X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=site.c;h=567b85f85d26d97947f11d1447f2330822ff14c4;hb=babd74ec57f6b3a6f6709d10ec725532deb3ed66;hp=c2a230383bc3ad45020091726364f26130d849c2;hpb=0009e60a914ef5239ba2f8cc19e07ab5368e49b1;p=secnet.git diff --git a/site.c b/site.c index c2a2303..567b85f 100644 --- a/site.c +++ b/site.c @@ -145,19 +145,19 @@ struct site { struct dh_if *dh; struct hash_if *hash; - uint32_t setup_retries; /* How many times to send setup packets */ - uint32_t setup_timeout; /* Initial timeout for setup packets */ - uint32_t wait_timeout; /* How long to wait if setup unsuccessful */ - uint32_t key_lifetime; /* How long a key lasts once set up */ - uint32_t key_renegotiate_time; /* If we see traffic (or a keepalive) + int32_t setup_retries; /* How many times to send setup packets */ + int32_t setup_timeout; /* Initial timeout for setup packets */ + int32_t wait_timeout; /* How long to wait if setup unsuccessful */ + int32_t key_lifetime; /* How long a key lasts once set up */ + int32_t key_renegotiate_time; /* If we see traffic (or a keepalive) after this time, initiate a new key exchange */ bool_t keepalive; /* Send keepalives to detect peer failure (not yet implemented) */ uint8_t *setupsig; /* Expected signature of incoming MSG1 packets */ - uint32_t setupsiglen; /* Allows us to discard packets quickly if - they are not for us */ + int32_t setupsiglen; /* Allows us to discard packets quickly if + they are not for us */ bool_t setup_priority; /* Do we have precedence if both sites emit message 1 simultaneously? */ uint32_t log_events; @@ -187,7 +187,7 @@ struct site { uint8_t localN[NONCELEN]; /* Nonces for key exchange */ uint8_t remoteN[NONCELEN]; struct buffer_if buffer; /* Current outgoing key exchange packet */ - uint32_t retries; /* Number of retries remaining */ + int32_t retries; /* Number of retries remaining */ uint64_t timeout; /* Timeout for current state */ uint8_t *dhsecret; uint8_t *sharedsecret; @@ -242,16 +242,16 @@ struct msg { uint8_t *hashstart; uint32_t dest; uint32_t source; - uint32_t remlen; + int32_t remlen; uint8_t *remote; - uint32_t loclen; + int32_t loclen; uint8_t *local; uint8_t *nR; uint8_t *nL; - uint32_t pklen; + int32_t pklen; uint8_t *pk; - uint32_t hashlen; - uint32_t siglen; + int32_t hashlen; + int32_t siglen; uint8_t *sig; }; @@ -932,8 +932,7 @@ static void enter_state_wait(struct site *st) /* XXX Erase keys etc. */ } -static inline void site_settimeout(uint64_t timeout, uint64_t *now, - int *timeout_io) +static inline void site_settimeout(uint64_t timeout, int *timeout_io) { if (timeout) { int64_t offset=timeout-*now; @@ -945,8 +944,7 @@ static inline void site_settimeout(uint64_t timeout, uint64_t *now, } static int site_beforepoll(void *sst, struct pollfd *fds, int *nfds_io, - int *timeout_io, const struct timeval *tv_now, - uint64_t *now) + int *timeout_io) { struct site *st=sst; @@ -956,15 +954,14 @@ static int site_beforepoll(void *sst, struct pollfd *fds, int *nfds_io, /* Work out when our next timeout is. The earlier of 'timeout' or 'current_key_timeout'. A stored value of '0' indicates no timeout active. */ - site_settimeout(st->timeout, now, timeout_io); - site_settimeout(st->current_key_timeout, now, timeout_io); + site_settimeout(st->timeout, timeout_io); + site_settimeout(st->current_key_timeout, timeout_io); return 0; /* success */ } /* NB site_afterpoll will be called before site_beforepoll is ever called */ -static void site_afterpoll(void *sst, struct pollfd *fds, int nfds, - const struct timeval *tv_now, uint64_t *now) +static void site_afterpoll(void *sst, struct pollfd *fds, int nfds) { struct site *st=sst; @@ -1241,18 +1238,19 @@ static list_t *site_apply(closure_t *self, struct cloc loc, dict_t *context, st->key_lifetime=dict_read_number( dict,"key-lifetime",False,"site",loc,DEFAULT_KEY_LIFETIME); - if (st->key_lifetime < DEFAULT_KEY_RENEGOTIATE_GAP) - st->key_renegotiate_time=st->key_lifetime/2; - else - st->key_renegotiate_time=st->key_lifetime-DEFAULT_KEY_RENEGOTIATE_GAP; st->setup_retries=dict_read_number( dict,"setup-retries",False,"site",loc,DEFAULT_SETUP_RETRIES); st->setup_timeout=dict_read_number( dict,"setup-timeout",False,"site",loc,DEFAULT_SETUP_TIMEOUT); st->wait_timeout=dict_read_number( dict,"wait-time",False,"site",loc,DEFAULT_WAIT_TIME); + + if (st->key_lifetime < DEFAULT_KEY_RENEGOTIATE_GAP*2) + st->key_renegotiate_time=st->key_lifetime/2; + else + st->key_renegotiate_time=st->key_lifetime-DEFAULT_KEY_RENEGOTIATE_GAP; st->key_renegotiate_time=dict_read_number( - dict,"renegotiate-time",False,"site",loc,st->key_lifetime); + dict,"renegotiate-time",False,"site",loc,st->key_renegotiate_time); if (st->key_renegotiate_time > st->key_lifetime) { cfgfatal(loc,"site", "renegotiate-time must be less than key-lifetime\n");