1 | /* |
1 | /* |
2 | connection.h -- header for connection.C |
2 | connection.h -- header for connection.C |
3 | Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> |
3 | Copyright (C) 2003-2008,2013 Marc Lehmann <gvpe@schmorp.de> |
4 | |
4 | |
5 | This file is part of GVPE. |
5 | This file is part of GVPE. |
6 | |
6 | |
7 | GVPE is free software; you can redistribute it and/or modify |
7 | GVPE is free software; you can redistribute it and/or modify it |
8 | it under the terms of the GNU General Public License as published by |
8 | under the terms of the GNU General Public License as published by the |
9 | the Free Software Foundation; either version 2 of the License, or |
9 | Free Software Foundation; either version 3 of the License, or (at your |
10 | (at your option) any later version. |
10 | option) any later version. |
11 | |
11 | |
12 | This program is distributed in the hope that it will be useful, |
12 | This program is distributed in the hope that it will be useful, but |
13 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | WITHOUT ANY WARRANTY; without even the implied warranty of |
14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General |
15 | GNU General Public License for more details. |
15 | Public License for more details. |
16 | |
16 | |
17 | You should have received a copy of the GNU General Public License |
17 | You should have received a copy of the GNU General Public License along |
18 | along with gvpe; if not, write to the Free Software |
18 | with this program; if not, see <http://www.gnu.org/licenses/>. |
19 | Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
19 | |
|
|
20 | Additional permission under GNU GPL version 3 section 7 |
|
|
21 | |
|
|
22 | If you modify this Program, or any covered work, by linking or |
|
|
23 | combining it with the OpenSSL project's OpenSSL library (or a modified |
|
|
24 | version of that library), containing parts covered by the terms of the |
|
|
25 | OpenSSL or SSLeay licenses, the licensors of this Program grant you |
|
|
26 | additional permission to convey the resulting work. Corresponding |
|
|
27 | Source for a non-source form of such a combination shall include the |
|
|
28 | source code for the parts of OpenSSL used as well as that of the |
|
|
29 | covered work. |
20 | */ |
30 | */ |
21 | |
31 | |
22 | #ifndef GVPE_CONNECTION_H__ |
32 | #ifndef GVPE_CONNECTION_H__ |
23 | #define GVPE_CONNECTION_H__ |
33 | #define GVPE_CONNECTION_H__ |
24 | |
34 | |
… | |
… | |
27 | #include "global.h" |
37 | #include "global.h" |
28 | #include "conf.h" |
38 | #include "conf.h" |
29 | #include "sockinfo.h" |
39 | #include "sockinfo.h" |
30 | #include "util.h" |
40 | #include "util.h" |
31 | #include "device.h" |
41 | #include "device.h" |
|
|
42 | #include "curve25519.h" |
32 | |
43 | |
33 | struct vpn; |
44 | struct vpn; |
34 | |
45 | |
35 | // called after HUP etc. to (re-)initialize global data structures |
46 | // called after HUP etc. to (re-)initialize global data structures |
36 | void connection_init (); |
47 | void connection_init (); |
37 | |
48 | |
|
|
49 | typedef curve25519_key ecdh_key; |
|
|
50 | |
38 | struct rsaid |
51 | struct rsa_data |
39 | { |
52 | { |
40 | u8 id[RSA_IDLEN]; // the challenge id |
53 | u32 seqno; |
|
|
54 | u8 auth_key[AUTH_SIZE]; |
|
|
55 | u8 mac_key[MAC_KEYSIZE]; // used to generate hmac key |
|
|
56 | u8 cipher_key[CIPHER_KEYSIZE]; // used to generate cipher key |
|
|
57 | u8 hkdf_salt[HKDF_SALT]; // used as hkdf salt |
|
|
58 | u8 ikm[IKM_SIZE]; // used as additional keying material for both sides |
|
|
59 | u8 pad[ |
|
|
60 | (RSABITS >> 3) |
|
|
61 | - 41 // OAEP |
|
|
62 | - sizeof (u32) // seqno |
|
|
63 | - AUTH_SIZE |
|
|
64 | - MAC_KEYSIZE |
|
|
65 | - CIPHER_KEYSIZE |
|
|
66 | - HKDF_SALT |
|
|
67 | - IKM_SIZE |
|
|
68 | - 3 // struct alignment... |
|
|
69 | ]; |
41 | }; |
70 | }; |
42 | |
71 | |
43 | typedef rsaclear rsachallenge; // challenge data; |
72 | struct auth_data |
44 | typedef rsacrypt rsaencrdata; // encrypted challenge |
73 | { |
45 | typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash |
74 | rsa_data rsa; |
|
|
75 | ecdh_key ecdh; |
|
|
76 | }; |
|
|
77 | |
|
|
78 | typedef u8 rsa_crypt[RSA_KEYLEN]; // encrypted challenge |
|
|
79 | |
|
|
80 | struct auth_encr |
|
|
81 | { |
|
|
82 | rsa_crypt rsa; |
|
|
83 | ecdh_key ecdh; |
|
|
84 | }; |
|
|
85 | |
|
|
86 | typedef u8 auth_mac[AUTH_SIZE]; |
|
|
87 | |
|
|
88 | struct auth_response |
|
|
89 | { |
|
|
90 | auth_mac mac; |
|
|
91 | ecdh_key ecdh; |
|
|
92 | }; |
46 | |
93 | |
47 | //////////////////////////////////////////////////////////////////////////////////////// |
94 | //////////////////////////////////////////////////////////////////////////////////////// |
48 | |
95 | |
49 | struct crypto_ctx; |
96 | struct crypto_ctx; |
50 | |
97 | |
… | |
… | |
142 | |
189 | |
143 | sockinfo si; // the current(!) destination ip to send packets to |
190 | sockinfo si; // the current(!) destination ip to send packets to |
144 | int retry_cnt; |
191 | int retry_cnt; |
145 | |
192 | |
146 | tstamp last_activity; // time of last packet received |
193 | tstamp last_activity; // time of last packet received |
147 | tstamp last_establish_attempt; |
194 | tstamp last_establish_attempt; |
|
|
195 | //tstamp last_si_change; // time we last changed the socket address |
148 | |
196 | |
149 | u32 oseqno; |
197 | u32 oseqno; |
150 | sliding_window iseqno; |
198 | sliding_window iseqno; |
151 | |
199 | |
152 | u8 protocol; |
200 | u8 protocol; |
153 | u8 features; |
201 | u8 features; |
|
|
202 | bool is_direct; // current connection (si) is direct? |
154 | |
203 | |
155 | pkt_queue data_queue, vpn_queue; |
204 | pkt_queue data_queue, vpn_queue; |
156 | |
205 | |
157 | crypto_ctx *octx, *ictx; |
206 | crypto_ctx *octx, *ictx; |
|
|
207 | |
|
|
208 | void generate_auth_data (); |
|
|
209 | |
|
|
210 | ev_tstamp auth_expire; // when the snd_* and *_ecdh values expire |
|
|
211 | |
|
|
212 | // send auth data - used for octx |
|
|
213 | auth_data snd_auth; |
|
|
214 | auth_mac snd_auth_mac; // expected response mac |
|
|
215 | ecdh_key snd_ecdh_a; // the secret ecdh key we used for our request |
|
|
216 | ecdh_key snd_ecdh_b; // the public ecdh key we received in the response |
|
|
217 | bool have_snd_auth; // received response for our req |
|
|
218 | |
|
|
219 | // receive auth data - used for ictx |
|
|
220 | auth_data rcv_auth; |
|
|
221 | ecdh_key rcv_ecdh_a; // the secret ecdh key we used for our response |
|
|
222 | ecdh_key rcv_ecdh_b; // the public ecdh key we sent in our response |
|
|
223 | bool have_rcv_auth; // received auth from other side |
158 | |
224 | |
159 | #if ENABLE_DNS |
225 | #if ENABLE_DNS |
160 | struct dns_connection *dns; |
226 | struct dns_connection *dns; |
161 | |
|
|
162 | void dnsv4_reset_connection (); |
|
|
163 | #endif |
227 | #endif |
164 | |
228 | |
165 | enum conf_node::connectmode connectmode; |
229 | enum conf_node::connectmode connectmode; |
166 | u8 prot_minor; // minor number of other side |
230 | u8 prot_minor; // minor number of other side |
167 | |
231 | |
168 | void reset_si (); |
232 | void reset_si (); |
169 | const sockinfo &forward_si (const sockinfo &si) const; |
233 | const sockinfo &forward_si (const sockinfo &si) const; |
170 | |
234 | |
171 | void shutdown (); |
235 | void shutdown (); |
172 | void connection_established (); |
236 | void connection_established (const sockinfo &rsi); |
173 | void reset_connection (); |
237 | void reset_connection (); |
174 | |
238 | |
175 | void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection; |
239 | void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection; |
176 | void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekying (actually current reset + reestablishing) |
240 | void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekying (actually current reset + reestablishing) |
177 | void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe |
241 | void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe |
178 | |
242 | |
179 | void send_connect_request (int id); |
243 | void send_connect_request (int id); |
180 | void send_auth_request (const sockinfo &si, bool initiate); |
244 | void send_auth_request (const sockinfo &si, bool initiate); |
181 | void send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg); |
245 | void send_auth_response (const sockinfo &si); |
182 | void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); |
246 | void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); |
183 | void send_reset (const sockinfo &dsi); |
247 | void send_reset (const sockinfo &dsi); |
184 | void send_ping (const sockinfo &dsi, u8 pong = 0); |
248 | void send_ping (const sockinfo &dsi, u8 pong = 0); |
185 | void send_data_packet (tap_packet *pkt); |
249 | void send_data_packet (tap_packet *pkt); |
186 | |
250 | |
… | |
… | |
192 | void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); |
256 | void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); |
193 | |
257 | |
194 | void script_init_env (const char *ext); |
258 | void script_init_env (const char *ext); |
195 | void script_init_connect_env (); |
259 | void script_init_connect_env (); |
196 | const char *script_node_up (); |
260 | const char *script_node_up (); |
|
|
261 | const char *script_node_change (); |
197 | const char *script_node_down (); |
262 | const char *script_node_down (); |
198 | |
263 | |
199 | void dump_status (); |
264 | void dump_status (); |
200 | |
265 | |
201 | connection (struct vpn *vpn, conf_node *conf); |
266 | connection (struct vpn *vpn, conf_node *conf); |