[ViewVC] Diff of: cvs/gvpe/src/vpn.C

Comparing gvpe/src/vpn.C (file contents):
Revision 1.36 by pcg, Fri Apr 8 16:48:16 2005 UTC vs.
Revision 1.70 by root, Thu Oct 6 03:03:09 2022 UTC

…		…
1	/*	1	/*
2	vpn.C -- handle the protocol, encryption, handshaking etc.	2	vpn.C -- handle the protocol, encryption, handshaking etc.
3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>	3	Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4		4
5	This file is part of GVPE.	5	This file is part of GVPE.
6		6
7	GVPE is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
8	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
9	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
10	(at your option) any later version.	10	option) any later version.
11		11
12	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
13	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15	GNU General Public License for more details.	15	Public License for more details.
16		16
17	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
18	along with gvpe; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
20	*/	30	*/
21		31
22	#include "config.h"	32	#include "config.h"
23		33
24	#include <list>	34	#include <list>
28	#include <cstdlib>	38	#include <cstdlib>
29		39
30	#include <sys/types.h>	40	#include <sys/types.h>
31	#include <sys/socket.h>	41	#include <sys/socket.h>
32	#include <sys/wait.h>	42	#include <sys/wait.h>
		43	#include <sys/stat.h>
33	#include <errno.h>	44	#include <errno.h>
34	#include <time.h>	45	#include <time.h>
35	#include <unistd.h>	46	#include <unistd.h>
36	#include <fcntl.h>	47	#include <fcntl.h>
37	#include <sys/socket.h>	48	#include <sys/socket.h>
…		…
42		53
43	#include "connection.h"	54	#include "connection.h"
44	#include "util.h"	55	#include "util.h"
45	#include "vpn.h"	56	#include "vpn.h"
46		57
		58	using namespace std;
		59
47	vpn network; // THE vpn (bad design...)	60	vpn network; // THE vpn (bad design...)
48		61
49	/////////////////////////////////////////////////////////////////////////////	62	/////////////////////////////////////////////////////////////////////////////
		63
		64	// hopefully temporary workaround for rare buffer full conditions
		65	// if it happens, usually instantly retrying or retrying ~5ms later
		66	// is good enough with current network technologies/kernels
		67
		68	static ssize_t
		69	xsendto (int fd, const void *buf, size_t len, int flags,
		70	const struct sockaddr *sa, socklen_t salen)
		71	{
		72	ssize_t res;
		73
		74	for (int retry = 0; retry <= 13; ++retry) // ~100ms
		75	{
		76	res = sendto (fd, buf, len, flags, sa, salen);
		77
		78	if (res >= 0 \|\| errno != ENOBUFS)
		79	break;
		80
		81	struct timespec ts = { 0, 1000 * retry };
		82	nanosleep (&ts, 0);
		83	}
		84
		85	return res;
		86	}
		87
		88	/////////////////////////////////////////////////////////////////////////////
		89
		90	static void inline
		91	set_tos (int fd, int &tos_prev, int tos)
		92	{
		93	#if defined(SOL_IP) && defined(IP_TOS)
		94	if (tos_prev == tos)
		95	return;
		96
		97	tos_prev = tos;
		98	setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
		99	#endif
		100	}
50		101
51	void	102	void
52	vpn::script_init_env ()	103	vpn::script_init_env ()
53	{	104	{
54	// the tunnel device mtu should be the physical mtu - overhead	105	// the tunnel device mtu should be the physical mtu - overhead
55	// the tricky part is rounding to the cipher key blocksize	106	// the tricky part is rounding to the cipher key blocksize
56	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;	107	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
57	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion	108	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
58	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round	109	mtu -= mtu % BLOCK_SIZE (CIPHER); // round
59	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again	110	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
60		111
61	char *env;	112	char *env;
62	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);	113	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
63	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);	114	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
…		…
75	snprintf (ext, 16, "_%d", (*c)->conf->id);	126	snprintf (ext, 16, "_%d", (*c)->conf->id);
76	(*c)->script_init_env (ext);	127	(*c)->script_init_env (ext);
77	}	128	}
78	}	129	}
79		130
		131	inline const char *
80	const char *vpn::script_if_init ()	132	vpn::script_if_init ()
81	{	133	{
82	script_init_env ();	134	script_init_env ();
83		135
84	return tap->if_up ();	136	return tap->if_up ();
85	}	137	}
86		138
		139	inline const char *
87	const char *vpn::script_if_up ()	140	vpn::script_if_up ()
88	{	141	{
89	script_init_env ();	142	script_init_env ();
90		143
91	char *filename;	144	return conf.config_filename (::conf.script_if_up, "if-up");
92	asprintf (&filename,	145	}
93	"%s/%s",
94	confbase,
95	::conf.script_if_up ? ::conf.script_if_up : "if-up");
96		146
97	return filename;	147	int
		148	vpn::setup_socket (u8 prot, int family, int type, int proto)
		149	{
		150	int fd = socket (family, type, proto);
		151
		152	if (fd < 0)
		153	{
		154	slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
		155	return fd;
		156	}
		157
		158	fcntl (fd, F_SETFL, O_NONBLOCK);
		159	fcntl (fd, F_SETFD, FD_CLOEXEC);
		160
		161	#ifdef SO_MARK
		162	if (::conf.nfmark)
		163	if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
		164	slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
		165	#endif
		166
		167	return fd;
98	}	168	}
99		169
100	int	170	int
101	vpn::setup ()	171	vpn::setup ()
102	{	172	{
		173	int success = 0;
		174
		175	ipv4_tos = -1;
103	ipv4_fd = -1;	176	ipv4_fd = -1;
104		177
105	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)	178	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106	{	179	{
107	ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);	180	ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
108		181
109	if (ipv4_fd < 0)	182	if (ipv4_fd < 0)
110	return -1;	183	return -1;
111
112	fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
113		184
114	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	185	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
115	// this I really consider a linux bug. I am neither connected	186	// this I really consider a linux bug. I am neither connected
116	// nor do I fragment myself. Linux still sets DF and doesn't	187	// nor do I fragment myself. Linux still sets DF and doesn't
117	// fragment for me sometimes.	188	// fragment for me sometimes.
…		…
123		194
124	sockinfo si (THISNODE, PROT_IPv4);	195	sockinfo si (THISNODE, PROT_IPv4);
125		196
126	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))	197	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
127	{	198	{
128	slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));	199	slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
129	exit (EXIT_FAILURE);	200	return -1;
130	}	201	}
131		202
132	ipv4_ev_watcher.start (ipv4_fd, EVENT_READ);	203	ipv4_ev_watcher.start (ipv4_fd, EV_READ);
		204	++success;
133	}	205	}
		206	else
		207	THISNODE->protocols &= ~PROT_IPv4;
134		208
		209	udpv4_tos = -1;
135	udpv4_fd = -1;	210	udpv4_fd = -1;
136		211
137	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)	212	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
138	{	213	{
139	udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	214	udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
140		215
141	if (udpv4_fd < 0)	216	if (udpv4_fd < 0)
142	return -1;	217	return -1;
143
144	fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
145		218
146	// standard daemon practise...	219	// standard daemon practise...
147	{	220	{
148	int oval = 1;	221	int oval = 1;
149	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	222	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
161		234
162	sockinfo si (THISNODE, PROT_UDPv4);	235	sockinfo si (THISNODE, PROT_UDPv4);
163		236
164	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))	237	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
165	{	238	{
166	slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));	239	slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
167	exit (EXIT_FAILURE);	240	return -1;
168	}	241	}
169		242
170	udpv4_ev_watcher.start (udpv4_fd, EVENT_READ);	243	udpv4_ev_watcher.start (udpv4_fd, EV_READ);
		244	++success;
171	}	245	}
		246	else
		247	THISNODE->protocols &= ~PROT_UDPv4;
172		248
		249	icmpv4_tos = -1;
173	icmpv4_fd = -1;	250	icmpv4_fd = -1;
174		251
175	#if ENABLE_ICMP	252	#if ENABLE_ICMP
176	if (THISNODE->protocols & PROT_ICMPv4)	253	if (THISNODE->protocols & PROT_ICMPv4)
177	{	254	{
178	icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);	255	icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
179		256
180	if (icmpv4_fd < 0)	257	if (icmpv4_fd < 0)
181	return -1;	258	return -1;
182		259
183	fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
184
185	#ifdef ICMP_FILTER	260	#ifdef ICMP_FILTER
186	{	261	{
187	icmp_filter oval;	262	icmp_filter oval;
188	oval.data = 0xffffffff;	263	oval.data = 0;
189	if (::conf.icmp_type < 32)	264	if (::conf.icmp_type < 32)
190	oval.data &= ~(1 << ::conf.icmp_type);	265	oval.data \|= 1 << ::conf.icmp_type;
		266	oval.data = ~oval.data;
191		267
192	setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);	268	setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
193	}	269	}
194	#endif	270	#endif
195		271
…		…
205		281
206	sockinfo si (THISNODE, PROT_ICMPv4);	282	sockinfo si (THISNODE, PROT_ICMPv4);
207		283
208	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))	284	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
209	{	285	{
210	slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno));	286	slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
211	exit (EXIT_FAILURE);	287	return -1;
212	}	288	}
213		289
214	icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ);	290	icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
		291	++success;
215	}	292	}
216	#endif	293	#endif
217		294
218	tcpv4_fd = -1;	295	tcpv4_fd = -1;
219		296
220	#if ENABLE_TCP	297	#if ENABLE_TCP
221	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)	298	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
222	{	299	{
223	tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);	300	tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
224		301
225	if (tcpv4_fd < 0)	302	if (tcpv4_fd < 0)
226	return -1;	303	return -1;
227		304
228	fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
229
230	// standard daemon practise...	305	// standard daemon practise...
231	{	306	{
232	int oval = 1;	307	int oval = 1;
233	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	308	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
234	}	309	}
235		310
236	sockinfo si (THISNODE, PROT_TCPv4);	311	sockinfo si (THISNODE, PROT_TCPv4);
237		312
238	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))	313	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
239	{	314	{
240	slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));	315	slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
241	exit (EXIT_FAILURE);	316	return -1;
242	}	317	}
243		318
244	if (listen (tcpv4_fd, 5))	319	if (listen (tcpv4_fd, 5))
245	{	320	{
246	slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));	321	slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
247	exit (EXIT_FAILURE);	322	return -1;
248	}	323	}
249		324
250	tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ);	325	tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
		326	++success;
251	}	327	}
		328	else
		329	THISNODE->protocols &= ~PROT_TCPv4;
252	#endif	330	#endif
		331
		332	dnsv4_tos = -1;
		333	dnsv4_fd = -1;
253		334
254	#if ENABLE_DNS	335	#if ENABLE_DNS
255	if (THISNODE->protocols & PROT_DNSv4)	336	if (THISNODE->protocols & PROT_DNSv4)
256	{	337	{
257	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	338	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
258		339
259	dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	340	dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
260		341
261	if (dnsv4_fd < 0)	342	if (dnsv4_fd < 0)
262	return -1;	343	return -1;
263		344
264	# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	345	# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
…		…
281	THISNODE->dns_hostname ? THISNODE->dns_port : 0,	362	THISNODE->dns_hostname ? THISNODE->dns_port : 0,
282	PROT_DNSv4);	363	PROT_DNSv4);
283		364
284	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))	365	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
285	{	366	{
286	slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno));	367	slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
287	exit (EXIT_FAILURE);	368	return -1;
288	}	369	}
289		370
290	dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ);	371	dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
		372	++success;
291	}	373	}
292	#endif	374	#endif
293		375
294	/////////////////////////////////////////////////////////////////////////////	376	/////////////////////////////////////////////////////////////////////////////
		377
		378	if (!success)
		379	{
		380	slog (L_ERR, _("no protocols enabled."));
		381	return -1;
		382	}
295		383
296	reconnect_all ();	384	reconnect_all ();
297		385
298	/////////////////////////////////////////////////////////////////////////////	386	/////////////////////////////////////////////////////////////////////////////
299		387
300	tap = new tap_device ();	388	tap = new tap_device ();
301	if (!tap) //D this, of course, never catches	389	if (!tap) //D this, of course, never catches
302	{	390	{
303	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);	391	slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
304	exit (EXIT_FAILURE);	392	return -1;
305	}	393	}
306		394
		395	fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
		396
		397	run_script_cb cb;
		398	cb.set<vpn, &vpn::script_if_init> (this);
		399
307	if (tap->if_up () &&	400	if (tap->if_up () &&
308	!run_script (run_script_cb (this, &vpn::script_if_init), true))	401	!run_script (cb, true))
309	{	402	{
310	slog (L_ERR, _("interface initialization command '%s' failed, exiting."),	403	slog (L_ERR, _("interface initialization command '%s' failed."),
311	tap->if_up ());	404	tap->if_up ());
312	exit (EXIT_FAILURE);	405	return -1;
313	}
314
315	if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
316	{	406	}
		407
		408	cb.set<vpn, &vpn::script_if_up> (this);
		409	if (!run_script (cb, true))
		410	{
317	slog (L_ERR, _("if-up command execution failed, exiting."));	411	slog (L_ERR, _("if-up command execution failed."));
318	exit (EXIT_FAILURE);	412	return -1;
319	}	413	}
320		414
321	tap_ev_watcher.start (tap->fd, EVENT_READ);	415	tap_ev_watcher.start (tap->fd, EV_READ);
322		416
323	return 0;	417	return 0;
		418	}
		419
		420	bool
		421	vpn::drop_privileges ()
		422	{
		423	if (::conf.change_root)
		424	{
		425	if (!strcmp (::conf.change_root, "/"))
		426	{
		427	char dir [L_tmpnam];
		428	if (!tmpnam (dir))
		429	{
		430	slog (L_CRIT, _("unable to create anonymous root path."));
		431	return false;
		432	}
		433
		434	if (mkdir (dir, 0700))
		435	{
		436	slog (L_CRIT, _("unable to create anonymous root directory."));
		437	return false;
		438	}
		439
		440	if (chdir (dir))
		441	{
		442	slog (L_CRIT, _("unable to change to anonymous root directory."));
		443	return false;
		444	}
		445
		446	if (rmdir (dir))
		447	slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
		448	}
		449	else
		450	{
		451	if (chdir (::conf.change_root))
		452	{
		453	slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
		454	return false;
		455	}
		456	}
		457
		458	if (chroot ("."))
		459	{
		460	slog (L_CRIT, _("unable to set new root directory."));
		461	return false;
		462	}
		463
		464	if (chdir ("/"))
		465	{
		466	slog (L_CRIT, _("unable to set cwd to new root directory."));
		467	return false;
		468	}
		469	}
		470
		471	if (::conf.change_gid)
		472	if (setgid (::conf.change_gid))
		473	{
		474	slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
		475	return false;
		476	}
		477
		478	if (::conf.change_uid)
		479	if (setuid (::conf.change_uid))
		480	{
		481	slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
		482	return false;
		483	}
		484
		485	return true;
324	}	486	}
325		487
326	bool	488	bool
327	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	489	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
328	{	490	{
329	#if defined(SOL_IP) && defined(IP_TOS)	491	set_tos (ipv4_fd, ipv4_tos, tos);
330	setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
331	#endif
332	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	492	xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
333		493
334	return true;	494	return true;
335	}	495	}
336		496
337	static u16	497	static u16
…		…
359		519
360	#if ENABLE_ICMP	520	#if ENABLE_ICMP
361	bool	521	bool
362	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	522	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
363	{	523	{
364	#if defined(SOL_IP) && defined(IP_TOS)
365	setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
366	#endif
367
368	pkt->unshift_hdr (4);	524	pkt->unshift_hdr (4);
369		525
370	icmp_header hdr = (icmp_header )&((*pkt)[0]);	526	icmp_header hdr = (icmp_header )&((*pkt)[0]);
371	hdr->type = ::conf.icmp_type;	527	hdr->type = ::conf.icmp_type;
372	hdr->code = 255;	528	hdr->code = 255;
373	hdr->checksum = 0;	529	hdr->checksum = 0;
374	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);	530	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
375		531
		532	set_tos (icmpv4_fd, icmpv4_tos, tos);
376	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	533	xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
377		534
378	return true;	535	return true;
379	}	536	}
380	#endif	537	#endif
381		538
382	bool	539	bool
383	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	540	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
384	{	541	{
385	#if defined(SOL_IP) && defined(IP_TOS)	542	set_tos (udpv4_fd, udpv4_tos, tos);
386	setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
387	#endif
388	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	543	xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
389		544
390	return true;	545	return true;
391	}	546	}
392		547
393	void	548	void
…		…
403	{	558	{
404	// broadcast, this is ugly, but due to the security policy	559	// broadcast, this is ugly, but due to the security policy
405	// we have to connect to all hosts...	560	// we have to connect to all hosts...
406	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	561	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
407	if ((*c)->conf != THISNODE)	562	if ((*c)->conf != THISNODE)
408	(*c)->inject_data_packet (pkt, true);	563	(*c)->inject_data_packet (pkt);
409	}	564	}
410	}	565	}
411		566
412	void	567	void
413	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	568	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
414	{	569	{
415	unsigned int src = pkt->src ();	570	unsigned int src = pkt->src ();
416	unsigned int dst = pkt->dst ();	571	unsigned int dst = pkt->dst ();
417		572
418	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),	573	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
419	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);	574	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
420		575
421	if (src == 0 \|\| src > conns.size ()	576	if (src == 0 \|\| src > conns.size ()
422	\|\| dst > conns.size ()	577	\|\| dst > conns.size ()
423	\|\| pkt->typ () >= vpn_packet::PT_MAX)	578	\|\| pkt->typ () >= vpn_packet::PT_MAX)
424	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	579	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
425	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
426	else if (dst > conns.size ())
427	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
428	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	580	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
429	else	581	else
430	{	582	{
431	connection *c = conns[src - 1];	583	connection *c = conns[src - 1];
432		584
433	if (dst == 0)	585	if (dst == 0)
434	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"),	586	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
435	c->conf->nodename, (const char *)rsi);	587	c->conf->nodename, (const char *)rsi);
436	else if (dst != THISNODE->id)	588	else if (dst != THISNODE->id)
437	{	589	{
438	if (THISNODE->routerprio)	590	if (THISNODE->routerprio)
439	// the tos setting gets lost here. who cares.	591	// the tos setting gets lost here. who cares.
440	conns[dst - 1]->inject_vpn_packet (pkt);	592	conns[dst - 1]->inject_vpn_packet (pkt);
441	else	593	else
442	slog (L_WARN,	594	slog (L_WARN,
443	_("%s(%s): forwarding request (=> %s), but we are no router"),	595	_("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
444	c->conf->nodename, (const char *)rsi,	596	c->conf->nodename, (const char *)rsi,
445	conns[dst - 1]->conf->nodename);	597	conns[dst - 1]->conf->nodename);
446	}	598	}
447	else	599	else
448	c->recv_vpn_packet (pkt, rsi);	600	c->recv_vpn_packet (pkt, rsi);
…		…
453	vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)	605	vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
454	{	606	{
455	switch (si.prot)	607	switch (si.prot)
456	{	608	{
457	case PROT_IPv4:	609	case PROT_IPv4:
458	return send_ipv4_packet (pkt, si, tos);	610	return send_ipv4_packet (pkt, si, tos);
		611
459	case PROT_UDPv4:	612	case PROT_UDPv4:
460	return send_udpv4_packet (pkt, si, tos);	613	return send_udpv4_packet (pkt, si, tos);
		614
461	#if ENABLE_TCP	615	#if ENABLE_TCP
462	case PROT_TCPv4:	616	case PROT_TCPv4:
463	return send_tcpv4_packet (pkt, si, tos);	617	return send_tcpv4_packet (pkt, si, tos);
464	#endif	618	#endif
465	#if ENABLE_ICMP	619	#if ENABLE_ICMP
466	case PROT_ICMPv4:	620	case PROT_ICMPv4:
467	return send_icmpv4_packet (pkt, si, tos);	621	return send_icmpv4_packet (pkt, si, tos);
468	#endif	622	#endif
469	#if ENABLE_DNS	623	#if ENABLE_DNS
470	case PROT_DNSv4:	624	case PROT_DNSv4:
471	return send_dnsv4_packet (pkt, si, tos);	625	return send_dnsv4_packet (pkt, si, tos);
472	#endif	626	#endif
473
474	default:	627	default:
475	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);	628	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
476	}	629	}
477		630
478	return false;	631	return false;
479	}	632	}
480		633
481	void	634	inline void
482	vpn::ipv4_ev (io_watcher &w, short revents)	635	vpn::ipv4_ev (ev::io &w, int revents)
483	{	636	{
484	if (revents & EVENT_READ)	637	if (revents & EV_READ)
485	{	638	{
486	vpn_packet *pkt = new vpn_packet;	639	vpn_packet *pkt = new vpn_packet;
487	struct sockaddr_in sa;	640	struct sockaddr_in sa;
488	socklen_t sa_len = sizeof (sa);	641	socklen_t sa_len = sizeof (sa);
489	int len;	642	int len;
…		…
495	if (len > 0)	648	if (len > 0)
496	{	649	{
497	pkt->len = len;	650	pkt->len = len;
498		651
499	// raw sockets deliver the ipv4 header, but don't expect it on sends	652	// raw sockets deliver the ipv4 header, but don't expect it on sends
500	pkt->skip_hdr (IP_OVERHEAD);	653	pkt->skip_hdr (pkt->ipv4_hdr_len ());
501		654
502	recv_vpn_packet (pkt, si);	655	recv_vpn_packet (pkt, si);
503	}	656	}
504	else	657	else
505	{	658	{
506	// probably ECONNRESET or somesuch	659	// probably ECONNRESET or somesuch
507	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	660	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
508	}	661	}
509		662
510	delete pkt;	663	delete pkt;
511	}	664	}
512	else	665	else
513	{	666	{
514	slog (L_ERR,	667	slog (L_ERR,
515	_("FATAL: unknown revents %08x in socket, terminating\n"),	668	_("FATAL: unknown revents %08x in socket, exiting.\n"),
516	revents);	669	revents);
517	exit (EXIT_FAILURE);	670	exit (EXIT_FAILURE);
518	}	671	}
519	}	672	}
520		673
521	#if ENABLE_ICMP	674	#if ENABLE_ICMP
522	void	675	inline void
523	vpn::icmpv4_ev (io_watcher &w, short revents)	676	vpn::icmpv4_ev (ev::io &w, int revents)
524	{	677	{
525	if (revents & EVENT_READ)	678	if (revents & EV_READ)
526	{	679	{
527	vpn_packet *pkt = new vpn_packet;	680	vpn_packet *pkt = new vpn_packet;
528	struct sockaddr_in sa;	681	struct sockaddr_in sa;
529	socklen_t sa_len = sizeof (sa);	682	socklen_t sa_len = sizeof (sa);
530	int len;	683	int len;
…		…
542	if (hdr->type == ::conf.icmp_type	695	if (hdr->type == ::conf.icmp_type
543	&& hdr->code == 255)	696	&& hdr->code == 255)
544	{	697	{
545	// raw sockets deliver the ipv4, but don't expect it on sends	698	// raw sockets deliver the ipv4, but don't expect it on sends
546	// this is slow, but...	699	// this is slow, but...
547	pkt->skip_hdr (ICMP_OVERHEAD);	700	pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
548		701
549	recv_vpn_packet (pkt, si);	702	recv_vpn_packet (pkt, si);
550	}	703	}
551	}	704	}
552	else	705	else
553	{	706	{
554	// probably ECONNRESET or somesuch	707	// probably ECONNRESET or somesuch
555	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	708	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
556	}	709	}
557		710
558	delete pkt;	711	delete pkt;
559	}	712	}
560	else	713	else
561	{	714	{
562	slog (L_ERR,	715	slog (L_ERR,
563	_("FATAL: unknown revents %08x in socket, terminating\n"),	716	_("FATAL: unknown revents %08x in socket, exiting.\n"),
564	revents);	717	revents);
565	exit (EXIT_FAILURE);	718	exit (EXIT_FAILURE);
566	}	719	}
567	}	720	}
568	#endif	721	#endif
569		722
570	void	723	inline void
571	vpn::udpv4_ev (io_watcher &w, short revents)	724	vpn::udpv4_ev (ev::io &w, int revents)
572	{	725	{
573	if (revents & EVENT_READ)	726	if (revents & EV_READ)
574	{	727	{
575	vpn_packet *pkt = new vpn_packet;	728	vpn_packet *pkt = new vpn_packet;
576	struct sockaddr_in sa;	729	struct sockaddr_in sa;
577	socklen_t sa_len = sizeof (sa);	730	socklen_t sa_len = sizeof (sa);
578	int len;	731	int len;
…		…
588	recv_vpn_packet (pkt, si);	741	recv_vpn_packet (pkt, si);
589	}	742	}
590	else	743	else
591	{	744	{
592	// probably ECONNRESET or somesuch	745	// probably ECONNRESET or somesuch
593	slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno));	746	slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
594	}	747	}
595		748
596	delete pkt;	749	delete pkt;
597	}	750	}
598	else	751	else
599	{	752	{
600	slog (L_ERR,	753	slog (L_ERR,
601	_("FATAL: unknown revents %08x in socket, terminating\n"),	754	_("FATAL: unknown revents %08x in socket, exiting.\n"),
602	revents);	755	revents);
603	exit (EXIT_FAILURE);	756	exit (EXIT_FAILURE);
604	}	757	}
605	}	758	}
606		759
607	void	760	inline void
608	vpn::tap_ev (io_watcher &w, short revents)	761	vpn::tap_ev (ev::io &w, int revents)
609	{	762	{
610	if (revents & EVENT_READ)	763	if (revents & EV_READ)
611	{	764	{
612	/* process data */	765	/* process data */
613	tap_packet *pkt;	766	tap_packet *pkt;
614		767
615	pkt = tap->recv ();	768	pkt = tap->recv ();
…		…
644	}	797	}
645	else	798	else
646	abort ();	799	abort ();
647	}	800	}
648		801
649	void	802	inline void
650	vpn::event_cb (time_watcher &w)	803	vpn::event_cb (ev::timer &w, int)
651	{	804	{
652	if (events)	805	if (events)
653	{	806	{
654	if (events & EVENT_SHUTDOWN)	807	if (events & EVENT_SHUTDOWN)
655	{	808	{
656	slog (L_INFO, _("preparing shutdown..."));	809	slog (L_INFO, _("preparing shutdown..."));
657		810
658	shutdown_all ();	811	shutdown_all ();
659	remove_pid (conf.pidfilename);	812	remove_pid (conf.pidfilename);
660	slog (L_INFO, _("terminating"));	813	slog (L_INFO, _("exiting."));
661	exit (EXIT_SUCCESS);	814	exit (EXIT_SUCCESS);
662	}	815	}
663		816
664	if (events & EVENT_RECONNECT)	817	if (events & EVENT_RECONNECT)
665	{	818	{
666	slog (L_INFO, _("forced reconnect"));	819	slog (L_INFO, _("forced reconnect."));
667		820
668	reconnect_all ();	821	reconnect_all ();
669	}	822	}
670		823
671	events = 0;	824	events = 0;
…		…
687		840
688	conns.clear ();	841	conns.clear ();
689		842
690	connection_init ();	843	connection_init ();
691		844
692	for (configuration::node_vector::iterator i = conf.nodes.begin ();	845	for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
693	i != conf.nodes.end (); ++i)	846	conns.push_back (new connection (this, *i));
694	{	847
695	connection conn = new connection (this, i);	848	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
696	conns.push_back (conn);
697	conn->establish_connection ();	849	(*c)->establish_connection ();
698	}
699	}	850	}
700		851
701	connection *vpn::find_router ()	852	bool
		853	vpn::can_direct (conf_node src, conf_node dst) const
702	{	854	{
703	u32 prio = 1;	855	return src != dst
		856	&& src->may_direct (dst)
		857	&& dst->may_direct (src)
		858	&& (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
		859	\|\| (src->protocols & dst->connectable_protocols ()));
		860	}
		861
		862	// only works for indirect and routed connections: find a router
		863	// from THISNODE to dst
		864	connection *
		865	vpn::find_router_for (const connection *dst)
		866	{
704	connection *router = 0;	867	connection *router = 0;
705		868
		869	// first try to find a router with a direct connection, route there
		870	// regardless of any other considerations.
		871	{
		872	u32 prio = 1;
		873
		874	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		875	{
		876	connection c = i;
		877
		878	if (c->conf->routerprio > prio
		879	&& c->conf != THISNODE
		880	&& can_direct (c->conf, dst->conf)
		881	&& c->ictx && c->octx)
		882	{
		883	prio = c->conf->routerprio;
		884	router = c;
		885	}
		886	}
		887	}
		888
		889	if (router)
		890	return router;
		891
		892	// second try find the router with the highest priority, higher than ours
		893	{
		894	u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
		895
		896	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		897	{
		898	connection c = i;
		899
		900	if (c->conf->routerprio > prio
		901	&& c != dst
		902	&& c->conf != THISNODE
		903	&& c->ictx && c->octx)
		904	{
		905	prio = c->conf->routerprio;
		906	router = c;
		907	}
		908	}
		909	}
		910
		911	return router;
		912	}
		913
		914	void
		915	vpn::connection_established (connection *c)
		916	{
706	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	917	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
707	{	918	{
708	connection c = i;	919	connection o = i;
709		920
710	if (c->conf->routerprio > prio	921	if (o->si.valid ()
711	&& c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use	922	&& c->si != o->si
712	&& c->ictx && c->octx	923	&& c == find_router_for (o)
713	&& c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode	924	&& !can_direct (THISNODE, o->conf))
714	{
715	prio = c->conf->routerprio;
716	router = c;
717	}	925	{
		926	slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
		927	o->conf->nodename, c->conf->nodename);
		928	o->rekey ();
		929	}
718	}	930	}
719
720	return router;
721	}	931	}
722		932
		933	void
723	void vpn::send_connect_request (int id)	934	vpn::send_connect_request (connection *c)
724	{	935	{
725	connection *c = find_router ();	936	connection *r = find_router_for (c);
726		937
727	if (c)	938	if (r)
		939	{
		940	slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
		941	c->conf->nodename, r->conf->nodename);
728	c->send_connect_request (id);	942	r->send_connect_request (c->conf->id);
		943	}
729	else	944	else
730	// no router found, aggressively connect to all routers	945	slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
731	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	946	c->conf->nodename);
732	if ((i)->conf->routerprio && (i)->conf != THISNODE)
733	(*i)->establish_connection ();
734	}	947	}
735		948
736	void	949	void
737	connection::dump_status ()	950	connection::dump_status ()
738	{	951	{
739	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);	952	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
740	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),	953	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
741	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);	954	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
742	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),	955	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
743	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);	956	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
744	slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
745	(long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
746	}	957	}
747		958
748	void	959	void
749	vpn::dump_status ()	960	vpn::dump_status ()
750	{	961	{
751	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);	962	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
752		963
753	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	964	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
754	(*c)->dump_status ();	965	(*c)->dump_status ();
755		966
756	slog (L_NOTICE, _("END status dump"));	967	slog (L_NOTICE, _("END status dump"));
757	}	968	}
758		969
759	vpn::vpn (void)	970	vpn::vpn (void)
		971	{
760	: event (this, &vpn::event_cb)	972	event .set<vpn, &vpn::event_cb > (this);
761	, udpv4_ev_watcher (this, &vpn::udpv4_ev)	973	udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
762	, ipv4_ev_watcher (this, &vpn::ipv4_ev)	974	ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
763	#if ENABLE_TCP	975	#if ENABLE_TCP
764	, tcpv4_ev_watcher (this, &vpn::tcpv4_ev)	976	tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
765	#endif	977	#endif
766	#if ENABLE_ICMP	978	#if ENABLE_ICMP
767	, icmpv4_ev_watcher(this, &vpn::icmpv4_ev)	979	icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
768	#endif	980	#endif
769	#if ENABLE_DNS	981	#if ENABLE_DNS
770	, dnsv4_ev_watcher (this, &vpn::dnsv4_ev)	982	dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
771	#endif	983	#endif
772	, tap_ev_watcher (this, &vpn::tap_ev)	984	tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
773	{
774	}	985	}
775		986
776	vpn::~vpn ()	987	vpn::~vpn ()
777	{	988	{
778	}	989	}

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/vpn.C (file contents): Revision 1.36 by pcg, Fri Apr 8 16:48:16 2005 UTC vs. Revision 1.70 by root, Thu Oct 6 03:03:09 2022 UTC

Diff Legend

Comparing gvpe/src/vpn.C (file contents):
Revision 1.36 by pcg, Fri Apr 8 16:48:16 2005 UTC vs.
Revision 1.70 by root, Thu Oct 6 03:03:09 2022 UTC