--- gvpe/src/connection.h 2005/03/04 04:52:38 1.19 +++ gvpe/src/connection.h 2013/10/11 04:07:24 1.40 @@ -1,26 +1,36 @@ /* connection.h -- header for connection.C - Copyright (C) 2003-2005 Marc Lehmann + Copyright (C) 2003-2008,2013 Marc Lehmann This file is part of GVPE. - GVPE is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with gvpe; if not, write to the Free Software - Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + GVPE is free software; you can redistribute it and/or modify it + under the terms of the GNU General Public License as published by the + Free Software Foundation; either version 3 of the License, or (at your + option) any later version. + + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General + Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, see . + + Additional permission under GNU GPL version 3 section 7 + + If you modify this Program, or any covered work, by linking or + combining it with the OpenSSL project's OpenSSL library (or a modified + version of that library), containing parts covered by the terms of the + OpenSSL or SSLeay licenses, the licensors of this Program grant you + additional permission to convey the resulting work. Corresponding + Source for a non-source form of such a combination shall include the + source code for the parts of OpenSSL used as well as that of the + covered work. */ -#ifndef VPE_CONNECTION_H__ -#define VPE_CONNECTION_H__ +#ifndef GVPE_CONNECTION_H__ +#define GVPE_CONNECTION_H__ #include @@ -29,19 +39,54 @@ #include "sockinfo.h" #include "util.h" #include "device.h" +#include "curve25519.h" +#include "iv_gen.h" struct vpn; // called after HUP etc. to (re-)initialize global data structures void connection_init (); -struct rsaid { - u8 id[RSA_IDLEN]; // the challenge id +typedef curve25519_key ecdh_key; + +struct rsa_data +{ + u32 seqno; // (ictx) initial sequence nr (31 bits) + u8 mac_key[MAC_IKMSIZE]; // (ictx) used to generate hmac key + u8 cipher_key[CIPHER_IKMSIZE]; // (ictx) used to generate cipher key + u8 hkdf_salt[HKDF_SALT]; // (octx) used as hkdf salt + u8 extra_auth[ // (ictx) additional auth randomness + (RSABITS >> 3) + - RSA_OAEP_SIZE + - sizeof (u32) // seqno + - MAC_IKMSIZE + - CIPHER_IKMSIZE + - HKDF_SALT + - 3 // struct alignment... + ]; +}; + +struct auth_data +{ + rsa_data rsa; + ecdh_key ecdh; +}; + +typedef u8 rsa_crypt[RSA_KEYLEN]; // encrypted challenge + +struct auth_encr +{ + rsa_crypt rsa; + ecdh_key ecdh; }; -typedef rsaclear rsachallenge; // challenge data; -typedef rsacrypt rsaencrdata; // encrypted challenge -typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash +typedef u8 auth_mac[AUTH_SIZE]; + +struct auth_response +{ + auth_mac mac; + ecdh_key ecdh; +}; //////////////////////////////////////////////////////////////////////////////////////// @@ -55,133 +100,167 @@ bool hmac_chk (crypto_ctx * ctx); private: - static unsigned char hmac_digest[EVP_MAX_MD_SIZE]; - - void hmac_gen (crypto_ctx * ctx); + void hmac_gen (crypto_ctx * ctx, u8 *hmac_digest); }; struct vpn_packet : hmac_packet +{ + enum ptype { - enum ptype - { - PT_RESET = 0, - PT_DATA_UNCOMPRESSED, - PT_DATA_COMPRESSED, - PT_PING, PT_PONG, // wasting namespace space? ;) - PT_AUTH_REQ, // authentification request - PT_AUTH_RES, // authentification response - PT_CONNECT_REQ, // want other host to contact me - PT_CONNECT_INFO, // request connection to some node - PT_MAX - }; - - u8 type; - u8 srcdst, src1, dst1; - - void set_hdr (ptype type_, unsigned int dst); - - unsigned int src () const - { - return src1 | ((srcdst >> 4) << 8); - } - - unsigned int dst () const - { - return dst1 | ((srcdst & 0xf) << 8); - } - - ptype typ () const - { - return (ptype) type; - } + PT_RESET = 0, + PT_DATA_UNCOMPRESSED, + PT_DATA_COMPRESSED, + PT_PING, PT_PONG, // wasting namespace space? ;) + PT_AUTH_REQ, // authentification request + PT_AUTH_RES, // authentification response + PT_CONNECT_REQ, // want other node to contact me + PT_CONNECT_INFO, // request connection to some node + PT_DATA_BRIDGED, // uncompressed packet with foreign mac pot. larger than path mtu (NYI) + PT_MAX }; + u8 type; + u8 srcdst, src1, dst1; + + void set_hdr (ptype type_, unsigned int dst); + + unsigned int src () const + { + return src1 | ((srcdst >> 4) << 8); + } + + unsigned int dst () const + { + return dst1 | ((srcdst & 0xf) << 8); + } + + ptype typ () const + { + return (ptype) type; + } +}; + //////////////////////////////////////////////////////////////////////////////////////// // a very simple fifo pkt-queue class pkt_queue - { - net_packet *queue[QUEUEDEPTH]; - int i, j; +{ + int i, j; + int max_queue; + double max_ttl; - public: + struct pkt { + ev_tstamp tstamp; + net_packet *pkt; + } *queue; - void put (net_packet *p); - net_packet *get (); + void expire_cb (ev::timer &w, int revents); ev::timer expire; - pkt_queue (); - ~pkt_queue (); - }; +public: -enum + void put (net_packet *p); + net_packet *get (); + + bool empty () { - FEATURE_COMPRESSION = 0x01, - FEATURE_ROHC = 0x02, - }; + return i == j; + } + + pkt_queue (double max_ttl, int max_queue); + ~pkt_queue (); +}; + +enum +{ + FEATURE_COMPRESSION = 0x01, + FEATURE_ROHC = 0x02, + FEATURE_BRIDGING = 0x04, +}; struct connection - { - conf_node *conf; - struct vpn *vpn; +{ + conf_node *conf; + struct vpn *vpn; - sockinfo si; // the current(!) destination ip to send packets to - int retry_cnt; + sockinfo si; // the current(!) destination ip to send packets to + int retry_cnt; - tstamp last_activity; // time of last packet received + tstamp last_activity; // time of last packet received + tstamp last_establish_attempt; + //tstamp last_si_change; // time we last changed the socket address - u32 oseqno; - sliding_window iseqno; + u32 oseqno; + sliding_window iseqno; - u8 protocol; - u8 features; + u8 protocol; + u8 features; - pkt_queue data_queue, vpn_queue; + pkt_queue data_queue, vpn_queue; - crypto_ctx *octx, *ictx; + crypto_ctx *octx, *ictx; + iv_gen oiv; // generator for random byte prefix -#if ENABLE_DNS - struct dns_connection *dns; + void generate_auth_data (); + + ev_tstamp auth_expire; // when the snd_* and *_ecdh values expire + ev_tstamp hmac_error; // time of first hmac error in a series - bool send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos); + // send auth data - used for octx + auth_data snd_auth; + ecdh_key snd_ecdh_a; // the secret ecdh key we used for our request + ecdh_key snd_ecdh_b; // the public ecdh key we received in the response + bool have_snd_auth; // received response for our req + + // receive auth data - used for ictx + auth_data rcv_auth; + ecdh_key rcv_ecdh_a; // the secret ecdh key we used for our response + ecdh_key rcv_ecdh_b; // the public ecdh key we sent in our response + bool have_rcv_auth; // received auth from other side + +#if ENABLE_DNS + struct dns_connection *dns; #endif - enum conf_node::connectmode connectmode; - u8 prot_minor; // minor number of other side + enum conf_node::connectmode connectmode; + u8 prot_minor; // minor number of other side - void reset_si (); - const sockinfo &forward_si (const sockinfo &si) const; + void reset_si (); + const sockinfo &forward_si (const sockinfo &si) const; - void shutdown (); - void connection_established (); - void reset_connection (); - - void establish_connection_cb (time_watcher &w); time_watcher establish_connection; - void rekey_cb (time_watcher &w); time_watcher rekey; // next rekying (actually current reset + reestablishing) - void keepalive_cb (time_watcher &w); time_watcher keepalive; // next keepalive probe - - void send_connect_request (int id); - void send_auth_request (const sockinfo &si, bool initiate); - void send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg); - void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); - void send_reset (const sockinfo &dsi); - void send_ping (const sockinfo &dsi, u8 pong = 0); - void send_data_packet (tap_packet *pkt); - - void inject_data_packet (tap_packet *pkt, bool broadcast = false); - void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding - - void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); - void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi); - - void script_node (); - const char *script_node_up (); - const char *script_node_down (); + void shutdown (); + void connection_established (const sockinfo &rsi); + void reset_connection (const char *reason); + + void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection; + void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekeying (actually current reset + reestablishing) + void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe + + void send_connect_request (int id); + void send_auth_request (const sockinfo &si, bool initiate); + void send_auth_response (const sockinfo &si); + void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); + void send_reset (const sockinfo &dsi); + void send_ping (const sockinfo &dsi, u8 pong = 0); + void send_data_packet (tap_packet *pkt); + + void post_inject_queue (); + void inject_data_packet (tap_packet *pkt); + void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding + + void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi); + void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); + + void script_init_env (const char *ext); + void script_init_connect_env (); + const char *script_node_up (); + const char *script_node_change (); + const char *script_node_down (); - void dump_status (); + void dump_status (); - connection (struct vpn *vpn, conf_node *conf); - ~connection (); - }; + connection (struct vpn *vpn, conf_node *conf); + ~connection (); +}; #endif