~mdw / secnet / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
site: Fix bugs when resolver request submission fails
[secnet] / site.c
CommitLineData
2fe58dfd
SE		 1/* site.c - manage communication with a remote network site */
2
469fd1d9
SE		 3/* The 'site' code doesn't know anything about the structure of the
4 packets it's transmitting. In fact, under the new netlink
5 configuration scheme it doesn't need to know anything at all about
6 IP addresses, except how to contact its peer. This means it could
7 potentially be used to tunnel other protocols too (IPv6, IPX, plain
8 old Ethernet frames) if appropriate netlink code can be written
9 (and that ought not to be too hard, eg. using the TUN/TAP device to
10 pretend to be an Ethernet interface). */
11
ff05a229
SE		 12/* At some point in the future the netlink code will be asked for
13 configuration information to go in the PING/PONG packets at the end
14 of the key exchange. */
15
8689b3a9 16#include "secnet.h"
2fe58dfd 17#include <stdio.h>
469fd1d9 18#include <string.h>
fe5e9cc4 19#include <limits.h>
58650a70 20#include <assert.h>
8689b3a9 21#include <sys/socket.h>
2fe58dfd 22
8689b3a9 23#include <sys/mman.h>
2fe58dfd 24#include "util.h"
59635212 25#include "unaligned.h"
ff05a229 26#include "magic.h"
2fe58dfd
SE		 27
28#define SETUP_BUFFER_LEN 2048
29
e7f8ec2a
IJ		 30#define DEFAULT_KEY_LIFETIME (3600*1000) /* [ms] */
31#define DEFAULT_KEY_RENEGOTIATE_GAP (5*60*1000) /* [ms] */
2fe58dfd 32#define DEFAULT_SETUP_RETRIES 5
e7f8ec2a
IJ		 33#define DEFAULT_SETUP_RETRY_INTERVAL (2*1000) /* [ms] */
34#define DEFAULT_WAIT_TIME (20*1000) /* [ms] */
e57264d6
IJ		 35
36#define DEFAULT_MOBILE_KEY_LIFETIME (2*24*3600*1000) /* [ms] */
37#define DEFAULT_MOBILE_KEY_RENEGOTIATE_GAP (12*3600*1000) /* [ms] */
38#define DEFAULT_MOBILE_SETUP_RETRIES 30
39#define DEFAULT_MOBILE_SETUP_RETRY_INTERVAL (1*1000) /* [ms] */
40#define DEFAULT_MOBILE_WAIT_TIME (10*1000) /* [ms] */
41
446353cd
IJ		 42#define DEFAULT_MOBILE_PEER_EXPIRY (2*60) /* [s] */
43#define DEFAULT_MOBILE_PEERS_MAX 3 /* send at most this many copies (default) */
2fe58dfd
SE		 44
45/* Each site can be in one of several possible states. */
46
47/* States:
48 SITE_STOP - nothing is allowed to happen; tunnel is down;
49 all session keys have been erased
50 -> SITE_RUN upon external instruction
51 SITE_RUN - site up, maybe with valid key
52 -> SITE_RESOLVE upon outgoing packet and no valid key
53 we start name resolution for the other end of the tunnel
54 -> SITE_SENTMSG2 upon valid incoming message 1 and suitable time
55 we send an appropriate message 2
56 SITE_RESOLVE - waiting for name resolution
57 -> SITE_SENTMSG1 upon successful resolution
58 we send an appropriate message 1
59 -> SITE_SENTMSG2 upon valid incoming message 1 (then abort resolution)
60 we abort resolution and
61 -> SITE_WAIT on timeout or resolution failure
62 SITE_SENTMSG1
63 -> SITE_SENTMSG2 upon valid incoming message 1 from higher priority end
64 -> SITE_SENTMSG3 upon valid incoming message 2
65 -> SITE_WAIT on timeout
66 SITE_SENTMSG2
67 -> SITE_SENTMSG4 upon valid incoming message 3
68 -> SITE_WAIT on timeout
69 SITE_SENTMSG3
70 -> SITE_SENTMSG5 upon valid incoming message 4
71 -> SITE_WAIT on timeout
72 SITE_SENTMSG4
73 -> SITE_RUN upon valid incoming message 5
74 -> SITE_WAIT on timeout
75 SITE_SENTMSG5
76 -> SITE_RUN upon valid incoming message 6
77 -> SITE_WAIT on timeout
78 SITE_WAIT - failed to establish key; do nothing for a while
79 -> SITE_RUN on timeout
80 */
81
82#define SITE_STOP 0
83#define SITE_RUN 1
84#define SITE_RESOLVE 2
85#define SITE_SENTMSG1 3
86#define SITE_SENTMSG2 4
87#define SITE_SENTMSG3 5
88#define SITE_SENTMSG4 6
89#define SITE_SENTMSG5 7
90#define SITE_WAIT 8
91
3abd18e8
IJ		 92int32_t site_max_start_pad = 4*4;
93
fe5e9cc4 94static cstring_t state_name(uint32_t state)
2fe58dfd
SE		 95{
96 switch (state) {
3454dce4
SE		 97 case 0: return "STOP";
98 case 1: return "RUN";
99 case 2: return "RESOLVE";
100 case 3: return "SENTMSG1";
101 case 4: return "SENTMSG2";
102 case 5: return "SENTMSG3";
103 case 6: return "SENTMSG4";
104 case 7: return "SENTMSG5";
105 case 8: return "WAIT";
2fe58dfd
SE		 106 default: return "*bad state*";
107 }
108}
109
2fe58dfd
SE		 110#define NONCELEN 8
111
112#define LOG_UNEXPECTED 0x00000001
113#define LOG_SETUP_INIT 0x00000002
114#define LOG_SETUP_TIMEOUT 0x00000004
115#define LOG_ACTIVATE_KEY 0x00000008
116#define LOG_TIMEOUT_KEY 0x00000010
9d3a4132 117#define LOG_SEC 0x00000020
2fe58dfd
SE		 118#define LOG_STATE 0x00000040
119#define LOG_DROP 0x00000080
120#define LOG_DUMP 0x00000100
121#define LOG_ERROR 0x00000400
446353cd 122#define LOG_PEER_ADDRS 0x00000800
2fe58dfd 123
9d3a4132
SE		 124static struct flagstr log_event_table[]={
125 { "unexpected", LOG_UNEXPECTED },
126 { "setup-init", LOG_SETUP_INIT },
127 { "setup-timeout", LOG_SETUP_TIMEOUT },
128 { "activate-key", LOG_ACTIVATE_KEY },
129 { "timeout-key", LOG_TIMEOUT_KEY },
130 { "security", LOG_SEC },
131 { "state-change", LOG_STATE },
132 { "packet-drop", LOG_DROP },
133 { "dump-packets", LOG_DUMP },
134 { "errors", LOG_ERROR },
446353cd 135 { "peer-addrs", LOG_PEER_ADDRS },
ff05a229
SE		 136 { "default", LOG_SETUP_INIT|LOG_SETUP_TIMEOUT|
137 LOG_ACTIVATE_KEY|LOG_TIMEOUT_KEY|LOG_SEC|LOG_ERROR },
9d3a4132
SE		 138 { "all", 0xffffffff },
139 { NULL, 0 }
140};
141
446353cd
IJ		 142
143/***** TRANSPORT PEERS declarations *****/
144
145/* Details of "mobile peer" semantics:
146
147 - We record mobile_peers_max peer address/port numbers ("peers")
148 for key setup, and separately mobile_peers_max for data
149 transfer. If these lists fill up, we retain the newest peers.
150 (For non-mobile peers we only record one of each.)
151
152 - Outgoing packets are sent to every recorded peer in the
153 applicable list.
154
155 - Data transfer peers are straightforward: whenever we successfully
156 process a data packet, we record the peer. Also, whenever we
157 successfully complete a key setup, we merge the key setup
158 peers into the data transfer peers.
159
160 (For "non-mobile" peers we simply copy the peer used for
161 successful key setup, and don't change the peer otherwise.)
162
163 - Key setup peers are slightly more complicated.
164
165 Whenever we receive and successfully process a key exchange
166 packet, we record the peer.
167
168 Whenever we try to initiate a key setup, we copy the list of data
169 transfer peers and use it for key setup. But we also look to see
170 if the config supplies an address and port number and if so we
171 add that as a key setup peer (possibly evicting one of the data
172 transfer peers we just copied).
173
174 (For "non-mobile" peers, if we if we have a configured peer
175 address and port, we always use that; otherwise if we have a
176 current data peer address we use that; otherwise we do not
177 attempt to initiate a key setup for lack of a peer address.)
178
179 "Record the peer" means
180 1. expire any peers last seen >120s ("mobile-peer-expiry") ago
181 2. add the peer of the just received packet to the applicable list
182 (possibly evicting older entries)
183 NB that we do not expire peers until an incoming packet arrives.
184
185 */
186
187#define MAX_MOBILE_PEERS_MAX 5 /* send at most this many copies, compiled max */
188
189typedef struct {
190 struct timeval last;
191 struct comm_addr addr;
192} transport_peer;
193
194typedef struct {
195/* configuration information */
196/* runtime information */
197 int npeers;
198 transport_peer peers[MAX_MOBILE_PEERS_MAX];
199} transport_peers;
200
201static void transport_peers_clear(struct site *st, transport_peers *peers);
202static int transport_peers_valid(transport_peers *peers);
203static void transport_peers_copy(struct site *st, transport_peers *dst,
204 const transport_peers *src);
205
206static void transport_setup_msgok(struct site *st, const struct comm_addr *a);
207static void transport_data_msgok(struct site *st, const struct comm_addr *a);
208static bool_t transport_compute_setupinit_peers(struct site *st,
dd9209d1
IJ		 209 const struct comm_addr *configured_addr /* 0 if none or not found */,
210 const struct comm_addr *prod_hint_addr /* 0 if none */);
446353cd
IJ		 211static void transport_record_peer(struct site *st, transport_peers *peers,
212 const struct comm_addr *addr, const char *m);
213
214static void transport_xmit(struct site *st, transport_peers *peers,
215 struct buffer_if *buf, bool_t candebug);
216
217 /***** END of transport peers declarations *****/
218
219
19e9a588
IJ		 220struct data_key {
221 struct transform_inst_if *transform;
222 uint64_t key_timeout; /* End of life of current key */
223 uint32_t remote_session_id;
224};
225
2fe58dfd
SE		 226struct site {
227 closure_t cl;
228 struct site_if ops;
229/* configuration information */
230 string_t localname;
231 string_t remotename;
446353cd
IJ		 232 bool_t peer_mobile; /* Mobile client support */
233 int32_t transport_peers_max;
ff05a229 234 string_t tunname; /* localname<->remotename by default, used in logs */
2fe58dfd 235 string_t address; /* DNS name for bootstrapping, optional */
ff05a229 236 int remoteport; /* Port for bootstrapping, optional */
3ed1846a 237 uint32_t mtu_target;
2fe58dfd 238 struct netlink_if *netlink;
59533c16
IJ		 239 struct comm_if **comms;
240 int ncomms;
2fe58dfd
SE		 241 struct resolver_if *resolver;
242 struct log_if *log;
243 struct random_if *random;
244 struct rsaprivkey_if *privkey;
2fe58dfd 245 struct rsapubkey_if *pubkey;
5b5f297f
IJ		 246 struct transform_if **transforms;
247 int ntransforms;
2fe58dfd
SE		 248 struct dh_if *dh;
249 struct hash_if *hash;
2fe58dfd 250
58650a70 251 uint32_t index; /* Index of this site */
09a385fb 252 uint32_t local_capabilities;
1caa23ff 253 int32_t setup_retries; /* How many times to send setup packets */
e7f8ec2a 254 int32_t setup_retry_interval; /* Initial timeout for setup packets */
4a8aed08 255 int32_t wait_timeout; /* How long to wait if setup unsuccessful */
446353cd 256 int32_t mobile_peer_expiry; /* How long to remember 2ary addresses */
4a8aed08
IJ		 257 int32_t key_lifetime; /* How long a key lasts once set up */
258 int32_t key_renegotiate_time; /* If we see traffic (or a keepalive)
9d3a4132
SE		 259 after this time, initiate a new
260 key exchange */
2fe58dfd 261
2fe58dfd
SE		 262 bool_t setup_priority; /* Do we have precedence if both sites emit
263 message 1 simultaneously? */
264 uint32_t log_events;
265
266/* runtime information */
267 uint32_t state;
268 uint64_t now; /* Most recently seen time */
dd9209d1 269 bool_t allow_send_prod;
2fe58dfd 270
ff05a229 271 /* The currently established session */
19e9a588 272 struct data_key current;
02b0959b 273 struct data_key auxiliary_key;
bd98cd6b 274 bool_t auxiliary_is_new;
ff05a229 275 uint64_t renegotiate_key_time; /* When we can negotiate a new key */
bd98cd6b 276 uint64_t auxiliary_renegotiate_key_time;
446353cd 277 transport_peers peers; /* Current address(es) of peer for data traffic */
2fe58dfd 278
ff05a229
SE		 279 /* The current key setup protocol exchange. We can only be
280 involved in one of these at a time. There's a potential for
281 denial of service here (the attacker keeps sending a setup
282 packet; we keep trying to continue the exchange, and have to
283 timeout before we can listen for another setup packet); perhaps
284 we should keep a list of 'bad' sources for setup packets. */
09a385fb 285 uint32_t remote_capabilities;
3ed1846a 286 uint16_t remote_adv_mtu;
5b5f297f 287 struct transform_if *chosen_transform;
2fe58dfd 288 uint32_t setup_session_id;
446353cd 289 transport_peers setup_peers;
2fe58dfd
SE		 290 uint8_t localN[NONCELEN]; /* Nonces for key exchange */
291 uint8_t remoteN[NONCELEN];
292 struct buffer_if buffer; /* Current outgoing key exchange packet */
05f39b4d 293 struct buffer_if scratch;
4a8aed08 294 int32_t retries; /* Number of retries remaining */
2fe58dfd
SE		 295 uint64_t timeout; /* Timeout for current state */
296 uint8_t *dhsecret;
297 uint8_t *sharedsecret;
5b5f297f 298 uint32_t sharedsecretlen, sharedsecretallocd;
2fe58dfd
SE		 299 struct transform_inst_if *new_transform; /* For key setup/verify */
300};
301
8368df34
IJ		 302static uint32_t event_log_priority(struct site *st, uint32_t event)
303{
304 if (!(event&st->log_events))
305 return 0;
306 switch(event) {
307 case LOG_UNEXPECTED: return M_INFO;
308 case LOG_SETUP_INIT: return M_INFO;
309 case LOG_SETUP_TIMEOUT: return M_NOTICE;
310 case LOG_ACTIVATE_KEY: return M_INFO;
311 case LOG_TIMEOUT_KEY: return M_INFO;
312 case LOG_SEC: return M_SECURITY;
313 case LOG_STATE: return M_DEBUG;
314 case LOG_DROP: return M_DEBUG;
315 case LOG_DUMP: return M_DEBUG;
316 case LOG_ERROR: return M_ERR;
317 case LOG_PEER_ADDRS: return M_DEBUG;
318 default: return M_ERR;
319 }
320}
321
0237c848
IJ		 322static void vslog(struct site *st, uint32_t event, cstring_t msg, va_list ap)
323FORMAT(printf,3,0);
324static void vslog(struct site *st, uint32_t event, cstring_t msg, va_list ap)
2fe58dfd 325{
b2a56f7c 326 uint32_t class;
2fe58dfd 327
8368df34
IJ		 328 class=event_log_priority(st, event);
329 if (class) {
e5d8c16e
IJ		 330 slilog_part(st->log,class,"%s: ",st->tunname);
331 vslilog_part(st->log,class,msg,ap);
332 slilog_part(st->log,class,"\n");
2fe58dfd 333 }
2fe58dfd
SE		 334}
335
0237c848
IJ		 336static void slog(struct site *st, uint32_t event, cstring_t msg, ...)
337FORMAT(printf,3,4);
338static void slog(struct site *st, uint32_t event, cstring_t msg, ...)
339{
340 va_list ap;
341 va_start(ap,msg);
342 vslog(st,event,msg,ap);
343 va_end(ap);
344}
345
4f3c75ac
IJ		 346static void logtimeout(struct site *st, const char *fmt, ...)
347FORMAT(printf,2,3);
348static void logtimeout(struct site *st, const char *fmt, ...)
349{
e9c9020e
IJ		 350 uint32_t class=event_log_priority(st,LOG_SETUP_TIMEOUT);
351 if (!class)
352 return;
353
4f3c75ac
IJ		 354 va_list ap;
355 va_start(ap,fmt);
e9c9020e
IJ		 356
357 slilog_part(st->log,class,"%s: ",st->tunname);
358 vslilog_part(st->log,class,fmt,ap);
359
360 const char *delim;
361 int i;
362 for (i=0, delim=" (tried ";
363 i<st->setup_peers.npeers;
364 i++, delim=", ") {
365 transport_peer *peer=&st->setup_peers.peers[i];
366 const char *s=comm_addr_to_string(&peer->addr);
367 slilog_part(st->log,class,"%s%s",delim,s);
368 }
369
370 slilog_part(st->log,class,")\n");
4f3c75ac
IJ		 371 va_end(ap);
372}
373
9d3a4132 374static void set_link_quality(struct site *st);
1d388569
IJ		 375static void delete_keys(struct site *st, cstring_t reason, uint32_t loglevel);
376static void delete_one_key(struct site *st, struct data_key *key,
377 const char *reason /* may be 0 meaning don't log*/,
378 const char *which /* ignored if !reasonn */,
379 uint32_t loglevel /* ignored if !reasonn */);
dd9209d1
IJ		 380static bool_t initiate_key_setup(struct site *st, cstring_t reason,
381 const struct comm_addr *prod_hint);
2fe58dfd
SE		 382static void enter_state_run(struct site *st);
383static bool_t enter_state_resolve(struct site *st);
ff05a229 384static bool_t enter_new_state(struct site *st,uint32_t next);
2fe58dfd 385static void enter_state_wait(struct site *st);
05f39b4d 386static void activate_new_key(struct site *st);
2fe58dfd 387
0afd257e
IJ		 388static bool_t is_transform_valid(struct transform_inst_if *transform)
389{
fcad4b0b 390 return transform && transform->valid(transform->st);
0afd257e
IJ		 391}
392
3d8d8f4e
IJ		 393static bool_t current_valid(struct site *st)
394{
0afd257e
IJ		 395 return is_transform_valid(st->current.transform);
396}
397
398#define DEFINE_CALL_TRANSFORM(fwdrev) \
399static int call_transform_##fwdrev(struct site *st, \
400 struct transform_inst_if *transform, \
401 struct buffer_if *buf, \
402 const char **errmsg) \
403{ \
fcad4b0b
IJ		 404 if (!is_transform_valid(transform)) { \
405 *errmsg="transform not set up"; \
406 return 1; \
407 } \
0afd257e 408 return transform->fwdrev(transform->st,buf,errmsg); \
3d8d8f4e
IJ		 409}
410
0afd257e
IJ		 411DEFINE_CALL_TRANSFORM(forwards)
412DEFINE_CALL_TRANSFORM(reverse)
413
414static void dispose_transform(struct transform_inst_if **transform_var)
415{
0afd257e 416 struct transform_inst_if *transform=*transform_var;
fcad4b0b
IJ		 417 if (transform) {
418 transform->delkey(transform->st);
419 transform->destroy(transform->st);
420 }
421 *transform_var = 0;
0afd257e
IJ		 422}
423
2fe58dfd
SE		 424#define CHECK_AVAIL(b,l) do { if ((b)->size<(l)) return False; } while(0)
425#define CHECK_EMPTY(b) do { if ((b)->size!=0) return False; } while(0)
426#define CHECK_TYPE(b,t) do { uint32_t type; \
427 CHECK_AVAIL((b),4); \
59635212 428 type=buf_unprepend_uint32((b)); \
2fe58dfd
SE		 429 if (type!=(t)) return False; } while(0)
430
3ed1846a
IJ		 431static _Bool type_is_msg34(uint32_t type)
432{
433 return
434 type == LABEL_MSG3 ||
435 type == LABEL_MSG3BIS ||
436 type == LABEL_MSG4;
437}
438
1737eeef
IJ		 439struct parsedname {
440 int32_t len;
441 uint8_t *name;
09a385fb 442 struct buffer_if extrainfo;
1737eeef
IJ		 443};
444
2fe58dfd
SE		 445struct msg {
446 uint8_t *hashstart;
447 uint32_t dest;
448 uint32_t source;
1737eeef
IJ		 449 struct parsedname remote;
450 struct parsedname local;
09a385fb 451 uint32_t remote_capabilities;
3ed1846a 452 uint16_t remote_mtu;
5b5f297f 453 int capab_transformnum;
2fe58dfd
SE		 454 uint8_t *nR;
455 uint8_t *nL;
1caa23ff 456 int32_t pklen;
3e8addad 457 char *pk;
1caa23ff
IJ		 458 int32_t hashlen;
459 int32_t siglen;
3e8addad 460 char *sig;
2fe58dfd
SE		 461};
462
5b5f297f 463static void set_new_transform(struct site *st, char *pk)
0afd257e 464{
5b5f297f
IJ		 465 /* Make room for the shared key */
466 st->sharedsecretlen=st->chosen_transform->keylen?:st->dh->ceil_len;
467 assert(st->sharedsecretlen);
468 if (st->sharedsecretlen > st->sharedsecretallocd) {
469 st->sharedsecretallocd=st->sharedsecretlen;
470 st->sharedsecret=realloc(st->sharedsecret,st->sharedsecretallocd);
471 }
472 if (!st->sharedsecret) fatal_perror("site:sharedsecret");
473
474 /* Generate the shared key */
475 st->dh->makeshared(st->dh->st,st->dhsecret,st->dh->len,pk,
476 st->sharedsecret,st->sharedsecretlen);
477
478 /* Set up the transform */
479 struct transform_if *generator=st->chosen_transform;
fcad4b0b
IJ		 480 struct transform_inst_if *generated=generator->create(generator->st);
481 generated->setkey(generated->st,st->sharedsecret,
482 st->sharedsecretlen,st->setup_priority);
483 dispose_transform(&st->new_transform);
484 st->new_transform=generated;
5b5f297f
IJ		 485
486 slog(st,LOG_SETUP_INIT,"key exchange negotiated transform"
487 " %d (capabilities ours=%#"PRIx32" theirs=%#"PRIx32")",
488 st->chosen_transform->capab_transformnum,
489 st->local_capabilities, st->remote_capabilities);
0afd257e
IJ		 490}
491
09a385fb
IJ		 492struct xinfoadd {
493 int32_t lenpos, afternul;
494};
495static void append_string_xinfo_start(struct buffer_if *buf,
496 struct xinfoadd *xia,
497 const char *str)
498 /* Helps construct one of the names with additional info as found
499 * in MSG1..4. Call this function first, then append all the
500 * desired extra info (not including the nul byte) to the buffer,
501 * then call append_string_xinfo_done. */
502{
503 xia->lenpos = buf->size;
504 buf_append_string(buf,str);
505 buf_append_uint8(buf,0);
506 xia->afternul = buf->size;
507}
508static void append_string_xinfo_done(struct buffer_if *buf,
509 struct xinfoadd *xia)
510{
511 /* we just need to adjust the string length */
512 if (buf->size == xia->afternul) {
513 /* no extra info, strip the nul too */
514 buf_unappend_uint8(buf);
515 } else {
516 put_uint16(buf->start+xia->lenpos, buf->size-(xia->lenpos+2));
517 }
518}
519
ff05a229
SE		 520/* Build any of msg1 to msg4. msg5 and msg6 are built from the inside
521 out using a transform of config data supplied by netlink */
fe5e9cc4 522static bool_t generate_msg(struct site *st, uint32_t type, cstring_t what)
2fe58dfd
SE		 523{
524 void *hst;
3b83c932 525 uint8_t *hash;
2fe58dfd
SE		 526 string_t dhpub, sig;
527
528 st->retries=st->setup_retries;
529 BUF_ALLOC(&st->buffer,what);
530 buffer_init(&st->buffer,0);
59635212
SE		 531 buf_append_uint32(&st->buffer,
532 (type==LABEL_MSG1?0:st->setup_session_id));
58650a70 533 buf_append_uint32(&st->buffer,st->index);
59635212 534 buf_append_uint32(&st->buffer,type);
09a385fb
IJ		 535
536 struct xinfoadd xia;
537 append_string_xinfo_start(&st->buffer,&xia,st->localname);
538 if ((st->local_capabilities & CAPAB_EARLY) || (type != LABEL_MSG1)) {
539 buf_append_uint32(&st->buffer,st->local_capabilities);
540 }
3ed1846a
IJ		 541 if (type_is_msg34(type)) {
542 buf_append_uint16(&st->buffer,st->mtu_target);
543 }
09a385fb
IJ		 544 append_string_xinfo_done(&st->buffer,&xia);
545
2fe58dfd
SE		 546 buf_append_string(&st->buffer,st->remotename);
547 memcpy(buf_append(&st->buffer,NONCELEN),st->localN,NONCELEN);
548 if (type==LABEL_MSG1) return True;
549 memcpy(buf_append(&st->buffer,NONCELEN),st->remoteN,NONCELEN);
550 if (type==LABEL_MSG2) return True;
3b83c932
SE		 551
552 if (hacky_par_mid_failnow()) return False;
553
5b5f297f
IJ		 554 if (type==LABEL_MSG3BIS)
555 buf_append_uint8(&st->buffer,st->chosen_transform->capab_transformnum);
556
2fe58dfd
SE		 557 dhpub=st->dh->makepublic(st->dh->st,st->dhsecret,st->dh->len);
558 buf_append_string(&st->buffer,dhpub);
559 free(dhpub);
3b83c932 560 hash=safe_malloc(st->hash->len, "generate_msg");
2fe58dfd
SE		 561 hst=st->hash->init();
562 st->hash->update(hst,st->buffer.start,st->buffer.size);
563 st->hash->final(hst,hash);
564 sig=st->privkey->sign(st->privkey->st,hash,st->hash->len);
565 buf_append_string(&st->buffer,sig);
566 free(sig);
3b83c932 567 free(hash);
2fe58dfd
SE		 568 return True;
569}
570
1737eeef
IJ		 571static bool_t unpick_name(struct buffer_if *msg, struct parsedname *nm)
572{
573 CHECK_AVAIL(msg,2);
574 nm->len=buf_unprepend_uint16(msg);
575 CHECK_AVAIL(msg,nm->len);
576 nm->name=buf_unprepend(msg,nm->len);
577 uint8_t *nul=memchr(nm->name,0,nm->len);
578 if (!nul) {
09a385fb 579 buffer_readonly_view(&nm->extrainfo,0,0);
1737eeef 580 } else {
09a385fb 581 buffer_readonly_view(&nm->extrainfo, nul+1, msg->start-(nul+1));
1737eeef
IJ		 582 nm->len=nul-nm->name;
583 }
584 return True;
585}
586
2fe58dfd
SE		 587static bool_t unpick_msg(struct site *st, uint32_t type,
588 struct buffer_if *msg, struct msg *m)
589{
5b5f297f 590 m->capab_transformnum=-1;
2fe58dfd
SE		 591 m->hashstart=msg->start;
592 CHECK_AVAIL(msg,4);
59635212 593 m->dest=buf_unprepend_uint32(msg);
2fe58dfd 594 CHECK_AVAIL(msg,4);
59635212 595 m->source=buf_unprepend_uint32(msg);
2fe58dfd 596 CHECK_TYPE(msg,type);
1737eeef 597 if (!unpick_name(msg,&m->remote)) return False;
09a385fb 598 m->remote_capabilities=0;
3ed1846a 599 m->remote_mtu=0;
09a385fb
IJ		 600 if (m->remote.extrainfo.size) {
601 CHECK_AVAIL(&m->remote.extrainfo,4);
602 m->remote_capabilities=buf_unprepend_uint32(&m->remote.extrainfo);
603 }
3ed1846a
IJ		 604 if (type_is_msg34(type) && m->remote.extrainfo.size) {
605 CHECK_AVAIL(&m->remote.extrainfo,2);
606 m->remote_mtu=buf_unprepend_uint16(&m->remote.extrainfo);
607 }
1737eeef 608 if (!unpick_name(msg,&m->local)) return False;
dd9209d1
IJ		 609 if (type==LABEL_PROD) {
610 CHECK_EMPTY(msg);
611 return True;
612 }
2fe58dfd
SE		 613 CHECK_AVAIL(msg,NONCELEN);
614 m->nR=buf_unprepend(msg,NONCELEN);
615 if (type==LABEL_MSG1) {
616 CHECK_EMPTY(msg);
617 return True;
618 }
619 CHECK_AVAIL(msg,NONCELEN);
620 m->nL=buf_unprepend(msg,NONCELEN);
621 if (type==LABEL_MSG2) {
622 CHECK_EMPTY(msg);
623 return True;
624 }
5b5f297f
IJ		 625 if (type==LABEL_MSG3BIS) {
626 CHECK_AVAIL(msg,1);
627 m->capab_transformnum = buf_unprepend_uint8(msg);
628 } else {
629 m->capab_transformnum = CAPAB_TRANSFORMNUM_ANCIENT;
630 }
2fe58dfd 631 CHECK_AVAIL(msg,2);
59635212 632 m->pklen=buf_unprepend_uint16(msg);
2fe58dfd
SE		 633 CHECK_AVAIL(msg,m->pklen);
634 m->pk=buf_unprepend(msg,m->pklen);
635 m->hashlen=msg->start-m->hashstart;
636 CHECK_AVAIL(msg,2);
59635212 637 m->siglen=buf_unprepend_uint16(msg);
2fe58dfd
SE		 638 CHECK_AVAIL(msg,m->siglen);
639 m->sig=buf_unprepend(msg,m->siglen);
640 CHECK_EMPTY(msg);
641 return True;
642}
643
1737eeef
IJ		 644static bool_t name_matches(const struct parsedname *nm, const char *expected)
645{
646 int expected_len=strlen(expected);
647 return
648 nm->len == expected_len &&
649 !memcmp(nm->name, expected, expected_len);
650}
651
ff05a229 652static bool_t check_msg(struct site *st, uint32_t type, struct msg *m,
fe5e9cc4 653 cstring_t *error)
ff05a229
SE		 654{
655 if (type==LABEL_MSG1) return True;
656
657 /* Check that the site names and our nonce have been sent
658 back correctly, and then store our peer's nonce. */
1737eeef 659 if (!name_matches(&m->remote,st->remotename)) {
ff05a229
SE		 660 *error="wrong remote site name";
661 return False;
662 }
1737eeef 663 if (!name_matches(&m->local,st->localname)) {
ff05a229
SE		 664 *error="wrong local site name";
665 return False;
666 }
667 if (memcmp(m->nL,st->localN,NONCELEN)!=0) {
668 *error="wrong locally-generated nonce";
669 return False;
670 }
671 if (type==LABEL_MSG2) return True;
5ad34db2 672 if (!consttime_memeq(m->nR,st->remoteN,NONCELEN)!=0) {
ff05a229
SE		 673 *error="wrong remotely-generated nonce";
674 return False;
675 }
09a385fb
IJ		 676 /* MSG3 has complicated rules about capabilities, which are
677 * handled in process_msg3. */
5b5f297f 678 if (type==LABEL_MSG3 || type==LABEL_MSG3BIS) return True;
09a385fb
IJ		 679 if (m->remote_capabilities!=st->remote_capabilities) {
680 *error="remote capabilities changed";
681 return False;
682 }
ff05a229
SE		 683 if (type==LABEL_MSG4) return True;
684 *error="unknown message type";
685 return False;
686}
687
2fe58dfd
SE		 688static bool_t generate_msg1(struct site *st)
689{
690 st->random->generate(st->random->st,NONCELEN,st->localN);
691 return generate_msg(st,LABEL_MSG1,"site:MSG1");
692}
693
694static bool_t process_msg1(struct site *st, struct buffer_if *msg1,
7e29719e 695 const struct comm_addr *src, struct msg *m)
2fe58dfd 696{
2fe58dfd
SE		 697 /* We've already determined we're in an appropriate state to
698 process an incoming MSG1, and that the MSG1 has correct values
699 of A and B. */
700
446353cd 701 transport_record_peer(st,&st->setup_peers,src,"msg1");
7e29719e 702 st->setup_session_id=m->source;
09a385fb 703 st->remote_capabilities=m->remote_capabilities;
7e29719e 704 memcpy(st->remoteN,m->nR,NONCELEN);
2fe58dfd
SE		 705 return True;
706}
707
708static bool_t generate_msg2(struct site *st)
709{
710 st->random->generate(st->random->st,NONCELEN,st->localN);
711 return generate_msg(st,LABEL_MSG2,"site:MSG2");
712}
713
714static bool_t process_msg2(struct site *st, struct buffer_if *msg2,
a15faeb2 715 const struct comm_addr *src)
2fe58dfd
SE		 716{
717 struct msg m;
fe5e9cc4 718 cstring_t err;
2fe58dfd
SE		 719
720 if (!unpick_msg(st,LABEL_MSG2,msg2,&m)) return False;
ff05a229
SE		 721 if (!check_msg(st,LABEL_MSG2,&m,&err)) {
722 slog(st,LOG_SEC,"msg2: %s",err);
2fe58dfd
SE		 723 return False;
724 }
725 st->setup_session_id=m.source;
09a385fb 726 st->remote_capabilities=m.remote_capabilities;
5b5f297f
IJ		 727
728 /* Select the transform to use */
729
730 uint32_t remote_transforms = st->remote_capabilities & CAPAB_TRANSFORM_MASK;
731 if (!remote_transforms)
732 /* old secnets only had this one transform */
733 remote_transforms = 1UL << CAPAB_TRANSFORMNUM_ANCIENT;
734
735 struct transform_if *ti;
736 int i;
737 for (i=0; i<st->ntransforms; i++) {
738 ti=st->transforms[i];
739 if ((1UL << ti->capab_transformnum) & remote_transforms)
740 goto transform_found;
741 }
742 slog(st,LOG_ERROR,"no transforms in common"
743 " (us %#"PRIx32"; them: %#"PRIx32")",
744 st->local_capabilities & CAPAB_TRANSFORM_MASK,
745 remote_transforms);
746 return False;
747 transform_found:
748 st->chosen_transform=ti;
749
2fe58dfd
SE		 750 memcpy(st->remoteN,m.nR,NONCELEN);
751 return True;
752}
753
754static bool_t generate_msg3(struct site *st)
755{
756 /* Now we have our nonce and their nonce. Think of a secret key,
757 and create message number 3. */
758 st->random->generate(st->random->st,st->dh->len,st->dhsecret);
5b5f297f
IJ		 759 return generate_msg(st,
760 (st->remote_capabilities & CAPAB_TRANSFORM_MASK
761 ? LABEL_MSG3BIS : LABEL_MSG3),
762 "site:MSG3");
2fe58dfd
SE		 763}
764
e001e8c0
IJ		 765static bool_t process_msg3_msg4(struct site *st, struct msg *m)
766{
767 uint8_t *hash;
768 void *hst;
769
770 /* Check signature and store g^x mod m */
771 hash=safe_malloc(st->hash->len, "process_msg3_msg4");
772 hst=st->hash->init();
773 st->hash->update(hst,m->hashstart,m->hashlen);
774 st->hash->final(hst,hash);
775 /* Terminate signature with a '0' - cheating, but should be ok */
776 m->sig[m->siglen]=0;
777 if (!st->pubkey->check(st->pubkey->st,hash,st->hash->len,m->sig)) {
778 slog(st,LOG_SEC,"msg3/msg4 signature failed check!");
779 free(hash);
780 return False;
781 }
782 free(hash);
783
3ed1846a
IJ		 784 st->remote_adv_mtu=m->remote_mtu;
785
e001e8c0
IJ		 786 return True;
787}
788
2fe58dfd 789static bool_t process_msg3(struct site *st, struct buffer_if *msg3,
5b5f297f 790 const struct comm_addr *src, uint32_t msgtype)
2fe58dfd
SE		 791{
792 struct msg m;
fe5e9cc4 793 cstring_t err;
2fe58dfd 794
5b5f297f
IJ		 795 assert(msgtype==LABEL_MSG3 || msgtype==LABEL_MSG3BIS);
796
797 if (!unpick_msg(st,msgtype,msg3,&m)) return False;
798 if (!check_msg(st,msgtype,&m,&err)) {
ff05a229 799 slog(st,LOG_SEC,"msg3: %s",err);
2fe58dfd
SE		 800 return False;
801 }
09a385fb
IJ		 802 uint32_t capab_adv_late = m.remote_capabilities
803 & ~st->remote_capabilities & CAPAB_EARLY;
804 if (capab_adv_late) {
805 slog(st,LOG_SEC,"msg3 impermissibly adds early capability flag(s)"
806 " %#"PRIx32" (was %#"PRIx32", now %#"PRIx32")",
807 capab_adv_late, st->remote_capabilities, m.remote_capabilities);
808 return False;
809 }
810 st->remote_capabilities|=m.remote_capabilities;
ff05a229 811
5b5f297f
IJ		 812 struct transform_if *ti;
813 int i;
814 for (i=0; i<st->ntransforms; i++) {
815 ti=st->transforms[i];
816 if (ti->capab_transformnum == m.capab_transformnum)
817 goto transform_found;
818 }
819 slog(st,LOG_SEC,"peer chose unknown-to-us transform %d!",
820 m.capab_transformnum);
821 return False;
822 transform_found:
823 st->chosen_transform=ti;
824
e001e8c0 825 if (!process_msg3_msg4(st,&m))
2fe58dfd 826 return False;
2fe58dfd
SE		 827
828 /* Terminate their DH public key with a '0' */
829 m.pk[m.pklen]=0;
830 /* Invent our DH secret key */
831 st->random->generate(st->random->st,st->dh->len,st->dhsecret);
832
5b5f297f
IJ		 833 /* Generate the shared key and set up the transform */
834 set_new_transform(st,m.pk);
2fe58dfd
SE		 835
836 return True;
837}
838
839static bool_t generate_msg4(struct site *st)
840{
841 /* We have both nonces, their public key and our private key. Generate
842 our public key, sign it and send it to them. */
843 return generate_msg(st,LABEL_MSG4,"site:MSG4");
844}
845
846static bool_t process_msg4(struct site *st, struct buffer_if *msg4,
a15faeb2 847 const struct comm_addr *src)
2fe58dfd
SE		 848{
849 struct msg m;
fe5e9cc4 850 cstring_t err;
2fe58dfd
SE		 851
852 if (!unpick_msg(st,LABEL_MSG4,msg4,&m)) return False;
ff05a229
SE		 853 if (!check_msg(st,LABEL_MSG4,&m,&err)) {
854 slog(st,LOG_SEC,"msg4: %s",err);
2fe58dfd
SE		 855 return False;
856 }
857
e001e8c0 858 if (!process_msg3_msg4(st,&m))
2fe58dfd 859 return False;
2fe58dfd
SE		 860
861 /* Terminate their DH public key with a '0' */
862 m.pk[m.pklen]=0;
5b5f297f
IJ		 863
864 /* Generate the shared key and set up the transform */
865 set_new_transform(st,m.pk);
2fe58dfd
SE		 866
867 return True;
868}
869
2fe58dfd
SE		 870struct msg0 {
871 uint32_t dest;
872 uint32_t source;
873 uint32_t type;
874};
875
876static bool_t unpick_msg0(struct site *st, struct buffer_if *msg0,
877 struct msg0 *m)
878{
879 CHECK_AVAIL(msg0,4);
59635212 880 m->dest=buf_unprepend_uint32(msg0);
2fe58dfd 881 CHECK_AVAIL(msg0,4);
59635212 882 m->source=buf_unprepend_uint32(msg0);
2fe58dfd 883 CHECK_AVAIL(msg0,4);
59635212 884 m->type=buf_unprepend_uint32(msg0);
2fe58dfd
SE		 885 return True;
886 /* Leaves transformed part of buffer untouched */
887}
888
ff05a229
SE		 889static bool_t generate_msg5(struct site *st)
890{
fe5e9cc4 891 cstring_t transform_err;
ff05a229
SE		 892
893 BUF_ALLOC(&st->buffer,"site:MSG5");
894 /* We are going to add four words to the message */
3abd18e8 895 buffer_init(&st->buffer,calculate_max_start_pad());
ff05a229
SE		 896 /* Give the netlink code an opportunity to put its own stuff in the
897 message (configuration information, etc.) */
ff05a229 898 buf_prepend_uint32(&st->buffer,LABEL_MSG5);
0afd257e
IJ		 899 if (call_transform_forwards(st,st->new_transform,
900 &st->buffer,&transform_err))
901 return False;
ff05a229 902 buf_prepend_uint32(&st->buffer,LABEL_MSG5);
58650a70 903 buf_prepend_uint32(&st->buffer,st->index);
ff05a229
SE		 904 buf_prepend_uint32(&st->buffer,st->setup_session_id);
905
906 st->retries=st->setup_retries;
907 return True;
908}
909
2fe58dfd 910static bool_t process_msg5(struct site *st, struct buffer_if *msg5,
c90cc2a7
IJ		 911 const struct comm_addr *src,
912 struct transform_inst_if *transform)
2fe58dfd
SE		 913{
914 struct msg0 m;
fe5e9cc4 915 cstring_t transform_err;
2fe58dfd
SE		 916
917 if (!unpick_msg0(st,msg5,&m)) return False;
918
0afd257e 919 if (call_transform_reverse(st,transform,msg5,&transform_err)) {
2fe58dfd 920 /* There's a problem */
59635212 921 slog(st,LOG_SEC,"process_msg5: transform: %s",transform_err);
2fe58dfd
SE		 922 return False;
923 }
924 /* Buffer should now contain untransformed PING packet data */
925 CHECK_AVAIL(msg5,4);
59635212 926 if (buf_unprepend_uint32(msg5)!=LABEL_MSG5) {
ff05a229 927 slog(st,LOG_SEC,"MSG5/PING packet contained wrong label");
2fe58dfd
SE		 928 return False;
929 }
ff7cdc9e
IJ		 930 /* Older versions of secnet used to write some config data here
931 * which we ignore. So we don't CHECK_EMPTY */
2fe58dfd
SE		 932 return True;
933}
934
c90cc2a7
IJ		 935static void create_msg6(struct site *st, struct transform_inst_if *transform,
936 uint32_t session_id)
2fe58dfd 937{
fe5e9cc4 938 cstring_t transform_err;
2fe58dfd
SE		 939
940 BUF_ALLOC(&st->buffer,"site:MSG6");
ff05a229 941 /* We are going to add four words to the message */
3abd18e8 942 buffer_init(&st->buffer,calculate_max_start_pad());
794f2398
SE		 943 /* Give the netlink code an opportunity to put its own stuff in the
944 message (configuration information, etc.) */
ff05a229 945 buf_prepend_uint32(&st->buffer,LABEL_MSG6);
0afd257e
IJ		 946 int problem = call_transform_forwards(st,transform,
947 &st->buffer,&transform_err);
948 assert(!problem);
59635212 949 buf_prepend_uint32(&st->buffer,LABEL_MSG6);
58650a70 950 buf_prepend_uint32(&st->buffer,st->index);
c90cc2a7
IJ		 951 buf_prepend_uint32(&st->buffer,session_id);
952}
2fe58dfd 953
c90cc2a7
IJ		 954static bool_t generate_msg6(struct site *st)
955{
0afd257e
IJ		 956 if (!is_transform_valid(st->new_transform))
957 return False;
c90cc2a7 958 create_msg6(st,st->new_transform,st->setup_session_id);
ff05a229 959 st->retries=1; /* Peer will retransmit MSG5 if this packet gets lost */
2fe58dfd
SE		 960 return True;
961}
962
963static bool_t process_msg6(struct site *st, struct buffer_if *msg6,
a15faeb2 964 const struct comm_addr *src)
2fe58dfd
SE		 965{
966 struct msg0 m;
fe5e9cc4 967 cstring_t transform_err;
2fe58dfd
SE		 968
969 if (!unpick_msg0(st,msg6,&m)) return False;
970
0afd257e 971 if (call_transform_reverse(st,st->new_transform,msg6,&transform_err)) {
2fe58dfd 972 /* There's a problem */
59635212 973 slog(st,LOG_SEC,"process_msg6: transform: %s",transform_err);
2fe58dfd
SE		 974 return False;
975 }
976 /* Buffer should now contain untransformed PING packet data */
977 CHECK_AVAIL(msg6,4);
59635212
SE		 978 if (buf_unprepend_uint32(msg6)!=LABEL_MSG6) {
979 slog(st,LOG_SEC,"MSG6/PONG packet contained invalid data");
2fe58dfd
SE		 980 return False;
981 }
ff7cdc9e
IJ		 982 /* Older versions of secnet used to write some config data here
983 * which we ignore. So we don't CHECK_EMPTY */
2fe58dfd
SE		 984 return True;
985}
986
48b97423
IJ		 987static bool_t decrypt_msg0(struct site *st, struct buffer_if *msg0,
988 const struct comm_addr *src)
2fe58dfd 989{
02b0959b 990 cstring_t transform_err, auxkey_err, newkey_err="n/a";
065e1922
IJ		 991 struct msg0 m;
992 uint32_t problem;
2fe58dfd 993
2fe58dfd
SE		 994 if (!unpick_msg0(st,msg0,&m)) return False;
995
05f39b4d
IJ		 996 /* Keep a copy so we can try decrypting it with multiple keys */
997 buffer_copy(&st->scratch, msg0);
998
0afd257e
IJ		 999 problem = call_transform_reverse(st,st->current.transform,
1000 msg0,&transform_err);
02b0959b 1001 if (!problem) {
bd98cd6b
IJ		 1002 if (!st->auxiliary_is_new)
1003 delete_one_key(st,&st->auxiliary_key,
1004 "peer has used new key","auxiliary key",LOG_SEC);
02b0959b
IJ		 1005 return True;
1006 }
48b97423
IJ		 1007 if (problem==2)
1008 goto skew;
07e4774c 1009
02b0959b 1010 buffer_copy(msg0, &st->scratch);
fcad4b0b
IJ		 1011 problem = call_transform_reverse(st,st->auxiliary_key.transform,
1012 msg0,&auxkey_err);
02b0959b
IJ		 1013 if (problem==0) {
1014 slog(st,LOG_DROP,"processing packet which uses auxiliary key");
bd98cd6b
IJ		 1015 if (st->auxiliary_is_new) {
1016 /* We previously timed out in state SENTMSG5 but it turns
1017 * out that our peer did in fact get our MSG5 and is
1018 * using the new key. So we should switch to it too. */
1019 /* This is a bit like activate_new_key. */
1020 struct data_key t;
1021 t=st->current;
1022 st->current=st->auxiliary_key;
1023 st->auxiliary_key=t;
1024
1025 delete_one_key(st,&st->auxiliary_key,"peer has used new key",
1026 "previous key",LOG_SEC);
1027 st->auxiliary_is_new=0;
1028 st->renegotiate_key_time=st->auxiliary_renegotiate_key_time;
1029 }
02b0959b
IJ		 1030 return True;
1031 }
48b97423
IJ		 1032 if (problem==2)
1033 goto skew;
02b0959b 1034
05f39b4d
IJ		 1035 if (st->state==SITE_SENTMSG5) {
1036 buffer_copy(msg0, &st->scratch);
0afd257e
IJ		 1037 problem = call_transform_reverse(st,st->new_transform,
1038 msg0,&newkey_err);
48b97423 1039 if (!problem) {
05f39b4d
IJ		 1040 /* It looks like we didn't get the peer's MSG6 */
1041 /* This is like a cut-down enter_new_state(SITE_RUN) */
1042 slog(st,LOG_STATE,"will enter state RUN (MSG0 with new key)");
1043 BUF_FREE(&st->buffer);
1044 st->timeout=0;
1045 activate_new_key(st);
1046 return True; /* do process the data in this packet */
1047 }
48b97423
IJ		 1048 if (problem==2)
1049 goto skew;
05f39b4d
IJ		 1050 }
1051
02b0959b
IJ		 1052 slog(st,LOG_SEC,"transform: %s (aux: %s, new: %s)",
1053 transform_err,auxkey_err,newkey_err);
dd9209d1 1054 initiate_key_setup(st,"incoming message would not decrypt",0);
48b97423
IJ		 1055 send_nak(src,m.dest,m.source,m.type,msg0,"message would not decrypt");
1056 return False;
1057
1058 skew:
1059 slog(st,LOG_DROP,"transform: %s (merely skew)",transform_err);
065e1922
IJ		 1060 return False;
1061}
1062
1063static bool_t process_msg0(struct site *st, struct buffer_if *msg0,
1064 const struct comm_addr *src)
1065{
1066 uint32_t type;
1067
48b97423 1068 if (!decrypt_msg0(st,msg0,src))
065e1922
IJ		 1069 return False;
1070
2fe58dfd 1071 CHECK_AVAIL(msg0,4);
59635212 1072 type=buf_unprepend_uint32(msg0);
2fe58dfd 1073 switch(type) {
794f2398
SE		 1074 case LABEL_MSG7:
1075 /* We must forget about the current session. */
1d388569 1076 delete_keys(st,"request from peer",LOG_SEC);
794f2398 1077 return True;
2fe58dfd
SE		 1078 case LABEL_MSG9:
1079 /* Deliver to netlink layer */
469fd1d9 1080 st->netlink->deliver(st->netlink->st,msg0);
446353cd 1081 transport_data_msgok(st,src);
837cf01e
IJ		 1082 /* See whether we should start negotiating a new key */
1083 if (st->now > st->renegotiate_key_time)
dd9209d1 1084 initiate_key_setup(st,"incoming packet in renegotiation window",0);
2fe58dfd 1085 return True;
2fe58dfd 1086 default:
ff05a229
SE		 1087 slog(st,LOG_SEC,"incoming encrypted message of type %08x "
1088 "(unknown)",type);
2fe58dfd
SE		 1089 break;
1090 }
1091 return False;
1092}
1093
1094static void dump_packet(struct site *st, struct buffer_if *buf,
a15faeb2 1095 const struct comm_addr *addr, bool_t incoming)
2fe58dfd 1096{
0a6cbade
IJ		 1097 uint32_t dest=get_uint32(buf->start);
1098 uint32_t source=get_uint32(buf->start+4);
1099 uint32_t msgtype=get_uint32(buf->start+8);
2fe58dfd
SE		 1100
1101 if (st->log_events & LOG_DUMP)
040ee979
SE		 1102 slilog(st->log,M_DEBUG,"%s: %s: %08x<-%08x: %08x:",
1103 st->tunname,incoming?"incoming":"outgoing",
1104 dest,source,msgtype);
2fe58dfd
SE		 1105}
1106
1107static uint32_t site_status(void *st)
1108{
1109 return 0;
1110}
1111
1112static bool_t send_msg(struct site *st)
1113{
1114 if (st->retries>0) {
446353cd 1115 transport_xmit(st, &st->setup_peers, &st->buffer, True);
e7f8ec2a 1116 st->timeout=st->now+st->setup_retry_interval;
2fe58dfd
SE		 1117 st->retries--;
1118 return True;
bd98cd6b 1119 } else if (st->state==SITE_SENTMSG5) {
4f3c75ac 1120 logtimeout(st,"timed out sending MSG5, stashing new key");
bd98cd6b
IJ		 1121 /* We stash the key we have produced, in case it turns out that
1122 * our peer did see our MSG5 after all and starts using it. */
1123 /* This is a bit like some of activate_new_key */
1124 struct transform_inst_if *t;
1125 t=st->auxiliary_key.transform;
1126 st->auxiliary_key.transform=st->new_transform;
1127 st->new_transform=t;
0afd257e 1128 dispose_transform(&st->new_transform);
bd98cd6b 1129
bd98cd6b
IJ		 1130 st->auxiliary_is_new=1;
1131 st->auxiliary_key.key_timeout=st->now+st->key_lifetime;
1132 st->auxiliary_renegotiate_key_time=st->now+st->key_renegotiate_time;
1133 st->auxiliary_key.remote_session_id=st->setup_session_id;
1134
1135 enter_state_wait(st);
1136 return False;
2fe58dfd 1137 } else {
4f3c75ac 1138 logtimeout(st,"timed out sending key setup packet "
3454dce4 1139 "(in state %s)",state_name(st->state));
2fe58dfd
SE		 1140 enter_state_wait(st);
1141 return False;
1142 }
1143}
1144
1145static void site_resolve_callback(void *sst, struct in_addr *address)
1146{
1147 struct site *st=sst;
446353cd 1148 struct comm_addr ca_buf, *ca_use;
2fe58dfd
SE		 1149
1150 if (st->state!=SITE_RESOLVE) {
1151 slog(st,LOG_UNEXPECTED,"site_resolve_callback called unexpectedly");
1152 return;
1153 }
1154 if (address) {
446353cd 1155 FILLZERO(ca_buf);
59533c16 1156 ca_buf.comm=st->comms[0];
446353cd
IJ		 1157 ca_buf.sin.sin_family=AF_INET;
1158 ca_buf.sin.sin_port=htons(st->remoteport);
1159 ca_buf.sin.sin_addr=*address;
1160 ca_use=&ca_buf;
2fe58dfd 1161 } else {
2fe58dfd 1162 slog(st,LOG_ERROR,"resolution of %s failed",st->address);
446353cd
IJ		 1163 ca_use=0;
1164 }
dd9209d1 1165 if (transport_compute_setupinit_peers(st,ca_use,0)) {
446353cd
IJ		 1166 enter_new_state(st,SITE_SENTMSG1);
1167 } else {
1168 /* Can't figure out who to try to to talk to */
1169 slog(st,LOG_SETUP_INIT,"key exchange failed: cannot find peer address");
2fe58dfd
SE		 1170 enter_state_run(st);
1171 }
1172}
1173
dd9209d1
IJ		 1174static bool_t initiate_key_setup(struct site *st, cstring_t reason,
1175 const struct comm_addr *prod_hint)
9d3a4132 1176{
77effe1d 1177 /* Reentrancy hazard: can call enter_new_state/enter_state_* */
9d3a4132 1178 if (st->state!=SITE_RUN) return False;
794f2398 1179 slog(st,LOG_SETUP_INIT,"initiating key exchange (%s)",reason);
9d3a4132 1180 if (st->address) {
794f2398 1181 slog(st,LOG_SETUP_INIT,"resolving peer address");
9d3a4132 1182 return enter_state_resolve(st);
dd9209d1 1183 } else if (transport_compute_setupinit_peers(st,0,prod_hint)) {
ff05a229 1184 return enter_new_state(st,SITE_SENTMSG1);
9d3a4132 1185 }
ff05a229 1186 slog(st,LOG_SETUP_INIT,"key exchange failed: no address for peer");
9d3a4132
SE		 1187 return False;
1188}
1189
2fe58dfd
SE		 1190static void activate_new_key(struct site *st)
1191{
1192 struct transform_inst_if *t;
1193
02b0959b
IJ		 1194 /* We have three transform instances, which we swap between old,
1195 active and setup */
1196 t=st->auxiliary_key.transform;
1197 st->auxiliary_key.transform=st->current.transform;
19e9a588 1198 st->current.transform=st->new_transform;
2fe58dfd 1199 st->new_transform=t;
0afd257e 1200 dispose_transform(&st->new_transform);
2fe58dfd 1201
2fe58dfd 1202 st->timeout=0;
bd98cd6b 1203 st->auxiliary_is_new=0;
02b0959b 1204 st->auxiliary_key.key_timeout=st->current.key_timeout;
19e9a588 1205 st->current.key_timeout=st->now+st->key_lifetime;
ff05a229 1206 st->renegotiate_key_time=st->now+st->key_renegotiate_time;
446353cd 1207 transport_peers_copy(st,&st->peers,&st->setup_peers);
19e9a588 1208 st->current.remote_session_id=st->setup_session_id;
2fe58dfd 1209
3ed1846a
IJ		 1210 /* Compute the inter-site MTU. This is min( our_mtu, their_mtu ).
1211 * But their mtu be unspecified, in which case we just use ours. */
1212 uint32_t intersite_mtu=
1213 MIN(st->mtu_target, st->remote_adv_mtu ?: ~(uint32_t)0);
1214 st->netlink->set_mtu(st->netlink->st,intersite_mtu);
1215
1216 slog(st,LOG_ACTIVATE_KEY,"new key activated"
1217 " (mtu ours=%"PRId32" theirs=%"PRId32" intersite=%"PRId32")",
1218 st->mtu_target, st->remote_adv_mtu, intersite_mtu);
9d3a4132 1219 enter_state_run(st);
2fe58dfd
SE		 1220}
1221
1d388569
IJ		 1222static void delete_one_key(struct site *st, struct data_key *key,
1223 cstring_t reason, cstring_t which, uint32_t loglevel)
1224{
0afd257e 1225 if (!is_transform_valid(key->transform)) return;
1d388569 1226 if (reason) slog(st,loglevel,"%s deleted (%s)",which,reason);
0afd257e 1227 dispose_transform(&key->transform);
1d388569
IJ		 1228 key->key_timeout=0;
1229}
1230
1231static void delete_keys(struct site *st, cstring_t reason, uint32_t loglevel)
794f2398 1232{
3d8d8f4e 1233 if (current_valid(st)) {
794f2398
SE		 1234 slog(st,loglevel,"session closed (%s)",reason);
1235
1d388569 1236 delete_one_key(st,&st->current,0,0,0);
794f2398
SE		 1237 set_link_quality(st);
1238 }
02b0959b 1239 delete_one_key(st,&st->auxiliary_key,0,0,0);
794f2398
SE		 1240}
1241
2fe58dfd
SE		 1242static void state_assert(struct site *st, bool_t ok)
1243{
4f5e39ec 1244 if (!ok) fatal("site:state_assert");
2fe58dfd
SE		 1245}
1246
1247static void enter_state_stop(struct site *st)
1248{
1249 st->state=SITE_STOP;
1250 st->timeout=0;
1d388569 1251 delete_keys(st,"entering state STOP",LOG_TIMEOUT_KEY);
0afd257e 1252 dispose_transform(&st->new_transform);
2fe58dfd
SE		 1253}
1254
9d3a4132
SE		 1255static void set_link_quality(struct site *st)
1256{
1257 uint32_t quality;
3d8d8f4e 1258 if (current_valid(st))
9d3a4132
SE		 1259 quality=LINK_QUALITY_UP;
1260 else if (st->state==SITE_WAIT || st->state==SITE_STOP)
1261 quality=LINK_QUALITY_DOWN;
1262 else if (st->address)
1263 quality=LINK_QUALITY_DOWN_CURRENT_ADDRESS;
446353cd 1264 else if (transport_peers_valid(&st->peers))
9d3a4132
SE		 1265 quality=LINK_QUALITY_DOWN_STALE_ADDRESS;
1266 else
1267 quality=LINK_QUALITY_DOWN;
1268
469fd1d9 1269 st->netlink->set_quality(st->netlink->st,quality);
9d3a4132
SE		 1270}
1271
2fe58dfd
SE		 1272static void enter_state_run(struct site *st)
1273{
1274 slog(st,LOG_STATE,"entering state RUN");
1275 st->state=SITE_RUN;
1276 st->timeout=0;
9d3a4132 1277
ff05a229 1278 st->setup_session_id=0;
446353cd 1279 transport_peers_clear(st,&st->setup_peers);
ff05a229
SE		 1280 memset(st->localN,0,NONCELEN);
1281 memset(st->remoteN,0,NONCELEN);
0afd257e 1282 dispose_transform(&st->new_transform);
ff05a229 1283 memset(st->dhsecret,0,st->dh->len);
7c9ca4bd 1284 memset(st->sharedsecret,0,st->sharedsecretlen);
9d3a4132 1285 set_link_quality(st);
2fe58dfd
SE		 1286}
1287
1288static bool_t enter_state_resolve(struct site *st)
1289{
77effe1d 1290 /* Reentrancy hazard! See ensure_resolving. */
2fe58dfd
SE		 1291 state_assert(st,st->state==SITE_RUN);
1292 slog(st,LOG_STATE,"entering state RESOLVE");
1293 st->state=SITE_RESOLVE;
75829536
IJ		 1294 return st->resolver->request(st->resolver->st,st->address,
1295 site_resolve_callback,st);
2fe58dfd
SE		 1296}
1297
ff05a229 1298static bool_t enter_new_state(struct site *st, uint32_t next)
2fe58dfd 1299{
ff05a229 1300 bool_t (*gen)(struct site *st);
3b83c932
SE		 1301 int r;
1302
ff05a229
SE		 1303 slog(st,LOG_STATE,"entering state %s",state_name(next));
1304 switch(next) {
1305 case SITE_SENTMSG1:
1306 state_assert(st,st->state==SITE_RUN || st->state==SITE_RESOLVE);
1307 gen=generate_msg1;
1308 break;
1309 case SITE_SENTMSG2:
1310 state_assert(st,st->state==SITE_RUN || st->state==SITE_RESOLVE ||
1311 st->state==SITE_SENTMSG1 || st->state==SITE_WAIT);
1312 gen=generate_msg2;
1313 break;
1314 case SITE_SENTMSG3:
1315 state_assert(st,st->state==SITE_SENTMSG1);
1316 BUF_FREE(&st->buffer);
1317 gen=generate_msg3;
1318 break;
1319 case SITE_SENTMSG4:
1320 state_assert(st,st->state==SITE_SENTMSG2);
1321 BUF_FREE(&st->buffer);
1322 gen=generate_msg4;
1323 break;
1324 case SITE_SENTMSG5:
1325 state_assert(st,st->state==SITE_SENTMSG3);
1326 BUF_FREE(&st->buffer);
1327 gen=generate_msg5;
1328 break;
1329 case SITE_RUN:
1330 state_assert(st,st->state==SITE_SENTMSG4);
1331 BUF_FREE(&st->buffer);
1332 gen=generate_msg6;
1333 break;
1334 default:
1335 gen=NULL;
4f5e39ec 1336 fatal("enter_new_state(%s): invalid new state",state_name(next));
ff05a229 1337 break;
2fe58dfd 1338 }
2fe58dfd 1339
3b83c932
SE		 1340 if (hacky_par_start_failnow()) return False;
1341
1342 r= gen(st) && send_msg(st);
1343
1344 hacky_par_end(&r,
e7f8ec2a 1345 st->setup_retries, st->setup_retry_interval,
3b83c932
SE		 1346 send_msg, st);
1347
1348 if (r) {
ff05a229
SE		 1349 st->state=next;
1350 if (next==SITE_RUN) {
1351 BUF_FREE(&st->buffer); /* Never reused */
1352 st->timeout=0; /* Never retransmit */
1353 activate_new_key(st);
1354 }
2fe58dfd
SE		 1355 return True;
1356 }
ff05a229
SE		 1357 slog(st,LOG_ERROR,"error entering state %s",state_name(next));
1358 st->buffer.free=False; /* Unconditionally use the buffer; it may be
1359 in either state, and enter_state_wait() will
1360 do a BUF_FREE() */
2fe58dfd
SE		 1361 enter_state_wait(st);
1362 return False;
1363}
1364
ff05a229 1365/* msg7 tells our peer that we're about to forget our key */
fe5e9cc4 1366static bool_t send_msg7(struct site *st, cstring_t reason)
794f2398 1367{
fe5e9cc4 1368 cstring_t transform_err;
794f2398 1369
3d8d8f4e 1370 if (current_valid(st) && st->buffer.free
446353cd 1371 && transport_peers_valid(&st->peers)) {
794f2398 1372 BUF_ALLOC(&st->buffer,"site:MSG7");
3abd18e8 1373 buffer_init(&st->buffer,calculate_max_start_pad());
794f2398
SE		 1374 buf_append_uint32(&st->buffer,LABEL_MSG7);
1375 buf_append_string(&st->buffer,reason);
0afd257e
IJ		 1376 if (call_transform_forwards(st, st->current.transform,
1377 &st->buffer, &transform_err))
1378 goto free_out;
794f2398 1379 buf_prepend_uint32(&st->buffer,LABEL_MSG0);
58650a70 1380 buf_prepend_uint32(&st->buffer,st->index);
19e9a588 1381 buf_prepend_uint32(&st->buffer,st->current.remote_session_id);
446353cd 1382 transport_xmit(st,&st->peers,&st->buffer,True);
794f2398 1383 BUF_FREE(&st->buffer);
0afd257e 1384 free_out:
794f2398
SE		 1385 return True;
1386 }
1387 return False;
1388}
1389
2fe58dfd
SE		 1390/* We go into this state if our peer becomes uncommunicative. Similar to
1391 the "stop" state, we forget all session keys for a while, before
1392 re-entering the "run" state. */
1393static void enter_state_wait(struct site *st)
1394{
1395 slog(st,LOG_STATE,"entering state WAIT");
1396 st->timeout=st->now+st->wait_timeout;
1397 st->state=SITE_WAIT;
9d3a4132 1398 set_link_quality(st);
2fe58dfd
SE		 1399 BUF_FREE(&st->buffer); /* will have had an outgoing packet in it */
1400 /* XXX Erase keys etc. */
1401}
1402
dd9209d1
IJ		 1403static void generate_prod(struct site *st, struct buffer_if *buf)
1404{
1405 buffer_init(buf,0);
1406 buf_append_uint32(buf,0);
1407 buf_append_uint32(buf,0);
1408 buf_append_uint32(buf,LABEL_PROD);
1409 buf_append_string(buf,st->localname);
1410 buf_append_string(buf,st->remotename);
1411}
1412
1413static void generate_send_prod(struct site *st,
1414 const struct comm_addr *source)
1415{
1416 if (!st->allow_send_prod) return; /* too soon */
1417 if (!(st->state==SITE_RUN || st->state==SITE_RESOLVE ||
1418 st->state==SITE_WAIT)) return; /* we'd ignore peer's MSG1 */
1419
1420 slog(st,LOG_SETUP_INIT,"prodding peer for key exchange");
1421 st->allow_send_prod=0;
1422 generate_prod(st,&st->scratch);
1423 dump_packet(st,&st->scratch,source,False);
1424 source->comm->sendmsg(source->comm->st, &st->scratch, source);
1425}
1426
16f73fa6 1427static inline void site_settimeout(uint64_t timeout, int *timeout_io)
fe5e9cc4
SE		 1428{
1429 if (timeout) {
0009e60a
IJ		 1430 int64_t offset=timeout-*now;
1431 if (offset<0) offset=0;
fe5e9cc4
SE		 1432 if (offset>INT_MAX) offset=INT_MAX;
1433 if (*timeout_io<0 || offset<*timeout_io)
1434 *timeout_io=offset;
1435 }
1436}
1437
2fe58dfd 1438static int site_beforepoll(void *sst, struct pollfd *fds, int *nfds_io,
90a39563 1439 int *timeout_io)
2fe58dfd
SE		 1440{
1441 struct site *st=sst;
1442
1443 *nfds_io=0; /* We don't use any file descriptors */
1444 st->now=*now;
1445
1446 /* Work out when our next timeout is. The earlier of 'timeout' or
19e9a588 1447 'current.key_timeout'. A stored value of '0' indicates no timeout
2fe58dfd 1448 active. */
16f73fa6 1449 site_settimeout(st->timeout, timeout_io);
19e9a588 1450 site_settimeout(st->current.key_timeout, timeout_io);
02b0959b 1451 site_settimeout(st->auxiliary_key.key_timeout, timeout_io);
2fe58dfd
SE		 1452
1453 return 0; /* success */
1454}
1455
1d388569
IJ		 1456static void check_expiry(struct site *st, struct data_key *key,
1457 const char *which)
1458{
1459 if (key->key_timeout && *now>key->key_timeout) {
1460 delete_one_key(st,key,"maximum life exceeded",which,LOG_TIMEOUT_KEY);
1461 }
1462}
1463
2fe58dfd 1464/* NB site_afterpoll will be called before site_beforepoll is ever called */
90a39563 1465static void site_afterpoll(void *sst, struct pollfd *fds, int nfds)
2fe58dfd
SE		 1466{
1467 struct site *st=sst;
1468
1469 st->now=*now;
1470 if (st->timeout && *now>st->timeout) {
2fe58dfd 1471 st->timeout=0;
3b83c932
SE		 1472 if (st->state>=SITE_SENTMSG1 && st->state<=SITE_SENTMSG5) {
1473 if (!hacky_par_start_failnow())
1474 send_msg(st);
1475 } else if (st->state==SITE_WAIT) {
2fe58dfd
SE		 1476 enter_state_run(st);
1477 } else {
1478 slog(st,LOG_ERROR,"site_afterpoll: unexpected timeout, state=%d",
1479 st->state);
1480 }
1481 }
1d388569 1482 check_expiry(st,&st->current,"current key");
02b0959b 1483 check_expiry(st,&st->auxiliary_key,"auxiliary key");
2fe58dfd
SE		 1484}
1485
1486/* This function is called by the netlink device to deliver packets
1487 intended for the remote network. The packet is in "raw" wire
1488 format, but is guaranteed to be word-aligned. */
469fd1d9 1489static void site_outgoing(void *sst, struct buffer_if *buf)
2fe58dfd
SE		 1490{
1491 struct site *st=sst;
fe5e9cc4 1492 cstring_t transform_err;
2fe58dfd
SE		 1493
1494 if (st->state==SITE_STOP) {
1495 BUF_FREE(buf);
1496 return;
1497 }
1498
dd9209d1
IJ		 1499 st->allow_send_prod=1;
1500
2fe58dfd
SE		 1501 /* In all other states we consider delivering the packet if we have
1502 a valid key and a valid address to send it to. */
3d8d8f4e 1503 if (current_valid(st) && transport_peers_valid(&st->peers)) {
2fe58dfd 1504 /* Transform it and send it */
70dc107b
SE		 1505 if (buf->size>0) {
1506 buf_prepend_uint32(buf,LABEL_MSG9);
0afd257e
IJ		 1507 if (call_transform_forwards(st, st->current.transform,
1508 buf, &transform_err))
1509 goto free_out;
70dc107b 1510 buf_prepend_uint32(buf,LABEL_MSG0);
58650a70 1511 buf_prepend_uint32(buf,st->index);
19e9a588 1512 buf_prepend_uint32(buf,st->current.remote_session_id);
446353cd 1513 transport_xmit(st,&st->peers,buf,False);
70dc107b 1514 }
0afd257e 1515 free_out:
2fe58dfd
SE		 1516 BUF_FREE(buf);
1517 return;
1518 }
1519
70dc107b 1520 slog(st,LOG_DROP,"discarding outgoing packet of size %d",buf->size);
2fe58dfd 1521 BUF_FREE(buf);
dd9209d1 1522 initiate_key_setup(st,"outgoing packet",0);
2fe58dfd
SE		 1523}
1524
7e29719e
IJ		 1525static bool_t named_for_us(struct site *st, const struct buffer_if *buf_in,
1526 uint32_t type, struct msg *m)
1527 /* For packets which are identified by the local and remote names.
1528 * If it has our name and our peer's name in it it's for us. */
1529{
1530 struct buffer_if buf[1];
1531 buffer_readonly_clone(buf,buf_in);
1532 return unpick_msg(st,type,buf,m)
1533 && name_matches(&m->remote,st->remotename)
1534 && name_matches(&m->local,st->localname);
1535}
1536
2fe58dfd 1537/* This function is called by the communication device to deliver
dd9209d1
IJ		 1538 packets from our peers.
1539 It should return True if the packet is recognised as being for
1540 this current site instance (and should therefore not be processed
1541 by other sites), even if the packet was otherwise ignored. */
2fe58dfd 1542static bool_t site_incoming(void *sst, struct buffer_if *buf,
a15faeb2 1543 const struct comm_addr *source)
2fe58dfd
SE		 1544{
1545 struct site *st=sst;
20138876
IJ		 1546
1547 if (buf->size < 12) return False;
1548
0a6cbade
IJ		 1549 uint32_t dest=get_uint32(buf->start);
1550 uint32_t msgtype=get_uint32(buf->start+8);
7e29719e
IJ		 1551 struct msg named_msg;
1552
1553 if (msgtype==LABEL_MSG1) {
1554 if (!named_for_us(st,buf,msgtype,&named_msg))
1555 return False;
1556 /* It's a MSG1 addressed to us. Decide what to do about it. */
1557 dump_packet(st,buf,source,True);
1558 if (st->state==SITE_RUN || st->state==SITE_RESOLVE ||
1559 st->state==SITE_WAIT) {
1560 /* We should definitely process it */
1561 if (process_msg1(st,buf,source,&named_msg)) {
1562 slog(st,LOG_SETUP_INIT,"key setup initiated by peer");
1563 enter_new_state(st,SITE_SENTMSG2);
1564 } else {
1565 slog(st,LOG_ERROR,"failed to process incoming msg1");
1566 }
1567 BUF_FREE(buf);
1568 return True;
1569 } else if (st->state==SITE_SENTMSG1) {
1570 /* We've just sent a message 1! They may have crossed on
1571 the wire. If we have priority then we ignore the
1572 incoming one, otherwise we process it as usual. */
1573 if (st->setup_priority) {
1574 BUF_FREE(buf);
1575 slog(st,LOG_DUMP,"crossed msg1s; we are higher "
1576 "priority => ignore incoming msg1");
1577 return True;
1578 } else {
1579 slog(st,LOG_DUMP,"crossed msg1s; we are lower "
1580 "priority => use incoming msg1");
1581 if (process_msg1(st,buf,source,&named_msg)) {
1582 BUF_FREE(&st->buffer); /* Free our old message 1 */
ff05a229 1583 enter_new_state(st,SITE_SENTMSG2);
2fe58dfd 1584 } else {
7e29719e
IJ		 1585 slog(st,LOG_ERROR,"failed to process an incoming "
1586 "crossed msg1 (we have low priority)");
2fe58dfd
SE		 1587 }
1588 BUF_FREE(buf);
1589 return True;
2fe58dfd 1590 }
2fe58dfd 1591 }
7e29719e
IJ		 1592 /* The message 1 was received at an unexpected stage of the
1593 key setup. XXX POLICY - what do we do? */
1594 slog(st,LOG_UNEXPECTED,"unexpected incoming message 1");
1595 BUF_FREE(buf);
1596 return True;
2fe58dfd 1597 }
dd9209d1
IJ		 1598 if (msgtype==LABEL_PROD) {
1599 if (!named_for_us(st,buf,msgtype,&named_msg))
1600 return False;
1601 dump_packet(st,buf,source,True);
1602 if (st->state!=SITE_RUN) {
1603 slog(st,LOG_DROP,"ignoring PROD when not in state RUN");
1604 } else if (current_valid(st)) {
1605 slog(st,LOG_DROP,"ignoring PROD when we think we have a key");
1606 } else {
1607 initiate_key_setup(st,"peer sent PROD packet",source);
1608 }
1609 BUF_FREE(buf);
1610 return True;
1611 }
58650a70 1612 if (dest==st->index) {
2fe58dfd
SE		 1613 /* Explicitly addressed to us */
1614 if (msgtype!=LABEL_MSG0) dump_packet(st,buf,source,True);
1615 switch (msgtype) {
136740e6 1616 case LABEL_NAK:
794f2398
SE		 1617 /* If the source is our current peer then initiate a key setup,
1618 because our peer's forgotten the key */
19e9a588 1619 if (get_uint32(buf->start+4)==st->current.remote_session_id) {
dd9209d1
IJ		 1620 bool_t initiated;
1621 initiated = initiate_key_setup(st,"received a NAK",0);
1622 if (!initiated) generate_send_prod(st,source);
794f2398
SE		 1623 } else {
1624 slog(st,LOG_SEC,"bad incoming NAK");
1625 }
1626 break;
2fe58dfd
SE		 1627 case LABEL_MSG0:
1628 process_msg0(st,buf,source);
1629 break;
1630 case LABEL_MSG1:
1631 /* Setup packet: should not have been explicitly addressed
1632 to us */
59635212 1633 slog(st,LOG_SEC,"incoming explicitly addressed msg1");
2fe58dfd
SE		 1634 break;
1635 case LABEL_MSG2:
1636 /* Setup packet: expected only in state SENTMSG1 */
1637 if (st->state!=SITE_SENTMSG1) {
1638 slog(st,LOG_UNEXPECTED,"unexpected MSG2");
446353cd
IJ		 1639 } else if (process_msg2(st,buf,source)) {
1640 transport_setup_msgok(st,source);
ff05a229 1641 enter_new_state(st,SITE_SENTMSG3);
446353cd 1642 } else {
59635212 1643 slog(st,LOG_SEC,"invalid MSG2");
2fe58dfd
SE		 1644 }
1645 break;
1646 case LABEL_MSG3:
5b5f297f 1647 case LABEL_MSG3BIS:
2fe58dfd
SE		 1648 /* Setup packet: expected only in state SENTMSG2 */
1649 if (st->state!=SITE_SENTMSG2) {
1650 slog(st,LOG_UNEXPECTED,"unexpected MSG3");
5b5f297f 1651 } else if (process_msg3(st,buf,source,msgtype)) {
446353cd 1652 transport_setup_msgok(st,source);
ff05a229 1653 enter_new_state(st,SITE_SENTMSG4);
446353cd 1654 } else {
59635212 1655 slog(st,LOG_SEC,"invalid MSG3");
2fe58dfd
SE		 1656 }
1657 break;
1658 case LABEL_MSG4:
1659 /* Setup packet: expected only in state SENTMSG3 */
1660 if (st->state!=SITE_SENTMSG3) {
1661 slog(st,LOG_UNEXPECTED,"unexpected MSG4");
446353cd
IJ		 1662 } else if (process_msg4(st,buf,source)) {
1663 transport_setup_msgok(st,source);
ff05a229 1664 enter_new_state(st,SITE_SENTMSG5);
446353cd 1665 } else {
59635212 1666 slog(st,LOG_SEC,"invalid MSG4");
2fe58dfd
SE		 1667 }
1668 break;
1669 case LABEL_MSG5:
4efd681a
SE		 1670 /* Setup packet: expected only in state SENTMSG4 */
1671 /* (may turn up in state RUN if our return MSG6 was lost
1672 and the new key has already been activated. In that
05f39b4d
IJ		 1673 case we discard it. The peer will realise that we
1674 are using the new key when they see our data packets.
1675 Until then the peer's data packets to us get discarded. */
c90cc2a7
IJ		 1676 if (st->state==SITE_SENTMSG4) {
1677 if (process_msg5(st,buf,source,st->new_transform)) {
1678 transport_setup_msgok(st,source);
1679 enter_new_state(st,SITE_RUN);
1680 } else {
1681 slog(st,LOG_SEC,"invalid MSG5");
1682 }
1683 } else if (st->state==SITE_RUN) {
19e9a588 1684 if (process_msg5(st,buf,source,st->current.transform)) {
c90cc2a7
IJ		 1685 slog(st,LOG_DROP,"got MSG5, retransmitting MSG6");
1686 transport_setup_msgok(st,source);
19e9a588
IJ		 1687 create_msg6(st,st->current.transform,
1688 st->current.remote_session_id);
c90cc2a7
IJ		 1689 transport_xmit(st,&st->peers,&st->buffer,True);
1690 BUF_FREE(&st->buffer);
1691 } else {
1692 slog(st,LOG_SEC,"invalid MSG5 (in state RUN)");
1693 }
2fe58dfd 1694 } else {
c90cc2a7 1695 slog(st,LOG_UNEXPECTED,"unexpected MSG5");
2fe58dfd
SE		 1696 }
1697 break;
1698 case LABEL_MSG6:
1699 /* Setup packet: expected only in state SENTMSG5 */
1700 if (st->state!=SITE_SENTMSG5) {
1701 slog(st,LOG_UNEXPECTED,"unexpected MSG6");
1702 } else if (process_msg6(st,buf,source)) {
1703 BUF_FREE(&st->buffer); /* Free message 5 */
446353cd 1704 transport_setup_msgok(st,source);
2fe58dfd
SE		 1705 activate_new_key(st);
1706 } else {
59635212 1707 slog(st,LOG_SEC,"invalid MSG6");
2fe58dfd
SE		 1708 }
1709 break;
2fe58dfd 1710 default:
59635212 1711 slog(st,LOG_SEC,"received message of unknown type 0x%08x",
2fe58dfd
SE		 1712 msgtype);
1713 break;
1714 }
1715 BUF_FREE(buf);
1716 return True;
1717 }
1718
1719 return False;
1720}
1721
1722static void site_control(void *vst, bool_t run)
1723{
1724 struct site *st=vst;
1725 if (run) enter_state_run(st);
1726 else enter_state_stop(st);
1727}
1728
794f2398
SE		 1729static void site_phase_hook(void *sst, uint32_t newphase)
1730{
1731 struct site *st=sst;
1732
1733 /* The program is shutting down; tell our peer */
1734 send_msg7(st,"shutting down");
1735}
1736
2fe58dfd
SE		 1737static list_t *site_apply(closure_t *self, struct cloc loc, dict_t *context,
1738 list_t *args)
1739{
58650a70 1740 static uint32_t index_sequence;
2fe58dfd
SE		 1741 struct site *st;
1742 item_t *item;
1743 dict_t *dict;
59533c16 1744 int i;
2fe58dfd
SE		 1745
1746 st=safe_malloc(sizeof(*st),"site_apply");
1747
1748 st->cl.description="site";
1749 st->cl.type=CL_SITE;
1750 st->cl.apply=NULL;
1751 st->cl.interface=&st->ops;
1752 st->ops.st=st;
1753 st->ops.control=site_control;
1754 st->ops.status=site_status;
1755
1756 /* First parameter must be a dict */
1757 item=list_elem(args,0);
1758 if (!item || item->type!=t_dict)
1759 cfgfatal(loc,"site","parameter must be a dictionary\n");
1760
1761 dict=item->data.dict;
558fa3fb
SE		 1762 st->localname=dict_read_string(dict, "local-name", True, "site", loc);
1763 st->remotename=dict_read_string(dict, "name", True, "site", loc);
dba19f84
IJ		 1764
1765 st->peer_mobile=dict_read_bool(dict,"mobile",False,"site",loc,False);
1766 bool_t local_mobile=
1767 dict_read_bool(dict,"local-mobile",False,"site",loc,False);
1768
558fa3fb
SE		 1769 /* Sanity check (which also allows the 'sites' file to include
1770 site() closures for all sites including our own): refuse to
1771 talk to ourselves */
1772 if (strcmp(st->localname,st->remotename)==0) {
b2a56f7c 1773 Message(M_DEBUG,"site %s: local-name==name -> ignoring this site\n",
baa06aeb 1774 st->localname);
dba19f84
IJ		 1775 if (st->peer_mobile != local_mobile)
1776 cfgfatal(loc,"site","site %s's peer-mobile=%d"
1777 " but our local-mobile=%d\n",
1778 st->localname, st->peer_mobile, local_mobile);
1779 free(st);
1780 return NULL;
1781 }
1782 if (st->peer_mobile && local_mobile) {
1783 Message(M_WARNING,"site %s: site is mobile but so are we"
1784 " -> ignoring this site\n", st->remotename);
558fa3fb
SE		 1785 free(st);
1786 return NULL;
1787 }
dba19f84 1788
58650a70
RK		 1789 assert(index_sequence < 0xffffffffUL);
1790 st->index = ++index_sequence;
09a385fb 1791 st->local_capabilities = 0;
469fd1d9 1792 st->netlink=find_cl_if(dict,"link",CL_NETLINK,True,"site",loc);
59533c16 1793
5b5f297f
IJ		 1794#define GET_CLOSURE_LIST(dictkey,things,nthings,CL_TYPE) do{ \
1795 list_t *things##_cfg=dict_lookup(dict,dictkey); \
1796 if (!things##_cfg) \
1797 cfgfatal(loc,"site","closure list \"%s\" not found\n",dictkey); \
1798 st->nthings=list_length(things##_cfg); \
1799 st->things=safe_malloc_ary(sizeof(*st->things),st->nthings,dictkey "s"); \
1800 assert(st->nthings); \
1801 for (i=0; i<st->nthings; i++) { \
1802 item_t *item=list_elem(things##_cfg,i); \
1803 if (item->type!=t_closure) \
1804 cfgfatal(loc,"site","%s is not a closure\n",dictkey); \
1805 closure_t *cl=item->data.closure; \
1806 if (cl->type!=CL_TYPE) \
1807 cfgfatal(loc,"site","%s closure wrong type\n",dictkey); \
1808 st->things[i]=cl->interface; \
1809 } \
1810}while(0)
1811
1812 GET_CLOSURE_LIST("comm",comms,ncomms,CL_COMM);
59533c16 1813
2fe58dfd
SE		 1814 st->resolver=find_cl_if(dict,"resolver",CL_RESOLVER,True,"site",loc);
1815 st->log=find_cl_if(dict,"log",CL_LOG,True,"site",loc);
1816 st->random=find_cl_if(dict,"random",CL_RANDOMSRC,True,"site",loc);
1817
2fe58dfd 1818 st->privkey=find_cl_if(dict,"local-key",CL_RSAPRIVKEY,True,"site",loc);
2fe58dfd 1819 st->address=dict_read_string(dict, "address", False, "site", loc);
3454dce4
SE		 1820 if (st->address)
1821 st->remoteport=dict_read_number(dict,"port",True,"site",loc,0);
1822 else st->remoteport=0;
2fe58dfd
SE		 1823 st->pubkey=find_cl_if(dict,"key",CL_RSAPUBKEY,True,"site",loc);
1824
5b5f297f 1825 GET_CLOSURE_LIST("transform",transforms,ntransforms,CL_TRANSFORM);
2fe58dfd
SE		 1826
1827 st->dh=find_cl_if(dict,"dh",CL_DH,True,"site",loc);
1828 st->hash=find_cl_if(dict,"hash",CL_HASH,True,"site",loc);
1829
e57264d6
IJ		 1830#define DEFAULT(D) (st->peer_mobile || local_mobile \
1831 ? DEFAULT_MOBILE_##D : DEFAULT_##D)
e7f8ec2a 1832#define CFG_NUMBER(k,D) dict_read_number(dict,(k),False,"site",loc,DEFAULT(D));
c27ca22f 1833
e7f8ec2a
IJ		 1834 st->key_lifetime= CFG_NUMBER("key-lifetime", KEY_LIFETIME);
1835 st->setup_retries= CFG_NUMBER("setup-retries", SETUP_RETRIES);
1836 st->setup_retry_interval= CFG_NUMBER("setup-timeout", SETUP_RETRY_INTERVAL);
1837 st->wait_timeout= CFG_NUMBER("wait-time", WAIT_TIME);
3ed1846a 1838 st->mtu_target= dict_read_number(dict,"mtu-target",False,"site",loc,0);
e7f8ec2a 1839
446353cd
IJ		 1840 st->mobile_peer_expiry= dict_read_number(
1841 dict,"mobile-peer-expiry",False,"site",loc,DEFAULT_MOBILE_PEER_EXPIRY);
1842
1843 st->transport_peers_max= !st->peer_mobile ? 1 : dict_read_number(
1844 dict,"mobile-peers-max",False,"site",loc,DEFAULT_MOBILE_PEERS_MAX);
1845 if (st->transport_peers_max<1 ||
1846 st->transport_peers_max>=MAX_MOBILE_PEERS_MAX) {
1847 cfgfatal(loc,"site","mobile-peers-max must be in range 1.."
1848 STRING(MAX_MOBILE_PEERS_MAX) "\n");
1849 }
1850
e7f8ec2a 1851 if (st->key_lifetime < DEFAULT(KEY_RENEGOTIATE_GAP)*2)
c27ca22f
IJ		 1852 st->key_renegotiate_time=st->key_lifetime/2;
1853 else
e7f8ec2a 1854 st->key_renegotiate_time=st->key_lifetime-DEFAULT(KEY_RENEGOTIATE_GAP);
9d3a4132 1855 st->key_renegotiate_time=dict_read_number(
cce0051f 1856 dict,"renegotiate-time",False,"site",loc,st->key_renegotiate_time);
9d3a4132
SE		 1857 if (st->key_renegotiate_time > st->key_lifetime) {
1858 cfgfatal(loc,"site",
1859 "renegotiate-time must be less than key-lifetime\n");
1860 }
9d3a4132
SE		 1861
1862 st->log_events=string_list_to_word(dict_lookup(dict,"log-events"),
1863 log_event_table,"site");
2fe58dfd 1864
dd9209d1
IJ		 1865 st->allow_send_prod=0;
1866
4efd681a
SE		 1867 st->tunname=safe_malloc(strlen(st->localname)+strlen(st->remotename)+5,
1868 "site_apply");
1869 sprintf(st->tunname,"%s<->%s",st->localname,st->remotename);
1870
2fe58dfd 1871 /* The information we expect to see in incoming messages of type 1 */
59230b9b
IJ		 1872 /* fixme: lots of unchecked overflows here, but the results are only
1873 corrupted packets rather than undefined behaviour */
2fe58dfd
SE		 1874 st->setup_priority=(strcmp(st->localname,st->remotename)>0);
1875
1876 buffer_new(&st->buffer,SETUP_BUFFER_LEN);
1877
8aaaa634 1878 buffer_new(&st->scratch,SETUP_BUFFER_LEN);
05f39b4d
IJ		 1879 BUF_ALLOC(&st->scratch,"site:scratch");
1880
2fe58dfd
SE		 1881 /* We are interested in poll(), but only for timeouts. We don't have
1882 any fds of our own. */
1883 register_for_poll(st, site_beforepoll, site_afterpoll, 0, "site");
1884 st->timeout=0;
1885
09a385fb 1886 st->remote_capabilities=0;
5b5f297f 1887 st->chosen_transform=0;
19e9a588 1888 st->current.key_timeout=0;
02b0959b 1889 st->auxiliary_key.key_timeout=0;
446353cd
IJ		 1890 transport_peers_clear(st,&st->peers);
1891 transport_peers_clear(st,&st->setup_peers);
2fe58dfd
SE		 1892 /* XXX mlock these */
1893 st->dhsecret=safe_malloc(st->dh->len,"site:dhsecret");
5b5f297f
IJ		 1894 st->sharedsecretlen=st->sharedsecretallocd=0;
1895 st->sharedsecret=0;
1896
5b5f297f
IJ		 1897 for (i=0; i<st->ntransforms; i++) {
1898 struct transform_if *ti=st->transforms[i];
1899 uint32_t capbit = 1UL << ti->capab_transformnum;
1900 if (st->local_capabilities & capbit)
1901 slog(st,LOG_ERROR,"transformnum capability bit"
1902 " %d (%#"PRIx32") reused", ti->capab_transformnum, capbit);
1903 st->local_capabilities |= capbit;
59533c16 1904 }
59533c16 1905
2fe58dfd 1906 /* We need to register the remote networks with the netlink device */
3ed1846a
IJ		 1907 uint32_t netlink_mtu; /* local virtual interface mtu */
1908 st->netlink->reg(st->netlink->st, site_outgoing, st, &netlink_mtu);
1909 if (!st->mtu_target)
1910 st->mtu_target=netlink_mtu;
ff05a229 1911
59533c16
IJ		 1912 for (i=0; i<st->ncomms; i++)
1913 st->comms[i]->request_notify(st->comms[i]->st, st, site_incoming);
2fe58dfd 1914
fcad4b0b
IJ		 1915 st->current.transform=0;
1916 st->auxiliary_key.transform=0;
1917 st->new_transform=0;
bd98cd6b 1918 st->auxiliary_is_new=0;
2fe58dfd
SE		 1919
1920 enter_state_stop(st);
1921
794f2398
SE		 1922 add_hook(PHASE_SHUTDOWN,site_phase_hook,st);
1923
2fe58dfd
SE		 1924 return new_closure(&st->cl);
1925}
1926
2fe58dfd
SE		 1927void site_module(dict_t *dict)
1928{
1929 add_closure(dict,"site",site_apply);
1930}
446353cd
IJ		 1931
1932
1933/***** TRANSPORT PEERS definitions *****/
1934
1935static void transport_peers_debug(struct site *st, transport_peers *dst,
1936 const char *didwhat,
1937 int nargs, const struct comm_addr *args,
1938 size_t stride) {
1939 int i;
1940 char *argp;
1941
1942 if (!(st->log_events & LOG_PEER_ADDRS))
1943 return; /* an optimisation */
1944
1945 slog(st, LOG_PEER_ADDRS, "peers (%s) %s nargs=%d => npeers=%d",
1946 (dst==&st->peers ? "data" :
1947 dst==&st->setup_peers ? "setup" : "UNKNOWN"),
1948 didwhat, nargs, dst->npeers);
1949
1950 for (i=0, argp=(void*)args;
1951 i<nargs;
1952 i++, (argp+=stride?stride:sizeof(*args))) {
1953 const struct comm_addr *ca=(void*)argp;
1954 slog(st, LOG_PEER_ADDRS, " args: addrs[%d]=%s",
1a448682 1955 i, comm_addr_to_string(ca));
446353cd
IJ		 1956 }
1957 for (i=0; i<dst->npeers; i++) {
1958 struct timeval diff;
1959 timersub(tv_now,&dst->peers[i].last,&diff);
1960 const struct comm_addr *ca=&dst->peers[i].addr;
1961 slog(st, LOG_PEER_ADDRS, " peers: addrs[%d]=%s T-%ld.%06ld",
1a448682 1962 i, comm_addr_to_string(ca),
446353cd
IJ		 1963 (unsigned long)diff.tv_sec, (unsigned long)diff.tv_usec);
1964 }
1965}
1966
1967static int transport_peer_compar(const void *av, const void *bv) {
1968 const transport_peer *a=av;
1969 const transport_peer *b=bv;
1970 /* put most recent first in the array */
1971 if (timercmp(&a->last, &b->last, <)) return +1;
1972 if (timercmp(&a->last, &b->last, >)) return -11;
1973 return 0;
1974}
1975
1976static void transport_peers_expire(struct site *st, transport_peers *peers) {
1977 /* peers must be sorted first */
1978 int previous_peers=peers->npeers;
1979 struct timeval oldest;
1980 oldest.tv_sec = tv_now->tv_sec - st->mobile_peer_expiry;
1981 oldest.tv_usec = tv_now->tv_usec;
1982 while (peers->npeers>1 &&
1983 timercmp(&peers->peers[peers->npeers-1].last, &oldest, <))
1984 peers->npeers--;
1985 if (peers->npeers != previous_peers)
1986 transport_peers_debug(st,peers,"expire", 0,0,0);
1987}
1988
1989static void transport_record_peer(struct site *st, transport_peers *peers,
1990 const struct comm_addr *addr, const char *m) {
1991 int slot, changed=0;
1992
1993 for (slot=0; slot<peers->npeers; slot++)
1994 if (!memcmp(&peers->peers[slot].addr, addr, sizeof(*addr)))
1995 goto found;
1996
1997 changed=1;
1998 if (peers->npeers==st->transport_peers_max)
925c5ca8 1999 slot=st->transport_peers_max-1;
446353cd
IJ		 2000 else
2001 slot=peers->npeers++;
2002
2003 found:
2004 peers->peers[slot].addr=*addr;
2005 peers->peers[slot].last=*tv_now;
2006
2007 if (peers->npeers>1)
2008 qsort(peers->peers, peers->npeers,
2009 sizeof(*peers->peers), transport_peer_compar);
2010
2011 if (changed || peers->npeers!=1)
2012 transport_peers_debug(st,peers,m, 1,addr,0);
2013 transport_peers_expire(st, peers);
2014}
2015
2016static bool_t transport_compute_setupinit_peers(struct site *st,
dd9209d1
IJ		 2017 const struct comm_addr *configured_addr /* 0 if none or not found */,
2018 const struct comm_addr *prod_hint_addr /* 0 if none */) {
446353cd 2019
dd9209d1
IJ		 2020 if (!configured_addr && !prod_hint_addr &&
2021 !transport_peers_valid(&st->peers))
446353cd
IJ		 2022 return False;
2023
2024 slog(st,LOG_SETUP_INIT,
dd9209d1
IJ		 2025 "using:%s%s %d old peer address(es)",
2026 configured_addr ? " configured address;" : "",
2027 prod_hint_addr ? " PROD hint address;" : "",
779837e1 2028 st->peers.npeers);
446353cd
IJ		 2029
2030 /* Non-mobile peers havve st->peers.npeers==0 or ==1, since they
2031 * have transport_peers_max==1. The effect is that this code
2032 * always uses the configured address if supplied, or otherwise
dd9209d1
IJ		 2033 * the address of the incoming PROD, or the existing data peer if
2034 * one exists; this is as desired. */
446353cd
IJ		 2035
2036 transport_peers_copy(st,&st->setup_peers,&st->peers);
2037
dd9209d1
IJ		 2038 if (prod_hint_addr)
2039 transport_record_peer(st,&st->setup_peers,prod_hint_addr,"prod");
2040
446353cd
IJ		 2041 if (configured_addr)
2042 transport_record_peer(st,&st->setup_peers,configured_addr,"setupinit");
2043
2044 assert(transport_peers_valid(&st->setup_peers));
2045 return True;
2046}
2047
2048static void transport_setup_msgok(struct site *st, const struct comm_addr *a) {
2049 if (st->peer_mobile)
2050 transport_record_peer(st,&st->setup_peers,a,"setupmsg");
2051}
2052static void transport_data_msgok(struct site *st, const struct comm_addr *a) {
2053 if (st->peer_mobile)
2054 transport_record_peer(st,&st->peers,a,"datamsg");
2055}
2056
2057static int transport_peers_valid(transport_peers *peers) {
2058 return peers->npeers;
2059}
2060static void transport_peers_clear(struct site *st, transport_peers *peers) {
2061 peers->npeers= 0;
2062 transport_peers_debug(st,peers,"clear",0,0,0);
2063}
2064static void transport_peers_copy(struct site *st, transport_peers *dst,
2065 const transport_peers *src) {
2066 dst->npeers=src->npeers;
2067 memcpy(dst->peers, src->peers, sizeof(*dst->peers) * dst->npeers);
2068 transport_peers_debug(st,dst,"copy",
a620a048 2069 src->npeers, &src->peers->addr, sizeof(*src->peers));
446353cd
IJ		 2070}
2071
2072void transport_xmit(struct site *st, transport_peers *peers,
2073 struct buffer_if *buf, bool_t candebug) {
2074 int slot;
2075 transport_peers_expire(st, peers);
2076 for (slot=0; slot<peers->npeers; slot++) {
2077 transport_peer *peer=&peers->peers[slot];
2078 if (candebug)
2079 dump_packet(st, buf, &peer->addr, False);
2080 peer->addr.comm->sendmsg(peer->addr.comm->st, buf, &peer->addr);
2081 }
2082}
2083
2084/***** END of transport peers declarations *****/
Secnet virtual private network: clone of http://www.chiark.greenend.org.uk/ucgi/~ian/git/secnet.git/