[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.70 by pcg, Thu Aug 7 19:07:02 2008 UTC vs.
Revision 1.87 by pcg, Fri Nov 12 18:39:33 2010 UTC

…		…
50		50
51	#if !HAVE_RAND_PSEUDO_BYTES	51	#if !HAVE_RAND_PSEUDO_BYTES
52	# define RAND_pseudo_bytes RAND_bytes	52	# define RAND_pseudo_bytes RAND_bytes
53	#endif	53	#endif
54		54
55	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic	55	#define MAGIC_OLD "vped\xbd\xc6\xdb\x82" // 8 bytes of magic (still used in the protocol)
		56	#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic (understood but not generated)
56		57
57	#define ULTRA_FAST 1	58	#define ULTRA_FAST 1
58	#define HLOG 15	59	#define HLOG 15
59	#include "lzf/lzf.h"	60	#include "lzf/lzf.h"
60	#include "lzf/lzf_c.c"	61	#include "lzf/lzf_c.c"
…		…
424	ptype type = PT_DATA_UNCOMPRESSED;	425	ptype type = PT_DATA_UNCOMPRESSED;
425		426
426	#if ENABLE_COMPRESSION	427	#if ENABLE_COMPRESSION
427	u8 cdata[MAX_MTU];	428	u8 cdata[MAX_MTU];
428		429
429	if (conn->features & ENABLE_COMPRESSION)	430	if (conn->features & FEATURE_COMPRESSION)
430	{	431	{
431	u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);	432	u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
432		433
433	if (cl)	434	if (cl)
434	{	435	{
…		…
613	rsaencrdata encr;	614	rsaencrdata encr;
614		615
615	auth_req_packet (int dst, bool initiate_, u8 protocols_)	616	auth_req_packet (int dst, bool initiate_, u8 protocols_)
616	{	617	{
617	config_packet::setup (PT_AUTH_REQ, dst);	618	config_packet::setup (PT_AUTH_REQ, dst);
618	strncpy (magic, MAGIC, 8);	619	strncpy (magic, MAGIC_OLD, 8);
619	initiate = !!initiate_;	620	initiate = !!initiate_;
620	protocols = protocols_;	621	protocols = protocols_;
621		622
622	len = sizeof (*this) - sizeof (net_packet);	623	len = sizeof (*this) - sizeof (net_packet);
623	}	624	}
…		…
672	/////////////////////////////////////////////////////////////////////////////	673	/////////////////////////////////////////////////////////////////////////////
673		674
674	void	675	void
675	connection::connection_established ()	676	connection::connection_established ()
676	{	677	{
677	slog (L_TRACE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);	678	slog (L_NOISE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);
678		679
679	if (ictx && octx)	680	if (ictx && octx)
680	{	681	{
681	// make sure rekeying timeouts are slightly asymmetric	682	// make sure rekeying timeouts are slightly asymmetric
682	ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);	683	ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
…		…
696	{	697	{
697	if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);	698	if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
698	delete p;	699	delete p;
699	}	700	}
700	}	701	}
		702
		703	vpn->connection_established (this);
701	}	704	}
702	else	705	else
703	{	706	{
704	retry_cnt = 0;	707	retry_cnt = 0;
705	establish_connection.start (5);	708	establish_connection.start (5);
…		…
709	}	712	}
710		713
711	void	714	void
712	connection::reset_si ()	715	connection::reset_si ()
713	{	716	{
		717	if (vpn->can_direct (THISNODE, conf))
714	protocol = best_protocol (THISNODE->protocols & conf->protocols);	718	protocol = best_protocol (THISNODE->protocols & conf->connectable_protocols ());
715		719	else
716	// mask out protocols we cannot establish
717	if (!conf->udp_port) protocol &= ~PROT_UDPv4;
718	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
719	if (!conf->dns_port) protocol &= ~PROT_DNSv4;
720
721	if (protocol
722	&& (!conf->can_direct (THISNODE)
723	\|\| !THISNODE->can_direct (conf)))
724	{	720	{
725	slog (L_DEBUG, _("%s: direct connection denied"), conf->nodename);	721	slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
726	protocol = 0;	722	protocol = 0;
727	}	723	}
728		724
729	si.set (conf, protocol);	725	si.set (conf, protocol);
		726
		727	is_direct = si.valid ();
730	}	728	}
731		729
732	// ensure sockinfo is valid, forward if necessary	730	// ensure sockinfo is valid, forward if necessary
733	const sockinfo &	731	const sockinfo &
734	connection::forward_si (const sockinfo &si) const	732	connection::forward_si (const sockinfo &si) const
735	{	733	{
736	if (!si.valid ())	734	if (!si.valid ())
737	{	735	{
738	connection *r = vpn->find_router ();	736	connection *r = vpn->find_router_for (this);
739		737
740	if (r)	738	if (r)
741	{	739	{
742	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"),	740	slog (L_DEBUG, _("%s: no common protocol, trying to route through %s."),
743	conf->nodename, r->conf->nodename, (const char *)r->si);	741	conf->nodename, r->conf->nodename);
744	return r->si;	742	return r->si;
745	}	743	}
746	else	744	else
747	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),	745	slog (L_DEBUG, _("%s: node unreachable, no common protocol or no router available."),
748	conf->nodename);	746	conf->nodename);
749	}	747	}
750		748
751	return si;	749	return si;
752	}	750	}
…		…
762	connection::send_ping (const sockinfo &si, u8 pong)	760	connection::send_ping (const sockinfo &si, u8 pong)
763	{	761	{
764	ping_packet *pkt = new ping_packet;	762	ping_packet *pkt = new ping_packet;
765		763
766	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);	764	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
		765
		766	slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
		767
767	send_vpn_packet (pkt, si, IPTOS_LOWDELAY);	768	send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
768		769
769	delete pkt;	770	delete pkt;
770	}	771	}
771		772
…		…
790		791
791	rsachallenge chg;	792	rsachallenge chg;
792	rsa_cache.gen (pkt->id, chg);	793	rsa_cache.gen (pkt->id, chg);
793	rsa_encrypt (conf->rsa_key, chg, pkt->encr);	794	rsa_encrypt (conf->rsa_key, chg, pkt->encr);
794		795
795	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);	796	slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
796		797
797	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly	798	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly
798		799
799	delete pkt;	800	delete pkt;
800	}	801	}
…		…
808		809
809	rsa_hash (id, chg, pkt->response);	810	rsa_hash (id, chg, pkt->response);
810		811
811	pkt->hmac_set (octx);	812	pkt->hmac_set (octx);
812		813
813	slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);	814	slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
814		815
815	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly	816	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
816		817
817	delete pkt;	818	delete pkt;
818	}	819	}
819		820
820	void	821	void
821	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)	822	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
822	{	823	{
823	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)",	824	slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s)", conf->nodename,
824	conf->id, rid, (const char *)rsi);	825	vpn->conns[rid - 1]->conf->nodename, (const char *)rsi);
825		826
826	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);	827	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
827		828
828	r->hmac_set (octx);	829	r->hmac_set (octx);
829	send_vpn_packet (r, si);	830	send_vpn_packet (r, si);
…		…
856		857
857	reset_si ();	858	reset_si ();
858		859
859	bool slow = si.prot & PROT_SLOW;	860	bool slow = si.prot & PROT_SLOW;
860		861
861	if (si.prot && !si.host)	862	if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
862	{	863	{
863	slog (L_TRACE, _("%s: connection request (indirect)"), conf->nodename);
864	/TODO/ /* start the timer so we don't recurse endlessly */	864	/TODO/ /* start the timer so we don't recurse endlessly */
865	w.start (1);	865	w.start (1);
866	vpn->send_connect_request (conf->id);	866	vpn->send_connect_request (this);
867	}	867	}
868	else	868	else
869	{	869	{
870	slog (L_TRACE, _("%s: connection request (direct)"), conf->nodename, !!ictx, !!octx);	870	if (si.valid ())
		871	slog (L_DEBUG, _("%s: sending direct connection request to %s."),
		872	conf->nodename, (const char *)si);
871		873
872	const sockinfo &dsi = forward_si (si);	874	const sockinfo &dsi = forward_si (si);
873		875
874	slow = slow \|\| (dsi.prot & PROT_SLOW);	876	slow = slow \|\| (dsi.prot & PROT_SLOW);
875		877
…		…
915	dnsv4_reset_connection ();	917	dnsv4_reset_connection ();
916	#endif	918	#endif
917		919
918	si.host = 0;	920	si.host = 0;
919		921
920	last_activity = 0;	922	last_activity = 0.;
		923	//last_si_change = 0.;
921	retry_cnt = 0;	924	retry_cnt = 0;
922		925
923	rekey.stop ();	926	rekey.stop ();
924	keepalive.stop ();	927	keepalive.stop ();
925	establish_connection.stop ();	928	establish_connection.stop ();
…		…
932	send_reset (si);	935	send_reset (si);
933		936
934	reset_connection ();	937	reset_connection ();
935	}	938	}
936		939
		940	// poor-man's rekeying
937	inline void	941	inline void
938	connection::rekey_cb (ev::timer &w, int revents)	942	connection::rekey_cb (ev::timer &w, int revents)
939	{	943	{
940	reset_connection ();	944	reset_connection ();
941	establish_connection ();	945	establish_connection ();
…		…
996	void	1000	void
997	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	1001	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
998	{	1002	{
999	last_activity = ev_now ();	1003	last_activity = ev_now ();
1000		1004
1001	slog (L_NOISE, "<<%d received packet type %d from %d to %d",	1005	slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
1002	conf->id, pkt->typ (), pkt->src (), pkt->dst ());	1006	conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
1003		1007
1004	if (connectmode == conf_node::C_DISABLED)	1008	if (connectmode == conf_node::C_DISABLED)
1005	return;	1009	return;
1006		1010
1007	switch (pkt->typ ())	1011	switch (pkt->typ ())
1008	{	1012	{
1009	case vpn_packet::PT_PING:	1013	case vpn_packet::PT_PING:
		1014	slog (L_TRACE, "%s >> PT_PING", conf->nodename);
		1015
1010	// we send pings instead of auth packets after some retries,	1016	// we send pings instead of auth packets after some retries,
1011	// so reset the retry counter and establish a connection	1017	// so reset the retry counter and establish a connection
1012	// when we receive a ping.	1018	// when we receive a ping.
1013	if (!ictx)	1019	if (!(ictx && octx))
1014	{	1020	{
1015	if (auth_rate_limiter.can (rsi))	1021	if (auth_rate_limiter.can (rsi))
1016	send_auth_request (rsi, true);	1022	send_auth_request (rsi, true);
1017	}	1023	}
1018	else	1024	else
		1025	// we would love to change thre socket address here, but ping's aren't
		1026	// authenticated, so we best ignore it.
1019	send_ping (rsi, 1); // pong	1027	send_ping (rsi, 1); // pong
1020		1028
1021	break;	1029	break;
1022		1030
1023	case vpn_packet::PT_PONG:	1031	case vpn_packet::PT_PONG:
		1032	slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
1024	break;	1033	break;
1025		1034
1026	case vpn_packet::PT_RESET:	1035	case vpn_packet::PT_RESET:
1027	{	1036	{
1028	reset_connection ();	1037	reset_connection ();
1029		1038
1030	config_packet p = (config_packet ) pkt;	1039	config_packet p = (config_packet ) pkt;
1031		1040
1032	if (!p->chk_config ())	1041	if (!p->chk_config ())
1033	{	1042	{
1034	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),	1043	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
1035	conf->nodename, (const char *)rsi);	1044	conf->nodename, (const char *)rsi);
1036	connectmode = conf_node::C_DISABLED;	1045	connectmode = conf_node::C_DISABLED;
1037	}	1046	}
1038	else if (connectmode == conf_node::C_ALWAYS)	1047	else if (connectmode == conf_node::C_ALWAYS)
1039	establish_connection ();	1048	establish_connection ();
…		…
1043	case vpn_packet::PT_AUTH_REQ:	1052	case vpn_packet::PT_AUTH_REQ:
1044	if (auth_rate_limiter.can (rsi))	1053	if (auth_rate_limiter.can (rsi))
1045	{	1054	{
1046	auth_req_packet p = (auth_req_packet ) pkt;	1055	auth_req_packet p = (auth_req_packet ) pkt;
1047		1056
1048	slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);	1057	slog (L_TRACE, "%s >> PT_AUTH_REQ(%s)", conf->nodename, p->initiate ? "initiate" : "reply");
1049		1058
1050	if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))	1059	if (p->chk_config ()
		1060	&& (!strncmp (p->magic, MAGIC_OLD, 8) \|\| !strncmp (p->magic, MAGIC, 8)))
1051	{	1061	{
1052	if (p->prot_minor != PROTOCOL_MINOR)	1062	if (p->prot_minor != PROTOCOL_MINOR)
1053	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	1063	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
1054	conf->nodename, (const char *)rsi,	1064	conf->nodename, (const char *)rsi,
1055	PROTOCOL_MINOR, conf->nodename, p->prot_minor);	1065	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
…		…
1081		1091
1082	break;	1092	break;
1083	}	1093	}
1084	}	1094	}
1085	else	1095	else
1086	slog (L_WARN, _("%s(%s): protocol mismatch"),	1096	slog (L_WARN, _("%s(%s): protocol mismatch."),
1087	conf->nodename, (const char *)rsi);	1097	conf->nodename, (const char *)rsi);
1088		1098
1089	send_reset (rsi);	1099	send_reset (rsi);
1090	}	1100	}
1091		1101
1092	break;	1102	break;
1093		1103
1094	case vpn_packet::PT_AUTH_RES:	1104	case vpn_packet::PT_AUTH_RES:
1095	{	1105	{
1096	auth_res_packet p = (auth_res_packet ) pkt;	1106	auth_res_packet p = (auth_res_packet )pkt;
1097		1107
1098	slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);	1108	slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
1099		1109
1100	if (p->chk_config ())	1110	if (p->chk_config ())
1101	{	1111	{
1102	if (p->prot_minor != PROTOCOL_MINOR)	1112	if (p->prot_minor != PROTOCOL_MINOR)
1103	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	1113	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
…		…
1106		1116
1107	rsachallenge chg;	1117	rsachallenge chg;
1108		1118
1109	if (!rsa_cache.find (p->id, chg))	1119	if (!rsa_cache.find (p->id, chg))
1110	{	1120	{
1111	slog (L_ERR, _("%s(%s): unrequested auth response ignored"),	1121	slog (L_ERR, _("%s(%s): unrequested auth response, ignoring."),
1112	conf->nodename, (const char *)rsi);	1122	conf->nodename, (const char *)rsi);
1113	break;	1123	break;
1114	}	1124	}
1115	else	1125	else
1116	{	1126	{
1117	crypto_ctx *cctx = new crypto_ctx (chg, 0);	1127	crypto_ctx *cctx = new crypto_ctx (chg, 0);
1118		1128
1119	if (!p->hmac_chk (cctx))	1129	if (!p->hmac_chk (cctx))
1120	{	1130	{
1121	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"	1131	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
1122	"could be an attack, or just corruption or a synchronization error"),	1132	"could be an attack, or just corruption or a synchronization error."),
1123	conf->nodename, (const char *)rsi);	1133	conf->nodename, (const char *)rsi);
1124	break;	1134	break;
1125	}	1135	}
1126	else	1136	else
1127	{	1137	{
…		…
1138	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid	1148	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
1139		1149
1140	si = rsi;	1150	si = rsi;
1141	protocol = rsi.prot;	1151	protocol = rsi.prot;
1142		1152
		1153	slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
		1154	conf->nodename, (const char *)rsi,
		1155	is_direct ? "direct" : "forwarded",
		1156	p->prot_major, p->prot_minor);
		1157
1143	connection_established ();	1158	connection_established ();
1144
1145	slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
1146	conf->nodename, (const char *)rsi,
1147	p->prot_major, p->prot_minor);
1148		1159
1149	if (::conf.script_node_up)	1160	if (::conf.script_node_up)
1150	{	1161	{
1151	run_script_cb *cb = new run_script_cb;	1162	run_script_cb *cb = new run_script_cb;
1152	cb->set<connection, &connection::script_node_up> (this);	1163	cb->set<connection, &connection::script_node_up> (this);
…		…
1154	}	1165	}
1155		1166
1156	break;	1167	break;
1157	}	1168	}
1158	else	1169	else
1159	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),	1170	slog (L_ERR, _("%s(%s): sent and received challenge do not match."),
1160	conf->nodename, (const char *)rsi);	1171	conf->nodename, (const char *)rsi);
1161	}	1172	}
1162		1173
1163	delete cctx;	1174	delete cctx;
1164	}	1175	}
…		…
1180	{	1191	{
1181	vpndata_packet p = (vpndata_packet )pkt;	1192	vpndata_packet p = (vpndata_packet )pkt;
1182		1193
1183	if (!p->hmac_chk (ictx))	1194	if (!p->hmac_chk (ictx))
1184	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"	1195	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1185	"could be an attack, or just corruption or a synchronization error"),	1196	"could be an attack, or just corruption or a synchronization error."),
1186	conf->nodename, (const char *)rsi);	1197	conf->nodename, (const char *)rsi);
1187	else	1198	else
1188	{	1199	{
1189	u32 seqno;	1200	u32 seqno;
1190	tap_packet *d = p->unpack (this, seqno);	1201	tap_packet *d = p->unpack (this, seqno);
		1202	int seqclass = iseqno.seqno_classify (seqno);
1191		1203
1192	if (iseqno.recv_ok (seqno))	1204	if (seqclass == 0) // ok
1193	{	1205	{
1194	vpn->tap->send (d);	1206	vpn->tap->send (d);
1195		1207
1196	if (si != rsi)	1208	if (si != rsi)
1197	{	1209	{
1198	// fast re-sync on source address changes, useful especially for tcp/ip	1210	// fast re-sync on source address changes, useful especially for tcp/ip
		1211	//if (last_si_change < ev_now () + 5.)
1199	si = rsi;	1212	// {
1200
1201	slog (L_INFO, _("%s(%s): socket address changed to %s"),	1213	slog (L_INFO, _("%s(%s): changing socket address to %s."),
1202	conf->nodename, (const char )si, (const char )rsi);	1214	conf->nodename, (const char )si, (const char )rsi);
		1215
		1216	si = rsi;
		1217
		1218	if (::conf.script_node_change)
		1219	{
		1220	run_script_cb *cb = new run_script_cb;
		1221	cb->set<connection, &connection::script_node_change> (this);
		1222	run_script_queued (cb, _("node-change command execution failed, continuing."));
		1223	}
		1224
		1225	// }
		1226	//else
		1227	// slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
		1228	// conf->nodename, (const char )si, (const char )rsi);
1203	}	1229	}
		1230	}
		1231	else if (seqclass == 1) // far history
		1232	slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
		1233	"possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
		1234	else if (seqclass == 2) // in-window duplicate, happens often on wireless
		1235	slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
		1236	"possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
		1237	else if (seqclass == 3) // reset
		1238	{
		1239	slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
		1240	"probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
		1241	send_reset (rsi);
1204	}	1242	}
1205		1243
1206	delete d;	1244	delete d;
1207	break;	1245	break;
1208	}	1246	}
…		…
1212	break;	1250	break;
1213		1251
1214	case vpn_packet::PT_CONNECT_REQ:	1252	case vpn_packet::PT_CONNECT_REQ:
1215	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1253	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1216	{	1254	{
1217	connect_req_packet p = (connect_req_packet ) pkt;	1255	connect_req_packet p = (connect_req_packet )pkt;
1218		1256
1219	if (p->id > 0 && p->id <= vpn->conns.size ())	1257	if (p->id > 0 && p->id <= vpn->conns.size ())
1220	{	1258	{
1221	connection *c = vpn->conns[p->id - 1];	1259	connection *c = vpn->conns[p->id - 1];
1222	conf->protocols = p->protocols;	1260	conf->protocols = p->protocols;
1223		1261
1224	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]",	1262	slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s) [%d]",
1225	conf->id, p->id, c->ictx && c->octx);	1263	conf->nodename, vpn->conns[p->id - 1]->conf->nodename, c->ictx && c->octx);
1226		1264
1227	if (c->ictx && c->octx)	1265	if (c->ictx && c->octx)
1228	{	1266	{
1229	// send connect_info packets to both sides, in case one is	1267	// send connect_info packets to both sides, in case one is
1230	// behind a nat firewall (or both ;)	1268	// behind a nat firewall (or both ;)
…		…
1253		1291
1254	c->conf->protocols = p->protocols;	1292	c->conf->protocols = p->protocols;
1255	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));	1293	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1256	p->si.upgrade_protocol (protocol, c->conf);	1294	p->si.upgrade_protocol (protocol, c->conf);
1257		1295
1258	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1296	slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s) [%d]",
		1297	conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1259	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1298	(const char *)p->si, !c->ictx && !c->octx);
1260		1299
1261	const sockinfo &dsi = forward_si (p->si);	1300	const sockinfo &dsi = forward_si (p->si);
1262		1301
1263	if (dsi.valid ())	1302	if (dsi.valid ())
1264	c->send_auth_request (dsi, true);	1303	c->send_auth_request (dsi, true);
…		…
1278	}	1317	}
1279		1318
1280	inline void	1319	inline void
1281	connection::keepalive_cb (ev::timer &w, int revents)	1320	connection::keepalive_cb (ev::timer &w, int revents)
1282	{	1321	{
1283	if (ev_now () >= last_activity + ::conf.keepalive + 30)	1322	if (ev_now () >= last_activity + ::conf.keepalive + 15)
1284	{	1323	{
1285	reset_connection ();	1324	reset_connection ();
1286	establish_connection ();	1325	establish_connection ();
1287	}	1326	}
1288	else if (ev_now () < last_activity + ::conf.keepalive)	1327	else if (ev_now () < last_activity + ::conf.keepalive)
1289	w.start (last_activity + ::conf.keepalive - ev::now ());	1328	w.start (last_activity + ::conf.keepalive - ev::now ());
1290	else if (conf->connectmode != conf_node::C_ONDEMAND	1329	else if (conf->connectmode != conf_node::C_ONDEMAND
1291	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)	1330	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)
1292	{	1331	{
1293	send_ping (si);	1332	send_ping (si);
1294	w.start (5);	1333	w.start (3);
1295	}	1334	}
1296	else if (ev_now () < last_activity + ::conf.keepalive + 10)	1335	else if (ev_now () < last_activity + ::conf.keepalive + 10)
1297	// hold ondemand connections implicitly a few seconds longer	1336	// hold ondemand connections implicitly a few seconds longer
1298	// should delete octx, though, or something like that ;)	1337	// should delete octx, though, or something like that ;)
1299	w.start (last_activity + ::conf.keepalive + 10 - ev::now ());	1338	w.start (last_activity + ::conf.keepalive + 10 - ev::now ());
…		…
1303		1342
1304	void connection::send_connect_request (int id)	1343	void connection::send_connect_request (int id)
1305	{	1344	{
1306	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);	1345	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1307		1346
1308	slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);	1347	slog (L_TRACE, "%s << PT_CONNECT_REQ(%s)",
		1348	conf->nodename, vpn->conns[id - 1]->conf->nodename);
1309	p->hmac_set (octx);	1349	p->hmac_set (octx);
1310	send_vpn_packet (p, si);	1350	send_vpn_packet (p, si);
1311		1351
1312	delete p;	1352	delete p;
1313	}	1353	}
1314		1354
1315	void connection::script_init_env (const char *ext)	1355	void connection::script_init_env (const char *ext)
1316	{	1356	{
1317	char *env;	1357	char *env;
1318	asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);	1358	asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
1319	asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);	1359	asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
1320	asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,	1360	asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
1321	0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,	1361	0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
1322	conf->id & 0xff); putenv (env);	1362	conf->id & 0xff); putenv (env);
1323	}	1363	}
1324		1364
1325	void connection::script_init_connect_env ()	1365	void connection::script_init_connect_env ()
1326	{	1366	{
1327	vpn->script_init_env ();	1367	vpn->script_init_env ();
1328		1368
1329	char *env;	1369	char *env;
1330	asprintf (&env, "DESTID=%d", conf->id); putenv (env);	1370	asprintf (&env, "DESTID=%d", conf->id); putenv (env);
		1371	asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env);
1331	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);	1372	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1332	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);	1373	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1333	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);	1374	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1334	}	1375	}
1335		1376
1336	inline const char *	1377	inline const char *
1337	connection::script_node_up ()	1378	connection::script_node_up ()
1338	{	1379	{
…		…
1348		1389
1349	return filename;	1390	return filename;
1350	}	1391	}
1351		1392
1352	inline const char *	1393	inline const char *
		1394	connection::script_node_change ()
		1395	{
		1396	script_init_connect_env ();
		1397
		1398	putenv ((char *)"STATE=change");
		1399
		1400	char *filename;
		1401	asprintf (&filename,
		1402	"%s/%s",
		1403	confbase,
		1404	::conf.script_node_change ? ::conf.script_node_change : "node-change");
		1405
		1406	return filename;
		1407	}
		1408
		1409	inline const char *
1353	connection::script_node_down ()	1410	connection::script_node_down ()
1354	{	1411	{
1355	script_init_connect_env ();	1412	script_init_connect_env ();
1356		1413
1357	putenv ((char *)"STATE=down");	1414	putenv ((char *)"STATE=down");
…		…
1368	connection::connection (struct vpn vpn, conf_node conf)	1425	connection::connection (struct vpn vpn, conf_node conf)
1369	: vpn(vpn), conf(conf),	1426	: vpn(vpn), conf(conf),
1370	#if ENABLE_DNS	1427	#if ENABLE_DNS
1371	dns (0),	1428	dns (0),
1372	#endif	1429	#endif
1373	data_queue(conf->max_ttl, conf->max_queue),	1430	data_queue(conf->max_ttl, conf->max_queue + 1),
1374	vpn_queue(conf->max_ttl, conf->max_queue)	1431	vpn_queue(conf->max_ttl, conf->max_queue + 1)
1375	{	1432	{
1376	rekey .set<connection, &connection::rekey_cb > (this);	1433	rekey .set<connection, &connection::rekey_cb > (this);
1377	keepalive .set<connection, &connection::keepalive_cb > (this);	1434	keepalive .set<connection, &connection::keepalive_cb > (this);
1378	establish_connection.set<connection, &connection::establish_connection_cb> (this);	1435	establish_connection.set<connection, &connection::establish_connection_cb> (this);
1379		1436

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.70 by pcg, Thu Aug 7 19:07:02 2008 UTC vs. Revision 1.87 by pcg, Fri Nov 12 18:39:33 2010 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.70 by pcg, Thu Aug 7 19:07:02 2008 UTC vs.
Revision 1.87 by pcg, Fri Nov 12 18:39:33 2010 UTC