ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.45 by pcg, Thu Dec 6 00:35:29 2007 UTC vs.
Revision 1.68 by root, Wed Jul 15 23:04:06 2015 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
46 57
58using namespace std;
59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
48 61
49///////////////////////////////////////////////////////////////////////////// 62/////////////////////////////////////////////////////////////////////////////
50 63
51static void inline 64static void inline
… …
65{ 78{
66 // the tunnel device mtu should be the physical mtu - overhead 79 // the tunnel device mtu should be the physical mtu - overhead
67 // the tricky part is rounding to the cipher key blocksize 80 // the tricky part is rounding to the cipher key blocksize
68 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 81 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
69 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 82 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
70 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 83 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
71 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 84 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
72 85
73 char *env; 86 char *env;
74 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 87 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
75 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 88 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
… …
100inline const char * 113inline const char *
101vpn::script_if_up () 114vpn::script_if_up ()
102{ 115{
103 script_init_env (); 116 script_init_env ();
104 117
105 char *filename; 118 return conf.config_filename (::conf.script_if_up, "if-up");
106 asprintf (&filename, 119}
107 "%s/%s",
108 confbase,
109 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
110 120
111 return filename; 121int
122vpn::setup_socket (u8 prot, int family, int type, int proto)
123{
124 int fd = socket (family, type, proto);
125
126 if (fd < 0)
127 {
128 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
129 return fd;
130 }
131
132 fcntl (fd, F_SETFL, O_NONBLOCK);
133 fcntl (fd, F_SETFD, FD_CLOEXEC);
134
135#ifdef SO_MARK
136 if (::conf.nfmark)
137 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
138 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
139#endif
140
141 return fd;
112} 142}
113 143
114int 144int
115vpn::setup () 145vpn::setup ()
116{ 146{
147 int success = 0;
148
117 ipv4_tos = -1; 149 ipv4_tos = -1;
118 ipv4_fd = -1; 150 ipv4_fd = -1;
119 151
120 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 152 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
121 { 153 {
122 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 154 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
123 155
124 if (ipv4_fd < 0) 156 if (ipv4_fd < 0)
125 return -1; 157 return -1;
126
127 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
128 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
129 158
130#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 159#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
131 // this I really consider a linux bug. I am neither connected 160 // this I really consider a linux bug. I am neither connected
132 // nor do I fragment myself. Linux still sets DF and doesn't 161 // nor do I fragment myself. Linux still sets DF and doesn't
133 // fragment for me sometimes. 162 // fragment for me sometimes.
… …
139 168
140 sockinfo si (THISNODE, PROT_IPv4); 169 sockinfo si (THISNODE, PROT_IPv4);
141 170
142 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 171 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
143 { 172 {
144 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 173 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
145 exit (EXIT_FAILURE); 174 return -1;
146 } 175 }
147 176
148 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 177 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
178 ++success;
149 } 179 }
180 else
181 THISNODE->protocols &= ~PROT_IPv4;
150 182
151 udpv4_tos = -1; 183 udpv4_tos = -1;
152 udpv4_fd = -1; 184 udpv4_fd = -1;
153 185
154 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 186 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
155 { 187 {
156 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 188 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
157 189
158 if (udpv4_fd < 0) 190 if (udpv4_fd < 0)
159 return -1; 191 return -1;
160
161 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
162 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
163 192
164 // standard daemon practise... 193 // standard daemon practise...
165 { 194 {
166 int oval = 1; 195 int oval = 1;
167 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 196 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
179 208
180 sockinfo si (THISNODE, PROT_UDPv4); 209 sockinfo si (THISNODE, PROT_UDPv4);
181 210
182 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 211 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
183 { 212 {
184 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 213 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
185 exit (EXIT_FAILURE); 214 return -1;
186 } 215 }
187 216
188 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 217 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
218 ++success;
189 } 219 }
220 else
221 THISNODE->protocols &= ~PROT_UDPv4;
190 222
191 icmpv4_tos = -1; 223 icmpv4_tos = -1;
192 icmpv4_fd = -1; 224 icmpv4_fd = -1;
193 225
194#if ENABLE_ICMP 226#if ENABLE_ICMP
195 if (THISNODE->protocols & PROT_ICMPv4) 227 if (THISNODE->protocols & PROT_ICMPv4)
196 { 228 {
197 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 229 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
198 230
199 if (icmpv4_fd < 0) 231 if (icmpv4_fd < 0)
200 return -1; 232 return -1;
201
202 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
203 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
204 233
205#ifdef ICMP_FILTER 234#ifdef ICMP_FILTER
206 { 235 {
207 icmp_filter oval; 236 icmp_filter oval;
208 oval.data = 0xffffffff; 237 oval.data = 0xffffffff;
… …
225 254
226 sockinfo si (THISNODE, PROT_ICMPv4); 255 sockinfo si (THISNODE, PROT_ICMPv4);
227 256
228 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 257 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
229 { 258 {
230 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 259 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
231 exit (EXIT_FAILURE); 260 return -1;
232 } 261 }
233 262
234 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 263 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
264 ++success;
235 } 265 }
236#endif 266#endif
237 267
238 tcpv4_fd = -1; 268 tcpv4_fd = -1;
239 269
240#if ENABLE_TCP 270#if ENABLE_TCP
241 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 271 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
242 { 272 {
243 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 273 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
244 274
245 if (tcpv4_fd < 0) 275 if (tcpv4_fd < 0)
246 return -1; 276 return -1;
247 277
248 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
249 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
250
251 // standard daemon practise... 278 // standard daemon practise...
252 { 279 {
253 int oval = 1; 280 int oval = 1;
254 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 281 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
255 } 282 }
256 283
257 sockinfo si (THISNODE, PROT_TCPv4); 284 sockinfo si (THISNODE, PROT_TCPv4);
258 285
259 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 286 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
260 { 287 {
261 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 288 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
262 exit (EXIT_FAILURE); 289 return -1;
263 } 290 }
264 291
265 if (listen (tcpv4_fd, 5)) 292 if (listen (tcpv4_fd, 5))
266 { 293 {
267 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 294 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
268 exit (EXIT_FAILURE); 295 return -1;
269 } 296 }
270 297
271 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 298 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
299 ++success;
272 } 300 }
301 else
302 THISNODE->protocols &= ~PROT_TCPv4;
273#endif 303#endif
274 304
275 dnsv4_tos = -1; 305 dnsv4_tos = -1;
276 dnsv4_fd = -1; 306 dnsv4_fd = -1;
277 307
278#if ENABLE_DNS 308#if ENABLE_DNS
279 if (THISNODE->protocols & PROT_DNSv4) 309 if (THISNODE->protocols & PROT_DNSv4)
280 { 310 {
281 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 311 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
282 312
283 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 313 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
284 314
285 if (dnsv4_fd < 0) 315 if (dnsv4_fd < 0)
286 return -1; 316 return -1;
287
288 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
289 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
290 317
291# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 318# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
292 // this I really consider a linux bug. I am neither connected 319 // this I really consider a linux bug. I am neither connected
293 // nor do I fragment myself. Linux still sets DF and doesn't 320 // nor do I fragment myself. Linux still sets DF and doesn't
294 // fragment for me sometimes. 321 // fragment for me sometimes.
… …
308 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 335 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
309 PROT_DNSv4); 336 PROT_DNSv4);
310 337
311 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 338 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
312 { 339 {
313 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 340 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
314 exit (EXIT_FAILURE); 341 return -1;
315 } 342 }
316 343
317 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 344 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
345 ++success;
318 } 346 }
319#endif 347#endif
320 348
321 ///////////////////////////////////////////////////////////////////////////// 349 /////////////////////////////////////////////////////////////////////////////
350
351 if (!success)
352 {
353 slog (L_ERR, _("no protocols enabled."));
354 return -1;
355 }
322 356
323 reconnect_all (); 357 reconnect_all ();
324 358
325 ///////////////////////////////////////////////////////////////////////////// 359 /////////////////////////////////////////////////////////////////////////////
326 360
327 tap = new tap_device (); 361 tap = new tap_device ();
328 if (!tap) //D this, of course, never catches 362 if (!tap) //D this, of course, never catches
329 { 363 {
330 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 364 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
331 exit (EXIT_FAILURE); 365 return -1;
332 } 366 }
333 367
334 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 368 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
335 369
336 run_script_cb cb; 370 run_script_cb cb;
337 cb.set<vpn, &vpn::script_if_init> (this); 371 cb.set<vpn, &vpn::script_if_init> (this);
338 372
339 if (tap->if_up () && 373 if (tap->if_up () &&
340 !run_script (cb, true)) 374 !run_script (cb, true))
341 { 375 {
342 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 376 slog (L_ERR, _("interface initialization command '%s' failed."),
343 tap->if_up ()); 377 tap->if_up ());
344 exit (EXIT_FAILURE); 378 return -1;
345 } 379 }
346 380
347 cb.set<vpn, &vpn::script_if_up> (this); 381 cb.set<vpn, &vpn::script_if_up> (this);
348 if (!run_script (cb, true)) 382 if (!run_script (cb, true))
349 { 383 {
350 slog (L_ERR, _("if-up command execution failed, exiting.")); 384 slog (L_ERR, _("if-up command execution failed."));
351 exit (EXIT_FAILURE); 385 return -1;
352 } 386 }
353 387
354 tap_ev_watcher.start (tap->fd, EV_READ); 388 tap_ev_watcher.start (tap->fd, EV_READ);
355 389
356 return 0; 390 return 0;
391}
392
393bool
394vpn::drop_privileges ()
395{
396 if (::conf.change_root)
397 {
398 if (!strcmp (::conf.change_root, "/"))
399 {
400 char dir [L_tmpnam];
401 if (!tmpnam (dir))
402 {
403 slog (L_CRIT, _("unable to create anonymous root path."));
404 return false;
405 }
406
407 if (mkdir (dir, 0700))
408 {
409 slog (L_CRIT, _("unable to create anonymous root directory."));
410 return false;
411 }
412
413 if (chdir (dir))
414 {
415 slog (L_CRIT, _("unable to change to anonymous root directory."));
416 return false;
417 }
418
419 if (rmdir (dir))
420 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
421 }
422 else
423 {
424 if (chdir (::conf.change_root))
425 {
426 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
427 return false;
428 }
429 }
430
431 if (chroot ("."))
432 {
433 slog (L_CRIT, _("unable to set new root directory."));
434 return false;
435 }
436
437 if (chdir ("/"))
438 {
439 slog (L_CRIT, _("unable to set cwd to new root directory."));
440 return false;
441 }
442 }
443
444 if (::conf.change_gid)
445 if (setgid (::conf.change_gid))
446 {
447 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
448 return false;
449 }
450
451 if (::conf.change_uid)
452 if (setuid (::conf.change_uid))
453 {
454 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
455 return false;
456 }
457
458 return true;
357} 459}
358 460
359bool 461bool
360vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 462vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
361{ 463{
… …
429 { 531 {
430 // broadcast, this is ugly, but due to the security policy 532 // broadcast, this is ugly, but due to the security policy
431 // we have to connect to all hosts... 533 // we have to connect to all hosts...
432 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 534 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
433 if ((*c)->conf != THISNODE) 535 if ((*c)->conf != THISNODE)
434 (*c)->inject_data_packet (pkt, true); 536 (*c)->inject_data_packet (pkt);
435 } 537 }
436} 538}
437 539
438void 540void
439vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 541vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
440{ 542{
441 unsigned int src = pkt->src (); 543 unsigned int src = pkt->src ();
442 unsigned int dst = pkt->dst (); 544 unsigned int dst = pkt->dst ();
443 545
444 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 546 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 547 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
446 548
447 if (src == 0 || src > conns.size () 549 if (src == 0 || src > conns.size ()
448 || dst > conns.size () 550 || dst > conns.size ()
449 || pkt->typ () >= vpn_packet::PT_MAX) 551 || pkt->typ () >= vpn_packet::PT_MAX)
450 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 552 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
451 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
452 else if (dst > conns.size ())
453 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
454 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 553 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
455 else 554 else
456 { 555 {
457 connection *c = conns[src - 1]; 556 connection *c = conns[src - 1];
458 557
459 if (dst == 0) 558 if (dst == 0)
460 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 559 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
461 c->conf->nodename, (const char *)rsi); 560 c->conf->nodename, (const char *)rsi);
462 else if (dst != THISNODE->id) 561 else if (dst != THISNODE->id)
463 { 562 {
464 if (THISNODE->routerprio) 563 if (THISNODE->routerprio)
465 // the tos setting gets lost here. who cares. 564 // the tos setting gets lost here. who cares.
466 conns[dst - 1]->inject_vpn_packet (pkt); 565 conns[dst - 1]->inject_vpn_packet (pkt);
467 else 566 else
468 slog (L_WARN, 567 slog (L_WARN,
469 _("%s(%s): forwarding request (=> %s), but we are no router"), 568 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
470 c->conf->nodename, (const char *)rsi, 569 c->conf->nodename, (const char *)rsi,
471 conns[dst - 1]->conf->nodename); 570 conns[dst - 1]->conf->nodename);
472 } 571 }
473 else 572 else
474 c->recv_vpn_packet (pkt, rsi); 573 c->recv_vpn_packet (pkt, rsi);
… …
479vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 578vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
480{ 579{
481 switch (si.prot) 580 switch (si.prot)
482 { 581 {
483 case PROT_IPv4: 582 case PROT_IPv4:
484 return send_ipv4_packet (pkt, si, tos); 583 return send_ipv4_packet (pkt, si, tos);
485 584
486 case PROT_UDPv4: 585 case PROT_UDPv4:
487 return send_udpv4_packet (pkt, si, tos); 586 return send_udpv4_packet (pkt, si, tos);
488 587
489#if ENABLE_TCP 588#if ENABLE_TCP
490 case PROT_TCPv4: 589 case PROT_TCPv4:
491 return send_tcpv4_packet (pkt, si, tos); 590 return send_tcpv4_packet (pkt, si, tos);
492#endif 591#endif
493#if ENABLE_ICMP 592#if ENABLE_ICMP
494 case PROT_ICMPv4: 593 case PROT_ICMPv4:
495 return send_icmpv4_packet (pkt, si, tos); 594 return send_icmpv4_packet (pkt, si, tos);
496#endif 595#endif
497#if ENABLE_DNS 596#if ENABLE_DNS
498 case PROT_DNSv4: 597 case PROT_DNSv4:
499 return send_dnsv4_packet (pkt, si, tos); 598 return send_dnsv4_packet (pkt, si, tos);
500#endif 599#endif
501 default: 600 default:
502 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 601 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
503 } 602 }
504 603
505 return false; 604 return false;
506} 605}
507 606
… …
522 if (len > 0) 621 if (len > 0)
523 { 622 {
524 pkt->len = len; 623 pkt->len = len;
525 624
526 // raw sockets deliver the ipv4 header, but don't expect it on sends 625 // raw sockets deliver the ipv4 header, but don't expect it on sends
527 pkt->skip_hdr (IP_OVERHEAD); 626 pkt->skip_hdr (pkt->ipv4_hdr_len ());
528 627
529 recv_vpn_packet (pkt, si); 628 recv_vpn_packet (pkt, si);
530 } 629 }
531 else 630 else
532 { 631 {
533 // probably ECONNRESET or somesuch 632 // probably ECONNRESET or somesuch
534 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 633 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
535 } 634 }
536 635
537 delete pkt; 636 delete pkt;
538 } 637 }
539 else 638 else
540 { 639 {
541 slog (L_ERR, 640 slog (L_ERR,
542 _("FATAL: unknown revents %08x in socket, terminating\n"), 641 _("FATAL: unknown revents %08x in socket, exiting.\n"),
543 revents); 642 revents);
544 exit (EXIT_FAILURE); 643 exit (EXIT_FAILURE);
545 } 644 }
546} 645}
547 646
… …
569 if (hdr->type == ::conf.icmp_type 668 if (hdr->type == ::conf.icmp_type
570 && hdr->code == 255) 669 && hdr->code == 255)
571 { 670 {
572 // raw sockets deliver the ipv4, but don't expect it on sends 671 // raw sockets deliver the ipv4, but don't expect it on sends
573 // this is slow, but... 672 // this is slow, but...
574 pkt->skip_hdr (ICMP_OVERHEAD); 673 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
575 674
576 recv_vpn_packet (pkt, si); 675 recv_vpn_packet (pkt, si);
577 } 676 }
578 } 677 }
579 else 678 else
580 { 679 {
581 // probably ECONNRESET or somesuch 680 // probably ECONNRESET or somesuch
582 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 681 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
583 } 682 }
584 683
585 delete pkt; 684 delete pkt;
586 } 685 }
587 else 686 else
588 { 687 {
589 slog (L_ERR, 688 slog (L_ERR,
590 _("FATAL: unknown revents %08x in socket, terminating\n"), 689 _("FATAL: unknown revents %08x in socket, exiting.\n"),
591 revents); 690 revents);
592 exit (EXIT_FAILURE); 691 exit (EXIT_FAILURE);
593 } 692 }
594} 693}
595#endif 694#endif
… …
615 recv_vpn_packet (pkt, si); 714 recv_vpn_packet (pkt, si);
616 } 715 }
617 else 716 else
618 { 717 {
619 // probably ECONNRESET or somesuch 718 // probably ECONNRESET or somesuch
620 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 719 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
621 } 720 }
622 721
623 delete pkt; 722 delete pkt;
624 } 723 }
625 else 724 else
626 { 725 {
627 slog (L_ERR, 726 slog (L_ERR,
628 _("FATAL: unknown revents %08x in socket, terminating\n"), 727 _("FATAL: unknown revents %08x in socket, exiting.\n"),
629 revents); 728 revents);
630 exit (EXIT_FAILURE); 729 exit (EXIT_FAILURE);
631 } 730 }
632} 731}
633 732
… …
682 { 781 {
683 slog (L_INFO, _("preparing shutdown...")); 782 slog (L_INFO, _("preparing shutdown..."));
684 783
685 shutdown_all (); 784 shutdown_all ();
686 remove_pid (conf.pidfilename); 785 remove_pid (conf.pidfilename);
687 slog (L_INFO, _("terminating")); 786 slog (L_INFO, _("exiting."));
688 exit (EXIT_SUCCESS); 787 exit (EXIT_SUCCESS);
689 } 788 }
690 789
691 if (events & EVENT_RECONNECT) 790 if (events & EVENT_RECONNECT)
692 { 791 {
693 slog (L_INFO, _("forced reconnect")); 792 slog (L_INFO, _("forced reconnect."));
694 793
695 reconnect_all (); 794 reconnect_all ();
696 } 795 }
697 796
698 events = 0; 797 events = 0;
… …
714 813
715 conns.clear (); 814 conns.clear ();
716 815
717 connection_init (); 816 connection_init ();
718 817
719 for (configuration::node_vector::iterator i = conf.nodes.begin (); 818 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
720 i != conf.nodes.end (); ++i) 819 conns.push_back (new connection (this, *i));
721 { 820
722 connection *conn = new connection (this, *i); 821 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
723 conns.push_back (conn);
724 conn->establish_connection (); 822 (*c)->establish_connection ();
725 }
726} 823}
727 824
728connection *vpn::find_router () 825bool
826vpn::can_direct (conf_node *src, conf_node *dst) const
729{ 827{
730 u32 prio = 1; 828 return src != dst
829 && src->may_direct (dst)
830 && dst->may_direct (src)
831 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
832 || (src->protocols & dst->connectable_protocols ()));
833}
834
835// only works for indirect and routed connections: find a router
836// from THISNODE to dst
837connection *
838vpn::find_router_for (const connection *dst)
839{
731 connection *router = 0; 840 connection *router = 0;
732 841
842 // first try to find a router with a direct connection, route there
843 // regardless of any other considerations.
844 {
845 u32 prio = 1;
846
847 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
848 {
849 connection *c = *i;
850
851 if (c->conf->routerprio > prio
852 && c->conf != THISNODE
853 && can_direct (c->conf, dst->conf)
854 && c->ictx && c->octx)
855 {
856 prio = c->conf->routerprio;
857 router = c;
858 }
859 }
860 }
861
862 if (router)
863 return router;
864
865 // second try find the router with the highest priority, higher than ours
866 {
867 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
868
869 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
870 {
871 connection *c = *i;
872
873 if (c->conf->routerprio > prio
874 && c != dst
875 && c->conf != THISNODE
876 && c->ictx && c->octx)
877 {
878 prio = c->conf->routerprio;
879 router = c;
880 }
881 }
882 }
883
884 return router;
885}
886
887void
888vpn::connection_established (connection *c)
889{
733 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 890 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
734 { 891 {
735 connection *c = *i; 892 connection *o = *i;
736 893
737 if (c->conf->routerprio > prio 894 if (o->si.valid ()
738 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 895 && c->si != o->si
739 && c->ictx && c->octx 896 && c == find_router_for (o)
740 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 897 && !can_direct (THISNODE, o->conf))
741 {
742 prio = c->conf->routerprio;
743 router = c;
744 } 898 {
899 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
900 o->conf->nodename, c->conf->nodename);
901 o->rekey ();
902 }
745 } 903 }
746
747 return router;
748} 904}
749 905
906void
750void vpn::send_connect_request (int id) 907vpn::send_connect_request (connection *c)
751{ 908{
752 connection *c = find_router (); 909 connection *r = find_router_for (c);
753 910
754 if (c) 911 if (r)
912 {
913 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
914 c->conf->nodename, r->conf->nodename);
755 c->send_connect_request (id); 915 r->send_connect_request (c->conf->id);
916 }
756 else 917 else
757 // no router found, aggressively connect to all routers 918 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
758 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 919 c->conf->nodename);
759 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
760 (*i)->establish_connection ();
761} 920}
762 921
763void 922void
764connection::dump_status () 923connection::dump_status ()
765{ 924{
766 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 925 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
767 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 926 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
768 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 927 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
769 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 928 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
770 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 929 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
771 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
772 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
773} 930}
774 931
775void 932void
776vpn::dump_status () 933vpn::dump_status ()
777{ 934{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines