transport_peer peers[MAX_MOBILE_PEERS_MAX];
} transport_peers;
+/* Basic operations on transport peer address sets */
static void transport_peers_clear(struct site *st, transport_peers *peers);
static int transport_peers_valid(transport_peers *peers);
static void transport_peers_copy(struct site *st, transport_peers *dst,
const transport_peers *src);
+/* Record address of incoming setup packet; resp. data packet. */
static void transport_setup_msgok(struct site *st, const struct comm_addr *a);
static void transport_data_msgok(struct site *st, const struct comm_addr *a);
+
+/* Initialise the setup addresses. Called before we send the first
+ * packet in a key exchange. If we are the initiator, as a result of
+ * resolve completing (or being determined not to be relevant) or an
+ * incoming PROD; if we are the responder, as a result of the MSG1. */
static bool_t transport_compute_setupinit_peers(struct site *st,
const struct comm_addr *configured_addr /* 0 if none or not found */,
- const struct comm_addr *prod_hint_addr /* 0 if none */);
-static void transport_record_peer(struct site *st, transport_peers *peers,
- const struct comm_addr *addr, const char *m);
+ const struct comm_addr *incoming_packet_addr /* 0 if none */);
+
+/* Called if we are the responder in a key setup, when the resolve
+ * completes. transport_compute_setupinit_peers will hvae been called
+ * earlier. If _complete is called, we are still doing the key setup
+ * (and we should use the new values for both the rest of the key
+ * setup and the ongoing data exchange); if _tardy is called, the key
+ * setup is done (either completed or not) and only the data peers are
+ * relevant */
+static void transport_resolve_complete(struct site *st,
+ const struct comm_addr *a);
+static void transport_resolve_complete_tardy(struct site *st,
+ const struct comm_addr *ca_use);
static void transport_xmit(struct site *st, transport_peers *peers,
struct buffer_if *buf, bool_t candebug);
append_string_xinfo_done(&st->buffer,&xia);
buf_append_string(&st->buffer,st->remotename);
- memcpy(buf_append(&st->buffer,NONCELEN),st->localN,NONCELEN);
+ BUF_ADD_OBJ(append,&st->buffer,st->localN);
if (type==LABEL_MSG1) return True;
- memcpy(buf_append(&st->buffer,NONCELEN),st->remoteN,NONCELEN);
+ BUF_ADD_OBJ(append,&st->buffer,st->remoteN);
if (type==LABEL_MSG2) return True;
if (hacky_par_mid_failnow()) return False;
process an incoming MSG1, and that the MSG1 has correct values
of A and B. */
- transport_record_peer(st,&st->setup_peers,src,"msg1");
st->setup_session_id=m->source;
st->remote_capabilities=m->remote_capabilities;
memcpy(st->remoteN,m->nR,NONCELEN);
st->resolving=False;
- if (st->state!=SITE_RESOLVE) {
- slog(st,LOG_UNEXPECTED,"site_resolve_callback called unexpectedly");
- return;
- }
if (address) {
FILLZERO(ca_buf);
ca_buf.comm=st->comms[0];
ca_buf.sin.sin_port=htons(st->remoteport);
ca_buf.sin.sin_addr=*address;
ca_use=&ca_buf;
+ slog(st,LOG_STATE,"resolution of %s completed: %s",
+ st->address, comm_addr_to_string(ca_use));;
} else {
slog(st,LOG_ERROR,"resolution of %s failed",st->address);
ca_use=0;
}
- if (transport_compute_setupinit_peers(st,ca_use,0)) {
- enter_new_state(st,SITE_SENTMSG1);
- } else {
- /* Can't figure out who to try to to talk to */
- slog(st,LOG_SETUP_INIT,"key exchange failed: cannot find peer address");
- enter_state_run(st);
+
+ switch (st->state) {
+ case SITE_RESOLVE:
+ if (transport_compute_setupinit_peers(st,ca_use,0)) {
+ enter_new_state(st,SITE_SENTMSG1);
+ } else {
+ /* Can't figure out who to try to to talk to */
+ slog(st,LOG_SETUP_INIT,
+ "key exchange failed: cannot find peer address");
+ enter_state_run(st);
+ }
+ break;
+ case SITE_SENTMSG1: case SITE_SENTMSG2:
+ case SITE_SENTMSG3: case SITE_SENTMSG4:
+ case SITE_SENTMSG5:
+ if (ca_use) {
+ /* We start using the address immediately for data too.
+ * It's best to store it in st->peers now because we might
+ * go via SENTMSG5, WAIT, and a MSG0, straight into using
+ * the new key (without updating the data peer addrs). */
+ transport_resolve_complete(st,ca_use);
+ } else if (st->local_mobile) {
+ /* We can't let this rest because we may have a peer
+ * address which will break in the future. */
+ slog(st,LOG_SETUP_INIT,"resolution of %s failed: "
+ "abandoning key exchange",st->address);
+ enter_state_wait(st);
+ } else {
+ slog(st,LOG_SETUP_INIT,"resolution of %s failed: "
+ " continuing to use source address of peer's packets"
+ " for key exchange and ultimately data",
+ st->address);
+ }
+ break;
+ case SITE_RUN:
+ if (ca_use) {
+ slog(st,LOG_SETUP_INIT,"resolution of %s completed tardily,"
+ " updating peer address(es)",st->address);
+ transport_resolve_complete_tardy(st,ca_use);
+ } else if (st->local_mobile) {
+ /* Not very good. We should queue (another) renegotiation
+ * so that we can update the peer address. */
+ st->key_renegotiate_time=st->now+st->wait_timeout;
+ } else {
+ slog(st,LOG_SETUP_INIT,"resolution of %s failed: "
+ " continuing to use source address of peer's packets",
+ st->address);
+ }
+ break;
+ case SITE_WAIT:
+ case SITE_STOP:
+ /* oh well */
+ break;
}
}
st->setup_session_id=0;
transport_peers_clear(st,&st->setup_peers);
- memset(st->localN,0,NONCELEN);
- memset(st->remoteN,0,NONCELEN);
+ FILLZERO(st->localN);
+ FILLZERO(st->remoteN);
dispose_transform(&st->new_transform);
memset(st->dhsecret,0,st->dh->len);
memset(st->sharedsecret,0,st->sharedsecretlen);
if (st->resolving)
return True;
+ assert(st->address);
+
/* resolver->request might reentrantly call site_resolve_callback
* which will clear st->resolving, so we need to set it beforehand
* rather than afterwards; also, it might return False, in which
if (st->state==SITE_RUN || st->state==SITE_RESOLVE ||
st->state==SITE_WAIT) {
/* We should definitely process it */
+ transport_compute_setupinit_peers(st,0,source);
if (process_msg1(st,buf,source,&named_msg)) {
slog(st,LOG_SETUP_INIT,"key setup initiated by peer");
- enter_new_state(st,SITE_SENTMSG2);
+ bool_t entered=enter_new_state(st,SITE_SENTMSG2);
+ if (entered && st->address && st->local_mobile)
+ /* We must do this as the very last thing, because
+ the resolver callback might reenter us. */
+ ensure_resolving(st);
} else {
slog(st,LOG_ERROR,"failed to process incoming msg1");
}
"priority => use incoming msg1");
if (process_msg1(st,buf,source,&named_msg)) {
BUF_FREE(&st->buffer); /* Free our old message 1 */
+ transport_setup_msgok(st,source);
enter_new_state(st,SITE_SENTMSG2);
} else {
slog(st,LOG_ERROR,"failed to process an incoming "
because our peer's forgotten the key */
if (get_uint32(buf->start+4)==st->current.remote_session_id) {
bool_t initiated;
- initiated = initiate_key_setup(st,"received a NAK",0);
+ initiated = initiate_key_setup(st,"received a NAK",source);
if (!initiated) generate_send_prod(st,source);
} else {
slog(st,LOG_SEC,"bad incoming NAK");
static bool_t transport_compute_setupinit_peers(struct site *st,
const struct comm_addr *configured_addr /* 0 if none or not found */,
- const struct comm_addr *prod_hint_addr /* 0 if none */) {
+ const struct comm_addr *incoming_packet_addr /* 0 if none */) {
- if (!configured_addr && !prod_hint_addr &&
+ if (!configured_addr && !incoming_packet_addr &&
!transport_peers_valid(&st->peers))
return False;
slog(st,LOG_SETUP_INIT,
"using:%s%s %d old peer address(es)",
configured_addr ? " configured address;" : "",
- prod_hint_addr ? " PROD hint address;" : "",
+ incoming_packet_addr ? " incoming packet address;" : "",
st->peers.npeers);
/* Non-mobile peers have st->peers.npeers==0 or ==1, since they
transport_peers_copy(st,&st->setup_peers,&st->peers);
- if (prod_hint_addr)
- transport_record_peer(st,&st->setup_peers,prod_hint_addr,"prod");
+ if (incoming_packet_addr)
+ transport_record_peer(st,&st->setup_peers,incoming_packet_addr,
+ "incoming");
if (configured_addr)
transport_record_peer(st,&st->setup_peers,configured_addr,"setupinit");
src->npeers, &src->peers->addr, sizeof(*src->peers));
}
+static void transport_resolve_complete(struct site *st,
+ const struct comm_addr *ca_use) {
+ transport_record_peer(st,&st->peers,ca_use,"resolved data");
+ transport_record_peer(st,&st->setup_peers,ca_use,"resolved setup");
+}
+
+static void transport_resolve_complete_tardy(struct site *st,
+ const struct comm_addr *ca_use) {
+ transport_record_peer(st,&st->peers,ca_use,"resolved tardily");
+}
+
void transport_xmit(struct site *st, transport_peers *peers,
struct buffer_if *buf, bool_t candebug) {
int slot;
~ian / secnet.git / blobdiff