1 | /* |
1 | /* |
2 | connection.h -- header for connection.C |
2 | connection.h -- header for connection.C |
3 | Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de> |
3 | Copyright (C) 2003-2008,2013,2016 Marc Lehmann <gvpe@schmorp.de> |
4 | |
4 | |
5 | This file is part of GVPE. |
5 | This file is part of GVPE. |
6 | |
6 | |
7 | GVPE is free software; you can redistribute it and/or modify it |
7 | GVPE is free software; you can redistribute it and/or modify it |
8 | under the terms of the GNU General Public License as published by the |
8 | under the terms of the GNU General Public License as published by the |
… | |
… | |
37 | #include "global.h" |
37 | #include "global.h" |
38 | #include "conf.h" |
38 | #include "conf.h" |
39 | #include "sockinfo.h" |
39 | #include "sockinfo.h" |
40 | #include "util.h" |
40 | #include "util.h" |
41 | #include "device.h" |
41 | #include "device.h" |
|
|
42 | #include "curve25519.h" |
|
|
43 | #include "iv_gen.h" |
42 | |
44 | |
43 | struct vpn; |
45 | struct vpn; |
44 | |
46 | |
45 | // called after HUP etc. to (re-)initialize global data structures |
47 | // called after HUP etc. to (re-)initialize global data structures |
46 | void connection_init (); |
48 | void connection_init (); |
47 | |
49 | |
|
|
50 | typedef curve25519_key ecdh_key; |
|
|
51 | |
48 | struct rsaid |
52 | struct rsa_data |
49 | { |
53 | { |
50 | u8 id[RSA_IDLEN]; // the challenge id |
54 | u32 seqno; // (ictx) initial sequence nr (31 bits) |
|
|
55 | u8 mac_key[MAC_IKMSIZE]; // (ictx) used to generate hmac key |
|
|
56 | u8 cipher_key[CIPHER_IKMSIZE]; // (ictx) used to generate cipher key |
|
|
57 | u8 hkdf_salt[HKDF_SALT]; // (octx) used as hkdf salt |
|
|
58 | u8 extra_auth[ // (ictx) additional auth randomness |
|
|
59 | (RSABITS >> 3) |
|
|
60 | - RSA_OAEP_SIZE |
|
|
61 | - sizeof (u32) // seqno |
|
|
62 | - MAC_IKMSIZE |
|
|
63 | - CIPHER_IKMSIZE |
|
|
64 | - HKDF_SALT |
|
|
65 | - 3 // struct alignment... |
|
|
66 | ]; |
51 | }; |
67 | }; |
52 | |
68 | |
53 | typedef rsaclear rsachallenge; // challenge data; |
69 | struct auth_data |
54 | typedef rsacrypt rsaencrdata; // encrypted challenge |
70 | { |
55 | typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash |
71 | rsa_data rsa; |
|
|
72 | ecdh_key ecdh; |
|
|
73 | }; |
|
|
74 | |
|
|
75 | typedef u8 rsa_crypt[RSA_KEYLEN]; // encrypted challenge |
|
|
76 | |
|
|
77 | struct auth_encr |
|
|
78 | { |
|
|
79 | rsa_crypt rsa; |
|
|
80 | ecdh_key ecdh; |
|
|
81 | }; |
|
|
82 | |
|
|
83 | typedef u8 auth_mac[AUTH_SIZE]; |
|
|
84 | |
|
|
85 | struct auth_response |
|
|
86 | { |
|
|
87 | auth_mac mac; |
|
|
88 | ecdh_key ecdh; |
|
|
89 | }; |
56 | |
90 | |
57 | //////////////////////////////////////////////////////////////////////////////////////// |
91 | //////////////////////////////////////////////////////////////////////////////////////// |
58 | |
92 | |
59 | struct crypto_ctx; |
93 | struct crypto_ctx; |
60 | |
94 | |
61 | struct hmac_packet : net_packet |
95 | struct hmac_packet : net_packet |
62 | { |
96 | { |
63 | u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere |
97 | u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere |
64 | |
98 | |
65 | void hmac_set (crypto_ctx * ctx); |
99 | void hmac_set (crypto_ctx *ctx); |
66 | bool hmac_chk (crypto_ctx * ctx); |
100 | bool hmac_chk (crypto_ctx *ctx); |
67 | |
101 | |
68 | private: |
102 | private: |
69 | static unsigned char hmac_digest[EVP_MAX_MD_SIZE]; |
|
|
70 | |
|
|
71 | void hmac_gen (crypto_ctx * ctx); |
103 | void hmac_gen (crypto_ctx *ctx, u8 *hmac_digest); |
72 | }; |
104 | }; |
73 | |
105 | |
74 | struct vpn_packet : hmac_packet |
106 | struct vpn_packet : hmac_packet |
75 | { |
107 | { |
76 | enum ptype |
108 | enum ptype |
… | |
… | |
152 | |
184 | |
153 | sockinfo si; // the current(!) destination ip to send packets to |
185 | sockinfo si; // the current(!) destination ip to send packets to |
154 | int retry_cnt; |
186 | int retry_cnt; |
155 | |
187 | |
156 | tstamp last_activity; // time of last packet received |
188 | tstamp last_activity; // time of last packet received |
157 | tstamp last_establish_attempt; |
189 | tstamp last_establish_attempt; |
|
|
190 | //tstamp last_si_change; // time we last changed the socket address |
158 | |
191 | |
159 | u32 oseqno; |
192 | u32 oseqno; |
160 | sliding_window iseqno; |
193 | sliding_window iseqno; |
161 | |
194 | |
162 | u8 protocol; |
195 | u8 protocol; |
… | |
… | |
164 | |
197 | |
165 | pkt_queue data_queue, vpn_queue; |
198 | pkt_queue data_queue, vpn_queue; |
166 | |
199 | |
167 | crypto_ctx *octx, *ictx; |
200 | crypto_ctx *octx, *ictx; |
168 | |
201 | |
|
|
202 | void generate_auth_data (); |
|
|
203 | |
|
|
204 | ev_tstamp auth_expire; // when the snd_* and *_ecdh values expire |
|
|
205 | ev_tstamp hmac_error; // time of first hmac error in a series |
|
|
206 | |
|
|
207 | // send auth data - used for octx |
|
|
208 | auth_data snd_auth; |
|
|
209 | ecdh_key snd_ecdh_a; // the secret ecdh key we used for our request |
|
|
210 | ecdh_key snd_ecdh_b; // the public ecdh key we received in the response |
|
|
211 | bool have_snd_auth; // received response for our req |
|
|
212 | |
|
|
213 | // receive auth data - used for ictx |
|
|
214 | auth_data rcv_auth; |
|
|
215 | ecdh_key rcv_ecdh_a; // the secret ecdh key we used for our response |
|
|
216 | ecdh_key rcv_ecdh_b; // the public ecdh key we sent in our response |
|
|
217 | bool have_rcv_auth; // received auth from other side |
|
|
218 | |
169 | #if ENABLE_DNS |
219 | #if ENABLE_DNS |
170 | struct dns_connection *dns; |
220 | struct dns_connection *dns; |
171 | |
|
|
172 | void dnsv4_reset_connection (); |
|
|
173 | #endif |
221 | #endif |
174 | |
222 | |
175 | enum conf_node::connectmode connectmode; |
223 | enum conf_node::connectmode connectmode; |
176 | u8 prot_minor; // minor number of other side |
224 | u8 prot_minor; // minor number of other side |
177 | |
225 | |
178 | void reset_si (); |
226 | void reset_si (); |
179 | const sockinfo &forward_si (const sockinfo &si) const; |
227 | const sockinfo &forward_si (const sockinfo &si) const; |
180 | |
228 | |
181 | void shutdown (); |
229 | void shutdown (); |
182 | void connection_established (); |
230 | void connection_established (const sockinfo &rsi); |
183 | void reset_connection (); |
231 | void reset_connection (const char *reason); |
184 | |
232 | |
185 | void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection; |
233 | void establish_connection_cb (ev::timer &w, int revents); ev::timer establish_connection; |
186 | void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekying (actually current reset + reestablishing) |
234 | void rekey_cb (ev::timer &w, int revents); ev::timer rekey; // next rekeying (actually current reset + reestablishing) |
187 | void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe |
235 | void keepalive_cb (ev::timer &w, int revents); ev::timer keepalive; // next keepalive probe |
188 | |
236 | |
189 | void send_connect_request (int id); |
237 | void send_connect_request (int id); |
190 | void send_auth_request (const sockinfo &si, bool initiate); |
238 | void send_auth_request (const sockinfo &si, bool initiate); |
191 | void send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg); |
239 | void send_auth_response (const sockinfo &si); |
192 | void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); |
240 | void send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols); |
193 | void send_reset (const sockinfo &dsi); |
241 | void send_reset (const sockinfo &dsi); |
194 | void send_ping (const sockinfo &dsi, u8 pong = 0); |
242 | void send_ping (const sockinfo &dsi, u8 pong = 0); |
195 | void send_data_packet (tap_packet *pkt); |
243 | void send_data_packet (tap_packet *pkt); |
196 | |
244 | |
… | |
… | |
202 | void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); |
250 | void send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos = 0); |
203 | |
251 | |
204 | void script_init_env (const char *ext); |
252 | void script_init_env (const char *ext); |
205 | void script_init_connect_env (); |
253 | void script_init_connect_env (); |
206 | const char *script_node_up (); |
254 | const char *script_node_up (); |
|
|
255 | const char *script_node_change (); |
207 | const char *script_node_down (); |
256 | const char *script_node_down (); |
208 | |
257 | |
209 | void dump_status (); |
258 | void dump_status (); |
210 | |
259 | |
211 | connection (struct vpn *vpn, conf_node *conf); |
260 | connection (struct vpn *vpn, conf_node *conf); |