ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/protocol.C
(Generate patch)

Comparing gvpe/src/protocol.C (file contents):
Revision 1.20 by pcg, Wed Mar 26 17:59:12 2003 UTC vs.
Revision 1.21 by pcg, Fri Mar 28 04:05:10 2003 UTC

… …
58 58
59static time_t next_timecheck; 59static time_t next_timecheck;
60 60
61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic 61#define MAGIC "vped\xbd\xc6\xdb\x82" // 8 bytes of magic
62 62
63static u8
64best_protocol (u8 protset)
65{
66 if (protset & PROT_IPv4)
67 return PROT_IPv4;
68
69 return PROT_UDPv4;
70}
71
63struct crypto_ctx 72struct crypto_ctx
64 { 73 {
65 EVP_CIPHER_CTX cctx; 74 EVP_CIPHER_CTX cctx;
66 HMAC_CTX hctx; 75 HMAC_CTX hctx;
67 76
… …
237}; 246};
238 247
239// only do action once every x seconds per host whole allowing bursts. 248// only do action once every x seconds per host whole allowing bursts.
240// this implementation ("splay list" ;) is inefficient, 249// this implementation ("splay list" ;) is inefficient,
241// but low on resources. 250// but low on resources.
242struct net_rate_limiter : private list<net_rateinfo> 251struct net_rate_limiter : list<net_rateinfo>
243{ 252{
244 static const double ALPHA = 1. - 1. / 90.; // allow bursts 253 static const double ALPHA = 1. - 1. / 90.; // allow bursts
245 static const double CUTOFF = 20.; // one event every CUTOFF seconds 254 static const double CUTOFF = 20.; // one event every CUTOFF seconds
246 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 255 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
247 256
257 bool can (const sockinfo &si) { return can((u32)si.host); }
248 bool can (u32 host); 258 bool can (u32 host);
249 bool can (SOCKADDR *sa) { return can((u32)sa->sin_addr.s_addr); }
250 bool can (sockinfo &si) { return can((u32)si.host); }
251}; 259};
252 260
253net_rate_limiter auth_rate_limiter, reset_rate_limiter; 261net_rate_limiter auth_rate_limiter, reset_rate_limiter;
254 262
255bool net_rate_limiter::can (u32 host) 263bool net_rate_limiter::can (u32 host)
… …
362 u8 type; 370 u8 type;
363 u8 srcdst, src1, dst1; 371 u8 srcdst, src1, dst1;
364 372
365 void set_hdr (ptype type, unsigned int dst); 373 void set_hdr (ptype type, unsigned int dst);
366 374
367 unsigned int src () 375 unsigned int src () const
368 { 376 {
369 return src1 | ((srcdst >> 4) << 8); 377 return src1 | ((srcdst >> 4) << 8);
370 } 378 }
371 379
372 unsigned int dst () 380 unsigned int dst () const
373 { 381 {
374 return dst1 | ((srcdst & 0xf) << 8); 382 return dst1 | ((srcdst & 0xf) << 8);
375 } 383 }
376 384
377 ptype typ () 385 ptype typ () const
378 { 386 {
379 return (ptype) type; 387 return (ptype) type;
380 } 388 }
381 }; 389 };
382 390
… …
537 { 545 {
538 return 0x80 546 return 0x80
539 | (ENABLE_COMPRESSION ? 0x01 : 0x00); 547 | (ENABLE_COMPRESSION ? 0x01 : 0x00);
540 } 548 }
541 549
542 void setup (ptype type, int dst) 550 void setup (ptype type, int dst);
543 {
544 prot_major = PROTOCOL_MAJOR;
545 prot_minor = PROTOCOL_MINOR;
546 randsize = RAND_SIZE;
547 hmaclen = HMACLENGTH;
548 flags = curflags ();
549 challengelen = sizeof (rsachallenge);
550
551 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
552 digest_nid = htonl (EVP_MD_type (RSA_HASH));
553 hmac_nid = htonl (EVP_MD_type (DIGEST));
554
555 len = sizeof (*this) - sizeof (net_packet);
556 set_hdr (type, dst);
557 }
558
559 bool chk_config () 551 bool chk_config () const;
560 {
561 return prot_major == PROTOCOL_MAJOR
562 && randsize == RAND_SIZE
563 && hmaclen == HMACLENGTH
564 && flags == curflags ()
565 && challengelen == sizeof (rsachallenge)
566 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
567 && digest_nid == htonl (EVP_MD_type (RSA_HASH))
568 && hmac_nid == htonl (EVP_MD_type (DIGEST));
569 }
570}; 552};
571 553
554void config_packet::setup (ptype type, int dst)
555{
556 prot_major = PROTOCOL_MAJOR;
557 prot_minor = PROTOCOL_MINOR;
558 randsize = RAND_SIZE;
559 hmaclen = HMACLENGTH;
560 flags = curflags ();
561 challengelen = sizeof (rsachallenge);
562
563 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
564 digest_nid = htonl (EVP_MD_type (RSA_HASH));
565 hmac_nid = htonl (EVP_MD_type (DIGEST));
566
567 len = sizeof (*this) - sizeof (net_packet);
568 set_hdr (type, dst);
569}
570
571bool config_packet::chk_config () const
572{
573 return prot_major == PROTOCOL_MAJOR
574 && randsize == RAND_SIZE
575 && hmaclen == HMACLENGTH
576 && flags == curflags ()
577 && challengelen == sizeof (rsachallenge)
578 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
579 && digest_nid == htonl (EVP_MD_type (RSA_HASH))
580 && hmac_nid == htonl (EVP_MD_type (DIGEST));
581}
582
572struct auth_req_packet : config_packet 583struct auth_req_packet : config_packet
573{ 584{
574 char magic[8]; 585 char magic[8];
575 u8 initiate; // false if this is just an automatic reply 586 u8 initiate, can_recv; // false if this is just an automatic reply
576 u8 pad1, pad2, pad3; 587 u8 pad2, pad3;
577 rsaid id; 588 rsaid id;
578 rsaencrdata encr; 589 rsaencrdata encr;
579 590
580 auth_req_packet (int dst, bool initiate_) 591 auth_req_packet (int dst, bool initiate_, u8 can_recv_)
581 { 592 {
582 config_packet::setup (PT_AUTH_REQ, dst); 593 config_packet::setup (PT_AUTH_REQ, dst);
594 strncpy (magic, MAGIC, 8);
583 initiate = !!initiate_; 595 initiate = !!initiate_;
584 strncpy (magic, MAGIC, 8); 596 can_recv = can_recv_;
597
585 len = sizeof (*this) - sizeof (net_packet); 598 len = sizeof (*this) - sizeof (net_packet);
586 } 599 }
587}; 600};
588 601
589struct auth_res_packet : config_packet 602struct auth_res_packet : config_packet
… …
594 rsaresponse response; 607 rsaresponse response;
595 608
596 auth_res_packet (int dst) 609 auth_res_packet (int dst)
597 { 610 {
598 config_packet::setup (PT_AUTH_RES, dst); 611 config_packet::setup (PT_AUTH_RES, dst);
612
599 len = sizeof (*this) - sizeof (net_packet); 613 len = sizeof (*this) - sizeof (net_packet);
600 } 614 }
601}; 615};
602 616
603struct connect_req_packet : vpn_packet 617struct connect_req_packet : vpn_packet
… …
613 } 627 }
614}; 628};
615 629
616struct connect_info_packet : vpn_packet 630struct connect_info_packet : vpn_packet
617{ 631{
618 u8 id; 632 u8 id, can_recv;
619 u8 pad1, pad2, pad3; 633 u8 pad1, pad2;
620 sockinfo si; 634 sockinfo si;
621 635
622 connect_info_packet (int dst, int id_, sockinfo &si_) 636 connect_info_packet (int dst, int id_, sockinfo &si_, u8 can_recv_)
623 { 637 {
624 id = id_; 638 id = id_;
639 can_recv = can_recv_;
625 si = si_; 640 si = si_;
626 set_hdr (PT_CONNECT_INFO, dst); 641 set_hdr (PT_CONNECT_INFO, dst);
642
627 len = sizeof (*this) - sizeof (net_packet); 643 len = sizeof (*this) - sizeof (net_packet);
628 } 644 }
629}; 645};
630 646
631///////////////////////////////////////////////////////////////////////////// 647/////////////////////////////////////////////////////////////////////////////
632 648
633void 649void
634fill_sa (SOCKADDR *sa, conf_node *conf)
635{
636 sa->sin_family = AF_INET;
637 sa->sin_port = htons (conf->port);
638 sa->sin_addr.s_addr = 0;
639
640 if (conf->hostname)
641 {
642 struct hostent *he = gethostbyname (conf->hostname);
643
644 if (he
645 && he->h_addrtype == AF_INET && he->h_length == 4 && he->h_addr_list[0])
646 {
647 //sa->sin_family = he->h_addrtype;
648 memcpy (&sa->sin_addr, he->h_addr_list[0], 4);
649 }
650 else
651 slog (L_NOTICE, _("unable to resolve host '%s'"), conf->hostname);
652 }
653}
654
655void
656connection::reset_dstaddr () 650connection::reset_dstaddr ()
657{ 651{
658 fill_sa (&sa, conf); 652 si.set (conf);
659} 653}
660 654
661void 655void
662connection::send_ping (SOCKADDR *dsa, u8 pong) 656connection::send_ping (const sockinfo &si, u8 pong)
663{ 657{
664 ping_packet *pkt = new ping_packet; 658 ping_packet *pkt = new ping_packet;
665 659
666 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 660 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
667 vpn->send_vpn_packet (pkt, dsa, IPTOS_LOWDELAY); 661 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
668 662
669 delete pkt; 663 delete pkt;
670} 664}
671 665
672void 666void
673connection::send_reset (SOCKADDR *dsa) 667connection::send_reset (const sockinfo &si)
674{ 668{
675 if (reset_rate_limiter.can (dsa) && connectmode != conf_node::C_DISABLED) 669 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
676 { 670 {
677 config_packet *pkt = new config_packet; 671 config_packet *pkt = new config_packet;
678 672
679 pkt->setup (vpn_packet::PT_RESET, conf->id); 673 pkt->setup (vpn_packet::PT_RESET, conf->id);
680 vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST); 674 send_vpn_packet (pkt, si, IPTOS_MINCOST);
681 675
682 delete pkt; 676 delete pkt;
683 } 677 }
684} 678}
685 679
686void 680void
687connection::send_auth_request (SOCKADDR *sa, bool initiate) 681connection::send_auth_request (const sockinfo &si, bool initiate)
688{ 682{
689 if (!initiate || auth_rate_limiter.can (sa))
690 {
691 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate); 683 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->can_recv);
692 684
685 // the next line is very conservative
686 prot_send = best_protocol (THISNODE->can_send & THISNODE->can_recv & conf->can_recv);
687
693 rsachallenge chg; 688 rsachallenge chg;
694 689
695 rsa_cache.gen (pkt->id, chg); 690 rsa_cache.gen (pkt->id, chg);
696 691
697 if (0 > RSA_public_encrypt (sizeof chg, 692 if (0 > RSA_public_encrypt (sizeof chg,
698 (unsigned char *)&chg, (unsigned char *)&pkt->encr, 693 (unsigned char *)&chg, (unsigned char *)&pkt->encr,
699 conf->rsa_key, RSA_PKCS1_OAEP_PADDING)) 694 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
700 fatal ("RSA_public_encrypt error"); 695 fatal ("RSA_public_encrypt error");
701 696
702 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)sockinfo (sa)); 697 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
703 698
704 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly 699 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
705 700
706 delete pkt; 701 delete pkt;
707 }
708} 702}
709 703
710void 704void
711connection::send_auth_response (SOCKADDR *sa, const rsaid &id, const rsachallenge &chg) 705connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg)
712{ 706{
713 auth_res_packet *pkt = new auth_res_packet (conf->id); 707 auth_res_packet *pkt = new auth_res_packet (conf->id);
714 708
715 pkt->id = id; 709 pkt->id = id;
716 710
717 rsa_hash (id, chg, pkt->response); 711 rsa_hash (id, chg, pkt->response);
718 712
719 pkt->hmac_set (octx); 713 pkt->hmac_set (octx);
720 714
721 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)sockinfo (sa)); 715 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);
722 716
723 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly 717 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
724 718
725 delete pkt; 719 delete pkt;
726} 720}
727 721
728void 722void
… …
742 ts = NOW + retry_int; 736 ts = NOW + retry_int;
743 737
744 if (conf->hostname) 738 if (conf->hostname)
745 { 739 {
746 reset_dstaddr (); 740 reset_dstaddr ();
747 if (sa.sin_addr.s_addr) 741 if (si.host && auth_rate_limiter.can (si))
742 {
748 if (retry_cnt < 4) 743 if (retry_cnt < 4)
749 send_auth_request (&sa, true); 744 send_auth_request (si, true);
750 else if (auth_rate_limiter.can (&sa)) 745 else
751 send_ping (&sa, 0); 746 send_ping (si, 0);
747 }
752 } 748 }
753 else 749 else
754 vpn->connect_request (conf->id); 750 vpn->connect_request (conf->id);
755 } 751 }
756} 752}
… …
759connection::reset_connection () 755connection::reset_connection ()
760{ 756{
761 if (ictx && octx) 757 if (ictx && octx)
762 { 758 {
763 slog (L_INFO, _("%s(%s): connection lost"), 759 slog (L_INFO, _("%s(%s): connection lost"),
764 conf->nodename, (const char *)sockinfo (sa)); 760 conf->nodename, (const char *)si);
765 761
766 if (::conf.script_node_down) 762 if (::conf.script_node_down)
767 run_script (run_script_cb (this, &connection::script_node_down), false); 763 run_script (run_script_cb (this, &connection::script_node_down), false);
768 } 764 }
769 765
770 delete ictx; ictx = 0; 766 delete ictx; ictx = 0;
771 delete octx; octx = 0; 767 delete octx; octx = 0;
772 768
773 sa.sin_port = 0; 769 si.host= 0;
774 sa.sin_addr.s_addr = 0;
775 770
776 last_activity = 0; 771 last_activity = 0;
772 retry_cnt = 0;
777 773
778 rekey.reset (); 774 rekey.reset ();
779 keepalive.reset (); 775 keepalive.reset ();
780 establish_connection.reset (); 776 establish_connection.reset ();
781} 777}
782 778
783void 779void
784connection::shutdown () 780connection::shutdown ()
785{ 781{
786 if (ictx && octx) 782 if (ictx && octx)
787 send_reset (&sa); 783 send_reset (si);
788 784
789 reset_connection (); 785 reset_connection ();
790} 786}
791 787
792void 788void
… …
797 reset_connection (); 793 reset_connection ();
798 establish_connection (); 794 establish_connection ();
799} 795}
800 796
801void 797void
802connection::send_data_packet (tap_packet * pkt, bool broadcast) 798connection::send_data_packet (tap_packet *pkt, bool broadcast)
803{ 799{
804 vpndata_packet *p = new vpndata_packet; 800 vpndata_packet *p = new vpndata_packet;
805 int tos = 0; 801 int tos = 0;
806 802
807 if (conf->inherit_tos 803 if (conf->inherit_tos
808 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 804 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
809 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4 805 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
810 tos = (*pkt)[15] & IPTOS_TOS_MASK; 806 tos = (*pkt)[15] & IPTOS_TOS_MASK;
811 807
812 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 808 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
813 vpn->send_vpn_packet (p, &sa, tos); 809 send_vpn_packet (p, si, tos);
814 810
815 delete p; 811 delete p;
816 812
817 if (oseqno > MAX_SEQNO) 813 if (oseqno > MAX_SEQNO)
818 rekey (); 814 rekey ();
… …
831 establish_connection (); 827 establish_connection ();
832 } 828 }
833} 829}
834 830
835void 831void
836connection::recv_vpn_packet (vpn_packet *pkt, SOCKADDR *ssa) 832connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
837{ 833{
838 last_activity = NOW; 834 last_activity = NOW;
839 835
840 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 836 slog (L_NOISE, "<<%d received packet type %d from %d to %d",
841 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 837 conf->id, pkt->typ (), pkt->src (), pkt->dst ());
842 838
843 switch (pkt->typ ()) 839 switch (pkt->typ ())
844 { 840 {
845 case vpn_packet::PT_PING: 841 case vpn_packet::PT_PING:
846 // we send pings instead of auth packets after some retries, 842 // we send pings instead of auth packets after some retries,
847 // so reset the retry counter and establish a conenction 843 // so reset the retry counter and establish a connection
848 // when we receive a pong. 844 // when we receive a ping.
849 if (!ictx && !octx) 845 if (!ictx && !octx)
850 { 846 {
851 retry_cnt = 0; 847 if (auth_rate_limiter.can (rsi))
852 establish_connection.at = 0; 848 send_auth_request (rsi, true);
853 establish_connection ();
854 } 849 }
855 else 850 else
856 send_ping (ssa, 1); // pong 851 send_ping (rsi, 1); // pong
857 852
858 break; 853 break;
859 854
860 case vpn_packet::PT_PONG: 855 case vpn_packet::PT_PONG:
861 break; 856 break;
… …
867 config_packet *p = (config_packet *) pkt; 862 config_packet *p = (config_packet *) pkt;
868 863
869 if (!p->chk_config ()) 864 if (!p->chk_config ())
870 { 865 {
871 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"), 866 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
872 conf->nodename, (const char *)sockinfo (ssa)); 867 conf->nodename, (const char *)rsi);
873 connectmode = conf_node::C_DISABLED; 868 connectmode = conf_node::C_DISABLED;
874 } 869 }
875 else if (connectmode == conf_node::C_ALWAYS) 870 else if (connectmode == conf_node::C_ALWAYS)
876 establish_connection (); 871 establish_connection ();
877 } 872 }
878 break; 873 break;
879 874
880 case vpn_packet::PT_AUTH_REQ: 875 case vpn_packet::PT_AUTH_REQ:
881 if (auth_rate_limiter.can (ssa)) 876 if (auth_rate_limiter.can (rsi))
882 { 877 {
883 auth_req_packet *p = (auth_req_packet *) pkt; 878 auth_req_packet *p = (auth_req_packet *) pkt;
884 879
885 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 880 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);
886 881
887 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 882 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
888 { 883 {
889 if (p->prot_minor != PROTOCOL_MINOR) 884 if (p->prot_minor != PROTOCOL_MINOR)
890 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 885 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
891 conf->nodename, (const char *)sockinfo (ssa), 886 conf->nodename, (const char *)rsi,
892 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 887 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
893 888
894 if (p->initiate) 889 if (p->initiate)
895 send_auth_request (ssa, false); 890 send_auth_request (rsi, false);
896 891
897 rsachallenge k; 892 rsachallenge k;
898 893
899 if (0 > RSA_private_decrypt (sizeof (p->encr), 894 if (0 > RSA_private_decrypt (sizeof (p->encr),
900 (unsigned char *)&p->encr, (unsigned char *)&k, 895 (unsigned char *)&p->encr, (unsigned char *)&k,
901 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING)) 896 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
902 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 897 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
903 conf->nodename, (const char *)sockinfo (ssa)); 898 conf->nodename, (const char *)rsi);
904 else 899 else
905 { 900 {
906 retry_cnt = 0; 901 retry_cnt = 0;
907 establish_connection.set (NOW + 8); //? ;) 902 establish_connection.set (NOW + 8); //? ;)
908 keepalive.reset (); 903 keepalive.reset ();
… …
914 delete octx; 909 delete octx;
915 910
916 octx = new crypto_ctx (k, 1); 911 octx = new crypto_ctx (k, 1);
917 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 912 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
918 913
914 conf->can_recv = p->can_recv;
919 send_auth_response (ssa, p->id, k); 915 send_auth_response (rsi, p->id, k);
920 916
921 break; 917 break;
922 } 918 }
923 } 919 }
924 920
925 send_reset (ssa); 921 send_reset (rsi);
926 } 922 }
927 923
928 break; 924 break;
929 925
930 case vpn_packet::PT_AUTH_RES: 926 case vpn_packet::PT_AUTH_RES:
… …
935 931
936 if (p->chk_config ()) 932 if (p->chk_config ())
937 { 933 {
938 if (p->prot_minor != PROTOCOL_MINOR) 934 if (p->prot_minor != PROTOCOL_MINOR)
939 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 935 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
940 conf->nodename, (const char *)sockinfo (ssa), 936 conf->nodename, (const char *)rsi,
941 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 937 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
942 938
943 rsachallenge chg; 939 rsachallenge chg;
944 940
945 if (!rsa_cache.find (p->id, chg)) 941 if (!rsa_cache.find (p->id, chg))
946 slog (L_ERR, _("%s(%s): unrequested auth response"), 942 slog (L_ERR, _("%s(%s): unrequested auth response"),
947 conf->nodename, (const char *)sockinfo (ssa)); 943 conf->nodename, (const char *)rsi);
948 else 944 else
949 { 945 {
950 crypto_ctx *cctx = new crypto_ctx (chg, 0); 946 crypto_ctx *cctx = new crypto_ctx (chg, 0);
951 947
952 if (!p->hmac_chk (cctx)) 948 if (!p->hmac_chk (cctx))
953 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 949 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
954 "could be an attack, or just corruption or an synchronization error"), 950 "could be an attack, or just corruption or an synchronization error"),
955 conf->nodename, (const char *)sockinfo (ssa)); 951 conf->nodename, (const char *)rsi);
956 else 952 else
957 { 953 {
958 rsaresponse h; 954 rsaresponse h;
959 955
960 rsa_hash (p->id, chg, h); 956 rsa_hash (p->id, chg, h);
… …
965 961
966 delete ictx; ictx = cctx; 962 delete ictx; ictx = cctx;
967 963
968 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 964 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
969 965
970 sa = *ssa; 966 si = rsi;
971 967
972 rekey.set (NOW + ::conf.rekey); 968 rekey.set (NOW + ::conf.rekey);
973 keepalive.set (NOW + ::conf.keepalive); 969 keepalive.set (NOW + ::conf.keepalive);
974 970
975 // send queued packets 971 // send queued packets
… …
980 } 976 }
981 977
982 connectmode = conf->connectmode; 978 connectmode = conf->connectmode;
983 979
984 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"), 980 slog (L_INFO, _("%s(%s): connection established, protocol version %d.%d"),
985 conf->nodename, (const char *)sockinfo (ssa), 981 conf->nodename, (const char *)rsi,
986 p->prot_major, p->prot_minor); 982 p->prot_major, p->prot_minor);
987 983
988 if (::conf.script_node_up) 984 if (::conf.script_node_up)
989 run_script (run_script_cb (this, &connection::script_node_up), false); 985 run_script (run_script_cb (this, &connection::script_node_up), false);
990 986
991 break; 987 break;
992 } 988 }
993 else 989 else
994 slog (L_ERR, _("%s(%s): sent and received challenge do not match"), 990 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
995 conf->nodename, (const char *)sockinfo (ssa)); 991 conf->nodename, (const char *)rsi);
996 } 992 }
997 993
998 delete cctx; 994 delete cctx;
999 } 995 }
1000 } 996 }
1001 } 997 }
1002 998
1003 send_reset (ssa); 999 send_reset (rsi);
1004 break; 1000 break;
1005 1001
1006 case vpn_packet::PT_DATA_COMPRESSED: 1002 case vpn_packet::PT_DATA_COMPRESSED:
1007#if !ENABLE_COMPRESSION 1003#if !ENABLE_COMPRESSION
1008 send_reset (ssa); 1004 send_reset (rsi);
1009 break; 1005 break;
1010#endif 1006#endif
1011 1007
1012 case vpn_packet::PT_DATA_UNCOMPRESSED: 1008 case vpn_packet::PT_DATA_UNCOMPRESSED:
1013 1009
1014 if (ictx && octx) 1010 if (ictx && octx)
1015 { 1011 {
1016 vpndata_packet *p = (vpndata_packet *)pkt; 1012 vpndata_packet *p = (vpndata_packet *)pkt;
1017 1013
1018 if (*ssa == sa) 1014 if (rsi == si)
1019 { 1015 {
1020 if (!p->hmac_chk (ictx)) 1016 if (!p->hmac_chk (ictx))
1021 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1017 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1022 "could be an attack, or just corruption or an synchronization error"), 1018 "could be an attack, or just corruption or an synchronization error"),
1023 conf->nodename, (const char *)sockinfo (ssa)); 1019 conf->nodename, (const char *)rsi);
1024 else 1020 else
1025 { 1021 {
1026 u32 seqno; 1022 u32 seqno;
1027 tap_packet *d = p->unpack (this, seqno); 1023 tap_packet *d = p->unpack (this, seqno);
1028 1024
… …
1044 break; 1040 break;
1045 } 1041 }
1046 } 1042 }
1047 } 1043 }
1048 else 1044 else
1049 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D 1045 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
1050 } 1046 }
1051 1047
1052 send_reset (ssa); 1048 send_reset (rsi);
1053 break; 1049 break;
1054 1050
1055 case vpn_packet::PT_CONNECT_REQ: 1051 case vpn_packet::PT_CONNECT_REQ:
1056 if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx)) 1052 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1057 { 1053 {
1058 connect_req_packet *p = (connect_req_packet *) pkt; 1054 connect_req_packet *p = (connect_req_packet *) pkt;
1059 1055
1060 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1056 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1061 1057
… …
1067 if (c->ictx && c->octx) 1063 if (c->ictx && c->octx)
1068 { 1064 {
1069 // send connect_info packets to both sides, in case one is 1065 // send connect_info packets to both sides, in case one is
1070 // behind a nat firewall (or both ;) 1066 // behind a nat firewall (or both ;)
1071 { 1067 {
1072 sockinfo si(sa);
1073
1074 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 1068 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1075 c->conf->id, conf->id, (const char *)si); 1069 c->conf->id, conf->id, (const char *)si);
1076 1070
1077 connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si); 1071 connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si, conf->can_recv);
1078 1072
1079 r->hmac_set (c->octx); 1073 r->hmac_set (c->octx);
1080 vpn->send_vpn_packet (r, &c->sa); 1074 send_vpn_packet (r, c->si);
1081 1075
1082 delete r; 1076 delete r;
1083 } 1077 }
1084 1078
1085 { 1079 {
1086 sockinfo si(c->sa);
1087
1088 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n", 1080 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1089 conf->id, c->conf->id, (const char *)si); 1081 conf->id, c->conf->id, (const char *)c->si);
1090 1082
1091 connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, si); 1083 connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, c->si, c->conf->can_recv);
1092 1084
1093 r->hmac_set (octx); 1085 r->hmac_set (octx);
1094 vpn->send_vpn_packet (r, &sa); 1086 send_vpn_packet (r, si);
1095 1087
1096 delete r; 1088 delete r;
1097 } 1089 }
1098 } 1090 }
1099 } 1091 }
1100 1092
1101 break; 1093 break;
1102 1094
1103 case vpn_packet::PT_CONNECT_INFO: 1095 case vpn_packet::PT_CONNECT_INFO:
1104 if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx)) 1096 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1105 { 1097 {
1106 connect_info_packet *p = (connect_info_packet *) pkt; 1098 connect_info_packet *p = (connect_info_packet *) pkt;
1107 1099
1108 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1100 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1109 1101
1110 connection *c = vpn->conns[p->id - 1]; 1102 connection *c = vpn->conns[p->id - 1];
1111 1103
1112 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1104 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1113 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1105 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1114 1106
1107 c->conf->can_recv = p->can_recv;
1115 c->send_auth_request (p->si.sa (), true); 1108 c->send_auth_request (p->si, true);
1116 } 1109 }
1117 1110
1118 break; 1111 break;
1119 1112
1120 default: 1113 default:
1121 send_reset (ssa); 1114 send_reset (rsi);
1122 break; 1115 break;
1123 1116
1124 } 1117 }
1125} 1118}
1126 1119
… …
1134 else if (NOW < last_activity + ::conf.keepalive) 1127 else if (NOW < last_activity + ::conf.keepalive)
1135 ts = last_activity + ::conf.keepalive; 1128 ts = last_activity + ::conf.keepalive;
1136 else if (conf->connectmode != conf_node::C_ONDEMAND 1129 else if (conf->connectmode != conf_node::C_ONDEMAND
1137 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1130 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1138 { 1131 {
1139 send_ping (&sa); 1132 send_ping (si);
1140 ts = NOW + 5; 1133 ts = NOW + 5;
1141 } 1134 }
1142 else 1135 else
1143 reset_connection (); 1136 reset_connection ();
1144 1137
… …
1148{ 1141{
1149 connect_req_packet *p = new connect_req_packet (conf->id, id); 1142 connect_req_packet *p = new connect_req_packet (conf->id, id);
1150 1143
1151 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", id, conf->id); 1144 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", id, conf->id);
1152 p->hmac_set (octx); 1145 p->hmac_set (octx);
1153 vpn->send_vpn_packet (p, &sa); 1146 send_vpn_packet (p, si);
1154 1147
1155 delete p; 1148 delete p;
1156} 1149}
1157 1150
1158void connection::script_node () 1151void connection::script_node ()
1159{ 1152{
1160 vpn->script_if_up (0); 1153 vpn->script_if_up (0);
1161 1154
1162 char *env; 1155 char *env;
1163 asprintf (&env, "DESTID=%d", conf->id); 1156 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1164 putenv (env);
1165 asprintf (&env, "DESTNODE=%s", conf->nodename); 1157 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1166 putenv (env); 1158 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1167 asprintf (&env, "DESTIP=%s", inet_ntoa (sa.sin_addr));
1168 putenv (env);
1169 asprintf (&env, "DESTPORT=%d", ntohs (sa.sin_port)); 1159 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1170 putenv (env);
1171} 1160}
1172 1161
1173const char *connection::script_node_up (int) 1162const char *connection::script_node_up (int)
1174{ 1163{
1175 script_node (); 1164 script_node ();
… …
1184 script_node (); 1173 script_node ();
1185 1174
1186 putenv ("STATE=down"); 1175 putenv ("STATE=down");
1187 1176
1188 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1177 return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1178}
1179
1180// send a vpn packet out to other hosts
1181void
1182connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1183{
1184 if (prot_send & PROT_IPv4)
1185 vpn->send_ipv4_packet (pkt, si, tos);
1186 else
1187 vpn->send_udpv4_packet (pkt, si, tos);
1189} 1188}
1190 1189
1191connection::connection(struct vpn *vpn_) 1190connection::connection(struct vpn *vpn_)
1192: vpn(vpn_) 1191: vpn(vpn_)
1193, rekey (this, &connection::rekey_cb) 1192, rekey (this, &connection::rekey_cb)
… …
1235 1234
1236 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 1235 return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
1237} 1236}
1238 1237
1239int 1238int
1240vpn::setup (void) 1239vpn::setup ()
1241{ 1240{
1242 struct sockaddr_in sa; 1241 u8 prots = 0;
1243 1242
1243 for (configuration::node_vector::iterator i = conf.nodes.begin ();
1244 i != conf.nodes.end (); ++i)
1245 prots |= (*i)->can_send | (*i)->can_recv;
1246
1247 sockinfo si;
1248
1249 si.set (THISNODE);
1250
1251 udpv4_fd = -1;
1252
1253 if (prots & PROT_UDPv4)
1254 {
1244 socket_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 1255 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
1245 if (socket_fd < 0) 1256
1257 if (udpv4_fd < 0)
1246 return -1; 1258 return -1;
1247 1259
1248 fill_sa (&sa, THISNODE); 1260 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
1249 1261 {
1250 if (bind (socket_fd, (sockaddr *)&sa, sizeof (sa)))
1251 {
1252 slog (L_ERR, _("can't bind to %s: %s"), (const char *)sockinfo(sa), strerror (errno)); 1262 slog (L_ERR, _("can't bind udpv4 to %s: %s"), (const char *)si, strerror (errno));
1253 exit (1); 1263 exit (1);
1254 } 1264 }
1255 1265
1256#ifdef IP_MTU_DISCOVER 1266#ifdef IP_MTU_DISCOVER
1257 // this I really consider a linux bug. I am neither connected 1267 // this I really consider a linux bug. I am neither connected
1258 // nor do I fragment myself. Linux still sets DF and doesn't 1268 // nor do I fragment myself. Linux still sets DF and doesn't
1259 // fragment for me sometimes. 1269 // fragment for me sometimes.
1260 { 1270 {
1261 int oval = IP_PMTUDISC_DONT; 1271 int oval = IP_PMTUDISC_DONT;
1262 setsockopt (socket_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 1272 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
1263 } 1273 }
1264#endif 1274#endif
1265 { 1275
1276 // standard daemon practise...
1277 {
1266 int oval = 1; 1278 int oval = 1;
1267 setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 1279 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
1268 } 1280 }
1269 1281
1270 udp_ev_watcher.start (socket_fd, POLLIN); 1282 udpv4_ev_watcher.start (udpv4_fd, POLLIN);
1283 }
1284
1285 ipv4_fd = -1;
1286 if (prots & PROT_IPv4)
1287 {
1288 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
1289
1290 if (ipv4_fd < 0)
1291 return -1;
1292
1293 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
1294 {
1295 slog (L_ERR, _("can't bind ipv4 socket to %s: %s"), (const char *)si, strerror (errno));
1296 exit (1);
1297 }
1298
1299#ifdef IP_MTU_DISCOVER
1300 // this I really consider a linux bug. I am neither connected
1301 // nor do I fragment myself. Linux still sets DF and doesn't
1302 // fragment for me sometimes.
1303 {
1304 int oval = IP_PMTUDISC_DONT;
1305 setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
1306 }
1307#endif
1308
1309 ipv4_ev_watcher.start (ipv4_fd, POLLIN);
1310 }
1271 1311
1272 tap = new tap_device (); 1312 tap = new tap_device ();
1273 if (!tap) //D this, of course, never catches 1313 if (!tap) //D this, of course, never catches
1274 { 1314 {
1275 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 1315 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
1276 exit (1); 1316 exit (1);
1277 } 1317 }
1278 1318
1279 run_script (run_script_cb (this, &vpn::script_if_up), true); 1319 run_script (run_script_cb (this, &vpn::script_if_up), true);
1280 1320
1281 vpn_ev_watcher.start (tap->fd, POLLIN); 1321 tap_ev_watcher.start (tap->fd, POLLIN);
1282 1322
1283 reconnect_all (); 1323 reconnect_all ();
1284 1324
1285 return 0; 1325 return 0;
1286} 1326}
1287 1327
1288void 1328void
1289vpn::send_vpn_packet (vpn_packet *pkt, SOCKADDR *sa, int tos) 1329vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1290{ 1330{
1291 setsockopt (socket_fd, SOL_IP, IP_TOS, &tos, sizeof tos); 1331 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1292 sendto (socket_fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)sa, sizeof (*sa)); 1332 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1293} 1333}
1294 1334
1295void 1335void
1296vpn::shutdown_all () 1336vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1297{ 1337{
1298 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 1338 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1299 (*c)->shutdown (); 1339 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1300} 1340}
1301 1341
1302void 1342void
1303vpn::reconnect_all () 1343vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
1304{ 1344{
1305 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 1345 unsigned int src = pkt->src ();
1306 delete *c; 1346 unsigned int dst = pkt->dst ();
1307 1347
1308 conns.clear (); 1348 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1349 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1309 1350
1310 for (configuration::node_vector::iterator i = conf.nodes.begin (); 1351 if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1311 i != conf.nodes.end (); ++i) 1352 slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1312 { 1353 pkt->typ (), pkt->src (), pkt->dst ());
1313 connection *conn = new connection (this); 1354 else if (dst == 0 && !THISNODE->routerprio)
1314 1355 slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1315 conn->conf = *i; 1356 else if (dst != 0 && dst != THISNODE->id)
1316 conns.push_back (conn); 1357 slog (L_WARN,
1317 1358 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1318 conn->establish_connection (); 1359 dst, conns[dst - 1]->conf->nodename,
1319 } 1360 (const char *)rsi,
1361 THISNODE->id, THISNODE->nodename);
1362 else if (src == 0 || src > conns.size ())
1363 slog (L_WARN, _("received frame from unknown node %d (%s)"),
1364 src, (const char *)rsi);
1365 else
1366 conns[src - 1]->recv_vpn_packet (pkt, rsi);
1320} 1367}
1321 1368
1322connection *vpn::find_router ()
1323{
1324 u32 prio = 0;
1325 connection *router = 0;
1326
1327 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1328 {
1329 connection *c = *i;
1330
1331 if (c->conf->routerprio > prio
1332 && c->connectmode == conf_node::C_ALWAYS
1333 && c->conf != THISNODE
1334 && c->ictx && c->octx)
1335 {
1336 prio = c->conf->routerprio;
1337 router = c;
1338 }
1339 }
1340
1341 return router;
1342}
1343
1344void vpn::connect_request (int id)
1345{
1346 connection *c = find_router ();
1347
1348 if (c)
1349 c->connect_request (id);
1350 //else // does not work, because all others must connect to the same router
1351 // // no router found, aggressively connect to all routers
1352 // for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1353 // if ((*i)->conf->routerprio)
1354 // (*i)->establish_connection ();
1355}
1356
1357void 1369void
1358vpn::udp_ev (short revents) 1370vpn::udpv4_ev (short revents)
1359{ 1371{
1360 if (revents & (POLLIN | POLLERR)) 1372 if (revents & (POLLIN | POLLERR))
1361 { 1373 {
1362 vpn_packet *pkt = new vpn_packet; 1374 vpn_packet *pkt = new vpn_packet;
1363 struct sockaddr_in sa; 1375 struct sockaddr_in sa;
1364 socklen_t sa_len = sizeof (sa); 1376 socklen_t sa_len = sizeof (sa);
1365 int len; 1377 int len;
1366 1378
1367 len = recvfrom (socket_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len); 1379 len = recvfrom (udpv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1380
1381 sockinfo si(sa);
1368 1382
1369 if (len > 0) 1383 if (len > 0)
1370 { 1384 {
1371 pkt->len = len; 1385 pkt->len = len;
1372 1386
1373 unsigned int src = pkt->src ();
1374 unsigned int dst = pkt->dst ();
1375
1376 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1377 (const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1378
1379 if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1380 slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1381 pkt->typ (), pkt->src (), pkt->dst ());
1382 else if (dst == 0 && !THISNODE->routerprio)
1383 slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1384 else if (dst != 0 && dst != THISNODE->id)
1385 slog (L_WARN,
1386 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1387 dst, conns[dst - 1]->conf->nodename,
1388 (const char *)sockinfo (sa),
1389 THISNODE->id, THISNODE->nodename);
1390 else if (src == 0 || src > conns.size ())
1391 slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
1392 else
1393 conns[src - 1]->recv_vpn_packet (pkt, &sa); 1387 recv_vpn_packet (pkt, si);
1394 } 1388 }
1395 else 1389 else
1396 { 1390 {
1397 // probably ECONNRESET or somesuch 1391 // probably ECONNRESET or somesuch
1398 slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno)); 1392 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
1399 } 1393 }
1400 1394
1401 delete pkt; 1395 delete pkt;
1402 } 1396 }
1403 else if (revents & POLLHUP) 1397 else if (revents & POLLHUP)
1404 { 1398 {
1405 // this cannot ;) happen on udp sockets 1399 // this cannot ;) happen on udp sockets
1406 slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating.")); 1400 slog (L_ERR, _("FATAL: POLLHUP on udp v4 fd, terminating."));
1407 exit (1); 1401 exit (1);
1408 } 1402 }
1409 else 1403 else
1410 { 1404 {
1411 slog (L_ERR, 1405 slog (L_ERR,
… …
1414 exit (1); 1408 exit (1);
1415 } 1409 }
1416} 1410}
1417 1411
1418void 1412void
1413vpn::ipv4_ev (short revents)
1414{
1415 if (revents & (POLLIN | POLLERR))
1416 {
1417 vpn_packet *pkt = new vpn_packet;
1418 struct sockaddr_in sa;
1419 socklen_t sa_len = sizeof (sa);
1420 int len;
1421
1422 len = recvfrom (ipv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1423
1424 sockinfo si(sa, PROT_IPv4);
1425
1426 if (len > 0)
1427 {
1428 pkt->len = len;
1429
1430 // raw sockets deliver the ipv4, but don't expect it on sends
1431 // this is slow, but...
1432 pkt->skip_hdr (IP_OVERHEAD);
1433
1434 recv_vpn_packet (pkt, si);
1435 }
1436 else
1437 {
1438 // probably ECONNRESET or somesuch
1439 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
1440 }
1441
1442 delete pkt;
1443 }
1444 else if (revents & POLLHUP)
1445 {
1446 // this cannot ;) happen on udp sockets
1447 slog (L_ERR, _("FATAL: POLLHUP on ipv4 fd, terminating."));
1448 exit (1);
1449 }
1450 else
1451 {
1452 slog (L_ERR,
1453 _("FATAL: unknown revents %08x in socket, terminating\n"),
1454 revents);
1455 exit (1);
1456 }
1457}
1458
1459void
1419vpn::vpn_ev (short revents) 1460vpn::tap_ev (short revents)
1420{ 1461{
1421 if (revents & POLLIN) 1462 if (revents & POLLIN)
1422 { 1463 {
1423 /* process data */ 1464 /* process data */
1424 tap_packet *pkt; 1465 tap_packet *pkt;
… …
1480{ 1521{
1481 if (events) 1522 if (events)
1482 { 1523 {
1483 if (events & EVENT_SHUTDOWN) 1524 if (events & EVENT_SHUTDOWN)
1484 { 1525 {
1526 slog (L_INFO, _("preparing shutdown..."));
1527
1485 shutdown_all (); 1528 shutdown_all ();
1486 1529
1487 remove_pid (pidfilename); 1530 remove_pid (pidfilename);
1488 1531
1489 slog (L_INFO, _("vped terminating")); 1532 slog (L_INFO, _("terminating"));
1490 1533
1491 exit (0); 1534 exit (0);
1492 } 1535 }
1493 1536
1494 if (events & EVENT_RECONNECT) 1537 if (events & EVENT_RECONNECT)
1538 {
1539 slog (L_INFO, _("forced reconnect"));
1540
1495 reconnect_all (); 1541 reconnect_all ();
1542 }
1496 1543
1497 events = 0; 1544 events = 0;
1498 } 1545 }
1499 1546
1500 ts = TSTAMP_CANCEL; 1547 ts = TSTAMP_CANCEL;
1501} 1548}
1502 1549
1550void
1551vpn::shutdown_all ()
1552{
1553 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1554 (*c)->shutdown ();
1555}
1556
1557void
1558vpn::reconnect_all ()
1559{
1560 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1561 delete *c;
1562
1563 conns.clear ();
1564
1565 auth_rate_limiter.clear ();
1566 reset_rate_limiter.clear ();
1567
1568 for (configuration::node_vector::iterator i = conf.nodes.begin ();
1569 i != conf.nodes.end (); ++i)
1570 {
1571 connection *conn = new connection (this);
1572
1573 conn->conf = *i;
1574 conns.push_back (conn);
1575
1576 conn->establish_connection ();
1577 }
1578}
1579
1580connection *vpn::find_router ()
1581{
1582 u32 prio = 0;
1583 connection *router = 0;
1584
1585 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1586 {
1587 connection *c = *i;
1588
1589 if (c->conf->routerprio > prio
1590 && c->connectmode == conf_node::C_ALWAYS
1591 && c->conf != THISNODE
1592 && c->ictx && c->octx)
1593 {
1594 prio = c->conf->routerprio;
1595 router = c;
1596 }
1597 }
1598
1599 return router;
1600}
1601
1602void vpn::connect_request (int id)
1603{
1604 connection *c = find_router ();
1605
1606 if (c)
1607 c->connect_request (id);
1608 //else // does not work, because all others must connect to the same router
1609 // // no router found, aggressively connect to all routers
1610 // for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1611 // if ((*i)->conf->routerprio)
1612 // (*i)->establish_connection ();
1613}
1614
1615void
1616connection::dump_status ()
1617{
1618 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
1619 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
1620 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
1621 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
1622 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
1623 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
1624 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
1625}
1626
1627void
1628vpn::dump_status ()
1629{
1630 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);
1631
1632 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1633 (*c)->dump_status ();
1634
1635 slog (L_NOTICE, _("END status dump"));
1636}
1637
1503vpn::vpn (void) 1638vpn::vpn (void)
1504: udp_ev_watcher (this, &vpn::udp_ev) 1639: udpv4_ev_watcher(this, &vpn::udpv4_ev)
1640, ipv4_ev_watcher(this, &vpn::ipv4_ev)
1505, vpn_ev_watcher (this, &vpn::vpn_ev) 1641, tap_ev_watcher(this, &vpn::tap_ev)
1506, event (this, &vpn::event_cb) 1642, event(this, &vpn::event_cb)
1507{ 1643{
1508} 1644}
1509 1645
1510vpn::~vpn () 1646vpn::~vpn ()
1511{ 1647{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines