1 | /* |
1 | /* |
2 | connection.h -- header for connection.C |
2 | connection.h -- header for connection.C |
|
|
3 | Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de> |
3 | |
4 | |
|
|
5 | This file is part of GVPE. |
|
|
6 | |
4 | This program is free software; you can redistribute it and/or modify |
7 | GVPE is free software; you can redistribute it and/or modify it |
5 | it under the terms of the GNU General Public License as published by |
8 | under the terms of the GNU General Public License as published by the |
6 | the Free Software Foundation; either version 2 of the License, or |
9 | Free Software Foundation; either version 3 of the License, or (at your |
7 | (at your option) any later version. |
10 | option) any later version. |
8 | |
11 | |
9 | This program is distributed in the hope that it will be useful, |
12 | This program is distributed in the hope that it will be useful, but |
10 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | WITHOUT ANY WARRANTY; without even the implied warranty of |
11 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General |
12 | GNU General Public License for more details. |
15 | Public License for more details. |
13 | |
16 | |
14 | You should have received a copy of the GNU General Public License |
17 | You should have received a copy of the GNU General Public License along |
15 | along with this program; if not, write to the Free Software |
18 | with this program; if not, see <http://www.gnu.org/licenses/>. |
16 | Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
19 | |
|
|
20 | Additional permission under GNU GPL version 3 section 7 |
|
|
21 | |
|
|
22 | If you modify this Program, or any covered work, by linking or |
|
|
23 | combining it with the OpenSSL project's OpenSSL library (or a modified |
|
|
24 | version of that library), containing parts covered by the terms of the |
|
|
25 | OpenSSL or SSLeay licenses, the licensors of this Program grant you |
|
|
26 | additional permission to convey the resulting work. Corresponding |
|
|
27 | Source for a non-source form of such a combination shall include the |
|
|
28 | source code for the parts of OpenSSL used as well as that of the |
|
|
29 | covered work. |
17 | */ |
30 | */ |
18 | |
31 | |
19 | #ifndef VPE_CONNECTION_H__ |
32 | #ifndef GVPE_CONNECTION_H__ |
20 | #define VPE_CONNECTION_H__ |
33 | #define GVPE_CONNECTION_H__ |
21 | |
|
|
22 | #include <netinet/ip.h> // for tos etc. |
|
|
23 | |
34 | |
24 | #include <openssl/hmac.h> |
35 | #include <openssl/hmac.h> |
25 | |
36 | |
26 | #include "global.h" |
37 | #include "global.h" |
27 | #include "conf.h" |
38 | #include "conf.h" |
… | |
… | |
32 | struct vpn; |
43 | struct vpn; |
33 | |
44 | |
34 | // called after HUP etc. to (re-)initialize global data structures |
45 | // called after HUP etc. to (re-)initialize global data structures |
35 | void connection_init (); |
46 | void connection_init (); |
36 | |
47 | |
37 | struct rsaid { |
48 | struct rsaid |
|
|
49 | { |
38 | u8 id[RSA_IDLEN]; // the challenge id |
50 | u8 id[RSA_IDLEN]; // the challenge id |
39 | }; |
51 | }; |
40 | |
52 | |
41 | typedef u8 rsachallenge[RSA_KEYLEN - RSA_OVERHEAD]; // challenge data; |
53 | typedef rsaclear rsachallenge; // challenge data; |
42 | typedef u8 rsaencrdata[RSA_KEYLEN]; // encrypted challenge |
54 | typedef rsacrypt rsaencrdata; // encrypted challenge |
43 | typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash |
55 | typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash |
44 | |
56 | |
45 | //////////////////////////////////////////////////////////////////////////////////////// |
57 | //////////////////////////////////////////////////////////////////////////////////////// |
46 | |
58 | |
47 | struct crypto_ctx; |
59 | struct crypto_ctx; |
48 | |
60 | |
49 | struct hmac_packet:net_packet |
61 | struct hmac_packet : net_packet |
50 | { |
62 | { |
51 | u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere |
63 | u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere |
52 | |
64 | |
53 | void hmac_set (crypto_ctx * ctx); |
65 | void hmac_set (crypto_ctx * ctx); |
54 | bool hmac_chk (crypto_ctx * ctx); |
66 | bool hmac_chk (crypto_ctx * ctx); |
… | |
… | |
58 | |
70 | |
59 | void hmac_gen (crypto_ctx * ctx); |
71 | void hmac_gen (crypto_ctx * ctx); |
60 | }; |
72 | }; |
61 | |
73 | |
62 | struct vpn_packet : hmac_packet |
74 | struct vpn_packet : hmac_packet |
63 | { |
75 | { |
64 | enum ptype |
76 | enum ptype |
65 | { |
77 | { |
66 | PT_RESET = 0, |
78 | PT_RESET = 0, |
67 | PT_DATA_UNCOMPRESSED, |
79 | PT_DATA_UNCOMPRESSED, |
68 | PT_DATA_COMPRESSED, |
80 | PT_DATA_COMPRESSED, |
69 | PT_PING, PT_PONG, // wasting namespace space? ;) |
81 | PT_PING, PT_PONG, // wasting namespace space? ;) |
70 | PT_AUTH_REQ, // authentification request |
82 | PT_AUTH_REQ, // authentification request |
71 | PT_AUTH_RES, // authentification response |
83 | PT_AUTH_RES, // authentification response |
72 | PT_CONNECT_REQ, // want other host to contact me |
84 | PT_CONNECT_REQ, // want other node to contact me |
73 | PT_CONNECT_INFO, // request connection to some node |
85 | PT_CONNECT_INFO, // request connection to some node |
|
|
86 | PT_DATA_BRIDGED, // uncompressed packet with foreign mac pot. larger than path mtu (NYI) |
74 | PT_MAX |
87 | PT_MAX |
75 | }; |
|
|
76 | |
|
|
77 | u8 type; |
|
|
78 | u8 srcdst, src1, dst1; |
|
|
79 | |
|
|
80 | void set_hdr (ptype type, unsigned int dst); |
|
|
81 | |
|
|
82 | unsigned int src () const |
|
|
83 | { |
|
|
84 | return src1 | ((srcdst >> 4) << 8); |
|
|
85 | } |
|
|
86 | |
|
|
87 | unsigned int dst () const |
|
|
88 | { |
|
|
89 | return dst1 | ((srcdst & 0xf) << 8); |
|
|
90 | } |
|
|
91 | |
|
|
92 | ptype typ () const |
|
|
93 | { |
|
|
94 | return (ptype) type; |
|
|
95 | } |
|
|
96 | }; |
88 | }; |
|
|
89 | |
|
|
90 | u8 type; |
|
|
91 | u8 srcdst, src1, dst1; |
|
|
92 | |
|
|
93 | void set_hdr (ptype type_, unsigned int dst); |
|
|
94 | |
|
|
95 | unsigned int src () const |
|
|
96 | { |
|
|
97 | return src1 | ((srcdst >> 4) << 8); |
|
|
98 | } |
|
|
99 | |
|
|
100 | unsigned int dst () const |
|
|
101 | { |
|
|
102 | return dst1 | ((srcdst & 0xf) << 8); |
|
|
103 | } |
|
|
104 | |
|
|
105 | ptype typ () const |
|
|
106 | { |
|
|
107 | return (ptype) type; |
|
|
108 | } |
|
|
109 | }; |
97 | |
110 | |
98 | //////////////////////////////////////////////////////////////////////////////////////// |
111 | //////////////////////////////////////////////////////////////////////////////////////// |
99 | |
112 | |
100 | // a very simple fifo pkt-queue |
113 | // a very simple fifo pkt-queue |
101 | class pkt_queue |
114 | class pkt_queue |
102 | { |
115 | { |
103 | tap_packet *queue[QUEUEDEPTH]; |
|
|
104 | int i, j; |
116 | int i, j; |
|
|
117 | int max_queue; |
|
|
118 | double max_ttl; |
105 | |
119 | |
|
|
120 | struct pkt { |
|
|
121 | ev_tstamp tstamp; |
|
|
122 | net_packet *pkt; |
|
|
123 | } *queue; |
|
|
124 | |
|
|
125 | void expire_cb (ev::timer &w, int revents); ev::timer expire; |
|
|
126 | |
106 | public: |
127 | public: |
107 | |
128 | |
108 | void put (tap_packet *p); |
129 | void put (net_packet *p); |
109 | tap_packet *get (); |
130 | net_packet *get (); |
110 | |
131 | |
111 | pkt_queue (); |
132 | bool empty () |
|
|
133 | { |
|
|
134 | return i == j; |
|
|
135 | } |
|
|
136 | |
|
|
137 | pkt_queue (double max_ttl, int max_queue); |
112 | ~pkt_queue (); |
138 | ~pkt_queue (); |
113 | }; |
139 | }; |
|
|
140 | |
|
|
141 | enum |
|
|
142 | { |
|
|
143 | FEATURE_COMPRESSION = 0x01, |
|
|
144 | FEATURE_ROHC = 0x02, |
|
|
145 | FEATURE_BRIDGING = 0x04, |
|
|
146 | }; |
114 | |
147 | |
115 | struct connection |
148 | struct connection |
116 | { |
149 | { |
117 | conf_node *conf; |
150 | conf_node *conf; |
118 | struct vpn *vpn; |
151 | struct vpn *vpn; |
119 | |
152 | |
120 | sockinfo si; // the current(!) destination ip to send packets to |
153 | sockinfo si; // the current(!) destination ip to send packets to |
121 | int retry_cnt; |
154 | int retry_cnt; |
122 | |
155 | |
123 | tstamp last_activity; // time of last packet received |
156 | tstamp last_activity; // time of last packet received |
|
|
157 | tstamp last_establish_attempt; |
|
|
158 | //tstamp last_si_change; // time we last changed the socket address |
124 | |
159 | |
125 | u32 oseqno; |
160 | u32 oseqno; |
126 | sliding_window iseqno; |
161 | sliding_window iseqno; |
127 | |
162 | |
128 | u8 protocol; |
163 | u8 protocol; |
|
|
164 | u8 features; |
|
|
165 | bool is_direct; // current connection (si) is direct? |
129 | |
166 | |
130 | pkt_queue queue; |
167 | pkt_queue data_queue, vpn_queue; |
131 | |
168 | |
132 | crypto_ctx *octx, *ictx; |
169 | crypto_ctx *octx, *ictx; |
133 | |
170 | |
134 | enum conf_node::connectmode connectmode; |
171 | #if ENABLE_DNS |
135 | u8 prot_minor; // minor number of other side |
172 | struct dns_connection *dns; |
136 | |
173 | |
137 | void reset_dstaddr (); |
|
|
138 | |
|
|
139 | void shutdown (); |
|
|
140 | void reset_connection (); |
174 | void dnsv4_reset_connection (); |
141 | void establish_connection_cb (tstamp &ts); time_watcher establish_connection; |
|
|
142 | void rekey_cb (tstamp &ts); time_watcher rekey; // next rekying (actually current reset + reestablishing) |
|
|
143 | void keepalive_cb (tstamp &ts); time_watcher keepalive; // next keepalive probe |
|
|
144 | |
|
|
145 | void send_auth_request (const sockinfo &si, bool initiate); |
|
|
146 | void send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg); |
|
|
147 | void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); |
|
|
148 | void send_reset (const sockinfo &dsi); |
|
|
149 | void send_ping (const sockinfo &dsi, u8 pong = 0); |
|
|
150 | void send_data_packet (tap_packet *pkt, bool broadcast = false); |
|
|
151 | void inject_data_packet (tap_packet *pkt, bool broadcast = false); |
|
|
152 | void connect_request (int id); |
|
|
153 | |
|
|
154 | void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = IPTOS_RELIABILITY); |
|
|
155 | void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi); |
|
|
156 | |
|
|
157 | void script_node (); |
|
|
158 | const char *script_node_up (int); |
|
|
159 | const char *script_node_down (int); |
|
|
160 | |
|
|
161 | void dump_status (); |
|
|
162 | |
|
|
163 | connection(struct vpn *vpn_); |
|
|
164 | ~connection (); |
|
|
165 | }; |
|
|
166 | |
|
|
167 | #endif |
175 | #endif |
168 | |
176 | |
|
|
177 | enum conf_node::connectmode connectmode; |
|
|
178 | u8 prot_minor; // minor number of other side |
|
|
179 | |
|
|
180 | void reset_si (); |
|
|
181 | const sockinfo &forward_si (const sockinfo &si) const; |
|
|
182 | |
|
|
183 | void shutdown (); |
|
|
184 | void connection_established (); |
|
|
185 | void reset_connection (); |
|
|
186 | |
|
|
187 | void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection; |
|
|
188 | void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekying (actually current reset + reestablishing) |
|
|
189 | void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe |
|
|
190 | |
|
|
191 | void send_connect_request (int id); |
|
|
192 | void send_auth_request (const sockinfo &si, bool initiate); |
|
|
193 | void send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg); |
|
|
194 | void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); |
|
|
195 | void send_reset (const sockinfo &dsi); |
|
|
196 | void send_ping (const sockinfo &dsi, u8 pong = 0); |
|
|
197 | void send_data_packet (tap_packet *pkt); |
|
|
198 | |
|
|
199 | void post_inject_queue (); |
|
|
200 | void inject_data_packet (tap_packet *pkt); |
|
|
201 | void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding |
|
|
202 | |
|
|
203 | void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi); |
|
|
204 | void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); |
|
|
205 | |
|
|
206 | void script_init_env (const char *ext); |
|
|
207 | void script_init_connect_env (); |
|
|
208 | const char *script_node_up (); |
|
|
209 | const char *script_node_change (); |
|
|
210 | const char *script_node_down (); |
|
|
211 | |
|
|
212 | void dump_status (); |
|
|
213 | |
|
|
214 | connection (struct vpn *vpn, conf_node *conf); |
|
|
215 | ~connection (); |
|
|
216 | }; |
|
|
217 | |
|
|
218 | #endif |
|
|
219 | |