[ViewVC] Diff of: cvs/gvpe/src/vpn.C

Comparing gvpe/src/vpn.C (file contents):
Revision 1.23 by pcg, Thu Jan 29 18:55:10 2004 UTC vs.
Revision 1.37 by pcg, Tue Apr 19 03:47:32 2005 UTC

 /*
     vpn.C -- handle the protocol, encryption, handshaking etc.
-    Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>
+    Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
+    This file is part of GVPE.
-    This program is free software; you can redistribute it and/or modify
+    GVPE is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
     the Free Software Foundation; either version 2 of the License, or
     (at your option) any later version.
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
     You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
+    along with gvpe; if not, write to the Free Software
     Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #include "config.h"
 vpn network; // THE vpn (bad design...)
 /////////////////////////////////////////////////////////////////////////////
-const char *vpn::script_if_up ()
+void
+vpn::script_init_env ()
 {
   // the tunnel device mtu should be the physical mtu - overhead
   // the tricky part is rounding to the cipher key blocksize
   int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
   mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
   mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
   mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
   char *env;
   asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
-  asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
-  asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
   asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
   asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
   asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
   asprintf (&env, "MTU=%d", mtu); putenv (env);
-  asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x",
+  asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
-            0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8,
+  asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
-            THISNODE->id & 0xff);
-  putenv (env);
+  conns [THISNODE->id - 1]->script_init_env ("");
+  for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
+    {
+      char ext[16];
+      snprintf (ext, 16, "_%d", (*c)->conf->id);
+      (*c)->script_init_env (ext);
+    }
+}
+const char *vpn::script_if_init ()
+{
+  script_init_env ();
+  return tap->if_up ();
+}
+const char *vpn::script_if_up ()
+{
+  script_init_env ();
+  char *filename;
+  asprintf (&filename,
+            "%s/%s",
+            confbase,
-  return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
+            ::conf.script_if_up ? ::conf.script_if_up : "if-up");
+  return filename;
 }
 int
 vpn::setup ()
 {
       if (ipv4_fd < 0)
         return -1;
       fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
+      fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
 #if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
       // this I really consider a linux bug. I am neither connected
       // nor do I fragment myself. Linux still sets DF and doesn't
       // fragment for me sometimes.
       if (udpv4_fd < 0)
         return -1;
       fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
+      fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
       // standard daemon practise...
       {
         int oval = 1;
         setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
       if (icmpv4_fd < 0)
         return -1;
       fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
+      fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
 #ifdef ICMP_FILTER
       {
         icmp_filter oval;
         oval.data = 0xffffffff;
       // this I really consider a linux bug. I am neither connected
       // nor do I fragment myself. Linux still sets DF and doesn't
       // fragment for me sometimes.
       {
         int oval = IP_PMTUDISC_DONT;
-        setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
+        setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
       }
 #endif
       sockinfo si (THISNODE, PROT_ICMPv4);
       if (tcpv4_fd < 0)
         return -1;
       fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
+      fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
       // standard daemon practise...
       {
         int oval = 1;
         setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
       tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ);
     }
 #endif
+#if ENABLE_DNS
+  if (THISNODE->protocols & PROT_DNSv4)
+    {
+      dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
+      dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
+      if (dnsv4_fd < 0)
+        return -1;
+      fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
+      fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
+# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
+      // this I really consider a linux bug. I am neither connected
+      // nor do I fragment myself. Linux still sets DF and doesn't
+      // fragment for me sometimes.
+      {
+        int oval = IP_PMTUDISC_DONT;
+        setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
+      }
+# endif
+      // standard daemon practise...
+      {
+        int oval = 1;
+        setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
+      }
+      sockinfo si (THISNODE->dns_hostname,
+                   THISNODE->dns_hostname ? THISNODE->dns_port : 0,
+                   PROT_DNSv4);
+      if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
+        {
+          slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno));
+          exit (EXIT_FAILURE);
+        }
+      dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ);
+    }
+#endif
+  /////////////////////////////////////////////////////////////////////////////
+  reconnect_all ();
+  /////////////////////////////////////////////////////////////////////////////
   tap = new tap_device ();
   if (!tap) //D this, of course, never catches
     {
       slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
       exit (EXIT_FAILURE);
     }
+  fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
+  if (tap->if_up () &&
+      !run_script (run_script_cb (this, &vpn::script_if_init), true))
+    {
+      slog (L_ERR, _("interface initialization command '%s' failed, exiting."),
+            tap->if_up ());
+      exit (EXIT_FAILURE);
+    }
-  run_script (run_script_cb (this, &vpn::script_if_up), true);
+  if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
+    {
+      slog (L_ERR, _("if-up command execution failed, exiting."));
+      exit (EXIT_FAILURE);
+    }
   tap_ev_watcher.start (tap->fd, EVENT_READ);
-  reconnect_all ();
   return 0;
-}
-// send a vpn packet out to other hosts
-bool
-vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
-{
-  switch (si.prot)
-    {
-      case PROT_IPv4:
-        return send_ipv4_packet (pkt, si, tos);
-      case PROT_UDPv4:
-        return send_udpv4_packet (pkt, si, tos);
-#if ENABLE_TCP
-      case PROT_TCPv4:
-        return send_tcpv4_packet (pkt, si, tos);
-#endif
-#if ENABLE_ICMP
-      case PROT_ICMPv4:
-        return send_icmpv4_packet (pkt, si, tos);
-#endif
-      default:
-        slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);
-        return false;
-    }
 }
 bool
 vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
 {
       else
         c->recv_vpn_packet (pkt, rsi);
     }
 }
+bool
+vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
+{
+  switch (si.prot)
+    {
+      case PROT_IPv4:
+        return send_ipv4_packet (pkt, si, tos);
+      case PROT_UDPv4:
+        return send_udpv4_packet (pkt, si, tos);
+#if ENABLE_TCP
+      case PROT_TCPv4:
+        return send_tcpv4_packet (pkt, si, tos);
+#endif
+#if ENABLE_ICMP
+      case PROT_ICMPv4:
+        return send_icmpv4_packet (pkt, si, tos);
+#endif
+#if ENABLE_DNS
+      case PROT_DNSv4:
+        return send_dnsv4_packet (pkt, si, tos);
+#endif
+      default:
+        slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);
+    }
+  return false;
+}
 void
 vpn::ipv4_ev (io_watcher &w, short revents)
 {
   if (revents & EVENT_READ)
     {
       if (len > 0)
         {
           pkt->len = len;
-          // raw sockets deliver the ipv4, but don't expect it on sends
+          // raw sockets deliver the ipv4 header, but don't expect it on sends
-          // this is slow, but...
           pkt->skip_hdr (IP_OVERHEAD);
           recv_vpn_packet (pkt, si);
         }
       else
       delete pkt;
     }
   else
     {
       slog (L_ERR,
-              _("FATAL: unknown revents %08x in socket, terminating\n"),
+            _("FATAL: unknown revents %08x in socket, terminating\n"),
-              revents);
+            revents);
       exit (EXIT_FAILURE);
     }
 }
 #if ENABLE_ICMP
           int dst = mac2id (pkt->dst);
           int src = mac2id (pkt->src);
           if (src != THISNODE->id)
             {
-              slog (L_ERR, _("FATAL: tap packet not originating on current node received, exiting."));
+              slog (L_ERR, _("FATAL: tap packet not originating on current node received (if-up script not working properly?), exiting."));
               exit (EXIT_FAILURE);
             }
           if (dst == THISNODE->id)
             {
       if (events & EVENT_SHUTDOWN)
         {
           slog (L_INFO, _("preparing shutdown..."));
           shutdown_all ();
-          remove_pid (pidfilename);
+          remove_pid (conf.pidfilename);
           slog (L_INFO, _("terminating"));
           exit (EXIT_SUCCESS);
         }
       if (events & EVENT_RECONNECT)
   connection_init ();
   for (configuration::node_vector::iterator i = conf.nodes.begin ();
        i != conf.nodes.end (); ++i)
     {
-      connection *conn = new connection (this);
+      connection *conn = new connection (this, *i);
-      conn->conf = *i;
       conns.push_back (conn);
       conn->establish_connection ();
     }
 }
 connection *vpn::find_router ()
 , tcpv4_ev_watcher (this, &vpn::tcpv4_ev)
 #endif
 #if ENABLE_ICMP
 , icmpv4_ev_watcher(this, &vpn::icmpv4_ev)
 #endif
+#if ENABLE_DNS
+, dnsv4_ev_watcher (this, &vpn::dnsv4_ev)
+#endif
 , tap_ev_watcher   (this, &vpn::tap_ev)
 {
 }
 vpn::~vpn ()

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/vpn.C (file contents): Revision 1.23 by pcg, Thu Jan 29 18:55:10 2004 UTC vs. Revision 1.37 by pcg, Tue Apr 19 03:47:32 2005 UTC

Diff Legend

Comparing gvpe/src/vpn.C (file contents):
Revision 1.23 by pcg, Thu Jan 29 18:55:10 2004 UTC vs.
Revision 1.37 by pcg, Tue Apr 19 03:47:32 2005 UTC