ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.h
(Generate patch)

Comparing gvpe/src/connection.h (file contents):
Revision 1.5 by pcg, Sat Apr 5 02:32:40 2003 UTC vs.
Revision 1.38 by root, Thu Jul 18 13:35:16 2013 UTC

1/* 1/*
2 connection.h -- header for connection.C 2 connection.h -- header for connection.C
3 Copyright (C) 2003-2008,2013 Marc Lehmann <gvpe@schmorp.de>
3 4
5 This file is part of GVPE.
6
4 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
5 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
6 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
7 (at your option) any later version. 10 option) any later version.
8 11
9 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
10 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
12 GNU General Public License for more details. 15 Public License for more details.
13 16
14 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
15 along with this program; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
16 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
17*/ 30*/
18 31
19#ifndef VPE_CONNECTION_H__ 32#ifndef GVPE_CONNECTION_H__
20#define VPE_CONNECTION_H__ 33#define GVPE_CONNECTION_H__
21 34
22#include <openssl/hmac.h> 35#include <openssl/hmac.h>
23 36
24#include "global.h" 37#include "global.h"
25#include "conf.h" 38#include "conf.h"
26#include "sockinfo.h" 39#include "sockinfo.h"
27#include "util.h" 40#include "util.h"
28#include "device.h" 41#include "device.h"
42#include "curve25519.h"
43#include "iv_gen.h"
29 44
30struct vpn; 45struct vpn;
31 46
32// called after HUP etc. to (re-)initialize global data structures 47// called after HUP etc. to (re-)initialize global data structures
33void connection_init (); 48void connection_init ();
34 49
50typedef curve25519_key ecdh_key;
51
35struct rsaid { 52struct rsa_data
36 u8 id[RSA_IDLEN]; // the challenge id 53{
54 u32 seqno;
55 u8 auth_key[AUTH_SIZE];
56 u8 mac_key[MAC_KEYSIZE]; // used to generate hmac key
57 u8 cipher_key[CIPHER_KEYSIZE]; // used to generate cipher key
58 u8 hkdf_salt[HKDF_SALT]; // used as hkdf salt
59 u8 pad[
60 (RSABITS >> 3)
61 - 41 // OAEP
62 - sizeof (u32) // seqno
63 - AUTH_SIZE
64 - MAC_KEYSIZE
65 - CIPHER_KEYSIZE
66 - HKDF_SALT
67 - 3 // struct alignment...
68 ];
37}; 69};
38 70
39typedef u8 rsachallenge[RSA_KEYLEN - RSA_OVERHEAD]; // challenge data; 71struct auth_data
72{
73 rsa_data rsa;
74 ecdh_key ecdh;
75};
76
40typedef u8 rsaencrdata[RSA_KEYLEN]; // encrypted challenge 77typedef u8 rsa_crypt[RSA_KEYLEN]; // encrypted challenge
41typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash 78
79struct auth_encr
80{
81 rsa_crypt rsa;
82 ecdh_key ecdh;
83};
84
85typedef u8 auth_mac[AUTH_SIZE];
86
87struct auth_response
88{
89 auth_mac mac;
90 ecdh_key ecdh;
91};
42 92
43//////////////////////////////////////////////////////////////////////////////////////// 93////////////////////////////////////////////////////////////////////////////////////////
44 94
45struct crypto_ctx; 95struct crypto_ctx;
46 96
47struct hmac_packet:net_packet 97struct hmac_packet : net_packet
48{ 98{
49 u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere 99 u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere
50 100
51 void hmac_set (crypto_ctx * ctx); 101 void hmac_set (crypto_ctx * ctx);
52 bool hmac_chk (crypto_ctx * ctx); 102 bool hmac_chk (crypto_ctx * ctx);
… …
56 106
57 void hmac_gen (crypto_ctx * ctx); 107 void hmac_gen (crypto_ctx * ctx);
58}; 108};
59 109
60struct vpn_packet : hmac_packet 110struct vpn_packet : hmac_packet
61 { 111{
62 enum ptype 112 enum ptype
63 { 113 {
64 PT_RESET = 0, 114 PT_RESET = 0,
65 PT_DATA_UNCOMPRESSED, 115 PT_DATA_UNCOMPRESSED,
66 PT_DATA_COMPRESSED, 116 PT_DATA_COMPRESSED,
67 PT_PING, PT_PONG, // wasting namespace space? ;) 117 PT_PING, PT_PONG, // wasting namespace space? ;)
68 PT_AUTH_REQ, // authentification request 118 PT_AUTH_REQ, // authentification request
69 PT_AUTH_RES, // authentification response 119 PT_AUTH_RES, // authentification response
70 PT_CONNECT_REQ, // want other host to contact me 120 PT_CONNECT_REQ, // want other node to contact me
71 PT_CONNECT_INFO, // request connection to some node 121 PT_CONNECT_INFO, // request connection to some node
122 PT_DATA_BRIDGED, // uncompressed packet with foreign mac pot. larger than path mtu (NYI)
72 PT_MAX 123 PT_MAX
73 };
74
75 u8 type;
76 u8 srcdst, src1, dst1;
77
78 void set_hdr (ptype type_, unsigned int dst);
79
80 unsigned int src () const
81 {
82 return src1 | ((srcdst >> 4) << 8);
83 }
84
85 unsigned int dst () const
86 {
87 return dst1 | ((srcdst & 0xf) << 8);
88 }
89
90 ptype typ () const
91 {
92 return (ptype) type;
93 }
94 }; 124 };
125
126 u8 type;
127 u8 srcdst, src1, dst1;
128
129 void set_hdr (ptype type_, unsigned int dst);
130
131 unsigned int src () const
132 {
133 return src1 | ((srcdst >> 4) << 8);
134 }
135
136 unsigned int dst () const
137 {
138 return dst1 | ((srcdst & 0xf) << 8);
139 }
140
141 ptype typ () const
142 {
143 return (ptype) type;
144 }
145};
95 146
96//////////////////////////////////////////////////////////////////////////////////////// 147////////////////////////////////////////////////////////////////////////////////////////
97 148
98// a very simple fifo pkt-queue 149// a very simple fifo pkt-queue
99class pkt_queue 150class pkt_queue
100 { 151{
101 tap_packet *queue[QUEUEDEPTH];
102 int i, j; 152 int i, j;
153 int max_queue;
154 double max_ttl;
103 155
156 struct pkt {
157 ev_tstamp tstamp;
158 net_packet *pkt;
159 } *queue;
160
161 void expire_cb (ev::timer &w, int revents); ev::timer expire;
162
104 public: 163public:
105 164
106 void put (tap_packet *p); 165 void put (net_packet *p);
107 tap_packet *get (); 166 net_packet *get ();
108 167
109 pkt_queue (); 168 bool empty ()
169 {
170 return i == j;
171 }
172
173 pkt_queue (double max_ttl, int max_queue);
110 ~pkt_queue (); 174 ~pkt_queue ();
111 }; 175};
176
177enum
178{
179 FEATURE_COMPRESSION = 0x01,
180 FEATURE_ROHC = 0x02,
181 FEATURE_BRIDGING = 0x04,
182};
112 183
113struct connection 184struct connection
114 { 185{
115 conf_node *conf; 186 conf_node *conf;
116 struct vpn *vpn; 187 struct vpn *vpn;
117 188
118 sockinfo si; // the current(!) destination ip to send packets to 189 sockinfo si; // the current(!) destination ip to send packets to
119 int retry_cnt; 190 int retry_cnt;
120 191
121 tstamp last_activity; // time of last packet received 192 tstamp last_activity; // time of last packet received
193 tstamp last_establish_attempt;
194 //tstamp last_si_change; // time we last changed the socket address
122 195
123 u32 oseqno; 196 u32 oseqno;
124 sliding_window iseqno; 197 sliding_window iseqno;
125 198
126 u8 protocol; 199 u8 protocol;
200 u8 features;
201 bool is_direct; // current connection (si) is direct?
127 202
128 pkt_queue queue; 203 pkt_queue data_queue, vpn_queue;
129 204
130 crypto_ctx *octx, *ictx; 205 crypto_ctx *octx, *ictx;
206 iv_gen oiv; // generator for random byte prefix
131 207
132 enum conf_node::connectmode connectmode; 208 void generate_auth_data ();
133 u8 prot_minor; // minor number of other side
134 209
135 void reset_dstaddr (); 210 ev_tstamp auth_expire; // when the snd_* and *_ecdh values expire
136 211
137 void shutdown (); 212 // send auth data - used for octx
138 void reset_connection (); 213 auth_data snd_auth;
139 void establish_connection_cb (time_watcher &w); time_watcher establish_connection; 214 auth_mac snd_auth_mac; // expected response mac
140 void rekey_cb (time_watcher &w); time_watcher rekey; // next rekying (actually current reset + reestablishing) 215 ecdh_key snd_ecdh_a; // the secret ecdh key we used for our request
141 void keepalive_cb (time_watcher &w); time_watcher keepalive; // next keepalive probe 216 ecdh_key snd_ecdh_b; // the public ecdh key we received in the response
217 bool have_snd_auth; // received response for our req
142 218
143 void send_auth_request (const sockinfo &si, bool initiate); 219 // receive auth data - used for ictx
144 void send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg); 220 auth_data rcv_auth;
145 void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); 221 ecdh_key rcv_ecdh_a; // the secret ecdh key we used for our response
146 void send_reset (const sockinfo &dsi); 222 ecdh_key rcv_ecdh_b; // the public ecdh key we sent in our response
147 void send_ping (const sockinfo &dsi, u8 pong = 0); 223 bool have_rcv_auth; // received auth from other side
148 void send_data_packet (tap_packet *pkt, bool broadcast = false);
149 void inject_data_packet (tap_packet *pkt, bool broadcast = false);
150 void connect_request (int id);
151 224
152 void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi); 225#if ENABLE_DNS
153 226 struct dns_connection *dns;
154 void script_node ();
155 const char *script_node_up ();
156 const char *script_node_down ();
157
158 void dump_status ();
159
160 connection(struct vpn *vpn_);
161 ~connection ();
162 };
163
164#endif 227#endif
165 228
229 enum conf_node::connectmode connectmode;
230 u8 prot_minor; // minor number of other side
231
232 void reset_si ();
233 const sockinfo &forward_si (const sockinfo &si) const;
234
235 void shutdown ();
236 void connection_established (const sockinfo &rsi);
237 void reset_connection ();
238
239 void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection;
240 void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekying (actually current reset + reestablishing)
241 void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe
242
243 void send_connect_request (int id);
244 void send_auth_request (const sockinfo &si, bool initiate);
245 void send_auth_response (const sockinfo &si);
246 void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols);
247 void send_reset (const sockinfo &dsi);
248 void send_ping (const sockinfo &dsi, u8 pong = 0);
249 void send_data_packet (tap_packet *pkt);
250
251 void post_inject_queue ();
252 void inject_data_packet (tap_packet *pkt);
253 void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding
254
255 void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi);
256 void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0);
257
258 void script_init_env (const char *ext);
259 void script_init_connect_env ();
260 const char *script_node_up ();
261 const char *script_node_change ();
262 const char *script_node_down ();
263
264 void dump_status ();
265
266 connection (struct vpn *vpn, conf_node *conf);
267 ~connection ();
268};
269
270#endif
271

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines