[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.11 by pcg, Sun Apr 13 00:35:46 2003 UTC vs.
Revision 1.80 by pcg, Fri Aug 15 18:11:14 2008 UTC

…		…
1	/*	1	/*
2	connection.C -- manage a single connection	2	connection.C -- manage a single connection
		3	Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
3		4
		5	This file is part of GVPE.
		6
4	This program is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
5	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
6	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
7	(at your option) any later version.	10	option) any later version.
8		11
9	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
10	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
11	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
12	GNU General Public License for more details.	15	Public License for more details.
13		16
14	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
15	along with this program; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
16	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
17	*/	30	*/
18		31
19	#include "config.h"	32	#include "config.h"
20		33
21	extern "C" {
22	# include "lzf/lzf.h"
23	}
24
25	#include <list>	34	#include <list>
		35	#include <queue>
		36	#include <utility>
26		37
27	#include <openssl/rand.h>	38	#include <openssl/rand.h>
28	#include <openssl/evp.h>	39	#include <openssl/evp.h>
29	#include <openssl/rsa.h>	40	#include <openssl/rsa.h>
30	#include <openssl/err.h>	41	#include <openssl/err.h>
31
32	#include "gettext.h"
33		42
34	#include "conf.h"	43	#include "conf.h"
35	#include "slog.h"	44	#include "slog.h"
36	#include "device.h"	45	#include "device.h"
37	#include "vpn.h"	46	#include "vpn.h"
38	#include "connection.h"	47	#include "connection.h"
39		48
		49	#include "netcompat.h"
		50
40	#if !HAVE_RAND_PSEUDO_BYTES	51	#if !HAVE_RAND_PSEUDO_BYTES
41	# define RAND_pseudo_bytes RAND_bytes	52	# define RAND_pseudo_bytes RAND_bytes
42	#endif	53	#endif
43		54
44	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic	55	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
45		56
		57	#define ULTRA_FAST 1
		58	#define HLOG 15
		59	#include "lzf/lzf.h"
		60	#include "lzf/lzf_c.c"
		61	#include "lzf/lzf_d.c"
		62
		63	//////////////////////////////////////////////////////////////////////////////
		64
		65	static std::queue< std::pair<run_script_cb , const char > > rs_queue;
		66	static ev::child rs_child_ev;
		67
		68	void // c++ requires external linkage here, apparently :(
		69	rs_child_cb (ev::child &w, int revents)
		70	{
		71	w.stop ();
		72
		73	if (rs_queue.empty ())
		74	return;
		75
		76	pid_t pid = run_script (*rs_queue.front ().first, false);
		77	if (pid)
		78	{
		79	w.set (pid);
		80	w.start ();
		81	}
		82	else
		83	slog (L_WARN, rs_queue.front ().second);
		84
		85	delete rs_queue.front ().first;
		86	rs_queue.pop ();
		87	}
		88
		89	// despite the fancy name, this is quite a hack
		90	static void
		91	run_script_queued (run_script_cb cb, const char warnmsg)
		92	{
		93	rs_queue.push (std::make_pair (cb, warnmsg));
		94
		95	if (!rs_child_ev.is_active ())
		96	{
		97	rs_child_ev.set<rs_child_cb> ();
		98	rs_child_ev ();
		99	}
		100	}
		101
		102	//////////////////////////////////////////////////////////////////////////////
		103
46	struct crypto_ctx	104	struct crypto_ctx
47	{	105	{
48	EVP_CIPHER_CTX cctx;	106	EVP_CIPHER_CTX cctx;
49	HMAC_CTX hctx;	107	HMAC_CTX hctx;
50		108
53	};	111	};
54		112
55	crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)	113	crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)
56	{	114	{
57	EVP_CIPHER_CTX_init (&cctx);	115	EVP_CIPHER_CTX_init (&cctx);
58	EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc);	116	require (EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc));
59	HMAC_CTX_init (&hctx);	117	HMAC_CTX_init (&hctx);
60	HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);	118	HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
61	}	119	}
62		120
63	crypto_ctx::~crypto_ctx ()	121	crypto_ctx::~crypto_ctx ()
64	{	122	{
65	EVP_CIPHER_CTX_cleanup (&cctx);	123	require (EVP_CIPHER_CTX_cleanup (&cctx));
66	HMAC_CTX_cleanup (&hctx);	124	HMAC_CTX_cleanup (&hctx);
67	}	125	}
68		126
69	static void	127	static void
70	rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)	128	rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)
71	{	129	{
72	EVP_MD_CTX ctx;	130	EVP_MD_CTX ctx;
73		131
74	EVP_MD_CTX_init (&ctx);	132	EVP_MD_CTX_init (&ctx);
75	EVP_DigestInit (&ctx, RSA_HASH);	133	require (EVP_DigestInit (&ctx, RSA_HASH));
76	EVP_DigestUpdate(&ctx, &chg, sizeof chg);	134	require (EVP_DigestUpdate(&ctx, &chg, sizeof chg));
77	EVP_DigestUpdate(&ctx, &id, sizeof id);	135	require (EVP_DigestUpdate(&ctx, &id, sizeof id));
78	EVP_DigestFinal (&ctx, (unsigned char *)&h, 0);	136	require (EVP_DigestFinal (&ctx, (unsigned char *)&h, 0));
79	EVP_MD_CTX_cleanup (&ctx);	137	EVP_MD_CTX_cleanup (&ctx);
80	}	138	}
81		139
82	struct rsa_entry {	140	struct rsa_entry
		141	{
83	tstamp expire;	142	tstamp expire;
84	rsaid id;	143	rsaid id;
85	rsachallenge chg;	144	rsachallenge chg;
86	};	145	};
87		146
88	struct rsa_cache : list<rsa_entry>	147	struct rsa_cache : list<rsa_entry>
89	{	148	{
90	void cleaner_cb (time_watcher &w); time_watcher cleaner;	149	inline void cleaner_cb (ev::timer &w, int revents); ev::timer cleaner;
91		150
92	bool find (const rsaid &id, rsachallenge &chg)	151	bool find (const rsaid &id, rsachallenge &chg)
93	{	152	{
94	for (iterator i = begin (); i != end (); ++i)	153	for (iterator i = begin (); i != end (); ++i)
95	{	154	{
96	if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW)	155	if (!memcmp (&id, &i->id, sizeof id) && i->expire > ev_now ())
97	{	156	{
98	memcpy (&chg, &i->chg, sizeof chg);	157	memcpy (&chg, &i->chg, sizeof chg);
99		158
100	erase (i);	159	erase (i);
101	return true;	160	return true;
102	}	161	}
103	}	162	}
104		163
105	if (cleaner.at < NOW)	164	if (!cleaner.is_active ())
106	cleaner.start (NOW + RSA_TTL);	165	cleaner.again ();
107		166
108	return false;	167	return false;
109	}	168	}
110		169
111	void gen (rsaid &id, rsachallenge &chg)	170	void gen (rsaid &id, rsachallenge &chg)
112	{	171	{
113	rsa_entry e;	172	rsa_entry e;
114		173
115	RAND_bytes ((unsigned char *)&id, sizeof id);	174	RAND_bytes ((unsigned char *)&id, sizeof id);
116	RAND_bytes ((unsigned char *)&chg, sizeof chg);	175	RAND_bytes ((unsigned char *)&chg, sizeof chg);
117		176
118	e.expire = NOW + RSA_TTL;	177	e.expire = ev_now () + RSA_TTL;
119	e.id = id;	178	e.id = id;
120	memcpy (&e.chg, &chg, sizeof chg);	179	memcpy (&e.chg, &chg, sizeof chg);
121		180
122	push_back (e);	181	push_back (e);
123		182
124	if (cleaner.at < NOW)	183	if (!cleaner.is_active ())
125	cleaner.start (NOW + RSA_TTL);	184	cleaner.again ();
126	}	185	}
127		186
128	rsa_cache ()	187	rsa_cache ()
129	: cleaner (this, &rsa_cache::cleaner_cb)	188	{
130	{ }	189	cleaner.set<rsa_cache, &rsa_cache::cleaner_cb> (this);
		190	cleaner.set (RSA_TTL, RSA_TTL);
		191	}
131		192
132	} rsa_cache;	193	} rsa_cache;
133		194
134	void rsa_cache::cleaner_cb (time_watcher &w)	195	void rsa_cache::cleaner_cb (ev::timer &w, int revents)
135	{	196	{
136	if (empty ())	197	if (empty ())
137	w.at = TSTAMP_CANCEL;	198	w.stop ();
138	else	199	else
139	{	200	{
140	w.at = NOW + RSA_TTL;
141
142	for (iterator i = begin (); i != end (); )	201	for (iterator i = begin (); i != end (); )
143	if (i->expire <= NOW)	202	if (i->expire <= ev_now ())
144	i = erase (i);	203	i = erase (i);
145	else	204	else
146	++i;	205	++i;
147	}	206	}
148	}	207	}
149		208
150	//////////////////////////////////////////////////////////////////////////////	209	//////////////////////////////////////////////////////////////////////////////
151		210
152	void pkt_queue::put (tap_packet *p)	211	pkt_queue::pkt_queue (double max_ttl, int max_queue)
		212	: max_ttl (max_ttl), max_queue (max_queue)
153	{	213	{
154	if (queue[i])	214	queue = new pkt [max_queue];
155	{
156	delete queue[i];
157	j = (j + 1) % QUEUEDEPTH;
158	}
159		215
160	queue[i] = p;
161
162	i = (i + 1) % QUEUEDEPTH;
163	}
164
165	tap_packet *pkt_queue::get ()
166	{
167	tap_packet *p = queue[j];
168
169	if (p)
170	{
171	queue[j] = 0;
172	j = (j + 1) % QUEUEDEPTH;
173	}
174
175	return p;
176	}
177
178	pkt_queue::pkt_queue ()
179	{
180	memset (queue, 0, sizeof (queue));
181	i = 0;	216	i = 0;
182	j = 0;	217	j = 0;
		218
		219	expire.set<pkt_queue, &pkt_queue::expire_cb> (this);
183	}	220	}
184		221
185	pkt_queue::~pkt_queue ()	222	pkt_queue::~pkt_queue ()
186	{	223	{
187	for (i = QUEUEDEPTH; --i > 0; )	224	while (net_packet *p = get ())
		225	delete p;
		226
188	delete queue[i];	227	delete [] queue;
189	}	228	}
190		229
		230	void pkt_queue::expire_cb (ev::timer &w, int revents)
		231	{
		232	ev_tstamp expire = ev_now () - max_ttl;
		233
		234	for (;;)
		235	{
		236	if (empty ())
		237	break;
		238
		239	double diff = queue[j].tstamp - expire;
		240
		241	if (diff >= 0.)
		242	{
		243	w.start (diff > 0.5 ? diff : 0.5);
		244	break;
		245	}
		246
		247	delete get ();
		248	}
		249	}
		250
		251	void pkt_queue::put (net_packet *p)
		252	{
		253	ev_tstamp now = ev_now ();
		254
		255	// start expiry timer
		256	if (empty ())
		257	expire.start (max_ttl);
		258
		259	int ni = i + 1 == max_queue ? 0 : i + 1;
		260
		261	if (ni == j)
		262	delete get ();
		263
		264	queue[i].pkt = p;
		265	queue[i].tstamp = now;
		266
		267	i = ni;
		268	}
		269
		270	net_packet *pkt_queue::get ()
		271	{
		272	if (empty ())
		273	return 0;
		274
		275	net_packet *p = queue[j].pkt;
		276	queue[j].pkt = 0;
		277
		278	j = j + 1 == max_queue ? 0 : j + 1;
		279
		280	return p;
		281	}
		282
191	struct net_rateinfo {	283	struct net_rateinfo
		284	{
192	u32 host;	285	u32 host;
193	double pcnt, diff;	286	double pcnt, diff;
194	tstamp last;	287	tstamp last;
195	};	288	};
196		289
197	// only do action once every x seconds per host whole allowing bursts.	290	// only do action once every x seconds per host whole allowing bursts.
198	// this implementation ("splay list" ;) is inefficient,	291	// this implementation ("splay list" ;) is inefficient,
199	// but low on resources.	292	// but low on resources.
200	struct net_rate_limiter : list<net_rateinfo>	293	struct net_rate_limiter : list<net_rateinfo>
201	{	294	{
202	static const double ALPHA = 1. - 1. / 180.; // allow bursts	295	# define NRL_ALPHA (1. - 1. / 600.) // allow bursts
203	static const double CUTOFF = 10.; // one event every CUTOFF seconds	296	# define NRL_CUTOFF 10. // one event every CUTOFF seconds
204	static const double EXPIRE = CUTOFF * 30.; // expire entries after this time	297	# define NRL_EXPIRE (NRL_CUTOFF * 30.) // expire entries after this time
205	static const double MAXDIF = CUTOFF * (1. / (1. - ALPHA)); // maximum diff /count value	298	# define NRL_MAXDIF (NRL_CUTOFF * (1. / (1. - NRL_ALPHA))) // maximum diff /count value
206		299
207	bool can (const sockinfo &si) { return can((u32)si.host); }	300	bool can (const sockinfo &si) { return can((u32)si.host); }
208	bool can (u32 host);	301	bool can (u32 host);
209	};	302	};
210		303
211	net_rate_limiter auth_rate_limiter, reset_rate_limiter;	304	net_rate_limiter auth_rate_limiter, reset_rate_limiter;
212		305
…		…
215	iterator i;	308	iterator i;
216		309
217	for (i = begin (); i != end (); )	310	for (i = begin (); i != end (); )
218	if (i->host == host)	311	if (i->host == host)
219	break;	312	break;
220	else if (i->last < NOW - EXPIRE)	313	else if (i->last < ev_now () - NRL_EXPIRE)
221	i = erase (i);	314	i = erase (i);
222	else	315	else
223	i++;	316	i++;
224		317
225	if (i == end ())	318	if (i == end ())
226	{	319	{
227	net_rateinfo ri;	320	net_rateinfo ri;
228		321
229	ri.host = host;	322	ri.host = host;
230	ri.pcnt = 1.;	323	ri.pcnt = 1.;
231	ri.diff = MAXDIF;	324	ri.diff = NRL_MAXDIF;
232	ri.last = NOW;	325	ri.last = ev_now ();
233		326
234	push_front (ri);	327	push_front (ri);
235		328
236	return true;	329	return true;
237	}	330	}
238	else	331	else
239	{	332	{
240	net_rateinfo ri (*i);	333	net_rateinfo ri (*i);
241	erase (i);	334	erase (i);
242		335
243	ri.pcnt = ri.pcnt * ALPHA;	336	ri.pcnt = ri.pcnt * NRL_ALPHA;
244	ri.diff = ri.diff * ALPHA + (NOW - ri.last);	337	ri.diff = ri.diff * NRL_ALPHA + (ev_now () - ri.last);
245		338
246	ri.last = NOW;	339	ri.last = ev_now ();
247		340
248	double dif = ri.diff / ri.pcnt;	341	double dif = ri.diff / ri.pcnt;
249		342
250	bool send = dif > CUTOFF;	343	bool send = dif > NRL_CUTOFF;
251		344
252	if (dif > MAXDIF)	345	if (dif > NRL_MAXDIF)
253	{	346	{
254	ri.pcnt = 1.;	347	ri.pcnt = 1.;
255	ri.diff = MAXDIF;	348	ri.diff = NRL_MAXDIF;
256	}	349	}
257	else if (send)	350	else if (send)
258	ri.pcnt++;	351	ri.pcnt++;
259		352
260	push_front (ri);	353	push_front (ri);
…		…
307	}	400	}
308		401
309	#define MAXVPNDATA (MAX_MTU - 6 - 6)	402	#define MAXVPNDATA (MAX_MTU - 6 - 6)
310	#define DATAHDR (sizeof (u32) + RAND_SIZE)	403	#define DATAHDR (sizeof (u32) + RAND_SIZE)
311		404
312	struct vpndata_packet:vpn_packet	405	struct vpndata_packet : vpn_packet
313	{	406	{
314	u8 data[MAXVPNDATA + DATAHDR]; // seqno	407	u8 data[MAXVPNDATA + DATAHDR]; // seqno
315		408
316	void setup (connection conn, int dst, u8 d, u32 len, u32 seqno);	409	void setup (connection conn, int dst, u8 d, u32 len, u32 seqno);
317	tap_packet unpack (connection conn, u32 &seqno);	410	tap_packet unpack (connection conn, u32 &seqno);
…		…
330	int outl = 0, outl2;	423	int outl = 0, outl2;
331	ptype type = PT_DATA_UNCOMPRESSED;	424	ptype type = PT_DATA_UNCOMPRESSED;
332		425
333	#if ENABLE_COMPRESSION	426	#if ENABLE_COMPRESSION
334	u8 cdata[MAX_MTU];	427	u8 cdata[MAX_MTU];
335	u32 cl;
336		428
		429	if (conn->features & ENABLE_COMPRESSION)
		430	{
337	cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);	431	u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
		432
338	if (cl)	433	if (cl)
339	{	434	{
340	type = PT_DATA_COMPRESSED;	435	type = PT_DATA_COMPRESSED;
341	d = cdata;	436	d = cdata;
342	l = cl + 2;	437	l = cl + 2;
343		438
344	d[0] = cl >> 8;	439	d[0] = cl >> 8;
345	d[1] = cl;	440	d[1] = cl;
		441	}
346	}	442	}
347	#endif	443	#endif
348		444
349	EVP_EncryptInit_ex (cctx, 0, 0, 0, 0);	445	require (EVP_EncryptInit_ex (cctx, 0, 0, 0, 0));
350		446
351	struct {	447	struct {
352	#if RAND_SIZE	448	#if RAND_SIZE
353	u8 rnd[RAND_SIZE];	449	u8 rnd[RAND_SIZE];
354	#endif	450	#endif
…		…
358	datahdr.seqno = ntohl (seqno);	454	datahdr.seqno = ntohl (seqno);
359	#if RAND_SIZE	455	#if RAND_SIZE
360	RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);	456	RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);
361	#endif	457	#endif
362		458
363	EVP_EncryptUpdate (cctx,	459	require (EVP_EncryptUpdate (cctx,
364	(unsigned char *) data + outl, &outl2,	460	(unsigned char *) data + outl, &outl2,
365	(unsigned char *) &datahdr, DATAHDR);	461	(unsigned char *) &datahdr, DATAHDR));
366	outl += outl2;	462	outl += outl2;
367		463
368	EVP_EncryptUpdate (cctx,	464	require (EVP_EncryptUpdate (cctx,
369	(unsigned char *) data + outl, &outl2,	465	(unsigned char *) data + outl, &outl2,
370	(unsigned char *) d, l);	466	(unsigned char *) d, l));
371	outl += outl2;	467	outl += outl2;
372		468
373	EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2);	469	require (EVP_EncryptFinal_ex (cctx, (unsigned char *) data + outl, &outl2));
374	outl += outl2;	470	outl += outl2;
375		471
376	len = outl + data_hdr_size ();	472	len = outl + data_hdr_size ();
377		473
378	set_hdr (type, dst);	474	set_hdr (type, dst);
…		…
387	int outl = 0, outl2;	483	int outl = 0, outl2;
388	tap_packet *p = new tap_packet;	484	tap_packet *p = new tap_packet;
389	u8 *d;	485	u8 *d;
390	u32 l = len - data_hdr_size ();	486	u32 l = len - data_hdr_size ();
391		487
392	EVP_DecryptInit_ex (cctx, 0, 0, 0, 0);	488	require (EVP_DecryptInit_ex (cctx, 0, 0, 0, 0));
393		489
394	#if ENABLE_COMPRESSION	490	#if ENABLE_COMPRESSION
395	u8 cdata[MAX_MTU];	491	u8 cdata[MAX_MTU];
396		492
397	if (type == PT_DATA_COMPRESSED)	493	if (type == PT_DATA_COMPRESSED)
…		…
399	else	495	else
400	#endif	496	#endif
401	d = &(*p)[6 + 6 - DATAHDR];	497	d = &(*p)[6 + 6 - DATAHDR];
402		498
403	/* this overwrites part of the src mac, but we fix that later */	499	/* this overwrites part of the src mac, but we fix that later */
404	EVP_DecryptUpdate (cctx,	500	require (EVP_DecryptUpdate (cctx,
405	d, &outl2,	501	d, &outl2,
406	(unsigned char *)&data, len - data_hdr_size ());	502	(unsigned char *)&data, len - data_hdr_size ()));
407	outl += outl2;	503	outl += outl2;
408		504
409	EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2);	505	require (EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2));
410	outl += outl2;	506	outl += outl2;
411		507
412	seqno = ntohl ((u32 )(d + RAND_SIZE));	508	seqno = ntohl ((u32 )(d + RAND_SIZE));
413		509
414	id2mac (dst () ? dst() : THISNODE->id, p->dst);	510	id2mac (dst () ? dst() : THISNODE->id, p->dst);
…		…
443	{	539	{
444	// actually, hmaclen cannot be checked because the hmac	540	// actually, hmaclen cannot be checked because the hmac
445	// field comes before this data, so peers with other	541	// field comes before this data, so peers with other
446	// hmacs simply will not work.	542	// hmacs simply will not work.
447	u8 prot_major, prot_minor, randsize, hmaclen;	543	u8 prot_major, prot_minor, randsize, hmaclen;
448	u8 flags, challengelen, pad2, pad3;	544	u8 flags, challengelen, features, pad3;
449	u32 cipher_nid, digest_nid, hmac_nid;	545	u32 cipher_nid, digest_nid, hmac_nid;
450
451	const u8 curflags () const
452	{
453	return 0x80
454	\| (ENABLE_COMPRESSION ? 0x01 : 0x00);
455	}
456		546
457	void setup (ptype type, int dst);	547	void setup (ptype type, int dst);
458	bool chk_config () const;	548	bool chk_config () const;
		549
		550	static u8 get_features ()
		551	{
		552	u8 f = 0;
		553	#if ENABLE_COMPRESSION
		554	f \|= FEATURE_COMPRESSION;
		555	#endif
		556	#if ENABLE_ROHC
		557	f \|= FEATURE_ROHC;
		558	#endif
		559	#if ENABLE_BRIDGING
		560	f \|= FEATURE_BRIDGING;
		561	#endif
		562	return f;
		563	}
459	};	564	};
460		565
461	void config_packet::setup (ptype type, int dst)	566	void config_packet::setup (ptype type, int dst)
462	{	567	{
463	prot_major = PROTOCOL_MAJOR;	568	prot_major = PROTOCOL_MAJOR;
464	prot_minor = PROTOCOL_MINOR;	569	prot_minor = PROTOCOL_MINOR;
465	randsize = RAND_SIZE;	570	randsize = RAND_SIZE;
466	hmaclen = HMACLENGTH;	571	hmaclen = HMACLENGTH;
467	flags = curflags ();	572	flags = 0;
468	challengelen = sizeof (rsachallenge);	573	challengelen = sizeof (rsachallenge);
		574	features = get_features ();
469		575
470	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));	576	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
471	digest_nid = htonl (EVP_MD_type (RSA_HASH));	577	digest_nid = htonl (EVP_MD_type (RSA_HASH));
472	hmac_nid = htonl (EVP_MD_type (DIGEST));	578	hmac_nid = htonl (EVP_MD_type (DIGEST));
473		579
…		…
475	set_hdr (type, dst);	581	set_hdr (type, dst);
476	}	582	}
477		583
478	bool config_packet::chk_config () const	584	bool config_packet::chk_config () const
479	{	585	{
480	return prot_major == PROTOCOL_MAJOR	586	if (prot_major != PROTOCOL_MAJOR)
481	&& randsize == RAND_SIZE	587	slog (L_WARN, _("major version mismatch (remote %d <=> local %d)"), prot_major, PROTOCOL_MAJOR);
482	&& hmaclen == HMACLENGTH	588	else if (randsize != RAND_SIZE)
483	&& flags == curflags ()	589	slog (L_WARN, _("rand size mismatch (remote %d <=> local %d)"), randsize, RAND_SIZE);
		590	else if (hmaclen != HMACLENGTH)
		591	slog (L_WARN, _("hmac length mismatch (remote %d <=> local %d)"), hmaclen, HMACLENGTH);
484	&& challengelen == sizeof (rsachallenge)	592	else if (challengelen != sizeof (rsachallenge))
		593	slog (L_WARN, _("challenge length mismatch (remote %d <=> local %d)"), challengelen, sizeof (rsachallenge));
485	&& cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))	594	else if (cipher_nid != htonl (EVP_CIPHER_nid (CIPHER)))
		595	slog (L_WARN, _("cipher mismatch (remote %x <=> local %x)"), ntohl (cipher_nid), EVP_CIPHER_nid (CIPHER));
486	&& digest_nid == htonl (EVP_MD_type (RSA_HASH))	596	else if (digest_nid != htonl (EVP_MD_type (RSA_HASH)))
		597	slog (L_WARN, _("digest mismatch (remote %x <=> local %x)"), ntohl (digest_nid), EVP_MD_type (RSA_HASH));
487	&& hmac_nid == htonl (EVP_MD_type (DIGEST));	598	else if (hmac_nid != htonl (EVP_MD_type (DIGEST)))
		599	slog (L_WARN, _("hmac mismatch (remote %x <=> local %x)"), ntohl (hmac_nid), EVP_MD_type (DIGEST));
		600	else
		601	return true;
		602
		603	return false;
488	}	604	}
489		605
490	struct auth_req_packet : config_packet	606	struct auth_req_packet : config_packet
491	{	607	{
492	char magic[8];	608	char magic[8];
493	u8 initiate; // false if this is just an automatic reply	609	u8 initiate; // false if this is just an automatic reply
494	u8 protocols; // supported protocols (will get patches on forward)	610	u8 protocols; // supported protocols (will be patched on forward)
495	u8 pad2, pad3;	611	u8 pad2, pad3;
496	rsaid id;	612	rsaid id;
497	rsaencrdata encr;	613	rsaencrdata encr;
498		614
499	auth_req_packet (int dst, bool initiate_, u8 protocols_)	615	auth_req_packet (int dst, bool initiate_, u8 protocols_)
…		…
556	/////////////////////////////////////////////////////////////////////////////	672	/////////////////////////////////////////////////////////////////////////////
557		673
558	void	674	void
559	connection::connection_established ()	675	connection::connection_established ()
560	{	676	{
		677	slog (L_NOISE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);
		678
561	if (ictx && octx)	679	if (ictx && octx)
562	{	680	{
563	connectmode = conf->connectmode;	681	// make sure rekeying timeouts are slightly asymmetric
564		682	ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
565	rekey.start (NOW + ::conf.rekey);	683	rekey.start (rekey_interval, rekey_interval);
566	keepalive.start (NOW + ::conf.keepalive);	684	keepalive.start (::conf.keepalive);
567		685
568	// send queued packets	686	// send queued packets
569	if (ictx && octx)	687	if (ictx && octx)
		688	{
570	while (tap_packet *p = queue.get ())	689	while (tap_packet p = (tap_packet )data_queue.get ())
571	{	690	{
572	send_data_packet (p);	691	if (p->len) send_data_packet (p);
573	delete p;	692	delete p;
574	}	693	}
		694
		695	while (vpn_packet p = (vpn_packet )vpn_queue.get ())
		696	{
		697	if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
		698	delete p;
		699	}
		700	}
		701
		702	vpn->connection_established (this);
575	}	703	}
576	else	704	else
577	{	705	{
578	retry_cnt = 0;	706	retry_cnt = 0;
579	establish_connection.start (NOW + 5);	707	establish_connection.start (5);
580	keepalive.reset ();	708	keepalive.stop ();
581	rekey.reset ();	709	rekey.stop ();
582	}	710	}
583	}	711	}
584		712
585	void	713	void
586	connection::reset_si ()	714	connection::reset_si ()
587	{	715	{
		716	if (vpn->can_direct (THISNODE, conf))
588	protocol = best_protocol (THISNODE->protocols & conf->protocols);	717	protocol = best_protocol (THISNODE->protocols & conf->connectable_protocols ());
589		718	else
590	// mask out protocols we cannot establish	719	{
591	if (!conf->udp_port) protocol &= ~PROT_UDPv4;	720	slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
592	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;	721	protocol = 0;
		722	}
593		723
594	si.set (conf, protocol);	724	si.set (conf, protocol);
		725
		726	is_direct = si.valid ();
595	}	727	}
596		728
597	// ensure sockinfo is valid, forward if necessary	729	// ensure sockinfo is valid, forward if necessary
598	const sockinfo &	730	const sockinfo &
599	connection::forward_si (const sockinfo &si) const	731	connection::forward_si (const sockinfo &si) const
600	{	732	{
601	if (!si.valid ())	733	if (!si.valid ())
602	{	734	{
603	connection *r = vpn->find_router ();	735	connection *r = vpn->find_router_for (this);
604		736
605	if (r)	737	if (r)
606	{	738	{
607	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s"),	739	slog (L_DEBUG, _("%s: no common protocol, trying to route through %s."),
608	conf->nodename, r->conf->nodename);	740	conf->nodename, r->conf->nodename);
609	return r->si;	741	return r->si;
610	}	742	}
611	else	743	else
612	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),	744	slog (L_DEBUG, _("%s: node unreachable, no common protocol or no router available."),
613	conf->nodename);	745	conf->nodename);
614	}	746	}
615		747
616	return si;	748	return si;
617	}	749	}
…		…
627	connection::send_ping (const sockinfo &si, u8 pong)	759	connection::send_ping (const sockinfo &si, u8 pong)
628	{	760	{
629	ping_packet *pkt = new ping_packet;	761	ping_packet *pkt = new ping_packet;
630		762
631	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);	763	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
		764
		765	slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
		766
632	send_vpn_packet (pkt, si, IPTOS_LOWDELAY);	767	send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
633		768
634	delete pkt;	769	delete pkt;
635	}	770	}
636		771
…		…
652	connection::send_auth_request (const sockinfo &si, bool initiate)	787	connection::send_auth_request (const sockinfo &si, bool initiate)
653	{	788	{
654	auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);	789	auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
655		790
656	rsachallenge chg;	791	rsachallenge chg;
657
658	rsa_cache.gen (pkt->id, chg);	792	rsa_cache.gen (pkt->id, chg);
		793	rsa_encrypt (conf->rsa_key, chg, pkt->encr);
659		794
660	if (0 > RSA_public_encrypt (sizeof chg,
661	(unsigned char )&chg, (unsigned char )&pkt->encr,
662	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
663	fatal ("RSA_public_encrypt error");
664
665	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);	795	slog (L_TRACE, "%s >> PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
666		796
667	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly	797	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly
668		798
669	delete pkt;	799	delete pkt;
670	}	800	}
…		…
678		808
679	rsa_hash (id, chg, pkt->response);	809	rsa_hash (id, chg, pkt->response);
680		810
681	pkt->hmac_set (octx);	811	pkt->hmac_set (octx);
682		812
683	slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);	813	slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
684		814
685	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly	815	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
686		816
687	delete pkt;	817	delete pkt;
688	}	818	}
689		819
690	void	820	void
691	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)	821	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
692	{	822	{
693	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",	823	slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s)", conf->nodename,
694	conf->id, rid, (const char *)rsi);	824	vpn->conns[rid - 1]->conf->nodename, (const char *)rsi);
695		825
696	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);	826	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
697		827
698	r->hmac_set (octx);	828	r->hmac_set (octx);
699	send_vpn_packet (r, si);	829	send_vpn_packet (r, si);
700		830
701	delete r;	831	delete r;
702	}	832	}
703		833
704	void	834	inline void
705	connection::establish_connection_cb (time_watcher &w)	835	connection::establish_connection_cb (ev::timer &w, int revents)
706	{	836	{
707	if (ictx \|\| conf == THISNODE	837	if (!ictx
		838	&& conf != THISNODE
708	\|\| connectmode == conf_node::C_NEVER	839	&& connectmode != conf_node::C_NEVER
709	\|\| connectmode == conf_node::C_DISABLED)	840	&& connectmode != conf_node::C_DISABLED
710	w.at = TSTAMP_CANCEL;	841	&& !w.is_active ())
711	else if (w.at <= NOW)
712	{	842	{
713	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;	843	// a bit hacky, if ondemand, and packets are no longer queued, then reset the connection
714		844	// and stop trying. should probably be handled by a per-connection expire handler.
715	if (retry_int < 3600 * 8)	845	if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())
		846	{
		847	reset_connection ();
716	retry_cnt++;	848	return;
		849	}
717		850
718	w.at = NOW + retry_int;	851	last_establish_attempt = ev_now ();
		852
		853	ev::tstamp retry_int = ev::tstamp (retry_cnt & 3
		854	? (retry_cnt & 3) + 1
		855	: 1 << (retry_cnt >> 2));
719		856
720	reset_si ();	857	reset_si ();
721		858
722	if (si.prot && !si.host)	859	bool slow = si.prot & PROT_SLOW;
		860
		861	if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
		862	{
		863	/TODO/ /* start the timer so we don't recurse endlessly */
		864	w.start (1);
723	vpn->send_connect_request (conf->id);	865	vpn->send_connect_request (this);
		866	}
724	else	867	else
725	{	868	{
		869	if (si.valid ())
		870	slog (L_DEBUG, _("%s: sending direct connection request to %s."),
		871	conf->nodename, (const char *)si);
		872
726	const sockinfo &dsi = forward_si (si);	873	const sockinfo &dsi = forward_si (si);
		874
		875	slow = slow \|\| (dsi.prot & PROT_SLOW);
727		876
728	if (dsi.valid () && auth_rate_limiter.can (dsi))	877	if (dsi.valid () && auth_rate_limiter.can (dsi))
729	{	878	{
730	if (retry_cnt < 4)	879	if (retry_cnt < 4)
731	send_auth_request (dsi, true);	880	send_auth_request (dsi, true);
732	else	881	else
733	send_ping (dsi, 0);	882	send_ping (dsi, 0);
734	}	883	}
735	}	884	}
		885
		886	retry_int *= slow ? 8. : 0.9;
		887
		888	if (retry_int < conf->max_retry)
		889	retry_cnt++;
		890	else
		891	retry_int = conf->max_retry;
		892
		893	w.start (retry_int);
736	}	894	}
737	}	895	}
738		896
739	void	897	void
740	connection::reset_connection ()	898	connection::reset_connection ()
…		…
743	{	901	{
744	slog (L_INFO, _("%s(%s): connection lost"),	902	slog (L_INFO, _("%s(%s): connection lost"),
745	conf->nodename, (const char *)si);	903	conf->nodename, (const char *)si);
746		904
747	if (::conf.script_node_down)	905	if (::conf.script_node_down)
748	run_script (run_script_cb (this, &connection::script_node_down), false);	906	{
		907	run_script_cb *cb = new run_script_cb;
		908	cb->set<connection, &connection::script_node_down> (this);
		909	run_script_queued (cb, _("node-down command execution failed, continuing."));
		910	}
749	}	911	}
750		912
751	delete ictx; ictx = 0;	913	delete ictx; ictx = 0;
752	delete octx; octx = 0;	914	delete octx; octx = 0;
		915	#if ENABLE_DNS
		916	dnsv4_reset_connection ();
		917	#endif
753		918
754	si.host= 0;	919	si.host = 0;
755		920
756	last_activity = 0;	921	last_activity = 0.;
		922	//last_si_change = 0.;
757	retry_cnt = 0;	923	retry_cnt = 0;
758		924
759	rekey.reset ();	925	rekey.stop ();
760	keepalive.reset ();	926	keepalive.stop ();
761	establish_connection.reset ();	927	establish_connection.stop ();
762	}	928	}
763		929
764	void	930	void
765	connection::shutdown ()	931	connection::shutdown ()
766	{	932	{
…		…
768	send_reset (si);	934	send_reset (si);
769		935
770	reset_connection ();	936	reset_connection ();
771	}	937	}
772		938
773	void	939	// poor-man's rekeying
774	connection::rekey_cb (time_watcher &w)	940	inline void
		941	connection::rekey_cb (ev::timer &w, int revents)
775	{	942	{
776	w.at = TSTAMP_CANCEL;
777
778	reset_connection ();	943	reset_connection ();
779	establish_connection ();	944	establish_connection ();
780	}	945	}
781		946
782	void	947	void
783	connection::send_data_packet (tap_packet *pkt, bool broadcast)	948	connection::send_data_packet (tap_packet *pkt)
784	{	949	{
785	vpndata_packet *p = new vpndata_packet;	950	vpndata_packet *p = new vpndata_packet;
786	int tos = 0;	951	int tos = 0;
787		952
788	if (conf->inherit_tos	953	// I am not hilarious about peeking into packets, but so be it.
789	&& (pkt)[12] == 0x08 && (pkt)[13] == 0x00 // IP	954	if (conf->inherit_tos && pkt->is_ipv4 ())
790	&& ((*pkt)[14] & 0xf0) == 0x40) // IPv4
791	tos = (*pkt)[15] & IPTOS_TOS_MASK;	955	tos = (*pkt)[15] & IPTOS_TOS_MASK;
792		956
793	p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs	957	p->setup (this, conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
794	send_vpn_packet (p, si, tos);	958	send_vpn_packet (p, si, tos);
795		959
796	delete p;	960	delete p;
797		961
798	if (oseqno > MAX_SEQNO)	962	if (oseqno > MAX_SEQNO)
799	rekey ();	963	rekey ();
800	}	964	}
801		965
802	void	966	void
		967	connection::post_inject_queue ()
		968	{
		969	// force a connection every now and when when packets are sent (max 1/s)
		970	if (ev_now () - last_establish_attempt >= 0.95) // arbitrary
		971	establish_connection.stop ();
		972
		973	establish_connection ();
		974	}
		975
		976	void
803	connection::inject_data_packet (tap_packet *pkt, bool broadcast)	977	connection::inject_data_packet (tap_packet *pkt)
804	{	978	{
805	if (ictx && octx)	979	if (ictx && octx)
806	send_data_packet (pkt, broadcast);	980	send_data_packet (pkt);
807	else	981	else
808	{	982	{
809	if (!broadcast)//DDDD
810	queue.put (new tap_packet (*pkt));	983	data_queue.put (new tap_packet (*pkt));
811		984	post_inject_queue ();
812	establish_connection ();
813	}	985	}
814	}	986	}
815		987
816	void connection::inject_vpn_packet (vpn_packet *pkt, int tos)	988	void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
817	{	989	{
818	if (ictx && octx)	990	if (ictx && octx)
819	send_vpn_packet (pkt, si, tos);	991	send_vpn_packet (pkt, si, tos);
820	else	992	else
821	establish_connection ();	993	{
		994	vpn_queue.put ((vpn_packet )new data_packet ((data_packet *)pkt));
		995	post_inject_queue ();
		996	}
822	}	997	}
823		998
824	void	999	void
825	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	1000	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
826	{	1001	{
827	last_activity = NOW;	1002	last_activity = ev_now ();
828		1003
829	slog (L_NOISE, "<<%d received packet type %d from %d to %d",	1004	slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
830	conf->id, pkt->typ (), pkt->src (), pkt->dst ());	1005	conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
		1006
		1007	if (connectmode == conf_node::C_DISABLED)
		1008	return;
831		1009
832	switch (pkt->typ ())	1010	switch (pkt->typ ())
833	{	1011	{
834	case vpn_packet::PT_PING:	1012	case vpn_packet::PT_PING:
		1013	slog (L_TRACE, "%s >> PT_PING", conf->nodename);
		1014
835	// we send pings instead of auth packets after some retries,	1015	// we send pings instead of auth packets after some retries,
836	// so reset the retry counter and establish a connection	1016	// so reset the retry counter and establish a connection
837	// when we receive a ping.	1017	// when we receive a ping.
838	if (!ictx)	1018	if (!ictx)
839	{	1019	{
840	if (auth_rate_limiter.can (rsi))	1020	if (auth_rate_limiter.can (rsi))
841	send_auth_request (rsi, true);	1021	send_auth_request (rsi, true);
842	}	1022	}
843	else	1023	else
		1024	// we would love to change thre socket address here, but ping's aren't
		1025	// authenticated, so we best ignore it.
844	send_ping (rsi, 1); // pong	1026	send_ping (rsi, 1); // pong
845		1027
846	break;	1028	break;
847		1029
848	case vpn_packet::PT_PONG:	1030	case vpn_packet::PT_PONG:
		1031	slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
849	break;	1032	break;
850		1033
851	case vpn_packet::PT_RESET:	1034	case vpn_packet::PT_RESET:
852	{	1035	{
853	reset_connection ();	1036	reset_connection ();
854		1037
855	config_packet p = (config_packet ) pkt;	1038	config_packet p = (config_packet ) pkt;
856		1039
857	if (!p->chk_config ())	1040	if (!p->chk_config ())
858	{	1041	{
859	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),	1042	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
860	conf->nodename, (const char *)rsi);	1043	conf->nodename, (const char *)rsi);
861	connectmode = conf_node::C_DISABLED;	1044	connectmode = conf_node::C_DISABLED;
862	}	1045	}
863	else if (connectmode == conf_node::C_ALWAYS)	1046	else if (connectmode == conf_node::C_ALWAYS)
864	establish_connection ();	1047	establish_connection ();
…		…
868	case vpn_packet::PT_AUTH_REQ:	1051	case vpn_packet::PT_AUTH_REQ:
869	if (auth_rate_limiter.can (rsi))	1052	if (auth_rate_limiter.can (rsi))
870	{	1053	{
871	auth_req_packet p = (auth_req_packet ) pkt;	1054	auth_req_packet p = (auth_req_packet ) pkt;
872		1055
873	slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);	1056	slog (L_TRACE, "%s << PT_AUTH_REQ(%s)", conf->nodename, p->initiate ? "initiate" : "reply");
874		1057
875	if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))	1058	if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
876	{	1059	{
877	if (p->prot_minor != PROTOCOL_MINOR)	1060	if (p->prot_minor != PROTOCOL_MINOR)
878	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	1061	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
…		…
882	if (p->initiate)	1065	if (p->initiate)
883	send_auth_request (rsi, false);	1066	send_auth_request (rsi, false);
884		1067
885	rsachallenge k;	1068	rsachallenge k;
886		1069
887	if (0 > RSA_private_decrypt (sizeof (p->encr),	1070	if (!rsa_decrypt (::conf.rsa_key, p->encr, k))
888	(unsigned char )&p->encr, (unsigned char )&k,	1071	{
889	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
890	slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),	1072	slog (L_ERR, _("%s(%s): challenge illegal or corrupted (%s). mismatched key or config file?"),
891	conf->nodename, (const char *)rsi);	1073	conf->nodename, (const char *)rsi, ERR_error_string (ERR_get_error (), 0));
		1074	break;
		1075	}
892	else	1076	else
893	{	1077	{
894	delete octx;	1078	delete octx;
895		1079
896	octx = new crypto_ctx (k, 1);	1080	octx = new crypto_ctx (k, 1);
897	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;	1081	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;
898		1082
899	conf->protocols = p->protocols;	1083	conf->protocols = p->protocols;
		1084	features = p->features & config_packet::get_features ();
900		1085
901	send_auth_response (rsi, p->id, k);	1086	send_auth_response (rsi, p->id, k);
902		1087
903	connection_established ();	1088	connection_established ();
904		1089
905	break;	1090	break;
906	}	1091	}
907	}	1092	}
		1093	else
		1094	slog (L_WARN, _("%s(%s): protocol mismatch."),
		1095	conf->nodename, (const char *)rsi);
908		1096
909	send_reset (rsi);	1097	send_reset (rsi);
910	}	1098	}
911		1099
912	break;	1100	break;
913		1101
914	case vpn_packet::PT_AUTH_RES:	1102	case vpn_packet::PT_AUTH_RES:
915	{	1103	{
916	auth_res_packet p = (auth_res_packet ) pkt;	1104	auth_res_packet p = (auth_res_packet )pkt;
917		1105
918	slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);	1106	slog (L_TRACE, "%s << PT_AUTH_RES", conf->nodename);
919		1107
920	if (p->chk_config ())	1108	if (p->chk_config ())
921	{	1109	{
922	if (p->prot_minor != PROTOCOL_MINOR)	1110	if (p->prot_minor != PROTOCOL_MINOR)
923	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	1111	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
…		…
925	PROTOCOL_MINOR, conf->nodename, p->prot_minor);	1113	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
926		1114
927	rsachallenge chg;	1115	rsachallenge chg;
928		1116
929	if (!rsa_cache.find (p->id, chg))	1117	if (!rsa_cache.find (p->id, chg))
		1118	{
930	slog (L_ERR, _("%s(%s): unrequested auth response"),	1119	slog (L_ERR, _("%s(%s): unrequested auth response, ignoring."),
931	conf->nodename, (const char *)rsi);	1120	conf->nodename, (const char *)rsi);
		1121	break;
		1122	}
932	else	1123	else
933	{	1124	{
934	crypto_ctx *cctx = new crypto_ctx (chg, 0);	1125	crypto_ctx *cctx = new crypto_ctx (chg, 0);
935		1126
936	if (!p->hmac_chk (cctx))	1127	if (!p->hmac_chk (cctx))
		1128	{
937	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"	1129	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
938	"could be an attack, or just corruption or an synchronization error"),	1130	"could be an attack, or just corruption or a synchronization error."),
939	conf->nodename, (const char *)rsi);	1131	conf->nodename, (const char *)rsi);
		1132	break;
		1133	}
940	else	1134	else
941	{	1135	{
942	rsaresponse h;	1136	rsaresponse h;
943		1137
944	rsa_hash (p->id, chg, h);	1138	rsa_hash (p->id, chg, h);
…		…
952	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid	1146	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
953		1147
954	si = rsi;	1148	si = rsi;
955	protocol = rsi.prot;	1149	protocol = rsi.prot;
956		1150
		1151	slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
		1152	conf->nodename, (const char *)rsi,
		1153	is_direct ? "direct" : "routed",
		1154	p->prot_major, p->prot_minor);
		1155
957	connection_established ();	1156	connection_established ();
958		1157
959	slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
960	conf->nodename, (const char *)rsi,
961	p->prot_major, p->prot_minor);
962
963	if (::conf.script_node_up)	1158	if (::conf.script_node_up)
964	run_script (run_script_cb (this, &connection::script_node_up), false);	1159	{
		1160	run_script_cb *cb = new run_script_cb;
		1161	cb->set<connection, &connection::script_node_up> (this);
		1162	run_script_queued (cb, _("node-up command execution failed, continuing."));
		1163	}
965		1164
966	break;	1165	break;
967	}	1166	}
968	else	1167	else
969	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),	1168	slog (L_ERR, _("%s(%s): sent and received challenge do not match."),
970	conf->nodename, (const char *)rsi);	1169	conf->nodename, (const char *)rsi);
971	}	1170	}
972		1171
973	delete cctx;	1172	delete cctx;
974	}	1173	}
…		…
990	{	1189	{
991	vpndata_packet p = (vpndata_packet )pkt;	1190	vpndata_packet p = (vpndata_packet )pkt;
992		1191
993	if (!p->hmac_chk (ictx))	1192	if (!p->hmac_chk (ictx))
994	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"	1193	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
995	"could be an attack, or just corruption or an synchronization error"),	1194	"could be an attack, or just corruption or a synchronization error."),
996	conf->nodename, (const char *)rsi);	1195	conf->nodename, (const char *)rsi);
997	else	1196	else
998	{	1197	{
999	u32 seqno;	1198	u32 seqno;
1000	tap_packet *d = p->unpack (this, seqno);	1199	tap_packet *d = p->unpack (this, seqno);
		1200	int seqclass = iseqno.seqno_classify (seqno);
1001		1201
1002	if (iseqno.recv_ok (seqno))	1202	if (seqclass == 0) // ok
1003	{	1203	{
1004	vpn->tap->send (d);	1204	vpn->tap->send (d);
1005		1205
1006	if (p->dst () == 0) // re-broadcast
1007	for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
1008	{
1009	connection c = i;
1010
1011	if (c->conf != THISNODE && c->conf != conf)
1012	c->inject_data_packet (d);
1013	}
1014
1015	if (si != rsi)	1206	if (si != rsi)
1016	{	1207	{
1017	// fast re-sync on conneciton changes, useful especially for tcp/ip	1208	// fast re-sync on source address changes, useful especially for tcp/ip
		1209	//if (last_si_change < ev_now () + 5.)
1018	si = rsi;	1210	// {
1019
1020	slog (L_INFO, _("%s(%s): socket address changed to %s"),	1211	slog (L_INFO, _("%s(%s): changing socket address to %s."),
1021	conf->nodename, (const char )si, (const char )rsi);	1212	conf->nodename, (const char )si, (const char )rsi);
		1213
		1214	si = rsi;
		1215	// }
		1216	//else
		1217	// slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
		1218	// conf->nodename, (const char )si, (const char )rsi);
1022	}	1219	}
1023
1024	delete d;
1025
1026	break;
1027	}	1220	}
		1221	else if (seqclass == 1) // far history
		1222	slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
		1223	"possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
		1224	else if (seqclass == 2) // in-window duplicate, happens often on wireless
		1225	slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
		1226	"possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
		1227	else if (seqclass == 3) // reset
		1228	{
		1229	slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
		1230	"probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
		1231	send_reset (rsi);
		1232	}
		1233
		1234	delete d;
		1235	break;
1028	}	1236	}
1029	}	1237	}
1030		1238
1031	send_reset (rsi);	1239	send_reset (rsi);
1032	break;	1240	break;
…		…
1034	case vpn_packet::PT_CONNECT_REQ:	1242	case vpn_packet::PT_CONNECT_REQ:
1035	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1243	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1036	{	1244	{
1037	connect_req_packet p = (connect_req_packet ) pkt;	1245	connect_req_packet p = (connect_req_packet ) pkt;
1038		1246
1039	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1247	if (p->id > 0 && p->id <= vpn->conns.size ())
1040	connection *c = vpn->conns[p->id - 1];
1041	conf->protocols = p->protocols;
1042
1043	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
1044	conf->id, p->id, c->ictx && c->octx);
1045
1046	if (c->ictx && c->octx)
1047	{	1248	{
		1249	connection *c = vpn->conns[p->id - 1];
		1250	conf->protocols = p->protocols;
		1251
		1252	slog (L_TRACE, "%s << PT_CONNECT_REQ(%s) [%d]",
		1253	conf->nodename, vpn->conns[p->id - 1]->conf->nodename, c->ictx && c->octx);
		1254
		1255	if (c->ictx && c->octx)
		1256	{
1048	// send connect_info packets to both sides, in case one is	1257	// send connect_info packets to both sides, in case one is
1049	// behind a nat firewall (or both ;)	1258	// behind a nat firewall (or both ;)
1050	c->send_connect_info (conf->id, si, conf->protocols);	1259	c->send_connect_info (conf->id, si, conf->protocols);
1051	send_connect_info (c->conf->id, c->si, c->conf->protocols);	1260	send_connect_info (c->conf->id, c->si, c->conf->protocols);
		1261	}
		1262	else
		1263	c->establish_connection ();
1052	}	1264	}
1053	else	1265	else
1054	c->establish_connection ();	1266	slog (L_WARN,
		1267	_("received authenticated connection request from unknown node #%d, config file mismatch?"),
		1268	p->id);
1055	}	1269	}
1056		1270
1057	break;	1271	break;
1058		1272
1059	case vpn_packet::PT_CONNECT_INFO:	1273	case vpn_packet::PT_CONNECT_INFO:
1060	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1274	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1061	{	1275	{
1062	connect_info_packet p = (connect_info_packet ) pkt;	1276	connect_info_packet p = (connect_info_packet )pkt;
1063		1277
1064	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1278	if (p->id > 0 && p->id <= vpn->conns.size ())
1065		1279	{
1066	connection *c = vpn->conns[p->id - 1];	1280	connection *c = vpn->conns[p->id - 1];
1067		1281
1068	c->conf->protocols = p->protocols;	1282	c->conf->protocols = p->protocols;
1069	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));	1283	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1070	p->si.upgrade_protocol (protocol, c->conf);	1284	p->si.upgrade_protocol (protocol, c->conf);
1071		1285
1072	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1286	slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s) [%d]",
		1287	conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1073	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1288	(const char *)p->si, !c->ictx && !c->octx);
1074		1289
1075	const sockinfo &dsi = forward_si (p->si);	1290	const sockinfo &dsi = forward_si (p->si);
1076		1291
1077	if (dsi.valid ())	1292	if (dsi.valid ())
1078	c->send_auth_request (dsi, true);	1293	c->send_auth_request (dsi, true);
		1294	}
		1295	else
		1296	slog (L_WARN,
		1297	_("received authenticated connection request from unknown node #%d, config file mismatch?"),
		1298	p->id);
1079	}	1299	}
1080		1300
1081	break;	1301	break;
1082		1302
1083	default:	1303	default:
1084	send_reset (rsi);	1304	send_reset (rsi);
1085	break;	1305	break;
1086	}	1306	}
1087	}	1307	}
1088		1308
1089	void connection::keepalive_cb (time_watcher &w)	1309	inline void
		1310	connection::keepalive_cb (ev::timer &w, int revents)
1090	{	1311	{
1091	if (NOW >= last_activity + ::conf.keepalive + 30)	1312	if (ev_now () >= last_activity + ::conf.keepalive + 30)
1092	{	1313	{
1093	reset_connection ();	1314	reset_connection ();
1094	establish_connection ();	1315	establish_connection ();
1095	}	1316	}
1096	else if (NOW < last_activity + ::conf.keepalive)	1317	else if (ev_now () < last_activity + ::conf.keepalive)
1097	w.at = last_activity + ::conf.keepalive;	1318	w.start (last_activity + ::conf.keepalive - ev::now ());
1098	else if (conf->connectmode != conf_node::C_ONDEMAND	1319	else if (conf->connectmode != conf_node::C_ONDEMAND
1099	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)	1320	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)
1100	{	1321	{
1101	send_ping (si);	1322	send_ping (si);
1102	w.at = NOW + 5;	1323	w.start (5);
1103	}	1324	}
		1325	else if (ev_now () < last_activity + ::conf.keepalive + 10)
		1326	// hold ondemand connections implicitly a few seconds longer
		1327	// should delete octx, though, or something like that ;)
		1328	w.start (last_activity + ::conf.keepalive + 10 - ev::now ());
1104	else	1329	else
1105	reset_connection ();	1330	reset_connection ();
1106	}	1331	}
1107		1332
1108	void connection::send_connect_request (int id)	1333	void connection::send_connect_request (int id)
1109	{	1334	{
1110	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);	1335	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1111		1336
1112	slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);	1337	slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s)",
		1338	conf->nodename, vpn->conns[id - 1]->conf->nodename);
1113	p->hmac_set (octx);	1339	p->hmac_set (octx);
1114	send_vpn_packet (p, si);	1340	send_vpn_packet (p, si);
1115		1341
1116	delete p;	1342	delete p;
1117	}	1343	}
1118		1344
		1345	void connection::script_init_env (const char *ext)
		1346	{
		1347	char *env;
		1348	asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
		1349	asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
		1350	asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
		1351	0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
		1352	conf->id & 0xff); putenv (env);
		1353	}
		1354
1119	void connection::script_node ()	1355	void connection::script_init_connect_env ()
1120	{	1356	{
1121	vpn->script_if_up ();	1357	vpn->script_init_env ();
1122		1358
1123	char *env;	1359	char *env;
1124	asprintf (&env, "DESTID=%d", conf->id); putenv (env);	1360	asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1125	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);	1361	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1126	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);	1362	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1127	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);	1363	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1128	}	1364	}
1129		1365
		1366	inline const char *
1130	const char *connection::script_node_up ()	1367	connection::script_node_up ()
1131	{	1368	{
1132	script_node ();	1369	script_init_connect_env ();
1133		1370
1134	putenv ("STATE=up");	1371	putenv ((char *)"STATE=up");
1135		1372
		1373	char *filename;
		1374	asprintf (&filename,
		1375	"%s/%s",
		1376	confbase,
1136	return ::conf.script_node_up ? ::conf.script_node_up : "node-up";	1377	::conf.script_node_up ? ::conf.script_node_up : "node-up");
1137	}
1138		1378
		1379	return filename;
		1380	}
		1381
		1382	inline const char *
1139	const char *connection::script_node_down ()	1383	connection::script_node_down ()
1140	{	1384	{
1141	script_node ();	1385	script_init_connect_env ();
1142		1386
1143	putenv ("STATE=down");	1387	putenv ((char *)"STATE=down");
1144		1388
1145	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";	1389	char *filename;
1146	}	1390	asprintf (&filename,
		1391	"%s/%s",
		1392	confbase,
		1393	::conf.script_node_down ? ::conf.script_node_down : "node-down");
1147		1394
		1395	return filename;
		1396	}
		1397
1148	connection::connection(struct vpn *vpn_)	1398	connection::connection (struct vpn vpn, conf_node conf)
1149	: vpn(vpn_)	1399	: vpn(vpn), conf(conf),
1150	, rekey (this, &connection::rekey_cb)	1400	#if ENABLE_DNS
1151	, keepalive (this, &connection::keepalive_cb)	1401	dns (0),
		1402	#endif
		1403	data_queue(conf->max_ttl, conf->max_queue + 1),
		1404	vpn_queue(conf->max_ttl, conf->max_queue + 1)
		1405	{
		1406	rekey .set<connection, &connection::rekey_cb > (this);
		1407	keepalive .set<connection, &connection::keepalive_cb > (this);
1152	, establish_connection (this, &connection::establish_connection_cb)	1408	establish_connection.set<connection, &connection::establish_connection_cb> (this);
1153	{	1409
		1410	last_establish_attempt = 0.;
1154	octx = ictx = 0;	1411	octx = ictx = 0;
1155	retry_cnt = 0;
1156		1412
1157	connectmode = conf_node::C_ALWAYS; // initial setting	1413	if (!conf->protocols) // make sure some protocol is enabled
		1414	conf->protocols = PROT_UDPv4;
		1415
		1416	connectmode = conf->connectmode;
		1417
		1418	// queue a dummy packet to force an initial connection attempt
		1419	if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
		1420	vpn_queue.put (new net_packet);
		1421
1158	reset_connection ();	1422	reset_connection ();
1159	}	1423	}
1160		1424
1161	connection::~connection ()	1425	connection::~connection ()
1162	{	1426	{

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.11 by pcg, Sun Apr 13 00:35:46 2003 UTC vs. Revision 1.80 by pcg, Fri Aug 15 18:11:14 2008 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.11 by pcg, Sun Apr 13 00:35:46 2003 UTC vs.
Revision 1.80 by pcg, Fri Aug 15 18:11:14 2008 UTC