func main() {
flag.Parse()
timeout := *timeoutP
var err error
log.SetFlags(log.Ldate | log.Lmicroseconds | log.Lshortfile)
govpn.MTU = *mtu
id, err := govpn.IDDecode(*IDRaw)
if err != nil {
log.Fatalln(err)
}
if *egdPath != "" {
log.Println("Using", *egdPath, "EGD")
govpn.EGDInit(*egdPath)
}
pub, priv := govpn.NewVerifier(id, govpn.StringFromFile(*keyPath))
conf := &govpn.PeerConf{
Id: id,
Timeout: time.Second * time.Duration(timeout),
NoiseEnable: *noisy,
CPR: *cpr,
DSAPub: pub,
DSAPriv: priv,
}
govpn.PeersInitDummy(id, conf)
var conn io.Writer
var sink chan []byte
var ready chan struct{}
switch *proto {
case "udp":
conn, sink, ready = startUDP()
case "tcp":
if *proxyAddr != "" {
conn, sink, ready = proxyTCP()
} else {
conn, sink, ready = startTCP()
}
default:
log.Fatalln("Unknown protocol specified")
}
tap, ethSink, ethReady, _, err := govpn.TAPListen(
*ifaceName,
time.Second*time.Duration(timeout),
*cpr,
)
if err != nil {
log.Fatalln("Can not listen on TAP interface:", err)
}
timeouts := 0
firstUpCall := true
var peer *govpn.Peer
var ethPkt []byte
var pkt []byte
knownPeers := govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer})
log.Println(govpn.VersionGet())
log.Println("Connected to", *proto, *remoteAddr)
log.Println("Max MTU on TAP interface:", govpn.TAPMaxMTU())
if *stats != "" {
log.Println("Stats are going to listen on", *stats)
statsPort, err := net.Listen("tcp", *stats)
if err != nil {
log.Fatalln("Can not listen on stats port:", err)
}
go govpn.StatsProcessor(statsPort, &knownPeers)
}
termSignal := make(chan os.Signal, 1)
signal.Notify(termSignal, os.Interrupt, os.Kill)
log.Println("Starting handshake")
handshake := govpn.HandshakeStart(*remoteAddr, conn, conf)
MainCycle:
for {
if peer != nil && (peer.BytesIn+peer.BytesOut) > govpn.MaxBytesPerKey {
peer.Zero()
peer = nil
handshake = govpn.HandshakeStart(*remoteAddr, conn, conf)
log.Println("Rehandshaking")
}
select {
case <-termSignal:
break MainCycle
case ethPkt = <-ethSink:
if peer == nil {
if len(ethPkt) > 0 {
ethReady <- struct{}{}
}
continue
}
peer.EthProcess(ethPkt, ethReady)
case pkt = <-sink:
timeouts++
if timeouts >= timeout {
break MainCycle
}
if pkt == nil {
ready <- struct{}{}
continue
}
if peer == nil {
if govpn.IDsCache.Find(pkt) == nil {
log.Println("Invalid identity in handshake packet")
ready <- struct{}{}
continue
}
if p := handshake.Client(pkt); p != nil {
log.Println("Handshake completed")
if firstUpCall {
go govpn.ScriptCall(*upPath, *ifaceName)
firstUpCall = false
}
peer = p
handshake.Zero()
handshake = nil
}
ready <- struct{}{}
continue
}
if peer == nil {
ready <- struct{}{}
continue
}
if peer.PktProcess(pkt, tap, ready) {
timeouts = 0
}
}
}
govpn.ScriptCall(*downPath, *ifaceName)
}
func handleTCP(conn *net.TCPConn, timeouted, rehandshaking, termination chan struct{}) {
hs := govpn.HandshakeStart(*remoteAddr, conn, conf)
buf := make([]byte, govpn.MTU)
var n int
var err error
var prev int
var peer *govpn.Peer
var terminator chan struct{}
HandshakeCycle:
for {
select {
case <-termination:
break HandshakeCycle
default:
}
if prev == govpn.MTU {
log.Println("Timeouted waiting for the packet")
timeouted <- struct{}{}
break HandshakeCycle
}
conn.SetReadDeadline(time.Now().Add(time.Duration(timeout) * time.Second))
n, err = conn.Read(buf[prev:])
if err != nil {
log.Println("Connection timeouted")
timeouted <- struct{}{}
break HandshakeCycle
}
prev += n
peerId := idsCache.Find(buf[:prev])
if peerId == nil {
continue
}
peer = hs.Client(buf[:prev])
prev = 0
if peer == nil {
continue
}
log.Println("Handshake completed")
knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer})
if firstUpCall {
go govpn.ScriptCall(*upPath, *ifaceName)
firstUpCall = false
}
hs.Zero()
terminator = make(chan struct{})
go func() {
heartbeat := time.NewTicker(peer.Timeout)
var data []byte
Processor:
for {
select {
case <-heartbeat.C:
peer.EthProcess(nil)
case <-terminator:
break Processor
case data = <-tap.Sink:
peer.EthProcess(data)
}
}
heartbeat.Stop()
peer.Zero()
}()
break HandshakeCycle
}
if hs != nil {
hs.Zero()
}
if peer == nil {
return
}
nonceExpectation := make([]byte, govpn.NonceSize)
peer.NonceExpectation(nonceExpectation)
prev = 0
var i int
TransportCycle:
for {
select {
case <-termination:
break TransportCycle
default:
}
if prev == govpn.MTU {
log.Println("Timeouted waiting for the packet")
timeouted <- struct{}{}
break TransportCycle
}
conn.SetReadDeadline(time.Now().Add(time.Duration(timeout) * time.Second))
n, err = conn.Read(buf[prev:])
if err != nil {
log.Println("Connection timeouted")
timeouted <- struct{}{}
break TransportCycle
}
prev += n
CheckMore:
if prev < govpn.MinPktLength {
continue
}
i = bytes.Index(buf[:prev], nonceExpectation)
if i == -1 {
continue
}
if !peer.PktProcess(buf[:i+govpn.NonceSize], tap, false) {
log.Println("Unauthenticated packet, dropping connection")
timeouted <- struct{}{}
break TransportCycle
}
if atomic.LoadInt64(&peer.BytesIn)+atomic.LoadInt64(&peer.BytesOut) > govpn.MaxBytesPerKey {
log.Println("Need rehandshake")
rehandshaking <- struct{}{}
break TransportCycle
}
peer.NonceExpectation(nonceExpectation)
copy(buf, buf[i+govpn.NonceSize:prev])
prev = prev - i - govpn.NonceSize
goto CheckMore
}
if terminator != nil {
terminator <- struct{}{}
}
peer.Zero()
conn.Close()
}
func handleTCP(conn net.Conn) {
addr := conn.RemoteAddr().String()
buf := make([]byte, govpn.MTU)
var n int
var err error
var prev int
var hs *govpn.Handshake
var ps *PeerState
var peer *govpn.Peer
var tap *govpn.TAP
var conf *govpn.PeerConf
for {
if prev == govpn.MTU {
break
}
conn.SetReadDeadline(time.Now().Add(time.Duration(govpn.TimeoutDefault) * time.Second))
n, err = conn.Read(buf[prev:])
if err != nil {
// Either EOFed or timeouted
break
}
prev += n
peerId := idsCache.Find(buf[:prev])
if peerId == nil {
continue
}
if hs == nil {
conf = confs[*peerId]
if conf == nil {
log.Println("Can not get peer configuration:", peerId.String())
break
}
hs = govpn.NewHandshake(addr, conn, conf)
}
peer = hs.Server(buf[:prev])
prev = 0
if peer == nil {
continue
}
hs.Zero()
log.Println("Peer handshake finished:", addr, peer.Id.String())
peersByIdLock.RLock()
addrPrev, exists := peersById[*peer.Id]
peersByIdLock.RUnlock()
if exists {
peersLock.Lock()
peers[addrPrev].terminator <- struct{}{}
tap = peers[addrPrev].tap
ps = &PeerState{
peer: peer,
tap: tap,
terminator: make(chan struct{}),
}
go peerReady(*ps)
peersByIdLock.Lock()
kpLock.Lock()
delete(peers, addrPrev)
delete(knownPeers, addrPrev)
peers[addr] = ps
knownPeers[addr] = &peer
peersById[*peer.Id] = addr
peersLock.Unlock()
peersByIdLock.Unlock()
kpLock.Unlock()
log.Println("Rehandshake processed:", peer.Id.String())
} else {
ifaceName, err := callUp(peer.Id)
if err != nil {
break
}
tap, err = govpn.TAPListen(ifaceName)
if err != nil {
log.Println("Unable to create TAP:", err)
break
}
ps = &PeerState{
peer: peer,
tap: tap,
terminator: make(chan struct{}, 1),
}
go peerReady(*ps)
peersLock.Lock()
peersByIdLock.Lock()
kpLock.Lock()
peers[addr] = ps
peersById[*peer.Id] = addr
knownPeers[addr] = &peer
peersLock.Unlock()
peersByIdLock.Unlock()
kpLock.Unlock()
log.Println("Peer created:", peer.Id.String())
}
break
}
if hs != nil {
hs.Zero()
}
if peer == nil {
return
}
nonceExpectation := make([]byte, govpn.NonceSize)
peer.NonceExpectation(nonceExpectation)
prev = 0
var i int
for {
if prev == govpn.MTU {
break
}
conn.SetReadDeadline(time.Now().Add(conf.Timeout))
n, err = conn.Read(buf[prev:])
if err != nil {
// Either EOFed or timeouted
break
}
prev += n
CheckMore:
if prev < govpn.MinPktLength {
continue
}
i = bytes.Index(buf[:prev], nonceExpectation)
if i == -1 {
continue
}
if !peer.PktProcess(buf[:i+govpn.NonceSize], tap, false) {
log.Println(
"Unauthenticated packet, dropping connection",
addr, peer.Id.String(),
)
break
}
peer.NonceExpectation(nonceExpectation)
copy(buf, buf[i+govpn.NonceSize:prev])
prev = prev - i - govpn.NonceSize
goto CheckMore
}
peer.Zero()
}
func startUDP() {
bind, err := net.ResolveUDPAddr("udp", *bindAddr)
if err != nil {
log.Fatalln("Can not resolve bind address:", err)
}
conn, err := net.ListenUDP("udp", bind)
if err != nil {
log.Fatalln("Can not listen on UDP:", err)
}
log.Println("Listening on UDP:" + *bindAddr)
udpBufs <- make([]byte, govpn.MTU)
go func() {
var buf []byte
var raddr *net.UDPAddr
var addr string
var n int
var err error
var ps *PeerState
var hs *govpn.Handshake
var addrPrev string
var exists bool
var peerId *govpn.PeerId
var peer *govpn.Peer
var conf *govpn.PeerConf
for {
buf = <-udpBufs
n, raddr, err = conn.ReadFromUDP(buf)
if err != nil {
log.Println("Unexpected error when receiving", err)
break
}
addr = raddr.String()
peersLock.RLock()
ps, exists = peers[addr]
peersLock.RUnlock()
if !exists {
goto CheckHandshake
}
go func(ps *govpn.Peer, tap *govpn.TAP, buf []byte, n int) {
peer.PktProcess(buf[:n], tap, true)
udpBufs <- buf
}(ps.peer, ps.tap, buf, n)
continue
CheckHandshake:
hsLock.RLock()
hs, exists = handshakes[addr]
hsLock.RUnlock()
if !exists {
goto CheckID
}
peer = hs.Server(buf[:n])
if peer == nil {
goto Finished
}
log.Println("Peer handshake finished:", addr, peer.Id.String())
hs.Zero()
hsLock.Lock()
delete(handshakes, addr)
hsLock.Unlock()
go func() {
udpBufs <- make([]byte, govpn.MTU)
udpBufs <- make([]byte, govpn.MTU)
}()
peersByIdLock.RLock()
addrPrev, exists = peersById[*peer.Id]
peersByIdLock.RUnlock()
if exists {
peersLock.Lock()
peers[addrPrev].terminator <- struct{}{}
ps = &PeerState{
peer: peer,
tap: peers[addrPrev].tap,
terminator: make(chan struct{}),
}
go func(ps PeerState) {
peerReady(ps)
<-udpBufs
<-udpBufs
}(*ps)
peersByIdLock.Lock()
kpLock.Lock()
delete(peers, addrPrev)
delete(knownPeers, addrPrev)
peers[addr] = ps
knownPeers[addr] = &peer
peersById[*peer.Id] = addr
peersLock.Unlock()
peersByIdLock.Unlock()
kpLock.Unlock()
log.Println("Rehandshake processed:", peer.Id.String())
} else {
go func(addr string, peer *govpn.Peer) {
ifaceName, err := callUp(peer.Id)
if err != nil {
return
}
tap, err := govpn.TAPListen(ifaceName)
if err != nil {
log.Println("Unable to create TAP:", err)
return
}
ps = &PeerState{
peer: peer,
tap: tap,
terminator: make(chan struct{}),
}
go func(ps PeerState) {
peerReady(ps)
<-udpBufs
<-udpBufs
}(*ps)
peersLock.Lock()
peersByIdLock.Lock()
kpLock.Lock()
peers[addr] = ps
knownPeers[addr] = &peer
peersById[*peer.Id] = addr
peersLock.Unlock()
peersByIdLock.Unlock()
kpLock.Unlock()
log.Println("Peer created:", peer.Id.String())
}(addr, peer)
}
goto Finished
CheckID:
peerId = idsCache.Find(buf[:n])
if peerId == nil {
log.Println("Unknown identity from:", addr)
goto Finished
}
conf = confs[*peerId]
if conf == nil {
log.Println("Unable to get peer configuration:", peerId.String())
goto Finished
}
hs = govpn.NewHandshake(
addr,
UDPSender{conn: conn, addr: raddr},
conf,
)
hs.Server(buf[:n])
hsLock.Lock()
handshakes[addr] = hs
hsLock.Unlock()
Finished:
udpBufs <- buf
}
}()
}
func startUDP(timeouted, rehandshaking, termination chan struct{}) {
remote, err := net.ResolveUDPAddr("udp", *remoteAddr)
if err != nil {
log.Fatalln("Can not resolve remote address:", err)
}
conn, err := net.DialUDP("udp", nil, remote)
if err != nil {
log.Fatalln("Can not listen on UDP:", err)
}
log.Println("Connected to UDP:" + *remoteAddr)
hs := govpn.HandshakeStart(*remoteAddr, conn, conf)
buf := make([]byte, govpn.MTU)
var n int
var timeouts int
var peer *govpn.Peer
var terminator chan struct{}
MainCycle:
for {
select {
case <-termination:
break MainCycle
default:
}
conn.SetReadDeadline(time.Now().Add(time.Second))
n, err = conn.Read(buf)
if timeouts == timeout {
log.Println("Timeouted")
timeouted <- struct{}{}
break
}
if err != nil {
timeouts++
continue
}
if peer != nil {
if peer.PktProcess(buf[:n], tap, true) {
timeouts = 0
} else {
log.Println("Unauthenticated packet")
timeouts++
}
if atomic.LoadInt64(&peer.BytesIn)+atomic.LoadInt64(&peer.BytesOut) > govpn.MaxBytesPerKey {
log.Println("Need rehandshake")
rehandshaking <- struct{}{}
break MainCycle
}
continue
}
if idsCache.Find(buf[:n]) == nil {
log.Println("Invalid identity in handshake packet")
continue
}
timeouts = 0
peer = hs.Client(buf[:n])
if peer == nil {
continue
}
log.Println("Handshake completed")
knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer})
if firstUpCall {
go govpn.ScriptCall(*upPath, *ifaceName)
firstUpCall = false
}
hs.Zero()
terminator = make(chan struct{})
go func() {
heartbeat := time.NewTicker(peer.Timeout)
var data []byte
Processor:
for {
select {
case <-heartbeat.C:
peer.EthProcess(nil)
case <-terminator:
break Processor
case data = <-tap.Sink:
peer.EthProcess(data)
}
}
heartbeat.Stop()
peer.Zero()
}()
}
if terminator != nil {
terminator <- struct{}{}
}
if hs != nil {
hs.Zero()
}
conn.Close()
}