ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.10 by pcg, Tue Apr 8 03:25:35 2003 UTC vs.
Revision 1.14 by pcg, Tue Oct 14 03:22:09 2003 UTC

… …
29#include <sys/poll.h> 29#include <sys/poll.h>
30#include <sys/wait.h> 30#include <sys/wait.h>
31#include <errno.h> 31#include <errno.h>
32#include <time.h> 32#include <time.h>
33#include <unistd.h> 33#include <unistd.h>
34#include <fcntl.h>
35#include <sys/socket.h>
36#include <netinet/in.h>
34#include <arpa/inet.h> 37#include <arpa/inet.h>
38#include <net/if.h>
39#ifdef HAVE_NETINET_IN_SYSTM_H
40# include <netinet/in_systm.h>
41#endif
42#ifdef HAVE_NETINET_IP_H
35#include <netinet/in.h> 43# include <netinet/ip.h>
44#endif
45#ifdef HAVE_NETINET_TCP_H
46# include <netinet/tcp.h>
47#endif
48#if ENABLE_ICMP
36#include <netinet/ip_icmp.h> 49# include <netinet/ip_icmp.h>
50#endif
37 51
38#include "pidfile.h" 52#include "pidfile.h"
39 53
40#include "connection.h" 54#include "connection.h"
41#include "util.h" 55#include "util.h"
42#include "vpn.h" 56#include "vpn.h"
57
58#if !defined(SOL_IP) && defined(IPPROTO_IP)
59# define SOL_IP IPPROTO_IP
60#endif
43 61
44///////////////////////////////////////////////////////////////////////////// 62/////////////////////////////////////////////////////////////////////////////
45 63
46const char *vpn::script_if_up () 64const char *vpn::script_if_up ()
47{ 65{
… …
81 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 99 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
82 100
83 if (ipv4_fd < 0) 101 if (ipv4_fd < 0)
84 return -1; 102 return -1;
85 103
86#ifdef IP_MTU_DISCOVER 104 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
105
106#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
87 // this I really consider a linux bug. I am neither connected 107 // this I really consider a linux bug. I am neither connected
88 // nor do I fragment myself. Linux still sets DF and doesn't 108 // nor do I fragment myself. Linux still sets DF and doesn't
89 // fragment for me sometimes. 109 // fragment for me sometimes.
90 { 110 {
91 int oval = IP_PMTUDISC_DONT; 111 int oval = IP_PMTUDISC_DONT;
… …
111 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 131 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
112 132
113 if (udpv4_fd < 0) 133 if (udpv4_fd < 0)
114 return -1; 134 return -1;
115 135
136 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
137
116 // standard daemon practise... 138 // standard daemon practise...
117 { 139 {
118 int oval = 1; 140 int oval = 1;
119 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 141 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
120 } 142 }
121 143
122#ifdef IP_MTU_DISCOVER 144#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
123 // this I really consider a linux bug. I am neither connected 145 // this I really consider a linux bug. I am neither connected
124 // nor do I fragment myself. Linux still sets DF and doesn't 146 // nor do I fragment myself. Linux still sets DF and doesn't
125 // fragment for me sometimes. 147 // fragment for me sometimes.
126 { 148 {
127 int oval = IP_PMTUDISC_DONT; 149 int oval = IP_PMTUDISC_DONT;
… …
148 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 170 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
149 171
150 if (icmpv4_fd < 0) 172 if (icmpv4_fd < 0)
151 return -1; 173 return -1;
152 174
175 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
176
153#ifdef ICMP_FILTER 177#ifdef ICMP_FILTER
154 { 178 {
155 icmp_filter oval; 179 icmp_filter oval;
156 oval.data = 0xffffffff; 180 oval.data = 0xffffffff;
157 if (::conf.icmp_type < 32) 181 if (::conf.icmp_type < 32)
… …
159 183
160 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval); 184 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
161 } 185 }
162#endif 186#endif
163 187
164#ifdef IP_MTU_DISCOVER 188#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
165 // this I really consider a linux bug. I am neither connected 189 // this I really consider a linux bug. I am neither connected
166 // nor do I fragment myself. Linux still sets DF and doesn't 190 // nor do I fragment myself. Linux still sets DF and doesn't
167 // fragment for me sometimes. 191 // fragment for me sometimes.
168 { 192 {
169 int oval = IP_PMTUDISC_DONT; 193 int oval = IP_PMTUDISC_DONT;
… …
191 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 215 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);
192 216
193 if (tcpv4_fd < 0) 217 if (tcpv4_fd < 0)
194 return -1; 218 return -1;
195 219
220 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
221
196 // standard daemon practise... 222 // standard daemon practise...
197 { 223 {
198 int oval = 1; 224 int oval = 1;
199 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 225 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
200 } 226 }
… …
262} 288}
263 289
264bool 290bool
265vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 291vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
266{ 292{
293#if defined(SOL_IP) && defined(IP_TOS)
267 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos); 294 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
295#endif
268 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 296 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
269 297
270 return true; 298 return true;
271} 299}
272 300
… …
291 sum += (sum >> 16); // carry 319 sum += (sum >> 16); // carry
292 320
293 return ~sum; 321 return ~sum;
294} 322}
295 323
324#if ENABLE_ICMP
325struct icmp_header {
326 u8 type;
327 u8 code;
328 u16 checksum;
329 union {
330 struct {
331 u16 id;
332 u16 sequence;
333 } echo;
334 u32 gateway;
335 struct {
336 u16 unused;
337 u16 mtu;
338 } frag;
339 } un;
340};
341
296bool 342bool
297vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 343vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
298{ 344{
345#if defined(SOL_IP) && defined(IP_TOS)
299 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos); 346 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
347#endif
300 348
301 pkt->unshift_hdr (4); 349 pkt->unshift_hdr (4);
302 350
303 icmphdr *hdr = (icmphdr *)&((*pkt)[0]); 351 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
304 hdr->type = ::conf.icmp_type; 352 hdr->type = ::conf.icmp_type;
305 hdr->code = 255; 353 hdr->code = 255;
306 hdr->checksum = 0; 354 hdr->checksum = 0;
307 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 355 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
308 356
309 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 357 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
310 358
311 return true; 359 return true;
312} 360}
361#endif
313 362
314bool 363bool
315vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 364vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
316{ 365{
366#if defined(SOL_IP) && defined(IP_TOS)
317 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos); 367 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
368#endif
318 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 369 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
319 370
320 return true; 371 return true;
321} 372}
322 373
… …
339 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 390 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
340 else 391 else
341 { 392 {
342 connection *c = conns[src - 1]; 393 connection *c = conns[src - 1];
343 394
344 if (dst == 0 && !THISNODE->routerprio) 395 if (dst == 0)
345 slog (L_WARN, _("%s(%s): received broadcast, but we are no router"), 396 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"),
346 c->conf->nodename, (const char *)rsi); 397 c->conf->nodename, (const char *)rsi);
347 else if (dst != 0 && dst != THISNODE->id) 398 else if (dst != 0 && dst != THISNODE->id)
348 { 399 {
349 if (THISNODE->routerprio) 400 if (THISNODE->routerprio)
350 // the tos setting gets lost here. who cares. 401 // the tos setting gets lost here. who cares.
… …
405 revents); 456 revents);
406 exit (1); 457 exit (1);
407 } 458 }
408} 459}
409 460
461#if ENABLE_ICMP
410void 462void
411vpn::icmpv4_ev (io_watcher &w, short revents) 463vpn::icmpv4_ev (io_watcher &w, short revents)
412{ 464{
413 if (revents & (POLLIN | POLLERR)) 465 if (revents & (POLLIN | POLLERR))
414 { 466 {
… …
423 475
424 if (len > 0) 476 if (len > 0)
425 { 477 {
426 pkt->len = len; 478 pkt->len = len;
427 479
428 icmphdr *hdr = (icmphdr *)&((*pkt)[IP_OVERHEAD]); 480 icmp_header *hdr = (icmp_header *)&((*pkt)[IP_OVERHEAD]);
429 481
430 if (hdr->type == ::conf.icmp_type 482 if (hdr->type == ::conf.icmp_type
431 && hdr->code == 255) 483 && hdr->code == 255)
432 { 484 {
433 // raw sockets deliver the ipv4, but don't expect it on sends 485 // raw sockets deliver the ipv4, but don't expect it on sends
… …
457 _("FATAL: unknown revents %08x in socket, terminating\n"), 509 _("FATAL: unknown revents %08x in socket, terminating\n"),
458 revents); 510 revents);
459 exit (1); 511 exit (1);
460 } 512 }
461} 513}
514#endif
462 515
463void 516void
464vpn::udpv4_ev (io_watcher &w, short revents) 517vpn::udpv4_ev (io_watcher &w, short revents)
465{ 518{
466 if (revents & (POLLIN | POLLERR)) 519 if (revents & (POLLIN | POLLERR))
… …
516 int dst = mac2id (pkt->dst); 569 int dst = mac2id (pkt->dst);
517 int src = mac2id (pkt->src); 570 int src = mac2id (pkt->src);
518 571
519 if (src != THISNODE->id) 572 if (src != THISNODE->id)
520 { 573 {
521 slog (L_ERR, _("FATAL: tap packet not originating on current node received, terminating.")); 574 slog (L_ERR, _("FATAL: tap packet not originating on current node received, exiting."));
522 exit (1); 575 exit (1);
523 } 576 }
524 577
525 if (dst == THISNODE->id) 578 if (dst == THISNODE->id)
526 { 579 {
527 slog (L_ERR, _("FATAL: tap packet destined for current node received, terminating.")); 580 slog (L_ERR, _("FATAL: tap packet destined for current node received, exiting."));
528 exit (1); 581 exit (1);
529 } 582 }
530 583
531 if (dst > conns.size ()) 584 if (dst > conns.size ())
532 slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst); 585 slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
… …
538 if (dst != THISNODE->id) 591 if (dst != THISNODE->id)
539 conns[dst - 1]->inject_data_packet (pkt); 592 conns[dst - 1]->inject_data_packet (pkt);
540 } 593 }
541 else 594 else
542 { 595 {
543 // broadcast, first check router, then self, then english 596 // broadcast, this is ugly, but due to the security policy
544 connection *router = find_router (); 597 // we have to connect to all hosts...
545
546 if (router)
547 router->inject_data_packet (pkt, true);
548 else
549 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 598 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
550 if ((*c)->conf != THISNODE) 599 if ((*c)->conf != THISNODE)
551 (*c)->inject_data_packet (pkt); 600 (*c)->inject_data_packet (pkt);
552 } 601 }
553 } 602 }
554 603
555 delete pkt; 604 delete pkt;
556 } 605 }
… …
623 } 672 }
624} 673}
625 674
626connection *vpn::find_router () 675connection *vpn::find_router ()
627{ 676{
628 u32 prio = 0; 677 u32 prio = 1;
629 connection *router = 0; 678 connection *router = 0;
630 679
631 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 680 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
632 { 681 {
633 connection *c = *i; 682 connection *c = *i;
634 683
635 if (c->conf->routerprio > prio 684 if (c->conf->routerprio > prio
636 && c->connectmode == conf_node::C_ALWAYS 685 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use
637 && c->conf != THISNODE
638 && c->ictx && c->octx) 686 && c->ictx && c->octx
687 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode
639 { 688 {
640 prio = c->conf->routerprio; 689 prio = c->conf->routerprio;
641 router = c; 690 router = c;
642 } 691 }
643 } 692 }
… …
652 if (c) 701 if (c)
653 c->send_connect_request (id); 702 c->send_connect_request (id);
654 else 703 else
655 // no router found, aggressively connect to all routers 704 // no router found, aggressively connect to all routers
656 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 705 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
657 if ((*i)->conf->routerprio) 706 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
658 (*i)->establish_connection (); 707 (*i)->establish_connection ();
659} 708}
660 709
661void 710void
662connection::dump_status () 711connection::dump_status ()

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines