ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/connection.h
(Generate patch)

Comparing gvpe/src/connection.h (file contents):
Revision 1.7 by pcg, Sun Apr 6 18:12:18 2003 UTC vs.
Revision 1.41 by root, Thu Jan 29 00:21:39 2015 UTC

1/* 1/*
2 connection.h -- header for connection.C 2 connection.h -- header for connection.C
3 Copyright (C) 2003-2008,2013 Marc Lehmann <gvpe@schmorp.de>
3 4
5 This file is part of GVPE.
6
4 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
5 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
6 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
7 (at your option) any later version. 10 option) any later version.
8 11
9 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
10 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
12 GNU General Public License for more details. 15 Public License for more details.
13 16
14 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
15 along with this program; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
16 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
17*/ 30*/
18 31
19#ifndef VPE_CONNECTION_H__ 32#ifndef GVPE_CONNECTION_H__
20#define VPE_CONNECTION_H__ 33#define GVPE_CONNECTION_H__
21 34
22#include <openssl/hmac.h> 35#include <openssl/hmac.h>
23 36
24#include "global.h" 37#include "global.h"
25#include "conf.h" 38#include "conf.h"
26#include "sockinfo.h" 39#include "sockinfo.h"
27#include "util.h" 40#include "util.h"
28#include "device.h" 41#include "device.h"
42#include "curve25519.h"
43#include "iv_gen.h"
29 44
30struct vpn; 45struct vpn;
31 46
32// called after HUP etc. to (re-)initialize global data structures 47// called after HUP etc. to (re-)initialize global data structures
33void connection_init (); 48void connection_init ();
34 49
50typedef curve25519_key ecdh_key;
51
35struct rsaid { 52struct rsa_data
36 u8 id[RSA_IDLEN]; // the challenge id 53{
54 u32 seqno; // (ictx) initial sequence nr (31 bits)
55 u8 mac_key[MAC_IKMSIZE]; // (ictx) used to generate hmac key
56 u8 cipher_key[CIPHER_IKMSIZE]; // (ictx) used to generate cipher key
57 u8 hkdf_salt[HKDF_SALT]; // (octx) used as hkdf salt
58 u8 extra_auth[ // (ictx) additional auth randomness
59 (RSABITS >> 3)
60 - RSA_OAEP_SIZE
61 - sizeof (u32) // seqno
62 - MAC_IKMSIZE
63 - CIPHER_IKMSIZE
64 - HKDF_SALT
65 - 3 // struct alignment...
66 ];
37}; 67};
38 68
39typedef u8 rsachallenge[RSA_KEYLEN - RSA_OVERHEAD]; // challenge data; 69struct auth_data
70{
71 rsa_data rsa;
72 ecdh_key ecdh;
73};
74
40typedef u8 rsaencrdata[RSA_KEYLEN]; // encrypted challenge 75typedef u8 rsa_crypt[RSA_KEYLEN]; // encrypted challenge
41typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash 76
77struct auth_encr
78{
79 rsa_crypt rsa;
80 ecdh_key ecdh;
81};
82
83typedef u8 auth_mac[AUTH_SIZE];
84
85struct auth_response
86{
87 auth_mac mac;
88 ecdh_key ecdh;
89};
42 90
43//////////////////////////////////////////////////////////////////////////////////////// 91////////////////////////////////////////////////////////////////////////////////////////
44 92
45struct crypto_ctx; 93struct crypto_ctx;
46 94
47struct hmac_packet:net_packet 95struct hmac_packet : net_packet
48{ 96{
49 u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere 97 u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere
50 98
51 void hmac_set (crypto_ctx * ctx); 99 void hmac_set (crypto_ctx * ctx);
52 bool hmac_chk (crypto_ctx * ctx); 100 bool hmac_chk (crypto_ctx * ctx);
53 101
54private: 102private:
55 static unsigned char hmac_digest[EVP_MAX_MD_SIZE];
56
57 void hmac_gen (crypto_ctx * ctx); 103 void hmac_gen (crypto_ctx * ctx, u8 *hmac_digest);
58}; 104};
59 105
60struct vpn_packet : hmac_packet 106struct vpn_packet : hmac_packet
61 { 107{
62 enum ptype 108 enum ptype
63 { 109 {
64 PT_RESET = 0, 110 PT_RESET = 0,
65 PT_DATA_UNCOMPRESSED, 111 PT_DATA_UNCOMPRESSED,
66 PT_DATA_COMPRESSED, 112 PT_DATA_COMPRESSED,
67 PT_PING, PT_PONG, // wasting namespace space? ;) 113 PT_PING, PT_PONG, // wasting namespace space? ;)
68 PT_AUTH_REQ, // authentification request 114 PT_AUTH_REQ, // authentification request
69 PT_AUTH_RES, // authentification response 115 PT_AUTH_RES, // authentification response
70 PT_CONNECT_REQ, // want other host to contact me 116 PT_CONNECT_REQ, // want other node to contact me
71 PT_CONNECT_INFO, // request connection to some node 117 PT_CONNECT_INFO, // request connection to some node
118 PT_DATA_BRIDGED, // uncompressed packet with foreign mac pot. larger than path mtu (NYI)
72 PT_MAX 119 PT_MAX
73 };
74
75 u8 type;
76 u8 srcdst, src1, dst1;
77
78 void set_hdr (ptype type_, unsigned int dst);
79
80 unsigned int src () const
81 {
82 return src1 | ((srcdst >> 4) << 8);
83 }
84
85 unsigned int dst () const
86 {
87 return dst1 | ((srcdst & 0xf) << 8);
88 }
89
90 ptype typ () const
91 {
92 return (ptype) type;
93 }
94 }; 120 };
121
122 u8 type;
123 u8 srcdst, src1, dst1;
124
125 void set_hdr (ptype type_, unsigned int dst);
126
127 unsigned int src () const
128 {
129 return src1 | ((srcdst >> 4) << 8);
130 }
131
132 unsigned int dst () const
133 {
134 return dst1 | ((srcdst & 0xf) << 8);
135 }
136
137 ptype typ () const
138 {
139 return (ptype) type;
140 }
141};
95 142
96//////////////////////////////////////////////////////////////////////////////////////// 143////////////////////////////////////////////////////////////////////////////////////////
97 144
98// a very simple fifo pkt-queue 145// a very simple fifo pkt-queue
99class pkt_queue 146class pkt_queue
100 { 147{
101 tap_packet *queue[QUEUEDEPTH];
102 int i, j; 148 int i, j;
149 int max_queue;
150 double max_ttl;
103 151
152 struct pkt {
153 ev_tstamp tstamp;
154 net_packet *pkt;
155 } *queue;
156
157 void expire_cb (ev::timer &w, int revents); ev::timer expire;
158
104 public: 159public:
105 160
106 void put (tap_packet *p); 161 void put (net_packet *p);
107 tap_packet *get (); 162 net_packet *get ();
108 163
109 pkt_queue (); 164 bool empty ()
165 {
166 return i == j;
167 }
168
169 pkt_queue (double max_ttl, int max_queue);
110 ~pkt_queue (); 170 ~pkt_queue ();
111 }; 171};
172
173enum
174{
175 FEATURE_COMPRESSION = 0x01,
176 FEATURE_ROHC = 0x02,
177 FEATURE_BRIDGING = 0x04,
178};
112 179
113struct connection 180struct connection
114 { 181{
115 conf_node *conf; 182 conf_node *conf;
116 struct vpn *vpn; 183 struct vpn *vpn;
117 184
118 sockinfo si; // the current(!) destination ip to send packets to 185 sockinfo si; // the current(!) destination ip to send packets to
119 int retry_cnt; 186 int retry_cnt;
120 187
121 tstamp last_activity; // time of last packet received 188 tstamp last_activity; // time of last packet received
189 tstamp last_establish_attempt;
190 //tstamp last_si_change; // time we last changed the socket address
122 191
123 u32 oseqno; 192 u32 oseqno;
124 sliding_window iseqno; 193 sliding_window iseqno;
125 194
126 u8 protocol; 195 u8 protocol;
196 u8 features;
127 197
128 pkt_queue queue; 198 pkt_queue data_queue, vpn_queue;
129 199
130 crypto_ctx *octx, *ictx; 200 crypto_ctx *octx, *ictx;
131 201
132 enum conf_node::connectmode connectmode; 202 void generate_auth_data ();
133 u8 prot_minor; // minor number of other side
134 203
135 void reset_si (); 204 ev_tstamp auth_expire; // when the snd_* and *_ecdh values expire
136 const sockinfo &forward_si (const sockinfo &si) const; 205 ev_tstamp hmac_error; // time of first hmac error in a series
137 206
138 void shutdown (); 207 // send auth data - used for octx
139 void connection_established (); 208 auth_data snd_auth;
140 void reset_connection (); 209 ecdh_key snd_ecdh_a; // the secret ecdh key we used for our request
210 ecdh_key snd_ecdh_b; // the public ecdh key we received in the response
211 bool have_snd_auth; // received response for our req
141 212
142 void establish_connection_cb (time_watcher &w); time_watcher establish_connection; 213 // receive auth data - used for ictx
143 void rekey_cb (time_watcher &w); time_watcher rekey; // next rekying (actually current reset + reestablishing) 214 auth_data rcv_auth;
144 void keepalive_cb (time_watcher &w); time_watcher keepalive; // next keepalive probe 215 ecdh_key rcv_ecdh_a; // the secret ecdh key we used for our response
216 ecdh_key rcv_ecdh_b; // the public ecdh key we sent in our response
217 bool have_rcv_auth; // received auth from other side
145 218
146 void send_connect_request (int id); 219#if ENABLE_DNS
147 void send_auth_request (const sockinfo &si, bool initiate); 220 struct dns_connection *dns;
148 void send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg);
149 void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols);
150 void send_reset (const sockinfo &dsi);
151 void send_ping (const sockinfo &dsi, u8 pong = 0);
152 void send_data_packet (tap_packet *pkt, bool broadcast = false);
153
154 void inject_data_packet (tap_packet *pkt, bool broadcast = false);
155 void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding
156
157 void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0);
158 void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi);
159
160 void script_node ();
161 const char *script_node_up ();
162 const char *script_node_down ();
163
164 void dump_status ();
165
166 connection(struct vpn *vpn_);
167 ~connection ();
168 };
169
170#endif 221#endif
171 222
223 enum conf_node::connectmode connectmode;
224 u8 prot_minor; // minor number of other side
225
226 void reset_si ();
227 const sockinfo &forward_si (const sockinfo &si) const;
228
229 void shutdown ();
230 void connection_established (const sockinfo &rsi);
231 void reset_connection (const char *reason);
232
233 void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection;
234 void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekeying (actually current reset + reestablishing)
235 void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe
236
237 void send_connect_request (int id);
238 void send_auth_request (const sockinfo &si, bool initiate);
239 void send_auth_response (const sockinfo &si);
240 void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols);
241 void send_reset (const sockinfo &dsi);
242 void send_ping (const sockinfo &dsi, u8 pong = 0);
243 void send_data_packet (tap_packet *pkt);
244
245 void post_inject_queue ();
246 void inject_data_packet (tap_packet *pkt);
247 void inject_vpn_packet (vpn_packet *pkt, int tos = 0); // for forwarding
248
249 void recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi);
250 void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0);
251
252 void script_init_env (const char *ext);
253 void script_init_connect_env ();
254 const char *script_node_up ();
255 const char *script_node_change ();
256 const char *script_node_down ();
257
258 void dump_status ();
259
260 connection (struct vpn *vpn, conf_node *conf);
261 ~connection ();
262};
263
264#endif
265

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines