… | |
… | |
18 | |
18 | |
19 | #ifndef VPE_PROTOCOL_H__ |
19 | #ifndef VPE_PROTOCOL_H__ |
20 | #define VPE_PROTOCOL_H__ |
20 | #define VPE_PROTOCOL_H__ |
21 | |
21 | |
22 | #include <netinet/in.h> |
22 | #include <netinet/in.h> |
|
|
23 | #include <netinet/ip.h> // for tos etc. |
23 | |
24 | |
24 | #include <openssl/evp.h> |
25 | #include <openssl/evp.h> |
25 | #include <openssl/rsa.h> |
26 | #include <openssl/rsa.h> |
26 | |
27 | |
27 | #include "conf.h" |
28 | #include "conf.h" |
|
|
29 | #include "iom.h" |
28 | #include "util.h" |
30 | #include "util.h" |
29 | #include "device.h" |
31 | #include "device.h" |
30 | |
32 | |
31 | /* Protocol version. Different versions are incompatible, |
33 | /* Protocol version. Different major versions are incompatible, |
32 | incompatible version have different protocols. |
34 | * different minor versions probably are compatible ;) |
33 | */ |
35 | */ |
34 | |
36 | |
35 | #define PROTOCOL_MAJOR 2 |
37 | #define PROTOCOL_MAJOR 0 |
36 | #define PROTOCOL_MINOR 0 |
38 | #define PROTOCOL_MINOR 0 |
37 | |
39 | |
38 | struct vpn; |
40 | struct vpn; |
39 | struct vpn_packet; |
41 | struct vpn_packet; |
40 | |
42 | |
|
|
43 | struct rsaid { |
|
|
44 | u8 id[RSA_IDLEN]; // the challenge id |
|
|
45 | }; |
|
|
46 | |
41 | typedef u8 rsachallenge[RSA_KEYLEN - RSA_OVERHEAD]; // challenge data |
47 | typedef u8 rsachallenge[RSA_KEYLEN - RSA_OVERHEAD]; // challenge data; |
42 | typedef u8 rsaencrdata[RSA_KEYLEN]; // encrypted challenge |
48 | typedef u8 rsaencrdata[RSA_KEYLEN]; // encrypted challenge |
|
|
49 | typedef u8 rsaresponse[RSA_RESLEN]; // the encrypted ripemd160 hash |
43 | |
50 | |
44 | struct crypto_ctx; |
51 | struct crypto_ctx; |
45 | |
52 | |
46 | enum auth_subtype { AUTH_INIT, AUTH_INITREPLY, AUTH_REPLY }; |
53 | // a very simple fifo pkt-queue |
|
|
54 | class pkt_queue |
|
|
55 | { |
|
|
56 | tap_packet *queue[QUEUEDEPTH]; |
|
|
57 | int i, j; |
|
|
58 | |
|
|
59 | public: |
|
|
60 | |
|
|
61 | void put (tap_packet *p); |
|
|
62 | tap_packet *get (); |
|
|
63 | |
|
|
64 | pkt_queue (); |
|
|
65 | ~pkt_queue (); |
|
|
66 | }; |
47 | |
67 | |
48 | struct connection |
68 | struct connection |
49 | { |
69 | { |
50 | conf_node *conf; |
70 | conf_node *conf; |
51 | struct vpn *vpn; |
71 | struct vpn *vpn; |
52 | |
72 | |
53 | SOCKADDR sa; |
73 | SOCKADDR sa; // the current(!) destination ip to send packets to |
54 | int retry_cnt; |
74 | int retry_cnt; |
55 | |
75 | |
56 | time_t next_retry; // next connection retry |
|
|
57 | time_t next_rekey; // next rekying (actually current reset + reestablishing) |
|
|
58 | time_t last_activity; // time of last packet received |
76 | tstamp last_activity; // time of last packet received |
59 | |
77 | |
60 | u32 oseqno; |
78 | u32 oseqno; |
61 | u32 iseqno; |
79 | sliding_window iseqno; |
62 | u32 ismask; // bitmask with set bits for each received seqno (input seen mask) |
|
|
63 | |
80 | |
64 | pkt_queue queue; |
81 | pkt_queue queue; |
65 | |
82 | |
66 | crypto_ctx *octx, *ictx; |
83 | crypto_ctx *octx, *ictx; |
67 | |
84 | |
68 | enum conf_node::connectmode connectmode; |
85 | enum conf_node::connectmode connectmode; |
|
|
86 | u8 prot_minor; // minor number of other side |
69 | |
87 | |
70 | void reset_dstaddr (); |
88 | void reset_dstaddr (); |
71 | |
89 | |
72 | void shutdown (); |
90 | void shutdown (); |
73 | void reset_connection (); |
91 | void reset_connection (); |
74 | void establish_connection (); |
92 | void establish_connection_cb (tstamp &ts); time_watcher establish_connection; |
75 | void rekey (); |
93 | void rekey_cb (tstamp &ts); time_watcher rekey; // next rekying (actually current reset + reestablishing) |
|
|
94 | void keepalive_cb (tstamp &ts); time_watcher keepalive; // next keepalive probe |
76 | |
95 | |
77 | void send_auth (auth_subtype subtype, SOCKADDR *sa, rsachallenge *k = 0); |
96 | void send_auth_request (SOCKADDR *sa, bool initiate); |
|
|
97 | void send_auth_response (SOCKADDR *sa, const rsaid &id, const rsachallenge &chg); |
78 | void send_reset (SOCKADDR *dsa); |
98 | void send_reset (SOCKADDR *dsa); |
79 | void send_ping (SOCKADDR *dss, u8 pong = 0); |
99 | void send_ping (SOCKADDR *dss, u8 pong = 0); |
80 | void send_data_packet (tap_packet *pkt, bool broadcast = false); |
100 | void send_data_packet (tap_packet *pkt, bool broadcast = false); |
81 | void inject_data_packet (tap_packet *pkt, bool broadcast = false); |
101 | void inject_data_packet (tap_packet *pkt, bool broadcast = false); |
82 | void connect_request (int id); |
102 | void connect_request (int id); |
83 | |
103 | |
84 | void recv_vpn_packet (vpn_packet *pkt, SOCKADDR *rsa); |
104 | void recv_vpn_packet (vpn_packet *pkt, SOCKADDR *rsa); |
85 | |
105 | |
86 | void timer (); |
106 | void script_node (); |
|
|
107 | const char *script_node_up (int); |
|
|
108 | const char *script_node_down (int); |
87 | |
109 | |
88 | connection(struct vpn *vpn_) |
110 | connection(struct vpn *vpn_); |
89 | : vpn(vpn_) |
|
|
90 | { |
|
|
91 | octx = ictx = 0; |
|
|
92 | retry_cnt = 0; |
|
|
93 | connectmode = conf_node::C_ALWAYS; // initial setting |
|
|
94 | reset_connection (); |
|
|
95 | } |
|
|
96 | |
|
|
97 | ~connection () |
111 | ~connection (); |
98 | { |
|
|
99 | shutdown (); |
|
|
100 | } |
|
|
101 | |
|
|
102 | void script_node (); |
|
|
103 | const char *script_node_up (); |
|
|
104 | const char *script_node_down (); |
|
|
105 | }; |
112 | }; |
106 | |
113 | |
107 | struct vpn |
114 | struct vpn |
108 | { |
115 | { |
109 | int socket_fd; |
116 | int socket_fd; |
110 | int events; |
117 | int events; |
111 | |
118 | |
112 | tap_device *tap; |
|
|
113 | |
|
|
114 | enum { |
119 | enum { |
115 | EVENT_RECONNECT = 1, |
120 | EVENT_RECONNECT = 1, |
116 | EVENT_SHUTDOWN = 2, |
121 | EVENT_SHUTDOWN = 2, |
117 | }; |
122 | }; |
|
|
123 | |
|
|
124 | void event_cb (tstamp &ts); time_watcher event; |
|
|
125 | |
|
|
126 | tap_device *tap; |
118 | |
127 | |
119 | typedef vector<connection *> conns_vector; |
128 | typedef vector<connection *> conns_vector; |
120 | conns_vector conns; |
129 | conns_vector conns; |
121 | |
130 | |
122 | connection *find_router (); |
131 | connection *find_router (); |
123 | |
132 | |
124 | void send_vpn_packet (vpn_packet *pkt, SOCKADDR *sa); |
133 | void send_vpn_packet (vpn_packet *pkt, SOCKADDR *sa, int tos = IPTOS_RELIABILITY); |
125 | void reconnect_all (); |
134 | void reconnect_all (); |
126 | void shutdown_all (); |
135 | void shutdown_all (); |
127 | void connect_request (int id); |
136 | void connect_request (int id); |
|
|
137 | |
|
|
138 | void vpn_ev (short revents); io_watcher vpn_ev_watcher; |
|
|
139 | void udp_ev (short revents); io_watcher udp_ev_watcher; |
128 | |
140 | |
129 | vpn (); |
141 | vpn (); |
130 | ~vpn (); |
142 | ~vpn (); |
131 | |
143 | |
132 | int setup (); |
144 | int setup (); |
133 | void main_loop (); |
|
|
134 | |
145 | |
135 | const char *script_if_up (); |
146 | const char *script_if_up (int); |
136 | }; |
147 | }; |
137 | |
148 | |
138 | #endif |
149 | #endif |
139 | |
150 | |