connection lost"),	805	slog (L_INFO, _("%s(%s): connection lost"),
745	conf->nodename, (const char *)si);	806	conf->nodename, (const char *)si);
746		807
747	if (::conf.script_node_down)	808	if (::conf.script_node_down)
748	run_script (run_script_cb (this, &connection::script_node_down), false);	809	if (!run_script (run_script_cb (this, &connection::script_node_down), false))
		810	slog (L_WARN, _("node-down command execution failed, continuing."));
749	}	811	}
750		812
751	delete ictx; ictx = 0;	813	delete ictx; ictx = 0;
752	delete octx; octx = 0;	814	delete octx; octx = 0;
		815	#if ENABLE_DNS
		816	dnsv4_reset_connection ();
		817	#endif
753		818
754	si.host= 0;	819	si.host = 0;
755		820
756	last_activity = 0;	821	last_activity = 0;
757	retry_cnt = 0;	822	retry_cnt = 0;
758		823
759	rekey.reset ();	824	rekey.stop ();
760	keepalive.reset ();	825	keepalive.stop ();
761	establish_connection.reset ();	826	establish_connection.stop ();
762	}	827	}
763		828
764	void	829	void
765	connection::shutdown ()	830	connection::shutdown ()
766	{	831	{
…		…
769		834
770	reset_connection ();	835	reset_connection ();
771	}	836	}
772		837
773	void	838	void
774	connection::rekey_cb (time_watcher &w)	839	connection::rekey_cb (ev::timer &w, int revents)
775	{	840	{
776	w.at = TSTAMP_CANCEL;
777
778	reset_connection ();	841	reset_connection ();
779	establish_connection ();	842	establish_connection ();
780	}	843	}
781		844
782	void	845	void
783	connection::send_data_packet (tap_packet *pkt, bool broadcast)	846	connection::send_data_packet (tap_packet *pkt)
784	{	847	{
785	vpndata_packet *p = new vpndata_packet;	848	vpndata_packet *p = new vpndata_packet;
786	int tos = 0;	849	int tos = 0;
787		850
788	if (conf->inherit_tos	851	// I am not hilarious about peeking into packets, but so be it.
789	&& (pkt)[12] == 0x08 && (pkt)[13] == 0x00 // IP	852	if (conf->inherit_tos && pkt->is_ipv4 ())
790	&& ((*pkt)[14] & 0xf0) == 0x40) // IPv4
791	tos = (*pkt)[15] & IPTOS_TOS_MASK;	853	tos = (*pkt)[15] & IPTOS_TOS_MASK;
792		854
793	p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs	855	p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
794	send_vpn_packet (p, si, tos);	856	send_vpn_packet (p, si, tos);
795		857
796	delete p;	858	delete p;
797		859
798	if (oseqno > MAX_SEQNO)	860	if (oseqno > MAX_SEQNO)
799	rekey ();	861	rekey ();
800	}	862	}
801		863
802	void	864	void
803	connection::inject_data_packet (tap_packet *pkt, bool broadcast)	865	connection::inject_data_packet (tap_packet pkt, bool broadcast/TODO DDD*/)
804	{	866	{
805	if (ictx && octx)	867	if (ictx && octx)
806	send_data_packet (pkt, broadcast);	868	send_data_packet (pkt);
807	else	869	else
808	{	870	{
809	if (!broadcast)//DDDD	871	if (!broadcast)
810	queue.put (new tap_packet (*pkt));	872	data_queue.put (new tap_packet (*pkt));
811		873
812	establish_connection ();	874	establish_connection ();
813	}	875	}
814	}	876	}
815		877
816	void connection::inject_vpn_packet (vpn_packet *pkt, int tos)	878	void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
817	{	879	{
818	if (ictx && octx)	880	if (ictx && octx)
819	send_vpn_packet (pkt, si, tos);	881	send_vpn_packet (pkt, si, tos);
820	else	882	else
		883	{
		884	vpn_queue.put ((vpn_packet )new data_packet ((data_packet *)pkt));
		885
821	establish_connection ();	886	establish_connection ();
		887	}
822	}	888	}
823		889
824	void	890	void
825	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	891	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
826	{	892	{
827	last_activity = NOW;	893	last_activity = ev::ev_now ();
828		894
829	slog (L_NOISE, "<<%d received packet type %d from %d to %d",	895	slog (L_NOISE, "<<%d received packet type %d from %d to %d",
830	conf->id, pkt->typ (), pkt->src (), pkt->dst ());	896	conf->id, pkt->typ (), pkt->src (), pkt->dst ());
		897
		898	if (connectmode == conf_node::C_DISABLED)
		899	return;
831		900
832	switch (pkt->typ ())	901	switch (pkt->typ ())
833	{	902	{
834	case vpn_packet::PT_PING:	903	case vpn_packet::PT_PING:
835	// we send pings instead of auth packets after some retries,	904	// we send pings instead of auth packets after some retries,
…		…
882	if (p->initiate)	951	if (p->initiate)
883	send_auth_request (rsi, false);	952	send_auth_request (rsi, false);
884		953
885	rsachallenge k;	954	rsachallenge k;
886		955
887	if (0 > RSA_private_decrypt (sizeof (p->encr),	956	if (!rsa_decrypt (::conf.rsa_key, p->encr, k))
888	(unsigned char )&p->encr, (unsigned char )&k,	957	{
889	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
890	slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),	958	slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
891	conf->nodename, (const char *)rsi);	959	conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
		960	break;
		961	}
892	else	962	else
893	{	963	{
894	delete octx;	964	delete octx;
895		965
896	octx = new crypto_ctx (k, 1);	966	octx = new crypto_ctx (k, 1);
897	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;	967	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;
898		968
899	conf->protocols = p->protocols;	969	conf->protocols = p->protocols;
		970	features = p->features & config_packet::get_features ();
900		971
901	send_auth_response (rsi, p->id, k);	972	send_auth_response (rsi, p->id, k);
902		973
903	connection_established ();	974	connection_established ();
904		975
905	break;	976	break;
906	}	977	}
907	}	978	}
		979	else
		980	slog (L_WARN, _("%s(%s): protocol mismatch"),
		981	conf->nodename, (const char *)rsi);
908		982
909	send_reset (rsi);	983	send_reset (rsi);
910	}	984	}
911		985
912	break;	986	break;
…		…
925	PROTOCOL_MINOR, conf->nodename, p->prot_minor);	999	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
926		1000
927	rsachallenge chg;	1001	rsachallenge chg;
928		1002
929	if (!rsa_cache.find (p->id, chg))	1003	if (!rsa_cache.find (p->id, chg))
		1004	{
930	slog (L_ERR, _("%s(%s): unrequested auth response"),	1005	slog (L_ERR, _("%s(%s): unrequested auth response ignored"),
931	conf->nodename, (const char *)rsi);	1006	conf->nodename, (const char *)rsi);
		1007	break;
		1008	}
932	else	1009	else
933	{	1010	{
934	crypto_ctx *cctx = new crypto_ctx (chg, 0);	1011	crypto_ctx *cctx = new crypto_ctx (chg, 0);
935		1012
936	if (!p->hmac_chk (cctx))	1013	if (!p->hmac_chk (cctx))
		1014	{
937	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"	1015	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
938	"could be an attack, or just corruption or an synchronization error"),	1016	"could be an attack, or just corruption or a synchronization error"),
939	conf->nodename, (const char *)rsi);	1017	conf->nodename, (const char *)rsi);
		1018	break;
		1019	}
940	else	1020	else
941	{	1021	{
942	rsaresponse h;	1022	rsaresponse h;
943		1023
944	rsa_hash (p->id, chg, h);	1024	rsa_hash (p->id, chg, h);
…		…
959	slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),	1039	slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
960	conf->nodename, (const char *)rsi,	1040	conf->nodename, (const char *)rsi,
961	p->prot_major, p->prot_minor);	1041	p->prot_major, p->prot_minor);
962		1042
963	if (::conf.script_node_up)	1043	if (::conf.script_node_up)
964	run_script (run_script_cb (this, &connection::script_node_up), false);	1044	if (!run_script (run_script_cb (this, &connection::script_node_up), false))
		1045	slog (L_WARN, _("node-up command execution failed, continuing."));
965		1046
966	break;	1047	break;
967	}	1048	}
968	else	1049	else
969	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),	1050	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
…		…
990	{	1071	{
991	vpndata_packet p = (vpndata_packet )pkt;	1072	vpndata_packet p = (vpndata_packet )pkt;
992		1073
993	if (!p->hmac_chk (ictx))	1074	if (!p->hmac_chk (ictx))
994	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"	1075	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
995	"could be an attack, or just corruption or an synchronization error"),	1076	"could be an attack, or just corruption or a synchronization error"),
996	conf->nodename, (const char *)rsi);	1077	conf->nodename, (const char *)rsi);
997	else	1078	else
998	{	1079	{
999	u32 seqno;	1080	u32 seqno;
1000	tap_packet *d = p->unpack (this, seqno);	1081	tap_packet *d = p->unpack (this, seqno);
1001		1082
1002	if (iseqno.recv_ok (seqno))	1083	if (iseqno.recv_ok (seqno))
1003	{	1084	{
1004	vpn->tap->send (d);	1085	vpn->tap->send (d);
1005		1086
1006	if (p->dst () == 0) // re-broadcast
1007	for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
1008	{
1009	connection c = i;
1010
1011	if (c->conf != THISNODE && c->conf != conf)
1012	c->inject_data_packet (d);
1013	}
1014
1015	if (si != rsi)	1087	if (si != rsi)
1016	{	1088	{
1017	// fast re-sync on conneciton changes, useful especially for tcp/ip	1089	// fast re-sync on source address changes, useful especially for tcp/ip
1018	si = rsi;	1090	si = rsi;
1019		1091
1020	slog (L_INFO, _("%s(%s): socket address changed to %s"),	1092	slog (L_INFO, _("%s(%s): socket address changed to %s"),
1021	conf->nodename, (const char )si, (const char )rsi);	1093	conf->nodename, (const char )si, (const char )rsi);
1022	}	1094	}
1023
1024	delete d;
1025
1026	break;
1027	}	1095	}
		1096
		1097	delete d;
		1098	break;
1028	}	1099	}
1029	}	1100	}
1030		1101
1031	send_reset (rsi);	1102	send_reset (rsi);
1032	break;	1103	break;
…		…
1034	case vpn_packet::PT_CONNECT_REQ:	1105	case vpn_packet::PT_CONNECT_REQ:
1035	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1106	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1036	{	1107	{
1037	connect_req_packet p = (connect_req_packet ) pkt;	1108	connect_req_packet p = (connect_req_packet ) pkt;
1038		1109
1039	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1110	if (p->id > 0 && p->id <= vpn->conns.size ())
1040	connection *c = vpn->conns[p->id - 1];
1041	conf->protocols = p->protocols;
1042
1043	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
1044	conf->id, p->id, c->ictx && c->octx);
1045
1046	if (c->ictx && c->octx)
1047	{	1111	{
		1112	connection *c = vpn->conns[p->id - 1];
		1113	conf->protocols = p->protocols;
		1114
		1115	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]",
		1116	conf->id, p->id, c->ictx && c->octx);
		1117
		1118	if (c->ictx && c->octx)
		1119	{
1048	// send connect_info packets to both sides, in case one is	1120	// send connect_info packets to both sides, in case one is
1049	// behind a nat firewall (or both ;)	1121	// behind a nat firewall (or both ;)
1050	c->send_connect_info (conf->id, si, conf->protocols);	1122	c->send_connect_info (conf->id, si, conf->protocols);
1051	send_connect_info (c->conf->id, c->si, c->conf->protocols);	1123	send_connect_info (c->conf->id, c->si, c->conf->protocols);
		1124	}
		1125	else
		1126	c->establish_connection ();
1052	}	1127	}
		1128	else
		1129	slog (L_WARN,
		1130	_("received authenticated connection request from unknown node #%d, config file mismatch?"),
		1131	p->id);
1053	}	1132	}
1054		1133
1055	break;	1134	break;
1056		1135
1057	case vpn_packet::PT_CONNECT_INFO:	1136	case vpn_packet::PT_CONNECT_INFO:
1058	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1137	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1059	{	1138	{
1060	connect_info_packet p = (connect_info_packet ) pkt;	1139	connect_info_packet p = (connect_info_packet )pkt;
1061		1140
1062	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1141	if (p->id > 0 && p->id <= vpn->conns.size ())
1063		1142	{
1064	connection *c = vpn->conns[p->id - 1];	1143	connection *c = vpn->conns[p->id - 1];
1065		1144
1066	c->conf->protocols = p->protocols;	1145	c->conf->protocols = p->protocols;
1067	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));	1146	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1068	p->si.upgrade_protocol (protocol, c->conf);	1147	p->si.upgrade_protocol (protocol, c->conf);
1069		1148
1070	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1149	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1071	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1150	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1072		1151
1073	const sockinfo &dsi = forward_si (p->si);	1152	const sockinfo &dsi = forward_si (p->si);
1074		1153
1075	if (dsi.valid ())	1154	if (dsi.valid ())
1076	c->send_auth_request (dsi, true);	1155	c->send_auth_request (dsi, true);
		1156	}
		1157	else
		1158	slog (L_WARN,
		1159	_("received authenticated connection request from unknown node #%d, config file mismatch?"),
		1160	p->id);
1077	}	1161	}
1078		1162
1079	break;	1163	break;
1080		1164
1081	default:	1165	default:
1082	send_reset (rsi);	1166	send_reset (rsi);
1083	break;	1167	break;
1084	}	1168	}
1085	}	1169	}
1086		1170
1087	void connection::keepalive_cb (time_watcher &w)	1171	void connection::keepalive_cb (ev::timer &w, int revents)
1088	{	1172	{
1089	if (NOW >= last_activity + ::conf.keepalive + 30)	1173	if (ev::ev_now () >= last_activity + ::conf.keepalive + 30)
1090	{	1174	{
1091	reset_connection ();	1175	reset_connection ();
1092	establish_connection ();	1176	establish_connection ();
1093	}	1177	}
1094	else if (NOW < last_activity + ::conf.keepalive)	1178	else if (ev::ev_now () < last_activity + ::conf.keepalive)
1095	w.at = last_activity + ::conf.keepalive;	1179	w.start (last_activity + ::conf.keepalive - ev::now ());
1096	else if (conf->connectmode != conf_node::C_ONDEMAND	1180	else if (conf->connectmode != conf_node::C_ONDEMAND
1097	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)	1181	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)
1098	{	1182	{
1099	send_ping (si);	1183	send_ping (si);
1100	w.at = NOW + 5;	1184	w.start (5);
1101	}	1185	}
		1186	else if (ev::ev_now () < last_activity + ::conf.keepalive + 10)
		1187	// hold ondemand connections implicitly a few seconds longer
		1188	// should delete octx, though, or something like that ;)
		1189	w.start (last_activity + ::conf.keepalive + 10 - ev::now ());
1102	else	1190	else
1103	reset_connection ();	1191	reset_connection ();
1104	}	1192	}
1105		1193
1106	void connection::send_connect_request (int id)	1194	void connection::send_connect_request (int id)
…		…
1112	send_vpn_packet (p, si);	1200	send_vpn_packet (p, si);
1113		1201
1114	delete p;	1202	delete p;
1115	}	1203	}
1116		1204
		1205	void connection::script_init_env (const char *ext)
		1206	{
		1207	char *env;
		1208	asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
		1209	asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
		1210	asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
		1211	0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
		1212	conf->id & 0xff); putenv (env);
		1213	}
		1214
1117	void connection::script_node ()	1215	void connection::script_init_connect_env ()
1118	{	1216	{
1119	vpn->script_if_up ();	1217	vpn->script_init_env ();
1120		1218
1121	char *env;	1219	char *env;
1122	asprintf (&env, "DESTID=%d", conf->id); putenv (env);	1220	asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1123	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);	1221	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1124	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);	1222	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1125	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);	1223	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1126	}	1224	}
1127		1225
1128	const char *connection::script_node_up ()	1226	const char *connection::script_node_up ()
1129	{	1227	{
1130	script_node ();	1228	script_init_connect_env ();
1131		1229
1132	putenv ("STATE=up");	1230	putenv ((char *)"STATE=up");
1133		1231
		1232	char *filename;
		1233	asprintf (&filename,
		1234	"%s/%s",
		1235	confbase,
1134	return ::conf.script_node_up ? ::conf.script_node_up : "node-up";	1236	::conf.script_node_up ? ::conf.script_node_up : "node-up");
		1237
		1238	return filename;
1135	}	1239	}
1136		1240
1137	const char *connection::script_node_down ()	1241	const char *connection::script_node_down ()
1138	{	1242	{
1139	script_node ();	1243	script_init_connect_env ();
1140		1244
1141	putenv ("STATE=down");	1245	putenv ((char *)"STATE=down");
1142		1246
1143	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";	1247	char *filename;
1144	}	1248	asprintf (&filename,
		1249	"%s/%s",
		1250	confbase,
		1251	::conf.script_node_down ? ::conf.script_node_down : "node-down");
1145		1252
		1253	return filename;
		1254	}
		1255
1146	connection::connection(struct vpn *vpn_)	1256	connection::connection (struct vpn vpn, conf_node conf)
1147	: vpn(vpn_)	1257	: vpn(vpn), conf(conf)
1148	, rekey (this, &connection::rekey_cb)	1258	, rekey (this, &connection::rekey_cb)
1149	, keepalive (this, &connection::keepalive_cb)	1259	, keepalive (this, &connection::keepalive_cb)
1150	, establish_connection (this, &connection::establish_connection_cb)	1260	, establish_connection (this, &connection::establish_connection_cb)
		1261	#if ENABLE_DNS
		1262	, dns (0)
		1263	#endif
1151	{	1264	{
1152	octx = ictx = 0;	1265	octx = ictx = 0;
1153	retry_cnt = 0;	1266	retry_cnt = 0;
1154		1267
		1268	if (!conf->protocols) // make sure some protocol is enabled
		1269	conf->protocols = PROT_UDPv4;
		1270
1155	connectmode = conf_node::C_ALWAYS; // initial setting	1271	connectmode = conf_node::C_ALWAYS; // initial setting
1156	reset_connection ();	1272	reset_connection ();
1157	}	1273	}
1158		1274
1159	connection::~connection ()	1275	connection::~connection ()

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.10 by pcg, Sun Apr 6 18:12:18 2003 UTC vs. Revision 1.61 by pcg, Sat Nov 10 19:43:37 2007 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.10 by pcg, Sun Apr 6 18:12:18 2003 UTC vs.
Revision 1.61 by pcg, Sat Nov 10 19:43:37 2007 UTC