ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/protocol.C
(Generate patch)

Comparing gvpe/src/protocol.C (file contents):
Revision 1.1 by pcg, Sat Mar 1 15:53:03 2003 UTC vs.
Revision 1.11 by pcg, Sat Mar 22 21:35:07 2003 UTC

… …
16 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 16 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17*/ 17*/
18 18
19#include "config.h" 19#include "config.h"
20 20
21#include <list>
22
21#include <cstdlib> 23#include <cstdlib>
22#include <cstring> 24#include <cstring>
23#include <cstdio> 25#include <cstdio>
24 26
25#include <sys/types.h> 27#include <sys/types.h>
… …
60 62
61static const rsachallenge & 63static const rsachallenge &
62challenge_bytes () 64challenge_bytes ()
63{ 65{
64 static rsachallenge challenge; 66 static rsachallenge challenge;
65 static time_t challenge_ttl; // time this challenge needs to be recreated 67 static double challenge_ttl; // time this challenge needs to be recreated
66 68
67 if (now > challenge_ttl) 69 if (NOW > challenge_ttl)
68 { 70 {
69 RAND_bytes ((unsigned char *)&challenge, sizeof (challenge)); 71 RAND_bytes ((unsigned char *)&challenge, sizeof (challenge));
70 challenge_ttl = now + CHALLENGE_TTL; 72 challenge_ttl = NOW + CHALLENGE_TTL;
71 } 73 }
72 74
73 return challenge; 75 return challenge;
76}
77
78// caching of rsa operations really helps slow computers
79struct rsa_entry {
80 tstamp expire;
81 rsachallenge chg;
82 RSA *key; // which key
83 rsaencrdata encr;
84
85 rsa_entry ()
86 {
87 expire = NOW + CHALLENGE_TTL;
88 }
89};
90
91struct rsa_cache : list<rsa_entry>
92{
93 void cleaner_cb (tstamp &ts); time_watcher cleaner;
94
95 const rsaencrdata *public_encrypt (RSA *key, const rsachallenge &chg)
96 {
97 for (iterator i = begin (); i != end (); ++i)
98 {
99 if (i->key == key && !memcmp (&chg, &i->chg, sizeof chg))
100 return &i->encr;
101 }
102
103 if (cleaner.at < NOW)
104 cleaner.start (NOW + CHALLENGE_TTL);
105
106 resize (size () + 1);
107 rsa_entry *e = &(*rbegin ());
108
109 e->key = key;
110 memcpy (&e->chg, &chg, sizeof chg);
111
112 if (0 > RSA_public_encrypt (sizeof chg,
113 (unsigned char *)&chg, (unsigned char *)&e->encr,
114 key, RSA_PKCS1_OAEP_PADDING))
115 fatal ("RSA_public_encrypt error");
116
117 return &e->encr;
118 }
119
120 const rsachallenge *private_decrypt (RSA *key, const rsaencrdata &encr)
121 {
122 for (iterator i = begin (); i != end (); ++i)
123 if (i->key == key && !memcmp (&encr, &i->encr, sizeof encr))
124 return &i->chg;
125
126 if (cleaner.at < NOW)
127 cleaner.start (NOW + CHALLENGE_TTL);
128
129 resize (size () + 1);
130 rsa_entry *e = &(*rbegin ());
131
132 e->key = key;
133 memcpy (&e->encr, &encr, sizeof encr);
134
135 if (0 > RSA_private_decrypt (sizeof encr,
136 (unsigned char *)&encr, (unsigned char *)&e->chg,
137 key, RSA_PKCS1_OAEP_PADDING))
138 {
139 pop_back ();
140 return 0;
141 }
142
143 return &e->chg;
144 }
145
146 rsa_cache ()
147 : cleaner (this, &rsa_cache::cleaner_cb)
148 { }
149
150} rsa_cache;
151
152void rsa_cache::cleaner_cb (tstamp &ts)
153{
154 if (empty ())
155 ts = TSTAMP_CANCEL;
156 else
157 {
158 ts = NOW + 3;
159 for (iterator i = begin (); i != end (); )
160 {
161 if (i->expire >= NOW)
162 i = erase (i);
163 else
164 ++i;
165 }
166 }
74} 167}
75 168
76// run a script. yes, it's a template function. yes, c++ 169// run a script. yes, it's a template function. yes, c++
77// is not a functional language. yes, this suxx. 170// is not a functional language. yes, this suxx.
78template<class owner> 171template<class owner>
… …
112struct crypto_ctx 205struct crypto_ctx
113 { 206 {
114 EVP_CIPHER_CTX cctx; 207 EVP_CIPHER_CTX cctx;
115 HMAC_CTX hctx; 208 HMAC_CTX hctx;
116 209
117 crypto_ctx (rsachallenge &challenge, int enc); 210 crypto_ctx (const rsachallenge &challenge, int enc);
118 ~crypto_ctx (); 211 ~crypto_ctx ();
119 }; 212 };
120 213
121crypto_ctx::crypto_ctx (rsachallenge &challenge, int enc) 214crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)
122{ 215{
123 EVP_CIPHER_CTX_init (&cctx); 216 EVP_CIPHER_CTX_init (&cctx);
124 EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc); 217 EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc);
125 HMAC_CTX_init (&hctx); 218 HMAC_CTX_init (&hctx);
126 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0); 219 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
… …
128 221
129crypto_ctx::~crypto_ctx () 222crypto_ctx::~crypto_ctx ()
130{ 223{
131 EVP_CIPHER_CTX_cleanup (&cctx); 224 EVP_CIPHER_CTX_cleanup (&cctx);
132 HMAC_CTX_cleanup (&hctx); 225 HMAC_CTX_cleanup (&hctx);
226}
227
228//////////////////////////////////////////////////////////////////////////////
229
230void pkt_queue::put (tap_packet *p)
231{
232 if (queue[i])
233 {
234 delete queue[i];
235 j = (j + 1) % QUEUEDEPTH;
236 }
237
238 queue[i] = p;
239
240 i = (i + 1) % QUEUEDEPTH;
241}
242
243tap_packet *pkt_queue::get ()
244{
245 tap_packet *p = queue[j];
246
247 if (p)
248 {
249 queue[j] = 0;
250 j = (j + 1) % QUEUEDEPTH;
251 }
252
253 return p;
254}
255
256pkt_queue::pkt_queue ()
257{
258 memset (queue, 0, sizeof (queue));
259 i = 0;
260 j = 0;
261}
262
263pkt_queue::~pkt_queue ()
264{
265 for (i = QUEUEDEPTH; --i > 0; )
266 delete queue[i];
267}
268
269// only do action once every x seconds per host.
270// currently this is quite a slow implementation,
271// but suffices for normal operation.
272struct u32_rate_limiter : private map<u32, tstamp>
273 {
274 tstamp every;
275
276 bool can (u32 host);
277
278 u32_rate_limiter (tstamp every = 1)
279 {
280 this->every = every;
281 }
282 };
283
284struct net_rate_limiter : u32_rate_limiter
285 {
286 bool can (SOCKADDR *sa) { return u32_rate_limiter::can((u32)sa->sin_addr.s_addr); }
287 bool can (sockinfo &si) { return u32_rate_limiter::can((u32)si.host); }
288
289 net_rate_limiter (tstamp every) : u32_rate_limiter (every) {}
290 };
291
292bool u32_rate_limiter::can (u32 host)
293{
294 iterator i;
295
296 for (i = begin (); i != end (); )
297 if (i->second <= NOW)
298 {
299 erase (i);
300 i = begin ();
301 }
302 else
303 ++i;
304
305 i = find (host);
306
307 if (i != end ())
308 return false;
309
310 insert (value_type (host, NOW + every));
311
312 return true;
133} 313}
134 314
135///////////////////////////////////////////////////////////////////////////// 315/////////////////////////////////////////////////////////////////////////////
136 316
137static void next_wakeup (time_t next) 317static void next_wakeup (time_t next)
… …
200 380
201 unsigned int src () 381 unsigned int src ()
202 { 382 {
203 return src1 | ((srcdst >> 4) << 8); 383 return src1 | ((srcdst >> 4) << 8);
204 } 384 }
385
205 unsigned int dst () 386 unsigned int dst ()
206 { 387 {
207 return dst1 | ((srcdst & 0xf) << 8); 388 return dst1 | ((srcdst & 0xf) << 8);
208 } 389 }
390
209 ptype typ () 391 ptype typ ()
210 { 392 {
211 return (ptype) type; 393 return (ptype) type;
212 } 394 }
213 }; 395 };
… …
252 u32 cl; 434 u32 cl;
253 435
254 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7); 436 cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
255 if (cl) 437 if (cl)
256 { 438 {
257 //printf ("compressed packet, %d => %d\n", l, cl);//D
258 type = PT_DATA_COMPRESSED; 439 type = PT_DATA_COMPRESSED;
259 d = cdata; 440 d = cdata;
260 l = cl + 2; 441 l = cl + 2;
261 442
262 d[0] = cl >> 8; 443 d[0] = cl >> 8;
… …
330 EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2); 511 EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2);
331 outl += outl2; 512 outl += outl2;
332 513
333 seqno = *(u32 *)(d + RAND_SIZE); 514 seqno = *(u32 *)(d + RAND_SIZE);
334 515
335 id2mac (dst (), p->dst); 516 id2mac (dst () ? dst() : THISNODE->id, p->dst);
336 id2mac (src (), p->src); 517 id2mac (src (), p->src);
337 518
338#if ENABLE_COMPRESSION 519#if ENABLE_COMPRESSION
339 if (type == PT_DATA_COMPRESSED) 520 if (type == PT_DATA_COMPRESSED)
340 { 521 {
341 u32 cl = (d[DATAHDR] << 8) | d[DATAHDR + 1]; 522 u32 cl = (d[DATAHDR] << 8) | d[DATAHDR + 1];
342 p->len = lzf_decompress (d + DATAHDR + 2, cl, &(*p)[6 + 6], MAX_MTU) + 6 + 6; 523 p->len = lzf_decompress (d + DATAHDR + 2, cl, &(*p)[6 + 6], MAX_MTU) + 6 + 6;
343 //printf ("decompressxed %d(%d) => %d\n", cl, len - data_hdr_size (), p->len);//D
344 } 524 }
345 else 525 else
346 p->len = outl + (6 + 6 - DATAHDR); 526 p->len = outl + (6 + 6 - DATAHDR);
347#endif 527#endif
348 528
… …
369 u32 digest_nid; 549 u32 digest_nid;
370 550
371 const u8 curflags () const 551 const u8 curflags () const
372 { 552 {
373 return 0x80 553 return 0x80
554 | 0x02
555#if PROTOCOL_MAJOR != 2
556#error hi
557#endif
374 | (ENABLE_COMPRESSION ? 0x01 : 0x00) 558 | (ENABLE_COMPRESSION ? 0x01 : 0x00);
375 | (ENABLE_TRUST ? 0x02 : 0x00);
376 } 559 }
377 560
378 void setup (ptype type, int dst) 561 void setup (ptype type, int dst)
379 { 562 {
380 prot_major = PROTOCOL_MAJOR; 563 prot_major = PROTOCOL_MAJOR;
… …
481connection::send_ping (SOCKADDR *dsa, u8 pong) 664connection::send_ping (SOCKADDR *dsa, u8 pong)
482{ 665{
483 ping_packet *pkt = new ping_packet; 666 ping_packet *pkt = new ping_packet;
484 667
485 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 668 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
486 vpn->send_vpn_packet (pkt, dsa); 669 vpn->send_vpn_packet (pkt, dsa, IPTOS_LOWDELAY);
487 670
488 delete pkt; 671 delete pkt;
489} 672}
490 673
491void 674void
492connection::send_reset (SOCKADDR *dsa) 675connection::send_reset (SOCKADDR *dsa)
493{ 676{
494 static net_rate_limiter limiter(1); 677 static net_rate_limiter limiter(1);
495 678
496 if (limiter.can (dsa)) 679 if (limiter.can (dsa) && connectmode != conf_node::C_DISABLED)
497 { 680 {
498 config_packet *pkt = new config_packet; 681 config_packet *pkt = new config_packet;
499 682
500 pkt->setup (vpn_packet::PT_RESET, conf->id); 683 pkt->setup (vpn_packet::PT_RESET, conf->id);
501 vpn->send_vpn_packet (pkt, dsa); 684 vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST);
502 685
503 delete pkt; 686 delete pkt;
504 } 687 }
505} 688}
506 689
507static rsachallenge * 690static rsachallenge *
508gen_challenge (SOCKADDR *sa) 691gen_challenge (u32 seqrand, SOCKADDR *sa)
509{ 692{
510 static rsachallenge k; 693 static rsachallenge k;
511 694
512 memcpy (&k, &challenge_bytes (), sizeof (k)); 695 memcpy (&k, &challenge_bytes (), sizeof (k));
513 RAND_bytes ((unsigned char *)&k[CHG_SEQNO], sizeof (u32)); 696 *(u32 *)&k[CHG_SEQNO] ^= seqrand;
514 xor_sa (k, sa); 697 xor_sa (k, sa);
515 698
516 return &k; 699 return &k;
517} 700}
518 701
519void 702void
520connection::send_auth (auth_subtype subtype, SOCKADDR *sa, rsachallenge *k) 703connection::send_auth (auth_subtype subtype, SOCKADDR *sa, const rsachallenge *k)
521{ 704{
522 static net_rate_limiter limiter(2); 705 static net_rate_limiter limiter(0.2);
523 706
524 if (subtype != AUTH_INIT || limiter.can (sa)) 707 if (subtype != AUTH_INIT || limiter.can (sa))
525 { 708 {
709 if (!k)
710 k = gen_challenge (seqrand, sa);
711
526 auth_packet *pkt = new auth_packet (conf->id, subtype); 712 auth_packet *pkt = new auth_packet (conf->id, subtype);
527 713
528 //printf ("send auth_packet subtype %d\n", subtype);//D 714 memcpy (pkt->challenge, rsa_cache.public_encrypt (conf->rsa_key, *k), sizeof (rsaencrdata));
529
530 if (!k)
531 k = gen_challenge (sa);
532
533#if ENABLE_TRUST
534 if (0 > RSA_public_encrypt (sizeof (*k),
535 (unsigned char *)k, (unsigned char *)&pkt->challenge,
536 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
537 fatal ("RSA_public_encrypt error");
538#else
539# error untrusted mode not yet implemented: programemr does not know how to
540 rsaencrdata enc;
541
542 if (0 > RSA_private_encrypt (sizeof (*k),
543 (unsigned char *)k, (unsigned char *)&enc,
544 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
545 fatal ("RSA_private_encrypt error");
546
547 if (0 > RSA_public_encrypt (sizeof (enc),
548 (unsigned char *)enc, (unsigned char *)&pkt->challenge,
549 conf->rsa_key, RSA_NO_PADDING))
550 fatal ("RSA_public_encrypt error");
551#endif
552 715
553 slog (L_TRACE, ">>%d PT_AUTH(%d) [%s]", conf->id, subtype, (const char *)sockinfo (sa)); 716 slog (L_TRACE, ">>%d PT_AUTH(%d) [%s]", conf->id, subtype, (const char *)sockinfo (sa));
554 717
555 vpn->send_vpn_packet (pkt, sa); 718 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY);
556 719
557 delete pkt; 720 delete pkt;
558 } 721 }
559} 722}
560 723
561void 724void
562connection::establish_connection () 725connection::establish_connection_cb (tstamp &ts)
563{ 726{
564 if (!ictx && conf != THISNODE && conf->connectmode != conf_node::C_NEVER) 727 if (ictx || conf == THISNODE || connectmode == conf_node::C_NEVER)
728 ts = TSTAMP_CANCEL;
729 else if (ts <= NOW)
565 { 730 {
566 if (now >= next_retry) 731 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.25;
567 {
568 int retry_int = retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2);
569 732
570 if (retry_cnt < (17 << 2) | 3) 733 if (retry_int < 3600 * 8)
571 retry_cnt++; 734 retry_cnt++;
572 735
573 if (conf->connectmode == conf_node::C_ONDEMAND 736 if (connectmode == conf_node::C_ONDEMAND
574 && retry_int > ::conf.keepalive) 737 && retry_int > ::conf.keepalive)
575 retry_int = ::conf.keepalive; 738 retry_int = ::conf.keepalive;
576 739
577 next_retry = now + retry_int; 740 ts = NOW + retry_int;
578 next_wakeup (next_retry);
579 741
580 if (conf->hostname) 742 if (conf->hostname)
581 { 743 {
582 reset_dstaddr (); 744 reset_dstaddr ();
583 if (sa.sin_addr.s_addr) 745 if (sa.sin_addr.s_addr)
584 if (retry_cnt < 4) 746 if (retry_cnt < 4)
585 send_auth (AUTH_INIT, &sa); 747 send_auth (AUTH_INIT, &sa);
586 else 748 else
587 send_ping (&sa, 0); 749 send_ping (&sa, 0);
588 } 750 }
589 else 751 else
590 vpn->connect_request (conf->id); 752 vpn->connect_request (conf->id);
591 }
592 } 753 }
593} 754}
594 755
595void 756void
596connection::reset_connection () 757connection::reset_connection ()
… …
601 762
602 if (::conf.script_node_down) 763 if (::conf.script_node_down)
603 run_script (this, &connection::script_node_down, false); 764 run_script (this, &connection::script_node_down, false);
604 } 765 }
605 766
606 delete ictx; 767 delete ictx; ictx = 0;
607 ictx = 0; 768 delete octx; octx = 0;
608 769
609 delete octx; 770 RAND_bytes ((unsigned char *)&seqrand, sizeof (u32));
610 octx = 0;
611 771
612 sa.sin_port = 0; 772 sa.sin_port = 0;
613 sa.sin_addr.s_addr = 0; 773 sa.sin_addr.s_addr = 0;
614 774
615 next_retry = 0;
616 next_rekey = 0;
617 last_activity = 0; 775 last_activity = 0;
776
777 rekey.reset ();
778 keepalive.reset ();
779 establish_connection.reset ();
618} 780}
619 781
620void 782void
621connection::shutdown () 783connection::shutdown ()
622{ 784{
… …
625 787
626 reset_connection (); 788 reset_connection ();
627} 789}
628 790
629void 791void
630connection::rekey () 792connection::rekey_cb (tstamp &ts)
631{ 793{
794 ts = TSTAMP_CANCEL;
795
632 reset_connection (); 796 reset_connection ();
633 establish_connection (); 797 establish_connection ();
634} 798}
635 799
636void 800void
637connection::send_data_packet (tap_packet * pkt, bool broadcast) 801connection::send_data_packet (tap_packet * pkt, bool broadcast)
638{ 802{
639 vpndata_packet *p = new vpndata_packet; 803 vpndata_packet *p = new vpndata_packet;
804 int tos = 0;
805
806 if (conf->inherit_tos
807 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
808 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
809 tos = (*pkt)[15] & IPTOS_TOS_MASK;
640 810
641 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 811 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
642 vpn->send_vpn_packet (p, &sa); 812 vpn->send_vpn_packet (p, &sa, tos);
643 813
644 delete p; 814 delete p;
645 815
646 if (oseqno > MAX_SEQNO) 816 if (oseqno > MAX_SEQNO)
647 rekey (); 817 rekey ();
… …
662} 832}
663 833
664void 834void
665connection::recv_vpn_packet (vpn_packet *pkt, SOCKADDR *ssa) 835connection::recv_vpn_packet (vpn_packet *pkt, SOCKADDR *ssa)
666{ 836{
667 last_activity = now; 837 last_activity = NOW;
668 838
669 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 839 slog (L_NOISE, "<<%d received packet type %d from %d to %d",
670 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 840 conf->id, pkt->typ (), pkt->src (), pkt->dst ());
671 841
672 switch (pkt->typ ()) 842 switch (pkt->typ ())
… …
680 // so reset the retry counter and establish a conenction 850 // so reset the retry counter and establish a conenction
681 // when we receive a pong. 851 // when we receive a pong.
682 if (!ictx && !octx) 852 if (!ictx && !octx)
683 { 853 {
684 retry_cnt = 0; 854 retry_cnt = 0;
685 next_retry = 0; 855 establish_connection.at = 0;
686 establish_connection (); 856 establish_connection ();
687 } 857 }
688 858
689 break; 859 break;
690 860
691 case vpn_packet::PT_RESET: 861 case vpn_packet::PT_RESET:
692 { 862 {
693 reset_connection (); 863 reset_connection ();
694 864
695 config_packet *p = (config_packet *) pkt; 865 config_packet *p = (config_packet *) pkt;
696 if (p->chk_config ()) 866 if (!p->chk_config ())
867 {
868 slog (L_WARN, _("protocol mismatch, disabling node '%s'"), conf->nodename);
869 connectmode = conf_node::C_DISABLED;
870 }
697 if (conf->connectmode == conf_node::C_ALWAYS) 871 else if (connectmode == conf_node::C_ALWAYS)
698 establish_connection (); 872 establish_connection ();
699
700 //D slog the protocol mismatch?
701 } 873 }
702 break; 874 break;
703 875
704 case vpn_packet::PT_AUTH: 876 case vpn_packet::PT_AUTH:
705 { 877 {
… …
715 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 887 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
716 888
717 if (p->subtype == AUTH_INIT) 889 if (p->subtype == AUTH_INIT)
718 send_auth (AUTH_INITREPLY, ssa); 890 send_auth (AUTH_INITREPLY, ssa);
719 891
720 rsachallenge k; 892 const rsachallenge *k = rsa_cache.private_decrypt (::conf.rsa_key, p->challenge);
721 893
722#if ENABLE_TRUST
723 if (0 > RSA_private_decrypt (sizeof (rsaencrdata),
724 (unsigned char *)&p->challenge, (unsigned char *)&k,
725 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
726 // continued below
727#else
728 rsaencrdata j;
729 894 if (!k)
730 if (0 > RSA_private_decrypt (sizeof (rsaencrdata),
731 (unsigned char *)&p->challenge, (unsigned char *)&j,
732 ::conf.rsa_key, RSA_NO_PADDING))
733 fatal ("RSA_private_decrypt error");
734
735 if (0 > RSA_public_decrypt (sizeof (k),
736 (unsigned char *)&j, (unsigned char *)&k,
737 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
738 // continued below
739#endif
740 { 895 {
741 slog (L_ERR, _("challenge from %s (%s) illegal or corrupted"), 896 slog (L_ERR, _("challenge from %s (%s) illegal or corrupted, disabling node"),
742 conf->nodename, (const char *)sockinfo (ssa)); 897 conf->nodename, (const char *)sockinfo (ssa));
898 connectmode = conf_node::C_DISABLED;
743 break; 899 break;
744 } 900 }
745 901
746 retry_cnt = 0; 902 retry_cnt = 0;
747 next_retry = now + 8; 903 establish_connection.set (NOW + 8); //? ;)
904 keepalive.reset ();
905 rekey.reset ();
748 906
749 switch (p->subtype) 907 switch (p->subtype)
750 { 908 {
751 case AUTH_INIT: 909 case AUTH_INIT:
752 case AUTH_INITREPLY: 910 case AUTH_INITREPLY:
753 delete ictx; 911 delete ictx;
754 ictx = 0; 912 ictx = 0;
755 913
756 delete octx; 914 delete octx;
757 915
758 octx = new crypto_ctx (k, 1); 916 octx = new crypto_ctx (*k, 1);
759 oseqno = *(u32 *)&k[CHG_SEQNO] & 0x7fffffff; 917 oseqno = *(u32 *)&k[CHG_SEQNO] & 0x7fffffff;
760 918
761 send_auth (AUTH_REPLY, ssa, &k); 919 send_auth (AUTH_REPLY, ssa, k);
762 break; 920 break;
763 921
764 case AUTH_REPLY: 922 case AUTH_REPLY:
765 923
766 if (!memcmp ((u8 *)gen_challenge (ssa) + sizeof (u32), (u8 *)&k + sizeof (u32), 924 if (!memcmp ((u8 *)gen_challenge (seqrand, ssa), (u8 *)k, sizeof (rsachallenge)))
767 sizeof (rsachallenge) - sizeof (u32)))
768 { 925 {
769 delete ictx; 926 delete ictx;
770 927
771 ictx = new crypto_ctx (k, 0); 928 ictx = new crypto_ctx (*k, 0);
772 iseqno = *(u32 *)&k[CHG_SEQNO] & 0x7fffffff; // at least 2**31 sequence numbers are valid 929 iseqno.reset (*(u32 *)&k[CHG_SEQNO] & 0x7fffffff); // at least 2**31 sequence numbers are valid
773 ismask = 0xffffffff; // initially, all lower sequence numbers are invalid
774 930
775 sa = *ssa; 931 sa = *ssa;
776 932
777 next_rekey = now + ::conf.rekey; 933 rekey.set (NOW + ::conf.rekey);
778 next_wakeup (next_rekey); 934 keepalive.set (NOW + ::conf.keepalive);
779 935
780 // send queued packets 936 // send queued packets
781 while (tap_packet *p = queue.get ()) 937 while (tap_packet *p = queue.get ())
782 { 938 {
783 send_data_packet (p); 939 send_data_packet (p);
784 delete p; 940 delete p;
785 } 941 }
942
943 connectmode = conf->connectmode;
786 944
787 slog (L_INFO, _("connection to %d (%s %s) established"), 945 slog (L_INFO, _("connection to %d (%s %s) established"),
788 conf->id, conf->nodename, (const char *)sockinfo (ssa)); 946 conf->id, conf->nodename, (const char *)sockinfo (ssa));
789 947
790 if (::conf.script_node_up) 948 if (::conf.script_node_up)
… …
826 else 984 else
827 { 985 {
828 u32 seqno; 986 u32 seqno;
829 tap_packet *d = p->unpack (this, seqno); 987 tap_packet *d = p->unpack (this, seqno);
830 988
831 if (seqno <= iseqno - 32) 989 if (iseqno.recv_ok (seqno))
832 slog (L_ERR, _("received duplicate or outdated packet (received %08lx, expected %08lx)\n"
833 "possible replay attack, or just massive packet reordering"), seqno, iseqno + 1);//D
834 else if (seqno > iseqno + 32)
835 slog (L_ERR, _("received duplicate or out-of-sync packet (received %08lx, expected %08lx)\n"
836 "possible replay attack, or just massive packet loss"), seqno, iseqno + 1);//D
837 else
838 { 990 {
839 if (seqno > iseqno)
840 {
841 ismask <<= seqno - iseqno;
842 iseqno = seqno;
843 }
844
845 u32 mask = 1 << (iseqno - seqno);
846
847 //printf ("received seqno %08lx, iseqno %08lx, mask %08lx is %08lx\n", seqno, iseqno, mask, ismask);
848 if (ismask & mask)
849 slog (L_ERR, _("received duplicate packet (received %08lx, expected %08lx)\n"
850 "possible replay attack, or just packet duplication"), seqno, iseqno + 1);//D
851 else
852 {
853 ismask |= mask;
854
855 vpn->tap->send (d); 991 vpn->tap->send (d);
856 992
857 if (p->dst () == 0) // re-broadcast 993 if (p->dst () == 0) // re-broadcast
858 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i) 994 for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
859 { 995 {
860 connection *c = *i; 996 connection *c = *i;
861 997
862 if (c->conf != THISNODE && c->conf != conf) 998 if (c->conf != THISNODE && c->conf != conf)
863 c->inject_data_packet (d); 999 c->inject_data_packet (d);
864 }
865
866 delete d;
867
868 break;
869 } 1000 }
1001
1002 delete d;
1003
1004 break;
870 } 1005 }
871 } 1006 }
872 } 1007 }
873 else 1008 else
874 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D 1009 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D
… …
889 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n", 1024 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
890 conf->id, p->id, c->ictx && c->octx); 1025 conf->id, p->id, c->ictx && c->octx);
891 1026
892 if (c->ictx && c->octx) 1027 if (c->ictx && c->octx)
893 { 1028 {
1029 // send connect_info packets to both sides, in case one is
1030 // behind a nat firewall (or both ;)
1031 {
894 sockinfo si(sa); 1032 sockinfo si(sa);
895 1033
896 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 1034 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
897 c->conf->id, p->id, (const char *)si); 1035 c->conf->id, conf->id, (const char *)si);
898 1036
899 connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si); 1037 connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si);
900 1038
901 r->hmac_set (c->octx); 1039 r->hmac_set (c->octx);
902 vpn->send_vpn_packet (r, &c->sa); 1040 vpn->send_vpn_packet (r, &c->sa);
903 1041
904 delete r; 1042 delete r;
1043 }
1044
1045 {
1046 sockinfo si(c->sa);
1047
1048 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1049 conf->id, c->conf->id, (const char *)si);
1050
1051 connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, si);
1052
1053 r->hmac_set (octx);
1054 vpn->send_vpn_packet (r, &sa);
1055
1056 delete r;
1057 }
905 } 1058 }
906 } 1059 }
907 1060
908 break; 1061 break;
909 1062
… …
927 send_reset (ssa); 1080 send_reset (ssa);
928 break; 1081 break;
929 } 1082 }
930} 1083}
931 1084
932void connection::timer () 1085void connection::keepalive_cb (tstamp &ts)
933{ 1086{
934 if (conf != THISNODE) 1087 if (NOW >= last_activity + ::conf.keepalive + 30)
935 { 1088 {
936 if (now >= next_retry && conf->connectmode == conf_node::C_ALWAYS) 1089 reset_connection ();
937 establish_connection (); 1090 establish_connection ();
938 1091 }
939 if (ictx && octx)
940 {
941 if (now >= next_rekey)
942 rekey ();
943 else if (now >= last_activity + ::conf.keepalive + 30)
944 {
945 reset_connection ();
946 establish_connection ();
947 }
948 else if (now >= last_activity + ::conf.keepalive) 1092 else if (NOW < last_activity + ::conf.keepalive)
1093 ts = last_activity + ::conf.keepalive;
949 if (conf->connectmode != conf_node::C_ONDEMAND 1094 else if (conf->connectmode != conf_node::C_ONDEMAND
950 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1095 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1096 {
951 send_ping (&sa); 1097 send_ping (&sa);
952 else 1098 ts = NOW + 5;
1099 }
1100 else
953 reset_connection (); 1101 reset_connection ();
954 1102
955 }
956 }
957} 1103}
958 1104
959void connection::connect_request (int id) 1105void connection::connect_request (int id)
960{ 1106{
961 connect_req_packet *p = new connect_req_packet (conf->id, id); 1107 connect_req_packet *p = new connect_req_packet (conf->id, id);
… …
998 putenv ("STATE=down"); 1144 putenv ("STATE=down");
999 1145
1000 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1146 return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1001} 1147}
1002 1148
1149connection::connection(struct vpn *vpn_)
1150: vpn(vpn_)
1151, rekey (this, &connection::rekey_cb)
1152, keepalive (this, &connection::keepalive_cb)
1153, establish_connection (this, &connection::establish_connection_cb)
1154{
1155 octx = ictx = 0;
1156 retry_cnt = 0;
1157
1158 connectmode = conf_node::C_ALWAYS; // initial setting
1159 reset_connection ();
1160}
1161
1162connection::~connection ()
1163{
1164 shutdown ();
1165}
1166
1003///////////////////////////////////////////////////////////////////////////// 1167/////////////////////////////////////////////////////////////////////////////
1004
1005vpn::vpn (void)
1006{}
1007 1168
1008const char *vpn::script_if_up () 1169const char *vpn::script_if_up ()
1009{ 1170{
1010 // the tunnel device mtu should be the physical mtu - overhead 1171 // the tunnel device mtu should be the physical mtu - overhead
1011 // the tricky part is rounding to the cipher key blocksize 1172 // the tricky part is rounding to the cipher key blocksize
… …
1062 { 1223 {
1063 int oval = 1; 1224 int oval = 1;
1064 setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 1225 setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
1065 } 1226 }
1066 1227
1228 udp_ev_watcher.start (socket_fd, POLLIN);
1229
1067 tap = new tap_device (); 1230 tap = new tap_device ();
1068 if (!tap) //D this, of course, never catches 1231 if (!tap) //D this, of course, never catches
1069 { 1232 {
1070 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 1233 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
1071 exit (1); 1234 exit (1);
1072 } 1235 }
1073 1236
1074 run_script (this, &vpn::script_if_up, true); 1237 run_script (this, &vpn::script_if_up, true);
1075 1238
1239 vpn_ev_watcher.start (tap->fd, POLLIN);
1240
1241 reconnect_all ();
1242
1076 return 0; 1243 return 0;
1077} 1244}
1078 1245
1079void 1246void
1080vpn::send_vpn_packet (vpn_packet *pkt, SOCKADDR *sa) 1247vpn::send_vpn_packet (vpn_packet *pkt, SOCKADDR *sa, int tos)
1081{ 1248{
1249 setsockopt (socket_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1082 sendto (socket_fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)sa, sizeof (*sa)); 1250 sendto (socket_fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)sa, sizeof (*sa));
1083} 1251}
1084 1252
1085void 1253void
1086vpn::shutdown_all () 1254vpn::shutdown_all ()
… …
1103 connection *conn = new connection (this); 1271 connection *conn = new connection (this);
1104 1272
1105 conn->conf = *i; 1273 conn->conf = *i;
1106 conns.push_back (conn); 1274 conns.push_back (conn);
1107 1275
1108 if (conn->conf->connectmode == conf_node::C_ALWAYS)
1109 conn->establish_connection (); 1276 conn->establish_connection ();
1110 } 1277 }
1111} 1278}
1112 1279
1113connection *vpn::find_router () 1280connection *vpn::find_router ()
1114{ 1281{
… …
1118 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 1285 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1119 { 1286 {
1120 connection *c = *i; 1287 connection *c = *i;
1121 1288
1122 if (c->conf->routerprio > prio 1289 if (c->conf->routerprio > prio
1123 && c->conf->connectmode == conf_node::C_ALWAYS 1290 && c->connectmode == conf_node::C_ALWAYS
1124 && c->conf != THISNODE 1291 && c->conf != THISNODE
1125 && c->ictx && c->octx) 1292 && c->ictx && c->octx)
1126 { 1293 {
1127 prio = c->conf->routerprio; 1294 prio = c->conf->routerprio;
1128 router = c; 1295 router = c;
… …
1136{ 1303{
1137 connection *c = find_router (); 1304 connection *c = find_router ();
1138 1305
1139 if (c) 1306 if (c)
1140 c->connect_request (id); 1307 c->connect_request (id);
1308 //else // does not work, because all others must connect to the same router
1309 // // no router found, aggressively connect to all routers
1310 // for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1311 // if ((*i)->conf->routerprio)
1312 // (*i)->establish_connection ();
1141} 1313}
1142 1314
1143void 1315void
1144vpn::main_loop () 1316vpn::udp_ev (short revents)
1145{ 1317{
1146 struct pollfd pollfd[2]; 1318 if (revents & (POLLIN | POLLERR))
1147
1148 pollfd[0].fd = tap->fd;
1149 pollfd[0].events = POLLIN;
1150 pollfd[1].fd = socket_fd;
1151 pollfd[1].events = POLLIN;
1152
1153 events = 0;
1154 now = time (0);
1155 next_timecheck = now + 1;
1156
1157 reconnect_all ();
1158
1159 for (;;)
1160 { 1319 {
1161 int npoll = poll (pollfd, 2, (next_timecheck - now) * 1000); 1320 vpn_packet *pkt = new vpn_packet;
1162 1321 struct sockaddr_in sa;
1163 now = time (0); 1322 socklen_t sa_len = sizeof (sa);
1323 int len;
1164 1324
1325 len = recvfrom (socket_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1326
1165 if (npoll > 0) 1327 if (len > 0)
1328 {
1329 pkt->len = len;
1330
1331 unsigned int src = pkt->src ();
1332 unsigned int dst = pkt->dst ();
1333
1334 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1335 (const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1336
1337 if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1338 slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1339 pkt->typ (), pkt->src (), pkt->dst ());
1340 else if (dst == 0 && !THISNODE->routerprio)
1341 slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1342 else if (dst != 0 && dst != THISNODE->id)
1343 slog (L_WARN,
1344 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1345 dst, conns[dst - 1]->conf->nodename,
1346 (const char *)sockinfo (sa),
1347 THISNODE->id, THISNODE->nodename);
1348 else if (src == 0 || src > conns.size ())
1349 slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
1350 else
1351 conns[src - 1]->recv_vpn_packet (pkt, &sa);
1166 { 1352 }
1167 if (pollfd[1].revents) 1353 else
1354 {
1355 // probably ECONNRESET or somesuch
1356 slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno));
1357 }
1358
1359 delete pkt;
1360 }
1361 else if (revents & POLLHUP)
1362 {
1363 // this cannot ;) happen on udp sockets
1364 slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating."));
1365 exit (1);
1366 }
1367 else
1368 {
1369 slog (L_ERR,
1370 _("FATAL: unknown revents %08x in socket, terminating\n"),
1371 revents);
1372 exit (1);
1373 }
1374}
1375
1376void
1377vpn::vpn_ev (short revents)
1378{
1379 if (revents & POLLIN)
1380 {
1381 /* process data */
1382 tap_packet *pkt;
1383
1384 pkt = tap->recv ();
1385
1386 int dst = mac2id (pkt->dst);
1387 int src = mac2id (pkt->src);
1388
1389 if (src != THISNODE->id)
1390 {
1391 slog (L_ERR, _("FATAL: tap packet not originating on current node received, terminating."));
1392 exit (1);
1393 }
1394
1395 if (dst == THISNODE->id)
1396 {
1397 slog (L_ERR, _("FATAL: tap packet destined for current node received, terminating."));
1398 exit (1);
1399 }
1400
1401 if (dst > conns.size ())
1402 slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
1403 else
1404 {
1405 if (dst)
1168 { 1406 {
1169 if (pollfd[1].revents & (POLLIN | POLLERR)) 1407 // unicast
1170 {
1171 vpn_packet *pkt = new vpn_packet;
1172 struct sockaddr_in sa;
1173 socklen_t sa_len = sizeof (sa);
1174 int len;
1175
1176 len = recvfrom (socket_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1177
1178 if (len > 0)
1179 {
1180 pkt->len = len;
1181
1182 unsigned int src = pkt->src ();
1183 unsigned int dst = pkt->dst ();
1184
1185 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1186 (const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1187
1188 if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1189 slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1190 pkt->typ (), pkt->src (), pkt->dst ());
1191 else if (dst == 0 && !THISNODE->routerprio)
1192 slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1193 else if (dst != 0 && dst != THISNODE->id) 1408 if (dst != THISNODE->id)
1194 slog (L_WARN,
1195 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1196 dst, conns[dst - 1]->conf->nodename,
1197 (const char *)sockinfo (sa),
1198 THISNODE->id, THISNODE->nodename);
1199 else if (src == 0 || src > conns.size ())
1200 slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
1201 else
1202 conns[src - 1]->recv_vpn_packet (pkt, &sa); 1409 conns[dst - 1]->inject_data_packet (pkt);
1203 }
1204 else
1205 {
1206 // probably ECONNRESET or somesuch
1207 slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno));
1208 }
1209
1210 delete pkt;
1211 } 1410 }
1212 else if (pollfd[1].revents & POLLHUP) 1411 else
1213 { 1412 {
1214 // this cannot ;) happen on udp sockets 1413 // broadcast, first check router, then self, then english
1215 slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating.")); 1414 connection *router = find_router ();
1216 exit (1); 1415
1217 } 1416 if (router)
1417 router->inject_data_packet (pkt, true);
1218 else 1418 else
1219 { 1419 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1220 slog (L_ERR, 1420 if ((*c)->conf != THISNODE)
1221 _("FATAL: unknown revents %08x in socket, terminating\n"), 1421 (*c)->inject_data_packet (pkt);
1222 pollfd[1].revents);
1223 exit (1);
1224 }
1225 } 1422 }
1423 }
1226 1424
1227 // I use else here to give vpn_packets absolute priority 1425 delete pkt;
1228 else if (pollfd[0].revents) 1426 }
1229 {
1230 if (pollfd[0].revents & POLLIN)
1231 {
1232 /* process data */
1233 tap_packet *pkt;
1234
1235 pkt = tap->recv ();
1236
1237 int dst = mac2id (pkt->dst);
1238 int src = mac2id (pkt->src);
1239
1240 if (src != THISNODE->id)
1241 {
1242 slog (L_ERR, _("FATAL: tap packet not originating on current node received, terminating."));
1243 exit (1);
1244 }
1245
1246 if (dst == THISNODE->id)
1247 {
1248 slog (L_ERR, _("FATAL: tap packet destined for current node received, terminating."));
1249 exit (1);
1250 }
1251
1252 if (dst > conns.size ())
1253 slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
1254 else
1255 {
1256 if (dst)
1257 {
1258 // unicast
1259 if (dst != THISNODE->id)
1260 conns[dst - 1]->inject_data_packet (pkt);
1261 }
1262 else
1263 {
1264 // broadcast, first check router, then self, then english
1265 connection *router = find_router ();
1266
1267 if (router)
1268 router->inject_data_packet (pkt, true);
1269 else
1270 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1271 if ((*c)->conf != THISNODE)
1272 (*c)->inject_data_packet (pkt);
1273 }
1274 }
1275
1276 delete pkt;
1277 }
1278 else if (pollfd[0].revents & (POLLHUP | POLLERR)) 1427 else if (revents & (POLLHUP | POLLERR))
1279 { 1428 {
1280 slog (L_ERR, _("FATAL: POLLHUP or POLLERR on network device fd, terminating.")); 1429 slog (L_ERR, _("FATAL: POLLHUP or POLLERR on network device fd, terminating."));
1281 exit (1); 1430 exit (1);
1282 } 1431 }
1283 else 1432 else
1284 abort (); 1433 abort ();
1285 } 1434}
1286 }
1287 1435
1436void
1437vpn::event_cb (tstamp &ts)
1438{
1288 if (events) 1439 if (events)
1289 { 1440 {
1290 if (events & EVENT_SHUTDOWN) 1441 if (events & EVENT_SHUTDOWN)
1291 { 1442 {
1292 shutdown_all (); 1443 shutdown_all ();
1293 1444
1294 remove_pid (pidfilename); 1445 remove_pid (pidfilename);
1295 1446
1296 slog (L_INFO, _("vped terminating")); 1447 slog (L_INFO, _("vped terminating"));
1297 1448
1298 exit (0); 1449 exit (0);
1299 } 1450 }
1300 1451
1301 if (events & EVENT_RECONNECT) 1452 if (events & EVENT_RECONNECT)
1302 reconnect_all (); 1453 reconnect_all ();
1303 1454
1304 events = 0; 1455 events = 0;
1305 }
1306
1307 // very very very dumb and crude and inefficient timer handling, or maybe not?
1308 if (now >= next_timecheck)
1309 {
1310 next_timecheck = now + TIMER_GRANULARITY;
1311
1312 for (conns_vector::iterator c = conns.begin ();
1313 c != conns.end (); ++c)
1314 (*c)->timer ();
1315 }
1316 } 1456 }
1457
1458 ts = TSTAMP_CANCEL;
1459}
1460
1461vpn::vpn (void)
1462: udp_ev_watcher (this, &vpn::udp_ev)
1463, vpn_ev_watcher (this, &vpn::vpn_ev)
1464, event (this, &vpn::event_cb)
1465{
1317} 1466}
1318 1467
1319vpn::~vpn () 1468vpn::~vpn ()
1320{} 1469{
1470}
1321 1471

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines