1 | /* |
1 | /* |
2 | connection.h -- header for connection.C |
2 | connection.h -- header for connection.C |
3 | Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com> |
3 | Copyright (C) 2003-2008,2013 Marc Lehmann <gvpe@schmorp.de> |
4 | |
4 | |
|
|
5 | This file is part of GVPE. |
|
|
6 | |
5 | This program is free software; you can redistribute it and/or modify |
7 | GVPE is free software; you can redistribute it and/or modify it |
6 | it under the terms of the GNU General Public License as published by |
8 | under the terms of the GNU General Public License as published by the |
7 | the Free Software Foundation; either version 2 of the License, or |
9 | Free Software Foundation; either version 3 of the License, or (at your |
8 | (at your option) any later version. |
10 | option) any later version. |
9 | |
11 | |
10 | This program is distributed in the hope that it will be useful, |
12 | This program is distributed in the hope that it will be useful, but |
11 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General |
13 | GNU General Public License for more details. |
15 | Public License for more details. |
14 | |
16 | |
15 | You should have received a copy of the GNU General Public License |
17 | You should have received a copy of the GNU General Public License along |
16 | along with this program; if not, write to the Free Software |
18 | with this program; if not, see <http://www.gnu.org/licenses/>. |
17 | Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
19 | |
|
|
20 | Additional permission under GNU GPL version 3 section 7 |
|
|
21 | |
|
|
22 | If you modify this Program, or any covered work, by linking or |
|
|
23 | combining it with the OpenSSL project's OpenSSL library (or a modified |
|
|
24 | version of that library), containing parts covered by the terms of the |
|
|
25 | OpenSSL or SSLeay licenses, the licensors of this Program grant you |
|
|
26 | additional permission to convey the resulting work. Corresponding |
|
|
27 | Source for a non-source form of such a combination shall include the |
|
|
28 | source code for the parts of OpenSSL used as well as that of the |
|
|
29 | covered work. |
18 | */ |
30 | */ |
19 | |
31 | |
20 | #ifndef VPE_CONNECTION_H__ |
32 | #ifndef GVPE_CONNECTION_H__ |
21 | #define VPE_CONNECTION_H__ |
33 | #define GVPE_CONNECTION_H__ |
22 | |
34 | |
23 | #include <openssl/hmac.h> |
35 | #include <openssl/hmac.h> |
24 | |
36 | |
25 | #include "global.h" |
37 | #include "global.h" |
26 | #include "conf.h" |
38 | #include "conf.h" |
27 | #include "sockinfo.h" |
39 | #include "sockinfo.h" |
28 | #include "util.h" |
40 | #include "util.h" |
29 | #include "device.h" |
41 | #include "device.h" |
|
|
42 | #include "curve25519.h" |
|
|
43 | #include "iv_gen.h" |
30 | |
44 | |
31 | struct vpn; |
45 | struct vpn; |
32 | |
46 | |
33 | // called after HUP etc. to (re-)initialize global data structures |
47 | // called after HUP etc. to (re-)initialize global data structures |
34 | void connection_init (); |
48 | void connection_init (); |
35 | |
49 | |
|
|
50 | typedef curve25519_key ecdh_key; |
|
|
51 | |
36 | struct rsaid { |
52 | struct rsa_data |
37 | u8 id[RSA_IDLEN]; // the challenge id |
53 | { |
|
|
54 | u32 seqno; // (ictx) initial sequence nr (31 bits) |
|
|
55 | u8 mac_key[MAC_IKMSIZE]; // (ictx) used to generate hmac key |
|
|
56 | u8 cipher_key[CIPHER_IKMSIZE]; // (ictx) used to generate cipher key |
|
|
57 | u8 hkdf_salt[HKDF_SALT]; // (octx) used as hkdf salt |
|
|
58 | u8 extra_auth[ // (ictx) additional auth randomness |
|
|
59 | (RSABITS >> 3) |
|
|
60 | - RSA_OAEP_SIZE |
|
|
61 | - sizeof (u32) // seqno |
|
|
62 | - MAC_IKMSIZE |
|
|
63 | - CIPHER_IKMSIZE |
|
|
64 | - HKDF_SALT |
|
|
65 | - 3 // struct alignment... |
|
|
66 | ]; |
38 | }; |
67 | }; |
39 | |
68 | |
40 | typedef rsaclear rsachallenge; // challenge data; |
69 | struct auth_data |
41 | typedef rsacrypt rsaencrdata; // encrypted challenge |
70 | { |
42 | typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash |
71 | rsa_data rsa; |
|
|
72 | ecdh_key ecdh; |
|
|
73 | }; |
|
|
74 | |
|
|
75 | typedef u8 rsa_crypt[RSA_KEYLEN]; // encrypted challenge |
|
|
76 | |
|
|
77 | struct auth_encr |
|
|
78 | { |
|
|
79 | rsa_crypt rsa; |
|
|
80 | ecdh_key ecdh; |
|
|
81 | }; |
|
|
82 | |
|
|
83 | typedef u8 auth_mac[AUTH_SIZE]; |
|
|
84 | |
|
|
85 | struct auth_response |
|
|
86 | { |
|
|
87 | auth_mac mac; |
|
|
88 | ecdh_key ecdh; |
|
|
89 | }; |
43 | |
90 | |
44 | //////////////////////////////////////////////////////////////////////////////////////// |
91 | //////////////////////////////////////////////////////////////////////////////////////// |
45 | |
92 | |
46 | struct crypto_ctx; |
93 | struct crypto_ctx; |
47 | |
94 | |
… | |
… | |
51 | |
98 | |
52 | void hmac_set (crypto_ctx * ctx); |
99 | void hmac_set (crypto_ctx * ctx); |
53 | bool hmac_chk (crypto_ctx * ctx); |
100 | bool hmac_chk (crypto_ctx * ctx); |
54 | |
101 | |
55 | private: |
102 | private: |
56 | static unsigned char hmac_digest[EVP_MAX_MD_SIZE]; |
|
|
57 | |
|
|
58 | void hmac_gen (crypto_ctx * ctx); |
103 | void hmac_gen (crypto_ctx * ctx, u8 *hmac_digest); |
59 | }; |
104 | }; |
60 | |
105 | |
61 | struct vpn_packet : hmac_packet |
106 | struct vpn_packet : hmac_packet |
62 | { |
107 | { |
63 | enum ptype |
108 | enum ptype |
64 | { |
109 | { |
65 | PT_RESET = 0, |
110 | PT_RESET = 0, |
66 | PT_DATA_UNCOMPRESSED, |
111 | PT_DATA_UNCOMPRESSED, |
67 | PT_DATA_COMPRESSED, |
112 | PT_DATA_COMPRESSED, |
68 | PT_PING, PT_PONG, // wasting namespace space? ;) |
113 | PT_PING, PT_PONG, // wasting namespace space? ;) |
69 | PT_AUTH_REQ, // authentification request |
114 | PT_AUTH_REQ, // authentification request |
70 | PT_AUTH_RES, // authentification response |
115 | PT_AUTH_RES, // authentification response |
71 | PT_CONNECT_REQ, // want other host to contact me |
116 | PT_CONNECT_REQ, // want other node to contact me |
72 | PT_CONNECT_INFO, // request connection to some node |
117 | PT_CONNECT_INFO, // request connection to some node |
|
|
118 | PT_DATA_BRIDGED, // uncompressed packet with foreign mac pot. larger than path mtu (NYI) |
73 | PT_MAX |
119 | PT_MAX |
74 | }; |
|
|
75 | |
|
|
76 | u8 type; |
|
|
77 | u8 srcdst, src1, dst1; |
|
|
78 | |
|
|
79 | void set_hdr (ptype type_, unsigned int dst); |
|
|
80 | |
|
|
81 | unsigned int src () const |
|
|
82 | { |
|
|
83 | return src1 | ((srcdst >> 4) << 8); |
|
|
84 | } |
|
|
85 | |
|
|
86 | unsigned int dst () const |
|
|
87 | { |
|
|
88 | return dst1 | ((srcdst & 0xf) << 8); |
|
|
89 | } |
|
|
90 | |
|
|
91 | ptype typ () const |
|
|
92 | { |
|
|
93 | return (ptype) type; |
|
|
94 | } |
|
|
95 | }; |
120 | }; |
|
|
121 | |
|
|
122 | u8 type; |
|
|
123 | u8 srcdst, src1, dst1; |
|
|
124 | |
|
|
125 | void set_hdr (ptype type_, unsigned int dst); |
|
|
126 | |
|
|
127 | unsigned int src () const |
|
|
128 | { |
|
|
129 | return src1 | ((srcdst >> 4) << 8); |
|
|
130 | } |
|
|
131 | |
|
|
132 | unsigned int dst () const |
|
|
133 | { |
|
|
134 | return dst1 | ((srcdst & 0xf) << 8); |
|
|
135 | } |
|
|
136 | |
|
|
137 | ptype typ () const |
|
|
138 | { |
|
|
139 | return (ptype) type; |
|
|
140 | } |
|
|
141 | }; |
96 | |
142 | |
97 | //////////////////////////////////////////////////////////////////////////////////////// |
143 | //////////////////////////////////////////////////////////////////////////////////////// |
98 | |
144 | |
99 | // a very simple fifo pkt-queue |
145 | // a very simple fifo pkt-queue |
100 | class pkt_queue |
146 | class pkt_queue |
101 | { |
147 | { |
102 | net_packet *queue[QUEUEDEPTH]; |
|
|
103 | int i, j; |
148 | int i, j; |
|
|
149 | int max_queue; |
|
|
150 | double max_ttl; |
104 | |
151 | |
|
|
152 | struct pkt { |
|
|
153 | ev_tstamp tstamp; |
|
|
154 | net_packet *pkt; |
|
|
155 | } *queue; |
|
|
156 | |
|
|
157 | void expire_cb (ev::timer &w, int revents); ev::timer expire; |
|
|
158 | |
105 | public: |
159 | public: |
106 | |
160 | |
107 | void put (net_packet *p); |
161 | void put (net_packet *p); |
108 | net_packet *get (); |
162 | net_packet *get (); |
109 | |
163 | |
110 | pkt_queue (); |
164 | bool empty () |
|
|
165 | { |
|
|
166 | return i == j; |
|
|
167 | } |
|
|
168 | |
|
|
169 | pkt_queue (double max_ttl, int max_queue); |
111 | ~pkt_queue (); |
170 | ~pkt_queue (); |
112 | }; |
171 | }; |
113 | |
172 | |
114 | enum |
173 | enum |
115 | { |
174 | { |
116 | FEATURE_COMPRESSION = 0x01, |
175 | FEATURE_COMPRESSION = 0x01, |
117 | FEATURE_ROHC = 0x02, |
176 | FEATURE_ROHC = 0x02, |
118 | }; |
177 | FEATURE_BRIDGING = 0x04, |
|
|
178 | }; |
119 | |
179 | |
120 | struct connection |
180 | struct connection |
121 | { |
181 | { |
122 | conf_node *conf; |
182 | conf_node *conf; |
123 | struct vpn *vpn; |
183 | struct vpn *vpn; |
124 | |
184 | |
125 | sockinfo si; // the current(!) destination ip to send packets to |
185 | sockinfo si; // the current(!) destination ip to send packets to |
126 | int retry_cnt; |
186 | int retry_cnt; |
127 | |
187 | |
128 | tstamp last_activity; // time of last packet received |
188 | tstamp last_activity; // time of last packet received |
|
|
189 | tstamp last_establish_attempt; |
|
|
190 | //tstamp last_si_change; // time we last changed the socket address |
129 | |
191 | |
130 | u32 oseqno; |
192 | u32 oseqno; |
131 | sliding_window iseqno; |
193 | sliding_window iseqno; |
132 | |
194 | |
133 | u8 protocol; |
195 | u8 protocol; |
134 | u8 features; |
196 | u8 features; |
|
|
197 | bool is_direct; // current connection (si) is direct? |
135 | |
198 | |
136 | pkt_queue data_queue, vpn_queue; |
199 | pkt_queue data_queue, vpn_queue; |
137 | |
200 | |
138 | crypto_ctx *octx, *ictx; |
201 | crypto_ctx *octx, *ictx; |
|
|
202 | iv_gen oiv; // generator for random byte prefix |
|
|
203 | |
|
|
204 | void generate_auth_data (); |
|
|
205 | |
|
|
206 | ev_tstamp auth_expire; // when the snd_* and *_ecdh values expire |
|
|
207 | |
|
|
208 | // send auth data - used for octx |
|
|
209 | auth_data snd_auth; |
|
|
210 | ecdh_key snd_ecdh_a; // the secret ecdh key we used for our request |
|
|
211 | ecdh_key snd_ecdh_b; // the public ecdh key we received in the response |
|
|
212 | bool have_snd_auth; // received response for our req |
|
|
213 | |
|
|
214 | // receive auth data - used for ictx |
|
|
215 | auth_data rcv_auth; |
|
|
216 | ecdh_key rcv_ecdh_a; // the secret ecdh key we used for our response |
|
|
217 | ecdh_key rcv_ecdh_b; // the public ecdh key we sent in our response |
|
|
218 | bool have_rcv_auth; // received auth from other side |
139 | |
219 | |
140 | #if ENABLE_DNS |
220 | #if ENABLE_DNS |
141 | vector<struct dns_rep *> dns_rcvq; |
221 | struct dns_connection *dns; |
142 | vector<struct dns_req *> dns_sndq; |
|
|
143 | |
|
|
144 | void dnsv4_cb (time_watcher &w); time_watcher dnsv4_tw; |
|
|
145 | bool send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos); |
|
|
146 | #endif |
222 | #endif |
147 | |
223 | |
148 | enum conf_node::connectmode connectmode; |
224 | enum conf_node::connectmode connectmode; |
149 | u8 prot_minor; // minor number of other side |
225 | u8 prot_minor; // minor number of other side |
150 | |
226 | |
151 | void reset_si (); |
227 | void reset_si (); |
152 | const sockinfo &forward_si (const sockinfo &si) const; |
228 | const sockinfo &forward_si (const sockinfo &si) const; |
153 | |
229 | |
154 | void shutdown (); |
230 | void shutdown (); |
155 | void connection_established (); |
231 | void connection_established (const sockinfo &rsi); |
156 | void reset_connection (); |
232 | void reset_connection (); |
157 | |
233 | |
158 | void establish_connection_cb (time_watcher &w); time_watcher establish_connection; |
234 | void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection; |
159 | void rekey_cb (time_watcher &w); time_watcher rekey; // next rekying (actually current reset + reestablishing) |
235 | void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekying (actually current reset + reestablishing) |
160 | void keepalive_cb (time_watcher &w); time_watcher keepalive; // next keepalive probe |
236 | void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe |
161 | |
237 | |
162 | void send_connect_request (int id); |
238 | void send_connect_request (int id); |
163 | void send_auth_request (const sockinfo &si, bool initiate); |
239 | void send_auth_request (const sockinfo &si, bool initiate); |
164 | void send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg); |
240 | void send_auth_response (const sockinfo &si); |
165 | void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); |
241 | void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); |
166 | void send_reset (const sockinfo &dsi); |
242 | void send_reset (const sockinfo &dsi); |
167 | void send_ping (const sockinfo &dsi, u8 pong = 0); |
243 | void send_ping (const sockinfo &dsi, u8 pong = 0); |
168 | void send_data_packet (tap_packet *pkt); |
244 | void send_data_packet (tap_packet *pkt); |
169 | |
245 | |
|
|
246 | void post_inject_queue (); |
170 | void inject_data_packet (tap_packet *pkt, bool broadcast = false); |
247 | void inject_data_packet (tap_packet *pkt); |
171 | void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding |
248 | void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding |
172 | |
249 | |
|
|
250 | void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi); |
173 | void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); |
251 | void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); |
174 | void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi); |
|
|
175 | |
252 | |
176 | void script_node (); |
253 | void script_init_env (const char *ext); |
|
|
254 | void script_init_connect_env (); |
177 | const char *script_node_up (); |
255 | const char *script_node_up (); |
|
|
256 | const char *script_node_change (); |
178 | const char *script_node_down (); |
257 | const char *script_node_down (); |
179 | |
258 | |
180 | void dump_status (); |
259 | void dump_status (); |
181 | |
260 | |
182 | connection (struct vpn *vpn, conf_node *conf); |
261 | connection (struct vpn *vpn, conf_node *conf); |
183 | ~connection (); |
262 | ~connection (); |
184 | }; |
263 | }; |
185 | |
264 | |
186 | #endif |
265 | #endif |
187 | |
266 | |