func handleTCP(conn *net.TCPConn, timeouted, rehandshaking, termination chan struct{}) { hs := govpn.HandshakeStart(*remoteAddr, conn, conf) buf := make([]byte, govpn.MTU) var n int var err error var prev int var peer *govpn.Peer var terminator chan struct{} HandshakeCycle: for { select { case <-termination: break HandshakeCycle default: } if prev == govpn.MTU { log.Println("Timeouted waiting for the packet") timeouted <- struct{}{} break HandshakeCycle } conn.SetReadDeadline(time.Now().Add(time.Duration(timeout) * time.Second)) n, err = conn.Read(buf[prev:]) if err != nil { log.Println("Connection timeouted") timeouted <- struct{}{} break HandshakeCycle } prev += n peerId := idsCache.Find(buf[:prev]) if peerId == nil { continue } peer = hs.Client(buf[:prev]) prev = 0 if peer == nil { continue } log.Println("Handshake completed") knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer}) if firstUpCall { go govpn.ScriptCall(*upPath, *ifaceName) firstUpCall = false } hs.Zero() terminator = make(chan struct{}) go func() { heartbeat := time.NewTicker(peer.Timeout) var data []byte Processor: for { select { case <-heartbeat.C: peer.EthProcess(nil) case <-terminator: break Processor case data = <-tap.Sink: peer.EthProcess(data) } } heartbeat.Stop() peer.Zero() }() break HandshakeCycle } if hs != nil { hs.Zero() } if peer == nil { return } nonceExpectation := make([]byte, govpn.NonceSize) peer.NonceExpectation(nonceExpectation) prev = 0 var i int TransportCycle: for { select { case <-termination: break TransportCycle default: } if prev == govpn.MTU { log.Println("Timeouted waiting for the packet") timeouted <- struct{}{} break TransportCycle } conn.SetReadDeadline(time.Now().Add(time.Duration(timeout) * time.Second)) n, err = conn.Read(buf[prev:]) if err != nil { log.Println("Connection timeouted") timeouted <- struct{}{} break TransportCycle } prev += n CheckMore: if prev < govpn.MinPktLength { continue } i = bytes.Index(buf[:prev], nonceExpectation) if i == -1 { continue } if !peer.PktProcess(buf[:i+govpn.NonceSize], tap, false) { log.Println("Unauthenticated packet, dropping connection") timeouted <- struct{}{} break TransportCycle } if atomic.LoadInt64(&peer.BytesIn)+atomic.LoadInt64(&peer.BytesOut) > govpn.MaxBytesPerKey { log.Println("Need rehandshake") rehandshaking <- struct{}{} break TransportCycle } peer.NonceExpectation(nonceExpectation) copy(buf, buf[i+govpn.NonceSize:prev]) prev = prev - i - govpn.NonceSize goto CheckMore } if terminator != nil { terminator <- struct{}{} } peer.Zero() conn.Close() }
func main() { flag.Parse() timeout := *timeoutP var err error log.SetFlags(log.Ldate | log.Lmicroseconds | log.Lshortfile) govpn.MTU = *mtu id, err := govpn.IDDecode(*IDRaw) if err != nil { log.Fatalln(err) } if *egdPath != "" { log.Println("Using", *egdPath, "EGD") govpn.EGDInit(*egdPath) } pub, priv := govpn.NewVerifier(id, govpn.StringFromFile(*keyPath)) conf := &govpn.PeerConf{ Id: id, Timeout: time.Second * time.Duration(timeout), NoiseEnable: *noisy, CPR: *cpr, DSAPub: pub, DSAPriv: priv, } govpn.PeersInitDummy(id, conf) var conn io.Writer var sink chan []byte var ready chan struct{} switch *proto { case "udp": conn, sink, ready = startUDP() case "tcp": if *proxyAddr != "" { conn, sink, ready = proxyTCP() } else { conn, sink, ready = startTCP() } default: log.Fatalln("Unknown protocol specified") } tap, ethSink, ethReady, _, err := govpn.TAPListen( *ifaceName, time.Second*time.Duration(timeout), *cpr, ) if err != nil { log.Fatalln("Can not listen on TAP interface:", err) } timeouts := 0 firstUpCall := true var peer *govpn.Peer var ethPkt []byte var pkt []byte knownPeers := govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer}) log.Println(govpn.VersionGet()) log.Println("Connected to", *proto, *remoteAddr) log.Println("Max MTU on TAP interface:", govpn.TAPMaxMTU()) if *stats != "" { log.Println("Stats are going to listen on", *stats) statsPort, err := net.Listen("tcp", *stats) if err != nil { log.Fatalln("Can not listen on stats port:", err) } go govpn.StatsProcessor(statsPort, &knownPeers) } termSignal := make(chan os.Signal, 1) signal.Notify(termSignal, os.Interrupt, os.Kill) log.Println("Starting handshake") handshake := govpn.HandshakeStart(*remoteAddr, conn, conf) MainCycle: for { if peer != nil && (peer.BytesIn+peer.BytesOut) > govpn.MaxBytesPerKey { peer.Zero() peer = nil handshake = govpn.HandshakeStart(*remoteAddr, conn, conf) log.Println("Rehandshaking") } select { case <-termSignal: break MainCycle case ethPkt = <-ethSink: if peer == nil { if len(ethPkt) > 0 { ethReady <- struct{}{} } continue } peer.EthProcess(ethPkt, ethReady) case pkt = <-sink: timeouts++ if timeouts >= timeout { break MainCycle } if pkt == nil { ready <- struct{}{} continue } if peer == nil { if govpn.IDsCache.Find(pkt) == nil { log.Println("Invalid identity in handshake packet") ready <- struct{}{} continue } if p := handshake.Client(pkt); p != nil { log.Println("Handshake completed") if firstUpCall { go govpn.ScriptCall(*upPath, *ifaceName) firstUpCall = false } peer = p handshake.Zero() handshake = nil } ready <- struct{}{} continue } if peer == nil { ready <- struct{}{} continue } if peer.PktProcess(pkt, tap, ready) { timeouts = 0 } } } govpn.ScriptCall(*downPath, *ifaceName) }
func startUDP(timeouted, rehandshaking, termination chan struct{}) { remote, err := net.ResolveUDPAddr("udp", *remoteAddr) if err != nil { log.Fatalln("Can not resolve remote address:", err) } conn, err := net.DialUDP("udp", nil, remote) if err != nil { log.Fatalln("Can not listen on UDP:", err) } log.Println("Connected to UDP:" + *remoteAddr) hs := govpn.HandshakeStart(*remoteAddr, conn, conf) buf := make([]byte, govpn.MTU) var n int var timeouts int var peer *govpn.Peer var terminator chan struct{} MainCycle: for { select { case <-termination: break MainCycle default: } conn.SetReadDeadline(time.Now().Add(time.Second)) n, err = conn.Read(buf) if timeouts == timeout { log.Println("Timeouted") timeouted <- struct{}{} break } if err != nil { timeouts++ continue } if peer != nil { if peer.PktProcess(buf[:n], tap, true) { timeouts = 0 } else { log.Println("Unauthenticated packet") timeouts++ } if atomic.LoadInt64(&peer.BytesIn)+atomic.LoadInt64(&peer.BytesOut) > govpn.MaxBytesPerKey { log.Println("Need rehandshake") rehandshaking <- struct{}{} break MainCycle } continue } if idsCache.Find(buf[:n]) == nil { log.Println("Invalid identity in handshake packet") continue } timeouts = 0 peer = hs.Client(buf[:n]) if peer == nil { continue } log.Println("Handshake completed") knownPeers = govpn.KnownPeers(map[string]**govpn.Peer{*remoteAddr: &peer}) if firstUpCall { go govpn.ScriptCall(*upPath, *ifaceName) firstUpCall = false } hs.Zero() terminator = make(chan struct{}) go func() { heartbeat := time.NewTicker(peer.Timeout) var data []byte Processor: for { select { case <-heartbeat.C: peer.EthProcess(nil) case <-terminator: break Processor case data = <-tap.Sink: peer.EthProcess(data) } } heartbeat.Stop() peer.Zero() }() } if terminator != nil { terminator <- struct{}{} } if hs != nil { hs.Zero() } conn.Close() }