ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.C
(Generate patch)

Comparing gvpe/src/connection.C (file contents):
Revision 1.74 by pcg, Sun Aug 10 02:49:21 2008 UTC vs.
Revision 1.85 by pcg, Tue Jul 28 00:42:14 2009 UTC

… …
50 50
51#if !HAVE_RAND_PSEUDO_BYTES 51#if !HAVE_RAND_PSEUDO_BYTES
52# define RAND_pseudo_bytes RAND_bytes 52# define RAND_pseudo_bytes RAND_bytes
53#endif 53#endif
54 54
55#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 55#define MAGIC_OLD "vped\xbd\xc6\xdb\x82" // 8 bytes of magic (still used in the protocol)
56#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic (understood but not generated)
56 57
57#define ULTRA_FAST 1 58#define ULTRA_FAST 1
58#define HLOG 15 59#define HLOG 15
59#include "lzf/lzf.h" 60#include "lzf/lzf.h"
60#include "lzf/lzf_c.c" 61#include "lzf/lzf_c.c"
… …
613 rsaencrdata encr; 614 rsaencrdata encr;
614 615
615 auth_req_packet (int dst, bool initiate_, u8 protocols_) 616 auth_req_packet (int dst, bool initiate_, u8 protocols_)
616 { 617 {
617 config_packet::setup (PT_AUTH_REQ, dst); 618 config_packet::setup (PT_AUTH_REQ, dst);
618 strncpy (magic, MAGIC, 8); 619 strncpy (magic, MAGIC_OLD, 8);
619 initiate = !!initiate_; 620 initiate = !!initiate_;
620 protocols = protocols_; 621 protocols = protocols_;
621 622
622 len = sizeof (*this) - sizeof (net_packet); 623 len = sizeof (*this) - sizeof (net_packet);
623 } 624 }
… …
672///////////////////////////////////////////////////////////////////////////// 673/////////////////////////////////////////////////////////////////////////////
673 674
674void 675void
675connection::connection_established () 676connection::connection_established ()
676{ 677{
677 slog (L_TRACE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx); 678 slog (L_NOISE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);
678 679
679 if (ictx && octx) 680 if (ictx && octx)
680 { 681 {
681 // make sure rekeying timeouts are slightly asymmetric 682 // make sure rekeying timeouts are slightly asymmetric
682 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0); 683 ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
… …
760{ 761{
761 ping_packet *pkt = new ping_packet; 762 ping_packet *pkt = new ping_packet;
762 763
763 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 764 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
764 765
765 slog (L_TRACE, ">>%d %s [%s]", conf->id, pong ? "PT_PONG" : "PT_PING", (const char *)si); 766 slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
766 767
767 send_vpn_packet (pkt, si, IPTOS_LOWDELAY); 768 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
768 769
769 delete pkt; 770 delete pkt;
770} 771}
… …
790 791
791 rsachallenge chg; 792 rsachallenge chg;
792 rsa_cache.gen (pkt->id, chg); 793 rsa_cache.gen (pkt->id, chg);
793 rsa_encrypt (conf->rsa_key, chg, pkt->encr); 794 rsa_encrypt (conf->rsa_key, chg, pkt->encr);
794 795
795 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si); 796 slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
796 797
797 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly 798 send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly
798 799
799 delete pkt; 800 delete pkt;
800} 801}
… …
808 809
809 rsa_hash (id, chg, pkt->response); 810 rsa_hash (id, chg, pkt->response);
810 811
811 pkt->hmac_set (octx); 812 pkt->hmac_set (octx);
812 813
813 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si); 814 slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
814 815
815 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 816 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
816 817
817 delete pkt; 818 delete pkt;
818} 819}
819 820
820void 821void
821connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols) 822connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
822{ 823{
823 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)", 824 slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s)", conf->nodename,
824 conf->id, rid, (const char *)rsi); 825 vpn->conns[rid - 1]->conf->nodename, (const char *)rsi);
825 826
826 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols); 827 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
827 828
828 r->hmac_set (octx); 829 r->hmac_set (octx);
829 send_vpn_packet (r, si); 830 send_vpn_packet (r, si);
… …
999void 1000void
1000connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 1001connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
1001{ 1002{
1002 last_activity = ev_now (); 1003 last_activity = ev_now ();
1003 1004
1004 slog (L_NOISE, "<<%d received packet type %d from %d to %d.", 1005 slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
1005 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 1006 conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
1006 1007
1007 if (connectmode == conf_node::C_DISABLED) 1008 if (connectmode == conf_node::C_DISABLED)
1008 return; 1009 return;
1009 1010
1010 switch (pkt->typ ()) 1011 switch (pkt->typ ())
1011 { 1012 {
1012 case vpn_packet::PT_PING: 1013 case vpn_packet::PT_PING:
1014 slog (L_TRACE, "%s >> PT_PING", conf->nodename);
1015
1013 // we send pings instead of auth packets after some retries, 1016 // we send pings instead of auth packets after some retries,
1014 // so reset the retry counter and establish a connection 1017 // so reset the retry counter and establish a connection
1015 // when we receive a ping. 1018 // when we receive a ping.
1016 if (!ictx) 1019 if (!ictx)
1017 { 1020 {
… …
1024 send_ping (rsi, 1); // pong 1027 send_ping (rsi, 1); // pong
1025 1028
1026 break; 1029 break;
1027 1030
1028 case vpn_packet::PT_PONG: 1031 case vpn_packet::PT_PONG:
1032 slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
1029 break; 1033 break;
1030 1034
1031 case vpn_packet::PT_RESET: 1035 case vpn_packet::PT_RESET:
1032 { 1036 {
1033 reset_connection (); 1037 reset_connection ();
… …
1048 case vpn_packet::PT_AUTH_REQ: 1052 case vpn_packet::PT_AUTH_REQ:
1049 if (auth_rate_limiter.can (rsi)) 1053 if (auth_rate_limiter.can (rsi))
1050 { 1054 {
1051 auth_req_packet *p = (auth_req_packet *) pkt; 1055 auth_req_packet *p = (auth_req_packet *) pkt;
1052 1056
1053 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 1057 slog (L_TRACE, "%s >> PT_AUTH_REQ(%s)", conf->nodename, p->initiate ? "initiate" : "reply");
1054 1058
1055 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 1059 if (p->chk_config ()
1060 && (!strncmp (p->magic, MAGIC_OLD, 8) || !strncmp (p->magic, MAGIC, 8)))
1056 { 1061 {
1057 if (p->prot_minor != PROTOCOL_MINOR) 1062 if (p->prot_minor != PROTOCOL_MINOR)
1058 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1063 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1059 conf->nodename, (const char *)rsi, 1064 conf->nodename, (const char *)rsi,
1060 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 1065 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
… …
1096 1101
1097 break; 1102 break;
1098 1103
1099 case vpn_packet::PT_AUTH_RES: 1104 case vpn_packet::PT_AUTH_RES:
1100 { 1105 {
1101 auth_res_packet *p = (auth_res_packet *) pkt; 1106 auth_res_packet *p = (auth_res_packet *)pkt;
1102 1107
1103 slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id); 1108 slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
1104 1109
1105 if (p->chk_config ()) 1110 if (p->chk_config ())
1106 { 1111 {
1107 if (p->prot_minor != PROTOCOL_MINOR) 1112 if (p->prot_minor != PROTOCOL_MINOR)
1108 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 1113 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
… …
1143 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 1148 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
1144 1149
1145 si = rsi; 1150 si = rsi;
1146 protocol = rsi.prot; 1151 protocol = rsi.prot;
1147 1152
1148 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d."), 1153 slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
1149 conf->nodename, (const char *)rsi, 1154 conf->nodename, (const char *)rsi,
1155 is_direct ? "direct" : "forwarded",
1150 p->prot_major, p->prot_minor); 1156 p->prot_major, p->prot_minor);
1151 1157
1152 connection_established (); 1158 connection_established ();
1153 1159
1154 if (::conf.script_node_up) 1160 if (::conf.script_node_up)
… …
1202 if (si != rsi) 1208 if (si != rsi)
1203 { 1209 {
1204 // fast re-sync on source address changes, useful especially for tcp/ip 1210 // fast re-sync on source address changes, useful especially for tcp/ip
1205 //if (last_si_change < ev_now () + 5.) 1211 //if (last_si_change < ev_now () + 5.)
1206 // { 1212 // {
1213 slog (L_INFO, _("%s(%s): changing socket address to %s."),
1214 conf->nodename, (const char *)si, (const char *)rsi);
1215
1207 si = rsi; 1216 si = rsi;
1208 1217
1209 slog (L_INFO, _("%s(%s): socket address changed to %s."), 1218 if (::conf.script_node_change)
1210 conf->nodename, (const char *)si, (const char *)rsi); 1219 {
1220 run_script_cb *cb = new run_script_cb;
1221 cb->set<connection, &connection::script_node_change> (this);
1222 run_script_queued (cb, _("node-change command execution failed, continuing."));
1223 }
1224
1211 // } 1225 // }
1212 //else 1226 //else
1213 // slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."), 1227 // slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
1214 // conf->nodename, (const char *)si, (const char *)rsi); 1228 // conf->nodename, (const char *)si, (const char *)rsi);
1215 } 1229 }
1216 } 1230 }
1217 else if (seqclass == 1) // silently ignore 1231 else if (seqclass == 1) // far history
1232 slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
1233 "possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
1234 else if (seqclass == 2) // in-window duplicate, happens often on wireless
1218 slog (L_ERR, _("received duplicate packet (received %08lx, expected %08lx)\n" 1235 slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
1219 "possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1); 1236 "possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
1220 else if (seqclass == 2) // reset 1237 else if (seqclass == 3) // reset
1221 { 1238 {
1222 slog (L_ERR, _("received duplicate or out-of-sync packet (received %08lx, expected %08lx)\n" 1239 slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
1223 "possible replay attack, or just massive packet loss, resetting connection."), seqno, iseqno.seq + 1); 1240 "probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
1224 send_reset (rsi); 1241 send_reset (rsi);
1225 } 1242 }
1226 1243
1227 delete d; 1244 delete d;
1228 break; 1245 break;
… …
1233 break; 1250 break;
1234 1251
1235 case vpn_packet::PT_CONNECT_REQ: 1252 case vpn_packet::PT_CONNECT_REQ:
1236 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1253 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1237 { 1254 {
1238 connect_req_packet *p = (connect_req_packet *) pkt; 1255 connect_req_packet *p = (connect_req_packet *)pkt;
1239 1256
1240 if (p->id > 0 && p->id <= vpn->conns.size ()) 1257 if (p->id > 0 && p->id <= vpn->conns.size ())
1241 { 1258 {
1242 connection *c = vpn->conns[p->id - 1]; 1259 connection *c = vpn->conns[p->id - 1];
1243 conf->protocols = p->protocols; 1260 conf->protocols = p->protocols;
1244 1261
1245 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]", 1262 slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s) [%d]",
1246 conf->id, p->id, c->ictx && c->octx); 1263 conf->nodename, vpn->conns[p->id - 1]->conf->nodename, c->ictx && c->octx);
1247 1264
1248 if (c->ictx && c->octx) 1265 if (c->ictx && c->octx)
1249 { 1266 {
1250 // send connect_info packets to both sides, in case one is 1267 // send connect_info packets to both sides, in case one is
1251 // behind a nat firewall (or both ;) 1268 // behind a nat firewall (or both ;)
… …
1274 1291
1275 c->conf->protocols = p->protocols; 1292 c->conf->protocols = p->protocols;
1276 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf)); 1293 protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1277 p->si.upgrade_protocol (protocol, c->conf); 1294 p->si.upgrade_protocol (protocol, c->conf);
1278 1295
1279 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1296 slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s) [%d]",
1297 conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1280 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1298 (const char *)p->si, !c->ictx && !c->octx);
1281 1299
1282 const sockinfo &dsi = forward_si (p->si); 1300 const sockinfo &dsi = forward_si (p->si);
1283 1301
1284 if (dsi.valid ()) 1302 if (dsi.valid ())
1285 c->send_auth_request (dsi, true); 1303 c->send_auth_request (dsi, true);
… …
1299} 1317}
1300 1318
1301inline void 1319inline void
1302connection::keepalive_cb (ev::timer &w, int revents) 1320connection::keepalive_cb (ev::timer &w, int revents)
1303{ 1321{
1304 if (ev_now () >= last_activity + ::conf.keepalive + 30) 1322 if (ev_now () >= last_activity + ::conf.keepalive + 15)
1305 { 1323 {
1306 reset_connection (); 1324 reset_connection ();
1307 establish_connection (); 1325 establish_connection ();
1308 } 1326 }
1309 else if (ev_now () < last_activity + ::conf.keepalive) 1327 else if (ev_now () < last_activity + ::conf.keepalive)
1310 w.start (last_activity + ::conf.keepalive - ev::now ()); 1328 w.start (last_activity + ::conf.keepalive - ev::now ());
1311 else if (conf->connectmode != conf_node::C_ONDEMAND 1329 else if (conf->connectmode != conf_node::C_ONDEMAND
1312 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1330 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1313 { 1331 {
1314 send_ping (si); 1332 send_ping (si);
1315 w.start (5); 1333 w.start (3);
1316 } 1334 }
1317 else if (ev_now () < last_activity + ::conf.keepalive + 10) 1335 else if (ev_now () < last_activity + ::conf.keepalive + 10)
1318 // hold ondemand connections implicitly a few seconds longer 1336 // hold ondemand connections implicitly a few seconds longer
1319 // should delete octx, though, or something like that ;) 1337 // should delete octx, though, or something like that ;)
1320 w.start (last_activity + ::conf.keepalive + 10 - ev::now ()); 1338 w.start (last_activity + ::conf.keepalive + 10 - ev::now ());
… …
1324 1342
1325void connection::send_connect_request (int id) 1343void connection::send_connect_request (int id)
1326{ 1344{
1327 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); 1345 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1328 1346
1329 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id); 1347 slog (L_TRACE, "%s << PT_CONNECT_REQ(%s)",
1348 conf->nodename, vpn->conns[id - 1]->conf->nodename);
1330 p->hmac_set (octx); 1349 p->hmac_set (octx);
1331 send_vpn_packet (p, si); 1350 send_vpn_packet (p, si);
1332 1351
1333 delete p; 1352 delete p;
1334} 1353}
1335 1354
1336void connection::script_init_env (const char *ext) 1355void connection::script_init_env (const char *ext)
1337{ 1356{
1338 char *env; 1357 char *env;
1339 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env); 1358 asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
1340 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env); 1359 asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
1341 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext, 1360 asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
1342 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8, 1361 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
1343 conf->id & 0xff); putenv (env); 1362 conf->id & 0xff); putenv (env);
1344} 1363}
1345 1364
1346void connection::script_init_connect_env () 1365void connection::script_init_connect_env ()
1347{ 1366{
1348 vpn->script_init_env (); 1367 vpn->script_init_env ();
1349 1368
1350 char *env; 1369 char *env;
1351 asprintf (&env, "DESTID=%d", conf->id); putenv (env); 1370 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1371 asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env);
1352 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); 1372 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1353 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); 1373 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1354 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); 1374 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1355} 1375}
1356 1376
1357inline const char * 1377inline const char *
1358connection::script_node_up () 1378connection::script_node_up ()
1359{ 1379{
… …
1364 char *filename; 1384 char *filename;
1365 asprintf (&filename, 1385 asprintf (&filename,
1366 "%s/%s", 1386 "%s/%s",
1367 confbase, 1387 confbase,
1368 ::conf.script_node_up ? ::conf.script_node_up : "node-up"); 1388 ::conf.script_node_up ? ::conf.script_node_up : "node-up");
1389
1390 return filename;
1391}
1392
1393inline const char *
1394connection::script_node_change ()
1395{
1396 script_init_connect_env ();
1397
1398 putenv ((char *)"STATE=change");
1399
1400 char *filename;
1401 asprintf (&filename,
1402 "%s/%s",
1403 confbase,
1404 ::conf.script_node_change ? ::conf.script_node_change : "node-change");
1369 1405
1370 return filename; 1406 return filename;
1371} 1407}
1372 1408
1373inline const char * 1409inline const char *

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines