ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/protocol.C
(Generate patch)

Comparing gvpe/src/protocol.C (file contents):
Revision 1.19 by pcg, Wed Mar 26 14:39:52 2003 UTC vs.
Revision 1.25 by pcg, Fri Mar 28 16:21:09 2003 UTC

… …
237}; 237};
238 238
239// only do action once every x seconds per host whole allowing bursts. 239// only do action once every x seconds per host whole allowing bursts.
240// this implementation ("splay list" ;) is inefficient, 240// this implementation ("splay list" ;) is inefficient,
241// but low on resources. 241// but low on resources.
242struct net_rate_limiter : private list<net_rateinfo> 242struct net_rate_limiter : list<net_rateinfo>
243{ 243{
244 static const double ALPHA = 1. - 1. / 90.; // allow bursts 244 static const double ALPHA = 1. - 1. / 90.; // allow bursts
245 static const double CUTOFF = 20.; // one event every CUTOFF seconds 245 static const double CUTOFF = 20.; // one event every CUTOFF seconds
246 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time 246 static const double EXPIRE = CUTOFF * 30.; // expire entries after this time
247 247
248 bool can (const sockinfo &si) { return can((u32)si.host); }
248 bool can (u32 host); 249 bool can (u32 host);
249 bool can (SOCKADDR *sa) { return can((u32)sa->sin_addr.s_addr); }
250 bool can (sockinfo &si) { return can((u32)si.host); }
251}; 250};
252 251
253net_rate_limiter auth_rate_limiter, reset_rate_limiter; 252net_rate_limiter auth_rate_limiter, reset_rate_limiter;
254 253
255bool net_rate_limiter::can (u32 host) 254bool net_rate_limiter::can (u32 host)
… …
362 u8 type; 361 u8 type;
363 u8 srcdst, src1, dst1; 362 u8 srcdst, src1, dst1;
364 363
365 void set_hdr (ptype type, unsigned int dst); 364 void set_hdr (ptype type, unsigned int dst);
366 365
367 unsigned int src () 366 unsigned int src () const
368 { 367 {
369 return src1 | ((srcdst >> 4) << 8); 368 return src1 | ((srcdst >> 4) << 8);
370 } 369 }
371 370
372 unsigned int dst () 371 unsigned int dst () const
373 { 372 {
374 return dst1 | ((srcdst & 0xf) << 8); 373 return dst1 | ((srcdst & 0xf) << 8);
375 } 374 }
376 375
377 ptype typ () 376 ptype typ () const
378 { 377 {
379 return (ptype) type; 378 return (ptype) type;
380 } 379 }
381 }; 380 };
382 381
… …
537 { 536 {
538 return 0x80 537 return 0x80
539 | (ENABLE_COMPRESSION ? 0x01 : 0x00); 538 | (ENABLE_COMPRESSION ? 0x01 : 0x00);
540 } 539 }
541 540
542 void setup (ptype type, int dst) 541 void setup (ptype type, int dst);
543 {
544 prot_major = PROTOCOL_MAJOR;
545 prot_minor = PROTOCOL_MINOR;
546 randsize = RAND_SIZE;
547 hmaclen = HMACLENGTH;
548 flags = curflags ();
549 challengelen = sizeof (rsachallenge);
550
551 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
552 digest_nid = htonl (EVP_MD_type (RSA_HASH));
553 hmac_nid = htonl (EVP_MD_type (DIGEST));
554
555 len = sizeof (*this) - sizeof (net_packet);
556 set_hdr (type, dst);
557 }
558
559 bool chk_config () 542 bool chk_config () const;
560 {
561 return prot_major == PROTOCOL_MAJOR
562 && randsize == RAND_SIZE
563 && hmaclen == HMACLENGTH
564 && flags == curflags ()
565 && challengelen == sizeof (rsachallenge)
566 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
567 && digest_nid == htonl (EVP_MD_type (RSA_HASH))
568 && hmac_nid == htonl (EVP_MD_type (DIGEST));
569 }
570}; 543};
544
545void config_packet::setup (ptype type, int dst)
546{
547 prot_major = PROTOCOL_MAJOR;
548 prot_minor = PROTOCOL_MINOR;
549 randsize = RAND_SIZE;
550 hmaclen = HMACLENGTH;
551 flags = curflags ();
552 challengelen = sizeof (rsachallenge);
553
554 cipher_nid = htonl (EVP_CIPHER_nid (CIPHER));
555 digest_nid = htonl (EVP_MD_type (RSA_HASH));
556 hmac_nid = htonl (EVP_MD_type (DIGEST));
557
558 len = sizeof (*this) - sizeof (net_packet);
559 set_hdr (type, dst);
560}
561
562bool config_packet::chk_config () const
563{
564 return prot_major == PROTOCOL_MAJOR
565 && randsize == RAND_SIZE
566 && hmaclen == HMACLENGTH
567 && flags == curflags ()
568 && challengelen == sizeof (rsachallenge)
569 && cipher_nid == htonl (EVP_CIPHER_nid (CIPHER))
570 && digest_nid == htonl (EVP_MD_type (RSA_HASH))
571 && hmac_nid == htonl (EVP_MD_type (DIGEST));
572}
571 573
572struct auth_req_packet : config_packet 574struct auth_req_packet : config_packet
573{ 575{
574 char magic[8]; 576 char magic[8];
575 u8 initiate; // false if this is just an automatic reply 577 u8 initiate; // false if this is just an automatic reply
578 u8 protocols; // supported protocols (will get patches on forward)
576 u8 pad1, pad2, pad3; 579 u8 pad2, pad3;
577 rsaid id; 580 rsaid id;
578 rsaencrdata encr; 581 rsaencrdata encr;
579 582
580 auth_req_packet (int dst, bool initiate_) 583 auth_req_packet (int dst, bool initiate_, u8 protocols_)
581 { 584 {
582 config_packet::setup (PT_AUTH_REQ, dst); 585 config_packet::setup (PT_AUTH_REQ, dst);
586 strncpy (magic, MAGIC, 8);
583 initiate = !!initiate_; 587 initiate = !!initiate_;
584 strncpy (magic, MAGIC, 8); 588 protocols = protocols_;
589
585 len = sizeof (*this) - sizeof (net_packet); 590 len = sizeof (*this) - sizeof (net_packet);
586 } 591 }
587}; 592};
588 593
589struct auth_res_packet : config_packet 594struct auth_res_packet : config_packet
… …
594 rsaresponse response; 599 rsaresponse response;
595 600
596 auth_res_packet (int dst) 601 auth_res_packet (int dst)
597 { 602 {
598 config_packet::setup (PT_AUTH_RES, dst); 603 config_packet::setup (PT_AUTH_RES, dst);
604
599 len = sizeof (*this) - sizeof (net_packet); 605 len = sizeof (*this) - sizeof (net_packet);
600 } 606 }
601}; 607};
602 608
603struct connect_req_packet : vpn_packet 609struct connect_req_packet : vpn_packet
604{ 610{
605 u8 id; 611 u8 id, protocols;
606 u8 pad1, pad2, pad3; 612 u8 pad1, pad2;
607 613
608 connect_req_packet (int dst, int id_) 614 connect_req_packet (int dst, int id_, u8 protocols_)
615 : id(id_)
616 , protocols(protocols_)
609 { 617 {
610 id = id_;
611 set_hdr (PT_CONNECT_REQ, dst); 618 set_hdr (PT_CONNECT_REQ, dst);
612 len = sizeof (*this) - sizeof (net_packet); 619 len = sizeof (*this) - sizeof (net_packet);
613 } 620 }
614}; 621};
615 622
616struct connect_info_packet : vpn_packet 623struct connect_info_packet : vpn_packet
617{ 624{
618 u8 id; 625 u8 id, protocols;
619 u8 pad1, pad2, pad3; 626 u8 pad1, pad2;
620 sockinfo si; 627 sockinfo si;
621 628
622 connect_info_packet (int dst, int id_, sockinfo &si_) 629 connect_info_packet (int dst, int id_, const sockinfo &si_, u8 protocols_)
630 : id(id_)
631 , protocols(protocols_)
632 , si(si_)
623 { 633 {
624 id = id_;
625 si = si_;
626 set_hdr (PT_CONNECT_INFO, dst); 634 set_hdr (PT_CONNECT_INFO, dst);
635
627 len = sizeof (*this) - sizeof (net_packet); 636 len = sizeof (*this) - sizeof (net_packet);
628 } 637 }
629}; 638};
630 639
631///////////////////////////////////////////////////////////////////////////// 640/////////////////////////////////////////////////////////////////////////////
632 641
633void 642void
634fill_sa (SOCKADDR *sa, conf_node *conf)
635{
636 sa->sin_family = AF_INET;
637 sa->sin_port = htons (conf->port);
638 sa->sin_addr.s_addr = 0;
639
640 if (conf->hostname)
641 {
642 struct hostent *he = gethostbyname (conf->hostname);
643
644 if (he
645 && he->h_addrtype == AF_INET && he->h_length == 4 && he->h_addr_list[0])
646 {
647 //sa->sin_family = he->h_addrtype;
648 memcpy (&sa->sin_addr, he->h_addr_list[0], 4);
649 }
650 else
651 slog (L_NOTICE, _("unable to resolve host '%s'"), conf->hostname);
652 }
653}
654
655void
656connection::reset_dstaddr () 643connection::reset_dstaddr ()
657{ 644{
658 fill_sa (&sa, conf); 645 si.set (conf);
659} 646}
660 647
661void 648void
662connection::send_ping (SOCKADDR *dsa, u8 pong) 649connection::send_ping (const sockinfo &si, u8 pong)
663{ 650{
664 ping_packet *pkt = new ping_packet; 651 ping_packet *pkt = new ping_packet;
665 652
666 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING); 653 pkt->setup (conf->id, pong ? ping_packet::PT_PONG : ping_packet::PT_PING);
667 vpn->send_vpn_packet (pkt, dsa, IPTOS_LOWDELAY); 654 send_vpn_packet (pkt, si, IPTOS_LOWDELAY);
668 655
669 delete pkt; 656 delete pkt;
670} 657}
671 658
672void 659void
673connection::send_reset (SOCKADDR *dsa) 660connection::send_reset (const sockinfo &si)
674{ 661{
675 if (reset_rate_limiter.can (dsa) && connectmode != conf_node::C_DISABLED) 662 if (reset_rate_limiter.can (si) && connectmode != conf_node::C_DISABLED)
676 { 663 {
677 config_packet *pkt = new config_packet; 664 config_packet *pkt = new config_packet;
678 665
679 pkt->setup (vpn_packet::PT_RESET, conf->id); 666 pkt->setup (vpn_packet::PT_RESET, conf->id);
680 vpn->send_vpn_packet (pkt, dsa, IPTOS_MINCOST); 667 send_vpn_packet (pkt, si, IPTOS_MINCOST);
681 668
682 delete pkt; 669 delete pkt;
683 } 670 }
684} 671}
685 672
686void 673void
687connection::send_auth_request (SOCKADDR *sa, bool initiate) 674connection::send_auth_request (const sockinfo &si, bool initiate)
688{ 675{
689 if (!initiate || auth_rate_limiter.can (sa))
690 {
691 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate); 676 auth_req_packet *pkt = new auth_req_packet (conf->id, initiate, THISNODE->protocols);
692 677
678 protocol = best_protocol (THISNODE->protocols & conf->protocols);
679
693 rsachallenge chg; 680 rsachallenge chg;
694 681
695 rsa_cache.gen (pkt->id, chg); 682 rsa_cache.gen (pkt->id, chg);
696 683
697 if (0 > RSA_public_encrypt (sizeof chg, 684 if (0 > RSA_public_encrypt (sizeof chg,
698 (unsigned char *)&chg, (unsigned char *)&pkt->encr, 685 (unsigned char *)&chg, (unsigned char *)&pkt->encr,
699 conf->rsa_key, RSA_PKCS1_OAEP_PADDING)) 686 conf->rsa_key, RSA_PKCS1_OAEP_PADDING))
700 fatal ("RSA_public_encrypt error"); 687 fatal ("RSA_public_encrypt error");
701 688
702 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)sockinfo (sa)); 689 slog (L_TRACE, ">>%d PT_AUTH_REQ [%s]", conf->id, (const char *)si);
703 690
704 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly 691 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
705 692
706 delete pkt; 693 delete pkt;
707 }
708} 694}
709 695
710void 696void
711connection::send_auth_response (SOCKADDR *sa, const rsaid &id, const rsachallenge &chg) 697connection::send_auth_response (const sockinfo &si, const rsaid &id, const rsachallenge &chg)
712{ 698{
713 auth_res_packet *pkt = new auth_res_packet (conf->id); 699 auth_res_packet *pkt = new auth_res_packet (conf->id);
714 700
715 pkt->id = id; 701 pkt->id = id;
716 702
717 rsa_hash (id, chg, pkt->response); 703 rsa_hash (id, chg, pkt->response);
718 704
719 pkt->hmac_set (octx); 705 pkt->hmac_set (octx);
720 706
721 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)sockinfo (sa)); 707 slog (L_TRACE, ">>%d PT_AUTH_RES [%s]", conf->id, (const char *)si);
722 708
723 vpn->send_vpn_packet (pkt, sa, IPTOS_RELIABILITY); // rsa is very very costly 709 send_vpn_packet (pkt, si, IPTOS_RELIABILITY); // rsa is very very costly
724 710
725 delete pkt; 711 delete pkt;
712}
713
714void
715connection::send_connect_info (int rid, const sockinfo &rsi, u8 rprotocols)
716{
717 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
718 conf->id, rid, (const char *)rsi);
719
720 connect_info_packet *r = new connect_info_packet (conf->id, rid, rsi, rprotocols);
721
722 r->hmac_set (octx);
723 send_vpn_packet (r, si);
724
725 delete r;
726} 726}
727 727
728void 728void
729connection::establish_connection_cb (tstamp &ts) 729connection::establish_connection_cb (tstamp &ts)
730{ 730{
… …
742 ts = NOW + retry_int; 742 ts = NOW + retry_int;
743 743
744 if (conf->hostname) 744 if (conf->hostname)
745 { 745 {
746 reset_dstaddr (); 746 reset_dstaddr ();
747 if (sa.sin_addr.s_addr) 747 if (si.host && auth_rate_limiter.can (si))
748 {
748 if (retry_cnt < 4) 749 if (retry_cnt < 4)
749 send_auth_request (&sa, true); 750 send_auth_request (si, true);
750 else if (auth_rate_limiter.can (&sa)) 751 else
751 send_ping (&sa, 0); 752 send_ping (si, 0);
753 }
752 } 754 }
753 else 755 else
754 vpn->connect_request (conf->id); 756 vpn->connect_request (conf->id);
755 } 757 }
756} 758}
… …
759connection::reset_connection () 761connection::reset_connection ()
760{ 762{
761 if (ictx && octx) 763 if (ictx && octx)
762 { 764 {
763 slog (L_INFO, _("%s(%s): connection lost"), 765 slog (L_INFO, _("%s(%s): connection lost"),
764 conf->nodename, (const char *)sockinfo (sa)); 766 conf->nodename, (const char *)si);
765 767
766 if (::conf.script_node_down) 768 if (::conf.script_node_down)
767 run_script (run_script_cb (this, &connection::script_node_down), false); 769 run_script (run_script_cb (this, &connection::script_node_down), false);
768 } 770 }
769 771
770 delete ictx; ictx = 0; 772 delete ictx; ictx = 0;
771 delete octx; octx = 0; 773 delete octx; octx = 0;
772 774
773 sa.sin_port = 0; 775 si.host= 0;
774 sa.sin_addr.s_addr = 0;
775 776
776 last_activity = 0; 777 last_activity = 0;
778 retry_cnt = 0;
777 779
778 rekey.reset (); 780 rekey.reset ();
779 keepalive.reset (); 781 keepalive.reset ();
780 establish_connection.reset (); 782 establish_connection.reset ();
781} 783}
782 784
783void 785void
784connection::shutdown () 786connection::shutdown ()
785{ 787{
786 if (ictx && octx) 788 if (ictx && octx)
787 send_reset (&sa); 789 send_reset (si);
788 790
789 reset_connection (); 791 reset_connection ();
790} 792}
791 793
792void 794void
… …
797 reset_connection (); 799 reset_connection ();
798 establish_connection (); 800 establish_connection ();
799} 801}
800 802
801void 803void
802connection::send_data_packet (tap_packet * pkt, bool broadcast) 804connection::send_data_packet (tap_packet *pkt, bool broadcast)
803{ 805{
804 vpndata_packet *p = new vpndata_packet; 806 vpndata_packet *p = new vpndata_packet;
805 int tos = 0; 807 int tos = 0;
806 808
807 if (conf->inherit_tos 809 if (conf->inherit_tos
808 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP 810 && (*pkt)[12] == 0x08 && (*pkt)[13] == 0x00 // IP
809 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4 811 && ((*pkt)[14] & 0xf0) == 0x40) // IPv4
810 tos = (*pkt)[15] & IPTOS_TOS_MASK; 812 tos = (*pkt)[15] & IPTOS_TOS_MASK;
811 813
812 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs 814 p->setup (this, broadcast ? 0 : conf->id, &((*pkt)[6 + 6]), pkt->len - 6 - 6, ++oseqno); // skip 2 macs
813 vpn->send_vpn_packet (p, &sa, tos); 815 send_vpn_packet (p, si, tos);
814 816
815 delete p; 817 delete p;
816 818
817 if (oseqno > MAX_SEQNO) 819 if (oseqno > MAX_SEQNO)
818 rekey (); 820 rekey ();
… …
831 establish_connection (); 833 establish_connection ();
832 } 834 }
833} 835}
834 836
835void 837void
836connection::recv_vpn_packet (vpn_packet *pkt, SOCKADDR *ssa) 838connection::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
837{ 839{
838 last_activity = NOW; 840 last_activity = NOW;
839 841
840 slog (L_NOISE, "<<%d received packet type %d from %d to %d", 842 slog (L_NOISE, "<<%d received packet type %d from %d to %d",
841 conf->id, pkt->typ (), pkt->src (), pkt->dst ()); 843 conf->id, pkt->typ (), pkt->src (), pkt->dst ());
842 844
843 switch (pkt->typ ()) 845 switch (pkt->typ ())
844 { 846 {
845 case vpn_packet::PT_PING: 847 case vpn_packet::PT_PING:
846 // we send pings instead of auth packets after some retries, 848 // we send pings instead of auth packets after some retries,
847 // so reset the retry counter and establish a conenction 849 // so reset the retry counter and establish a connection
848 // when we receive a pong. 850 // when we receive a ping.
849 if (!ictx && !octx) 851 if (!ictx)
850 { 852 {
851 retry_cnt = 0; 853 if (auth_rate_limiter.can (rsi))
852 establish_connection.at = 0; 854 send_auth_request (rsi, true);
853 establish_connection ();
854 } 855 }
855 else 856 else
856 send_ping (ssa, 1); // pong 857 send_ping (rsi, 1); // pong
857 858
858 break; 859 break;
859 860
860 case vpn_packet::PT_PONG: 861 case vpn_packet::PT_PONG:
861 break; 862 break;
… …
867 config_packet *p = (config_packet *) pkt; 868 config_packet *p = (config_packet *) pkt;
868 869
869 if (!p->chk_config ()) 870 if (!p->chk_config ())
870 { 871 {
871 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"), 872 slog (L_WARN, _("%s(%s): protocol mismatch, disabling node"),
872 conf->nodename, (const char *)sockinfo (ssa)); 873 conf->nodename, (const char *)rsi);
873 connectmode = conf_node::C_DISABLED; 874 connectmode = conf_node::C_DISABLED;
874 } 875 }
875 else if (connectmode == conf_node::C_ALWAYS) 876 else if (connectmode == conf_node::C_ALWAYS)
876 establish_connection (); 877 establish_connection ();
877 } 878 }
878 break; 879 break;
879 880
880 case vpn_packet::PT_AUTH_REQ: 881 case vpn_packet::PT_AUTH_REQ:
881 if (auth_rate_limiter.can (ssa)) 882 if (auth_rate_limiter.can (rsi))
882 { 883 {
883 auth_req_packet *p = (auth_req_packet *) pkt; 884 auth_req_packet *p = (auth_req_packet *) pkt;
884 885
885 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate); 886 slog (L_TRACE, "<<%d PT_AUTH_REQ(%d)", conf->id, p->initiate);
886 887
887 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8)) 888 if (p->chk_config () && !strncmp (p->magic, MAGIC, 8))
888 { 889 {
889 if (p->prot_minor != PROTOCOL_MINOR) 890 if (p->prot_minor != PROTOCOL_MINOR)
890 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 891 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
891 conf->nodename, (const char *)sockinfo (ssa), 892 conf->nodename, (const char *)rsi,
892 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 893 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
893 894
894 if (p->initiate) 895 if (p->initiate)
895 send_auth_request (ssa, false); 896 send_auth_request (rsi, false);
896 897
897 rsachallenge k; 898 rsachallenge k;
898 899
899 if (0 > RSA_private_decrypt (sizeof (p->encr), 900 if (0 > RSA_private_decrypt (sizeof (p->encr),
900 (unsigned char *)&p->encr, (unsigned char *)&k, 901 (unsigned char *)&p->encr, (unsigned char *)&k,
901 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING)) 902 ::conf.rsa_key, RSA_PKCS1_OAEP_PADDING))
902 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"), 903 slog (L_ERR, _("%s(%s): challenge illegal or corrupted"),
903 conf->nodename, (const char *)sockinfo (ssa)); 904 conf->nodename, (const char *)rsi);
904 else 905 else
905 { 906 {
906 retry_cnt = 0; 907 retry_cnt = 0;
907 establish_connection.set (NOW + 8); //? ;) 908 establish_connection.set (NOW + 8); //? ;)
908 keepalive.reset (); 909 keepalive.reset ();
… …
914 delete octx; 915 delete octx;
915 916
916 octx = new crypto_ctx (k, 1); 917 octx = new crypto_ctx (k, 1);
917 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff; 918 oseqno = ntohl (*(u32 *)&k[CHG_SEQNO]) & 0x7fffffff;
918 919
920 conf->protocols = p->protocols;
919 send_auth_response (ssa, p->id, k); 921 send_auth_response (rsi, p->id, k);
920 922
921 break; 923 break;
922 } 924 }
923 } 925 }
924 926
925 send_reset (ssa); 927 send_reset (rsi);
926 } 928 }
927 929
928 break; 930 break;
929 931
930 case vpn_packet::PT_AUTH_RES: 932 case vpn_packet::PT_AUTH_RES:
… …
935 937
936 if (p->chk_config ()) 938 if (p->chk_config ())
937 { 939 {
938 if (p->prot_minor != PROTOCOL_MINOR) 940 if (p->prot_minor != PROTOCOL_MINOR)
939 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."), 941 slog (L_INFO, _("%s(%s): protocol minor version mismatch: ours is %d, %s's is %d."),
940 conf->nodename, (const char *)sockinfo (ssa), 942 conf->nodename, (const char *)rsi,
941 PROTOCOL_MINOR, conf->nodename, p->prot_minor); 943 PROTOCOL_MINOR, conf->nodename, p->prot_minor);
942 944
943 rsachallenge chg; 945 rsachallenge chg;
944 946
945 if (!rsa_cache.find (p->id, chg)) 947 if (!rsa_cache.find (p->id, chg))
946 slog (L_ERR, _("%s(%s): unrequested auth response"), 948 slog (L_ERR, _("%s(%s): unrequested auth response"),
947 conf->nodename, (const char *)sockinfo (ssa)); 949 conf->nodename, (const char *)rsi);
948 else 950 else
949 { 951 {
950 crypto_ctx *cctx = new crypto_ctx (chg, 0); 952 crypto_ctx *cctx = new crypto_ctx (chg, 0);
951 953
952 if (!p->hmac_chk (cctx)) 954 if (!p->hmac_chk (cctx))
953 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n" 955 slog (L_ERR, _("%s(%s): hmac authentication error on auth response, received invalid packet\n"
954 "could be an attack, or just corruption or an synchronization error"), 956 "could be an attack, or just corruption or an synchronization error"),
955 conf->nodename, (const char *)sockinfo (ssa)); 957 conf->nodename, (const char *)rsi);
956 else 958 else
957 { 959 {
958 rsaresponse h; 960 rsaresponse h;
959 961
960 rsa_hash (p->id, chg, h); 962 rsa_hash (p->id, chg, h);
… …
965 967
966 delete ictx; ictx = cctx; 968 delete ictx; ictx = cctx;
967 969
968 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid 970 iseqno.reset (ntohl (*(u32 *)&chg[CHG_SEQNO]) & 0x7fffffff); // at least 2**31 sequence numbers are valid
969 971
970 sa = *ssa; 972 si = rsi;
971 973
972 rekey.set (NOW + ::conf.rekey); 974 rekey.set (NOW + ::conf.rekey);
973 keepalive.set (NOW + ::conf.keepalive); 975 keepalive.set (NOW + ::conf.keepalive);
974 976
975 // send queued packets 977 // send queued packets
… …
979 delete p; 981 delete p;
980 } 982 }
981 983
982 connectmode = conf->connectmode; 984 connectmode = conf->connectmode;
983 985
984 slog (L_INFO, _("%s(%s): connection established, protocol version %d:%d"), 986 slog (L_INFO, _("%s(%s): %s connection established, protocol version %d.%d"),
985 conf->nodename, (const char *)sockinfo (ssa), 987 conf->nodename, (const char *)rsi,
988 strprotocol (protocol),
986 p->prot_major, p->prot_minor); 989 p->prot_major, p->prot_minor);
987 990
988 if (::conf.script_node_up) 991 if (::conf.script_node_up)
989 run_script (run_script_cb (this, &connection::script_node_up), false); 992 run_script (run_script_cb (this, &connection::script_node_up), false);
990 993
991 break; 994 break;
992 } 995 }
993 else 996 else
994 slog (L_ERR, _("%s(%s): sent and received challenge do not match"), 997 slog (L_ERR, _("%s(%s): sent and received challenge do not match"),
995 conf->nodename, (const char *)sockinfo (ssa)); 998 conf->nodename, (const char *)rsi);
996 } 999 }
997 1000
998 delete cctx; 1001 delete cctx;
999 } 1002 }
1000 } 1003 }
1001 } 1004 }
1002 1005
1003 send_reset (ssa); 1006 send_reset (rsi);
1004 break; 1007 break;
1005 1008
1006 case vpn_packet::PT_DATA_COMPRESSED: 1009 case vpn_packet::PT_DATA_COMPRESSED:
1007#if !ENABLE_COMPRESSION 1010#if !ENABLE_COMPRESSION
1008 send_reset (ssa); 1011 send_reset (rsi);
1009 break; 1012 break;
1010#endif 1013#endif
1011 1014
1012 case vpn_packet::PT_DATA_UNCOMPRESSED: 1015 case vpn_packet::PT_DATA_UNCOMPRESSED:
1013 1016
1014 if (ictx && octx) 1017 if (ictx && octx)
1015 { 1018 {
1016 vpndata_packet *p = (vpndata_packet *)pkt; 1019 vpndata_packet *p = (vpndata_packet *)pkt;
1017 1020
1018 if (*ssa == sa) 1021 if (rsi == si)
1019 { 1022 {
1020 if (!p->hmac_chk (ictx)) 1023 if (!p->hmac_chk (ictx))
1021 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n" 1024 slog (L_ERR, _("%s(%s): hmac authentication error, received invalid packet\n"
1022 "could be an attack, or just corruption or an synchronization error"), 1025 "could be an attack, or just corruption or an synchronization error"),
1023 conf->nodename, (const char *)sockinfo (ssa)); 1026 conf->nodename, (const char *)rsi);
1024 else 1027 else
1025 { 1028 {
1026 u32 seqno; 1029 u32 seqno;
1027 tap_packet *d = p->unpack (this, seqno); 1030 tap_packet *d = p->unpack (this, seqno);
1028 1031
… …
1044 break; 1047 break;
1045 } 1048 }
1046 } 1049 }
1047 } 1050 }
1048 else 1051 else
1049 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)sockinfo (ssa));//D 1052 slog (L_ERR, _("received data packet from unknown source %s"), (const char *)rsi);
1050 } 1053 }
1051 1054
1052 send_reset (ssa); 1055 send_reset (rsi);
1053 break; 1056 break;
1054 1057
1055 case vpn_packet::PT_CONNECT_REQ: 1058 case vpn_packet::PT_CONNECT_REQ:
1056 if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx)) 1059 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1057 { 1060 {
1058 connect_req_packet *p = (connect_req_packet *) pkt; 1061 connect_req_packet *p = (connect_req_packet *) pkt;
1059 1062
1060 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1063 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1061 1064 conf->protocols = p->protocols;
1062 connection *c = vpn->conns[p->id - 1]; 1065 connection *c = vpn->conns[p->id - 1];
1063 1066
1064 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n", 1067 slog (L_TRACE, "<<%d PT_CONNECT_REQ(%d) [%d]\n",
1065 conf->id, p->id, c->ictx && c->octx); 1068 conf->id, p->id, c->ictx && c->octx);
1066 1069
1067 if (c->ictx && c->octx) 1070 if (c->ictx && c->octx)
1068 { 1071 {
1069 // send connect_info packets to both sides, in case one is 1072 // send connect_info packets to both sides, in case one is
1070 // behind a nat firewall (or both ;) 1073 // behind a nat firewall (or both ;)
1071 { 1074 c->send_connect_info (conf->id, si, conf->protocols);
1072 sockinfo si(sa); 1075 send_connect_info (c->conf->id, c->si, c->conf->protocols);
1073
1074 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1075 c->conf->id, conf->id, (const char *)si);
1076
1077 connect_info_packet *r = new connect_info_packet (c->conf->id, conf->id, si);
1078
1079 r->hmac_set (c->octx);
1080 vpn->send_vpn_packet (r, &c->sa);
1081
1082 delete r;
1083 }
1084
1085 {
1086 sockinfo si(c->sa);
1087
1088 slog (L_TRACE, ">>%d PT_CONNECT_INFO(%d,%s)\n",
1089 conf->id, c->conf->id, (const char *)si);
1090
1091 connect_info_packet *r = new connect_info_packet (conf->id, c->conf->id, si);
1092
1093 r->hmac_set (octx);
1094 vpn->send_vpn_packet (r, &sa);
1095
1096 delete r;
1097 }
1098 } 1076 }
1099 } 1077 }
1100 1078
1101 break; 1079 break;
1102 1080
1103 case vpn_packet::PT_CONNECT_INFO: 1081 case vpn_packet::PT_CONNECT_INFO:
1104 if (ictx && octx && *ssa == sa && pkt->hmac_chk (ictx)) 1082 if (ictx && octx && rsi == si && pkt->hmac_chk (ictx))
1105 { 1083 {
1106 connect_info_packet *p = (connect_info_packet *) pkt; 1084 connect_info_packet *p = (connect_info_packet *) pkt;
1107 1085
1108 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything 1086 assert (p->id > 0 && p->id <= vpn->conns.size ()); // hmac-auth does not mean we accept anything
1109 1087 conf->protocols = p->protocols;
1110 connection *c = vpn->conns[p->id - 1]; 1088 connection *c = vpn->conns[p->id - 1];
1111 1089
1112 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)", 1090 slog (L_TRACE, "<<%d PT_CONNECT_INFO(%d,%s) (%d)",
1113 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx); 1091 conf->id, p->id, (const char *)p->si, !c->ictx && !c->octx);
1114 1092
1115 c->send_auth_request (p->si.sa (), true); 1093 c->send_auth_request (p->si, true);
1116 } 1094 }
1117 1095
1118 break; 1096 break;
1119 1097
1120 default: 1098 default:
1121 send_reset (ssa); 1099 send_reset (rsi);
1122 break; 1100 break;
1123 1101
1124 } 1102 }
1125} 1103}
1126 1104
… …
1132 establish_connection (); 1110 establish_connection ();
1133 } 1111 }
1134 else if (NOW < last_activity + ::conf.keepalive) 1112 else if (NOW < last_activity + ::conf.keepalive)
1135 ts = last_activity + ::conf.keepalive; 1113 ts = last_activity + ::conf.keepalive;
1136 else if (conf->connectmode != conf_node::C_ONDEMAND 1114 else if (conf->connectmode != conf_node::C_ONDEMAND
1137 || THISNODE->connectmode != conf_node::C_ONDEMAND) 1115 || THISNODE->connectmode != conf_node::C_ONDEMAND)
1138 { 1116 {
1139 send_ping (&sa); 1117 send_ping (si);
1140 ts = NOW + 5; 1118 ts = NOW + 5;
1141 } 1119 }
1142 else 1120 else
1143 reset_connection (); 1121 reset_connection ();
1144
1145} 1122}
1146 1123
1147void connection::connect_request (int id) 1124void connection::connect_request (int id)
1148{ 1125{
1149 connect_req_packet *p = new connect_req_packet (conf->id, id); 1126 connect_req_packet *p = new connect_req_packet (conf->id, id, conf->protocols);
1150 1127
1151 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", id, conf->id); 1128 slog (L_TRACE, ">>%d PT_CONNECT_REQ(%d)", conf->id, id);
1152 p->hmac_set (octx); 1129 p->hmac_set (octx);
1153 vpn->send_vpn_packet (p, &sa); 1130 send_vpn_packet (p, si);
1154 1131
1155 delete p; 1132 delete p;
1156} 1133}
1157 1134
1158void connection::script_node () 1135void connection::script_node ()
1159{ 1136{
1160 vpn->script_if_up (0); 1137 vpn->script_if_up (0);
1161 1138
1162 char *env; 1139 char *env;
1163 asprintf (&env, "DESTID=%d", conf->id); 1140 asprintf (&env, "DESTID=%d", conf->id); putenv (env);
1164 putenv (env);
1165 asprintf (&env, "DESTNODE=%s", conf->nodename); 1141 asprintf (&env, "DESTNODE=%s", conf->nodename); putenv (env);
1166 putenv (env); 1142 asprintf (&env, "DESTIP=%s", si.ntoa ()); putenv (env);
1167 asprintf (&env, "DESTIP=%s", inet_ntoa (sa.sin_addr));
1168 putenv (env);
1169 asprintf (&env, "DESTPORT=%d", ntohs (sa.sin_port)); 1143 asprintf (&env, "DESTPORT=%d", ntohs (si.port)); putenv (env);
1170 putenv (env);
1171} 1144}
1172 1145
1173const char *connection::script_node_up (int) 1146const char *connection::script_node_up (int)
1174{ 1147{
1175 script_node (); 1148 script_node ();
… …
1184 script_node (); 1157 script_node ();
1185 1158
1186 putenv ("STATE=down"); 1159 putenv ("STATE=down");
1187 1160
1188 return ::conf.script_node_up ? ::conf.script_node_down : "node-down"; 1161 return ::conf.script_node_up ? ::conf.script_node_down : "node-down";
1162}
1163
1164// send a vpn packet out to other hosts
1165void
1166connection::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1167{
1168 if (protocol & PROT_IPv4)
1169 vpn->send_ipv4_packet (pkt, si, tos);
1170 else
1171 vpn->send_udpv4_packet (pkt, si, tos);
1189} 1172}
1190 1173
1191connection::connection(struct vpn *vpn_) 1174connection::connection(struct vpn *vpn_)
1192: vpn(vpn_) 1175: vpn(vpn_)
1193, rekey (this, &connection::rekey_cb) 1176, rekey (this, &connection::rekey_cb)
… …
1235 1218
1236 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 1219 return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
1237} 1220}
1238 1221
1239int 1222int
1240vpn::setup (void) 1223vpn::setup ()
1241{ 1224{
1242 struct sockaddr_in sa; 1225 sockinfo si;
1243 1226
1227 si.set (THISNODE);
1228
1229 udpv4_fd = -1;
1230
1231 if (THISNODE->protocols & PROT_UDPv4)
1232 {
1244 socket_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 1233 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
1245 if (socket_fd < 0) 1234
1235 if (udpv4_fd < 0)
1246 return -1; 1236 return -1;
1247 1237
1248 fill_sa (&sa, THISNODE); 1238 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
1249 1239 {
1250 if (bind (socket_fd, (sockaddr *)&sa, sizeof (sa)))
1251 {
1252 slog (L_ERR, _("can't bind to %s: %s"), (const char *)sockinfo(sa), strerror (errno)); 1240 slog (L_ERR, _("can't bind udpv4 to %s: %s"), (const char *)si, strerror (errno));
1253 exit (1); 1241 exit (1);
1254 } 1242 }
1255 1243
1256#ifdef IP_MTU_DISCOVER 1244#ifdef IP_MTU_DISCOVER
1257 // this I really consider a linux bug. I am neither connected 1245 // this I really consider a linux bug. I am neither connected
1258 // nor do I fragment myself. Linux still sets DF and doesn't 1246 // nor do I fragment myself. Linux still sets DF and doesn't
1259 // fragment for me sometimes. 1247 // fragment for me sometimes.
1260 { 1248 {
1261 int oval = IP_PMTUDISC_DONT; 1249 int oval = IP_PMTUDISC_DONT;
1262 setsockopt (socket_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 1250 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
1263 } 1251 }
1264#endif 1252#endif
1265 { 1253
1254 // standard daemon practise...
1255 {
1266 int oval = 1; 1256 int oval = 1;
1267 setsockopt (socket_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 1257 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
1268 } 1258 }
1269 1259
1270 udp_ev_watcher.start (socket_fd, POLLIN); 1260 udpv4_ev_watcher.start (udpv4_fd, POLLIN);
1261 }
1262
1263 ipv4_fd = -1;
1264 if (THISNODE->protocols & PROT_IPv4)
1265 {
1266 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
1267
1268 if (ipv4_fd < 0)
1269 return -1;
1270
1271 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
1272 {
1273 slog (L_ERR, _("can't bind ipv4 socket to %s: %s"), (const char *)si, strerror (errno));
1274 exit (1);
1275 }
1276
1277#ifdef IP_MTU_DISCOVER
1278 // this I really consider a linux bug. I am neither connected
1279 // nor do I fragment myself. Linux still sets DF and doesn't
1280 // fragment for me sometimes.
1281 {
1282 int oval = IP_PMTUDISC_DONT;
1283 setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
1284 }
1285#endif
1286
1287 ipv4_ev_watcher.start (ipv4_fd, POLLIN);
1288 }
1271 1289
1272 tap = new tap_device (); 1290 tap = new tap_device ();
1273 if (!tap) //D this, of course, never catches 1291 if (!tap) //D this, of course, never catches
1274 { 1292 {
1275 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 1293 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
1276 exit (1); 1294 exit (1);
1277 } 1295 }
1278 1296
1279 run_script (run_script_cb (this, &vpn::script_if_up), true); 1297 run_script (run_script_cb (this, &vpn::script_if_up), true);
1280 1298
1281 vpn_ev_watcher.start (tap->fd, POLLIN); 1299 tap_ev_watcher.start (tap->fd, POLLIN);
1282 1300
1283 reconnect_all (); 1301 reconnect_all ();
1284 1302
1285 return 0; 1303 return 0;
1286} 1304}
1287 1305
1288void 1306void
1289vpn::send_vpn_packet (vpn_packet *pkt, SOCKADDR *sa, int tos) 1307vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1290{ 1308{
1291 setsockopt (socket_fd, SOL_IP, IP_TOS, &tos, sizeof tos); 1309 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1292 sendto (socket_fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)sa, sizeof (*sa)); 1310 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1293} 1311}
1294 1312
1295void 1313void
1296vpn::shutdown_all () 1314vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
1297{ 1315{
1298 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 1316 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
1299 (*c)->shutdown (); 1317 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
1300} 1318}
1301 1319
1302void 1320void
1303vpn::reconnect_all () 1321vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
1304{ 1322{
1305 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 1323 unsigned int src = pkt->src ();
1306 delete *c; 1324 unsigned int dst = pkt->dst ();
1307 1325
1308 conns.clear (); 1326 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1327 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1309 1328
1310 for (configuration::node_vector::iterator i = conf.nodes.begin (); 1329 if (src == 0 || src > conns.size ()
1311 i != conf.nodes.end (); ++i) 1330 || dst > conns.size ()
1312 { 1331 || pkt->typ () >= vpn_packet::PT_MAX)
1313 connection *conn = new connection (this); 1332 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
1314 1333 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
1315 conn->conf = *i; 1334 else
1316 conns.push_back (conn);
1317
1318 conn->establish_connection ();
1319 } 1335 {
1320} 1336 connection *c = conns[src - 1];
1321 1337
1322connection *vpn::find_router () 1338 if (dst == 0 && !THISNODE->routerprio)
1323{ 1339 slog (L_WARN, _("%s(%s): received broadcast, but we are no router"),
1324 u32 prio = 0; 1340 c->conf->nodename, (const char *)rsi);
1325 connection *router = 0; 1341 else if (dst != 0 && dst != THISNODE->id)
1326 1342 // FORWARDING NEEDED ;)
1327 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 1343 slog (L_WARN,
1344 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1345 dst, conns[dst - 1]->conf->nodename,
1346 (const char *)rsi,
1347 THISNODE->id, THISNODE->nodename);
1348 else
1349 c->recv_vpn_packet (pkt, rsi);
1328 { 1350 }
1329 connection *c = *i;
1330
1331 if (c->conf->routerprio > prio
1332 && c->connectmode == conf_node::C_ALWAYS
1333 && c->conf != THISNODE
1334 && c->ictx && c->octx)
1335 {
1336 prio = c->conf->routerprio;
1337 router = c;
1338 }
1339 }
1340
1341 return router;
1342} 1351}
1343 1352
1344void vpn::connect_request (int id)
1345{
1346 connection *c = find_router ();
1347
1348 if (c)
1349 c->connect_request (id);
1350 //else // does not work, because all others must connect to the same router
1351 // // no router found, aggressively connect to all routers
1352 // for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1353 // if ((*i)->conf->routerprio)
1354 // (*i)->establish_connection ();
1355}
1356
1357void 1353void
1358vpn::udp_ev (short revents) 1354vpn::udpv4_ev (short revents)
1359{ 1355{
1360 if (revents & (POLLIN | POLLERR)) 1356 if (revents & (POLLIN | POLLERR))
1361 { 1357 {
1362 vpn_packet *pkt = new vpn_packet; 1358 vpn_packet *pkt = new vpn_packet;
1363 struct sockaddr_in sa; 1359 struct sockaddr_in sa;
1364 socklen_t sa_len = sizeof (sa); 1360 socklen_t sa_len = sizeof (sa);
1365 int len; 1361 int len;
1366 1362
1367 len = recvfrom (socket_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len); 1363 len = recvfrom (udpv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1364
1365 sockinfo si(sa);
1368 1366
1369 if (len > 0) 1367 if (len > 0)
1370 { 1368 {
1371 pkt->len = len; 1369 pkt->len = len;
1372 1370
1373 unsigned int src = pkt->src ();
1374 unsigned int dst = pkt->dst ();
1375
1376 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
1377 (const char *)sockinfo (sa), pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
1378
1379 if (dst > conns.size () || pkt->typ () >= vpn_packet::PT_MAX)
1380 slog (L_WARN, _("<<? received CORRUPTED packet type %d from %d to %d"),
1381 pkt->typ (), pkt->src (), pkt->dst ());
1382 else if (dst == 0 && !THISNODE->routerprio)
1383 slog (L_WARN, _("<<%d received broadcast, but we are no router"), dst);
1384 else if (dst != 0 && dst != THISNODE->id)
1385 slog (L_WARN,
1386 _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
1387 dst, conns[dst - 1]->conf->nodename,
1388 (const char *)sockinfo (sa),
1389 THISNODE->id, THISNODE->nodename);
1390 else if (src == 0 || src > conns.size ())
1391 slog (L_WARN, _("received frame from unknown node %d (%s)"), src, (const char *)sockinfo (sa));
1392 else
1393 conns[src - 1]->recv_vpn_packet (pkt, &sa); 1371 recv_vpn_packet (pkt, si);
1394 } 1372 }
1395 else 1373 else
1396 { 1374 {
1397 // probably ECONNRESET or somesuch 1375 // probably ECONNRESET or somesuch
1398 slog (L_DEBUG, _("%s: %s"), (const char *)sockinfo(sa), strerror (errno)); 1376 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
1399 } 1377 }
1400 1378
1401 delete pkt; 1379 delete pkt;
1402 } 1380 }
1403 else if (revents & POLLHUP) 1381 else if (revents & POLLHUP)
1404 { 1382 {
1405 // this cannot ;) happen on udp sockets 1383 // this cannot ;) happen on udp sockets
1406 slog (L_ERR, _("FATAL: POLLHUP on socket fd, terminating.")); 1384 slog (L_ERR, _("FATAL: POLLHUP on udp v4 fd, terminating."));
1407 exit (1); 1385 exit (1);
1408 } 1386 }
1409 else 1387 else
1410 { 1388 {
1411 slog (L_ERR, 1389 slog (L_ERR,
… …
1414 exit (1); 1392 exit (1);
1415 } 1393 }
1416} 1394}
1417 1395
1418void 1396void
1397vpn::ipv4_ev (short revents)
1398{
1399 if (revents & (POLLIN | POLLERR))
1400 {
1401 vpn_packet *pkt = new vpn_packet;
1402 struct sockaddr_in sa;
1403 socklen_t sa_len = sizeof (sa);
1404 int len;
1405
1406 len = recvfrom (ipv4_fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
1407
1408 sockinfo si(sa, PROT_IPv4);
1409
1410 if (len > 0)
1411 {
1412 pkt->len = len;
1413
1414 // raw sockets deliver the ipv4, but don't expect it on sends
1415 // this is slow, but...
1416 pkt->skip_hdr (IP_OVERHEAD);
1417
1418 recv_vpn_packet (pkt, si);
1419 }
1420 else
1421 {
1422 // probably ECONNRESET or somesuch
1423 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
1424 }
1425
1426 delete pkt;
1427 }
1428 else if (revents & POLLHUP)
1429 {
1430 // this cannot ;) happen on udp sockets
1431 slog (L_ERR, _("FATAL: POLLHUP on ipv4 fd, terminating."));
1432 exit (1);
1433 }
1434 else
1435 {
1436 slog (L_ERR,
1437 _("FATAL: unknown revents %08x in socket, terminating\n"),
1438 revents);
1439 exit (1);
1440 }
1441}
1442
1443void
1419vpn::vpn_ev (short revents) 1444vpn::tap_ev (short revents)
1420{ 1445{
1421 if (revents & POLLIN) 1446 if (revents & POLLIN)
1422 { 1447 {
1423 /* process data */ 1448 /* process data */
1424 tap_packet *pkt; 1449 tap_packet *pkt;
… …
1480{ 1505{
1481 if (events) 1506 if (events)
1482 { 1507 {
1483 if (events & EVENT_SHUTDOWN) 1508 if (events & EVENT_SHUTDOWN)
1484 { 1509 {
1510 slog (L_INFO, _("preparing shutdown..."));
1511
1485 shutdown_all (); 1512 shutdown_all ();
1486 1513
1487 remove_pid (pidfilename); 1514 remove_pid (pidfilename);
1488 1515
1489 slog (L_INFO, _("vped terminating")); 1516 slog (L_INFO, _("terminating"));
1490 1517
1491 exit (0); 1518 exit (0);
1492 } 1519 }
1493 1520
1494 if (events & EVENT_RECONNECT) 1521 if (events & EVENT_RECONNECT)
1522 {
1523 slog (L_INFO, _("forced reconnect"));
1524
1495 reconnect_all (); 1525 reconnect_all ();
1526 }
1496 1527
1497 events = 0; 1528 events = 0;
1498 } 1529 }
1499 1530
1500 ts = TSTAMP_CANCEL; 1531 ts = TSTAMP_CANCEL;
1501} 1532}
1502 1533
1534void
1535vpn::shutdown_all ()
1536{
1537 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1538 (*c)->shutdown ();
1539}
1540
1541void
1542vpn::reconnect_all ()
1543{
1544 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1545 delete *c;
1546
1547 conns.clear ();
1548
1549 auth_rate_limiter.clear ();
1550 reset_rate_limiter.clear ();
1551
1552 for (configuration::node_vector::iterator i = conf.nodes.begin ();
1553 i != conf.nodes.end (); ++i)
1554 {
1555 connection *conn = new connection (this);
1556
1557 conn->conf = *i;
1558 conns.push_back (conn);
1559
1560 conn->establish_connection ();
1561 }
1562}
1563
1564connection *vpn::find_router ()
1565{
1566 u32 prio = 0;
1567 connection *router = 0;
1568
1569 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1570 {
1571 connection *c = *i;
1572
1573 if (c->conf->routerprio > prio
1574 && c->connectmode == conf_node::C_ALWAYS
1575 && c->conf != THISNODE
1576 && c->ictx && c->octx)
1577 {
1578 prio = c->conf->routerprio;
1579 router = c;
1580 }
1581 }
1582
1583 return router;
1584}
1585
1586void vpn::connect_request (int id)
1587{
1588 connection *c = find_router ();
1589
1590 if (c)
1591 c->connect_request (id);
1592 //else // does not work, because all others must connect to the same router
1593 // // no router found, aggressively connect to all routers
1594 // for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
1595 // if ((*i)->conf->routerprio)
1596 // (*i)->establish_connection ();
1597}
1598
1599void
1600connection::dump_status ()
1601{
1602 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
1603 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
1604 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
1605 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
1606 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
1607 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
1608 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
1609}
1610
1611void
1612vpn::dump_status ()
1613{
1614 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);
1615
1616 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
1617 (*c)->dump_status ();
1618
1619 slog (L_NOTICE, _("END status dump"));
1620}
1621
1503vpn::vpn (void) 1622vpn::vpn (void)
1504: udp_ev_watcher (this, &vpn::udp_ev) 1623: udpv4_ev_watcher(this, &vpn::udpv4_ev)
1624, ipv4_ev_watcher(this, &vpn::ipv4_ev)
1505, vpn_ev_watcher (this, &vpn::vpn_ev) 1625, tap_ev_watcher(this, &vpn::tap_ev)
1506, event (this, &vpn::event_cb) 1626, event(this, &vpn::event_cb)
1507{ 1627{
1508} 1628}
1509 1629
1510vpn::~vpn () 1630vpn::~vpn ()
1511{ 1631{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines