net.c revision 1.16
1/* $OpenBSD: net.c,v 1.16 2010/06/29 18:10:04 kjell Exp $ */ 2 3/* 4 * Copyright (c) 2005 H�kan Olsson. All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28/* 29 * This code was written under funding by Multicom Security AB. 30 */ 31 32#include <sys/types.h> 33#include <sys/socket.h> 34#include <sys/time.h> 35#include <netinet/in.h> 36#include <arpa/inet.h> 37#include <ifaddrs.h> 38#include <netdb.h> 39#include <signal.h> 40 41#include <openssl/aes.h> 42#include <openssl/sha.h> 43 44#include <errno.h> 45#include <stdio.h> 46#include <stdlib.h> 47#include <string.h> 48#include <unistd.h> 49 50#include "sasyncd.h" 51#include "net.h" 52 53struct msg { 54 u_int8_t *buf; 55 u_int32_t len; 56 int refcnt; 57}; 58 59struct qmsg { 60 SIMPLEQ_ENTRY(qmsg) next; 61 struct msg *msg; 62}; 63 64int *listeners; 65AES_KEY aes_key[2]; 66#define AES_IV_LEN AES_BLOCK_SIZE 67 68/* We never send (or expect to receive) messages smaller/larger than this. */ 69#define MSG_MINLEN 12 70#define MSG_MAXLEN 4096 71 72/* Local prototypes. */ 73static u_int8_t *net_read(struct syncpeer *, u_int32_t *, u_int32_t *); 74static int net_set_sa(struct sockaddr *, char *, in_port_t); 75static void net_check_peers(void *); 76 77/* Pretty-print a buffer. */ 78void 79dump_buf(int lvl, u_int8_t *b, u_int32_t len, char *title) 80{ 81 u_int32_t i, off, blen; 82 u_int8_t *buf; 83 const char def[] = "Buffer:"; 84 85 if (cfgstate.verboselevel < lvl) 86 return; 87 88 blen = 2 * (len + len / 36) + 3 + (title ? strlen(title) : sizeof def); 89 if (!(buf = (u_int8_t *)calloc(1, blen))) 90 return; 91 92 snprintf(buf, blen, "%s\n ", title ? title : def); 93 off = strlen(buf); 94 for (i = 0; i < len; i++, off+=2) { 95 snprintf(buf + off, blen - off, "%02x", b[i]); 96 if ((i+1) % 36 == 0) { 97 off += 2; 98 snprintf(buf + off, blen - off, "\n "); 99 } 100 } 101 log_msg(lvl, "%s", buf); 102 free(buf); 103} 104 105/* Add a listening socket. */ 106static int 107net_add_listener(struct sockaddr *sa) 108{ 109 char host[NI_MAXHOST], port[NI_MAXSERV]; 110 int r, s; 111 112 s = socket(sa->sa_family, SOCK_STREAM, 0); 113 if (s < 0) { 114 perror("net_add_listener: socket()"); 115 close(s); 116 return -1; 117 } 118 119 r = 1; 120 if (setsockopt(s, SOL_SOCKET, 121 cfgstate.listen_on ? SO_REUSEADDR : SO_REUSEPORT, (void *)&r, 122 sizeof r)) { 123 perror("net_add_listener: setsockopt()"); 124 close(s); 125 return -1; 126 } 127 128 if (bind(s, sa, sa->sa_family == AF_INET ? sizeof(struct sockaddr_in) : 129 sizeof (struct sockaddr_in6))) { 130 perror("net_add_listener: bind()"); 131 close(s); 132 return -1; 133 } 134 135 if (listen(s, 3)) { 136 perror("net_add_listener: listen()"); 137 close(s); 138 return -1; 139 } 140 141 if (getnameinfo(sa, sa->sa_len, host, sizeof host, port, sizeof port, 142 NI_NUMERICHOST | NI_NUMERICSERV)) 143 log_msg(2, "listening on port %u fd %d", cfgstate.listen_port, 144 s); 145 else 146 log_msg(2, "listening on %s port %s fd %d", host, port, s); 147 148 return s; 149} 150 151/* Allocate and fill in listeners array. */ 152static int 153net_setup_listeners(void) 154{ 155 struct sockaddr_storage sa_storage; 156 struct sockaddr *sa = (struct sockaddr *)&sa_storage; 157 struct sockaddr_in *sin = (struct sockaddr_in *)sa; 158 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa; 159 struct ifaddrs *ifap = 0, *ifa; 160 int i, count; 161 162 /* Setup listening sockets. */ 163 memset(&sa_storage, 0, sizeof sa_storage); 164 if (net_set_sa(sa, cfgstate.listen_on, cfgstate.listen_port) == 0) { 165 listeners = (int *)calloc(2, sizeof(int)); 166 if (!listeners) { 167 perror("net_setup_listeners: calloc()"); 168 goto errout; 169 } 170 listeners[1] = -1; 171 listeners[0] = net_add_listener(sa); 172 if (listeners[0] == -1) { 173 log_msg(0, "net_setup_listeners: could not find " 174 "listen address (%s)", cfgstate.listen_on); 175 goto errout; 176 } 177 return 0; 178 } 179 180 /* 181 * If net_set_sa() failed, cfgstate.listen_on is probably an 182 * interface name, so we should listen on all it's addresses. 183 */ 184 185 if (getifaddrs(&ifap) != 0) { 186 perror("net_setup_listeners: getifaddrs()"); 187 goto errout; 188 } 189 190 /* How many addresses matches? */ 191 for (count = 0, ifa = ifap; ifa; ifa = ifa->ifa_next) { 192 if (!ifa->ifa_name || !ifa->ifa_addr || 193 (ifa->ifa_addr->sa_family != AF_INET && 194 ifa->ifa_addr->sa_family != AF_INET6)) 195 continue; 196 if (cfgstate.listen_family && 197 cfgstate.listen_family != ifa->ifa_addr->sa_family) 198 continue; 199 if (strcmp(ifa->ifa_name, cfgstate.listen_on) != 0) 200 continue; 201 count++; 202 } 203 204 if (!count) { 205 log_msg(0, "net_setup_listeners: no listeners found for %s", 206 cfgstate.listen_on); 207 goto errout; 208 } 209 210 /* Allocate one extra slot and set to -1, marking end of array. */ 211 listeners = (int *)calloc(count + 1, sizeof(int)); 212 if (!listeners) { 213 perror("net_setup_listeners: calloc()"); 214 goto errout; 215 } 216 for (i = 0; i <= count; i++) 217 listeners[i] = -1; 218 219 /* Create listening sockets */ 220 for (count = 0, ifa = ifap; ifa; ifa = ifa->ifa_next) { 221 if (!ifa->ifa_name || !ifa->ifa_addr || 222 (ifa->ifa_addr->sa_family != AF_INET && 223 ifa->ifa_addr->sa_family != AF_INET6)) 224 continue; 225 if (cfgstate.listen_family && 226 cfgstate.listen_family != ifa->ifa_addr->sa_family) 227 continue; 228 if (strcmp(ifa->ifa_name, cfgstate.listen_on) != 0) 229 continue; 230 231 memset(&sa_storage, 0, sizeof sa_storage); 232 sa->sa_family = ifa->ifa_addr->sa_family; 233 switch (sa->sa_family) { 234 case AF_INET: 235 sin->sin_port = htons(cfgstate.listen_port); 236 sin->sin_len = sizeof *sin; 237 memcpy(&sin->sin_addr, 238 &((struct sockaddr_in *)ifa->ifa_addr)->sin_addr, 239 sizeof sin->sin_addr); 240 break; 241 case AF_INET6: 242 sin6->sin6_port = htons(cfgstate.listen_port); 243 sin6->sin6_len = sizeof *sin6; 244 memcpy(&sin6->sin6_addr, 245 &((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr, 246 sizeof sin6->sin6_addr); 247 break; 248 } 249 250 listeners[count] = net_add_listener(sa); 251 if (listeners[count] == -1) { 252 log_msg(2, "net_setup_listeners(setup): failed to " 253 "add listener, count = %d", count); 254 goto errout; 255 } 256 count++; 257 } 258 freeifaddrs(ifap); 259 return 0; 260 261 errout: 262 if (ifap) 263 freeifaddrs(ifap); 264 if (listeners) { 265 for (i = 0; listeners[i] != -1; i++) 266 close(listeners[i]); 267 free(listeners); 268 } 269 return -1; 270} 271 272int 273net_init(void) 274{ 275 struct syncpeer *p; 276 277 if (AES_set_encrypt_key(cfgstate.sharedkey, cfgstate.sharedkey_len, 278 &aes_key[0]) || 279 AES_set_decrypt_key(cfgstate.sharedkey, cfgstate.sharedkey_len, 280 &aes_key[1])) { 281 fprintf(stderr, "Bad AES shared key\n"); 282 return -1; 283 } 284 285 if (net_setup_listeners()) 286 return -1; 287 288 for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) { 289 p->socket = -1; 290 SIMPLEQ_INIT(&p->msgs); 291 } 292 293 net_check_peers(0); 294 return 0; 295} 296 297static void 298net_enqueue(struct syncpeer *p, struct msg *m) 299{ 300 struct qmsg *qm; 301 302 if (p->socket < 0) 303 return; 304 305 qm = (struct qmsg *)malloc(sizeof *qm); 306 if (!qm) { 307 log_err("net_enqueue: malloc()"); 308 return; 309 } 310 311 memset(qm, 0, sizeof *qm); 312 qm->msg = m; 313 m->refcnt++; 314 315 SIMPLEQ_INSERT_TAIL(&p->msgs, qm, next); 316 return; 317} 318 319/* 320 * Queue a message for transmission to a particular peer, 321 * or to all peers if no peer is specified. 322 */ 323int 324net_queue(struct syncpeer *p0, u_int32_t msgtype, u_int8_t *buf, u_int32_t len) 325{ 326 struct syncpeer *p = p0; 327 struct msg *m; 328 SHA_CTX ctx; 329 u_int8_t hash[SHA_DIGEST_LENGTH]; 330 u_int8_t iv[AES_IV_LEN], tmp_iv[AES_IV_LEN]; 331 u_int32_t v, padlen = 0; 332 int i, offset; 333 334 m = (struct msg *)calloc(1, sizeof *m); 335 if (!m) { 336 log_err("net_queue: calloc()"); 337 free(buf); 338 return -1; 339 } 340 341 /* Generate hash */ 342 SHA1_Init(&ctx); 343 SHA1_Update(&ctx, buf, len); 344 SHA1_Final(hash, &ctx); 345 dump_buf(2, hash, sizeof hash, "net_queue: computed hash"); 346 347 /* Padding required? */ 348 i = len % AES_IV_LEN; 349 if (i) { 350 u_int8_t *pbuf; 351 i = AES_IV_LEN - i; 352 pbuf = realloc(buf, len + i); 353 if (!pbuf) { 354 log_err("net_queue: realloc()"); 355 free(buf); 356 free(m); 357 return -1; 358 } 359 padlen = i; 360 while (i > 0) 361 pbuf[len++] = (u_int8_t)i--; 362 buf = pbuf; 363 } 364 365 /* Get random IV */ 366 for (i = 0; i <= sizeof iv - sizeof v; i += sizeof v) { 367 v = arc4random(); 368 memcpy(&iv[i], &v, sizeof v); 369 } 370 dump_buf(2, iv, sizeof iv, "net_queue: IV"); 371 memcpy(tmp_iv, iv, sizeof tmp_iv); 372 373 /* Encrypt */ 374 dump_buf(2, buf, len, "net_queue: pre encrypt"); 375 AES_cbc_encrypt(buf, buf, len, &aes_key[0], tmp_iv, AES_ENCRYPT); 376 dump_buf(2, buf, len, "net_queue: post encrypt"); 377 378 /* Allocate send buffer */ 379 m->len = len + sizeof iv + sizeof hash + 3 * sizeof(u_int32_t); 380 m->buf = (u_int8_t *)malloc(m->len); 381 if (!m->buf) { 382 free(m); 383 free(buf); 384 log_err("net_queue: calloc()"); 385 return -1; 386 } 387 offset = 0; 388 389 /* Fill it (order must match parsing code in net_read()) */ 390 v = htonl(m->len - sizeof(u_int32_t)); 391 memcpy(m->buf + offset, &v, sizeof v); 392 offset += sizeof v; 393 v = htonl(msgtype); 394 memcpy(m->buf + offset, &v, sizeof v); 395 offset += sizeof v; 396 v = htonl(padlen); 397 memcpy(m->buf + offset, &v, sizeof v); 398 offset += sizeof v; 399 memcpy(m->buf + offset, hash, sizeof hash); 400 offset += sizeof hash; 401 memcpy(m->buf + offset, iv, sizeof iv); 402 offset += sizeof iv; 403 memcpy(m->buf + offset, buf, len); 404 free(buf); 405 406 if (p) 407 net_enqueue(p, m); 408 else 409 for (p = LIST_FIRST(&cfgstate.peerlist); p; 410 p = LIST_NEXT(p, link)) 411 net_enqueue(p, m); 412 413 if (!m->refcnt) { 414 free(m->buf); 415 free(m); 416 } 417 418 return 0; 419} 420 421/* Set all write pending filedescriptors. */ 422int 423net_set_pending_wfds(fd_set *fds) 424{ 425 struct syncpeer *p; 426 int max_fd = -1; 427 428 for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) 429 if (p->socket > -1 && SIMPLEQ_FIRST(&p->msgs)) { 430 FD_SET(p->socket, fds); 431 if (p->socket > max_fd) 432 max_fd = p->socket; 433 } 434 return max_fd + 1; 435} 436 437/* 438 * Set readable filedescriptors. They are basically the same as for write, 439 * plus the listening socket. 440 */ 441int 442net_set_rfds(fd_set *fds) 443{ 444 struct syncpeer *p; 445 int i, max_fd = -1; 446 447 for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) { 448 if (p->socket > -1) 449 FD_SET(p->socket, fds); 450 if (p->socket > max_fd) 451 max_fd = p->socket; 452 } 453 for (i = 0; listeners[i] != -1; i++) { 454 FD_SET(listeners[i], fds); 455 if (listeners[i] > max_fd) 456 max_fd = listeners[i]; 457 } 458 return max_fd + 1; 459} 460 461static void 462net_accept(int accept_socket) 463{ 464 struct sockaddr_storage sa_storage, sa_storage2; 465 struct sockaddr *sa = (struct sockaddr *)&sa_storage; 466 struct sockaddr *sa2 = (struct sockaddr *)&sa_storage2; 467 struct sockaddr_in *sin, *sin2; 468 struct sockaddr_in6 *sin6, *sin62; 469 struct syncpeer *p; 470 socklen_t socklen; 471 int s, found; 472 473 /* Accept a new incoming connection */ 474 socklen = sizeof sa_storage; 475 memset(&sa_storage, 0, socklen); 476 memset(&sa_storage2, 0, socklen); 477 s = accept(accept_socket, sa, &socklen); 478 if (s > -1) { 479 /* Setup the syncpeer structure */ 480 found = 0; 481 for (p = LIST_FIRST(&cfgstate.peerlist); p && !found; 482 p = LIST_NEXT(p, link)) { 483 484 /* Match? */ 485 if (net_set_sa(sa2, p->name, 0)) 486 continue; 487 if (sa->sa_family != sa2->sa_family) 488 continue; 489 if (sa->sa_family == AF_INET) { 490 sin = (struct sockaddr_in *)sa; 491 sin2 = (struct sockaddr_in *)sa2; 492 if (memcmp(&sin->sin_addr, &sin2->sin_addr, 493 sizeof(struct in_addr))) 494 continue; 495 } else { 496 sin6 = (struct sockaddr_in6 *)sa; 497 sin62 = (struct sockaddr_in6 *)sa2; 498 if (memcmp(&sin6->sin6_addr, &sin62->sin6_addr, 499 sizeof(struct in6_addr))) 500 continue; 501 } 502 /* Match! */ 503 found++; 504 p->socket = s; 505 log_msg(1, "net: peer \"%s\" connected", p->name); 506 if (cfgstate.runstate == MASTER) 507 timer_add("pfkey_snap", 2, pfkey_snapshot, p); 508 } 509 if (!found) { 510 log_msg(1, "net: found no matching peer for accepted " 511 "socket, closing."); 512 close(s); 513 } 514 } else 515 log_err("net: accept()"); 516} 517 518void 519net_handle_messages(fd_set *fds) 520{ 521 struct syncpeer *p; 522 u_int8_t *msg; 523 u_int32_t msgtype, msglen; 524 int i; 525 526 for (i = 0; listeners[i] != -1; i++) 527 if (FD_ISSET(listeners[i], fds)) 528 net_accept(listeners[i]); 529 530 for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) { 531 if (p->socket < 0 || !FD_ISSET(p->socket, fds)) 532 continue; 533 msg = net_read(p, &msgtype, &msglen); 534 if (!msg) 535 continue; 536 537 log_msg(2, "net_handle_messages: got msg type %u len %u from " 538 "peer %s", msgtype, msglen, p->name); 539 540 switch (msgtype) { 541 case MSG_SYNCCTL: 542 net_ctl_handle_msg(p, msg, msglen); 543 free(msg); 544 break; 545 546 case MSG_PFKEYDATA: 547 if (p->runstate != MASTER || 548 cfgstate.runstate == MASTER) { 549 log_msg(1, "net: got PFKEY message from " 550 "non-MASTER peer"); 551 free(msg); 552 if (cfgstate.runstate == MASTER) 553 net_ctl_send_state(p); 554 else 555 net_ctl_send_error(p, 0); 556 } else if (pfkey_queue_message(msg, msglen)) 557 free(msg); 558 break; 559 560 default: 561 log_msg(0, "net: got unknown message type %u len %u " 562 "from peer %s", msgtype, msglen, p->name); 563 free(msg); 564 net_ctl_send_error(p, 0); 565 } 566 } 567} 568 569void 570net_send_messages(fd_set *fds) 571{ 572 struct syncpeer *p; 573 struct qmsg *qm; 574 struct msg *m; 575 ssize_t r; 576 577 for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) { 578 if (p->socket < 0 || !FD_ISSET(p->socket, fds)) 579 continue; 580 qm = SIMPLEQ_FIRST(&p->msgs); 581 if (!qm) { 582 /* XXX Log */ 583 continue; 584 } 585 m = qm->msg; 586 587 log_msg(2, "net_send_messages: msg %p len %u ref %d " 588 "to peer %s", m, m->len, m->refcnt, p->name); 589 590 /* write message */ 591 r = write(p->socket, m->buf, m->len); 592 if (r == -1) { 593 net_disconnect_peer(p); 594 log_msg(0, "net_send_messages: write() failed, " 595 "peer disconnected"); 596 } else if (r < (ssize_t)m->len) { 597 /* retransmit later */ 598 continue; 599 } 600 601 /* cleanup */ 602 SIMPLEQ_REMOVE_HEAD(&p->msgs, next); 603 free(qm); 604 605 if (--m->refcnt < 1) { 606 log_msg(2, "net_send_messages: freeing msg %p", m); 607 free(m->buf); 608 free(m); 609 } 610 } 611 return; 612} 613 614void 615net_disconnect_peer(struct syncpeer *p) 616{ 617 if (p->socket > -1) { 618 log_msg(1, "net_disconnect_peer: peer \"%s\" removed", 619 p->name); 620 close(p->socket); 621 } 622 p->socket = -1; 623} 624 625void 626net_shutdown(void) 627{ 628 struct syncpeer *p; 629 struct qmsg *qm; 630 struct msg *m; 631 int i; 632 633 while ((p = LIST_FIRST(&cfgstate.peerlist))) { 634 while ((qm = SIMPLEQ_FIRST(&p->msgs))) { 635 SIMPLEQ_REMOVE_HEAD(&p->msgs, next); 636 m = qm->msg; 637 if (--m->refcnt < 1) { 638 free(m->buf); 639 free(m); 640 } 641 free(qm); 642 } 643 net_disconnect_peer(p); 644 if (p->sa) 645 free(p->sa); 646 if (p->name) 647 free(p->name); 648 LIST_REMOVE(p, link); 649 cfgstate.peercnt--; 650 free(p); 651 } 652 653 if (listeners) { 654 for (i = 0; listeners[i] != -1; i++) 655 close(listeners[i]); 656 free(listeners); 657 listeners = 0; 658 } 659} 660 661/* 662 * Helper functions (local) below here. 663 */ 664 665static u_int8_t * 666net_read(struct syncpeer *p, u_int32_t *msgtype, u_int32_t *msglen) 667{ 668 u_int8_t *msg, *blob, *rhash, *iv, hash[SHA_DIGEST_LENGTH]; 669 u_int32_t v, blob_len, pos = 0; 670 int padlen = 0, offset = 0, r; 671 SHA_CTX ctx; 672 673 /* Read blob length */ 674 r = read(p->socket, &v, sizeof v); 675 if (r != (ssize_t)sizeof v) { 676 if (r < 1) 677 net_disconnect_peer(p); 678 return NULL; 679 } 680 681 blob_len = ntohl(v); 682 if (blob_len < sizeof hash + AES_IV_LEN + 2 * sizeof(u_int32_t)) 683 return NULL; 684 *msglen = blob_len - sizeof hash - AES_IV_LEN - 2 * sizeof(u_int32_t); 685 if (*msglen < MSG_MINLEN || *msglen > MSG_MAXLEN) 686 return NULL; 687 688 /* Read message blob */ 689 blob = (u_int8_t *)malloc(blob_len); 690 if (!blob) { 691 log_err("net_read: malloc()"); 692 return NULL; 693 } 694 695 while (blob_len > pos) { 696 switch (r = read(p->socket, blob + pos, blob_len - pos)) { 697 case -1: 698 if (errno == EINTR || errno == EAGAIN) 699 continue; 700 /* FALLTHROUGH */ 701 case 0: 702 net_disconnect_peer(p); 703 free(blob); 704 return NULL; 705 /* NOTREACHED */ 706 default: 707 pos += r; 708 } 709 } 710 711 offset = 0; 712 memcpy(&v, blob + offset, sizeof v); 713 *msgtype = ntohl(v); 714 offset += sizeof v; 715 716 if (*msgtype > MSG_MAXTYPE) { 717 free(blob); 718 return NULL; 719 } 720 721 memcpy(&v, blob + offset, sizeof v); 722 padlen = ntohl(v); 723 offset += sizeof v; 724 725 rhash = blob + offset; 726 iv = rhash + sizeof hash; 727 msg = (u_int8_t *)malloc(*msglen); 728 if (!msg) { 729 free(blob); 730 return NULL; 731 } 732 memcpy(msg, iv + AES_IV_LEN, *msglen); 733 734 dump_buf(2, rhash, sizeof hash, "net_read: got hash"); 735 dump_buf(2, iv, AES_IV_LEN, "net_read: got IV"); 736 dump_buf(2, msg, *msglen, "net_read: pre decrypt"); 737 AES_cbc_encrypt(msg, msg, *msglen, &aes_key[1], iv, AES_DECRYPT); 738 dump_buf(2, msg, *msglen, "net_read: post decrypt"); 739 *msglen -= padlen; 740 741 SHA1_Init(&ctx); 742 SHA1_Update(&ctx, msg, *msglen); 743 SHA1_Final(hash, &ctx); 744 dump_buf(2, hash, sizeof hash, "net_read: computed hash"); 745 746 if (memcmp(hash, rhash, sizeof hash) != 0) { 747 free(blob); 748 log_msg(0, "net_read: got bad message (typo in shared key?)"); 749 return NULL; 750 } 751 free(blob); 752 return msg; 753} 754 755static int 756net_set_sa(struct sockaddr *sa, char *name, in_port_t port) 757{ 758 struct sockaddr_in *sin = (struct sockaddr_in *)sa; 759 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa; 760 761 if (!name) { 762 /* XXX Assume IPv4 */ 763 sa->sa_family = AF_INET; 764 sin->sin_port = htons(port); 765 sin->sin_len = sizeof *sin; 766 return 0; 767 } 768 769 if (inet_pton(AF_INET, name, &sin->sin_addr) == 1) { 770 sa->sa_family = AF_INET; 771 sin->sin_port = htons(port); 772 sin->sin_len = sizeof *sin; 773 return 0; 774 } 775 776 if (inet_pton(AF_INET6, name, &sin6->sin6_addr) == 1) { 777 sa->sa_family = AF_INET6; 778 sin6->sin6_port = htons(port); 779 sin6->sin6_len = sizeof *sin6; 780 return 0; 781 } 782 783 return -1; 784} 785 786static void 787got_sigalrm(int s) 788{ 789 return; 790} 791 792void 793net_connect(void) 794{ 795 struct itimerval iv; 796 struct syncpeer *p; 797 798 signal(SIGALRM, got_sigalrm); 799 memset(&iv, 0, sizeof iv); 800 iv.it_value.tv_sec = 5; 801 iv.it_interval.tv_sec = 5; 802 setitimer(ITIMER_REAL, &iv, NULL); 803 804 for (p = LIST_FIRST(&cfgstate.peerlist); p; p = LIST_NEXT(p, link)) { 805 if (p->socket > -1) 806 continue; 807 if (!p->sa) { 808 p->sa = (void *)calloc(1, 809 sizeof(struct sockaddr_storage)); 810 if (!p->sa) 811 return; 812 if (net_set_sa(p->sa, p->name, cfgstate.listen_port)) 813 continue; 814 } 815 p->socket = socket(p->sa->sa_family, SOCK_STREAM, 0); 816 if (p->socket < 0) { 817 log_err("peer \"%s\": socket()", p->name); 818 continue; 819 } 820 if (connect(p->socket, p->sa, p->sa->sa_len)) { 821 log_msg(1, "net_connect: peer \"%s\" not ready yet", 822 p->name); 823 net_disconnect_peer(p); 824 continue; 825 } 826 if (net_ctl_send_state(p)) { 827 log_msg(0, "net_connect: peer \"%s\" failed", p->name); 828 net_disconnect_peer(p); 829 continue; 830 } 831 log_msg(1, "net_connect: peer \"%s\" connected, fd %d", 832 p->name, p->socket); 833 834 /* Schedule a pfkey sync to the newly connected peer. */ 835 if (cfgstate.runstate == MASTER) 836 timer_add("pfkey_snapshot", 2, pfkey_snapshot, p); 837 } 838 839 timerclear(&iv.it_value); 840 timerclear(&iv.it_interval); 841 setitimer(ITIMER_REAL, &iv, NULL); 842 signal(SIGALRM, SIG_IGN); 843 844 return; 845} 846 847static void 848net_check_peers(void *arg) 849{ 850 net_connect(); 851 (void)timer_add("peer recheck", 600, net_check_peers, 0); 852} 853