[ViewVC] Diff of: cvs/gvpe/src/vpn.C

Comparing gvpe/src/vpn.C (file contents):
Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs.
Revision 1.51 by pcg, Sun Aug 10 14:48:57 2008 UTC

…		…
1	/*	1	/*
2	vpn.C -- handle the protocol, encryption, handshaking etc.	2	vpn.C -- handle the protocol, encryption, handshaking etc.
3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>	3	Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4		4
5	This file is part of GVPE.	5	This file is part of GVPE.
6		6
7	GVPE is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
8	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
9	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
10	(at your option) any later version.	10	option) any later version.
11		11
12	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
13	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15	GNU General Public License for more details.	15	Public License for more details.
16		16
17	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
18	along with gvpe; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
20	*/	30	*/
21		31
22	#include "config.h"	32	#include "config.h"
23		33
24	#include <list>	34	#include <list>
46		56
47	vpn network; // THE vpn (bad design...)	57	vpn network; // THE vpn (bad design...)
48		58
49	/////////////////////////////////////////////////////////////////////////////	59	/////////////////////////////////////////////////////////////////////////////
50		60
		61	static void inline
		62	set_tos (int fd, int &tos_prev, int tos)
		63	{
		64	#if defined(SOL_IP) && defined(IP_TOS)
		65	if (tos_prev == tos)
		66	return;
		67
		68	tos_prev = tos;
		69	setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
		70	#endif
		71	}
		72
51	void	73	void
52	vpn::script_init_env ()	74	vpn::script_init_env ()
53	{	75	{
54	// the tunnel device mtu should be the physical mtu - overhead	76	// the tunnel device mtu should be the physical mtu - overhead
55	// the tricky part is rounding to the cipher key blocksize	77	// the tricky part is rounding to the cipher key blocksize
…		…
58	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round	80	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
59	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again	81	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
60		82
61	char *env;	83	char *env;
62	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);	84	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
63	asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
64	asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
65	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);	85	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
66	asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);	86	asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
67	asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);	87	asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
68	asprintf (&env, "MTU=%d", mtu); putenv (env);	88	asprintf (&env, "MTU=%d", mtu); putenv (env);
69	asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x",	89	asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
70	0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8,	90	asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
71	THISNODE->id & 0xff); putenv (env);
72		91
73	// TODO: info for other nodes, maybe?	92	conns [THISNODE->id - 1]->script_init_env ("");
74	}
75		93
		94	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
		95	{
		96	char ext[16];
		97	snprintf (ext, 16, "_%d", (*c)->conf->id);
		98	(*c)->script_init_env (ext);
		99	}
		100	}
		101
		102	inline const char *
76	const char *vpn::script_if_init ()	103	vpn::script_if_init ()
77	{	104	{
78	script_init_env ();	105	script_init_env ();
79		106
80	return tap->if_up ();	107	return tap->if_up ();
81	}	108	}
82		109
		110	inline const char *
83	const char *vpn::script_if_up ()	111	vpn::script_if_up ()
84	{	112	{
85	script_init_env ();	113	script_init_env ();
86		114
87	char *filename;	115	char *filename;
88	asprintf (&filename,	116	asprintf (&filename,
…		…
94	}	122	}
95		123
96	int	124	int
97	vpn::setup ()	125	vpn::setup ()
98	{	126	{
		127	int success = 0;
		128
		129	ipv4_tos = -1;
99	ipv4_fd = -1;	130	ipv4_fd = -1;
100		131
101	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)	132	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
102	{	133	{
103	ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);	134	ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
104		135
105	if (ipv4_fd < 0)	136	if (ipv4_fd < 0)
106	return -1;	137	return -1;
107		138
108	fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);	139	fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
		140	fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
109		141
110	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	142	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
111	// this I really consider a linux bug. I am neither connected	143	// this I really consider a linux bug. I am neither connected
112	// nor do I fragment myself. Linux still sets DF and doesn't	144	// nor do I fragment myself. Linux still sets DF and doesn't
113	// fragment for me sometimes.	145	// fragment for me sometimes.
…		…
119		151
120	sockinfo si (THISNODE, PROT_IPv4);	152	sockinfo si (THISNODE, PROT_IPv4);
121		153
122	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))	154	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
123	{	155	{
124	slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));	156	slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
125	exit (EXIT_FAILURE);	157	exit (EXIT_FAILURE);
126	}	158	}
127		159
128	ipv4_ev_watcher.start (ipv4_fd, EVENT_READ);	160	ipv4_ev_watcher.start (ipv4_fd, EV_READ);
		161	++success;
129	}	162	}
		163	else
		164	THISNODE->protocols &= ~PROT_IPv4;
130		165
		166	udpv4_tos = -1;
131	udpv4_fd = -1;	167	udpv4_fd = -1;
132		168
133	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)	169	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
134	{	170	{
135	udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	171	udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
136		172
137	if (udpv4_fd < 0)	173	if (udpv4_fd < 0)
138	return -1;	174	return -1;
139		175
140	fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);	176	fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
		177	fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
141		178
142	// standard daemon practise...	179	// standard daemon practise...
143	{	180	{
144	int oval = 1;	181	int oval = 1;
145	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	182	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
157		194
158	sockinfo si (THISNODE, PROT_UDPv4);	195	sockinfo si (THISNODE, PROT_UDPv4);
159		196
160	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))	197	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
161	{	198	{
162	slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));	199	slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
163	exit (EXIT_FAILURE);	200	exit (EXIT_FAILURE);
164	}	201	}
165		202
166	udpv4_ev_watcher.start (udpv4_fd, EVENT_READ);	203	udpv4_ev_watcher.start (udpv4_fd, EV_READ);
		204	++success;
167	}	205	}
		206	else
		207	THISNODE->protocols &= ~PROT_UDPv4;
168		208
		209	icmpv4_tos = -1;
169	icmpv4_fd = -1;	210	icmpv4_fd = -1;
170		211
171	#if ENABLE_ICMP	212	#if ENABLE_ICMP
172	if (THISNODE->protocols & PROT_ICMPv4)	213	if (THISNODE->protocols & PROT_ICMPv4)
173	{	214	{
174	icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);	215	icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
175		216
176	if (icmpv4_fd < 0)	217	if (icmpv4_fd < 0)
177	return -1;	218	return -1;
178		219
179	fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);	220	fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
		221	fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
180		222
181	#ifdef ICMP_FILTER	223	#ifdef ICMP_FILTER
182	{	224	{
183	icmp_filter oval;	225	icmp_filter oval;
184	oval.data = 0xffffffff;	226	oval.data = 0xffffffff;
…		…
193	// this I really consider a linux bug. I am neither connected	235	// this I really consider a linux bug. I am neither connected
194	// nor do I fragment myself. Linux still sets DF and doesn't	236	// nor do I fragment myself. Linux still sets DF and doesn't
195	// fragment for me sometimes.	237	// fragment for me sometimes.
196	{	238	{
197	int oval = IP_PMTUDISC_DONT;	239	int oval = IP_PMTUDISC_DONT;
198	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);	240	setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
199	}	241	}
200	#endif	242	#endif
201		243
202	sockinfo si (THISNODE, PROT_ICMPv4);	244	sockinfo si (THISNODE, PROT_ICMPv4);
203		245
204	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))	246	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
205	{	247	{
206	slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno));	248	slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
207	exit (EXIT_FAILURE);	249	exit (EXIT_FAILURE);
208	}	250	}
209		251
210	icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ);	252	icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
		253	++success;
211	}	254	}
212	#endif	255	#endif
213		256
214	tcpv4_fd = -1;	257	tcpv4_fd = -1;
215		258
…		…
220		263
221	if (tcpv4_fd < 0)	264	if (tcpv4_fd < 0)
222	return -1;	265	return -1;
223		266
224	fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);	267	fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
		268	fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
225		269
226	// standard daemon practise...	270	// standard daemon practise...
227	{	271	{
228	int oval = 1;	272	int oval = 1;
229	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	273	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
231		275
232	sockinfo si (THISNODE, PROT_TCPv4);	276	sockinfo si (THISNODE, PROT_TCPv4);
233		277
234	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))	278	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
235	{	279	{
236	slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));	280	slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
237	exit (EXIT_FAILURE);	281	exit (EXIT_FAILURE);
238	}	282	}
239		283
240	if (listen (tcpv4_fd, 5))	284	if (listen (tcpv4_fd, 5))
241	{	285	{
242	slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));	286	slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
243	exit (EXIT_FAILURE);	287	exit (EXIT_FAILURE);
244	}	288	}
245		289
246	tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ);	290	tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
		291	++success;
247	}	292	}
		293	else
		294	THISNODE->protocols &= ~PROT_TCPv4;
248	#endif	295	#endif
		296
		297	dnsv4_tos = -1;
		298	dnsv4_fd = -1;
249		299
250	#if ENABLE_DNS	300	#if ENABLE_DNS
251	if (THISNODE->protocols & PROT_DNSv4)	301	if (THISNODE->protocols & PROT_DNSv4)
252	{	302	{
253	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	303	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
…		…
255	dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	305	dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
256		306
257	if (dnsv4_fd < 0)	307	if (dnsv4_fd < 0)
258	return -1;	308	return -1;
259		309
		310	fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
		311	fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
		312
260	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	313	# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
261	// this I really consider a linux bug. I am neither connected	314	// this I really consider a linux bug. I am neither connected
262	// nor do I fragment myself. Linux still sets DF and doesn't	315	// nor do I fragment myself. Linux still sets DF and doesn't
263	// fragment for me sometimes.	316	// fragment for me sometimes.
264	{	317	{
265	int oval = IP_PMTUDISC_DONT;	318	int oval = IP_PMTUDISC_DONT;
266	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);	319	setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
267	}	320	}
268	#endif	321	# endif
269		322
270	// standard daemon practise...	323	// standard daemon practise...
271	{	324	{
272	int oval = 1;	325	int oval = 1;
273	setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	326	setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
277	THISNODE->dns_hostname ? THISNODE->dns_port : 0,	330	THISNODE->dns_hostname ? THISNODE->dns_port : 0,
278	PROT_DNSv4);	331	PROT_DNSv4);
279		332
280	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))	333	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
281	{	334	{
282	slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno));	335	slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
283	exit (EXIT_FAILURE);	336	exit (EXIT_FAILURE);
284	}	337	}
285		338
286	dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ);	339	dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
		340	++success;
		341	}
		342	#endif
		343
		344	/////////////////////////////////////////////////////////////////////////////
		345
		346	if (!success)
287	}	347	{
288	#endif	348	slog (L_ERR, _("no protocols enabled, exiting."));
		349	exit (EXIT_FAILURE);
		350	}
		351
		352	reconnect_all ();
		353
		354	/////////////////////////////////////////////////////////////////////////////
289		355
290	tap = new tap_device ();	356	tap = new tap_device ();
291	if (!tap) //D this, of course, never catches	357	if (!tap) //D this, of course, never catches
292	{	358	{
293	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);	359	slog (L_ERR, _("cannot create network interface '%s', exiting."), conf.ifname);
294	exit (EXIT_FAILURE);	360	exit (EXIT_FAILURE);
295	}	361	}
296		362
		363	fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
		364
		365	run_script_cb cb;
		366	cb.set<vpn, &vpn::script_if_init> (this);
		367
297	if (tap->if_up () &&	368	if (tap->if_up () &&
298	!run_script (run_script_cb (this, &vpn::script_if_init), true))	369	!run_script (cb, true))
299	{	370	{
300	slog (L_ERR, _("interface initialization command '%s' failed, exiting."),	371	slog (L_ERR, _("interface initialization command '%s' failed, exiting."),
301	tap->if_up ());	372	tap->if_up ());
302	exit (EXIT_FAILURE);	373	exit (EXIT_FAILURE);
303	}	374	}
304		375
305	if (!run_script (run_script_cb (this, &vpn::script_if_up), true))	376	cb.set<vpn, &vpn::script_if_up> (this);
		377	if (!run_script (cb, true))
306	{	378	{
307	slog (L_ERR, _("if-up command execution failed, exiting."));	379	slog (L_ERR, _("if-up command execution failed, exiting."));
308	exit (EXIT_FAILURE);	380	exit (EXIT_FAILURE);
309	}	381	}
310		382
311	tap_ev_watcher.start (tap->fd, EVENT_READ);	383	tap_ev_watcher.start (tap->fd, EV_READ);
312
313	reconnect_all ();
314		384
315	return 0;	385	return 0;
316	}	386	}
317		387
318	bool	388	bool
319	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	389	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
320	{	390	{
321	#if defined(SOL_IP) && defined(IP_TOS)	391	set_tos (ipv4_fd, ipv4_tos, tos);
322	setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
323	#endif
324	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	392	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
325		393
326	return true;	394	return true;
327	}	395	}
328		396
…		…
351		419
352	#if ENABLE_ICMP	420	#if ENABLE_ICMP
353	bool	421	bool
354	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	422	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
355	{	423	{
356	#if defined(SOL_IP) && defined(IP_TOS)
357	setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
358	#endif
359
360	pkt->unshift_hdr (4);	424	pkt->unshift_hdr (4);
361		425
362	icmp_header hdr = (icmp_header )&((*pkt)[0]);	426	icmp_header hdr = (icmp_header )&((*pkt)[0]);
363	hdr->type = ::conf.icmp_type;	427	hdr->type = ::conf.icmp_type;
364	hdr->code = 255;	428	hdr->code = 255;
365	hdr->checksum = 0;	429	hdr->checksum = 0;
366	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);	430	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
367		431
		432	set_tos (icmpv4_fd, icmpv4_tos, tos);
368	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	433	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
369		434
370	return true;	435	return true;
371	}	436	}
372	#endif	437	#endif
373		438
374	bool	439	bool
375	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	440	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
376	{	441	{
377	#if defined(SOL_IP) && defined(IP_TOS)	442	set_tos (udpv4_fd, udpv4_tos, tos);
378	setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
379	#endif
380	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	443	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
381		444
382	return true;	445	return true;
383	}	446	}
384		447
…		…
395	{	458	{
396	// broadcast, this is ugly, but due to the security policy	459	// broadcast, this is ugly, but due to the security policy
397	// we have to connect to all hosts...	460	// we have to connect to all hosts...
398	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	461	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
399	if ((*c)->conf != THISNODE)	462	if ((*c)->conf != THISNODE)
400	(*c)->inject_data_packet (pkt, true);	463	(*c)->inject_data_packet (pkt);
401	}	464	}
402	}	465	}
403		466
404	void	467	void
405	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	468	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
406	{	469	{
407	unsigned int src = pkt->src ();	470	unsigned int src = pkt->src ();
408	unsigned int dst = pkt->dst ();	471	unsigned int dst = pkt->dst ();
409		472
410	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),	473	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
411	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);	474	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
412		475
413	if (src == 0 \|\| src > conns.size ()	476	if (src == 0 \|\| src > conns.size ()
414	\|\| dst > conns.size ()	477	\|\| dst > conns.size ()
415	\|\| pkt->typ () >= vpn_packet::PT_MAX)	478	\|\| pkt->typ () >= vpn_packet::PT_MAX)
416	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	479	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
417	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	480	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
418	else if (dst > conns.size ())	481	else if (dst > conns.size ())
419	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	482	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
420	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	483	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
421	else	484	else
422	{	485	{
423	connection *c = conns[src - 1];	486	connection *c = conns[src - 1];
424		487
425	if (dst == 0)	488	if (dst == 0)
426	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"),	489	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
427	c->conf->nodename, (const char *)rsi);	490	c->conf->nodename, (const char *)rsi);
428	else if (dst != THISNODE->id)	491	else if (dst != THISNODE->id)
429	{	492	{
430	if (THISNODE->routerprio)	493	if (THISNODE->routerprio)
431	// the tos setting gets lost here. who cares.	494	// the tos setting gets lost here. who cares.
432	conns[dst - 1]->inject_vpn_packet (pkt);	495	conns[dst - 1]->inject_vpn_packet (pkt);
433	else	496	else
434	slog (L_WARN,	497	slog (L_WARN,
435	_("%s(%s): forwarding request (=> %s), but we are no router"),	498	_("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
436	c->conf->nodename, (const char *)rsi,	499	c->conf->nodename, (const char *)rsi,
437	conns[dst - 1]->conf->nodename);	500	conns[dst - 1]->conf->nodename);
438	}	501	}
439	else	502	else
440	c->recv_vpn_packet (pkt, rsi);	503	c->recv_vpn_packet (pkt, rsi);
…		…
446	{	509	{
447	switch (si.prot)	510	switch (si.prot)
448	{	511	{
449	case PROT_IPv4:	512	case PROT_IPv4:
450	return send_ipv4_packet (pkt, si, tos);	513	return send_ipv4_packet (pkt, si, tos);
		514
451	case PROT_UDPv4:	515	case PROT_UDPv4:
452	return send_udpv4_packet (pkt, si, tos);	516	return send_udpv4_packet (pkt, si, tos);
		517
453	#if ENABLE_TCP	518	#if ENABLE_TCP
454	case PROT_TCPv4:	519	case PROT_TCPv4:
455	return send_tcpv4_packet (pkt, si, tos);	520	return send_tcpv4_packet (pkt, si, tos);
456	#endif	521	#endif
457	#if ENABLE_ICMP	522	#if ENABLE_ICMP
…		…
460	#endif	525	#endif
461	#if ENABLE_DNS	526	#if ENABLE_DNS
462	case PROT_DNSv4:	527	case PROT_DNSv4:
463	return send_dnsv4_packet (pkt, si, tos);	528	return send_dnsv4_packet (pkt, si, tos);
464	#endif	529	#endif
465
466	default:	530	default:
467	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);	531	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
468	}	532	}
469		533
470	return false;	534	return false;
471	}	535	}
472		536
473	void	537	inline void
474	vpn::ipv4_ev (io_watcher &w, short revents)	538	vpn::ipv4_ev (ev::io &w, int revents)
475	{	539	{
476	if (revents & EVENT_READ)	540	if (revents & EV_READ)
477	{	541	{
478	vpn_packet *pkt = new vpn_packet;	542	vpn_packet *pkt = new vpn_packet;
479	struct sockaddr_in sa;	543	struct sockaddr_in sa;
480	socklen_t sa_len = sizeof (sa);	544	socklen_t sa_len = sizeof (sa);
481	int len;	545	int len;
…		…
494	recv_vpn_packet (pkt, si);	558	recv_vpn_packet (pkt, si);
495	}	559	}
496	else	560	else
497	{	561	{
498	// probably ECONNRESET or somesuch	562	// probably ECONNRESET or somesuch
499	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	563	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
500	}	564	}
501		565
502	delete pkt;	566	delete pkt;
503	}	567	}
504	else	568	else
505	{	569	{
506	slog (L_ERR,	570	slog (L_ERR,
507	_("FATAL: unknown revents %08x in socket, terminating\n"),	571	_("FATAL: unknown revents %08x in socket, exiting.\n"),
508	revents);	572	revents);
509	exit (EXIT_FAILURE);	573	exit (EXIT_FAILURE);
510	}	574	}
511	}	575	}
512		576
513	#if ENABLE_ICMP	577	#if ENABLE_ICMP
514	void	578	inline void
515	vpn::icmpv4_ev (io_watcher &w, short revents)	579	vpn::icmpv4_ev (ev::io &w, int revents)
516	{	580	{
517	if (revents & EVENT_READ)	581	if (revents & EV_READ)
518	{	582	{
519	vpn_packet *pkt = new vpn_packet;	583	vpn_packet *pkt = new vpn_packet;
520	struct sockaddr_in sa;	584	struct sockaddr_in sa;
521	socklen_t sa_len = sizeof (sa);	585	socklen_t sa_len = sizeof (sa);
522	int len;	586	int len;
…		…
542	}	606	}
543	}	607	}
544	else	608	else
545	{	609	{
546	// probably ECONNRESET or somesuch	610	// probably ECONNRESET or somesuch
547	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	611	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
548	}	612	}
549		613
550	delete pkt;	614	delete pkt;
551	}	615	}
552	else	616	else
553	{	617	{
554	slog (L_ERR,	618	slog (L_ERR,
555	_("FATAL: unknown revents %08x in socket, terminating\n"),	619	_("FATAL: unknown revents %08x in socket, exiting.\n"),
556	revents);	620	revents);
557	exit (EXIT_FAILURE);	621	exit (EXIT_FAILURE);
558	}	622	}
559	}	623	}
560	#endif	624	#endif
561		625
562	void	626	inline void
563	vpn::udpv4_ev (io_watcher &w, short revents)	627	vpn::udpv4_ev (ev::io &w, int revents)
564	{	628	{
565	if (revents & EVENT_READ)	629	if (revents & EV_READ)
566	{	630	{
567	vpn_packet *pkt = new vpn_packet;	631	vpn_packet *pkt = new vpn_packet;
568	struct sockaddr_in sa;	632	struct sockaddr_in sa;
569	socklen_t sa_len = sizeof (sa);	633	socklen_t sa_len = sizeof (sa);
570	int len;	634	int len;
…		…
580	recv_vpn_packet (pkt, si);	644	recv_vpn_packet (pkt, si);
581	}	645	}
582	else	646	else
583	{	647	{
584	// probably ECONNRESET or somesuch	648	// probably ECONNRESET or somesuch
585	slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno));	649	slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
586	}	650	}
587		651
588	delete pkt;	652	delete pkt;
589	}	653	}
590	else	654	else
591	{	655	{
592	slog (L_ERR,	656	slog (L_ERR,
593	_("FATAL: unknown revents %08x in socket, terminating\n"),	657	_("FATAL: unknown revents %08x in socket, exiting.\n"),
594	revents);	658	revents);
595	exit (EXIT_FAILURE);	659	exit (EXIT_FAILURE);
596	}	660	}
597	}	661	}
598		662
599	void	663	inline void
600	vpn::tap_ev (io_watcher &w, short revents)	664	vpn::tap_ev (ev::io &w, int revents)
601	{	665	{
602	if (revents & EVENT_READ)	666	if (revents & EV_READ)
603	{	667	{
604	/* process data */	668	/* process data */
605	tap_packet *pkt;	669	tap_packet *pkt;
606		670
607	pkt = tap->recv ();	671	pkt = tap->recv ();
…		…
636	}	700	}
637	else	701	else
638	abort ();	702	abort ();
639	}	703	}
640		704
641	void	705	inline void
642	vpn::event_cb (time_watcher &w)	706	vpn::event_cb (ev::timer &w, int)
643	{	707	{
644	if (events)	708	if (events)
645	{	709	{
646	if (events & EVENT_SHUTDOWN)	710	if (events & EVENT_SHUTDOWN)
647	{	711	{
648	slog (L_INFO, _("preparing shutdown..."));	712	slog (L_INFO, _("preparing shutdown..."));
649		713
650	shutdown_all ();	714	shutdown_all ();
651	remove_pid (conf.pidfilename);	715	remove_pid (conf.pidfilename);
652	slog (L_INFO, _("terminating"));	716	slog (L_INFO, _("exiting."));
653	exit (EXIT_SUCCESS);	717	exit (EXIT_SUCCESS);
654	}	718	}
655		719
656	if (events & EVENT_RECONNECT)	720	if (events & EVENT_RECONNECT)
657	{	721	{
658	slog (L_INFO, _("forced reconnect"));	722	slog (L_INFO, _("forced reconnect."));
659		723
660	reconnect_all ();	724	reconnect_all ();
661	}	725	}
662		726
663	events = 0;	727	events = 0;
…		…
679		743
680	conns.clear ();	744	conns.clear ();
681		745
682	connection_init ();	746	connection_init ();
683		747
684	for (configuration::node_vector::iterator i = conf.nodes.begin ();	748	for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
685	i != conf.nodes.end (); ++i)	749	conns.push_back (new connection (this, *i));
686	{	750
687	connection conn = new connection (this, i);	751	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
688	conns.push_back (conn);
689	conn->establish_connection ();	752	(*c)->establish_connection ();
690	}
691	}	753	}
692		754
693	connection *vpn::find_router ()	755	bool vpn::can_direct (conf_node src, conf_node dst) const
694	{	756	{
695	u32 prio = 1;	757	return src != dst
		758	&& src->may_direct (dst)
		759	&& dst->may_direct (src)
		760	&& (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
		761	\|\| (src->protocols & dst->connectable_protocols ()));
		762	}
		763
		764	// only works for indirect and routed connections: find a router
		765	// from THISNODE to dst
		766	connection vpn::find_router_for (const connection dst)
		767	{
696	connection *router = 0;	768	connection *router = 0;
697		769
		770	// first try to find a router with a direct connection
		771	{
		772	u32 prio = 1;
		773
		774	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		775	{
		776	connection c = i;
		777
		778	if (c->conf->routerprio > prio
		779	&& c->conf != THISNODE
		780	&& c != dst
		781	&& can_direct (c->conf, dst->conf))
		782	{
		783	if (c->ictx && c->octx)
		784	{
		785	prio = c->conf->routerprio;
		786	router = c;
		787	}
		788	else
		789	c->establish_connection ();
		790	}
		791	}
		792	}
		793
		794	if (router)
		795	return router;
		796
		797	// second try find the router with the highest priority higher than ours
		798	{
		799	u32 prio = 1;
		800
		801	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		802	{
		803	connection c = i;
		804
		805	if (c->conf->routerprio > prio
		806	&& c->conf->routerprio > THISNODE->routerprio
		807	&& c != dst
		808	&& c->conf != THISNODE)
		809	{
		810	if (c->ictx && c->octx)
		811	{
		812	prio = c->conf->routerprio;
		813	router = c;
		814	}
		815	else
		816	c->establish_connection ();
		817	}
		818	}
		819	}
		820	return router;
		821	}
		822
		823	void vpn::connection_established (connection *c)
		824	{
698	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	825	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
699	{	826	{
700	connection c = i;	827	connection o = i;
701		828
702	if (c->conf->routerprio > prio	829	if (!o->is_direct
703	&& c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use	830	&& o->si.valid ()
704	&& c->ictx && c->octx	831	&& c->si != o->si
705	&& c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode	832	&& c == find_router_for (o))
706	{
707	prio = c->conf->routerprio;
708	router = c;
709	}	833	{
		834	slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
		835	o->conf->nodename, c->conf->nodename);
		836	o->rekey ();
		837	}
710	}	838	}
711
712	return router;
713	}	839	}
714		840
715	void vpn::send_connect_request (int id)	841	void vpn::send_connect_request (connection *c)
716	{	842	{
717	connection *c = find_router ();	843	connection *r = find_router_for (c);
718		844
719	if (c)	845	if (r)
		846	{
		847	slog (L_TRACE, _("%s: no way to connect, sending mediated connection request via %s."),
		848	c->conf->nodename, r->conf->nodename);
720	c->send_connect_request (id);	849	r->send_connect_request (c->conf->id);
		850	}
721	else	851	else
722	// no router found, aggressively connect to all routers	852	slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect."),
723	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	853	c->conf->nodename);
724	if ((i)->conf->routerprio && (i)->conf != THISNODE)
725	(*i)->establish_connection ();
726	}	854	}
727		855
728	void	856	void
729	connection::dump_status ()	857	connection::dump_status ()
730	{	858	{
731	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);	859	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
732	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),	860	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
733	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);	861	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
734	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),	862	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
735	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);	863	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
736	slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
737	(long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
738	}	864	}
739		865
740	void	866	void
741	vpn::dump_status ()	867	vpn::dump_status ()
742	{	868	{
743	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);	869	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
744		870
745	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	871	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
746	(*c)->dump_status ();	872	(*c)->dump_status ();
747		873
748	slog (L_NOTICE, _("END status dump"));	874	slog (L_NOTICE, _("END status dump"));
749	}	875	}
750		876
751	vpn::vpn (void)	877	vpn::vpn (void)
		878	{
752	: event (this, &vpn::event_cb)	879	event .set<vpn, &vpn::event_cb > (this);
753	, udpv4_ev_watcher (this, &vpn::udpv4_ev)	880	udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
754	, ipv4_ev_watcher (this, &vpn::ipv4_ev)	881	ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
755	#if ENABLE_TCP	882	#if ENABLE_TCP
756	, tcpv4_ev_watcher (this, &vpn::tcpv4_ev)	883	tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
757	#endif	884	#endif
758	#if ENABLE_ICMP	885	#if ENABLE_ICMP
759	, icmpv4_ev_watcher(this, &vpn::icmpv4_ev)	886	icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
760	#endif	887	#endif
761	#if ENABLE_DNS	888	#if ENABLE_DNS
762	, dnsv4_ev_watcher (this, &vpn::dnsv4_ev)	889	dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
763	#endif	890	#endif
764	, tap_ev_watcher (this, &vpn::tap_ev)	891	tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
765	{
766	}	892	}
767		893
768	vpn::~vpn ()	894	vpn::~vpn ()
769	{	895	{
770	}	896	}

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/vpn.C (file contents): Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs. Revision 1.51 by pcg, Sun Aug 10 14:48:57 2008 UTC

Diff Legend

Comparing gvpe/src/vpn.C (file contents):
Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs.
Revision 1.51 by pcg, Sun Aug 10 14:48:57 2008 UTC