site setup: Correct logic for DEFAULT_KEY_RENEGOTIATE_GAP

[secnet.git] / site.c

diff --git a/site.c b/site.c
index c2a230383bc3ad45020091726364f26130d849c2..835ccc80065a1e5709f3d7c5b890d859b8975468 100644 (file)
--- a/site.c
+++ b/site.c
@@ -145,19 +145,19 @@ struct site {
     struct dh_if *dh;
     struct hash_if *hash;
 
-    uint32_t setup_retries; /* How many times to send setup packets */
-    uint32_t setup_timeout; /* Initial timeout for setup packets */
-    uint32_t wait_timeout; /* How long to wait if setup unsuccessful */
-    uint32_t key_lifetime; /* How long a key lasts once set up */
-    uint32_t key_renegotiate_time; /* If we see traffic (or a keepalive)
+    int32_t setup_retries; /* How many times to send setup packets */
+    int32_t setup_timeout; /* Initial timeout for setup packets */
+    int32_t wait_timeout; /* How long to wait if setup unsuccessful */
+    int32_t key_lifetime; /* How long a key lasts once set up */
+    int32_t key_renegotiate_time; /* If we see traffic (or a keepalive)
                                      after this time, initiate a new
                                      key exchange */
     bool_t keepalive; /* Send keepalives to detect peer failure (not yet
                         implemented) */
 
     uint8_t *setupsig; /* Expected signature of incoming MSG1 packets */
-    uint32_t setupsiglen; /* Allows us to discard packets quickly if
-                            they are not for us */
+    int32_t setupsiglen; /* Allows us to discard packets quickly if
+                           they are not for us */
     bool_t setup_priority; /* Do we have precedence if both sites emit
                              message 1 simultaneously? */
     uint32_t log_events;
@@ -187,7 +187,7 @@ struct site {
     uint8_t localN[NONCELEN]; /* Nonces for key exchange */
     uint8_t remoteN[NONCELEN];
     struct buffer_if buffer; /* Current outgoing key exchange packet */
-    uint32_t retries; /* Number of retries remaining */
+    int32_t retries; /* Number of retries remaining */
     uint64_t timeout; /* Timeout for current state */
     uint8_t *dhsecret;
     uint8_t *sharedsecret;
@@ -242,16 +242,16 @@ struct msg {
     uint8_t *hashstart;
     uint32_t dest;
     uint32_t source;
-    uint32_t remlen;
+    int32_t remlen;
     uint8_t *remote;
-    uint32_t loclen;
+    int32_t loclen;
     uint8_t *local;
     uint8_t *nR;
     uint8_t *nL;
-    uint32_t pklen;
+    int32_t pklen;
     uint8_t *pk;
-    uint32_t hashlen;
-    uint32_t siglen;
+    int32_t hashlen;
+    int32_t siglen;
     uint8_t *sig;
 };
 
@@ -932,8 +932,7 @@ static void enter_state_wait(struct site *st)
     /* XXX Erase keys etc. */
 }
 
-static inline void site_settimeout(uint64_t timeout, uint64_t *now,
-                                  int *timeout_io)
+static inline void site_settimeout(uint64_t timeout, int *timeout_io)
 {
     if (timeout) {
        int64_t offset=timeout-*now;
@@ -945,8 +944,7 @@ static inline void site_settimeout(uint64_t timeout, uint64_t *now,
 }
 
 static int site_beforepoll(void *sst, struct pollfd *fds, int *nfds_io,
-                          int *timeout_io, const struct timeval *tv_now,
-                          uint64_t *now)
+                          int *timeout_io)
 {
     struct site *st=sst;
 
@@ -956,15 +954,14 @@ static int site_beforepoll(void *sst, struct pollfd *fds, int *nfds_io,
     /* Work out when our next timeout is. The earlier of 'timeout' or
        'current_key_timeout'. A stored value of '0' indicates no timeout
        active. */
-    site_settimeout(st->timeout, now, timeout_io);
-    site_settimeout(st->current_key_timeout, now, timeout_io);
+    site_settimeout(st->timeout, timeout_io);
+    site_settimeout(st->current_key_timeout, timeout_io);
 
     return 0; /* success */
 }
 
 /* NB site_afterpoll will be called before site_beforepoll is ever called */
-static void site_afterpoll(void *sst, struct pollfd *fds, int nfds,
-                          const struct timeval *tv_now, uint64_t *now)
+static void site_afterpoll(void *sst, struct pollfd *fds, int nfds)
 {
     struct site *st=sst;
 
@@ -1241,7 +1238,7 @@ static list_t *site_apply(closure_t *self, struct cloc loc, dict_t *context,
 
     st->key_lifetime=dict_read_number(
        dict,"key-lifetime",False,"site",loc,DEFAULT_KEY_LIFETIME);
-    if (st->key_lifetime < DEFAULT_KEY_RENEGOTIATE_GAP)
+    if (st->key_lifetime < DEFAULT_KEY_RENEGOTIATE_GAP*2)
        st->key_renegotiate_time=st->key_lifetime/2;
     else
        st->key_renegotiate_time=st->key_lifetime-DEFAULT_KEY_RENEGOTIATE_GAP;