ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/protocol.C
(Generate patch)

Comparing gvpe/src/protocol.C (file contents):
Revision 1.20 by pcg, Wed Mar 26 17:59:12 2003 UTC vs.
Revision 1.23 by pcg, Fri Mar 28 05:40:54 2003 UTC

… …
58 58
59static time_t next_timecheck; 59static time_t next_timecheck;
60 60
61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
62 62
63static u8
64best_protocol (u8 protset)
65{
66 if (protset & PROT_IPv4)
67 return PROT_IPv4;
68
69 return PROT_UDPv4;
70}
71
63struct crypto_ctx 72struct crypto_ctx
64 { 73 {
65 EVP_CIPHER_CTX cctx; 74 EVP_CIPHER_CTX cctx;
66 HMAC_CTX hctx; 75 HMAC_CTX hctx;
67 76
… …
237}; 246};
238 247
239// only do action once every x seconds per host whole allowing bursts. 248// only do action once every x seconds per host whole allowing bursts.
240// this implementation ("splay list" ;) is inefficient, 249// this implementation ("splay list" ;) is inefficient,
241// but low on resources. 250// but low on resources.
242struct net_rate_limiter : private list<net_rateinfo> 251struct net_rate_limiter : list<net_rateinfo>
243{ 252{
244 static const double ALPHA = 1. - 1. / 90.; // allow bursts 253 static const double ALPHA = 1. - 1. / 90.; // allow bursts
245 static const double CUTOFF = 20.; // one event every CUTOFF seconds 254 static const double CUTOFF = 20.; // one event every CUTOFF seconds
246 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 255 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
247 256
257 bool can (const sockinfo &si) { return can((u32)si.host); }
248 bool can (u32 host); 258 bool can (u32 host);
249 bool can (SOCKADDR *sa) { return can((u32)sa->sin_addr.s_addr); }
250 bool can (sockinfo &si) { return can((u32)si.host); }
251}; 259};
252 260
253net_rate_limiter auth_rate_limiter, reset_rate_limiter; 261net_rate_limiter auth_rate_limiter, reset_rate_limiter;
254 262
255bool net_rate_limiter::can (u32 host) 263bool net_rate_limiter::can (u32 host)
… …
362 u8 type; 370 u8 type;
363 u8 srcdst, src1, dst1; 371 u8 srcdst, src1, dst1;
364 372
365 void set_hdr (ptype type, unsigned int dst); 373 void set_hdr (ptype type, unsigned int dst);
366 374
367 unsigned int src () 375 unsigned int src () const
368 { 376 {
369 return src1 | ((srcdst >> 4) << 8); 377 return src1 | ((srcdst >> 4) << 8);
370 } 378 }
371 379
372 unsigned int dst () 380 unsigned int dst () const
373 { 381 {
374 return dst1 | ((srcdst & 0xf) << 8); 382 return dst1 | ((srcdst & 0xf) << 8);
375 } 383 }
376 384
377 ptype typ () 385 ptype typ () const
378 { 386 {
379 return (ptype) type; 387 return (ptype) type;
380 } 388 }
381 }; 389 };
382 390
… …
537 { 545 {
538 return 0x80 546 return 0x80
539 | (ENABLE_COMPRESSION ? 0x01 : 0x00); 547 | (ENABLE_COMPRESSION ? 0x01 : 0x00);
540 } 548 }
541 549
542 void setup (ptype type, int dst) 550 void setup (ptype type, int dst);
543 {
544 prot_major = PROTOCOL_MAJOR;
545 prot_minor = PROTOCOL_MINOR;
546 randsize = RAND_SIZE;
547 hmaclen = HMACLENGTH;
548 flags = curflags ();
549 challengelen = sizeof (rsachallenge);
550
551 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
552 digest_nid = htonl (EVP_MD_type (RSA_HASH));
553 hmac_nid = htonl (EVP_MD_type (DIGEST));
554
555 len = sizeof (*this) - sizeof (net_packet);
556 set_hdr (type, dst);
557 }
558
559 bool chk_config () 551 bool chk_config () const;
560 {
561 return prot_major == PROTOCOL_MAJOR
562 && randsize == RAND_SIZE
563 && hmaclen == HMACLENGTH
564 && flags == curflags ()
565 && challengelen == sizeof (rsachallenge)
566 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
567 && digest_nid == htonl (EVP_MD_type (RSA_HASH))
568 && hmac_nid == htonl (EVP_MD_type (DIGEST));
569 }
570}; 552};
571 553
554void config_packet::setup (ptype type, int dst)
555{
556 prot_major = PROTOCOL_MAJOR;
557 prot_minor = PROTOCOL_MINOR;
558 randsize = RAND_SIZE;
559 hmaclen = HMACLENGTH;
560 flags = curflags ();
561 challengelen = sizeof (rsachallenge);
562
563 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
564 digest_nid = htonl (EVP_MD_type (RSA_HASH));
565 hmac_nid = htonl (EVP_MD_type (DIGEST));
566
567 len = sizeof (*this) - sizeof (net_packet);
568 set_hdr (type, dst);
569}
570
571bool config_packet::chk_config () const
572{
573 return prot_major == PROTOCOL_MAJOR
574 && randsize == RAND_SIZE
575 && hmaclen == HMACLENGTH
576 && flags == curflags ()
577 && challengelen == sizeof (rsachallenge)
578 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
579 && digest_nid == htonl (EVP_MD_type (RSA_HASH))
580 && hmac_nid == htonl (EVP_MD_type (DIGEST));
581}
582
572struct auth_req_packet : config_packet 583struct auth_req_packet : config_packet
573{ 584{
574 char magic[8]; 585 char magic[8];
575 u8 initiate; // false if this is just an automatic reply 586 u8 initiate, can_recv; // false if this is just an automatic reply
576 u8 pad1, pad2, pad3; 587 u8 pad2, pad3;
577 rsaid id; 588 rsaid id;
578 rsaencrdata encr; 589 rsaencrdata encr;
579 590
580 auth_req_packet (int dst, bool initiate_) 591 auth_req_packet (int dst, bool initiate_, u8 can_recv_)
581 { 592 {
582 config_packet::setup (PT_AUTH_REQ, dst); 593 config_packet::setup (PT_AUTH_REQ, dst);
594 strncpy (magic, MAGIC, 8);
583 initiate = !!initiate_; 595 initiate = !!initiate_;
584 strncpy (magic, MAGIC, 8); 596 can_recv = can_recv_;
597
585 len = sizeof (*this) - sizeof (net_packet); 598 len = sizeof (*this) - sizeof (net_packet);
586 } 599 }
587}; 600};
588 601
589struct auth_res_packet : config_packet 602struct auth_res_packet : config_packet
… …
594 rsaresponse response; 607 rsaresponse response;
595 608
596 auth_res_packet (int dst) 609 auth_res_packet (int dst)
597 { 610 {
598 config_packet::setup (PT_AUTH_RES, dst); 611 config_packet::setup (PT_AUTH_RES, dst);
612
599 len = sizeof (*this) - sizeof (net_packet); 613 len = sizeof (*this) - sizeof (net_packet);
600 } 614 }
601}; 615};
602 616
603struct connect_req_packet : vpn_packet 617struct connect_req_packet : vpn_packet
… …
613 } 627 }
614}; 628};
615 629
616struct connect_info_packet : vpn_packet 630struct connect_info_packet : vpn_packet
617{ 631{
618 u8 id; 632 u8 id, can_recv;
619 u8 pad1, pad2, pad3; 633 u8 pad1, pad2;
620 sockinfo si; 634 sockinfo si;
621 635
622 connect_info_packet (int dst, int id_, sockinfo &si_) 636 connect_info_packet (int dst, int id_, sockinfo &si_, u8 can_recv_)
623 { 637 {
624 id = id_; 638 id = id_;
639 can_recv = can_recv_;
625 si = si_; 640 si = si_;
626 set_hdr (PT_CONNECT_INFO, dst); 641 set_hdr (PT_CONNECT_INFO, dst);
642
627 len = sizeof (*this) - sizeof (net_packet); 643 len = sizeof (*this) - sizeof (net_packet);
628 } 644 }
629}; 645};
630 646
631///////////////////////////////////////////////////////////////////////////// 647/////////////////////////////////////////////////////////////////////////////
632 648
633void 649void
634fill_sa (SOCKADDR *sa, conf_node *conf)
635{
636 sa->sin_family = AF_INET;
637 sa->sin_port = htons (conf->port);
638 sa->sin_addr.s_addr = 0;
639
640 if (conf->hostname)
641 {
642 struct hostent *he = gethostbyname (conf->hostname);
643
644 if (he
645 && he->h_addrtype == AF_INET && he->h_length == 4 && he->h_addr_list[0])
646 {
647 //sa->sin_family = he->h_addrtype;
648 memcpy (&sa->sin_addr, he->h_addr_list[0], 4);
649 }
650 else
651 slog (L_NOTICE, _("unable to resolve host '%s'"), conf->hostname);
652 }
653}
654
655void
656connection::reset_dstaddr () 650connection::reset_dstaddr ()
657{ 651{
658 fill_sa (&sa, conf); 652 si.set (conf);
659} 653}
660 654
661void 655void
662connection::send_ping (SOCKADDR *dsa, u8 pong) 656connection::send_ping (const sockinfo &si, u8 pong)
663{ 657{
664 ping_packet *pkt = new ping_packet; 658 ping_packet *pkt = new ping_packet;
665 659
666 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 660 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
667 vpn->send_vpn_packet (pkt, dsa, IPTOS_LOWDELAY); 661 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
668 662
669 delete pkt; 663 delete pkt;
670} 664}
671 665
672void 666void
673connection::send_reset (SOCKADDR *dsa) 667connection::send_reset (const sockinfo &si)
674{ 668{
675 if (reset_rate_limiter.can (dsa) && connectmode != conf_node::C_DISABLED) 669 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
676 { 670 {
677 config_packet *pkt = new config_packet; 671 config_packet *pkt = new config_packet;
678 672
679 pkt->setup (vpn_packet::PT_RESET, conf->id); 673 pkt->setup (vpn_packet::PT_RESET, conf->id);
680 vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST); 674 send_vpn_packet (pkt, si, IPTOS_MINCOST);
681 675
682 delete pkt; 676 delete pkt;
683 } 677 }
684} 678}
685 679
686void 680void
687connection::send_auth_request (SOCKADDR *sa, bool initiate) 681connection::send_auth_request (const sockinfo &si, bool initiate)
688{ 682{
689 if (!initiate || auth_rate_limiter.can (sa))
690 {
691 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate); 683 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->can_recv);
692 684
685 // the next line is very conservative
686 prot_send = best_protocol (THISNODE->can_send & THISNODE->can_recv & conf->can_recv);
687
693 rsachallenge chg; 688 rsachallenge chg;
694 689
695 rsa_cache.gen (pkt->id, chg); 690 rsa_cache.gen (pkt->id, chg);
696 691
697 if (0 > RSA_public_encrypt (sizeof chg, 692 if (0 > RSA_public_encrypt (sizeof chg,
698 (unsigned char *)&chg, (unsigned char *)&pkt->encr, 693 (unsigned char *)&chg, (unsigned char *)&pkt->encr,
699 conf->rsa_key, RSA_PKCS1_OAEP_PADDING)) 694 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
700 fatal ("RSA_public_encrypt error"); 695 fatal ("RSA_public_encrypt error");
701 696
702 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)sockinfo (sa)); 697 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
703 698
704 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly 699 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
705 700
706 delete pkt; 701 delete pkt;
707 }
708} 702}
709 703
710void 704void
711connection::send_auth_response (SOCKADDR *sa, const rsaid &id, const rsachallenge &chg) 705connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg)
712{ 706{
713 auth_res_packet *pkt = new auth_res_packet (conf->id); 707 auth_res_packet *pkt = new auth_res_packet (conf->id);
714 708
715 pkt->id = id; 709 pkt->id = id;
716 710
717 rsa_hash (id, chg, pkt->response); 711 rsa_hash (id, chg, pkt->response);
718 712
719 pkt->hmac_set (octx); 713 pkt->hmac_set (octx);
720 714
721 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)sockinfo (sa)); 715 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);
722 716
723 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly 717 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
724 718
725 delete pkt; 719 delete pkt;
726} 720}
727 721
728void 722void
… …
742 ts = NOW + retry_int; 736 ts = NOW + retry_int;
743 737
744 if (conf->hostname) 738 if (conf->hostname)
745 { 739 {
746 reset_dstaddr (); 740 reset_dstaddr ();
747 if (sa.sin_addr.s_addr) 741 if (si.host && auth_rate_limiter.can (si))
742 {
748 if (retry_cnt < 4) 743 if (retry_cnt < 4)
749 send_auth_request (&sa, true); 744 send_auth_request (si, true);
750 else if (auth_rate_limiter.can (&sa)) 745 else
751 send_ping (&sa, 0); 746 send_ping (si, 0);
747 }
752 } 748 }
753 else 749 else
754 vpn->connect_request (conf->id); 750 vpn->connect_request (conf->id);
755 } 751 }
756} 752}
… …
759connection::reset_connection () 755connection::reset_connection ()
760{ 756{
761 if (ictx && octx) 757 if (ictx && octx)
762 { 758 {
763 slog (L_INFO, _("%s(%s): connection lost"), 759 slog (L_INFO, _("%s(%s): connection lost"),
764 conf->nodename, (const char *)sockinfo (sa)); 760 conf->nodename, (const char *)si);
765 761
766 if (::conf.script_node_down) 762 if (::conf.script_node_down)
767 run_script (run_script_cb (this, &connection::script_node_down), false); 763 run_script (run_script_cb (this, &connection::script_node_down), false);
768 } 764 }
769 765
770 delete ictx; ictx = 0; 766 delete ictx; ictx = 0;
771 delete octx; octx = 0; 767 delete octx; octx = 0;
772 768
773 sa.sin_port = 0; 769 si.host= 0;
774 sa.sin_addr.s_addr = 0;
775 770
776 last_activity = 0; 771 last_activity = 0;
772 retry_cnt = 0;
777 773
778 rekey.reset (); 774 rekey.reset ();
779 keepalive.reset (); 775 keepalive.reset ();
780 establish_connection.reset (); 776 establish_connection.reset ();
781} 777}
782 778
783void 779void
784connection::shutdown () 780connection::shutdown ()
785{ 781{
786 if (ictx && octx) 782 if (ictx && octx)
787 send_reset (&sa); 783 send_reset (si);
788 784
789 reset_connection (); 785 reset_connection ();
790} 786}
791 787
792void 788void
… …
797 reset_connection (); 793 reset_connection ();
798 establish_connection (); 794 establish_connection ();
799} 795}
800 796
801void 797void
802connection::send_data_packet (tap_packet * pkt, bool broadcast) 798connection::send_data_packet (tap_packet *pkt, bool broadcast)
803{ 799{
804 vpndata_packet *p = new vpndata_packet; 800 vpndata_packet *p = new vpndata_packet;
805 int tos = 0; 801 int tos = 0;
806 802
807 if (conf->inherit_tos 803 if (conf->inherit_tos
808 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 804 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
809 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4 805 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
810 tos = (*pkt)[15] & IPTOS_TOS_MASK; 806 tos = (*pkt)[15] & IPTOS_TOS_MASK;
811 807
812 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 808 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
813 vpn->send_vpn_packet (p, &sa, tos); 809 send_vpn_packet (p, si, tos);
814 810
815 delete p; 811 delete p;
816 812
817 if (oseqno > MAX_SEQNO) 813 if (oseqno > MAX_SEQNO)
818 rekey (); 814 rekey ();
… …
831 establish_connection (); 827 establish_connection ();
832 } 828 }
833} 829}
834 830
835void 831void
836connection::recv_vpn_packet (vpn_packet *pkt, SOCKADDR *ssa) 832connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
837{ 833{
838 last_activity = NOW; 834 last_activity = NOW;
839 835
840 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 836 slog (L_NOISE, "<<%d received packet type %d from %d to %d",
841 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 837 conf->id, pkt->typ (), pkt->src (), pkt->dst ());
842 838
843 switch (pkt->typ ()) 839 switch (pkt->typ ())
844 { 840 {
845 case vpn_packet::PT_PING: 841 case vpn_packet::PT_PING:
846 // we send pings instead of auth packets after some retries, 842 // we send pings instead of auth packets after some retries,
847 // so reset the retry counter and establish a conenction 843 // so reset the retry counter and establish a connection
848 // when we receive a pong. 844 // when we receive a ping.
849 if (!ictx && !octx) 845 if (!ictx)
850 { 846 {
851 retry_cnt = 0; 847 if (auth_rate_limiter.can (rsi))
852 establish_connection.at = 0; 848 send_auth_request (rsi, true);
853 establish_connection ();
854 } 849 }
855 else 850 else
856 send_ping (ssa, 1); // pong 851 send_ping (rsi, 1); // pong
857 852
858 break; 853 break;
859 854
860 case vpn_packet::PT_PONG: 855 case vpn_packet::PT_PONG:
861 break; 856 break;
… …
867 config_packet *p = (config_packet *) pkt; 862 config_packet *p = (config_packet *) pkt;
868 863
869 if (!p->chk_config ()) 864 if (!p->chk_config ())
870 { 865 {
871 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"), 866 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
872 conf->nodename, (const char *)sockinfo (ssa)); 867 conf->nodename, (const char *)rsi);
873 connectmode = conf_node::C_DISABLED; 868 connectmode = conf_node::C_DISABLED;
874 } 869 }
875 else if (connectmode == conf_node::C_ALWAYS) 870 else if (connectmode == conf_node::C_ALWAYS)
876 establish_connection (); 871 establish_connection ();
877 } 872 }
878 break; 873 break;
879 874
880 case vpn_packet::PT_AUTH_REQ: 875 case vpn_packet::PT_AUTH_REQ:
881 if (auth_rate_limiter.can (ssa)) 876 if (auth_rate_limiter.can (rsi))
882 { 877 {
883 auth_req_packet *p = (auth_req_packet *) pkt; 878 auth_req_packet *p = (auth_req_packet *) pkt;
884 879
885 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 880 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);
886 881
887 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 882 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
888 { 883 {
889 if (p->prot_minor != PROTOCOL_MINOR) 884 if (p->prot_minor != PROTOCOL_MINOR)
890 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 885 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
891 conf->nodename, (const char *)sockinfo (ssa), 886 conf->nodename, (const char *)rsi,
892 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 887 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
893 888
894 if (p->initiate) 889 if (p->initiate)
895 send_auth_request (ssa, false); 890 send_auth_request (rsi, false);
896 891
897 rsachallenge k; 892 rsachallenge k;
898 893
899 if (0 > RSA_private_decrypt (sizeof (p->encr), 894 if (0 > RSA_private_decrypt (sizeof (p->encr),
900 (unsigned char *)&p->encr, (unsigned char *)&k, 895 (unsigned char *)&p->encr, (unsigned char *)&k,
901 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING)) 896 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
902 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 897 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
903 conf->nodename, (const char *)sockinfo (ssa)); 898 conf->nodename, (const char *)rsi);
904 else 899 else
905 { 900 {
906 retry_cnt = 0; 901 retry_cnt = 0;
907 establish_connection.set (NOW + 8); //? ;) 902 establish_connection.set (NOW + 8); //? ;)
908 keepalive.reset (); 903 keepalive.reset ();
… …
914 delete octx; 909 delete octx;
915 910
916 octx = new crypto_ctx (k, 1); 911 octx = new crypto_ctx (k, 1);
917 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 912 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
918 913
914 conf->can_recv = p->can_recv;
919 send_auth_response (ssa, p->id, k); 915 send_auth_response (rsi, p->id, k);
920 916
921 break; 917 break;
922 } 918 }
923 } 919 }
924 920
925 send_reset (ssa); 921 send_reset (rsi);
926 } 922 }
927 923
928 break; 924 break;
929 925
930 case vpn_packet::PT_AUTH_RES: 926 case vpn_packet::PT_AUTH_RES:
… …
935 931
936 if (p->chk_config ()) 932 if (p->chk_config ())
937 { 933 {
938 if (p->prot_minor != PROTOCOL_MINOR) 934 if (p->prot_minor != PROTOCOL_MINOR)
939 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 935 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
940 conf->nodename, (const char *)sockinfo (ssa), 936 conf->nodename, (const char *)rsi,
941 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 937 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
942 938
943 rsachallenge chg; 939 rsachallenge chg;
944 940
945 if (!rsa_cache.find (p->id, chg)) 941 if (!rsa_cache.find (p->id, chg))
946 slog (L_ERR, _("%s(%s): unrequested auth response"), 942 slog (L_ERR, _("%s(%s): unrequested auth response"),
947 conf->nodename, (const char *)sockinfo (ssa)); 943 conf->nodename, (const char *)rsi);
948 else 944 else
949 { 945 {
950 crypto_ctx *cctx = new crypto_ctx (chg, 0); 946 crypto_ctx *cctx = new crypto_ctx (chg, 0);
951 947
952 if (!p->hmac_chk (cctx)) 948 if (!p->hmac_chk (cctx))
953 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 949 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
954 "could be an attack, or just corruption or an synchronization error"), 950 "could be an attack, or just corruption or an synchronization error"),
955 conf->nodename, (const char *)sockinfo (ssa)); 951 conf->nodename, (const char *)rsi);
956 else 952 else
957 { 953 {
958 rsaresponse h; 954 rsaresponse h;
959 955
960 rsa_hash (p->id, chg, h); 956 rsa_hash (p->id, chg, h);
… …
965 961
966 delete ictx; ictx = cctx; 962 delete ictx; ictx = cctx;
967 963
968 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 964 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
969 965
970 sa = *ssa; 966 si = rsi;
971 967
972 rekey.set (NOW + ::conf.rekey); 968 rekey.set (NOW + ::conf.rekey);
973 keepalive.set (NOW + ::conf.keepalive); 969 keepalive.set (NOW + ::conf.keepalive);
974 970
975 // send queued packets 971 // send queued packets
… …
980 } 976 }
981 977
982 connectmode = conf->connectmode; 978 connectmode = conf->connectmode;
983 979
984 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"), 980 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
985 conf->nodename, (const char *)sockinfo (ssa), 981 conf->nodename, (const char *)rsi,
986 p->prot_major, p->prot_minor); 982 p->prot_major, p->prot_minor);
987 983
988 if (::conf.script_node_up) 984 if (::conf.script_node_up)
989 run_script (run_script_cb (this, &connection::script_node_up), false); 985 run_script (run_script_cb (this, &connection::script_node_up), false);
990 986
991 break; 987 break;
992 } 988 }
993 else 989 else
994 slog (L_ERR, _("%s(%s): sent and received challenge do not match"), 990 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
995 conf->nodename, (const char *)sockinfo (ssa)); 991 conf->nodename, (const char *)rsi);
996 } 992 }
997 993
998 delete cctx; 994 delete cctx;
999 } 995 }
1000 } 996 }
1001 } 997 }
1002 998
1003 send_reset (ssa); 999 send_reset (rsi);
1004 break; 1000 break;
1005 1001
1006 case vpn_packet::PT_DATA_COMPRESSED: 1002 case vpn_packet::PT_DATA_COMPRESSED:
1007#if !ENABLE_COMPRESSION 1003#if !ENABLE_COMPRESSION
1008 send_reset (ssa); 1004 send_reset (rsi);
1009 break; 1005 break;
1010#endif 1006#endif
1011 1007
1012 case vpn_packet::PT_DATA_UNCOMPRESSED: 1008 case vpn_packet::PT_DATA_UNCOMPRESSED:
1013 1009
1014 if (ictx && octx) 1010 if (ictx && octx)
1015 { 1011 {
1016 vpndata_packet *p = (vpndata_packet *)pkt; 1012 vpndata_packet *p = (vpndata_packet *)pkt;
1017 1013
1018 if (*ssa == sa) 1014 if (rsi == si)
1019 { 1015 {
1020 if (!p->hmac_chk (ictx)) 1016 if (!p->hmac_chk (ictx))
1021 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1017 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1022 "could be an attack, or just corruption or an synchronization error"), 1018 "could be an attack, or just corruption or an synchronization error"),
1023 conf->nodename, (const char *)sockinfo (ssa)); 1019 conf->nodename, (const char *)rsi);
1024 else 1020 else
1025 { 1021 {
1026 u32 seqno; 1022 u32 seqno;
1027 tap_packet *d = p->unpack (this, seqno); 1023 tap_packet *d = p->unpack (this, seqno);
1028 1024
… …
1044 break; 1040 break;
1045 } 1041 }
1046 } 1042 }
1047 } 1043 }
1048 else 1044 else
1049 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D 1045 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
1050 } 1046 }
1051 1047
1052 send_reset (ssa); 1048 send_reset (rsi);
1053 break; 1049 break;
1054 1050
1055 case vpn_packet::PT_CONNECT_REQ: 1051 case vpn_packet::PT_CONNECT_REQ:
1056 if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx)) 1052 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1057 { 1053 {
1058 connect_req_packet *p = (connect_req_packet *) pkt; 1054 connect_req_packet *p = (connect_req_packet *) pkt;
1059 1055
1060 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1056 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1061 1057
… …
1067 if (c->ictx && c->octx) 1063 if (c->ictx && c->octx)
1068 { 1064 {
1069 // send connect_info packets to both sides, in case one is 1065 // send connect_info packets to both sides, in case one is
1070 // behind a nat firewall (or both ;) 1066 // behind a nat firewall (or both ;)
1071 { 1067 {
1072 sockinfo si(sa);
1073
1074 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 1068 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1075 c->conf->id, conf->id, (const char *)si); 1069 c->conf->id, conf->id, (const char *)si);
1076 1070
1077 connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si); 1071 connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si, conf->can_recv);
1078 1072
1079 r->hmac_set (c->octx); 1073 r->hmac_set (c->octx);
1080 vpn->send_vpn_packet (r, &c->sa); 1074 send_vpn_packet (r, c->si);
1081 1075
1082 delete r; 1076 delete r;
1083 } 1077 }
1084 1078
1085 { 1079 {
1086 sockinfo si(c->sa);
1087
1088 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 1080 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1089 conf->id, c->conf->id, (const char *)si); 1081 conf->id, c->conf->id, (const char *)c->si);
1090 1082
1091 connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, si); 1083 connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, c->si, c->conf->can_recv);
1092 1084
1093 r->hmac_set (octx); 1085 r->hmac_set (octx);
1094 vpn->send_vpn_packet (r, &sa); 1086 send_vpn_packet (r, si);
1095 1087
1096 delete r; 1088 delete r;
1097 } 1089 }
1098 } 1090 }
1099 } 1091 }
1100 1092
1101 break; 1093 break;
1102 1094
1103 case vpn_packet::PT_CONNECT_INFO: 1095 case vpn_packet::PT_CONNECT_INFO:
1104 if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx)) 1096 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1105 { 1097 {
1106 connect_info_packet *p = (connect_info_packet *) pkt; 1098 connect_info_packet *p = (connect_info_packet *) pkt;
1107 1099
1108 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1100 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1109 1101
1110 connection *c = vpn->conns[p->id - 1]; 1102 connection *c = vpn->conns[p->id - 1];
1111 1103
1112 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1104 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1113 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1105 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1114 1106
1107 c->conf->can_recv = p->can_recv;
1115 c->send_auth_request (p->si.sa (), true); 1108 c->send_auth_request (p->si, true);
1116 } 1109 }
1117 1110
1118 break; 1111 break;
1119 1112
1120 default: 1113 default:
1121 send_reset (ssa); 1114 send_reset (rsi);
1122 break; 1115 break;
1123 1116
1124 } 1117 }
1125} 1118}
1126 1119
… …
1132 establish_connection (); 1125 establish_connection ();
1133 } 1126 }
1134 else if (NOW < last_activity + ::conf.keepalive) 1127 else if (NOW < last_activity + ::conf.keepalive)
1135 ts = last_activity + ::conf.keepalive; 1128 ts = last_activity + ::conf.keepalive;
1136 else if (conf->connectmode != conf_node::C_ONDEMAND 1129 else if (conf->connectmode != conf_node::C_ONDEMAND
1137 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1130 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1138 { 1131 {
1139 send_ping (&sa); 1132 send_ping (si);
1140 ts = NOW + 5; 1133 ts = NOW + 5;
1141 } 1134 }
1142 else 1135 else
1143 reset_connection (); 1136 reset_connection ();
1144
1145} 1137}
1146 1138
1147void connection::connect_request (int id) 1139void connection::connect_request (int id)
1148{ 1140{
1149 connect_req_packet *p = new connect_req_packet (conf->id, id); 1141 connect_req_packet *p = new connect_req_packet (conf->id, id);
1150 1142
1151 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", id, conf->id); 1143 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", id, conf->id);
1152 p->hmac_set (octx); 1144 p->hmac_set (octx);
1153 vpn->send_vpn_packet (p, &sa); 1145 send_vpn_packet (p, si);
1154 1146
1155 delete p; 1147 delete p;
1156} 1148}
1157 1149
1158void connection::script_node () 1150void connection::script_node ()
1159{ 1151{
1160 vpn->script_if_up (0); 1152 vpn->script_if_up (0);
1161 1153
1162 char *env; 1154 char *env;
1163 asprintf (&env, "DESTID=%d", conf->id); 1155 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1164 putenv (env);
1165 asprintf (&env, "DESTNODE=%s", conf->nodename); 1156 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1166 putenv (env); 1157 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1167 asprintf (&env, "DESTIP=%s", inet_ntoa (sa.sin_addr));
1168 putenv (env);
1169 asprintf (&env, "DESTPORT=%d", ntohs (sa.sin_port)); 1158 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1170 putenv (env);
1171} 1159}
1172 1160
1173const char *connection::script_node_up (int) 1161const char *connection::script_node_up (int)
1174{ 1162{
1175 script_node (); 1163 script_node ();
… …
1184 script_node (); 1172 script_node ();
1185 1173
1186 putenv ("STATE=down"); 1174 putenv ("STATE=down");
1187 1175
1188 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1176 return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1177}
1178
1179// send a vpn packet out to other hosts
1180void
1181connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1182{
1183 if (prot_send & PROT_IPv4)
1184 vpn->send_ipv4_packet (pkt, si, tos);
1185 else
1186 vpn->send_udpv4_packet (pkt, si, tos);
1189} 1187}
1190 1188
1191connection::connection(struct vpn *vpn_) 1189connection::connection(struct vpn *vpn_)
1192: vpn(vpn_) 1190: vpn(vpn_)
1193, rekey (this, &connection::rekey_cb) 1191, rekey (this, &connection::rekey_cb)
… …
1235 1233
1236 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 1234 return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
1237} 1235}
1238 1236
1239int 1237int
1240vpn::setup (void) 1238vpn::setup ()
1241{ 1239{
1242 struct sockaddr_in sa; 1240 u8 prots = 0;
1243 1241
1242 for (configuration::node_vector::iterator i = conf.nodes.begin ();
1243 i != conf.nodes.end (); ++i)
1244 prots |= (*i)->can_send | (*i)->can_recv;
1245
1246 sockinfo si;
1247
1248 si.set (THISNODE);
1249
1250 udpv4_fd = -1;
1251
1252 if (prots & PROT_UDPv4)
1253 {
1244 socket_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 1254 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
1245 if (socket_fd < 0) 1255
1256 if (udpv4_fd < 0)
1246 return -1; 1257 return -1;
1247 1258
1248 fill_sa (&sa, THISNODE); 1259 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
1249 1260 {
1250 if (bind (socket_fd, (sockaddr *)&sa, sizeof (sa)))
1251 {
1252 slog (L_ERR, _("can't bind to %s: %s"), (const char *)sockinfo(sa), strerror (errno)); 1261 slog (L_ERR, _("can't bind udpv4 to %s: %s"), (const char *)si, strerror (errno));
1253 exit (1); 1262 exit (1);
1254 } 1263 }
1255 1264
1256#ifdef IP_MTU_DISCOVER 1265#ifdef IP_MTU_DISCOVER
1257 // this I really consider a linux bug. I am neither connected 1266 // this I really consider a linux bug. I am neither connected
1258 // nor do I fragment myself. Linux still sets DF and doesn't 1267 // nor do I fragment myself. Linux still sets DF and doesn't
1259 // fragment for me sometimes. 1268 // fragment for me sometimes.
1260 { 1269 {
1261 int oval = IP_PMTUDISC_DONT; 1270 int oval = IP_PMTUDISC_DONT;
1262 setsockopt (socket_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 1271 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
1263 } 1272 }
1264#endif 1273#endif
1265 { 1274
1275 // standard daemon practise...
1276 {
1266 int oval = 1; 1277 int oval = 1;
1267 setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 1278 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
1268 } 1279 }
1269 1280
1270 udp_ev_watcher.start (socket_fd, POLLIN); 1281 udpv4_ev_watcher.start (udpv4_fd, POLLIN);
1282 }
1283
1284 ipv4_fd = -1;
1285 if (prots & PROT_IPv4)
1286 {
1287 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
1288
1289 if (ipv4_fd < 0)
1290 return -1;
1291
1292 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
1293 {
1294 slog (L_ERR, _("can't bind ipv4 socket to %s: %s"), (const char *)si, strerror (errno));
1295 exit (1);
1296 }
1297
1298#ifdef IP_MTU_DISCOVER
1299 // this I really consider a linux bug. I am neither connected
1300 // nor do I fragment myself. Linux still sets DF and doesn't
1301 // fragment for me sometimes.
1302 {
1303 int oval = IP_PMTUDISC_DONT;
1304 setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
1305 }
1306#endif
1307
1308 ipv4_ev_watcher.start (ipv4_fd, POLLIN);
1309 }
1271 1310
1272 tap = new tap_device (); 1311 tap = new tap_device ();
1273 if (!tap) //D this, of course, never catches 1312 if (!tap) //D this, of course, never catches
1274 { 1313 {
1275 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 1314 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
1276 exit (1); 1315 exit (1);
1277 } 1316 }
1278 1317
1279 run_script (run_script_cb (this, &vpn::script_if_up), true); 1318 run_script (run_script_cb (this, &vpn::script_if_up), true);
1280 1319
1281 vpn_ev_watcher.start (tap->fd, POLLIN); 1320 tap_ev_watcher.start (tap->fd, POLLIN);
1282 1321
1283 reconnect_all (); 1322 reconnect_all ();
1284 1323
1285 return 0; 1324 return 0;
1286} 1325}
1287 1326
1288void 1327void
1289vpn::send_vpn_packet (vpn_packet *pkt, SOCKADDR *sa, int tos) 1328vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1290{ 1329{
1291 setsockopt (socket_fd, SOL_IP, IP_TOS, &tos, sizeof tos); 1330 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1292 sendto (socket_fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)sa, sizeof (*sa)); 1331 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1293} 1332}
1294 1333
1295void 1334void
1296vpn::shutdown_all () 1335vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1297{ 1336{
1298 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 1337 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1299 (*c)->shutdown (); 1338 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1300} 1339}
1301 1340
1302void 1341void
1303vpn::reconnect_all () 1342vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
1304{ 1343{
1305 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 1344 unsigned int src = pkt->src ();
1306 delete *c; 1345 unsigned int dst = pkt->dst ();
1307 1346
1308 conns.clear (); 1347 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1348 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1309 1349
1310 for (configuration::node_vector::iterator i = conf.nodes.begin (); 1350 if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1311 i != conf.nodes.end (); ++i) 1351 slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1312 { 1352 pkt->typ (), pkt->src (), pkt->dst ());
1313 connection *conn = new connection (this); 1353 else if (dst == 0 && !THISNODE->routerprio)
1314 1354 slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1315 conn->conf = *i; 1355 else if (dst != 0 && dst != THISNODE->id)
1316 conns.push_back (conn); 1356 slog (L_WARN,
1317 1357 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1318 conn->establish_connection (); 1358 dst, conns[dst - 1]->conf->nodename,
1319 } 1359 (const char *)rsi,
1360 THISNODE->id, THISNODE->nodename);
1361 else if (src == 0 || src > conns.size ())
1362 slog (L_WARN, _("received frame from unknown node %d (%s)"),
1363 src, (const char *)rsi);
1364 else
1365 conns[src - 1]->recv_vpn_packet (pkt, rsi);
1320} 1366}
1321 1367
1322connection *vpn::find_router ()
1323{
1324 u32 prio = 0;
1325 connection *router = 0;
1326
1327 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1328 {
1329 connection *c = *i;
1330
1331 if (c->conf->routerprio > prio
1332 && c->connectmode == conf_node::C_ALWAYS
1333 && c->conf != THISNODE
1334 && c->ictx && c->octx)
1335 {
1336 prio = c->conf->routerprio;
1337 router = c;
1338 }
1339 }
1340
1341 return router;
1342}
1343
1344void vpn::connect_request (int id)
1345{
1346 connection *c = find_router ();
1347
1348 if (c)
1349 c->connect_request (id);
1350 //else // does not work, because all others must connect to the same router
1351 // // no router found, aggressively connect to all routers
1352 // for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1353 // if ((*i)->conf->routerprio)
1354 // (*i)->establish_connection ();
1355}
1356
1357void 1368void
1358vpn::udp_ev (short revents) 1369vpn::udpv4_ev (short revents)
1359{ 1370{
1360 if (revents & (POLLIN | POLLERR)) 1371 if (revents & (POLLIN | POLLERR))
1361 { 1372 {
1362 vpn_packet *pkt = new vpn_packet; 1373 vpn_packet *pkt = new vpn_packet;
1363 struct sockaddr_in sa; 1374 struct sockaddr_in sa;
1364 socklen_t sa_len = sizeof (sa); 1375 socklen_t sa_len = sizeof (sa);
1365 int len; 1376 int len;
1366 1377
1367 len = recvfrom (socket_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len); 1378 len = recvfrom (udpv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1379
1380 sockinfo si(sa);
1368 1381
1369 if (len > 0) 1382 if (len > 0)
1370 { 1383 {
1371 pkt->len = len; 1384 pkt->len = len;
1372 1385
1373 unsigned int src = pkt->src ();
1374 unsigned int dst = pkt->dst ();
1375
1376 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1377 (const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1378
1379 if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1380 slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1381 pkt->typ (), pkt->src (), pkt->dst ());
1382 else if (dst == 0 && !THISNODE->routerprio)
1383 slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1384 else if (dst != 0 && dst != THISNODE->id)
1385 slog (L_WARN,
1386 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1387 dst, conns[dst - 1]->conf->nodename,
1388 (const char *)sockinfo (sa),
1389 THISNODE->id, THISNODE->nodename);
1390 else if (src == 0 || src > conns.size ())
1391 slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
1392 else
1393 conns[src - 1]->recv_vpn_packet (pkt, &sa); 1386 recv_vpn_packet (pkt, si);
1394 } 1387 }
1395 else 1388 else
1396 { 1389 {
1397 // probably ECONNRESET or somesuch 1390 // probably ECONNRESET or somesuch
1398 slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno)); 1391 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
1399 } 1392 }
1400 1393
1401 delete pkt; 1394 delete pkt;
1402 } 1395 }
1403 else if (revents & POLLHUP) 1396 else if (revents & POLLHUP)
1404 { 1397 {
1405 // this cannot ;) happen on udp sockets 1398 // this cannot ;) happen on udp sockets
1406 slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating.")); 1399 slog (L_ERR, _("FATAL: POLLHUP on udp v4 fd, terminating."));
1407 exit (1); 1400 exit (1);
1408 } 1401 }
1409 else 1402 else
1410 { 1403 {
1411 slog (L_ERR, 1404 slog (L_ERR,
… …
1414 exit (1); 1407 exit (1);
1415 } 1408 }
1416} 1409}
1417 1410
1418void 1411void
1412vpn::ipv4_ev (short revents)
1413{
1414 if (revents & (POLLIN | POLLERR))
1415 {
1416 vpn_packet *pkt = new vpn_packet;
1417 struct sockaddr_in sa;
1418 socklen_t sa_len = sizeof (sa);
1419 int len;
1420
1421 len = recvfrom (ipv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1422
1423 sockinfo si(sa, PROT_IPv4);
1424
1425 if (len > 0)
1426 {
1427 pkt->len = len;
1428
1429 // raw sockets deliver the ipv4, but don't expect it on sends
1430 // this is slow, but...
1431 pkt->skip_hdr (IP_OVERHEAD);
1432
1433 recv_vpn_packet (pkt, si);
1434 }
1435 else
1436 {
1437 // probably ECONNRESET or somesuch
1438 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
1439 }
1440
1441 delete pkt;
1442 }
1443 else if (revents & POLLHUP)
1444 {
1445 // this cannot ;) happen on udp sockets
1446 slog (L_ERR, _("FATAL: POLLHUP on ipv4 fd, terminating."));
1447 exit (1);
1448 }
1449 else
1450 {
1451 slog (L_ERR,
1452 _("FATAL: unknown revents %08x in socket, terminating\n"),
1453 revents);
1454 exit (1);
1455 }
1456}
1457
1458void
1419vpn::vpn_ev (short revents) 1459vpn::tap_ev (short revents)
1420{ 1460{
1421 if (revents & POLLIN) 1461 if (revents & POLLIN)
1422 { 1462 {
1423 /* process data */ 1463 /* process data */
1424 tap_packet *pkt; 1464 tap_packet *pkt;
… …
1480{ 1520{
1481 if (events) 1521 if (events)
1482 { 1522 {
1483 if (events & EVENT_SHUTDOWN) 1523 if (events & EVENT_SHUTDOWN)
1484 { 1524 {
1525 slog (L_INFO, _("preparing shutdown..."));
1526
1485 shutdown_all (); 1527 shutdown_all ();
1486 1528
1487 remove_pid (pidfilename); 1529 remove_pid (pidfilename);
1488 1530
1489 slog (L_INFO, _("vped terminating")); 1531 slog (L_INFO, _("terminating"));
1490 1532
1491 exit (0); 1533 exit (0);
1492 } 1534 }
1493 1535
1494 if (events & EVENT_RECONNECT) 1536 if (events & EVENT_RECONNECT)
1537 {
1538 slog (L_INFO, _("forced reconnect"));
1539
1495 reconnect_all (); 1540 reconnect_all ();
1541 }
1496 1542
1497 events = 0; 1543 events = 0;
1498 } 1544 }
1499 1545
1500 ts = TSTAMP_CANCEL; 1546 ts = TSTAMP_CANCEL;
1501} 1547}
1502 1548
1549void
1550vpn::shutdown_all ()
1551{
1552 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1553 (*c)->shutdown ();
1554}
1555
1556void
1557vpn::reconnect_all ()
1558{
1559 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1560 delete *c;
1561
1562 conns.clear ();
1563
1564 auth_rate_limiter.clear ();
1565 reset_rate_limiter.clear ();
1566
1567 for (configuration::node_vector::iterator i = conf.nodes.begin ();
1568 i != conf.nodes.end (); ++i)
1569 {
1570 connection *conn = new connection (this);
1571
1572 conn->conf = *i;
1573 conns.push_back (conn);
1574
1575 conn->establish_connection ();
1576 }
1577}
1578
1579connection *vpn::find_router ()
1580{
1581 u32 prio = 0;
1582 connection *router = 0;
1583
1584 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1585 {
1586 connection *c = *i;
1587
1588 if (c->conf->routerprio > prio
1589 && c->connectmode == conf_node::C_ALWAYS
1590 && c->conf != THISNODE
1591 && c->ictx && c->octx)
1592 {
1593 prio = c->conf->routerprio;
1594 router = c;
1595 }
1596 }
1597
1598 return router;
1599}
1600
1601void vpn::connect_request (int id)
1602{
1603 connection *c = find_router ();
1604
1605 if (c)
1606 c->connect_request (id);
1607 //else // does not work, because all others must connect to the same router
1608 // // no router found, aggressively connect to all routers
1609 // for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1610 // if ((*i)->conf->routerprio)
1611 // (*i)->establish_connection ();
1612}
1613
1614void
1615connection::dump_status ()
1616{
1617 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
1618 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
1619 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
1620 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
1621 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
1622 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
1623 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
1624}
1625
1626void
1627vpn::dump_status ()
1628{
1629 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);
1630
1631 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1632 (*c)->dump_status ();
1633
1634 slog (L_NOTICE, _("END status dump"));
1635}
1636
1503vpn::vpn (void) 1637vpn::vpn (void)
1504: udp_ev_watcher (this, &vpn::udp_ev) 1638: udpv4_ev_watcher(this, &vpn::udpv4_ev)
1639, ipv4_ev_watcher(this, &vpn::ipv4_ev)
1505, vpn_ev_watcher (this, &vpn::vpn_ev) 1640, tap_ev_watcher(this, &vpn::tap_ev)
1506, event (this, &vpn::event_cb) 1641, event(this, &vpn::event_cb)
1507{ 1642{
1508} 1643}
1509 1644
1510vpn::~vpn () 1645vpn::~vpn ()
1511{ 1646{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines