ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.h
(Generate patch)

Comparing gvpe/src/connection.h (file contents):
Revision 1.29 by pcg, Sun Dec 2 00:09:35 2007 UTC vs.
Revision 1.39 by root, Fri Jul 19 18:18:27 2013 UTC

1/* 1/*
2 connection.h -- header for connection.C 2 connection.h -- header for connection.C
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#ifndef GVPE_CONNECTION_H__ 32#ifndef GVPE_CONNECTION_H__
23#define GVPE_CONNECTION_H__ 33#define GVPE_CONNECTION_H__
24 34
… …
27#include "global.h" 37#include "global.h"
28#include "conf.h" 38#include "conf.h"
29#include "sockinfo.h" 39#include "sockinfo.h"
30#include "util.h" 40#include "util.h"
31#include "device.h" 41#include "device.h"
42#include "curve25519.h"
43#include "iv_gen.h"
32 44
33struct vpn; 45struct vpn;
34 46
35// called after HUP etc. to (re-)initialize global data structures 47// called after HUP etc. to (re-)initialize global data structures
36void connection_init (); 48void connection_init ();
37 49
50typedef curve25519_key ecdh_key;
51
38struct rsaid 52struct rsa_data
39{ 53{
40 u8 id[RSA_IDLEN]; // the challenge id 54 u32 seqno; // (ictx) initial sequence nr (31 bits)
55 u8 mac_key[MAC_IKMSIZE]; // (ictx) used to generate hmac key
56 u8 cipher_key[CIPHER_IKMSIZE]; // (ictx) used to generate cipher key
57 u8 hkdf_salt[HKDF_SALT]; // (octx) used as hkdf salt
58 u8 extra_auth[ // (ictx) additional auth randomness
59 (RSABITS >> 3)
60 - RSA_OAEP_SIZE
61 - sizeof (u32) // seqno
62 - MAC_IKMSIZE
63 - CIPHER_IKMSIZE
64 - HKDF_SALT
65 - 3 // struct alignment...
66 ];
41}; 67};
42 68
43typedef rsaclear rsachallenge; // challenge data; 69struct auth_data
44typedef rsacrypt rsaencrdata; // encrypted challenge 70{
45typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash 71 rsa_data rsa;
72 ecdh_key ecdh;
73};
74
75typedef u8 rsa_crypt[RSA_KEYLEN]; // encrypted challenge
76
77struct auth_encr
78{
79 rsa_crypt rsa;
80 ecdh_key ecdh;
81};
82
83typedef u8 auth_mac[AUTH_SIZE];
84
85struct auth_response
86{
87 auth_mac mac;
88 ecdh_key ecdh;
89};
46 90
47//////////////////////////////////////////////////////////////////////////////////////// 91////////////////////////////////////////////////////////////////////////////////////////
48 92
49struct crypto_ctx; 93struct crypto_ctx;
50 94
… …
54 98
55 void hmac_set (crypto_ctx * ctx); 99 void hmac_set (crypto_ctx * ctx);
56 bool hmac_chk (crypto_ctx * ctx); 100 bool hmac_chk (crypto_ctx * ctx);
57 101
58private: 102private:
59 static unsigned char hmac_digest[EVP_MAX_MD_SIZE];
60
61 void hmac_gen (crypto_ctx * ctx); 103 void hmac_gen (crypto_ctx * ctx, u8 *hmac_digest);
62}; 104};
63 105
64struct vpn_packet : hmac_packet 106struct vpn_packet : hmac_packet
65{ 107{
66 enum ptype 108 enum ptype
… …
71 PT_PING, PT_PONG, // wasting namespace space? ;) 113 PT_PING, PT_PONG, // wasting namespace space? ;)
72 PT_AUTH_REQ, // authentification request 114 PT_AUTH_REQ, // authentification request
73 PT_AUTH_RES, // authentification response 115 PT_AUTH_RES, // authentification response
74 PT_CONNECT_REQ, // want other node to contact me 116 PT_CONNECT_REQ, // want other node to contact me
75 PT_CONNECT_INFO, // request connection to some node 117 PT_CONNECT_INFO, // request connection to some node
76 PT_DATA_BRIDGED, // uncompressed packet with foreign mac pot. larger than path mtu 118 PT_DATA_BRIDGED, // uncompressed packet with foreign mac pot. larger than path mtu (NYI)
77 PT_MAX 119 PT_MAX
78 }; 120 };
79 121
80 u8 type; 122 u8 type;
81 u8 srcdst, src1, dst1; 123 u8 srcdst, src1, dst1;
… …
101//////////////////////////////////////////////////////////////////////////////////////// 143////////////////////////////////////////////////////////////////////////////////////////
102 144
103// a very simple fifo pkt-queue 145// a very simple fifo pkt-queue
104class pkt_queue 146class pkt_queue
105{ 147{
106 net_packet *queue[QUEUEDEPTH];
107 int i, j; 148 int i, j;
149 int max_queue;
150 double max_ttl;
151
152 struct pkt {
153 ev_tstamp tstamp;
154 net_packet *pkt;
155 } *queue;
156
157 void expire_cb (ev::timer &w, int revents); ev::timer expire;
108 158
109public: 159public:
110 160
111 void put (net_packet *p); 161 void put (net_packet *p);
112 net_packet *get (); 162 net_packet *get ();
113 163
114 pkt_queue (); 164 bool empty ()
165 {
166 return i == j;
167 }
168
169 pkt_queue (double max_ttl, int max_queue);
115 ~pkt_queue (); 170 ~pkt_queue ();
116}; 171};
117 172
118enum 173enum
119{ 174{
… …
129 184
130 sockinfo si; // the current(!) destination ip to send packets to 185 sockinfo si; // the current(!) destination ip to send packets to
131 int retry_cnt; 186 int retry_cnt;
132 187
133 tstamp last_activity; // time of last packet received 188 tstamp last_activity; // time of last packet received
189 tstamp last_establish_attempt;
190 //tstamp last_si_change; // time we last changed the socket address
134 191
135 u32 oseqno; 192 u32 oseqno;
136 sliding_window iseqno; 193 sliding_window iseqno;
137 194
138 u8 protocol; 195 u8 protocol;
139 u8 features; 196 u8 features;
197 bool is_direct; // current connection (si) is direct?
140 198
141 pkt_queue data_queue, vpn_queue; 199 pkt_queue data_queue, vpn_queue;
142 200
143 crypto_ctx *octx, *ictx; 201 crypto_ctx *octx, *ictx;
202 iv_gen oiv; // generator for random byte prefix
203
204 void generate_auth_data ();
205
206 ev_tstamp auth_expire; // when the snd_* and *_ecdh values expire
207
208 // send auth data - used for octx
209 auth_data snd_auth;
210 ecdh_key snd_ecdh_a; // the secret ecdh key we used for our request
211 ecdh_key snd_ecdh_b; // the public ecdh key we received in the response
212 bool have_snd_auth; // received response for our req
213
214 // receive auth data - used for ictx
215 auth_data rcv_auth;
216 ecdh_key rcv_ecdh_a; // the secret ecdh key we used for our response
217 ecdh_key rcv_ecdh_b; // the public ecdh key we sent in our response
218 bool have_rcv_auth; // received auth from other side
144 219
145#if ENABLE_DNS 220#if ENABLE_DNS
146 struct dns_connection *dns; 221 struct dns_connection *dns;
147
148 void dnsv4_reset_connection ();
149#endif 222#endif
150 223
151 enum conf_node::connectmode connectmode; 224 enum conf_node::connectmode connectmode;
152 u8 prot_minor; // minor number of other side 225 u8 prot_minor; // minor number of other side
153 226
154 void reset_si (); 227 void reset_si ();
155 const sockinfo &forward_si (const sockinfo &si) const; 228 const sockinfo &forward_si (const sockinfo &si) const;
156 229
157 void shutdown (); 230 void shutdown ();
158 void connection_established (); 231 void connection_established (const sockinfo &rsi);
159 void reset_connection (); 232 void reset_connection ();
160 233
161 void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection; 234 void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection;
162 void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekying (actually current reset + reestablishing) 235 void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekying (actually current reset + reestablishing)
163 void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe 236 void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe
164 237
165 void send_connect_request (int id); 238 void send_connect_request (int id);
166 void send_auth_request (const sockinfo &si, bool initiate); 239 void send_auth_request (const sockinfo &si, bool initiate);
167 void send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg); 240 void send_auth_response (const sockinfo &si);
168 void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); 241 void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols);
169 void send_reset (const sockinfo &dsi); 242 void send_reset (const sockinfo &dsi);
170 void send_ping (const sockinfo &dsi, u8 pong = 0); 243 void send_ping (const sockinfo &dsi, u8 pong = 0);
171 void send_data_packet (tap_packet *pkt); 244 void send_data_packet (tap_packet *pkt);
172 245
246 void post_inject_queue ();
173 void inject_data_packet (tap_packet *pkt, bool broadcast = false); 247 void inject_data_packet (tap_packet *pkt);
174 void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding 248 void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding
175 249
176 void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi); 250 void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi);
177 void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); 251 void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0);
178 252
179 void script_init_env (const char *ext); 253 void script_init_env (const char *ext);
180 void script_init_connect_env (); 254 void script_init_connect_env ();
181 const char *script_node_up (); 255 const char *script_node_up ();
256 const char *script_node_change ();
182 const char *script_node_down (); 257 const char *script_node_down ();
183 258
184 void dump_status (); 259 void dump_status ();
185 260
186 connection (struct vpn *vpn, conf_node *conf); 261 connection (struct vpn *vpn, conf_node *conf);

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines