ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/protocol.C
(Generate patch)

Comparing gvpe/src/protocol.C (file contents):
Revision 1.23 by pcg, Fri Mar 28 05:40:54 2003 UTC vs.
Revision 1.25 by pcg, Fri Mar 28 16:21:09 2003 UTC

… …
58 58
59static time_t next_timecheck; 59static time_t next_timecheck;
60 60
61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
62 62
63static u8
64best_protocol (u8 protset)
65{
66 if (protset & PROT_IPv4)
67 return PROT_IPv4;
68
69 return PROT_UDPv4;
70}
71
72struct crypto_ctx 63struct crypto_ctx
73 { 64 {
74 EVP_CIPHER_CTX cctx; 65 EVP_CIPHER_CTX cctx;
75 HMAC_CTX hctx; 66 HMAC_CTX hctx;
76 67
… …
581} 572}
582 573
583struct auth_req_packet : config_packet 574struct auth_req_packet : config_packet
584{ 575{
585 char magic[8]; 576 char magic[8];
586 u8 initiate, can_recv; // false if this is just an automatic reply 577 u8 initiate; // false if this is just an automatic reply
578 u8 protocols; // supported protocols (will get patches on forward)
587 u8 pad2, pad3; 579 u8 pad2, pad3;
588 rsaid id; 580 rsaid id;
589 rsaencrdata encr; 581 rsaencrdata encr;
590 582
591 auth_req_packet (int dst, bool initiate_, u8 can_recv_) 583 auth_req_packet (int dst, bool initiate_, u8 protocols_)
592 { 584 {
593 config_packet::setup (PT_AUTH_REQ, dst); 585 config_packet::setup (PT_AUTH_REQ, dst);
594 strncpy (magic, MAGIC, 8); 586 strncpy (magic, MAGIC, 8);
595 initiate = !!initiate_; 587 initiate = !!initiate_;
596 can_recv = can_recv_; 588 protocols = protocols_;
597 589
598 len = sizeof (*this) - sizeof (net_packet); 590 len = sizeof (*this) - sizeof (net_packet);
599 } 591 }
600}; 592};
601 593
… …
614 } 606 }
615}; 607};
616 608
617struct connect_req_packet : vpn_packet 609struct connect_req_packet : vpn_packet
618{ 610{
619 u8 id; 611 u8 id, protocols;
620 u8 pad1, pad2, pad3; 612 u8 pad1, pad2;
621 613
622 connect_req_packet (int dst, int id_) 614 connect_req_packet (int dst, int id_, u8 protocols_)
615 : id(id_)
616 , protocols(protocols_)
623 { 617 {
624 id = id_;
625 set_hdr (PT_CONNECT_REQ, dst); 618 set_hdr (PT_CONNECT_REQ, dst);
626 len = sizeof (*this) - sizeof (net_packet); 619 len = sizeof (*this) - sizeof (net_packet);
627 } 620 }
628}; 621};
629 622
630struct connect_info_packet : vpn_packet 623struct connect_info_packet : vpn_packet
631{ 624{
632 u8 id, can_recv; 625 u8 id, protocols;
633 u8 pad1, pad2; 626 u8 pad1, pad2;
634 sockinfo si; 627 sockinfo si;
635 628
636 connect_info_packet (int dst, int id_, sockinfo &si_, u8 can_recv_) 629 connect_info_packet (int dst, int id_, const sockinfo &si_, u8 protocols_)
630 : id(id_)
631 , protocols(protocols_)
632 , si(si_)
637 { 633 {
638 id = id_;
639 can_recv = can_recv_;
640 si = si_;
641 set_hdr (PT_CONNECT_INFO, dst); 634 set_hdr (PT_CONNECT_INFO, dst);
642 635
643 len = sizeof (*this) - sizeof (net_packet); 636 len = sizeof (*this) - sizeof (net_packet);
644 } 637 }
645}; 638};
… …
678} 671}
679 672
680void 673void
681connection::send_auth_request (const sockinfo &si, bool initiate) 674connection::send_auth_request (const sockinfo &si, bool initiate)
682{ 675{
683 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->can_recv); 676 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
684 677
685 // the next line is very conservative 678 protocol = best_protocol (THISNODE->protocols & conf->protocols);
686 prot_send = best_protocol (THISNODE->can_send & THISNODE->can_recv & conf->can_recv);
687 679
688 rsachallenge chg; 680 rsachallenge chg;
689 681
690 rsa_cache.gen (pkt->id, chg); 682 rsa_cache.gen (pkt->id, chg);
691 683
… …
715 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si); 707 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);
716 708
717 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly 709 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
718 710
719 delete pkt; 711 delete pkt;
712}
713
714void
715connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
716{
717 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
718 conf->id, rid, (const char *)rsi);
719
720 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
721
722 r->hmac_set (octx);
723 send_vpn_packet (r, si);
724
725 delete r;
720} 726}
721 727
722void 728void
723connection::establish_connection_cb (tstamp &ts) 729connection::establish_connection_cb (tstamp &ts)
724{ 730{
… …
909 delete octx; 915 delete octx;
910 916
911 octx = new crypto_ctx (k, 1); 917 octx = new crypto_ctx (k, 1);
912 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 918 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
913 919
914 conf->can_recv = p->can_recv; 920 conf->protocols = p->protocols;
915 send_auth_response (rsi, p->id, k); 921 send_auth_response (rsi, p->id, k);
916 922
917 break; 923 break;
918 } 924 }
919 } 925 }
… …
975 delete p; 981 delete p;
976 } 982 }
977 983
978 connectmode = conf->connectmode; 984 connectmode = conf->connectmode;
979 985
980 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"), 986 slog (L_INFO, _("%s(%s): %s connection established, protocol version %d.%d"),
981 conf->nodename, (const char *)rsi, 987 conf->nodename, (const char *)rsi,
988 strprotocol (protocol),
982 p->prot_major, p->prot_minor); 989 p->prot_major, p->prot_minor);
983 990
984 if (::conf.script_node_up) 991 if (::conf.script_node_up)
985 run_script (run_script_cb (this, &connection::script_node_up), false); 992 run_script (run_script_cb (this, &connection::script_node_up), false);
986 993
… …
1052 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1059 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1053 { 1060 {
1054 connect_req_packet *p = (connect_req_packet *) pkt; 1061 connect_req_packet *p = (connect_req_packet *) pkt;
1055 1062
1056 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1063 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1057 1064 conf->protocols = p->protocols;
1058 connection *c = vpn->conns[p->id - 1]; 1065 connection *c = vpn->conns[p->id - 1];
1059 1066
1060 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n", 1067 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
1061 conf->id, p->id, c->ictx && c->octx); 1068 conf->id, p->id, c->ictx && c->octx);
1062 1069
1063 if (c->ictx && c->octx) 1070 if (c->ictx && c->octx)
1064 { 1071 {
1065 // send connect_info packets to both sides, in case one is 1072 // send connect_info packets to both sides, in case one is
1066 // behind a nat firewall (or both ;) 1073 // behind a nat firewall (or both ;)
1067 { 1074 c->send_connect_info (conf->id, si, conf->protocols);
1068 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 1075 send_connect_info (c->conf->id, c->si, c->conf->protocols);
1069 c->conf->id, conf->id, (const char *)si);
1070
1071 connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si, conf->can_recv);
1072
1073 r->hmac_set (c->octx);
1074 send_vpn_packet (r, c->si);
1075
1076 delete r;
1077 }
1078
1079 {
1080 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1081 conf->id, c->conf->id, (const char *)c->si);
1082
1083 connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, c->si, c->conf->can_recv);
1084
1085 r->hmac_set (octx);
1086 send_vpn_packet (r, si);
1087
1088 delete r;
1089 }
1090 } 1076 }
1091 } 1077 }
1092 1078
1093 break; 1079 break;
1094 1080
… …
1096 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx)) 1082 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1097 { 1083 {
1098 connect_info_packet *p = (connect_info_packet *) pkt; 1084 connect_info_packet *p = (connect_info_packet *) pkt;
1099 1085
1100 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1086 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1101 1087 conf->protocols = p->protocols;
1102 connection *c = vpn->conns[p->id - 1]; 1088 connection *c = vpn->conns[p->id - 1];
1103 1089
1104 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1090 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1105 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1091 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1106 1092
1107 c->conf->can_recv = p->can_recv;
1108 c->send_auth_request (p->si, true); 1093 c->send_auth_request (p->si, true);
1109 } 1094 }
1110 1095
1111 break; 1096 break;
1112 1097
… …
1136 reset_connection (); 1121 reset_connection ();
1137} 1122}
1138 1123
1139void connection::connect_request (int id) 1124void connection::connect_request (int id)
1140{ 1125{
1141 connect_req_packet *p = new connect_req_packet (conf->id, id); 1126 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1142 1127
1143 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", id, conf->id); 1128 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);
1144 p->hmac_set (octx); 1129 p->hmac_set (octx);
1145 send_vpn_packet (p, si); 1130 send_vpn_packet (p, si);
1146 1131
1147 delete p; 1132 delete p;
1148} 1133}
… …
1178 1163
1179// send a vpn packet out to other hosts 1164// send a vpn packet out to other hosts
1180void 1165void
1181connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 1166connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1182{ 1167{
1183 if (prot_send & PROT_IPv4) 1168 if (protocol & PROT_IPv4)
1184 vpn->send_ipv4_packet (pkt, si, tos); 1169 vpn->send_ipv4_packet (pkt, si, tos);
1185 else 1170 else
1186 vpn->send_udpv4_packet (pkt, si, tos); 1171 vpn->send_udpv4_packet (pkt, si, tos);
1187} 1172}
1188 1173
… …
1235} 1220}
1236 1221
1237int 1222int
1238vpn::setup () 1223vpn::setup ()
1239{ 1224{
1240 u8 prots = 0;
1241
1242 for (configuration::node_vector::iterator i = conf.nodes.begin ();
1243 i != conf.nodes.end (); ++i)
1244 prots |= (*i)->can_send | (*i)->can_recv;
1245
1246 sockinfo si; 1225 sockinfo si;
1247 1226
1248 si.set (THISNODE); 1227 si.set (THISNODE);
1249 1228
1250 udpv4_fd = -1; 1229 udpv4_fd = -1;
1251 1230
1252 if (prots & PROT_UDPv4) 1231 if (THISNODE->protocols & PROT_UDPv4)
1253 { 1232 {
1254 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 1233 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
1255 1234
1256 if (udpv4_fd < 0) 1235 if (udpv4_fd < 0)
1257 return -1; 1236 return -1;
… …
1280 1259
1281 udpv4_ev_watcher.start (udpv4_fd, POLLIN); 1260 udpv4_ev_watcher.start (udpv4_fd, POLLIN);
1282 } 1261 }
1283 1262
1284 ipv4_fd = -1; 1263 ipv4_fd = -1;
1285 if (prots & PROT_IPv4) 1264 if (THISNODE->protocols & PROT_IPv4)
1286 { 1265 {
1287 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 1266 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
1288 1267
1289 if (ipv4_fd < 0) 1268 if (ipv4_fd < 0)
1290 return -1; 1269 return -1;
… …
1345 unsigned int dst = pkt->dst (); 1324 unsigned int dst = pkt->dst ();
1346 1325
1347 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 1326 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1348 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 1327 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1349 1328
1350 if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1351 slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1352 pkt->typ (), pkt->src (), pkt->dst ());
1353 else if (dst == 0 && !THISNODE->routerprio)
1354 slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1355 else if (dst != 0 && dst != THISNODE->id)
1356 slog (L_WARN,
1357 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1358 dst, conns[dst - 1]->conf->nodename,
1359 (const char *)rsi,
1360 THISNODE->id, THISNODE->nodename);
1361 else if (src == 0 || src > conns.size ()) 1329 if (src == 0 || src > conns.size ()
1362 slog (L_WARN, _("received frame from unknown node %d (%s)"), 1330 || dst > conns.size ()
1363 src, (const char *)rsi); 1331 || pkt->typ () >= vpn_packet::PT_MAX)
1332 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
1333 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
1364 else 1334 else
1335 {
1336 connection *c = conns[src - 1];
1337
1338 if (dst == 0 && !THISNODE->routerprio)
1339 slog (L_WARN, _("%s(%s): received broadcast, but we are no router"),
1340 c->conf->nodename, (const char *)rsi);
1341 else if (dst != 0 && dst != THISNODE->id)
1342 // FORWARDING NEEDED ;)
1343 slog (L_WARN,
1344 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1345 dst, conns[dst - 1]->conf->nodename,
1346 (const char *)rsi,
1347 THISNODE->id, THISNODE->nodename);
1348 else
1365 conns[src - 1]->recv_vpn_packet (pkt, rsi); 1349 c->recv_vpn_packet (pkt, rsi);
1350 }
1366} 1351}
1367 1352
1368void 1353void
1369vpn::udpv4_ev (short revents) 1354vpn::udpv4_ev (short revents)
1370{ 1355{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines