X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=secnet.git;a=blobdiff_plain;f=site.c;h=afa85e886ebf27da76236db92405906be13ec26f;hp=b04f3b340b91f9e90057636c9f6ba1b347d4f850;hb=90d7e3ad26101cf3538171aec2d194e9de1aaed5;hpb=0391d9ee80a1847381ad205b8f707e43707b90b0;ds=sidebyside diff --git a/site.c b/site.c index b04f3b3..afa85e8 100644 --- a/site.c +++ b/site.c @@ -208,6 +208,10 @@ static void transport_data_msgok(struct site *st, const struct comm_addr *a); static bool_t transport_compute_setupinit_peers(struct site *st, const struct comm_addr *configured_addr /* 0 if none or not found */, const struct comm_addr *prod_hint_addr /* 0 if none */); +static void transport_resolve_complete(struct site *st, + const struct comm_addr *a); +static void transport_resolve_complete_tardy(struct site *st, + const struct comm_addr *ca_use); static void transport_record_peer(struct site *st, transport_peers *peers, const struct comm_addr *addr, const char *m); @@ -699,7 +703,6 @@ static bool_t process_msg1(struct site *st, struct buffer_if *msg1, process an incoming MSG1, and that the MSG1 has correct values of A and B. */ - transport_record_peer(st,&st->setup_peers,src,"msg1"); st->setup_session_id=m->source; st->remote_capabilities=m->remote_capabilities; memcpy(st->remoteN,m->nR,NONCELEN); @@ -1150,10 +1153,6 @@ static void site_resolve_callback(void *sst, struct in_addr *address) st->resolving=False; - if (st->state!=SITE_RESOLVE) { - slog(st,LOG_UNEXPECTED,"site_resolve_callback called unexpectedly"); - return; - } if (address) { FILLZERO(ca_buf); ca_buf.comm=st->comms[0]; @@ -1161,16 +1160,65 @@ static void site_resolve_callback(void *sst, struct in_addr *address) ca_buf.sin.sin_port=htons(st->remoteport); ca_buf.sin.sin_addr=*address; ca_use=&ca_buf; + slog(st,LOG_STATE,"resolution of %s completed: %s", + st->address, comm_addr_to_string(ca_use));; } else { slog(st,LOG_ERROR,"resolution of %s failed",st->address); ca_use=0; } - if (transport_compute_setupinit_peers(st,ca_use,0)) { - enter_new_state(st,SITE_SENTMSG1); - } else { - /* Can't figure out who to try to to talk to */ - slog(st,LOG_SETUP_INIT,"key exchange failed: cannot find peer address"); - enter_state_run(st); + + switch (st->state) { + case SITE_RESOLVE: + if (transport_compute_setupinit_peers(st,ca_use,0)) { + enter_new_state(st,SITE_SENTMSG1); + } else { + /* Can't figure out who to try to to talk to */ + slog(st,LOG_SETUP_INIT, + "key exchange failed: cannot find peer address"); + enter_state_run(st); + } + break; + case SITE_SENTMSG1: case SITE_SENTMSG2: + case SITE_SENTMSG3: case SITE_SENTMSG4: + case SITE_SENTMSG5: + if (ca_use) { + /* We start using the address immediately for data too. + * It's best to store it in st->peers now because we might + * go via SENTMSG5, WAIT, and a MSG0, straight into using + * the new key (without updating the data peer addrs). */ + transport_resolve_complete(st,ca_use); + } else if (st->local_mobile) { + /* We can't let this rest because we may have a peer + * address which will break in the future. */ + slog(st,LOG_SETUP_INIT,"resolution of %s failed: " + "abandoning key exchange",st->address); + enter_state_wait(st); + } else { + slog(st,LOG_SETUP_INIT,"resolution of %s failed: " + " continuing to use source address of peer's packets" + " for key exchange and ultimately data", + st->address); + } + break; + case SITE_RUN: + if (ca_use) { + slog(st,LOG_SETUP_INIT,"resolution of %s completed tardily," + " updating peer address(es)",st->address); + transport_resolve_complete_tardy(st,ca_use); + } else if (st->local_mobile) { + /* Not very good. We should queue (another) renegotiation + * so that we can update the peer address. */ + st->key_renegotiate_time=st->now+st->wait_timeout; + } else { + slog(st,LOG_SETUP_INIT,"resolution of %s failed: " + " continuing to use source address of peer's packets", + st->address); + } + break; + case SITE_WAIT: + case SITE_STOP: + /* oh well */ + break; } } @@ -1295,6 +1343,8 @@ static bool_t ensure_resolving(struct site *st) if (st->resolving) return True; + assert(st->address); + /* resolver->request might reentrantly call site_resolve_callback * which will clear st->resolving, so we need to set it beforehand * rather than afterwards; also, it might return False, in which @@ -1580,9 +1630,14 @@ static bool_t site_incoming(void *sst, struct buffer_if *buf, if (st->state==SITE_RUN || st->state==SITE_RESOLVE || st->state==SITE_WAIT) { /* We should definitely process it */ + transport_record_peer(st,&st->setup_peers,source,"msg1"); if (process_msg1(st,buf,source,&named_msg)) { slog(st,LOG_SETUP_INIT,"key setup initiated by peer"); - enter_new_state(st,SITE_SENTMSG2); + bool_t entered=enter_new_state(st,SITE_SENTMSG2); + if (entered && st->address && st->local_mobile) + /* We must do this as the very last thing, because + the resolver callback might reenter us. */ + ensure_resolving(st); } else { slog(st,LOG_ERROR,"failed to process incoming msg1"); } @@ -1602,6 +1657,7 @@ static bool_t site_incoming(void *sst, struct buffer_if *buf, "priority => use incoming msg1"); if (process_msg1(st,buf,source,&named_msg)) { BUF_FREE(&st->buffer); /* Free our old message 1 */ + transport_setup_msgok(st,source); enter_new_state(st,SITE_SENTMSG2); } else { slog(st,LOG_ERROR,"failed to process an incoming " @@ -2092,6 +2148,17 @@ static void transport_peers_copy(struct site *st, transport_peers *dst, src->npeers, &src->peers->addr, sizeof(*src->peers)); } +static void transport_resolve_complete(struct site *st, + const struct comm_addr *ca_use) { + transport_record_peer(st,&st->peers,ca_use,"resolved data"); + transport_record_peer(st,&st->setup_peers,ca_use,"resolved setup"); +} + +static void transport_resolve_complete_tardy(struct site *st, + const struct comm_addr *ca_use) { + transport_record_peer(st,&st->peers,ca_use,"resolved tardily"); +} + void transport_xmit(struct site *st, transport_peers *peers, struct buffer_if *buf, bool_t candebug) { int slot;