[ViewVC] Diff of: cvs/gvpe/src/protocol.C

Comparing gvpe/src/protocol.C (file contents):
Revision 1.2 by pcg, Sun Mar 2 23:04:02 2003 UTC vs.
Revision 1.20 by pcg, Wed Mar 26 17:59:12 2003 UTC

…		…
16	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	16	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17	*/	17	*/
18		18
19	#include "config.h"	19	#include "config.h"
20		20
		21	#include <list>
		22
21	#include <cstdlib>	23	#include <cstdlib>
22	#include <cstring>	24	#include <cstring>
23	#include <cstdio>	25	#include <cstdio>
24		26
25	#include <sys/types.h>	27	#include <sys/types.h>
…		…
56		58
57	static time_t next_timecheck;	59	static time_t next_timecheck;
58		60
59	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic	61	#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
60		62
61	static const rsachallenge &	63	struct crypto_ctx
62	challenge_bytes ()
63	{
64	static rsachallenge challenge;
65	static time_t challenge_ttl; // time this challenge needs to be recreated
66
67	if (now > challenge_ttl)
68	{	64	{
69	RAND_bytes ((unsigned char *)&challenge, sizeof (challenge));	65	EVP_CIPHER_CTX cctx;
70	challenge_ttl = now + CHALLENGE_TTL;	66	HMAC_CTX hctx;
71	}
72		67
73	return challenge;	68	crypto_ctx (const rsachallenge &challenge, int enc);
74	}	69	~crypto_ctx ();
		70	};
75		71
76	// run a script. yes, it's a template function. yes, c++	72	crypto_ctx::crypto_ctx (const rsachallenge &challenge, int enc)
77	// is not a functional language. yes, this suxx.	73	{
78	template<class owner>	74	EVP_CIPHER_CTX_init (&cctx);
		75	EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc);
		76	HMAC_CTX_init (&hctx);
		77	HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
		78	}
		79
		80	crypto_ctx::~crypto_ctx ()
		81	{
		82	EVP_CIPHER_CTX_cleanup (&cctx);
		83	HMAC_CTX_cleanup (&hctx);
		84	}
		85
79	static void	86	static void
80	run_script (owner obj, const char (owner::*setup)(), bool wait)	87	rsa_hash (const rsaid &id, const rsachallenge &chg, rsaresponse &h)
		88	{
		89	EVP_MD_CTX ctx;
		90
		91	EVP_MD_CTX_init (&ctx);
		92	EVP_DigestInit (&ctx, RSA_HASH);
		93	EVP_DigestUpdate(&ctx, &chg, sizeof chg);
		94	EVP_DigestUpdate(&ctx, &id, sizeof id);
		95	EVP_DigestFinal (&ctx, (unsigned char *)&h, 0);
		96	EVP_MD_CTX_cleanup (&ctx);
		97	}
		98
		99	struct rsa_entry {
		100	tstamp expire;
		101	rsaid id;
		102	rsachallenge chg;
		103	};
		104
		105	struct rsa_cache : list<rsa_entry>
		106	{
		107	void cleaner_cb (tstamp &ts); time_watcher cleaner;
		108
		109	bool find (const rsaid &id, rsachallenge &chg)
		110	{
		111	for (iterator i = begin (); i != end (); ++i)
		112	{
		113	if (!memcmp (&id, &i->id, sizeof id) && i->expire > NOW)
		114	{
		115	memcpy (&chg, &i->chg, sizeof chg);
		116
		117	erase (i);
		118	return true;
		119	}
		120	}
		121
		122	if (cleaner.at < NOW)
		123	cleaner.start (NOW + RSA_TTL);
		124
		125	return false;
		126	}
		127
		128	void gen (rsaid &id, rsachallenge &chg)
		129	{
		130	rsa_entry e;
		131
		132	RAND_bytes ((unsigned char *)&id, sizeof id);
		133	RAND_bytes ((unsigned char *)&chg, sizeof chg);
		134
		135	e.expire = NOW + RSA_TTL;
		136	e.id = id;
		137	memcpy (&e.chg, &chg, sizeof chg);
		138
		139	push_back (e);
		140
		141	if (cleaner.at < NOW)
		142	cleaner.start (NOW + RSA_TTL);
		143	}
		144
		145	rsa_cache ()
		146	: cleaner (this, &rsa_cache::cleaner_cb)
		147	{ }
		148
		149	} rsa_cache;
		150
		151	void rsa_cache::cleaner_cb (tstamp &ts)
		152	{
		153	if (empty ())
		154	ts = TSTAMP_CANCEL;
		155	else
		156	{
		157	ts = NOW + RSA_TTL;
		158
		159	for (iterator i = begin (); i != end (); )
		160	if (i->expire <= NOW)
		161	i = erase (i);
		162	else
		163	++i;
		164	}
		165	}
		166
		167	typedef callback<const char *, int> run_script_cb;
		168
		169	// run a shell script (or actually an external program).
		170	static void
		171	run_script (const run_script_cb &cb, bool wait)
81	{	172	{
82	int pid;	173	int pid;
83		174
84	if ((pid = fork ()) == 0)	175	if ((pid = fork ()) == 0)
85	{	176	{
86	char *filename;	177	char *filename;
87	asprintf (&filename, "%s/%s", confbase, (obj->*setup) ());	178	asprintf (&filename, "%s/%s", confbase, cb(0));
88	execl (filename, filename, (char *) 0);	179	execl (filename, filename, (char *) 0);
89	exit (255);	180	exit (255);
90	}	181	}
91	else if (pid > 0)	182	else if (pid > 0)
92	{	183	{
…		…
96	/* TODO: check status */	187	/* TODO: check status */
97	}	188	}
98	}	189	}
99	}	190	}
100		191
101	// xor the socket address into the challenge to ensure different challenges	192	//////////////////////////////////////////////////////////////////////////////
102	// per host. we could rely on the OAEP padding, but this doesn't hurt.
103	void
104	xor_sa (rsachallenge &k, SOCKADDR *sa)
105	{
106	((u32 *) k)[(CHG_CIPHER_KEY + 0) / 4] ^= sa->sin_addr.s_addr;
107	((u16 *) k)[(CHG_CIPHER_KEY + 4) / 2] ^= sa->sin_port;
108	((u32 *) k)[(CHG_HMAC_KEY + 0) / 4] ^= sa->sin_addr.s_addr;
109	((u16 *) k)[(CHG_HMAC_KEY + 4) / 2] ^= sa->sin_port;
110	}
111		193
112	struct crypto_ctx	194	void pkt_queue::put (tap_packet *p)
		195	{
		196	if (queue[i])
113	{	197	{
114	EVP_CIPHER_CTX cctx;	198	delete queue[i];
115	HMAC_CTX hctx;	199	j = (j + 1) % QUEUEDEPTH;
		200	}
116		201
117	crypto_ctx (rsachallenge &challenge, int enc);	202	queue[i] = p;
118	~crypto_ctx ();
119	};
120		203
121	crypto_ctx::crypto_ctx (rsachallenge &challenge, int enc)	204	i = (i + 1) % QUEUEDEPTH;
122	{
123	EVP_CIPHER_CTX_init (&cctx);
124	EVP_CipherInit_ex (&cctx, CIPHER, 0, &challenge[CHG_CIPHER_KEY], 0, enc);
125	HMAC_CTX_init (&hctx);
126	HMAC_Init_ex (&hctx, &challenge[CHG_HMAC_KEY], HMAC_KEYLEN, DIGEST, 0);
127	}	205	}
128		206
129	crypto_ctx::~crypto_ctx ()	207	tap_packet *pkt_queue::get ()
130	{	208	{
131	EVP_CIPHER_CTX_cleanup (&cctx);	209	tap_packet *p = queue[j];
132	HMAC_CTX_cleanup (&hctx);	210
		211	if (p)
		212	{
		213	queue[j] = 0;
		214	j = (j + 1) % QUEUEDEPTH;
		215	}
		216
		217	return p;
		218	}
		219
		220	pkt_queue::pkt_queue ()
		221	{
		222	memset (queue, 0, sizeof (queue));
		223	i = 0;
		224	j = 0;
		225	}
		226
		227	pkt_queue::~pkt_queue ()
		228	{
		229	for (i = QUEUEDEPTH; --i > 0; )
		230	delete queue[i];
		231	}
		232
		233	struct net_rateinfo {
		234	u32 host;
		235	double pcnt, diff;
		236	tstamp last;
		237	};
		238
		239	// only do action once every x seconds per host whole allowing bursts.
		240	// this implementation ("splay list" ;) is inefficient,
		241	// but low on resources.
		242	struct net_rate_limiter : private list<net_rateinfo>
		243	{
		244	static const double ALPHA = 1. - 1. / 90.; // allow bursts
		245	static const double CUTOFF = 20.; // one event every CUTOFF seconds
		246	static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
		247
		248	bool can (u32 host);
		249	bool can (SOCKADDR *sa) { return can((u32)sa->sin_addr.s_addr); }
		250	bool can (sockinfo &si) { return can((u32)si.host); }
		251	};
		252
		253	net_rate_limiter auth_rate_limiter, reset_rate_limiter;
		254
		255	bool net_rate_limiter::can (u32 host)
		256	{
		257	iterator i;
		258
		259	for (i = begin (); i != end (); )
		260	if (i->host == host)
		261	break;
		262	else if (i->last < NOW - EXPIRE)
		263	i = erase (i);
		264	else
		265	i++;
		266
		267	if (i == end ())
		268	{
		269	net_rateinfo ri;
		270
		271	ri.host = host;
		272	ri.pcnt = 1.;
		273	ri.diff = CUTOFF * (1. / (1. - ALPHA));
		274	ri.last = NOW;
		275
		276	push_front (ri);
		277
		278	return true;
		279	}
		280	else
		281	{
		282	net_rateinfo ri (*i);
		283	erase (i);
		284
		285	ri.pcnt = ri.pcnt * ALPHA;
		286	ri.diff = ri.diff * ALPHA + (NOW - ri.last);
		287
		288	ri.last = NOW;
		289
		290	bool send = ri.diff / ri.pcnt > CUTOFF;
		291
		292	if (send)
		293	ri.pcnt++;
		294
		295	push_front (ri);
		296
		297	return send;
		298	}
133	}	299	}
134		300
135	/////////////////////////////////////////////////////////////////////////////	301	/////////////////////////////////////////////////////////////////////////////
136		302
137	static void next_wakeup (time_t next)	303	static void next_wakeup (time_t next)
…		…
141	}	307	}
142		308
143	static unsigned char hmac_digest[EVP_MAX_MD_SIZE];	309	static unsigned char hmac_digest[EVP_MAX_MD_SIZE];
144		310
145	struct hmac_packet:net_packet	311	struct hmac_packet:net_packet
		312	{
		313	u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere
		314
		315	void hmac_set (crypto_ctx * ctx);
		316	bool hmac_chk (crypto_ctx * ctx);
		317
		318	private:
		319	void hmac_gen (crypto_ctx * ctx)
146	{	320	{
147	u8 hmac[HMACLENGTH]; // each and every packet has a hmac field, but that is not (yet) checked everywhere
148
149	void hmac_set (crypto_ctx * ctx);
150	bool hmac_chk (crypto_ctx * ctx);
151
152	private:
153	void hmac_gen (crypto_ctx * ctx)
154	{
155	unsigned int xlen;	321	unsigned int xlen;
156	HMAC_CTX *hctx = &ctx->hctx;	322	HMAC_CTX *hctx = &ctx->hctx;
157		323
158	HMAC_Init_ex (hctx, 0, 0, 0, 0);	324	HMAC_Init_ex (hctx, 0, 0, 0, 0);
159	HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet),	325	HMAC_Update (hctx, ((unsigned char *) this) + sizeof (hmac_packet),
160	len - sizeof (hmac_packet));	326	len - sizeof (hmac_packet));
161	HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen);	327	HMAC_Final (hctx, (unsigned char *) &hmac_digest, &xlen);
162	}
163	};	328	}
		329	};
164		330
165	void	331	void
166	hmac_packet::hmac_set (crypto_ctx * ctx)	332	hmac_packet::hmac_set (crypto_ctx * ctx)
167	{	333	{
168	hmac_gen (ctx);	334	hmac_gen (ctx);
…		…
184	{	350	{
185	PT_RESET = 0,	351	PT_RESET = 0,
186	PT_DATA_UNCOMPRESSED,	352	PT_DATA_UNCOMPRESSED,
187	PT_DATA_COMPRESSED,	353	PT_DATA_COMPRESSED,
188	PT_PING, PT_PONG, // wasting namespace space? ;)	354	PT_PING, PT_PONG, // wasting namespace space? ;)
189	PT_AUTH, // authentification	355	PT_AUTH_REQ, // authentification request
		356	PT_AUTH_RES, // authentification response
190	PT_CONNECT_REQ, // want other host to contact me	357	PT_CONNECT_REQ, // want other host to contact me
191	PT_CONNECT_INFO, // request connection to some node	358	PT_CONNECT_INFO, // request connection to some node
192	PT_REKEY, // rekeying (not yet implemented)
193	PT_MAX	359	PT_MAX
194	};	360	};
195		361
196	u8 type;	362	u8 type;
197	u8 srcdst, src1, dst1;	363	u8 srcdst, src1, dst1;
…		…
200		366
201	unsigned int src ()	367	unsigned int src ()
202	{	368	{
203	return src1 \| ((srcdst >> 4) << 8);	369	return src1 \| ((srcdst >> 4) << 8);
204	}	370	}
		371
205	unsigned int dst ()	372	unsigned int dst ()
206	{	373	{
207	return dst1 \| ((srcdst & 0xf) << 8);	374	return dst1 \| ((srcdst & 0xf) << 8);
208	}	375	}
		376
209	ptype typ ()	377	ptype typ ()
210	{	378	{
211	return (ptype) type;	379	return (ptype) type;
212	}	380	}
213	};	381	};
…		…
252	u32 cl;	420	u32 cl;
253		421
254	cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);	422	cl = lzf_compress (d, l, cdata + 2, (l - 2) & ~7);
255	if (cl)	423	if (cl)
256	{	424	{
257	//printf ("compressed packet, %d => %d\n", l, cl);//D
258	type = PT_DATA_COMPRESSED;	425	type = PT_DATA_COMPRESSED;
259	d = cdata;	426	d = cdata;
260	l = cl + 2;	427	l = cl + 2;
261		428
262	d[0] = cl >> 8;	429	d[0] = cl >> 8;
…		…
264	}	431	}
265	#endif	432	#endif
266		433
267	EVP_EncryptInit_ex (cctx, 0, 0, 0, 0);	434	EVP_EncryptInit_ex (cctx, 0, 0, 0, 0);
268		435
		436	struct {
269	#if RAND_SIZE	437	#if RAND_SIZE
270	struct {
271	u8 rnd[RAND_SIZE];	438	u8 rnd[RAND_SIZE];
		439	#endif
272	u32 seqno;	440	u32 seqno;
273	} datahdr;	441	} datahdr;
274		442
275	datahdr.seqno = seqno;	443	datahdr.seqno = ntohl (seqno);
		444	#if RAND_SIZE
276	RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);	445	RAND_pseudo_bytes ((unsigned char *) datahdr.rnd, RAND_SIZE);
		446	#endif
277		447
278	EVP_EncryptUpdate (cctx,	448	EVP_EncryptUpdate (cctx,
279	(unsigned char *) data + outl, &outl2,	449	(unsigned char *) data + outl, &outl2,
280	(unsigned char *) &datahdr, DATAHDR);	450	(unsigned char *) &datahdr, DATAHDR);
281	outl += outl2;	451	outl += outl2;
282	#else
283	EVP_EncryptUpdate (cctx,
284	(unsigned char *) data + outl, &outl2,
285	(unsigned char *) &seqno, DATAHDR);
286	outl += outl2;
287	#endif
288		452
289	EVP_EncryptUpdate (cctx,	453	EVP_EncryptUpdate (cctx,
290	(unsigned char *) data + outl, &outl2,	454	(unsigned char *) data + outl, &outl2,
291	(unsigned char *) d, l);	455	(unsigned char *) d, l);
292	outl += outl2;	456	outl += outl2;
…		…
328	outl += outl2;	492	outl += outl2;
329		493
330	EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2);	494	EVP_DecryptFinal_ex (cctx, (unsigned char *)d + outl, &outl2);
331	outl += outl2;	495	outl += outl2;
332		496
333	seqno = (u32 )(d + RAND_SIZE);	497	seqno = ntohl ((u32 )(d + RAND_SIZE));
334		498
335	id2mac (dst () ? dst() : THISNODE->id, p->dst);	499	id2mac (dst () ? dst() : THISNODE->id, p->dst);
336	id2mac (src (), p->src);	500	id2mac (src (), p->src);
337		501
338	#if ENABLE_COMPRESSION	502	#if ENABLE_COMPRESSION
339	if (type == PT_DATA_COMPRESSED)	503	if (type == PT_DATA_COMPRESSED)
340	{	504	{
341	u32 cl = (d[DATAHDR] << 8) \| d[DATAHDR + 1];	505	u32 cl = (d[DATAHDR] << 8) \| d[DATAHDR + 1];
		506
342	p->len = lzf_decompress (d + DATAHDR + 2, cl, &(*p)[6 + 6], MAX_MTU) + 6 + 6;	507	p->len = lzf_decompress (d + DATAHDR + 2, cl < MAX_MTU ? cl : 0,
343	//printf ("decompressxed %d(%d) => %d\n", cl, len - data_hdr_size (), p->len);//D	508	&(*p)[6 + 6], MAX_MTU)
		509	+ 6 + 6;
344	}	510	}
345	else	511	else
346	p->len = outl + (6 + 6 - DATAHDR);	512	p->len = outl + (6 + 6 - DATAHDR);
347	#endif	513	#endif
348		514
349	return p;	515	return p;
350	}	516	}
351		517
352	struct ping_packet : vpn_packet	518	struct ping_packet : vpn_packet
		519	{
		520	void setup (int dst, ptype type)
353	{	521	{
354	void setup (int dst, ptype type)
355	{
356	set_hdr (type, dst);	522	set_hdr (type, dst);
357	len = sizeof (*this) - sizeof (net_packet);	523	len = sizeof (*this) - sizeof (net_packet);
358	}
359	};	524	}
		525	};
360		526
361	struct config_packet : vpn_packet	527	struct config_packet : vpn_packet
		528	{
		529	// actually, hmaclen cannot be checked because the hmac
		530	// field comes before this data, so peers with other
		531	// hmacs simply will not work.
		532	u8 prot_major, prot_minor, randsize, hmaclen;
		533	u8 flags, challengelen, pad2, pad3;
		534	u32 cipher_nid, digest_nid, hmac_nid;
		535
		536	const u8 curflags () const
362	{	537	{
363	// actually, hmaclen cannot be checked because the hmac
364	// field comes before this data, so peers with other
365	// hmacs simply will not work.
366	u8 prot_major, prot_minor, randsize, hmaclen;
367	u8 flags, challengelen, pad2, pad3;
368	u32 cipher_nid;
369	u32 digest_nid;
370
371	const u8 curflags () const
372	{
373	return 0x80	538	return 0x80
374	\| (ENABLE_COMPRESSION ? 0x01 : 0x00)	539	\| (ENABLE_COMPRESSION ? 0x01 : 0x00);
375	\| (ENABLE_TRUST ? 0x02 : 0x00);
376	}	540	}
377		541
378	void setup (ptype type, int dst)	542	void setup (ptype type, int dst)
379	{
380	prot_major = PROTOCOL_MAJOR;
381	prot_minor = PROTOCOL_MINOR;
382	randsize = RAND_SIZE;
383	hmaclen = HMACLENGTH;
384	flags = curflags ();
385	challengelen = sizeof (rsachallenge);
386
387	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
388	digest_nid = htonl (EVP_MD_type (DIGEST));
389
390	len = sizeof (*this) - sizeof (net_packet);
391	set_hdr (type, dst);
392	}
393
394	bool chk_config ()
395	{
396	return prot_major == PROTOCOL_MAJOR
397	&& randsize == RAND_SIZE
398	&& hmaclen == HMACLENGTH
399	&& flags == curflags ()
400	&& challengelen == sizeof (rsachallenge)
401	&& cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
402	&& digest_nid == htonl (EVP_MD_type (DIGEST));
403	}
404	};
405
406	struct auth_packet : config_packet
407	{	543	{
408	char magic[8];	544	prot_major = PROTOCOL_MAJOR;
409	u8 subtype;	545	prot_minor = PROTOCOL_MINOR;
410	u8 pad1, pad2;	546	randsize = RAND_SIZE;
411	rsaencrdata challenge;	547	hmaclen = HMACLENGTH;
		548	flags = curflags ();
		549	challengelen = sizeof (rsachallenge);
412		550
413	auth_packet (int dst, auth_subtype stype)	551	cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
414	{	552	digest_nid = htonl (EVP_MD_type (RSA_HASH));
415	config_packet::setup (PT_AUTH, dst);	553	hmac_nid = htonl (EVP_MD_type (DIGEST));
416	subtype = stype;	554
417	len = sizeof (*this) - sizeof (net_packet);	555	len = sizeof (*this) - sizeof (net_packet);
		556	set_hdr (type, dst);
		557	}
		558
		559	bool chk_config ()
		560	{
		561	return prot_major == PROTOCOL_MAJOR
		562	&& randsize == RAND_SIZE
		563	&& hmaclen == HMACLENGTH
		564	&& flags == curflags ()
		565	&& challengelen == sizeof (rsachallenge)
		566	&& cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
		567	&& digest_nid == htonl (EVP_MD_type (RSA_HASH))
		568	&& hmac_nid == htonl (EVP_MD_type (DIGEST));
		569	}
		570	};
		571
		572	struct auth_req_packet : config_packet
		573	{
		574	char magic[8];
		575	u8 initiate; // false if this is just an automatic reply
		576	u8 pad1, pad2, pad3;
		577	rsaid id;
		578	rsaencrdata encr;
		579
		580	auth_req_packet (int dst, bool initiate_)
		581	{
		582	config_packet::setup (PT_AUTH_REQ, dst);
		583	initiate = !!initiate_;
418	strncpy (magic, MAGIC, 8);	584	strncpy (magic, MAGIC, 8);
419	}	585	len = sizeof (*this) - sizeof (net_packet);
420	};	586	}
		587	};
		588
		589	struct auth_res_packet : config_packet
		590	{
		591	rsaid id;
		592	u8 pad1, pad2, pad3;
		593	u8 response_len; // encrypted length
		594	rsaresponse response;
		595
		596	auth_res_packet (int dst)
		597	{
		598	config_packet::setup (PT_AUTH_RES, dst);
		599	len = sizeof (*this) - sizeof (net_packet);
		600	}
		601	};
421		602
422	struct connect_req_packet : vpn_packet	603	struct connect_req_packet : vpn_packet
		604	{
		605	u8 id;
		606	u8 pad1, pad2, pad3;
		607
		608	connect_req_packet (int dst, int id_)
423	{	609	{
424	u8 id;	610	id = id_;
425	u8 pad1, pad2, pad3;
426
427	connect_req_packet (int dst, int id)
428	{
429	this->id = id;
430	set_hdr (PT_CONNECT_REQ, dst);	611	set_hdr (PT_CONNECT_REQ, dst);
431	len = sizeof (*this) - sizeof (net_packet);	612	len = sizeof (*this) - sizeof (net_packet);
432	}
433	};	613	}
		614	};
434		615
435	struct connect_info_packet : vpn_packet	616	struct connect_info_packet : vpn_packet
		617	{
		618	u8 id;
		619	u8 pad1, pad2, pad3;
		620	sockinfo si;
		621
		622	connect_info_packet (int dst, int id_, sockinfo &si_)
436	{	623	{
437	u8 id;	624	id = id_;
438	u8 pad1, pad2, pad3;	625	si = si_;
439	sockinfo si;
440
441	connect_info_packet (int dst, int id, sockinfo &si)
442	{
443	this->id = id;
444	this->si = si;
445	set_hdr (PT_CONNECT_INFO, dst);	626	set_hdr (PT_CONNECT_INFO, dst);
446	len = sizeof (*this) - sizeof (net_packet);	627	len = sizeof (*this) - sizeof (net_packet);
447	}
448	};	628	}
		629	};
449		630
450	/////////////////////////////////////////////////////////////////////////////	631	/////////////////////////////////////////////////////////////////////////////
451		632
452	void	633	void
453	fill_sa (SOCKADDR sa, conf_node conf)	634	fill_sa (SOCKADDR sa, conf_node conf)
…		…
481	connection::send_ping (SOCKADDR *dsa, u8 pong)	662	connection::send_ping (SOCKADDR *dsa, u8 pong)
482	{	663	{
483	ping_packet *pkt = new ping_packet;	664	ping_packet *pkt = new ping_packet;
484		665
485	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);	666	pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
486	vpn->send_vpn_packet (pkt, dsa);	667	vpn->send_vpn_packet (pkt, dsa, IPTOS_LOWDELAY);
487		668
488	delete pkt;	669	delete pkt;
489	}	670	}
490		671
491	void	672	void
492	connection::send_reset (SOCKADDR *dsa)	673	connection::send_reset (SOCKADDR *dsa)
493	{	674	{
494	static net_rate_limiter limiter(1);	675	if (reset_rate_limiter.can (dsa) && connectmode != conf_node::C_DISABLED)
495
496	if (limiter.can (dsa))
497	{	676	{
498	config_packet *pkt = new config_packet;	677	config_packet *pkt = new config_packet;
499		678
500	pkt->setup (vpn_packet::PT_RESET, conf->id);	679	pkt->setup (vpn_packet::PT_RESET, conf->id);
501	vpn->send_vpn_packet (pkt, dsa);	680	vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST);
502		681
503	delete pkt;	682	delete pkt;
504	}	683	}
505	}	684	}
506		685
507	static rsachallenge *
508	gen_challenge (SOCKADDR *sa)
509	{
510	static rsachallenge k;
511
512	memcpy (&k, &challenge_bytes (), sizeof (k));
513	RAND_bytes ((unsigned char *)&k[CHG_SEQNO], sizeof (u32));
514	xor_sa (k, sa);
515
516	return &k;
517	}
518
519	void	686	void
520	connection::send_auth (auth_subtype subtype, SOCKADDR sa, rsachallenge k)	687	connection::send_auth_request (SOCKADDR *sa, bool initiate)
521	{	688	{
522	static net_rate_limiter limiter(2);	689	if (!initiate \|\| auth_rate_limiter.can (sa))
523
524	if (subtype != AUTH_INIT \|\| limiter.can (sa))
525	{	690	{
526	auth_packet *pkt = new auth_packet (conf->id, subtype);	691	auth_req_packet *pkt = new auth_req_packet (conf->id, initiate);
527		692
528	//printf ("send auth_packet subtype %d\n", subtype);//D	693	rsachallenge chg;
529		694
530	if (!k)	695	rsa_cache.gen (pkt->id, chg);
531	k = gen_challenge (sa);
532		696
533	#if ENABLE_TRUST
534	if (0 > RSA_public_encrypt (sizeof (*k),	697	if (0 > RSA_public_encrypt (sizeof chg,
535	(unsigned char )k, (unsigned char )&pkt->challenge,	698	(unsigned char )&chg, (unsigned char )&pkt->encr,
536	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))	699	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
537	fatal ("RSA_public_encrypt error");	700	fatal ("RSA_public_encrypt error");
538	#else
539	# error untrusted mode not yet implemented: programemr does not know how to
540	rsaencrdata enc;
541		701
542	if (0 > RSA_private_encrypt (sizeof (*k),
543	(unsigned char )k, (unsigned char )&enc,
544	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
545	fatal ("RSA_private_encrypt error");
546
547	if (0 > RSA_public_encrypt (sizeof (enc),
548	(unsigned char )enc, (unsigned char )&pkt->challenge,
549	conf->rsa_key, RSA_NO_PADDING))
550	fatal ("RSA_public_encrypt error");
551	#endif
552
553	slog (L_TRACE, ">>%d PT_AUTH(%d) [%s]", conf->id, subtype, (const char *)sockinfo (sa));	702	slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)sockinfo (sa));
554		703
555	vpn->send_vpn_packet (pkt, sa);	704	vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly
556		705
557	delete pkt;	706	delete pkt;
558	}	707	}
559	}	708	}
560		709
561	void	710	void
		711	connection::send_auth_response (SOCKADDR *sa, const rsaid &id, const rsachallenge &chg)
		712	{
		713	auth_res_packet *pkt = new auth_res_packet (conf->id);
		714
		715	pkt->id = id;
		716
		717	rsa_hash (id, chg, pkt->response);
		718
		719	pkt->hmac_set (octx);
		720
		721	slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)sockinfo (sa));
		722
		723	vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly
		724
		725	delete pkt;
		726	}
		727
		728	void
562	connection::establish_connection ()	729	connection::establish_connection_cb (tstamp &ts)
563	{	730	{
564	if (!ictx && conf != THISNODE && conf->connectmode != conf_node::C_NEVER)	731	if (ictx \|\| conf == THISNODE
		732	\|\| connectmode == conf_node::C_NEVER
		733	\|\| connectmode == conf_node::C_DISABLED)
		734	ts = TSTAMP_CANCEL;
		735	else if (ts <= NOW)
565	{	736	{
566	if (now >= next_retry)	737	double retry_int = double (retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2)) * 0.6;
		738
		739	if (retry_int < 3600 * 8)
		740	retry_cnt++;
		741
		742	ts = NOW + retry_int;
		743
		744	if (conf->hostname)
567	{	745	{
568	int retry_int = retry_cnt & 3 ? (retry_cnt & 3) : 1 << (retry_cnt >> 2);
569
570	if (retry_cnt < (17 << 2) \| 3)
571	retry_cnt++;
572
573	if (conf->connectmode == conf_node::C_ONDEMAND
574	&& retry_int > ::conf.keepalive)
575	retry_int = ::conf.keepalive;
576
577	next_retry = now + retry_int;
578	next_wakeup (next_retry);
579
580	if (conf->hostname)
581	{
582	reset_dstaddr ();	746	reset_dstaddr ();
583	if (sa.sin_addr.s_addr)	747	if (sa.sin_addr.s_addr)
584	if (retry_cnt < 4)	748	if (retry_cnt < 4)
585	send_auth (AUTH_INIT, &sa);	749	send_auth_request (&sa, true);
586	else	750	else if (auth_rate_limiter.can (&sa))
587	send_ping (&sa, 0);	751	send_ping (&sa, 0);
588	}
589	else
590	vpn->connect_request (conf->id);
591	}	752	}
		753	else
		754	vpn->connect_request (conf->id);
592	}	755	}
593	}	756	}
594		757
595	void	758	void
596	connection::reset_connection ()	759	connection::reset_connection ()
597	{	760	{
598	if (ictx && octx)	761	if (ictx && octx)
599	{	762	{
600	slog (L_INFO, _("connection to %d (%s) lost"), conf->id, conf->nodename);	763	slog (L_INFO, _("%s(%s): connection lost"),
		764	conf->nodename, (const char *)sockinfo (sa));
601		765
602	if (::conf.script_node_down)	766	if (::conf.script_node_down)
603	run_script (this, &connection::script_node_down, false);	767	run_script (run_script_cb (this, &connection::script_node_down), false);
604	}	768	}
605		769
606	delete ictx;	770	delete ictx; ictx = 0;
607	ictx = 0;	771	delete octx; octx = 0;
608
609	delete octx;
610	octx = 0;
611		772
612	sa.sin_port = 0;	773	sa.sin_port = 0;
613	sa.sin_addr.s_addr = 0;	774	sa.sin_addr.s_addr = 0;
614		775
615	next_retry = 0;
616	next_rekey = 0;
617	last_activity = 0;	776	last_activity = 0;
		777
		778	rekey.reset ();
		779	keepalive.reset ();
		780	establish_connection.reset ();
618	}	781	}
619		782
620	void	783	void
621	connection::shutdown ()	784	connection::shutdown ()
622	{	785	{
…		…
625		788
626	reset_connection ();	789	reset_connection ();
627	}	790	}
628		791
629	void	792	void
630	connection::rekey ()	793	connection::rekey_cb (tstamp &ts)
631	{	794	{
		795	ts = TSTAMP_CANCEL;
		796
632	reset_connection ();	797	reset_connection ();
633	establish_connection ();	798	establish_connection ();
634	}	799	}
635		800
636	void	801	void
637	connection::send_data_packet (tap_packet * pkt, bool broadcast)	802	connection::send_data_packet (tap_packet * pkt, bool broadcast)
638	{	803	{
639	vpndata_packet *p = new vpndata_packet;	804	vpndata_packet *p = new vpndata_packet;
		805	int tos = 0;
		806
		807	if (conf->inherit_tos
		808	&& (pkt)[12] == 0x08 && (pkt)[13] == 0x00 // IP
		809	&& ((*pkt)[14] & 0xf0) == 0x40) // IPv4
		810	tos = (*pkt)[15] & IPTOS_TOS_MASK;
640		811
641	p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs	812	p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
642	vpn->send_vpn_packet (p, &sa);	813	vpn->send_vpn_packet (p, &sa, tos);
643		814
644	delete p;	815	delete p;
645		816
646	if (oseqno > MAX_SEQNO)	817	if (oseqno > MAX_SEQNO)
647	rekey ();	818	rekey ();
…		…
662	}	833	}
663		834
664	void	835	void
665	connection::recv_vpn_packet (vpn_packet pkt, SOCKADDR ssa)	836	connection::recv_vpn_packet (vpn_packet pkt, SOCKADDR ssa)
666	{	837	{
667	last_activity = now;	838	last_activity = NOW;
668		839
669	slog (L_NOISE, "<<%d received packet type %d from %d to %d",	840	slog (L_NOISE, "<<%d received packet type %d from %d to %d",
670	conf->id, pkt->typ (), pkt->src (), pkt->dst ());	841	conf->id, pkt->typ (), pkt->src (), pkt->dst ());
671		842
672	switch (pkt->typ ())	843	switch (pkt->typ ())
673	{	844	{
674	case vpn_packet::PT_PING:	845	case vpn_packet::PT_PING:
675	send_ping (ssa, 1); // pong
676	break;
677
678	case vpn_packet::PT_PONG:
679	// we send pings instead of auth packets after some retries,	846	// we send pings instead of auth packets after some retries,
680	// so reset the retry counter and establish a conenction	847	// so reset the retry counter and establish a conenction
681	// when we receive a pong.	848	// when we receive a pong.
682	if (!ictx && !octx)	849	if (!ictx && !octx)
683	{	850	{
684	retry_cnt = 0;	851	retry_cnt = 0;
685	next_retry = 0;	852	establish_connection.at = 0;
686	establish_connection ();	853	establish_connection ();
687	}	854	}
		855	else
		856	send_ping (ssa, 1); // pong
688		857
		858	break;
		859
		860	case vpn_packet::PT_PONG:
689	break;	861	break;
690		862
691	case vpn_packet::PT_RESET:	863	case vpn_packet::PT_RESET:
692	{	864	{
693	reset_connection ();	865	reset_connection ();
694		866
695	config_packet p = (config_packet ) pkt;	867	config_packet p = (config_packet ) pkt;
		868
696	if (p->chk_config ())	869	if (!p->chk_config ())
		870	{
		871	slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
		872	conf->nodename, (const char *)sockinfo (ssa));
		873	connectmode = conf_node::C_DISABLED;
		874	}
697	if (conf->connectmode == conf_node::C_ALWAYS)	875	else if (connectmode == conf_node::C_ALWAYS)
698	establish_connection ();	876	establish_connection ();
699
700	//D slog the protocol mismatch?
701	}	877	}
702	break;	878	break;
703		879
704	case vpn_packet::PT_AUTH:	880	case vpn_packet::PT_AUTH_REQ:
		881	if (auth_rate_limiter.can (ssa))
		882	{
		883	auth_req_packet p = (auth_req_packet ) pkt;
		884
		885	slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);
		886
		887	if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
		888	{
		889	if (p->prot_minor != PROTOCOL_MINOR)
		890	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
		891	conf->nodename, (const char *)sockinfo (ssa),
		892	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
		893
		894	if (p->initiate)
		895	send_auth_request (ssa, false);
		896
		897	rsachallenge k;
		898
		899	if (0 > RSA_private_decrypt (sizeof (p->encr),
		900	(unsigned char )&p->encr, (unsigned char )&k,
		901	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
		902	slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
		903	conf->nodename, (const char *)sockinfo (ssa));
		904	else
		905	{
		906	retry_cnt = 0;
		907	establish_connection.set (NOW + 8); //? ;)
		908	keepalive.reset ();
		909	rekey.reset ();
		910
		911	delete ictx;
		912	ictx = 0;
		913
		914	delete octx;
		915
		916	octx = new crypto_ctx (k, 1);
		917	oseqno = ntohl ((u32 )&k[CHG_SEQNO]) & 0x7fffffff;
		918
		919	send_auth_response (ssa, p->id, k);
		920
		921	break;
		922	}
		923	}
		924
		925	send_reset (ssa);
		926	}
		927
		928	break;
		929
		930	case vpn_packet::PT_AUTH_RES:
705	{	931	{
706	auth_packet p = (auth_packet ) pkt;	932	auth_res_packet p = (auth_res_packet ) pkt;
707		933
708	slog (L_TRACE, "<<%d PT_AUTH(%d)", conf->id, p->subtype);	934	slog (L_TRACE, "<<%d PT_AUTH_RES", conf->id);
709		935
710	if (p->chk_config ()	936	if (p->chk_config ())
711	&& !strncmp (p->magic, MAGIC, 8))
712	{	937	{
713	if (p->prot_minor != PROTOCOL_MINOR)	938	if (p->prot_minor != PROTOCOL_MINOR)
714	slog (L_INFO, _("protocol minor version mismatch: ours is %d, %s's is %d."),	939	slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
		940	conf->nodename, (const char *)sockinfo (ssa),
715	PROTOCOL_MINOR, conf->nodename, p->prot_minor);	941	PROTOCOL_MINOR, conf->nodename, p->prot_minor);
716		942
717	if (p->subtype == AUTH_INIT)
718	send_auth (AUTH_INITREPLY, ssa);
719
720	rsachallenge k;	943	rsachallenge chg;
721		944
722	#if ENABLE_TRUST	945	if (!rsa_cache.find (p->id, chg))
723	if (0 > RSA_private_decrypt (sizeof (rsaencrdata),	946	slog (L_ERR, _("%s(%s): unrequested auth response"),
724	(unsigned char )&p->challenge, (unsigned char )&k,	947	conf->nodename, (const char *)sockinfo (ssa));
725	::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
726	// continued below
727	#else
728	rsaencrdata j;
729		948	else
730	if (0 > RSA_private_decrypt (sizeof (rsaencrdata),
731	(unsigned char )&p->challenge, (unsigned char )&j,
732	::conf.rsa_key, RSA_NO_PADDING))
733	fatal ("RSA_private_decrypt error");
734
735	if (0 > RSA_public_decrypt (sizeof (k),
736	(unsigned char )&j, (unsigned char )&k,
737	conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
738	// continued below
739	#endif
740	{	949	{
741	slog (L_ERR, _("challenge from %s (%s) illegal or corrupted"),	950	crypto_ctx *cctx = new crypto_ctx (chg, 0);
		951
		952	if (!p->hmac_chk (cctx))
		953	slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
		954	"could be an attack, or just corruption or an synchronization error"),
742	conf->nodename, (const char *)sockinfo (ssa));	955	conf->nodename, (const char *)sockinfo (ssa));
743	break;	956	else
744	}
745
746	retry_cnt = 0;
747	next_retry = now + 8;
748
749	switch (p->subtype)
750	{
751	case AUTH_INIT:
752	case AUTH_INITREPLY:
753	delete ictx;
754	ictx = 0;
755
756	delete octx;
757
758	octx = new crypto_ctx (k, 1);
759	oseqno = (u32 )&k[CHG_SEQNO] & 0x7fffffff;
760
761	send_auth (AUTH_REPLY, ssa, &k);
762	break;
763
764	case AUTH_REPLY:
765
766	if (!memcmp ((u8 )gen_challenge (ssa) + sizeof (u32), (u8 )&k + sizeof (u32),
767	sizeof (rsachallenge) - sizeof (u32)))
768	{	957	{
769	delete ictx;
770
771	ictx = new crypto_ctx (k, 0);
772	iseqno = (u32 )&k[CHG_SEQNO] & 0x7fffffff; // at least 2**31 sequence numbers are valid
773	ismask = 0xffffffff; // initially, all lower sequence numbers are invalid
774
775	sa = *ssa;	958	rsaresponse h;
776		959
777	next_rekey = now + ::conf.rekey;	960	rsa_hash (p->id, chg, h);
778	next_wakeup (next_rekey);
779		961
780	// send queued packets	962	if (!memcmp ((u8 )&h, (u8 )p->response, sizeof h))
781	while (tap_packet *p = queue.get ())
782	{	963	{
		964	prot_minor = p->prot_minor;
		965
		966	delete ictx; ictx = cctx;
		967
		968	iseqno.reset (ntohl ((u32 )&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
		969
		970	sa = *ssa;
		971
		972	rekey.set (NOW + ::conf.rekey);
		973	keepalive.set (NOW + ::conf.keepalive);
		974
		975	// send queued packets
		976	while (tap_packet *p = queue.get ())
		977	{
783	send_data_packet (p);	978	send_data_packet (p);
784	delete p;	979	delete p;
		980	}
		981
		982	connectmode = conf->connectmode;
		983
		984	slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
		985	conf->nodename, (const char *)sockinfo (ssa),
		986	p->prot_major, p->prot_minor);
		987
		988	if (::conf.script_node_up)
		989	run_script (run_script_cb (this, &connection::script_node_up), false);
		990
		991	break;
785	}	992	}
786		993	else
787	slog (L_INFO, _("connection to %d (%s %s) established"),	994	slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
788	conf->id, conf->nodename, (const char *)sockinfo (ssa));	995	conf->nodename, (const char *)sockinfo (ssa));
789
790	if (::conf.script_node_up)
791	run_script (this, &connection::script_node_up, false);
792	}	996	}
		997
793	else	998	delete cctx;
794	slog (L_ERR, _("sent and received challenge do not match with (%s %s))"),
795	conf->nodename, (const char *)sockinfo (ssa));
796
797	break;
798	default:
799	slog (L_ERR, _("authentification illegal subtype error (%s %s)"),
800	conf->nodename, (const char *)sockinfo (ssa));
801	break;
802	}	999	}
803	}	1000	}
804	else
805	send_reset (ssa);
806
807	break;
808	}	1001	}
		1002
		1003	send_reset (ssa);
		1004	break;
809		1005
810	case vpn_packet::PT_DATA_COMPRESSED:	1006	case vpn_packet::PT_DATA_COMPRESSED:
811	#if !ENABLE_COMPRESSION	1007	#if !ENABLE_COMPRESSION
812	send_reset (ssa);	1008	send_reset (ssa);
813	break;	1009	break;
814	#endif	1010	#endif
		1011
815	case vpn_packet::PT_DATA_UNCOMPRESSED:	1012	case vpn_packet::PT_DATA_UNCOMPRESSED:
816		1013
817	if (ictx && octx)	1014	if (ictx && octx)
818	{	1015	{
819	vpndata_packet p = (vpndata_packet )pkt;	1016	vpndata_packet p = (vpndata_packet )pkt;
820		1017
821	if (*ssa == sa)	1018	if (*ssa == sa)
822	{	1019	{
823	if (!p->hmac_chk (ictx))	1020	if (!p->hmac_chk (ictx))
824	slog (L_ERR, _("hmac authentication error, received invalid packet\n"	1021	slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
825	"could be an attack, or just corruption or an synchronization error"));	1022	"could be an attack, or just corruption or an synchronization error"),
		1023	conf->nodename, (const char *)sockinfo (ssa));
826	else	1024	else
827	{	1025	{
828	u32 seqno;	1026	u32 seqno;
829	tap_packet *d = p->unpack (this, seqno);	1027	tap_packet *d = p->unpack (this, seqno);
830		1028
831	if (seqno <= iseqno - 32)	1029	if (iseqno.recv_ok (seqno))
832	slog (L_ERR, _("received duplicate or outdated packet (received %08lx, expected %08lx)\n"
833	"possible replay attack, or just massive packet reordering"), seqno, iseqno + 1);//D
834	else if (seqno > iseqno + 32)
835	slog (L_ERR, _("received duplicate or out-of-sync packet (received %08lx, expected %08lx)\n"
836	"possible replay attack, or just massive packet loss"), seqno, iseqno + 1);//D
837	else
838	{	1030	{
839	if (seqno > iseqno)
840	{
841	ismask <<= seqno - iseqno;
842	iseqno = seqno;
843	}
844
845	u32 mask = 1 << (iseqno - seqno);
846
847	//printf ("received seqno %08lx, iseqno %08lx, mask %08lx is %08lx\n", seqno, iseqno, mask, ismask);
848	if (ismask & mask)
849	slog (L_ERR, _("received duplicate packet (received %08lx, expected %08lx)\n"
850	"possible replay attack, or just packet duplication"), seqno, iseqno + 1);//D
851	else
852	{
853	ismask \|= mask;
854
855	vpn->tap->send (d);	1031	vpn->tap->send (d);
856		1032
857	if (p->dst () == 0) // re-broadcast	1033	if (p->dst () == 0) // re-broadcast
858	for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)	1034	for (vpn::conns_vector::iterator i = vpn->conns.begin (); i != vpn->conns.end (); ++i)
859	{	1035	{
860	connection c = i;	1036	connection c = i;
861		1037
862	if (c->conf != THISNODE && c->conf != conf)	1038	if (c->conf != THISNODE && c->conf != conf)
863	c->inject_data_packet (d);	1039	c->inject_data_packet (d);
864	}
865
866	delete d;
867
868	break;
869	}	1040	}
		1041
		1042	delete d;
		1043
		1044	break;
870	}	1045	}
871	}	1046	}
872	}	1047	}
873	else	1048	else
874	slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D	1049	slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D
…		…
889	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",	1064	slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
890	conf->id, p->id, c->ictx && c->octx);	1065	conf->id, p->id, c->ictx && c->octx);
891		1066
892	if (c->ictx && c->octx)	1067	if (c->ictx && c->octx)
893	{	1068	{
		1069	// send connect_info packets to both sides, in case one is
		1070	// behind a nat firewall (or both ;)
		1071	{
894	sockinfo si(sa);	1072	sockinfo si(sa);
895		1073
896	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",	1074	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
897	c->conf->id, p->id, (const char *)si);	1075	c->conf->id, conf->id, (const char *)si);
898		1076
899	connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si);	1077	connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si);
900		1078
901	r->hmac_set (c->octx);	1079	r->hmac_set (c->octx);
902	vpn->send_vpn_packet (r, &c->sa);	1080	vpn->send_vpn_packet (r, &c->sa);
903		1081
904	delete r;	1082	delete r;
		1083	}
		1084
		1085	{
		1086	sockinfo si(c->sa);
		1087
		1088	slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
		1089	conf->id, c->conf->id, (const char *)si);
		1090
		1091	connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, si);
		1092
		1093	r->hmac_set (octx);
		1094	vpn->send_vpn_packet (r, &sa);
		1095
		1096	delete r;
		1097	}
905	}	1098	}
906	}	1099	}
907		1100
908	break;	1101	break;
909		1102
…		…
917	connection *c = vpn->conns[p->id - 1];	1110	connection *c = vpn->conns[p->id - 1];
918		1111
919	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",	1112	slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
920	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);	1113	conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
921		1114
922	c->send_auth (AUTH_INIT, p->si.sa ());	1115	c->send_auth_request (p->si.sa (), true);
923	}	1116	}
		1117
924	break;	1118	break;
925		1119
926	default:	1120	default:
927	send_reset (ssa);	1121	send_reset (ssa);
928	break;	1122	break;
929	}
930	}
931		1123
932	void connection::timer ()
933	{
934	if (conf != THISNODE)
935	{	1124	}
936	if (now >= next_retry && conf->connectmode == conf_node::C_ALWAYS)	1125	}
		1126
		1127	void connection::keepalive_cb (tstamp &ts)
		1128	{
		1129	if (NOW >= last_activity + ::conf.keepalive + 30)
		1130	{
		1131	reset_connection ();
937	establish_connection ();	1132	establish_connection ();
938		1133	}
939	if (ictx && octx)
940	{
941	if (now >= next_rekey)
942	rekey ();
943	else if (now >= last_activity + ::conf.keepalive + 30)
944	{
945	reset_connection ();
946	establish_connection ();
947	}
948	else if (now >= last_activity + ::conf.keepalive)	1134	else if (NOW < last_activity + ::conf.keepalive)
		1135	ts = last_activity + ::conf.keepalive;
949	if (conf->connectmode != conf_node::C_ONDEMAND	1136	else if (conf->connectmode != conf_node::C_ONDEMAND
950	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)	1137	\|\| THISNODE->connectmode != conf_node::C_ONDEMAND)
		1138	{
951	send_ping (&sa);	1139	send_ping (&sa);
952	else	1140	ts = NOW + 5;
		1141	}
		1142	else
953	reset_connection ();	1143	reset_connection ();
954		1144
955	}
956	}
957	}	1145	}
958		1146
959	void connection::connect_request (int id)	1147	void connection::connect_request (int id)
960	{	1148	{
961	connect_req_packet *p = new connect_req_packet (conf->id, id);	1149	connect_req_packet *p = new connect_req_packet (conf->id, id);
…		…
967	delete p;	1155	delete p;
968	}	1156	}
969		1157
970	void connection::script_node ()	1158	void connection::script_node ()
971	{	1159	{
972	vpn->script_if_up ();	1160	vpn->script_if_up (0);
973		1161
974	char *env;	1162	char *env;
975	asprintf (&env, "DESTID=%d", conf->id);	1163	asprintf (&env, "DESTID=%d", conf->id);
976	putenv (env);	1164	putenv (env);
977	asprintf (&env, "DESTNODE=%s", conf->nodename);	1165	asprintf (&env, "DESTNODE=%s", conf->nodename);
…		…
980	putenv (env);	1168	putenv (env);
981	asprintf (&env, "DESTPORT=%d", ntohs (sa.sin_port));	1169	asprintf (&env, "DESTPORT=%d", ntohs (sa.sin_port));
982	putenv (env);	1170	putenv (env);
983	}	1171	}
984		1172
985	const char *connection::script_node_up ()	1173	const char *connection::script_node_up (int)
986	{	1174	{
987	script_node ();	1175	script_node ();
988		1176
989	putenv ("STATE=up");	1177	putenv ("STATE=up");
990		1178
991	return ::conf.script_node_up ? ::conf.script_node_up : "node-up";	1179	return ::conf.script_node_up ? ::conf.script_node_up : "node-up";
992	}	1180	}
993		1181
994	const char *connection::script_node_down ()	1182	const char *connection::script_node_down (int)
995	{	1183	{
996	script_node ();	1184	script_node ();
997		1185
998	putenv ("STATE=down");	1186	putenv ("STATE=down");
999		1187
1000	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";	1188	return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1001	}	1189	}
1002		1190
		1191	connection::connection(struct vpn *vpn_)
		1192	: vpn(vpn_)
		1193	, rekey (this, &connection::rekey_cb)
		1194	, keepalive (this, &connection::keepalive_cb)
		1195	, establish_connection (this, &connection::establish_connection_cb)
		1196	{
		1197	octx = ictx = 0;
		1198	retry_cnt = 0;
		1199
		1200	connectmode = conf_node::C_ALWAYS; // initial setting
		1201	reset_connection ();
		1202	}
		1203
		1204	connection::~connection ()
		1205	{
		1206	shutdown ();
		1207	}
		1208
1003	/////////////////////////////////////////////////////////////////////////////	1209	/////////////////////////////////////////////////////////////////////////////
1004		1210
1005	vpn::vpn (void)
1006	{}
1007
1008	const char *vpn::script_if_up ()	1211	const char *vpn::script_if_up (int)
1009	{	1212	{
1010	// the tunnel device mtu should be the physical mtu - overhead	1213	// the tunnel device mtu should be the physical mtu - overhead
1011	// the tricky part is rounding to the cipher key blocksize	1214	// the tricky part is rounding to the cipher key blocksize
1012	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - UDP_OVERHEAD;	1215	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
1013	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion	1216	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
1014	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round	1217	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
1015	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again	1218	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
1016		1219
1017	char *env;	1220	char *env;
…		…
1062	{	1265	{
1063	int oval = 1;	1266	int oval = 1;
1064	setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	1267	setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
1065	}	1268	}
1066		1269
		1270	udp_ev_watcher.start (socket_fd, POLLIN);
		1271
1067	tap = new tap_device ();	1272	tap = new tap_device ();
1068	if (!tap) //D this, of course, never catches	1273	if (!tap) //D this, of course, never catches
1069	{	1274	{
1070	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);	1275	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
1071	exit (1);	1276	exit (1);
1072	}	1277	}
1073		1278
1074	run_script (this, &vpn::script_if_up, true);	1279	run_script (run_script_cb (this, &vpn::script_if_up), true);
		1280
		1281	vpn_ev_watcher.start (tap->fd, POLLIN);
		1282
		1283	reconnect_all ();
1075		1284
1076	return 0;	1285	return 0;
1077	}	1286	}
1078		1287
1079	void	1288	void
1080	vpn::send_vpn_packet (vpn_packet pkt, SOCKADDR sa)	1289	vpn::send_vpn_packet (vpn_packet pkt, SOCKADDR sa, int tos)
1081	{	1290	{
		1291	setsockopt (socket_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1082	sendto (socket_fd, &((pkt)[0]), pkt->len, 0, (sockaddr )sa, sizeof (*sa));	1292	sendto (socket_fd, &((pkt)[0]), pkt->len, 0, (sockaddr )sa, sizeof (*sa));
1083	}	1293	}
1084		1294
1085	void	1295	void
1086	vpn::shutdown_all ()	1296	vpn::shutdown_all ()
…		…
1103	connection *conn = new connection (this);	1313	connection *conn = new connection (this);
1104		1314
1105	conn->conf = *i;	1315	conn->conf = *i;
1106	conns.push_back (conn);	1316	conns.push_back (conn);
1107		1317
1108	if (conn->conf->connectmode == conf_node::C_ALWAYS)
1109	conn->establish_connection ();	1318	conn->establish_connection ();
1110	}	1319	}
1111	}	1320	}
1112		1321
1113	connection *vpn::find_router ()	1322	connection *vpn::find_router ()
1114	{	1323	{
…		…
1118	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	1327	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1119	{	1328	{
1120	connection c = i;	1329	connection c = i;
1121		1330
1122	if (c->conf->routerprio > prio	1331	if (c->conf->routerprio > prio
1123	&& c->conf->connectmode == conf_node::C_ALWAYS	1332	&& c->connectmode == conf_node::C_ALWAYS
1124	&& c->conf != THISNODE	1333	&& c->conf != THISNODE
1125	&& c->ictx && c->octx)	1334	&& c->ictx && c->octx)
1126	{	1335	{
1127	prio = c->conf->routerprio;	1336	prio = c->conf->routerprio;
1128	router = c;	1337	router = c;
…		…
1136	{	1345	{
1137	connection *c = find_router ();	1346	connection *c = find_router ();
1138		1347
1139	if (c)	1348	if (c)
1140	c->connect_request (id);	1349	c->connect_request (id);
		1350	//else // does not work, because all others must connect to the same router
		1351	// // no router found, aggressively connect to all routers
		1352	// for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		1353	// if ((*i)->conf->routerprio)
		1354	// (*i)->establish_connection ();
1141	}	1355	}
1142		1356
1143	void	1357	void
1144	vpn::main_loop ()	1358	vpn::udp_ev (short revents)
1145	{	1359	{
1146	struct pollfd pollfd[2];	1360	if (revents & (POLLIN \| POLLERR))
1147
1148	pollfd[0].fd = tap->fd;
1149	pollfd[0].events = POLLIN;
1150	pollfd[1].fd = socket_fd;
1151	pollfd[1].events = POLLIN;
1152
1153	events = 0;
1154	now = time (0);
1155	next_timecheck = now + 1;
1156
1157	reconnect_all ();
1158
1159	for (;;)
1160	{	1361	{
1161	int npoll = poll (pollfd, 2, (next_timecheck - now) * 1000);	1362	vpn_packet *pkt = new vpn_packet;
1162		1363	struct sockaddr_in sa;
1163	now = time (0);	1364	socklen_t sa_len = sizeof (sa);
		1365	int len;
1164		1366
		1367	len = recvfrom (socket_fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
		1368
1165	if (npoll > 0)	1369	if (len > 0)
1166	{	1370	{
1167	if (pollfd[1].revents)	1371	pkt->len = len;
		1372
		1373	unsigned int src = pkt->src ();
		1374	unsigned int dst = pkt->dst ();
		1375
		1376	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
		1377	(const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
		1378
		1379	if (dst > conns.size () \|\| pkt->typ () >= vpn_packet::PT_MAX)
		1380	slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
		1381	pkt->typ (), pkt->src (), pkt->dst ());
		1382	else if (dst == 0 && !THISNODE->routerprio)
		1383	slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
		1384	else if (dst != 0 && dst != THISNODE->id)
		1385	slog (L_WARN,
		1386	_("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
		1387	dst, conns[dst - 1]->conf->nodename,
		1388	(const char *)sockinfo (sa),
		1389	THISNODE->id, THISNODE->nodename);
		1390	else if (src == 0 \|\| src > conns.size ())
		1391	slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
		1392	else
		1393	conns[src - 1]->recv_vpn_packet (pkt, &sa);
		1394	}
		1395	else
		1396	{
		1397	// probably ECONNRESET or somesuch
		1398	slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno));
		1399	}
		1400
		1401	delete pkt;
		1402	}
		1403	else if (revents & POLLHUP)
		1404	{
		1405	// this cannot ;) happen on udp sockets
		1406	slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating."));
		1407	exit (1);
		1408	}
		1409	else
		1410	{
		1411	slog (L_ERR,
		1412	_("FATAL: unknown revents %08x in socket, terminating\n"),
		1413	revents);
		1414	exit (1);
		1415	}
		1416	}
		1417
		1418	void
		1419	vpn::vpn_ev (short revents)
		1420	{
		1421	if (revents & POLLIN)
		1422	{
		1423	/* process data */
		1424	tap_packet *pkt;
		1425
		1426	pkt = tap->recv ();
		1427
		1428	int dst = mac2id (pkt->dst);
		1429	int src = mac2id (pkt->src);
		1430
		1431	if (src != THISNODE->id)
		1432	{
		1433	slog (L_ERR, _("FATAL: tap packet not originating on current node received, terminating."));
		1434	exit (1);
		1435	}
		1436
		1437	if (dst == THISNODE->id)
		1438	{
		1439	slog (L_ERR, _("FATAL: tap packet destined for current node received, terminating."));
		1440	exit (1);
		1441	}
		1442
		1443	if (dst > conns.size ())
		1444	slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
		1445	else
		1446	{
		1447	if (dst)
1168	{	1448	{
1169	if (pollfd[1].revents & (POLLIN \| POLLERR))	1449	// unicast
1170	{
1171	vpn_packet *pkt = new vpn_packet;
1172	struct sockaddr_in sa;
1173	socklen_t sa_len = sizeof (sa);
1174	int len;
1175
1176	len = recvfrom (socket_fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
1177
1178	if (len > 0)
1179	{
1180	pkt->len = len;
1181
1182	unsigned int src = pkt->src ();
1183	unsigned int dst = pkt->dst ();
1184
1185	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1186	(const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1187
1188	if (dst > conns.size () \|\| pkt->typ () >= vpn_packet::PT_MAX)
1189	slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1190	pkt->typ (), pkt->src (), pkt->dst ());
1191	else if (dst == 0 && !THISNODE->routerprio)
1192	slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1193	else if (dst != 0 && dst != THISNODE->id)	1450	if (dst != THISNODE->id)
1194	slog (L_WARN,
1195	_("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1196	dst, conns[dst - 1]->conf->nodename,
1197	(const char *)sockinfo (sa),
1198	THISNODE->id, THISNODE->nodename);
1199	else if (src == 0 \|\| src > conns.size ())
1200	slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
1201	else
1202	conns[src - 1]->recv_vpn_packet (pkt, &sa);	1451	conns[dst - 1]->inject_data_packet (pkt);
1203	}
1204	else
1205	{
1206	// probably ECONNRESET or somesuch
1207	slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno));
1208	}
1209
1210	delete pkt;
1211	}	1452	}
1212	else if (pollfd[1].revents & POLLHUP)	1453	else
1213	{	1454	{
1214	// this cannot ;) happen on udp sockets	1455	// broadcast, first check router, then self, then english
1215	slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating."));	1456	connection *router = find_router ();
1216	exit (1);	1457
1217	}	1458	if (router)
		1459	router->inject_data_packet (pkt, true);
1218	else	1460	else
1219	{
1220	slog (L_ERR,
1221	_("FATAL: unknown revents %08x in socket, terminating\n"),
1222	pollfd[1].revents);
1223	exit (1);
1224	}
1225	}
1226
1227	// I use else here to give vpn_packets absolute priority
1228	else if (pollfd[0].revents)
1229	{
1230	if (pollfd[0].revents & POLLIN)
1231	{
1232	/* process data */
1233	tap_packet *pkt;
1234
1235	pkt = tap->recv ();
1236
1237	int dst = mac2id (pkt->dst);
1238	int src = mac2id (pkt->src);
1239
1240	if (src != THISNODE->id)
1241	{
1242	slog (L_ERR, _("FATAL: tap packet not originating on current node received, terminating."));
1243	exit (1);
1244	}
1245
1246	if (dst == THISNODE->id)
1247	{
1248	slog (L_ERR, _("FATAL: tap packet destined for current node received, terminating."));
1249	exit (1);
1250	}
1251
1252	if (dst > conns.size ())
1253	slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
1254	else
1255	{
1256	if (dst)
1257	{
1258	// unicast
1259	if (dst != THISNODE->id)
1260	conns[dst - 1]->inject_data_packet (pkt);
1261	}
1262	else
1263	{
1264	// broadcast, first check router, then self, then english
1265	connection *router = find_router ();
1266
1267	if (router)
1268	router->inject_data_packet (pkt, true);
1269	else
1270	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	1461	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1271	if ((*c)->conf != THISNODE)	1462	if ((*c)->conf != THISNODE)
1272	(*c)->inject_data_packet (pkt);	1463	(*c)->inject_data_packet (pkt);
1273	}
1274	}
1275
1276	delete pkt;
1277	}
1278	else if (pollfd[0].revents & (POLLHUP \| POLLERR))
1279	{
1280	slog (L_ERR, _("FATAL: POLLHUP or POLLERR on network device fd, terminating."));
1281	exit (1);
1282	}
1283	else
1284	abort ();
1285	}	1464	}
1286	}	1465	}
1287		1466
		1467	delete pkt;
		1468	}
		1469	else if (revents & (POLLHUP \| POLLERR))
		1470	{
		1471	slog (L_ERR, _("FATAL: POLLHUP or POLLERR on network device fd, terminating."));
		1472	exit (1);
		1473	}
		1474	else
		1475	abort ();
		1476	}
		1477
		1478	void
		1479	vpn::event_cb (tstamp &ts)
		1480	{
1288	if (events)	1481	if (events)
		1482	{
		1483	if (events & EVENT_SHUTDOWN)
1289	{	1484	{
1290	if (events & EVENT_SHUTDOWN)
1291	{
1292	shutdown_all ();	1485	shutdown_all ();
1293		1486
1294	remove_pid (pidfilename);	1487	remove_pid (pidfilename);
1295		1488
1296	slog (L_INFO, _("vped terminating"));	1489	slog (L_INFO, _("vped terminating"));
1297		1490
1298	exit (0);	1491	exit (0);
1299	}
1300
1301	if (events & EVENT_RECONNECT)
1302	reconnect_all ();
1303
1304	events = 0;
1305	}	1492	}
1306		1493
1307	// very very very dumb and crude and inefficient timer handling, or maybe not?	1494	if (events & EVENT_RECONNECT)
1308	if (now >= next_timecheck)	1495	reconnect_all ();
1309	{
1310	next_timecheck = now + TIMER_GRANULARITY;
1311		1496
1312	for (conns_vector::iterator c = conns.begin ();	1497	events = 0;
1313	c != conns.end (); ++c)
1314	(*c)->timer ();
1315	}
1316	}	1498	}
		1499
		1500	ts = TSTAMP_CANCEL;
		1501	}
		1502
		1503	vpn::vpn (void)
		1504	: udp_ev_watcher (this, &vpn::udp_ev)
		1505	, vpn_ev_watcher (this, &vpn::vpn_ev)
		1506	, event (this, &vpn::event_cb)
		1507	{
1317	}	1508	}
1318		1509
1319	vpn::~vpn ()	1510	vpn::~vpn ()
1320	{}	1511	{
		1512	}
1321		1513

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/protocol.C (file contents): Revision 1.2 by pcg, Sun Mar 2 23:04:02 2003 UTC vs. Revision 1.20 by pcg, Wed Mar 26 17:59:12 2003 UTC

Diff Legend

Comparing gvpe/src/protocol.C (file contents):
Revision 1.2 by pcg, Sun Mar 2 23:04:02 2003 UTC vs.
Revision 1.20 by pcg, Wed Mar 26 17:59:12 2003 UTC