X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fprotocol.c;h=6740cb0d30ede6ef0a1ecc3cad79f17da049b05f;hp=e9bad82e7e5c6830bb27f3a043f9e14e23972a8f;hb=e8e7379311ca3bf6e1fdd7d0f477a43e510e2317;hpb=17fa07510ad74d0f96f9700538d32eb8e7b2a0ce diff --git a/src/protocol.c b/src/protocol.c index e9bad82e..6740cb0d 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -17,7 +17,7 @@ along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - $Id: protocol.c,v 1.28 2000/05/30 21:36:16 zarq Exp $ + $Id: protocol.c,v 1.28.4.15 2000/06/29 13:04:15 guus Exp $ */ #include "config.h" @@ -50,18 +50,17 @@ int buflen; int send_ack(conn_list_t *cl) { cp - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Send ACK to %s"), cl->hostname); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending ACK to %s (%s)"), + cl->vpn_hostname, cl->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d\n", ACK); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %d:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %d:%d: %m"), __FILE__, __LINE__); return -1; } - - syslog(LOG_NOTICE, _("Connection with %s activated."), cl->hostname); cp return 0; } @@ -69,16 +68,16 @@ cp int send_termreq(conn_list_t *cl) { cp - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Send TERMREQ to " IP_ADDR_S), - IP_ADDR_V(cl->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending TERMREQ to %s (%s)"), + cl->vpn_hostname, cl->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d %lx\n", TERMREQ, myself->vpn_ip); if(write(cl->meta_socket, buffer, buflen) < 0) { if(debug_lvl > 1) - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -88,15 +87,15 @@ cp int send_timeout(conn_list_t *cl) { cp - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Send TIMEOUT to " IP_ADDR_S), - IP_ADDR_V(cl->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending TIMEOUT to %s (%s)"), + cl->vpn_hostname, cl->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d %lx\n", PINGTIMEOUT, myself->vpn_ip); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -106,15 +105,15 @@ cp int send_del_host(conn_list_t *cl, conn_list_t *new_host) { cp - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Sending delete host " IP_ADDR_S " to " IP_ADDR_S), - IP_ADDR_V(new_host->vpn_ip), IP_ADDR_V(cl->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending DEL_HOST for %s (%s) to %s (%s)"), + new_host->vpn_hostname, new_host->real_hostname, cl->vpn_hostname, cl->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d %lx\n", DEL_HOST, new_host->vpn_ip); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -124,14 +123,15 @@ cp int send_ping(conn_list_t *cl) { cp - if(debug_lvl > 3) - syslog(LOG_DEBUG, _("pinging " IP_ADDR_S), IP_ADDR_V(cl->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending PING to %s (%s)"), + cl->vpn_hostname, cl->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d\n", PING); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -141,11 +141,15 @@ cp int send_pong(conn_list_t *cl) { cp + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending PONG to %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + buflen = snprintf(buffer, MAXBUFSIZE, "%d\n", PONG); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -154,16 +158,37 @@ cp int send_add_host(conn_list_t *cl, conn_list_t *new_host) { + ip_t real_ip; + int flags; + char *hostname; cp - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Sending add host to " IP_ADDR_S), - IP_ADDR_V(cl->vpn_ip)); + real_ip = new_host->real_ip; + hostname = new_host->real_hostname; + flags = new_host->flags; + + /* If we need to propagate information about a new host that wants us to export + * it's indirectdata flag, we set the INDIRECTDATA flag and unset the EXPORT... + * flag, and set it's real_ip to our vpn_ip, so that net.c send_packet() will + * work correctly. + */ + + if(flags & EXPORTINDIRECTDATA) + { + flags &= ~EXPORTINDIRECTDATA; + flags |= INDIRECTDATA; + real_ip = myself->vpn_ip; + hostname = myself->real_hostname; + } + + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending ADD_HOST for %s (%s) to %s (%s)"), + new_host->vpn_hostname, hostname, cl->vpn_hostname, cl->real_hostname); - buflen = snprintf(buffer, MAXBUFSIZE, "%d %lx %lx/%lx:%x\n", ADD_HOST, new_host->real_ip, new_host->vpn_ip, new_host->vpn_mask, new_host->port); + buflen = snprintf(buffer, MAXBUFSIZE, "%d %lx %lx/%lx:%x %d\n", ADD_HOST, real_ip, new_host->vpn_ip, new_host->vpn_mask, new_host->port, flags); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -173,15 +198,15 @@ cp int send_key_changed(conn_list_t *cl, conn_list_t *src) { cp - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Sending KEY_CHANGED to " IP_ADDR_S), - IP_ADDR_V(cl->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending KEY_CHANGED origin %s to %s (%s)"), + src->vpn_hostname, cl->vpn_hostname, cl->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d %lx\n", KEY_CHANGED, src->vpn_ip); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -201,15 +226,15 @@ cp int send_basic_info(conn_list_t *cl) { cp - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Send BASIC_INFO to " IP_ADDR_S), - IP_ADDR_V(cl->real_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending BASIC_INFO to %s"), + cl->real_hostname); - buflen = snprintf(buffer, MAXBUFSIZE, "%d %d %lx/%lx:%x\n", BASIC_INFO, PROT_CURRENT, myself->vpn_ip, myself->vpn_mask, myself->port); + buflen = snprintf(buffer, MAXBUFSIZE, "%d %d %lx/%lx:%x %d\n", BASIC_INFO, PROT_CURRENT, myself->vpn_ip, myself->vpn_mask, myself->port, myself->flags); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -222,15 +247,15 @@ int send_passphrase(conn_list_t *cl) cp encrypt_passphrase(&tmp); - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Send PASSPHRASE %s to " IP_ADDR_S), - tmp.phrase, IP_ADDR_V(cl->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending PASSPHRASE to %s (%s)"), + cl->vpn_hostname, cl->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d %s\n", PASSPHRASE, tmp.phrase); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -240,21 +265,22 @@ cp int send_public_key(conn_list_t *cl) { cp - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Send PUBLIC_KEY %s to " IP_ADDR_S), - my_public_key_base36, IP_ADDR_V(cl->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending PUBLIC_KEY to %s (%s)"), + cl->vpn_hostname, cl->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d %s\n", PUBLIC_KEY, my_public_key_base36); if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp return 0; } +/* WDN doet deze functie? (GS) int send_calculate(conn_list_t *cl, char *k) { cp @@ -262,12 +288,13 @@ cp if((write(cl->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp return 0; } +*/ int send_key_request(ip_t to) { @@ -276,20 +303,20 @@ cp fw = lookup_conn(to); if(!fw) { - syslog(LOG_ERR, _("Attempting to send key request to " IP_ADDR_S ", which does not exist?"), + syslog(LOG_ERR, _("Attempting to send REQ_KEY to %d.%d.%d.%d, which does not exist?"), IP_ADDR_V(to)); return -1; } - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Sending out request for public key to " IP_ADDR_S), - IP_ADDR_V(fw->nexthop->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending REQ_KEY to %s (%s)"), + fw->nexthop->vpn_hostname, fw->nexthop->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d %lx %lx\n", REQ_KEY, to, myself->vpn_ip); if((write(fw->nexthop->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } fw->status.waitingforkey = 1; @@ -306,20 +333,20 @@ cp if(!fw) { - syslog(LOG_ERR, _("Attempting to send key answer to " IP_ADDR_S ", which does not exist?"), + syslog(LOG_ERR, _("Attempting to send ANS_KEY to %d.%d.%d.%d, which does not exist?"), IP_ADDR_V(to)); return -1; } - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Sending public key to " IP_ADDR_S), - IP_ADDR_V(fw->nexthop->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Sending ANS_KEY to %s (%s)"), + fw->nexthop->vpn_hostname, fw->nexthop->real_hostname); buflen = snprintf(buffer, MAXBUFSIZE, "%d %lx %lx %d %s\n", ANS_KEY, to, myself->vpn_ip, my_key_expiry, my_public_key_base36); if((write(fw->nexthop->meta_socket, buffer, buflen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -365,26 +392,25 @@ cp int basic_info_h(conn_list_t *cl) { cp - if(sscanf(cl->buffer, "%*d %d %lx/%lx:%hx", &cl->protocol_version, &cl->vpn_ip, &cl->vpn_mask, &cl->port) != 4) + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got BASIC_INFO from %s"), cl->real_hostname); + + if(sscanf(cl->buffer, "%*d %d %lx/%lx:%hx %d", &cl->protocol_version, &cl->vpn_ip, &cl->vpn_mask, &cl->port, &cl->flags) != 5) { - syslog(LOG_ERR, _("got bad BASIC_INFO request: %s"), cl->buffer); + syslog(LOG_ERR, _("Got bad BASIC_INFO from %s"), + cl->real_hostname); return -1; - } + } + + cl->vpn_hostname = hostlookup(htonl(cl->vpn_ip)); if(cl->protocol_version != PROT_CURRENT) { - syslog(LOG_ERR, _("Peer uses incompatible protocol version %d."), + syslog(LOG_ERR, _("Peer uses incompatible protocol version %d"), cl->protocol_version); return -1; } - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("got BASIC_INFO(%hd," IP_ADDR_S "," IP_ADDR_S ")"), cl->port, - IP_ADDR_V(cl->vpn_ip), IP_ADDR_V(cl->vpn_mask)); - if(debug_lvl > 1) - syslog(LOG_DEBUG, _("Peer uses protocol version %d"), - cl->protocol_version); - if(cl->status.outgoing) { if(setup_vpn_connection(cl) < 0) @@ -408,13 +434,15 @@ cp if(sscanf(cl->buffer, "%*d %as", &(cl->pp->phrase)) != 1) { - syslog(LOG_ERR, _("got bad PASSPHRASE request: %s"), cl->buffer); + syslog(LOG_ERR, _("Got bad PASSPHRASE from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); return -1; } cl->pp->len = strlen(cl->pp->phrase); - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("got PASSPHRASE")); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got PASSPHRASE from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); if(cl->status.outgoing) send_passphrase(cl); @@ -431,23 +459,22 @@ int public_key_h(conn_list_t *cl) cp if(sscanf(cl->buffer, "%*d %as", &g_n) != 1) { - syslog(LOG_ERR, _("got bad PUBLIC_KEY request: %s"), cl->buffer); + syslog(LOG_ERR, _("Got bad PUBLIC_KEY from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); return -1; } - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("got PUBLIC_KEY %s"), g_n); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got PUBLIC_KEY from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); if(verify_passphrase(cl, g_n)) { /* intruder! */ - syslog(LOG_ERR, _("Intruder: passphrase does not match.")); + syslog(LOG_ERR, _("Intruder: passphrase does not match!")); return -1; } - if(debug_lvl > 2) - syslog(LOG_INFO, _("Passphrase OK")); - if(cl->status.outgoing) send_public_key(cl); else @@ -459,10 +486,15 @@ cp old connection that has timed out but we don't know it yet. Because our conn_list entry is not active, lookup_conn will skip ourself. */ - while(old=lookup_conn(cl->vpn_ip)) + while(old = lookup_conn(cl->vpn_ip)) terminate_connection(old); cl->status.active = 1; + + if(debug_lvl > 0) + syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), + cl->vpn_hostname, cl->real_hostname); + notify_others(cl, NULL, send_add_host); notify_one(cl); } @@ -473,11 +505,19 @@ cp int ack_h(conn_list_t *cl) { cp - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("got ACK")); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got ACK from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); cl->status.active = 1; - syslog(LOG_NOTICE, _("Connection with %s activated."), cl->hostname); + + syslog(LOG_NOTICE, _("Connection with %s (%s) activated"), + cl->vpn_hostname, cl->real_hostname); + + notify_others(cl, NULL, send_add_host); + notify_one(cl); + + upstreamindex = 0; cp return 0; } @@ -485,11 +525,25 @@ cp int termreq_h(conn_list_t *cl) { cp - syslog(LOG_NOTICE, _(IP_ADDR_S " wants to quit"), IP_ADDR_V(cl->vpn_ip)); + if(!cl->status.active) + { + syslog(LOG_ERR, _("Got unauthorized TERMREQ from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + return -1; + } + + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got TERMREQ from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + cl->status.termreq = 1; - terminate_connection(cl); - notify_others(cl, NULL, send_del_host); + if(cl->status.active) + notify_others(cl, NULL, send_del_host); + + cl->status.active = 0; + + terminate_connection(cl); cp return 0; } @@ -497,8 +551,17 @@ cp int timeout_h(conn_list_t *cl) { cp - if(!cl->status.active) return -1; - syslog(LOG_NOTICE, _(IP_ADDR_S " says it's gotten a timeout from us"), IP_ADDR_V(cl->vpn_ip)); + if(!cl->status.active) + { + syslog(LOG_ERR, _("Got unauthorized TIMEOUT from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + return -1; + } + + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got TIMEOUT from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + cl->status.termreq = 1; terminate_connection(cl); cp @@ -510,28 +573,36 @@ int del_host_h(conn_list_t *cl) ip_t vpn_ip; conn_list_t *fw; cp - if(!cl->status.active) return -1; + if(!cl->status.active) + { + syslog(LOG_ERR, _("Got unauthorized DEL_HOST from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + return -1; + } if(sscanf(cl->buffer, "%*d %lx", &vpn_ip) != 1) { - syslog(LOG_ERR, _("got bad DEL_HOST request: %s"), cl->buffer); + syslog(LOG_ERR, _("Got bad DEL_HOST from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); return -1; } - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("got DEL_HOST for " IP_ADDR_S), - IP_ADDR_V(vpn_ip)); - if(!(fw = lookup_conn(vpn_ip))) { - syslog(LOG_ERR, _("Somebody wanted to delete " IP_ADDR_S " which does not exist?"), - IP_ADDR_V(vpn_ip)); + syslog(LOG_ERR, _("Got DEL_HOST for %d.%d.%d.%d from %s (%s) which does not exist?"), + IP_ADDR_V(vpn_ip), cl->vpn_hostname, cl->real_hostname); return 0; } - notify_others(cl, fw, send_del_host); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got DEL_HOST for %s (%s) from %s (%s)"), + fw->vpn_hostname, fw->real_hostname, cl->vpn_hostname, cl->real_hostname); + + notify_others(fw, cl, send_del_host); fw->status.termreq = 1; + fw->status.active = 0; + terminate_connection(fw); cp return 0; @@ -540,9 +611,17 @@ cp int ping_h(conn_list_t *cl) { cp - if(!cl->status.active) return -1; - if(debug_lvl > 3) - syslog(LOG_DEBUG, _("responding to ping from " IP_ADDR_S), IP_ADDR_V(cl->vpn_ip)); + if(!cl->status.active) + { + syslog(LOG_ERR, _("Got unauthorized PING from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + return -1; + } + + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got PING from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + cl->status.pinged = 0; cl->status.got_pong = 1; @@ -554,9 +633,17 @@ cp int pong_h(conn_list_t *cl) { cp - if(!cl->status.active) return -1; - if(debug_lvl > 3) - syslog(LOG_DEBUG, _("ok, got pong from " IP_ADDR_S), IP_ADDR_V(cl->vpn_ip)); + if(!cl->status.active) + { + syslog(LOG_ERR, _("Got unauthorized PONG from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + return -1; + } + + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got PONG from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + cl->status.got_pong = 1; cp return 0; @@ -568,46 +655,43 @@ int add_host_h(conn_list_t *cl) ip_t vpn_ip; ip_t vpn_mask; unsigned short port; - conn_list_t *ncn, *fw; + int flags; + conn_list_t *ncn, *old; cp if(!cl->status.active) - return -1; - if(sscanf(cl->buffer, "%*d %lx %lx/%lx:%hx", &real_ip, &vpn_ip, &vpn_mask, &port) != 4) { - syslog(LOG_ERR, _("got bad ADD_HOST request: %s"), cl->buffer); + syslog(LOG_ERR, _("Got unauthorized ADD_HOST from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + return -1; + } + + if(sscanf(cl->buffer, "%*d %lx %lx/%lx:%hx %d", &real_ip, &vpn_ip, &vpn_mask, &port, &flags) != 5) + { + syslog(LOG_ERR, _("Got bad ADD_HOST from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); return -1; } - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Add host request from " IP_ADDR_S), IP_ADDR_V(cl->vpn_ip)); - if(debug_lvl > 3) - syslog(LOG_DEBUG, _("got ADD_HOST(" IP_ADDR_S "," IP_ADDR_S ",%hd)"), - IP_ADDR_V(vpn_ip), IP_ADDR_V(vpn_mask), port); - - /* - Suggestion of Hans Bayle - */ - if((fw = lookup_conn(vpn_ip))) - { - if(fw->nexthop == cl) - notify_others(fw, cl, send_add_host); - else - if(debug_lvl > 1) - syslog(LOG_DEBUG, _("Invalid add_host request from " IP_ADDR_S), - IP_ADDR_V(cl->vpn_ip)); - return 0; - } - + while(old = lookup_conn(vpn_ip)) + terminate_connection(old); + ncn = new_conn_list(); ncn->real_ip = real_ip; + ncn->real_hostname = hostlookup(htonl(real_ip)); ncn->vpn_ip = vpn_ip; ncn->vpn_mask = vpn_mask; + ncn->vpn_hostname = hostlookup(htonl(vpn_ip)); ncn->port = port; - ncn->hostname = hostlookup(real_ip); + ncn->flags = flags; ncn->nexthop = cl; ncn->next = conn_list; conn_list = ncn; ncn->status.active = 1; + + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got ADD_HOST for %s (%s) from %s (%s)"), + ncn->vpn_hostname, ncn->real_hostname, cl->vpn_hostname, cl->real_hostname); + notify_others(ncn, cl, send_add_host); cp return 0; @@ -619,16 +703,23 @@ int req_key_h(conn_list_t *cl) ip_t from; conn_list_t *fw; cp - if(!cl->status.active) return -1; + if(!cl->status.active) + { + syslog(LOG_ERR, _("Got unauthorized REQ_KEY from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + return -1; + } + if(sscanf(cl->buffer, "%*d %lx %lx", &to, &from) != 2) { - syslog(LOG_ERR, _("got bad request: %s"), cl->buffer); + syslog(LOG_ERR, _("Got bad REQ_KEY from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); return -1; } - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("got REQ_KEY from " IP_ADDR_S " for " IP_ADDR_S), - IP_ADDR_V(from), IP_ADDR_V(to)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got REQ_KEY origin %d.%d.%d.%d destination %d.%d.%d.%d from %s (%s)"), + IP_ADDR_V(from), IP_ADDR_V(to), cl->vpn_hostname, cl->real_hostname); if((to & myself->vpn_mask) == (myself->vpn_ip & myself->vpn_mask)) { /* hey! they want something from ME! :) */ @@ -640,20 +731,20 @@ cp if(!fw) { - syslog(LOG_ERR, _("Attempting to forward key request to " IP_ADDR_S ", which does not exist?"), + syslog(LOG_ERR, _("Attempting to forward REQ_KEY to %d.%d.%d.%d, which does not exist?"), IP_ADDR_V(to)); return -1; } - if(debug_lvl > 3) - syslog(LOG_DEBUG, _("Forwarding request for public key to " IP_ADDR_S), - IP_ADDR_V(fw->nexthop->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Forwarding REQ_KEY to %s (%s)"), + fw->nexthop->vpn_hostname, fw->nexthop->real_hostname); cl->buffer[cl->reqlen-1] = '\n'; if(write(fw->nexthop->meta_socket, cl->buffer, cl->reqlen) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -703,27 +794,32 @@ int ans_key_h(conn_list_t *cl) char *key; conn_list_t *fw, *gk; cp - if(!cl->status.active) return -1; + if(!cl->status.active) + { + syslog(LOG_ERR, _("Got unauthorized ANS_KEY from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + return -1; + } + if(sscanf(cl->buffer, "%*d %lx %lx %d %as", &to, &from, &expiry, &key) != 4) { - syslog(LOG_ERR, _("got bad ANS_KEY request: %s"), cl->buffer); + syslog(LOG_ERR, _("Got bad ANS_KEY from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); return -1; } - if(debug_lvl > 3) - syslog(LOG_DEBUG, _("got ANS_KEY from " IP_ADDR_S " for " IP_ADDR_S), - IP_ADDR_V(from), IP_ADDR_V(to)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got ANS_KEY origin %d.%d.%d.%d destination %d.%d.%d.%d from %s (%s)"), + IP_ADDR_V(from), IP_ADDR_V(to), cl->vpn_hostname, cl->real_hostname); if(to == myself->vpn_ip) { /* hey! that key's for ME! :) */ - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Yeah! key arrived. Now do something with it.")); gk = lookup_conn(from); if(!gk) { - syslog(LOG_ERR, _("Receiving key from " IP_ADDR_S ", which does not exist?"), - IP_ADDR_V(from)); + syslog(LOG_ERR, _("Receiving ANS_KEY origin %d.%d.%d.%d from %s (%s), which does not exist?"), + IP_ADDR_V(from), cl->vpn_hostname, cl->real_hostname); return -1; } @@ -738,20 +834,20 @@ cp if(!fw) { - syslog(LOG_ERR, _("Attempting to forward key to " IP_ADDR_S ", which does not exist?"), + syslog(LOG_ERR, _("Attempting to forward ANS_KEY to %d.%d.%d.%d, which does not exist?"), IP_ADDR_V(to)); return -1; } - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("Forwarding public key to " IP_ADDR_S), - IP_ADDR_V(fw->nexthop->vpn_ip)); + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Forwarding ANS_KEY to %s (%s)"), + fw->nexthop->vpn_hostname, fw->nexthop->real_hostname); cl->buffer[cl->reqlen-1] = '\n'; if((write(fw->nexthop->meta_socket, cl->buffer, cl->reqlen)) < 0) { - syslog(LOG_ERR, _("send failed: %s:%d: %m"), __FILE__, __LINE__); + syslog(LOG_ERR, _("Send failed: %s:%d: %m"), __FILE__, __LINE__); return -1; } cp @@ -763,33 +859,37 @@ int key_changed_h(conn_list_t *cl) ip_t from; conn_list_t *ik; cp - if(!cl->status.active) return -1; + if(!cl->status.active) + { + syslog(LOG_ERR, _("Got unauthorized KEY_CHANGED from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); + return -1; + } + if(sscanf(cl->buffer, "%*d %lx", &from) != 1) { - syslog(LOG_ERR, _("got bad ANS_KEY request: %s"), cl->buffer); + syslog(LOG_ERR, _("Got bad KEY_CHANGED from %s (%s)"), + cl->vpn_hostname, cl->real_hostname); return -1; } - if(debug_lvl > 2) - syslog(LOG_DEBUG, _("got KEY_CHANGED from " IP_ADDR_S), - IP_ADDR_V(from)); - ik = lookup_conn(from); if(!ik) { - syslog(LOG_ERR, _("Got changed key from " IP_ADDR_S ", which does not exist?"), - IP_ADDR_V(from)); + syslog(LOG_ERR, _("Got KEY_CHANGED origin %d.%d.%d.%d from %s (%s), which does not exist?"), + IP_ADDR_V(from), cl->vpn_hostname, cl->real_hostname); return -1; } + if(debug_lvl > 1) + syslog(LOG_DEBUG, _("Got KEY_CHANGED origin %s from %s (%s)"), + ik->vpn_hostname, cl->vpn_hostname, cl->real_hostname); + ik->status.validkey = 0; ik->status.waitingforkey = 0; - if(debug_lvl > 3) - syslog(LOG_DEBUG, _("Forwarding key invalidation request")); - - notify_others(cl, ik, send_key_changed); + notify_others(ik, cl, send_key_changed); cp return 0; }