[ViewVC] Diff of: cvs/gvpe/src/connection.C

Comparing gvpe/src/connection.C (file contents):
Revision 1.66 by pcg, Thu Dec 6 00:35:29 2007 UTC vs.
Revision 1.89 by root, Thu Dec 2 08:15:09 2010 UTC

…		…
1	/*	1	/*
2	connection.C -- manage a single connection	2	connection.C -- manage a single connection
3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>	3	Copyright (C) 2003-2008,2010 Marc Lehmann <gvpe@schmorp.de>
4		4
5	This file is part of GVPE.	5	This file is part of GVPE.
6		6
7	GVPE is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
8	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
9	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
10	(at your option) any later version.	10	option) any later version.
11		11
12	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
13	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15	GNU General Public License for more details.	15	Public License for more details.
16		16
17	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
18	along with gvpe; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
19	Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
20	*/	30	*/
21		31
22	#include "config.h"	32	#include "config.h"
23		33
24	#include <list>	34	#include <list>
		35	#include <queue>
		36	#include <utility>
25		37
26	#include <openssl/rand.h>	38	#include <openssl/rand.h>
27	#include <openssl/evp.h>	39	#include <openssl/evp.h>
28	#include <openssl/rsa.h>	40	#include <openssl/rsa.h>
29	#include <openssl/err.h>	41	#include <openssl/err.h>
38		50
39	#if !HAVE_RAND_PSEUDO_BYTES	51	#if !HAVE_RAND_PSEUDO_BYTES
40	# define RAND_pseudo_bytes RAND_bytes	52	# define RAND_pseudo_bytes RAND_bytes
41	#endif	53	#endif
42		54
43	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic	55	#define MAGIC_OLD "vped\xbd\xc6\xdb\x82" // 8 bytes of magic (still used in the protocol)
		56	#define MAGIC "gvpe\xbd\xc6\xdb\x82" // 8 bytes of magic (understood but not generated)
44		57
45	#define ULTRA_FAST 1	58	#define ULTRA_FAST 1
46	#define HLOG 15	59	#define HLOG 15
47	#include "lzf/lzf.h"	60	#include "lzf/lzf.h"
48	#include "lzf/lzf_c.c"	61	#include "lzf/lzf_c.c"
49	#include "lzf/lzf_d.c"	62	#include "lzf/lzf_d.c"
		63
		64	//////////////////////////////////////////////////////////////////////////////
		65
		66	static std::queue< std::pair<run_script_cb , const char > > rs_queue;
		67	static ev::child rs_child_ev;
		68
		69	void // c++ requires external linkage here, apparently :(
		70	rs_child_cb (ev::child &w, int revents)
		71	{
		72	w.stop ();
		73
		74	if (rs_queue.empty ())
		75	return;
		76
		77	pid_t pid = run_script (*rs_queue.front ().first, false);
		78	if (pid)
		79	{
		80	w.set (pid);
		81	w.start ();
		82	}
		83	else
		84	slog (L_WARN, rs_queue.front ().second);
		85
		86	delete rs_queue.front ().first;
		87	rs_queue.pop ();
		88	}
		89
		90	// despite the fancy name, this is quite a hack
		91	static void
		92	run_script_queued (run_script_cb cb, const char warnmsg)
		93	{
		94	rs_queue.push (std::make_pair (cb, warnmsg));
		95
		96	if (!rs_child_ev.is_active ())
		97	{
		98	rs_child_ev.set<rs_child_cb> ();
		99	rs_child_ev ();
		100	}
		101	}
		102
		103	//////////////////////////////////////////////////////////////////////////////
50		104
51	struct crypto_ctx	105	struct crypto_ctx
52	{	106	{
53	EVP_CIPHER_CTX cctx;	107	EVP_CIPHER_CTX cctx;
54	HMAC_CTX hctx;	108	HMAC_CTX hctx;
…		…
153	}	207	}
154	}	208	}
155		209
156	//////////////////////////////////////////////////////////////////////////////	210	//////////////////////////////////////////////////////////////////////////////
157		211
158	void pkt_queue::put (net_packet *p)	212	pkt_queue::pkt_queue (double max_ttl, int max_queue)
		213	: max_ttl (max_ttl), max_queue (max_queue)
159	{	214	{
160	if (queue[i])	215	queue = new pkt [max_queue];
161	{
162	delete queue[i];
163	j = (j + 1) % QUEUEDEPTH;
164	}
165		216
166	queue[i] = p;
167
168	i = (i + 1) % QUEUEDEPTH;
169	}
170
171	net_packet *pkt_queue::get ()
172	{
173	net_packet *p = queue[j];
174
175	if (p)
176	{
177	queue[j] = 0;
178	j = (j + 1) % QUEUEDEPTH;
179	}
180
181	return p;
182	}
183
184	pkt_queue::pkt_queue ()
185	{
186	memset (queue, 0, sizeof (queue));
187	i = 0;	217	i = 0;
188	j = 0;	218	j = 0;
		219
		220	expire.set<pkt_queue, &pkt_queue::expire_cb> (this);
189	}	221	}
190		222
191	pkt_queue::~pkt_queue ()	223	pkt_queue::~pkt_queue ()
192	{	224	{
193	for (i = QUEUEDEPTH; --i > 0; )	225	while (net_packet *p = get ())
		226	delete p;
		227
194	delete queue[i];	228	delete [] queue;
		229	}
		230
		231	void pkt_queue::expire_cb (ev::timer &w, int revents)
		232	{
		233	ev_tstamp expire = ev_now () - max_ttl;
		234
		235	for (;;)
		236	{
		237	if (empty ())
		238	break;
		239
		240	double diff = queue[j].tstamp - expire;
		241
		242	if (diff >= 0.)
		243	{
		244	w.start (diff > 0.5 ? diff : 0.5);
		245	break;
		246	}
		247
		248	delete get ();
		249	}
		250	}
		251
		252	void pkt_queue::put (net_packet *p)
		253	{
		254	ev_tstamp now = ev_now ();
		255
		256	// start expiry timer
		257	if (empty ())
		258	expire.start (max_ttl);
		259
		260	int ni = i + 1 == max_queue ? 0 : i + 1;
		261
		262	if (ni == j)
		263	delete get ();
		264
		265	queue[i].pkt = p;
		266	queue[i].tstamp = now;
		267
		268	i = ni;
		269	}
		270
		271	net_packet *pkt_queue::get ()
		272	{
		273	if (empty ())
		274	return 0;
		275
		276	net_packet *p = queue[j].pkt;
		277	queue[j].pkt = 0;
		278
		279	j = j + 1 == max_queue ? 0 : j + 1;
		280
		281	return p;
195	}	282	}
196		283
197	struct net_rateinfo	284	struct net_rateinfo
198	{	285	{
199	u32 host;	286	u32 host;
…		…
338	ptype type = PT_DATA_UNCOMPRESSED;	425	ptype type = PT_DATA_UNCOMPRESSED;
339		426
340	#if ENABLE_COMPRESSION	427	#if ENABLE_COMPRESSION
341	u8 cdata[MAX_MTU];	428	u8 cdata[MAX_MTU];
342		429
343	if (conn->features & ENABLE_COMPRESSION)	430	if (conn->features & FEATURE_COMPRESSION)
344	{	431	{
345	u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);	432	u32 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
346		433
347	if (cl)	434	if (cl)
348	{	435	{
…		…
527	rsaencrdata encr;	614	rsaencrdata encr;
528		615
529	auth_req_packet (int dst, bool initiate_, u8 protocols_)	616	auth_req_packet (int dst, bool initiate_, u8 protocols_)
530	{	617	{
531	config_packet::setup (PT_AUTH_REQ, dst);	618	config_packet::setup (PT_AUTH_REQ, dst);
532	strncpy (magic, MAGIC, 8);	619	strncpy (magic, MAGIC_OLD, 8);
533	initiate = !!initiate_;	620	initiate = !!initiate_;
534	protocols = protocols_;	621	protocols = protocols_;
535		622
536	len = sizeof (*this) - sizeof (net_packet);	623	len = sizeof (*this) - sizeof (net_packet);
537	}	624	}
…		…
586	/////////////////////////////////////////////////////////////////////////////	673	/////////////////////////////////////////////////////////////////////////////
587		674
588	void	675	void
589	connection::connection_established ()	676	connection::connection_established ()
590	{	677	{
591	slog (L_TRACE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);	678	slog (L_NOISE, _("%s: possible connection establish (ictx %d, octx %d)"), conf->nodename, !!ictx, !!octx);
592		679
593	if (ictx && octx)	680	if (ictx && octx)
594	{	681	{
595	connectmode = conf->connectmode;
596
597	// make sure rekeying timeouts are slightly asymmetric	682	// make sure rekeying timeouts are slightly asymmetric
598	ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);	683	ev::tstamp rekey_interval = ::conf.rekey + (conf->id > THISNODE->id ? 10 : 0);
599	rekey.start (rekey_interval, rekey_interval);	684	rekey.start (rekey_interval, rekey_interval);
600	keepalive.start (::conf.keepalive);	685	keepalive.start (::conf.keepalive);
601		686
602	// send queued packets	687	// send queued packets
603	if (ictx && octx)	688	if (ictx && octx)
604	{	689	{
605	while (tap_packet p = (tap_packet )data_queue.get ())	690	while (tap_packet p = (tap_packet )data_queue.get ())
606	{	691	{
607	send_data_packet (p);	692	if (p->len) send_data_packet (p);
608	delete p;	693	delete p;
609	}	694	}
610		695
611	while (vpn_packet p = (vpn_packet )vpn_queue.get ())	696	while (vpn_packet p = (vpn_packet )vpn_queue.get ())
612	{	697	{
613	send_vpn_packet (p, si, IPTOS_RELIABILITY);	698	if (p->len) send_vpn_packet (p, si, IPTOS_RELIABILITY);
614	delete p;	699	delete p;
615	}	700	}
616	}	701	}
		702
		703	vpn->connection_established (this);
617	}	704	}
618	else	705	else
619	{	706	{
620	retry_cnt = 0;	707	retry_cnt = 0;
621	establish_connection.start (5);	708	establish_connection.start (5);
…		…
625	}	712	}
626		713
627	void	714	void
628	connection::reset_si ()	715	connection::reset_si ()
629	{	716	{
		717	if (vpn->can_direct (THISNODE, conf))
630	protocol = best_protocol (THISNODE->protocols & conf->protocols);	718	protocol = best_protocol (THISNODE->protocols & conf->connectable_protocols ());
631		719	else
632	// mask out protocols we cannot establish
633	if (!conf->udp_port) protocol &= ~PROT_UDPv4;
634	if (!conf->tcp_port) protocol &= ~PROT_TCPv4;
635	if (!conf->dns_port) protocol &= ~PROT_DNSv4;
636
637	if (protocol
638	&& (!conf->can_direct (THISNODE)
639	\|\| !THISNODE->can_direct (conf)))
640	{	720	{
641	slog (L_DEBUG, _("%s: direct connection denied"), conf->nodename);	721	slog (L_TRACE, _("%s: direct connection denied by config."), conf->nodename);
642	protocol = 0;	722	protocol = 0;
643	}	723	}
644		724
645	si.set (conf, protocol);	725	si.set (conf, protocol);
		726
		727	is_direct = si.valid ();
646	}	728	}
647		729
648	// ensure sockinfo is valid, forward if necessary	730	// ensure sockinfo is valid, forward if necessary
649	const sockinfo &	731	const sockinfo &
650	connection::forward_si (const sockinfo &si) const	732	connection::forward_si (const sockinfo &si) const
651	{	733	{
652	if (!si.valid ())	734	if (!si.valid ())
653	{	735	{
654	connection *r = vpn->find_router ();	736	connection *r = vpn->find_router_for (this);
655		737
656	if (r)	738	if (r)
657	{	739	{
658	slog (L_DEBUG, _("%s: no common protocol, trying indirectly through %s (%s)"),	740	slog (L_DEBUG, _("%s: no common protocol, trying to route through %s."),
659	conf->nodename, r->conf->nodename, (const char *)r->si);	741	conf->nodename, r->conf->nodename);
660	return r->si;	742	return r->si;
661	}	743	}
662	else	744	else
663	slog (L_DEBUG, _("%s: node unreachable, no common protocol"),	745	slog (L_DEBUG, _("%s: node unreachable, no common protocol or no router available."),
664	conf->nodename);	746	conf->nodename);
665	}	747	}
666		748
667	return si;	749	return si;
668	}	750	}
…		…
678	connection::send_ping (const sockinfo &si, u8 pong)	760	connection::send_ping (const sockinfo &si, u8 pong)
679	{	761	{
680	ping_packet *pkt = new ping_packet;	762	ping_packet *pkt = new ping_packet;
681		763
682	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);	764	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
		765
		766	slog (L_TRACE, "%s << %s [%s]", conf->nodename, pong ? "PT_PONG" : "PT_PING", (const char *)si);
		767
683	send_vpn_packet (pkt, si, IPTOS_LOWDELAY);	768	send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
684		769
685	delete pkt;	770	delete pkt;
686	}	771	}
687		772
…		…
706		791
707	rsachallenge chg;	792	rsachallenge chg;
708	rsa_cache.gen (pkt->id, chg);	793	rsa_cache.gen (pkt->id, chg);
709	rsa_encrypt (conf->rsa_key, chg, pkt->encr);	794	rsa_encrypt (conf->rsa_key, chg, pkt->encr);
710		795
711	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);	796	slog (L_TRACE, "%s << PT_AUTH_REQ [%s]", conf->nodename, (const char *)si);
712		797
713	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly	798	send_vpn_packet (pkt, si, IPTOS_RELIABILITY \| IPTOS_LOWDELAY); // rsa is very very costly
714		799
715	delete pkt;	800	delete pkt;
716	}	801	}
…		…
724		809
725	rsa_hash (id, chg, pkt->response);	810	rsa_hash (id, chg, pkt->response);
726		811
727	pkt->hmac_set (octx);	812	pkt->hmac_set (octx);
728		813
729	slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);	814	slog (L_TRACE, "%s << PT_AUTH_RES [%s]", conf->nodename, (const char *)si);
730		815
731	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly	816	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
732		817
733	delete pkt;	818	delete pkt;
734	}	819	}
735		820
736	void	821	void
737	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)	822	connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
738	{	823	{
739	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)",	824	slog (L_TRACE, "%s << PT_CONNECT_INFO(%s,%s)", conf->nodename,
740	conf->id, rid, (const char *)rsi);	825	vpn->conns[rid - 1]->conf->nodename, (const char *)rsi);
741		826
742	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);	827	connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
743		828
744	r->hmac_set (octx);	829	r->hmac_set (octx);
745	send_vpn_packet (r, si);	830	send_vpn_packet (r, si);
…		…
754	&& conf != THISNODE	839	&& conf != THISNODE
755	&& connectmode != conf_node::C_NEVER	840	&& connectmode != conf_node::C_NEVER
756	&& connectmode != conf_node::C_DISABLED	841	&& connectmode != conf_node::C_DISABLED
757	&& !w.is_active ())	842	&& !w.is_active ())
758	{	843	{
		844	// a bit hacky, if ondemand, and packets are no longer queued, then reset the connection
		845	// and stop trying. should probably be handled by a per-connection expire handler.
		846	if (connectmode == conf_node::C_ONDEMAND && vpn_queue.empty () && data_queue.empty ())
		847	{
		848	reset_connection ();
		849	return;
		850	}
		851
		852	last_establish_attempt = ev_now ();
		853
759	ev::tstamp retry_int = ev::tstamp (retry_cnt & 3	854	ev::tstamp retry_int = ev::tstamp (retry_cnt & 3
760	? (retry_cnt & 3) + 1	855	? (retry_cnt & 3) + 1
761	: 1 << (retry_cnt >> 2));	856	: 1 << (retry_cnt >> 2));
762		857
763	reset_si ();	858	reset_si ();
764		859
765	bool slow = si.prot & PROT_SLOW;	860	bool slow = si.prot & PROT_SLOW;
766		861
767	if (si.prot && !si.host)	862	if (si.prot && !si.host && vpn->can_direct (THISNODE, conf))
768	{	863	{
769	slog (L_TRACE, _("%s: connection request (indirect)"), conf->nodename);
770	/TODO/ /* start the timer so we don't recurse endlessly */	864	/TODO/ /* start the timer so we don't recurse endlessly */
771	w.start (1);	865	w.start (1);
772	vpn->send_connect_request (conf->id);	866	vpn->send_connect_request (this);
773	}	867	}
774	else	868	else
775	{	869	{
776	slog (L_TRACE, _("%s: connection request (direct)"), conf->nodename, !!ictx, !!octx);	870	if (si.valid ())
		871	slog (L_DEBUG, _("%s: sending direct connection request to %s."),
		872	conf->nodename, (const char *)si);
777		873
778	const sockinfo &dsi = forward_si (si);	874	const sockinfo &dsi = forward_si (si);
779		875
780	slow = slow \|\| (dsi.prot & PROT_SLOW);	876	slow = slow \|\| (dsi.prot & PROT_SLOW);
781		877
…		…
786	else	882	else
787	send_ping (dsi, 0);	883	send_ping (dsi, 0);
788	}	884	}
789	}	885	}
790		886
791	retry_int *= slow ? 8. : 0.7;	887	retry_int *= slow ? 8. : 0.9;
792		888
793	if (retry_int < conf->max_retry)	889	if (retry_int < conf->max_retry)
794	retry_cnt++;	890	retry_cnt++;
795	else	891	else
796	retry_int = conf->max_retry;	892	retry_int = conf->max_retry;
…		…
807	slog (L_INFO, _("%s(%s): connection lost"),	903	slog (L_INFO, _("%s(%s): connection lost"),
808	conf->nodename, (const char *)si);	904	conf->nodename, (const char *)si);
809		905
810	if (::conf.script_node_down)	906	if (::conf.script_node_down)
811	{	907	{
812	run_script_cb cb;	908	run_script_cb *cb = new run_script_cb;
813	cb.set<connection, &connection::script_node_down> (this);	909	cb->set<connection, &connection::script_node_down> (this);
814	if (!run_script (cb, false))
815	slog (L_WARN, _("node-down command execution failed, continuing."));	910	run_script_queued (cb, _("node-down command execution failed, continuing."));
816	}	911	}
817	}	912	}
818		913
819	delete ictx; ictx = 0;	914	delete ictx; ictx = 0;
820	delete octx; octx = 0;	915	delete octx; octx = 0;
…		…
822	dnsv4_reset_connection ();	917	dnsv4_reset_connection ();
823	#endif	918	#endif
824		919
825	si.host = 0;	920	si.host = 0;
826		921
827	last_activity = 0;	922	last_activity = 0.;
		923	//last_si_change = 0.;
828	retry_cnt = 0;	924	retry_cnt = 0;
829		925
830	rekey.stop ();	926	rekey.stop ();
831	keepalive.stop ();	927	keepalive.stop ();
832	establish_connection.stop ();	928	establish_connection.stop ();
…		…
839	send_reset (si);	935	send_reset (si);
840		936
841	reset_connection ();	937	reset_connection ();
842	}	938	}
843		939
		940	// poor-man's rekeying
844	inline void	941	inline void
845	connection::rekey_cb (ev::timer &w, int revents)	942	connection::rekey_cb (ev::timer &w, int revents)
846	{	943	{
847	reset_connection ();	944	reset_connection ();
848	establish_connection ();	945	establish_connection ();
…		…
866	if (oseqno > MAX_SEQNO)	963	if (oseqno > MAX_SEQNO)
867	rekey ();	964	rekey ();
868	}	965	}
869		966
870	void	967	void
		968	connection::post_inject_queue ()
		969	{
		970	// force a connection every now and when when packets are sent (max 1/s)
		971	if (ev_now () - last_establish_attempt >= 0.95) // arbitrary
		972	establish_connection.stop ();
		973
		974	establish_connection ();
		975	}
		976
		977	void
871	connection::inject_data_packet (tap_packet pkt, bool broadcast/TODO DDD*/)	978	connection::inject_data_packet (tap_packet *pkt)
872	{	979	{
873	if (ictx && octx)	980	if (ictx && octx)
874	send_data_packet (pkt);	981	send_data_packet (pkt);
875	else	982	else
876	{	983	{
877	if (!broadcast)
878	data_queue.put (new tap_packet (*pkt));	984	data_queue.put (new tap_packet (*pkt));
879		985	post_inject_queue ();
880	establish_connection ();
881	}	986	}
882	}	987	}
883		988
884	void connection::inject_vpn_packet (vpn_packet *pkt, int tos)	989	void connection::inject_vpn_packet (vpn_packet *pkt, int tos)
885	{	990	{
886	if (ictx && octx)	991	if (ictx && octx)
887	send_vpn_packet (pkt, si, tos);	992	send_vpn_packet (pkt, si, tos);
888	else	993	else
889	{	994	{
890	vpn_queue.put ((vpn_packet )new data_packet ((data_packet *)pkt));	995	vpn_queue.put ((vpn_packet )new data_packet ((data_packet *)pkt));
891		996	post_inject_queue ();
892	establish_connection ();
893	}	997	}
894	}	998	}
895		999
896	void	1000	void
897	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	1001	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
898	{	1002	{
899	last_activity = ev_now ();	1003	last_activity = ev_now ();
900		1004
901	slog (L_NOISE, "<<%d received packet type %d from %d to %d",	1005	slog (L_NOISE, "%s >> received packet type %d from %d to %d.",
902	conf->id, pkt->typ (), pkt->src (), pkt->dst ());	1006	conf->nodename, pkt->typ (), pkt->src (), pkt->dst ());
903		1007
904	if (connectmode == conf_node::C_DISABLED)	1008	if (connectmode == conf_node::C_DISABLED)
905	return;	1009	return;
906		1010
907	switch (pkt->typ ())	1011	switch (pkt->typ ())
908	{	1012	{
909	case vpn_packet::PT_PING:	1013	case vpn_packet::PT_PING:
		1014	slog (L_TRACE, "%s >> PT_PING", conf->nodename);
		1015
910	// we send pings instead of auth packets after some retries,	1016	// we send pings instead of auth packets after some retries,
911	// so reset the retry counter and establish a connection	1017	// so reset the retry counter and establish a connection
912	// when we receive a ping.	1018	// when we receive a ping.
913	if (!ictx)	1019	if (!ictx)
914	{	1020	{
915	if (auth_rate_limiter.can (rsi))	1021	if (auth_rate_limiter.can (rsi))
916	send_auth_request (rsi, true);	1022	send_auth_request (rsi, true);
917	}	1023	}
918	else	1024	else
		1025	// we would love to change the socket address here, but ping's aren't
		1026	// authenticated, so we best ignore it.
919	send_ping (rsi, 1); // pong	1027	send_ping (rsi, 1); // pong
920		1028
921	break;	1029	break;
922		1030
923	case vpn_packet::PT_PONG:	1031	case vpn_packet::PT_PONG:
		1032	slog (L_TRACE, "%s >> PT_PONG", conf->nodename);
		1033
		1034	// a PONG might mean that the other side doesn't really know
		1035	// about our desire for communication.
		1036	establish_connection ();
924	break;	1037	break;
925		1038
926	case vpn_packet::PT_RESET:	1039	case vpn_packet::PT_RESET:
927	{	1040	{
928	reset_connection ();	1041	reset_connection ();
929		1042
930	config_packet p = (config_packet ) pkt;	1043	config_packet p = (config_packet ) pkt;
931		1044
932	if (!p->chk_config ())	1045	if (!p->chk_config ())
933	{	1046	{
934	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),	1047	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node."),
935	conf->nodename, (const char *)rsi);	1048	conf->nodename, (const char *)rsi);
936	connectmode = conf_node::C_DISABLED;	1049	connectmode = conf_node::C_DISABLED;
937	}	1050	}
938	else if (connectmode == conf_node::C_ALWAYS)	1051	else if (connectmode == conf_node::C_ALWAYS)
939	establish_connection ();	1052	establish_connection ();
…		…
943	case vpn_packet::PT_AUTH_REQ:	1056	case vpn_packet::PT_AUTH_REQ:
944	if (auth_rate_limiter.can (rsi))	1057	if (auth_rate_limiter.can (rsi))
945	{	1058	{
946	auth_req_packet p = (auth_req_packet ) pkt;	1059	auth_req_packet p = (auth_req_packet ) pkt;
947		1060
948	slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);	1061	slog (L_TRACE, "%s >> PT_AUTH_REQ(%s)", conf->nodename, p->initiate ? "initiate" : "reply");
949		1062
950	if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))	1063	if (p->chk_config ()
		1064	&& (!strncmp (p->magic, MAGIC_OLD, 8) \|\| !strncmp (p->magic, MAGIC, 8)))
951	{	1065	{
952	if (p->prot_minor != PROTOCOL_MINOR)	1066	if (p->prot_minor != PROTOCOL_MINOR)
953	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	1067	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
954	conf->nodename, (const char *)rsi,	1068	conf->nodename, (const char *)rsi,
955	PROTOCOL_MINOR, conf->nodename, p->prot_minor);	1069	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
…		…
981		1095
982	break;	1096	break;
983	}	1097	}
984	}	1098	}
985	else	1099	else
986	slog (L_WARN, _("%s(%s): protocol mismatch"),	1100	slog (L_WARN, _("%s(%s): protocol mismatch."),
987	conf->nodename, (const char *)rsi);	1101	conf->nodename, (const char *)rsi);
988		1102
989	send_reset (rsi);	1103	send_reset (rsi);
990	}	1104	}
991		1105
992	break;	1106	break;
993		1107
994	case vpn_packet::PT_AUTH_RES:	1108	case vpn_packet::PT_AUTH_RES:
995	{	1109	{
996	auth_res_packet p = (auth_res_packet ) pkt;	1110	auth_res_packet p = (auth_res_packet )pkt;
997		1111
998	slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);	1112	slog (L_TRACE, "%s >> PT_AUTH_RES", conf->nodename);
999		1113
1000	if (p->chk_config ())	1114	if (p->chk_config ())
1001	{	1115	{
1002	if (p->prot_minor != PROTOCOL_MINOR)	1116	if (p->prot_minor != PROTOCOL_MINOR)
1003	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),	1117	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
…		…
1006		1120
1007	rsachallenge chg;	1121	rsachallenge chg;
1008		1122
1009	if (!rsa_cache.find (p->id, chg))	1123	if (!rsa_cache.find (p->id, chg))
1010	{	1124	{
1011	slog (L_ERR, _("%s(%s): unrequested auth response ignored"),	1125	slog (L_ERR, _("%s(%s): unrequested auth response, ignoring."),
1012	conf->nodename, (const char *)rsi);	1126	conf->nodename, (const char *)rsi);
1013	break;	1127	break;
1014	}	1128	}
1015	else	1129	else
1016	{	1130	{
1017	crypto_ctx *cctx = new crypto_ctx (chg, 0);	1131	crypto_ctx *cctx = new crypto_ctx (chg, 0);
1018		1132
1019	if (!p->hmac_chk (cctx))	1133	if (!p->hmac_chk (cctx))
1020	{	1134	{
1021	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"	1135	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
1022	"could be an attack, or just corruption or a synchronization error"),	1136	"could be an attack, or just corruption or a synchronization error."),
1023	conf->nodename, (const char *)rsi);	1137	conf->nodename, (const char *)rsi);
1024	break;	1138	break;
1025	}	1139	}
1026	else	1140	else
1027	{	1141	{
…		…
1038	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid	1152	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
1039		1153
1040	si = rsi;	1154	si = rsi;
1041	protocol = rsi.prot;	1155	protocol = rsi.prot;
1042		1156
		1157	slog (L_INFO, _("%s(%s): connection established (%s), protocol version %d.%d."),
		1158	conf->nodename, (const char *)rsi,
		1159	is_direct ? "direct" : "forwarded",
		1160	p->prot_major, p->prot_minor);
		1161
1043	connection_established ();	1162	connection_established ();
1044
1045	slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
1046	conf->nodename, (const char *)rsi,
1047	p->prot_major, p->prot_minor);
1048		1163
1049	if (::conf.script_node_up)	1164	if (::conf.script_node_up)
1050	{	1165	{
1051	run_script_cb cb;	1166	run_script_cb *cb = new run_script_cb;
1052	cb.set<connection, &connection::script_node_up> (this);	1167	cb->set<connection, &connection::script_node_up> (this);
1053	if (!run_script (cb, false))
1054	slog (L_WARN, _("node-up command execution failed, continuing."));	1168	run_script_queued (cb, _("node-up command execution failed, continuing."));
1055	}	1169	}
1056		1170
1057	break;	1171	break;
1058	}	1172	}
1059	else	1173	else
1060	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),	1174	slog (L_ERR, _("%s(%s): sent and received challenge do not match."),
1061	conf->nodename, (const char *)rsi);	1175	conf->nodename, (const char *)rsi);
1062	}	1176	}
1063		1177
1064	delete cctx;	1178	delete cctx;
1065	}	1179	}
…		…
1081	{	1195	{
1082	vpndata_packet p = (vpndata_packet )pkt;	1196	vpndata_packet p = (vpndata_packet )pkt;
1083		1197
1084	if (!p->hmac_chk (ictx))	1198	if (!p->hmac_chk (ictx))
1085	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"	1199	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1086	"could be an attack, or just corruption or a synchronization error"),	1200	"could be an attack, or just corruption or a synchronization error."),
1087	conf->nodename, (const char *)rsi);	1201	conf->nodename, (const char *)rsi);
1088	else	1202	else
1089	{	1203	{
1090	u32 seqno;	1204	u32 seqno;
1091	tap_packet *d = p->unpack (this, seqno);	1205	tap_packet *d = p->unpack (this, seqno);
		1206	int seqclass = iseqno.seqno_classify (seqno);
1092		1207
1093	if (iseqno.recv_ok (seqno))	1208	if (seqclass == 0) // ok
1094	{	1209	{
1095	vpn->tap->send (d);	1210	vpn->tap->send (d);
1096		1211
1097	if (si != rsi)	1212	if (si != rsi)
1098	{	1213	{
1099	// fast re-sync on source address changes, useful especially for tcp/ip	1214	// fast re-sync on source address changes, useful especially for tcp/ip
		1215	//if (last_si_change < ev_now () + 5.)
1100	si = rsi;	1216	// {
1101
1102	slog (L_INFO, _("%s(%s): socket address changed to %s"),	1217	slog (L_INFO, _("%s(%s): changing socket address to %s."),
1103	conf->nodename, (const char )si, (const char )rsi);	1218	conf->nodename, (const char )si, (const char )rsi);
		1219
		1220	si = rsi;
		1221
		1222	if (::conf.script_node_change)
		1223	{
		1224	run_script_cb *cb = new run_script_cb;
		1225	cb->set<connection, &connection::script_node_change> (this);
		1226	run_script_queued (cb, _("node-change command execution failed, continuing."));
		1227	}
		1228
		1229	// }
		1230	//else
		1231	// slog (L_INFO, _("%s(%s): accepted packet from %s, not (yet) redirecting traffic."),
		1232	// conf->nodename, (const char )si, (const char )rsi);
1104	}	1233	}
		1234	}
		1235	else if (seqclass == 1) // far history
		1236	slog (L_ERR, _("received very old packet (received %08lx, expected %08lx). "
		1237	"possible replay attack, or just packet duplication/delay, ignoring."), seqno, iseqno.seq + 1);
		1238	else if (seqclass == 2) // in-window duplicate, happens often on wireless
		1239	slog (L_DEBUG, _("received recent duplicated packet (received %08lx, expected %08lx). "
		1240	"possible replay attack, or just packet duplication, ignoring."), seqno, iseqno.seq + 1);
		1241	else if (seqclass == 3) // reset
		1242	{
		1243	slog (L_ERR, _("received out-of-sync (far future) packet (received %08lx, expected %08lx). "
		1244	"probably just massive packet loss, sending reset."), seqno, iseqno.seq + 1);
		1245	send_reset (rsi);
1105	}	1246	}
1106		1247
1107	delete d;	1248	delete d;
1108	break;	1249	break;
1109	}	1250	}
…		…
1113	break;	1254	break;
1114		1255
1115	case vpn_packet::PT_CONNECT_REQ:	1256	case vpn_packet::PT_CONNECT_REQ:
1116	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))	1257	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1117	{	1258	{
1118	connect_req_packet p = (connect_req_packet ) pkt;	1259	connect_req_packet p = (connect_req_packet )pkt;
1119		1260
1120	if (p->id > 0 && p->id <= vpn->conns.size ())	1261	if (p->id > 0 && p->id <= vpn->conns.size ())
1121	{	1262	{
1122	connection *c = vpn->conns[p->id - 1];	1263	connection *c = vpn->conns[p->id - 1];
1123	conf->protocols = p->protocols;	1264	conf->protocols = p->protocols;
1124		1265
1125	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]",	1266	slog (L_TRACE, "%s >> PT_CONNECT_REQ(%s) [%d]",
1126	conf->id, p->id, c->ictx && c->octx);	1267	conf->nodename, vpn->conns[p->id - 1]->conf->nodename, c->ictx && c->octx);
1127		1268
1128	if (c->ictx && c->octx)	1269	if (c->ictx && c->octx)
1129	{	1270	{
1130	// send connect_info packets to both sides, in case one is	1271	// send connect_info packets to both sides, in case one is
1131	// behind a nat firewall (or both ;)	1272	// behind a nat firewall (or both ;)
…		…
1154		1295
1155	c->conf->protocols = p->protocols;	1296	c->conf->protocols = p->protocols;
1156	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));	1297	protocol = best_protocol (c->conf->protocols & THISNODE->protocols & p->si.supported_protocols (c->conf));
1157	p->si.upgrade_protocol (protocol, c->conf);	1298	p->si.upgrade_protocol (protocol, c->conf);
1158		1299
1159	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1300	slog (L_TRACE, "%s >> PT_CONNECT_INFO(%s,%s) [%d]",
		1301	conf->nodename, vpn->conns[p->id - 1]->conf->nodename,
1160	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1302	(const char *)p->si, !c->ictx && !c->octx);
1161		1303
1162	const sockinfo &dsi = forward_si (p->si);	1304	const sockinfo &dsi = forward_si (p->si);
1163		1305
1164	if (dsi.valid ())	1306	if (dsi.valid ())
1165	c->send_auth_request (dsi, true);	1307	c->send_auth_request (dsi, true);
…		…
1179	}	1321	}
1180		1322
1181	inline void	1323	inline void
1182	connection::keepalive_cb (ev::timer &w, int revents)	1324	connection::keepalive_cb (ev::timer &w, int revents)
1183	{	1325	{
1184	if (ev_now () >= last_activity + ::conf.keepalive + 30)	1326	if (ev_now () >= last_activity + ::conf.keepalive + 15)
1185	{	1327	{
1186	reset_connection ();	1328	reset_connection ();
1187	establish_connection ();	1329	establish_connection ();
1188	}	1330	}
1189	else if (ev_now () < last_activity + ::conf.keepalive)	1331	else if (ev_now () < last_activity + ::conf.keepalive)
1190	w.start (last_activity + ::conf.keepalive - ev::now ());	1332	w.start (last_activity + ::conf.keepalive - ev::now ());
1191	else if (conf->connectmode != conf_node::C_ONDEMAND	1333	else if (conf->connectmode != conf_node::C_ONDEMAND
1192	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)	1334	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)
1193	{	1335	{
1194	send_ping (si);	1336	send_ping (si);
1195	w.start (5);	1337	w.start (3);
1196	}	1338	}
1197	else if (ev_now () < last_activity + ::conf.keepalive + 10)	1339	else if (ev_now () < last_activity + ::conf.keepalive + 10)
1198	// hold ondemand connections implicitly a few seconds longer	1340	// hold ondemand connections implicitly a few seconds longer
1199	// should delete octx, though, or something like that ;)	1341	// should delete octx, though, or something like that ;)
1200	w.start (last_activity + ::conf.keepalive + 10 - ev::now ());	1342	w.start (last_activity + ::conf.keepalive + 10 - ev::now ());
…		…
1204		1346
1205	void connection::send_connect_request (int id)	1347	void connection::send_connect_request (int id)
1206	{	1348	{
1207	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);	1349	connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1208		1350
1209	slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);	1351	slog (L_TRACE, "%s << PT_CONNECT_REQ(%s)",
		1352	conf->nodename, vpn->conns[id - 1]->conf->nodename);
1210	p->hmac_set (octx);	1353	p->hmac_set (octx);
1211	send_vpn_packet (p, si);	1354	send_vpn_packet (p, si);
1212		1355
1213	delete p;	1356	delete p;
1214	}	1357	}
1215		1358
1216	void connection::script_init_env (const char *ext)	1359	void connection::script_init_env (const char *ext)
1217	{	1360	{
1218	char *env;	1361	char *env;
1219	asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);	1362	asprintf (&env, "IFUPDATA%s=%s", ext, conf->if_up_data); putenv (env);
1220	asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);	1363	asprintf (&env, "NODENAME%s=%s", ext, conf->nodename); putenv (env);
1221	asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,	1364	asprintf (&env, "MAC%s=%02x:%02x:%02x:%02x:%02x:%02x", ext,
1222	0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,	1365	0xfe, 0xfd, 0x80, 0x00, conf->id >> 8,
1223	conf->id & 0xff); putenv (env);	1366	conf->id & 0xff); putenv (env);
1224	}	1367	}
1225		1368
1226	void connection::script_init_connect_env ()	1369	void connection::script_init_connect_env ()
1227	{	1370	{
1228	vpn->script_init_env ();	1371	vpn->script_init_env ();
1229		1372
1230	char *env;	1373	char *env;
1231	asprintf (&env, "DESTID=%d", conf->id); putenv (env);	1374	asprintf (&env, "DESTID=%d", conf->id); putenv (env);
		1375	asprintf (&env, "DESTSI=%s", (const char *)si); putenv (env);
1232	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);	1376	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1233	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);	1377	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1234	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);	1378	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1235	}	1379	}
1236		1380
1237	inline const char *	1381	inline const char *
1238	connection::script_node_up ()	1382	connection::script_node_up ()
1239	{	1383	{
…		…
1249		1393
1250	return filename;	1394	return filename;
1251	}	1395	}
1252		1396
1253	inline const char *	1397	inline const char *
		1398	connection::script_node_change ()
		1399	{
		1400	script_init_connect_env ();
		1401
		1402	putenv ((char *)"STATE=change");
		1403
		1404	char *filename;
		1405	asprintf (&filename,
		1406	"%s/%s",
		1407	confbase,
		1408	::conf.script_node_change ? ::conf.script_node_change : "node-change");
		1409
		1410	return filename;
		1411	}
		1412
		1413	inline const char *
1254	connection::script_node_down ()	1414	connection::script_node_down ()
1255	{	1415	{
1256	script_init_connect_env ();	1416	script_init_connect_env ();
1257		1417
1258	putenv ((char *)"STATE=down");	1418	putenv ((char *)"STATE=down");
…		…
1265		1425
1266	return filename;	1426	return filename;
1267	}	1427	}
1268		1428
1269	connection::connection (struct vpn vpn, conf_node conf)	1429	connection::connection (struct vpn vpn, conf_node conf)
1270	: vpn(vpn), conf(conf)	1430	: vpn(vpn), conf(conf),
1271	#if ENABLE_DNS	1431	#if ENABLE_DNS
1272	, dns (0)	1432	dns (0),
1273	#endif	1433	#endif
		1434	data_queue(conf->max_ttl, conf->max_queue + 1),
		1435	vpn_queue(conf->max_ttl, conf->max_queue + 1)
1274	{	1436	{
1275	rekey .set<connection, &connection::rekey_cb > (this);	1437	rekey .set<connection, &connection::rekey_cb > (this);
1276	keepalive .set<connection, &connection::keepalive_cb > (this);	1438	keepalive .set<connection, &connection::keepalive_cb > (this);
1277	establish_connection.set<connection, &connection::establish_connection_cb> (this);	1439	establish_connection.set<connection, &connection::establish_connection_cb> (this);
1278		1440
		1441	last_establish_attempt = 0.;
1279	octx = ictx = 0;	1442	octx = ictx = 0;
1280	retry_cnt = 0;
1281		1443
1282	if (!conf->protocols) // make sure some protocol is enabled	1444	if (!conf->protocols) // make sure some protocol is enabled
1283	conf->protocols = PROT_UDPv4;	1445	conf->protocols = PROT_UDPv4;
1284		1446
1285	connectmode = conf_node::C_ALWAYS; // initial setting	1447	connectmode = conf->connectmode;
		1448
		1449	// queue a dummy packet to force an initial connection attempt
		1450	if (connectmode != conf_node::C_ALWAYS && connectmode != conf_node::C_DISABLED)
		1451	vpn_queue.put (new net_packet);
		1452
1286	reset_connection ();	1453	reset_connection ();
1287	}	1454	}
1288		1455
1289	connection::~connection ()	1456	connection::~connection ()
1290	{	1457	{

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/connection.C (file contents): Revision 1.66 by pcg, Thu Dec 6 00:35:29 2007 UTC vs. Revision 1.89 by root, Thu Dec 2 08:15:09 2010 UTC

Diff Legend

Comparing gvpe/src/connection.C (file contents):
Revision 1.66 by pcg, Thu Dec 6 00:35:29 2007 UTC vs.
Revision 1.89 by root, Thu Dec 2 08:15:09 2010 UTC