ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.31 by pcg, Sat Mar 5 19:13:16 2005 UTC vs.
Revision 1.55 by pcg, Fri Mar 27 22:02:57 2009 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
51const char *vpn::script_if_up () 61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
73void
74vpn::script_init_env ()
52{ 75{
53 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
54 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
55 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 78 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
56 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 79 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
57 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
58 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
59 82
60 char *env; 83 char *env;
61 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
62 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
63 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
64 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
65 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 86 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
66 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 87 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
67 asprintf (&env, "MTU=%d", mtu); putenv (env); 88 asprintf (&env, "MTU=%d", mtu); putenv (env);
68 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 89 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
69 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 90 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
70 THISNODE->id & 0xff);
71 putenv (env);
72 91
92 conns [THISNODE->id - 1]->script_init_env ("");
93
94 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
95 {
96 char ext[16];
97 snprintf (ext, 16, "_%d", (*c)->conf->id);
98 (*c)->script_init_env (ext);
99 }
100}
101
102inline const char *
103vpn::script_if_init ()
104{
105 script_init_env ();
106
107 return tap->if_up ();
108}
109
110inline const char *
111vpn::script_if_up ()
112{
113 script_init_env ();
114
115 char *filename;
116 asprintf (&filename,
117 "%s/%s",
118 confbase,
73 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 119 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
120
121 return filename;
122}
123
124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
74} 145}
75 146
76int 147int
77vpn::setup () 148vpn::setup ()
78{ 149{
150 int success = 0;
151
152 ipv4_tos = -1;
79 ipv4_fd = -1; 153 ipv4_fd = -1;
80 154
81 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 155 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
82 { 156 {
83 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 157 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
84 158
85 if (ipv4_fd < 0) 159 if (ipv4_fd < 0)
86 return -1; 160 return -1;
87
88 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
89 161
90#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 162#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
91 // this I really consider a linux bug. I am neither connected 163 // this I really consider a linux bug. I am neither connected
92 // nor do I fragment myself. Linux still sets DF and doesn't 164 // nor do I fragment myself. Linux still sets DF and doesn't
93 // fragment for me sometimes. 165 // fragment for me sometimes.
… …
99 171
100 sockinfo si (THISNODE, PROT_IPv4); 172 sockinfo si (THISNODE, PROT_IPv4);
101 173
102 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 174 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
103 { 175 {
104 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 176 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
105 exit (EXIT_FAILURE); 177 return -1;
106 } 178 }
107 179
108 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 180 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
181 ++success;
109 } 182 }
183 else
184 THISNODE->protocols &= ~PROT_IPv4;
110 185
186 udpv4_tos = -1;
111 udpv4_fd = -1; 187 udpv4_fd = -1;
112 188
113 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 189 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
114 { 190 {
115 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 191 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
116 192
117 if (udpv4_fd < 0) 193 if (udpv4_fd < 0)
118 return -1; 194 return -1;
119
120 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
121 195
122 // standard daemon practise... 196 // standard daemon practise...
123 { 197 {
124 int oval = 1; 198 int oval = 1;
125 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 199 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
137 211
138 sockinfo si (THISNODE, PROT_UDPv4); 212 sockinfo si (THISNODE, PROT_UDPv4);
139 213
140 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 214 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
141 { 215 {
142 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 216 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 217 return -1;
144 } 218 }
145 219
146 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 220 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
221 ++success;
147 } 222 }
223 else
224 THISNODE->protocols &= ~PROT_UDPv4;
148 225
226 icmpv4_tos = -1;
149 icmpv4_fd = -1; 227 icmpv4_fd = -1;
150 228
151#if ENABLE_ICMP 229#if ENABLE_ICMP
152 if (THISNODE->protocols & PROT_ICMPv4) 230 if (THISNODE->protocols & PROT_ICMPv4)
153 { 231 {
154 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 232 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
155 233
156 if (icmpv4_fd < 0) 234 if (icmpv4_fd < 0)
157 return -1; 235 return -1;
158
159 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
160 236
161#ifdef ICMP_FILTER 237#ifdef ICMP_FILTER
162 { 238 {
163 icmp_filter oval; 239 icmp_filter oval;
164 oval.data = 0xffffffff; 240 oval.data = 0xffffffff;
… …
173 // this I really consider a linux bug. I am neither connected 249 // this I really consider a linux bug. I am neither connected
174 // nor do I fragment myself. Linux still sets DF and doesn't 250 // nor do I fragment myself. Linux still sets DF and doesn't
175 // fragment for me sometimes. 251 // fragment for me sometimes.
176 { 252 {
177 int oval = IP_PMTUDISC_DONT; 253 int oval = IP_PMTUDISC_DONT;
178 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 254 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
179 } 255 }
180#endif 256#endif
181 257
182 sockinfo si (THISNODE, PROT_ICMPv4); 258 sockinfo si (THISNODE, PROT_ICMPv4);
183 259
184 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 260 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
185 { 261 {
186 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 262 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
187 exit (EXIT_FAILURE); 263 return -1;
188 } 264 }
189 265
190 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 266 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
267 ++success;
191 } 268 }
192#endif 269#endif
193 270
194 tcpv4_fd = -1; 271 tcpv4_fd = -1;
195 272
196#if ENABLE_TCP 273#if ENABLE_TCP
197 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 274 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
198 { 275 {
199 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 276 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
200 277
201 if (tcpv4_fd < 0) 278 if (tcpv4_fd < 0)
202 return -1; 279 return -1;
203 280
204 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
205
206 // standard daemon practise... 281 // standard daemon practise...
207 { 282 {
208 int oval = 1; 283 int oval = 1;
209 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 284 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
210 } 285 }
211 286
212 sockinfo si (THISNODE, PROT_TCPv4); 287 sockinfo si (THISNODE, PROT_TCPv4);
213 288
214 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
215 { 290 {
216 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
217 exit (EXIT_FAILURE); 292 return -1;
218 } 293 }
219 294
220 if (listen (tcpv4_fd, 5)) 295 if (listen (tcpv4_fd, 5))
221 { 296 {
222 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 297 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
223 exit (EXIT_FAILURE); 298 return -1;
224 } 299 }
225 300
226 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 301 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
302 ++success;
227 } 303 }
304 else
305 THISNODE->protocols &= ~PROT_TCPv4;
228#endif 306#endif
307
308 dnsv4_tos = -1;
309 dnsv4_fd = -1;
229 310
230#if ENABLE_DNS 311#if ENABLE_DNS
231 if (THISNODE->protocols & PROT_DNSv4) 312 if (THISNODE->protocols & PROT_DNSv4)
232 { 313 {
233 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 314 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
234 315
235 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 316 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
236 317
237 if (dnsv4_fd < 0) 318 if (dnsv4_fd < 0)
238 return -1; 319 return -1;
320
321# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
322 // this I really consider a linux bug. I am neither connected
323 // nor do I fragment myself. Linux still sets DF and doesn't
324 // fragment for me sometimes.
325 {
326 int oval = IP_PMTUDISC_DONT;
327 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
328 }
329# endif
239 330
240 // standard daemon practise... 331 // standard daemon practise...
241 { 332 {
242 int oval = 1; 333 int oval = 1;
243 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 334 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
247 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 338 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
248 PROT_DNSv4); 339 PROT_DNSv4);
249 340
250 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 341 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
251 { 342 {
252 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 343 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
253 exit (EXIT_FAILURE); 344 return -1;
254 } 345 }
255 346
256 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 347 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
348 ++success;
349 }
350#endif
351
352 /////////////////////////////////////////////////////////////////////////////
353
354 if (!success)
257 } 355 {
258#endif 356 slog (L_ERR, _("no protocols enabled."));
357 return -1;
358 }
359
360 reconnect_all ();
361
362 /////////////////////////////////////////////////////////////////////////////
259 363
260 tap = new tap_device (); 364 tap = new tap_device ();
261 if (!tap) //D this, of course, never catches 365 if (!tap) //D this, of course, never catches
262 { 366 {
263 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 367 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
264 exit (EXIT_FAILURE); 368 return -1;
265 } 369 }
266 370
267 run_script (run_script_cb (this, &vpn::script_if_up), true); 371 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
268 372
373 run_script_cb cb;
374 cb.set<vpn, &vpn::script_if_init> (this);
375
376 if (tap->if_up () &&
377 !run_script (cb, true))
378 {
379 slog (L_ERR, _("interface initialization command '%s' failed."),
380 tap->if_up ());
381 return -1;
382 }
383
384 cb.set<vpn, &vpn::script_if_up> (this);
385 if (!run_script (cb, true))
386 {
387 slog (L_ERR, _("if-up command execution failed."));
388 return -1;
389 }
390
269 tap_ev_watcher.start (tap->fd, EVENT_READ); 391 tap_ev_watcher.start (tap->fd, EV_READ);
270
271 reconnect_all ();
272 392
273 return 0; 393 return 0;
274} 394}
275 395
276bool 396bool
277vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 397vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
278{ 398{
279#if defined(SOL_IP) && defined(IP_TOS) 399 set_tos (ipv4_fd, ipv4_tos, tos);
280 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
281#endif
282 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 400 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
283 401
284 return true; 402 return true;
285} 403}
286 404
… …
309 427
310#if ENABLE_ICMP 428#if ENABLE_ICMP
311bool 429bool
312vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 430vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
313{ 431{
314#if defined(SOL_IP) && defined(IP_TOS)
315 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
316#endif
317
318 pkt->unshift_hdr (4); 432 pkt->unshift_hdr (4);
319 433
320 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 434 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
321 hdr->type = ::conf.icmp_type; 435 hdr->type = ::conf.icmp_type;
322 hdr->code = 255; 436 hdr->code = 255;
323 hdr->checksum = 0; 437 hdr->checksum = 0;
324 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 438 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
325 439
440 set_tos (icmpv4_fd, icmpv4_tos, tos);
326 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 441 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
327 442
328 return true; 443 return true;
329} 444}
330#endif 445#endif
331 446
332bool 447bool
333vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 448vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
334{ 449{
335#if defined(SOL_IP) && defined(IP_TOS) 450 set_tos (udpv4_fd, udpv4_tos, tos);
336 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
337#endif
338 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 451 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
339 452
340 return true; 453 return true;
341} 454}
342 455
… …
353 { 466 {
354 // broadcast, this is ugly, but due to the security policy 467 // broadcast, this is ugly, but due to the security policy
355 // we have to connect to all hosts... 468 // we have to connect to all hosts...
356 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 469 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
357 if ((*c)->conf != THISNODE) 470 if ((*c)->conf != THISNODE)
358 (*c)->inject_data_packet (pkt, true); 471 (*c)->inject_data_packet (pkt);
359 } 472 }
360} 473}
361 474
362void 475void
363vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 476vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
364{ 477{
365 unsigned int src = pkt->src (); 478 unsigned int src = pkt->src ();
366 unsigned int dst = pkt->dst (); 479 unsigned int dst = pkt->dst ();
367 480
368 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 481 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
369 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 482 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
370 483
371 if (src == 0 || src > conns.size () 484 if (src == 0 || src > conns.size ()
372 || dst > conns.size () 485 || dst > conns.size ()
373 || pkt->typ () >= vpn_packet::PT_MAX) 486 || pkt->typ () >= vpn_packet::PT_MAX)
374 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 487 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
375 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 488 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
376 else if (dst > conns.size ()) 489 else if (dst > conns.size ())
377 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 490 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
378 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 491 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
379 else 492 else
380 { 493 {
381 connection *c = conns[src - 1]; 494 connection *c = conns[src - 1];
382 495
383 if (dst == 0) 496 if (dst == 0)
384 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 497 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
385 c->conf->nodename, (const char *)rsi); 498 c->conf->nodename, (const char *)rsi);
386 else if (dst != THISNODE->id) 499 else if (dst != THISNODE->id)
387 { 500 {
388 if (THISNODE->routerprio) 501 if (THISNODE->routerprio)
389 // the tos setting gets lost here. who cares. 502 // the tos setting gets lost here. who cares.
390 conns[dst - 1]->inject_vpn_packet (pkt); 503 conns[dst - 1]->inject_vpn_packet (pkt);
391 else 504 else
392 slog (L_WARN, 505 slog (L_WARN,
393 _("%s(%s): forwarding request (=> %s), but we are no router"), 506 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
394 c->conf->nodename, (const char *)rsi, 507 c->conf->nodename, (const char *)rsi,
395 conns[dst - 1]->conf->nodename); 508 conns[dst - 1]->conf->nodename);
396 } 509 }
397 else 510 else
398 c->recv_vpn_packet (pkt, rsi); 511 c->recv_vpn_packet (pkt, rsi);
… …
404{ 517{
405 switch (si.prot) 518 switch (si.prot)
406 { 519 {
407 case PROT_IPv4: 520 case PROT_IPv4:
408 return send_ipv4_packet (pkt, si, tos); 521 return send_ipv4_packet (pkt, si, tos);
522
409 case PROT_UDPv4: 523 case PROT_UDPv4:
410 return send_udpv4_packet (pkt, si, tos); 524 return send_udpv4_packet (pkt, si, tos);
525
411#if ENABLE_TCP 526#if ENABLE_TCP
412 case PROT_TCPv4: 527 case PROT_TCPv4:
413 return send_tcpv4_packet (pkt, si, tos); 528 return send_tcpv4_packet (pkt, si, tos);
414#endif 529#endif
415#if ENABLE_ICMP 530#if ENABLE_ICMP
… …
418#endif 533#endif
419#if ENABLE_DNS 534#if ENABLE_DNS
420 case PROT_DNSv4: 535 case PROT_DNSv4:
421 return send_dnsv4_packet (pkt, si, tos); 536 return send_dnsv4_packet (pkt, si, tos);
422#endif 537#endif
423
424 default: 538 default:
425 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 539 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
426 } 540 }
427 541
428 return false; 542 return false;
429} 543}
430 544
431void 545inline void
432vpn::ipv4_ev (io_watcher &w, short revents) 546vpn::ipv4_ev (ev::io &w, int revents)
433{ 547{
434 if (revents & EVENT_READ) 548 if (revents & EV_READ)
435 { 549 {
436 vpn_packet *pkt = new vpn_packet; 550 vpn_packet *pkt = new vpn_packet;
437 struct sockaddr_in sa; 551 struct sockaddr_in sa;
438 socklen_t sa_len = sizeof (sa); 552 socklen_t sa_len = sizeof (sa);
439 int len; 553 int len;
… …
452 recv_vpn_packet (pkt, si); 566 recv_vpn_packet (pkt, si);
453 } 567 }
454 else 568 else
455 { 569 {
456 // probably ECONNRESET or somesuch 570 // probably ECONNRESET or somesuch
457 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 571 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
458 } 572 }
459 573
460 delete pkt; 574 delete pkt;
461 } 575 }
462 else 576 else
463 { 577 {
464 slog (L_ERR, 578 slog (L_ERR,
465 _("FATAL: unknown revents %08x in socket, terminating\n"), 579 _("FATAL: unknown revents %08x in socket, exiting.\n"),
466 revents); 580 revents);
467 exit (EXIT_FAILURE); 581 exit (EXIT_FAILURE);
468 } 582 }
469} 583}
470 584
471#if ENABLE_ICMP 585#if ENABLE_ICMP
472void 586inline void
473vpn::icmpv4_ev (io_watcher &w, short revents) 587vpn::icmpv4_ev (ev::io &w, int revents)
474{ 588{
475 if (revents & EVENT_READ) 589 if (revents & EV_READ)
476 { 590 {
477 vpn_packet *pkt = new vpn_packet; 591 vpn_packet *pkt = new vpn_packet;
478 struct sockaddr_in sa; 592 struct sockaddr_in sa;
479 socklen_t sa_len = sizeof (sa); 593 socklen_t sa_len = sizeof (sa);
480 int len; 594 int len;
… …
500 } 614 }
501 } 615 }
502 else 616 else
503 { 617 {
504 // probably ECONNRESET or somesuch 618 // probably ECONNRESET or somesuch
505 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 619 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
506 } 620 }
507 621
508 delete pkt; 622 delete pkt;
509 } 623 }
510 else 624 else
511 { 625 {
512 slog (L_ERR, 626 slog (L_ERR,
513 _("FATAL: unknown revents %08x in socket, terminating\n"), 627 _("FATAL: unknown revents %08x in socket, exiting.\n"),
514 revents); 628 revents);
515 exit (EXIT_FAILURE); 629 exit (EXIT_FAILURE);
516 } 630 }
517} 631}
518#endif 632#endif
519 633
520void 634inline void
521vpn::udpv4_ev (io_watcher &w, short revents) 635vpn::udpv4_ev (ev::io &w, int revents)
522{ 636{
523 if (revents & EVENT_READ) 637 if (revents & EV_READ)
524 { 638 {
525 vpn_packet *pkt = new vpn_packet; 639 vpn_packet *pkt = new vpn_packet;
526 struct sockaddr_in sa; 640 struct sockaddr_in sa;
527 socklen_t sa_len = sizeof (sa); 641 socklen_t sa_len = sizeof (sa);
528 int len; 642 int len;
… …
538 recv_vpn_packet (pkt, si); 652 recv_vpn_packet (pkt, si);
539 } 653 }
540 else 654 else
541 { 655 {
542 // probably ECONNRESET or somesuch 656 // probably ECONNRESET or somesuch
543 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 657 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
544 } 658 }
545 659
546 delete pkt; 660 delete pkt;
547 } 661 }
548 else 662 else
549 { 663 {
550 slog (L_ERR, 664 slog (L_ERR,
551 _("FATAL: unknown revents %08x in socket, terminating\n"), 665 _("FATAL: unknown revents %08x in socket, exiting.\n"),
552 revents); 666 revents);
553 exit (EXIT_FAILURE); 667 exit (EXIT_FAILURE);
554 } 668 }
555} 669}
556 670
557void 671inline void
558vpn::tap_ev (io_watcher &w, short revents) 672vpn::tap_ev (ev::io &w, int revents)
559{ 673{
560 if (revents & EVENT_READ) 674 if (revents & EV_READ)
561 { 675 {
562 /* process data */ 676 /* process data */
563 tap_packet *pkt; 677 tap_packet *pkt;
564 678
565 pkt = tap->recv (); 679 pkt = tap->recv ();
… …
594 } 708 }
595 else 709 else
596 abort (); 710 abort ();
597} 711}
598 712
599void 713inline void
600vpn::event_cb (time_watcher &w) 714vpn::event_cb (ev::timer &w, int)
601{ 715{
602 if (events) 716 if (events)
603 { 717 {
604 if (events & EVENT_SHUTDOWN) 718 if (events & EVENT_SHUTDOWN)
605 { 719 {
606 slog (L_INFO, _("preparing shutdown...")); 720 slog (L_INFO, _("preparing shutdown..."));
607 721
608 shutdown_all (); 722 shutdown_all ();
609 remove_pid (conf.pidfilename); 723 remove_pid (conf.pidfilename);
610 slog (L_INFO, _("terminating")); 724 slog (L_INFO, _("exiting."));
611 exit (EXIT_SUCCESS); 725 exit (EXIT_SUCCESS);
612 } 726 }
613 727
614 if (events & EVENT_RECONNECT) 728 if (events & EVENT_RECONNECT)
615 { 729 {
616 slog (L_INFO, _("forced reconnect")); 730 slog (L_INFO, _("forced reconnect."));
617 731
618 reconnect_all (); 732 reconnect_all ();
619 } 733 }
620 734
621 events = 0; 735 events = 0;
… …
637 751
638 conns.clear (); 752 conns.clear ();
639 753
640 connection_init (); 754 connection_init ();
641 755
642 for (configuration::node_vector::iterator i = conf.nodes.begin (); 756 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
643 i != conf.nodes.end (); ++i) 757 conns.push_back (new connection (this, *i));
644 { 758
645 connection *conn = new connection (this, *i); 759 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
646 conns.push_back (conn);
647 conn->establish_connection (); 760 (*c)->establish_connection ();
648 }
649} 761}
650 762
651connection *vpn::find_router () 763bool vpn::can_direct (conf_node *src, conf_node *dst) const
652{ 764{
653 u32 prio = 1; 765 return src != dst
766 && src->may_direct (dst)
767 && dst->may_direct (src)
768 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
769 || (src->protocols & dst->connectable_protocols ()));
770}
771
772// only works for indirect and routed connections: find a router
773// from THISNODE to dst
774connection *vpn::find_router_for (const connection *dst)
775{
654 connection *router = 0; 776 connection *router = 0;
655 777
778 // first try to find a router with a direct connection, route there
779 // regardless of any other considerations.
780 {
781 u32 prio = 1;
782
783 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
784 {
785 connection *c = *i;
786
787 if (c->conf->routerprio > prio
788 && c->conf != THISNODE
789 && can_direct (c->conf, dst->conf)
790 && c->ictx && c->octx)
791 {
792 prio = c->conf->routerprio;
793 router = c;
794 }
795 }
796 }
797
798 if (router)
799 return router;
800
801 // second try find the router with the highest priority, higher than ours
802 {
803 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
804
805 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
806 {
807 connection *c = *i;
808
809 if (c->conf->routerprio > prio
810 && c != dst
811 && c->conf != THISNODE
812 && c->ictx && c->octx)
813 {
814 prio = c->conf->routerprio;
815 router = c;
816 }
817 }
818 }
819
820 return router;
821}
822
823void vpn::connection_established (connection *c)
824{
656 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 825 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
657 { 826 {
658 connection *c = *i; 827 connection *o = *i;
659 828
660 if (c->conf->routerprio > prio 829 if (!o->is_direct
661 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 830 && o->si.valid ()
662 && c->ictx && c->octx 831 && c->si != o->si
663 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 832 && c == find_router_for (o))
664 {
665 prio = c->conf->routerprio;
666 router = c;
667 } 833 {
834 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
835 o->conf->nodename, c->conf->nodename);
836 o->rekey ();
837 }
668 } 838 }
669
670 return router;
671} 839}
672 840
673void vpn::send_connect_request (int id) 841void vpn::send_connect_request (connection *c)
674{ 842{
675 connection *c = find_router (); 843 connection *r = find_router_for (c);
676 844
677 if (c) 845 if (r)
846 {
847 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
848 c->conf->nodename, r->conf->nodename);
678 c->send_connect_request (id); 849 r->send_connect_request (c->conf->id);
850 }
679 else 851 else
680 // no router found, aggressively connect to all routers 852 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
681 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 853 c->conf->nodename);
682 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
683 (*i)->establish_connection ();
684} 854}
685 855
686void 856void
687connection::dump_status () 857connection::dump_status ()
688{ 858{
689 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 859 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
690 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 860 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
691 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 861 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
692 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 862 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
693 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 863 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
694 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
695 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
696} 864}
697 865
698void 866void
699vpn::dump_status () 867vpn::dump_status ()
700{ 868{
701 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 869 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
702 870
703 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 871 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
704 (*c)->dump_status (); 872 (*c)->dump_status ();
705 873
706 slog (L_NOTICE, _("END status dump")); 874 slog (L_NOTICE, _("END status dump"));
707} 875}
708 876
709vpn::vpn (void) 877vpn::vpn (void)
878{
710: event (this, &vpn::event_cb) 879 event .set<vpn, &vpn::event_cb > (this);
711, udpv4_ev_watcher (this, &vpn::udpv4_ev) 880 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
712, ipv4_ev_watcher (this, &vpn::ipv4_ev) 881 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
713#if ENABLE_TCP 882#if ENABLE_TCP
714, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 883 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
715#endif 884#endif
716#if ENABLE_ICMP 885#if ENABLE_ICMP
717, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 886 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
718#endif 887#endif
719#if ENABLE_DNS 888#if ENABLE_DNS
720, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 889 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
721#endif 890#endif
722, tap_ev_watcher (this, &vpn::tap_ev) 891 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
723{
724} 892}
725 893
726vpn::~vpn () 894vpn::~vpn ()
727{ 895{
728} 896}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines