ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.30 by pcg, Fri Mar 4 20:26:50 2005 UTC vs.
Revision 1.50 by pcg, Sun Aug 10 02:49:21 2008 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
51const char *vpn::script_if_up () 61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
73void
74vpn::script_init_env ()
52{ 75{
53 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
54 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
55 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 78 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
56 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 79 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
57 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
58 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
59 82
60 char *env; 83 char *env;
61 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
62 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
63 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
64 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
65 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 86 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
66 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 87 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
67 asprintf (&env, "MTU=%d", mtu); putenv (env); 88 asprintf (&env, "MTU=%d", mtu); putenv (env);
68 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 89 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
69 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 90 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
70 THISNODE->id & 0xff);
71 putenv (env);
72 91
92 conns [THISNODE->id - 1]->script_init_env ("");
93
94 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
95 {
96 char ext[16];
97 snprintf (ext, 16, "_%d", (*c)->conf->id);
98 (*c)->script_init_env (ext);
99 }
100}
101
102inline const char *
103vpn::script_if_init ()
104{
105 script_init_env ();
106
107 return tap->if_up ();
108}
109
110inline const char *
111vpn::script_if_up ()
112{
113 script_init_env ();
114
115 char *filename;
116 asprintf (&filename,
117 "%s/%s",
118 confbase,
73 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 119 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
120
121 return filename;
74} 122}
75 123
76int 124int
77vpn::setup () 125vpn::setup ()
78{ 126{
127 ipv4_tos = -1;
79 ipv4_fd = -1; 128 ipv4_fd = -1;
80 129
81 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 130 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
82 { 131 {
83 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 132 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
84 133
85 if (ipv4_fd < 0) 134 if (ipv4_fd < 0)
86 return -1; 135 return -1;
87 136
88 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK); 137 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
138 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
89 139
90#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 140#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
91 // this I really consider a linux bug. I am neither connected 141 // this I really consider a linux bug. I am neither connected
92 // nor do I fragment myself. Linux still sets DF and doesn't 142 // nor do I fragment myself. Linux still sets DF and doesn't
93 // fragment for me sometimes. 143 // fragment for me sometimes.
99 149
100 sockinfo si (THISNODE, PROT_IPv4); 150 sockinfo si (THISNODE, PROT_IPv4);
101 151
102 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 152 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
103 { 153 {
104 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 154 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
105 exit (EXIT_FAILURE); 155 exit (EXIT_FAILURE);
106 } 156 }
107 157
108 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 158 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
109 } 159 }
110 160
161 udpv4_tos = -1;
111 udpv4_fd = -1; 162 udpv4_fd = -1;
112 163
113 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 164 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
114 { 165 {
115 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 166 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
116 167
117 if (udpv4_fd < 0) 168 if (udpv4_fd < 0)
118 return -1; 169 return -1;
119 170
120 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK); 171 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
172 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
121 173
122 // standard daemon practise... 174 // standard daemon practise...
123 { 175 {
124 int oval = 1; 176 int oval = 1;
125 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 177 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
137 189
138 sockinfo si (THISNODE, PROT_UDPv4); 190 sockinfo si (THISNODE, PROT_UDPv4);
139 191
140 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 192 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
141 { 193 {
142 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 194 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 195 exit (EXIT_FAILURE);
144 } 196 }
145 197
146 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 198 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
147 } 199 }
148 200
201 icmpv4_tos = -1;
149 icmpv4_fd = -1; 202 icmpv4_fd = -1;
150 203
151#if ENABLE_ICMP 204#if ENABLE_ICMP
152 if (THISNODE->protocols & PROT_ICMPv4) 205 if (THISNODE->protocols & PROT_ICMPv4)
153 { 206 {
154 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 207 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
155 208
156 if (icmpv4_fd < 0) 209 if (icmpv4_fd < 0)
157 return -1; 210 return -1;
158 211
159 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK); 212 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
213 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
160 214
161#ifdef ICMP_FILTER 215#ifdef ICMP_FILTER
162 { 216 {
163 icmp_filter oval; 217 icmp_filter oval;
164 oval.data = 0xffffffff; 218 oval.data = 0xffffffff;
173 // this I really consider a linux bug. I am neither connected 227 // this I really consider a linux bug. I am neither connected
174 // nor do I fragment myself. Linux still sets DF and doesn't 228 // nor do I fragment myself. Linux still sets DF and doesn't
175 // fragment for me sometimes. 229 // fragment for me sometimes.
176 { 230 {
177 int oval = IP_PMTUDISC_DONT; 231 int oval = IP_PMTUDISC_DONT;
178 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 232 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
179 } 233 }
180#endif 234#endif
181 235
182 sockinfo si (THISNODE, PROT_ICMPv4); 236 sockinfo si (THISNODE, PROT_ICMPv4);
183 237
184 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 238 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
185 { 239 {
186 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 240 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
187 exit (EXIT_FAILURE); 241 exit (EXIT_FAILURE);
188 } 242 }
189 243
190 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 244 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
191 } 245 }
192#endif 246#endif
193 247
194 tcpv4_fd = -1; 248 tcpv4_fd = -1;
195 249
200 254
201 if (tcpv4_fd < 0) 255 if (tcpv4_fd < 0)
202 return -1; 256 return -1;
203 257
204 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK); 258 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
259 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
205 260
206 // standard daemon practise... 261 // standard daemon practise...
207 { 262 {
208 int oval = 1; 263 int oval = 1;
209 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 264 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
211 266
212 sockinfo si (THISNODE, PROT_TCPv4); 267 sockinfo si (THISNODE, PROT_TCPv4);
213 268
214 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 269 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
215 { 270 {
216 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 271 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
217 exit (EXIT_FAILURE); 272 exit (EXIT_FAILURE);
218 } 273 }
219 274
220 if (listen (tcpv4_fd, 5)) 275 if (listen (tcpv4_fd, 5))
221 { 276 {
222 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 277 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
223 exit (EXIT_FAILURE); 278 exit (EXIT_FAILURE);
224 } 279 }
225 280
226 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 281 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
227 } 282 }
228#endif 283#endif
284
285 dnsv4_tos = -1;
286 dnsv4_fd = -1;
229 287
230#if ENABLE_DNS 288#if ENABLE_DNS
231 if (THISNODE->protocols & PROT_DNSv4) 289 if (THISNODE->protocols & PROT_DNSv4)
232 { 290 {
233 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 291 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
235 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 293 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
236 294
237 if (dnsv4_fd < 0) 295 if (dnsv4_fd < 0)
238 return -1; 296 return -1;
239 297
298 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
299 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
300
301# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
302 // this I really consider a linux bug. I am neither connected
303 // nor do I fragment myself. Linux still sets DF and doesn't
304 // fragment for me sometimes.
305 {
306 int oval = IP_PMTUDISC_DONT;
307 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
308 }
309# endif
310
240 // standard daemon practise... 311 // standard daemon practise...
241 { 312 {
242 int oval = 1; 313 int oval = 1;
243 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 314 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
244 } 315 }
245 316
246 sockinfo si (THISNODE, PROT_DNSv4); 317 sockinfo si (THISNODE->dns_hostname,
318 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
319 PROT_DNSv4);
247 320
248 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 321 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
249 { 322 {
250 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 323 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
251 exit (EXIT_FAILURE); 324 exit (EXIT_FAILURE);
252 } 325 }
253 326
254 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 327 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
255 } 328 }
256#endif 329#endif
330
331 /////////////////////////////////////////////////////////////////////////////
332
333 reconnect_all ();
334
335 /////////////////////////////////////////////////////////////////////////////
257 336
258 tap = new tap_device (); 337 tap = new tap_device ();
259 if (!tap) //D this, of course, never catches 338 if (!tap) //D this, of course, never catches
260 { 339 {
261 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 340 slog (L_ERR, _("cannot create network interface '%s', exiting."), conf.ifname);
262 exit (EXIT_FAILURE); 341 exit (EXIT_FAILURE);
263 } 342 }
264 343
265 run_script (run_script_cb (this, &vpn::script_if_up), true); 344 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
266 345
346 run_script_cb cb;
347 cb.set<vpn, &vpn::script_if_init> (this);
348
349 if (tap->if_up () &&
350 !run_script (cb, true))
351 {
352 slog (L_ERR, _("interface initialization command '%s' failed, exiting."),
353 tap->if_up ());
354 exit (EXIT_FAILURE);
355 }
356
357 cb.set<vpn, &vpn::script_if_up> (this);
358 if (!run_script (cb, true))
359 {
360 slog (L_ERR, _("if-up command execution failed, exiting."));
361 exit (EXIT_FAILURE);
362 }
363
267 tap_ev_watcher.start (tap->fd, EVENT_READ); 364 tap_ev_watcher.start (tap->fd, EV_READ);
268
269 reconnect_all ();
270 365
271 return 0; 366 return 0;
272} 367}
273 368
274bool 369bool
275vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 370vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
276{ 371{
277#if defined(SOL_IP) && defined(IP_TOS) 372 set_tos (ipv4_fd, ipv4_tos, tos);
278 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
279#endif
280 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 373 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
281 374
282 return true; 375 return true;
283} 376}
284 377
307 400
308#if ENABLE_ICMP 401#if ENABLE_ICMP
309bool 402bool
310vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 403vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
311{ 404{
312#if defined(SOL_IP) && defined(IP_TOS)
313 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
314#endif
315
316 pkt->unshift_hdr (4); 405 pkt->unshift_hdr (4);
317 406
318 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 407 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
319 hdr->type = ::conf.icmp_type; 408 hdr->type = ::conf.icmp_type;
320 hdr->code = 255; 409 hdr->code = 255;
321 hdr->checksum = 0; 410 hdr->checksum = 0;
322 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 411 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
323 412
413 set_tos (icmpv4_fd, icmpv4_tos, tos);
324 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 414 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
325 415
326 return true; 416 return true;
327} 417}
328#endif 418#endif
329 419
330bool 420bool
331vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 421vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
332{ 422{
333#if defined(SOL_IP) && defined(IP_TOS) 423 set_tos (udpv4_fd, udpv4_tos, tos);
334 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
335#endif
336 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 424 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
337 425
338 return true; 426 return true;
339} 427}
340 428
351 { 439 {
352 // broadcast, this is ugly, but due to the security policy 440 // broadcast, this is ugly, but due to the security policy
353 // we have to connect to all hosts... 441 // we have to connect to all hosts...
354 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 442 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
355 if ((*c)->conf != THISNODE) 443 if ((*c)->conf != THISNODE)
356 (*c)->inject_data_packet (pkt, true); 444 (*c)->inject_data_packet (pkt);
357 } 445 }
358} 446}
359 447
360void 448void
361vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 449vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
362{ 450{
363 unsigned int src = pkt->src (); 451 unsigned int src = pkt->src ();
364 unsigned int dst = pkt->dst (); 452 unsigned int dst = pkt->dst ();
365 453
366 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 454 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
367 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 455 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
368 456
369 if (src == 0 || src > conns.size () 457 if (src == 0 || src > conns.size ()
370 || dst > conns.size () 458 || dst > conns.size ()
371 || pkt->typ () >= vpn_packet::PT_MAX) 459 || pkt->typ () >= vpn_packet::PT_MAX)
372 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 460 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
373 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 461 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
374 else if (dst > conns.size ()) 462 else if (dst > conns.size ())
375 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 463 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
376 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 464 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
377 else 465 else
378 { 466 {
379 connection *c = conns[src - 1]; 467 connection *c = conns[src - 1];
380 468
381 if (dst == 0) 469 if (dst == 0)
382 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 470 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
383 c->conf->nodename, (const char *)rsi); 471 c->conf->nodename, (const char *)rsi);
384 else if (dst != THISNODE->id) 472 else if (dst != THISNODE->id)
385 { 473 {
386 if (THISNODE->routerprio) 474 if (THISNODE->routerprio)
387 // the tos setting gets lost here. who cares. 475 // the tos setting gets lost here. who cares.
388 conns[dst - 1]->inject_vpn_packet (pkt); 476 conns[dst - 1]->inject_vpn_packet (pkt);
389 else 477 else
390 slog (L_WARN, 478 slog (L_WARN,
391 _("%s(%s): forwarding request (=> %s), but we are no router"), 479 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
392 c->conf->nodename, (const char *)rsi, 480 c->conf->nodename, (const char *)rsi,
393 conns[dst - 1]->conf->nodename); 481 conns[dst - 1]->conf->nodename);
394 } 482 }
395 else 483 else
396 c->recv_vpn_packet (pkt, rsi); 484 c->recv_vpn_packet (pkt, rsi);
397 } 485 }
398} 486}
399 487
400void 488bool
489vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
490{
491 switch (si.prot)
492 {
493 case PROT_IPv4:
494 return send_ipv4_packet (pkt, si, tos);
495
496 case PROT_UDPv4:
497 return send_udpv4_packet (pkt, si, tos);
498
499#if ENABLE_TCP
500 case PROT_TCPv4:
501 return send_tcpv4_packet (pkt, si, tos);
502#endif
503#if ENABLE_ICMP
504 case PROT_ICMPv4:
505 return send_icmpv4_packet (pkt, si, tos);
506#endif
507#if ENABLE_DNS
508 case PROT_DNSv4:
509 return send_dnsv4_packet (pkt, si, tos);
510#endif
511 default:
512 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
513 }
514
515 return false;
516}
517
518inline void
401vpn::ipv4_ev (io_watcher &w, short revents) 519vpn::ipv4_ev (ev::io &w, int revents)
402{ 520{
403 if (revents & EVENT_READ) 521 if (revents & EV_READ)
404 { 522 {
405 vpn_packet *pkt = new vpn_packet; 523 vpn_packet *pkt = new vpn_packet;
406 struct sockaddr_in sa; 524 struct sockaddr_in sa;
407 socklen_t sa_len = sizeof (sa); 525 socklen_t sa_len = sizeof (sa);
408 int len; 526 int len;
421 recv_vpn_packet (pkt, si); 539 recv_vpn_packet (pkt, si);
422 } 540 }
423 else 541 else
424 { 542 {
425 // probably ECONNRESET or somesuch 543 // probably ECONNRESET or somesuch
426 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 544 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
427 } 545 }
428 546
429 delete pkt; 547 delete pkt;
430 } 548 }
431 else 549 else
432 { 550 {
433 slog (L_ERR, 551 slog (L_ERR,
434 _("FATAL: unknown revents %08x in socket, terminating\n"), 552 _("FATAL: unknown revents %08x in socket, exiting.\n"),
435 revents); 553 revents);
436 exit (EXIT_FAILURE); 554 exit (EXIT_FAILURE);
437 } 555 }
438} 556}
439 557
440#if ENABLE_ICMP 558#if ENABLE_ICMP
441void 559inline void
442vpn::icmpv4_ev (io_watcher &w, short revents) 560vpn::icmpv4_ev (ev::io &w, int revents)
443{ 561{
444 if (revents & EVENT_READ) 562 if (revents & EV_READ)
445 { 563 {
446 vpn_packet *pkt = new vpn_packet; 564 vpn_packet *pkt = new vpn_packet;
447 struct sockaddr_in sa; 565 struct sockaddr_in sa;
448 socklen_t sa_len = sizeof (sa); 566 socklen_t sa_len = sizeof (sa);
449 int len; 567 int len;
469 } 587 }
470 } 588 }
471 else 589 else
472 { 590 {
473 // probably ECONNRESET or somesuch 591 // probably ECONNRESET or somesuch
474 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 592 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
475 } 593 }
476 594
477 delete pkt; 595 delete pkt;
478 } 596 }
479 else 597 else
480 { 598 {
481 slog (L_ERR, 599 slog (L_ERR,
482 _("FATAL: unknown revents %08x in socket, terminating\n"), 600 _("FATAL: unknown revents %08x in socket, exiting.\n"),
483 revents); 601 revents);
484 exit (EXIT_FAILURE); 602 exit (EXIT_FAILURE);
485 } 603 }
486} 604}
487#endif 605#endif
488 606
489void 607inline void
490vpn::udpv4_ev (io_watcher &w, short revents) 608vpn::udpv4_ev (ev::io &w, int revents)
491{ 609{
492 if (revents & EVENT_READ) 610 if (revents & EV_READ)
493 { 611 {
494 vpn_packet *pkt = new vpn_packet; 612 vpn_packet *pkt = new vpn_packet;
495 struct sockaddr_in sa; 613 struct sockaddr_in sa;
496 socklen_t sa_len = sizeof (sa); 614 socklen_t sa_len = sizeof (sa);
497 int len; 615 int len;
507 recv_vpn_packet (pkt, si); 625 recv_vpn_packet (pkt, si);
508 } 626 }
509 else 627 else
510 { 628 {
511 // probably ECONNRESET or somesuch 629 // probably ECONNRESET or somesuch
512 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 630 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
513 } 631 }
514 632
515 delete pkt; 633 delete pkt;
516 } 634 }
517 else 635 else
518 { 636 {
519 slog (L_ERR, 637 slog (L_ERR,
520 _("FATAL: unknown revents %08x in socket, terminating\n"), 638 _("FATAL: unknown revents %08x in socket, exiting.\n"),
521 revents); 639 revents);
522 exit (EXIT_FAILURE); 640 exit (EXIT_FAILURE);
523 } 641 }
524} 642}
525 643
526void 644inline void
527vpn::tap_ev (io_watcher &w, short revents) 645vpn::tap_ev (ev::io &w, int revents)
528{ 646{
529 if (revents & EVENT_READ) 647 if (revents & EV_READ)
530 { 648 {
531 /* process data */ 649 /* process data */
532 tap_packet *pkt; 650 tap_packet *pkt;
533 651
534 pkt = tap->recv (); 652 pkt = tap->recv ();
563 } 681 }
564 else 682 else
565 abort (); 683 abort ();
566} 684}
567 685
568void 686inline void
569vpn::event_cb (time_watcher &w) 687vpn::event_cb (ev::timer &w, int)
570{ 688{
571 if (events) 689 if (events)
572 { 690 {
573 if (events & EVENT_SHUTDOWN) 691 if (events & EVENT_SHUTDOWN)
574 { 692 {
575 slog (L_INFO, _("preparing shutdown...")); 693 slog (L_INFO, _("preparing shutdown..."));
576 694
577 shutdown_all (); 695 shutdown_all ();
578 remove_pid (conf.pidfilename); 696 remove_pid (conf.pidfilename);
579 slog (L_INFO, _("terminating")); 697 slog (L_INFO, _("exiting."));
580 exit (EXIT_SUCCESS); 698 exit (EXIT_SUCCESS);
581 } 699 }
582 700
583 if (events & EVENT_RECONNECT) 701 if (events & EVENT_RECONNECT)
584 { 702 {
585 slog (L_INFO, _("forced reconnect")); 703 slog (L_INFO, _("forced reconnect."));
586 704
587 reconnect_all (); 705 reconnect_all ();
588 } 706 }
589 707
590 events = 0; 708 events = 0;
606 724
607 conns.clear (); 725 conns.clear ();
608 726
609 connection_init (); 727 connection_init ();
610 728
611 for (configuration::node_vector::iterator i = conf.nodes.begin (); 729 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
612 i != conf.nodes.end (); ++i) 730 conns.push_back (new connection (this, *i));
613 { 731
614 connection *conn = new connection (this, *i); 732 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
615 conns.push_back (conn);
616 conn->establish_connection (); 733 (*c)->establish_connection ();
617 }
618} 734}
619 735
620connection *vpn::find_router () 736bool vpn::can_direct (conf_node *src, conf_node *dst) const
621{ 737{
622 u32 prio = 1; 738 return src != dst
739 && src->may_direct (dst)
740 && dst->may_direct (src)
741 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
742 || (src->protocols & dst->connectable_protocols ()));
743}
744
745// only works for indirect and routed connections: find a router
746// from THISNODE to dst
747connection *vpn::find_router_for (const connection *dst)
748{
623 connection *router = 0; 749 connection *router = 0;
624 750
751 // first try to find a router with a direct connection
752 {
753 u32 prio = 1;
754
755 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
756 {
757 connection *c = *i;
758
759 if (c->conf->routerprio > prio
760 && c->conf != THISNODE
761 && c != dst
762 && can_direct (c->conf, dst->conf))
763 {
764 if (c->ictx && c->octx)
765 {
766 prio = c->conf->routerprio;
767 router = c;
768 }
769 else
770 c->establish_connection ();
771 }
772 }
773 }
774
775 if (router)
776 return router;
777
778 // second try find the router with the highest priority higher than ours
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf->routerprio > THISNODE->routerprio
788 && c != dst
789 && c->conf != THISNODE)
790 {
791 if (c->ictx && c->octx)
792 {
793 prio = c->conf->routerprio;
794 router = c;
795 }
796 else
797 c->establish_connection ();
798 }
799 }
800 }
801 return router;
802}
803
804void vpn::connection_established (connection *c)
805{
625 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 806 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
626 { 807 {
627 connection *c = *i; 808 connection *o = *i;
628 809
629 if (c->conf->routerprio > prio 810 if (!o->is_direct
630 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 811 && o->si.valid ()
631 && c->ictx && c->octx 812 && c->si != o->si
632 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 813 && c == find_router_for (o))
633 {
634 prio = c->conf->routerprio;
635 router = c;
636 } 814 {
815 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
816 o->conf->nodename, c->conf->nodename);
817 o->rekey ();
818 }
637 } 819 }
638
639 return router;
640} 820}
641 821
642void vpn::send_connect_request (int id) 822void vpn::send_connect_request (connection *c)
643{ 823{
644 connection *c = find_router (); 824 connection *r = find_router_for (c);
645 825
646 if (c) 826 if (r)
827 {
828 slog (L_TRACE, _("%s: no way to connect, sending mediated connection request via %s."),
829 c->conf->nodename, r->conf->nodename);
647 c->send_connect_request (id); 830 r->send_connect_request (c->conf->id);
831 }
648 else 832 else
649 // no router found, aggressively connect to all routers 833 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect."),
650 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 834 c->conf->nodename);
651 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
652 (*i)->establish_connection ();
653} 835}
654 836
655void 837void
656connection::dump_status () 838connection::dump_status ()
657{ 839{
658 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 840 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
659 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 841 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
660 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 842 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
661 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 843 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
662 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 844 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
663 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
664 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
665} 845}
666 846
667void 847void
668vpn::dump_status () 848vpn::dump_status ()
669{ 849{
670 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 850 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
671 851
672 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 852 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
673 (*c)->dump_status (); 853 (*c)->dump_status ();
674 854
675 slog (L_NOTICE, _("END status dump")); 855 slog (L_NOTICE, _("END status dump"));
676} 856}
677 857
678vpn::vpn (void) 858vpn::vpn (void)
859{
679: event (this, &vpn::event_cb) 860 event .set<vpn, &vpn::event_cb > (this);
680, udpv4_ev_watcher (this, &vpn::udpv4_ev) 861 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
681, ipv4_ev_watcher (this, &vpn::ipv4_ev) 862 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
682#if ENABLE_TCP 863#if ENABLE_TCP
683, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 864 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
684#endif 865#endif
685#if ENABLE_ICMP 866#if ENABLE_ICMP
686, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 867 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
687#endif 868#endif
688#if ENABLE_DNS 869#if ENABLE_DNS
689, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 870 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
690#endif 871#endif
691, tap_ev_watcher (this, &vpn::tap_ev) 872 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
692{
693} 873}
694 874
695vpn::~vpn () 875vpn::~vpn ()
696{ 876{
697} 877}

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines