gvpe/src/vpn.C

/*
    vpn.C -- handle the protocol, encryption, handshaking etc.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include "config.h"

#include <list>

#include <cstdlib>
#include <cstring>
#include <cstdio>

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/poll.h>
#include <sys/wait.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <errno.h>
#include <time.h>
#include <unistd.h>

#include "pidfile.h"

#include "connection.h"
#include "util.h"
#include "vpn.h"

#if ENABLE_TCP
# include <map>
# include <unistd.h>
# include <fcntl.h>
# include <sys/poll.h>
#endif

/////////////////////////////////////////////////////////////////////////////

const char *vpn::script_if_up ()
{
  // the tunnel device mtu should be the physical mtu - overhead
  // the tricky part is rounding to the cipher key blocksize
  int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
  mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
  mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
  mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again

  char *env;
  asprintf (&env, "CONFBASE=%s", confbase);
  putenv (env);
  asprintf (&env, "NODENAME=%s", THISNODE->nodename);
  putenv (env);
  asprintf (&env, "NODEID=%d", THISNODE->id);
  putenv (env);
  asprintf (&env, "IFNAME=%s", tap->interface ());
  putenv (env);
  asprintf (&env, "MTU=%d", mtu);
  putenv (env);
  asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x",
            0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8,
            THISNODE->id & 0xff);
  putenv (env);

  return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
}

int
vpn::setup ()
{
  udpv4_fd = -1;

  if (THISNODE->protocols & PROT_UDPv4)
    {
      udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);

      if (udpv4_fd < 0)
        return -1;

      // standard daemon practise...
      {
        int oval = 1;
        setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
      }

      sockinfo si (THISNODE, PROT_UDPv4);

      if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
        {
          slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));
          exit (1);
        }

#ifdef IP_MTU_DISCOVER
      // this I really consider a linux bug. I am neither connected
      // nor do I fragment myself. Linux still sets DF and doesn't
      // fragment for me sometimes.
      {
        int oval = IP_PMTUDISC_DONT;
        setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
      }
#endif

      udpv4_ev_watcher.start (udpv4_fd, POLLIN);
    }

  ipv4_fd = -1;
  if (THISNODE->protocols & PROT_IPv4)
    {
      ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);

      if (ipv4_fd < 0)
        return -1;

      sockinfo si (THISNODE, PROT_IPv4);

      if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
        {
          slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));
          exit (1);
        }

#ifdef IP_MTU_DISCOVER
      // this I really consider a linux bug. I am neither connected
      // nor do I fragment myself. Linux still sets DF and doesn't
      // fragment for me sometimes.
      {
        int oval = IP_PMTUDISC_DONT;
        setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
      }
#endif

      ipv4_ev_watcher.start (ipv4_fd, POLLIN);
    }

#if ENABLE_TCP
  if (THISNODE->protocols & PROT_TCPv4)
    {
      tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);

      if (tcpv4_fd < 0)
        return -1;

      // standard daemon practise...
      {
        int oval = 1;
        setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
      }

      sockinfo si (THISNODE, PROT_TCPv4);

      if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
        {
          slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));
          exit (1);
        }

      if (listen (tcpv4_fd, 5))
        {
          slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));
          exit (1);
        }

      tcpv4_ev_watcher.start (tcpv4_fd, POLLIN);
    }
#endif

  tap = new tap_device ();
  if (!tap) //D this, of course, never catches
    {
      slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
      exit (1);
    }
  
  run_script (run_script_cb (this, &vpn::script_if_up), true);

  tap_ev_watcher.start (tap->fd, POLLIN);

  reconnect_all ();

  return 0;
}

void
vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
{
  setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
  sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
}

void
vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
{
  setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
  sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
}

void
vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
{
  unsigned int src = pkt->src ();
  unsigned int dst = pkt->dst ();

  slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
        (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);

  if (src == 0 || src > conns.size ()
      || dst > conns.size ()
      || pkt->typ () >= vpn_packet::PT_MAX)
    slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
          (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
  else
    {
      connection *c = conns[src - 1];

      if (dst == 0 && !THISNODE->routerprio)
        slog (L_WARN, _("%s(%s): received broadcast, but we are no router"),
              c->conf->nodename, (const char *)rsi);
      else if (dst != 0 && dst != THISNODE->id)
        // FORWARDING NEEDED ;)
        slog (L_WARN,
              _("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
              dst, conns[dst - 1]->conf->nodename,
              (const char *)rsi,
              THISNODE->id, THISNODE->nodename);
      else
        c->recv_vpn_packet (pkt, rsi);
    }
}

void
vpn::udpv4_ev (io_watcher &w, short revents)
{
  if (revents & (POLLIN | POLLERR))
    {
      vpn_packet *pkt = new vpn_packet;
      struct sockaddr_in sa;
      socklen_t sa_len = sizeof (sa);
      int len;

      len = recvfrom (w.p->fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);

      sockinfo si(sa);

      if (len > 0)
        {
          pkt->len = len;

          recv_vpn_packet (pkt, si);
        }
      else
        {
          // probably ECONNRESET or somesuch
          slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
        }

      delete pkt;
    }
  else if (revents & POLLHUP)
    {
      // this cannot ;) happen on udp sockets
      slog (L_ERR, _("FATAL: POLLHUP on udp v4 fd, terminating."));
      exit (1);
    }
  else
    {
      slog (L_ERR,
              _("FATAL: unknown revents %08x in socket, terminating\n"),
              revents);
      exit (1);
    }
}

void
vpn::ipv4_ev (io_watcher &w, short revents)
{
  if (revents & (POLLIN | POLLERR))
    {
      vpn_packet *pkt = new vpn_packet;
      struct sockaddr_in sa;
      socklen_t sa_len = sizeof (sa);
      int len;

      len = recvfrom (w.p->fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);

      sockinfo si(sa, PROT_IPv4);

      if (len > 0)
        {
          pkt->len = len;

          // raw sockets deliver the ipv4, but don't expect it on sends
          // this is slow, but...
          pkt->skip_hdr (IP_OVERHEAD);

          recv_vpn_packet (pkt, si);
        }
      else
        {
          // probably ECONNRESET or somesuch
          slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
        }

      delete pkt;
    }
  else if (revents & POLLHUP)
    {
      // this cannot ;) happen on udp sockets
      slog (L_ERR, _("FATAL: POLLHUP on ipv4 fd, terminating."));
      exit (1);
    }
  else
    {
      slog (L_ERR,
              _("FATAL: unknown revents %08x in socket, terminating\n"),
              revents);
      exit (1);
    }
}

#if ENABLE_TCP

struct tcp_connection;

struct lt_sockinfo
{
  bool operator()(const sockinfo *a, const sockinfo *b) const
  {
    return *a < *b;
  }
};

struct tcp_si_map : public map<const sockinfo *, tcp_connection *, lt_sockinfo> {
  void cleaner_cb (time_watcher &w); time_watcher cleaner;

  tcp_si_map ()
    : cleaner(this, &tcp_si_map::cleaner_cb)
    {
      cleaner.start (0);
    }
} tcp_si;

struct tcp_connection : io_watcher {
  tstamp last_activity;
  const sockinfo si;
  vpn &v;
  bool ok;

  vpn_packet *r_pkt;
  u32 r_len, r_ofs;

  void tcpv4_ev (io_watcher &w, short revents);

  operator tcp_si_map::value_type()
    {
      return tcp_si_map::value_type (&si, this);
    }

  tcp_connection (int fd, const sockinfo &si_, vpn &v_)
    : v(v_), si(si_), io_watcher(this, &tcp_connection::tcpv4_ev)
    {
      last_activity = NOW;
      ok = false;
      r_pkt = 0;
      start (fd, POLLOUT);
    }

  ~tcp_connection () { if (p) close (p->fd); }
};

void tcp_si_map::cleaner_cb (time_watcher &w)
{
  w.at = NOW + 600;
  tstamp to = NOW - ::conf.keepalive - 30;

  for (iterator i = begin (); i != end(); )
    if (i->second->last_activity >= to)
      ++i;
    else
      {
        erase (i);
        i = begin ();
      }
}

void
vpn::send_tcpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
{
  tcp_si_map::iterator info = tcp_si.find (&si);

  if (info == tcp_si.end ())
    {
      // woaw, the first lost packet ;)
      int fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);

      if (fd >= 0)
        {
          fcntl (fd, F_SETFL, O_NONBLOCK);
          
          if (connect (fd, si.sav4 (), si.salenv4 ()) >= 0
              || errno == EINPROGRESS)
            {
              tcp_connection *i = new tcp_connection (fd, si, *this);

              tcp_si.insert (*i);
            }
          else
            close (fd);
        }
    }
  else
    {
      tcp_connection *i = info->second;

      i->last_activity = NOW;

      if (i->ok)
        {
          setsockopt (i->p->fd, SOL_IP, IP_TOS, &tos, sizeof tos);

          // we use none of the advantages of tcp
          write (i->p->fd, (void *)pkt, pkt->len + sizeof (u32)) != pkt->len + sizeof (u32);
        }
    }
  
#if 0
  setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
  sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
#endif
}

void
tcp_connection::tcpv4_ev (io_watcher &w, short revents)
{
  last_activity = NOW;

  if (!ok) // just established?
    {
      ok = true;
      set (POLLIN);
    }

  if (revents & (POLLIN | POLLERR))
    {
      u32 len;

      if (sizeof (len) == read (p->fd, &len, sizeof (len)))
        {
          vpn_packet *pkt = new vpn_packet;

          if (len == read (p->fd, &((*pkt)[0]), len))
            {
              pkt->len = len;

              v.recv_vpn_packet (pkt, si);
              return;
            }
          
          delete pkt;
        }

      tcp_si.erase (&si);

      set (0);//D
    }
}

void
vpn::tcpv4_ev (io_watcher &w, short revents)
{
  if (revents & (POLLIN | POLLERR))
    {
      struct sockaddr_in sa;
      socklen_t sa_len = sizeof (sa);
      int len;

      int fd = accept (w.p->fd, (sockaddr *)&sa, &sa_len);

      if (fd >= 0)
        {
          fcntl (fd, F_SETFL, O_NONBLOCK);

          sockinfo si(sa, PROT_TCPv4);
          tcp_connection *i = new tcp_connection (fd, si, *this);

          slog (L_DEBUG, _("accepted tcp connection from %s\n"), (const char *)si);//D

          tcp_si.insert (*i);
        }
    }
}

#endif

void
vpn::tap_ev (io_watcher &w, short revents)
{
  if (revents & POLLIN)
    {
      /* process data */
      tap_packet *pkt;

      pkt = tap->recv ();

      int dst = mac2id (pkt->dst);
      int src = mac2id (pkt->src);

      if (src != THISNODE->id)
        {
          slog (L_ERR, _("FATAL: tap packet not originating on current node received, terminating."));
          exit (1);
        }

      if (dst == THISNODE->id)
        {
          slog (L_ERR, _("FATAL: tap packet destined for current node received, terminating."));
          exit (1);
        }

      if (dst > conns.size ())
        slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
      else
        {
          if (dst)
            {
              // unicast
              if (dst != THISNODE->id)
                conns[dst - 1]->inject_data_packet (pkt);
            }
          else
            {
              // broadcast, first check router, then self, then english
              connection *router = find_router ();

              if (router)
                router->inject_data_packet (pkt, true);
              else
                for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
                  if ((*c)->conf != THISNODE)
                    (*c)->inject_data_packet (pkt);
            }
        }

      delete pkt;
    }
  else if (revents & (POLLHUP | POLLERR))
    {
      slog (L_ERR, _("FATAL: POLLHUP or POLLERR on network device fd, terminating."));
      exit (1);
    }
  else
    abort ();
}

void
vpn::event_cb (time_watcher &w)
{
  if (events)
    {
      if (events & EVENT_SHUTDOWN)
        {
          slog (L_INFO, _("preparing shutdown..."));

          shutdown_all ();

          remove_pid (pidfilename);

          slog (L_INFO, _("terminating"));

          exit (0);
        }

      if (events & EVENT_RECONNECT)
        {
          slog (L_INFO, _("forced reconnect"));

          reconnect_all ();
        }

      events = 0;
    }

  w.at = TSTAMP_CANCEL;
}

void
vpn::shutdown_all ()
{
  for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
    (*c)->shutdown ();
}

void
vpn::reconnect_all ()
{
  for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
    delete *c;

  conns.clear ();

  connection_init ();

  for (configuration::node_vector::iterator i = conf.nodes.begin ();
       i != conf.nodes.end (); ++i)
    {
      connection *conn = new connection (this);

      conn->conf = *i;
      conns.push_back (conn);

      conn->establish_connection ();
    }
}

connection *vpn::find_router ()
{
  u32 prio = 0;
  connection *router = 0;

  for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
    {
      connection *c = *i;

      if (c->conf->routerprio > prio
          && c->connectmode == conf_node::C_ALWAYS
          && c->conf != THISNODE
          && c->ictx && c->octx)
        {
          prio = c->conf->routerprio;
          router = c;
        }
    }

  return router;
}

void vpn::connect_request (int id)
{
  connection *c = find_router ();

  if (c)
    c->connect_request (id);
  //else // does not work, because all others must connect to the same router
  //  // no router found, aggressively connect to all routers
  //  for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
  //    if ((*i)->conf->routerprio)
  //      (*i)->establish_connection ();
}

void
connection::dump_status ()
{
  slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
  slog (L_NOTICE, _("  connectmode %d (%d) / sockaddr %s / minor %d"),
        connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
  slog (L_NOTICE, _("  ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
        (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
  slog (L_NOTICE, _("  establish_conn %ld / rekey %ld / keepalive %ld"),
        (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
}

void
vpn::dump_status ()
{
  slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);

  for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
    (*c)->dump_status ();

  slog (L_NOTICE, _("END status dump"));
}

vpn::vpn (void)
: event(this, &vpn::event_cb)
, udpv4_ev_watcher(this, &vpn::udpv4_ev)
, ipv4_ev_watcher (this, &vpn::ipv4_ev)
, tap_ev_watcher  (this, &vpn::tap_ev)
#if ENABLE_TCP
, tcpv4_ev_watcher(this, &vpn::tcpv4_ev)
#endif
{
}

vpn::~vpn ()
{
}

Revision:	1.4
Committed:	Fri Apr 4 05:26:45 2003 UTC (21 years, 1 month ago) by pcg
Content type:	text/plain
Branch:	MAIN
Changes since 1.3:	+20 -16 lines
Log Message:	* empty log message *
#	User	Rev	Content
1	pcg	1.1	/*
2			vpn.C -- handle the protocol, encryption, handshaking etc.
3
4			This program is free software; you can redistribute it and/or modify
5			it under the terms of the GNU General Public License as published by
6			the Free Software Foundation; either version 2 of the License, or
7			(at your option) any later version.
8
9			This program is distributed in the hope that it will be useful,
10			but WITHOUT ANY WARRANTY; without even the implied warranty of
11			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12			GNU General Public License for more details.
13
14			You should have received a copy of the GNU General Public License
15			along with this program; if not, write to the Free Software
16			Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17			*/
18
19			#include "config.h"
20
21			#include <list>
22
23			#include <cstdlib>
24			#include <cstring>
25			#include <cstdio>
26
27			#include <sys/types.h>
28			#include <sys/socket.h>
29			#include <sys/poll.h>
30			#include <sys/wait.h>
31			#include <netinet/in.h>
32			#include <arpa/inet.h>
33			#include <errno.h>
34			#include <time.h>
35			#include <unistd.h>
36
37			#include "pidfile.h"
38
39			#include "connection.h"
40			#include "util.h"
41			#include "vpn.h"
42
43	pcg	1.2	#if ENABLE_TCP
44			# include <map>
45			# include <unistd.h>
46			# include <fcntl.h>
47			# include <sys/poll.h>
48			#endif
49
50	pcg	1.1	/////////////////////////////////////////////////////////////////////////////
51
52	pcg	1.2	const char *vpn::script_if_up ()
53	pcg	1.1	{
54			// the tunnel device mtu should be the physical mtu - overhead
55			// the tricky part is rounding to the cipher key blocksize
56			int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
57			mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
58			mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
59			mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
60
61			char *env;
62			asprintf (&env, "CONFBASE=%s", confbase);
63			putenv (env);
64			asprintf (&env, "NODENAME=%s", THISNODE->nodename);
65			putenv (env);
66			asprintf (&env, "NODEID=%d", THISNODE->id);
67			putenv (env);
68			asprintf (&env, "IFNAME=%s", tap->interface ());
69			putenv (env);
70			asprintf (&env, "MTU=%d", mtu);
71			putenv (env);
72			asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x",
73			0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8,
74			THISNODE->id & 0xff);
75			putenv (env);
76
77			return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
78			}
79
80			int
81			vpn::setup ()
82			{
83			udpv4_fd = -1;
84
85			if (THISNODE->protocols & PROT_UDPv4)
86			{
87			udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
88
89			if (udpv4_fd < 0)
90			return -1;
91
92	pcg	1.3	// standard daemon practise...
93			{
94			int oval = 1;
95			setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
96			}
97
98	pcg	1.2	sockinfo si (THISNODE, PROT_UDPv4);
99
100	pcg	1.1	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
101			{
102	pcg	1.2	slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));
103	pcg	1.1	exit (1);
104			}
105
106			#ifdef IP_MTU_DISCOVER
107			// this I really consider a linux bug. I am neither connected
108			// nor do I fragment myself. Linux still sets DF and doesn't
109			// fragment for me sometimes.
110			{
111			int oval = IP_PMTUDISC_DONT;
112			setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
113			}
114			#endif
115
116			udpv4_ev_watcher.start (udpv4_fd, POLLIN);
117			}
118
119			ipv4_fd = -1;
120			if (THISNODE->protocols & PROT_IPv4)
121			{
122			ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
123
124			if (ipv4_fd < 0)
125			return -1;
126
127	pcg	1.2	sockinfo si (THISNODE, PROT_IPv4);
128
129	pcg	1.1	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
130			{
131	pcg	1.2	slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));
132	pcg	1.1	exit (1);
133			}
134
135			#ifdef IP_MTU_DISCOVER
136			// this I really consider a linux bug. I am neither connected
137			// nor do I fragment myself. Linux still sets DF and doesn't
138			// fragment for me sometimes.
139			{
140			int oval = IP_PMTUDISC_DONT;
141			setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
142			}
143			#endif
144
145			ipv4_ev_watcher.start (ipv4_fd, POLLIN);
146			}
147
148	pcg	1.2	#if ENABLE_TCP
149			if (THISNODE->protocols & PROT_TCPv4)
150			{
151			tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);
152
153			if (tcpv4_fd < 0)
154			return -1;
155
156	pcg	1.3	// standard daemon practise...
157			{
158			int oval = 1;
159			setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
160			}
161
162	pcg	1.2	sockinfo si (THISNODE, PROT_TCPv4);
163
164			if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
165			{
166			slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));
167			exit (1);
168			}
169
170			if (listen (tcpv4_fd, 5))
171			{
172			slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));
173			exit (1);
174			}
175
176	pcg	1.3	tcpv4_ev_watcher.start (tcpv4_fd, POLLIN);
177	pcg	1.2	}
178			#endif
179
180	pcg	1.1	tap = new tap_device ();
181			if (!tap) //D this, of course, never catches
182			{
183			slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
184			exit (1);
185			}
186
187			run_script (run_script_cb (this, &vpn::script_if_up), true);
188
189			tap_ev_watcher.start (tap->fd, POLLIN);
190
191			reconnect_all ();
192
193			return 0;
194			}
195
196			void
197			vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
198			{
199			setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
200			sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
201			}
202
203			void
204			vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
205			{
206			setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
207			sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
208			}
209
210			void
211			vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
212			{
213			unsigned int src = pkt->src ();
214			unsigned int dst = pkt->dst ();
215
216			slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
217			(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
218
219			if (src == 0 \|\| src > conns.size ()
220			\|\| dst > conns.size ()
221			\|\| pkt->typ () >= vpn_packet::PT_MAX)
222			slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
223			(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
224			else
225			{
226			connection *c = conns[src - 1];
227
228			if (dst == 0 && !THISNODE->routerprio)
229			slog (L_WARN, _("%s(%s): received broadcast, but we are no router"),
230			c->conf->nodename, (const char *)rsi);
231			else if (dst != 0 && dst != THISNODE->id)
232			// FORWARDING NEEDED ;)
233			slog (L_WARN,
234			_("received frame for node %d ('%s') from %s, but this is node %d ('%s')"),
235			dst, conns[dst - 1]->conf->nodename,
236			(const char *)rsi,
237			THISNODE->id, THISNODE->nodename);
238			else
239			c->recv_vpn_packet (pkt, rsi);
240			}
241			}
242
243			void
244	pcg	1.3	vpn::udpv4_ev (io_watcher &w, short revents)
245	pcg	1.1	{
246			if (revents & (POLLIN \| POLLERR))
247			{
248			vpn_packet *pkt = new vpn_packet;
249			struct sockaddr_in sa;
250			socklen_t sa_len = sizeof (sa);
251			int len;
252
253	pcg	1.4	len = recvfrom (w.p->fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
254	pcg	1.1
255			sockinfo si(sa);
256
257			if (len > 0)
258			{
259			pkt->len = len;
260
261			recv_vpn_packet (pkt, si);
262			}
263			else
264			{
265			// probably ECONNRESET or somesuch
266			slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
267			}
268
269			delete pkt;
270			}
271			else if (revents & POLLHUP)
272			{
273			// this cannot ;) happen on udp sockets
274			slog (L_ERR, _("FATAL: POLLHUP on udp v4 fd, terminating."));
275			exit (1);
276			}
277			else
278			{
279			slog (L_ERR,
280			_("FATAL: unknown revents %08x in socket, terminating\n"),
281			revents);
282			exit (1);
283			}
284			}
285
286			void
287	pcg	1.3	vpn::ipv4_ev (io_watcher &w, short revents)
288	pcg	1.1	{
289			if (revents & (POLLIN \| POLLERR))
290			{
291			vpn_packet *pkt = new vpn_packet;
292			struct sockaddr_in sa;
293			socklen_t sa_len = sizeof (sa);
294			int len;
295
296	pcg	1.4	len = recvfrom (w.p->fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
297	pcg	1.1
298			sockinfo si(sa, PROT_IPv4);
299
300			if (len > 0)
301			{
302			pkt->len = len;
303
304			// raw sockets deliver the ipv4, but don't expect it on sends
305			// this is slow, but...
306			pkt->skip_hdr (IP_OVERHEAD);
307
308			recv_vpn_packet (pkt, si);
309			}
310			else
311			{
312			// probably ECONNRESET or somesuch
313			slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
314			}
315
316			delete pkt;
317			}
318			else if (revents & POLLHUP)
319			{
320			// this cannot ;) happen on udp sockets
321			slog (L_ERR, _("FATAL: POLLHUP on ipv4 fd, terminating."));
322			exit (1);
323			}
324			else
325			{
326			slog (L_ERR,
327			_("FATAL: unknown revents %08x in socket, terminating\n"),
328			revents);
329			exit (1);
330			}
331			}
332
333	pcg	1.2	#if ENABLE_TCP
334
335	pcg	1.3	struct tcp_connection;
336
337			struct lt_sockinfo
338			{
339			bool operator()(const sockinfo a, const sockinfo b) const
340			{
341			return a < b;
342			}
343			};
344
345			struct tcp_si_map : public map<const sockinfo , tcp_connection , lt_sockinfo> {
346			void cleaner_cb (time_watcher &w); time_watcher cleaner;
347
348			tcp_si_map ()
349			: cleaner(this, &tcp_si_map::cleaner_cb)
350			{
351			cleaner.start (0);
352			}
353			} tcp_si;
354
355			struct tcp_connection : io_watcher {
356			tstamp last_activity;
357			const sockinfo si;
358			vpn &v;
359	pcg	1.2	bool ok;
360
361	pcg	1.4	vpn_packet *r_pkt;
362			u32 r_len, r_ofs;
363
364	pcg	1.3	void tcpv4_ev (io_watcher &w, short revents);
365
366			operator tcp_si_map::value_type()
367			{
368			return tcp_si_map::value_type (&si, this);
369			}
370
371	pcg	1.4	tcp_connection (int fd, const sockinfo &si_, vpn &v_)
372			: v(v_), si(si_), io_watcher(this, &tcp_connection::tcpv4_ev)
373	pcg	1.2	{
374	pcg	1.3	last_activity = NOW;
375	pcg	1.4	ok = false;
376			r_pkt = 0;
377			start (fd, POLLOUT);
378	pcg	1.2	}
379
380	pcg	1.4	~tcp_connection () { if (p) close (p->fd); }
381	pcg	1.2	};
382
383	pcg	1.3	void tcp_si_map::cleaner_cb (time_watcher &w)
384			{
385			w.at = NOW + 600;
386			tstamp to = NOW - ::conf.keepalive - 30;
387
388			for (iterator i = begin (); i != end(); )
389			if (i->second->last_activity >= to)
390			++i;
391			else
392			{
393			erase (i);
394			i = begin ();
395			}
396			}
397	pcg	1.2
398			void
399			vpn::send_tcpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
400			{
401	pcg	1.3	tcp_si_map::iterator info = tcp_si.find (&si);
402	pcg	1.2
403			if (info == tcp_si.end ())
404			{
405			// woaw, the first lost packet ;)
406	pcg	1.3	int fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);
407	pcg	1.2
408	pcg	1.3	if (fd >= 0)
409	pcg	1.2	{
410	pcg	1.3	fcntl (fd, F_SETFL, O_NONBLOCK);
411	pcg	1.2
412	pcg	1.3	if (connect (fd, si.sav4 (), si.salenv4 ()) >= 0
413	pcg	1.2	\|\| errno == EINPROGRESS)
414			{
415	pcg	1.3	tcp_connection i = new tcp_connection (fd, si, this);
416
417			tcp_si.insert (*i);
418	pcg	1.2	}
419	pcg	1.3	else
420			close (fd);
421	pcg	1.2	}
422			}
423			else
424			{
425	pcg	1.3	tcp_connection *i = info->second;
426
427			i->last_activity = NOW;
428	pcg	1.2
429			if (i->ok)
430			{
431	pcg	1.4	setsockopt (i->p->fd, SOL_IP, IP_TOS, &tos, sizeof tos);
432	pcg	1.2
433	pcg	1.3	// we use none of the advantages of tcp
434	pcg	1.4	write (i->p->fd, (void *)pkt, pkt->len + sizeof (u32)) != pkt->len + sizeof (u32);
435	pcg	1.2	}
436			}
437
438			#if 0
439			setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
440			sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
441			#endif
442			}
443
444			void
445	pcg	1.3	tcp_connection::tcpv4_ev (io_watcher &w, short revents)
446	pcg	1.2	{
447	pcg	1.3	last_activity = NOW;
448
449			if (!ok) // just established?
450			{
451			ok = true;
452	pcg	1.4	set (POLLIN);
453	pcg	1.3	}
454
455	pcg	1.2	if (revents & (POLLIN \| POLLERR))
456			{
457	pcg	1.3	u32 len;
458	pcg	1.2
459	pcg	1.4	if (sizeof (len) == read (p->fd, &len, sizeof (len)))
460	pcg	1.2	{
461	pcg	1.3	vpn_packet *pkt = new vpn_packet;
462	pcg	1.2
463	pcg	1.4	if (len == read (p->fd, &((*pkt)[0]), len))
464	pcg	1.3	{
465			pkt->len = len;
466	pcg	1.2
467	pcg	1.3	v.recv_vpn_packet (pkt, si);
468			return;
469			}
470
471			delete pkt;
472			}
473	pcg	1.2
474	pcg	1.3	tcp_si.erase (&si);
475	pcg	1.4
476			set (0);//D
477	pcg	1.2	}
478			}
479
480	pcg	1.1	void
481	pcg	1.3	vpn::tcpv4_ev (io_watcher &w, short revents)
482	pcg	1.2	{
483			if (revents & (POLLIN \| POLLERR))
484			{
485	pcg	1.3	struct sockaddr_in sa;
486			socklen_t sa_len = sizeof (sa);
487			int len;
488
489	pcg	1.4	int fd = accept (w.p->fd, (sockaddr *)&sa, &sa_len);
490	pcg	1.2
491	pcg	1.3	if (fd >= 0)
492	pcg	1.2	{
493	pcg	1.3	fcntl (fd, F_SETFL, O_NONBLOCK);
494	pcg	1.2
495	pcg	1.3	sockinfo si(sa, PROT_TCPv4);
496			tcp_connection i = new tcp_connection (fd, si, this);
497	pcg	1.2
498	pcg	1.4	slog (L_DEBUG, _("accepted tcp connection from %s\n"), (const char *)si);//D
499	pcg	1.2
500	pcg	1.3	tcp_si.insert (*i);
501	pcg	1.2	}
502			}
503			}
504
505			#endif
506
507			void
508	pcg	1.3	vpn::tap_ev (io_watcher &w, short revents)
509	pcg	1.1	{
510			if (revents & POLLIN)
511			{
512			/* process data */
513			tap_packet *pkt;
514
515			pkt = tap->recv ();
516
517			int dst = mac2id (pkt->dst);
518			int src = mac2id (pkt->src);
519
520			if (src != THISNODE->id)
521			{
522			slog (L_ERR, _("FATAL: tap packet not originating on current node received, terminating."));
523			exit (1);
524			}
525
526			if (dst == THISNODE->id)
527			{
528			slog (L_ERR, _("FATAL: tap packet destined for current node received, terminating."));
529			exit (1);
530			}
531
532			if (dst > conns.size ())
533			slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
534			else
535			{
536			if (dst)
537			{
538			// unicast
539			if (dst != THISNODE->id)
540			conns[dst - 1]->inject_data_packet (pkt);
541			}
542			else
543			{
544			// broadcast, first check router, then self, then english
545			connection *router = find_router ();
546
547			if (router)
548			router->inject_data_packet (pkt, true);
549			else
550			for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
551			if ((*c)->conf != THISNODE)
552			(*c)->inject_data_packet (pkt);
553			}
554			}
555
556			delete pkt;
557			}
558			else if (revents & (POLLHUP \| POLLERR))
559			{
560			slog (L_ERR, _("FATAL: POLLHUP or POLLERR on network device fd, terminating."));
561			exit (1);
562			}
563			else
564			abort ();
565			}
566
567			void
568	pcg	1.3	vpn::event_cb (time_watcher &w)
569	pcg	1.1	{
570			if (events)
571			{
572			if (events & EVENT_SHUTDOWN)
573			{
574			slog (L_INFO, _("preparing shutdown..."));
575
576			shutdown_all ();
577
578			remove_pid (pidfilename);
579
580			slog (L_INFO, _("terminating"));
581
582			exit (0);
583			}
584
585			if (events & EVENT_RECONNECT)
586			{
587			slog (L_INFO, _("forced reconnect"));
588
589			reconnect_all ();
590			}
591
592			events = 0;
593			}
594
595	pcg	1.3	w.at = TSTAMP_CANCEL;
596	pcg	1.1	}
597
598			void
599			vpn::shutdown_all ()
600			{
601			for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
602			(*c)->shutdown ();
603			}
604
605			void
606			vpn::reconnect_all ()
607			{
608			for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
609			delete *c;
610
611			conns.clear ();
612
613			connection_init ();
614
615			for (configuration::node_vector::iterator i = conf.nodes.begin ();
616			i != conf.nodes.end (); ++i)
617			{
618			connection *conn = new connection (this);
619
620			conn->conf = *i;
621			conns.push_back (conn);
622
623			conn->establish_connection ();
624			}
625			}
626
627			connection *vpn::find_router ()
628			{
629			u32 prio = 0;
630			connection *router = 0;
631
632			for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
633			{
634			connection c = i;
635
636			if (c->conf->routerprio > prio
637			&& c->connectmode == conf_node::C_ALWAYS
638			&& c->conf != THISNODE
639			&& c->ictx && c->octx)
640			{
641			prio = c->conf->routerprio;
642			router = c;
643			}
644			}
645
646			return router;
647			}
648
649			void vpn::connect_request (int id)
650			{
651			connection *c = find_router ();
652
653			if (c)
654			c->connect_request (id);
655			//else // does not work, because all others must connect to the same router
656			// // no router found, aggressively connect to all routers
657			// for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
658			// if ((*i)->conf->routerprio)
659			// (*i)->establish_connection ();
660			}
661
662			void
663			connection::dump_status ()
664			{
665			slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
666			slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
667			connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
668			slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
669			(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
670			slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
671			(long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
672			}
673
674			void
675			vpn::dump_status ()
676			{
677			slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);
678
679			for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
680			(*c)->dump_status ();
681
682			slog (L_NOTICE, _("END status dump"));
683			}
684
685			vpn::vpn (void)
686	pcg	1.2	: event(this, &vpn::event_cb)
687			, udpv4_ev_watcher(this, &vpn::udpv4_ev)
688			, ipv4_ev_watcher (this, &vpn::ipv4_ev)
689			, tap_ev_watcher (this, &vpn::tap_ev)
690			#if ENABLE_TCP
691	pcg	1.3	, tcpv4_ev_watcher(this, &vpn::tcpv4_ev)
692	pcg	1.2	#endif
693	pcg	1.1	{
694			}
695
696			vpn::~vpn ()
697			{
698			}
699