ViewVC Help

View File | Revision Log | Show Annotations | Download File

/cvs/gvpe/src/protocol.C

Comparing gvpe/src/protocol.C (file contents):
Revision 1.13 by pcg, Sat Mar 22 22:34:36 2003 UTC vs.
Revision 1.22 by pcg, Fri Mar 28 04:27:33 2003 UTC

…		…
58		58
59	static time_t next_timecheck;	59	static time_t next_timecheck;
60		60
61	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic	61	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
62		62
63	static const rsachallenge &	63	static u8
64	challenge_bytes ()	64	best_protocol (u8 protset)
65	{	65	{
66	static rsachallenge challenge;	66	if (protset & PROT_IPv4)
67	static double challenge_ttl; // time this challenge needs to be recreated	67	return PROT_IPv4;
68		68
69	if (NOW > challenge_ttl)	69	return PROT_UDPv4;
70	{
71	RAND_bytes ((unsigned char *)&challenge, sizeof (challenge));
72	challenge_ttl = NOW + CHALLENGE_TTL;
73	}
74
75	return challenge;
76	}
77
78	// caching of rsa operations really helps slow computers
79	struct rsa_entry {
80	tstamp expire;
81	rsachallenge chg;
82	RSA *key; // which key
83	rsaencrdata encr;
84
85	rsa_entry ()
86	{
87	expire = NOW + CHALLENGE_TTL;
88	}
89	};
90
91	struct rsa_cache : list<rsa_entry>
92	{
93	void cleaner_cb (tstamp &ts); time_watcher cleaner;
94
95	const rsaencrdata *public_encrypt (RSA *key, const rsachallenge &chg)
96	{
97	for (iterator i = begin (); i != end (); ++i)
98	{
99	if (i->key == key && !memcmp (&chg, &i->chg, sizeof chg))
100	return &i->encr;
101	}
102
103	if (cleaner.at < NOW)
104	cleaner.start (NOW + CHALLENGE_TTL);
105
106	resize (size () + 1);
107	rsa_entry *e = &(*rbegin ());
108
109	e->key = key;
110	memcpy (&e->chg, &chg, sizeof chg);
111
112	if (0 > RSA_public_encrypt (sizeof chg,
113	(unsigned char *)&chg, (unsigned char *)&e->encr,
114	key, RSA_PKCS1_OAEP_PADDING))
115	fatal ("RSA_public_encrypt error");
116
117	return &e->encr;
118	}
119
120	const rsachallenge *private_decrypt (RSA *key, const rsaencrdata &encr)
121	{
122	for (iterator i = begin (); i != end (); ++i)
123	if (i->key == key && !memcmp (&encr, &i->encr, sizeof encr))
124	return &i->chg;
125
126	if (cleaner.at < NOW)
127	cleaner.start (NOW + CHALLENGE_TTL);
128
129	resize (size () + 1);
130	rsa_entry *e = &(*rbegin ());
131
132	e->key = key;
133	memcpy (&e->encr, &encr, sizeof encr);
134
135	if (0 > RSA_private_decrypt (sizeof encr,
136	(unsigned char *)&encr, (unsigned char *)&e->chg,
137	key, RSA_PKCS1_OAEP_PADDING))
138	{
139	pop_back ();
140	return 0;
141	}
142
143	return &e->chg;
144	}
145
146	rsa_cache ()
147	: cleaner (this, &rsa_cache::cleaner_cb)
148	{ }
149
150	} rsa_cache;
151
152	void rsa_cache::cleaner_cb (tstamp &ts)
153	{
154	if (empty ())
155	ts = TSTAMP_CANCEL;
156	else
157	{
158	ts = NOW + 3;
159	for (iterator i = begin (); i != end (); )
160	{
161	if (i->expire >= NOW)
162	i = erase (i);
163	else
164	++i;
165	}
166	}
167	}
168
169	// run a script. yes, it's a template function. yes, c++
170	// is not a functional language. yes, this suxx.
171	template<class owner>
172	static void
173	run_script (owner *obj, const char *(owner::*setup)(), bool wait)
174	{
175	int pid;
176
177	if ((pid = fork ()) == 0)
178	{
179	char *filename;
180	asprintf (&filename, "%s/%s", confbase, (obj->*setup) ());
181	execl (filename, filename, (char *) 0);
182	exit (255);
183	}
184	else if (pid > 0)
185	{
186	if (wait)
187	{
188	waitpid (pid, 0, 0);
189	/* TODO: check status */
190	}
191	}
192	}
193
194	// xor the socket address into the challenge to ensure different challenges
195	// per host. we could rely on the OAEP padding, but this doesn't hurt.
196	void
197	xor_sa (rsachallenge &k, SOCKADDR *sa)
198	{
199	((u32 *) k)[(CHG_CIPHER_KEY + 0) / 4] ^= sa->sin_addr.s_addr;
200	((u16 *) k)[(CHG_CIPHER_KEY + 4) / 2] ^= sa->sin_port;
201	((u32 *) k)[(CHG_HMAC_KEY + 0) / 4] ^= sa->sin_addr.s_addr;
202	((u16 *) k)[(CHG_HMAC_KEY + 4) / 2] ^= sa->sin_port;
203	}	70	}
204		71
205	struct crypto_ctx	72	struct crypto_ctx
206	{	73	{
207	EVP_CIPHER_CTX cctx;	74	EVP_CIPHER_CTX cctx;
…		…
223	{	90	{
224	EVP_CIPHER_CTX_cleanup (&cctx);	91	EVP_CIPHER_CTX_cleanup (&cctx);
225	HMAC_CTX_cleanup (&hctx);	92	HMAC_CTX_cleanup (&hctx);
226	}	93	}
227		94
		95	static void
		96	rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)
		97	{
		98	EVP_MD_CTX ctx;
		99
		100	EVP_MD_CTX_init (&ctx);
		101	EVP_DigestInit (&ctx, RSA_HASH);
		102	EVP_DigestUpdate(&ctx, &chg, sizeof chg);
		103	EVP_DigestUpdate(&ctx, &id, sizeof id);
		104	EVP_DigestFinal (&ctx, (unsigned char *)&h, 0);
		105	EVP_MD_CTX_cleanup (&ctx);
		106	}
		107
		108	struct rsa_entry {
		109	tstamp expire;
		110	rsaid id;
		111	rsachallenge chg;
		112	};
		113
		114	struct rsa_cache : list<rsa_entry>
		115	{
		116	void cleaner_cb (tstamp &ts); time_watcher cleaner;
		117
		118	bool find (const rsaid &id, rsachallenge &chg)
		119	{
		120	for (iterator i = begin (); i != end (); ++i)
		121	{
		122	if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW)
		123	{
		124	memcpy (&chg, &i->chg, sizeof chg);
		125
		126	erase (i);
		127	return true;
		128	}
		129	}
		130
		131	if (cleaner.at < NOW)
		132	cleaner.start (NOW + RSA_TTL);
		133
		134	return false;
		135	}
		136
		137	void gen (rsaid &id, rsachallenge &chg)
		138	{
		139	rsa_entry e;
		140
		141	RAND_bytes ((unsigned char *)&id, sizeof id);
		142	RAND_bytes ((unsigned char *)&chg, sizeof chg);
		143
		144	e.expire = NOW + RSA_TTL;
		145	e.id = id;
		146	memcpy (&e.chg, &chg, sizeof chg);
		147
		148	push_back (e);
		149
		150	if (cleaner.at < NOW)
		151	cleaner.start (NOW + RSA_TTL);
		152	}
		153
		154	rsa_cache ()
		155	: cleaner (this, &rsa_cache::cleaner_cb)
		156	{ }
		157
		158	} rsa_cache;
		159
		160	void rsa_cache::cleaner_cb (tstamp &ts)
		161	{
		162	if (empty ())
		163	ts = TSTAMP_CANCEL;
		164	else
		165	{
		166	ts = NOW + RSA_TTL;
		167
		168	for (iterator i = begin (); i != end (); )
		169	if (i->expire <= NOW)
		170	i = erase (i);
		171	else
		172	++i;
		173	}
		174	}
		175
		176	typedef callback<const char *, int> run_script_cb;
		177
		178	// run a shell script (or actually an external program).
		179	static void
		180	run_script (const run_script_cb &cb, bool wait)
		181	{
		182	int pid;
		183
		184	if ((pid = fork ()) == 0)
		185	{
		186	char *filename;
		187	asprintf (&filename, "%s/%s", confbase, cb(0));
		188	execl (filename, filename, (char *) 0);
		189	exit (255);
		190	}
		191	else if (pid > 0)
		192	{
		193	if (wait)
		194	{
		195	waitpid (pid, 0, 0);
		196	/* TODO: check status */
		197	}
		198	}
		199	}
		200
228	//////////////////////////////////////////////////////////////////////////////	201	//////////////////////////////////////////////////////////////////////////////
229		202
230	void pkt_queue::put (tap_packet *p)	203	void pkt_queue::put (tap_packet *p)
231	{	204	{
232	if (queue[i])	205	if (queue[i])
…		…
264	{	237	{
265	for (i = QUEUEDEPTH; --i > 0; )	238	for (i = QUEUEDEPTH; --i > 0; )
266	delete queue[i];	239	delete queue[i];
267	}	240	}
268		241
		242	struct net_rateinfo {
		243	u32 host;
		244	double pcnt, diff;
		245	tstamp last;
		246	};
		247
269	// only do action once every x seconds per host.	248	// only do action once every x seconds per host whole allowing bursts.
270	// currently this is quite a slow implementation,	249	// this implementation ("splay list" ;) is inefficient,
271	// but suffices for normal operation.	250	// but low on resources.
272	struct u32_rate_limiter : private map<u32, tstamp>	251	struct net_rate_limiter : list<net_rateinfo>
273	{	252	{
274	tstamp every;	253	static const double ALPHA = 1. - 1. / 90.; // allow bursts
		254	static const double CUTOFF = 20.; // one event every CUTOFF seconds
		255	static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
275		256
		257	bool can (const sockinfo &si) { return can((u32)si.host); }
276	bool can (u32 host);	258	bool can (u32 host);
277
278	u32_rate_limiter (tstamp every = 1)
279	{
280	this->every = every;
281	}
282	};	259	};
283		260
284	struct net_rate_limiter : u32_rate_limiter	261	net_rate_limiter auth_rate_limiter, reset_rate_limiter;
285	{
286	bool can (SOCKADDR *sa) { return u32_rate_limiter::can((u32)sa->sin_addr.s_addr); }
287	bool can (sockinfo &si) { return u32_rate_limiter::can((u32)si.host); }
288		262
289	net_rate_limiter (tstamp every) : u32_rate_limiter (every) {}
290	};
291
292	bool u32_rate_limiter::can (u32 host)	263	bool net_rate_limiter::can (u32 host)
293	{	264	{
294	iterator i;	265	iterator i;
295		266
296	for (i = begin (); i != end (); )	267	for (i = begin (); i != end (); )
297	if (i->second <= NOW)	268	if (i->host == host)
298	{	269	break;
		270	else if (i->last < NOW - EXPIRE)
299	erase (i);	271	i = erase (i);
300	i = begin ();
301	}
302	else	272	else
303	++i;	273	i++;
304		274
305	i = find (host);
306
307	if (i != end ())	275	if (i == end ())
308	return false;	276	{
		277	net_rateinfo ri;
309		278
310	insert (value_type (host, NOW + every));	279	ri.host = host;
		280	ri.pcnt = 1.;
		281	ri.diff = CUTOFF * (1. / (1. - ALPHA));
		282	ri.last = NOW;
311		283
		284	push_front (ri);
		285
312	return true;	286	return true;
		287	}
		288	else
		289	{
		290	net_rateinfo ri (*i);
		291	erase (i);
		292
		293	ri.pcnt = ri.pcnt * ALPHA;
		294	ri.diff = ri.diff * ALPHA + (NOW - ri.last);
		295
		296	ri.last = NOW;
		297
		298	bool send = ri.diff / ri.pcnt > CUTOFF;
		299
		300	if (send)
		301	ri.pcnt++;
		302
		303	push_front (ri);
		304
		305	return send;
		306	}
313	}	307	}
314		308
315	/////////////////////////////////////////////////////////////////////////////	309	/////////////////////////////////////////////////////////////////////////////
316		310
317	static void next_wakeup (time_t next)	311	static void next_wakeup (time_t next)
…		…
321	}	315	}
322		316
323	static unsigned char hmac_digest[EVP_MAX_MD_SIZE];	317	static unsigned char hmac_digest[EVP_MAX_MD_SIZE];
324		318
325	struct hmac_packet:net_packet	319	struct hmac_packet:net_packet
		320	{
		321	u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere
		322
		323	void hmac_set (crypto_ctx * ctx);
		324	bool hmac_chk (crypto_ctx * ctx);
		325
		326	private:
		327	void hmac_gen (crypto_ctx * ctx)
326	{	328	{
327	u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere
328
329	void hmac_set (crypto_ctx * ctx);
330	bool hmac_chk (crypto_ctx * ctx);
331
332	private:
333	void hmac_gen (crypto_ctx * ctx)
334	{
335	unsigned int xlen;	329	unsigned int xlen;
336	HMAC_CTX *hctx = &ctx->hctx;	330	HMAC_CTX *hctx = &ctx->hctx;
337		331
338	HMAC_Init_ex (hctx, 0, 0, 0, 0);	332	HMAC_Init_ex (hctx, 0, 0, 0, 0);
339	HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet),	333	HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet),
340	len - sizeof (hmac_packet));	334	len - sizeof (hmac_packet));
341	HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen);	335	HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen);
342	}
343	};	336	}
		337	};
344		338
345	void	339	void
346	hmac_packet::hmac_set (crypto_ctx * ctx)	340	hmac_packet::hmac_set (crypto_ctx * ctx)
347	{	341	{
348	hmac_gen (ctx);	342	hmac_gen (ctx);
…		…
364	{	358	{
365	PT_RESET = 0,	359	PT_RESET = 0,
366	PT_DATA_UNCOMPRESSED,	360	PT_DATA_UNCOMPRESSED,
367	PT_DATA_COMPRESSED,	361	PT_DATA_COMPRESSED,
368	PT_PING, PT_PONG, // wasting namespace space? ;)	362	PT_PING, PT_PONG, // wasting namespace space? ;)
369	PT_AUTH, // authentification	363	PT_AUTH_REQ, // authentification request
		364	PT_AUTH_RES, // authentification response
370	PT_CONNECT_REQ, // want other host to contact me	365	PT_CONNECT_REQ, // want other host to contact me
371	PT_CONNECT_INFO, // request connection to some node	366	PT_CONNECT_INFO, // request connection to some node
372	PT_REKEY, // rekeying (not yet implemented)
373	PT_MAX	367	PT_MAX
374	};	368	};
375		369
376	u8 type;	370	u8 type;
377	u8 srcdst, src1, dst1;	371	u8 srcdst, src1, dst1;
378		372
379	void set_hdr (ptype type, unsigned int dst);	373	void set_hdr (ptype type, unsigned int dst);
380		374
381	unsigned int src ()	375	unsigned int src () const
382	{	376	{
383	return src1 | ((srcdst >> 4) << 8);	377	return src1 | ((srcdst >> 4) << 8);
384	}	378	}
385		379
386	unsigned int dst ()	380	unsigned int dst () const
387	{	381	{
388	return dst1 | ((srcdst & 0xf) << 8);	382	return dst1 | ((srcdst & 0xf) << 8);
389	}	383	}
390		384
391	ptype typ ()	385	ptype typ () const
392	{	386	{
393	return (ptype) type;	387	return (ptype) type;
394	}	388	}
395	};	389	};
396		390
…		…
515		509
516	#if ENABLE_COMPRESSION	510	#if ENABLE_COMPRESSION
517	if (type == PT_DATA_COMPRESSED)	511	if (type == PT_DATA_COMPRESSED)
518	{	512	{
519	u32 cl = (d[DATAHDR] << 8) | d[DATAHDR + 1];	513	u32 cl = (d[DATAHDR] << 8) | d[DATAHDR + 1];
		514
520	p->len = lzf_decompress (d + DATAHDR + 2, cl, &(*p)[6 + 6], MAX_MTU) + 6 + 6;	515	p->len = lzf_decompress (d + DATAHDR + 2, cl < MAX_MTU ? cl : 0,
		516	&(*p)[6 + 6], MAX_MTU)
		517	+ 6 + 6;
521	}	518	}
522	else	519	else
523	p->len = outl + (6 + 6 - DATAHDR);	520	p->len = outl + (6 + 6 - DATAHDR);
524	#endif	521	#endif
525		522
526	return p;	523	return p;
527	}	524	}
528		525
529	struct ping_packet : vpn_packet	526	struct ping_packet : vpn_packet
		527	{
		528	void setup (int dst, ptype type)
530	{	529	{
531	void setup (int dst, ptype type)
532	{
533	set_hdr (type, dst);	530	set_hdr (type, dst);
534	len = sizeof (*this) - sizeof (net_packet);	531	len = sizeof (*this) - sizeof (net_packet);
535	}
536	};	532	}
		533	};
537		534
538	struct config_packet : vpn_packet	535	struct config_packet : vpn_packet
		536	{
		537	// actually, hmaclen cannot be checked because the hmac
		538	// field comes before this data, so peers with other
		539	// hmacs simply will not work.
		540	u8 prot_major, prot_minor, randsize, hmaclen;
		541	u8 flags, challengelen, pad2, pad3;
		542	u32 cipher_nid, digest_nid, hmac_nid;
		543
		544	const u8 curflags () const
539	{	545	{
540	// actually, hmaclen cannot be checked because the hmac
541	// field comes before this data, so peers with other
542	// hmacs simply will not work.
543	u8 prot_major, prot_minor, randsize, hmaclen;
544	u8 flags, challengelen, pad2, pad3;
545	u32 cipher_nid;
546	u32 digest_nid;
547
548	const u8 curflags () const
549	{
550	return 0x80	546	return 0x80
551	| 0x02
552	#if PROTOCOL_MAJOR != 2
553	#error hi
554	#endif
555	| (ENABLE_COMPRESSION ? 0x01 : 0x00);	547	| (ENABLE_COMPRESSION ? 0x01 : 0x00);
556	}	548	}
557		549
558	void setup (ptype type, int dst)	550	void setup (ptype type, int dst);
559	{	551	bool chk_config () const;
		552	};
		553
		554	void config_packet::setup (ptype type, int dst)
		555	{
560	prot_major = PROTOCOL_MAJOR;	556	prot_major = PROTOCOL_MAJOR;
561	prot_minor = PROTOCOL_MINOR;	557	prot_minor = PROTOCOL_MINOR;
562	randsize = RAND_SIZE;	558	randsize = RAND_SIZE;
563	hmaclen = HMACLENGTH;	559	hmaclen = HMACLENGTH;
564	flags = curflags ();	560	flags = curflags ();
565	challengelen = sizeof (rsachallenge);	561	challengelen = sizeof (rsachallenge);
566		562
567	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));	563	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
568	digest_nid = htonl (EVP_MD_type (DIGEST));	564	digest_nid = htonl (EVP_MD_type (RSA_HASH));
		565	hmac_nid = htonl (EVP_MD_type (DIGEST));
569		566
570	len = sizeof (*this) - sizeof (net_packet);	567	len = sizeof (*this) - sizeof (net_packet);
571	set_hdr (type, dst);	568	set_hdr (type, dst);
572	}	569	}
573		570
574	bool chk_config ()	571	bool config_packet::chk_config () const
575	{	572	{
576	return prot_major == PROTOCOL_MAJOR	573	return prot_major == PROTOCOL_MAJOR
577	&& randsize == RAND_SIZE	574	&& randsize == RAND_SIZE
578	&& hmaclen == HMACLENGTH	575	&& hmaclen == HMACLENGTH
579	&& flags == curflags ()	576	&& flags == curflags ()
580	&& challengelen == sizeof (rsachallenge)	577	&& challengelen == sizeof (rsachallenge)
581	&& cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))	578	&& cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
		579	&& digest_nid == htonl (EVP_MD_type (RSA_HASH))
582	&& digest_nid == htonl (EVP_MD_type (DIGEST));	580	&& hmac_nid == htonl (EVP_MD_type (DIGEST));
583	}	581	}
584	};
585		582
586	struct auth_packet : config_packet	583	struct auth_req_packet : config_packet
		584	{
		585	char magic[8];
		586	u8 initiate, can_recv; // false if this is just an automatic reply
		587	u8 pad2, pad3;
		588	rsaid id;
		589	rsaencrdata encr;
		590
		591	auth_req_packet (int dst, bool initiate_, u8 can_recv_)
587	{	592	{
588	char magic[8];
589	u8 subtype;
590	u8 pad1, pad2;
591	rsaencrdata challenge;
592
593	auth_packet (int dst, auth_subtype stype)
594	{
595	config_packet::setup (PT_AUTH, dst);	593	config_packet::setup (PT_AUTH_REQ, dst);
596	subtype = stype;	594	strncpy (magic, MAGIC, 8);
		595	initiate = !!initiate_;
		596	can_recv = can_recv_;
		597
597	len = sizeof (*this) - sizeof (net_packet);	598	len = sizeof (*this) - sizeof (net_packet);
598	strncpy (magic, MAGIC, 8);
599	}
600	};	599	}
		600	};
		601
		602	struct auth_res_packet : config_packet
		603	{
		604	rsaid id;
		605	u8 pad1, pad2, pad3;
		606	u8 response_len; // encrypted length
		607	rsaresponse response;
		608
		609	auth_res_packet (int dst)
		610	{
		611	config_packet::setup (PT_AUTH_RES, dst);
		612
		613	len = sizeof (*this) - sizeof (net_packet);
		614	}
		615	};
601		616
602	struct connect_req_packet : vpn_packet	617	struct connect_req_packet : vpn_packet
		618	{
		619	u8 id;
		620	u8 pad1, pad2, pad3;
		621
		622	connect_req_packet (int dst, int id_)
603	{	623	{
604	u8 id;	624	id = id_;
605	u8 pad1, pad2, pad3;
606
607	connect_req_packet (int dst, int id)
608	{
609	this->id = id;
610	set_hdr (PT_CONNECT_REQ, dst);	625	set_hdr (PT_CONNECT_REQ, dst);
611	len = sizeof (*this) - sizeof (net_packet);	626	len = sizeof (*this) - sizeof (net_packet);
612	}
613	};	627	}
		628	};
614		629
615	struct connect_info_packet : vpn_packet	630	struct connect_info_packet : vpn_packet
		631	{
		632	u8 id, can_recv;
		633	u8 pad1, pad2;
		634	sockinfo si;
		635
		636	connect_info_packet (int dst, int id_, sockinfo &si_, u8 can_recv_)
616	{	637	{
617	u8 id;	638	id = id_;
618	u8 pad1, pad2, pad3;	639	can_recv = can_recv_;
619	sockinfo si;	640	si = si_;
620
621	connect_info_packet (int dst, int id, sockinfo &si)
622	{
623	this->id = id;
624	this->si = si;
625	set_hdr (PT_CONNECT_INFO, dst);	641	set_hdr (PT_CONNECT_INFO, dst);
		642
626	len = sizeof (*this) - sizeof (net_packet);	643	len = sizeof (*this) - sizeof (net_packet);
627	}
628	};	644	}
		645	};
629		646
630	/////////////////////////////////////////////////////////////////////////////	647	/////////////////////////////////////////////////////////////////////////////
631		648
632	void	649	void
633	fill_sa (SOCKADDR *sa, conf_node *conf)
634	{
635	sa->sin_family = AF_INET;
636	sa->sin_port = htons (conf->port);
637	sa->sin_addr.s_addr = 0;
638
639	if (conf->hostname)
640	{
641	struct hostent *he = gethostbyname (conf->hostname);
642
643	if (he
644	&& he->h_addrtype == AF_INET && he->h_length == 4 && he->h_addr_list[0])
645	{
646	//sa->sin_family = he->h_addrtype;
647	memcpy (&sa->sin_addr, he->h_addr_list[0], 4);
648	}
649	else
650	slog (L_NOTICE, _("unable to resolve host '%s'"), conf->hostname);
651	}
652	}
653
654	void
655	connection::reset_dstaddr ()	650	connection::reset_dstaddr ()
656	{	651	{
657	fill_sa (&sa, conf);	652	si.set (conf);
658	}	653	}
659		654
660	void	655	void
661	connection::send_ping (SOCKADDR *dsa, u8 pong)	656	connection::send_ping (const sockinfo &si, u8 pong)
662	{	657	{
663	ping_packet *pkt = new ping_packet;	658	ping_packet *pkt = new ping_packet;
664		659
665	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);	660	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
666	vpn->send_vpn_packet (pkt, dsa, IPTOS_LOWDELAY);	661	send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
667		662
668	delete pkt;	663	delete pkt;
669	}	664	}
670		665
671	void	666	void
672	connection::send_reset (SOCKADDR *dsa)	667	connection::send_reset (const sockinfo &si)
673	{	668	{
674	static net_rate_limiter limiter(1);
675
676	if (limiter.can (dsa) && connectmode != conf_node::C_DISABLED)	669	if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
677	{	670	{
678	config_packet *pkt = new config_packet;	671	config_packet *pkt = new config_packet;
679		672
680	pkt->setup (vpn_packet::PT_RESET, conf->id);	673	pkt->setup (vpn_packet::PT_RESET, conf->id);
681	vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST);	674	send_vpn_packet (pkt, si, IPTOS_MINCOST);
682		675
683	delete pkt;	676	delete pkt;
684	}	677	}
685	}	678	}
686		679
687	static rsachallenge *
688	gen_challenge (u32 seqrand, SOCKADDR *sa)
689	{
690	static rsachallenge k;
691
692	memcpy (&k, &challenge_bytes (), sizeof (k));
693	*(u32 *)&k[CHG_SEQNO] ^= seqrand;
694	xor_sa (k, sa);
695
696	return &k;
697	}
698
699	void	680	void
700	connection::send_auth (auth_subtype subtype, SOCKADDR *sa, const rsachallenge *k)	681	connection::send_auth_request (const sockinfo &si, bool initiate)
701	{	682	{
702	static net_rate_limiter limiter(0.2);	683	auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->can_recv);
703		684
704	if (subtype != AUTH_INIT || limiter.can (sa))	685	// the next line is very conservative
705	{	686	prot_send = best_protocol (THISNODE->can_send & THISNODE->can_recv & conf->can_recv);
706	if (!k)
707	k = gen_challenge (seqrand, sa);
708		687
709	auth_packet *pkt = new auth_packet (conf->id, subtype);	688	rsachallenge chg;
710		689
711	memcpy (pkt->challenge, rsa_cache.public_encrypt (conf->rsa_key, *k), sizeof (rsaencrdata));	690	rsa_cache.gen (pkt->id, chg);
712		691
		692	if (0 > RSA_public_encrypt (sizeof chg,
		693	(unsigned char *)&chg, (unsigned char *)&pkt->encr,
		694	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
		695	fatal ("RSA_public_encrypt error");
		696
713	slog (L_TRACE, ">>%d PT_AUTH(%d) [%s]", conf->id, subtype, (const char *)sockinfo (sa));	697	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
714		698
715	vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY);	699	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
716		700
717	delete pkt;	701	delete pkt;
718	}	702	}
		703
		704	void
		705	connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg)
		706	{
		707	auth_res_packet *pkt = new auth_res_packet (conf->id);
		708
		709	pkt->id = id;
		710
		711	rsa_hash (id, chg, pkt->response);
		712
		713	pkt->hmac_set (octx);
		714
		715	slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);
		716
		717	send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
		718
		719	delete pkt;
719	}	720	}
720		721
721	void	722	void
722	connection::establish_connection_cb (tstamp &ts)	723	connection::establish_connection_cb (tstamp &ts)
723	{	724	{
724	if (ictx || conf == THISNODE || connectmode == conf_node::C_NEVER)	725	if (ictx || conf == THISNODE
		726	|| connectmode == conf_node::C_NEVER
		727	|| connectmode == conf_node::C_DISABLED)
725	ts = TSTAMP_CANCEL;	728	ts = TSTAMP_CANCEL;
726	else if (ts <= NOW)	729	else if (ts <= NOW)
727	{	730	{
728	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.25;	731	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;
729		732
730	if (retry_int < 3600 * 8)	733	if (retry_int < 3600 * 8)
731	retry_cnt++;	734	retry_cnt++;
732		735
733	if (connectmode == conf_node::C_ONDEMAND
734	&& retry_int > ::conf.keepalive)
735	retry_int = ::conf.keepalive;
736
737	ts = NOW + retry_int;	736	ts = NOW + retry_int;
738		737
739	if (conf->hostname)	738	if (conf->hostname)
740	{	739	{
741	reset_dstaddr ();	740	reset_dstaddr ();
742	if (sa.sin_addr.s_addr)	741	if (si.host && auth_rate_limiter.can (si))
		742	{
743	if (retry_cnt < 4)	743	if (retry_cnt < 4)
744	send_auth (AUTH_INIT, &sa);	744	send_auth_request (si, true);
745	else	745	else
746	send_ping (&sa, 0);	746	send_ping (si, 0);
		747	}
747	}	748	}
748	else	749	else
749	vpn->connect_request (conf->id);	750	vpn->connect_request (conf->id);
750	}	751	}
751	}	752	}
…		…
753	void	754	void
754	connection::reset_connection ()	755	connection::reset_connection ()
755	{	756	{
756	if (ictx && octx)	757	if (ictx && octx)
757	{	758	{
758	slog (L_INFO, _("connection to %d (%s) lost"), conf->id, conf->nodename);	759	slog (L_INFO, _("%s(%s): connection lost"),
		760	conf->nodename, (const char *)si);
759		761
760	if (::conf.script_node_down)	762	if (::conf.script_node_down)
761	run_script (this, &connection::script_node_down, false);	763	run_script (run_script_cb (this, &connection::script_node_down), false);
762	}	764	}
763		765
764	delete ictx; ictx = 0;	766	delete ictx; ictx = 0;
765	delete octx; octx = 0;	767	delete octx; octx = 0;
766		768
767	RAND_bytes ((unsigned char *)&seqrand, sizeof (u32));	769	si.host= 0;
768
769	sa.sin_port = 0;
770	sa.sin_addr.s_addr = 0;
771		770
772	last_activity = 0;	771	last_activity = 0;
		772	retry_cnt = 0;
773		773
774	rekey.reset ();	774	rekey.reset ();
775	keepalive.reset ();	775	keepalive.reset ();
776	establish_connection.reset ();	776	establish_connection.reset ();
777	}	777	}
778		778
779	void	779	void
780	connection::shutdown ()	780	connection::shutdown ()
781	{	781	{
782	if (ictx && octx)	782	if (ictx && octx)
783	send_reset (&sa);	783	send_reset (si);
784		784
785	reset_connection ();	785	reset_connection ();
786	}	786	}
787		787
788	void	788	void
…		…
793	reset_connection ();	793	reset_connection ();
794	establish_connection ();	794	establish_connection ();
795	}	795	}
796		796
797	void	797	void
798	connection::send_data_packet (tap_packet * pkt, bool broadcast)	798	connection::send_data_packet (tap_packet *pkt, bool broadcast)
799	{	799	{
800	vpndata_packet *p = new vpndata_packet;	800	vpndata_packet *p = new vpndata_packet;
801	int tos = 0;	801	int tos = 0;
802		802
803	if (conf->inherit_tos	803	if (conf->inherit_tos
804	&& (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP	804	&& (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
805	&& ((*pkt)[14] & 0xf0) == 0x40) // IPv4	805	&& ((*pkt)[14] & 0xf0) == 0x40) // IPv4
806	tos = (*pkt)[15] & IPTOS_TOS_MASK;	806	tos = (*pkt)[15] & IPTOS_TOS_MASK;
807		807
808	p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs	808	p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
809	vpn->send_vpn_packet (p, &sa, tos);	809	send_vpn_packet (p, si, tos);
810		810
811	delete p;	811	delete p;
812		812
813	if (oseqno > MAX_SEQNO)	813	if (oseqno > MAX_SEQNO)
814	rekey ();	814	rekey ();
…		…
827	establish_connection ();	827	establish_connection ();
828	}	828	}
829	}	829	}
830		830
831	void	831	void
832	connection::recv_vpn_packet (vpn_packet *pkt, SOCKADDR *ssa)	832	connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
833	{	833	{
834	last_activity = NOW;	834	last_activity = NOW;
835		835
836	slog (L_NOISE, "<<%d received packet type %d from %d to %d",	836	slog (L_NOISE, "<<%d received packet type %d from %d to %d",
837	conf->id, pkt->typ (), pkt->src (), pkt->dst ());	837	conf->id, pkt->typ (), pkt->src (), pkt->dst ());
838		838
839	switch (pkt->typ ())	839	switch (pkt->typ ())
840	{	840	{
841	case vpn_packet::PT_PING:	841	case vpn_packet::PT_PING:
		842	// we send pings instead of auth packets after some retries,
		843	// so reset the retry counter and establish a connection
		844	// when we receive a ping.
		845	if (!ictx)
		846	{
		847	if (auth_rate_limiter.can (rsi))
		848	send_auth_request (rsi, true);
		849	}
		850	else
842	send_ping (ssa, 1); // pong	851	send_ping (rsi, 1); // pong
		852
843	break;	853	break;
844		854
845	case vpn_packet::PT_PONG:	855	case vpn_packet::PT_PONG:
846	// we send pings instead of auth packets after some retries,
847	// so reset the retry counter and establish a conenction
848	// when we receive a pong.
849	if (!ictx && !octx)
850	{
851	retry_cnt = 0;
852	establish_connection.at = 0;
853	establish_connection ();
854	}
855
856	break;	856	break;
857		857
858	case vpn_packet::PT_RESET:	858	case vpn_packet::PT_RESET:
859	{	859	{
860	reset_connection ();	860	reset_connection ();
861		861
862	config_packet *p = (config_packet *) pkt;	862	config_packet *p = (config_packet *) pkt;
		863
863	if (!p->chk_config ())	864	if (!p->chk_config ())
864	{	865	{
865	slog (L_WARN, _("protocol mismatch, disabling node '%s'"), conf->nodename);	866	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
		867	conf->nodename, (const char *)rsi);
866	connectmode = conf_node::C_DISABLED;	868	connectmode = conf_node::C_DISABLED;
867	}	869	}
868	else if (connectmode == conf_node::C_ALWAYS)	870	else if (connectmode == conf_node::C_ALWAYS)
869	establish_connection ();	871	establish_connection ();
870	}	872	}
871	break;	873	break;
872		874
873	case vpn_packet::PT_AUTH:	875	case vpn_packet::PT_AUTH_REQ:
		876	if (auth_rate_limiter.can (rsi))
		877	{
		878	auth_req_packet *p = (auth_req_packet *) pkt;
		879
		880	slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);
		881
		882	if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
		883	{
		884	if (p->prot_minor != PROTOCOL_MINOR)
		885	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
		886	conf->nodename, (const char *)rsi,
		887	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
		888
		889	if (p->initiate)
		890	send_auth_request (rsi, false);
		891
		892	rsachallenge k;
		893
		894	if (0 > RSA_private_decrypt (sizeof (p->encr),
		895	(unsigned char *)&p->encr, (unsigned char *)&k,
		896	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
		897	slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
		898	conf->nodename, (const char *)rsi);
		899	else
		900	{
		901	retry_cnt = 0;
		902	establish_connection.set (NOW + 8); //? ;)
		903	keepalive.reset ();
		904	rekey.reset ();
		905
		906	delete ictx;
		907	ictx = 0;
		908
		909	delete octx;
		910
		911	octx = new crypto_ctx (k, 1);
		912	oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
		913
		914	conf->can_recv = p->can_recv;
		915	send_auth_response (rsi, p->id, k);
		916
		917	break;
		918	}
		919	}
		920
		921	send_reset (rsi);
		922	}
		923
		924	break;
		925
		926	case vpn_packet::PT_AUTH_RES:
874	{	927	{
875	auth_packet *p = (auth_packet *) pkt;	928	auth_res_packet *p = (auth_res_packet *) pkt;
876		929
877	slog (L_TRACE, "<<%d PT_AUTH(%d)", conf->id, p->subtype);	930	slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);
878		931
879	if (p->chk_config ()	932	if (p->chk_config ())
880	&& !strncmp (p->magic, MAGIC, 8))
881	{	933	{
882	if (p->prot_minor != PROTOCOL_MINOR)	934	if (p->prot_minor != PROTOCOL_MINOR)
883	slog (L_INFO, _("protocol minor version mismatch: ours is %d, %s's is %d."),	935	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
		936	conf->nodename, (const char *)rsi,
884	PROTOCOL_MINOR, conf->nodename, p->prot_minor);	937	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
885		938
886	if (p->subtype == AUTH_INIT)	939	rsachallenge chg;
887	send_auth (AUTH_INITREPLY, ssa);
888		940
889	const rsachallenge *k = rsa_cache.private_decrypt (::conf.rsa_key, p->challenge);	941	if (!rsa_cache.find (p->id, chg))
890		942	slog (L_ERR, _("%s(%s): unrequested auth response"),
891	if (!k)	943	conf->nodename, (const char *)rsi);
		944	else
892	{	945	{
893	slog (L_ERR, _("challenge from %s (%s) illegal or corrupted"),	946	crypto_ctx *cctx = new crypto_ctx (chg, 0);
		947
		948	if (!p->hmac_chk (cctx))
		949	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
		950	"could be an attack, or just corruption or an synchronization error"),
894	conf->nodename, (const char *)sockinfo (ssa));	951	conf->nodename, (const char *)rsi);
895	break;	952	else
896	}
897
898	retry_cnt = 0;
899	establish_connection.set (NOW + 8); //? ;)
900	keepalive.reset ();
901	rekey.reset ();
902
903	switch (p->subtype)
904	{
905	case AUTH_INIT:
906	case AUTH_INITREPLY:
907	delete ictx;
908	ictx = 0;
909
910	delete octx;
911
912	octx = new crypto_ctx (*k, 1);
913	oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
914
915	send_auth (AUTH_REPLY, ssa, k);
916	break;
917
918	case AUTH_REPLY:
919
920	if (!memcmp ((u8 *)gen_challenge (seqrand, ssa), (u8 *)k, sizeof (rsachallenge)))
921	{	953	{
922	delete ictx;
923
924	ictx = new crypto_ctx (*k, 0);
925	iseqno.reset (ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
926
927	sa = *ssa;	954	rsaresponse h;
928		955
929	rekey.set (NOW + ::conf.rekey);	956	rsa_hash (p->id, chg, h);
930	keepalive.set (NOW + ::conf.keepalive);
931		957
932	// send queued packets	958	if (!memcmp ((u8 *)&h, (u8 *)p->response, sizeof h))
933	while (tap_packet *p = queue.get ())
934	{	959	{
		960	prot_minor = p->prot_minor;
		961
		962	delete ictx; ictx = cctx;
		963
		964	iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
		965
		966	si = rsi;
		967
		968	rekey.set (NOW + ::conf.rekey);
		969	keepalive.set (NOW + ::conf.keepalive);
		970
		971	// send queued packets
		972	while (tap_packet *p = queue.get ())
		973	{
935	send_data_packet (p);	974	send_data_packet (p);
936	delete p;	975	delete p;
		976	}
		977
		978	connectmode = conf->connectmode;
		979
		980	slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
		981	conf->nodename, (const char *)rsi,
		982	p->prot_major, p->prot_minor);
		983
		984	if (::conf.script_node_up)
		985	run_script (run_script_cb (this, &connection::script_node_up), false);
		986
		987	break;
937	}	988	}
938		989	else
939	connectmode = conf->connectmode;	990	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
940
941	slog (L_INFO, _("connection to %d (%s %s) established"),
942	conf->id, conf->nodename, (const char *)sockinfo (ssa));	991	conf->nodename, (const char *)rsi);
943
944	if (::conf.script_node_up)
945	run_script (this, &connection::script_node_up, false);
946	}	992	}
		993
947	else	994	delete cctx;
948	slog (L_ERR, _("sent and received challenge do not match with (%s %s))"),
949	conf->nodename, (const char *)sockinfo (ssa));
950
951	break;
952	default:
953	slog (L_ERR, _("authentification illegal subtype error (%s %s)"),
954	conf->nodename, (const char *)sockinfo (ssa));
955	break;
956	}	995	}
957	}	996	}
958	else
959	send_reset (ssa);
960
961	break;
962	}	997	}
		998
		999	send_reset (rsi);
		1000	break;
963		1001
964	case vpn_packet::PT_DATA_COMPRESSED:	1002	case vpn_packet::PT_DATA_COMPRESSED:
965	#if !ENABLE_COMPRESSION	1003	#if !ENABLE_COMPRESSION
966	send_reset (ssa);	1004	send_reset (rsi);
967	break;	1005	break;
968	#endif	1006	#endif
		1007
969	case vpn_packet::PT_DATA_UNCOMPRESSED:	1008	case vpn_packet::PT_DATA_UNCOMPRESSED:
970		1009
971	if (ictx && octx)	1010	if (ictx && octx)
972	{	1011	{
973	vpndata_packet *p = (vpndata_packet *)pkt;	1012	vpndata_packet *p = (vpndata_packet *)pkt;
974		1013
975	if (*ssa == sa)	1014	if (rsi == si)
976	{	1015	{
977	if (!p->hmac_chk (ictx))	1016	if (!p->hmac_chk (ictx))
978	slog (L_ERR, _("hmac authentication error, received invalid packet\n"	1017	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
979	"could be an attack, or just corruption or an synchronization error"));	1018	"could be an attack, or just corruption or an synchronization error"),
		1019	conf->nodename, (const char *)rsi);
980	else	1020	else
981	{	1021	{
982	u32 seqno;	1022	u32 seqno;
983	tap_packet *d = p->unpack (this, seqno);	1023	tap_packet *d = p->unpack (this, seqno);
984		1024
…		…
1000	break;	1040	break;
1001	}	1041	}
1002	}	1042	}
1003	}	1043	}
1004	else	1044	else
1005	slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D	1045	slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
1006	}	1046	}
1007		1047
1008	send_reset (ssa);	1048	send_reset (rsi);
1009	break;	1049	break;
1010		1050
1011	case vpn_packet::PT_CONNECT_REQ:	1051	case vpn_packet::PT_CONNECT_REQ:
1012	if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx))	1052	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1013	{	1053	{
1014	connect_req_packet *p = (connect_req_packet *) pkt;	1054	connect_req_packet *p = (connect_req_packet *) pkt;
1015		1055
1016	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1056	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1017		1057
…		…
1023	if (c->ictx && c->octx)	1063	if (c->ictx && c->octx)
1024	{	1064	{
1025	// send connect_info packets to both sides, in case one is	1065	// send connect_info packets to both sides, in case one is
1026	// behind a nat firewall (or both ;)	1066	// behind a nat firewall (or both ;)
1027	{	1067	{
1028	sockinfo si(sa);
1029
1030	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",	1068	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1031	c->conf->id, conf->id, (const char *)si);	1069	c->conf->id, conf->id, (const char *)si);
1032		1070
1033	connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si);	1071	connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si, conf->can_recv);
1034		1072
1035	r->hmac_set (c->octx);	1073	r->hmac_set (c->octx);
1036	vpn->send_vpn_packet (r, &c->sa);	1074	send_vpn_packet (r, c->si);
1037		1075
1038	delete r;	1076	delete r;
1039	}	1077	}
1040		1078
1041	{	1079	{
1042	sockinfo si(c->sa);
1043
1044	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",	1080	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1045	conf->id, c->conf->id, (const char *)si);	1081	conf->id, c->conf->id, (const char *)c->si);
1046		1082
1047	connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, si);	1083	connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, c->si, c->conf->can_recv);
1048		1084
1049	r->hmac_set (octx);	1085	r->hmac_set (octx);
1050	vpn->send_vpn_packet (r, &sa);	1086	send_vpn_packet (r, si);
1051		1087
1052	delete r;	1088	delete r;
1053	}	1089	}
1054	}	1090	}
1055	}	1091	}
1056		1092
1057	break;	1093	break;
1058		1094
1059	case vpn_packet::PT_CONNECT_INFO:	1095	case vpn_packet::PT_CONNECT_INFO:
1060	if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx))	1096	if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1061	{	1097	{
1062	connect_info_packet *p = (connect_info_packet *) pkt;	1098	connect_info_packet *p = (connect_info_packet *) pkt;
1063		1099
1064	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything	1100	assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1065		1101
1066	connection *c = vpn->conns[p->id - 1];	1102	connection *c = vpn->conns[p->id - 1];
1067		1103
1068	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1104	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1069	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1105	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1070		1106
1071	c->send_auth (AUTH_INIT, p->si.sa ());	1107	c->conf->can_recv = p->can_recv;
		1108	c->send_auth_request (p->si, true);
1072	}	1109	}
		1110
1073	break;	1111	break;
1074		1112
1075	default:	1113	default:
1076	send_reset (ssa);	1114	send_reset (rsi);
1077	break;	1115	break;
		1116
1078	}	1117	}
1079	}	1118	}
1080		1119
1081	void connection::keepalive_cb (tstamp &ts)	1120	void connection::keepalive_cb (tstamp &ts)
1082	{	1121	{
…		…
1088	else if (NOW < last_activity + ::conf.keepalive)	1127	else if (NOW < last_activity + ::conf.keepalive)
1089	ts = last_activity + ::conf.keepalive;	1128	ts = last_activity + ::conf.keepalive;
1090	else if (conf->connectmode != conf_node::C_ONDEMAND	1129	else if (conf->connectmode != conf_node::C_ONDEMAND
1091	|| THISNODE->connectmode != conf_node::C_ONDEMAND)	1130	|| THISNODE->connectmode != conf_node::C_ONDEMAND)
1092	{	1131	{
1093	send_ping (&sa);	1132	send_ping (si);
1094	ts = NOW + 5;	1133	ts = NOW + 5;
1095	}	1134	}
1096	else	1135	else
1097	reset_connection ();	1136	reset_connection ();
1098		1137
…		…
1102	{	1141	{
1103	connect_req_packet *p = new connect_req_packet (conf->id, id);	1142	connect_req_packet *p = new connect_req_packet (conf->id, id);
1104		1143
1105	slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", id, conf->id);	1144	slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", id, conf->id);
1106	p->hmac_set (octx);	1145	p->hmac_set (octx);
1107	vpn->send_vpn_packet (p, &sa);	1146	send_vpn_packet (p, si);
1108		1147
1109	delete p;	1148	delete p;
1110	}	1149	}
1111		1150
1112	void connection::script_node ()	1151	void connection::script_node ()
1113	{	1152	{
1114	vpn->script_if_up ();	1153	vpn->script_if_up (0);
1115		1154
1116	char *env;	1155	char *env;
1117	asprintf (&env, "DESTID=%d", conf->id);	1156	asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1118	putenv (env);
1119	asprintf (&env, "DESTNODE=%s", conf->nodename);	1157	asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1120	putenv (env);	1158	asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1121	asprintf (&env, "DESTIP=%s", inet_ntoa (sa.sin_addr));
1122	putenv (env);
1123	asprintf (&env, "DESTPORT=%d", ntohs (sa.sin_port));	1159	asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1124	putenv (env);
1125	}	1160	}
1126		1161
1127	const char *connection::script_node_up ()	1162	const char *connection::script_node_up (int)
1128	{	1163	{
1129	script_node ();	1164	script_node ();
1130		1165
1131	putenv ("STATE=up");	1166	putenv ("STATE=up");
1132		1167
1133	return ::conf.script_node_up ? ::conf.script_node_up : "node-up";	1168	return ::conf.script_node_up ? ::conf.script_node_up : "node-up";
1134	}	1169	}
1135		1170
1136	const char *connection::script_node_down ()	1171	const char *connection::script_node_down (int)
1137	{	1172	{
1138	script_node ();	1173	script_node ();
1139		1174
1140	putenv ("STATE=down");	1175	putenv ("STATE=down");
1141		1176
1142	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";	1177	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
		1178	}
		1179
		1180	// send a vpn packet out to other hosts
		1181	void
		1182	connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
		1183	{
		1184	if (prot_send & PROT_IPv4)
		1185	vpn->send_ipv4_packet (pkt, si, tos);
		1186	else
		1187	vpn->send_udpv4_packet (pkt, si, tos);
1143	}	1188	}
1144		1189
1145	connection::connection(struct vpn *vpn_)	1190	connection::connection(struct vpn *vpn_)
1146	: vpn(vpn_)	1191	: vpn(vpn_)
1147	, rekey (this, &connection::rekey_cb)	1192	, rekey (this, &connection::rekey_cb)
…		…
1160	shutdown ();	1205	shutdown ();
1161	}	1206	}
1162		1207
1163	/////////////////////////////////////////////////////////////////////////////	1208	/////////////////////////////////////////////////////////////////////////////
1164		1209
1165	const char *vpn::script_if_up ()	1210	const char *vpn::script_if_up (int)
1166	{	1211	{
1167	// the tunnel device mtu should be the physical mtu - overhead	1212	// the tunnel device mtu should be the physical mtu - overhead
1168	// the tricky part is rounding to the cipher key blocksize	1213	// the tricky part is rounding to the cipher key blocksize
1169	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - UDP_OVERHEAD;	1214	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
1170	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion	1215	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
1171	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round	1216	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
1172	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again	1217	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
1173		1218
1174	char *env;	1219	char *env;
…		…
1189		1234
1190	return ::conf.script_if_up ? ::conf.script_if_up : "if-up";	1235	return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
1191	}	1236	}
1192		1237
1193	int	1238	int
1194	vpn::setup (void)	1239	vpn::setup ()
1195	{	1240	{
1196	struct sockaddr_in sa;	1241	u8 prots = 0;
1197		1242
		1243	for (configuration::node_vector::iterator i = conf.nodes.begin ();
		1244	i != conf.nodes.end (); ++i)
		1245	prots |= (*i)->can_send | (*i)->can_recv;
		1246
		1247	sockinfo si;
		1248
		1249	si.set (THISNODE);
		1250
		1251	udpv4_fd = -1;
		1252
		1253	if (prots & PROT_UDPv4)
		1254	{
1198	socket_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	1255	udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
1199	if (socket_fd < 0)	1256
		1257	if (udpv4_fd < 0)
1200	return -1;	1258	return -1;
1201		1259
1202	fill_sa (&sa, THISNODE);	1260	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
1203		1261	{
1204	if (bind (socket_fd, (sockaddr *)&sa, sizeof (sa)))
1205	{
1206	slog (L_ERR, _("can't bind to %s: %s"), (const char *)sockinfo(sa), strerror (errno));	1262	slog (L_ERR, _("can't bind udpv4 to %s: %s"), (const char *)si, strerror (errno));
1207	exit (1);	1263	exit (1);
1208	}	1264	}
1209		1265
1210	#ifdef IP_MTU_DISCOVER	1266	#ifdef IP_MTU_DISCOVER
1211	// this I really consider a linux bug. I am neither connected	1267	// this I really consider a linux bug. I am neither connected
1212	// nor do I fragment myself. Linux still sets DF and doesn't	1268	// nor do I fragment myself. Linux still sets DF and doesn't
1213	// fragment for me sometimes.	1269	// fragment for me sometimes.
1214	{	1270	{
1215	int oval = IP_PMTUDISC_DONT;	1271	int oval = IP_PMTUDISC_DONT;
1216	setsockopt (socket_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);	1272	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
1217	}	1273	}
1218	#endif	1274	#endif
1219	{	1275
		1276	// standard daemon practise...
		1277	{
1220	int oval = 1;	1278	int oval = 1;
1221	setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	1279	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
1222	}	1280	}
1223		1281
1224	udp_ev_watcher.start (socket_fd, POLLIN);	1282	udpv4_ev_watcher.start (udpv4_fd, POLLIN);
		1283	}
		1284
		1285	ipv4_fd = -1;
		1286	if (prots & PROT_IPv4)
		1287	{
		1288	ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
		1289
		1290	if (ipv4_fd < 0)
		1291	return -1;
		1292
		1293	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
		1294	{
		1295	slog (L_ERR, _("can't bind ipv4 socket to %s: %s"), (const char *)si, strerror (errno));
		1296	exit (1);
		1297	}
		1298
		1299	#ifdef IP_MTU_DISCOVER
		1300	// this I really consider a linux bug. I am neither connected
		1301	// nor do I fragment myself. Linux still sets DF and doesn't
		1302	// fragment for me sometimes.
		1303	{
		1304	int oval = IP_PMTUDISC_DONT;
		1305	setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
		1306	}
		1307	#endif
		1308
		1309	ipv4_ev_watcher.start (ipv4_fd, POLLIN);
		1310	}
1225		1311
1226	tap = new tap_device ();	1312	tap = new tap_device ();
1227	if (!tap) //D this, of course, never catches	1313	if (!tap) //D this, of course, never catches
1228	{	1314	{
1229	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);	1315	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
1230	exit (1);	1316	exit (1);
1231	}	1317	}
1232		1318
1233	run_script (this, &vpn::script_if_up, true);	1319	run_script (run_script_cb (this, &vpn::script_if_up), true);
1234		1320
1235	vpn_ev_watcher.start (tap->fd, POLLIN);	1321	tap_ev_watcher.start (tap->fd, POLLIN);
1236		1322
1237	reconnect_all ();	1323	reconnect_all ();
1238		1324
1239	return 0;	1325	return 0;
1240	}	1326	}
1241		1327
1242	void	1328	void
1243	vpn::send_vpn_packet (vpn_packet *pkt, SOCKADDR *sa, int tos)	1329	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1244	{	1330	{
1245	setsockopt (socket_fd, SOL_IP, IP_TOS, &tos, sizeof tos);	1331	setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1246	sendto (socket_fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)sa, sizeof (*sa));	1332	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1247	}	1333	}
1248		1334
1249	void	1335	void
1250	vpn::shutdown_all ()	1336	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1251	{	1337	{
1252	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	1338	setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1253	(*c)->shutdown ();	1339	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1254	}	1340	}
1255		1341
1256	void	1342	void
1257	vpn::reconnect_all ()	1343	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
1258	{	1344	{
1259	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	1345	unsigned int src = pkt->src ();
1260	delete *c;	1346	unsigned int dst = pkt->dst ();
1261		1347
1262	conns.clear ();	1348	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
		1349	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1263		1350
1264	for (configuration::node_vector::iterator i = conf.nodes.begin ();	1351	if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1265	i != conf.nodes.end (); ++i)	1352	slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1266	{	1353	pkt->typ (), pkt->src (), pkt->dst ());
1267	connection *conn = new connection (this);	1354	else if (dst == 0 && !THISNODE->routerprio)
1268		1355	slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1269	conn->conf = *i;	1356	else if (dst != 0 && dst != THISNODE->id)
1270	conns.push_back (conn);	1357	slog (L_WARN,
1271		1358	_("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1272	conn->establish_connection ();	1359	dst, conns[dst - 1]->conf->nodename,
1273	}	1360	(const char *)rsi,
		1361	THISNODE->id, THISNODE->nodename);
		1362	else if (src == 0 || src > conns.size ())
		1363	slog (L_WARN, _("received frame from unknown node %d (%s)"),
		1364	src, (const char *)rsi);
		1365	else
		1366	conns[src - 1]->recv_vpn_packet (pkt, rsi);
1274	}	1367	}
1275		1368
1276	connection *vpn::find_router ()
1277	{
1278	u32 prio = 0;
1279	connection *router = 0;
1280
1281	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1282	{
1283	connection *c = *i;
1284
1285	if (c->conf->routerprio > prio
1286	&& c->connectmode == conf_node::C_ALWAYS
1287	&& c->conf != THISNODE
1288	&& c->ictx && c->octx)
1289	{
1290	prio = c->conf->routerprio;
1291	router = c;
1292	}
1293	}
1294
1295	return router;
1296	}
1297
1298	void vpn::connect_request (int id)
1299	{
1300	connection *c = find_router ();
1301
1302	if (c)
1303	c->connect_request (id);
1304	//else // does not work, because all others must connect to the same router
1305	// // no router found, aggressively connect to all routers
1306	// for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1307	// if ((*i)->conf->routerprio)
1308	// (*i)->establish_connection ();
1309	}
1310
1311	void	1369	void
1312	vpn::udp_ev (short revents)	1370	vpn::udpv4_ev (short revents)
1313	{	1371	{
1314	if (revents & (POLLIN | POLLERR))	1372	if (revents & (POLLIN | POLLERR))
1315	{	1373	{
1316	vpn_packet *pkt = new vpn_packet;	1374	vpn_packet *pkt = new vpn_packet;
1317	struct sockaddr_in sa;	1375	struct sockaddr_in sa;
1318	socklen_t sa_len = sizeof (sa);	1376	socklen_t sa_len = sizeof (sa);
1319	int len;	1377	int len;
1320		1378
1321	len = recvfrom (socket_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);	1379	len = recvfrom (udpv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
		1380
		1381	sockinfo si(sa);
1322		1382
1323	if (len > 0)	1383	if (len > 0)
1324	{	1384	{
1325	pkt->len = len;	1385	pkt->len = len;
1326		1386
1327	unsigned int src = pkt->src ();
1328	unsigned int dst = pkt->dst ();
1329
1330	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1331	(const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1332
1333	if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1334	slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1335	pkt->typ (), pkt->src (), pkt->dst ());
1336	else if (dst == 0 && !THISNODE->routerprio)
1337	slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1338	else if (dst != 0 && dst != THISNODE->id)
1339	slog (L_WARN,
1340	_("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1341	dst, conns[dst - 1]->conf->nodename,
1342	(const char *)sockinfo (sa),
1343	THISNODE->id, THISNODE->nodename);
1344	else if (src == 0 || src > conns.size ())
1345	slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
1346	else
1347	conns[src - 1]->recv_vpn_packet (pkt, &sa);	1387	recv_vpn_packet (pkt, si);
1348	}	1388	}
1349	else	1389	else
1350	{	1390	{
1351	// probably ECONNRESET or somesuch	1391	// probably ECONNRESET or somesuch
1352	slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno));	1392	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
1353	}	1393	}
1354		1394
1355	delete pkt;	1395	delete pkt;
1356	}	1396	}
1357	else if (revents & POLLHUP)	1397	else if (revents & POLLHUP)
1358	{	1398	{
1359	// this cannot ;) happen on udp sockets	1399	// this cannot ;) happen on udp sockets
1360	slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating."));	1400	slog (L_ERR, _("FATAL: POLLHUP on udp v4 fd, terminating."));
1361	exit (1);	1401	exit (1);
1362	}	1402	}
1363	else	1403	else
1364	{	1404	{
1365	slog (L_ERR,	1405	slog (L_ERR,
…		…
1368	exit (1);	1408	exit (1);
1369	}	1409	}
1370	}	1410	}
1371		1411
1372	void	1412	void
		1413	vpn::ipv4_ev (short revents)
		1414	{
		1415	if (revents & (POLLIN | POLLERR))
		1416	{
		1417	vpn_packet *pkt = new vpn_packet;
		1418	struct sockaddr_in sa;
		1419	socklen_t sa_len = sizeof (sa);
		1420	int len;
		1421
		1422	len = recvfrom (ipv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
		1423
		1424	sockinfo si(sa, PROT_IPv4);
		1425
		1426	if (len > 0)
		1427	{
		1428	pkt->len = len;
		1429
		1430	// raw sockets deliver the ipv4, but don't expect it on sends
		1431	// this is slow, but...
		1432	pkt->skip_hdr (IP_OVERHEAD);
		1433
		1434	recv_vpn_packet (pkt, si);
		1435	}
		1436	else
		1437	{
		1438	// probably ECONNRESET or somesuch
		1439	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
		1440	}
		1441
		1442	delete pkt;
		1443	}
		1444	else if (revents & POLLHUP)
		1445	{
		1446	// this cannot ;) happen on udp sockets
		1447	slog (L_ERR, _("FATAL: POLLHUP on ipv4 fd, terminating."));
		1448	exit (1);
		1449	}
		1450	else
		1451	{
		1452	slog (L_ERR,
		1453	_("FATAL: unknown revents %08x in socket, terminating\n"),
		1454	revents);
		1455	exit (1);
		1456	}
		1457	}
		1458
		1459	void
1373	vpn::vpn_ev (short revents)	1460	vpn::tap_ev (short revents)
1374	{	1461	{
1375	if (revents & POLLIN)	1462	if (revents & POLLIN)
1376	{	1463	{
1377	/* process data */	1464	/* process data */
1378	tap_packet *pkt;	1465	tap_packet *pkt;
…		…
1434	{	1521	{
1435	if (events)	1522	if (events)
1436	{	1523	{
1437	if (events & EVENT_SHUTDOWN)	1524	if (events & EVENT_SHUTDOWN)
1438	{	1525	{
		1526	slog (L_INFO, _("preparing shutdown..."));
		1527
1439	shutdown_all ();	1528	shutdown_all ();
1440		1529
1441	remove_pid (pidfilename);	1530	remove_pid (pidfilename);
1442		1531
1443	slog (L_INFO, _("vped terminating"));	1532	slog (L_INFO, _("terminating"));
1444		1533
1445	exit (0);	1534	exit (0);
1446	}	1535	}
1447		1536
1448	if (events & EVENT_RECONNECT)	1537	if (events & EVENT_RECONNECT)
		1538	{
		1539	slog (L_INFO, _("forced reconnect"));
		1540
1449	reconnect_all ();	1541	reconnect_all ();
		1542	}
1450		1543
1451	events = 0;	1544	events = 0;
1452	}	1545	}
1453		1546
1454	ts = TSTAMP_CANCEL;	1547	ts = TSTAMP_CANCEL;
1455	}	1548	}
1456		1549
		1550	void
		1551	vpn::shutdown_all ()
		1552	{
		1553	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
		1554	(*c)->shutdown ();
		1555	}
		1556
		1557	void
		1558	vpn::reconnect_all ()
		1559	{
		1560	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
		1561	delete *c;
		1562
		1563	conns.clear ();
		1564
		1565	auth_rate_limiter.clear ();
		1566	reset_rate_limiter.clear ();
		1567
		1568	for (configuration::node_vector::iterator i = conf.nodes.begin ();
		1569	i != conf.nodes.end (); ++i)
		1570	{
		1571	connection *conn = new connection (this);
		1572
		1573	conn->conf = *i;
		1574	conns.push_back (conn);
		1575
		1576	conn->establish_connection ();
		1577	}
		1578	}
		1579
		1580	connection *vpn::find_router ()
		1581	{
		1582	u32 prio = 0;
		1583	connection *router = 0;
		1584
		1585	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		1586	{
		1587	connection *c = *i;
		1588
		1589	if (c->conf->routerprio > prio
		1590	&& c->connectmode == conf_node::C_ALWAYS
		1591	&& c->conf != THISNODE
		1592	&& c->ictx && c->octx)
		1593	{
		1594	prio = c->conf->routerprio;
		1595	router = c;
		1596	}
		1597	}
		1598
		1599	return router;
		1600	}
		1601
		1602	void vpn::connect_request (int id)
		1603	{
		1604	connection *c = find_router ();
		1605
		1606	if (c)
		1607	c->connect_request (id);
		1608	//else // does not work, because all others must connect to the same router
		1609	// // no router found, aggressively connect to all routers
		1610	// for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		1611	// if ((*i)->conf->routerprio)
		1612	// (*i)->establish_connection ();
		1613	}
		1614
		1615	void
		1616	connection::dump_status ()
		1617	{
		1618	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
		1619	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
		1620	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
		1621	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
		1622	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
		1623	slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
		1624	(long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
		1625	}
		1626
		1627	void
		1628	vpn::dump_status ()
		1629	{
		1630	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);
		1631
		1632	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
		1633	(*c)->dump_status ();
		1634
		1635	slog (L_NOTICE, _("END status dump"));
		1636	}
		1637
1457	vpn::vpn (void)	1638	vpn::vpn (void)
1458	: udp_ev_watcher (this, &vpn::udp_ev)	1639	: udpv4_ev_watcher(this, &vpn::udpv4_ev)
		1640	, ipv4_ev_watcher(this, &vpn::ipv4_ev)
1459	, vpn_ev_watcher (this, &vpn::vpn_ev)	1641	, tap_ev_watcher(this, &vpn::tap_ev)
1460	, event (this, &vpn::event_cb)	1642	, event(this, &vpn::event_cb)
1461	{	1643	{
1462	}	1644	}
1463		1645
1464	vpn::~vpn ()	1646	vpn::~vpn ()
1465	{	1647	{

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines
>	Changed lines