ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/protocol.C
(Generate patch)

Comparing gvpe/src/protocol.C (file contents):
Revision 1.13 by pcg, Sat Mar 22 22:34:36 2003 UTC vs.
Revision 1.20 by pcg, Wed Mar 26 17:59:12 2003 UTC

… …
58 58
59static time_t next_timecheck; 59static time_t next_timecheck;
60 60
61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
62 62
63static const rsachallenge & 63struct crypto_ctx
64challenge_bytes ()
65{
66 static rsachallenge challenge;
67 static double challenge_ttl; // time this challenge needs to be recreated
68
69 if (NOW > challenge_ttl)
70 { 64 {
71 RAND_bytes ((unsigned char *)&challenge, sizeof (challenge)); 65 EVP_CIPHER_CTX cctx;
72 challenge_ttl = NOW + CHALLENGE_TTL; 66 HMAC_CTX hctx;
73 }
74 67
75 return challenge; 68 crypto_ctx (const rsachallenge &challenge, int enc);
76} 69 ~crypto_ctx ();
70 };
77 71
78// caching of rsa operations really helps slow computers 72crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)
73{
74 EVP_CIPHER_CTX_init (&cctx);
75 EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc);
76 HMAC_CTX_init (&hctx);
77 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
78}
79
80crypto_ctx::~crypto_ctx ()
81{
82 EVP_CIPHER_CTX_cleanup (&cctx);
83 HMAC_CTX_cleanup (&hctx);
84}
85
86static void
87rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)
88{
89 EVP_MD_CTX ctx;
90
91 EVP_MD_CTX_init (&ctx);
92 EVP_DigestInit (&ctx, RSA_HASH);
93 EVP_DigestUpdate(&ctx, &chg, sizeof chg);
94 EVP_DigestUpdate(&ctx, &id, sizeof id);
95 EVP_DigestFinal (&ctx, (unsigned char *)&h, 0);
96 EVP_MD_CTX_cleanup (&ctx);
97}
98
79struct rsa_entry { 99struct rsa_entry {
80 tstamp expire; 100 tstamp expire;
101 rsaid id;
81 rsachallenge chg; 102 rsachallenge chg;
82 RSA *key; // which key
83 rsaencrdata encr;
84
85 rsa_entry ()
86 {
87 expire = NOW + CHALLENGE_TTL;
88 }
89}; 103};
90 104
91struct rsa_cache : list<rsa_entry> 105struct rsa_cache : list<rsa_entry>
92{ 106{
93 void cleaner_cb (tstamp &ts); time_watcher cleaner; 107 void cleaner_cb (tstamp &ts); time_watcher cleaner;
94 108
95 const rsaencrdata *public_encrypt (RSA *key, const rsachallenge &chg) 109 bool find (const rsaid &id, rsachallenge &chg)
96 { 110 {
97 for (iterator i = begin (); i != end (); ++i) 111 for (iterator i = begin (); i != end (); ++i)
98 { 112 {
99 if (i->key == key && !memcmp (&chg, &i->chg, sizeof chg)) 113 if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW)
100 return &i->encr; 114 {
115 memcpy (&chg, &i->chg, sizeof chg);
116
117 erase (i);
118 return true;
119 }
101 } 120 }
102 121
103 if (cleaner.at < NOW) 122 if (cleaner.at < NOW)
104 cleaner.start (NOW + CHALLENGE_TTL); 123 cleaner.start (NOW + RSA_TTL);
105 124
106 resize (size () + 1); 125 return false;
107 rsa_entry *e = &(*rbegin ()); 126 }
108 127
109 e->key = key; 128 void gen (rsaid &id, rsachallenge &chg)
129 {
130 rsa_entry e;
131
132 RAND_bytes ((unsigned char *)&id, sizeof id);
133 RAND_bytes ((unsigned char *)&chg, sizeof chg);
134
135 e.expire = NOW + RSA_TTL;
136 e.id = id;
110 memcpy (&e->chg, &chg, sizeof chg); 137 memcpy (&e.chg, &chg, sizeof chg);
111 138
112 if (0 > RSA_public_encrypt (sizeof chg, 139 push_back (e);
113 (unsigned char *)&chg, (unsigned char *)&e->encr,
114 key, RSA_PKCS1_OAEP_PADDING))
115 fatal ("RSA_public_encrypt error");
116
117 return &e->encr;
118 }
119
120 const rsachallenge *private_decrypt (RSA *key, const rsaencrdata &encr)
121 {
122 for (iterator i = begin (); i != end (); ++i)
123 if (i->key == key && !memcmp (&encr, &i->encr, sizeof encr))
124 return &i->chg;
125 140
126 if (cleaner.at < NOW) 141 if (cleaner.at < NOW)
127 cleaner.start (NOW + CHALLENGE_TTL); 142 cleaner.start (NOW + RSA_TTL);
128
129 resize (size () + 1);
130 rsa_entry *e = &(*rbegin ());
131
132 e->key = key;
133 memcpy (&e->encr, &encr, sizeof encr);
134
135 if (0 > RSA_private_decrypt (sizeof encr,
136 (unsigned char *)&encr, (unsigned char *)&e->chg,
137 key, RSA_PKCS1_OAEP_PADDING))
138 {
139 pop_back ();
140 return 0;
141 }
142
143 return &e->chg;
144 } 143 }
145 144
146 rsa_cache () 145 rsa_cache ()
147 : cleaner (this, &rsa_cache::cleaner_cb) 146 : cleaner (this, &rsa_cache::cleaner_cb)
148 { } 147 { }
… …
153{ 152{
154 if (empty ()) 153 if (empty ())
155 ts = TSTAMP_CANCEL; 154 ts = TSTAMP_CANCEL;
156 else 155 else
157 { 156 {
158 ts = NOW + 3; 157 ts = NOW + RSA_TTL;
158
159 for (iterator i = begin (); i != end (); ) 159 for (iterator i = begin (); i != end (); )
160 {
161 if (i->expire >= NOW) 160 if (i->expire <= NOW)
162 i = erase (i); 161 i = erase (i);
163 else 162 else
164 ++i; 163 ++i;
165 }
166 } 164 }
167} 165}
168 166
169// run a script. yes, it's a template function. yes, c++ 167typedef callback<const char *, int> run_script_cb;
170// is not a functional language. yes, this suxx. 168
171template<class owner> 169// run a shell script (or actually an external program).
172static void 170static void
173run_script (owner *obj, const char *(owner::*setup)(), bool wait) 171run_script (const run_script_cb &cb, bool wait)
174{ 172{
175 int pid; 173 int pid;
176 174
177 if ((pid = fork ()) == 0) 175 if ((pid = fork ()) == 0)
178 { 176 {
179 char *filename; 177 char *filename;
180 asprintf (&filename, "%s/%s", confbase, (obj->*setup) ()); 178 asprintf (&filename, "%s/%s", confbase, cb(0));
181 execl (filename, filename, (char *) 0); 179 execl (filename, filename, (char *) 0);
182 exit (255); 180 exit (255);
183 } 181 }
184 else if (pid > 0) 182 else if (pid > 0)
185 { 183 {
… …
189 /* TODO: check status */ 187 /* TODO: check status */
190 } 188 }
191 } 189 }
192} 190}
193 191
194// xor the socket address into the challenge to ensure different challenges
195// per host. we could rely on the OAEP padding, but this doesn't hurt.
196void
197xor_sa (rsachallenge &k, SOCKADDR *sa)
198{
199 ((u32 *) k)[(CHG_CIPHER_KEY + 0) / 4] ^= sa->sin_addr.s_addr;
200 ((u16 *) k)[(CHG_CIPHER_KEY + 4) / 2] ^= sa->sin_port;
201 ((u32 *) k)[(CHG_HMAC_KEY + 0) / 4] ^= sa->sin_addr.s_addr;
202 ((u16 *) k)[(CHG_HMAC_KEY + 4) / 2] ^= sa->sin_port;
203}
204
205struct crypto_ctx
206 {
207 EVP_CIPHER_CTX cctx;
208 HMAC_CTX hctx;
209
210 crypto_ctx (const rsachallenge &challenge, int enc);
211 ~crypto_ctx ();
212 };
213
214crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)
215{
216 EVP_CIPHER_CTX_init (&cctx);
217 EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc);
218 HMAC_CTX_init (&hctx);
219 HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
220}
221
222crypto_ctx::~crypto_ctx ()
223{
224 EVP_CIPHER_CTX_cleanup (&cctx);
225 HMAC_CTX_cleanup (&hctx);
226}
227
228////////////////////////////////////////////////////////////////////////////// 192//////////////////////////////////////////////////////////////////////////////
229 193
230void pkt_queue::put (tap_packet *p) 194void pkt_queue::put (tap_packet *p)
231{ 195{
232 if (queue[i]) 196 if (queue[i])
… …
264{ 228{
265 for (i = QUEUEDEPTH; --i > 0; ) 229 for (i = QUEUEDEPTH; --i > 0; )
266 delete queue[i]; 230 delete queue[i];
267} 231}
268 232
233struct net_rateinfo {
234 u32 host;
235 double pcnt, diff;
236 tstamp last;
237};
238
269// only do action once every x seconds per host. 239// only do action once every x seconds per host whole allowing bursts.
270// currently this is quite a slow implementation, 240// this implementation ("splay list" ;) is inefficient,
271// but suffices for normal operation. 241// but low on resources.
272struct u32_rate_limiter : private map<u32, tstamp> 242struct net_rate_limiter : private list<net_rateinfo>
273 { 243{
274 tstamp every; 244 static const double ALPHA = 1. - 1. / 90.; // allow bursts
245 static const double CUTOFF = 20.; // one event every CUTOFF seconds
246 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
275 247
276 bool can (u32 host); 248 bool can (u32 host);
277
278 u32_rate_limiter (tstamp every = 1)
279 {
280 this->every = every;
281 }
282 };
283
284struct net_rate_limiter : u32_rate_limiter
285 {
286 bool can (SOCKADDR *sa) { return u32_rate_limiter::can((u32)sa->sin_addr.s_addr); } 249 bool can (SOCKADDR *sa) { return can((u32)sa->sin_addr.s_addr); }
287 bool can (sockinfo &si) { return u32_rate_limiter::can((u32)si.host); } 250 bool can (sockinfo &si) { return can((u32)si.host); }
251};
288 252
289 net_rate_limiter (tstamp every) : u32_rate_limiter (every) {} 253net_rate_limiter auth_rate_limiter, reset_rate_limiter;
290 };
291 254
292bool u32_rate_limiter::can (u32 host) 255bool net_rate_limiter::can (u32 host)
293{ 256{
294 iterator i; 257 iterator i;
295 258
296 for (i = begin (); i != end (); ) 259 for (i = begin (); i != end (); )
297 if (i->second <= NOW) 260 if (i->host == host)
298 { 261 break;
262 else if (i->last < NOW - EXPIRE)
299 erase (i); 263 i = erase (i);
300 i = begin ();
301 }
302 else 264 else
303 ++i; 265 i++;
304 266
305 i = find (host);
306
307 if (i != end ()) 267 if (i == end ())
308 return false; 268 {
269 net_rateinfo ri;
309 270
310 insert (value_type (host, NOW + every)); 271 ri.host = host;
272 ri.pcnt = 1.;
273 ri.diff = CUTOFF * (1. / (1. - ALPHA));
274 ri.last = NOW;
311 275
276 push_front (ri);
277
312 return true; 278 return true;
279 }
280 else
281 {
282 net_rateinfo ri (*i);
283 erase (i);
284
285 ri.pcnt = ri.pcnt * ALPHA;
286 ri.diff = ri.diff * ALPHA + (NOW - ri.last);
287
288 ri.last = NOW;
289
290 bool send = ri.diff / ri.pcnt > CUTOFF;
291
292 if (send)
293 ri.pcnt++;
294
295 push_front (ri);
296
297 return send;
298 }
313} 299}
314 300
315///////////////////////////////////////////////////////////////////////////// 301/////////////////////////////////////////////////////////////////////////////
316 302
317static void next_wakeup (time_t next) 303static void next_wakeup (time_t next)
… …
321} 307}
322 308
323static unsigned char hmac_digest[EVP_MAX_MD_SIZE]; 309static unsigned char hmac_digest[EVP_MAX_MD_SIZE];
324 310
325struct hmac_packet:net_packet 311struct hmac_packet:net_packet
312{
313 u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere
314
315 void hmac_set (crypto_ctx * ctx);
316 bool hmac_chk (crypto_ctx * ctx);
317
318private:
319 void hmac_gen (crypto_ctx * ctx)
326 { 320 {
327 u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere
328
329 void hmac_set (crypto_ctx * ctx);
330 bool hmac_chk (crypto_ctx * ctx);
331
332private:
333 void hmac_gen (crypto_ctx * ctx)
334 {
335 unsigned int xlen; 321 unsigned int xlen;
336 HMAC_CTX *hctx = &ctx->hctx; 322 HMAC_CTX *hctx = &ctx->hctx;
337 323
338 HMAC_Init_ex (hctx, 0, 0, 0, 0); 324 HMAC_Init_ex (hctx, 0, 0, 0, 0);
339 HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet), 325 HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet),
340 len - sizeof (hmac_packet)); 326 len - sizeof (hmac_packet));
341 HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen); 327 HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen);
342 }
343 }; 328 }
329};
344 330
345void 331void
346hmac_packet::hmac_set (crypto_ctx * ctx) 332hmac_packet::hmac_set (crypto_ctx * ctx)
347{ 333{
348 hmac_gen (ctx); 334 hmac_gen (ctx);
… …
364 { 350 {
365 PT_RESET = 0, 351 PT_RESET = 0,
366 PT_DATA_UNCOMPRESSED, 352 PT_DATA_UNCOMPRESSED,
367 PT_DATA_COMPRESSED, 353 PT_DATA_COMPRESSED,
368 PT_PING, PT_PONG, // wasting namespace space? ;) 354 PT_PING, PT_PONG, // wasting namespace space? ;)
369 PT_AUTH, // authentification 355 PT_AUTH_REQ, // authentification request
356 PT_AUTH_RES, // authentification response
370 PT_CONNECT_REQ, // want other host to contact me 357 PT_CONNECT_REQ, // want other host to contact me
371 PT_CONNECT_INFO, // request connection to some node 358 PT_CONNECT_INFO, // request connection to some node
372 PT_REKEY, // rekeying (not yet implemented)
373 PT_MAX 359 PT_MAX
374 }; 360 };
375 361
376 u8 type; 362 u8 type;
377 u8 srcdst, src1, dst1; 363 u8 srcdst, src1, dst1;
… …
515 501
516#if ENABLE_COMPRESSION 502#if ENABLE_COMPRESSION
517 if (type == PT_DATA_COMPRESSED) 503 if (type == PT_DATA_COMPRESSED)
518 { 504 {
519 u32 cl = (d[DATAHDR] << 8) | d[DATAHDR + 1]; 505 u32 cl = (d[DATAHDR] << 8) | d[DATAHDR + 1];
506
520 p->len = lzf_decompress (d + DATAHDR + 2, cl, &(*p)[6 + 6], MAX_MTU) + 6 + 6; 507 p->len = lzf_decompress (d + DATAHDR + 2, cl < MAX_MTU ? cl : 0,
508 &(*p)[6 + 6], MAX_MTU)
509 + 6 + 6;
521 } 510 }
522 else 511 else
523 p->len = outl + (6 + 6 - DATAHDR); 512 p->len = outl + (6 + 6 - DATAHDR);
524#endif 513#endif
525 514
526 return p; 515 return p;
527} 516}
528 517
529struct ping_packet : vpn_packet 518struct ping_packet : vpn_packet
519{
520 void setup (int dst, ptype type)
530 { 521 {
531 void setup (int dst, ptype type)
532 {
533 set_hdr (type, dst); 522 set_hdr (type, dst);
534 len = sizeof (*this) - sizeof (net_packet); 523 len = sizeof (*this) - sizeof (net_packet);
535 }
536 }; 524 }
525};
537 526
538struct config_packet : vpn_packet 527struct config_packet : vpn_packet
528{
529 // actually, hmaclen cannot be checked because the hmac
530 // field comes before this data, so peers with other
531 // hmacs simply will not work.
532 u8 prot_major, prot_minor, randsize, hmaclen;
533 u8 flags, challengelen, pad2, pad3;
534 u32 cipher_nid, digest_nid, hmac_nid;
535
536 const u8 curflags () const
539 { 537 {
540 // actually, hmaclen cannot be checked because the hmac
541 // field comes before this data, so peers with other
542 // hmacs simply will not work.
543 u8 prot_major, prot_minor, randsize, hmaclen;
544 u8 flags, challengelen, pad2, pad3;
545 u32 cipher_nid;
546 u32 digest_nid;
547
548 const u8 curflags () const
549 {
550 return 0x80 538 return 0x80
551 | 0x02
552#if PROTOCOL_MAJOR != 2
553#error hi
554#endif
555 | (ENABLE_COMPRESSION ? 0x01 : 0x00); 539 | (ENABLE_COMPRESSION ? 0x01 : 0x00);
556 } 540 }
557 541
558 void setup (ptype type, int dst) 542 void setup (ptype type, int dst)
559 {
560 prot_major = PROTOCOL_MAJOR;
561 prot_minor = PROTOCOL_MINOR;
562 randsize = RAND_SIZE;
563 hmaclen = HMACLENGTH;
564 flags = curflags ();
565 challengelen = sizeof (rsachallenge);
566
567 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
568 digest_nid = htonl (EVP_MD_type (DIGEST));
569
570 len = sizeof (*this) - sizeof (net_packet);
571 set_hdr (type, dst);
572 }
573
574 bool chk_config ()
575 {
576 return prot_major == PROTOCOL_MAJOR
577 && randsize == RAND_SIZE
578 && hmaclen == HMACLENGTH
579 && flags == curflags ()
580 && challengelen == sizeof (rsachallenge)
581 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
582 && digest_nid == htonl (EVP_MD_type (DIGEST));
583 }
584 };
585
586struct auth_packet : config_packet
587 { 543 {
588 char magic[8]; 544 prot_major = PROTOCOL_MAJOR;
589 u8 subtype; 545 prot_minor = PROTOCOL_MINOR;
590 u8 pad1, pad2; 546 randsize = RAND_SIZE;
591 rsaencrdata challenge; 547 hmaclen = HMACLENGTH;
548 flags = curflags ();
549 challengelen = sizeof (rsachallenge);
592 550
593 auth_packet (int dst, auth_subtype stype) 551 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
594 { 552 digest_nid = htonl (EVP_MD_type (RSA_HASH));
595 config_packet::setup (PT_AUTH, dst); 553 hmac_nid = htonl (EVP_MD_type (DIGEST));
596 subtype = stype; 554
597 len = sizeof (*this) - sizeof (net_packet); 555 len = sizeof (*this) - sizeof (net_packet);
556 set_hdr (type, dst);
557 }
558
559 bool chk_config ()
560 {
561 return prot_major == PROTOCOL_MAJOR
562 && randsize == RAND_SIZE
563 && hmaclen == HMACLENGTH
564 && flags == curflags ()
565 && challengelen == sizeof (rsachallenge)
566 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
567 && digest_nid == htonl (EVP_MD_type (RSA_HASH))
568 && hmac_nid == htonl (EVP_MD_type (DIGEST));
569 }
570};
571
572struct auth_req_packet : config_packet
573{
574 char magic[8];
575 u8 initiate; // false if this is just an automatic reply
576 u8 pad1, pad2, pad3;
577 rsaid id;
578 rsaencrdata encr;
579
580 auth_req_packet (int dst, bool initiate_)
581 {
582 config_packet::setup (PT_AUTH_REQ, dst);
583 initiate = !!initiate_;
598 strncpy (magic, MAGIC, 8); 584 strncpy (magic, MAGIC, 8);
599 } 585 len = sizeof (*this) - sizeof (net_packet);
600 }; 586 }
587};
588
589struct auth_res_packet : config_packet
590{
591 rsaid id;
592 u8 pad1, pad2, pad3;
593 u8 response_len; // encrypted length
594 rsaresponse response;
595
596 auth_res_packet (int dst)
597 {
598 config_packet::setup (PT_AUTH_RES, dst);
599 len = sizeof (*this) - sizeof (net_packet);
600 }
601};
601 602
602struct connect_req_packet : vpn_packet 603struct connect_req_packet : vpn_packet
604{
605 u8 id;
606 u8 pad1, pad2, pad3;
607
608 connect_req_packet (int dst, int id_)
603 { 609 {
604 u8 id; 610 id = id_;
605 u8 pad1, pad2, pad3;
606
607 connect_req_packet (int dst, int id)
608 {
609 this->id = id;
610 set_hdr (PT_CONNECT_REQ, dst); 611 set_hdr (PT_CONNECT_REQ, dst);
611 len = sizeof (*this) - sizeof (net_packet); 612 len = sizeof (*this) - sizeof (net_packet);
612 }
613 }; 613 }
614};
614 615
615struct connect_info_packet : vpn_packet 616struct connect_info_packet : vpn_packet
617{
618 u8 id;
619 u8 pad1, pad2, pad3;
620 sockinfo si;
621
622 connect_info_packet (int dst, int id_, sockinfo &si_)
616 { 623 {
617 u8 id; 624 id = id_;
618 u8 pad1, pad2, pad3; 625 si = si_;
619 sockinfo si;
620
621 connect_info_packet (int dst, int id, sockinfo &si)
622 {
623 this->id = id;
624 this->si = si;
625 set_hdr (PT_CONNECT_INFO, dst); 626 set_hdr (PT_CONNECT_INFO, dst);
626 len = sizeof (*this) - sizeof (net_packet); 627 len = sizeof (*this) - sizeof (net_packet);
627 }
628 }; 628 }
629};
629 630
630///////////////////////////////////////////////////////////////////////////// 631/////////////////////////////////////////////////////////////////////////////
631 632
632void 633void
633fill_sa (SOCKADDR *sa, conf_node *conf) 634fill_sa (SOCKADDR *sa, conf_node *conf)
… …
669} 670}
670 671
671void 672void
672connection::send_reset (SOCKADDR *dsa) 673connection::send_reset (SOCKADDR *dsa)
673{ 674{
674 static net_rate_limiter limiter(1);
675
676 if (limiter.can (dsa) && connectmode != conf_node::C_DISABLED) 675 if (reset_rate_limiter.can (dsa) && connectmode != conf_node::C_DISABLED)
677 { 676 {
678 config_packet *pkt = new config_packet; 677 config_packet *pkt = new config_packet;
679 678
680 pkt->setup (vpn_packet::PT_RESET, conf->id); 679 pkt->setup (vpn_packet::PT_RESET, conf->id);
681 vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST); 680 vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST);
682 681
683 delete pkt; 682 delete pkt;
684 } 683 }
685} 684}
686 685
687static rsachallenge *
688gen_challenge (u32 seqrand, SOCKADDR *sa)
689{
690 static rsachallenge k;
691
692 memcpy (&k, &challenge_bytes (), sizeof (k));
693 *(u32 *)&k[CHG_SEQNO] ^= seqrand;
694 xor_sa (k, sa);
695
696 return &k;
697}
698
699void 686void
700connection::send_auth (auth_subtype subtype, SOCKADDR *sa, const rsachallenge *k) 687connection::send_auth_request (SOCKADDR *sa, bool initiate)
701{ 688{
702 static net_rate_limiter limiter(0.2); 689 if (!initiate || auth_rate_limiter.can (sa))
703
704 if (subtype != AUTH_INIT || limiter.can (sa))
705 { 690 {
706 if (!k)
707 k = gen_challenge (seqrand, sa);
708
709 auth_packet *pkt = new auth_packet (conf->id, subtype); 691 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate);
710 692
711 memcpy (pkt->challenge, rsa_cache.public_encrypt (conf->rsa_key, *k), sizeof (rsaencrdata)); 693 rsachallenge chg;
712 694
695 rsa_cache.gen (pkt->id, chg);
696
697 if (0 > RSA_public_encrypt (sizeof chg,
698 (unsigned char *)&chg, (unsigned char *)&pkt->encr,
699 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
700 fatal ("RSA_public_encrypt error");
701
713 slog (L_TRACE, ">>%d PT_AUTH(%d) [%s]", conf->id, subtype, (const char *)sockinfo (sa)); 702 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)sockinfo (sa));
714 703
715 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); 704 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly
716 705
717 delete pkt; 706 delete pkt;
718 } 707 }
719} 708}
720 709
721void 710void
711connection::send_auth_response (SOCKADDR *sa, const rsaid &id, const rsachallenge &chg)
712{
713 auth_res_packet *pkt = new auth_res_packet (conf->id);
714
715 pkt->id = id;
716
717 rsa_hash (id, chg, pkt->response);
718
719 pkt->hmac_set (octx);
720
721 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)sockinfo (sa));
722
723 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly
724
725 delete pkt;
726}
727
728void
722connection::establish_connection_cb (tstamp &ts) 729connection::establish_connection_cb (tstamp &ts)
723{ 730{
724 if (ictx || conf == THISNODE || connectmode == conf_node::C_NEVER) 731 if (ictx || conf == THISNODE
732 || connectmode == conf_node::C_NEVER
733 || connectmode == conf_node::C_DISABLED)
725 ts = TSTAMP_CANCEL; 734 ts = TSTAMP_CANCEL;
726 else if (ts <= NOW) 735 else if (ts <= NOW)
727 { 736 {
728 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.25; 737 double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;
729 738
730 if (retry_int < 3600 * 8) 739 if (retry_int < 3600 * 8)
731 retry_cnt++; 740 retry_cnt++;
732
733 if (connectmode == conf_node::C_ONDEMAND
734 && retry_int > ::conf.keepalive)
735 retry_int = ::conf.keepalive;
736 741
737 ts = NOW + retry_int; 742 ts = NOW + retry_int;
738 743
739 if (conf->hostname) 744 if (conf->hostname)
740 { 745 {
741 reset_dstaddr (); 746 reset_dstaddr ();
742 if (sa.sin_addr.s_addr) 747 if (sa.sin_addr.s_addr)
743 if (retry_cnt < 4) 748 if (retry_cnt < 4)
744 send_auth (AUTH_INIT, &sa); 749 send_auth_request (&sa, true);
745 else 750 else if (auth_rate_limiter.can (&sa))
746 send_ping (&sa, 0); 751 send_ping (&sa, 0);
747 } 752 }
748 else 753 else
749 vpn->connect_request (conf->id); 754 vpn->connect_request (conf->id);
750 } 755 }
… …
753void 758void
754connection::reset_connection () 759connection::reset_connection ()
755{ 760{
756 if (ictx && octx) 761 if (ictx && octx)
757 { 762 {
758 slog (L_INFO, _("connection to %d (%s) lost"), conf->id, conf->nodename); 763 slog (L_INFO, _("%s(%s): connection lost"),
764 conf->nodename, (const char *)sockinfo (sa));
759 765
760 if (::conf.script_node_down) 766 if (::conf.script_node_down)
761 run_script (this, &connection::script_node_down, false); 767 run_script (run_script_cb (this, &connection::script_node_down), false);
762 } 768 }
763 769
764 delete ictx; ictx = 0; 770 delete ictx; ictx = 0;
765 delete octx; octx = 0; 771 delete octx; octx = 0;
766
767 RAND_bytes ((unsigned char *)&seqrand, sizeof (u32));
768 772
769 sa.sin_port = 0; 773 sa.sin_port = 0;
770 sa.sin_addr.s_addr = 0; 774 sa.sin_addr.s_addr = 0;
771 775
772 last_activity = 0; 776 last_activity = 0;
… …
837 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 841 conf->id, pkt->typ (), pkt->src (), pkt->dst ());
838 842
839 switch (pkt->typ ()) 843 switch (pkt->typ ())
840 { 844 {
841 case vpn_packet::PT_PING: 845 case vpn_packet::PT_PING:
842 send_ping (ssa, 1); // pong
843 break;
844
845 case vpn_packet::PT_PONG:
846 // we send pings instead of auth packets after some retries, 846 // we send pings instead of auth packets after some retries,
847 // so reset the retry counter and establish a conenction 847 // so reset the retry counter and establish a conenction
848 // when we receive a pong. 848 // when we receive a pong.
849 if (!ictx && !octx) 849 if (!ictx && !octx)
850 { 850 {
851 retry_cnt = 0; 851 retry_cnt = 0;
852 establish_connection.at = 0; 852 establish_connection.at = 0;
853 establish_connection (); 853 establish_connection ();
854 } 854 }
855 else
856 send_ping (ssa, 1); // pong
855 857
858 break;
859
860 case vpn_packet::PT_PONG:
856 break; 861 break;
857 862
858 case vpn_packet::PT_RESET: 863 case vpn_packet::PT_RESET:
859 { 864 {
860 reset_connection (); 865 reset_connection ();
861 866
862 config_packet *p = (config_packet *) pkt; 867 config_packet *p = (config_packet *) pkt;
868
863 if (!p->chk_config ()) 869 if (!p->chk_config ())
864 { 870 {
865 slog (L_WARN, _("protocol mismatch, disabling node '%s'"), conf->nodename); 871 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
872 conf->nodename, (const char *)sockinfo (ssa));
866 connectmode = conf_node::C_DISABLED; 873 connectmode = conf_node::C_DISABLED;
867 } 874 }
868 else if (connectmode == conf_node::C_ALWAYS) 875 else if (connectmode == conf_node::C_ALWAYS)
869 establish_connection (); 876 establish_connection ();
870 } 877 }
871 break; 878 break;
872 879
873 case vpn_packet::PT_AUTH: 880 case vpn_packet::PT_AUTH_REQ:
881 if (auth_rate_limiter.can (ssa))
882 {
883 auth_req_packet *p = (auth_req_packet *) pkt;
884
885 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);
886
887 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
888 {
889 if (p->prot_minor != PROTOCOL_MINOR)
890 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
891 conf->nodename, (const char *)sockinfo (ssa),
892 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
893
894 if (p->initiate)
895 send_auth_request (ssa, false);
896
897 rsachallenge k;
898
899 if (0 > RSA_private_decrypt (sizeof (p->encr),
900 (unsigned char *)&p->encr, (unsigned char *)&k,
901 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
902 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
903 conf->nodename, (const char *)sockinfo (ssa));
904 else
905 {
906 retry_cnt = 0;
907 establish_connection.set (NOW + 8); //? ;)
908 keepalive.reset ();
909 rekey.reset ();
910
911 delete ictx;
912 ictx = 0;
913
914 delete octx;
915
916 octx = new crypto_ctx (k, 1);
917 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
918
919 send_auth_response (ssa, p->id, k);
920
921 break;
922 }
923 }
924
925 send_reset (ssa);
926 }
927
928 break;
929
930 case vpn_packet::PT_AUTH_RES:
874 { 931 {
875 auth_packet *p = (auth_packet *) pkt; 932 auth_res_packet *p = (auth_res_packet *) pkt;
876 933
877 slog (L_TRACE, "<<%d PT_AUTH(%d)", conf->id, p->subtype); 934 slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);
878 935
879 if (p->chk_config () 936 if (p->chk_config ())
880 && !strncmp (p->magic, MAGIC, 8))
881 { 937 {
882 if (p->prot_minor != PROTOCOL_MINOR) 938 if (p->prot_minor != PROTOCOL_MINOR)
883 slog (L_INFO, _("protocol minor version mismatch: ours is %d, %s's is %d."), 939 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
940 conf->nodename, (const char *)sockinfo (ssa),
884 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 941 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
885 942
886 if (p->subtype == AUTH_INIT) 943 rsachallenge chg;
887 send_auth (AUTH_INITREPLY, ssa);
888 944
889 const rsachallenge *k = rsa_cache.private_decrypt (::conf.rsa_key, p->challenge); 945 if (!rsa_cache.find (p->id, chg))
890 946 slog (L_ERR, _("%s(%s): unrequested auth response"),
891 if (!k) 947 conf->nodename, (const char *)sockinfo (ssa));
948 else
892 { 949 {
893 slog (L_ERR, _("challenge from %s (%s) illegal or corrupted"), 950 crypto_ctx *cctx = new crypto_ctx (chg, 0);
951
952 if (!p->hmac_chk (cctx))
953 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
954 "could be an attack, or just corruption or an synchronization error"),
894 conf->nodename, (const char *)sockinfo (ssa)); 955 conf->nodename, (const char *)sockinfo (ssa));
895 break; 956 else
896 }
897
898 retry_cnt = 0;
899 establish_connection.set (NOW + 8); //? ;)
900 keepalive.reset ();
901 rekey.reset ();
902
903 switch (p->subtype)
904 {
905 case AUTH_INIT:
906 case AUTH_INITREPLY:
907 delete ictx;
908 ictx = 0;
909
910 delete octx;
911
912 octx = new crypto_ctx (*k, 1);
913 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
914
915 send_auth (AUTH_REPLY, ssa, k);
916 break;
917
918 case AUTH_REPLY:
919
920 if (!memcmp ((u8 *)gen_challenge (seqrand, ssa), (u8 *)k, sizeof (rsachallenge)))
921 { 957 {
922 delete ictx;
923
924 ictx = new crypto_ctx (*k, 0);
925 iseqno.reset (ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
926
927 sa = *ssa; 958 rsaresponse h;
928 959
929 rekey.set (NOW + ::conf.rekey); 960 rsa_hash (p->id, chg, h);
930 keepalive.set (NOW + ::conf.keepalive);
931 961
932 // send queued packets 962 if (!memcmp ((u8 *)&h, (u8 *)p->response, sizeof h))
933 while (tap_packet *p = queue.get ())
934 { 963 {
964 prot_minor = p->prot_minor;
965
966 delete ictx; ictx = cctx;
967
968 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
969
970 sa = *ssa;
971
972 rekey.set (NOW + ::conf.rekey);
973 keepalive.set (NOW + ::conf.keepalive);
974
975 // send queued packets
976 while (tap_packet *p = queue.get ())
977 {
935 send_data_packet (p); 978 send_data_packet (p);
936 delete p; 979 delete p;
980 }
981
982 connectmode = conf->connectmode;
983
984 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
985 conf->nodename, (const char *)sockinfo (ssa),
986 p->prot_major, p->prot_minor);
987
988 if (::conf.script_node_up)
989 run_script (run_script_cb (this, &connection::script_node_up), false);
990
991 break;
937 } 992 }
938 993 else
939 connectmode = conf->connectmode; 994 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
940
941 slog (L_INFO, _("connection to %d (%s %s) established"),
942 conf->id, conf->nodename, (const char *)sockinfo (ssa)); 995 conf->nodename, (const char *)sockinfo (ssa));
943
944 if (::conf.script_node_up)
945 run_script (this, &connection::script_node_up, false);
946 } 996 }
997
947 else 998 delete cctx;
948 slog (L_ERR, _("sent and received challenge do not match with (%s %s))"),
949 conf->nodename, (const char *)sockinfo (ssa));
950
951 break;
952 default:
953 slog (L_ERR, _("authentification illegal subtype error (%s %s)"),
954 conf->nodename, (const char *)sockinfo (ssa));
955 break;
956 } 999 }
957 } 1000 }
958 else
959 send_reset (ssa);
960
961 break;
962 } 1001 }
1002
1003 send_reset (ssa);
1004 break;
963 1005
964 case vpn_packet::PT_DATA_COMPRESSED: 1006 case vpn_packet::PT_DATA_COMPRESSED:
965#if !ENABLE_COMPRESSION 1007#if !ENABLE_COMPRESSION
966 send_reset (ssa); 1008 send_reset (ssa);
967 break; 1009 break;
968#endif 1010#endif
1011
969 case vpn_packet::PT_DATA_UNCOMPRESSED: 1012 case vpn_packet::PT_DATA_UNCOMPRESSED:
970 1013
971 if (ictx && octx) 1014 if (ictx && octx)
972 { 1015 {
973 vpndata_packet *p = (vpndata_packet *)pkt; 1016 vpndata_packet *p = (vpndata_packet *)pkt;
974 1017
975 if (*ssa == sa) 1018 if (*ssa == sa)
976 { 1019 {
977 if (!p->hmac_chk (ictx)) 1020 if (!p->hmac_chk (ictx))
978 slog (L_ERR, _("hmac authentication error, received invalid packet\n" 1021 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
979 "could be an attack, or just corruption or an synchronization error")); 1022 "could be an attack, or just corruption or an synchronization error"),
1023 conf->nodename, (const char *)sockinfo (ssa));
980 else 1024 else
981 { 1025 {
982 u32 seqno; 1026 u32 seqno;
983 tap_packet *d = p->unpack (this, seqno); 1027 tap_packet *d = p->unpack (this, seqno);
984 1028
… …
1066 connection *c = vpn->conns[p->id - 1]; 1110 connection *c = vpn->conns[p->id - 1];
1067 1111
1068 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1112 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1069 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1113 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1070 1114
1071 c->send_auth (AUTH_INIT, p->si.sa ()); 1115 c->send_auth_request (p->si.sa (), true);
1072 } 1116 }
1117
1073 break; 1118 break;
1074 1119
1075 default: 1120 default:
1076 send_reset (ssa); 1121 send_reset (ssa);
1077 break; 1122 break;
1123
1078 } 1124 }
1079} 1125}
1080 1126
1081void connection::keepalive_cb (tstamp &ts) 1127void connection::keepalive_cb (tstamp &ts)
1082{ 1128{
… …
1109 delete p; 1155 delete p;
1110} 1156}
1111 1157
1112void connection::script_node () 1158void connection::script_node ()
1113{ 1159{
1114 vpn->script_if_up (); 1160 vpn->script_if_up (0);
1115 1161
1116 char *env; 1162 char *env;
1117 asprintf (&env, "DESTID=%d", conf->id); 1163 asprintf (&env, "DESTID=%d", conf->id);
1118 putenv (env); 1164 putenv (env);
1119 asprintf (&env, "DESTNODE=%s", conf->nodename); 1165 asprintf (&env, "DESTNODE=%s", conf->nodename);
… …
1122 putenv (env); 1168 putenv (env);
1123 asprintf (&env, "DESTPORT=%d", ntohs (sa.sin_port)); 1169 asprintf (&env, "DESTPORT=%d", ntohs (sa.sin_port));
1124 putenv (env); 1170 putenv (env);
1125} 1171}
1126 1172
1127const char *connection::script_node_up () 1173const char *connection::script_node_up (int)
1128{ 1174{
1129 script_node (); 1175 script_node ();
1130 1176
1131 putenv ("STATE=up"); 1177 putenv ("STATE=up");
1132 1178
1133 return ::conf.script_node_up ? ::conf.script_node_up : "node-up"; 1179 return ::conf.script_node_up ? ::conf.script_node_up : "node-up";
1134} 1180}
1135 1181
1136const char *connection::script_node_down () 1182const char *connection::script_node_down (int)
1137{ 1183{
1138 script_node (); 1184 script_node ();
1139 1185
1140 putenv ("STATE=down"); 1186 putenv ("STATE=down");
1141 1187
… …
1160 shutdown (); 1206 shutdown ();
1161} 1207}
1162 1208
1163///////////////////////////////////////////////////////////////////////////// 1209/////////////////////////////////////////////////////////////////////////////
1164 1210
1165const char *vpn::script_if_up () 1211const char *vpn::script_if_up (int)
1166{ 1212{
1167 // the tunnel device mtu should be the physical mtu - overhead 1213 // the tunnel device mtu should be the physical mtu - overhead
1168 // the tricky part is rounding to the cipher key blocksize 1214 // the tricky part is rounding to the cipher key blocksize
1169 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - UDP_OVERHEAD; 1215 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
1170 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 1216 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
1171 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 1217 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
1172 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 1218 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
1173 1219
1174 char *env; 1220 char *env;
… …
1228 { 1274 {
1229 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 1275 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
1230 exit (1); 1276 exit (1);
1231 } 1277 }
1232 1278
1233 run_script (this, &vpn::script_if_up, true); 1279 run_script (run_script_cb (this, &vpn::script_if_up), true);
1234 1280
1235 vpn_ev_watcher.start (tap->fd, POLLIN); 1281 vpn_ev_watcher.start (tap->fd, POLLIN);
1236 1282
1237 reconnect_all (); 1283 reconnect_all ();
1238 1284

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines