gnunet-service-cadet_tunnels.c File Reference

Information we track per tunnel. More...

#include "gnunet_common.h"
#include "gnunet_pils_service.h"
#include "gnunet_scheduler_lib.h"
#include "platform.h"
#include "gnunet_util_lib.h"
#include "gnunet_statistics_service.h"
#include "cadet_protocol.h"
#include "gnunet-service-cadet_channel.h"
#include "gnunet-service-cadet_connection.h"
#include "gnunet-service-cadet_tunnels.h"
#include "gnunet-service-cadet_peer.h"
#include "gnunet-service-cadet_paths.h"

Include dependency graph for gnunet-service-cadet_tunnels.c:

Go to the source code of this file.

Data Structures
struct	CadetTunnelSkippedKey
	Struct to old keys for skipped messages while advancing the Axolotl ratchet. More...
struct	CadetTunnelAxolotl
	Axolotl data, according to https://github.com/trevp/axolotl/wiki . More...
struct	CadetTunnelAsync
	Struct used to store data required for an async update AX by KX process. More...
struct	CadetTunnelQueueEntry
	Struct used to save messages in a non-ready tunnel to send once connected. More...
struct	CadetTunnel
	Struct containing all information regarding a tunnel to a peer. More...
struct	EvaluationSummary
	Closure for evaluate_connection. More...
struct	ChanIterCls
	Closure for iterate_channels_cb. More...

Macros
#define	LOG(level, ...)   GNUNET_log_from (level, "cadet-tun", __VA_ARGS__)
#define	MAX_UNVERIFIED_ATTEMPTS   16
	How often do we try to decrypt payload with unverified key material? Used to limit CPU increase upon receiving bogus KX.
#define	IDLE_DESTROY_DELAY
	How long do we wait until tearing down an idle tunnel?
#define	INITIAL_KX_RETRY_DELAY
	How long do we wait initially before retransmitting the KX? TODO: replace by 2 RTT if/once we have connection-level RTT data!
#define	MAX_SKIPPED_KEYS   64
	Maximum number of skipped keys we keep in memory per tunnel.
#define	MAX_KEY_GAP   256
	Maximum number of keys (and thus ratchet steps) we are willing to skip before we decide this is either a bogus packet or a DoS-attempt.
#define	HIGH_BIT   0x8000000
#define	LOG2(level, ...)

Typedefs
typedef void(*	CadetTunnelAxolotlCallback) (void *cls, enum GNUNET_GenericReturnValue res)
	Signature of the follow up function from an udate AX by KX.

Functions
int	GCT_alice_or_betty (const struct GNUNET_PeerIdentity *other)
	Am I Alice or Betty (some call her Bob), or talking to myself?
static void	mark_connection_unready (struct CadetTConnection *ct)
	Connection ct is now unready, clear it's ready flag and move it from the ready DLL to the busy DLL.
const char *	GCT_2s (const struct CadetTunnel *t)
	Get the static string for the peer this tunnel is directed.
static const char *	estate2s (enum CadetTunnelEState es)
	Get string description for tunnel encryption state.
struct CadetPeer *	GCT_get_destination (struct CadetTunnel *t)
	Return the peer to which this tunnel goes.
unsigned int	GCT_count_channels (struct CadetTunnel *t)
	Returns the number of channels using a tunnel.
static struct CadetChannel *	lookup_channel (struct CadetTunnel *t, struct GNUNET_CADET_ChannelTunnelNumber ctn)
	Lookup a channel by its ctn.
unsigned int	GCT_count_any_connections (const struct CadetTunnel *t)
	Counts the number of connections created for a tunnel, including busy connections.
static struct CadetTConnection *	get_ready_connection (struct CadetTunnel *t)
	Find first connection that is ready in the list of our connections.
enum CadetTunnelEState	GCT_get_estate (struct CadetTunnel *t)
	Get the encryption state of a tunnel.
static void	trigger_transmissions (void *cls)
	Called when either we have a new connection, or a new message in the queue, or some existing connection has transmission capacity.
static void	new_ephemeral (struct CadetTunnelAxolotl *ax)
	Create a new Axolotl ephemeral (ratchet) key.
static void	t_hmac (const void *plaintext, size_t size, uint32_t iv, const struct GNUNET_CRYPTO_SymmetricSessionKey *key, struct GNUNET_ShortHashCode *hmac)
	Calculate HMAC.
static void	t_ax_hmac_hash (const struct GNUNET_CRYPTO_SymmetricSessionKey *key, struct GNUNET_HashCode *hash, const void *source, unsigned int len)
	Perform a HMAC.
static void	t_hmac_derive_key (const struct GNUNET_CRYPTO_SymmetricSessionKey *key, struct GNUNET_CRYPTO_SymmetricSessionKey *out, const void *source, unsigned int len)
	Derive a symmetric encryption key from an HMAC-HASH.
static void	t_ax_encrypt (struct CadetTunnelAxolotl *ax, void *dst, const void *src, size_t size)
	Encrypt data with the axolotl tunnel key.
static void	t_ax_decrypt (struct CadetTunnelAxolotl *ax, void *dst, const void *src, size_t size)
	Decrypt data with the axolotl tunnel key.
static void	t_h_encrypt (struct CadetTunnelAxolotl *ax, struct GNUNET_CADET_TunnelEncryptedMessage *msg)
	Encrypt header with the axolotl header key.
static void	t_h_decrypt (struct CadetTunnelAxolotl *ax, const struct GNUNET_CADET_TunnelEncryptedMessage *src, struct GNUNET_CADET_TunnelEncryptedMessage *dst)
	Decrypt header with the current axolotl header key.
static void	delete_skipped_key (struct CadetTunnelAxolotl *ax, struct CadetTunnelSkippedKey *key)
	Delete a key from the list of skipped keys.
static ssize_t	try_old_ax_keys (struct CadetTunnelAxolotl *ax, void *dst, const struct GNUNET_CADET_TunnelEncryptedMessage *src, size_t size)
	Decrypt and verify data with the appropriate tunnel key and verify that the data has not been altered since it was sent by the remote peer.
static void	store_skipped_key (struct CadetTunnelAxolotl *ax, const struct GNUNET_CRYPTO_SymmetricSessionKey *HKr)
	Delete a key from the list of skipped keys.
static int	store_ax_keys (struct CadetTunnelAxolotl *ax, const struct GNUNET_CRYPTO_SymmetricSessionKey *HKr, uint32_t Np)
	Stage skipped AX keys and calculate the message key.
static ssize_t	t_ax_decrypt_and_validate (struct CadetTunnelAxolotl *ax, void *dst, const struct GNUNET_CADET_TunnelEncryptedMessage *src, size_t size)
	Decrypt and verify data with the appropriate tunnel key and verify that the data has not been altered since it was sent by the remote peer.
static int	notify_tunnel_up_cb (void *cls, uint32_t key, void *value)
	Our tunnel became ready for the first time, notify channels that have been waiting.
void	GCT_change_estate (struct CadetTunnel *t, enum CadetTunnelEState state)
	Change the tunnel encryption state.
static void	send_kx (struct CadetTunnel *t, struct CadetTConnection *ct, struct CadetTunnelAxolotl *ax)
	Send a KX message.
static void	send_kx_auth (struct CadetTunnel *t, struct CadetTConnection *ct, struct CadetTunnelAxolotl *ax, int force_reply)
	Send a KX_AUTH message.
static void	cleanup_ax (struct CadetTunnelAxolotl *ax)
	Cleanup state used by ax.
static void	update_ax_by_kx (void *cls, const struct GNUNET_HashCode *key_result)
	Update our Axolotl key state based on the KX data we received.
static void	retry_kx (void *cls)
	Try to redo the KX or KX_AUTH handshake, if we can.
static void	cont_GCT_handle_kx (void *cls, enum GNUNET_GenericReturnValue ret)
	Continue to handle KX message.
void	GCT_handle_kx (struct CadetTConnection *ct, const struct GNUNET_CADET_TunnelKeyExchangeMessage *msg)
	Continue to handle KX message.
static void	cont_GCT_handle_kx_auth (void *cls, enum GNUNET_GenericReturnValue ret)
	Continue to handle KX_AUTH message.
void	GCT_handle_kx_auth (struct CadetTConnection *ct, const struct GNUNET_CADET_TunnelKeyExchangeAuthMessage *msg)
	Handle KX_AUTH message.
static struct GNUNET_CADET_ChannelTunnelNumber	get_next_free_ctn (struct CadetTunnel *t)
	Compute the next free channel tunnel number for this tunnel.
struct GNUNET_CADET_ChannelTunnelNumber	GCT_add_channel (struct CadetTunnel *t, struct CadetChannel *ch)
	Add a channel to a tunnel, and notify channel that we are ready for transmission if we are already up.
void	GCT_connection_lost (struct CadetTConnection *ct)
	We lost a connection, remove it from our list and clean up the connection object itself.
static void	destroy_t_connection (void *cls, struct CadetTConnection *ct)
	Clean up connection ct of a tunnel.
static void	destroy_tunnel (void *cls)
	This tunnel is no longer used, destroy it.
void	GCT_remove_channel (struct CadetTunnel *t, struct CadetChannel *ch, struct GNUNET_CADET_ChannelTunnelNumber ctn)
	Remove a channel from a tunnel.
static int	destroy_remaining_channels (void *cls, uint32_t key, void *value)
	Destroy remaining channels during shutdown.
void	GCT_destroy_tunnel_now (struct CadetTunnel *t)
	Destroys the tunnel t now, without delay.
static void	try_send_normal_payload (struct CadetTunnel *t, struct CadetTConnection *ct)
	Send normal payload from queue in t via connection ct.
static void	connection_ready_cb (void *cls, int is_ready)
	A connection is is_ready for transmission.
static void	evaluate_connection (void *cls, struct CadetTConnection *ct)
	Evaluate a connection, updating our summary information in cls about what kinds of connections we have.
static int	consider_path_cb (void *cls, struct CadetPeerPath *path, unsigned int off)
	Consider using the path p for the tunnel t.
static void	maintain_connections_cb (void *cls)
	Function called to maintain the connections underlying our tunnel.
void	GCT_consider_path (struct CadetTunnel *t, struct CadetPeerPath *p, unsigned int off)
	Consider using the path p for the tunnel t.
static void	handle_plaintext_keepalive (void *cls, const struct GNUNET_MessageHeader *msg)
	We got a keepalive.
static int	check_plaintext_data (void *cls, const struct GNUNET_CADET_ChannelAppDataMessage *msg)
	Check that msg is well-formed.
static void	handle_plaintext_data (void *cls, const struct GNUNET_CADET_ChannelAppDataMessage *msg)
	We received payload data for a channel.
static void	handle_plaintext_data_ack (void *cls, const struct GNUNET_CADET_ChannelDataAckMessage *ack)
	We received an acknowledgement for data we sent on a channel.
static void	handle_plaintext_channel_open (void *cls, const struct GNUNET_CADET_ChannelOpenMessage *copen)
	We have received a request to open a channel to a port from another peer.
void	GCT_send_channel_destroy (struct CadetTunnel *t, struct GNUNET_CADET_ChannelTunnelNumber ctn)
	Send a DESTROY message via the tunnel.
static void	handle_plaintext_channel_open_ack (void *cls, const struct GNUNET_CADET_ChannelOpenAckMessage *cm)
	We have received confirmation from the target peer that the given channel could be established (the port is open).
static void	handle_plaintext_channel_destroy (void *cls, const struct GNUNET_CADET_ChannelDestroyMessage *cm)
	We received a message saying that a channel should be destroyed.
static int	handle_decrypted (void *cls, const struct GNUNET_MessageHeader *msg)
	Handles a message we decrypted, by injecting it into our message queue (which will do the dispatching).
static void	decrypted_error_cb (void *cls, enum GNUNET_MQ_Error error)
	Function called if we had an error processing an incoming decrypted message.
struct CadetTunnel *	GCT_create_tunnel (struct CadetPeer *destination)
	Create a tunnel to destination.
int	GCT_add_inbound_connection (struct CadetTunnel *t, const struct GNUNET_CADET_ConnectionTunnelIdentifier *cid, struct CadetPeerPath *path)
	Add a connection to the tunnel.
void	GCT_handle_encrypted (struct CadetTConnection *ct, const struct GNUNET_CADET_TunnelEncryptedMessage *msg)
	Handle encrypted message.
struct CadetTunnelQueueEntry *	GCT_send (struct CadetTunnel *t, const struct GNUNET_MessageHeader *message, GCT_SendContinuation cont, void *cont_cls, struct GNUNET_CADET_ChannelTunnelNumber *ctn)
	Sends an already built message on a tunnel, encrypting it and choosing the best connection if not provided.
void	GCT_send_cancel (struct CadetTunnelQueueEntry *tq)
	Cancel a previously sent message while it's in the queue.
void	GCT_iterate_connections (struct CadetTunnel *t, GCT_ConnectionIterator iter, void *iter_cls)
	Iterate over all connections of a tunnel.
static int	iterate_channels_cb (void *cls, uint32_t key, void *value)
	Helper function for GCT_iterate_channels.
void	GCT_iterate_channels (struct CadetTunnel *t, GCT_ChannelIterator iter, void *iter_cls)
	Iterate over all channels of a tunnel.
static int	debug_channel (void *cls, uint32_t key, void *value)
	Call GCCH_debug() on a channel.
void	GCT_debug (const struct CadetTunnel *t, enum GNUNET_ErrorType level)
	Log all possible info about the tunnel state.

Detailed Description

Information we track per tunnel.

Author

Bartlomiej Polot

Christian Grothoff

FIXME:

• proper connection evaluation during connection management:
  • consider quality (or quality spread?) of current connection set when deciding how often to do maintenance
  • interact with PEER to drive DHT GET/PUT operations based on how much we like our connections

Definition in file gnunet-service-cadet_tunnels.c.

Macro Definition Documentation

LOG

#define LOG	(		level,
			...
	)		GNUNET_log_from (level, "cadet-tun", __VA_ARGS__)

Definition at line 47 of file gnunet-service-cadet_tunnels.c.

MAX_UNVERIFIED_ATTEMPTS

#define MAX_UNVERIFIED_ATTEMPTS   16

How often do we try to decrypt payload with unverified key material? Used to limit CPU increase upon receiving bogus KX.

Definition at line 54 of file gnunet-service-cadet_tunnels.c.

IDLE_DESTROY_DELAY

#define IDLE_DESTROY_DELAY

Value:

          GNUNET_TIME_relative_multiply ( \
          GNUNET_TIME_UNIT_SECONDS, 90)

How long do we wait until tearing down an idle tunnel?

Definition at line 59 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnelSkippedKey *next;
 
  struct CadetTunnelSkippedKey *prev;
 
  struct GNUNET_TIME_Absolute timestamp;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey HK;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey MK;
 
  unsigned int Kn;
};
 
 
struct CadetTunnelAxolotl
{
  struct CadetTunnelSkippedKey *skipped_head;
 
  struct CadetTunnelSkippedKey *skipped_tail;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey RK;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey HKs;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey HKr;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey NHKs;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey NHKr;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey CKs;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey CKr;
 
  struct GNUNET_CRYPTO_EcdhePrivateKey kx_0;
 
  struct GNUNET_CRYPTO_EcdhePrivateKey DHRs;
 
  struct GNUNET_CRYPTO_EcdhePublicKey DHRr;
 
  struct GNUNET_CRYPTO_EcdhePublicKey last_ephemeral;
 
  struct GNUNET_TIME_Absolute ratchet_expiration;
 
  unsigned int skipped;
 
  uint32_t Ns;
 
  uint32_t Nr;
 
  uint32_t PNs;
 
  int ratchet_flag;
 
  int ratchet_allowed;
 
  unsigned int ratchet_counter;
};
 
 
typedef void
(*CadetTunnelAxolotlCallback) (void *cls,
                               enum GNUNET_GenericReturnValue res);
 
 
struct CadetTunnelAsync
{
  struct CadetTunnelAxolotl ax;
 
  struct GNUNET_PeerIdentity peer_id;
 
  struct GNUNET_CRYPTO_EcdhePublicKey ephemeral_key;
 
  struct GNUNET_CRYPTO_EcdhePublicKey ratchet_key;
 
  struct GNUNET_HashCode auth;
 
  uint32_t flags;
 
  struct GNUNET_PILS_Operation *ecdh_op;
 
  void *cb_cls;
 
  CadetTunnelAxolotlCallback cb;
};
 
 
struct CadetTunnelQueueEntry
{
  struct CadetTunnelQueueEntry *next;
 
  struct CadetTunnelQueueEntry *prev;
 
  struct CadetTunnel *t;
 
  GCT_SendContinuation cont;
 
  void *cont_cls;
 
  struct GNUNET_MQ_Envelope *env;
 
  struct GNUNET_CADET_ConnectionTunnelIdentifier *cid;
};
 
 
struct CadetTunnel
{
  struct CadetPeer *destination;
 
  struct GNUNET_CRYPTO_EcdhePublicKey peers_ephemeral_key;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey e_key;
 
  struct GNUNET_CRYPTO_SymmetricSessionKey d_key;
 
  struct CadetTunnelAxolotl ax;
 
  struct CadetTunnelAxolotl *unverified_ax;
 
  struct CadetTunnelAsync as;
 
  struct GNUNET_SCHEDULER_Task *destroy_task;
 
  struct GNUNET_SCHEDULER_Task *maintain_connections_task;
 
  struct GNUNET_SCHEDULER_Task *send_task;
 
  struct GNUNET_SCHEDULER_Task *kx_task;
 
  struct GNUNET_MessageStreamTokenizer *mst;
 
  struct GNUNET_MQ_Handle *mq;
 
  struct CadetTConnection *connection_ready_head;
 
  struct CadetTConnection *connection_ready_tail;
 
  struct CadetTConnection *connection_busy_head;
 
  struct CadetTConnection *connection_busy_tail;
 
  struct GNUNET_CONTAINER_MultiHashMap32 *channels;
 
  struct GNUNET_CADET_ChannelTunnelNumber next_ctn;
 
  struct CadetTunnelQueueEntry *tq_head;
 
  struct CadetTunnelQueueEntry *tq_tail;
 
  struct CadetTConnection *current_ct;
 
  struct GNUNET_TIME_Relative kx_retry_delay;
 
  struct GNUNET_TIME_Absolute next_kx_attempt;
 
  unsigned int num_ready_connections;
 
  unsigned int num_busy_connections;
 
  unsigned int unverified_attempts;
 
  unsigned int tq_len;
 
  enum CadetTunnelEState estate;
 
  int kx_auth_requested;
};
 
 
int
GCT_alice_or_betty (const struct GNUNET_PeerIdentity *other)
{
  const struct GNUNET_PeerIdentity *my_identity;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  if (0 > GNUNET_memcmp (my_identity, other))
    return GNUNET_YES;
  else if (0 < GNUNET_memcmp (my_identity, other))
    return GNUNET_NO;
  else
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
}
 
 
static void
mark_connection_unready (struct CadetTConnection *ct)
{
  struct CadetTunnel *t = ct->t;
 
  GNUNET_assert (GNUNET_YES == ct->is_ready);
  GNUNET_CONTAINER_DLL_remove (t->connection_ready_head,
                               t->connection_ready_tail,
                               ct);
  GNUNET_assert (0 < t->num_ready_connections);
  t->num_ready_connections--;
  ct->is_ready = GNUNET_NO;
  GNUNET_CONTAINER_DLL_insert (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  t->num_busy_connections++;
}
 
 
const char *
GCT_2s (const struct CadetTunnel *t)
{
  static char buf[64];
 
  if (NULL == t)
    return "Tunnel(NULL)";
  GNUNET_snprintf (buf,
                   sizeof(buf),
                   "Tunnel %s",
                   GNUNET_i2s (GCP_get_id (t->destination)));
  return buf;
}
 
 
static const char *
estate2s (enum CadetTunnelEState es)
{
  static char buf[32];
 
  switch (es)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
    return "CADET_TUNNEL_KEY_UNINITIALIZED";
  case CADET_TUNNEL_KEY_AX_RECV:
    return "CADET_TUNNEL_KEY_AX_RECV";
  case CADET_TUNNEL_KEY_AX_SENT:
    return "CADET_TUNNEL_KEY_AX_SENT";
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    return "CADET_TUNNEL_KEY_AX_SENT_AND_RECV";
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    return "CADET_TUNNEL_KEY_AX_AUTH_SENT";
  case CADET_TUNNEL_KEY_OK:
    return "CADET_TUNNEL_KEY_OK";
  }
  GNUNET_snprintf (buf,
                   sizeof(buf),
                   "%u (UNKNOWN STATE)",
                   es);
  return buf;
}
 
 
struct CadetPeer *
GCT_get_destination (struct CadetTunnel *t)
{
  return t->destination;
}
 
 
unsigned int
GCT_count_channels (struct CadetTunnel *t)
{
  return GNUNET_CONTAINER_multihashmap32_size (t->channels);
}
 
 
static struct CadetChannel *
lookup_channel (struct CadetTunnel *t,
                struct GNUNET_CADET_ChannelTunnelNumber ctn)
{
  return GNUNET_CONTAINER_multihashmap32_get (t->channels,
                                              ntohl (ctn.cn));
}
 
 
unsigned int
GCT_count_any_connections (const struct CadetTunnel *t)
{
  return t->num_ready_connections + t->num_busy_connections;
}
 
 
static struct CadetTConnection *
get_ready_connection (struct CadetTunnel *t)
{
  struct CadetTConnection *hd = t->connection_ready_head;
 
  GNUNET_assert ((NULL == hd) ||
                 (GNUNET_YES == hd->is_ready));
  return hd;
}
 
 
enum CadetTunnelEState
GCT_get_estate (struct CadetTunnel *t)
{
  return t->estate;
}
 
 
static void
trigger_transmissions (void *cls);
 
 
/* ************************************** start core crypto ***************************** */
 
 
static void
new_ephemeral (struct CadetTunnelAxolotl *ax)
{
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Creating new ephemeral ratchet key (DHRs)\n");
  GNUNET_CRYPTO_ecdhe_key_create (&ax->DHRs);
}
 
 
static void
t_hmac (const void *plaintext,
        size_t size,
        uint32_t iv,
        const struct GNUNET_CRYPTO_SymmetricSessionKey *key,
        struct GNUNET_ShortHashCode *hmac)
{
  static const char ctx[] = "cadet authentication key";
  struct GNUNET_CRYPTO_AuthKey auth_key;
  struct GNUNET_HashCode hash;
 
  // FIXME now that we directly invoke HKDF instead of a
  // thin wrapper we can clearly see the sillyness of adding
  // the key parameter twice...
  GNUNET_CRYPTO_hkdf_gnunet (
    &auth_key,
    sizeof auth_key,
    &iv,
    sizeof(iv),
    key,
    sizeof(*key),
    GNUNET_CRYPTO_kdf_arg_auto (key),
    GNUNET_CRYPTO_kdf_arg_string (ctx));
  /* Two step: GNUNET_ShortHash is only 256 bits,
     GNUNET_HashCode is 512, so we truncate. */
  GNUNET_CRYPTO_hmac (&auth_key,
                      plaintext,
                      size,
                      &hash);
  GNUNET_memcpy (hmac,
                 &hash,
                 sizeof(*hmac));
}
 
 
static void
t_ax_hmac_hash (const struct GNUNET_CRYPTO_SymmetricSessionKey *key,
                struct GNUNET_HashCode *hash,
                const void *source,
                unsigned int len)
{
  static const char ctx[] = "axolotl HMAC-HASH";
  struct GNUNET_CRYPTO_AuthKey auth_key;
 
  GNUNET_CRYPTO_hkdf_gnunet (
    &auth_key,
    sizeof auth_key,
    ctx,
    sizeof(ctx),
    key,
    sizeof *key);
  GNUNET_CRYPTO_hmac (&auth_key,
                      source,
                      len,
                      hash);
}
 
 
static void
t_hmac_derive_key (const struct GNUNET_CRYPTO_SymmetricSessionKey *key,
                   struct GNUNET_CRYPTO_SymmetricSessionKey *out,
                   const void *source,
                   unsigned int len)
{
  static const char ctx[] = "axolotl derive key";
  struct GNUNET_HashCode h;
 
  t_ax_hmac_hash (key,
                  &h,
                  source,
                  len);
  GNUNET_CRYPTO_hkdf_gnunet (
    out, sizeof(*out),
    ctx, sizeof(ctx),
    &h, sizeof(h));
}
 
 
static void
t_ax_encrypt (struct CadetTunnelAxolotl *ax,
              void *dst,
              const void *src,
              size_t size)
{
  struct GNUNET_CRYPTO_SymmetricSessionKey MK;
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  size_t out_size;
 
  ax->ratchet_counter++;
  if ((GNUNET_YES == ax->ratchet_allowed) &&
      ((ratchet_messages <= ax->ratchet_counter) ||
       (0 == GNUNET_TIME_absolute_get_remaining (
          ax->ratchet_expiration).rel_value_us)))
  {
    ax->ratchet_flag = GNUNET_YES;
  }
  if (GNUNET_YES == ax->ratchet_flag)
  {
    /* Advance ratchet */
    struct GNUNET_CRYPTO_SymmetricSessionKey keys[3];
    struct GNUNET_HashCode dh;
    struct GNUNET_HashCode hmac;
    static const char ctx[] = "axolotl ratchet";
 
    new_ephemeral (ax);
    ax->HKs = ax->NHKs;
 
    /* RK, NHKs, CKs = KDF( HMAC-HASH(RK, DH(DHRs, DHRr)) ) */
    GNUNET_CRYPTO_ecc_ecdh (&ax->DHRs,
                            &ax->DHRr,
                            &dh);
    t_ax_hmac_hash (&ax->RK,
                    &hmac,
                    &dh,
                    sizeof(dh));
    GNUNET_CRYPTO_hkdf_gnunet (
      keys, sizeof(keys),
      ctx, sizeof(ctx),
      &hmac, sizeof(hmac));
    ax->RK = keys[0];
    ax->NHKs = keys[1];
    ax->CKs = keys[2];
 
    ax->PNs = ax->Ns;
    ax->Ns = 0;
    ax->ratchet_flag = GNUNET_NO;
    ax->ratchet_allowed = GNUNET_NO;
    ax->ratchet_counter = 0;
    ax->ratchet_expiration
      = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (),
                                  ratchet_time);
  }
 
  t_hmac_derive_key (&ax->CKs,
                     &MK,
                     "0",
                     1);
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &MK,
                             sizeof MK);
 
  out_size = GNUNET_CRYPTO_symmetric_encrypt (src,
                                              size,
                                              &MK,
                                              &iv,
                                              dst);
  GNUNET_assert (size == out_size);
  t_hmac_derive_key (&ax->CKs,
                     &ax->CKs,
                     "1",
                     1);
}
 
 
static void
t_ax_decrypt (struct CadetTunnelAxolotl *ax,
              void *dst,
              const void *src,
              size_t size)
{
  struct GNUNET_CRYPTO_SymmetricSessionKey MK;
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  size_t out_size;
 
  t_hmac_derive_key (&ax->CKr,
                     &MK,
                     "0",
                     1);
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &MK,
                             sizeof MK);
  GNUNET_assert (size >= sizeof(struct GNUNET_MessageHeader));
  out_size = GNUNET_CRYPTO_symmetric_decrypt (src,
                                              size,
                                              &MK,
                                              &iv,
                                              dst);
  GNUNET_assert (out_size == size);
  t_hmac_derive_key (&ax->CKr,
                     &ax->CKr,
                     "1",
                     1);
}
 
 
static void
t_h_encrypt (struct CadetTunnelAxolotl *ax,
             struct GNUNET_CADET_TunnelEncryptedMessage *msg)
{
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  size_t out_size;
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &ax->HKs,
                             sizeof ax->HKs);
  out_size = GNUNET_CRYPTO_symmetric_encrypt (&msg->ax_header,
                                              sizeof(struct
                                                     GNUNET_CADET_AxHeader),
                                              &ax->HKs,
                                              &iv,
                                              &msg->ax_header);
  GNUNET_assert (sizeof(struct GNUNET_CADET_AxHeader) == out_size);
}
 
 
static void
t_h_decrypt (struct CadetTunnelAxolotl *ax,
             const struct GNUNET_CADET_TunnelEncryptedMessage *src,
             struct GNUNET_CADET_TunnelEncryptedMessage *dst)
{
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  size_t out_size;
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &ax->HKr,
                             sizeof ax->HKr);
 
 
  out_size = GNUNET_CRYPTO_symmetric_decrypt (&src->ax_header.Ns,
                                              sizeof(struct
                                                     GNUNET_CADET_AxHeader),
                                              &ax->HKr,
                                              &iv,
                                              &dst->ax_header.Ns);
  GNUNET_assert (sizeof(struct GNUNET_CADET_AxHeader) == out_size);
}
 
 
static void
delete_skipped_key (struct CadetTunnelAxolotl *ax,
                    struct CadetTunnelSkippedKey *key)
{
  GNUNET_CONTAINER_DLL_remove (ax->skipped_head,
                               ax->skipped_tail,
                               key);
  GNUNET_free (key);
  ax->skipped--;
}
 
 
static ssize_t
try_old_ax_keys (struct CadetTunnelAxolotl *ax,
                 void *dst,
                 const struct GNUNET_CADET_TunnelEncryptedMessage *src,
                 size_t size)
{
  struct CadetTunnelSkippedKey *key;
  struct GNUNET_ShortHashCode *hmac;
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  struct GNUNET_CADET_TunnelEncryptedMessage plaintext_header;
  struct GNUNET_CRYPTO_SymmetricSessionKey *valid_HK;
  size_t esize;
  size_t res;
  size_t len;
  unsigned int N;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Trying skipped keys\n");
  hmac = &plaintext_header.hmac;
  esize = size - sizeof(struct GNUNET_CADET_TunnelEncryptedMessage);
 
  /* Find a correct Header Key */
  valid_HK = NULL;
  for (key = ax->skipped_head; NULL != key; key = key->next)
  {
    t_hmac (&src->ax_header,
            sizeof(struct GNUNET_CADET_AxHeader) + esize,
            0,
            &key->HK,
            hmac);
    if (0 == GNUNET_memcmp (hmac,
                            &src->hmac))
    {
      valid_HK = &key->HK;
      break;
    }
  }
  if (NULL == key)
    return -1;
 
  /* Should've been checked in -cadet_connection.c handle_cadet_encrypted. */
  GNUNET_assert (size > sizeof(struct GNUNET_CADET_TunnelEncryptedMessage));
  len = size - sizeof(struct GNUNET_CADET_TunnelEncryptedMessage);
  GNUNET_assert (len >= sizeof(struct GNUNET_MessageHeader));
 
  /* Decrypt header */
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &key->HK,
                             sizeof key->HK);
 
  res = GNUNET_CRYPTO_symmetric_decrypt (&src->ax_header.Ns,
                                         sizeof(struct GNUNET_CADET_AxHeader),
                                         &key->HK,
                                         &iv,
                                         &plaintext_header.ax_header.Ns);
  GNUNET_assert (sizeof(struct GNUNET_CADET_AxHeader) == res);
 
  /* Find the correct message key */
  N = ntohl (plaintext_header.ax_header.Ns);
  while ((NULL != key) &&
         (N != key->Kn))
    key = key->next;
  if ((NULL == key) ||
      (0 != GNUNET_memcmp (&key->HK,
                           valid_HK)))
    return -1;
 
  /* Decrypt payload */
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &key->MK,
                             sizeof key->MK);
 
  res = GNUNET_CRYPTO_symmetric_decrypt (&src[1],
                                         len,
                                         &key->MK,
                                         &iv,
                                         dst);
  delete_skipped_key (ax,
                      key);
  return res;
}
 
 
static void
store_skipped_key (struct CadetTunnelAxolotl *ax,
                   const struct GNUNET_CRYPTO_SymmetricSessionKey *HKr)
{
  struct CadetTunnelSkippedKey *key;
 
  key = GNUNET_new (struct CadetTunnelSkippedKey);
  key->timestamp = GNUNET_TIME_absolute_get ();
  key->Kn = ax->Nr;
  key->HK = ax->HKr;
  t_hmac_derive_key (&ax->CKr,
                     &key->MK,
                     "0",
                     1);
  t_hmac_derive_key (&ax->CKr,
                     &ax->CKr,
                     "1",
                     1);
  GNUNET_CONTAINER_DLL_insert (ax->skipped_head,
                               ax->skipped_tail,
                               key);
  ax->skipped++;
  ax->Nr++;
}
 
 
static int
store_ax_keys (struct CadetTunnelAxolotl *ax,
               const struct GNUNET_CRYPTO_SymmetricSessionKey *HKr,
               uint32_t Np)
{
  int gap;
 
  gap = Np - ax->Nr;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Storing skipped keys [%u, %u)\n",
       ax->Nr,
       Np);
  if (MAX_KEY_GAP < gap)
  {
    /* Avoid DoS (forcing peer to do more than #MAX_KEY_GAP HMAC operations) */
    /* TODO: start new key exchange on return */
    GNUNET_break_op (0);
    LOG (GNUNET_ERROR_TYPE_WARNING,
         "Got message %u, expected %u+\n",
         Np,
         ax->Nr);
    return GNUNET_SYSERR;
  }
  if (0 > gap)
  {
    /* Delayed message: don't store keys, flag to try old keys. */
    return GNUNET_SYSERR;
  }
 
  while (ax->Nr < Np)
    store_skipped_key (ax,
                       HKr);
 
  while (ax->skipped > MAX_SKIPPED_KEYS)
    delete_skipped_key (ax,
                        ax->skipped_tail);
  return GNUNET_OK;
}
 
 
static ssize_t
t_ax_decrypt_and_validate (struct CadetTunnelAxolotl *ax,
                           void *dst,
                           const struct
                           GNUNET_CADET_TunnelEncryptedMessage *src,
                           size_t size)
{
  struct GNUNET_ShortHashCode msg_hmac;
  struct GNUNET_HashCode hmac;
  struct GNUNET_CADET_TunnelEncryptedMessage plaintext_header;
  uint32_t Np;
  uint32_t PNp;
  size_t esize; /* Size of encrypted payload */
 
  esize = size - sizeof(struct GNUNET_CADET_TunnelEncryptedMessage);
 
  /* Try current HK */
  t_hmac (&src->ax_header,
          sizeof(struct GNUNET_CADET_AxHeader) + esize,
          0, &ax->HKr,
          &msg_hmac);
  if (0 != GNUNET_memcmp (&msg_hmac,
                          &src->hmac))
  {
    static const char ctx[] = "axolotl ratchet";
    struct GNUNET_CRYPTO_SymmetricSessionKey keys[3];   /* RKp, NHKp, CKp */
    struct GNUNET_CRYPTO_SymmetricSessionKey HK;
    struct GNUNET_HashCode dh;
    struct GNUNET_CRYPTO_EcdhePublicKey *DHRp;
 
    /* Try Next HK */
    t_hmac (&src->ax_header,
            sizeof(struct GNUNET_CADET_AxHeader) + esize,
            0,
            &ax->NHKr,
            &msg_hmac);
    if (0 != GNUNET_memcmp (&msg_hmac,
                            &src->hmac))
    {
      /* Try the skipped keys, if that fails, we're out of luck. */
      return try_old_ax_keys (ax,
                              dst,
                              src,
                              size);
    }
    HK = ax->HKr;
    ax->HKr = ax->NHKr;
    t_h_decrypt (ax,
                 src,
                 &plaintext_header);
    Np = ntohl (plaintext_header.ax_header.Ns);
    PNp = ntohl (plaintext_header.ax_header.PNs);
    DHRp = &plaintext_header.ax_header.DHRs;
    store_ax_keys (ax,
                   &HK,
                   PNp);
 
    /* RKp, NHKp, CKp = KDF (HMAC-HASH (RK, DH (DHRp, DHRs))) */
    GNUNET_CRYPTO_ecc_ecdh (&ax->DHRs,
                            DHRp,
                            &dh);
    t_ax_hmac_hash (&ax->RK,
                    &hmac,
                    &dh, sizeof(dh));
    GNUNET_CRYPTO_hkdf_gnunet (
      keys, sizeof(keys),
      ctx, sizeof(ctx),
      &hmac, sizeof(hmac));
 
    /* Commit "purported" keys */
    ax->RK = keys[0];
    ax->NHKr = keys[1];
    ax->CKr = keys[2];
    ax->DHRr = *DHRp;
    ax->Nr = 0;
    ax->ratchet_allowed = GNUNET_YES;
  }
  else
  {
    t_h_decrypt (ax,
                 src,
                 &plaintext_header);
    Np = ntohl (plaintext_header.ax_header.Ns);
    PNp = ntohl (plaintext_header.ax_header.PNs);
  }
  if ((Np != ax->Nr) &&
      (GNUNET_OK != store_ax_keys (ax,
                                   &ax->HKr,
                                   Np)))
  {
    /* Try the skipped keys, if that fails, we're out of luck. */
    return try_old_ax_keys (ax,
                            dst,
                            src,
                            size);
  }
 
  t_ax_decrypt (ax,
                dst,
                &src[1],
                esize);
  ax->Nr = Np + 1;
  return esize;
}
 
 
static int
notify_tunnel_up_cb (void *cls,
                     uint32_t key,
                     void *value)
{
  struct CadetChannel *ch = value;
 
  GCCH_tunnel_up (ch);
  return GNUNET_OK;
}
 
 
void
GCT_change_estate (struct CadetTunnel *t,
                   enum CadetTunnelEState state)
{
  enum CadetTunnelEState old = t->estate;
 
  t->estate = state;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s estate changed from %s to %s\n",
       GCT_2s (t),
       estate2s (old),
       estate2s (state));
 
  if ((CADET_TUNNEL_KEY_OK != old) &&
      (CADET_TUNNEL_KEY_OK == t->estate))
  {
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    /* notify all channels that have been waiting */
    GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                             &notify_tunnel_up_cb,
                                             t);
    if (NULL != t->send_task)
      GNUNET_SCHEDULER_cancel (t->send_task);
    t->send_task = GNUNET_SCHEDULER_add_now (&trigger_transmissions,
                                             t);
  }
}
 
 
static void
send_kx (struct CadetTunnel *t,
         struct CadetTConnection *ct,
         struct CadetTunnelAxolotl *ax)
{
  struct CadetConnection *cc;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CADET_TunnelKeyExchangeMessage *msg;
  enum GNUNET_CADET_KX_Flags flags;
 
  if (GNUNET_YES != GCT_alice_or_betty (GCP_get_id (t->destination)))
    return; /* only Alice may send KX */
  if ((NULL == ct) ||
      (GNUNET_NO == ct->is_ready))
    ct = get_ready_connection (t);
  if (NULL == ct)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Wanted to send %s in state %s, but no connection is ready, deferring\n",
         GCT_2s (t),
         estate2s (t->estate));
    t->next_kx_attempt = GNUNET_TIME_absolute_get ();
    return;
  }
  cc = ct->cc;
  env = GNUNET_MQ_msg (msg,
                       GNUNET_MESSAGE_TYPE_CADET_TUNNEL_KX);
  flags = GNUNET_CADET_KX_FLAG_FORCE_REPLY; /* always for KX */
  msg->flags = htonl (flags);
  msg->cid = *GCC_get_id (cc);
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->kx_0,
                                      &msg->ephemeral_key);
#if DEBUG_KX
  msg->ephemeral_key_XXX = ax->kx_0;
#endif
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending KX message to %s with ephemeral %s on CID %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->ephemeral_key),
       GNUNET_sh2s (&msg->cid.connection_of_tunnel));
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->DHRs,
                                      &msg->ratchet_key);
  mark_connection_unready (ct);
  t->kx_retry_delay = GNUNET_TIME_STD_BACKOFF (t->kx_retry_delay);
  t->next_kx_attempt = GNUNET_TIME_relative_to_absolute (t->kx_retry_delay);
  if (CADET_TUNNEL_KEY_UNINITIALIZED == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_SENT);
  else if (CADET_TUNNEL_KEY_AX_RECV == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_SENT_AND_RECV);
  GCC_transmit (cc,
                env);
  GNUNET_STATISTICS_update (stats,
                            "# KX transmitted",
                            1,
                            GNUNET_NO);
}
 
 
static void
send_kx_auth (struct CadetTunnel *t,
              struct CadetTConnection *ct,
              struct CadetTunnelAxolotl *ax,
              int force_reply)
{
  struct CadetConnection *cc;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CADET_TunnelKeyExchangeAuthMessage *msg;
  enum GNUNET_CADET_KX_Flags flags;
 
  if ((NULL == ct) ||
      (GNUNET_NO == ct->is_ready))
    ct = get_ready_connection (t);
  if (NULL == ct)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Wanted to send KX_AUTH on %s, but no connection is ready, deferring\n",
         GCT_2s (t));
    t->next_kx_attempt = GNUNET_TIME_absolute_get ();
    t->kx_auth_requested = GNUNET_YES;   /* queue KX_AUTH independent of estate */
    return;
  }
  t->kx_auth_requested = GNUNET_NO; /* clear flag */
  cc = ct->cc;
  env = GNUNET_MQ_msg (msg,
                       GNUNET_MESSAGE_TYPE_CADET_TUNNEL_KX_AUTH);
  flags = GNUNET_CADET_KX_FLAG_NONE;
  if (GNUNET_YES == force_reply)
    flags |= GNUNET_CADET_KX_FLAG_FORCE_REPLY;
  msg->kx.flags = htonl (flags);
  msg->kx.cid = *GCC_get_id (cc);
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->kx_0,
                                      &msg->kx.ephemeral_key);
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->DHRs,
                                      &msg->kx.ratchet_key);
#if DEBUG_KX
  msg->kx.ephemeral_key_XXX = ax->kx_0;
  msg->r_ephemeral_key_XXX = ax->last_ephemeral;
#endif
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending KX_AUTH message to %s with ephemeral %s on CID %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->kx.ephemeral_key),
       GNUNET_sh2s (&msg->kx.cid.connection_of_tunnel));
 
  /* Compute authenticator (this is the main difference to #send_kx()) */
  GNUNET_CRYPTO_hash (&ax->RK,
                      sizeof(ax->RK),
                      &msg->auth);
  /* Compute when to be triggered again; actual job will
     be scheduled via #connection_ready_cb() */
  t->kx_retry_delay
    = GNUNET_TIME_STD_BACKOFF (t->kx_retry_delay);
  t->next_kx_attempt
    = GNUNET_TIME_relative_to_absolute (t->kx_retry_delay);
 
  /* Send via cc, mark it as unready */
  mark_connection_unready (ct);
 
  /* Update state machine, unless we are already OK */
  if (CADET_TUNNEL_KEY_OK != t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_AUTH_SENT);
  GCC_transmit (cc,
                env);
  GNUNET_STATISTICS_update (stats,
                            "# KX_AUTH transmitted",
                            1,
                            GNUNET_NO);
}
 
 
static void
cleanup_ax (struct CadetTunnelAxolotl *ax)
{
  while (NULL != ax->skipped_head)
    delete_skipped_key (ax,
                        ax->skipped_head);
  GNUNET_assert (0 == ax->skipped);
  GNUNET_CRYPTO_ecdhe_key_clear (&ax->kx_0);
  GNUNET_CRYPTO_ecdhe_key_clear (&ax->DHRs);
}
 
 
static void
update_ax_by_kx (void *cls,
                 const struct GNUNET_HashCode *key_result)
{
  struct CadetTunnelAsync *as;
  struct GNUNET_HashCode key_material[3];
  struct GNUNET_CRYPTO_SymmetricSessionKey keys[5];
  struct CadetTunnelAxolotl *ax;
  const struct GNUNET_PeerIdentity *pid;
  const struct GNUNET_CRYPTO_EcdhePublicKey *ephemeral_key;
  const struct GNUNET_CRYPTO_EcdhePublicKey *ratchet_key;
  const char salt[] = "CADET Axolotl salt";
  int am_I_alice;
 
  as = cls;
  ax = &as->ax;
  pid = &as->peer_id;
  ephemeral_key = &as->ephemeral_key;
  ratchet_key = &as->ratchet_key;
 
  as->ecdh_op = NULL;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Updating AX by KX with result from ECDH using ephemeral %s\n",
       GNUNET_e2s (ephemeral_key));
 
  if (GNUNET_SYSERR == (am_I_alice = GCT_alice_or_betty (pid)))
  {
    GNUNET_break_op (0);
    if (as->cb)
      as->cb (as->cb_cls, GNUNET_SYSERR);
    return;
  }
 
  if (0 == GNUNET_memcmp (&ax->DHRr,
                          ratchet_key))
  {
    GNUNET_STATISTICS_update (stats,
                              "# Ratchet key already known",
                              1,
                              GNUNET_NO);
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ratchet key already known. Ignoring KX.\n");
    if (as->cb)
      as->cb (as->cb_cls, GNUNET_NO);
    return;
  }
 
  ax->DHRr = *ratchet_key;
  ax->last_ephemeral = *ephemeral_key;
  /* ECDH A B0 */
  if (GNUNET_YES == am_I_alice)
  {
    GNUNET_memcpy (&key_material[0], key_result,
                   sizeof (*key_result));
  }
  else
  {
    GNUNET_CRYPTO_ecdh_eddsa (&ax->kx_0,            /* b0 */
                              &pid->public_key,     /* A */
                              &key_material[0]);
  }
  /* ECDH A0 B */
  if (GNUNET_YES == am_I_alice)
  {
    GNUNET_CRYPTO_ecdh_eddsa (&ax->kx_0,            /* a0 */
                              &pid->public_key,     /* B */
                              &key_material[1]);
  }
  else
  {
    GNUNET_memcpy (&key_material[1], key_result,
                   sizeof (*key_result));
  }
 
  /* ECDH A0 B0 */
  GNUNET_CRYPTO_ecc_ecdh (&ax->kx_0,              /* a0 or b0 */
                          ephemeral_key,         /* B0 or A0 */
                          &key_material[2]);
  /* KDF */
  GNUNET_CRYPTO_hkdf_gnunet (
    keys, sizeof(keys),
    salt, sizeof(salt),
    &key_material, sizeof(key_material));
 
  if (0 == memcmp (&ax->RK,
                   &keys[0],
                   sizeof(ax->RK)))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Root key already known. Ignoring KX.\n");
    GNUNET_STATISTICS_update (stats,
                              "# Root key already known",
                              1,
                              GNUNET_NO);
    if (as->cb)
      as->cb (as->cb_cls, GNUNET_NO);
    return;
  }
 
  ax->RK = keys[0];
  if (GNUNET_YES == am_I_alice)
  {
    ax->HKr = keys[1];
    ax->NHKs = keys[2];
    ax->NHKr = keys[3];
    ax->CKr = keys[4];
    ax->ratchet_flag = GNUNET_YES;
  }
  else
  {
    ax->HKs = keys[1];
    ax->NHKr = keys[2];
    ax->NHKs = keys[3];
    ax->CKs = keys[4];
    ax->ratchet_flag = GNUNET_NO;
    ax->ratchet_expiration
      = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (),
                                  ratchet_time);
  }
 
  if (as->cb)
    as->cb (as->cb_cls, GNUNET_OK);
}
 
 
static void
retry_kx (void *cls)
{
  struct CadetTunnel *t = cls;
  struct CadetTunnelAxolotl *ax;
 
  t->kx_task = NULL;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Trying to make KX progress on %s in state %s\n",
       GCT_2s (t),
       estate2s (t->estate));
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:   /* first attempt */
  case CADET_TUNNEL_KEY_AX_SENT:         /* trying again */
    send_kx (t,
             NULL,
             &t->ax);
    break;
 
  case CADET_TUNNEL_KEY_AX_RECV:
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    /* We are responding, so only require reply
       if WE have a channel waiting. */
    if (NULL != t->unverified_ax)
    {
      /* Send AX_AUTH so we might get this one verified */
      ax = t->unverified_ax;
    }
    else
    {
      /* How can this be? */
      GNUNET_break (0);
      ax = &t->ax;
    }
    send_kx_auth (t,
                  NULL,
                  ax,
                  (0 == GCT_count_channels (t))
                  ? GNUNET_NO
                  : GNUNET_YES);
    break;
 
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    /* We are responding, so only require reply
       if WE have a channel waiting. */
    if (NULL != t->unverified_ax)
    {
      /* Send AX_AUTH so we might get this one verified */
      ax = t->unverified_ax;
    }
    else
    {
      /* How can this be? */
      GNUNET_break (0);
      ax = &t->ax;
    }
    send_kx_auth (t,
                  NULL,
                  ax,
                  (0 == GCT_count_channels (t))
                  ? GNUNET_NO
                  : GNUNET_YES);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    /* Must have been the *other* peer asking us to
       respond with a KX_AUTH. */
    if (NULL != t->unverified_ax)
    {
      /* Sending AX_AUTH in response to AX so we might get this one verified */
      ax = t->unverified_ax;
    }
    else
    {
      /* Sending AX_AUTH in response to AX_AUTH */
      ax = &t->ax;
    }
    send_kx_auth (t,
                  NULL,
                  ax,
                  GNUNET_NO);
    break;
  }
}
 
 
static void
cont_GCT_handle_kx (void *cls,
                    enum GNUNET_GenericReturnValue ret)
{
  struct CadetTunnel *t = cls;
 
  if (t->unverified_ax)
    *(t->unverified_ax) = t->as.ax;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Continue handling KX message from %s from %s\n",
       GCT_2s (t),
       GNUNET_i2s (GCP_get_id (t->destination)));
 
  GNUNET_break (GNUNET_SYSERR != ret);
  if (GNUNET_OK != ret)
  {
    GNUNET_STATISTICS_update (stats,
                              "# Useless KX",
                              1,
                              GNUNET_NO);
    return;   /* duplicate KX, nothing to do */
  }
  /* move ahead in our state machine */
  if (CADET_TUNNEL_KEY_UNINITIALIZED == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_RECV);
  else if (CADET_TUNNEL_KEY_AX_SENT == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_SENT_AND_RECV);
 
  /* KX is still not done, try again our end. */
  if (CADET_TUNNEL_KEY_OK != t->estate)
  {
    if (NULL != t->kx_task)
      GNUNET_SCHEDULER_cancel (t->kx_task);
    t->kx_task
      = GNUNET_SCHEDULER_add_now (&retry_kx,
                                  t);
  }
}
 
 
void
GCT_handle_kx (struct CadetTConnection *ct,
               const struct GNUNET_CADET_TunnelKeyExchangeMessage *msg)
{
  struct CadetTunnel *t = ct->t;
 
  GNUNET_STATISTICS_update (stats,
                            "# KX received",
                            1,
                            GNUNET_NO);
  if (GNUNET_YES ==
      GCT_alice_or_betty (GCP_get_id (t->destination)))
  {
    /* Betty/Bob is not allowed to send KX! */
    GNUNET_break_op (0);
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received KX message from %s with ephemeral %s from %s on connection %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->ephemeral_key),
       GNUNET_i2s (GCP_get_id (t->destination)),
       GCC_2s (ct->cc));
#if 1
  if ((0 ==
       memcmp (&t->ax.DHRr,
               &msg->ratchet_key,
               sizeof(msg->ratchet_key))) &&
      (0 ==
       memcmp (&t->ax.last_ephemeral,
               &msg->ephemeral_key,
               sizeof(msg->ephemeral_key))))
 
  {
    GNUNET_STATISTICS_update (stats,
                              "# Duplicate KX received",
                              1,
                              GNUNET_NO);
    send_kx_auth (t,
                  ct,
                  &t->ax,
                  GNUNET_NO);
    return;
  }
#endif
  /* We only keep ONE unverified KX around, so if there is an existing one,
     clean it up. */
  if (NULL != t->unverified_ax)
  {
    if ((0 ==
         memcmp (&t->unverified_ax->DHRr,
                 &msg->ratchet_key,
                 sizeof(msg->ratchet_key))) &&
        (0 ==
         memcmp (&t->unverified_ax->last_ephemeral,
                 &msg->ephemeral_key,
                 sizeof(msg->ephemeral_key))))
    {
      GNUNET_STATISTICS_update (stats,
                                "# Duplicate unverified KX received",
                                1,
                                GNUNET_NO);
#if 1
      send_kx_auth (t,
                    ct,
                    t->unverified_ax,
                    GNUNET_NO);
      return;
#endif
    }
    if ((t->as.ecdh_op) &&
        (0 ==
         memcmp (&t->as.ratchet_key,
                 &msg->ratchet_key,
                 sizeof(msg->ratchet_key))) &&
        (0 ==
         memcmp (&t->as.ephemeral_key,
                 &msg->ephemeral_key,
                 sizeof(msg->ephemeral_key))))
    {
      LOG (GNUNET_ERROR_TYPE_DEBUG,
           "Waiting for previous ECDH operation\n");
      return;
    }
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Dropping old unverified KX state.\n");
    GNUNET_STATISTICS_update (stats,
                              "# Unverified KX dropped for fresh KX",
                              1,
                              GNUNET_NO);
    GNUNET_break (NULL == t->unverified_ax->skipped_head);
    memset (t->unverified_ax,
            0,
            sizeof(struct CadetTunnelAxolotl));
  }
  else
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Creating fresh unverified KX for %s\n",
         GCT_2s (t));
    GNUNET_STATISTICS_update (stats,
                              "# Fresh KX setup",
                              1,
                              GNUNET_NO);
    t->unverified_ax = GNUNET_new (struct CadetTunnelAxolotl);
  }
  /* Set as the 'current' RK/DHRr the one we are currently using,
     so that the duplicate-detection logic of
   #update_ax_by_kx can work. */
  t->unverified_ax->RK = t->ax.RK;
  t->unverified_ax->DHRr = t->ax.DHRr;
  t->unverified_ax->DHRs = t->ax.DHRs;
  t->unverified_ax->kx_0 = t->ax.kx_0;
  t->unverified_attempts = 0;
 
  t->as.ax = *(t->unverified_ax);
  GNUNET_memcpy (&t->as.peer_id, GCP_get_id (t->destination),
                 sizeof (t->as.peer_id));
  GNUNET_memcpy (&t->as.ephemeral_key, &msg->ephemeral_key,
                 sizeof (t->as.ephemeral_key));
  GNUNET_memcpy (&t->as.ratchet_key, &msg->ratchet_key,
                 sizeof (t->as.ratchet_key));
  memset (&t->as.auth, 0, sizeof (t->as.auth));
  t->as.flags = 0;
  t->as.cb_cls = t;
  t->as.cb = &cont_GCT_handle_kx;
 
  if (t->as.ecdh_op)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Cancelling previous ECDH operation\n");
 
    GNUNET_PILS_cancel (t->as.ecdh_op);
  }
 
  t->as.ecdh_op = GNUNET_PILS_ecdh (pils, &msg->ephemeral_key,
                                    &update_ax_by_kx, &t->as);
}
 
 
static void
cont_GCT_handle_kx_auth (void *cls,
                         enum GNUNET_GenericReturnValue ret)
{
  struct CadetTunnel *t = cls;
  struct CadetTunnelAxolotl *ax_tmp;
  struct GNUNET_HashCode kx_auth;
 
  ax_tmp = &t->as.ax;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Continue handling KX_AUTH message from %s\n",
       GCT_2s (t));
 
  if (GNUNET_OK != ret)
  {
    if (GNUNET_NO == ret)
      GNUNET_STATISTICS_update (stats,
                                "# redundant KX_AUTH received",
                                1,
                                GNUNET_NO);
    else
      GNUNET_break (0);  /* connect to self!? */
    return;
  }
  GNUNET_CRYPTO_hash (&ax_tmp->RK,
                      sizeof(ax_tmp->RK),
                      &kx_auth);
  if (0 != GNUNET_memcmp (&kx_auth,
                          &t->as.auth))
  {
    /* This KX_AUTH is not using the latest KX/KX_AUTH data
       we transmitted to the sender, refuse it, try KX again. */
    GNUNET_STATISTICS_update (stats,
                              "# KX_AUTH not using our last KX received (auth failure)",
                              1,
                              GNUNET_NO);
    LOG (GNUNET_ERROR_TYPE_WARNING,
         "KX AUTH mismatch!\n");
#if DEBUG_KX
    {
      struct GNUNET_CRYPTO_EcdhePublicKey ephemeral_key;
 
      GNUNET_CRYPTO_ecdhe_key_get_public (&ax_tmp.kx_0,
                                          &ephemeral_key);
      if (0 != GNUNET_memcmp (&ephemeral_key,
                              &msg->r_ephemeral_key_XXX))
      {
        LOG (GNUNET_ERROR_TYPE_WARNING,
             "My ephemeral is %s!\n",
             GNUNET_e2s (&ephemeral_key));
        LOG (GNUNET_ERROR_TYPE_WARNING,
             "Response is for ephemeral %s!\n",
             GNUNET_e2s (&msg->r_ephemeral_key_XXX));
      }
    }
#endif
    if (NULL == t->kx_task)
      t->kx_task
        = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
                                   &retry_kx,
                                   t);
    return;
  }
  /* Yep, we're good. */
  t->ax = *ax_tmp;
  if (NULL != t->unverified_ax)
  {
    /* We got some "stale" KX before, drop that. */
    cleanup_ax (t->unverified_ax);
    GNUNET_free (t->unverified_ax);
    t->unverified_ax = NULL;
  }
 
  /* move ahead in our state machine */
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
  case CADET_TUNNEL_KEY_AX_RECV:
    /* Checked above, this is impossible. */
    GNUNET_assert (0);
    break;
 
  case CADET_TUNNEL_KEY_AX_SENT:      /* This is the normal case */
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:   /* both peers started KX */
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:   /* both peers now did KX_AUTH */
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_OK);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    /* Did not expect another KX_AUTH, but so what, still acceptable.
       Nothing to do here. */
    break;
  }
  if (0 != (GNUNET_CADET_KX_FLAG_FORCE_REPLY & ntohl (t->as.flags)))
  {
    send_kx_auth (t,
                  NULL,
                  &t->ax,
                  GNUNET_NO);
  }
}
 
 
void
GCT_handle_kx_auth (struct CadetTConnection *ct,
                    const struct GNUNET_CADET_TunnelKeyExchangeAuthMessage *msg)
{
  struct CadetTunnel *t = ct->t;
 
  GNUNET_STATISTICS_update (stats,
                            "# KX_AUTH received",
                            1,
                            GNUNET_NO);
  if ((CADET_TUNNEL_KEY_UNINITIALIZED == t->estate) ||
      (CADET_TUNNEL_KEY_AX_RECV == t->estate))
  {
    /* Confusing, we got a KX_AUTH before we even send our own
       KX. This should not happen. We'll send our own KX ASAP anyway,
       so let's ignore this here. */
    GNUNET_break_op (0);
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Handling KX_AUTH message from %s with ephemeral %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->kx.ephemeral_key));
  if ((t->as.ecdh_op) &&
      (0 ==
       memcmp (&t->as.ratchet_key,
               &msg->kx.ratchet_key,
               sizeof(msg->kx.ratchet_key))) &&
      (0 ==
       memcmp (&t->as.ephemeral_key,
               &msg->kx.ephemeral_key,
               sizeof(msg->kx.ephemeral_key))))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Waiting for previous ECDH operation\n");
    return;
  }
  /* We do everything in a copy until we've checked the authentication
     so we don't clobber anything we care about by accident. */
  t->as.ax = t->ax;
  GNUNET_memcpy (&t->as.peer_id, GCP_get_id (t->destination),
                 sizeof (t->as.peer_id));
  GNUNET_memcpy (&t->as.ephemeral_key, &msg->kx.ephemeral_key,
                 sizeof (t->as.ephemeral_key));
  GNUNET_memcpy (&t->as.ratchet_key, &msg->kx.ratchet_key,
                 sizeof (t->as.ratchet_key));
  t->as.auth = msg->auth;
  t->as.flags = msg->kx.flags;
  t->as.cb_cls = t;
  t->as.cb = &cont_GCT_handle_kx_auth;
 
  if (t->as.ecdh_op)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Cancelling previous ECDH operation\n");
 
    GNUNET_PILS_cancel (t->as.ecdh_op);
  }
 
  /* Update 'ax' by the new key material */
  t->as.ecdh_op = GNUNET_PILS_ecdh (pils, &msg->kx.ephemeral_key,
                                    &update_ax_by_kx, &t->as);
}
 
 
/* ************************************** end core crypto ***************************** */
 
 
static struct GNUNET_CADET_ChannelTunnelNumber
get_next_free_ctn (struct CadetTunnel *t)
{
#define HIGH_BIT 0x8000000
  const struct GNUNET_PeerIdentity *my_identity;
  struct GNUNET_CADET_ChannelTunnelNumber ret;
  uint32_t ctn;
  int cmp;
  uint32_t highbit;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  cmp = GNUNET_memcmp (my_identity,
                       GCP_get_id (GCT_get_destination (t)));
  if (0 < cmp)
    highbit = HIGH_BIT;
  else if (0 > cmp)
    highbit = 0;
  else
    GNUNET_assert (0); // loopback must never go here!
  ctn = ntohl (t->next_ctn.cn);
  while (NULL !=
         GNUNET_CONTAINER_multihashmap32_get (t->channels,
                                              ctn | highbit))
  {
    ctn = ((ctn + 1) & (~HIGH_BIT));
  }
  t->next_ctn.cn = htonl ((ctn + 1) & (~HIGH_BIT));
  ret.cn = htonl (ctn | highbit);
  return ret;
}
 
 
struct GNUNET_CADET_ChannelTunnelNumber
GCT_add_channel (struct CadetTunnel *t,
                 struct CadetChannel *ch)
{
  struct GNUNET_CADET_ChannelTunnelNumber ctn;
 
  ctn = get_next_free_ctn (t);
  if (NULL != t->destroy_task)
  {
    GNUNET_SCHEDULER_cancel (t->destroy_task);
    t->destroy_task = NULL;
  }
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multihashmap32_put (t->channels,
                                                      ntohl (ctn.cn),
                                                      ch,
                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Adding %s to %s with state %d\n",
       GCCH_2s (ch),
       GCT_2s (t),
       t->estate);
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
    /* waiting for connection to start KX */
    break;
 
  case CADET_TUNNEL_KEY_AX_RECV:
  case CADET_TUNNEL_KEY_AX_SENT:
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    /* we're currently waiting for KX to complete */
    break;
 
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    /* waiting for OTHER peer to send us data,
       we might need to prompt more aggressively! */
    if (NULL == t->kx_task)
      t->kx_task
        = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
                                   &retry_kx,
                                   t);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    /* We are ready. Tell the new channel that we are up. */
    GCCH_tunnel_up (ch);
    break;
  }
  return ctn;
}
 
 
void
GCT_connection_lost (struct CadetTConnection *ct)
{
  struct CadetTunnel *t = ct->t;
 
  if (GNUNET_YES == ct->is_ready)
  {
    GNUNET_CONTAINER_DLL_remove (t->connection_ready_head,
                                 t->connection_ready_tail,
                                 ct);
    t->num_ready_connections--;
  }
  else
  {
    GNUNET_CONTAINER_DLL_remove (t->connection_busy_head,
                                 t->connection_busy_tail,
                                 ct);
    t->num_busy_connections--;
  }
  GNUNET_free (ct);
}
 
 
static void
destroy_t_connection (void *cls,
                      struct CadetTConnection *ct)
{
  struct CadetTunnel *t = cls;
  struct CadetConnection *cc = ct->cc;
 
  GNUNET_assert (ct->t == t);
  GCT_connection_lost (ct);
  GCC_destroy_without_tunnel (cc);
}
 
 
static void
destroy_tunnel (void *cls)
{
  struct CadetTunnel *t = cls;
  struct CadetTunnelQueueEntry *tq;
 
  t->destroy_task = NULL;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Destroying idle %s\n",
       GCT_2s (t));
  GNUNET_assert (0 == GCT_count_channels (t));
  GCT_iterate_connections (t,
                           &destroy_t_connection,
                           t);
  GNUNET_assert (NULL == t->connection_ready_head);
  GNUNET_assert (NULL == t->connection_busy_head);
  while (NULL != (tq = t->tq_head))
  {
    if (NULL != tq->cont)
      tq->cont (tq->cont_cls,
                NULL);
    GCT_send_cancel (tq);
  }
  GCP_drop_tunnel (t->destination,
                   t);
  GNUNET_CONTAINER_multihashmap32_destroy (t->channels);
  if (NULL != t->maintain_connections_task)
  {
    GNUNET_SCHEDULER_cancel (t->maintain_connections_task);
    t->maintain_connections_task = NULL;
  }
  if (NULL != t->send_task)
  {
    GNUNET_SCHEDULER_cancel (t->send_task);
    t->send_task = NULL;
  }
  if (NULL != t->kx_task)
  {
    GNUNET_SCHEDULER_cancel (t->kx_task);
    t->kx_task = NULL;
  }
  if (NULL != t->as.ecdh_op)
  {
    GNUNET_PILS_cancel (t->as.ecdh_op);
    t->as.ecdh_op = NULL;
  }
  GNUNET_MST_destroy (t->mst);
  GNUNET_MQ_destroy (t->mq);
  if (NULL != t->unverified_ax)
  {
    cleanup_ax (t->unverified_ax);
    GNUNET_free (t->unverified_ax);
  }
  cleanup_ax (&t->ax);
  GNUNET_assert (NULL == t->destroy_task);
  GNUNET_free (t);
}
 
 
void
GCT_remove_channel (struct CadetTunnel *t,
                    struct CadetChannel *ch,
                    struct GNUNET_CADET_ChannelTunnelNumber ctn)
{
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Removing %s from %s\n",
       GCCH_2s (ch),
       GCT_2s (t));
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multihashmap32_remove (t->channels,
                                                         ntohl (ctn.cn),
                                                         ch));
  if ((0 ==
       GCT_count_channels (t)) &&
      (NULL == t->destroy_task))
  {
    t->destroy_task
      = GNUNET_SCHEDULER_add_delayed (IDLE_DESTROY_DELAY,
                                      &destroy_tunnel,
                                      t);
  }
}
 
 
static int
destroy_remaining_channels (void *cls,
                            uint32_t key,
                            void *value)
{
  struct CadetChannel *ch = value;
 
  GCCH_handle_remote_destroy (ch,
                              NULL);
  return GNUNET_OK;
}
 
 
void
GCT_destroy_tunnel_now (struct CadetTunnel *t)
{
  GNUNET_assert (GNUNET_YES == shutting_down);
  GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                           &destroy_remaining_channels,
                                           t);
  GNUNET_assert (0 ==
                 GCT_count_channels (t));
  if (NULL != t->destroy_task)
  {
    GNUNET_SCHEDULER_cancel (t->destroy_task);
    t->destroy_task = NULL;
  }
  destroy_tunnel (t);
}
 
 
static void
try_send_normal_payload (struct CadetTunnel *t,
                         struct CadetTConnection *ct)
{
  struct CadetTunnelQueueEntry *tq;
 
  GNUNET_assert (GNUNET_YES == ct->is_ready);
  tq = t->tq_head;
  if (NULL == tq)
  {
    /* no messages pending right now */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Not sending payload of %s on ready %s (nothing pending)\n",
         GCT_2s (t),
         GCC_2s (ct->cc));
    return;
  }
  /* ready to send message 'tq' on tunnel 'ct' */
  GNUNET_assert (t == tq->t);
  GNUNET_CONTAINER_DLL_remove (t->tq_head,
                               t->tq_tail,
                               tq);
  if (NULL != tq->cid)
    *tq->cid = *GCC_get_id (ct->cc);
  mark_connection_unready (ct);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending payload of %s on %s\n",
       GCT_2s (t),
       GCC_2s (ct->cc));
  GCC_transmit (ct->cc,
                tq->env);
  if (NULL != tq->cont)
    tq->cont (tq->cont_cls,
              GCC_get_id (ct->cc));
  GNUNET_free (tq);
}
 
 
static void
connection_ready_cb (void *cls,
                     int is_ready)
{
  struct CadetTConnection *ct = cls;
  struct CadetTunnel *t = ct->t;
 
  if (GNUNET_NO == is_ready)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "%s no longer ready for %s\n",
         GCC_2s (ct->cc),
         GCT_2s (t));
    mark_connection_unready (ct);
    return;
  }
  GNUNET_assert (GNUNET_NO == ct->is_ready);
  GNUNET_CONTAINER_DLL_remove (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  GNUNET_assert (0 < t->num_busy_connections);
  t->num_busy_connections--;
  ct->is_ready = GNUNET_YES;
  GNUNET_CONTAINER_DLL_insert_tail (t->connection_ready_head,
                                    t->connection_ready_tail,
                                    ct);
  t->num_ready_connections++;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s now ready for %s in state %s\n",
       GCC_2s (ct->cc),
       GCT_2s (t),
       estate2s (t->estate));
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Do not begin KX for %s if WE have no channels waiting. Retrying after %llu\n",
         GCT_2s (t),
         (unsigned long long) GNUNET_TIME_absolute_get_remaining (
           t->next_kx_attempt).rel_value_us);
    /* Do not begin KX if WE have no channels waiting! */
    if (0 != GNUNET_TIME_absolute_get_remaining (
          t->next_kx_attempt).rel_value_us)
      return;   /* wait for timeout before retrying */
    /* We are uninitialized, just transmit immediately,
       without undue delay. */
 
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Why for %s \n",
         GCT_2s (t));
 
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    if ((0 ==
         GCT_count_channels (t)) &&
        (NULL == t->destroy_task))
    {
      t->destroy_task
        = GNUNET_SCHEDULER_add_delayed (IDLE_DESTROY_DELAY,
                                        &destroy_tunnel,
                                        t);
    }
    break;
 
  case CADET_TUNNEL_KEY_AX_RECV:
  case CADET_TUNNEL_KEY_AX_SENT:
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    /* we're currently waiting for KX to complete, schedule job */
    if (NULL == t->kx_task)
      t->kx_task
        = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
                                   &retry_kx,
                                   t);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    if (GNUNET_YES == t->kx_auth_requested)
    {
      if (0 != GNUNET_TIME_absolute_get_remaining (
            t->next_kx_attempt).rel_value_us)
        return;     /* wait for timeout */
      if (NULL != t->kx_task)
      {
        GNUNET_SCHEDULER_cancel (t->kx_task);
        t->kx_task = NULL;
      }
      send_kx_auth (t,
                    ct,
                    &t->ax,
                    GNUNET_NO);
      return;
    }
    try_send_normal_payload (t,
                             ct);
    break;
  }
}
 
 
static void
trigger_transmissions (void *cls)
{
  struct CadetTunnel *t = cls;
  struct CadetTConnection *ct;
 
  t->send_task = NULL;
  if (NULL == t->tq_head)
    return; /* no messages pending right now */
  ct = get_ready_connection (t);
  if (NULL == ct)
    return; /* no connections ready */
  try_send_normal_payload (t,
                           ct);
}
 
 
struct EvaluationSummary
{
  unsigned int min_length;
 
  unsigned int max_length;
 
  GNUNET_CONTAINER_HeapCostType min_desire;
 
  GNUNET_CONTAINER_HeapCostType max_desire;
 
  struct CadetPeerPath *path;
 
  struct CadetTConnection *worst;
 
  double worst_score;
 
  int duplicate;
};
 
 
static void
evaluate_connection (void *cls,
                     struct CadetTConnection *ct)
{
  struct EvaluationSummary *es = cls;
  struct CadetConnection *cc = ct->cc;
  unsigned int ct_length;
  struct CadetPeerPath *ps;
  const struct CadetConnectionMetrics *metrics;
  GNUNET_CONTAINER_HeapCostType ct_desirability;
  struct GNUNET_TIME_Relative uptime;
  struct GNUNET_TIME_Relative last_use;
  double score;
  double success_rate;
 
  ps = GCC_get_path (cc,
                     &ct_length);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Evaluating path %s of existing %s\n",
       GCPP_2s (ps),
       GCC_2s (cc));
  if (ps == es->path)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ignoring duplicate path %s.\n",
         GCPP_2s (es->path));
    es->duplicate = GNUNET_YES;
    return;
  }
  if (NULL != es->path)
  {
    int duplicate = GNUNET_YES;
 
    for (unsigned int i = 0; i < ct_length; i++)
    {
      GNUNET_assert (GCPP_get_length (es->path) > i);
      if (GCPP_get_peer_at_offset (es->path,
                                   i) !=
          GCPP_get_peer_at_offset (ps,
                                   i))
      {
        duplicate = GNUNET_NO;
        break;
      }
    }
    if (GNUNET_YES == duplicate)
    {
      LOG (GNUNET_ERROR_TYPE_DEBUG,
           "Ignoring overlapping path %s.\n",
           GCPP_2s (es->path));
      es->duplicate = GNUNET_YES;
      return;
    }
    else
    {
      LOG (GNUNET_ERROR_TYPE_DEBUG,
           "Known path %s differs from proposed path\n",
           GCPP_2s (ps));
    }
  }
 
  ct_desirability = GCPP_get_desirability (ps);
  metrics = GCC_get_metrics (cc);
  uptime = GNUNET_TIME_absolute_get_duration (metrics->age);
  last_use = GNUNET_TIME_absolute_get_duration (metrics->last_use);
  /* We add 1.0 here to avoid division by zero. */
  success_rate = (metrics->num_acked_transmissions + 1.0)
                 / (metrics->num_successes + 1.0);
  score
    = ct_desirability
      + 100.0 / (1.0 + ct_length) /* longer paths = better */
      + sqrt (uptime.rel_value_us / 60000000LL) /* larger uptime = better */
      - last_use.rel_value_us / 1000L;        /* longer idle = worse */
  score *= success_rate;        /* weigh overall by success rate */
 
  if ((NULL == es->worst) ||
      (score < es->worst_score))
  {
    es->worst = ct;
    es->worst_score = score;
  }
  es->min_length = GNUNET_MIN (es->min_length,
                               ct_length);
  es->max_length = GNUNET_MAX (es->max_length,
                               ct_length);
  es->min_desire = GNUNET_MIN (es->min_desire,
                               ct_desirability);
  es->max_desire = GNUNET_MAX (es->max_desire,
                               ct_desirability);
}
 
 
static int
consider_path_cb (void *cls,
                  struct CadetPeerPath *path,
                  unsigned int off)
{
  struct CadetTunnel *t = cls;
  struct EvaluationSummary es;
  struct CadetTConnection *ct;
 
  GNUNET_assert (off < GCPP_get_length (path));
  GNUNET_assert (GCPP_get_peer_at_offset (path,
                                          off) == t->destination);
  es.min_length = UINT_MAX;
  es.max_length = 0;
  es.max_desire = 0;
  es.min_desire = UINT64_MAX;
  es.path = path;
  es.duplicate = GNUNET_NO;
  es.worst = NULL;
 
  /* Compute evaluation summary over existing connections. */
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Evaluating proposed path %s for target %s\n",
       GCPP_2s (path),
       GCT_2s (t));
  /* FIXME: suspect this does not ACTUALLY iterate
     over all existing paths, otherwise dup detection
     should work!!! */
  GCT_iterate_connections (t,
                           &evaluate_connection,
                           &es);
  if (GNUNET_YES == es.duplicate)
    return GNUNET_YES;
 
  /* FIXME: not sure we should really just count
     'num_connections' here, as they may all have
     consistently failed to connect. */
 
  /* We iterate by increasing path length; if we have enough paths and
     this one is more than twice as long than what we are currently
     using, then ignore all of these super-long ones! */
  if ((GCT_count_any_connections (t) > DESIRED_CONNECTIONS_PER_TUNNEL) &&
      (es.min_length * 2 < off) &&
      (es.max_length < off))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ignoring paths of length %u, they are way too long.\n",
         es.min_length * 2);
    return GNUNET_NO;
  }
  /* If we have enough paths and this one looks no better, ignore it. */
  if ((GCT_count_any_connections (t) >= DESIRED_CONNECTIONS_PER_TUNNEL) &&
      (es.min_length < GCPP_get_length (path)) &&
      (es.min_desire > GCPP_get_desirability (path)) &&
      (es.max_length < off))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ignoring path (%u/%llu) to %s, got something better already.\n",
         GCPP_get_length (path),
         (unsigned long long) GCPP_get_desirability (path),
         GCP_2s (t->destination));
    return GNUNET_YES;
  }
 
  /* Path is interesting (better by some metric, or we don't have
     enough paths yet). */
  ct = GNUNET_new (struct CadetTConnection);
  ct->created = GNUNET_TIME_absolute_get ();
  ct->t = t;
  ct->cc = GCC_create (t->destination,
                       path,
                       off,
                       ct,
                       &connection_ready_cb,
                       ct);
 
  /* FIXME: schedule job to kill connection (and path?)  if it takes
     too long to get ready! (And track performance data on how long
     other connections took with the tunnel!)
     => Note: to be done within 'connection'-logic! */
  GNUNET_CONTAINER_DLL_insert (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  t->num_busy_connections++;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Found interesting path %s for %s, created %s\n",
       GCPP_2s (path),
       GCT_2s (t),
       GCC_2s (ct->cc));
  return GNUNET_YES;
}
 
 
static void
maintain_connections_cb (void *cls)
{
  struct CadetTunnel *t = cls;
  struct GNUNET_TIME_Relative delay;
  struct EvaluationSummary es;
 
  t->maintain_connections_task = NULL;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Performing connection maintenance for %s.\n",
       GCT_2s (t));
 
  es.min_length = UINT_MAX;
  es.max_length = 0;
  es.max_desire = 0;
  es.min_desire = UINT64_MAX;
  es.path = NULL;
  es.worst = NULL;
  es.duplicate = GNUNET_NO;
  GCT_iterate_connections (t,
                           &evaluate_connection,
                           &es);
  if ((NULL != es.worst) &&
      (GCT_count_any_connections (t) > DESIRED_CONNECTIONS_PER_TUNNEL))
  {
    /* Clear out worst-performing connection 'es.worst'. */
    destroy_t_connection (t,
                          es.worst);
  }
 
  /* Consider additional paths */
  (void) GCP_iterate_paths (t->destination,
                            &consider_path_cb,
                            t);
 
  /* FIXME: calculate when to try again based on how well we are doing;
     in particular, if we have to few connections, we might be able
     to do without this (as PATHS should tell us whenever a new path
     is available instantly; however, need to make sure this job is
     restarted after that happens).
     Furthermore, if the paths we do know are in a reasonably narrow
     quality band and are plentyful, we might also consider us stabilized
     and then reduce the frequency accordingly.  */delay = GNUNET_TIME_UNIT_MINUTES;
  t->maintain_connections_task
    = GNUNET_SCHEDULER_add_delayed (delay,
                                    &maintain_connections_cb,
                                    t);
}
 
 
void
GCT_consider_path (struct CadetTunnel *t,
                   struct CadetPeerPath *p,
                   unsigned int off)
{
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Considering %s for %s (offset %u)\n",
       GCPP_2s (p),
       GCT_2s (t),
       off);
  (void) consider_path_cb (t,
                           p,
                           off);
}
 
 
static void
handle_plaintext_keepalive (void *cls,
                            const struct GNUNET_MessageHeader *msg)
{
  struct CadetTunnel *t = cls;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received KEEPALIVE on %s\n",
       GCT_2s (t));
  GNUNET_STATISTICS_update (stats,
                            "# keepalives received",
                            1,
                            GNUNET_NO);
}
 
 
static int
check_plaintext_data (void *cls,
                      const struct GNUNET_CADET_ChannelAppDataMessage *msg)
{
  return GNUNET_OK;
}
 
 
static void
handle_plaintext_data (void *cls,
                       const struct GNUNET_CADET_ChannelAppDataMessage *msg)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       msg->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. Send back a DESTROY. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received %u bytes of application data for unknown channel %u, sending DESTROY\n",
         (unsigned int) (ntohs (msg->header.size) - sizeof(*msg)),
         ntohl (msg->ctn.cn));
    GCT_send_channel_destroy (t,
                              msg->ctn);
    return;
  }
  GCCH_handle_channel_plaintext_data (ch,
                                      GCC_get_id (t->current_ct->cc),
                                      msg);
}
 
 
static void
handle_plaintext_data_ack (void *cls,
                           const struct GNUNET_CADET_ChannelDataAckMessage *ack)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       ack->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. Send back a DESTROY. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received DATA_ACK for unknown channel %u, sending DESTROY\n",
         ntohl (ack->ctn.cn));
    GCT_send_channel_destroy (t,
                              ack->ctn);
    return;
  }
  GCCH_handle_channel_plaintext_data_ack (ch,
                                          GCC_get_id (t->current_ct->cc),
                                          ack);
}
 
 
static void
handle_plaintext_channel_open (void *cls,
                               const struct
                               GNUNET_CADET_ChannelOpenMessage *copen)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = GNUNET_CONTAINER_multihashmap32_get (t->channels,
                                            ntohl (copen->ctn.cn));
  if (NULL != ch)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received duplicate channel CHANNEL_OPEN on h_port %s from %s (%s), resending ACK\n",
         GNUNET_h2s (&copen->h_port),
         GCT_2s (t),
         GCCH_2s (ch));
    GCCH_handle_duplicate_open (ch,
                                GCC_get_id (t->current_ct->cc));
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received CHANNEL_OPEN on h_port %s from %s\n",
       GNUNET_h2s (&copen->h_port),
       GCT_2s (t));
  ch = GCCH_channel_incoming_new (t,
                                  copen->ctn,
                                  &copen->h_port,
                                  ntohl (copen->opt));
  if (NULL != t->destroy_task)
  {
    GNUNET_SCHEDULER_cancel (t->destroy_task);
    t->destroy_task = NULL;
  }
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CONTAINER_multihashmap32_put (t->channels,
                                                      ntohl (copen->ctn.cn),
                                                      ch,
                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
}
 
 
void
GCT_send_channel_destroy (struct CadetTunnel *t,
                          struct GNUNET_CADET_ChannelTunnelNumber ctn)
{
  struct GNUNET_CADET_ChannelDestroyMessage msg;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending DESTROY message for channel ID %u\n",
       ntohl (ctn.cn));
  msg.header.size = htons (sizeof(msg));
  msg.header.type = htons (GNUNET_MESSAGE_TYPE_CADET_CHANNEL_DESTROY);
  msg.reserved = htonl (0);
  msg.ctn = ctn;
  GCT_send (t,
            &msg.header,
            NULL,
            NULL,
            &ctn);
}
 
 
static void
handle_plaintext_channel_open_ack (void *cls,
                                   const struct
                                   GNUNET_CADET_ChannelOpenAckMessage *cm)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       cm->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. Send back a DESTROY. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received channel OPEN_ACK for unknown channel %u, sending DESTROY\n",
         ntohl (cm->ctn.cn));
    GCT_send_channel_destroy (t,
                              cm->ctn);
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received channel OPEN_ACK on channel %s from %s\n",
       GCCH_2s (ch),
       GCT_2s (t));
  GCCH_handle_channel_open_ack (ch,
                                GCC_get_id (t->current_ct->cc),
                                &cm->port);
}
 
 
static void
handle_plaintext_channel_destroy (void *cls,
                                  const struct
                                  GNUNET_CADET_ChannelDestroyMessage *cm)
{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       cm->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received channel DESTROY for unknown channel %u. Ignoring.\n",
         ntohl (cm->ctn.cn));
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received channel DESTROY on %s from %s\n",
       GCCH_2s (ch),
       GCT_2s (t));
  GCCH_handle_remote_destroy (ch,
                              GCC_get_id (t->current_ct->cc));
}
 
 
static int
handle_decrypted (void *cls,
                  const struct GNUNET_MessageHeader *msg)
{
  struct CadetTunnel *t = cls;
 
  GNUNET_assert (NULL != t->current_ct);
  GNUNET_MQ_inject_message (t->mq,
                            msg);
  return GNUNET_OK;
}
 
 
static void
decrypted_error_cb (void *cls,
                    enum GNUNET_MQ_Error error)
{
  GNUNET_break_op (0);
}
 
 
struct CadetTunnel *
GCT_create_tunnel (struct CadetPeer *destination)
{
  struct CadetTunnel *t = GNUNET_new (struct CadetTunnel);
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_fixed_size (plaintext_keepalive,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_KEEPALIVE,
                             struct GNUNET_MessageHeader,
                             t),
    GNUNET_MQ_hd_var_size (plaintext_data,
                           GNUNET_MESSAGE_TYPE_CADET_CHANNEL_APP_DATA,
                           struct GNUNET_CADET_ChannelAppDataMessage,
                           t),
    GNUNET_MQ_hd_fixed_size (plaintext_data_ack,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_APP_DATA_ACK,
                             struct GNUNET_CADET_ChannelDataAckMessage,
                             t),
    GNUNET_MQ_hd_fixed_size (plaintext_channel_open,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_OPEN,
                             struct GNUNET_CADET_ChannelOpenMessage,
                             t),
    GNUNET_MQ_hd_fixed_size (plaintext_channel_open_ack,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_OPEN_ACK,
                             struct GNUNET_CADET_ChannelOpenAckMessage,
                             t),
    GNUNET_MQ_hd_fixed_size (plaintext_channel_destroy,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_DESTROY,
                             struct GNUNET_CADET_ChannelDestroyMessage,
                             t),
    GNUNET_MQ_handler_end ()
  };
 
  t->kx_retry_delay = INITIAL_KX_RETRY_DELAY;
  new_ephemeral (&t->ax);
  GNUNET_CRYPTO_ecdhe_key_create (&t->ax.kx_0);
  t->destination = destination;
  t->channels = GNUNET_CONTAINER_multihashmap32_create (8);
  t->maintain_connections_task
    = GNUNET_SCHEDULER_add_now (&maintain_connections_cb,
                                t);
  t->mq = GNUNET_MQ_queue_for_callbacks (NULL,
                                         NULL,
                                         NULL,
                                         NULL,
                                         handlers,
                                         &decrypted_error_cb,
                                         t);
  t->mst = GNUNET_MST_create (&handle_decrypted,
                              t);
  return t;
}
 
 
int
GCT_add_inbound_connection (struct CadetTunnel *t,
                            const struct
                            GNUNET_CADET_ConnectionTunnelIdentifier *cid,
                            struct CadetPeerPath *path)
{
  struct CadetTConnection *ct;
 
  ct = GNUNET_new (struct CadetTConnection);
  ct->created = GNUNET_TIME_absolute_get ();
  ct->t = t;
  ct->cc = GCC_create_inbound (t->destination,
                               path,
                               ct,
                               cid,
                               &connection_ready_cb,
                               ct);
  if (NULL == ct->cc)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "%s refused inbound %s (duplicate)\n",
         GCT_2s (t),
         GCC_2s (ct->cc));
    GNUNET_free (ct);
    return GNUNET_SYSERR;
  }
  /* FIXME: schedule job to kill connection (and path?)  if it takes
     too long to get ready! (And track performance data on how long
     other connections took with the tunnel!)
     => Note: to be done within 'connection'-logic! */
  GNUNET_CONTAINER_DLL_insert (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  t->num_busy_connections++;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s has new %s\n",
       GCT_2s (t),
       GCC_2s (ct->cc));
  return GNUNET_OK;
}
 
 
void
GCT_handle_encrypted (struct CadetTConnection *ct,
                      const struct GNUNET_CADET_TunnelEncryptedMessage *msg)
{
  struct CadetTunnel *t = ct->t;
  uint16_t size = ntohs (msg->header.size);
  char cbuf[size] GNUNET_ALIGN;
  ssize_t decrypted_size;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s received %u bytes of encrypted data in state %d\n",
       GCT_2s (t),
       (unsigned int) size,
       t->estate);
 
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
  case CADET_TUNNEL_KEY_AX_RECV:
    /* We did not even SEND our KX, how can the other peer
       send us encrypted data? Must have been that we went
       down and the other peer still things we are up.
       Let's send it KX back. */
    GNUNET_STATISTICS_update (stats,
                              "# received encrypted without any KX",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    return;
 
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    /* We send KX, and other peer send KX to us at the same time.
       Neither KX is AUTH'ed, so let's try KX_AUTH this time. */
    GNUNET_STATISTICS_update (stats,
                              "# received encrypted without KX_AUTH",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx_auth (t,
                  ct,
                  &t->ax,
                  GNUNET_YES);
    return;
 
  case CADET_TUNNEL_KEY_AX_SENT:
    /* We did not get the KX of the other peer, but that
       might have been lost.  Send our KX again immediately. */
    GNUNET_STATISTICS_update (stats,
                              "# received encrypted without KX",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    return;
 
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
  /* Great, first payload, we might graduate to OK! */
  case CADET_TUNNEL_KEY_OK:
    /* We are up and running, all good. */
    break;
  }
 
  decrypted_size = -1;
  if (CADET_TUNNEL_KEY_OK == t->estate)
  {
    /* We have well-established key material available,
       try that. (This is the common case.) */
    decrypted_size = t_ax_decrypt_and_validate (&t->ax,
                                                cbuf,
                                                msg,
                                                size);
  }
 
  if ((-1 == decrypted_size) &&
      (NULL != t->unverified_ax))
  {
    /* We have un-authenticated KX material available. We should try
       this as a back-up option, in case the sender crashed and
       switched keys. */
    decrypted_size = t_ax_decrypt_and_validate (t->unverified_ax,
                                                cbuf,
                                                msg,
                                                size);
    if (-1 != decrypted_size)
    {
      /* It worked! Treat this as authentication of the AX data! */
      cleanup_ax (&t->ax);
      t->ax = *t->unverified_ax;
      GNUNET_free (t->unverified_ax);
      t->unverified_ax = NULL;
    }
    if (CADET_TUNNEL_KEY_AX_AUTH_SENT == t->estate)
    {
      /* First time it worked, move tunnel into production! */
      GCT_change_estate (t,
                         CADET_TUNNEL_KEY_OK);
      if (NULL != t->send_task)
        GNUNET_SCHEDULER_cancel (t->send_task);
      t->send_task = GNUNET_SCHEDULER_add_now (&trigger_transmissions,
                                               t);
    }
  }
  if (NULL != t->unverified_ax)
  {
    /* We had unverified KX material that was useless; so increment
       counter and eventually move to ignore it.  Note that we even do
       this increment if we successfully decrypted with the old KX
       material and thus didn't even both with the new one.  This is
       the ideal case, as a malicious injection of bogus KX data
       basically only causes us to increment a counter a few times. */t->unverified_attempts++;
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Failed to decrypt message with unverified KX data %u times\n",
         t->unverified_attempts);
    if (t->unverified_attempts > MAX_UNVERIFIED_ATTEMPTS)
    {
      cleanup_ax (t->unverified_ax);
      GNUNET_free (t->unverified_ax);
      t->unverified_ax = NULL;
    }
  }
 
  if (-1 == decrypted_size)
  {
    /* Decryption failed for good, complain. */
    LOG (GNUNET_ERROR_TYPE_WARNING,
         "%s failed to decrypt and validate encrypted data, retrying KX\n",
         GCT_2s (t));
    GNUNET_STATISTICS_update (stats,
                              "# unable to decrypt",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    return;
  }
  GNUNET_STATISTICS_update (stats,
                            "# decrypted bytes",
                            decrypted_size,
                            GNUNET_NO);
 
  /* The MST will ultimately call #handle_decrypted() on each message. */
  t->current_ct = ct;
  GNUNET_break_op (GNUNET_OK ==
                   GNUNET_MST_from_buffer (t->mst,
                                           cbuf,
                                           decrypted_size,
                                           GNUNET_YES,
                                           GNUNET_NO));
  t->current_ct = NULL;
}
 
 
struct CadetTunnelQueueEntry *
GCT_send (struct CadetTunnel *t,
          const struct GNUNET_MessageHeader *message,
          GCT_SendContinuation cont,
          void *cont_cls,
          struct GNUNET_CADET_ChannelTunnelNumber *ctn)
{
  struct CadetTunnelQueueEntry *tq;
  uint16_t payload_size;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CADET_TunnelEncryptedMessage *ax_msg;
  struct CadetChannel *ch;
 
  if (NULL != ctn)
  {
    ch = lookup_channel (t,
                         *ctn);
    if ((NULL != ch) && GCCH_is_type_to_drop (ch, message))
    {
      GNUNET_break (0);
      return NULL;
    }
  }
 
  if (CADET_TUNNEL_KEY_OK != t->estate)
  {
    GNUNET_break (0);
    return NULL;
  }
  payload_size = ntohs (message->size);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Encrypting %u bytes for %s\n",
       (unsigned int) payload_size,
       GCT_2s (t));
  env = GNUNET_MQ_msg_extra (ax_msg,
                             payload_size,
                             GNUNET_MESSAGE_TYPE_CADET_TUNNEL_ENCRYPTED);
  t_ax_encrypt (&t->ax,
                &ax_msg[1],
                message,
                payload_size);
  GNUNET_STATISTICS_update (stats,
                            "# encrypted bytes",
                            payload_size,
                            GNUNET_NO);
  ax_msg->ax_header.Ns = htonl (t->ax.Ns++);
  ax_msg->ax_header.PNs = htonl (t->ax.PNs);
  /* FIXME: we should do this once, not once per message;
     this is a point multiplication, and DHRs does not
     change all the time. */
  GNUNET_CRYPTO_ecdhe_key_get_public (&t->ax.DHRs,
                                      &ax_msg->ax_header.DHRs);
  t_h_encrypt (&t->ax,
               ax_msg);
  t_hmac (&ax_msg->ax_header,
          sizeof(struct GNUNET_CADET_AxHeader) + payload_size,
          0,
          &t->ax.HKs,
          &ax_msg->hmac);
 
  tq = GNUNET_malloc (sizeof(*tq));
  tq->t = t;
  tq->env = env;
  tq->cid = &ax_msg->cid; /* will initialize 'ax_msg->cid' once we know the connection */
  tq->cont = cont;
  tq->cont_cls = cont_cls;
  GNUNET_CONTAINER_DLL_insert_tail (t->tq_head,
                                    t->tq_tail,
                                    tq);
  if (NULL != t->send_task)
    GNUNET_SCHEDULER_cancel (t->send_task);
  t->send_task
    = GNUNET_SCHEDULER_add_now (&trigger_transmissions,
                                t);
  return tq;
}
 
 
void
GCT_send_cancel (struct CadetTunnelQueueEntry *tq)
{
  struct CadetTunnel *t = tq->t;
 
  GNUNET_CONTAINER_DLL_remove (t->tq_head,
                               t->tq_tail,
                               tq);
  GNUNET_MQ_discard (tq->env);
  GNUNET_free (tq);
}
 
 
void
GCT_iterate_connections (struct CadetTunnel *t,
                         GCT_ConnectionIterator iter,
                         void *iter_cls)
{
  struct CadetTConnection *n;
 
  for (struct CadetTConnection *ct = t->connection_ready_head;
       NULL != ct;
       ct = n)
  {
    n = ct->next;
    iter (iter_cls,
          ct);
  }
  for (struct CadetTConnection *ct = t->connection_busy_head;
       NULL != ct;
       ct = n)
  {
    n = ct->next;
    iter (iter_cls,
          ct);
  }
}
 
 
struct ChanIterCls
{
  GCT_ChannelIterator iter;
 
  void *iter_cls;
};
 
 
static int
iterate_channels_cb (void *cls,
                     uint32_t key,
                     void *value)
{
  struct ChanIterCls *ctx = cls;
  struct CadetChannel *ch = value;
 
  ctx->iter (ctx->iter_cls,
             ch);
  return GNUNET_OK;
}
 
 
void
GCT_iterate_channels (struct CadetTunnel *t,
                      GCT_ChannelIterator iter,
                      void *iter_cls)
{
  struct ChanIterCls ctx;
 
  ctx.iter = iter;
  ctx.iter_cls = iter_cls;
  GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                           &iterate_channels_cb,
                                           &ctx);
}
 
 
static int
debug_channel (void *cls,
               uint32_t key,
               void *value)
{
  const enum GNUNET_ErrorType *level = cls;
  struct CadetChannel *ch = value;
 
  GCCH_debug (ch, *level);
  return GNUNET_OK;
}
 
 
#define LOG2(level, ...) GNUNET_log_from_nocheck (level, "cadet-tun", \
                                                  __VA_ARGS__)
 
 
void
GCT_debug (const struct CadetTunnel *t,
           enum GNUNET_ErrorType level)
{
#if ! defined(GNUNET_CULL_LOGGING)
  struct CadetTConnection *iter_c;
  int do_log;
 
  do_log = GNUNET_get_log_call_status (level & (~GNUNET_ERROR_TYPE_BULK),
                                       "cadet-tun",
                                       __FILE__, __FUNCTION__, __LINE__);
  if (0 == do_log)
    return;
 
  LOG2 (level,
        "TTT TUNNEL TOWARDS %s in estate %s tq_len: %u #cons: %u\n",
        GCT_2s (t),
        estate2s (t->estate),
        t->tq_len,
        GCT_count_any_connections (t));
  LOG2 (level,
        "TTT channels:\n");
  GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                           &debug_channel,
                                           &level);
  LOG2 (level,
        "TTT connections:\n");
  for (iter_c = t->connection_ready_head; NULL != iter_c; iter_c = iter_c->next)
    GCC_debug (iter_c->cc,
               level);
  for (iter_c = t->connection_busy_head; NULL != iter_c; iter_c = iter_c->next)
    GCC_debug (iter_c->cc,
               level);
 
  LOG2 (level,
        "TTT TUNNEL END\n");
#endif
}
 
 
/* end of gnunet-service-cadet_tunnels.c */

INITIAL_KX_RETRY_DELAY

#define INITIAL_KX_RETRY_DELAY

Value:

          GNUNET_TIME_relative_multiply ( \
          GNUNET_TIME_UNIT_MILLISECONDS, 250)

How long do we wait initially before retransmitting the KX? TODO: replace by 2 RTT if/once we have connection-level RTT data!

Definition at line 66 of file gnunet-service-cadet_tunnels.c.

MAX_SKIPPED_KEYS

#define MAX_SKIPPED_KEYS   64

Maximum number of skipped keys we keep in memory per tunnel.

Definition at line 72 of file gnunet-service-cadet_tunnels.c.

MAX_KEY_GAP

#define MAX_KEY_GAP   256

Maximum number of keys (and thus ratchet steps) we are willing to skip before we decide this is either a bogus packet or a DoS-attempt.

Definition at line 78 of file gnunet-service-cadet_tunnels.c.

HIGH_BIT

#define HIGH_BIT   0x8000000

LOG2

#define LOG2	(		level,
			...
	)

Value:

                                                  GNUNET_log_from_nocheck (level, "cadet-tun", \
                                                  __VA_ARGS__)

Definition at line 3780 of file gnunet-service-cadet_tunnels.c.

Typedef Documentation

CadetTunnelAxolotlCallback

typedef void(* CadetTunnelAxolotlCallback) (void *cls, enum GNUNET_GenericReturnValue res)

Signature of the follow up function from an udate AX by KX.

Parameters

cls	closure
res	result

Definition at line 264 of file gnunet-service-cadet_tunnels.c.

Function Documentation

GCT_alice_or_betty()

int GCT_alice_or_betty

(

const struct GNUNET_PeerIdentity *

other

)

Am I Alice or Betty (some call her Bob), or talking to myself?

Parameters

other

the other peer

Returns

GNUNET_YES for Alice, GNUNET_NO for Betty, GNUNET_SYSERR if talking to myself

Definition at line 540 of file gnunet-service-cadet_tunnels.c.

{
  const struct GNUNET_PeerIdentity *my_identity;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  if (0 > GNUNET_memcmp (my_identity, other))
    return GNUNET_YES;
  else if (0 < GNUNET_memcmp (my_identity, other))
    return GNUNET_NO;
  else
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
}

References GNUNET_assert, GNUNET_break_op, GNUNET_memcmp, GNUNET_NO, GNUNET_PILS_get_identity(), GNUNET_SYSERR, GNUNET_YES, my_identity, and pils.

Referenced by GCT_handle_kx(), send_create(), send_kx(), and update_ax_by_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

mark_connection_unready()

static void mark_connection_unready ( struct CadetTConnection *  ct )

static

Connection ct is now unready, clear it's ready flag and move it from the ready DLL to the busy DLL.

Parameters

ct	connection to move to unready status

Definition at line 566 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = ct->t;
 
  GNUNET_assert (GNUNET_YES == ct->is_ready);
  GNUNET_CONTAINER_DLL_remove (t->connection_ready_head,
                               t->connection_ready_tail,
                               ct);
  GNUNET_assert (0 < t->num_ready_connections);
  t->num_ready_connections--;
  ct->is_ready = GNUNET_NO;
  GNUNET_CONTAINER_DLL_insert (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  t->num_busy_connections++;
}

References GNUNET_assert, GNUNET_CONTAINER_DLL_insert, GNUNET_CONTAINER_DLL_remove, GNUNET_NO, GNUNET_YES, CadetTConnection::is_ready, t, and CadetTConnection::t.

Referenced by connection_ready_cb(), send_kx(), send_kx_auth(), and try_send_normal_payload().

Here is the caller graph for this function:

GCT_2s()

const char * GCT_2s

(

const struct CadetTunnel *

t

)

Get the static string for the peer this tunnel is directed.

Parameters

t

Tunnel.

Returns

Static string the destination peer's ID.

Definition at line 592 of file gnunet-service-cadet_tunnels.c.

{
  static char buf[64];
 
  if (NULL == t)
    return "Tunnel(NULL)";
  GNUNET_snprintf (buf,
                   sizeof(buf),
                   "Tunnel %s",
                   GNUNET_i2s (GCP_get_id (t->destination)));
  return buf;
}

References GCP_get_id(), GNUNET_i2s(), GNUNET_snprintf(), and t.

Referenced by connection_ready_cb(), consider_path_cb(), cont_GCT_handle_kx(), cont_GCT_handle_kx_auth(), destroy_tunnel(), GCC_2s(), GCCH_bind(), GCCH_channel_local_new(), GCCH_debug(), GCP_drop_tunnel(), GCT_add_channel(), GCT_add_inbound_connection(), GCT_change_estate(), GCT_consider_path(), GCT_debug(), GCT_handle_encrypted(), GCT_handle_kx(), GCT_handle_kx_auth(), GCT_remove_channel(), GCT_send(), handle_plaintext_channel_destroy(), handle_plaintext_channel_open(), handle_plaintext_channel_open_ack(), handle_plaintext_keepalive(), maintain_connections_cb(), retry_kx(), send_keepalive(), send_kx(), send_kx_auth(), try_send_normal_payload(), and update_state().

Here is the call graph for this function:

Here is the caller graph for this function:

estate2s()

static const char * estate2s ( enum CadetTunnelEState  es )

static

Get string description for tunnel encryption state.

Parameters

es	Tunnel state.

Returns

String representation.

Definition at line 614 of file gnunet-service-cadet_tunnels.c.

{
  static char buf[32];
 
  switch (es)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
    return "CADET_TUNNEL_KEY_UNINITIALIZED";
  case CADET_TUNNEL_KEY_AX_RECV:
    return "CADET_TUNNEL_KEY_AX_RECV";
  case CADET_TUNNEL_KEY_AX_SENT:
    return "CADET_TUNNEL_KEY_AX_SENT";
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    return "CADET_TUNNEL_KEY_AX_SENT_AND_RECV";
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    return "CADET_TUNNEL_KEY_AX_AUTH_SENT";
  case CADET_TUNNEL_KEY_OK:
    return "CADET_TUNNEL_KEY_OK";
  }
  GNUNET_snprintf (buf,
                   sizeof(buf),
                   "%u (UNKNOWN STATE)",
                   es);
  return buf;
}

References CADET_TUNNEL_KEY_AX_AUTH_SENT, CADET_TUNNEL_KEY_AX_RECV, CADET_TUNNEL_KEY_AX_SENT, CADET_TUNNEL_KEY_AX_SENT_AND_RECV, CADET_TUNNEL_KEY_OK, CADET_TUNNEL_KEY_UNINITIALIZED, and GNUNET_snprintf().

Referenced by connection_ready_cb(), GCT_change_estate(), GCT_debug(), retry_kx(), and send_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_get_destination()

struct CadetPeer * GCT_get_destination

(

struct CadetTunnel *

t

)

Return the peer to which this tunnel goes.

Parameters

t

a tunnel

Returns

the destination of the tunnel

Definition at line 648 of file gnunet-service-cadet_tunnels.c.

{
  return t->destination;
}

References t.

Referenced by GCCH_2s(), GCCH_bind(), GCCH_channel_incoming_new(), get_next_free_ctn(), and timeout_closed_cb().

Here is the caller graph for this function:

GCT_count_channels()

unsigned int GCT_count_channels

(

struct CadetTunnel *

t

)

Returns the number of channels using a tunnel.

Parameters

t	Tunnel in question.

Returns

Number of channels using the tunnel.

Definition at line 655 of file gnunet-service-cadet_tunnels.c.

{
  return GNUNET_CONTAINER_multihashmap32_size (t->channels);
}

References GNUNET_CONTAINER_multihashmap32_size(), and t.

Referenced by connection_ready_cb(), destroy_tunnel(), GCT_destroy_tunnel_now(), GCT_remove_channel(), get_all_tunnels_iterator(), and retry_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

lookup_channel()

static struct CadetChannel * lookup_channel ( struct CadetTunnel *  t, struct GNUNET_CADET_ChannelTunnelNumber  ctn  )

static

Lookup a channel by its ctn.

Parameters

t	tunnel to look in
ctn	number of channel to find

Returns

NULL if channel does not exist

Definition at line 669 of file gnunet-service-cadet_tunnels.c.

{
  return GNUNET_CONTAINER_multihashmap32_get (t->channels,
                                              ntohl (ctn.cn));
}

References GNUNET_CADET_ChannelTunnelNumber::cn, CadetChannel::ctn, GNUNET_CONTAINER_multihashmap32_get(), and t.

Referenced by GCT_send(), handle_plaintext_channel_destroy(), handle_plaintext_channel_open_ack(), handle_plaintext_data(), and handle_plaintext_data_ack().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_count_any_connections()

unsigned int GCT_count_any_connections

(

const struct CadetTunnel *

t

)

Counts the number of connections created for a tunnel, including busy connections.

Parameters

t	Tunnel to be counted.

Returns

Number of connections created for the tunnel.

Definition at line 678 of file gnunet-service-cadet_tunnels.c.

{
  return t->num_ready_connections + t->num_busy_connections;
}

References t.

Referenced by consider_path_cb(), GCT_debug(), get_all_tunnels_iterator(), and maintain_connections_cb().

Here is the caller graph for this function:

get_ready_connection()

static struct CadetTConnection * get_ready_connection ( struct CadetTunnel *  t )

static

Find first connection that is ready in the list of our connections.

Picks ready connections round-robin.

Parameters

t	tunnel to search

Returns

NULL if we have no connection that is ready

Definition at line 692 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTConnection *hd = t->connection_ready_head;
 
  GNUNET_assert ((NULL == hd) ||
                 (GNUNET_YES == hd->is_ready));
  return hd;
}

References GNUNET_assert, GNUNET_YES, CadetTConnection::is_ready, and t.

Referenced by send_kx(), send_kx_auth(), and trigger_transmissions().

Here is the caller graph for this function:

GCT_get_estate()

enum CadetTunnelEState GCT_get_estate

(

struct CadetTunnel *

t

)

Get the encryption state of a tunnel.

Parameters

t

Tunnel.

Returns

Tunnel's encryption state.

Definition at line 710 of file gnunet-service-cadet_tunnels.c.

{
  return t->estate;
}

References t.

Referenced by get_all_tunnels_iterator(), handle_connection_create(), send_create(), and send_keepalive().

Here is the caller graph for this function:

trigger_transmissions()

static void trigger_transmissions ( void *  cls )

static

Called when either we have a new connection, or a new message in the queue, or some existing connection has transmission capacity.

Looks at our message queue and if there is a message, picks a connection to send it on.

Parameters

cls	the struct CadetTunnel to process messages on

Definition at line 2653 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetTConnection *ct;
 
  t->send_task = NULL;
  if (NULL == t->tq_head)
    return; /* no messages pending right now */
  ct = get_ready_connection (t);
  if (NULL == ct)
    return; /* no connections ready */
  try_send_normal_payload (t,
                           ct);
}

References get_ready_connection(), t, and try_send_normal_payload().

Referenced by GCT_change_estate(), GCT_handle_encrypted(), and GCT_send().

Here is the call graph for this function:

Here is the caller graph for this function:

new_ephemeral()

static void new_ephemeral ( struct CadetTunnelAxolotl *  ax )

static

Create a new Axolotl ephemeral (ratchet) key.

Parameters

ax	key material to update

Definition at line 737 of file gnunet-service-cadet_tunnels.c.

{
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Creating new ephemeral ratchet key (DHRs)\n");
  GNUNET_CRYPTO_ecdhe_key_create (&ax->DHRs);
}

References CadetTunnelAxolotl::DHRs, GNUNET_CRYPTO_ecdhe_key_create(), GNUNET_ERROR_TYPE_DEBUG, and LOG.

Referenced by GCT_create_tunnel(), and t_ax_encrypt().

Here is the call graph for this function:

Here is the caller graph for this function:

t_hmac()

static void t_hmac ( const void *  plaintext, size_t  size, uint32_t  iv, const struct GNUNET_CRYPTO_SymmetricSessionKey *  key, struct GNUNET_ShortHashCode *  hmac  )

static

Calculate HMAC.

Parameters

	plaintext	Content to HMAC.
	size	Size of plaintext.
	iv	Initialization vector for the message.
	key	Key to use.
[out]	hmac	Destination to store the HMAC.

Definition at line 755 of file gnunet-service-cadet_tunnels.c.

{
  static const char ctx[] = "cadet authentication key";
  struct GNUNET_CRYPTO_AuthKey auth_key;
  struct GNUNET_HashCode hash;
 
  // FIXME now that we directly invoke HKDF instead of a
  // thin wrapper we can clearly see the sillyness of adding
  // the key parameter twice...
  GNUNET_CRYPTO_hkdf_gnunet (
    &auth_key,
    sizeof auth_key,
    &iv,
    sizeof(iv),
    key,
    sizeof(*key),
    GNUNET_CRYPTO_kdf_arg_auto (key),
    GNUNET_CRYPTO_kdf_arg_string (ctx));
  /* Two step: GNUNET_ShortHash is only 256 bits,
     GNUNET_HashCode is 512, so we truncate. */
  GNUNET_CRYPTO_hmac (&auth_key,
                      plaintext,
                      size,
                      &hash);
  GNUNET_memcpy (hmac,
                 &hash,
                 sizeof(*hmac));
}

References ctx, GNUNET_CRYPTO_hkdf_gnunet, GNUNET_CRYPTO_hmac(), GNUNET_CRYPTO_kdf_arg_auto, GNUNET_CRYPTO_kdf_arg_string, GNUNET_memcpy, key, and size.

Referenced by GCT_send(), t_ax_decrypt_and_validate(), and try_old_ax_keys().

Here is the call graph for this function:

Here is the caller graph for this function:

t_ax_hmac_hash()

static void t_ax_hmac_hash ( const struct GNUNET_CRYPTO_SymmetricSessionKey *  key, struct GNUNET_HashCode *  hash, const void *  source, unsigned int  len  )

static

Perform a HMAC.

Parameters

	key	Key to use.
[out]	hash	Resulting HMAC.
	source	Source key material (data to HMAC).
	len	Length of source.

Definition at line 798 of file gnunet-service-cadet_tunnels.c.

{
  static const char ctx[] = "axolotl HMAC-HASH";
  struct GNUNET_CRYPTO_AuthKey auth_key;
 
  GNUNET_CRYPTO_hkdf_gnunet (
    &auth_key,
    sizeof auth_key,
    ctx,
    sizeof(ctx),
    key,
    sizeof *key);
  GNUNET_CRYPTO_hmac (&auth_key,
                      source,
                      len,
                      hash);
}

References ctx, GNUNET_CRYPTO_hkdf_gnunet, GNUNET_CRYPTO_hmac(), key, and source.

Referenced by t_ax_decrypt_and_validate(), t_ax_encrypt(), and t_hmac_derive_key().

Here is the call graph for this function:

Here is the caller graph for this function:

t_hmac_derive_key()

static void t_hmac_derive_key ( const struct GNUNET_CRYPTO_SymmetricSessionKey *  key, struct GNUNET_CRYPTO_SymmetricSessionKey *  out, const void *  source, unsigned int  len  )

static

Derive a symmetric encryption key from an HMAC-HASH.

Parameters

	key	Key to use for the HMAC.
[out]	out	Key to generate.
	source	Source key material (data to HMAC).
	len	Length of source.

Definition at line 829 of file gnunet-service-cadet_tunnels.c.

{
  static const char ctx[] = "axolotl derive key";
  struct GNUNET_HashCode h;
 
  t_ax_hmac_hash (key,
                  &h,
                  source,
                  len);
  GNUNET_CRYPTO_hkdf_gnunet (
    out, sizeof(*out),
    ctx, sizeof(ctx),
    &h, sizeof(h));
}

References ctx, GNUNET_CRYPTO_hkdf_gnunet, h, key, source, and t_ax_hmac_hash().

Referenced by store_skipped_key(), t_ax_decrypt(), and t_ax_encrypt().

Here is the call graph for this function:

Here is the caller graph for this function:

t_ax_encrypt()

static void t_ax_encrypt ( struct CadetTunnelAxolotl *  ax, void *  dst, const void *  src, size_t  size  )

static

Encrypt data with the axolotl tunnel key.

Parameters

ax	key material to use.
dst	Destination with size bytes for the encrypted data.
src	Source of the plaintext. Can overlap with dst, must contain size bytes
size	Size of the buffers at src and dst

Definition at line 857 of file gnunet-service-cadet_tunnels.c.

{
  struct GNUNET_CRYPTO_SymmetricSessionKey MK;
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  size_t out_size;
 
  ax->ratchet_counter++;
  if ((GNUNET_YES == ax->ratchet_allowed) &&
      ((ratchet_messages <= ax->ratchet_counter) ||
       (0 == GNUNET_TIME_absolute_get_remaining (
          ax->ratchet_expiration).rel_value_us)))
  {
    ax->ratchet_flag = GNUNET_YES;
  }
  if (GNUNET_YES == ax->ratchet_flag)
  {
    /* Advance ratchet */
    struct GNUNET_CRYPTO_SymmetricSessionKey keys[3];
    struct GNUNET_HashCode dh;
    struct GNUNET_HashCode hmac;
    static const char ctx[] = "axolotl ratchet";
 
    new_ephemeral (ax);
    ax->HKs = ax->NHKs;
 
    /* RK, NHKs, CKs = KDF( HMAC-HASH(RK, DH(DHRs, DHRr)) ) */
    GNUNET_CRYPTO_ecc_ecdh (&ax->DHRs,
                            &ax->DHRr,
                            &dh);
    t_ax_hmac_hash (&ax->RK,
                    &hmac,
                    &dh,
                    sizeof(dh));
    GNUNET_CRYPTO_hkdf_gnunet (
      keys, sizeof(keys),
      ctx, sizeof(ctx),
      &hmac, sizeof(hmac));
    ax->RK = keys[0];
    ax->NHKs = keys[1];
    ax->CKs = keys[2];
 
    ax->PNs = ax->Ns;
    ax->Ns = 0;
    ax->ratchet_flag = GNUNET_NO;
    ax->ratchet_allowed = GNUNET_NO;
    ax->ratchet_counter = 0;
    ax->ratchet_expiration
      = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (),
                                  ratchet_time);
  }
 
  t_hmac_derive_key (&ax->CKs,
                     &MK,
                     "0",
                     1);
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &MK,
                             sizeof MK);
 
  out_size = GNUNET_CRYPTO_symmetric_encrypt (src,
                                              size,
                                              &MK,
                                              &iv,
                                              dst);
  GNUNET_assert (size == out_size);
  t_hmac_derive_key (&ax->CKs,
                     &ax->CKs,
                     "1",
                     1);
}

References CadetTunnelAxolotl::CKs, ctx, CadetTunnelAxolotl::DHRr, CadetTunnelAxolotl::DHRs, GNUNET_assert, GNUNET_CRYPTO_ecc_ecdh(), GNUNET_CRYPTO_hkdf_gnunet, GNUNET_CRYPTO_symmetric_encrypt(), GNUNET_NO, GNUNET_TIME_absolute_add(), GNUNET_TIME_absolute_get(), GNUNET_TIME_absolute_get_remaining(), GNUNET_YES, CadetTunnelAxolotl::HKs, new_ephemeral(), CadetTunnelAxolotl::NHKs, CadetTunnelAxolotl::Ns, CadetTunnelAxolotl::PNs, CadetTunnelAxolotl::ratchet_allowed, CadetTunnelAxolotl::ratchet_counter, CadetTunnelAxolotl::ratchet_expiration, CadetTunnelAxolotl::ratchet_flag, ratchet_time, GNUNET_TIME_Relative::rel_value_us, CadetTunnelAxolotl::RK, size, t_ax_hmac_hash(), and t_hmac_derive_key().

Referenced by GCT_send().

Here is the call graph for this function:

Here is the caller graph for this function:

t_ax_decrypt()

static void t_ax_decrypt ( struct CadetTunnelAxolotl *  ax, void *  dst, const void *  src, size_t  size  )

static

Decrypt data with the axolotl tunnel key.

Parameters

ax	key material to use.
dst	Destination for the decrypted data, must contain size bytes.
src	Source of the ciphertext. Can overlap with dst, must contain size bytes.
size	Size of the src and dst buffers

Definition at line 945 of file gnunet-service-cadet_tunnels.c.

{
  struct GNUNET_CRYPTO_SymmetricSessionKey MK;
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  size_t out_size;
 
  t_hmac_derive_key (&ax->CKr,
                     &MK,
                     "0",
                     1);
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &MK,
                             sizeof MK);
  GNUNET_assert (size >= sizeof(struct GNUNET_MessageHeader));
  out_size = GNUNET_CRYPTO_symmetric_decrypt (src,
                                              size,
                                              &MK,
                                              &iv,
                                              dst);
  GNUNET_assert (out_size == size);
  t_hmac_derive_key (&ax->CKr,
                     &ax->CKr,
                     "1",
                     1);
}

References CadetTunnelAxolotl::CKr, GNUNET_assert, GNUNET_CRYPTO_hkdf_gnunet, GNUNET_CRYPTO_symmetric_decrypt(), size, and t_hmac_derive_key().

Referenced by t_ax_decrypt_and_validate().

Here is the call graph for this function:

Here is the caller graph for this function:

t_h_encrypt()

static void t_h_encrypt ( struct CadetTunnelAxolotl *  ax, struct GNUNET_CADET_TunnelEncryptedMessage *  msg  )

static

Encrypt header with the axolotl header key.

Parameters

	ax	key material to use.
[in,out]	msg	Message whose header to encrypt.

Definition at line 986 of file gnunet-service-cadet_tunnels.c.

{
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  size_t out_size;
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &ax->HKs,
                             sizeof ax->HKs);
  out_size = GNUNET_CRYPTO_symmetric_encrypt (&msg->ax_header,
                                              sizeof(struct
                                                     GNUNET_CADET_AxHeader),
                                              &ax->HKs,
                                              &iv,
                                              &msg->ax_header);
  GNUNET_assert (sizeof(struct GNUNET_CADET_AxHeader) == out_size);
}

References GNUNET_assert, GNUNET_CRYPTO_hkdf_gnunet, GNUNET_CRYPTO_symmetric_encrypt(), CadetTunnelAxolotl::HKs, and msg.

Referenced by GCT_send().

Here is the call graph for this function:

Here is the caller graph for this function:

t_h_decrypt()

static void t_h_decrypt ( struct CadetTunnelAxolotl *  ax, const struct GNUNET_CADET_TunnelEncryptedMessage *  src, struct GNUNET_CADET_TunnelEncryptedMessage *  dst  )

static

Decrypt header with the current axolotl header key.

Parameters

ax	key material to use.
src	Message whose header to decrypt.
dst	Where to decrypt header to.

Definition at line 1016 of file gnunet-service-cadet_tunnels.c.

{
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  size_t out_size;
 
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &ax->HKr,
                             sizeof ax->HKr);
 
 
  out_size = GNUNET_CRYPTO_symmetric_decrypt (&src->ax_header.Ns,
                                              sizeof(struct
                                                     GNUNET_CADET_AxHeader),
                                              &ax->HKr,
                                              &iv,
                                              &dst->ax_header.Ns);
  GNUNET_assert (sizeof(struct GNUNET_CADET_AxHeader) == out_size);
}

References GNUNET_CADET_TunnelEncryptedMessage::ax_header, GNUNET_assert, GNUNET_CRYPTO_hkdf_gnunet, GNUNET_CRYPTO_symmetric_decrypt(), CadetTunnelAxolotl::HKr, and GNUNET_CADET_AxHeader::Ns.

Referenced by t_ax_decrypt_and_validate().

Here is the call graph for this function:

Here is the caller graph for this function:

delete_skipped_key()

static void delete_skipped_key ( struct CadetTunnelAxolotl *  ax, struct CadetTunnelSkippedKey *  key  )

static

Delete a key from the list of skipped keys.

Parameters

ax	key material to delete key from.
key	Key to delete.

Definition at line 1048 of file gnunet-service-cadet_tunnels.c.

{
  GNUNET_CONTAINER_DLL_remove (ax->skipped_head,
                               ax->skipped_tail,
                               key);
  GNUNET_free (key);
  ax->skipped--;
}

References GNUNET_CONTAINER_DLL_remove, GNUNET_free, key, CadetTunnelAxolotl::skipped, CadetTunnelAxolotl::skipped_head, and CadetTunnelAxolotl::skipped_tail.

Referenced by cleanup_ax(), store_ax_keys(), and try_old_ax_keys().

Here is the caller graph for this function:

try_old_ax_keys()

static ssize_t try_old_ax_keys ( struct CadetTunnelAxolotl *  ax, void *  dst, const struct GNUNET_CADET_TunnelEncryptedMessage *  src, size_t  size  )

static

Decrypt and verify data with the appropriate tunnel key and verify that the data has not been altered since it was sent by the remote peer.

Parameters

ax	key material to use.
dst	Destination for the plaintext.
src	Source of the message. Can overlap with dst.
size	Size of the message.

Returns

Size of the decrypted data, -1 if an error was encountered.

Definition at line 1070 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnelSkippedKey *key;
  struct GNUNET_ShortHashCode *hmac;
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  struct GNUNET_CADET_TunnelEncryptedMessage plaintext_header;
  struct GNUNET_CRYPTO_SymmetricSessionKey *valid_HK;
  size_t esize;
  size_t res;
  size_t len;
  unsigned int N;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Trying skipped keys\n");
  hmac = &plaintext_header.hmac;
  esize = size - sizeof(struct GNUNET_CADET_TunnelEncryptedMessage);
 
  /* Find a correct Header Key */
  valid_HK = NULL;
  for (key = ax->skipped_head; NULL != key; key = key->next)
  {
    t_hmac (&src->ax_header,
            sizeof(struct GNUNET_CADET_AxHeader) + esize,
            0,
            &key->HK,
            hmac);
    if (0 == GNUNET_memcmp (hmac,
                            &src->hmac))
    {
      valid_HK = &key->HK;
      break;
    }
  }
  if (NULL == key)
    return -1;
 
  /* Should've been checked in -cadet_connection.c handle_cadet_encrypted. */
  GNUNET_assert (size > sizeof(struct GNUNET_CADET_TunnelEncryptedMessage));
  len = size - sizeof(struct GNUNET_CADET_TunnelEncryptedMessage);
  GNUNET_assert (len >= sizeof(struct GNUNET_MessageHeader));
 
  /* Decrypt header */
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &key->HK,
                             sizeof key->HK);
 
  res = GNUNET_CRYPTO_symmetric_decrypt (&src->ax_header.Ns,
                                         sizeof(struct GNUNET_CADET_AxHeader),
                                         &key->HK,
                                         &iv,
                                         &plaintext_header.ax_header.Ns);
  GNUNET_assert (sizeof(struct GNUNET_CADET_AxHeader) == res);
 
  /* Find the correct message key */
  N = ntohl (plaintext_header.ax_header.Ns);
  while ((NULL != key) &&
         (N != key->Kn))
    key = key->next;
  if ((NULL == key) ||
      (0 != GNUNET_memcmp (&key->HK,
                           valid_HK)))
    return -1;
 
  /* Decrypt payload */
  GNUNET_CRYPTO_hkdf_gnunet (&iv,
                             sizeof iv,
                             NULL,
                             0,
                             &key->MK,
                             sizeof key->MK);
 
  res = GNUNET_CRYPTO_symmetric_decrypt (&src[1],
                                         len,
                                         &key->MK,
                                         &iv,
                                         dst);
  delete_skipped_key (ax,
                      key);
  return res;
}

References GNUNET_CADET_TunnelEncryptedMessage::ax_header, delete_skipped_key(), GNUNET_assert, GNUNET_CRYPTO_hkdf_gnunet, GNUNET_CRYPTO_symmetric_decrypt(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_memcmp, GNUNET_CADET_TunnelEncryptedMessage::hmac, key, LOG, N, GNUNET_CADET_AxHeader::Ns, res, size, CadetTunnelAxolotl::skipped_head, and t_hmac().

Referenced by t_ax_decrypt_and_validate().

Here is the call graph for this function:

Here is the caller graph for this function:

store_skipped_key()

static void store_skipped_key ( struct CadetTunnelAxolotl *  ax, const struct GNUNET_CRYPTO_SymmetricSessionKey *  HKr  )

static

Delete a key from the list of skipped keys.

Parameters

ax	key material to delete from.
HKr	Header Key to use.

Definition at line 1165 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnelSkippedKey *key;
 
  key = GNUNET_new (struct CadetTunnelSkippedKey);
  key->timestamp = GNUNET_TIME_absolute_get ();
  key->Kn = ax->Nr;
  key->HK = ax->HKr;
  t_hmac_derive_key (&ax->CKr,
                     &key->MK,
                     "0",
                     1);
  t_hmac_derive_key (&ax->CKr,
                     &ax->CKr,
                     "1",
                     1);
  GNUNET_CONTAINER_DLL_insert (ax->skipped_head,
                               ax->skipped_tail,
                               key);
  ax->skipped++;
  ax->Nr++;
}

References CadetTunnelAxolotl::CKr, GNUNET_CONTAINER_DLL_insert, GNUNET_new, GNUNET_TIME_absolute_get(), CadetTunnelAxolotl::HKr, key, CadetTunnelAxolotl::Nr, CadetTunnelAxolotl::skipped, CadetTunnelAxolotl::skipped_head, CadetTunnelAxolotl::skipped_tail, and t_hmac_derive_key().

Referenced by store_ax_keys().

Here is the call graph for this function:

Here is the caller graph for this function:

store_ax_keys()

static int store_ax_keys ( struct CadetTunnelAxolotl *  ax, const struct GNUNET_CRYPTO_SymmetricSessionKey *  HKr, uint32_t  Np  )

static

Stage skipped AX keys and calculate the message key.

Stores each HK and MK for skipped messages.

Parameters

ax	key material to use
HKr	Header key.
Np	Received message number.

Returns

GNUNET_OK if keys were stored. GNUNET_SYSERR if an error occurred (Np not expected).

Definition at line 1201 of file gnunet-service-cadet_tunnels.c.

{
  int gap;
 
  gap = Np - ax->Nr;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Storing skipped keys [%u, %u)\n",
       ax->Nr,
       Np);
  if (MAX_KEY_GAP < gap)
  {
    /* Avoid DoS (forcing peer to do more than #MAX_KEY_GAP HMAC operations) */
    /* TODO: start new key exchange on return */
    GNUNET_break_op (0);
    LOG (GNUNET_ERROR_TYPE_WARNING,
         "Got message %u, expected %u+\n",
         Np,
         ax->Nr);
    return GNUNET_SYSERR;
  }
  if (0 > gap)
  {
    /* Delayed message: don't store keys, flag to try old keys. */
    return GNUNET_SYSERR;
  }
 
  while (ax->Nr < Np)
    store_skipped_key (ax,
                       HKr);
 
  while (ax->skipped > MAX_SKIPPED_KEYS)
    delete_skipped_key (ax,
                        ax->skipped_tail);
  return GNUNET_OK;
}

References delete_skipped_key(), GNUNET_break_op, GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_WARNING, GNUNET_OK, GNUNET_SYSERR, LOG, MAX_KEY_GAP, MAX_SKIPPED_KEYS, CadetTunnelAxolotl::Nr, CadetTunnelAxolotl::skipped, CadetTunnelAxolotl::skipped_tail, and store_skipped_key().

Referenced by t_ax_decrypt_and_validate().

Here is the call graph for this function:

Here is the caller graph for this function:

t_ax_decrypt_and_validate()

static ssize_t t_ax_decrypt_and_validate ( struct CadetTunnelAxolotl *  ax, void *  dst, const struct GNUNET_CADET_TunnelEncryptedMessage *  src, size_t  size  )

static

Decrypt and verify data with the appropriate tunnel key and verify that the data has not been altered since it was sent by the remote peer.

Parameters

ax	key material to use
dst	Destination for the plaintext.
src	Source of the message. Can overlap with dst.
size	Size of the message.

Returns

Size of the decrypted data, -1 if an error was encountered.

Definition at line 1251 of file gnunet-service-cadet_tunnels.c.

{
  struct GNUNET_ShortHashCode msg_hmac;
  struct GNUNET_HashCode hmac;
  struct GNUNET_CADET_TunnelEncryptedMessage plaintext_header;
  uint32_t Np;
  uint32_t PNp;
  size_t esize; /* Size of encrypted payload */
 
  esize = size - sizeof(struct GNUNET_CADET_TunnelEncryptedMessage);
 
  /* Try current HK */
  t_hmac (&src->ax_header,
          sizeof(struct GNUNET_CADET_AxHeader) + esize,
          0, &ax->HKr,
          &msg_hmac);
  if (0 != GNUNET_memcmp (&msg_hmac,
                          &src->hmac))
  {
    static const char ctx[] = "axolotl ratchet";
    struct GNUNET_CRYPTO_SymmetricSessionKey keys[3];   /* RKp, NHKp, CKp */
    struct GNUNET_CRYPTO_SymmetricSessionKey HK;
    struct GNUNET_HashCode dh;
    struct GNUNET_CRYPTO_EcdhePublicKey *DHRp;
 
    /* Try Next HK */
    t_hmac (&src->ax_header,
            sizeof(struct GNUNET_CADET_AxHeader) + esize,
            0,
            &ax->NHKr,
            &msg_hmac);
    if (0 != GNUNET_memcmp (&msg_hmac,
                            &src->hmac))
    {
      /* Try the skipped keys, if that fails, we're out of luck. */
      return try_old_ax_keys (ax,
                              dst,
                              src,
                              size);
    }
    HK = ax->HKr;
    ax->HKr = ax->NHKr;
    t_h_decrypt (ax,
                 src,
                 &plaintext_header);
    Np = ntohl (plaintext_header.ax_header.Ns);
    PNp = ntohl (plaintext_header.ax_header.PNs);
    DHRp = &plaintext_header.ax_header.DHRs;
    store_ax_keys (ax,
                   &HK,
                   PNp);
 
    /* RKp, NHKp, CKp = KDF (HMAC-HASH (RK, DH (DHRp, DHRs))) */
    GNUNET_CRYPTO_ecc_ecdh (&ax->DHRs,
                            DHRp,
                            &dh);
    t_ax_hmac_hash (&ax->RK,
                    &hmac,
                    &dh, sizeof(dh));
    GNUNET_CRYPTO_hkdf_gnunet (
      keys, sizeof(keys),
      ctx, sizeof(ctx),
      &hmac, sizeof(hmac));
 
    /* Commit "purported" keys */
    ax->RK = keys[0];
    ax->NHKr = keys[1];
    ax->CKr = keys[2];
    ax->DHRr = *DHRp;
    ax->Nr = 0;
    ax->ratchet_allowed = GNUNET_YES;
  }
  else
  {
    t_h_decrypt (ax,
                 src,
                 &plaintext_header);
    Np = ntohl (plaintext_header.ax_header.Ns);
    PNp = ntohl (plaintext_header.ax_header.PNs);
  }
  if ((Np != ax->Nr) &&
      (GNUNET_OK != store_ax_keys (ax,
                                   &ax->HKr,
                                   Np)))
  {
    /* Try the skipped keys, if that fails, we're out of luck. */
    return try_old_ax_keys (ax,
                            dst,
                            src,
                            size);
  }
 
  t_ax_decrypt (ax,
                dst,
                &src[1],
                esize);
  ax->Nr = Np + 1;
  return esize;
}

References GNUNET_CADET_TunnelEncryptedMessage::ax_header, CadetTunnelAxolotl::CKr, ctx, CadetTunnelAxolotl::DHRr, GNUNET_CADET_AxHeader::DHRs, CadetTunnelAxolotl::DHRs, GNUNET_CRYPTO_ecc_ecdh(), GNUNET_CRYPTO_hkdf_gnunet, GNUNET_memcmp, GNUNET_OK, GNUNET_YES, CadetTunnelAxolotl::HKr, GNUNET_CADET_TunnelEncryptedMessage::hmac, CadetTunnelAxolotl::NHKr, CadetTunnelAxolotl::Nr, GNUNET_CADET_AxHeader::Ns, GNUNET_CADET_AxHeader::PNs, CadetTunnelAxolotl::ratchet_allowed, CadetTunnelAxolotl::RK, size, store_ax_keys(), t_ax_decrypt(), t_ax_hmac_hash(), t_h_decrypt(), t_hmac(), and try_old_ax_keys().

Referenced by GCT_handle_encrypted().

Here is the call graph for this function:

Here is the caller graph for this function:

notify_tunnel_up_cb()

static int notify_tunnel_up_cb ( void *  cls, uint32_t  key, void *  value  )

static

Our tunnel became ready for the first time, notify channels that have been waiting.

Parameters

cls	our tunnel, not used
key	unique ID of the channel, not used
value	the struct CadetChannel to notify

Returns

GNUNET_OK (continue to iterate)

Definition at line 1366 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetChannel *ch = value;
 
  GCCH_tunnel_up (ch);
  return GNUNET_OK;
}

References ch, GCCH_tunnel_up(), GNUNET_OK, and value.

Referenced by GCT_change_estate().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_change_estate()

void GCT_change_estate	(	struct CadetTunnel *	t,
		enum CadetTunnelEState	state
	)

Change the tunnel encryption state.

If the encryption state changes to OK, stop the rekey task.

Parameters

t	Tunnel whose encryption state to change, or NULL.
state	New encryption state.

Definition at line 1385 of file gnunet-service-cadet_tunnels.c.

{
  enum CadetTunnelEState old = t->estate;
 
  t->estate = state;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s estate changed from %s to %s\n",
       GCT_2s (t),
       estate2s (old),
       estate2s (state));
 
  if ((CADET_TUNNEL_KEY_OK != old) &&
      (CADET_TUNNEL_KEY_OK == t->estate))
  {
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    /* notify all channels that have been waiting */
    GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                             &notify_tunnel_up_cb,
                                             t);
    if (NULL != t->send_task)
      GNUNET_SCHEDULER_cancel (t->send_task);
    t->send_task = GNUNET_SCHEDULER_add_now (&trigger_transmissions,
                                             t);
  }
}

References CADET_TUNNEL_KEY_OK, estate2s(), GCT_2s(), GNUNET_CONTAINER_multihashmap32_iterate(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_SCHEDULER_add_now(), GNUNET_SCHEDULER_cancel(), LOG, notify_tunnel_up_cb(), state, t, and trigger_transmissions().

Referenced by cont_GCT_handle_kx(), cont_GCT_handle_kx_auth(), GCT_handle_encrypted(), handle_connection_create(), send_kx(), and send_kx_auth().

Here is the call graph for this function:

Here is the caller graph for this function:

send_kx()

static void send_kx ( struct CadetTunnel *  t, struct CadetTConnection *  ct, struct CadetTunnelAxolotl *  ax  )

static

Send a KX message.

Parameters

t	tunnel on which to send the KX_AUTH
ct	Tunnel and connection on which to send the KX_AUTH, NULL if we are to find one that is ready.
ax	axolotl key context to use

Definition at line 1426 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetConnection *cc;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CADET_TunnelKeyExchangeMessage *msg;
  enum GNUNET_CADET_KX_Flags flags;
 
  if (GNUNET_YES != GCT_alice_or_betty (GCP_get_id (t->destination)))
    return; /* only Alice may send KX */
  if ((NULL == ct) ||
      (GNUNET_NO == ct->is_ready))
    ct = get_ready_connection (t);
  if (NULL == ct)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Wanted to send %s in state %s, but no connection is ready, deferring\n",
         GCT_2s (t),
         estate2s (t->estate));
    t->next_kx_attempt = GNUNET_TIME_absolute_get ();
    return;
  }
  cc = ct->cc;
  env = GNUNET_MQ_msg (msg,
                       GNUNET_MESSAGE_TYPE_CADET_TUNNEL_KX);
  flags = GNUNET_CADET_KX_FLAG_FORCE_REPLY; /* always for KX */
  msg->flags = htonl (flags);
  msg->cid = *GCC_get_id (cc);
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->kx_0,
                                      &msg->ephemeral_key);
#if DEBUG_KX
  msg->ephemeral_key_XXX = ax->kx_0;
#endif
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending KX message to %s with ephemeral %s on CID %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->ephemeral_key),
       GNUNET_sh2s (&msg->cid.connection_of_tunnel));
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->DHRs,
                                      &msg->ratchet_key);
  mark_connection_unready (ct);
  t->kx_retry_delay = GNUNET_TIME_STD_BACKOFF (t->kx_retry_delay);
  t->next_kx_attempt = GNUNET_TIME_relative_to_absolute (t->kx_retry_delay);
  if (CADET_TUNNEL_KEY_UNINITIALIZED == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_SENT);
  else if (CADET_TUNNEL_KEY_AX_RECV == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_SENT_AND_RECV);
  GCC_transmit (cc,
                env);
  GNUNET_STATISTICS_update (stats,
                            "# KX transmitted",
                            1,
                            GNUNET_NO);
}

References CADET_TUNNEL_KEY_AX_RECV, CADET_TUNNEL_KEY_AX_SENT, CADET_TUNNEL_KEY_AX_SENT_AND_RECV, CADET_TUNNEL_KEY_UNINITIALIZED, CadetTConnection::cc, CadetTunnelAxolotl::DHRs, env, estate2s(), GNUNET_CADET_TunnelKeyExchangeMessage::flags, GCC_get_id(), GCC_transmit(), GCP_get_id(), GCT_2s(), GCT_alice_or_betty(), GCT_change_estate(), get_ready_connection(), GNUNET_CADET_KX_FLAG_FORCE_REPLY, GNUNET_CRYPTO_ecdhe_key_get_public(), GNUNET_e2s(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_MESSAGE_TYPE_CADET_TUNNEL_KX, GNUNET_MQ_msg, GNUNET_NO, GNUNET_sh2s(), GNUNET_STATISTICS_update(), GNUNET_TIME_absolute_get(), GNUNET_TIME_relative_to_absolute(), GNUNET_TIME_STD_BACKOFF, GNUNET_YES, CadetTConnection::is_ready, CadetTunnelAxolotl::kx_0, LOG, mark_connection_unready(), msg, stats, and t.

Referenced by connection_ready_cb(), GCT_handle_encrypted(), and retry_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

send_kx_auth()

static void send_kx_auth ( struct CadetTunnel *  t, struct CadetTConnection *  ct, struct CadetTunnelAxolotl *  ax, int  force_reply  )

static

Send a KX_AUTH message.

Parameters

t	tunnel on which to send the KX_AUTH
ct	Tunnel and connection on which to send the KX_AUTH, NULL if we are to find one that is ready.
ax	axolotl key context to use
force_reply	Force the other peer to reply with a KX_AUTH message (set if we would like to transmit right now, but cannot)

Definition at line 1496 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetConnection *cc;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CADET_TunnelKeyExchangeAuthMessage *msg;
  enum GNUNET_CADET_KX_Flags flags;
 
  if ((NULL == ct) ||
      (GNUNET_NO == ct->is_ready))
    ct = get_ready_connection (t);
  if (NULL == ct)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Wanted to send KX_AUTH on %s, but no connection is ready, deferring\n",
         GCT_2s (t));
    t->next_kx_attempt = GNUNET_TIME_absolute_get ();
    t->kx_auth_requested = GNUNET_YES;   /* queue KX_AUTH independent of estate */
    return;
  }
  t->kx_auth_requested = GNUNET_NO; /* clear flag */
  cc = ct->cc;
  env = GNUNET_MQ_msg (msg,
                       GNUNET_MESSAGE_TYPE_CADET_TUNNEL_KX_AUTH);
  flags = GNUNET_CADET_KX_FLAG_NONE;
  if (GNUNET_YES == force_reply)
    flags |= GNUNET_CADET_KX_FLAG_FORCE_REPLY;
  msg->kx.flags = htonl (flags);
  msg->kx.cid = *GCC_get_id (cc);
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->kx_0,
                                      &msg->kx.ephemeral_key);
  GNUNET_CRYPTO_ecdhe_key_get_public (&ax->DHRs,
                                      &msg->kx.ratchet_key);
#if DEBUG_KX
  msg->kx.ephemeral_key_XXX = ax->kx_0;
  msg->r_ephemeral_key_XXX = ax->last_ephemeral;
#endif
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending KX_AUTH message to %s with ephemeral %s on CID %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->kx.ephemeral_key),
       GNUNET_sh2s (&msg->kx.cid.connection_of_tunnel));
 
  /* Compute authenticator (this is the main difference to #send_kx()) */
  GNUNET_CRYPTO_hash (&ax->RK,
                      sizeof(ax->RK),
                      &msg->auth);
  /* Compute when to be triggered again; actual job will
     be scheduled via #connection_ready_cb() */
  t->kx_retry_delay
    = GNUNET_TIME_STD_BACKOFF (t->kx_retry_delay);
  t->next_kx_attempt
    = GNUNET_TIME_relative_to_absolute (t->kx_retry_delay);
 
  /* Send via cc, mark it as unready */
  mark_connection_unready (ct);
 
  /* Update state machine, unless we are already OK */
  if (CADET_TUNNEL_KEY_OK != t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_AUTH_SENT);
  GCC_transmit (cc,
                env);
  GNUNET_STATISTICS_update (stats,
                            "# KX_AUTH transmitted",
                            1,
                            GNUNET_NO);
}

References CADET_TUNNEL_KEY_AX_AUTH_SENT, CADET_TUNNEL_KEY_OK, CadetTConnection::cc, CadetTunnelAxolotl::DHRs, env, GCC_get_id(), GCC_transmit(), GCT_2s(), GCT_change_estate(), get_ready_connection(), GNUNET_CADET_KX_FLAG_FORCE_REPLY, GNUNET_CADET_KX_FLAG_NONE, GNUNET_CRYPTO_ecdhe_key_get_public(), GNUNET_CRYPTO_hash(), GNUNET_e2s(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_MESSAGE_TYPE_CADET_TUNNEL_KX_AUTH, GNUNET_MQ_msg, GNUNET_NO, GNUNET_sh2s(), GNUNET_STATISTICS_update(), GNUNET_TIME_absolute_get(), GNUNET_TIME_relative_to_absolute(), GNUNET_TIME_STD_BACKOFF, GNUNET_YES, CadetTConnection::is_ready, CadetTunnelAxolotl::kx_0, CadetTunnelAxolotl::last_ephemeral, LOG, mark_connection_unready(), msg, CadetTunnelAxolotl::RK, stats, and t.

Referenced by connection_ready_cb(), cont_GCT_handle_kx_auth(), GCT_handle_encrypted(), GCT_handle_kx(), and retry_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

cleanup_ax()

static void cleanup_ax ( struct CadetTunnelAxolotl *  ax )

static

Cleanup state used by ax.

Parameters

ax	state to free, but not memory of ax itself

Definition at line 1574 of file gnunet-service-cadet_tunnels.c.

{
  while (NULL != ax->skipped_head)
    delete_skipped_key (ax,
                        ax->skipped_head);
  GNUNET_assert (0 == ax->skipped);
  GNUNET_CRYPTO_ecdhe_key_clear (&ax->kx_0);
  GNUNET_CRYPTO_ecdhe_key_clear (&ax->DHRs);
}

References delete_skipped_key(), CadetTunnelAxolotl::DHRs, GNUNET_assert, GNUNET_CRYPTO_ecdhe_key_clear(), CadetTunnelAxolotl::kx_0, CadetTunnelAxolotl::skipped, and CadetTunnelAxolotl::skipped_head.

Referenced by cont_GCT_handle_kx_auth(), destroy_tunnel(), and GCT_handle_encrypted().

Here is the call graph for this function:

Here is the caller graph for this function:

update_ax_by_kx()

static void update_ax_by_kx ( void *  cls, const struct GNUNET_HashCode *  key_result  )

static

Update our Axolotl key state based on the KX data we received.

Computes the new chain keys, and root keys, etc, and also checks whether this is a replay of the current chain.

Parameters

cls	closure using the async structure for Axolotl
key_result	ecdh result from the ephemeral public key of the other peer

Returns

GNUNET_OK on success, GNUNET_NO if the resulting root key is already in ax and thus the KX is useless; GNUNET_SYSERR on hard errors

Definition at line 1597 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnelAsync *as;
  struct GNUNET_HashCode key_material[3];
  struct GNUNET_CRYPTO_SymmetricSessionKey keys[5];
  struct CadetTunnelAxolotl *ax;
  const struct GNUNET_PeerIdentity *pid;
  const struct GNUNET_CRYPTO_EcdhePublicKey *ephemeral_key;
  const struct GNUNET_CRYPTO_EcdhePublicKey *ratchet_key;
  const char salt[] = "CADET Axolotl salt";
  int am_I_alice;
 
  as = cls;
  ax = &as->ax;
  pid = &as->peer_id;
  ephemeral_key = &as->ephemeral_key;
  ratchet_key = &as->ratchet_key;
 
  as->ecdh_op = NULL;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Updating AX by KX with result from ECDH using ephemeral %s\n",
       GNUNET_e2s (ephemeral_key));
 
  if (GNUNET_SYSERR == (am_I_alice = GCT_alice_or_betty (pid)))
  {
    GNUNET_break_op (0);
    if (as->cb)
      as->cb (as->cb_cls, GNUNET_SYSERR);
    return;
  }
 
  if (0 == GNUNET_memcmp (&ax->DHRr,
                          ratchet_key))
  {
    GNUNET_STATISTICS_update (stats,
                              "# Ratchet key already known",
                              1,
                              GNUNET_NO);
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ratchet key already known. Ignoring KX.\n");
    if (as->cb)
      as->cb (as->cb_cls, GNUNET_NO);
    return;
  }
 
  ax->DHRr = *ratchet_key;
  ax->last_ephemeral = *ephemeral_key;
  /* ECDH A B0 */
  if (GNUNET_YES == am_I_alice)
  {
    GNUNET_memcpy (&key_material[0], key_result,
                   sizeof (*key_result));
  }
  else
  {
    GNUNET_CRYPTO_ecdh_eddsa (&ax->kx_0,            /* b0 */
                              &pid->public_key,     /* A */
                              &key_material[0]);
  }
  /* ECDH A0 B */
  if (GNUNET_YES == am_I_alice)
  {
    GNUNET_CRYPTO_ecdh_eddsa (&ax->kx_0,            /* a0 */
                              &pid->public_key,     /* B */
                              &key_material[1]);
  }
  else
  {
    GNUNET_memcpy (&key_material[1], key_result,
                   sizeof (*key_result));
  }
 
  /* ECDH A0 B0 */
  GNUNET_CRYPTO_ecc_ecdh (&ax->kx_0,              /* a0 or b0 */
                          ephemeral_key,         /* B0 or A0 */
                          &key_material[2]);
  /* KDF */
  GNUNET_CRYPTO_hkdf_gnunet (
    keys, sizeof(keys),
    salt, sizeof(salt),
    &key_material, sizeof(key_material));
 
  if (0 == memcmp (&ax->RK,
                   &keys[0],
                   sizeof(ax->RK)))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Root key already known. Ignoring KX.\n");
    GNUNET_STATISTICS_update (stats,
                              "# Root key already known",
                              1,
                              GNUNET_NO);
    if (as->cb)
      as->cb (as->cb_cls, GNUNET_NO);
    return;
  }
 
  ax->RK = keys[0];
  if (GNUNET_YES == am_I_alice)
  {
    ax->HKr = keys[1];
    ax->NHKs = keys[2];
    ax->NHKr = keys[3];
    ax->CKr = keys[4];
    ax->ratchet_flag = GNUNET_YES;
  }
  else
  {
    ax->HKs = keys[1];
    ax->NHKr = keys[2];
    ax->NHKs = keys[3];
    ax->CKs = keys[4];
    ax->ratchet_flag = GNUNET_NO;
    ax->ratchet_expiration
      = GNUNET_TIME_absolute_add (GNUNET_TIME_absolute_get (),
                                  ratchet_time);
  }
 
  if (as->cb)
    as->cb (as->cb_cls, GNUNET_OK);
}

References CadetTunnelAsync::ax, CadetTunnelAsync::cb, CadetTunnelAsync::cb_cls, CadetTunnelAxolotl::CKr, CadetTunnelAxolotl::CKs, CadetTunnelAxolotl::DHRr, CadetTunnelAsync::ecdh_op, CadetTunnelAsync::ephemeral_key, GCT_alice_or_betty(), GNUNET_break_op, GNUNET_CRYPTO_ecc_ecdh(), GNUNET_CRYPTO_ecdh_eddsa(), GNUNET_CRYPTO_hkdf_gnunet, GNUNET_e2s(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_memcmp, GNUNET_memcpy, GNUNET_NO, GNUNET_OK, GNUNET_STATISTICS_update(), GNUNET_SYSERR, GNUNET_TIME_absolute_add(), GNUNET_TIME_absolute_get(), GNUNET_YES, CadetTunnelAxolotl::HKr, CadetTunnelAxolotl::HKs, CadetTunnelAxolotl::kx_0, CadetTunnelAxolotl::last_ephemeral, LOG, CadetTunnelAxolotl::NHKr, CadetTunnelAxolotl::NHKs, CadetTunnelAsync::peer_id, pid, GNUNET_PeerIdentity::public_key, CadetTunnelAxolotl::ratchet_expiration, CadetTunnelAxolotl::ratchet_flag, CadetTunnelAsync::ratchet_key, ratchet_time, CadetTunnelAxolotl::RK, salt, and stats.

Referenced by GCT_handle_kx(), and GCT_handle_kx_auth().

Here is the call graph for this function:

Here is the caller graph for this function:

retry_kx()

static void retry_kx ( void *  cls )

static

Try to redo the KX or KX_AUTH handshake, if we can.

Parameters

cls	the struct CadetTunnel to do KX for.

Definition at line 1728 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetTunnelAxolotl *ax;
 
  t->kx_task = NULL;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Trying to make KX progress on %s in state %s\n",
       GCT_2s (t),
       estate2s (t->estate));
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:   /* first attempt */
  case CADET_TUNNEL_KEY_AX_SENT:         /* trying again */
    send_kx (t,
             NULL,
             &t->ax);
    break;
 
  case CADET_TUNNEL_KEY_AX_RECV:
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    /* We are responding, so only require reply
       if WE have a channel waiting. */
    if (NULL != t->unverified_ax)
    {
      /* Send AX_AUTH so we might get this one verified */
      ax = t->unverified_ax;
    }
    else
    {
      /* How can this be? */
      GNUNET_break (0);
      ax = &t->ax;
    }
    send_kx_auth (t,
                  NULL,
                  ax,
                  (0 == GCT_count_channels (t))
                  ? GNUNET_NO
                  : GNUNET_YES);
    break;
 
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    /* We are responding, so only require reply
       if WE have a channel waiting. */
    if (NULL != t->unverified_ax)
    {
      /* Send AX_AUTH so we might get this one verified */
      ax = t->unverified_ax;
    }
    else
    {
      /* How can this be? */
      GNUNET_break (0);
      ax = &t->ax;
    }
    send_kx_auth (t,
                  NULL,
                  ax,
                  (0 == GCT_count_channels (t))
                  ? GNUNET_NO
                  : GNUNET_YES);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    /* Must have been the *other* peer asking us to
       respond with a KX_AUTH. */
    if (NULL != t->unverified_ax)
    {
      /* Sending AX_AUTH in response to AX so we might get this one verified */
      ax = t->unverified_ax;
    }
    else
    {
      /* Sending AX_AUTH in response to AX_AUTH */
      ax = &t->ax;
    }
    send_kx_auth (t,
                  NULL,
                  ax,
                  GNUNET_NO);
    break;
  }
}

References CADET_TUNNEL_KEY_AX_AUTH_SENT, CADET_TUNNEL_KEY_AX_RECV, CADET_TUNNEL_KEY_AX_SENT, CADET_TUNNEL_KEY_AX_SENT_AND_RECV, CADET_TUNNEL_KEY_OK, CADET_TUNNEL_KEY_UNINITIALIZED, estate2s(), GCT_2s(), GCT_count_channels(), GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_NO, GNUNET_YES, LOG, send_kx(), send_kx_auth(), and t.

Referenced by connection_ready_cb(), cont_GCT_handle_kx(), cont_GCT_handle_kx_auth(), and GCT_add_channel().

Here is the call graph for this function:

Here is the caller graph for this function:

cont_GCT_handle_kx()

static void cont_GCT_handle_kx ( void *  cls, enum GNUNET_GenericReturnValue  ret  )

static

Continue to handle KX message.

Parameters

cls	closure from updating AX by KX
ret	result from the update call

Definition at line 1821 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
 
  if (t->unverified_ax)
    *(t->unverified_ax) = t->as.ax;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Continue handling KX message from %s from %s\n",
       GCT_2s (t),
       GNUNET_i2s (GCP_get_id (t->destination)));
 
  GNUNET_break (GNUNET_SYSERR != ret);
  if (GNUNET_OK != ret)
  {
    GNUNET_STATISTICS_update (stats,
                              "# Useless KX",
                              1,
                              GNUNET_NO);
    return;   /* duplicate KX, nothing to do */
  }
  /* move ahead in our state machine */
  if (CADET_TUNNEL_KEY_UNINITIALIZED == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_RECV);
  else if (CADET_TUNNEL_KEY_AX_SENT == t->estate)
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_AX_SENT_AND_RECV);
 
  /* KX is still not done, try again our end. */
  if (CADET_TUNNEL_KEY_OK != t->estate)
  {
    if (NULL != t->kx_task)
      GNUNET_SCHEDULER_cancel (t->kx_task);
    t->kx_task
      = GNUNET_SCHEDULER_add_now (&retry_kx,
                                  t);
  }
}

References CADET_TUNNEL_KEY_AX_RECV, CADET_TUNNEL_KEY_AX_SENT, CADET_TUNNEL_KEY_AX_SENT_AND_RECV, CADET_TUNNEL_KEY_OK, CADET_TUNNEL_KEY_UNINITIALIZED, GCP_get_id(), GCT_2s(), GCT_change_estate(), GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_i2s(), GNUNET_NO, GNUNET_OK, GNUNET_SCHEDULER_add_now(), GNUNET_SCHEDULER_cancel(), GNUNET_STATISTICS_update(), GNUNET_SYSERR, LOG, ret, retry_kx(), stats, and t.

Referenced by GCT_handle_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_handle_kx()

void GCT_handle_kx	(	struct CadetTConnection *	ct,
		const struct GNUNET_CADET_TunnelKeyExchangeMessage *	msg
	)

Continue to handle KX message.

Handle KX message that lacks authentication (and which will thus only be considered authenticated after we respond with our own KX_AUTH and finally successfully decrypt the payload).

Parameters

cls	closure from updating AX by KX
ret	result from the update call

Definition at line 1870 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = ct->t;
 
  GNUNET_STATISTICS_update (stats,
                            "# KX received",
                            1,
                            GNUNET_NO);
  if (GNUNET_YES ==
      GCT_alice_or_betty (GCP_get_id (t->destination)))
  {
    /* Betty/Bob is not allowed to send KX! */
    GNUNET_break_op (0);
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received KX message from %s with ephemeral %s from %s on connection %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->ephemeral_key),
       GNUNET_i2s (GCP_get_id (t->destination)),
       GCC_2s (ct->cc));
#if 1
  if ((0 ==
       memcmp (&t->ax.DHRr,
               &msg->ratchet_key,
               sizeof(msg->ratchet_key))) &&
      (0 ==
       memcmp (&t->ax.last_ephemeral,
               &msg->ephemeral_key,
               sizeof(msg->ephemeral_key))))
 
  {
    GNUNET_STATISTICS_update (stats,
                              "# Duplicate KX received",
                              1,
                              GNUNET_NO);
    send_kx_auth (t,
                  ct,
                  &t->ax,
                  GNUNET_NO);
    return;
  }
#endif
  /* We only keep ONE unverified KX around, so if there is an existing one,
     clean it up. */
  if (NULL != t->unverified_ax)
  {
    if ((0 ==
         memcmp (&t->unverified_ax->DHRr,
                 &msg->ratchet_key,
                 sizeof(msg->ratchet_key))) &&
        (0 ==
         memcmp (&t->unverified_ax->last_ephemeral,
                 &msg->ephemeral_key,
                 sizeof(msg->ephemeral_key))))
    {
      GNUNET_STATISTICS_update (stats,
                                "# Duplicate unverified KX received",
                                1,
                                GNUNET_NO);
#if 1
      send_kx_auth (t,
                    ct,
                    t->unverified_ax,
                    GNUNET_NO);
      return;
#endif
    }
    if ((t->as.ecdh_op) &&
        (0 ==
         memcmp (&t->as.ratchet_key,
                 &msg->ratchet_key,
                 sizeof(msg->ratchet_key))) &&
        (0 ==
         memcmp (&t->as.ephemeral_key,
                 &msg->ephemeral_key,
                 sizeof(msg->ephemeral_key))))
    {
      LOG (GNUNET_ERROR_TYPE_DEBUG,
           "Waiting for previous ECDH operation\n");
      return;
    }
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Dropping old unverified KX state.\n");
    GNUNET_STATISTICS_update (stats,
                              "# Unverified KX dropped for fresh KX",
                              1,
                              GNUNET_NO);
    GNUNET_break (NULL == t->unverified_ax->skipped_head);
    memset (t->unverified_ax,
            0,
            sizeof(struct CadetTunnelAxolotl));
  }
  else
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Creating fresh unverified KX for %s\n",
         GCT_2s (t));
    GNUNET_STATISTICS_update (stats,
                              "# Fresh KX setup",
                              1,
                              GNUNET_NO);
    t->unverified_ax = GNUNET_new (struct CadetTunnelAxolotl);
  }
  /* Set as the 'current' RK/DHRr the one we are currently using,
     so that the duplicate-detection logic of
   #update_ax_by_kx can work. */
  t->unverified_ax->RK = t->ax.RK;
  t->unverified_ax->DHRr = t->ax.DHRr;
  t->unverified_ax->DHRs = t->ax.DHRs;
  t->unverified_ax->kx_0 = t->ax.kx_0;
  t->unverified_attempts = 0;
 
  t->as.ax = *(t->unverified_ax);
  GNUNET_memcpy (&t->as.peer_id, GCP_get_id (t->destination),
                 sizeof (t->as.peer_id));
  GNUNET_memcpy (&t->as.ephemeral_key, &msg->ephemeral_key,
                 sizeof (t->as.ephemeral_key));
  GNUNET_memcpy (&t->as.ratchet_key, &msg->ratchet_key,
                 sizeof (t->as.ratchet_key));
  memset (&t->as.auth, 0, sizeof (t->as.auth));
  t->as.flags = 0;
  t->as.cb_cls = t;
  t->as.cb = &cont_GCT_handle_kx;
 
  if (t->as.ecdh_op)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Cancelling previous ECDH operation\n");
 
    GNUNET_PILS_cancel (t->as.ecdh_op);
  }
 
  t->as.ecdh_op = GNUNET_PILS_ecdh (pils, &msg->ephemeral_key,
                                    &update_ax_by_kx, &t->as);
}

References CadetTConnection::cc, cont_GCT_handle_kx(), GCC_2s(), GCP_get_id(), GCT_2s(), GCT_alice_or_betty(), GNUNET_break, GNUNET_break_op, GNUNET_e2s(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_i2s(), GNUNET_memcpy, GNUNET_new, GNUNET_NO, GNUNET_PILS_cancel(), GNUNET_PILS_ecdh(), GNUNET_STATISTICS_update(), GNUNET_YES, LOG, msg, pils, send_kx_auth(), stats, t, CadetTConnection::t, and update_ax_by_kx().

Referenced by GCC_handle_kx().

Here is the call graph for this function:

Here is the caller graph for this function:

cont_GCT_handle_kx_auth()

static void cont_GCT_handle_kx_auth ( void *  cls, enum GNUNET_GenericReturnValue  ret  )

static

Continue to handle KX_AUTH message.

Parameters

cls	closure from updating AX by KX
ret	result from the update call

Definition at line 2016 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetTunnelAxolotl *ax_tmp;
  struct GNUNET_HashCode kx_auth;
 
  ax_tmp = &t->as.ax;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Continue handling KX_AUTH message from %s\n",
       GCT_2s (t));
 
  if (GNUNET_OK != ret)
  {
    if (GNUNET_NO == ret)
      GNUNET_STATISTICS_update (stats,
                                "# redundant KX_AUTH received",
                                1,
                                GNUNET_NO);
    else
      GNUNET_break (0);  /* connect to self!? */
    return;
  }
  GNUNET_CRYPTO_hash (&ax_tmp->RK,
                      sizeof(ax_tmp->RK),
                      &kx_auth);
  if (0 != GNUNET_memcmp (&kx_auth,
                          &t->as.auth))
  {
    /* This KX_AUTH is not using the latest KX/KX_AUTH data
       we transmitted to the sender, refuse it, try KX again. */
    GNUNET_STATISTICS_update (stats,
                              "# KX_AUTH not using our last KX received (auth failure)",
                              1,
                              GNUNET_NO);
    LOG (GNUNET_ERROR_TYPE_WARNING,
         "KX AUTH mismatch!\n");
#if DEBUG_KX
    {
      struct GNUNET_CRYPTO_EcdhePublicKey ephemeral_key;
 
      GNUNET_CRYPTO_ecdhe_key_get_public (&ax_tmp.kx_0,
                                          &ephemeral_key);
      if (0 != GNUNET_memcmp (&ephemeral_key,
                              &msg->r_ephemeral_key_XXX))
      {
        LOG (GNUNET_ERROR_TYPE_WARNING,
             "My ephemeral is %s!\n",
             GNUNET_e2s (&ephemeral_key));
        LOG (GNUNET_ERROR_TYPE_WARNING,
             "Response is for ephemeral %s!\n",
             GNUNET_e2s (&msg->r_ephemeral_key_XXX));
      }
    }
#endif
    if (NULL == t->kx_task)
      t->kx_task
        = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
                                   &retry_kx,
                                   t);
    return;
  }
  /* Yep, we're good. */
  t->ax = *ax_tmp;
  if (NULL != t->unverified_ax)
  {
    /* We got some "stale" KX before, drop that. */
    cleanup_ax (t->unverified_ax);
    GNUNET_free (t->unverified_ax);
    t->unverified_ax = NULL;
  }
 
  /* move ahead in our state machine */
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
  case CADET_TUNNEL_KEY_AX_RECV:
    /* Checked above, this is impossible. */
    GNUNET_assert (0);
    break;
 
  case CADET_TUNNEL_KEY_AX_SENT:      /* This is the normal case */
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:   /* both peers started KX */
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:   /* both peers now did KX_AUTH */
    GCT_change_estate (t,
                       CADET_TUNNEL_KEY_OK);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    /* Did not expect another KX_AUTH, but so what, still acceptable.
       Nothing to do here. */
    break;
  }
  if (0 != (GNUNET_CADET_KX_FLAG_FORCE_REPLY & ntohl (t->as.flags)))
  {
    send_kx_auth (t,
                  NULL,
                  &t->ax,
                  GNUNET_NO);
  }
}

References CADET_TUNNEL_KEY_AX_AUTH_SENT, CADET_TUNNEL_KEY_AX_RECV, CADET_TUNNEL_KEY_AX_SENT, CADET_TUNNEL_KEY_AX_SENT_AND_RECV, CADET_TUNNEL_KEY_OK, CADET_TUNNEL_KEY_UNINITIALIZED, cleanup_ax(), GCT_2s(), GCT_change_estate(), GNUNET_assert, GNUNET_break, GNUNET_CADET_KX_FLAG_FORCE_REPLY, GNUNET_CRYPTO_ecdhe_key_get_public(), GNUNET_CRYPTO_hash(), GNUNET_e2s(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_WARNING, GNUNET_free, GNUNET_memcmp, GNUNET_NO, GNUNET_OK, GNUNET_SCHEDULER_add_at(), GNUNET_STATISTICS_update(), CadetTunnelAxolotl::kx_0, LOG, msg, ret, retry_kx(), CadetTunnelAxolotl::RK, send_kx_auth(), stats, and t.

Referenced by GCT_handle_kx_auth().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_handle_kx_auth()

void GCT_handle_kx_auth	(	struct CadetTConnection *	ct,
		const struct GNUNET_CADET_TunnelKeyExchangeAuthMessage *	msg
	)

Handle KX_AUTH message.

Parameters

ct	connection/tunnel combo that received encrypted message
msg	the key exchange message

Definition at line 2127 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = ct->t;
 
  GNUNET_STATISTICS_update (stats,
                            "# KX_AUTH received",
                            1,
                            GNUNET_NO);
  if ((CADET_TUNNEL_KEY_UNINITIALIZED == t->estate) ||
      (CADET_TUNNEL_KEY_AX_RECV == t->estate))
  {
    /* Confusing, we got a KX_AUTH before we even send our own
       KX. This should not happen. We'll send our own KX ASAP anyway,
       so let's ignore this here. */
    GNUNET_break_op (0);
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Handling KX_AUTH message from %s with ephemeral %s\n",
       GCT_2s (t),
       GNUNET_e2s (&msg->kx.ephemeral_key));
  if ((t->as.ecdh_op) &&
      (0 ==
       memcmp (&t->as.ratchet_key,
               &msg->kx.ratchet_key,
               sizeof(msg->kx.ratchet_key))) &&
      (0 ==
       memcmp (&t->as.ephemeral_key,
               &msg->kx.ephemeral_key,
               sizeof(msg->kx.ephemeral_key))))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Waiting for previous ECDH operation\n");
    return;
  }
  /* We do everything in a copy until we've checked the authentication
     so we don't clobber anything we care about by accident. */
  t->as.ax = t->ax;
  GNUNET_memcpy (&t->as.peer_id, GCP_get_id (t->destination),
                 sizeof (t->as.peer_id));
  GNUNET_memcpy (&t->as.ephemeral_key, &msg->kx.ephemeral_key,
                 sizeof (t->as.ephemeral_key));
  GNUNET_memcpy (&t->as.ratchet_key, &msg->kx.ratchet_key,
                 sizeof (t->as.ratchet_key));
  t->as.auth = msg->auth;
  t->as.flags = msg->kx.flags;
  t->as.cb_cls = t;
  t->as.cb = &cont_GCT_handle_kx_auth;
 
  if (t->as.ecdh_op)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Cancelling previous ECDH operation\n");
 
    GNUNET_PILS_cancel (t->as.ecdh_op);
  }
 
  /* Update 'ax' by the new key material */
  t->as.ecdh_op = GNUNET_PILS_ecdh (pils, &msg->kx.ephemeral_key,
                                    &update_ax_by_kx, &t->as);
}

References CADET_TUNNEL_KEY_AX_RECV, CADET_TUNNEL_KEY_UNINITIALIZED, cont_GCT_handle_kx_auth(), GCP_get_id(), GCT_2s(), GNUNET_break_op, GNUNET_e2s(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_memcpy, GNUNET_NO, GNUNET_PILS_cancel(), GNUNET_PILS_ecdh(), GNUNET_STATISTICS_update(), LOG, msg, pils, stats, t, CadetTConnection::t, and update_ax_by_kx().

Referenced by GCC_handle_kx_auth().

Here is the call graph for this function:

Here is the caller graph for this function:

get_next_free_ctn()

static struct GNUNET_CADET_ChannelTunnelNumber get_next_free_ctn ( struct CadetTunnel *  t )

static

Compute the next free channel tunnel number for this tunnel.

Parameters

t	the tunnel

Returns

unused number that can uniquely identify a channel in the tunnel

Definition at line 2201 of file gnunet-service-cadet_tunnels.c.

{
#define HIGH_BIT 0x8000000
  const struct GNUNET_PeerIdentity *my_identity;
  struct GNUNET_CADET_ChannelTunnelNumber ret;
  uint32_t ctn;
  int cmp;
  uint32_t highbit;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  cmp = GNUNET_memcmp (my_identity,
                       GCP_get_id (GCT_get_destination (t)));
  if (0 < cmp)
    highbit = HIGH_BIT;
  else if (0 > cmp)
    highbit = 0;
  else
    GNUNET_assert (0); // loopback must never go here!
  ctn = ntohl (t->next_ctn.cn);
  while (NULL !=
         GNUNET_CONTAINER_multihashmap32_get (t->channels,
                                              ctn | highbit))
  {
    ctn = ((ctn + 1) & (~HIGH_BIT));
  }
  t->next_ctn.cn = htonl ((ctn + 1) & (~HIGH_BIT));
  ret.cn = htonl (ctn | highbit);
  return ret;
}

References GCP_get_id(), GCT_get_destination(), GNUNET_assert, GNUNET_CONTAINER_multihashmap32_get(), GNUNET_memcmp, GNUNET_PILS_get_identity(), HIGH_BIT, my_identity, pils, ret, and t.

Referenced by GCT_add_channel().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_add_channel()

struct GNUNET_CADET_ChannelTunnelNumber GCT_add_channel	(	struct CadetTunnel *	t,
		struct CadetChannel *	ch
	)

Add a channel to a tunnel, and notify channel that we are ready for transmission if we are already up.

Add a channel to a tunnel.

Otherwise that notification will be done later in notify_tunnel_up_cb().

Parameters

t	Tunnel.
ch	Channel

Returns

unique number identifying ch within t

Definition at line 2244 of file gnunet-service-cadet_tunnels.c.

{
  struct GNUNET_CADET_ChannelTunnelNumber ctn;
 
  ctn = get_next_free_ctn (t);
  if (NULL != t->destroy_task)
  {
    GNUNET_SCHEDULER_cancel (t->destroy_task);
    t->destroy_task = NULL;
  }
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multihashmap32_put (t->channels,
                                                      ntohl (ctn.cn),
                                                      ch,
                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Adding %s to %s with state %d\n",
       GCCH_2s (ch),
       GCT_2s (t),
       t->estate);
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
    /* waiting for connection to start KX */
    break;
 
  case CADET_TUNNEL_KEY_AX_RECV:
  case CADET_TUNNEL_KEY_AX_SENT:
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    /* we're currently waiting for KX to complete */
    break;
 
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    /* waiting for OTHER peer to send us data,
       we might need to prompt more aggressively! */
    if (NULL == t->kx_task)
      t->kx_task
        = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
                                   &retry_kx,
                                   t);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    /* We are ready. Tell the new channel that we are up. */
    GCCH_tunnel_up (ch);
    break;
  }
  return ctn;
}

References CADET_TUNNEL_KEY_AX_AUTH_SENT, CADET_TUNNEL_KEY_AX_RECV, CADET_TUNNEL_KEY_AX_SENT, CADET_TUNNEL_KEY_AX_SENT_AND_RECV, CADET_TUNNEL_KEY_OK, CADET_TUNNEL_KEY_UNINITIALIZED, ch, GNUNET_CADET_ChannelTunnelNumber::cn, GCCH_2s(), GCCH_tunnel_up(), GCT_2s(), get_next_free_ctn(), GNUNET_assert, GNUNET_CONTAINER_multihashmap32_put(), GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY, GNUNET_ERROR_TYPE_DEBUG, GNUNET_SCHEDULER_add_at(), GNUNET_SCHEDULER_cancel(), GNUNET_YES, LOG, retry_kx(), and t.

Referenced by GCCH_channel_local_new().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_connection_lost()

void GCT_connection_lost

(

struct CadetTConnection *

ct

)

We lost a connection, remove it from our list and clean up the connection object itself.

Parameters

ct	binding of connection to tunnel of the connection that was lost.

Definition at line 2303 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = ct->t;
 
  if (GNUNET_YES == ct->is_ready)
  {
    GNUNET_CONTAINER_DLL_remove (t->connection_ready_head,
                                 t->connection_ready_tail,
                                 ct);
    t->num_ready_connections--;
  }
  else
  {
    GNUNET_CONTAINER_DLL_remove (t->connection_busy_head,
                                 t->connection_busy_tail,
                                 ct);
    t->num_busy_connections--;
  }
  GNUNET_free (ct);
}

References GNUNET_CONTAINER_DLL_remove, GNUNET_free, GNUNET_YES, CadetTConnection::is_ready, t, and CadetTConnection::t.

Referenced by destroy_t_connection(), GCC_create_inbound(), and GCC_destroy_without_core().

Here is the caller graph for this function:

destroy_t_connection()

static void destroy_t_connection ( void *  cls, struct CadetTConnection *  ct  )

static

Clean up connection ct of a tunnel.

Parameters

cls	the struct CadetTunnel
ct	connection to clean up

Definition at line 2332 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetConnection *cc = ct->cc;
 
  GNUNET_assert (ct->t == t);
  GCT_connection_lost (ct);
  GCC_destroy_without_tunnel (cc);
}

References CadetTConnection::cc, CadetConnection::ct, GCC_destroy_without_tunnel(), GCT_connection_lost(), GNUNET_assert, t, and CadetTConnection::t.

Referenced by destroy_tunnel(), and maintain_connections_cb().

Here is the call graph for this function:

Here is the caller graph for this function:

destroy_tunnel()

static void destroy_tunnel ( void *  cls )

static

This tunnel is no longer used, destroy it.

Parameters

cls	the idle tunnel

Definition at line 2350 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetTunnelQueueEntry *tq;
 
  t->destroy_task = NULL;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Destroying idle %s\n",
       GCT_2s (t));
  GNUNET_assert (0 == GCT_count_channels (t));
  GCT_iterate_connections (t,
                           &destroy_t_connection,
                           t);
  GNUNET_assert (NULL == t->connection_ready_head);
  GNUNET_assert (NULL == t->connection_busy_head);
  while (NULL != (tq = t->tq_head))
  {
    if (NULL != tq->cont)
      tq->cont (tq->cont_cls,
                NULL);
    GCT_send_cancel (tq);
  }
  GCP_drop_tunnel (t->destination,
                   t);
  GNUNET_CONTAINER_multihashmap32_destroy (t->channels);
  if (NULL != t->maintain_connections_task)
  {
    GNUNET_SCHEDULER_cancel (t->maintain_connections_task);
    t->maintain_connections_task = NULL;
  }
  if (NULL != t->send_task)
  {
    GNUNET_SCHEDULER_cancel (t->send_task);
    t->send_task = NULL;
  }
  if (NULL != t->kx_task)
  {
    GNUNET_SCHEDULER_cancel (t->kx_task);
    t->kx_task = NULL;
  }
  if (NULL != t->as.ecdh_op)
  {
    GNUNET_PILS_cancel (t->as.ecdh_op);
    t->as.ecdh_op = NULL;
  }
  GNUNET_MST_destroy (t->mst);
  GNUNET_MQ_destroy (t->mq);
  if (NULL != t->unverified_ax)
  {
    cleanup_ax (t->unverified_ax);
    GNUNET_free (t->unverified_ax);
  }
  cleanup_ax (&t->ax);
  GNUNET_assert (NULL == t->destroy_task);
  GNUNET_free (t);
}

References cleanup_ax(), CadetTunnelQueueEntry::cont, CadetTunnelQueueEntry::cont_cls, destroy_t_connection(), GCP_drop_tunnel(), GCT_2s(), GCT_count_channels(), GCT_iterate_connections(), GCT_send_cancel(), GNUNET_assert, GNUNET_CONTAINER_multihashmap32_destroy(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_free, GNUNET_MQ_destroy(), GNUNET_MST_destroy(), GNUNET_PILS_cancel(), GNUNET_SCHEDULER_cancel(), LOG, and t.

Referenced by callback_room_connect(), connection_ready_cb(), enter_srv_room_at(), GCT_destroy_tunnel_now(), GCT_remove_channel(), and iterate_destroy_tunnels().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_remove_channel()

void GCT_remove_channel	(	struct CadetTunnel *	t,
		struct CadetChannel *	ch,
		struct GNUNET_CADET_ChannelTunnelNumber	ctn
	)

Remove a channel from a tunnel.

Parameters

t	Tunnel.
ch	Channel
ctn	unique number identifying ch within t

Definition at line 2416 of file gnunet-service-cadet_tunnels.c.

{
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Removing %s from %s\n",
       GCCH_2s (ch),
       GCT_2s (t));
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multihashmap32_remove (t->channels,
                                                         ntohl (ctn.cn),
                                                         ch));
  if ((0 ==
       GCT_count_channels (t)) &&
      (NULL == t->destroy_task))
  {
    t->destroy_task
      = GNUNET_SCHEDULER_add_delayed (IDLE_DESTROY_DELAY,
                                      &destroy_tunnel,
                                      t);
  }
}

References ch, GNUNET_CADET_ChannelTunnelNumber::cn, destroy_tunnel(), GCCH_2s(), GCT_2s(), GCT_count_channels(), GNUNET_assert, GNUNET_CONTAINER_multihashmap32_remove(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_SCHEDULER_add_delayed(), GNUNET_YES, IDLE_DESTROY_DELAY, LOG, and t.

Referenced by channel_destroy().

Here is the call graph for this function:

Here is the caller graph for this function:

destroy_remaining_channels()

static int destroy_remaining_channels ( void *  cls, uint32_t  key, void *  value  )

static

Destroy remaining channels during shutdown.

Parameters

cls	the struct CadetTunnel of the channel
key	key of the channel
value	the struct CadetChannel

Returns

GNUNET_OK (continue to iterate)

Definition at line 2449 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetChannel *ch = value;
 
  GCCH_handle_remote_destroy (ch,
                              NULL);
  return GNUNET_OK;
}

References ch, GCCH_handle_remote_destroy(), GNUNET_OK, and value.

Referenced by GCT_destroy_tunnel_now().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_destroy_tunnel_now()

void GCT_destroy_tunnel_now

(

struct CadetTunnel *

t

)

Destroys the tunnel t now, without delay.

Used during shutdown.

Parameters

t	tunnel to destroy

Definition at line 2467 of file gnunet-service-cadet_tunnels.c.

{
  GNUNET_assert (GNUNET_YES == shutting_down);
  GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                           &destroy_remaining_channels,
                                           t);
  GNUNET_assert (0 ==
                 GCT_count_channels (t));
  if (NULL != t->destroy_task)
  {
    GNUNET_SCHEDULER_cancel (t->destroy_task);
    t->destroy_task = NULL;
  }
  destroy_tunnel (t);
}

References destroy_remaining_channels(), destroy_tunnel(), GCT_count_channels(), GNUNET_assert, GNUNET_CONTAINER_multihashmap32_iterate(), GNUNET_SCHEDULER_cancel(), GNUNET_YES, shutting_down, and t.

Referenced by destroy_tunnels_now().

Here is the call graph for this function:

Here is the caller graph for this function:

try_send_normal_payload()

static void try_send_normal_payload ( struct CadetTunnel *  t, struct CadetTConnection *  ct  )

static

Send normal payload from queue in t via connection ct.

Does nothing if our payload queue is empty.

Parameters

t	tunnel to send data from
ct	connection to use for transmission (is ready)

Definition at line 2492 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnelQueueEntry *tq;
 
  GNUNET_assert (GNUNET_YES == ct->is_ready);
  tq = t->tq_head;
  if (NULL == tq)
  {
    /* no messages pending right now */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Not sending payload of %s on ready %s (nothing pending)\n",
         GCT_2s (t),
         GCC_2s (ct->cc));
    return;
  }
  /* ready to send message 'tq' on tunnel 'ct' */
  GNUNET_assert (t == tq->t);
  GNUNET_CONTAINER_DLL_remove (t->tq_head,
                               t->tq_tail,
                               tq);
  if (NULL != tq->cid)
    *tq->cid = *GCC_get_id (ct->cc);
  mark_connection_unready (ct);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending payload of %s on %s\n",
       GCT_2s (t),
       GCC_2s (ct->cc));
  GCC_transmit (ct->cc,
                tq->env);
  if (NULL != tq->cont)
    tq->cont (tq->cont_cls,
              GCC_get_id (ct->cc));
  GNUNET_free (tq);
}

References CadetTConnection::cc, CadetTunnelQueueEntry::cid, CadetTunnelQueueEntry::cont, CadetTunnelQueueEntry::cont_cls, CadetTunnelQueueEntry::env, GCC_2s(), GCC_get_id(), GCC_transmit(), GCT_2s(), GNUNET_assert, GNUNET_CONTAINER_DLL_remove, GNUNET_ERROR_TYPE_DEBUG, GNUNET_free, GNUNET_YES, CadetTConnection::is_ready, LOG, mark_connection_unready(), t, and CadetTunnelQueueEntry::t.

Referenced by connection_ready_cb(), and trigger_transmissions().

Here is the call graph for this function:

Here is the caller graph for this function:

connection_ready_cb()

static void connection_ready_cb ( void *  cls, int  is_ready  )

static

A connection is is_ready for transmission.

Looks at our message queue and if there is a message, sends it out via the connection.

Parameters

cls	the struct CadetTConnection that is is_ready
is_ready	GNUNET_YES if connection are now ready, GNUNET_NO if connection are no longer ready

Definition at line 2538 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTConnection *ct = cls;
  struct CadetTunnel *t = ct->t;
 
  if (GNUNET_NO == is_ready)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "%s no longer ready for %s\n",
         GCC_2s (ct->cc),
         GCT_2s (t));
    mark_connection_unready (ct);
    return;
  }
  GNUNET_assert (GNUNET_NO == ct->is_ready);
  GNUNET_CONTAINER_DLL_remove (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  GNUNET_assert (0 < t->num_busy_connections);
  t->num_busy_connections--;
  ct->is_ready = GNUNET_YES;
  GNUNET_CONTAINER_DLL_insert_tail (t->connection_ready_head,
                                    t->connection_ready_tail,
                                    ct);
  t->num_ready_connections++;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s now ready for %s in state %s\n",
       GCC_2s (ct->cc),
       GCT_2s (t),
       estate2s (t->estate));
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Do not begin KX for %s if WE have no channels waiting. Retrying after %llu\n",
         GCT_2s (t),
         (unsigned long long) GNUNET_TIME_absolute_get_remaining (
           t->next_kx_attempt).rel_value_us);
    /* Do not begin KX if WE have no channels waiting! */
    if (0 != GNUNET_TIME_absolute_get_remaining (
          t->next_kx_attempt).rel_value_us)
      return;   /* wait for timeout before retrying */
    /* We are uninitialized, just transmit immediately,
       without undue delay. */
 
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Why for %s \n",
         GCT_2s (t));
 
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    if ((0 ==
         GCT_count_channels (t)) &&
        (NULL == t->destroy_task))
    {
      t->destroy_task
        = GNUNET_SCHEDULER_add_delayed (IDLE_DESTROY_DELAY,
                                        &destroy_tunnel,
                                        t);
    }
    break;
 
  case CADET_TUNNEL_KEY_AX_RECV:
  case CADET_TUNNEL_KEY_AX_SENT:
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
    /* we're currently waiting for KX to complete, schedule job */
    if (NULL == t->kx_task)
      t->kx_task
        = GNUNET_SCHEDULER_add_at (t->next_kx_attempt,
                                   &retry_kx,
                                   t);
    break;
 
  case CADET_TUNNEL_KEY_OK:
    if (GNUNET_YES == t->kx_auth_requested)
    {
      if (0 != GNUNET_TIME_absolute_get_remaining (
            t->next_kx_attempt).rel_value_us)
        return;     /* wait for timeout */
      if (NULL != t->kx_task)
      {
        GNUNET_SCHEDULER_cancel (t->kx_task);
        t->kx_task = NULL;
      }
      send_kx_auth (t,
                    ct,
                    &t->ax,
                    GNUNET_NO);
      return;
    }
    try_send_normal_payload (t,
                             ct);
    break;
  }
}

References CADET_TUNNEL_KEY_AX_AUTH_SENT, CADET_TUNNEL_KEY_AX_RECV, CADET_TUNNEL_KEY_AX_SENT, CADET_TUNNEL_KEY_AX_SENT_AND_RECV, CADET_TUNNEL_KEY_OK, CADET_TUNNEL_KEY_UNINITIALIZED, CadetTConnection::cc, destroy_tunnel(), estate2s(), GCC_2s(), GCT_2s(), GCT_count_channels(), GNUNET_assert, GNUNET_CONTAINER_DLL_insert_tail, GNUNET_CONTAINER_DLL_remove, GNUNET_ERROR_TYPE_DEBUG, GNUNET_NO, GNUNET_SCHEDULER_add_at(), GNUNET_SCHEDULER_add_delayed(), GNUNET_SCHEDULER_cancel(), GNUNET_TIME_absolute_get_remaining(), GNUNET_YES, IDLE_DESTROY_DELAY, CadetTConnection::is_ready, LOG, mark_connection_unready(), GNUNET_TIME_Relative::rel_value_us, retry_kx(), send_kx(), send_kx_auth(), t, CadetTConnection::t, and try_send_normal_payload().

Referenced by consider_path_cb(), and GCT_add_inbound_connection().

Here is the call graph for this function:

Here is the caller graph for this function:

evaluate_connection()

static void evaluate_connection ( void *  cls, struct CadetTConnection *  ct  )

static

Evaluate a connection, updating our summary information in cls about what kinds of connections we have.

Parameters

cls	the struct EvaluationSummary * to update
ct	a connection to include in the summary

Definition at line 2726 of file gnunet-service-cadet_tunnels.c.

{
  struct EvaluationSummary *es = cls;
  struct CadetConnection *cc = ct->cc;
  unsigned int ct_length;
  struct CadetPeerPath *ps;
  const struct CadetConnectionMetrics *metrics;
  GNUNET_CONTAINER_HeapCostType ct_desirability;
  struct GNUNET_TIME_Relative uptime;
  struct GNUNET_TIME_Relative last_use;
  double score;
  double success_rate;
 
  ps = GCC_get_path (cc,
                     &ct_length);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Evaluating path %s of existing %s\n",
       GCPP_2s (ps),
       GCC_2s (cc));
  if (ps == es->path)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ignoring duplicate path %s.\n",
         GCPP_2s (es->path));
    es->duplicate = GNUNET_YES;
    return;
  }
  if (NULL != es->path)
  {
    int duplicate = GNUNET_YES;
 
    for (unsigned int i = 0; i < ct_length; i++)
    {
      GNUNET_assert (GCPP_get_length (es->path) > i);
      if (GCPP_get_peer_at_offset (es->path,
                                   i) !=
          GCPP_get_peer_at_offset (ps,
                                   i))
      {
        duplicate = GNUNET_NO;
        break;
      }
    }
    if (GNUNET_YES == duplicate)
    {
      LOG (GNUNET_ERROR_TYPE_DEBUG,
           "Ignoring overlapping path %s.\n",
           GCPP_2s (es->path));
      es->duplicate = GNUNET_YES;
      return;
    }
    else
    {
      LOG (GNUNET_ERROR_TYPE_DEBUG,
           "Known path %s differs from proposed path\n",
           GCPP_2s (ps));
    }
  }
 
  ct_desirability = GCPP_get_desirability (ps);
  metrics = GCC_get_metrics (cc);
  uptime = GNUNET_TIME_absolute_get_duration (metrics->age);
  last_use = GNUNET_TIME_absolute_get_duration (metrics->last_use);
  /* We add 1.0 here to avoid division by zero. */
  success_rate = (metrics->num_acked_transmissions + 1.0)
                 / (metrics->num_successes + 1.0);
  score
    = ct_desirability
      + 100.0 / (1.0 + ct_length) /* longer paths = better */
      + sqrt (uptime.rel_value_us / 60000000LL) /* larger uptime = better */
      - last_use.rel_value_us / 1000L;        /* longer idle = worse */
  score *= success_rate;        /* weigh overall by success rate */
 
  if ((NULL == es->worst) ||
      (score < es->worst_score))
  {
    es->worst = ct;
    es->worst_score = score;
  }
  es->min_length = GNUNET_MIN (es->min_length,
                               ct_length);
  es->max_length = GNUNET_MAX (es->max_length,
                               ct_length);
  es->min_desire = GNUNET_MIN (es->min_desire,
                               ct_desirability);
  es->max_desire = GNUNET_MAX (es->max_desire,
                               ct_desirability);
}

References CadetConnectionMetrics::age, CadetTConnection::cc, CadetConnection::ct, EvaluationSummary::duplicate, GCC_2s(), GCC_get_metrics(), GCC_get_path(), GCPP_2s(), GCPP_get_desirability(), GCPP_get_length(), GCPP_get_peer_at_offset(), GNUNET_assert, GNUNET_ERROR_TYPE_DEBUG, GNUNET_MAX, GNUNET_MIN, GNUNET_NO, GNUNET_TIME_absolute_get_duration(), GNUNET_YES, CadetConnectionMetrics::last_use, LOG, EvaluationSummary::max_desire, EvaluationSummary::max_length, EvaluationSummary::min_desire, EvaluationSummary::min_length, CadetConnectionMetrics::num_acked_transmissions, CadetConnectionMetrics::num_successes, CadetConnection::off, EvaluationSummary::path, ps, GNUNET_TIME_Relative::rel_value_us, EvaluationSummary::worst, and EvaluationSummary::worst_score.

Referenced by consider_path_cb(), and maintain_connections_cb().

Here is the call graph for this function:

Here is the caller graph for this function:

consider_path_cb()

static int consider_path_cb ( void *  cls, struct CadetPeerPath *  path, unsigned int  off  )

static

Consider using the path p for the tunnel t.

The tunnel destination is at offset off in path p.

Parameters

cls	our tunnel
path	a path to our destination
off	offset of the destination on path path

Returns

GNUNET_YES (should keep iterating)

Definition at line 2827 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct EvaluationSummary es;
  struct CadetTConnection *ct;
 
  GNUNET_assert (off < GCPP_get_length (path));
  GNUNET_assert (GCPP_get_peer_at_offset (path,
                                          off) == t->destination);
  es.min_length = UINT_MAX;
  es.max_length = 0;
  es.max_desire = 0;
  es.min_desire = UINT64_MAX;
  es.path = path;
  es.duplicate = GNUNET_NO;
  es.worst = NULL;
 
  /* Compute evaluation summary over existing connections. */
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Evaluating proposed path %s for target %s\n",
       GCPP_2s (path),
       GCT_2s (t));
  /* FIXME: suspect this does not ACTUALLY iterate
     over all existing paths, otherwise dup detection
     should work!!! */
  GCT_iterate_connections (t,
                           &evaluate_connection,
                           &es);
  if (GNUNET_YES == es.duplicate)
    return GNUNET_YES;
 
  /* FIXME: not sure we should really just count
     'num_connections' here, as they may all have
     consistently failed to connect. */
 
  /* We iterate by increasing path length; if we have enough paths and
     this one is more than twice as long than what we are currently
     using, then ignore all of these super-long ones! */
  if ((GCT_count_any_connections (t) > DESIRED_CONNECTIONS_PER_TUNNEL) &&
      (es.min_length * 2 < off) &&
      (es.max_length < off))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ignoring paths of length %u, they are way too long.\n",
         es.min_length * 2);
    return GNUNET_NO;
  }
  /* If we have enough paths and this one looks no better, ignore it. */
  if ((GCT_count_any_connections (t) >= DESIRED_CONNECTIONS_PER_TUNNEL) &&
      (es.min_length < GCPP_get_length (path)) &&
      (es.min_desire > GCPP_get_desirability (path)) &&
      (es.max_length < off))
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Ignoring path (%u/%llu) to %s, got something better already.\n",
         GCPP_get_length (path),
         (unsigned long long) GCPP_get_desirability (path),
         GCP_2s (t->destination));
    return GNUNET_YES;
  }
 
  /* Path is interesting (better by some metric, or we don't have
     enough paths yet). */
  ct = GNUNET_new (struct CadetTConnection);
  ct->created = GNUNET_TIME_absolute_get ();
  ct->t = t;
  ct->cc = GCC_create (t->destination,
                       path,
                       off,
                       ct,
                       &connection_ready_cb,
                       ct);
 
  /* FIXME: schedule job to kill connection (and path?)  if it takes
     too long to get ready! (And track performance data on how long
     other connections took with the tunnel!)
     => Note: to be done within 'connection'-logic! */
  GNUNET_CONTAINER_DLL_insert (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  t->num_busy_connections++;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Found interesting path %s for %s, created %s\n",
       GCPP_2s (path),
       GCT_2s (t),
       GCC_2s (ct->cc));
  return GNUNET_YES;
}

References CadetTConnection::cc, connection_ready_cb(), CadetTConnection::created, DESIRED_CONNECTIONS_PER_TUNNEL, EvaluationSummary::duplicate, evaluate_connection(), GCC_2s(), GCC_create(), GCP_2s(), GCPP_2s(), GCPP_get_desirability(), GCPP_get_length(), GCPP_get_peer_at_offset(), GCT_2s(), GCT_count_any_connections(), GCT_iterate_connections(), GNUNET_assert, GNUNET_CONTAINER_DLL_insert, GNUNET_ERROR_TYPE_DEBUG, GNUNET_new, GNUNET_NO, GNUNET_TIME_absolute_get(), GNUNET_YES, LOG, EvaluationSummary::max_desire, EvaluationSummary::max_length, EvaluationSummary::min_desire, EvaluationSummary::min_length, EvaluationSummary::path, t, CadetTConnection::t, and EvaluationSummary::worst.

Referenced by GCT_consider_path(), and maintain_connections_cb().

Here is the call graph for this function:

Here is the caller graph for this function:

maintain_connections_cb()

static void maintain_connections_cb ( void *  cls )

static

Function called to maintain the connections underlying our tunnel.

Tries to maintain (incl. tear down) connections for the tunnel, and if there is a significant change, may trigger transmissions.

Basically, needs to check if there are connections that perform badly, and if so eventually kill them and trigger a replacement. The strategy is to open one more connection than DESIRED_CONNECTIONS_PER_TUNNEL, and then periodically kick out the least-performing one, and then inquire for new ones.

Parameters

cls	the struct CadetTunnel

Definition at line 2933 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct GNUNET_TIME_Relative delay;
  struct EvaluationSummary es;
 
  t->maintain_connections_task = NULL;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Performing connection maintenance for %s.\n",
       GCT_2s (t));
 
  es.min_length = UINT_MAX;
  es.max_length = 0;
  es.max_desire = 0;
  es.min_desire = UINT64_MAX;
  es.path = NULL;
  es.worst = NULL;
  es.duplicate = GNUNET_NO;
  GCT_iterate_connections (t,
                           &evaluate_connection,
                           &es);
  if ((NULL != es.worst) &&
      (GCT_count_any_connections (t) > DESIRED_CONNECTIONS_PER_TUNNEL))
  {
    /* Clear out worst-performing connection 'es.worst'. */
    destroy_t_connection (t,
                          es.worst);
  }
 
  /* Consider additional paths */
  (void) GCP_iterate_paths (t->destination,
                            &consider_path_cb,
                            t);
 
  /* FIXME: calculate when to try again based on how well we are doing;
     in particular, if we have to few connections, we might be able
     to do without this (as PATHS should tell us whenever a new path
     is available instantly; however, need to make sure this job is
     restarted after that happens).
     Furthermore, if the paths we do know are in a reasonably narrow
     quality band and are plentyful, we might also consider us stabilized
     and then reduce the frequency accordingly.  */delay = GNUNET_TIME_UNIT_MINUTES;
  t->maintain_connections_task
    = GNUNET_SCHEDULER_add_delayed (delay,
                                    &maintain_connections_cb,
                                    t);
}

References consider_path_cb(), DESIRED_CONNECTIONS_PER_TUNNEL, destroy_t_connection(), EvaluationSummary::duplicate, evaluate_connection(), GCP_iterate_paths(), GCT_2s(), GCT_count_any_connections(), GCT_iterate_connections(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_NO, GNUNET_SCHEDULER_add_delayed(), GNUNET_TIME_UNIT_MINUTES, LOG, maintain_connections_cb(), EvaluationSummary::max_desire, EvaluationSummary::max_length, EvaluationSummary::min_desire, EvaluationSummary::min_length, EvaluationSummary::path, t, and EvaluationSummary::worst.

Referenced by GCT_create_tunnel(), and maintain_connections_cb().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_consider_path()

void GCT_consider_path	(	struct CadetTunnel *	t,
		struct CadetPeerPath *	p,
		unsigned int	off
	)

Consider using the path p for the tunnel t.

The tunnel destination is at offset off in path p.

Parameters

t	our tunnel
p	a path to our destination
off	offset of the destination on path path

Definition at line 2983 of file gnunet-service-cadet_tunnels.c.

{
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Considering %s for %s (offset %u)\n",
       GCPP_2s (p),
       GCT_2s (t),
       off);
  (void) consider_path_cb (t,
                           p,
                           off);
}

References consider_path_cb(), GCPP_2s(), GCT_2s(), GNUNET_ERROR_TYPE_DEBUG, LOG, p, and t.

Referenced by GCP_path_entry_add(), and GCP_set_mq().

Here is the call graph for this function:

Here is the caller graph for this function:

handle_plaintext_keepalive()

static void handle_plaintext_keepalive ( void *  cls, const struct GNUNET_MessageHeader *  msg  )

static

We got a keepalive.

Track in statistics.

Parameters

cls	the struct CadetTunnel for which we decrypted the message
msg	the message we received on the tunnel

Definition at line 3005 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received KEEPALIVE on %s\n",
       GCT_2s (t));
  GNUNET_STATISTICS_update (stats,
                            "# keepalives received",
                            1,
                            GNUNET_NO);
}

References GCT_2s(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_NO, GNUNET_STATISTICS_update(), LOG, stats, and t.

Here is the call graph for this function:

check_plaintext_data()

static int check_plaintext_data ( void *  cls, const struct GNUNET_CADET_ChannelAppDataMessage *  msg  )

static

Check that msg is well-formed.

Parameters

cls	the struct CadetTunnel for which we decrypted the message
msg	the message we received on the tunnel

Returns

GNUNET_OK (any variable-size payload goes)

Definition at line 3028 of file gnunet-service-cadet_tunnels.c.

{
  return GNUNET_OK;
}

References GNUNET_OK.

handle_plaintext_data()

static void handle_plaintext_data ( void *  cls, const struct GNUNET_CADET_ChannelAppDataMessage *  msg  )

static

We received payload data for a channel.

Locate the channel and process the data, or return an error if the channel is unknown.

Parameters

cls	the struct CadetTunnel for which we decrypted the message
msg	the message we received on the tunnel

Definition at line 3043 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       msg->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. Send back a DESTROY. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received %u bytes of application data for unknown channel %u, sending DESTROY\n",
         (unsigned int) (ntohs (msg->header.size) - sizeof(*msg)),
         ntohl (msg->ctn.cn));
    GCT_send_channel_destroy (t,
                              msg->ctn);
    return;
  }
  GCCH_handle_channel_plaintext_data (ch,
                                      GCC_get_id (t->current_ct->cc),
                                      msg);
}

References ch, GCC_get_id(), GCCH_handle_channel_plaintext_data(), GCT_send_channel_destroy(), GNUNET_ERROR_TYPE_DEBUG, LOG, lookup_channel(), msg, GNUNET_MessageHeader::size, and t.

Here is the call graph for this function:

handle_plaintext_data_ack()

static void handle_plaintext_data_ack ( void *  cls, const struct GNUNET_CADET_ChannelDataAckMessage *  ack  )

static

We received an acknowledgement for data we sent on a channel.

Locate the channel and process it, or return an error if the channel is unknown.

Parameters

cls	the struct CadetTunnel for which we decrypted the message
ack	the message we received on the tunnel

Definition at line 3078 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       ack->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. Send back a DESTROY. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received DATA_ACK for unknown channel %u, sending DESTROY\n",
         ntohl (ack->ctn.cn));
    GCT_send_channel_destroy (t,
                              ack->ctn);
    return;
  }
  GCCH_handle_channel_plaintext_data_ack (ch,
                                          GCC_get_id (t->current_ct->cc),
                                          ack);
}

References ch, GNUNET_CADET_ChannelTunnelNumber::cn, GNUNET_CADET_ChannelDataAckMessage::ctn, GCC_get_id(), GCCH_handle_channel_plaintext_data_ack(), GCT_send_channel_destroy(), GNUNET_ERROR_TYPE_DEBUG, LOG, lookup_channel(), and t.

Here is the call graph for this function:

handle_plaintext_channel_open()

static void handle_plaintext_channel_open ( void *  cls, const struct GNUNET_CADET_ChannelOpenMessage *  copen  )

static

We have received a request to open a channel to a port from another peer.

Creates the incoming channel.

Parameters

cls	the struct CadetTunnel for which we decrypted the message
copen	the message we received on the tunnel

Definition at line 3111 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = GNUNET_CONTAINER_multihashmap32_get (t->channels,
                                            ntohl (copen->ctn.cn));
  if (NULL != ch)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received duplicate channel CHANNEL_OPEN on h_port %s from %s (%s), resending ACK\n",
         GNUNET_h2s (&copen->h_port),
         GCT_2s (t),
         GCCH_2s (ch));
    GCCH_handle_duplicate_open (ch,
                                GCC_get_id (t->current_ct->cc));
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received CHANNEL_OPEN on h_port %s from %s\n",
       GNUNET_h2s (&copen->h_port),
       GCT_2s (t));
  ch = GCCH_channel_incoming_new (t,
                                  copen->ctn,
                                  &copen->h_port,
                                  ntohl (copen->opt));
  if (NULL != t->destroy_task)
  {
    GNUNET_SCHEDULER_cancel (t->destroy_task);
    t->destroy_task = NULL;
  }
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CONTAINER_multihashmap32_put (t->channels,
                                                      ntohl (copen->ctn.cn),
                                                      ch,
                                                      GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
}

References ch, GNUNET_CADET_ChannelTunnelNumber::cn, GNUNET_CADET_ChannelOpenMessage::ctn, GCC_get_id(), GCCH_2s(), GCCH_channel_incoming_new(), GCCH_handle_duplicate_open(), GCT_2s(), GNUNET_assert, GNUNET_CONTAINER_multihashmap32_get(), GNUNET_CONTAINER_multihashmap32_put(), GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY, GNUNET_ERROR_TYPE_DEBUG, GNUNET_h2s(), GNUNET_OK, GNUNET_SCHEDULER_cancel(), GNUNET_CADET_ChannelOpenMessage::h_port, LOG, GNUNET_CADET_ChannelOpenMessage::opt, and t.

Here is the call graph for this function:

GCT_send_channel_destroy()

void GCT_send_channel_destroy	(	struct CadetTunnel *	t,
		struct GNUNET_CADET_ChannelTunnelNumber	ctn
	)

Send a DESTROY message via the tunnel.

Parameters

t	the tunnel to transmit over
ctn	ID of the channel to destroy

Definition at line 3159 of file gnunet-service-cadet_tunnels.c.

{
  struct GNUNET_CADET_ChannelDestroyMessage msg;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Sending DESTROY message for channel ID %u\n",
       ntohl (ctn.cn));
  msg.header.size = htons (sizeof(msg));
  msg.header.type = htons (GNUNET_MESSAGE_TYPE_CADET_CHANNEL_DESTROY);
  msg.reserved = htonl (0);
  msg.ctn = ctn;
  GCT_send (t,
            &msg.header,
            NULL,
            NULL,
            &ctn);
}

References GNUNET_CADET_ChannelTunnelNumber::cn, GNUNET_CADET_ChannelDestroyMessage::ctn, GCT_send(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_MESSAGE_TYPE_CADET_CHANNEL_DESTROY, LOG, msg, GNUNET_MessageHeader::size, t, and GNUNET_MessageHeader::type.

Referenced by GCCH_channel_local_destroy(), GCCH_handle_channel_plaintext_data(), GCCH_handle_local_ack(), handle_plaintext_channel_open_ack(), handle_plaintext_data(), and handle_plaintext_data_ack().

Here is the call graph for this function:

Here is the caller graph for this function:

handle_plaintext_channel_open_ack()

static void handle_plaintext_channel_open_ack ( void *  cls, const struct GNUNET_CADET_ChannelOpenAckMessage *  cm  )

static

We have received confirmation from the target peer that the given channel could be established (the port is open).

Tell the client.

Parameters

cls	the struct CadetTunnel for which we decrypted the message
cm	the message we received on the tunnel

Definition at line 3188 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       cm->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. Send back a DESTROY. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received channel OPEN_ACK for unknown channel %u, sending DESTROY\n",
         ntohl (cm->ctn.cn));
    GCT_send_channel_destroy (t,
                              cm->ctn);
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received channel OPEN_ACK on channel %s from %s\n",
       GCCH_2s (ch),
       GCT_2s (t));
  GCCH_handle_channel_open_ack (ch,
                                GCC_get_id (t->current_ct->cc),
                                &cm->port);
}

References ch, GNUNET_CADET_ChannelTunnelNumber::cn, GNUNET_CADET_ChannelOpenAckMessage::ctn, GCC_get_id(), GCCH_2s(), GCCH_handle_channel_open_ack(), GCT_2s(), GCT_send_channel_destroy(), GNUNET_ERROR_TYPE_DEBUG, LOG, lookup_channel(), GNUNET_CADET_ChannelOpenAckMessage::port, and t.

Here is the call graph for this function:

handle_plaintext_channel_destroy()

static void handle_plaintext_channel_destroy ( void *  cls, const struct GNUNET_CADET_ChannelDestroyMessage *  cm  )

static

We received a message saying that a channel should be destroyed.

Pass it on to the correct channel.

Parameters

cls	the struct CadetTunnel for which we decrypted the message
cm	the message we received on the tunnel

Definition at line 3226 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
  struct CadetChannel *ch;
 
  ch = lookup_channel (t,
                       cm->ctn);
  if (NULL == ch)
  {
    /* We don't know about such a channel, might have been destroyed on our
       end in the meantime, or never existed. */
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Received channel DESTROY for unknown channel %u. Ignoring.\n",
         ntohl (cm->ctn.cn));
    return;
  }
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received channel DESTROY on %s from %s\n",
       GCCH_2s (ch),
       GCT_2s (t));
  GCCH_handle_remote_destroy (ch,
                              GCC_get_id (t->current_ct->cc));
}

References ch, GNUNET_CADET_ChannelTunnelNumber::cn, GNUNET_CADET_ChannelDestroyMessage::ctn, GCC_get_id(), GCCH_2s(), GCCH_handle_remote_destroy(), GCT_2s(), GNUNET_ERROR_TYPE_DEBUG, LOG, lookup_channel(), and t.

Here is the call graph for this function:

handle_decrypted()

static int handle_decrypted ( void *  cls, const struct GNUNET_MessageHeader *  msg  )

static

Handles a message we decrypted, by injecting it into our message queue (which will do the dispatching).

Parameters

cls	the struct CadetTunnel that got the message
msg	the message

Returns

GNUNET_OK on success (always) GNUNET_NO to stop further processing (no error) GNUNET_SYSERR to stop further processing with error

Definition at line 3264 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = cls;
 
  GNUNET_assert (NULL != t->current_ct);
  GNUNET_MQ_inject_message (t->mq,
                            msg);
  return GNUNET_OK;
}

References GNUNET_assert, GNUNET_MQ_inject_message(), GNUNET_OK, msg, and t.

Referenced by GCT_create_tunnel().

Here is the call graph for this function:

Here is the caller graph for this function:

decrypted_error_cb()

static void decrypted_error_cb ( void *  cls, enum GNUNET_MQ_Error  error  )

static

Function called if we had an error processing an incoming decrypted message.

Parameters

cls	the struct CadetTunnel
error	error code

Definition at line 3284 of file gnunet-service-cadet_tunnels.c.

{
  GNUNET_break_op (0);
}

References GNUNET_break_op.

Referenced by GCT_create_tunnel().

Here is the caller graph for this function:

GCT_create_tunnel()

struct CadetTunnel * GCT_create_tunnel

(

struct CadetPeer *

destination

)

Create a tunnel to destination.

Must only be called from within GCP_get_tunnel().

Parameters

destination

where to create the tunnel to

Returns

new tunnel to destination

Definition at line 3299 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = GNUNET_new (struct CadetTunnel);
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_fixed_size (plaintext_keepalive,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_KEEPALIVE,
                             struct GNUNET_MessageHeader,
                             t),
    GNUNET_MQ_hd_var_size (plaintext_data,
                           GNUNET_MESSAGE_TYPE_CADET_CHANNEL_APP_DATA,
                           struct GNUNET_CADET_ChannelAppDataMessage,
                           t),
    GNUNET_MQ_hd_fixed_size (plaintext_data_ack,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_APP_DATA_ACK,
                             struct GNUNET_CADET_ChannelDataAckMessage,
                             t),
    GNUNET_MQ_hd_fixed_size (plaintext_channel_open,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_OPEN,
                             struct GNUNET_CADET_ChannelOpenMessage,
                             t),
    GNUNET_MQ_hd_fixed_size (plaintext_channel_open_ack,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_OPEN_ACK,
                             struct GNUNET_CADET_ChannelOpenAckMessage,
                             t),
    GNUNET_MQ_hd_fixed_size (plaintext_channel_destroy,
                             GNUNET_MESSAGE_TYPE_CADET_CHANNEL_DESTROY,
                             struct GNUNET_CADET_ChannelDestroyMessage,
                             t),
    GNUNET_MQ_handler_end ()
  };
 
  t->kx_retry_delay = INITIAL_KX_RETRY_DELAY;
  new_ephemeral (&t->ax);
  GNUNET_CRYPTO_ecdhe_key_create (&t->ax.kx_0);
  t->destination = destination;
  t->channels = GNUNET_CONTAINER_multihashmap32_create (8);
  t->maintain_connections_task
    = GNUNET_SCHEDULER_add_now (&maintain_connections_cb,
                                t);
  t->mq = GNUNET_MQ_queue_for_callbacks (NULL,
                                         NULL,
                                         NULL,
                                         NULL,
                                         handlers,
                                         &decrypted_error_cb,
                                         t);
  t->mst = GNUNET_MST_create (&handle_decrypted,
                              t);
  return t;
}

References decrypted_error_cb(), GNUNET_CONTAINER_multihashmap32_create(), GNUNET_CRYPTO_ecdhe_key_create(), GNUNET_MESSAGE_TYPE_CADET_CHANNEL_APP_DATA, GNUNET_MESSAGE_TYPE_CADET_CHANNEL_APP_DATA_ACK, GNUNET_MESSAGE_TYPE_CADET_CHANNEL_DESTROY, GNUNET_MESSAGE_TYPE_CADET_CHANNEL_KEEPALIVE, GNUNET_MESSAGE_TYPE_CADET_CHANNEL_OPEN, GNUNET_MESSAGE_TYPE_CADET_CHANNEL_OPEN_ACK, GNUNET_MQ_handler_end, GNUNET_MQ_hd_fixed_size, GNUNET_MQ_hd_var_size, GNUNET_MQ_queue_for_callbacks(), GNUNET_MST_create(), GNUNET_new, GNUNET_SCHEDULER_add_now(), handle_decrypted(), handlers, INITIAL_KX_RETRY_DELAY, maintain_connections_cb(), new_ephemeral(), and t.

Referenced by GCP_get_tunnel().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_add_inbound_connection()

int GCT_add_inbound_connection	(	struct CadetTunnel *	t,
		const struct GNUNET_CADET_ConnectionTunnelIdentifier *	cid,
		struct CadetPeerPath *	path
	)

Add a connection to the tunnel.

Parameters

t	a tunnel
cid	connection identifier to use for the connection
path	path to use for the connection

Returns

GNUNET_OK on success, GNUNET_SYSERR on failure (duplicate connection)

Definition at line 3352 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTConnection *ct;
 
  ct = GNUNET_new (struct CadetTConnection);
  ct->created = GNUNET_TIME_absolute_get ();
  ct->t = t;
  ct->cc = GCC_create_inbound (t->destination,
                               path,
                               ct,
                               cid,
                               &connection_ready_cb,
                               ct);
  if (NULL == ct->cc)
  {
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "%s refused inbound %s (duplicate)\n",
         GCT_2s (t),
         GCC_2s (ct->cc));
    GNUNET_free (ct);
    return GNUNET_SYSERR;
  }
  /* FIXME: schedule job to kill connection (and path?)  if it takes
     too long to get ready! (And track performance data on how long
     other connections took with the tunnel!)
     => Note: to be done within 'connection'-logic! */
  GNUNET_CONTAINER_DLL_insert (t->connection_busy_head,
                               t->connection_busy_tail,
                               ct);
  t->num_busy_connections++;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s has new %s\n",
       GCT_2s (t),
       GCC_2s (ct->cc));
  return GNUNET_OK;
}

References CadetTConnection::cc, connection_ready_cb(), CadetTConnection::created, GCC_2s(), GCC_create_inbound(), GCT_2s(), GNUNET_CONTAINER_DLL_insert, GNUNET_ERROR_TYPE_DEBUG, GNUNET_free, GNUNET_new, GNUNET_OK, GNUNET_SYSERR, GNUNET_TIME_absolute_get(), LOG, t, and CadetTConnection::t.

Referenced by handle_connection_create().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_handle_encrypted()

void GCT_handle_encrypted	(	struct CadetTConnection *	ct,
		const struct GNUNET_CADET_TunnelEncryptedMessage *	msg
	)

Handle encrypted message.

Parameters

ct	connection/tunnel combo that received encrypted message
msg	the encrypted message to decrypt

Definition at line 3400 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = ct->t;
  uint16_t size = ntohs (msg->header.size);
  char cbuf[size] GNUNET_ALIGN;
  ssize_t decrypted_size;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "%s received %u bytes of encrypted data in state %d\n",
       GCT_2s (t),
       (unsigned int) size,
       t->estate);
 
  switch (t->estate)
  {
  case CADET_TUNNEL_KEY_UNINITIALIZED:
  case CADET_TUNNEL_KEY_AX_RECV:
    /* We did not even SEND our KX, how can the other peer
       send us encrypted data? Must have been that we went
       down and the other peer still things we are up.
       Let's send it KX back. */
    GNUNET_STATISTICS_update (stats,
                              "# received encrypted without any KX",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    return;
 
  case CADET_TUNNEL_KEY_AX_SENT_AND_RECV:
    /* We send KX, and other peer send KX to us at the same time.
       Neither KX is AUTH'ed, so let's try KX_AUTH this time. */
    GNUNET_STATISTICS_update (stats,
                              "# received encrypted without KX_AUTH",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx_auth (t,
                  ct,
                  &t->ax,
                  GNUNET_YES);
    return;
 
  case CADET_TUNNEL_KEY_AX_SENT:
    /* We did not get the KX of the other peer, but that
       might have been lost.  Send our KX again immediately. */
    GNUNET_STATISTICS_update (stats,
                              "# received encrypted without KX",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    return;
 
  case CADET_TUNNEL_KEY_AX_AUTH_SENT:
  /* Great, first payload, we might graduate to OK! */
  case CADET_TUNNEL_KEY_OK:
    /* We are up and running, all good. */
    break;
  }
 
  decrypted_size = -1;
  if (CADET_TUNNEL_KEY_OK == t->estate)
  {
    /* We have well-established key material available,
       try that. (This is the common case.) */
    decrypted_size = t_ax_decrypt_and_validate (&t->ax,
                                                cbuf,
                                                msg,
                                                size);
  }
 
  if ((-1 == decrypted_size) &&
      (NULL != t->unverified_ax))
  {
    /* We have un-authenticated KX material available. We should try
       this as a back-up option, in case the sender crashed and
       switched keys. */
    decrypted_size = t_ax_decrypt_and_validate (t->unverified_ax,
                                                cbuf,
                                                msg,
                                                size);
    if (-1 != decrypted_size)
    {
      /* It worked! Treat this as authentication of the AX data! */
      cleanup_ax (&t->ax);
      t->ax = *t->unverified_ax;
      GNUNET_free (t->unverified_ax);
      t->unverified_ax = NULL;
    }
    if (CADET_TUNNEL_KEY_AX_AUTH_SENT == t->estate)
    {
      /* First time it worked, move tunnel into production! */
      GCT_change_estate (t,
                         CADET_TUNNEL_KEY_OK);
      if (NULL != t->send_task)
        GNUNET_SCHEDULER_cancel (t->send_task);
      t->send_task = GNUNET_SCHEDULER_add_now (&trigger_transmissions,
                                               t);
    }
  }
  if (NULL != t->unverified_ax)
  {
    /* We had unverified KX material that was useless; so increment
       counter and eventually move to ignore it.  Note that we even do
       this increment if we successfully decrypted with the old KX
       material and thus didn't even both with the new one.  This is
       the ideal case, as a malicious injection of bogus KX data
       basically only causes us to increment a counter a few times. */t->unverified_attempts++;
    LOG (GNUNET_ERROR_TYPE_DEBUG,
         "Failed to decrypt message with unverified KX data %u times\n",
         t->unverified_attempts);
    if (t->unverified_attempts > MAX_UNVERIFIED_ATTEMPTS)
    {
      cleanup_ax (t->unverified_ax);
      GNUNET_free (t->unverified_ax);
      t->unverified_ax = NULL;
    }
  }
 
  if (-1 == decrypted_size)
  {
    /* Decryption failed for good, complain. */
    LOG (GNUNET_ERROR_TYPE_WARNING,
         "%s failed to decrypt and validate encrypted data, retrying KX\n",
         GCT_2s (t));
    GNUNET_STATISTICS_update (stats,
                              "# unable to decrypt",
                              1,
                              GNUNET_NO);
    if (NULL != t->kx_task)
    {
      GNUNET_SCHEDULER_cancel (t->kx_task);
      t->kx_task = NULL;
    }
    send_kx (t,
             ct,
             &t->ax);
    return;
  }
  GNUNET_STATISTICS_update (stats,
                            "# decrypted bytes",
                            decrypted_size,
                            GNUNET_NO);
 
  /* The MST will ultimately call #handle_decrypted() on each message. */
  t->current_ct = ct;
  GNUNET_break_op (GNUNET_OK ==
                   GNUNET_MST_from_buffer (t->mst,
                                           cbuf,
                                           decrypted_size,
                                           GNUNET_YES,
                                           GNUNET_NO));
  t->current_ct = NULL;
}

References CADET_TUNNEL_KEY_AX_AUTH_SENT, CADET_TUNNEL_KEY_AX_RECV, CADET_TUNNEL_KEY_AX_SENT, CADET_TUNNEL_KEY_AX_SENT_AND_RECV, CADET_TUNNEL_KEY_OK, CADET_TUNNEL_KEY_UNINITIALIZED, cleanup_ax(), GCT_2s(), GCT_change_estate(), GNUNET_ALIGN, GNUNET_break_op, GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_WARNING, GNUNET_free, GNUNET_MST_from_buffer(), GNUNET_NO, GNUNET_OK, GNUNET_SCHEDULER_add_now(), GNUNET_SCHEDULER_cancel(), GNUNET_STATISTICS_update(), GNUNET_YES, LOG, MAX_UNVERIFIED_ATTEMPTS, msg, send_kx(), send_kx_auth(), GNUNET_MessageHeader::size, size, stats, t, CadetTConnection::t, t_ax_decrypt_and_validate(), and trigger_transmissions().

Referenced by GCC_handle_encrypted().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_send()

struct CadetTunnelQueueEntry * GCT_send	(	struct CadetTunnel *	t,
		const struct GNUNET_MessageHeader *	message,
		GCT_SendContinuation	cont,
		void *	cont_cls,
		struct GNUNET_CADET_ChannelTunnelNumber *	ctn
	)

Sends an already built message on a tunnel, encrypting it and choosing the best connection if not provided.

Parameters

message	Message to send. Function modifies it.
t	Tunnel on which this message is transmitted.
cont	Continuation to call once message is really sent.
cont_cls	Closure for cont.

Returns

Handle to cancel message.

Definition at line 3575 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnelQueueEntry *tq;
  uint16_t payload_size;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CADET_TunnelEncryptedMessage *ax_msg;
  struct CadetChannel *ch;
 
  if (NULL != ctn)
  {
    ch = lookup_channel (t,
                         *ctn);
    if ((NULL != ch) && GCCH_is_type_to_drop (ch, message))
    {
      GNUNET_break (0);
      return NULL;
    }
  }
 
  if (CADET_TUNNEL_KEY_OK != t->estate)
  {
    GNUNET_break (0);
    return NULL;
  }
  payload_size = ntohs (message->size);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Encrypting %u bytes for %s\n",
       (unsigned int) payload_size,
       GCT_2s (t));
  env = GNUNET_MQ_msg_extra (ax_msg,
                             payload_size,
                             GNUNET_MESSAGE_TYPE_CADET_TUNNEL_ENCRYPTED);
  t_ax_encrypt (&t->ax,
                &ax_msg[1],
                message,
                payload_size);
  GNUNET_STATISTICS_update (stats,
                            "# encrypted bytes",
                            payload_size,
                            GNUNET_NO);
  ax_msg->ax_header.Ns = htonl (t->ax.Ns++);
  ax_msg->ax_header.PNs = htonl (t->ax.PNs);
  /* FIXME: we should do this once, not once per message;
     this is a point multiplication, and DHRs does not
     change all the time. */
  GNUNET_CRYPTO_ecdhe_key_get_public (&t->ax.DHRs,
                                      &ax_msg->ax_header.DHRs);
  t_h_encrypt (&t->ax,
               ax_msg);
  t_hmac (&ax_msg->ax_header,
          sizeof(struct GNUNET_CADET_AxHeader) + payload_size,
          0,
          &t->ax.HKs,
          &ax_msg->hmac);
 
  tq = GNUNET_malloc (sizeof(*tq));
  tq->t = t;
  tq->env = env;
  tq->cid = &ax_msg->cid; /* will initialize 'ax_msg->cid' once we know the connection */
  tq->cont = cont;
  tq->cont_cls = cont_cls;
  GNUNET_CONTAINER_DLL_insert_tail (t->tq_head,
                                    t->tq_tail,
                                    tq);
  if (NULL != t->send_task)
    GNUNET_SCHEDULER_cancel (t->send_task);
  t->send_task
    = GNUNET_SCHEDULER_add_now (&trigger_transmissions,
                                t);
  return tq;
}

References GNUNET_CADET_TunnelEncryptedMessage::ax_header, CADET_TUNNEL_KEY_OK, ch, GNUNET_CADET_TunnelEncryptedMessage::cid, CadetTunnelQueueEntry::cid, CadetTunnelQueueEntry::cont, CadetTunnelQueueEntry::cont_cls, CadetChannel::ctn, GNUNET_CADET_AxHeader::DHRs, env, CadetTunnelQueueEntry::env, GCCH_is_type_to_drop(), GCT_2s(), GNUNET_break, GNUNET_CONTAINER_DLL_insert_tail, GNUNET_CRYPTO_ecdhe_key_get_public(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_malloc, GNUNET_MESSAGE_TYPE_CADET_TUNNEL_ENCRYPTED, GNUNET_MQ_msg_extra, GNUNET_NO, GNUNET_SCHEDULER_add_now(), GNUNET_SCHEDULER_cancel(), GNUNET_STATISTICS_update(), GNUNET_CADET_TunnelEncryptedMessage::hmac, LOG, lookup_channel(), GNUNET_CADET_AxHeader::Ns, GNUNET_CADET_AxHeader::PNs, GNUNET_MessageHeader::size, stats, t, CadetTunnelQueueEntry::t, t_ax_encrypt(), t_h_encrypt(), t_hmac(), and trigger_transmissions().

Referenced by GCCH_handle_local_data(), GCT_send_channel_destroy(), retry_transmission(), send_channel_data_ack(), send_channel_open(), send_keepalive(), and send_open_ack().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_send_cancel()

void GCT_send_cancel

(

struct CadetTunnelQueueEntry *

q

)

Cancel a previously sent message while it's in the queue.

ONLY can be called before the continuation given to the send function is called. Once the continuation is called, the message is no longer in the queue!

Parameters

q	Handle to the queue entry to cancel.

Definition at line 3653 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTunnel *t = tq->t;
 
  GNUNET_CONTAINER_DLL_remove (t->tq_head,
                               t->tq_tail,
                               tq);
  GNUNET_MQ_discard (tq->env);
  GNUNET_free (tq);
}

References CadetTunnelQueueEntry::env, GNUNET_CONTAINER_DLL_remove, GNUNET_free, GNUNET_MQ_discard(), t, and CadetTunnelQueueEntry::t.

Referenced by channel_destroy(), destroy_tunnel(), GCC_destroy(), handle_matching_ack(), send_channel_data_ack(), send_channel_open(), and send_open_ack().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_iterate_connections()

void GCT_iterate_connections	(	struct CadetTunnel *	t,
		GCT_ConnectionIterator	iter,
		void *	iter_cls
	)

Iterate over all connections of a tunnel.

Parameters

t	Tunnel whose connections to iterate.
iter	Iterator.
iter_cls	Closure for iter.

Definition at line 3673 of file gnunet-service-cadet_tunnels.c.

{
  struct CadetTConnection *n;
 
  for (struct CadetTConnection *ct = t->connection_ready_head;
       NULL != ct;
       ct = n)
  {
    n = ct->next;
    iter (iter_cls,
          ct);
  }
  for (struct CadetTConnection *ct = t->connection_busy_head;
       NULL != ct;
       ct = n)
  {
    n = ct->next;
    iter (iter_cls,
          ct);
  }
}

References CadetTConnection::next, and t.

Referenced by consider_path_cb(), destroy_tunnel(), and maintain_connections_cb().

Here is the caller graph for this function:

iterate_channels_cb()

static int iterate_channels_cb ( void *  cls, uint32_t  key, void *  value  )

static

Helper function for GCT_iterate_channels.

Parameters

cls	the struct ChanIterCls
key	unused
value	a struct CadetChannel

Returns

GNUNET_OK

Definition at line 3724 of file gnunet-service-cadet_tunnels.c.

{
  struct ChanIterCls *ctx = cls;
  struct CadetChannel *ch = value;
 
  ctx->iter (ctx->iter_cls,
             ch);
  return GNUNET_OK;
}

References ch, ctx, GNUNET_OK, and value.

Referenced by GCT_iterate_channels().

Here is the caller graph for this function:

GCT_iterate_channels()

void GCT_iterate_channels	(	struct CadetTunnel *	t,
		GCT_ChannelIterator	iter,
		void *	iter_cls
	)

Iterate over all channels of a tunnel.

Parameters

t	Tunnel whose channels to iterate.
iter	Iterator.
iter_cls	Closure for iter.

Definition at line 3745 of file gnunet-service-cadet_tunnels.c.

{
  struct ChanIterCls ctx;
 
  ctx.iter = iter;
  ctx.iter_cls = iter_cls;
  GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                           &iterate_channels_cb,
                                           &ctx);
}

References ctx, GNUNET_CONTAINER_multihashmap32_iterate(), ChanIterCls::iter, ChanIterCls::iter_cls, iterate_channels_cb(), and t.

Here is the call graph for this function:

debug_channel()

static int debug_channel ( void *  cls, uint32_t  key, void *  value  )

static

Call GCCH_debug() on a channel.

Parameters

cls	points to the log level to use
key	unused
value	the struct CadetChannel to dump

Returns

GNUNET_OK (continue iteration)

Definition at line 3768 of file gnunet-service-cadet_tunnels.c.

{
  const enum GNUNET_ErrorType *level = cls;
  struct CadetChannel *ch = value;
 
  GCCH_debug (ch, *level);
  return GNUNET_OK;
}

References ch, GCCH_debug(), GNUNET_OK, and value.

Referenced by GCT_debug().

Here is the call graph for this function:

Here is the caller graph for this function:

GCT_debug()

void GCT_debug	(	const struct CadetTunnel *	t,
		enum GNUNET_ErrorType	level
	)

Log all possible info about the tunnel state.

Parameters

t	Tunnel to debug.
level	Debug level to use.

Definition at line 3791 of file gnunet-service-cadet_tunnels.c.

{
#if ! defined(GNUNET_CULL_LOGGING)
  struct CadetTConnection *iter_c;
  int do_log;
 
  do_log = GNUNET_get_log_call_status (level & (~GNUNET_ERROR_TYPE_BULK),
                                       "cadet-tun",
                                       __FILE__, __FUNCTION__, __LINE__);
  if (0 == do_log)
    return;
 
  LOG2 (level,
        "TTT TUNNEL TOWARDS %s in estate %s tq_len: %u #cons: %u\n",
        GCT_2s (t),
        estate2s (t->estate),
        t->tq_len,
        GCT_count_any_connections (t));
  LOG2 (level,
        "TTT channels:\n");
  GNUNET_CONTAINER_multihashmap32_iterate (t->channels,
                                           &debug_channel,
                                           &level);
  LOG2 (level,
        "TTT connections:\n");
  for (iter_c = t->connection_ready_head; NULL != iter_c; iter_c = iter_c->next)
    GCC_debug (iter_c->cc,
               level);
  for (iter_c = t->connection_busy_head; NULL != iter_c; iter_c = iter_c->next)
    GCC_debug (iter_c->cc,
               level);
 
  LOG2 (level,
        "TTT TUNNEL END\n");
#endif
}

References CadetTConnection::cc, debug_channel(), estate2s(), GCC_debug(), GCT_2s(), GCT_count_any_connections(), GNUNET_CONTAINER_multihashmap32_iterate(), GNUNET_ERROR_TYPE_BULK, GNUNET_get_log_call_status(), LOG2, CadetTConnection::next, and t.

Here is the call graph for this function: