site.c: Allocate and free the Diffie--Hellman secret buffers each time.
[secnet] / site.c
CommitLineData
2fe58dfd
SE
1/* site.c - manage communication with a remote network site */
2
c215a4bc
IJ
3/*
4 * This file is part of secnet.
5 * See README for full list of copyright holders.
6 *
7 * secnet is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by
9c6a8729 9 * the Free Software Foundation; either version 3 of the License, or
c215a4bc
IJ
10 * (at your option) any later version.
11 *
12 * secnet is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * version 3 along with secnet; if not, see
19 * https://www.gnu.org/licenses/gpl.html.
20 */
21
469fd1d9
SE
22/* The 'site' code doesn't know anything about the structure of the
23 packets it's transmitting. In fact, under the new netlink
24 configuration scheme it doesn't need to know anything at all about
25 IP addresses, except how to contact its peer. This means it could
26 potentially be used to tunnel other protocols too (IPv6, IPX, plain
27 old Ethernet frames) if appropriate netlink code can be written
28 (and that ought not to be too hard, eg. using the TUN/TAP device to
29 pretend to be an Ethernet interface). */
30
ff05a229
SE
31/* At some point in the future the netlink code will be asked for
32 configuration information to go in the PING/PONG packets at the end
33 of the key exchange. */
34
8689b3a9 35#include "secnet.h"
2fe58dfd 36#include <stdio.h>
469fd1d9 37#include <string.h>
fe5e9cc4 38#include <limits.h>
58650a70 39#include <assert.h>
8689b3a9 40#include <sys/socket.h>
2fe58dfd 41
8689b3a9 42#include <sys/mman.h>
2fe58dfd 43#include "util.h"
59635212 44#include "unaligned.h"
ff05a229 45#include "magic.h"
2fe58dfd
SE
46
47#define SETUP_BUFFER_LEN 2048
48
e7f8ec2a
IJ
49#define DEFAULT_KEY_LIFETIME (3600*1000) /* [ms] */
50#define DEFAULT_KEY_RENEGOTIATE_GAP (5*60*1000) /* [ms] */
2fe58dfd 51#define DEFAULT_SETUP_RETRIES 5
e7f8ec2a
IJ
52#define DEFAULT_SETUP_RETRY_INTERVAL (2*1000) /* [ms] */
53#define DEFAULT_WAIT_TIME (20*1000) /* [ms] */
e57264d6
IJ
54
55#define DEFAULT_MOBILE_KEY_LIFETIME (2*24*3600*1000) /* [ms] */
56#define DEFAULT_MOBILE_KEY_RENEGOTIATE_GAP (12*3600*1000) /* [ms] */
57#define DEFAULT_MOBILE_SETUP_RETRIES 30
58#define DEFAULT_MOBILE_SETUP_RETRY_INTERVAL (1*1000) /* [ms] */
59#define DEFAULT_MOBILE_WAIT_TIME (10*1000) /* [ms] */
60
446353cd 61#define DEFAULT_MOBILE_PEER_EXPIRY (2*60) /* [s] */
2fe58dfd
SE
62
63/* Each site can be in one of several possible states. */
64
65/* States:
66 SITE_STOP - nothing is allowed to happen; tunnel is down;
67 all session keys have been erased
68 -> SITE_RUN upon external instruction
69 SITE_RUN - site up, maybe with valid key
70 -> SITE_RESOLVE upon outgoing packet and no valid key
71 we start name resolution for the other end of the tunnel
72 -> SITE_SENTMSG2 upon valid incoming message 1 and suitable time
73 we send an appropriate message 2
74 SITE_RESOLVE - waiting for name resolution
75 -> SITE_SENTMSG1 upon successful resolution
76 we send an appropriate message 1
77 -> SITE_SENTMSG2 upon valid incoming message 1 (then abort resolution)
78 we abort resolution and
79 -> SITE_WAIT on timeout or resolution failure
80 SITE_SENTMSG1
81 -> SITE_SENTMSG2 upon valid incoming message 1 from higher priority end
82 -> SITE_SENTMSG3 upon valid incoming message 2
83 -> SITE_WAIT on timeout
84 SITE_SENTMSG2
85 -> SITE_SENTMSG4 upon valid incoming message 3
86 -> SITE_WAIT on timeout
87 SITE_SENTMSG3
88 -> SITE_SENTMSG5 upon valid incoming message 4
89 -> SITE_WAIT on timeout
90 SITE_SENTMSG4
91 -> SITE_RUN upon valid incoming message 5
92 -> SITE_WAIT on timeout
93 SITE_SENTMSG5
94 -> SITE_RUN upon valid incoming message 6
95 -> SITE_WAIT on timeout
96 SITE_WAIT - failed to establish key; do nothing for a while
97 -> SITE_RUN on timeout
98 */
99
100#define SITE_STOP 0
101#define SITE_RUN 1
102#define SITE_RESOLVE 2
103#define SITE_SENTMSG1 3
104#define SITE_SENTMSG2 4
105#define SITE_SENTMSG3 5
106#define SITE_SENTMSG4 6
107#define SITE_SENTMSG5 7
108#define SITE_WAIT 8
109
0fa27fb3
MW
110#define CASES_MSG3_KNOWN LABEL_MSG3: case LABEL_MSG3BIS
111
3abd18e8
IJ
112int32_t site_max_start_pad = 4*4;
113
fe5e9cc4 114static cstring_t state_name(uint32_t state)
2fe58dfd
SE
115{
116 switch (state) {
3454dce4
SE
117 case 0: return "STOP";
118 case 1: return "RUN";
119 case 2: return "RESOLVE";
120 case 3: return "SENTMSG1";
121 case 4: return "SENTMSG2";
122 case 5: return "SENTMSG3";
123 case 6: return "SENTMSG4";
124 case 7: return "SENTMSG5";
125 case 8: return "WAIT";
2fe58dfd
SE
126 default: return "*bad state*";
127 }
128}
129
2fe58dfd
SE
130#define NONCELEN 8
131
132#define LOG_UNEXPECTED 0x00000001
133#define LOG_SETUP_INIT 0x00000002
134#define LOG_SETUP_TIMEOUT 0x00000004
135#define LOG_ACTIVATE_KEY 0x00000008
136#define LOG_TIMEOUT_KEY 0x00000010
9d3a4132 137#define LOG_SEC 0x00000020
2fe58dfd
SE
138#define LOG_STATE 0x00000040
139#define LOG_DROP 0x00000080
140#define LOG_DUMP 0x00000100
141#define LOG_ERROR 0x00000400
446353cd 142#define LOG_PEER_ADDRS 0x00000800
2fe58dfd 143
9d3a4132
SE
144static struct flagstr log_event_table[]={
145 { "unexpected", LOG_UNEXPECTED },
146 { "setup-init", LOG_SETUP_INIT },
147 { "setup-timeout", LOG_SETUP_TIMEOUT },
148 { "activate-key", LOG_ACTIVATE_KEY },
149 { "timeout-key", LOG_TIMEOUT_KEY },
150 { "security", LOG_SEC },
151 { "state-change", LOG_STATE },
152 { "packet-drop", LOG_DROP },
153 { "dump-packets", LOG_DUMP },
154 { "errors", LOG_ERROR },
446353cd 155 { "peer-addrs", LOG_PEER_ADDRS },
ff05a229
SE
156 { "default", LOG_SETUP_INIT|LOG_SETUP_TIMEOUT|
157 LOG_ACTIVATE_KEY|LOG_TIMEOUT_KEY|LOG_SEC|LOG_ERROR },
9d3a4132
SE
158 { "all", 0xffffffff },
159 { NULL, 0 }
160};
161
446353cd
IJ
162
163/***** TRANSPORT PEERS declarations *****/
164
165/* Details of "mobile peer" semantics:
f6eff504 166
f6eff504
IJ
167 - We use the same data structure for the different configurations,
168 but manage it with different algorithms.
446353cd 169
f6eff504
IJ
170 - We record up to mobile_peers_max peer address/port numbers
171 ("peers") for key setup, and separately up to mobile_peers_max
172 for data transfer.
173
174 - In general, we make a new set of addrs (see below) when we start
175 a new key exchange; the key setup addrs become the data transport
176 addrs when key setup complets.
177
178 If our peer is mobile:
179
180 - We send to all recent addresses of incoming packets, plus
181 initially all configured addresses (which we also expire).
182
183 - So, we record addrs of good incoming packets, as follows:
184 1. expire any peers last seen >120s ("mobile-peer-expiry") ago
185 2. add the peer of the just received packet to the applicable list
186 (possibly evicting the oldest entries to make room)
187 NB that we do not expire peers until an incoming packet arrives.
446353cd 188
f6eff504
IJ
189 - If the peer has a configured address or name, we record them the
190 same way, but only as a result of our own initiation of key
191 setup. (We might evict some incoming packet addrs to make room.)
446353cd 192
f6eff504
IJ
193 - The default number of addrs to keep is 3, or 4 if we have a
194 configured name or address. That's space for two configured
195 addresses (one IPv6 and one IPv4), plus two received addresses.
196
197 - Outgoing packets are sent to every recorded address in the
198 applicable list. Any unsupported[1] addresses are deleted from
199 the list right away. (This should only happen to configured
200 addresses, of course, but there is no need to check that.)
201
202 - When we successfully complete a key setup, we merge the key setup
446353cd
IJ
203 peers into the data transfer peers.
204
f6eff504
IJ
205 [1] An unsupported address is one for whose AF we don't have a
206 socket (perhaps because we got EAFNOSUPPORT or some such) or for
207 which sendto gives ENETUNREACH.
208
209 If neither end is mobile:
210
211 - When peer initiated the key exchange, we use the incoming packet
212 address.
213
214 - When we initiate the key exchange, we try configured addresses
215 until we get one which isn't unsupported then fixate on that.
216
217 - When we complete a key setup, we replace the data transport peers
218 with those from the key setup.
446353cd 219
f6eff504 220 If we are mobile:
446353cd 221
f6eff504
IJ
222 - We can't tell when local network setup changes so we can't cache
223 the unsupported addrs and completely remove the spurious calls to
224 sendto, but we can optimise things a bit by deprioritising addrs
225 which seem to be unsupported.
446353cd 226
f6eff504
IJ
227 - Use only configured addresses. (Except, that if our peer
228 initiated a key exchange we use the incoming packet address until
229 our name resolution completes.)
446353cd 230
f6eff504
IJ
231 - When we send a packet, try each address in turn; if addr
232 supported, put that address to the end of the list for future
233 packets, and go onto the next address.
446353cd 234
f6eff504
IJ
235 - When we complete a key setup, we replace the data transport peers
236 with those from the key setup.
446353cd
IJ
237
238 */
239
446353cd
IJ
240typedef struct {
241 struct timeval last;
242 struct comm_addr addr;
243} transport_peer;
244
245typedef struct {
246/* configuration information */
247/* runtime information */
248 int npeers;
0f27325c 249 transport_peer peers[MAX_PEER_ADDRS];
446353cd
IJ
250} transport_peers;
251
8b21a212 252/* Basic operations on transport peer address sets */
446353cd
IJ
253static void transport_peers_clear(struct site *st, transport_peers *peers);
254static int transport_peers_valid(transport_peers *peers);
255static void transport_peers_copy(struct site *st, transport_peers *dst,
256 const transport_peers *src);
257
8b21a212 258/* Record address of incoming setup packet; resp. data packet. */
446353cd
IJ
259static void transport_setup_msgok(struct site *st, const struct comm_addr *a);
260static void transport_data_msgok(struct site *st, const struct comm_addr *a);
8b21a212
IJ
261
262/* Initialise the setup addresses. Called before we send the first
263 * packet in a key exchange. If we are the initiator, as a result of
264 * resolve completing (or being determined not to be relevant) or an
265 * incoming PROD; if we are the responder, as a result of the MSG1. */
446353cd 266static bool_t transport_compute_setupinit_peers(struct site *st,
45a14422
IJ
267 const struct comm_addr *configured_addrs /* 0 if none or not found */,
268 int n_configured_addrs /* 0 if none or not found */,
a96fda35 269 const struct comm_addr *incoming_packet_addr /* 0 if none */);
8b21a212
IJ
270
271/* Called if we are the responder in a key setup, when the resolve
272 * completes. transport_compute_setupinit_peers will hvae been called
273 * earlier. If _complete is called, we are still doing the key setup
274 * (and we should use the new values for both the rest of the key
275 * setup and the ongoing data exchange); if _tardy is called, the key
276 * setup is done (either completed or not) and only the data peers are
277 * relevant */
90d7e3ad 278static void transport_resolve_complete(struct site *st,
45a14422 279 const struct comm_addr *addrs, int naddrs);
90d7e3ad 280static void transport_resolve_complete_tardy(struct site *st,
45a14422 281 const struct comm_addr *addrs, int naddrs);
446353cd
IJ
282
283static void transport_xmit(struct site *st, transport_peers *peers,
284 struct buffer_if *buf, bool_t candebug);
285
286 /***** END of transport peers declarations *****/
287
288
19e9a588
IJ
289struct data_key {
290 struct transform_inst_if *transform;
291 uint64_t key_timeout; /* End of life of current key */
292 uint32_t remote_session_id;
293};
294
2fe58dfd
SE
295struct site {
296 closure_t cl;
297 struct site_if ops;
298/* configuration information */
299 string_t localname;
300 string_t remotename;
e6d6991c 301 bool_t keepalive;
0391d9ee 302 bool_t local_mobile, peer_mobile; /* Mobile client support */
446353cd 303 int32_t transport_peers_max;
ff05a229 304 string_t tunname; /* localname<->remotename by default, used in logs */
83dbdd3f 305 cstring_t *addresses; /* DNS name or address(es) for bootstrapping, optional */
ff05a229 306 int remoteport; /* Port for bootstrapping, optional */
3ed1846a 307 uint32_t mtu_target;
2fe58dfd 308 struct netlink_if *netlink;
59533c16 309 struct comm_if **comms;
5dfe538b 310 struct comm_clientinfo **commclientinfos;
59533c16 311 int ncomms;
2fe58dfd
SE
312 struct resolver_if *resolver;
313 struct log_if *log;
314 struct random_if *random;
315 struct rsaprivkey_if *privkey;
2fe58dfd 316 struct rsapubkey_if *pubkey;
5b5f297f
IJ
317 struct transform_if **transforms;
318 int ntransforms;
2fe58dfd
SE
319 struct dh_if *dh;
320 struct hash_if *hash;
2fe58dfd 321
58650a70 322 uint32_t index; /* Index of this site */
5d903efd 323 uint32_t early_capabilities;
09a385fb 324 uint32_t local_capabilities;
1caa23ff 325 int32_t setup_retries; /* How many times to send setup packets */
e7f8ec2a 326 int32_t setup_retry_interval; /* Initial timeout for setup packets */
f7a86234 327 int32_t wait_timeout_mean; /* How long to wait if setup unsuccessful */
446353cd 328 int32_t mobile_peer_expiry; /* How long to remember 2ary addresses */
4a8aed08
IJ
329 int32_t key_lifetime; /* How long a key lasts once set up */
330 int32_t key_renegotiate_time; /* If we see traffic (or a keepalive)
9d3a4132
SE
331 after this time, initiate a new
332 key exchange */
2fe58dfd 333
ffafab08 334 bool_t our_name_later; /* our name > peer name */
2fe58dfd
SE
335 uint32_t log_events;
336
337/* runtime information */
338 uint32_t state;
339 uint64_t now; /* Most recently seen time */
dd9209d1 340 bool_t allow_send_prod;
8b978d45 341 bool_t msg1_crossed_logged;
83dbdd3f
IJ
342 int resolving_count;
343 int resolving_n_results_all;
344 int resolving_n_results_stored;
345 struct comm_addr resolving_results[MAX_PEER_ADDRS];
2fe58dfd 346
ff05a229 347 /* The currently established session */
19e9a588 348 struct data_key current;
02b0959b 349 struct data_key auxiliary_key;
bd98cd6b 350 bool_t auxiliary_is_new;
ff05a229 351 uint64_t renegotiate_key_time; /* When we can negotiate a new key */
bd98cd6b 352 uint64_t auxiliary_renegotiate_key_time;
446353cd 353 transport_peers peers; /* Current address(es) of peer for data traffic */
2fe58dfd 354
ff05a229
SE
355 /* The current key setup protocol exchange. We can only be
356 involved in one of these at a time. There's a potential for
357 denial of service here (the attacker keeps sending a setup
358 packet; we keep trying to continue the exchange, and have to
359 timeout before we can listen for another setup packet); perhaps
360 we should keep a list of 'bad' sources for setup packets. */
09a385fb 361 uint32_t remote_capabilities;
3ed1846a 362 uint16_t remote_adv_mtu;
5b5f297f 363 struct transform_if *chosen_transform;
2fe58dfd 364 uint32_t setup_session_id;
446353cd 365 transport_peers setup_peers;
2fe58dfd
SE
366 uint8_t localN[NONCELEN]; /* Nonces for key exchange */
367 uint8_t remoteN[NONCELEN];
368 struct buffer_if buffer; /* Current outgoing key exchange packet */
05f39b4d 369 struct buffer_if scratch;
4a8aed08 370 int32_t retries; /* Number of retries remaining */
2fe58dfd
SE
371 uint64_t timeout; /* Timeout for current state */
372 uint8_t *dhsecret;
373 uint8_t *sharedsecret;
2fe58dfd
SE
374 struct transform_inst_if *new_transform; /* For key setup/verify */
375};
376
8368df34
IJ
377static uint32_t event_log_priority(struct site *st, uint32_t event)
378{
379 if (!(event&st->log_events))
380 return 0;
381 switch(event) {
382 case LOG_UNEXPECTED: return M_INFO;
383 case LOG_SETUP_INIT: return M_INFO;
384 case LOG_SETUP_TIMEOUT: return M_NOTICE;
385 case LOG_ACTIVATE_KEY: return M_INFO;
386 case LOG_TIMEOUT_KEY: return M_INFO;
387 case LOG_SEC: return M_SECURITY;
388 case LOG_STATE: return M_DEBUG;
389 case LOG_DROP: return M_DEBUG;
390 case LOG_DUMP: return M_DEBUG;
391 case LOG_ERROR: return M_ERR;
392 case LOG_PEER_ADDRS: return M_DEBUG;
393 default: return M_ERR;
394 }
395}
396
0237c848
IJ
397static void vslog(struct site *st, uint32_t event, cstring_t msg, va_list ap)
398FORMAT(printf,3,0);
399static void vslog(struct site *st, uint32_t event, cstring_t msg, va_list ap)
2fe58dfd 400{
b2a56f7c 401 uint32_t class;
2fe58dfd 402
8368df34
IJ
403 class=event_log_priority(st, event);
404 if (class) {
e5d8c16e
IJ
405 slilog_part(st->log,class,"%s: ",st->tunname);
406 vslilog_part(st->log,class,msg,ap);
407 slilog_part(st->log,class,"\n");
2fe58dfd 408 }
2fe58dfd
SE
409}
410
0237c848
IJ
411static void slog(struct site *st, uint32_t event, cstring_t msg, ...)
412FORMAT(printf,3,4);
413static void slog(struct site *st, uint32_t event, cstring_t msg, ...)
414{
415 va_list ap;
416 va_start(ap,msg);
417 vslog(st,event,msg,ap);
418 va_end(ap);
419}
420
4f3c75ac
IJ
421static void logtimeout(struct site *st, const char *fmt, ...)
422FORMAT(printf,2,3);
423static void logtimeout(struct site *st, const char *fmt, ...)
424{
e9c9020e
IJ
425 uint32_t class=event_log_priority(st,LOG_SETUP_TIMEOUT);
426 if (!class)
427 return;
428
4f3c75ac
IJ
429 va_list ap;
430 va_start(ap,fmt);
e9c9020e
IJ
431
432 slilog_part(st->log,class,"%s: ",st->tunname);
433 vslilog_part(st->log,class,fmt,ap);
434
435 const char *delim;
436 int i;
437 for (i=0, delim=" (tried ";
438 i<st->setup_peers.npeers;
439 i++, delim=", ") {
440 transport_peer *peer=&st->setup_peers.peers[i];
441 const char *s=comm_addr_to_string(&peer->addr);
442 slilog_part(st->log,class,"%s%s",delim,s);
443 }
444
445 slilog_part(st->log,class,")\n");
4f3c75ac
IJ
446 va_end(ap);
447}
448
9d3a4132 449static void set_link_quality(struct site *st);
1d388569
IJ
450static void delete_keys(struct site *st, cstring_t reason, uint32_t loglevel);
451static void delete_one_key(struct site *st, struct data_key *key,
452 const char *reason /* may be 0 meaning don't log*/,
453 const char *which /* ignored if !reasonn */,
454 uint32_t loglevel /* ignored if !reasonn */);
dd9209d1
IJ
455static bool_t initiate_key_setup(struct site *st, cstring_t reason,
456 const struct comm_addr *prod_hint);
2fe58dfd
SE
457static void enter_state_run(struct site *st);
458static bool_t enter_state_resolve(struct site *st);
83dbdd3f 459static void decrement_resolving_count(struct site *st, int by);
ff05a229 460static bool_t enter_new_state(struct site *st,uint32_t next);
2fe58dfd 461static void enter_state_wait(struct site *st);
05f39b4d 462static void activate_new_key(struct site *st);
2fe58dfd 463
0afd257e
IJ
464static bool_t is_transform_valid(struct transform_inst_if *transform)
465{
fcad4b0b 466 return transform && transform->valid(transform->st);
0afd257e
IJ
467}
468
3d8d8f4e
IJ
469static bool_t current_valid(struct site *st)
470{
0afd257e
IJ
471 return is_transform_valid(st->current.transform);
472}
473
474#define DEFINE_CALL_TRANSFORM(fwdrev) \
14f78812
IJ
475static transform_apply_return \
476call_transform_##fwdrev(struct site *st, \
0afd257e
IJ
477 struct transform_inst_if *transform, \
478 struct buffer_if *buf, \
479 const char **errmsg) \
480{ \
fcad4b0b
IJ
481 if (!is_transform_valid(transform)) { \
482 *errmsg="transform not set up"; \
14f78812 483 return transform_apply_err; \
fcad4b0b 484 } \
0afd257e 485 return transform->fwdrev(transform->st,buf,errmsg); \
3d8d8f4e
IJ
486}
487
0afd257e
IJ
488DEFINE_CALL_TRANSFORM(forwards)
489DEFINE_CALL_TRANSFORM(reverse)
490
491static void dispose_transform(struct transform_inst_if **transform_var)
492{
0afd257e 493 struct transform_inst_if *transform=*transform_var;
fcad4b0b
IJ
494 if (transform) {
495 transform->delkey(transform->st);
496 transform->destroy(transform->st);
497 }
498 *transform_var = 0;
0afd257e
IJ
499}
500
2fe58dfd
SE
501#define CHECK_AVAIL(b,l) do { if ((b)->size<(l)) return False; } while(0)
502#define CHECK_EMPTY(b) do { if ((b)->size!=0) return False; } while(0)
503#define CHECK_TYPE(b,t) do { uint32_t type; \
504 CHECK_AVAIL((b),4); \
59635212 505 type=buf_unprepend_uint32((b)); \
2fe58dfd
SE
506 if (type!=(t)) return False; } while(0)
507
3ed1846a
IJ
508static _Bool type_is_msg34(uint32_t type)
509{
0fa27fb3
MW
510 switch (type) {
511 case CASES_MSG3_KNOWN: case LABEL_MSG4: return True;
512 default: return False;
513 }
3ed1846a
IJ
514}
515
1737eeef
IJ
516struct parsedname {
517 int32_t len;
518 uint8_t *name;
09a385fb 519 struct buffer_if extrainfo;
1737eeef
IJ
520};
521
2fe58dfd
SE
522struct msg {
523 uint8_t *hashstart;
524 uint32_t dest;
525 uint32_t source;
1737eeef
IJ
526 struct parsedname remote;
527 struct parsedname local;
09a385fb 528 uint32_t remote_capabilities;
3ed1846a 529 uint16_t remote_mtu;
5b5f297f 530 int capab_transformnum;
2fe58dfd
SE
531 uint8_t *nR;
532 uint8_t *nL;
1caa23ff 533 int32_t pklen;
3e8addad 534 char *pk;
1caa23ff
IJ
535 int32_t hashlen;
536 int32_t siglen;
3e8addad 537 char *sig;
2fe58dfd
SE
538};
539
f7a86234 540static int32_t wait_timeout(struct site *st) {
19074a85
IJ
541 int32_t t = st->wait_timeout_mean;
542 int8_t factor;
543 if (t < INT_MAX/2) {
544 st->random->generate(st->random->st,sizeof(factor),&factor);
545 t += (t / 256) * factor;
546 }
547 return t;
f7a86234
IJ
548}
549
6f0c71c5 550static _Bool set_new_transform(struct site *st, char *pk)
0afd257e 551{
6f0c71c5
MW
552 _Bool ok;
553
5b5f297f 554 /* Generate the shared key */
088f80a1
MW
555 assert(!st->sharedsecret);
556 st->sharedsecret = safe_malloc(st->dh->shared_len, "site:sharedsecret");
5f679c36 557 if (!st->dh->makeshared(st->dh->st,st->dhsecret,st->dh->secret_len,
3f488f14 558 pk, st->sharedsecret,st->dh->shared_len))
29c2f818 559 return False;
5b5f297f
IJ
560
561 /* Set up the transform */
562 struct transform_if *generator=st->chosen_transform;
fcad4b0b 563 struct transform_inst_if *generated=generator->create(generator->st);
6f0c71c5 564 ok = generated->setkey(generated->st,st->sharedsecret,
3f488f14 565 st->dh->shared_len,st->our_name_later);
6f0c71c5 566
fcad4b0b 567 dispose_transform(&st->new_transform);
6f0c71c5 568 if (!ok) return False;
fcad4b0b 569 st->new_transform=generated;
5b5f297f
IJ
570
571 slog(st,LOG_SETUP_INIT,"key exchange negotiated transform"
572 " %d (capabilities ours=%#"PRIx32" theirs=%#"PRIx32")",
92cc0bca 573 st->chosen_transform->capab_bit,
5b5f297f 574 st->local_capabilities, st->remote_capabilities);
6f0c71c5 575 return True;
0afd257e
IJ
576}
577
09a385fb
IJ
578struct xinfoadd {
579 int32_t lenpos, afternul;
580};
581static void append_string_xinfo_start(struct buffer_if *buf,
582 struct xinfoadd *xia,
583 const char *str)
584 /* Helps construct one of the names with additional info as found
585 * in MSG1..4. Call this function first, then append all the
586 * desired extra info (not including the nul byte) to the buffer,
587 * then call append_string_xinfo_done. */
588{
589 xia->lenpos = buf->size;
590 buf_append_string(buf,str);
591 buf_append_uint8(buf,0);
592 xia->afternul = buf->size;
593}
594static void append_string_xinfo_done(struct buffer_if *buf,
595 struct xinfoadd *xia)
596{
597 /* we just need to adjust the string length */
598 if (buf->size == xia->afternul) {
599 /* no extra info, strip the nul too */
600 buf_unappend_uint8(buf);
601 } else {
602 put_uint16(buf->start+xia->lenpos, buf->size-(xia->lenpos+2));
603 }
604}
605
ff05a229
SE
606/* Build any of msg1 to msg4. msg5 and msg6 are built from the inside
607 out using a transform of config data supplied by netlink */
fe5e9cc4 608static bool_t generate_msg(struct site *st, uint32_t type, cstring_t what)
2fe58dfd
SE
609{
610 void *hst;
3b83c932 611 uint8_t *hash;
2fe58dfd 612 string_t dhpub, sig;
0fa27fb3 613 unsigned minor;
2fe58dfd
SE
614
615 st->retries=st->setup_retries;
616 BUF_ALLOC(&st->buffer,what);
617 buffer_init(&st->buffer,0);
59635212
SE
618 buf_append_uint32(&st->buffer,
619 (type==LABEL_MSG1?0:st->setup_session_id));
58650a70 620 buf_append_uint32(&st->buffer,st->index);
59635212 621 buf_append_uint32(&st->buffer,type);
09a385fb
IJ
622
623 struct xinfoadd xia;
624 append_string_xinfo_start(&st->buffer,&xia,st->localname);
5d903efd
MW
625 if ((st->local_capabilities & st->early_capabilities) ||
626 (type != LABEL_MSG1)) {
09a385fb
IJ
627 buf_append_uint32(&st->buffer,st->local_capabilities);
628 }
3ed1846a
IJ
629 if (type_is_msg34(type)) {
630 buf_append_uint16(&st->buffer,st->mtu_target);
631 }
09a385fb
IJ
632 append_string_xinfo_done(&st->buffer,&xia);
633
2fe58dfd 634 buf_append_string(&st->buffer,st->remotename);
4f28e77e 635 BUF_ADD_OBJ(append,&st->buffer,st->localN);
2fe58dfd 636 if (type==LABEL_MSG1) return True;
4f28e77e 637 BUF_ADD_OBJ(append,&st->buffer,st->remoteN);
2fe58dfd 638 if (type==LABEL_MSG2) return True;
3b83c932
SE
639
640 if (hacky_par_mid_failnow()) return False;
641
0fa27fb3
MW
642 if (MSGMAJOR(type) == 3) do {
643 minor = MSGMINOR(type);
644 if (minor < 1) break;
92cc0bca 645 buf_append_uint8(&st->buffer,st->chosen_transform->capab_bit);
0fa27fb3 646 } while (0);
5b5f297f 647
5f679c36 648 dhpub=st->dh->makepublic(st->dh->st,st->dhsecret,st->dh->secret_len);
2fe58dfd
SE
649 buf_append_string(&st->buffer,dhpub);
650 free(dhpub);
3b83c932 651 hash=safe_malloc(st->hash->len, "generate_msg");
2fe58dfd
SE
652 hst=st->hash->init();
653 st->hash->update(hst,st->buffer.start,st->buffer.size);
654 st->hash->final(hst,hash);
655 sig=st->privkey->sign(st->privkey->st,hash,st->hash->len);
656 buf_append_string(&st->buffer,sig);
657 free(sig);
3b83c932 658 free(hash);
2fe58dfd
SE
659 return True;
660}
661
1737eeef
IJ
662static bool_t unpick_name(struct buffer_if *msg, struct parsedname *nm)
663{
664 CHECK_AVAIL(msg,2);
665 nm->len=buf_unprepend_uint16(msg);
666 CHECK_AVAIL(msg,nm->len);
667 nm->name=buf_unprepend(msg,nm->len);
668 uint8_t *nul=memchr(nm->name,0,nm->len);
669 if (!nul) {
09a385fb 670 buffer_readonly_view(&nm->extrainfo,0,0);
1737eeef 671 } else {
09a385fb 672 buffer_readonly_view(&nm->extrainfo, nul+1, msg->start-(nul+1));
1737eeef
IJ
673 nm->len=nul-nm->name;
674 }
675 return True;
676}
677
2fe58dfd
SE
678static bool_t unpick_msg(struct site *st, uint32_t type,
679 struct buffer_if *msg, struct msg *m)
680{
0fa27fb3
MW
681 unsigned minor;
682
5b5f297f 683 m->capab_transformnum=-1;
2fe58dfd
SE
684 m->hashstart=msg->start;
685 CHECK_AVAIL(msg,4);
59635212 686 m->dest=buf_unprepend_uint32(msg);
2fe58dfd 687 CHECK_AVAIL(msg,4);
59635212 688 m->source=buf_unprepend_uint32(msg);
2fe58dfd 689 CHECK_TYPE(msg,type);
1737eeef 690 if (!unpick_name(msg,&m->remote)) return False;
09a385fb 691 m->remote_capabilities=0;
3ed1846a 692 m->remote_mtu=0;
09a385fb
IJ
693 if (m->remote.extrainfo.size) {
694 CHECK_AVAIL(&m->remote.extrainfo,4);
695 m->remote_capabilities=buf_unprepend_uint32(&m->remote.extrainfo);
696 }
3ed1846a
IJ
697 if (type_is_msg34(type) && m->remote.extrainfo.size) {
698 CHECK_AVAIL(&m->remote.extrainfo,2);
699 m->remote_mtu=buf_unprepend_uint16(&m->remote.extrainfo);
700 }
1737eeef 701 if (!unpick_name(msg,&m->local)) return False;
dd9209d1
IJ
702 if (type==LABEL_PROD) {
703 CHECK_EMPTY(msg);
704 return True;
705 }
2fe58dfd
SE
706 CHECK_AVAIL(msg,NONCELEN);
707 m->nR=buf_unprepend(msg,NONCELEN);
708 if (type==LABEL_MSG1) {
709 CHECK_EMPTY(msg);
710 return True;
711 }
712 CHECK_AVAIL(msg,NONCELEN);
713 m->nL=buf_unprepend(msg,NONCELEN);
714 if (type==LABEL_MSG2) {
715 CHECK_EMPTY(msg);
716 return True;
717 }
0fa27fb3
MW
718 if (MSGMAJOR(type) == 3) do {
719 minor = MSGMINOR(type);
720#define MAYBE_READ_CAP(minminor, kind, dflt) do { \
721 if (minor < (minminor)) \
722 m->capab_##kind##num = (dflt); \
723 else { \
724 CHECK_AVAIL(msg, 1); \
725 m->capab_##kind##num = buf_unprepend_uint8(msg); \
726 } \
727} while (0)
728 MAYBE_READ_CAP(1, transform, CAPAB_BIT_ANCIENTTRANSFORM);
729#undef MAYBE_READ_CAP
730 } while (0);
2fe58dfd 731 CHECK_AVAIL(msg,2);
59635212 732 m->pklen=buf_unprepend_uint16(msg);
2fe58dfd
SE
733 CHECK_AVAIL(msg,m->pklen);
734 m->pk=buf_unprepend(msg,m->pklen);
735 m->hashlen=msg->start-m->hashstart;
736 CHECK_AVAIL(msg,2);
59635212 737 m->siglen=buf_unprepend_uint16(msg);
2fe58dfd
SE
738 CHECK_AVAIL(msg,m->siglen);
739 m->sig=buf_unprepend(msg,m->siglen);
740 CHECK_EMPTY(msg);
534fb389
MW
741
742 /* In `process_msg3_msg4' below, we assume that we can write a nul
743 * terminator following the signature. Make sure there's enough space.
744 */
745 if (msg->start >= msg->base + msg->alloclen)
746 return False;
747
2fe58dfd
SE
748 return True;
749}
750
1737eeef
IJ
751static bool_t name_matches(const struct parsedname *nm, const char *expected)
752{
753 int expected_len=strlen(expected);
754 return
755 nm->len == expected_len &&
756 !memcmp(nm->name, expected, expected_len);
757}
758
ff05a229 759static bool_t check_msg(struct site *st, uint32_t type, struct msg *m,
fe5e9cc4 760 cstring_t *error)
ff05a229
SE
761{
762 if (type==LABEL_MSG1) return True;
763
764 /* Check that the site names and our nonce have been sent
765 back correctly, and then store our peer's nonce. */
1737eeef 766 if (!name_matches(&m->remote,st->remotename)) {
ff05a229
SE
767 *error="wrong remote site name";
768 return False;
769 }
1737eeef 770 if (!name_matches(&m->local,st->localname)) {
ff05a229
SE
771 *error="wrong local site name";
772 return False;
773 }
774 if (memcmp(m->nL,st->localN,NONCELEN)!=0) {
775 *error="wrong locally-generated nonce";
776 return False;
777 }
778 if (type==LABEL_MSG2) return True;
30ba82a5 779 if (!consttime_memeq(m->nR,st->remoteN,NONCELEN)) {
ff05a229
SE
780 *error="wrong remotely-generated nonce";
781 return False;
782 }
09a385fb
IJ
783 /* MSG3 has complicated rules about capabilities, which are
784 * handled in process_msg3. */
0fa27fb3 785 if (MSGMAJOR(type) == 3) return True;
09a385fb
IJ
786 if (m->remote_capabilities!=st->remote_capabilities) {
787 *error="remote capabilities changed";
788 return False;
789 }
ff05a229
SE
790 if (type==LABEL_MSG4) return True;
791 *error="unknown message type";
792 return False;
793}
794
2fe58dfd
SE
795static bool_t generate_msg1(struct site *st)
796{
797 st->random->generate(st->random->st,NONCELEN,st->localN);
798 return generate_msg(st,LABEL_MSG1,"site:MSG1");
799}
800
801static bool_t process_msg1(struct site *st, struct buffer_if *msg1,
7e29719e 802 const struct comm_addr *src, struct msg *m)
2fe58dfd 803{
2fe58dfd
SE
804 /* We've already determined we're in an appropriate state to
805 process an incoming MSG1, and that the MSG1 has correct values
806 of A and B. */
807
7e29719e 808 st->setup_session_id=m->source;
09a385fb 809 st->remote_capabilities=m->remote_capabilities;
7e29719e 810 memcpy(st->remoteN,m->nR,NONCELEN);
2fe58dfd
SE
811 return True;
812}
813
814static bool_t generate_msg2(struct site *st)
815{
816 st->random->generate(st->random->st,NONCELEN,st->localN);
817 return generate_msg(st,LABEL_MSG2,"site:MSG2");
818}
819
820static bool_t process_msg2(struct site *st, struct buffer_if *msg2,
a15faeb2 821 const struct comm_addr *src)
2fe58dfd
SE
822{
823 struct msg m;
fe5e9cc4 824 cstring_t err;
2fe58dfd
SE
825
826 if (!unpick_msg(st,LABEL_MSG2,msg2,&m)) return False;
ff05a229
SE
827 if (!check_msg(st,LABEL_MSG2,&m,&err)) {
828 slog(st,LOG_SEC,"msg2: %s",err);
2fe58dfd
SE
829 return False;
830 }
831 st->setup_session_id=m.source;
09a385fb 832 st->remote_capabilities=m.remote_capabilities;
5b5f297f
IJ
833
834 /* Select the transform to use */
835
10b7d092
MW
836 uint32_t remote_crypto_caps = st->remote_capabilities & CAPAB_TRANSFORM_MASK;
837 if (!remote_crypto_caps)
5b5f297f 838 /* old secnets only had this one transform */
10b7d092 839 remote_crypto_caps = 1UL << CAPAB_BIT_ANCIENTTRANSFORM;
5b5f297f 840
8bb8c22a
MW
841#define CHOOSE_CRYPTO(kind, whats) do { \
842 struct kind##_if *iface; \
843 uint32_t bit, ours = 0; \
844 int i; \
845 for (i= 0; i < st->n##kind##s; i++) { \
846 iface=st->kind##s[i]; \
847 bit = 1UL << iface->capab_bit; \
848 if (bit & remote_crypto_caps) goto kind##_found; \
849 ours |= bit; \
850 } \
851 slog(st,LOG_ERROR,"no " whats " in common" \
852 " (us %#"PRIx32"; them: %#"PRIx32")", \
853 st->local_capabilities & ours, remote_crypto_caps); \
854 return False; \
855kind##_found: \
856 st->chosen_##kind = iface; \
857} while (0)
858
859 CHOOSE_CRYPTO(transform, "transforms");
860
861#undef CHOOSE_CRYPTO
5b5f297f 862
2fe58dfd
SE
863 memcpy(st->remoteN,m.nR,NONCELEN);
864 return True;
865}
866
242a13f7
MW
867static void generate_dhsecret(struct site *st)
868{
088f80a1
MW
869 assert(!st->dhsecret);
870 st->dhsecret = safe_malloc(st->dh->secret_len, "site:dhsecret");
242a13f7
MW
871 st->random->generate(st->random->st, st->dh->secret_len,st->dhsecret);
872}
873
2fe58dfd
SE
874static bool_t generate_msg3(struct site *st)
875{
876 /* Now we have our nonce and their nonce. Think of a secret key,
877 and create message number 3. */
242a13f7 878 generate_dhsecret(st);
5b5f297f 879 return generate_msg(st,
0fa27fb3
MW
880 (st->remote_capabilities & CAPAB_TRANSFORM_MASK)
881 ? LABEL_MSG3BIS
882 : LABEL_MSG3,
5b5f297f 883 "site:MSG3");
2fe58dfd
SE
884}
885
e001e8c0
IJ
886static bool_t process_msg3_msg4(struct site *st, struct msg *m)
887{
888 uint8_t *hash;
889 void *hst;
890
891 /* Check signature and store g^x mod m */
892 hash=safe_malloc(st->hash->len, "process_msg3_msg4");
893 hst=st->hash->init();
894 st->hash->update(hst,m->hashstart,m->hashlen);
895 st->hash->final(hst,hash);
534fb389 896 /* Terminate signature with a '0' - already checked that this will fit */
e001e8c0
IJ
897 m->sig[m->siglen]=0;
898 if (!st->pubkey->check(st->pubkey->st,hash,st->hash->len,m->sig)) {
899 slog(st,LOG_SEC,"msg3/msg4 signature failed check!");
900 free(hash);
901 return False;
902 }
903 free(hash);
904
3ed1846a
IJ
905 st->remote_adv_mtu=m->remote_mtu;
906
e001e8c0
IJ
907 return True;
908}
909
2fe58dfd 910static bool_t process_msg3(struct site *st, struct buffer_if *msg3,
5b5f297f 911 const struct comm_addr *src, uint32_t msgtype)
2fe58dfd
SE
912{
913 struct msg m;
fe5e9cc4 914 cstring_t err;
2fe58dfd 915
0fa27fb3
MW
916 switch (msgtype) {
917 case CASES_MSG3_KNOWN: break;
918 default: assert(0);
919 }
5b5f297f
IJ
920
921 if (!unpick_msg(st,msgtype,msg3,&m)) return False;
922 if (!check_msg(st,msgtype,&m,&err)) {
ff05a229 923 slog(st,LOG_SEC,"msg3: %s",err);
2fe58dfd
SE
924 return False;
925 }
09a385fb 926 uint32_t capab_adv_late = m.remote_capabilities
5d903efd 927 & ~st->remote_capabilities & st->early_capabilities;
09a385fb
IJ
928 if (capab_adv_late) {
929 slog(st,LOG_SEC,"msg3 impermissibly adds early capability flag(s)"
930 " %#"PRIx32" (was %#"PRIx32", now %#"PRIx32")",
931 capab_adv_late, st->remote_capabilities, m.remote_capabilities);
932 return False;
933 }
934 st->remote_capabilities|=m.remote_capabilities;
ff05a229 935
8bb8c22a
MW
936#define CHOSE_CRYPTO(kind, what) do { \
937 struct kind##_if *iface; \
938 int i; \
939 for (i=0; i<st->n##kind##s; i++) { \
940 iface=st->kind##s[i]; \
941 if (iface->capab_bit == m.capab_##kind##num) \
942 goto kind##_found; \
943 } \
944 slog(st,LOG_SEC,"peer chose unknown-to-us " what " %d!", \
945 m.capab_##kind##num); \
946 return False; \
947kind##_found: \
948 st->chosen_##kind=iface; \
949} while (0)
950
951 CHOSE_CRYPTO(transform, "transform");
952
953#undef CHOSE_CRYPTO
5b5f297f 954
e001e8c0 955 if (!process_msg3_msg4(st,&m))
2fe58dfd 956 return False;
2fe58dfd
SE
957
958 /* Terminate their DH public key with a '0' */
959 m.pk[m.pklen]=0;
960 /* Invent our DH secret key */
242a13f7 961 generate_dhsecret(st);
2fe58dfd 962
5b5f297f 963 /* Generate the shared key and set up the transform */
6f0c71c5 964 if (!set_new_transform(st,m.pk)) return False;
2fe58dfd
SE
965
966 return True;
967}
968
969static bool_t generate_msg4(struct site *st)
970{
971 /* We have both nonces, their public key and our private key. Generate
972 our public key, sign it and send it to them. */
973 return generate_msg(st,LABEL_MSG4,"site:MSG4");
974}
975
976static bool_t process_msg4(struct site *st, struct buffer_if *msg4,
a15faeb2 977 const struct comm_addr *src)
2fe58dfd
SE
978{
979 struct msg m;
fe5e9cc4 980 cstring_t err;
2fe58dfd
SE
981
982 if (!unpick_msg(st,LABEL_MSG4,msg4,&m)) return False;
ff05a229
SE
983 if (!check_msg(st,LABEL_MSG4,&m,&err)) {
984 slog(st,LOG_SEC,"msg4: %s",err);
2fe58dfd
SE
985 return False;
986 }
987
e001e8c0 988 if (!process_msg3_msg4(st,&m))
2fe58dfd 989 return False;
2fe58dfd
SE
990
991 /* Terminate their DH public key with a '0' */
992 m.pk[m.pklen]=0;
5b5f297f
IJ
993
994 /* Generate the shared key and set up the transform */
6f0c71c5 995 if (!set_new_transform(st,m.pk)) return False;
2fe58dfd
SE
996
997 return True;
998}
999
2fe58dfd
SE
1000struct msg0 {
1001 uint32_t dest;
1002 uint32_t source;
1003 uint32_t type;
1004};
1005
1006static bool_t unpick_msg0(struct site *st, struct buffer_if *msg0,
1007 struct msg0 *m)
1008{
1009 CHECK_AVAIL(msg0,4);
59635212 1010 m->dest=buf_unprepend_uint32(msg0);
2fe58dfd 1011 CHECK_AVAIL(msg0,4);
59635212 1012 m->source=buf_unprepend_uint32(msg0);
2fe58dfd 1013 CHECK_AVAIL(msg0,4);
59635212 1014 m->type=buf_unprepend_uint32(msg0);
2fe58dfd
SE
1015 return True;
1016 /* Leaves transformed part of buffer untouched */
1017}
1018
ff05a229
SE
1019static bool_t generate_msg5(struct site *st)
1020{
fe5e9cc4 1021 cstring_t transform_err;
ff05a229
SE
1022
1023 BUF_ALLOC(&st->buffer,"site:MSG5");
1024 /* We are going to add four words to the message */
3abd18e8 1025 buffer_init(&st->buffer,calculate_max_start_pad());
ff05a229
SE
1026 /* Give the netlink code an opportunity to put its own stuff in the
1027 message (configuration information, etc.) */
ff05a229 1028 buf_prepend_uint32(&st->buffer,LABEL_MSG5);
0afd257e
IJ
1029 if (call_transform_forwards(st,st->new_transform,
1030 &st->buffer,&transform_err))
1031 return False;
ff05a229 1032 buf_prepend_uint32(&st->buffer,LABEL_MSG5);
58650a70 1033 buf_prepend_uint32(&st->buffer,st->index);
ff05a229
SE
1034 buf_prepend_uint32(&st->buffer,st->setup_session_id);
1035
1036 st->retries=st->setup_retries;
1037 return True;
1038}
1039
2fe58dfd 1040static bool_t process_msg5(struct site *st, struct buffer_if *msg5,
c90cc2a7
IJ
1041 const struct comm_addr *src,
1042 struct transform_inst_if *transform)
2fe58dfd
SE
1043{
1044 struct msg0 m;
fe5e9cc4 1045 cstring_t transform_err;
2fe58dfd
SE
1046
1047 if (!unpick_msg0(st,msg5,&m)) return False;
1048
0afd257e 1049 if (call_transform_reverse(st,transform,msg5,&transform_err)) {
2fe58dfd 1050 /* There's a problem */
59635212 1051 slog(st,LOG_SEC,"process_msg5: transform: %s",transform_err);
2fe58dfd
SE
1052 return False;
1053 }
1054 /* Buffer should now contain untransformed PING packet data */
1055 CHECK_AVAIL(msg5,4);
59635212 1056 if (buf_unprepend_uint32(msg5)!=LABEL_MSG5) {
ff05a229 1057 slog(st,LOG_SEC,"MSG5/PING packet contained wrong label");
2fe58dfd
SE
1058 return False;
1059 }
ff7cdc9e
IJ
1060 /* Older versions of secnet used to write some config data here
1061 * which we ignore. So we don't CHECK_EMPTY */
2fe58dfd
SE
1062 return True;
1063}
1064
c90cc2a7
IJ
1065static void create_msg6(struct site *st, struct transform_inst_if *transform,
1066 uint32_t session_id)
2fe58dfd 1067{
fe5e9cc4 1068 cstring_t transform_err;
2fe58dfd
SE
1069
1070 BUF_ALLOC(&st->buffer,"site:MSG6");
ff05a229 1071 /* We are going to add four words to the message */
3abd18e8 1072 buffer_init(&st->buffer,calculate_max_start_pad());
794f2398
SE
1073 /* Give the netlink code an opportunity to put its own stuff in the
1074 message (configuration information, etc.) */
ff05a229 1075 buf_prepend_uint32(&st->buffer,LABEL_MSG6);
14f78812
IJ
1076 transform_apply_return problem =
1077 call_transform_forwards(st,transform,
1078 &st->buffer,&transform_err);
0afd257e 1079 assert(!problem);
59635212 1080 buf_prepend_uint32(&st->buffer,LABEL_MSG6);
58650a70 1081 buf_prepend_uint32(&st->buffer,st->index);
c90cc2a7
IJ
1082 buf_prepend_uint32(&st->buffer,session_id);
1083}
2fe58dfd 1084
c90cc2a7
IJ
1085static bool_t generate_msg6(struct site *st)
1086{
0afd257e
IJ
1087 if (!is_transform_valid(st->new_transform))
1088 return False;
c90cc2a7 1089 create_msg6(st,st->new_transform,st->setup_session_id);
ff05a229 1090 st->retries=1; /* Peer will retransmit MSG5 if this packet gets lost */
2fe58dfd
SE
1091 return True;
1092}
1093
1094static bool_t process_msg6(struct site *st, struct buffer_if *msg6,
a15faeb2 1095 const struct comm_addr *src)
2fe58dfd
SE
1096{
1097 struct msg0 m;
fe5e9cc4 1098 cstring_t transform_err;
2fe58dfd
SE
1099
1100 if (!unpick_msg0(st,msg6,&m)) return False;
1101
0afd257e 1102 if (call_transform_reverse(st,st->new_transform,msg6,&transform_err)) {
2fe58dfd 1103 /* There's a problem */
59635212 1104 slog(st,LOG_SEC,"process_msg6: transform: %s",transform_err);
2fe58dfd
SE
1105 return False;
1106 }
1107 /* Buffer should now contain untransformed PING packet data */
1108 CHECK_AVAIL(msg6,4);
59635212
SE
1109 if (buf_unprepend_uint32(msg6)!=LABEL_MSG6) {
1110 slog(st,LOG_SEC,"MSG6/PONG packet contained invalid data");
2fe58dfd
SE
1111 return False;
1112 }
ff7cdc9e
IJ
1113 /* Older versions of secnet used to write some config data here
1114 * which we ignore. So we don't CHECK_EMPTY */
2fe58dfd
SE
1115 return True;
1116}
1117
3cdb830c
IJ
1118static transform_apply_return
1119decrypt_msg0(struct site *st, struct buffer_if *msg0,
48b97423 1120 const struct comm_addr *src)
2fe58dfd 1121{
02b0959b 1122 cstring_t transform_err, auxkey_err, newkey_err="n/a";
065e1922 1123 struct msg0 m;
14f78812 1124 transform_apply_return problem;
2fe58dfd 1125
2fe58dfd
SE
1126 if (!unpick_msg0(st,msg0,&m)) return False;
1127
05f39b4d
IJ
1128 /* Keep a copy so we can try decrypting it with multiple keys */
1129 buffer_copy(&st->scratch, msg0);
1130
0afd257e
IJ
1131 problem = call_transform_reverse(st,st->current.transform,
1132 msg0,&transform_err);
02b0959b 1133 if (!problem) {
bd98cd6b
IJ
1134 if (!st->auxiliary_is_new)
1135 delete_one_key(st,&st->auxiliary_key,
1136 "peer has used new key","auxiliary key",LOG_SEC);
3cdb830c 1137 return 0;
02b0959b 1138 }
31dd0788
IJ
1139 if (transform_apply_return_badseq(problem))
1140 goto badseq;
07e4774c 1141
02b0959b 1142 buffer_copy(msg0, &st->scratch);
fcad4b0b
IJ
1143 problem = call_transform_reverse(st,st->auxiliary_key.transform,
1144 msg0,&auxkey_err);
14f78812 1145 if (!problem) {
02b0959b 1146 slog(st,LOG_DROP,"processing packet which uses auxiliary key");
bd98cd6b
IJ
1147 if (st->auxiliary_is_new) {
1148 /* We previously timed out in state SENTMSG5 but it turns
1149 * out that our peer did in fact get our MSG5 and is
1150 * using the new key. So we should switch to it too. */
1151 /* This is a bit like activate_new_key. */
1152 struct data_key t;
1153 t=st->current;
1154 st->current=st->auxiliary_key;
1155 st->auxiliary_key=t;
1156
1157 delete_one_key(st,&st->auxiliary_key,"peer has used new key",
1158 "previous key",LOG_SEC);
1159 st->auxiliary_is_new=0;
1160 st->renegotiate_key_time=st->auxiliary_renegotiate_key_time;
1161 }
3cdb830c 1162 return 0;
02b0959b 1163 }
31dd0788
IJ
1164 if (transform_apply_return_badseq(problem))
1165 goto badseq;
02b0959b 1166
05f39b4d
IJ
1167 if (st->state==SITE_SENTMSG5) {
1168 buffer_copy(msg0, &st->scratch);
0afd257e
IJ
1169 problem = call_transform_reverse(st,st->new_transform,
1170 msg0,&newkey_err);
48b97423 1171 if (!problem) {
05f39b4d
IJ
1172 /* It looks like we didn't get the peer's MSG6 */
1173 /* This is like a cut-down enter_new_state(SITE_RUN) */
1174 slog(st,LOG_STATE,"will enter state RUN (MSG0 with new key)");
1175 BUF_FREE(&st->buffer);
1176 st->timeout=0;
1177 activate_new_key(st);
3cdb830c 1178 return 0; /* do process the data in this packet */
05f39b4d 1179 }
31dd0788
IJ
1180 if (transform_apply_return_badseq(problem))
1181 goto badseq;
05f39b4d
IJ
1182 }
1183
02b0959b
IJ
1184 slog(st,LOG_SEC,"transform: %s (aux: %s, new: %s)",
1185 transform_err,auxkey_err,newkey_err);
dd9209d1 1186 initiate_key_setup(st,"incoming message would not decrypt",0);
48b97423 1187 send_nak(src,m.dest,m.source,m.type,msg0,"message would not decrypt");
3cdb830c
IJ
1188 assert(problem);
1189 return problem;
48b97423 1190
31dd0788
IJ
1191 badseq:
1192 slog(st,LOG_DROP,"transform: %s (bad seq.)",transform_err);
37acaef1
IJ
1193 assert(problem);
1194 return problem;
065e1922
IJ
1195}
1196
1197static bool_t process_msg0(struct site *st, struct buffer_if *msg0,
1198 const struct comm_addr *src)
1199{
1200 uint32_t type;
3cdb830c 1201 transform_apply_return problem;
065e1922 1202
3cdb830c 1203 problem = decrypt_msg0(st,msg0,src);
cbc25196
IJ
1204 if (problem==transform_apply_seqdupe) {
1205 /* We recently received another copy of this packet, maybe due
1206 * to polypath. That's not a problem; indeed, for the
1207 * purposes of transport address management it is a success.
1208 * But we don't want to process the packet. */
1209 transport_data_msgok(st,src);
1210 return False;
1211 }
3cdb830c 1212 if (problem)
065e1922
IJ
1213 return False;
1214
2fe58dfd 1215 CHECK_AVAIL(msg0,4);
59635212 1216 type=buf_unprepend_uint32(msg0);
2fe58dfd 1217 switch(type) {
794f2398
SE
1218 case LABEL_MSG7:
1219 /* We must forget about the current session. */
1d388569 1220 delete_keys(st,"request from peer",LOG_SEC);
e0d2e637
IJ
1221 /* probably, the peer is shutting down, and this is going to fail,
1222 * but we need to be trying to bring the link up again */
1223 if (st->keepalive)
1224 initiate_key_setup(st,"peer requested key teardown",0);
794f2398 1225 return True;
2fe58dfd
SE
1226 case LABEL_MSG9:
1227 /* Deliver to netlink layer */
469fd1d9 1228 st->netlink->deliver(st->netlink->st,msg0);
446353cd 1229 transport_data_msgok(st,src);
837cf01e
IJ
1230 /* See whether we should start negotiating a new key */
1231 if (st->now > st->renegotiate_key_time)
dd9209d1 1232 initiate_key_setup(st,"incoming packet in renegotiation window",0);
2fe58dfd 1233 return True;
2fe58dfd 1234 default:
ff05a229
SE
1235 slog(st,LOG_SEC,"incoming encrypted message of type %08x "
1236 "(unknown)",type);
2fe58dfd
SE
1237 break;
1238 }
1239 return False;
1240}
1241
1242static void dump_packet(struct site *st, struct buffer_if *buf,
62846523
IJ
1243 const struct comm_addr *addr, bool_t incoming,
1244 bool_t ok)
2fe58dfd 1245{
0a6cbade
IJ
1246 uint32_t dest=get_uint32(buf->start);
1247 uint32_t source=get_uint32(buf->start+4);
1248 uint32_t msgtype=get_uint32(buf->start+8);
2fe58dfd
SE
1249
1250 if (st->log_events & LOG_DUMP)
62846523 1251 slilog(st->log,M_DEBUG,"%s: %s: %08x<-%08x: %08x: %s%s",
040ee979 1252 st->tunname,incoming?"incoming":"outgoing",
62846523
IJ
1253 dest,source,msgtype,comm_addr_to_string(addr),
1254 ok?"":" - fail");
2fe58dfd
SE
1255}
1256
eff48c12
IJ
1257static bool_t comm_addr_sendmsg(struct site *st,
1258 const struct comm_addr *dest,
1259 struct buffer_if *buf)
1260{
5dfe538b
IJ
1261 int i;
1262 struct comm_clientinfo *commclientinfo = 0;
1263
1264 for (i=0; i < st->ncomms; i++) {
1265 if (st->comms[i] == dest->comm) {
1266 commclientinfo = st->commclientinfos[i];
1267 break;
1268 }
1269 }
1270 return dest->comm->sendmsg(dest->comm->st, buf, dest, commclientinfo);
eff48c12
IJ
1271}
1272
2fe58dfd
SE
1273static uint32_t site_status(void *st)
1274{
1275 return 0;
1276}
1277
1278static bool_t send_msg(struct site *st)
1279{
1280 if (st->retries>0) {
446353cd 1281 transport_xmit(st, &st->setup_peers, &st->buffer, True);
e7f8ec2a 1282 st->timeout=st->now+st->setup_retry_interval;
2fe58dfd
SE
1283 st->retries--;
1284 return True;
bd98cd6b 1285 } else if (st->state==SITE_SENTMSG5) {
4f3c75ac 1286 logtimeout(st,"timed out sending MSG5, stashing new key");
bd98cd6b
IJ
1287 /* We stash the key we have produced, in case it turns out that
1288 * our peer did see our MSG5 after all and starts using it. */
1289 /* This is a bit like some of activate_new_key */
1290 struct transform_inst_if *t;
1291 t=st->auxiliary_key.transform;
1292 st->auxiliary_key.transform=st->new_transform;
1293 st->new_transform=t;
0afd257e 1294 dispose_transform(&st->new_transform);
bd98cd6b 1295
bd98cd6b
IJ
1296 st->auxiliary_is_new=1;
1297 st->auxiliary_key.key_timeout=st->now+st->key_lifetime;
1298 st->auxiliary_renegotiate_key_time=st->now+st->key_renegotiate_time;
1299 st->auxiliary_key.remote_session_id=st->setup_session_id;
1300
1301 enter_state_wait(st);
1302 return False;
2fe58dfd 1303 } else {
4f3c75ac 1304 logtimeout(st,"timed out sending key setup packet "
3454dce4 1305 "(in state %s)",state_name(st->state));
2fe58dfd
SE
1306 enter_state_wait(st);
1307 return False;
1308 }
1309}
1310
cc420616 1311static void site_resolve_callback(void *sst, const struct comm_addr *addrs,
83dbdd3f 1312 int stored_naddrs, int all_naddrs,
bc07424d 1313 const char *address, const char *failwhy)
2fe58dfd
SE
1314{
1315 struct site *st=sst;
1316
83dbdd3f
IJ
1317 if (!stored_naddrs) {
1318 slog(st,LOG_ERROR,"resolution of %s failed: %s",address,failwhy);
1319 } else {
1320 slog(st,LOG_PEER_ADDRS,"resolution of %s completed, %d addrs, eg: %s",
1321 address, all_naddrs, comm_addr_to_string(&addrs[0]));;
1322
1323 int space=st->transport_peers_max-st->resolving_n_results_stored;
1324 int n_tocopy=MIN(stored_naddrs,space);
1325 COPY_ARRAY(st->resolving_results + st->resolving_n_results_stored,
1326 addrs,
1327 n_tocopy);
1328 st->resolving_n_results_stored += n_tocopy;
1329 st->resolving_n_results_all += all_naddrs;
1330 }
1331
1332 decrement_resolving_count(st,1);
1333}
1334
1335static void decrement_resolving_count(struct site *st, int by)
1336{
1337 assert(st->resolving_count>0);
1338 st->resolving_count-=by;
1339
1340 if (st->resolving_count)
1341 return;
1342
1343 /* OK, we are done with them all. Handle combined results. */
1344
1345 const struct comm_addr *addrs=st->resolving_results;
1346 int naddrs=st->resolving_n_results_stored;
1347 assert(naddrs<=st->transport_peers_max);
5c19b79c 1348
cc420616 1349 if (naddrs) {
83dbdd3f 1350 if (naddrs != st->resolving_n_results_all) {
cc420616
IJ
1351 slog(st,LOG_SETUP_INIT,"resolution of supplied addresses/names"
1352 " yielded too many results (%d > %d), some ignored",
83dbdd3f 1353 st->resolving_n_results_all, naddrs);
cc420616 1354 }
83dbdd3f 1355 slog(st,LOG_STATE,"resolution completed, %d addrs, eg: %s",
d9d101ea 1356 naddrs, iaddr_to_string(&addrs[0].ia));;
446353cd 1357 }
c22c3541
IJ
1358
1359 switch (st->state) {
1360 case SITE_RESOLVE:
45a14422 1361 if (transport_compute_setupinit_peers(st,addrs,naddrs,0)) {
c22c3541
IJ
1362 enter_new_state(st,SITE_SENTMSG1);
1363 } else {
1364 /* Can't figure out who to try to to talk to */
1365 slog(st,LOG_SETUP_INIT,
1366 "key exchange failed: cannot find peer address");
1367 enter_state_run(st);
1368 }
1369 break;
1370 case SITE_SENTMSG1: case SITE_SENTMSG2:
1371 case SITE_SENTMSG3: case SITE_SENTMSG4:
1372 case SITE_SENTMSG5:
45a14422 1373 if (naddrs) {
c22c3541
IJ
1374 /* We start using the address immediately for data too.
1375 * It's best to store it in st->peers now because we might
1376 * go via SENTMSG5, WAIT, and a MSG0, straight into using
1377 * the new key (without updating the data peer addrs). */
45a14422 1378 transport_resolve_complete(st,addrs,naddrs);
c22c3541
IJ
1379 } else if (st->local_mobile) {
1380 /* We can't let this rest because we may have a peer
1381 * address which will break in the future. */
83dbdd3f
IJ
1382 slog(st,LOG_SETUP_INIT,"resolution failed: "
1383 "abandoning key exchange");
c22c3541
IJ
1384 enter_state_wait(st);
1385 } else {
83dbdd3f 1386 slog(st,LOG_SETUP_INIT,"resolution failed: "
c22c3541 1387 " continuing to use source address of peer's packets"
83dbdd3f 1388 " for key exchange and ultimately data");
c22c3541
IJ
1389 }
1390 break;
1391 case SITE_RUN:
45a14422 1392 if (naddrs) {
83dbdd3f
IJ
1393 slog(st,LOG_SETUP_INIT,"resolution completed tardily,"
1394 " updating peer address(es)");
45a14422 1395 transport_resolve_complete_tardy(st,addrs,naddrs);
c22c3541
IJ
1396 } else if (st->local_mobile) {
1397 /* Not very good. We should queue (another) renegotiation
1398 * so that we can update the peer address. */
f7a86234 1399 st->key_renegotiate_time=st->now+wait_timeout(st);
c22c3541 1400 } else {
83dbdd3f
IJ
1401 slog(st,LOG_SETUP_INIT,"resolution failed: "
1402 " continuing to use source address of peer's packets");
c22c3541
IJ
1403 }
1404 break;
1405 case SITE_WAIT:
1406 case SITE_STOP:
1407 /* oh well */
1408 break;
2fe58dfd
SE
1409 }
1410}
1411
dd9209d1
IJ
1412static bool_t initiate_key_setup(struct site *st, cstring_t reason,
1413 const struct comm_addr *prod_hint)
9d3a4132 1414{
77effe1d 1415 /* Reentrancy hazard: can call enter_new_state/enter_state_* */
9d3a4132 1416 if (st->state!=SITE_RUN) return False;
794f2398 1417 slog(st,LOG_SETUP_INIT,"initiating key exchange (%s)",reason);
83dbdd3f
IJ
1418 if (st->addresses) {
1419 slog(st,LOG_SETUP_INIT,"resolving peer address(es)");
9d3a4132 1420 return enter_state_resolve(st);
45a14422 1421 } else if (transport_compute_setupinit_peers(st,0,0,prod_hint)) {
ff05a229 1422 return enter_new_state(st,SITE_SENTMSG1);
9d3a4132 1423 }
ff05a229 1424 slog(st,LOG_SETUP_INIT,"key exchange failed: no address for peer");
9d3a4132
SE
1425 return False;
1426}
1427
2fe58dfd
SE
1428static void activate_new_key(struct site *st)
1429{
1430 struct transform_inst_if *t;
1431
02b0959b
IJ
1432 /* We have three transform instances, which we swap between old,
1433 active and setup */
1434 t=st->auxiliary_key.transform;
1435 st->auxiliary_key.transform=st->current.transform;
19e9a588 1436 st->current.transform=st->new_transform;
2fe58dfd 1437 st->new_transform=t;
0afd257e 1438 dispose_transform(&st->new_transform);
2fe58dfd 1439
2fe58dfd 1440 st->timeout=0;
bd98cd6b 1441 st->auxiliary_is_new=0;
02b0959b 1442 st->auxiliary_key.key_timeout=st->current.key_timeout;
19e9a588 1443 st->current.key_timeout=st->now+st->key_lifetime;
ff05a229 1444 st->renegotiate_key_time=st->now+st->key_renegotiate_time;
446353cd 1445 transport_peers_copy(st,&st->peers,&st->setup_peers);
19e9a588 1446 st->current.remote_session_id=st->setup_session_id;
2fe58dfd 1447
3ed1846a
IJ
1448 /* Compute the inter-site MTU. This is min( our_mtu, their_mtu ).
1449 * But their mtu be unspecified, in which case we just use ours. */
1450 uint32_t intersite_mtu=
1451 MIN(st->mtu_target, st->remote_adv_mtu ?: ~(uint32_t)0);
1452 st->netlink->set_mtu(st->netlink->st,intersite_mtu);
1453
1454 slog(st,LOG_ACTIVATE_KEY,"new key activated"
1455 " (mtu ours=%"PRId32" theirs=%"PRId32" intersite=%"PRId32")",
1456 st->mtu_target, st->remote_adv_mtu, intersite_mtu);
9d3a4132 1457 enter_state_run(st);
2fe58dfd
SE
1458}
1459
1d388569
IJ
1460static void delete_one_key(struct site *st, struct data_key *key,
1461 cstring_t reason, cstring_t which, uint32_t loglevel)
1462{
0afd257e 1463 if (!is_transform_valid(key->transform)) return;
1d388569 1464 if (reason) slog(st,loglevel,"%s deleted (%s)",which,reason);
0afd257e 1465 dispose_transform(&key->transform);
1d388569
IJ
1466 key->key_timeout=0;
1467}
1468
1469static void delete_keys(struct site *st, cstring_t reason, uint32_t loglevel)
794f2398 1470{
3d8d8f4e 1471 if (current_valid(st)) {
794f2398
SE
1472 slog(st,loglevel,"session closed (%s)",reason);
1473
1d388569 1474 delete_one_key(st,&st->current,0,0,0);
794f2398
SE
1475 set_link_quality(st);
1476 }
02b0959b 1477 delete_one_key(st,&st->auxiliary_key,0,0,0);
794f2398
SE
1478}
1479
2fe58dfd
SE
1480static void state_assert(struct site *st, bool_t ok)
1481{
4f5e39ec 1482 if (!ok) fatal("site:state_assert");
2fe58dfd
SE
1483}
1484
1485static void enter_state_stop(struct site *st)
1486{
1487 st->state=SITE_STOP;
1488 st->timeout=0;
1d388569 1489 delete_keys(st,"entering state STOP",LOG_TIMEOUT_KEY);
0afd257e 1490 dispose_transform(&st->new_transform);
2fe58dfd
SE
1491}
1492
9d3a4132
SE
1493static void set_link_quality(struct site *st)
1494{
1495 uint32_t quality;
3d8d8f4e 1496 if (current_valid(st))
9d3a4132
SE
1497 quality=LINK_QUALITY_UP;
1498 else if (st->state==SITE_WAIT || st->state==SITE_STOP)
1499 quality=LINK_QUALITY_DOWN;
83dbdd3f 1500 else if (st->addresses)
9d3a4132 1501 quality=LINK_QUALITY_DOWN_CURRENT_ADDRESS;
446353cd 1502 else if (transport_peers_valid(&st->peers))
9d3a4132
SE
1503 quality=LINK_QUALITY_DOWN_STALE_ADDRESS;
1504 else
1505 quality=LINK_QUALITY_DOWN;
1506
469fd1d9 1507 st->netlink->set_quality(st->netlink->st,quality);
9d3a4132
SE
1508}
1509
2fe58dfd
SE
1510static void enter_state_run(struct site *st)
1511{
c02fba3b
IJ
1512 slog(st,LOG_STATE,"entering state RUN%s",
1513 current_valid(st) ? " (keyed)" : " (unkeyed)");
2fe58dfd
SE
1514 st->state=SITE_RUN;
1515 st->timeout=0;
9d3a4132 1516
ff05a229 1517 st->setup_session_id=0;
446353cd 1518 transport_peers_clear(st,&st->setup_peers);
4f28e77e
IJ
1519 FILLZERO(st->localN);
1520 FILLZERO(st->remoteN);
0afd257e 1521 dispose_transform(&st->new_transform);
088f80a1
MW
1522 if (st->dhsecret) {
1523 memset(st->dhsecret, 0, st->dh->secret_len);
1524 free(st->dhsecret);
1525 st->dhsecret = 0;
1526 }
1527 if (st->sharedsecret) {
1528 memset(st->sharedsecret, 0, st->dh->shared_len);
1529 free(st->sharedsecret);
1530 st->sharedsecret = 0;
1531 }
9d3a4132 1532 set_link_quality(st);
e6d6991c
IJ
1533
1534 if (st->keepalive && !current_valid(st))
1535 initiate_key_setup(st, "keepalive", 0);
2fe58dfd
SE
1536}
1537
5c19b79c
IJ
1538static bool_t ensure_resolving(struct site *st)
1539{
1540 /* Reentrancy hazard: may call site_resolve_callback and hence
1541 * enter_new_state, enter_state_* and generate_msg*. */
83dbdd3f 1542 if (st->resolving_count)
5c19b79c
IJ
1543 return True;
1544
83dbdd3f 1545 assert(st->addresses);
4ac8a7d2 1546
5c19b79c 1547 /* resolver->request might reentrantly call site_resolve_callback
83dbdd3f
IJ
1548 * which will decrement st->resolving, so we need to increment it
1549 * twice beforehand to prevent decrement from thinking we're
1550 * finished, and decrement it ourselves. Alternatively if
1551 * everything fails then there are no callbacks due and we simply
1552 * set it to 0 and return false.. */
1553 st->resolving_n_results_stored=0;
1554 st->resolving_n_results_all=0;
1555 st->resolving_count+=2;
1556 const char **addrp=st->addresses;
1557 const char *address;
1558 bool_t anyok=False;
1559 for (; (address=*addrp++); ) {
1560 bool_t ok = st->resolver->request(st->resolver->st,address,
1561 st->remoteport,st->comms[0],
1562 site_resolve_callback,st);
1563 if (ok)
1564 st->resolving_count++;
1565 anyok|=ok;
1566 }
1567 if (!anyok) {
1568 st->resolving_count=0;
1569 return False;
1570 }
1571 decrement_resolving_count(st,2);
1572 return True;
5c19b79c
IJ
1573}
1574
2fe58dfd
SE
1575static bool_t enter_state_resolve(struct site *st)
1576{
77effe1d 1577 /* Reentrancy hazard! See ensure_resolving. */
2fe58dfd
SE
1578 state_assert(st,st->state==SITE_RUN);
1579 slog(st,LOG_STATE,"entering state RESOLVE");
1580 st->state=SITE_RESOLVE;
5c19b79c 1581 return ensure_resolving(st);
2fe58dfd
SE
1582}
1583
ff05a229 1584static bool_t enter_new_state(struct site *st, uint32_t next)
2fe58dfd 1585{
ff05a229 1586 bool_t (*gen)(struct site *st);
3b83c932
SE
1587 int r;
1588
ff05a229
SE
1589 slog(st,LOG_STATE,"entering state %s",state_name(next));
1590 switch(next) {
1591 case SITE_SENTMSG1:
1592 state_assert(st,st->state==SITE_RUN || st->state==SITE_RESOLVE);
1593 gen=generate_msg1;
8b978d45 1594 st->msg1_crossed_logged = False;
ff05a229
SE
1595 break;
1596 case SITE_SENTMSG2:
1597 state_assert(st,st->state==SITE_RUN || st->state==SITE_RESOLVE ||
1598 st->state==SITE_SENTMSG1 || st->state==SITE_WAIT);
1599 gen=generate_msg2;
1600 break;
1601 case SITE_SENTMSG3:
1602 state_assert(st,st->state==SITE_SENTMSG1);
1603 BUF_FREE(&st->buffer);
1604 gen=generate_msg3;
1605 break;
1606 case SITE_SENTMSG4:
1607 state_assert(st,st->state==SITE_SENTMSG2);
1608 BUF_FREE(&st->buffer);
1609 gen=generate_msg4;
1610 break;
1611 case SITE_SENTMSG5:
1612 state_assert(st,st->state==SITE_SENTMSG3);
1613 BUF_FREE(&st->buffer);
1614 gen=generate_msg5;
1615 break;
1616 case SITE_RUN:
1617 state_assert(st,st->state==SITE_SENTMSG4);
1618 BUF_FREE(&st->buffer);
1619 gen=generate_msg6;
1620 break;
1621 default:
1622 gen=NULL;
4f5e39ec 1623 fatal("enter_new_state(%s): invalid new state",state_name(next));
ff05a229 1624 break;
2fe58dfd 1625 }
2fe58dfd 1626
3b83c932
SE
1627 if (hacky_par_start_failnow()) return False;
1628
1629 r= gen(st) && send_msg(st);
1630
1631 hacky_par_end(&r,
e7f8ec2a 1632 st->setup_retries, st->setup_retry_interval,
3b83c932
SE
1633 send_msg, st);
1634
1635 if (r) {
ff05a229
SE
1636 st->state=next;
1637 if (next==SITE_RUN) {
1638 BUF_FREE(&st->buffer); /* Never reused */
1639 st->timeout=0; /* Never retransmit */
1640 activate_new_key(st);
1641 }
2fe58dfd
SE
1642 return True;
1643 }
ff05a229
SE
1644 slog(st,LOG_ERROR,"error entering state %s",state_name(next));
1645 st->buffer.free=False; /* Unconditionally use the buffer; it may be
1646 in either state, and enter_state_wait() will
1647 do a BUF_FREE() */
2fe58dfd
SE
1648 enter_state_wait(st);
1649 return False;
1650}
1651
ff05a229 1652/* msg7 tells our peer that we're about to forget our key */
fe5e9cc4 1653static bool_t send_msg7(struct site *st, cstring_t reason)
794f2398 1654{
fe5e9cc4 1655 cstring_t transform_err;
794f2398 1656
3d8d8f4e 1657 if (current_valid(st) && st->buffer.free
446353cd 1658 && transport_peers_valid(&st->peers)) {
794f2398 1659 BUF_ALLOC(&st->buffer,"site:MSG7");
3abd18e8 1660 buffer_init(&st->buffer,calculate_max_start_pad());
794f2398
SE
1661 buf_append_uint32(&st->buffer,LABEL_MSG7);
1662 buf_append_string(&st->buffer,reason);
0afd257e
IJ
1663 if (call_transform_forwards(st, st->current.transform,
1664 &st->buffer, &transform_err))
1665 goto free_out;
794f2398 1666 buf_prepend_uint32(&st->buffer,LABEL_MSG0);
58650a70 1667 buf_prepend_uint32(&st->buffer,st->index);
19e9a588 1668 buf_prepend_uint32(&st->buffer,st->current.remote_session_id);
446353cd 1669 transport_xmit(st,&st->peers,&st->buffer,True);
794f2398 1670 BUF_FREE(&st->buffer);
0afd257e 1671 free_out:
794f2398
SE
1672 return True;
1673 }
1674 return False;
1675}
1676
2fe58dfd
SE
1677/* We go into this state if our peer becomes uncommunicative. Similar to
1678 the "stop" state, we forget all session keys for a while, before
1679 re-entering the "run" state. */
1680static void enter_state_wait(struct site *st)
1681{
1682 slog(st,LOG_STATE,"entering state WAIT");
f7a86234 1683 st->timeout=st->now+wait_timeout(st);
2fe58dfd 1684 st->state=SITE_WAIT;
9d3a4132 1685 set_link_quality(st);
2fe58dfd
SE
1686 BUF_FREE(&st->buffer); /* will have had an outgoing packet in it */
1687 /* XXX Erase keys etc. */
1688}
1689
dd9209d1
IJ
1690static void generate_prod(struct site *st, struct buffer_if *buf)
1691{
1692 buffer_init(buf,0);
1693 buf_append_uint32(buf,0);
1694 buf_append_uint32(buf,0);
1695 buf_append_uint32(buf,LABEL_PROD);
1696 buf_append_string(buf,st->localname);
1697 buf_append_string(buf,st->remotename);
1698}
1699
1700static void generate_send_prod(struct site *st,
1701 const struct comm_addr *source)
1702{
1703 if (!st->allow_send_prod) return; /* too soon */
1704 if (!(st->state==SITE_RUN || st->state==SITE_RESOLVE ||
1705 st->state==SITE_WAIT)) return; /* we'd ignore peer's MSG1 */
1706
1707 slog(st,LOG_SETUP_INIT,"prodding peer for key exchange");
1708 st->allow_send_prod=0;
1709 generate_prod(st,&st->scratch);
eff48c12 1710 bool_t ok = comm_addr_sendmsg(st, source, &st->scratch);
62846523 1711 dump_packet(st,&st->scratch,source,False,ok);
dd9209d1
IJ
1712}
1713
16f73fa6 1714static inline void site_settimeout(uint64_t timeout, int *timeout_io)
fe5e9cc4
SE
1715{
1716 if (timeout) {
0009e60a
IJ
1717 int64_t offset=timeout-*now;
1718 if (offset<0) offset=0;
fe5e9cc4
SE
1719 if (offset>INT_MAX) offset=INT_MAX;
1720 if (*timeout_io<0 || offset<*timeout_io)
1721 *timeout_io=offset;
1722 }
1723}
1724
2fe58dfd 1725static int site_beforepoll(void *sst, struct pollfd *fds, int *nfds_io,
90a39563 1726 int *timeout_io)
2fe58dfd
SE
1727{
1728 struct site *st=sst;
1729
ee697dd9 1730 BEFOREPOLL_WANT_FDS(0); /* We don't use any file descriptors */
2fe58dfd
SE
1731 st->now=*now;
1732
1733 /* Work out when our next timeout is. The earlier of 'timeout' or
19e9a588 1734 'current.key_timeout'. A stored value of '0' indicates no timeout
2fe58dfd 1735 active. */
16f73fa6 1736 site_settimeout(st->timeout, timeout_io);
19e9a588 1737 site_settimeout(st->current.key_timeout, timeout_io);
02b0959b 1738 site_settimeout(st->auxiliary_key.key_timeout, timeout_io);
2fe58dfd
SE
1739
1740 return 0; /* success */
1741}
1742
1d388569
IJ
1743static void check_expiry(struct site *st, struct data_key *key,
1744 const char *which)
1745{
1746 if (key->key_timeout && *now>key->key_timeout) {
1747 delete_one_key(st,key,"maximum life exceeded",which,LOG_TIMEOUT_KEY);
1748 }
1749}
1750
2fe58dfd 1751/* NB site_afterpoll will be called before site_beforepoll is ever called */
90a39563 1752static void site_afterpoll(void *sst, struct pollfd *fds, int nfds)
2fe58dfd
SE
1753{
1754 struct site *st=sst;
1755
1756 st->now=*now;
1757 if (st->timeout && *now>st->timeout) {
2fe58dfd 1758 st->timeout=0;
3b83c932
SE
1759 if (st->state>=SITE_SENTMSG1 && st->state<=SITE_SENTMSG5) {
1760 if (!hacky_par_start_failnow())
1761 send_msg(st);
1762 } else if (st->state==SITE_WAIT) {
2fe58dfd
SE
1763 enter_state_run(st);
1764 } else {
1765 slog(st,LOG_ERROR,"site_afterpoll: unexpected timeout, state=%d",
1766 st->state);
1767 }
1768 }
1d388569 1769 check_expiry(st,&st->current,"current key");
02b0959b 1770 check_expiry(st,&st->auxiliary_key,"auxiliary key");
2fe58dfd
SE
1771}
1772
1773/* This function is called by the netlink device to deliver packets
1774 intended for the remote network. The packet is in "raw" wire
1775 format, but is guaranteed to be word-aligned. */
469fd1d9 1776static void site_outgoing(void *sst, struct buffer_if *buf)
2fe58dfd
SE
1777{
1778 struct site *st=sst;
fe5e9cc4 1779 cstring_t transform_err;
2fe58dfd
SE
1780
1781 if (st->state==SITE_STOP) {
1782 BUF_FREE(buf);
1783 return;
1784 }
1785
dd9209d1
IJ
1786 st->allow_send_prod=1;
1787
2fe58dfd
SE
1788 /* In all other states we consider delivering the packet if we have
1789 a valid key and a valid address to send it to. */
3d8d8f4e 1790 if (current_valid(st) && transport_peers_valid(&st->peers)) {
2fe58dfd 1791 /* Transform it and send it */
70dc107b
SE
1792 if (buf->size>0) {
1793 buf_prepend_uint32(buf,LABEL_MSG9);
0afd257e
IJ
1794 if (call_transform_forwards(st, st->current.transform,
1795 buf, &transform_err))
1796 goto free_out;
70dc107b 1797 buf_prepend_uint32(buf,LABEL_MSG0);
58650a70 1798 buf_prepend_uint32(buf,st->index);
19e9a588 1799 buf_prepend_uint32(buf,st->current.remote_session_id);
446353cd 1800 transport_xmit(st,&st->peers,buf,False);
70dc107b 1801 }
0afd257e 1802 free_out:
2fe58dfd
SE
1803 BUF_FREE(buf);
1804 return;
1805 }
1806
70dc107b 1807 slog(st,LOG_DROP,"discarding outgoing packet of size %d",buf->size);
2fe58dfd 1808 BUF_FREE(buf);
dd9209d1 1809 initiate_key_setup(st,"outgoing packet",0);
2fe58dfd
SE
1810}
1811
7e29719e
IJ
1812static bool_t named_for_us(struct site *st, const struct buffer_if *buf_in,
1813 uint32_t type, struct msg *m)
1814 /* For packets which are identified by the local and remote names.
1815 * If it has our name and our peer's name in it it's for us. */
1816{
1817 struct buffer_if buf[1];
1818 buffer_readonly_clone(buf,buf_in);
1819 return unpick_msg(st,type,buf,m)
1820 && name_matches(&m->remote,st->remotename)
1821 && name_matches(&m->local,st->localname);
1822}
1823
67871f70 1824static bool_t we_have_priority(struct site *st, const struct msg *m) {
4c795bdb
MW
1825 if (st->local_capabilities & m->remote_capabilities &
1826 CAPAB_PRIORITY_MOBILE) {
b2de6bd2
IJ
1827 if (st->local_mobile) return True;
1828 if (st-> peer_mobile) return False;
1829 }
67871f70
IJ
1830 return st->our_name_later;
1831}
1832
db6534a3
IJ
1833static bool_t setup_late_msg_ok(struct site *st,
1834 const struct buffer_if *buf_in,
1835 uint32_t msgtype,
1836 const struct comm_addr *source) {
1837 /* For setup packets which seem from their type like they are
1838 * late. Maybe they came via a different path. All we do is make
1839 * a note of the sending address, iff they look like they are part
1840 * of the current key setup attempt. */
1841 struct msg m;
1842 if (!named_for_us(st,buf_in,msgtype,&m))
1843 /* named_for_us calls unpick_msg which gets the nonces */
1844 return False;
1845 if (!consttime_memeq(m.nR,st->remoteN,NONCELEN) ||
1846 !consttime_memeq(m.nL,st->localN, NONCELEN))
1847 /* spoof ? from stale run ? who knows */
1848 return False;
1849 transport_setup_msgok(st,source);
1850 return True;
1851}
1852
2fe58dfd 1853/* This function is called by the communication device to deliver
dd9209d1
IJ
1854 packets from our peers.
1855 It should return True if the packet is recognised as being for
1856 this current site instance (and should therefore not be processed
1857 by other sites), even if the packet was otherwise ignored. */
2fe58dfd 1858static bool_t site_incoming(void *sst, struct buffer_if *buf,
a15faeb2 1859 const struct comm_addr *source)
2fe58dfd
SE
1860{
1861 struct site *st=sst;
20138876
IJ
1862
1863 if (buf->size < 12) return False;
1864
0a6cbade
IJ
1865 uint32_t dest=get_uint32(buf->start);
1866 uint32_t msgtype=get_uint32(buf->start+8);
7e29719e
IJ
1867 struct msg named_msg;
1868
1869 if (msgtype==LABEL_MSG1) {
1870 if (!named_for_us(st,buf,msgtype,&named_msg))
1871 return False;
1872 /* It's a MSG1 addressed to us. Decide what to do about it. */
62846523 1873 dump_packet(st,buf,source,True,True);
7e29719e
IJ
1874 if (st->state==SITE_RUN || st->state==SITE_RESOLVE ||
1875 st->state==SITE_WAIT) {
1876 /* We should definitely process it */
45a14422 1877 transport_compute_setupinit_peers(st,0,0,source);
7e29719e
IJ
1878 if (process_msg1(st,buf,source,&named_msg)) {
1879 slog(st,LOG_SETUP_INIT,"key setup initiated by peer");
c22c3541 1880 bool_t entered=enter_new_state(st,SITE_SENTMSG2);
83dbdd3f 1881 if (entered && st->addresses && st->local_mobile)
c22c3541
IJ
1882 /* We must do this as the very last thing, because
1883 the resolver callback might reenter us. */
1884 ensure_resolving(st);
7e29719e
IJ
1885 } else {
1886 slog(st,LOG_ERROR,"failed to process incoming msg1");
1887 }
1888 BUF_FREE(buf);
1889 return True;
1890 } else if (st->state==SITE_SENTMSG1) {
1891 /* We've just sent a message 1! They may have crossed on
1892 the wire. If we have priority then we ignore the
1893 incoming one, otherwise we process it as usual. */
67871f70 1894 if (we_have_priority(st,&named_msg)) {
7e29719e 1895 BUF_FREE(buf);
8b978d45 1896 if (!st->msg1_crossed_logged++)
dea92314 1897 slog(st,LOG_SETUP_INIT,"crossed msg1s; we are higher "
8b978d45 1898 "priority => ignore incoming msg1");
7e29719e
IJ
1899 return True;
1900 } else {
dea92314 1901 slog(st,LOG_SETUP_INIT,"crossed msg1s; we are lower "
7e29719e
IJ
1902 "priority => use incoming msg1");
1903 if (process_msg1(st,buf,source,&named_msg)) {
1904 BUF_FREE(&st->buffer); /* Free our old message 1 */
c22c3541 1905 transport_setup_msgok(st,source);
ff05a229 1906 enter_new_state(st,SITE_SENTMSG2);
2fe58dfd 1907 } else {
7e29719e
IJ
1908 slog(st,LOG_ERROR,"failed to process an incoming "
1909 "crossed msg1 (we have low priority)");
2fe58dfd
SE
1910 }
1911 BUF_FREE(buf);
1912 return True;
2fe58dfd 1913 }
04c5c5d7
IJ
1914 } else if (st->state==SITE_SENTMSG2 ||
1915 st->state==SITE_SENTMSG4) {
1916 if (consttime_memeq(named_msg.nR,st->remoteN,NONCELEN)) {
1917 /* We are ahead in the protocol, but that msg1 had the
1918 * peer's nonce so presumably it is from this key
1919 * exchange run, via a slower route */
1920 transport_setup_msgok(st,source);
1921 } else {
1922 slog(st,LOG_UNEXPECTED,"competing incoming message 1");
1923 }
1924 BUF_FREE(buf);
1925 return True;
2fe58dfd 1926 }
7e29719e 1927 /* The message 1 was received at an unexpected stage of the
04c5c5d7 1928 key setup. Well, they lost the race. */
7e29719e
IJ
1929 slog(st,LOG_UNEXPECTED,"unexpected incoming message 1");
1930 BUF_FREE(buf);
1931 return True;
2fe58dfd 1932 }
dd9209d1
IJ
1933 if (msgtype==LABEL_PROD) {
1934 if (!named_for_us(st,buf,msgtype,&named_msg))
1935 return False;
62846523 1936 dump_packet(st,buf,source,True,True);
dd9209d1
IJ
1937 if (st->state!=SITE_RUN) {
1938 slog(st,LOG_DROP,"ignoring PROD when not in state RUN");
1939 } else if (current_valid(st)) {
1940 slog(st,LOG_DROP,"ignoring PROD when we think we have a key");
1941 } else {
1942 initiate_key_setup(st,"peer sent PROD packet",source);
1943 }
1944 BUF_FREE(buf);
1945 return True;
1946 }
58650a70 1947 if (dest==st->index) {
2fe58dfd 1948 /* Explicitly addressed to us */
62846523 1949 if (msgtype!=LABEL_MSG0) dump_packet(st,buf,source,True,True);
2fe58dfd 1950 switch (msgtype) {
136740e6 1951 case LABEL_NAK:
794f2398
SE
1952 /* If the source is our current peer then initiate a key setup,
1953 because our peer's forgotten the key */
19e9a588 1954 if (get_uint32(buf->start+4)==st->current.remote_session_id) {
dd9209d1 1955 bool_t initiated;
e5e67212 1956 initiated = initiate_key_setup(st,"received a NAK",source);
dd9209d1 1957 if (!initiated) generate_send_prod(st,source);
794f2398
SE
1958 } else {
1959 slog(st,LOG_SEC,"bad incoming NAK");
1960 }
1961 break;
2fe58dfd
SE
1962 case LABEL_MSG0:
1963 process_msg0(st,buf,source);
1964 break;
1965 case LABEL_MSG1:
1966 /* Setup packet: should not have been explicitly addressed
1967 to us */
59635212 1968 slog(st,LOG_SEC,"incoming explicitly addressed msg1");
2fe58dfd
SE
1969 break;
1970 case LABEL_MSG2:
1971 /* Setup packet: expected only in state SENTMSG1 */
1972 if (st->state!=SITE_SENTMSG1) {
db6534a3
IJ
1973 if ((st->state==SITE_SENTMSG3 ||
1974 st->state==SITE_SENTMSG5) &&
1975 setup_late_msg_ok(st,buf,msgtype,source))
1976 break;
2fe58dfd 1977 slog(st,LOG_UNEXPECTED,"unexpected MSG2");
446353cd
IJ
1978 } else if (process_msg2(st,buf,source)) {
1979 transport_setup_msgok(st,source);
ff05a229 1980 enter_new_state(st,SITE_SENTMSG3);
446353cd 1981 } else {
59635212 1982 slog(st,LOG_SEC,"invalid MSG2");
2fe58dfd
SE
1983 }
1984 break;
0fa27fb3 1985 case CASES_MSG3_KNOWN:
2fe58dfd
SE
1986 /* Setup packet: expected only in state SENTMSG2 */
1987 if (st->state!=SITE_SENTMSG2) {
db6534a3
IJ
1988 if ((st->state==SITE_SENTMSG4) &&
1989 setup_late_msg_ok(st,buf,msgtype,source))
1990 break;
2fe58dfd 1991 slog(st,LOG_UNEXPECTED,"unexpected MSG3");
5b5f297f 1992 } else if (process_msg3(st,buf,source,msgtype)) {
446353cd 1993 transport_setup_msgok(st,source);
ff05a229 1994 enter_new_state(st,SITE_SENTMSG4);
446353cd 1995 } else {
59635212 1996 slog(st,LOG_SEC,"invalid MSG3");
2fe58dfd
SE
1997 }
1998 break;
1999 case LABEL_MSG4:
2000 /* Setup packet: expected only in state SENTMSG3 */
2001 if (st->state!=SITE_SENTMSG3) {
db6534a3
IJ
2002 if ((st->state==SITE_SENTMSG5) &&
2003 setup_late_msg_ok(st,buf,msgtype,source))
2004 break;
2fe58dfd 2005 slog(st,LOG_UNEXPECTED,"unexpected MSG4");
446353cd
IJ
2006 } else if (process_msg4(st,buf,source)) {
2007 transport_setup_msgok(st,source);
ff05a229 2008 enter_new_state(st,SITE_SENTMSG5);
446353cd 2009 } else {
59635212 2010 slog(st,LOG_SEC,"invalid MSG4");
2fe58dfd
SE
2011 }
2012 break;
2013 case LABEL_MSG5:
4efd681a
SE
2014 /* Setup packet: expected only in state SENTMSG4 */
2015 /* (may turn up in state RUN if our return MSG6 was lost
2016 and the new key has already been activated. In that
05f39b4d
IJ
2017 case we discard it. The peer will realise that we
2018 are using the new key when they see our data packets.
2019 Until then the peer's data packets to us get discarded. */
c90cc2a7
IJ
2020 if (st->state==SITE_SENTMSG4) {
2021 if (process_msg5(st,buf,source,st->new_transform)) {
2022 transport_setup_msgok(st,source);
2023 enter_new_state(st,SITE_RUN);
2024 } else {
2025 slog(st,LOG_SEC,"invalid MSG5");
2026 }
2027 } else if (st->state==SITE_RUN) {
19e9a588 2028 if (process_msg5(st,buf,source,st->current.transform)) {
c90cc2a7
IJ
2029 slog(st,LOG_DROP,"got MSG5, retransmitting MSG6");
2030 transport_setup_msgok(st,source);
19e9a588
IJ
2031 create_msg6(st,st->current.transform,
2032 st->current.remote_session_id);
c90cc2a7
IJ
2033 transport_xmit(st,&st->peers,&st->buffer,True);
2034 BUF_FREE(&st->buffer);
2035 } else {
2036 slog(st,LOG_SEC,"invalid MSG5 (in state RUN)");
2037 }
2fe58dfd 2038 } else {
c90cc2a7 2039 slog(st,LOG_UNEXPECTED,"unexpected MSG5");
2fe58dfd
SE
2040 }
2041 break;
2042 case LABEL_MSG6:
2043 /* Setup packet: expected only in state SENTMSG5 */
2044 if (st->state!=SITE_SENTMSG5) {
2045 slog(st,LOG_UNEXPECTED,"unexpected MSG6");
2046 } else if (process_msg6(st,buf,source)) {
2047 BUF_FREE(&st->buffer); /* Free message 5 */
446353cd 2048 transport_setup_msgok(st,source);
2fe58dfd
SE
2049 activate_new_key(st);
2050 } else {
59635212 2051 slog(st,LOG_SEC,"invalid MSG6");
2fe58dfd
SE
2052 }
2053 break;
2fe58dfd 2054 default:
59635212 2055 slog(st,LOG_SEC,"received message of unknown type 0x%08x",
2fe58dfd
SE
2056 msgtype);
2057 break;
2058 }
2059 BUF_FREE(buf);
2060 return True;
2061 }
2062
2063 return False;
2064}
2065
2066static void site_control(void *vst, bool_t run)
2067{
2068 struct site *st=vst;
2069 if (run) enter_state_run(st);
2070 else enter_state_stop(st);
2071}
2072
794f2398
SE
2073static void site_phase_hook(void *sst, uint32_t newphase)
2074{
2075 struct site *st=sst;
2076
2077 /* The program is shutting down; tell our peer */
2078 send_msg7(st,"shutting down");
2079}
2080
32654a31
IJ
2081static void site_childpersist_clearkeys(void *sst, uint32_t newphase)
2082{
2083 struct site *st=sst;
2084 dispose_transform(&st->current.transform);
2085 dispose_transform(&st->auxiliary_key.transform);
2086 dispose_transform(&st->new_transform);
2087 /* Not much point overwiting the signing key, since we loaded it
2088 from disk, and it is only valid prospectively if at all,
2089 anyway. */
2090 /* XXX it would be best to overwrite the DH state, because that
2091 _is_ relevant to forward secrecy. However we have no
2092 convenient interface for doing that and in practice gmp has
2093 probably dribbled droppings all over the malloc arena. A good
2094 way to fix this would be to have a privsep child for asymmetric
2095 crypto operations, but that's a task for another day. */
2096}
2097
2fe58dfd
SE
2098static list_t *site_apply(closure_t *self, struct cloc loc, dict_t *context,
2099 list_t *args)
2100{
58650a70 2101 static uint32_t index_sequence;
2fe58dfd
SE
2102 struct site *st;
2103 item_t *item;
2104 dict_t *dict;
59533c16 2105 int i;
2fe58dfd 2106
b7886fd4 2107 NEW(st);
2fe58dfd
SE
2108
2109 st->cl.description="site";
2110 st->cl.type=CL_SITE;
2111 st->cl.apply=NULL;
2112 st->cl.interface=&st->ops;
2113 st->ops.st=st;
2114 st->ops.control=site_control;
2115 st->ops.status=site_status;
2116
2117 /* First parameter must be a dict */
2118 item=list_elem(args,0);
2119 if (!item || item->type!=t_dict)
2120 cfgfatal(loc,"site","parameter must be a dictionary\n");
2121
2122 dict=item->data.dict;
558fa3fb
SE
2123 st->localname=dict_read_string(dict, "local-name", True, "site", loc);
2124 st->remotename=dict_read_string(dict, "name", True, "site", loc);
dba19f84 2125
e6d6991c
IJ
2126 st->keepalive=dict_read_bool(dict,"keepalive",False,"site",loc,False);
2127
dba19f84 2128 st->peer_mobile=dict_read_bool(dict,"mobile",False,"site",loc,False);
0391d9ee 2129 st->local_mobile=
dba19f84
IJ
2130 dict_read_bool(dict,"local-mobile",False,"site",loc,False);
2131
558fa3fb
SE
2132 /* Sanity check (which also allows the 'sites' file to include
2133 site() closures for all sites including our own): refuse to
2134 talk to ourselves */
2135 if (strcmp(st->localname,st->remotename)==0) {
b2a56f7c 2136 Message(M_DEBUG,"site %s: local-name==name -> ignoring this site\n",
baa06aeb 2137 st->localname);
0391d9ee 2138 if (st->peer_mobile != st->local_mobile)
dba19f84
IJ
2139 cfgfatal(loc,"site","site %s's peer-mobile=%d"
2140 " but our local-mobile=%d\n",
0391d9ee 2141 st->localname, st->peer_mobile, st->local_mobile);
dba19f84
IJ
2142 free(st);
2143 return NULL;
2144 }
0391d9ee 2145 if (st->peer_mobile && st->local_mobile) {
dba19f84
IJ
2146 Message(M_WARNING,"site %s: site is mobile but so are we"
2147 " -> ignoring this site\n", st->remotename);
558fa3fb
SE
2148 free(st);
2149 return NULL;
2150 }
dba19f84 2151
58650a70
RK
2152 assert(index_sequence < 0xffffffffUL);
2153 st->index = ++index_sequence;
09a385fb 2154 st->local_capabilities = 0;
5d903efd 2155 st->early_capabilities = CAPAB_PRIORITY_MOBILE;
469fd1d9 2156 st->netlink=find_cl_if(dict,"link",CL_NETLINK,True,"site",loc);
59533c16 2157
5b5f297f
IJ
2158#define GET_CLOSURE_LIST(dictkey,things,nthings,CL_TYPE) do{ \
2159 list_t *things##_cfg=dict_lookup(dict,dictkey); \
2160 if (!things##_cfg) \
2161 cfgfatal(loc,"site","closure list \"%s\" not found\n",dictkey); \
2162 st->nthings=list_length(things##_cfg); \
b4ececfc 2163 NEW_ARY(st->things,st->nthings); \
5b5f297f
IJ
2164 assert(st->nthings); \
2165 for (i=0; i<st->nthings; i++) { \
2166 item_t *item=list_elem(things##_cfg,i); \
2167 if (item->type!=t_closure) \
2168 cfgfatal(loc,"site","%s is not a closure\n",dictkey); \
2169 closure_t *cl=item->data.closure; \
2170 if (cl->type!=CL_TYPE) \
2171 cfgfatal(loc,"site","%s closure wrong type\n",dictkey); \
2172 st->things[i]=cl->interface; \
2173 } \
2174}while(0)
2175
2176 GET_CLOSURE_LIST("comm",comms,ncomms,CL_COMM);
59533c16 2177
5dfe538b
IJ
2178 NEW_ARY(st->commclientinfos, st->ncomms);
2179 dict_t *comminfo = dict_read_dict(dict,"comm-info",False,"site",loc);
2180 for (i=0; i<st->ncomms; i++) {
2181 st->commclientinfos[i] =
2182 !comminfo ? 0 :
2183 st->comms[i]->clientinfo(st->comms[i],comminfo,loc);
2184 }
2185
2fe58dfd
SE
2186 st->resolver=find_cl_if(dict,"resolver",CL_RESOLVER,True,"site",loc);
2187 st->log=find_cl_if(dict,"log",CL_LOG,True,"site",loc);
2188 st->random=find_cl_if(dict,"random",CL_RANDOMSRC,True,"site",loc);
2189
2fe58dfd 2190 st->privkey=find_cl_if(dict,"local-key",CL_RSAPRIVKEY,True,"site",loc);
83dbdd3f
IJ
2191 st->addresses=dict_read_string_array(dict,"address",False,"site",loc,0);
2192 if (st->addresses)
3454dce4
SE
2193 st->remoteport=dict_read_number(dict,"port",True,"site",loc,0);
2194 else st->remoteport=0;
2fe58dfd
SE
2195 st->pubkey=find_cl_if(dict,"key",CL_RSAPUBKEY,True,"site",loc);
2196
5b5f297f 2197 GET_CLOSURE_LIST("transform",transforms,ntransforms,CL_TRANSFORM);
2fe58dfd
SE
2198
2199 st->dh=find_cl_if(dict,"dh",CL_DH,True,"site",loc);
2200 st->hash=find_cl_if(dict,"hash",CL_HASH,True,"site",loc);
2201
0391d9ee 2202#define DEFAULT(D) (st->peer_mobile || st->local_mobile \
e57264d6 2203 ? DEFAULT_MOBILE_##D : DEFAULT_##D)
e7f8ec2a 2204#define CFG_NUMBER(k,D) dict_read_number(dict,(k),False,"site",loc,DEFAULT(D));
c27ca22f 2205
e7f8ec2a
IJ
2206 st->key_lifetime= CFG_NUMBER("key-lifetime", KEY_LIFETIME);
2207 st->setup_retries= CFG_NUMBER("setup-retries", SETUP_RETRIES);
2208 st->setup_retry_interval= CFG_NUMBER("setup-timeout", SETUP_RETRY_INTERVAL);
f7a86234 2209 st->wait_timeout_mean= CFG_NUMBER("wait-time", WAIT_TIME);
3ed1846a 2210 st->mtu_target= dict_read_number(dict,"mtu-target",False,"site",loc,0);
e7f8ec2a 2211
446353cd
IJ
2212 st->mobile_peer_expiry= dict_read_number(
2213 dict,"mobile-peer-expiry",False,"site",loc,DEFAULT_MOBILE_PEER_EXPIRY);
2214
0f27325c
IJ
2215 const char *peerskey= st->peer_mobile
2216 ? "mobile-peers-max" : "static-peers-max";
2217 st->transport_peers_max= dict_read_number(
83dbdd3f 2218 dict,peerskey,False,"site",loc, st->addresses ? 4 : 3);
446353cd 2219 if (st->transport_peers_max<1 ||
0f27325c
IJ
2220 st->transport_peers_max>MAX_PEER_ADDRS) {
2221 cfgfatal(loc,"site", "%s must be in range 1.."
2222 STRING(MAX_PEER_ADDRS) "\n", peerskey);
446353cd
IJ
2223 }
2224
e7f8ec2a 2225 if (st->key_lifetime < DEFAULT(KEY_RENEGOTIATE_GAP)*2)
c27ca22f
IJ
2226 st->key_renegotiate_time=st->key_lifetime/2;
2227 else
e7f8ec2a 2228 st->key_renegotiate_time=st->key_lifetime-DEFAULT(KEY_RENEGOTIATE_GAP);
9d3a4132 2229 st->key_renegotiate_time=dict_read_number(
cce0051f 2230 dict,"renegotiate-time",False,"site",loc,st->key_renegotiate_time);
9d3a4132
SE
2231 if (st->key_renegotiate_time > st->key_lifetime) {
2232 cfgfatal(loc,"site",
2233 "renegotiate-time must be less than key-lifetime\n");
2234 }
9d3a4132
SE
2235
2236 st->log_events=string_list_to_word(dict_lookup(dict,"log-events"),
2237 log_event_table,"site");
2fe58dfd 2238
83dbdd3f 2239 st->resolving_count=0;
dd9209d1
IJ
2240 st->allow_send_prod=0;
2241
4efd681a
SE
2242 st->tunname=safe_malloc(strlen(st->localname)+strlen(st->remotename)+5,
2243 "site_apply");
2244 sprintf(st->tunname,"%s<->%s",st->localname,st->remotename);
2245
2fe58dfd 2246 /* The information we expect to see in incoming messages of type 1 */
59230b9b
IJ
2247 /* fixme: lots of unchecked overflows here, but the results are only
2248 corrupted packets rather than undefined behaviour */
ffafab08 2249 st->our_name_later=(strcmp(st->localname,st->remotename)>0);
2fe58dfd
SE
2250
2251 buffer_new(&st->buffer,SETUP_BUFFER_LEN);
2252
8aaaa634 2253 buffer_new(&st->scratch,SETUP_BUFFER_LEN);
05f39b4d
IJ
2254 BUF_ALLOC(&st->scratch,"site:scratch");
2255
2fe58dfd
SE
2256 /* We are interested in poll(), but only for timeouts. We don't have
2257 any fds of our own. */
32fc582f 2258 register_for_poll(st, site_beforepoll, site_afterpoll, "site");
2fe58dfd
SE
2259 st->timeout=0;
2260
09a385fb 2261 st->remote_capabilities=0;
5b5f297f 2262 st->chosen_transform=0;
19e9a588 2263 st->current.key_timeout=0;
02b0959b 2264 st->auxiliary_key.key_timeout=0;
446353cd
IJ
2265 transport_peers_clear(st,&st->peers);
2266 transport_peers_clear(st,&st->setup_peers);
088f80a1
MW
2267 st->dhsecret=0;
2268 st->sharedsecret=0;
5b5f297f 2269
8bb8c22a
MW
2270#define SET_CAPBIT(bit) do { \
2271 uint32_t capflag = 1UL << (bit); \
2272 if (st->local_capabilities & capflag) \
2273 slog(st,LOG_ERROR,"capability bit" \
2274 " %d (%#"PRIx32") reused", (bit), capflag); \
2275 st->local_capabilities |= capflag; \
2276} while (0)
2277
2278 for (i=0; i<st->ntransforms; i++)
2279 SET_CAPBIT(st->transforms[i]->capab_bit);
2280
2281#undef SET_CAPBIT
59533c16 2282
b2de6bd2
IJ
2283 if (st->local_mobile || st->peer_mobile)
2284 st->local_capabilities |= CAPAB_PRIORITY_MOBILE;
2285
2fe58dfd 2286 /* We need to register the remote networks with the netlink device */
3ed1846a
IJ
2287 uint32_t netlink_mtu; /* local virtual interface mtu */
2288 st->netlink->reg(st->netlink->st, site_outgoing, st, &netlink_mtu);
2289 if (!st->mtu_target)
2290 st->mtu_target=netlink_mtu;
ff05a229 2291
59533c16
IJ
2292 for (i=0; i<st->ncomms; i++)
2293 st->comms[i]->request_notify(st->comms[i]->st, st, site_incoming);
2fe58dfd 2294
fcad4b0b
IJ
2295 st->current.transform=0;
2296 st->auxiliary_key.transform=0;
2297 st->new_transform=0;
bd98cd6b 2298 st->auxiliary_is_new=0;
2fe58dfd
SE
2299
2300 enter_state_stop(st);
2301
794f2398 2302 add_hook(PHASE_SHUTDOWN,site_phase_hook,st);
32654a31 2303 add_hook(PHASE_CHILDPERSIST,site_childpersist_clearkeys,st);
794f2398 2304
2fe58dfd
SE
2305 return new_closure(&st->cl);
2306}
2307
2fe58dfd
SE
2308void site_module(dict_t *dict)
2309{
2310 add_closure(dict,"site",site_apply);
2311}
446353cd
IJ
2312
2313
2314/***** TRANSPORT PEERS definitions *****/
2315
2316static void transport_peers_debug(struct site *st, transport_peers *dst,
2317 const char *didwhat,
2318 int nargs, const struct comm_addr *args,
2319 size_t stride) {
2320 int i;
2321 char *argp;
2322
2323 if (!(st->log_events & LOG_PEER_ADDRS))
2324 return; /* an optimisation */
2325
2326 slog(st, LOG_PEER_ADDRS, "peers (%s) %s nargs=%d => npeers=%d",
2327 (dst==&st->peers ? "data" :
2328 dst==&st->setup_peers ? "setup" : "UNKNOWN"),
2329 didwhat, nargs, dst->npeers);
2330
2331 for (i=0, argp=(void*)args;
2332 i<nargs;
2333 i++, (argp+=stride?stride:sizeof(*args))) {
2334 const struct comm_addr *ca=(void*)argp;
2335 slog(st, LOG_PEER_ADDRS, " args: addrs[%d]=%s",
1a448682 2336 i, comm_addr_to_string(ca));
446353cd
IJ
2337 }
2338 for (i=0; i<dst->npeers; i++) {
2339 struct timeval diff;
2340 timersub(tv_now,&dst->peers[i].last,&diff);
2341 const struct comm_addr *ca=&dst->peers[i].addr;
2342 slog(st, LOG_PEER_ADDRS, " peers: addrs[%d]=%s T-%ld.%06ld",
1a448682 2343 i, comm_addr_to_string(ca),
446353cd
IJ
2344 (unsigned long)diff.tv_sec, (unsigned long)diff.tv_usec);
2345 }
2346}
2347
446353cd
IJ
2348static void transport_peers_expire(struct site *st, transport_peers *peers) {
2349 /* peers must be sorted first */
2350 int previous_peers=peers->npeers;
2351 struct timeval oldest;
2352 oldest.tv_sec = tv_now->tv_sec - st->mobile_peer_expiry;
2353 oldest.tv_usec = tv_now->tv_usec;
2354 while (peers->npeers>1 &&
2355 timercmp(&peers->peers[peers->npeers-1].last, &oldest, <))
2356 peers->npeers--;
2357 if (peers->npeers != previous_peers)
2358 transport_peers_debug(st,peers,"expire", 0,0,0);
2359}
2360
51fc5a74
IJ
2361static bool_t transport_peer_record_one(struct site *st, transport_peers *peers,
2362 const struct comm_addr *ca,
2363 const struct timeval *tv) {
2364 /* returns false if output is full */
2365 int search;
446353cd 2366
51fc5a74
IJ
2367 if (peers->npeers >= st->transport_peers_max)
2368 return 0;
446353cd 2369
51fc5a74 2370 for (search=0; search<peers->npeers; search++)
2093fb5c 2371 if (comm_addr_equal(&peers->peers[search].addr, ca))
51fc5a74
IJ
2372 return 1;
2373
2374 peers->peers[peers->npeers].addr = *ca;
2375 peers->peers[peers->npeers].last = *tv;
2376 peers->npeers++;
2377 return 1;
2378}
2379
2380static void transport_record_peers(struct site *st, transport_peers *peers,
2381 const struct comm_addr *addrs, int naddrs,
2382 const char *m) {
2383 /* We add addrs into peers. The new entries end up at the front
2384 * and displace entries towards the end (perhaps even off the
2385 * end). Any existing matching entries are moved up to the front.
2386 *
2387 * Caller must first call transport_peers_expire. */
2388
fdef47ec
IJ
2389 if (naddrs==1) {
2390 /* avoids debug for uninteresting updates */
2391 int i;
2392 for (i=0; i<peers->npeers; i++) {
2393 if (comm_addr_equal(&addrs[0], &peers->peers[i].addr)) {
2394 memmove(peers->peers+1, peers->peers,
2395 sizeof(peers->peers[0]) * i);
2396 peers->peers[0].addr = addrs[0];
2397 peers->peers[0].last = *tv_now;
2398 return;
2399 }
2400 }
51fc5a74 2401 }
446353cd 2402
51fc5a74
IJ
2403 int old_npeers=peers->npeers;
2404 transport_peer old_peers[old_npeers];
2405 COPY_ARRAY(old_peers,peers->peers,old_npeers);
446353cd 2406
51fc5a74
IJ
2407 peers->npeers=0;
2408 int i;
2409 for (i=0; i<naddrs; i++) {
2410 if (!transport_peer_record_one(st,peers, &addrs[i], tv_now))
2411 break;
2412 }
2413 for (i=0; i<old_npeers; i++) {
2414 const transport_peer *old=&old_peers[i];
2415 if (!transport_peer_record_one(st,peers, &old->addr, &old->last))
2416 break;
2417 }
446353cd 2418
51fc5a74
IJ
2419 transport_peers_debug(st,peers,m, naddrs,addrs,0);
2420}
2421
2422static void transport_expire_record_peers(struct site *st,
2423 transport_peers *peers,
2424 const struct comm_addr *addrs,
2425 int naddrs, const char *m) {
2426 /* Convenience function */
2427 transport_peers_expire(st,peers);
2428 transport_record_peers(st,peers,addrs,naddrs,m);
446353cd
IJ
2429}
2430
2431static bool_t transport_compute_setupinit_peers(struct site *st,
45a14422
IJ
2432 const struct comm_addr *configured_addrs /* 0 if none or not found */,
2433 int n_configured_addrs /* 0 if none or not found */,
a96fda35 2434 const struct comm_addr *incoming_packet_addr /* 0 if none */) {
45a14422 2435 if (!n_configured_addrs && !incoming_packet_addr &&
dd9209d1 2436 !transport_peers_valid(&st->peers))
446353cd
IJ
2437 return False;
2438
2439 slog(st,LOG_SETUP_INIT,
45a14422
IJ
2440 "using: %d configured addr(s);%s %d old peer addrs(es)",
2441 n_configured_addrs,
a96fda35 2442 incoming_packet_addr ? " incoming packet address;" : "",
779837e1 2443 st->peers.npeers);
446353cd 2444
0f27325c
IJ
2445 /* Non-mobile peers try addresses until one is plausible. The
2446 * effect is that this code always tries first the configured
2447 * address if supplied, or otherwise the address of the incoming
2448 * PROD, or finally the existing data peer if one exists; this is
2449 * as desired. */
446353cd
IJ
2450
2451 transport_peers_copy(st,&st->setup_peers,&st->peers);
51fc5a74 2452 transport_peers_expire(st,&st->setup_peers);
446353cd 2453
a96fda35 2454 if (incoming_packet_addr)
51fc5a74
IJ
2455 transport_record_peers(st,&st->setup_peers,
2456 incoming_packet_addr,1, "incoming");
dd9209d1 2457
45a14422 2458 if (n_configured_addrs)
51fc5a74 2459 transport_record_peers(st,&st->setup_peers,
45a14422 2460 configured_addrs,n_configured_addrs, "setupinit");
446353cd
IJ
2461
2462 assert(transport_peers_valid(&st->setup_peers));
2463 return True;
2464}
2465
2466static void transport_setup_msgok(struct site *st, const struct comm_addr *a) {
2467 if (st->peer_mobile)
51fc5a74 2468 transport_expire_record_peers(st,&st->setup_peers,a,1,"setupmsg");
446353cd
IJ
2469}
2470static void transport_data_msgok(struct site *st, const struct comm_addr *a) {
2471 if (st->peer_mobile)
51fc5a74 2472 transport_expire_record_peers(st,&st->peers,a,1,"datamsg");
446353cd
IJ
2473}
2474
2475static int transport_peers_valid(transport_peers *peers) {
2476 return peers->npeers;
2477}
2478static void transport_peers_clear(struct site *st, transport_peers *peers) {
2479 peers->npeers= 0;
2480 transport_peers_debug(st,peers,"clear",0,0,0);
2481}
2482static void transport_peers_copy(struct site *st, transport_peers *dst,
2483 const transport_peers *src) {
2484 dst->npeers=src->npeers;
4f28e77e 2485 COPY_ARRAY(dst->peers, src->peers, dst->npeers);
446353cd 2486 transport_peers_debug(st,dst,"copy",
a620a048 2487 src->npeers, &src->peers->addr, sizeof(*src->peers));
446353cd
IJ
2488}
2489
90d7e3ad 2490static void transport_resolve_complete(struct site *st,
45a14422
IJ
2491 const struct comm_addr *addrs,
2492 int naddrs) {
2493 transport_expire_record_peers(st,&st->peers,addrs,naddrs,
2494 "resolved data");
2495 transport_expire_record_peers(st,&st->setup_peers,addrs,naddrs,
2496 "resolved setup");
90d7e3ad
IJ
2497}
2498
2499static void transport_resolve_complete_tardy(struct site *st,
45a14422
IJ
2500 const struct comm_addr *addrs,
2501 int naddrs) {
2502 transport_expire_record_peers(st,&st->peers,addrs,naddrs,
2503 "resolved tardily");
90d7e3ad
IJ
2504}
2505
027a218f
IJ
2506static void transport_peers__copy_by_mask(transport_peer *out, int *nout_io,
2507 unsigned mask,
2508 const transport_peers *inp) {
2509 /* out and in->peers may be the same region, or nonoverlapping */
2510 const transport_peer *in=inp->peers;
2511 int slot;
2512 for (slot=0; slot<inp->npeers; slot++) {
2513 if (!(mask & (1U << slot)))
2514 continue;
2515 if (!(out==in && slot==*nout_io))
2516 COPY_OBJ(out[*nout_io], in[slot]);
2517 (*nout_io)++;
2518 }
2519}
2520
446353cd
IJ
2521void transport_xmit(struct site *st, transport_peers *peers,
2522 struct buffer_if *buf, bool_t candebug) {
2523 int slot;
2524 transport_peers_expire(st, peers);
027a218f 2525 unsigned failed=0; /* bitmask */
0f27325c 2526 assert(MAX_PEER_ADDRS < sizeof(unsigned)*CHAR_BIT);
027a218f
IJ
2527
2528 int nfailed=0;
446353cd
IJ
2529 for (slot=0; slot<peers->npeers; slot++) {
2530 transport_peer *peer=&peers->peers[slot];
eff48c12 2531 bool_t ok = comm_addr_sendmsg(st, &peer->addr, buf);
62846523
IJ
2532 if (candebug)
2533 dump_packet(st, buf, &peer->addr, False, ok);
027a218f
IJ
2534 if (!ok) {
2535 failed |= 1U << slot;
2536 nfailed++;
2537 }
2538 if (ok && !st->peer_mobile)
2539 break;
2540 }
2541 /* Now we need to demote/delete failing addrs: if we are mobile we
2542 * merely demote them; otherwise we delete them. */
2543 if (st->local_mobile) {
2544 unsigned expected = ((1U << nfailed)-1) << (peers->npeers-nfailed);
2545 /* `expected' has all the failures at the end already */
2546 if (failed != expected) {
2547 int fslot=0;
2548 transport_peer failedpeers[nfailed];
2549 transport_peers__copy_by_mask(failedpeers, &fslot, failed,peers);
2550 assert(fslot == nfailed);
2551 int wslot=0;
2552 transport_peers__copy_by_mask(peers->peers,&wslot,~failed,peers);
2553 assert(wslot+nfailed == peers->npeers);
2554 COPY_ARRAY(peers->peers+wslot, failedpeers, nfailed);
92ae57c5 2555 transport_peers_debug(st,peers,"mobile failure reorder",0,0,0);
027a218f
IJ
2556 }
2557 } else {
2558 if (failed && peers->npeers > 1) {
2559 int wslot=0;
2560 transport_peers__copy_by_mask(peers->peers,&wslot,~failed,peers);
2561 peers->npeers=wslot;
92ae57c5 2562 transport_peers_debug(st,peers,"non-mobile failure cleanup",0,0,0);
027a218f 2563 }
446353cd
IJ
2564 }
2565}
2566
2567/***** END of transport peers declarations *****/