[ViewVC] Diff of: cvs/gvpe/src/protocol.C

Comparing gvpe/src/protocol.C (file contents):
Revision 1.6 by pcg, Sun Mar 9 12:40:18 2003 UTC vs.
Revision 1.9 by pcg, Fri Mar 21 23:17:01 2003 UTC

…		…
60		60
61	static const rsachallenge &	61	static const rsachallenge &
62	challenge_bytes ()	62	challenge_bytes ()
63	{	63	{
64	static rsachallenge challenge;	64	static rsachallenge challenge;
65	static time_t challenge_ttl; // time this challenge needs to be recreated	65	static double challenge_ttl; // time this challenge needs to be recreated
66		66
67	if (now > challenge_ttl)	67	if (NOW > challenge_ttl)
68	{	68	{
69	RAND_bytes ((unsigned char *)&challenge, sizeof (challenge));	69	RAND_bytes ((unsigned char *)&challenge, sizeof (challenge));
70	challenge_ttl = now + CHALLENGE_TTL;	70	challenge_ttl = NOW + CHALLENGE_TTL;
71	}	71	}
72		72
73	return challenge;	73	return challenge;
74	}	74	}
75		75
…		…
128		128
129	crypto_ctx::~crypto_ctx ()	129	crypto_ctx::~crypto_ctx ()
130	{	130	{
131	EVP_CIPHER_CTX_cleanup (&cctx);	131	EVP_CIPHER_CTX_cleanup (&cctx);
132	HMAC_CTX_cleanup (&hctx);	132	HMAC_CTX_cleanup (&hctx);
		133	}
		134
		135	//////////////////////////////////////////////////////////////////////////////
		136
		137	void pkt_queue::put (tap_packet *p)
		138	{
		139	if (queue[i])
		140	{
		141	delete queue[i];
		142	j = (j + 1) % QUEUEDEPTH;
		143	}
		144
		145	queue[i] = p;
		146
		147	i = (i + 1) % QUEUEDEPTH;
		148	}
		149
		150	tap_packet *pkt_queue::get ()
		151	{
		152	tap_packet *p = queue[j];
		153
		154	if (p)
		155	{
		156	queue[j] = 0;
		157	j = (j + 1) % QUEUEDEPTH;
		158	}
		159
		160	return p;
		161	}
		162
		163	pkt_queue::pkt_queue ()
		164	{
		165	memset (queue, 0, sizeof (queue));
		166	i = 0;
		167	j = 0;
		168	}
		169
		170	pkt_queue::~pkt_queue ()
		171	{
		172	for (i = QUEUEDEPTH; --i > 0; )
		173	delete queue[i];
		174	}
		175
		176	// only do action once every x seconds per host.
		177	// currently this is quite a slow implementation,
		178	// but suffices for normal operation.
		179	struct u32_rate_limiter : private map<u32, tstamp>
		180	{
		181	tstamp every;
		182
		183	bool can (u32 host);
		184
		185	u32_rate_limiter (tstamp every = 1)
		186	{
		187	this->every = every;
		188	}
		189	};
		190
		191	struct net_rate_limiter : u32_rate_limiter
		192	{
		193	bool can (SOCKADDR *sa) { return u32_rate_limiter::can((u32)sa->sin_addr.s_addr); }
		194	bool can (sockinfo &si) { return u32_rate_limiter::can((u32)si.host); }
		195
		196	net_rate_limiter (tstamp every) : u32_rate_limiter (every) {}
		197	};
		198
		199	bool u32_rate_limiter::can (u32 host)
		200	{
		201	iterator i;
		202
		203	for (i = begin (); i != end (); )
		204	if (i->second <= NOW)
		205	{
		206	erase (i);
		207	i = begin ();
		208	}
		209	else
		210	++i;
		211
		212	i = find (host);
		213
		214	if (i != end ())
		215	return false;
		216
		217	insert (value_type (host, NOW + every));
		218
		219	return true;
133	}	220	}
134		221
135	/////////////////////////////////////////////////////////////////////////////	222	/////////////////////////////////////////////////////////////////////////////
136		223
137	static void next_wakeup (time_t next)	224	static void next_wakeup (time_t next)
…		…
200		287
201	unsigned int src ()	288	unsigned int src ()
202	{	289	{
203	return src1 \| ((srcdst >> 4) << 8);	290	return src1 \| ((srcdst >> 4) << 8);
204	}	291	}
		292
205	unsigned int dst ()	293	unsigned int dst ()
206	{	294	{
207	return dst1 \| ((srcdst & 0xf) << 8);	295	return dst1 \| ((srcdst & 0xf) << 8);
208	}	296	}
		297
209	ptype typ ()	298	ptype typ ()
210	{	299	{
211	return (ptype) type;	300	return (ptype) type;
212	}	301	}
213	};	302	};
…		…
252	u32 cl;	341	u32 cl;
253		342
254	cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);	343	cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
255	if (cl)	344	if (cl)
256	{	345	{
257	//printf ("compressed packet, %d => %d\n", l, cl);//D
258	type = PT_DATA_COMPRESSED;	346	type = PT_DATA_COMPRESSED;
259	d = cdata;	347	d = cdata;
260	l = cl + 2;	348	l = cl + 2;
261		349
262	d[0] = cl >> 8;	350	d[0] = cl >> 8;
…		…
338	#if ENABLE_COMPRESSION	426	#if ENABLE_COMPRESSION
339	if (type == PT_DATA_COMPRESSED)	427	if (type == PT_DATA_COMPRESSED)
340	{	428	{
341	u32 cl = (d[DATAHDR] << 8) \| d[DATAHDR + 1];	429	u32 cl = (d[DATAHDR] << 8) \| d[DATAHDR + 1];
342	p->len = lzf_decompress (d + DATAHDR + 2, cl, &(*p)[6 + 6], MAX_MTU) + 6 + 6;	430	p->len = lzf_decompress (d + DATAHDR + 2, cl, &(*p)[6 + 6], MAX_MTU) + 6 + 6;
343	//printf ("decompressxed %d(%d) => %d\n", cl, len - data_hdr_size (), p->len);//D
344	}	431	}
345	else	432	else
346	p->len = outl + (6 + 6 - DATAHDR);	433	p->len = outl + (6 + 6 - DATAHDR);
347	#endif	434	#endif
348		435
…		…
369	u32 digest_nid;	456	u32 digest_nid;
370		457
371	const u8 curflags () const	458	const u8 curflags () const
372	{	459	{
373	return 0x80	460	return 0x80
		461	\| 0x02
		462	#if PROTOCOL_MAJOR != 2
		463	#error hi
		464	#endif
374	\| (ENABLE_COMPRESSION ? 0x01 : 0x00)	465	\| (ENABLE_COMPRESSION ? 0x01 : 0x00);
375	\| (ENABLE_TRUST ? 0x02 : 0x00);
376	}	466	}
377		467
378	void setup (ptype type, int dst)	468	void setup (ptype type, int dst)
379	{	469	{
380	prot_major = PROTOCOL_MAJOR;	470	prot_major = PROTOCOL_MAJOR;
…		…
523		613
524	if (subtype != AUTH_INIT \|\| limiter.can (sa))	614	if (subtype != AUTH_INIT \|\| limiter.can (sa))
525	{	615	{
526	auth_packet *pkt = new auth_packet (conf->id, subtype);	616	auth_packet *pkt = new auth_packet (conf->id, subtype);
527		617
528	//printf ("send auth_packet subtype %d\n", subtype);//D
529
530	if (!k)	618	if (!k)
531	k = gen_challenge (sa);	619	k = gen_challenge (sa);
532		620
533	#if ENABLE_TRUST
534	if (0 > RSA_public_encrypt (sizeof (*k),	621	if (0 > RSA_public_encrypt (sizeof (*k),
535	(unsigned char )k, (unsigned char )&pkt->challenge,	622	(unsigned char )k, (unsigned char )&pkt->challenge,
536	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))	623	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
537	fatal ("RSA_public_encrypt error");	624	fatal ("RSA_public_encrypt error");
538	#else
539	# error untrusted mode not yet implemented: programemr does not know how to
540	rsaencrdata enc;
541
542	if (0 > RSA_private_encrypt (sizeof (*k),
543	(unsigned char )k, (unsigned char )&enc,
544	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
545	fatal ("RSA_private_encrypt error");
546
547	if (0 > RSA_public_encrypt (sizeof (enc),
548	(unsigned char )enc, (unsigned char )&pkt->challenge,
549	conf->rsa_key, RSA_NO_PADDING))
550	fatal ("RSA_public_encrypt error");
551	#endif
552		625
553	slog (L_TRACE, ">>%d PT_AUTH(%d) [%s]", conf->id, subtype, (const char *)sockinfo (sa));	626	slog (L_TRACE, ">>%d PT_AUTH(%d) [%s]", conf->id, subtype, (const char *)sockinfo (sa));
554		627
555	vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY);	628	vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY);
556		629
557	delete pkt;	630	delete pkt;
558	}	631	}
559	}	632	}
560		633
561	void	634	void
562	connection::establish_connection ()	635	connection::establish_connection_cb (tstamp &ts)
563	{	636	{
564	if (!ictx && conf != THISNODE && connectmode != conf_node::C_NEVER)	637	if (ictx \|\| conf == THISNODE \|\| connectmode == conf_node::C_NEVER)
		638	ts = TSTAMP_CANCEL;
		639	else if (ts <= NOW)
565	{	640	{
566	if (now >= next_retry)	641	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.25;
		642
		643	if (retry_int < 3600 * 8)
		644	retry_cnt++;
		645
		646	if (connectmode == conf_node::C_ONDEMAND
		647	&& retry_int > ::conf.keepalive)
		648	retry_int = ::conf.keepalive;
		649
		650	ts = NOW + retry_int;
		651
		652	if (conf->hostname)
567	{	653	{
568	int retry_int = retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2);
569
570	if (retry_cnt < (17 << 2) \| 3)
571	retry_cnt++;
572
573	if (connectmode == conf_node::C_ONDEMAND
574	&& retry_int > ::conf.keepalive)
575	retry_int = ::conf.keepalive;
576
577	next_retry = now + retry_int;
578	next_wakeup (next_retry);
579
580	if (conf->hostname)
581	{
582	reset_dstaddr ();	654	reset_dstaddr ();
583	if (sa.sin_addr.s_addr)	655	if (sa.sin_addr.s_addr)
584	if (retry_cnt < 4)	656	if (retry_cnt < 4)
585	send_auth (AUTH_INIT, &sa);	657	send_auth (AUTH_INIT, &sa);
586	else	658	else
587	send_ping (&sa, 0);	659	send_ping (&sa, 0);
588	}
589	else
590	vpn->connect_request (conf->id);
591	}	660	}
		661	else
		662	vpn->connect_request (conf->id);
592	}	663	}
593	}	664	}
594		665
595	void	666	void
596	connection::reset_connection ()	667	connection::reset_connection ()
…		…
610	octx = 0;	681	octx = 0;
611		682
612	sa.sin_port = 0;	683	sa.sin_port = 0;
613	sa.sin_addr.s_addr = 0;	684	sa.sin_addr.s_addr = 0;
614		685
615	next_retry = 0;
616	next_rekey = 0;
617	last_activity = 0;	686	last_activity = 0;
		687
		688	rekey.reset ();
		689	keepalive.reset ();
		690	establish_connection.reset ();
618	}	691	}
619		692
620	void	693	void
621	connection::shutdown ()	694	connection::shutdown ()
622	{	695	{
…		…
625		698
626	reset_connection ();	699	reset_connection ();
627	}	700	}
628		701
629	void	702	void
630	connection::rekey ()	703	connection::rekey_cb (tstamp &ts)
631	{	704	{
		705	ts = TSTAMP_CANCEL;
		706
632	reset_connection ();	707	reset_connection ();
633	establish_connection ();	708	establish_connection ();
634	}	709	}
635		710
636	void	711	void
…		…
641		716
642	if (conf->inherit_tos	717	if (conf->inherit_tos
643	&& (pkt)[12] == 0x08 && (pkt)[13] == 0x00 // IP	718	&& (pkt)[12] == 0x08 && (pkt)[13] == 0x00 // IP
644	&& ((*pkt)[14] & 0xf0) == 0x40) // IPv4	719	&& ((*pkt)[14] & 0xf0) == 0x40) // IPv4
645	tos = (*pkt)[15] & IPTOS_TOS_MASK;	720	tos = (*pkt)[15] & IPTOS_TOS_MASK;
646	printf ("%d %02x %02x %02x %02x = %02x\n", (int)conf->inherit_tos, (pkt)[12],(pkt)[13],(pkt)[14],(pkt)[15], tos);
647		721
648	p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs	722	p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
649	vpn->send_vpn_packet (p, &sa, tos);	723	vpn->send_vpn_packet (p, &sa, tos);
650		724
651	delete p;	725	delete p;
…		…
669	}	743	}
670		744
671	void	745	void
672	connection::recv_vpn_packet (vpn_packet pkt, SOCKADDR ssa)	746	connection::recv_vpn_packet (vpn_packet pkt, SOCKADDR ssa)
673	{	747	{
674	last_activity = now;	748	last_activity = NOW;
675		749
676	slog (L_NOISE, "<<%d received packet type %d from %d to %d",	750	slog (L_NOISE, "<<%d received packet type %d from %d to %d",
677	conf->id, pkt->typ (), pkt->src (), pkt->dst ());	751	conf->id, pkt->typ (), pkt->src (), pkt->dst ());
678		752
679	switch (pkt->typ ())	753	switch (pkt->typ ())
…		…
687	// so reset the retry counter and establish a conenction	761	// so reset the retry counter and establish a conenction
688	// when we receive a pong.	762	// when we receive a pong.
689	if (!ictx && !octx)	763	if (!ictx && !octx)
690	{	764	{
691	retry_cnt = 0;	765	retry_cnt = 0;
692	next_retry = 0;	766	establish_connection.at = 0;
693	establish_connection ();	767	establish_connection ();
694	}	768	}
695		769
696	break;	770	break;
697		771
698	case vpn_packet::PT_RESET:	772	case vpn_packet::PT_RESET:
699	{	773	{
700	reset_connection ();	774	reset_connection ();
701		775
702	config_packet p = (config_packet ) pkt;	776	config_packet p = (config_packet ) pkt;
703	if (p->chk_config ())	777	if (!p->chk_config ())
		778	{
		779	slog (L_WARN, _("disabling node '%s' because of differing protocol"), conf->nodename);
		780	connectmode = conf_node::C_NEVER;
		781	}
704	if (connectmode == conf_node::C_ALWAYS)	782	else if (connectmode == conf_node::C_ALWAYS)
705	establish_connection ();	783	establish_connection ();
706
707	//D slog the protocol mismatch?
708	}	784	}
709	break;	785	break;
710		786
711	case vpn_packet::PT_AUTH:	787	case vpn_packet::PT_AUTH:
712	{	788	{
…		…
724	if (p->subtype == AUTH_INIT)	800	if (p->subtype == AUTH_INIT)
725	send_auth (AUTH_INITREPLY, ssa);	801	send_auth (AUTH_INITREPLY, ssa);
726		802
727	rsachallenge k;	803	rsachallenge k;
728		804
729	#if ENABLE_TRUST
730	if (0 > RSA_private_decrypt (sizeof (rsaencrdata),	805	if (0 > RSA_private_decrypt (sizeof (rsaencrdata),
731	(unsigned char )&p->challenge, (unsigned char )&k,	806	(unsigned char )&p->challenge, (unsigned char )&k,
732	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))	807	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
733	// continued below
734	#else
735	rsaencrdata j;
736
737	if (0 > RSA_private_decrypt (sizeof (rsaencrdata),
738	(unsigned char )&p->challenge, (unsigned char )&j,
739	::conf.rsa_key, RSA_NO_PADDING))
740	fatal ("RSA_private_decrypt error");
741
742	if (0 > RSA_public_decrypt (sizeof (k),
743	(unsigned char )&j, (unsigned char )&k,
744	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
745	// continued below
746	#endif
747	{	808	{
748	slog (L_ERR, _("challenge from %s (%s) illegal or corrupted"),	809	slog (L_ERR, _("challenge from %s (%s) illegal or corrupted"),
749	conf->nodename, (const char *)sockinfo (ssa));	810	conf->nodename, (const char *)sockinfo (ssa));
750	break;	811	break;
751	}	812	}
752		813
753	retry_cnt = 0;	814	retry_cnt = 0;
754	next_retry = now + 8;	815	establish_connection.set (NOW + 8); //? ;)
		816	keepalive.reset ();
		817	rekey.reset ();
755		818
756	switch (p->subtype)	819	switch (p->subtype)
757	{	820	{
758	case AUTH_INIT:	821	case AUTH_INIT:
759	case AUTH_INITREPLY:	822	case AUTH_INITREPLY:
…		…
773	if (!memcmp ((u8 )gen_challenge (ssa) + sizeof (u32), (u8 )&k + sizeof (u32),	836	if (!memcmp ((u8 )gen_challenge (ssa) + sizeof (u32), (u8 )&k + sizeof (u32),
774	sizeof (rsachallenge) - sizeof (u32)))	837	sizeof (rsachallenge) - sizeof (u32)))
775	{	838	{
776	delete ictx;	839	delete ictx;
777		840
778	ictx = new crypto_ctx (k, 0);	841	ictx = new crypto_ctx (k, 0);
779	iseqno = (u32 )&k[CHG_SEQNO] & 0x7fffffff; // at least 2**31 sequence numbers are valid	842	iseqno.reset ((u32 )&k[CHG_SEQNO] & 0x7fffffff); // at least 2**31 sequence numbers are valid
780	ismask = 0xffffffff; // initially, all lower sequence numbers are invalid
781		843
782	sa = *ssa;	844	sa = *ssa;
783		845
784	next_rekey = now + ::conf.rekey;	846	rekey.set (NOW + ::conf.rekey);
785	next_wakeup (next_rekey);	847	keepalive.set (NOW + ::conf.keepalive);
786		848
787	// send queued packets	849	// send queued packets
788	while (tap_packet *p = queue.get ())	850	while (tap_packet *p = queue.get ())
789	{	851	{
790	send_data_packet (p);	852	send_data_packet (p);
…		…
835	else	897	else
836	{	898	{
837	u32 seqno;	899	u32 seqno;
838	tap_packet *d = p->unpack (this, seqno);	900	tap_packet *d = p->unpack (this, seqno);
839		901
840	if (seqno <= iseqno - 32)	902	if (iseqno.recv_ok (seqno))
841	slog (L_ERR, _("received duplicate or outdated packet (received %08lx, expected %08lx)\n"
842	"possible replay attack, or just massive packet reordering"), seqno, iseqno + 1);//D
843	else if (seqno > iseqno + 32)
844	slog (L_ERR, _("received duplicate or out-of-sync packet (received %08lx, expected %08lx)\n"
845	"possible replay attack, or just massive packet loss"), seqno, iseqno + 1);//D
846	else
847	{	903	{
848	if (seqno > iseqno)
849	{
850	ismask <<= seqno - iseqno;
851	iseqno = seqno;
852	}
853
854	u32 mask = 1 << (iseqno - seqno);
855
856	//printf ("received seqno %08lx, iseqno %08lx, mask %08lx is %08lx\n", seqno, iseqno, mask, ismask);
857	if (ismask & mask)
858	slog (L_ERR, _("received duplicate packet (received %08lx, expected %08lx)\n"
859	"possible replay attack, or just packet duplication"), seqno, iseqno + 1);//D
860	else
861	{
862	ismask \|= mask;
863
864	vpn->tap->send (d);	904	vpn->tap->send (d);
865		905
866	if (p->dst () == 0) // re-broadcast	906	if (p->dst () == 0) // re-broadcast
867	for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)	907	for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
868	{	908	{
869	connection c = i;	909	connection c = i;
870		910
871	if (c->conf != THISNODE && c->conf != conf)	911	if (c->conf != THISNODE && c->conf != conf)
872	c->inject_data_packet (d);	912	c->inject_data_packet (d);
873	}
874
875	delete d;
876
877	break;
878	}	913	}
		914
		915	delete d;
		916
		917	break;
879	}	918	}
880	}	919	}
881	}	920	}
882	else	921	else
883	slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D	922	slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D
…		…
954	send_reset (ssa);	993	send_reset (ssa);
955	break;	994	break;
956	}	995	}
957	}	996	}
958		997
959	void connection::timer ()	998	void connection::keepalive_cb (tstamp &ts)
960	{	999	{
961	if (conf != THISNODE)	1000	if (NOW >= last_activity + ::conf.keepalive + 30)
962	{	1001	{
963	if (now >= next_retry && connectmode == conf_node::C_ALWAYS)	1002	reset_connection ();
964	establish_connection ();	1003	establish_connection ();
965		1004	}
966	if (ictx && octx)
967	{
968	if (now >= next_rekey)
969	rekey ();
970	else if (now >= last_activity + ::conf.keepalive + 30)
971	{
972	reset_connection ();
973	establish_connection ();
974	}
975	else if (now >= last_activity + ::conf.keepalive)	1005	else if (NOW < last_activity + ::conf.keepalive)
		1006	ts = last_activity + ::conf.keepalive;
976	if (conf->connectmode != conf_node::C_ONDEMAND	1007	else if (conf->connectmode != conf_node::C_ONDEMAND
977	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)	1008	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)
		1009	{
978	send_ping (&sa);	1010	send_ping (&sa);
979	else	1011	ts = NOW + 5;
		1012	}
		1013	else
980	reset_connection ();	1014	reset_connection ();
981		1015
982	}
983	}
984	}	1016	}
985		1017
986	void connection::connect_request (int id)	1018	void connection::connect_request (int id)
987	{	1019	{
988	connect_req_packet *p = new connect_req_packet (conf->id, id);	1020	connect_req_packet *p = new connect_req_packet (conf->id, id);
…		…
1025	putenv ("STATE=down");	1057	putenv ("STATE=down");
1026		1058
1027	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";	1059	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1028	}	1060	}
1029		1061
		1062	connection::connection(struct vpn *vpn_)
		1063	: vpn(vpn_)
		1064	, rekey (this, &connection::rekey_cb)
		1065	, keepalive (this, &connection::keepalive_cb)
		1066	, establish_connection (this, &connection::establish_connection_cb)
		1067	{
		1068	octx = ictx = 0;
		1069	retry_cnt = 0;
		1070
		1071	connectmode = conf_node::C_ALWAYS; // initial setting
		1072	reset_connection ();
		1073	}
		1074
		1075	connection::~connection ()
		1076	{
		1077	shutdown ();
		1078	}
		1079
1030	/////////////////////////////////////////////////////////////////////////////	1080	/////////////////////////////////////////////////////////////////////////////
1031
1032	vpn::vpn (void)
1033	{}
1034		1081
1035	const char *vpn::script_if_up ()	1082	const char *vpn::script_if_up ()
1036	{	1083	{
1037	// the tunnel device mtu should be the physical mtu - overhead	1084	// the tunnel device mtu should be the physical mtu - overhead
1038	// the tricky part is rounding to the cipher key blocksize	1085	// the tricky part is rounding to the cipher key blocksize
…		…
1089	{	1136	{
1090	int oval = 1;	1137	int oval = 1;
1091	setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	1138	setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
1092	}	1139	}
1093		1140
		1141	udp_ev_watcher.start (socket_fd, POLLIN);
		1142
1094	tap = new tap_device ();	1143	tap = new tap_device ();
1095	if (!tap) //D this, of course, never catches	1144	if (!tap) //D this, of course, never catches
1096	{	1145	{
1097	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);	1146	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
1098	exit (1);	1147	exit (1);
1099	}	1148	}
1100		1149
1101	run_script (this, &vpn::script_if_up, true);	1150	run_script (this, &vpn::script_if_up, true);
		1151
		1152	vpn_ev_watcher.start (tap->fd, POLLIN);
		1153
		1154	reconnect_all ();
1102		1155
1103	return 0;	1156	return 0;
1104	}	1157	}
1105		1158
1106	void	1159	void
…		…
1171	// if ((*i)->conf->routerprio)	1224	// if ((*i)->conf->routerprio)
1172	// (*i)->establish_connection ();	1225	// (*i)->establish_connection ();
1173	}	1226	}
1174		1227
1175	void	1228	void
1176	vpn::main_loop ()	1229	vpn::udp_ev (short revents)
1177	{	1230	{
1178	struct pollfd pollfd[2];	1231	if (revents & (POLLIN \| POLLERR))
1179
1180	pollfd[0].fd = tap->fd;
1181	pollfd[0].events = POLLIN;
1182	pollfd[1].fd = socket_fd;
1183	pollfd[1].events = POLLIN;
1184
1185	events = 0;
1186	now = time (0);
1187	next_timecheck = now + 1;
1188
1189	reconnect_all ();
1190
1191	for (;;)
1192	{	1232	{
1193	int npoll = poll (pollfd, 2, (next_timecheck - now) * 1000);	1233	vpn_packet *pkt = new vpn_packet;
1194		1234	struct sockaddr_in sa;
1195	now = time (0);	1235	socklen_t sa_len = sizeof (sa);
		1236	int len;
1196		1237
		1238	len = recvfrom (socket_fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
		1239
1197	if (npoll > 0)	1240	if (len > 0)
1198	{	1241	{
1199	if (pollfd[1].revents)	1242	pkt->len = len;
		1243
		1244	unsigned int src = pkt->src ();
		1245	unsigned int dst = pkt->dst ();
		1246
		1247	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
		1248	(const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
		1249
		1250	if (dst > conns.size () \|\| pkt->typ () >= vpn_packet::PT_MAX)
		1251	slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
		1252	pkt->typ (), pkt->src (), pkt->dst ());
		1253	else if (dst == 0 && !THISNODE->routerprio)
		1254	slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
		1255	else if (dst != 0 && dst != THISNODE->id)
		1256	slog (L_WARN,
		1257	_("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
		1258	dst, conns[dst - 1]->conf->nodename,
		1259	(const char *)sockinfo (sa),
		1260	THISNODE->id, THISNODE->nodename);
		1261	else if (src == 0 \|\| src > conns.size ())
		1262	slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
		1263	else
		1264	conns[src - 1]->recv_vpn_packet (pkt, &sa);
		1265	}
		1266	else
		1267	{
		1268	// probably ECONNRESET or somesuch
		1269	slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno));
		1270	}
		1271
		1272	delete pkt;
		1273	}
		1274	else if (revents & POLLHUP)
		1275	{
		1276	// this cannot ;) happen on udp sockets
		1277	slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating."));
		1278	exit (1);
		1279	}
		1280	else
		1281	{
		1282	slog (L_ERR,
		1283	_("FATAL: unknown revents %08x in socket, terminating\n"),
		1284	revents);
		1285	exit (1);
		1286	}
		1287	}
		1288
		1289	void
		1290	vpn::vpn_ev (short revents)
		1291	{
		1292	if (revents & POLLIN)
		1293	{
		1294	/* process data */
		1295	tap_packet *pkt;
		1296
		1297	pkt = tap->recv ();
		1298
		1299	int dst = mac2id (pkt->dst);
		1300	int src = mac2id (pkt->src);
		1301
		1302	if (src != THISNODE->id)
		1303	{
		1304	slog (L_ERR, _("FATAL: tap packet not originating on current node received, terminating."));
		1305	exit (1);
		1306	}
		1307
		1308	if (dst == THISNODE->id)
		1309	{
		1310	slog (L_ERR, _("FATAL: tap packet destined for current node received, terminating."));
		1311	exit (1);
		1312	}
		1313
		1314	if (dst > conns.size ())
		1315	slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
		1316	else
		1317	{
		1318	if (dst)
1200	{	1319	{
1201	if (pollfd[1].revents & (POLLIN \| POLLERR))	1320	// unicast
1202	{
1203	vpn_packet *pkt = new vpn_packet;
1204	struct sockaddr_in sa;
1205	socklen_t sa_len = sizeof (sa);
1206	int len;
1207
1208	len = recvfrom (socket_fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
1209
1210	if (len > 0)
1211	{
1212	pkt->len = len;
1213
1214	unsigned int src = pkt->src ();
1215	unsigned int dst = pkt->dst ();
1216
1217	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1218	(const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1219
1220	if (dst > conns.size () \|\| pkt->typ () >= vpn_packet::PT_MAX)
1221	slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1222	pkt->typ (), pkt->src (), pkt->dst ());
1223	else if (dst == 0 && !THISNODE->routerprio)
1224	slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1225	else if (dst != 0 && dst != THISNODE->id)	1321	if (dst != THISNODE->id)
1226	slog (L_WARN,
1227	_("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1228	dst, conns[dst - 1]->conf->nodename,
1229	(const char *)sockinfo (sa),
1230	THISNODE->id, THISNODE->nodename);
1231	else if (src == 0 \|\| src > conns.size ())
1232	slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
1233	else
1234	conns[src - 1]->recv_vpn_packet (pkt, &sa);	1322	conns[dst - 1]->inject_data_packet (pkt);
1235	}
1236	else
1237	{
1238	// probably ECONNRESET or somesuch
1239	slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno));
1240	}
1241
1242	delete pkt;
1243	}	1323	}
1244	else if (pollfd[1].revents & POLLHUP)	1324	else
1245	{	1325	{
1246	// this cannot ;) happen on udp sockets	1326	// broadcast, first check router, then self, then english
1247	slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating."));	1327	connection *router = find_router ();
1248	exit (1);	1328
1249	}	1329	if (router)
		1330	router->inject_data_packet (pkt, true);
1250	else	1331	else
1251	{
1252	slog (L_ERR,
1253	_("FATAL: unknown revents %08x in socket, terminating\n"),
1254	pollfd[1].revents);
1255	exit (1);
1256	}
1257	}
1258
1259	// I use else here to give vpn_packets absolute priority
1260	else if (pollfd[0].revents)
1261	{
1262	if (pollfd[0].revents & POLLIN)
1263	{
1264	/* process data */
1265	tap_packet *pkt;
1266
1267	pkt = tap->recv ();
1268
1269	int dst = mac2id (pkt->dst);
1270	int src = mac2id (pkt->src);
1271
1272	if (src != THISNODE->id)
1273	{
1274	slog (L_ERR, _("FATAL: tap packet not originating on current node received, terminating."));
1275	exit (1);
1276	}
1277
1278	if (dst == THISNODE->id)
1279	{
1280	slog (L_ERR, _("FATAL: tap packet destined for current node received, terminating."));
1281	exit (1);
1282	}
1283
1284	if (dst > conns.size ())
1285	slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
1286	else
1287	{
1288	if (dst)
1289	{
1290	// unicast
1291	if (dst != THISNODE->id)
1292	conns[dst - 1]->inject_data_packet (pkt);
1293	}
1294	else
1295	{
1296	// broadcast, first check router, then self, then english
1297	connection *router = find_router ();
1298
1299	if (router)
1300	router->inject_data_packet (pkt, true);
1301	else
1302	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	1332	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1303	if ((*c)->conf != THISNODE)	1333	if ((*c)->conf != THISNODE)
1304	(*c)->inject_data_packet (pkt);	1334	(*c)->inject_data_packet (pkt);
1305	}
1306	}
1307
1308	delete pkt;
1309	}
1310	else if (pollfd[0].revents & (POLLHUP \| POLLERR))
1311	{
1312	slog (L_ERR, _("FATAL: POLLHUP or POLLERR on network device fd, terminating."));
1313	exit (1);
1314	}
1315	else
1316	abort ();
1317	}	1335	}
1318	}	1336	}
1319		1337
		1338	delete pkt;
		1339	}
		1340	else if (revents & (POLLHUP \| POLLERR))
		1341	{
		1342	slog (L_ERR, _("FATAL: POLLHUP or POLLERR on network device fd, terminating."));
		1343	exit (1);
		1344	}
		1345	else
		1346	abort ();
		1347	}
		1348
		1349	void
		1350	vpn::event_cb (tstamp &ts)
		1351	{
1320	if (events)	1352	if (events)
		1353	{
		1354	if (events & EVENT_SHUTDOWN)
1321	{	1355	{
1322	if (events & EVENT_SHUTDOWN)
1323	{
1324	shutdown_all ();	1356	shutdown_all ();
1325		1357
1326	remove_pid (pidfilename);	1358	remove_pid (pidfilename);
1327		1359
1328	slog (L_INFO, _("vped terminating"));	1360	slog (L_INFO, _("vped terminating"));
1329		1361
1330	exit (0);	1362	exit (0);
1331	}
1332
1333	if (events & EVENT_RECONNECT)
1334	reconnect_all ();
1335
1336	events = 0;
1337	}	1363	}
1338		1364
1339	// very very very dumb and crude and inefficient timer handling, or maybe not?	1365	if (events & EVENT_RECONNECT)
1340	if (now >= next_timecheck)	1366	reconnect_all ();
1341	{
1342	next_timecheck = now + TIMER_GRANULARITY;
1343		1367
1344	for (conns_vector::iterator c = conns.begin ();	1368	events = 0;
1345	c != conns.end (); ++c)
1346	(*c)->timer ();
1347	}
1348	}	1369	}
		1370
		1371	ts = TSTAMP_CANCEL;
		1372	}
		1373
		1374	vpn::vpn (void)
		1375	: udp_ev_watcher (this, &vpn::udp_ev)
		1376	, vpn_ev_watcher (this, &vpn::vpn_ev)
		1377	, event (this, &vpn::event_cb)
		1378	{
1349	}	1379	}
1350		1380
1351	vpn::~vpn ()	1381	vpn::~vpn ()
1352	{}	1382	{
		1383	}
1353		1384

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/protocol.C (file contents): Revision 1.6 by pcg, Sun Mar 9 12:40:18 2003 UTC vs. Revision 1.9 by pcg, Fri Mar 21 23:17:01 2003 UTC

Diff Legend

Comparing gvpe/src/protocol.C (file contents):
Revision 1.6 by pcg, Sun Mar 9 12:40:18 2003 UTC vs.
Revision 1.9 by pcg, Fri Mar 21 23:17:01 2003 UTC