1 | /* |
1 | /* |
2 | connection.C -- manage a single connection |
2 | connection.C -- manage a single connection |
3 | Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de> |
3 | Copyright (C) 2003-2008,2010 Marc Lehmann <gvpe@schmorp.de> |
4 | |
4 | |
5 | This file is part of GVPE. |
5 | This file is part of GVPE. |
6 | |
6 | |
7 | GVPE is free software; you can redistribute it and/or modify it |
7 | GVPE is free software; you can redistribute it and/or modify it |
8 | under the terms of the GNU General Public License as published by the |
8 | under the terms of the GNU General Public License as published by the |
… | |
… | |
50 | |
50 | |
51 | #if !HAVE_RAND_PSEUDO_BYTES |
51 | #if !HAVE_RAND_PSEUDO_BYTES |
52 | # define RAND_pseudo_bytes RAND_bytes |
52 | # define RAND_pseudo_bytes RAND_bytes |
53 | #endif |
53 | #endif |
54 | |
54 | |
55 | #define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic |
55 | #define MAGIC_OLD "vped\xbd\xc6\xdb\x82" // 8 bytes of magic (still used in the protocol) |
|
|
56 | #define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic (understood but not generated) |
56 | |
57 | |
57 | #define ULTRA_FAST 1 |
58 | #define ULTRA_FAST 1 |
58 | #define HLOG 15 |
59 | #define HLOG 15 |
59 | #include "lzf/lzf.h" |
60 | #include "lzf/lzf.h" |
60 | #include "lzf/lzf_c.c" |
61 | #include "lzf/lzf_c.c" |
… | |
… | |
424 | ptype type = PT_DATA_UNCOMPRESSED; |
425 | ptype type = PT_DATA_UNCOMPRESSED; |
425 | |
426 | |
426 | #if ENABLE_COMPRESSION |
427 | #if ENABLE_COMPRESSION |
427 | u8 cdata[MAX_MTU]; |
428 | u8 cdata[MAX_MTU]; |
428 | |
429 | |
429 | if (conn->features & ENABLE_COMPRESSION) |
430 | if (conn->features & FEATURE_COMPRESSION) |
430 | { |
431 | { |
431 | u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7); |
432 | u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7); |
432 | |
433 | |
433 | if (cl) |
434 | if (cl) |
434 | { |
435 | { |
… | |
… | |
613 | rsaencrdata encr; |
614 | rsaencrdata encr; |
614 | |
615 | |
615 | auth_req_packet (int dst, bool initiate_, u8 protocols_) |
616 | auth_req_packet (int dst, bool initiate_, u8 protocols_) |
616 | { |
617 | { |
617 | config_packet::setup (PT_AUTH_REQ, dst); |
618 | config_packet::setup (PT_AUTH_REQ, dst); |
618 | strncpy (magic, MAGIC, 8); |
619 | strncpy (magic, MAGIC_OLD, 8); |
619 | initiate = !!initiate_; |
620 | initiate = !!initiate_; |
620 | protocols = protocols_; |
621 | protocols = protocols_; |
621 | |
622 | |
622 | len = sizeof (*this) - sizeof (net_packet); |
623 | len = sizeof (*this) - sizeof (net_packet); |
623 | } |
624 | } |
… | |
… | |
790 | |
791 | |
791 | rsachallenge chg; |
792 | rsachallenge chg; |
792 | rsa_cache.gen (pkt->id, chg); |
793 | rsa_cache.gen (pkt->id, chg); |
793 | rsa_encrypt (conf->rsa_key, chg, pkt->encr); |
794 | rsa_encrypt (conf->rsa_key, chg, pkt->encr); |
794 | |
795 | |
795 | slog (L_TRACE, "%s >> PT_AUTH_REQ [%s]", conf->nodename, (const char *)si); |
796 | slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si); |
796 | |
797 | |
797 | send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly |
798 | send_vpn_packet (pkt, si, IPTOS_RELIABILITY | IPTOS_LOWDELAY); // rsa is very very costly |
798 | |
799 | |
799 | delete pkt; |
800 | delete pkt; |
800 | } |
801 | } |
… | |
… | |
1013 | slog (L_TRACE, "%s >> PT_PING", conf->nodename); |
1014 | slog (L_TRACE, "%s >> PT_PING", conf->nodename); |
1014 | |
1015 | |
1015 | // we send pings instead of auth packets after some retries, |
1016 | // we send pings instead of auth packets after some retries, |
1016 | // so reset the retry counter and establish a connection |
1017 | // so reset the retry counter and establish a connection |
1017 | // when we receive a ping. |
1018 | // when we receive a ping. |
1018 | if (!ictx) |
1019 | if (!(ictx && octx)) |
1019 | { |
1020 | { |
1020 | if (auth_rate_limiter.can (rsi)) |
1021 | if (auth_rate_limiter.can (rsi)) |
1021 | send_auth_request (rsi, true); |
1022 | send_auth_request (rsi, true); |
1022 | } |
1023 | } |
1023 | else |
1024 | else |
… | |
… | |
1051 | case vpn_packet::PT_AUTH_REQ: |
1052 | case vpn_packet::PT_AUTH_REQ: |
1052 | if (auth_rate_limiter.can (rsi)) |
1053 | if (auth_rate_limiter.can (rsi)) |
1053 | { |
1054 | { |
1054 | auth_req_packet *p = (auth_req_packet *) pkt; |
1055 | auth_req_packet *p = (auth_req_packet *) pkt; |
1055 | |
1056 | |
1056 | slog (L_TRACE, "%s << PT_AUTH_REQ(%s)", conf->nodename, p->initiate ? "initiate" : "reply"); |
1057 | slog (L_TRACE, "%s >> PT_AUTH_REQ(%s)", conf->nodename, p->initiate ? "initiate" : "reply"); |
1057 | |
1058 | |
1058 | if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) |
1059 | if (p->chk_config () |
|
|
1060 | && (!strncmp (p->magic, MAGIC_OLD, 8) || !strncmp (p->magic, MAGIC, 8))) |
1059 | { |
1061 | { |
1060 | if (p->prot_minor != PROTOCOL_MINOR) |
1062 | if (p->prot_minor != PROTOCOL_MINOR) |
1061 | slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), |
1063 | slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), |
1062 | conf->nodename, (const char *)rsi, |
1064 | conf->nodename, (const char *)rsi, |
1063 | PROTOCOL_MINOR, conf->nodename, p->prot_minor); |
1065 | PROTOCOL_MINOR, conf->nodename, p->prot_minor); |
… | |
… | |
1101 | |
1103 | |
1102 | case vpn_packet::PT_AUTH_RES: |
1104 | case vpn_packet::PT_AUTH_RES: |
1103 | { |
1105 | { |
1104 | auth_res_packet *p = (auth_res_packet *)pkt; |
1106 | auth_res_packet *p = (auth_res_packet *)pkt; |
1105 | |
1107 | |
1106 | slog (L_TRACE, "%s << PT_AUTH_RES", conf->nodename); |
1108 | slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename); |
1107 | |
1109 | |
1108 | if (p->chk_config ()) |
1110 | if (p->chk_config ()) |
1109 | { |
1111 | { |
1110 | if (p->prot_minor != PROTOCOL_MINOR) |
1112 | if (p->prot_minor != PROTOCOL_MINOR) |
1111 | slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), |
1113 | slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), |
… | |
… | |
1148 | si = rsi; |
1150 | si = rsi; |
1149 | protocol = rsi.prot; |
1151 | protocol = rsi.prot; |
1150 | |
1152 | |
1151 | slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."), |
1153 | slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."), |
1152 | conf->nodename, (const char *)rsi, |
1154 | conf->nodename, (const char *)rsi, |
1153 | is_direct ? "direct" : "routed", |
1155 | is_direct ? "direct" : "forwarded", |
1154 | p->prot_major, p->prot_minor); |
1156 | p->prot_major, p->prot_minor); |
1155 | |
1157 | |
1156 | connection_established (); |
1158 | connection_established (); |
1157 | |
1159 | |
1158 | if (::conf.script_node_up) |
1160 | if (::conf.script_node_up) |
… | |
… | |
1210 | // { |
1212 | // { |
1211 | slog (L_INFO, _("%s(%s): changing socket address to %s."), |
1213 | slog (L_INFO, _("%s(%s): changing socket address to %s."), |
1212 | conf->nodename, (const char *)si, (const char *)rsi); |
1214 | conf->nodename, (const char *)si, (const char *)rsi); |
1213 | |
1215 | |
1214 | si = rsi; |
1216 | si = rsi; |
|
|
1217 | |
|
|
1218 | if (::conf.script_node_change) |
|
|
1219 | { |
|
|
1220 | run_script_cb *cb = new run_script_cb; |
|
|
1221 | cb->set<connection, &connection::script_node_change> (this); |
|
|
1222 | run_script_queued (cb, _("node-change command execution failed, continuing.")); |
|
|
1223 | } |
|
|
1224 | |
1215 | // } |
1225 | // } |
1216 | //else |
1226 | //else |
1217 | // slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."), |
1227 | // slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."), |
1218 | // conf->nodename, (const char *)si, (const char *)rsi); |
1228 | // conf->nodename, (const char *)si, (const char *)rsi); |
1219 | } |
1229 | } |
… | |
… | |
1240 | break; |
1250 | break; |
1241 | |
1251 | |
1242 | case vpn_packet::PT_CONNECT_REQ: |
1252 | case vpn_packet::PT_CONNECT_REQ: |
1243 | if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) |
1253 | if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) |
1244 | { |
1254 | { |
1245 | connect_req_packet *p = (connect_req_packet *) pkt; |
1255 | connect_req_packet *p = (connect_req_packet *)pkt; |
1246 | |
1256 | |
1247 | if (p->id > 0 && p->id <= vpn->conns.size ()) |
1257 | if (p->id > 0 && p->id <= vpn->conns.size ()) |
1248 | { |
1258 | { |
1249 | connection *c = vpn->conns[p->id - 1]; |
1259 | connection *c = vpn->conns[p->id - 1]; |
1250 | conf->protocols = p->protocols; |
1260 | conf->protocols = p->protocols; |
1251 | |
1261 | |
1252 | slog (L_TRACE, "%s << PT_CONNECT_REQ(%s) [%d]", |
1262 | slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s) [%d]", |
1253 | conf->nodename, vpn->conns[p->id - 1]->conf->nodename, c->ictx && c->octx); |
1263 | conf->nodename, vpn->conns[p->id - 1]->conf->nodename, c->ictx && c->octx); |
1254 | |
1264 | |
1255 | if (c->ictx && c->octx) |
1265 | if (c->ictx && c->octx) |
1256 | { |
1266 | { |
1257 | // send connect_info packets to both sides, in case one is |
1267 | // send connect_info packets to both sides, in case one is |
… | |
… | |
1281 | |
1291 | |
1282 | c->conf->protocols = p->protocols; |
1292 | c->conf->protocols = p->protocols; |
1283 | protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf)); |
1293 | protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf)); |
1284 | p->si.upgrade_protocol (protocol, c->conf); |
1294 | p->si.upgrade_protocol (protocol, c->conf); |
1285 | |
1295 | |
1286 | slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s) [%d]", |
1296 | slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s) [%d]", |
1287 | conf->nodename, vpn->conns[p->id - 1]->conf->nodename, |
1297 | conf->nodename, vpn->conns[p->id - 1]->conf->nodename, |
1288 | (const char *)p->si, !c->ictx && !c->octx); |
1298 | (const char *)p->si, !c->ictx && !c->octx); |
1289 | |
1299 | |
1290 | const sockinfo &dsi = forward_si (p->si); |
1300 | const sockinfo &dsi = forward_si (p->si); |
1291 | |
1301 | |
… | |
… | |
1307 | } |
1317 | } |
1308 | |
1318 | |
1309 | inline void |
1319 | inline void |
1310 | connection::keepalive_cb (ev::timer &w, int revents) |
1320 | connection::keepalive_cb (ev::timer &w, int revents) |
1311 | { |
1321 | { |
1312 | if (ev_now () >= last_activity + ::conf.keepalive + 30) |
1322 | if (ev_now () >= last_activity + ::conf.keepalive + 15) |
1313 | { |
1323 | { |
1314 | reset_connection (); |
1324 | reset_connection (); |
1315 | establish_connection (); |
1325 | establish_connection (); |
1316 | } |
1326 | } |
1317 | else if (ev_now () < last_activity + ::conf.keepalive) |
1327 | else if (ev_now () < last_activity + ::conf.keepalive) |
1318 | w.start (last_activity + ::conf.keepalive - ev::now ()); |
1328 | w.start (last_activity + ::conf.keepalive - ev::now ()); |
1319 | else if (conf->connectmode != conf_node::C_ONDEMAND |
1329 | else if (conf->connectmode != conf_node::C_ONDEMAND |
1320 | || THISNODE->connectmode != conf_node::C_ONDEMAND) |
1330 | || THISNODE->connectmode != conf_node::C_ONDEMAND) |
1321 | { |
1331 | { |
1322 | send_ping (si); |
1332 | send_ping (si); |
1323 | w.start (5); |
1333 | w.start (3); |
1324 | } |
1334 | } |
1325 | else if (ev_now () < last_activity + ::conf.keepalive + 10) |
1335 | else if (ev_now () < last_activity + ::conf.keepalive + 10) |
1326 | // hold ondemand connections implicitly a few seconds longer |
1336 | // hold ondemand connections implicitly a few seconds longer |
1327 | // should delete octx, though, or something like that ;) |
1337 | // should delete octx, though, or something like that ;) |
1328 | w.start (last_activity + ::conf.keepalive + 10 - ev::now ()); |
1338 | w.start (last_activity + ::conf.keepalive + 10 - ev::now ()); |
… | |
… | |
1332 | |
1342 | |
1333 | void connection::send_connect_request (int id) |
1343 | void connection::send_connect_request (int id) |
1334 | { |
1344 | { |
1335 | connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); |
1345 | connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols); |
1336 | |
1346 | |
1337 | slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s)", |
1347 | slog (L_TRACE, "%s << PT_CONNECT_REQ(%s)", |
1338 | conf->nodename, vpn->conns[id - 1]->conf->nodename); |
1348 | conf->nodename, vpn->conns[id - 1]->conf->nodename); |
1339 | p->hmac_set (octx); |
1349 | p->hmac_set (octx); |
1340 | send_vpn_packet (p, si); |
1350 | send_vpn_packet (p, si); |
1341 | |
1351 | |
1342 | delete p; |
1352 | delete p; |
… | |
… | |
1344 | |
1354 | |
1345 | void connection::script_init_env (const char *ext) |
1355 | void connection::script_init_env (const char *ext) |
1346 | { |
1356 | { |
1347 | char *env; |
1357 | char *env; |
1348 | asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env); |
1358 | asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env); |
1349 | asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env); |
1359 | asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env); |
1350 | asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext, |
1360 | asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext, |
1351 | 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8, |
1361 | 0xfe, 0xfd, 0x80, 0x00, conf->id >> 8, |
1352 | conf->id & 0xff); putenv (env); |
1362 | conf->id & 0xff); putenv (env); |
1353 | } |
1363 | } |
1354 | |
1364 | |
1355 | void connection::script_init_connect_env () |
1365 | void connection::script_init_connect_env () |
1356 | { |
1366 | { |
1357 | vpn->script_init_env (); |
1367 | vpn->script_init_env (); |
1358 | |
1368 | |
1359 | char *env; |
1369 | char *env; |
1360 | asprintf (&env, "DESTID=%d", conf->id); putenv (env); |
1370 | asprintf (&env, "DESTID=%d", conf->id); putenv (env); |
|
|
1371 | asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env); |
1361 | asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); |
1372 | asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env); |
1362 | asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); |
1373 | asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env); |
1363 | asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); |
1374 | asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env); |
1364 | } |
1375 | } |
1365 | |
1376 | |
1366 | inline const char * |
1377 | inline const char * |
1367 | connection::script_node_up () |
1378 | connection::script_node_up () |
1368 | { |
1379 | { |
… | |
… | |
1373 | char *filename; |
1384 | char *filename; |
1374 | asprintf (&filename, |
1385 | asprintf (&filename, |
1375 | "%s/%s", |
1386 | "%s/%s", |
1376 | confbase, |
1387 | confbase, |
1377 | ::conf.script_node_up ? ::conf.script_node_up : "node-up"); |
1388 | ::conf.script_node_up ? ::conf.script_node_up : "node-up"); |
|
|
1389 | |
|
|
1390 | return filename; |
|
|
1391 | } |
|
|
1392 | |
|
|
1393 | inline const char * |
|
|
1394 | connection::script_node_change () |
|
|
1395 | { |
|
|
1396 | script_init_connect_env (); |
|
|
1397 | |
|
|
1398 | putenv ((char *)"STATE=change"); |
|
|
1399 | |
|
|
1400 | char *filename; |
|
|
1401 | asprintf (&filename, |
|
|
1402 | "%s/%s", |
|
|
1403 | confbase, |
|
|
1404 | ::conf.script_node_change ? ::conf.script_node_change : "node-change"); |
1378 | |
1405 | |
1379 | return filename; |
1406 | return filename; |
1380 | } |
1407 | } |
1381 | |
1408 | |
1382 | inline const char * |
1409 | inline const char * |