ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.31 by pcg, Sat Mar 5 19:13:16 2005 UTC vs.
Revision 1.70 by root, Thu Oct 6 03:03:09 2022 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
46 57
58using namespace std;
59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
48 61
49///////////////////////////////////////////////////////////////////////////// 62/////////////////////////////////////////////////////////////////////////////
50 63
51const char *vpn::script_if_up () 64// hopefully temporary workaround for rare buffer full conditions
65// if it happens, usually instantly retrying or retrying ~5ms later
66// is good enough with current network technologies/kernels
67
68static ssize_t
69xsendto (int fd, const void *buf, size_t len, int flags,
70 const struct sockaddr *sa, socklen_t salen)
71{
72 ssize_t res;
73
74 for (int retry = 0; retry <= 13; ++retry) // ~100ms
75 {
76 res = sendto (fd, buf, len, flags, sa, salen);
77
78 if (res >= 0 || errno != ENOBUFS)
79 break;
80
81 struct timespec ts = { 0, 1000 * retry };
82 nanosleep (&ts, 0);
83 }
84
85 return res;
86}
87
88/////////////////////////////////////////////////////////////////////////////
89
90static void inline
91set_tos (int fd, int &tos_prev, int tos)
92{
93#if defined(SOL_IP) && defined(IP_TOS)
94 if (tos_prev == tos)
95 return;
96
97 tos_prev = tos;
98 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
99#endif
100}
101
102void
103vpn::script_init_env ()
52{ 104{
53 // the tunnel device mtu should be the physical mtu - overhead 105 // the tunnel device mtu should be the physical mtu - overhead
54 // the tricky part is rounding to the cipher key blocksize 106 // the tricky part is rounding to the cipher key blocksize
55 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 107 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
56 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 108 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
57 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 109 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
58 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 110 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
59 111
60 char *env; 112 char *env;
61 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 113 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
62 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
63 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
64 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 114 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
65 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 115 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
66 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 116 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
67 asprintf (&env, "MTU=%d", mtu); putenv (env); 117 asprintf (&env, "MTU=%d", mtu); putenv (env);
68 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 118 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
69 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 119 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
70 THISNODE->id & 0xff);
71 putenv (env);
72 120
73 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 121 conns [THISNODE->id - 1]->script_init_env ("");
122
123 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
124 {
125 char ext[16];
126 snprintf (ext, 16, "_%d", (*c)->conf->id);
127 (*c)->script_init_env (ext);
128 }
129}
130
131inline const char *
132vpn::script_if_init ()
133{
134 script_init_env ();
135
136 return tap->if_up ();
137}
138
139inline const char *
140vpn::script_if_up ()
141{
142 script_init_env ();
143
144 return conf.config_filename (::conf.script_if_up, "if-up");
145}
146
147int
148vpn::setup_socket (u8 prot, int family, int type, int proto)
149{
150 int fd = socket (family, type, proto);
151
152 if (fd < 0)
153 {
154 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
155 return fd;
156 }
157
158 fcntl (fd, F_SETFL, O_NONBLOCK);
159 fcntl (fd, F_SETFD, FD_CLOEXEC);
160
161#ifdef SO_MARK
162 if (::conf.nfmark)
163 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
164 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
165#endif
166
167 return fd;
74} 168}
75 169
76int 170int
77vpn::setup () 171vpn::setup ()
78{ 172{
173 int success = 0;
174
175 ipv4_tos = -1;
79 ipv4_fd = -1; 176 ipv4_fd = -1;
80 177
81 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 178 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
82 { 179 {
83 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 180 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
84 181
85 if (ipv4_fd < 0) 182 if (ipv4_fd < 0)
86 return -1; 183 return -1;
87
88 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
89 184
90#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 185#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
91 // this I really consider a linux bug. I am neither connected 186 // this I really consider a linux bug. I am neither connected
92 // nor do I fragment myself. Linux still sets DF and doesn't 187 // nor do I fragment myself. Linux still sets DF and doesn't
93 // fragment for me sometimes. 188 // fragment for me sometimes.
… …
99 194
100 sockinfo si (THISNODE, PROT_IPv4); 195 sockinfo si (THISNODE, PROT_IPv4);
101 196
102 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
103 { 198 {
104 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
105 exit (EXIT_FAILURE); 200 return -1;
106 } 201 }
107 202
108 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 203 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
204 ++success;
109 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_IPv4;
110 208
209 udpv4_tos = -1;
111 udpv4_fd = -1; 210 udpv4_fd = -1;
112 211
113 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 212 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
114 { 213 {
115 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 214 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
116 215
117 if (udpv4_fd < 0) 216 if (udpv4_fd < 0)
118 return -1; 217 return -1;
119
120 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
121 218
122 // standard daemon practise... 219 // standard daemon practise...
123 { 220 {
124 int oval = 1; 221 int oval = 1;
125 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 222 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
137 234
138 sockinfo si (THISNODE, PROT_UDPv4); 235 sockinfo si (THISNODE, PROT_UDPv4);
139 236
140 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 237 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
141 { 238 {
142 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 239 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 240 return -1;
144 } 241 }
145 242
146 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 243 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
244 ++success;
147 } 245 }
246 else
247 THISNODE->protocols &= ~PROT_UDPv4;
148 248
249 icmpv4_tos = -1;
149 icmpv4_fd = -1; 250 icmpv4_fd = -1;
150 251
151#if ENABLE_ICMP 252#if ENABLE_ICMP
152 if (THISNODE->protocols & PROT_ICMPv4) 253 if (THISNODE->protocols & PROT_ICMPv4)
153 { 254 {
154 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 255 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
155 256
156 if (icmpv4_fd < 0) 257 if (icmpv4_fd < 0)
157 return -1; 258 return -1;
158 259
159 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
160
161#ifdef ICMP_FILTER 260#ifdef ICMP_FILTER
162 { 261 {
163 icmp_filter oval; 262 icmp_filter oval;
164 oval.data = 0xffffffff; 263 oval.data = 0;
165 if (::conf.icmp_type < 32) 264 if (::conf.icmp_type < 32)
166 oval.data &= ~(1 << ::conf.icmp_type); 265 oval.data |= 1 << ::conf.icmp_type;
266 oval.data = ~oval.data;
167 267
168 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval); 268 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
169 } 269 }
170#endif 270#endif
171 271
… …
173 // this I really consider a linux bug. I am neither connected 273 // this I really consider a linux bug. I am neither connected
174 // nor do I fragment myself. Linux still sets DF and doesn't 274 // nor do I fragment myself. Linux still sets DF and doesn't
175 // fragment for me sometimes. 275 // fragment for me sometimes.
176 { 276 {
177 int oval = IP_PMTUDISC_DONT; 277 int oval = IP_PMTUDISC_DONT;
178 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 278 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
179 } 279 }
180#endif 280#endif
181 281
182 sockinfo si (THISNODE, PROT_ICMPv4); 282 sockinfo si (THISNODE, PROT_ICMPv4);
183 283
184 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 284 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
185 { 285 {
186 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 286 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
187 exit (EXIT_FAILURE); 287 return -1;
188 } 288 }
189 289
190 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 290 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
291 ++success;
191 } 292 }
192#endif 293#endif
193 294
194 tcpv4_fd = -1; 295 tcpv4_fd = -1;
195 296
196#if ENABLE_TCP 297#if ENABLE_TCP
197 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 298 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
198 { 299 {
199 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 300 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
200 301
201 if (tcpv4_fd < 0) 302 if (tcpv4_fd < 0)
202 return -1; 303 return -1;
203 304
204 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
205
206 // standard daemon practise... 305 // standard daemon practise...
207 { 306 {
208 int oval = 1; 307 int oval = 1;
209 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 308 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
210 } 309 }
211 310
212 sockinfo si (THISNODE, PROT_TCPv4); 311 sockinfo si (THISNODE, PROT_TCPv4);
213 312
214 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 313 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
215 { 314 {
216 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 315 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
217 exit (EXIT_FAILURE); 316 return -1;
218 } 317 }
219 318
220 if (listen (tcpv4_fd, 5)) 319 if (listen (tcpv4_fd, 5))
221 { 320 {
222 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 321 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
223 exit (EXIT_FAILURE); 322 return -1;
224 } 323 }
225 324
226 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 325 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
326 ++success;
227 } 327 }
328 else
329 THISNODE->protocols &= ~PROT_TCPv4;
228#endif 330#endif
331
332 dnsv4_tos = -1;
333 dnsv4_fd = -1;
229 334
230#if ENABLE_DNS 335#if ENABLE_DNS
231 if (THISNODE->protocols & PROT_DNSv4) 336 if (THISNODE->protocols & PROT_DNSv4)
232 { 337 {
233 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 338 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
234 339
235 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 340 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
236 341
237 if (dnsv4_fd < 0) 342 if (dnsv4_fd < 0)
238 return -1; 343 return -1;
344
345# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
346 // this I really consider a linux bug. I am neither connected
347 // nor do I fragment myself. Linux still sets DF and doesn't
348 // fragment for me sometimes.
349 {
350 int oval = IP_PMTUDISC_DONT;
351 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
352 }
353# endif
239 354
240 // standard daemon practise... 355 // standard daemon practise...
241 { 356 {
242 int oval = 1; 357 int oval = 1;
243 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 358 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
247 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 362 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
248 PROT_DNSv4); 363 PROT_DNSv4);
249 364
250 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 365 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
251 { 366 {
252 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 367 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
253 exit (EXIT_FAILURE); 368 return -1;
254 } 369 }
255 370
256 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 371 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
372 ++success;
373 }
374#endif
375
376 /////////////////////////////////////////////////////////////////////////////
377
378 if (!success)
257 } 379 {
258#endif 380 slog (L_ERR, _("no protocols enabled."));
381 return -1;
382 }
383
384 reconnect_all ();
385
386 /////////////////////////////////////////////////////////////////////////////
259 387
260 tap = new tap_device (); 388 tap = new tap_device ();
261 if (!tap) //D this, of course, never catches 389 if (!tap) //D this, of course, never catches
262 { 390 {
263 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 391 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
264 exit (EXIT_FAILURE); 392 return -1;
265 } 393 }
266 394
267 run_script (run_script_cb (this, &vpn::script_if_up), true); 395 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
268 396
397 run_script_cb cb;
398 cb.set<vpn, &vpn::script_if_init> (this);
399
400 if (tap->if_up () &&
401 !run_script (cb, true))
402 {
403 slog (L_ERR, _("interface initialization command '%s' failed."),
404 tap->if_up ());
405 return -1;
406 }
407
408 cb.set<vpn, &vpn::script_if_up> (this);
409 if (!run_script (cb, true))
410 {
411 slog (L_ERR, _("if-up command execution failed."));
412 return -1;
413 }
414
269 tap_ev_watcher.start (tap->fd, EVENT_READ); 415 tap_ev_watcher.start (tap->fd, EV_READ);
270
271 reconnect_all ();
272 416
273 return 0; 417 return 0;
418}
419
420bool
421vpn::drop_privileges ()
422{
423 if (::conf.change_root)
424 {
425 if (!strcmp (::conf.change_root, "/"))
426 {
427 char dir [L_tmpnam];
428 if (!tmpnam (dir))
429 {
430 slog (L_CRIT, _("unable to create anonymous root path."));
431 return false;
432 }
433
434 if (mkdir (dir, 0700))
435 {
436 slog (L_CRIT, _("unable to create anonymous root directory."));
437 return false;
438 }
439
440 if (chdir (dir))
441 {
442 slog (L_CRIT, _("unable to change to anonymous root directory."));
443 return false;
444 }
445
446 if (rmdir (dir))
447 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
448 }
449 else
450 {
451 if (chdir (::conf.change_root))
452 {
453 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
454 return false;
455 }
456 }
457
458 if (chroot ("."))
459 {
460 slog (L_CRIT, _("unable to set new root directory."));
461 return false;
462 }
463
464 if (chdir ("/"))
465 {
466 slog (L_CRIT, _("unable to set cwd to new root directory."));
467 return false;
468 }
469 }
470
471 if (::conf.change_gid)
472 if (setgid (::conf.change_gid))
473 {
474 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
475 return false;
476 }
477
478 if (::conf.change_uid)
479 if (setuid (::conf.change_uid))
480 {
481 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
482 return false;
483 }
484
485 return true;
274} 486}
275 487
276bool 488bool
277vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 489vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
278{ 490{
279#if defined(SOL_IP) && defined(IP_TOS) 491 set_tos (ipv4_fd, ipv4_tos, tos);
280 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
281#endif
282 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 492 xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
283 493
284 return true; 494 return true;
285} 495}
286 496
287static u16 497static u16
… …
309 519
310#if ENABLE_ICMP 520#if ENABLE_ICMP
311bool 521bool
312vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 522vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
313{ 523{
314#if defined(SOL_IP) && defined(IP_TOS)
315 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
316#endif
317
318 pkt->unshift_hdr (4); 524 pkt->unshift_hdr (4);
319 525
320 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 526 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
321 hdr->type = ::conf.icmp_type; 527 hdr->type = ::conf.icmp_type;
322 hdr->code = 255; 528 hdr->code = 255;
323 hdr->checksum = 0; 529 hdr->checksum = 0;
324 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 530 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
325 531
532 set_tos (icmpv4_fd, icmpv4_tos, tos);
326 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 533 xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
327 534
328 return true; 535 return true;
329} 536}
330#endif 537#endif
331 538
332bool 539bool
333vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 540vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
334{ 541{
335#if defined(SOL_IP) && defined(IP_TOS) 542 set_tos (udpv4_fd, udpv4_tos, tos);
336 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
337#endif
338 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 543 xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
339 544
340 return true; 545 return true;
341} 546}
342 547
343void 548void
… …
353 { 558 {
354 // broadcast, this is ugly, but due to the security policy 559 // broadcast, this is ugly, but due to the security policy
355 // we have to connect to all hosts... 560 // we have to connect to all hosts...
356 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 561 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
357 if ((*c)->conf != THISNODE) 562 if ((*c)->conf != THISNODE)
358 (*c)->inject_data_packet (pkt, true); 563 (*c)->inject_data_packet (pkt);
359 } 564 }
360} 565}
361 566
362void 567void
363vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 568vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
364{ 569{
365 unsigned int src = pkt->src (); 570 unsigned int src = pkt->src ();
366 unsigned int dst = pkt->dst (); 571 unsigned int dst = pkt->dst ();
367 572
368 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 573 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
369 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 574 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
370 575
371 if (src == 0 || src > conns.size () 576 if (src == 0 || src > conns.size ()
372 || dst > conns.size () 577 || dst > conns.size ()
373 || pkt->typ () >= vpn_packet::PT_MAX) 578 || pkt->typ () >= vpn_packet::PT_MAX)
374 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 579 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
375 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
376 else if (dst > conns.size ())
377 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
378 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 580 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
379 else 581 else
380 { 582 {
381 connection *c = conns[src - 1]; 583 connection *c = conns[src - 1];
382 584
383 if (dst == 0) 585 if (dst == 0)
384 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 586 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
385 c->conf->nodename, (const char *)rsi); 587 c->conf->nodename, (const char *)rsi);
386 else if (dst != THISNODE->id) 588 else if (dst != THISNODE->id)
387 { 589 {
388 if (THISNODE->routerprio) 590 if (THISNODE->routerprio)
389 // the tos setting gets lost here. who cares. 591 // the tos setting gets lost here. who cares.
390 conns[dst - 1]->inject_vpn_packet (pkt); 592 conns[dst - 1]->inject_vpn_packet (pkt);
391 else 593 else
392 slog (L_WARN, 594 slog (L_WARN,
393 _("%s(%s): forwarding request (=> %s), but we are no router"), 595 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
394 c->conf->nodename, (const char *)rsi, 596 c->conf->nodename, (const char *)rsi,
395 conns[dst - 1]->conf->nodename); 597 conns[dst - 1]->conf->nodename);
396 } 598 }
397 else 599 else
398 c->recv_vpn_packet (pkt, rsi); 600 c->recv_vpn_packet (pkt, rsi);
… …
403vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 605vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
404{ 606{
405 switch (si.prot) 607 switch (si.prot)
406 { 608 {
407 case PROT_IPv4: 609 case PROT_IPv4:
408 return send_ipv4_packet (pkt, si, tos); 610 return send_ipv4_packet (pkt, si, tos);
611
409 case PROT_UDPv4: 612 case PROT_UDPv4:
410 return send_udpv4_packet (pkt, si, tos); 613 return send_udpv4_packet (pkt, si, tos);
614
411#if ENABLE_TCP 615#if ENABLE_TCP
412 case PROT_TCPv4: 616 case PROT_TCPv4:
413 return send_tcpv4_packet (pkt, si, tos); 617 return send_tcpv4_packet (pkt, si, tos);
414#endif 618#endif
415#if ENABLE_ICMP 619#if ENABLE_ICMP
416 case PROT_ICMPv4: 620 case PROT_ICMPv4:
417 return send_icmpv4_packet (pkt, si, tos); 621 return send_icmpv4_packet (pkt, si, tos);
418#endif 622#endif
419#if ENABLE_DNS 623#if ENABLE_DNS
420 case PROT_DNSv4: 624 case PROT_DNSv4:
421 return send_dnsv4_packet (pkt, si, tos); 625 return send_dnsv4_packet (pkt, si, tos);
422#endif 626#endif
423
424 default: 627 default:
425 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 628 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
426 } 629 }
427 630
428 return false; 631 return false;
429} 632}
430 633
431void 634inline void
432vpn::ipv4_ev (io_watcher &w, short revents) 635vpn::ipv4_ev (ev::io &w, int revents)
433{ 636{
434 if (revents & EVENT_READ) 637 if (revents & EV_READ)
435 { 638 {
436 vpn_packet *pkt = new vpn_packet; 639 vpn_packet *pkt = new vpn_packet;
437 struct sockaddr_in sa; 640 struct sockaddr_in sa;
438 socklen_t sa_len = sizeof (sa); 641 socklen_t sa_len = sizeof (sa);
439 int len; 642 int len;
… …
445 if (len > 0) 648 if (len > 0)
446 { 649 {
447 pkt->len = len; 650 pkt->len = len;
448 651
449 // raw sockets deliver the ipv4 header, but don't expect it on sends 652 // raw sockets deliver the ipv4 header, but don't expect it on sends
450 pkt->skip_hdr (IP_OVERHEAD); 653 pkt->skip_hdr (pkt->ipv4_hdr_len ());
451 654
452 recv_vpn_packet (pkt, si); 655 recv_vpn_packet (pkt, si);
453 } 656 }
454 else 657 else
455 { 658 {
456 // probably ECONNRESET or somesuch 659 // probably ECONNRESET or somesuch
457 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 660 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
458 } 661 }
459 662
460 delete pkt; 663 delete pkt;
461 } 664 }
462 else 665 else
463 { 666 {
464 slog (L_ERR, 667 slog (L_ERR,
465 _("FATAL: unknown revents %08x in socket, terminating\n"), 668 _("FATAL: unknown revents %08x in socket, exiting.\n"),
466 revents); 669 revents);
467 exit (EXIT_FAILURE); 670 exit (EXIT_FAILURE);
468 } 671 }
469} 672}
470 673
471#if ENABLE_ICMP 674#if ENABLE_ICMP
472void 675inline void
473vpn::icmpv4_ev (io_watcher &w, short revents) 676vpn::icmpv4_ev (ev::io &w, int revents)
474{ 677{
475 if (revents & EVENT_READ) 678 if (revents & EV_READ)
476 { 679 {
477 vpn_packet *pkt = new vpn_packet; 680 vpn_packet *pkt = new vpn_packet;
478 struct sockaddr_in sa; 681 struct sockaddr_in sa;
479 socklen_t sa_len = sizeof (sa); 682 socklen_t sa_len = sizeof (sa);
480 int len; 683 int len;
… …
492 if (hdr->type == ::conf.icmp_type 695 if (hdr->type == ::conf.icmp_type
493 && hdr->code == 255) 696 && hdr->code == 255)
494 { 697 {
495 // raw sockets deliver the ipv4, but don't expect it on sends 698 // raw sockets deliver the ipv4, but don't expect it on sends
496 // this is slow, but... 699 // this is slow, but...
497 pkt->skip_hdr (ICMP_OVERHEAD); 700 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
498 701
499 recv_vpn_packet (pkt, si); 702 recv_vpn_packet (pkt, si);
500 } 703 }
501 } 704 }
502 else 705 else
503 { 706 {
504 // probably ECONNRESET or somesuch 707 // probably ECONNRESET or somesuch
505 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 708 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
506 } 709 }
507 710
508 delete pkt; 711 delete pkt;
509 } 712 }
510 else 713 else
511 { 714 {
512 slog (L_ERR, 715 slog (L_ERR,
513 _("FATAL: unknown revents %08x in socket, terminating\n"), 716 _("FATAL: unknown revents %08x in socket, exiting.\n"),
514 revents); 717 revents);
515 exit (EXIT_FAILURE); 718 exit (EXIT_FAILURE);
516 } 719 }
517} 720}
518#endif 721#endif
519 722
520void 723inline void
521vpn::udpv4_ev (io_watcher &w, short revents) 724vpn::udpv4_ev (ev::io &w, int revents)
522{ 725{
523 if (revents & EVENT_READ) 726 if (revents & EV_READ)
524 { 727 {
525 vpn_packet *pkt = new vpn_packet; 728 vpn_packet *pkt = new vpn_packet;
526 struct sockaddr_in sa; 729 struct sockaddr_in sa;
527 socklen_t sa_len = sizeof (sa); 730 socklen_t sa_len = sizeof (sa);
528 int len; 731 int len;
… …
538 recv_vpn_packet (pkt, si); 741 recv_vpn_packet (pkt, si);
539 } 742 }
540 else 743 else
541 { 744 {
542 // probably ECONNRESET or somesuch 745 // probably ECONNRESET or somesuch
543 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 746 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
544 } 747 }
545 748
546 delete pkt; 749 delete pkt;
547 } 750 }
548 else 751 else
549 { 752 {
550 slog (L_ERR, 753 slog (L_ERR,
551 _("FATAL: unknown revents %08x in socket, terminating\n"), 754 _("FATAL: unknown revents %08x in socket, exiting.\n"),
552 revents); 755 revents);
553 exit (EXIT_FAILURE); 756 exit (EXIT_FAILURE);
554 } 757 }
555} 758}
556 759
557void 760inline void
558vpn::tap_ev (io_watcher &w, short revents) 761vpn::tap_ev (ev::io &w, int revents)
559{ 762{
560 if (revents & EVENT_READ) 763 if (revents & EV_READ)
561 { 764 {
562 /* process data */ 765 /* process data */
563 tap_packet *pkt; 766 tap_packet *pkt;
564 767
565 pkt = tap->recv (); 768 pkt = tap->recv ();
… …
594 } 797 }
595 else 798 else
596 abort (); 799 abort ();
597} 800}
598 801
599void 802inline void
600vpn::event_cb (time_watcher &w) 803vpn::event_cb (ev::timer &w, int)
601{ 804{
602 if (events) 805 if (events)
603 { 806 {
604 if (events & EVENT_SHUTDOWN) 807 if (events & EVENT_SHUTDOWN)
605 { 808 {
606 slog (L_INFO, _("preparing shutdown...")); 809 slog (L_INFO, _("preparing shutdown..."));
607 810
608 shutdown_all (); 811 shutdown_all ();
609 remove_pid (conf.pidfilename); 812 remove_pid (conf.pidfilename);
610 slog (L_INFO, _("terminating")); 813 slog (L_INFO, _("exiting."));
611 exit (EXIT_SUCCESS); 814 exit (EXIT_SUCCESS);
612 } 815 }
613 816
614 if (events & EVENT_RECONNECT) 817 if (events & EVENT_RECONNECT)
615 { 818 {
616 slog (L_INFO, _("forced reconnect")); 819 slog (L_INFO, _("forced reconnect."));
617 820
618 reconnect_all (); 821 reconnect_all ();
619 } 822 }
620 823
621 events = 0; 824 events = 0;
… …
637 840
638 conns.clear (); 841 conns.clear ();
639 842
640 connection_init (); 843 connection_init ();
641 844
642 for (configuration::node_vector::iterator i = conf.nodes.begin (); 845 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
643 i != conf.nodes.end (); ++i) 846 conns.push_back (new connection (this, *i));
644 { 847
645 connection *conn = new connection (this, *i); 848 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
646 conns.push_back (conn);
647 conn->establish_connection (); 849 (*c)->establish_connection ();
648 }
649} 850}
650 851
651connection *vpn::find_router () 852bool
853vpn::can_direct (conf_node *src, conf_node *dst) const
652{ 854{
653 u32 prio = 1; 855 return src != dst
856 && src->may_direct (dst)
857 && dst->may_direct (src)
858 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
859 || (src->protocols & dst->connectable_protocols ()));
860}
861
862// only works for indirect and routed connections: find a router
863// from THISNODE to dst
864connection *
865vpn::find_router_for (const connection *dst)
866{
654 connection *router = 0; 867 connection *router = 0;
655 868
869 // first try to find a router with a direct connection, route there
870 // regardless of any other considerations.
871 {
872 u32 prio = 1;
873
874 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
875 {
876 connection *c = *i;
877
878 if (c->conf->routerprio > prio
879 && c->conf != THISNODE
880 && can_direct (c->conf, dst->conf)
881 && c->ictx && c->octx)
882 {
883 prio = c->conf->routerprio;
884 router = c;
885 }
886 }
887 }
888
889 if (router)
890 return router;
891
892 // second try find the router with the highest priority, higher than ours
893 {
894 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
895
896 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
897 {
898 connection *c = *i;
899
900 if (c->conf->routerprio > prio
901 && c != dst
902 && c->conf != THISNODE
903 && c->ictx && c->octx)
904 {
905 prio = c->conf->routerprio;
906 router = c;
907 }
908 }
909 }
910
911 return router;
912}
913
914void
915vpn::connection_established (connection *c)
916{
656 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 917 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
657 { 918 {
658 connection *c = *i; 919 connection *o = *i;
659 920
660 if (c->conf->routerprio > prio 921 if (o->si.valid ()
661 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 922 && c->si != o->si
662 && c->ictx && c->octx 923 && c == find_router_for (o)
663 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 924 && !can_direct (THISNODE, o->conf))
664 {
665 prio = c->conf->routerprio;
666 router = c;
667 } 925 {
926 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
927 o->conf->nodename, c->conf->nodename);
928 o->rekey ();
929 }
668 } 930 }
669
670 return router;
671} 931}
672 932
933void
673void vpn::send_connect_request (int id) 934vpn::send_connect_request (connection *c)
674{ 935{
675 connection *c = find_router (); 936 connection *r = find_router_for (c);
676 937
677 if (c) 938 if (r)
939 {
940 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
941 c->conf->nodename, r->conf->nodename);
678 c->send_connect_request (id); 942 r->send_connect_request (c->conf->id);
943 }
679 else 944 else
680 // no router found, aggressively connect to all routers 945 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
681 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 946 c->conf->nodename);
682 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
683 (*i)->establish_connection ();
684} 947}
685 948
686void 949void
687connection::dump_status () 950connection::dump_status ()
688{ 951{
689 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 952 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
690 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 953 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
691 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 954 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
692 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 955 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
693 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 956 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
694 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
695 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
696} 957}
697 958
698void 959void
699vpn::dump_status () 960vpn::dump_status ()
700{ 961{
701 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 962 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
702 963
703 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 964 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
704 (*c)->dump_status (); 965 (*c)->dump_status ();
705 966
706 slog (L_NOTICE, _("END status dump")); 967 slog (L_NOTICE, _("END status dump"));
707} 968}
708 969
709vpn::vpn (void) 970vpn::vpn (void)
971{
710: event (this, &vpn::event_cb) 972 event .set<vpn, &vpn::event_cb > (this);
711, udpv4_ev_watcher (this, &vpn::udpv4_ev) 973 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
712, ipv4_ev_watcher (this, &vpn::ipv4_ev) 974 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
713#if ENABLE_TCP 975#if ENABLE_TCP
714, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 976 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
715#endif 977#endif
716#if ENABLE_ICMP 978#if ENABLE_ICMP
717, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 979 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
718#endif 980#endif
719#if ENABLE_DNS 981#if ENABLE_DNS
720, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 982 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
721#endif 983#endif
722, tap_ev_watcher (this, &vpn::tap_ev) 984 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
723{
724} 985}
725 986
726vpn::~vpn () 987vpn::~vpn ()
727{ 988{
728} 989}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines