ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/protocol.C
(Generate patch)

Comparing gvpe/src/protocol.C (file contents):
Revision 1.20 by pcg, Wed Mar 26 17:59:12 2003 UTC vs.
Revision 1.24 by pcg, Fri Mar 28 16:14:40 2003 UTC

… …
58 58
59static time_t next_timecheck; 59static time_t next_timecheck;
60 60
61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
62 62
63static u8
64best_protocol (u8 protset)
65{
66 if (protset & PROT_IPv4)
67 return PROT_IPv4;
68
69 return PROT_UDPv4;
70}
71
63struct crypto_ctx 72struct crypto_ctx
64 { 73 {
65 EVP_CIPHER_CTX cctx; 74 EVP_CIPHER_CTX cctx;
66 HMAC_CTX hctx; 75 HMAC_CTX hctx;
67 76
… …
237}; 246};
238 247
239// only do action once every x seconds per host whole allowing bursts. 248// only do action once every x seconds per host whole allowing bursts.
240// this implementation ("splay list" ;) is inefficient, 249// this implementation ("splay list" ;) is inefficient,
241// but low on resources. 250// but low on resources.
242struct net_rate_limiter : private list<net_rateinfo> 251struct net_rate_limiter : list<net_rateinfo>
243{ 252{
244 static const double ALPHA = 1. - 1. / 90.; // allow bursts 253 static const double ALPHA = 1. - 1. / 90.; // allow bursts
245 static const double CUTOFF = 20.; // one event every CUTOFF seconds 254 static const double CUTOFF = 20.; // one event every CUTOFF seconds
246 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 255 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
247 256
257 bool can (const sockinfo &si) { return can((u32)si.host); }
248 bool can (u32 host); 258 bool can (u32 host);
249 bool can (SOCKADDR *sa) { return can((u32)sa->sin_addr.s_addr); }
250 bool can (sockinfo &si) { return can((u32)si.host); }
251}; 259};
252 260
253net_rate_limiter auth_rate_limiter, reset_rate_limiter; 261net_rate_limiter auth_rate_limiter, reset_rate_limiter;
254 262
255bool net_rate_limiter::can (u32 host) 263bool net_rate_limiter::can (u32 host)
… …
362 u8 type; 370 u8 type;
363 u8 srcdst, src1, dst1; 371 u8 srcdst, src1, dst1;
364 372
365 void set_hdr (ptype type, unsigned int dst); 373 void set_hdr (ptype type, unsigned int dst);
366 374
367 unsigned int src () 375 unsigned int src () const
368 { 376 {
369 return src1 | ((srcdst >> 4) << 8); 377 return src1 | ((srcdst >> 4) << 8);
370 } 378 }
371 379
372 unsigned int dst () 380 unsigned int dst () const
373 { 381 {
374 return dst1 | ((srcdst & 0xf) << 8); 382 return dst1 | ((srcdst & 0xf) << 8);
375 } 383 }
376 384
377 ptype typ () 385 ptype typ () const
378 { 386 {
379 return (ptype) type; 387 return (ptype) type;
380 } 388 }
381 }; 389 };
382 390
… …
537 { 545 {
538 return 0x80 546 return 0x80
539 | (ENABLE_COMPRESSION ? 0x01 : 0x00); 547 | (ENABLE_COMPRESSION ? 0x01 : 0x00);
540 } 548 }
541 549
542 void setup (ptype type, int dst) 550 void setup (ptype type, int dst);
543 {
544 prot_major = PROTOCOL_MAJOR;
545 prot_minor = PROTOCOL_MINOR;
546 randsize = RAND_SIZE;
547 hmaclen = HMACLENGTH;
548 flags = curflags ();
549 challengelen = sizeof (rsachallenge);
550
551 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
552 digest_nid = htonl (EVP_MD_type (RSA_HASH));
553 hmac_nid = htonl (EVP_MD_type (DIGEST));
554
555 len = sizeof (*this) - sizeof (net_packet);
556 set_hdr (type, dst);
557 }
558
559 bool chk_config () 551 bool chk_config () const;
560 {
561 return prot_major == PROTOCOL_MAJOR
562 && randsize == RAND_SIZE
563 && hmaclen == HMACLENGTH
564 && flags == curflags ()
565 && challengelen == sizeof (rsachallenge)
566 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
567 && digest_nid == htonl (EVP_MD_type (RSA_HASH))
568 && hmac_nid == htonl (EVP_MD_type (DIGEST));
569 }
570}; 552};
553
554void config_packet::setup (ptype type, int dst)
555{
556 prot_major = PROTOCOL_MAJOR;
557 prot_minor = PROTOCOL_MINOR;
558 randsize = RAND_SIZE;
559 hmaclen = HMACLENGTH;
560 flags = curflags ();
561 challengelen = sizeof (rsachallenge);
562
563 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
564 digest_nid = htonl (EVP_MD_type (RSA_HASH));
565 hmac_nid = htonl (EVP_MD_type (DIGEST));
566
567 len = sizeof (*this) - sizeof (net_packet);
568 set_hdr (type, dst);
569}
570
571bool config_packet::chk_config () const
572{
573 return prot_major == PROTOCOL_MAJOR
574 && randsize == RAND_SIZE
575 && hmaclen == HMACLENGTH
576 && flags == curflags ()
577 && challengelen == sizeof (rsachallenge)
578 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
579 && digest_nid == htonl (EVP_MD_type (RSA_HASH))
580 && hmac_nid == htonl (EVP_MD_type (DIGEST));
581}
571 582
572struct auth_req_packet : config_packet 583struct auth_req_packet : config_packet
573{ 584{
574 char magic[8]; 585 char magic[8];
575 u8 initiate; // false if this is just an automatic reply 586 u8 initiate; // false if this is just an automatic reply
587 u8 protocols; // supported protocols (will get patches on forward)
576 u8 pad1, pad2, pad3; 588 u8 pad2, pad3;
577 rsaid id; 589 rsaid id;
578 rsaencrdata encr; 590 rsaencrdata encr;
579 591
580 auth_req_packet (int dst, bool initiate_) 592 auth_req_packet (int dst, bool initiate_, u8 protocols_)
581 { 593 {
582 config_packet::setup (PT_AUTH_REQ, dst); 594 config_packet::setup (PT_AUTH_REQ, dst);
595 strncpy (magic, MAGIC, 8);
583 initiate = !!initiate_; 596 initiate = !!initiate_;
584 strncpy (magic, MAGIC, 8); 597 protocols = protocols_;
598
585 len = sizeof (*this) - sizeof (net_packet); 599 len = sizeof (*this) - sizeof (net_packet);
586 } 600 }
587}; 601};
588 602
589struct auth_res_packet : config_packet 603struct auth_res_packet : config_packet
… …
594 rsaresponse response; 608 rsaresponse response;
595 609
596 auth_res_packet (int dst) 610 auth_res_packet (int dst)
597 { 611 {
598 config_packet::setup (PT_AUTH_RES, dst); 612 config_packet::setup (PT_AUTH_RES, dst);
613
599 len = sizeof (*this) - sizeof (net_packet); 614 len = sizeof (*this) - sizeof (net_packet);
600 } 615 }
601}; 616};
602 617
603struct connect_req_packet : vpn_packet 618struct connect_req_packet : vpn_packet
604{ 619{
605 u8 id; 620 u8 id, protocols;
606 u8 pad1, pad2, pad3; 621 u8 pad1, pad2;
607 622
608 connect_req_packet (int dst, int id_) 623 connect_req_packet (int dst, int id_, u8 protocols_)
624 : id(id_)
625 , protocols(protocols_)
609 { 626 {
610 id = id_;
611 set_hdr (PT_CONNECT_REQ, dst); 627 set_hdr (PT_CONNECT_REQ, dst);
612 len = sizeof (*this) - sizeof (net_packet); 628 len = sizeof (*this) - sizeof (net_packet);
613 } 629 }
614}; 630};
615 631
616struct connect_info_packet : vpn_packet 632struct connect_info_packet : vpn_packet
617{ 633{
618 u8 id; 634 u8 id, protocols;
619 u8 pad1, pad2, pad3; 635 u8 pad1, pad2;
620 sockinfo si; 636 sockinfo si;
621 637
622 connect_info_packet (int dst, int id_, sockinfo &si_) 638 connect_info_packet (int dst, int id_, const sockinfo &si_, u8 protocols_)
639 : id(id_)
640 , protocols(protocols_)
641 , si(si_)
623 { 642 {
624 id = id_;
625 si = si_;
626 set_hdr (PT_CONNECT_INFO, dst); 643 set_hdr (PT_CONNECT_INFO, dst);
644
627 len = sizeof (*this) - sizeof (net_packet); 645 len = sizeof (*this) - sizeof (net_packet);
628 } 646 }
629}; 647};
630 648
631///////////////////////////////////////////////////////////////////////////// 649/////////////////////////////////////////////////////////////////////////////
632 650
633void 651void
634fill_sa (SOCKADDR *sa, conf_node *conf)
635{
636 sa->sin_family = AF_INET;
637 sa->sin_port = htons (conf->port);
638 sa->sin_addr.s_addr = 0;
639
640 if (conf->hostname)
641 {
642 struct hostent *he = gethostbyname (conf->hostname);
643
644 if (he
645 && he->h_addrtype == AF_INET && he->h_length == 4 && he->h_addr_list[0])
646 {
647 //sa->sin_family = he->h_addrtype;
648 memcpy (&sa->sin_addr, he->h_addr_list[0], 4);
649 }
650 else
651 slog (L_NOTICE, _("unable to resolve host '%s'"), conf->hostname);
652 }
653}
654
655void
656connection::reset_dstaddr () 652connection::reset_dstaddr ()
657{ 653{
658 fill_sa (&sa, conf); 654 si.set (conf);
659} 655}
660 656
661void 657void
662connection::send_ping (SOCKADDR *dsa, u8 pong) 658connection::send_ping (const sockinfo &si, u8 pong)
663{ 659{
664 ping_packet *pkt = new ping_packet; 660 ping_packet *pkt = new ping_packet;
665 661
666 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 662 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
667 vpn->send_vpn_packet (pkt, dsa, IPTOS_LOWDELAY); 663 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
668 664
669 delete pkt; 665 delete pkt;
670} 666}
671 667
672void 668void
673connection::send_reset (SOCKADDR *dsa) 669connection::send_reset (const sockinfo &si)
674{ 670{
675 if (reset_rate_limiter.can (dsa) && connectmode != conf_node::C_DISABLED) 671 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
676 { 672 {
677 config_packet *pkt = new config_packet; 673 config_packet *pkt = new config_packet;
678 674
679 pkt->setup (vpn_packet::PT_RESET, conf->id); 675 pkt->setup (vpn_packet::PT_RESET, conf->id);
680 vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST); 676 send_vpn_packet (pkt, si, IPTOS_MINCOST);
681 677
682 delete pkt; 678 delete pkt;
683 } 679 }
684} 680}
685 681
686void 682void
687connection::send_auth_request (SOCKADDR *sa, bool initiate) 683connection::send_auth_request (const sockinfo &si, bool initiate)
688{ 684{
689 if (!initiate || auth_rate_limiter.can (sa))
690 {
691 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate); 685 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
692 686
687 prot_send = best_protocol (THISNODE->protocols & conf->protocols);
688
693 rsachallenge chg; 689 rsachallenge chg;
694 690
695 rsa_cache.gen (pkt->id, chg); 691 rsa_cache.gen (pkt->id, chg);
696 692
697 if (0 > RSA_public_encrypt (sizeof chg, 693 if (0 > RSA_public_encrypt (sizeof chg,
698 (unsigned char *)&chg, (unsigned char *)&pkt->encr, 694 (unsigned char *)&chg, (unsigned char *)&pkt->encr,
699 conf->rsa_key, RSA_PKCS1_OAEP_PADDING)) 695 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
700 fatal ("RSA_public_encrypt error"); 696 fatal ("RSA_public_encrypt error");
701 697
702 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)sockinfo (sa)); 698 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
703 699
704 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly 700 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
705 701
706 delete pkt; 702 delete pkt;
707 }
708} 703}
709 704
710void 705void
711connection::send_auth_response (SOCKADDR *sa, const rsaid &id, const rsachallenge &chg) 706connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg)
712{ 707{
713 auth_res_packet *pkt = new auth_res_packet (conf->id); 708 auth_res_packet *pkt = new auth_res_packet (conf->id);
714 709
715 pkt->id = id; 710 pkt->id = id;
716 711
717 rsa_hash (id, chg, pkt->response); 712 rsa_hash (id, chg, pkt->response);
718 713
719 pkt->hmac_set (octx); 714 pkt->hmac_set (octx);
720 715
721 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)sockinfo (sa)); 716 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);
722 717
723 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly 718 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
724 719
725 delete pkt; 720 delete pkt;
721}
722
723void
724connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
725{
726 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
727 conf->id, rid, (const char *)rsi);
728
729 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
730
731 r->hmac_set (octx);
732 send_vpn_packet (r, si);
733
734 delete r;
726} 735}
727 736
728void 737void
729connection::establish_connection_cb (tstamp &ts) 738connection::establish_connection_cb (tstamp &ts)
730{ 739{
… …
742 ts = NOW + retry_int; 751 ts = NOW + retry_int;
743 752
744 if (conf->hostname) 753 if (conf->hostname)
745 { 754 {
746 reset_dstaddr (); 755 reset_dstaddr ();
747 if (sa.sin_addr.s_addr) 756 if (si.host && auth_rate_limiter.can (si))
757 {
748 if (retry_cnt < 4) 758 if (retry_cnt < 4)
749 send_auth_request (&sa, true); 759 send_auth_request (si, true);
750 else if (auth_rate_limiter.can (&sa)) 760 else
751 send_ping (&sa, 0); 761 send_ping (si, 0);
762 }
752 } 763 }
753 else 764 else
754 vpn->connect_request (conf->id); 765 vpn->connect_request (conf->id);
755 } 766 }
756} 767}
… …
759connection::reset_connection () 770connection::reset_connection ()
760{ 771{
761 if (ictx && octx) 772 if (ictx && octx)
762 { 773 {
763 slog (L_INFO, _("%s(%s): connection lost"), 774 slog (L_INFO, _("%s(%s): connection lost"),
764 conf->nodename, (const char *)sockinfo (sa)); 775 conf->nodename, (const char *)si);
765 776
766 if (::conf.script_node_down) 777 if (::conf.script_node_down)
767 run_script (run_script_cb (this, &connection::script_node_down), false); 778 run_script (run_script_cb (this, &connection::script_node_down), false);
768 } 779 }
769 780
770 delete ictx; ictx = 0; 781 delete ictx; ictx = 0;
771 delete octx; octx = 0; 782 delete octx; octx = 0;
772 783
773 sa.sin_port = 0; 784 si.host= 0;
774 sa.sin_addr.s_addr = 0;
775 785
776 last_activity = 0; 786 last_activity = 0;
787 retry_cnt = 0;
777 788
778 rekey.reset (); 789 rekey.reset ();
779 keepalive.reset (); 790 keepalive.reset ();
780 establish_connection.reset (); 791 establish_connection.reset ();
781} 792}
782 793
783void 794void
784connection::shutdown () 795connection::shutdown ()
785{ 796{
786 if (ictx && octx) 797 if (ictx && octx)
787 send_reset (&sa); 798 send_reset (si);
788 799
789 reset_connection (); 800 reset_connection ();
790} 801}
791 802
792void 803void
… …
797 reset_connection (); 808 reset_connection ();
798 establish_connection (); 809 establish_connection ();
799} 810}
800 811
801void 812void
802connection::send_data_packet (tap_packet * pkt, bool broadcast) 813connection::send_data_packet (tap_packet *pkt, bool broadcast)
803{ 814{
804 vpndata_packet *p = new vpndata_packet; 815 vpndata_packet *p = new vpndata_packet;
805 int tos = 0; 816 int tos = 0;
806 817
807 if (conf->inherit_tos 818 if (conf->inherit_tos
808 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 819 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
809 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4 820 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
810 tos = (*pkt)[15] & IPTOS_TOS_MASK; 821 tos = (*pkt)[15] & IPTOS_TOS_MASK;
811 822
812 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 823 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
813 vpn->send_vpn_packet (p, &sa, tos); 824 send_vpn_packet (p, si, tos);
814 825
815 delete p; 826 delete p;
816 827
817 if (oseqno > MAX_SEQNO) 828 if (oseqno > MAX_SEQNO)
818 rekey (); 829 rekey ();
… …
831 establish_connection (); 842 establish_connection ();
832 } 843 }
833} 844}
834 845
835void 846void
836connection::recv_vpn_packet (vpn_packet *pkt, SOCKADDR *ssa) 847connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
837{ 848{
838 last_activity = NOW; 849 last_activity = NOW;
839 850
840 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 851 slog (L_NOISE, "<<%d received packet type %d from %d to %d",
841 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 852 conf->id, pkt->typ (), pkt->src (), pkt->dst ());
842 853
843 switch (pkt->typ ()) 854 switch (pkt->typ ())
844 { 855 {
845 case vpn_packet::PT_PING: 856 case vpn_packet::PT_PING:
846 // we send pings instead of auth packets after some retries, 857 // we send pings instead of auth packets after some retries,
847 // so reset the retry counter and establish a conenction 858 // so reset the retry counter and establish a connection
848 // when we receive a pong. 859 // when we receive a ping.
849 if (!ictx && !octx) 860 if (!ictx)
850 { 861 {
851 retry_cnt = 0; 862 if (auth_rate_limiter.can (rsi))
852 establish_connection.at = 0; 863 send_auth_request (rsi, true);
853 establish_connection ();
854 } 864 }
855 else 865 else
856 send_ping (ssa, 1); // pong 866 send_ping (rsi, 1); // pong
857 867
858 break; 868 break;
859 869
860 case vpn_packet::PT_PONG: 870 case vpn_packet::PT_PONG:
861 break; 871 break;
… …
867 config_packet *p = (config_packet *) pkt; 877 config_packet *p = (config_packet *) pkt;
868 878
869 if (!p->chk_config ()) 879 if (!p->chk_config ())
870 { 880 {
871 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"), 881 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
872 conf->nodename, (const char *)sockinfo (ssa)); 882 conf->nodename, (const char *)rsi);
873 connectmode = conf_node::C_DISABLED; 883 connectmode = conf_node::C_DISABLED;
874 } 884 }
875 else if (connectmode == conf_node::C_ALWAYS) 885 else if (connectmode == conf_node::C_ALWAYS)
876 establish_connection (); 886 establish_connection ();
877 } 887 }
878 break; 888 break;
879 889
880 case vpn_packet::PT_AUTH_REQ: 890 case vpn_packet::PT_AUTH_REQ:
881 if (auth_rate_limiter.can (ssa)) 891 if (auth_rate_limiter.can (rsi))
882 { 892 {
883 auth_req_packet *p = (auth_req_packet *) pkt; 893 auth_req_packet *p = (auth_req_packet *) pkt;
884 894
885 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 895 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);
886 896
887 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 897 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
888 { 898 {
889 if (p->prot_minor != PROTOCOL_MINOR) 899 if (p->prot_minor != PROTOCOL_MINOR)
890 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 900 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
891 conf->nodename, (const char *)sockinfo (ssa), 901 conf->nodename, (const char *)rsi,
892 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 902 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
893 903
894 if (p->initiate) 904 if (p->initiate)
895 send_auth_request (ssa, false); 905 send_auth_request (rsi, false);
896 906
897 rsachallenge k; 907 rsachallenge k;
898 908
899 if (0 > RSA_private_decrypt (sizeof (p->encr), 909 if (0 > RSA_private_decrypt (sizeof (p->encr),
900 (unsigned char *)&p->encr, (unsigned char *)&k, 910 (unsigned char *)&p->encr, (unsigned char *)&k,
901 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING)) 911 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
902 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 912 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
903 conf->nodename, (const char *)sockinfo (ssa)); 913 conf->nodename, (const char *)rsi);
904 else 914 else
905 { 915 {
906 retry_cnt = 0; 916 retry_cnt = 0;
907 establish_connection.set (NOW + 8); //? ;) 917 establish_connection.set (NOW + 8); //? ;)
908 keepalive.reset (); 918 keepalive.reset ();
… …
914 delete octx; 924 delete octx;
915 925
916 octx = new crypto_ctx (k, 1); 926 octx = new crypto_ctx (k, 1);
917 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 927 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
918 928
929 conf->protocols = p->protocols;
919 send_auth_response (ssa, p->id, k); 930 send_auth_response (rsi, p->id, k);
920 931
921 break; 932 break;
922 } 933 }
923 } 934 }
924 935
925 send_reset (ssa); 936 send_reset (rsi);
926 } 937 }
927 938
928 break; 939 break;
929 940
930 case vpn_packet::PT_AUTH_RES: 941 case vpn_packet::PT_AUTH_RES:
… …
935 946
936 if (p->chk_config ()) 947 if (p->chk_config ())
937 { 948 {
938 if (p->prot_minor != PROTOCOL_MINOR) 949 if (p->prot_minor != PROTOCOL_MINOR)
939 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 950 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
940 conf->nodename, (const char *)sockinfo (ssa), 951 conf->nodename, (const char *)rsi,
941 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 952 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
942 953
943 rsachallenge chg; 954 rsachallenge chg;
944 955
945 if (!rsa_cache.find (p->id, chg)) 956 if (!rsa_cache.find (p->id, chg))
946 slog (L_ERR, _("%s(%s): unrequested auth response"), 957 slog (L_ERR, _("%s(%s): unrequested auth response"),
947 conf->nodename, (const char *)sockinfo (ssa)); 958 conf->nodename, (const char *)rsi);
948 else 959 else
949 { 960 {
950 crypto_ctx *cctx = new crypto_ctx (chg, 0); 961 crypto_ctx *cctx = new crypto_ctx (chg, 0);
951 962
952 if (!p->hmac_chk (cctx)) 963 if (!p->hmac_chk (cctx))
953 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 964 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
954 "could be an attack, or just corruption or an synchronization error"), 965 "could be an attack, or just corruption or an synchronization error"),
955 conf->nodename, (const char *)sockinfo (ssa)); 966 conf->nodename, (const char *)rsi);
956 else 967 else
957 { 968 {
958 rsaresponse h; 969 rsaresponse h;
959 970
960 rsa_hash (p->id, chg, h); 971 rsa_hash (p->id, chg, h);
… …
965 976
966 delete ictx; ictx = cctx; 977 delete ictx; ictx = cctx;
967 978
968 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 979 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
969 980
970 sa = *ssa; 981 si = rsi;
971 982
972 rekey.set (NOW + ::conf.rekey); 983 rekey.set (NOW + ::conf.rekey);
973 keepalive.set (NOW + ::conf.keepalive); 984 keepalive.set (NOW + ::conf.keepalive);
974 985
975 // send queued packets 986 // send queued packets
… …
980 } 991 }
981 992
982 connectmode = conf->connectmode; 993 connectmode = conf->connectmode;
983 994
984 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"), 995 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
985 conf->nodename, (const char *)sockinfo (ssa), 996 conf->nodename, (const char *)rsi,
986 p->prot_major, p->prot_minor); 997 p->prot_major, p->prot_minor);
987 998
988 if (::conf.script_node_up) 999 if (::conf.script_node_up)
989 run_script (run_script_cb (this, &connection::script_node_up), false); 1000 run_script (run_script_cb (this, &connection::script_node_up), false);
990 1001
991 break; 1002 break;
992 } 1003 }
993 else 1004 else
994 slog (L_ERR, _("%s(%s): sent and received challenge do not match"), 1005 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
995 conf->nodename, (const char *)sockinfo (ssa)); 1006 conf->nodename, (const char *)rsi);
996 } 1007 }
997 1008
998 delete cctx; 1009 delete cctx;
999 } 1010 }
1000 } 1011 }
1001 } 1012 }
1002 1013
1003 send_reset (ssa); 1014 send_reset (rsi);
1004 break; 1015 break;
1005 1016
1006 case vpn_packet::PT_DATA_COMPRESSED: 1017 case vpn_packet::PT_DATA_COMPRESSED:
1007#if !ENABLE_COMPRESSION 1018#if !ENABLE_COMPRESSION
1008 send_reset (ssa); 1019 send_reset (rsi);
1009 break; 1020 break;
1010#endif 1021#endif
1011 1022
1012 case vpn_packet::PT_DATA_UNCOMPRESSED: 1023 case vpn_packet::PT_DATA_UNCOMPRESSED:
1013 1024
1014 if (ictx && octx) 1025 if (ictx && octx)
1015 { 1026 {
1016 vpndata_packet *p = (vpndata_packet *)pkt; 1027 vpndata_packet *p = (vpndata_packet *)pkt;
1017 1028
1018 if (*ssa == sa) 1029 if (rsi == si)
1019 { 1030 {
1020 if (!p->hmac_chk (ictx)) 1031 if (!p->hmac_chk (ictx))
1021 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1032 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1022 "could be an attack, or just corruption or an synchronization error"), 1033 "could be an attack, or just corruption or an synchronization error"),
1023 conf->nodename, (const char *)sockinfo (ssa)); 1034 conf->nodename, (const char *)rsi);
1024 else 1035 else
1025 { 1036 {
1026 u32 seqno; 1037 u32 seqno;
1027 tap_packet *d = p->unpack (this, seqno); 1038 tap_packet *d = p->unpack (this, seqno);
1028 1039
… …
1044 break; 1055 break;
1045 } 1056 }
1046 } 1057 }
1047 } 1058 }
1048 else 1059 else
1049 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D 1060 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
1050 } 1061 }
1051 1062
1052 send_reset (ssa); 1063 send_reset (rsi);
1053 break; 1064 break;
1054 1065
1055 case vpn_packet::PT_CONNECT_REQ: 1066 case vpn_packet::PT_CONNECT_REQ:
1056 if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx)) 1067 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1057 { 1068 {
1058 connect_req_packet *p = (connect_req_packet *) pkt; 1069 connect_req_packet *p = (connect_req_packet *) pkt;
1059 1070
1060 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1071 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1061 1072 conf->protocols = p->protocols;
1062 connection *c = vpn->conns[p->id - 1]; 1073 connection *c = vpn->conns[p->id - 1];
1063 1074
1064 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n", 1075 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
1065 conf->id, p->id, c->ictx && c->octx); 1076 conf->id, p->id, c->ictx && c->octx);
1066 1077
1067 if (c->ictx && c->octx) 1078 if (c->ictx && c->octx)
1068 { 1079 {
1069 // send connect_info packets to both sides, in case one is 1080 // send connect_info packets to both sides, in case one is
1070 // behind a nat firewall (or both ;) 1081 // behind a nat firewall (or both ;)
1071 { 1082 c->send_connect_info (conf->id, si, conf->protocols);
1072 sockinfo si(sa); 1083 send_connect_info (c->conf->id, c->si, c->conf->protocols);
1073
1074 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1075 c->conf->id, conf->id, (const char *)si);
1076
1077 connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si);
1078
1079 r->hmac_set (c->octx);
1080 vpn->send_vpn_packet (r, &c->sa);
1081
1082 delete r;
1083 }
1084
1085 {
1086 sockinfo si(c->sa);
1087
1088 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1089 conf->id, c->conf->id, (const char *)si);
1090
1091 connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, si);
1092
1093 r->hmac_set (octx);
1094 vpn->send_vpn_packet (r, &sa);
1095
1096 delete r;
1097 }
1098 } 1084 }
1099 } 1085 }
1100 1086
1101 break; 1087 break;
1102 1088
1103 case vpn_packet::PT_CONNECT_INFO: 1089 case vpn_packet::PT_CONNECT_INFO:
1104 if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx)) 1090 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1105 { 1091 {
1106 connect_info_packet *p = (connect_info_packet *) pkt; 1092 connect_info_packet *p = (connect_info_packet *) pkt;
1107 1093
1108 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1094 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1109 1095 conf->protocols = p->protocols;
1110 connection *c = vpn->conns[p->id - 1]; 1096 connection *c = vpn->conns[p->id - 1];
1111 1097
1112 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1098 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1113 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1099 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1114 1100
1115 c->send_auth_request (p->si.sa (), true); 1101 c->send_auth_request (p->si, true);
1116 } 1102 }
1117 1103
1118 break; 1104 break;
1119 1105
1120 default: 1106 default:
1121 send_reset (ssa); 1107 send_reset (rsi);
1122 break; 1108 break;
1123 1109
1124 } 1110 }
1125} 1111}
1126 1112
… …
1132 establish_connection (); 1118 establish_connection ();
1133 } 1119 }
1134 else if (NOW < last_activity + ::conf.keepalive) 1120 else if (NOW < last_activity + ::conf.keepalive)
1135 ts = last_activity + ::conf.keepalive; 1121 ts = last_activity + ::conf.keepalive;
1136 else if (conf->connectmode != conf_node::C_ONDEMAND 1122 else if (conf->connectmode != conf_node::C_ONDEMAND
1137 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1123 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1138 { 1124 {
1139 send_ping (&sa); 1125 send_ping (si);
1140 ts = NOW + 5; 1126 ts = NOW + 5;
1141 } 1127 }
1142 else 1128 else
1143 reset_connection (); 1129 reset_connection ();
1144
1145} 1130}
1146 1131
1147void connection::connect_request (int id) 1132void connection::connect_request (int id)
1148{ 1133{
1149 connect_req_packet *p = new connect_req_packet (conf->id, id); 1134 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1150 1135
1151 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", id, conf->id); 1136 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);
1152 p->hmac_set (octx); 1137 p->hmac_set (octx);
1153 vpn->send_vpn_packet (p, &sa); 1138 send_vpn_packet (p, si);
1154 1139
1155 delete p; 1140 delete p;
1156} 1141}
1157 1142
1158void connection::script_node () 1143void connection::script_node ()
1159{ 1144{
1160 vpn->script_if_up (0); 1145 vpn->script_if_up (0);
1161 1146
1162 char *env; 1147 char *env;
1163 asprintf (&env, "DESTID=%d", conf->id); 1148 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1164 putenv (env);
1165 asprintf (&env, "DESTNODE=%s", conf->nodename); 1149 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1166 putenv (env); 1150 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1167 asprintf (&env, "DESTIP=%s", inet_ntoa (sa.sin_addr));
1168 putenv (env);
1169 asprintf (&env, "DESTPORT=%d", ntohs (sa.sin_port)); 1151 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1170 putenv (env);
1171} 1152}
1172 1153
1173const char *connection::script_node_up (int) 1154const char *connection::script_node_up (int)
1174{ 1155{
1175 script_node (); 1156 script_node ();
… …
1184 script_node (); 1165 script_node ();
1185 1166
1186 putenv ("STATE=down"); 1167 putenv ("STATE=down");
1187 1168
1188 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1169 return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1170}
1171
1172// send a vpn packet out to other hosts
1173void
1174connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1175{
1176 if (prot_send & PROT_IPv4)
1177 vpn->send_ipv4_packet (pkt, si, tos);
1178 else
1179 vpn->send_udpv4_packet (pkt, si, tos);
1189} 1180}
1190 1181
1191connection::connection(struct vpn *vpn_) 1182connection::connection(struct vpn *vpn_)
1192: vpn(vpn_) 1183: vpn(vpn_)
1193, rekey (this, &connection::rekey_cb) 1184, rekey (this, &connection::rekey_cb)
… …
1235 1226
1236 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 1227 return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
1237} 1228}
1238 1229
1239int 1230int
1240vpn::setup (void) 1231vpn::setup ()
1241{ 1232{
1242 struct sockaddr_in sa; 1233 sockinfo si;
1243 1234
1235 si.set (THISNODE);
1236
1237 udpv4_fd = -1;
1238
1239 if (THISNODE->protocols & PROT_UDPv4)
1240 {
1244 socket_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 1241 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
1245 if (socket_fd < 0) 1242
1243 if (udpv4_fd < 0)
1246 return -1; 1244 return -1;
1247 1245
1248 fill_sa (&sa, THISNODE); 1246 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
1249 1247 {
1250 if (bind (socket_fd, (sockaddr *)&sa, sizeof (sa)))
1251 {
1252 slog (L_ERR, _("can't bind to %s: %s"), (const char *)sockinfo(sa), strerror (errno)); 1248 slog (L_ERR, _("can't bind udpv4 to %s: %s"), (const char *)si, strerror (errno));
1253 exit (1); 1249 exit (1);
1254 } 1250 }
1255 1251
1256#ifdef IP_MTU_DISCOVER 1252#ifdef IP_MTU_DISCOVER
1257 // this I really consider a linux bug. I am neither connected 1253 // this I really consider a linux bug. I am neither connected
1258 // nor do I fragment myself. Linux still sets DF and doesn't 1254 // nor do I fragment myself. Linux still sets DF and doesn't
1259 // fragment for me sometimes. 1255 // fragment for me sometimes.
1260 { 1256 {
1261 int oval = IP_PMTUDISC_DONT; 1257 int oval = IP_PMTUDISC_DONT;
1262 setsockopt (socket_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 1258 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
1263 } 1259 }
1264#endif 1260#endif
1265 { 1261
1262 // standard daemon practise...
1263 {
1266 int oval = 1; 1264 int oval = 1;
1267 setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 1265 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
1268 } 1266 }
1269 1267
1270 udp_ev_watcher.start (socket_fd, POLLIN); 1268 udpv4_ev_watcher.start (udpv4_fd, POLLIN);
1269 }
1270
1271 ipv4_fd = -1;
1272 if (THISNODE->protocols & PROT_IPv4)
1273 {
1274 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
1275
1276 if (ipv4_fd < 0)
1277 return -1;
1278
1279 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
1280 {
1281 slog (L_ERR, _("can't bind ipv4 socket to %s: %s"), (const char *)si, strerror (errno));
1282 exit (1);
1283 }
1284
1285#ifdef IP_MTU_DISCOVER
1286 // this I really consider a linux bug. I am neither connected
1287 // nor do I fragment myself. Linux still sets DF and doesn't
1288 // fragment for me sometimes.
1289 {
1290 int oval = IP_PMTUDISC_DONT;
1291 setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
1292 }
1293#endif
1294
1295 ipv4_ev_watcher.start (ipv4_fd, POLLIN);
1296 }
1271 1297
1272 tap = new tap_device (); 1298 tap = new tap_device ();
1273 if (!tap) //D this, of course, never catches 1299 if (!tap) //D this, of course, never catches
1274 { 1300 {
1275 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 1301 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
1276 exit (1); 1302 exit (1);
1277 } 1303 }
1278 1304
1279 run_script (run_script_cb (this, &vpn::script_if_up), true); 1305 run_script (run_script_cb (this, &vpn::script_if_up), true);
1280 1306
1281 vpn_ev_watcher.start (tap->fd, POLLIN); 1307 tap_ev_watcher.start (tap->fd, POLLIN);
1282 1308
1283 reconnect_all (); 1309 reconnect_all ();
1284 1310
1285 return 0; 1311 return 0;
1286} 1312}
1287 1313
1288void 1314void
1289vpn::send_vpn_packet (vpn_packet *pkt, SOCKADDR *sa, int tos) 1315vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1290{ 1316{
1291 setsockopt (socket_fd, SOL_IP, IP_TOS, &tos, sizeof tos); 1317 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1292 sendto (socket_fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)sa, sizeof (*sa)); 1318 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1293} 1319}
1294 1320
1295void 1321void
1296vpn::shutdown_all () 1322vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1297{ 1323{
1298 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 1324 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1299 (*c)->shutdown (); 1325 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1300} 1326}
1301 1327
1302void 1328void
1303vpn::reconnect_all () 1329vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
1304{ 1330{
1305 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 1331 unsigned int src = pkt->src ();
1306 delete *c; 1332 unsigned int dst = pkt->dst ();
1307 1333
1308 conns.clear (); 1334 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1335 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1309 1336
1310 for (configuration::node_vector::iterator i = conf.nodes.begin (); 1337 if (src == 0 || src > conns.size ()
1311 i != conf.nodes.end (); ++i) 1338 || dst > conns.size ()
1312 { 1339 || pkt->typ () >= vpn_packet::PT_MAX)
1313 connection *conn = new connection (this); 1340 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
1314 1341 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
1315 conn->conf = *i; 1342 else
1316 conns.push_back (conn);
1317
1318 conn->establish_connection ();
1319 } 1343 {
1320} 1344 connection *c = conns[src - 1];
1321 1345
1322connection *vpn::find_router () 1346 if (dst == 0 && !THISNODE->routerprio)
1323{ 1347 slog (L_WARN, _("%s(%s): received broadcast, but we are no router"),
1324 u32 prio = 0; 1348 c->conf->nodename, (const char *)rsi);
1325 connection *router = 0; 1349 else if (dst != 0 && dst != THISNODE->id)
1326 1350 // FORWARDING NEEDED ;)
1327 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 1351 slog (L_WARN,
1352 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1353 dst, conns[dst - 1]->conf->nodename,
1354 (const char *)rsi,
1355 THISNODE->id, THISNODE->nodename);
1356 else
1357 c->recv_vpn_packet (pkt, rsi);
1328 { 1358 }
1329 connection *c = *i;
1330
1331 if (c->conf->routerprio > prio
1332 && c->connectmode == conf_node::C_ALWAYS
1333 && c->conf != THISNODE
1334 && c->ictx && c->octx)
1335 {
1336 prio = c->conf->routerprio;
1337 router = c;
1338 }
1339 }
1340
1341 return router;
1342} 1359}
1343 1360
1344void vpn::connect_request (int id)
1345{
1346 connection *c = find_router ();
1347
1348 if (c)
1349 c->connect_request (id);
1350 //else // does not work, because all others must connect to the same router
1351 // // no router found, aggressively connect to all routers
1352 // for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1353 // if ((*i)->conf->routerprio)
1354 // (*i)->establish_connection ();
1355}
1356
1357void 1361void
1358vpn::udp_ev (short revents) 1362vpn::udpv4_ev (short revents)
1359{ 1363{
1360 if (revents & (POLLIN | POLLERR)) 1364 if (revents & (POLLIN | POLLERR))
1361 { 1365 {
1362 vpn_packet *pkt = new vpn_packet; 1366 vpn_packet *pkt = new vpn_packet;
1363 struct sockaddr_in sa; 1367 struct sockaddr_in sa;
1364 socklen_t sa_len = sizeof (sa); 1368 socklen_t sa_len = sizeof (sa);
1365 int len; 1369 int len;
1366 1370
1367 len = recvfrom (socket_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len); 1371 len = recvfrom (udpv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1372
1373 sockinfo si(sa);
1368 1374
1369 if (len > 0) 1375 if (len > 0)
1370 { 1376 {
1371 pkt->len = len; 1377 pkt->len = len;
1372 1378
1373 unsigned int src = pkt->src ();
1374 unsigned int dst = pkt->dst ();
1375
1376 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1377 (const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1378
1379 if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1380 slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1381 pkt->typ (), pkt->src (), pkt->dst ());
1382 else if (dst == 0 && !THISNODE->routerprio)
1383 slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1384 else if (dst != 0 && dst != THISNODE->id)
1385 slog (L_WARN,
1386 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1387 dst, conns[dst - 1]->conf->nodename,
1388 (const char *)sockinfo (sa),
1389 THISNODE->id, THISNODE->nodename);
1390 else if (src == 0 || src > conns.size ())
1391 slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
1392 else
1393 conns[src - 1]->recv_vpn_packet (pkt, &sa); 1379 recv_vpn_packet (pkt, si);
1394 } 1380 }
1395 else 1381 else
1396 { 1382 {
1397 // probably ECONNRESET or somesuch 1383 // probably ECONNRESET or somesuch
1398 slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno)); 1384 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
1399 } 1385 }
1400 1386
1401 delete pkt; 1387 delete pkt;
1402 } 1388 }
1403 else if (revents & POLLHUP) 1389 else if (revents & POLLHUP)
1404 { 1390 {
1405 // this cannot ;) happen on udp sockets 1391 // this cannot ;) happen on udp sockets
1406 slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating.")); 1392 slog (L_ERR, _("FATAL: POLLHUP on udp v4 fd, terminating."));
1407 exit (1); 1393 exit (1);
1408 } 1394 }
1409 else 1395 else
1410 { 1396 {
1411 slog (L_ERR, 1397 slog (L_ERR,
… …
1414 exit (1); 1400 exit (1);
1415 } 1401 }
1416} 1402}
1417 1403
1418void 1404void
1405vpn::ipv4_ev (short revents)
1406{
1407 if (revents & (POLLIN | POLLERR))
1408 {
1409 vpn_packet *pkt = new vpn_packet;
1410 struct sockaddr_in sa;
1411 socklen_t sa_len = sizeof (sa);
1412 int len;
1413
1414 len = recvfrom (ipv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1415
1416 sockinfo si(sa, PROT_IPv4);
1417
1418 if (len > 0)
1419 {
1420 pkt->len = len;
1421
1422 // raw sockets deliver the ipv4, but don't expect it on sends
1423 // this is slow, but...
1424 pkt->skip_hdr (IP_OVERHEAD);
1425
1426 recv_vpn_packet (pkt, si);
1427 }
1428 else
1429 {
1430 // probably ECONNRESET or somesuch
1431 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
1432 }
1433
1434 delete pkt;
1435 }
1436 else if (revents & POLLHUP)
1437 {
1438 // this cannot ;) happen on udp sockets
1439 slog (L_ERR, _("FATAL: POLLHUP on ipv4 fd, terminating."));
1440 exit (1);
1441 }
1442 else
1443 {
1444 slog (L_ERR,
1445 _("FATAL: unknown revents %08x in socket, terminating\n"),
1446 revents);
1447 exit (1);
1448 }
1449}
1450
1451void
1419vpn::vpn_ev (short revents) 1452vpn::tap_ev (short revents)
1420{ 1453{
1421 if (revents & POLLIN) 1454 if (revents & POLLIN)
1422 { 1455 {
1423 /* process data */ 1456 /* process data */
1424 tap_packet *pkt; 1457 tap_packet *pkt;
… …
1480{ 1513{
1481 if (events) 1514 if (events)
1482 { 1515 {
1483 if (events & EVENT_SHUTDOWN) 1516 if (events & EVENT_SHUTDOWN)
1484 { 1517 {
1518 slog (L_INFO, _("preparing shutdown..."));
1519
1485 shutdown_all (); 1520 shutdown_all ();
1486 1521
1487 remove_pid (pidfilename); 1522 remove_pid (pidfilename);
1488 1523
1489 slog (L_INFO, _("vped terminating")); 1524 slog (L_INFO, _("terminating"));
1490 1525
1491 exit (0); 1526 exit (0);
1492 } 1527 }
1493 1528
1494 if (events & EVENT_RECONNECT) 1529 if (events & EVENT_RECONNECT)
1530 {
1531 slog (L_INFO, _("forced reconnect"));
1532
1495 reconnect_all (); 1533 reconnect_all ();
1534 }
1496 1535
1497 events = 0; 1536 events = 0;
1498 } 1537 }
1499 1538
1500 ts = TSTAMP_CANCEL; 1539 ts = TSTAMP_CANCEL;
1501} 1540}
1502 1541
1542void
1543vpn::shutdown_all ()
1544{
1545 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1546 (*c)->shutdown ();
1547}
1548
1549void
1550vpn::reconnect_all ()
1551{
1552 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1553 delete *c;
1554
1555 conns.clear ();
1556
1557 auth_rate_limiter.clear ();
1558 reset_rate_limiter.clear ();
1559
1560 for (configuration::node_vector::iterator i = conf.nodes.begin ();
1561 i != conf.nodes.end (); ++i)
1562 {
1563 connection *conn = new connection (this);
1564
1565 conn->conf = *i;
1566 conns.push_back (conn);
1567
1568 conn->establish_connection ();
1569 }
1570}
1571
1572connection *vpn::find_router ()
1573{
1574 u32 prio = 0;
1575 connection *router = 0;
1576
1577 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1578 {
1579 connection *c = *i;
1580
1581 if (c->conf->routerprio > prio
1582 && c->connectmode == conf_node::C_ALWAYS
1583 && c->conf != THISNODE
1584 && c->ictx && c->octx)
1585 {
1586 prio = c->conf->routerprio;
1587 router = c;
1588 }
1589 }
1590
1591 return router;
1592}
1593
1594void vpn::connect_request (int id)
1595{
1596 connection *c = find_router ();
1597
1598 if (c)
1599 c->connect_request (id);
1600 //else // does not work, because all others must connect to the same router
1601 // // no router found, aggressively connect to all routers
1602 // for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1603 // if ((*i)->conf->routerprio)
1604 // (*i)->establish_connection ();
1605}
1606
1607void
1608connection::dump_status ()
1609{
1610 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
1611 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
1612 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
1613 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
1614 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
1615 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
1616 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
1617}
1618
1619void
1620vpn::dump_status ()
1621{
1622 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);
1623
1624 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1625 (*c)->dump_status ();
1626
1627 slog (L_NOTICE, _("END status dump"));
1628}
1629
1503vpn::vpn (void) 1630vpn::vpn (void)
1504: udp_ev_watcher (this, &vpn::udp_ev) 1631: udpv4_ev_watcher(this, &vpn::udpv4_ev)
1632, ipv4_ev_watcher(this, &vpn::ipv4_ev)
1505, vpn_ev_watcher (this, &vpn::vpn_ev) 1633, tap_ev_watcher(this, &vpn::tap_ev)
1506, event (this, &vpn::event_cb) 1634, event(this, &vpn::event_cb)
1507{ 1635{
1508} 1636}
1509 1637
1510vpn::~vpn () 1638vpn::~vpn ()
1511{ 1639{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines