ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.23 by pcg, Thu Jan 29 18:55:10 2004 UTC vs.
Revision 1.57 by root, Tue Feb 8 23:13:48 2011 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE.
6
5 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
6 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
7 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
8 (at your option) any later version. 10 option) any later version.
9 11
10 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
11 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
13 GNU General Public License for more details. 15 Public License for more details.
14 16
15 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
16 along with this program; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
17 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
18*/ 30*/
19 31
20#include "config.h" 32#include "config.h"
21 33
22#include <list> 34#include <list>
… …
44 56
45vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
46 58
47///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
48 60
49const char *vpn::script_if_up () 61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
73void
74vpn::script_init_env ()
50{ 75{
51 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
52 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
53 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 78 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
54 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 79 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
55 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
56 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
57 82
58 char *env; 83 char *env;
59 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
60 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
61 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
62 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
63 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 86 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
64 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 87 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
65 asprintf (&env, "MTU=%d", mtu); putenv (env); 88 asprintf (&env, "MTU=%d", mtu); putenv (env);
66 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 89 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
67 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 90 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
68 THISNODE->id & 0xff);
69 putenv (env);
70 91
92 conns [THISNODE->id - 1]->script_init_env ("");
93
94 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
95 {
96 char ext[16];
97 snprintf (ext, 16, "_%d", (*c)->conf->id);
98 (*c)->script_init_env (ext);
99 }
100}
101
102inline const char *
103vpn::script_if_init ()
104{
105 script_init_env ();
106
107 return tap->if_up ();
108}
109
110inline const char *
111vpn::script_if_up ()
112{
113 script_init_env ();
114
115 char *filename;
116 asprintf (&filename,
117 "%s/%s",
118 confbase,
71 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 119 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
120
121 return filename;
122}
123
124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
72} 145}
73 146
74int 147int
75vpn::setup () 148vpn::setup ()
76{ 149{
150 int success = 0;
151
152 ipv4_tos = -1;
77 ipv4_fd = -1; 153 ipv4_fd = -1;
78 154
79 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 155 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
80 { 156 {
81 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 157 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
82 158
83 if (ipv4_fd < 0) 159 if (ipv4_fd < 0)
84 return -1; 160 return -1;
85
86 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
87 161
88#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 162#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
89 // this I really consider a linux bug. I am neither connected 163 // this I really consider a linux bug. I am neither connected
90 // nor do I fragment myself. Linux still sets DF and doesn't 164 // nor do I fragment myself. Linux still sets DF and doesn't
91 // fragment for me sometimes. 165 // fragment for me sometimes.
… …
97 171
98 sockinfo si (THISNODE, PROT_IPv4); 172 sockinfo si (THISNODE, PROT_IPv4);
99 173
100 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 174 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
101 { 175 {
102 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 176 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
103 exit (EXIT_FAILURE); 177 return -1;
104 } 178 }
105 179
106 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 180 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
181 ++success;
107 } 182 }
183 else
184 THISNODE->protocols &= ~PROT_IPv4;
108 185
186 udpv4_tos = -1;
109 udpv4_fd = -1; 187 udpv4_fd = -1;
110 188
111 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 189 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
112 { 190 {
113 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 191 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
114 192
115 if (udpv4_fd < 0) 193 if (udpv4_fd < 0)
116 return -1; 194 return -1;
117
118 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
119 195
120 // standard daemon practise... 196 // standard daemon practise...
121 { 197 {
122 int oval = 1; 198 int oval = 1;
123 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 199 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
135 211
136 sockinfo si (THISNODE, PROT_UDPv4); 212 sockinfo si (THISNODE, PROT_UDPv4);
137 213
138 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 214 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
139 { 215 {
140 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 216 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
141 exit (EXIT_FAILURE); 217 return -1;
142 } 218 }
143 219
144 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 220 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
221 ++success;
145 } 222 }
223 else
224 THISNODE->protocols &= ~PROT_UDPv4;
146 225
226 icmpv4_tos = -1;
147 icmpv4_fd = -1; 227 icmpv4_fd = -1;
148 228
149#if ENABLE_ICMP 229#if ENABLE_ICMP
150 if (THISNODE->protocols & PROT_ICMPv4) 230 if (THISNODE->protocols & PROT_ICMPv4)
151 { 231 {
152 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 232 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
153 233
154 if (icmpv4_fd < 0) 234 if (icmpv4_fd < 0)
155 return -1; 235 return -1;
156
157 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
158 236
159#ifdef ICMP_FILTER 237#ifdef ICMP_FILTER
160 { 238 {
161 icmp_filter oval; 239 icmp_filter oval;
162 oval.data = 0xffffffff; 240 oval.data = 0xffffffff;
… …
171 // this I really consider a linux bug. I am neither connected 249 // this I really consider a linux bug. I am neither connected
172 // nor do I fragment myself. Linux still sets DF and doesn't 250 // nor do I fragment myself. Linux still sets DF and doesn't
173 // fragment for me sometimes. 251 // fragment for me sometimes.
174 { 252 {
175 int oval = IP_PMTUDISC_DONT; 253 int oval = IP_PMTUDISC_DONT;
176 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 254 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
177 } 255 }
178#endif 256#endif
179 257
180 sockinfo si (THISNODE, PROT_ICMPv4); 258 sockinfo si (THISNODE, PROT_ICMPv4);
181 259
182 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 260 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
183 { 261 {
184 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 262 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
185 exit (EXIT_FAILURE); 263 return -1;
186 } 264 }
187 265
188 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 266 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
267 ++success;
189 } 268 }
190#endif 269#endif
191 270
192 tcpv4_fd = -1; 271 tcpv4_fd = -1;
193 272
194#if ENABLE_TCP 273#if ENABLE_TCP
195 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 274 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
196 { 275 {
197 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 276 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
198 277
199 if (tcpv4_fd < 0) 278 if (tcpv4_fd < 0)
200 return -1; 279 return -1;
201
202 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
203 280
204 // standard daemon practise... 281 // standard daemon practise...
205 { 282 {
206 int oval = 1; 283 int oval = 1;
207 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 284 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
209 286
210 sockinfo si (THISNODE, PROT_TCPv4); 287 sockinfo si (THISNODE, PROT_TCPv4);
211 288
212 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
213 { 290 {
214 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
215 exit (EXIT_FAILURE); 292 return -1;
216 } 293 }
217 294
218 if (listen (tcpv4_fd, 5)) 295 if (listen (tcpv4_fd, 5))
219 { 296 {
220 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 297 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
221 exit (EXIT_FAILURE); 298 return -1;
222 } 299 }
223 300
224 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 301 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
302 ++success;
303 }
304 else
305 THISNODE->protocols &= ~PROT_TCPv4;
306#endif
307
308 dnsv4_tos = -1;
309 dnsv4_fd = -1;
310
311#if ENABLE_DNS
312 if (THISNODE->protocols & PROT_DNSv4)
313 {
314 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
315
316 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
317
318 if (dnsv4_fd < 0)
319 return -1;
320
321# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
322 // this I really consider a linux bug. I am neither connected
323 // nor do I fragment myself. Linux still sets DF and doesn't
324 // fragment for me sometimes.
325 {
326 int oval = IP_PMTUDISC_DONT;
327 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
225 } 328 }
226#endif 329# endif
330
331 // standard daemon practise...
332 {
333 int oval = 1;
334 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
335 }
336
337 sockinfo si (THISNODE->dns_hostname,
338 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
339 PROT_DNSv4);
340
341 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
342 {
343 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
344 return -1;
345 }
346
347 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
348 ++success;
349 }
350#endif
351
352 /////////////////////////////////////////////////////////////////////////////
353
354 if (!success)
355 {
356 slog (L_ERR, _("no protocols enabled."));
357 return -1;
358 }
359
360 reconnect_all ();
361
362 /////////////////////////////////////////////////////////////////////////////
227 363
228 tap = new tap_device (); 364 tap = new tap_device ();
229 if (!tap) //D this, of course, never catches 365 if (!tap) //D this, of course, never catches
230 { 366 {
231 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 367 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
232 exit (EXIT_FAILURE); 368 return -1;
233 } 369 }
234 370
235 run_script (run_script_cb (this, &vpn::script_if_up), true); 371 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
236 372
373 run_script_cb cb;
374 cb.set<vpn, &vpn::script_if_init> (this);
375
376 if (tap->if_up () &&
377 !run_script (cb, true))
378 {
379 slog (L_ERR, _("interface initialization command '%s' failed."),
380 tap->if_up ());
381 return -1;
382 }
383
384 cb.set<vpn, &vpn::script_if_up> (this);
385 if (!run_script (cb, true))
386 {
387 slog (L_ERR, _("if-up command execution failed."));
388 return -1;
389 }
390
237 tap_ev_watcher.start (tap->fd, EVENT_READ); 391 tap_ev_watcher.start (tap->fd, EV_READ);
238
239 reconnect_all ();
240 392
241 return 0; 393 return 0;
242}
243
244// send a vpn packet out to other hosts
245bool
246vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
247{
248 switch (si.prot)
249 {
250 case PROT_IPv4:
251 return send_ipv4_packet (pkt, si, tos);
252
253 case PROT_UDPv4:
254 return send_udpv4_packet (pkt, si, tos);
255
256#if ENABLE_TCP
257 case PROT_TCPv4:
258 return send_tcpv4_packet (pkt, si, tos);
259#endif
260
261#if ENABLE_ICMP
262 case PROT_ICMPv4:
263 return send_icmpv4_packet (pkt, si, tos);
264#endif
265
266 default:
267 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);
268 return false;
269 }
270} 394}
271 395
272bool 396bool
273vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 397vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
274{ 398{
275#if defined(SOL_IP) && defined(IP_TOS) 399 set_tos (ipv4_fd, ipv4_tos, tos);
276 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
277#endif
278 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 400 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
279 401
280 return true; 402 return true;
281} 403}
282 404
… …
305 427
306#if ENABLE_ICMP 428#if ENABLE_ICMP
307bool 429bool
308vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 430vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
309{ 431{
310#if defined(SOL_IP) && defined(IP_TOS)
311 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
312#endif
313
314 pkt->unshift_hdr (4); 432 pkt->unshift_hdr (4);
315 433
316 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 434 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
317 hdr->type = ::conf.icmp_type; 435 hdr->type = ::conf.icmp_type;
318 hdr->code = 255; 436 hdr->code = 255;
319 hdr->checksum = 0; 437 hdr->checksum = 0;
320 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 438 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
321 439
440 set_tos (icmpv4_fd, icmpv4_tos, tos);
322 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 441 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
323 442
324 return true; 443 return true;
325} 444}
326#endif 445#endif
327 446
328bool 447bool
329vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 448vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
330{ 449{
331#if defined(SOL_IP) && defined(IP_TOS) 450 set_tos (udpv4_fd, udpv4_tos, tos);
332 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
333#endif
334 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 451 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
335 452
336 return true; 453 return true;
337} 454}
338 455
… …
349 { 466 {
350 // broadcast, this is ugly, but due to the security policy 467 // broadcast, this is ugly, but due to the security policy
351 // we have to connect to all hosts... 468 // we have to connect to all hosts...
352 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 469 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
353 if ((*c)->conf != THISNODE) 470 if ((*c)->conf != THISNODE)
354 (*c)->inject_data_packet (pkt, true); 471 (*c)->inject_data_packet (pkt);
355 } 472 }
356} 473}
357 474
358void 475void
359vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 476vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
360{ 477{
361 unsigned int src = pkt->src (); 478 unsigned int src = pkt->src ();
362 unsigned int dst = pkt->dst (); 479 unsigned int dst = pkt->dst ();
363 480
364 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 481 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
365 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 482 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
366 483
367 if (src == 0 || src > conns.size () 484 if (src == 0 || src > conns.size ()
368 || dst > conns.size () 485 || dst > conns.size ()
369 || pkt->typ () >= vpn_packet::PT_MAX) 486 || pkt->typ () >= vpn_packet::PT_MAX)
370 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 487 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
371 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 488 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
372 else if (dst > conns.size ()) 489 else if (dst > conns.size ())
373 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 490 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
374 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 491 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
375 else 492 else
376 { 493 {
377 connection *c = conns[src - 1]; 494 connection *c = conns[src - 1];
378 495
379 if (dst == 0) 496 if (dst == 0)
380 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 497 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
381 c->conf->nodename, (const char *)rsi); 498 c->conf->nodename, (const char *)rsi);
382 else if (dst != THISNODE->id) 499 else if (dst != THISNODE->id)
383 { 500 {
384 if (THISNODE->routerprio) 501 if (THISNODE->routerprio)
385 // the tos setting gets lost here. who cares. 502 // the tos setting gets lost here. who cares.
386 conns[dst - 1]->inject_vpn_packet (pkt); 503 conns[dst - 1]->inject_vpn_packet (pkt);
387 else 504 else
388 slog (L_WARN, 505 slog (L_WARN,
389 _("%s(%s): forwarding request (=> %s), but we are no router"), 506 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
390 c->conf->nodename, (const char *)rsi, 507 c->conf->nodename, (const char *)rsi,
391 conns[dst - 1]->conf->nodename); 508 conns[dst - 1]->conf->nodename);
392 } 509 }
393 else 510 else
394 c->recv_vpn_packet (pkt, rsi); 511 c->recv_vpn_packet (pkt, rsi);
395 } 512 }
396} 513}
397 514
398void 515bool
516vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
517{
518 switch (si.prot)
519 {
520 case PROT_IPv4:
521 return send_ipv4_packet (pkt, si, tos);
522
523 case PROT_UDPv4:
524 return send_udpv4_packet (pkt, si, tos);
525
526#if ENABLE_TCP
527 case PROT_TCPv4:
528 return send_tcpv4_packet (pkt, si, tos);
529#endif
530#if ENABLE_ICMP
531 case PROT_ICMPv4:
532 return send_icmpv4_packet (pkt, si, tos);
533#endif
534#if ENABLE_DNS
535 case PROT_DNSv4:
536 return send_dnsv4_packet (pkt, si, tos);
537#endif
538 default:
539 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
540 }
541
542 return false;
543}
544
545inline void
399vpn::ipv4_ev (io_watcher &w, short revents) 546vpn::ipv4_ev (ev::io &w, int revents)
400{ 547{
401 if (revents & EVENT_READ) 548 if (revents & EV_READ)
402 { 549 {
403 vpn_packet *pkt = new vpn_packet; 550 vpn_packet *pkt = new vpn_packet;
404 struct sockaddr_in sa; 551 struct sockaddr_in sa;
405 socklen_t sa_len = sizeof (sa); 552 socklen_t sa_len = sizeof (sa);
406 int len; 553 int len;
… …
411 558
412 if (len > 0) 559 if (len > 0)
413 { 560 {
414 pkt->len = len; 561 pkt->len = len;
415 562
416 // raw sockets deliver the ipv4, but don't expect it on sends 563 // raw sockets deliver the ipv4 header, but don't expect it on sends
417 // this is slow, but...
418 pkt->skip_hdr (IP_OVERHEAD); 564 pkt->skip_hdr (IP_OVERHEAD);
419 565
420 recv_vpn_packet (pkt, si); 566 recv_vpn_packet (pkt, si);
421 } 567 }
422 else 568 else
423 { 569 {
424 // probably ECONNRESET or somesuch 570 // probably ECONNRESET or somesuch
425 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 571 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
426 } 572 }
427 573
428 delete pkt; 574 delete pkt;
429 } 575 }
430 else 576 else
431 { 577 {
432 slog (L_ERR, 578 slog (L_ERR,
433 _("FATAL: unknown revents %08x in socket, terminating\n"), 579 _("FATAL: unknown revents %08x in socket, exiting.\n"),
434 revents); 580 revents);
435 exit (EXIT_FAILURE); 581 exit (EXIT_FAILURE);
436 } 582 }
437} 583}
438 584
439#if ENABLE_ICMP 585#if ENABLE_ICMP
440void 586inline void
441vpn::icmpv4_ev (io_watcher &w, short revents) 587vpn::icmpv4_ev (ev::io &w, int revents)
442{ 588{
443 if (revents & EVENT_READ) 589 if (revents & EV_READ)
444 { 590 {
445 vpn_packet *pkt = new vpn_packet; 591 vpn_packet *pkt = new vpn_packet;
446 struct sockaddr_in sa; 592 struct sockaddr_in sa;
447 socklen_t sa_len = sizeof (sa); 593 socklen_t sa_len = sizeof (sa);
448 int len; 594 int len;
… …
468 } 614 }
469 } 615 }
470 else 616 else
471 { 617 {
472 // probably ECONNRESET or somesuch 618 // probably ECONNRESET or somesuch
473 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 619 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
474 } 620 }
475 621
476 delete pkt; 622 delete pkt;
477 } 623 }
478 else 624 else
479 { 625 {
480 slog (L_ERR, 626 slog (L_ERR,
481 _("FATAL: unknown revents %08x in socket, terminating\n"), 627 _("FATAL: unknown revents %08x in socket, exiting.\n"),
482 revents); 628 revents);
483 exit (EXIT_FAILURE); 629 exit (EXIT_FAILURE);
484 } 630 }
485} 631}
486#endif 632#endif
487 633
488void 634inline void
489vpn::udpv4_ev (io_watcher &w, short revents) 635vpn::udpv4_ev (ev::io &w, int revents)
490{ 636{
491 if (revents & EVENT_READ) 637 if (revents & EV_READ)
492 { 638 {
493 vpn_packet *pkt = new vpn_packet; 639 vpn_packet *pkt = new vpn_packet;
494 struct sockaddr_in sa; 640 struct sockaddr_in sa;
495 socklen_t sa_len = sizeof (sa); 641 socklen_t sa_len = sizeof (sa);
496 int len; 642 int len;
… …
506 recv_vpn_packet (pkt, si); 652 recv_vpn_packet (pkt, si);
507 } 653 }
508 else 654 else
509 { 655 {
510 // probably ECONNRESET or somesuch 656 // probably ECONNRESET or somesuch
511 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 657 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
512 } 658 }
513 659
514 delete pkt; 660 delete pkt;
515 } 661 }
516 else 662 else
517 { 663 {
518 slog (L_ERR, 664 slog (L_ERR,
519 _("FATAL: unknown revents %08x in socket, terminating\n"), 665 _("FATAL: unknown revents %08x in socket, exiting.\n"),
520 revents); 666 revents);
521 exit (EXIT_FAILURE); 667 exit (EXIT_FAILURE);
522 } 668 }
523} 669}
524 670
525void 671inline void
526vpn::tap_ev (io_watcher &w, short revents) 672vpn::tap_ev (ev::io &w, int revents)
527{ 673{
528 if (revents & EVENT_READ) 674 if (revents & EV_READ)
529 { 675 {
530 /* process data */ 676 /* process data */
531 tap_packet *pkt; 677 tap_packet *pkt;
532 678
533 pkt = tap->recv (); 679 pkt = tap->recv ();
… …
540 int dst = mac2id (pkt->dst); 686 int dst = mac2id (pkt->dst);
541 int src = mac2id (pkt->src); 687 int src = mac2id (pkt->src);
542 688
543 if (src != THISNODE->id) 689 if (src != THISNODE->id)
544 { 690 {
545 slog (L_ERR, _("FATAL: tap packet not originating on current node received, exiting.")); 691 slog (L_ERR, _("FATAL: tap packet not originating on current node received (if-up script not working properly?), exiting."));
546 exit (EXIT_FAILURE); 692 exit (EXIT_FAILURE);
547 } 693 }
548 694
549 if (dst == THISNODE->id) 695 if (dst == THISNODE->id)
550 { 696 {
… …
562 } 708 }
563 else 709 else
564 abort (); 710 abort ();
565} 711}
566 712
567void 713inline void
568vpn::event_cb (time_watcher &w) 714vpn::event_cb (ev::timer &w, int)
569{ 715{
570 if (events) 716 if (events)
571 { 717 {
572 if (events & EVENT_SHUTDOWN) 718 if (events & EVENT_SHUTDOWN)
573 { 719 {
574 slog (L_INFO, _("preparing shutdown...")); 720 slog (L_INFO, _("preparing shutdown..."));
575 721
576 shutdown_all (); 722 shutdown_all ();
577 remove_pid (pidfilename); 723 remove_pid (conf.pidfilename);
578 slog (L_INFO, _("terminating")); 724 slog (L_INFO, _("exiting."));
579 exit (EXIT_SUCCESS); 725 exit (EXIT_SUCCESS);
580 } 726 }
581 727
582 if (events & EVENT_RECONNECT) 728 if (events & EVENT_RECONNECT)
583 { 729 {
584 slog (L_INFO, _("forced reconnect")); 730 slog (L_INFO, _("forced reconnect."));
585 731
586 reconnect_all (); 732 reconnect_all ();
587 } 733 }
588 734
589 events = 0; 735 events = 0;
… …
605 751
606 conns.clear (); 752 conns.clear ();
607 753
608 connection_init (); 754 connection_init ();
609 755
610 for (configuration::node_vector::iterator i = conf.nodes.begin (); 756 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
611 i != conf.nodes.end (); ++i) 757 conns.push_back (new connection (this, *i));
612 {
613 connection *conn = new connection (this);
614 758
615 conn->conf = *i; 759 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
616 conns.push_back (conn);
617
618 conn->establish_connection (); 760 (*c)->establish_connection ();
619 }
620} 761}
621 762
622connection *vpn::find_router () 763bool
764vpn::can_direct (conf_node *src, conf_node *dst) const
623{ 765{
624 u32 prio = 1; 766 return src != dst
767 && src->may_direct (dst)
768 && dst->may_direct (src)
769 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
770 || (src->protocols & dst->connectable_protocols ()));
771}
772
773// only works for indirect and routed connections: find a router
774// from THISNODE to dst
775connection *
776vpn::find_router_for (const connection *dst)
777{
625 connection *router = 0; 778 connection *router = 0;
626 779
780 // first try to find a router with a direct connection, route there
781 // regardless of any other considerations.
782 {
783 u32 prio = 1;
784
785 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
786 {
787 connection *c = *i;
788
789 if (c->conf->routerprio > prio
790 && c->conf != THISNODE
791 && can_direct (c->conf, dst->conf)
792 && c->ictx && c->octx)
793 {
794 prio = c->conf->routerprio;
795 router = c;
796 }
797 }
798 }
799
800 if (router)
801 return router;
802
803 // second try find the router with the highest priority, higher than ours
804 {
805 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
806
807 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
808 {
809 connection *c = *i;
810
811 if (c->conf->routerprio > prio
812 && c != dst
813 && c->conf != THISNODE
814 && c->ictx && c->octx)
815 {
816 prio = c->conf->routerprio;
817 router = c;
818 }
819 }
820 }
821
822 return router;
823}
824
825void
826vpn::connection_established (connection *c)
827{
627 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 828 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
628 { 829 {
629 connection *c = *i; 830 connection *o = *i;
630 831
631 if (c->conf->routerprio > prio 832 if (!o->is_direct
632 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 833 && o->si.valid ()
633 && c->ictx && c->octx 834 && c->si != o->si
634 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 835 && c == find_router_for (o))
635 {
636 prio = c->conf->routerprio;
637 router = c;
638 } 836 {
837 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
838 o->conf->nodename, c->conf->nodename);
839 o->rekey ();
840 }
639 } 841 }
640
641 return router;
642} 842}
643 843
844void
644void vpn::send_connect_request (int id) 845vpn::send_connect_request (connection *c)
645{ 846{
646 connection *c = find_router (); 847 connection *r = find_router_for (c);
647 848
648 if (c) 849 if (r)
850 {
851 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
852 c->conf->nodename, r->conf->nodename);
649 c->send_connect_request (id); 853 r->send_connect_request (c->conf->id);
854 }
650 else 855 else
651 // no router found, aggressively connect to all routers 856 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
652 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 857 c->conf->nodename);
653 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
654 (*i)->establish_connection ();
655} 858}
656 859
657void 860void
658connection::dump_status () 861connection::dump_status ()
659{ 862{
660 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 863 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
661 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 864 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
662 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 865 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
663 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 866 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
664 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 867 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
665 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
666 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
667} 868}
668 869
669void 870void
670vpn::dump_status () 871vpn::dump_status ()
671{ 872{
672 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 873 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
673 874
674 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 875 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
675 (*c)->dump_status (); 876 (*c)->dump_status ();
676 877
677 slog (L_NOTICE, _("END status dump")); 878 slog (L_NOTICE, _("END status dump"));
678} 879}
679 880
680vpn::vpn (void) 881vpn::vpn (void)
882{
681: event (this, &vpn::event_cb) 883 event .set<vpn, &vpn::event_cb > (this);
682, udpv4_ev_watcher (this, &vpn::udpv4_ev) 884 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
683, ipv4_ev_watcher (this, &vpn::ipv4_ev) 885 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
684#if ENABLE_TCP 886#if ENABLE_TCP
685, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 887 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
686#endif 888#endif
687#if ENABLE_ICMP 889#if ENABLE_ICMP
688, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 890 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
689#endif 891#endif
690, tap_ev_watcher (this, &vpn::tap_ev) 892#if ENABLE_DNS
691{ 893 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
894#endif
895 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
692} 896}
693 897
694vpn::~vpn () 898vpn::~vpn ()
695{ 899{
696} 900}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines