ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.27 by pcg, Tue Mar 1 06:27:20 2005 UTC vs.
Revision 1.49 by pcg, Sun Aug 10 01:34:36 2008 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE.
6
5 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
6 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
7 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
8 (at your option) any later version. 10 option) any later version.
9 11
10 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
11 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
13 GNU General Public License for more details. 15 Public License for more details.
14 16
15 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
16 along with this program; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
17 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
18*/ 30*/
19 31
20#include "config.h" 32#include "config.h"
21 33
22#include <list> 34#include <list>
… …
44 56
45vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
46 58
47///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
48 60
49const char *vpn::script_if_up () 61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
73void
74vpn::script_init_env ()
50{ 75{
51 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
52 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
53 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 78 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
54 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 79 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
55 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
56 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
57 82
58 char *env; 83 char *env;
59 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
60 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
61 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
62 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
63 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 86 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
64 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 87 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
65 asprintf (&env, "MTU=%d", mtu); putenv (env); 88 asprintf (&env, "MTU=%d", mtu); putenv (env);
66 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 89 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
67 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 90 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
68 THISNODE->id & 0xff);
69 putenv (env);
70 91
92 conns [THISNODE->id - 1]->script_init_env ("");
93
94 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
95 {
96 char ext[16];
97 snprintf (ext, 16, "_%d", (*c)->conf->id);
98 (*c)->script_init_env (ext);
99 }
100}
101
102inline const char *
103vpn::script_if_init ()
104{
105 script_init_env ();
106
107 return tap->if_up ();
108}
109
110inline const char *
111vpn::script_if_up ()
112{
113 script_init_env ();
114
115 char *filename;
116 asprintf (&filename,
117 "%s/%s",
118 confbase,
71 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 119 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
120
121 return filename;
72} 122}
73 123
74int 124int
75vpn::setup () 125vpn::setup ()
76{ 126{
127 ipv4_tos = -1;
77 ipv4_fd = -1; 128 ipv4_fd = -1;
78 129
79 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 130 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
80 { 131 {
81 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 132 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
82 133
83 if (ipv4_fd < 0) 134 if (ipv4_fd < 0)
84 return -1; 135 return -1;
85 136
86 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK); 137 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
138 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
87 139
88#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 140#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
89 // this I really consider a linux bug. I am neither connected 141 // this I really consider a linux bug. I am neither connected
90 // nor do I fragment myself. Linux still sets DF and doesn't 142 // nor do I fragment myself. Linux still sets DF and doesn't
91 // fragment for me sometimes. 143 // fragment for me sometimes.
… …
97 149
98 sockinfo si (THISNODE, PROT_IPv4); 150 sockinfo si (THISNODE, PROT_IPv4);
99 151
100 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 152 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
101 { 153 {
102 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 154 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
103 exit (EXIT_FAILURE); 155 exit (EXIT_FAILURE);
104 } 156 }
105 157
106 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 158 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
107 } 159 }
108 160
161 udpv4_tos = -1;
109 udpv4_fd = -1; 162 udpv4_fd = -1;
110 163
111 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 164 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
112 { 165 {
113 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 166 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
114 167
115 if (udpv4_fd < 0) 168 if (udpv4_fd < 0)
116 return -1; 169 return -1;
117 170
118 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK); 171 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
172 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
119 173
120 // standard daemon practise... 174 // standard daemon practise...
121 { 175 {
122 int oval = 1; 176 int oval = 1;
123 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 177 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
135 189
136 sockinfo si (THISNODE, PROT_UDPv4); 190 sockinfo si (THISNODE, PROT_UDPv4);
137 191
138 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 192 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
139 { 193 {
140 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 194 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
141 exit (EXIT_FAILURE); 195 exit (EXIT_FAILURE);
142 } 196 }
143 197
144 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 198 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
145 } 199 }
146 200
201 icmpv4_tos = -1;
147 icmpv4_fd = -1; 202 icmpv4_fd = -1;
148 203
149#if ENABLE_ICMP 204#if ENABLE_ICMP
150 if (THISNODE->protocols & PROT_ICMPv4) 205 if (THISNODE->protocols & PROT_ICMPv4)
151 { 206 {
152 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 207 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
153 208
154 if (icmpv4_fd < 0) 209 if (icmpv4_fd < 0)
155 return -1; 210 return -1;
156 211
157 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK); 212 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
213 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
158 214
159#ifdef ICMP_FILTER 215#ifdef ICMP_FILTER
160 { 216 {
161 icmp_filter oval; 217 icmp_filter oval;
162 oval.data = 0xffffffff; 218 oval.data = 0xffffffff;
… …
171 // this I really consider a linux bug. I am neither connected 227 // this I really consider a linux bug. I am neither connected
172 // nor do I fragment myself. Linux still sets DF and doesn't 228 // nor do I fragment myself. Linux still sets DF and doesn't
173 // fragment for me sometimes. 229 // fragment for me sometimes.
174 { 230 {
175 int oval = IP_PMTUDISC_DONT; 231 int oval = IP_PMTUDISC_DONT;
176 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 232 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
177 } 233 }
178#endif 234#endif
179 235
180 sockinfo si (THISNODE, PROT_ICMPv4); 236 sockinfo si (THISNODE, PROT_ICMPv4);
181 237
182 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 238 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
183 { 239 {
184 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 240 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
185 exit (EXIT_FAILURE); 241 exit (EXIT_FAILURE);
186 } 242 }
187 243
188 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 244 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
189 } 245 }
190#endif 246#endif
191 247
192 tcpv4_fd = -1; 248 tcpv4_fd = -1;
193 249
… …
198 254
199 if (tcpv4_fd < 0) 255 if (tcpv4_fd < 0)
200 return -1; 256 return -1;
201 257
202 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK); 258 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
259 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
203 260
204 // standard daemon practise... 261 // standard daemon practise...
205 { 262 {
206 int oval = 1; 263 int oval = 1;
207 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 264 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
209 266
210 sockinfo si (THISNODE, PROT_TCPv4); 267 sockinfo si (THISNODE, PROT_TCPv4);
211 268
212 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 269 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
213 { 270 {
214 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 271 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
215 exit (EXIT_FAILURE); 272 exit (EXIT_FAILURE);
216 } 273 }
217 274
218 if (listen (tcpv4_fd, 5)) 275 if (listen (tcpv4_fd, 5))
219 { 276 {
220 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 277 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
221 exit (EXIT_FAILURE); 278 exit (EXIT_FAILURE);
222 } 279 }
223 280
224 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 281 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
225 } 282 }
226#endif 283#endif
284
285 dnsv4_tos = -1;
286 dnsv4_fd = -1;
227 287
228#if ENABLE_DNS 288#if ENABLE_DNS
229 if (THISNODE->protocols & PROT_DNSv4) 289 if (THISNODE->protocols & PROT_DNSv4)
230 { 290 {
291 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
292
231 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 293 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
232 294
233 if (dnsv4_fd < 0) 295 if (dnsv4_fd < 0)
234 return -1; 296 return -1;
235 297
298 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
299 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
300
301# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
302 // this I really consider a linux bug. I am neither connected
303 // nor do I fragment myself. Linux still sets DF and doesn't
304 // fragment for me sometimes.
305 {
306 int oval = IP_PMTUDISC_DONT;
307 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
308 }
309# endif
310
236 // standard daemon practise... 311 // standard daemon practise...
237 { 312 {
238 int oval = 1; 313 int oval = 1;
239 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 314 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
240 } 315 }
241 316
242 sockinfo si (THISNODE, PROT_DNSv4); 317 sockinfo si (THISNODE->dns_hostname,
318 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
319 PROT_DNSv4);
243 320
244 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 321 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
245 { 322 {
246 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 323 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
247 exit (EXIT_FAILURE); 324 exit (EXIT_FAILURE);
248 } 325 }
249 326
250 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 327 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
251 } 328 }
252#endif 329#endif
330
331 /////////////////////////////////////////////////////////////////////////////
332
333 reconnect_all ();
334
335 /////////////////////////////////////////////////////////////////////////////
253 336
254 tap = new tap_device (); 337 tap = new tap_device ();
255 if (!tap) //D this, of course, never catches 338 if (!tap) //D this, of course, never catches
256 { 339 {
257 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 340 slog (L_ERR, _("cannot create network interface '%s', exiting."), conf.ifname);
258 exit (EXIT_FAILURE); 341 exit (EXIT_FAILURE);
259 } 342 }
260 343
261 run_script (run_script_cb (this, &vpn::script_if_up), true); 344 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
262 345
346 run_script_cb cb;
347 cb.set<vpn, &vpn::script_if_init> (this);
348
349 if (tap->if_up () &&
350 !run_script (cb, true))
351 {
352 slog (L_ERR, _("interface initialization command '%s' failed, exiting."),
353 tap->if_up ());
354 exit (EXIT_FAILURE);
355 }
356
357 cb.set<vpn, &vpn::script_if_up> (this);
358 if (!run_script (cb, true))
359 {
360 slog (L_ERR, _("if-up command execution failed, exiting."));
361 exit (EXIT_FAILURE);
362 }
363
263 tap_ev_watcher.start (tap->fd, EVENT_READ); 364 tap_ev_watcher.start (tap->fd, EV_READ);
264
265 reconnect_all ();
266 365
267 return 0; 366 return 0;
268} 367}
269 368
270bool 369bool
271vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 370vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
272{ 371{
273#if defined(SOL_IP) && defined(IP_TOS) 372 set_tos (ipv4_fd, ipv4_tos, tos);
274 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
275#endif
276 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 373 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
277 374
278 return true; 375 return true;
279} 376}
280 377
… …
303 400
304#if ENABLE_ICMP 401#if ENABLE_ICMP
305bool 402bool
306vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 403vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
307{ 404{
308#if defined(SOL_IP) && defined(IP_TOS)
309 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
310#endif
311
312 pkt->unshift_hdr (4); 405 pkt->unshift_hdr (4);
313 406
314 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 407 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
315 hdr->type = ::conf.icmp_type; 408 hdr->type = ::conf.icmp_type;
316 hdr->code = 255; 409 hdr->code = 255;
317 hdr->checksum = 0; 410 hdr->checksum = 0;
318 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 411 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
319 412
413 set_tos (icmpv4_fd, icmpv4_tos, tos);
320 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 414 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
321 415
322 return true; 416 return true;
323} 417}
324#endif 418#endif
325 419
326bool 420bool
327vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 421vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
328{ 422{
329#if defined(SOL_IP) && defined(IP_TOS) 423 set_tos (udpv4_fd, udpv4_tos, tos);
330 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
331#endif
332 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 424 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
333 425
334 return true; 426 return true;
335} 427}
336 428
… …
347 { 439 {
348 // broadcast, this is ugly, but due to the security policy 440 // broadcast, this is ugly, but due to the security policy
349 // we have to connect to all hosts... 441 // we have to connect to all hosts...
350 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 442 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
351 if ((*c)->conf != THISNODE) 443 if ((*c)->conf != THISNODE)
352 (*c)->inject_data_packet (pkt, true); 444 (*c)->inject_data_packet (pkt);
353 } 445 }
354} 446}
355 447
356void 448void
357vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 449vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
358{ 450{
359 unsigned int src = pkt->src (); 451 unsigned int src = pkt->src ();
360 unsigned int dst = pkt->dst (); 452 unsigned int dst = pkt->dst ();
361 453
362 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 454 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
363 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 455 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
364 456
365 if (src == 0 || src > conns.size () 457 if (src == 0 || src > conns.size ()
366 || dst > conns.size () 458 || dst > conns.size ()
367 || pkt->typ () >= vpn_packet::PT_MAX) 459 || pkt->typ () >= vpn_packet::PT_MAX)
368 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 460 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
369 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 461 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
370 else if (dst > conns.size ()) 462 else if (dst > conns.size ())
371 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 463 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
372 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 464 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
373 else 465 else
374 { 466 {
375 connection *c = conns[src - 1]; 467 connection *c = conns[src - 1];
376 468
377 if (dst == 0) 469 if (dst == 0)
378 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 470 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
379 c->conf->nodename, (const char *)rsi); 471 c->conf->nodename, (const char *)rsi);
380 else if (dst != THISNODE->id) 472 else if (dst != THISNODE->id)
381 { 473 {
382 if (THISNODE->routerprio) 474 if (THISNODE->routerprio)
383 // the tos setting gets lost here. who cares. 475 // the tos setting gets lost here. who cares.
384 conns[dst - 1]->inject_vpn_packet (pkt); 476 conns[dst - 1]->inject_vpn_packet (pkt);
385 else 477 else
386 slog (L_WARN, 478 slog (L_WARN,
387 _("%s(%s): forwarding request (=> %s), but we are no router"), 479 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
388 c->conf->nodename, (const char *)rsi, 480 c->conf->nodename, (const char *)rsi,
389 conns[dst - 1]->conf->nodename); 481 conns[dst - 1]->conf->nodename);
390 } 482 }
391 else 483 else
392 c->recv_vpn_packet (pkt, rsi); 484 c->recv_vpn_packet (pkt, rsi);
393 } 485 }
394} 486}
395 487
396void 488bool
489vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
490{
491 switch (si.prot)
492 {
493 case PROT_IPv4:
494 return send_ipv4_packet (pkt, si, tos);
495
496 case PROT_UDPv4:
497 return send_udpv4_packet (pkt, si, tos);
498
499#if ENABLE_TCP
500 case PROT_TCPv4:
501 return send_tcpv4_packet (pkt, si, tos);
502#endif
503#if ENABLE_ICMP
504 case PROT_ICMPv4:
505 return send_icmpv4_packet (pkt, si, tos);
506#endif
507#if ENABLE_DNS
508 case PROT_DNSv4:
509 return send_dnsv4_packet (pkt, si, tos);
510#endif
511 default:
512 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
513 }
514
515 return false;
516}
517
518inline void
397vpn::ipv4_ev (io_watcher &w, short revents) 519vpn::ipv4_ev (ev::io &w, int revents)
398{ 520{
399 if (revents & EVENT_READ) 521 if (revents & EV_READ)
400 { 522 {
401 vpn_packet *pkt = new vpn_packet; 523 vpn_packet *pkt = new vpn_packet;
402 struct sockaddr_in sa; 524 struct sockaddr_in sa;
403 socklen_t sa_len = sizeof (sa); 525 socklen_t sa_len = sizeof (sa);
404 int len; 526 int len;
… …
409 531
410 if (len > 0) 532 if (len > 0)
411 { 533 {
412 pkt->len = len; 534 pkt->len = len;
413 535
414 // raw sockets deliver the ipv4, but don't expect it on sends 536 // raw sockets deliver the ipv4 header, but don't expect it on sends
415 // this is slow, but...
416 pkt->skip_hdr (IP_OVERHEAD); 537 pkt->skip_hdr (IP_OVERHEAD);
417 538
418 recv_vpn_packet (pkt, si); 539 recv_vpn_packet (pkt, si);
419 } 540 }
420 else 541 else
421 { 542 {
422 // probably ECONNRESET or somesuch 543 // probably ECONNRESET or somesuch
423 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 544 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
424 } 545 }
425 546
426 delete pkt; 547 delete pkt;
427 } 548 }
428 else 549 else
429 { 550 {
430 slog (L_ERR, 551 slog (L_ERR,
431 _("FATAL: unknown revents %08x in socket, terminating\n"), 552 _("FATAL: unknown revents %08x in socket, exiting.\n"),
432 revents); 553 revents);
433 exit (EXIT_FAILURE); 554 exit (EXIT_FAILURE);
434 } 555 }
435} 556}
436 557
437#if ENABLE_ICMP 558#if ENABLE_ICMP
438void 559inline void
439vpn::icmpv4_ev (io_watcher &w, short revents) 560vpn::icmpv4_ev (ev::io &w, int revents)
440{ 561{
441 if (revents & EVENT_READ) 562 if (revents & EV_READ)
442 { 563 {
443 vpn_packet *pkt = new vpn_packet; 564 vpn_packet *pkt = new vpn_packet;
444 struct sockaddr_in sa; 565 struct sockaddr_in sa;
445 socklen_t sa_len = sizeof (sa); 566 socklen_t sa_len = sizeof (sa);
446 int len; 567 int len;
… …
466 } 587 }
467 } 588 }
468 else 589 else
469 { 590 {
470 // probably ECONNRESET or somesuch 591 // probably ECONNRESET or somesuch
471 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 592 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
472 } 593 }
473 594
474 delete pkt; 595 delete pkt;
475 } 596 }
476 else 597 else
477 { 598 {
478 slog (L_ERR, 599 slog (L_ERR,
479 _("FATAL: unknown revents %08x in socket, terminating\n"), 600 _("FATAL: unknown revents %08x in socket, exiting.\n"),
480 revents); 601 revents);
481 exit (EXIT_FAILURE); 602 exit (EXIT_FAILURE);
482 } 603 }
483} 604}
484#endif 605#endif
485 606
486void 607inline void
487vpn::udpv4_ev (io_watcher &w, short revents) 608vpn::udpv4_ev (ev::io &w, int revents)
488{ 609{
489 if (revents & EVENT_READ) 610 if (revents & EV_READ)
490 { 611 {
491 vpn_packet *pkt = new vpn_packet; 612 vpn_packet *pkt = new vpn_packet;
492 struct sockaddr_in sa; 613 struct sockaddr_in sa;
493 socklen_t sa_len = sizeof (sa); 614 socklen_t sa_len = sizeof (sa);
494 int len; 615 int len;
… …
504 recv_vpn_packet (pkt, si); 625 recv_vpn_packet (pkt, si);
505 } 626 }
506 else 627 else
507 { 628 {
508 // probably ECONNRESET or somesuch 629 // probably ECONNRESET or somesuch
509 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 630 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
510 } 631 }
511 632
512 delete pkt; 633 delete pkt;
513 } 634 }
514 else 635 else
515 { 636 {
516 slog (L_ERR, 637 slog (L_ERR,
517 _("FATAL: unknown revents %08x in socket, terminating\n"), 638 _("FATAL: unknown revents %08x in socket, exiting.\n"),
518 revents); 639 revents);
519 exit (EXIT_FAILURE); 640 exit (EXIT_FAILURE);
520 } 641 }
521} 642}
522 643
523void 644inline void
524vpn::tap_ev (io_watcher &w, short revents) 645vpn::tap_ev (ev::io &w, int revents)
525{ 646{
526 if (revents & EVENT_READ) 647 if (revents & EV_READ)
527 { 648 {
528 /* process data */ 649 /* process data */
529 tap_packet *pkt; 650 tap_packet *pkt;
530 651
531 pkt = tap->recv (); 652 pkt = tap->recv ();
… …
538 int dst = mac2id (pkt->dst); 659 int dst = mac2id (pkt->dst);
539 int src = mac2id (pkt->src); 660 int src = mac2id (pkt->src);
540 661
541 if (src != THISNODE->id) 662 if (src != THISNODE->id)
542 { 663 {
543 slog (L_ERR, _("FATAL: tap packet not originating on current node received, exiting.")); 664 slog (L_ERR, _("FATAL: tap packet not originating on current node received (if-up script not working properly?), exiting."));
544 exit (EXIT_FAILURE); 665 exit (EXIT_FAILURE);
545 } 666 }
546 667
547 if (dst == THISNODE->id) 668 if (dst == THISNODE->id)
548 { 669 {
… …
560 } 681 }
561 else 682 else
562 abort (); 683 abort ();
563} 684}
564 685
565void 686inline void
566vpn::event_cb (time_watcher &w) 687vpn::event_cb (ev::timer &w, int)
567{ 688{
568 if (events) 689 if (events)
569 { 690 {
570 if (events & EVENT_SHUTDOWN) 691 if (events & EVENT_SHUTDOWN)
571 { 692 {
572 slog (L_INFO, _("preparing shutdown...")); 693 slog (L_INFO, _("preparing shutdown..."));
573 694
574 shutdown_all (); 695 shutdown_all ();
575 remove_pid (conf.pidfilename); 696 remove_pid (conf.pidfilename);
576 slog (L_INFO, _("terminating")); 697 slog (L_INFO, _("exiting."));
577 exit (EXIT_SUCCESS); 698 exit (EXIT_SUCCESS);
578 } 699 }
579 700
580 if (events & EVENT_RECONNECT) 701 if (events & EVENT_RECONNECT)
581 { 702 {
582 slog (L_INFO, _("forced reconnect")); 703 slog (L_INFO, _("forced reconnect."));
583 704
584 reconnect_all (); 705 reconnect_all ();
585 } 706 }
586 707
587 events = 0; 708 events = 0;
… …
612 conns.push_back (conn); 733 conns.push_back (conn);
613 conn->establish_connection (); 734 conn->establish_connection ();
614 } 735 }
615} 736}
616 737
617connection *vpn::find_router () 738bool vpn::can_direct (conf_node *src, conf_node *dst) const
618{ 739{
619 u32 prio = 1; 740 return src != dst
741 && src->may_direct (dst)
742 && dst->may_direct (src)
743 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
744 || (src->protocols & dst->connectable_protocols ()));
745}
746
747// only works for indirect and routed connections: find a router
748// from THISNODE to dst
749connection *vpn::find_router_for (const connection *dst)
750{
620 connection *router = 0; 751 connection *router = 0;
621 752
753 // first try to find a router with a direct connection
754 {
755 u32 prio = 1;
756
757 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
758 {
759 connection *c = *i;
760
761 if (c->conf->routerprio > prio
762 && c->conf != THISNODE
763 && c != dst
764 && can_direct (c->conf, dst->conf))
765 {
766 if (c->ictx && c->octx)
767 {
768 prio = c->conf->routerprio;
769 router = c;
770 }
771 else
772 c->establish_connection ();
773 }
774 }
775 }
776
777 if (router)
778 return router;
779
780 // second try find the router with the highest priority higher than ours
781 {
782 u32 prio = 1;
783
784 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
785 {
786 connection *c = *i;
787
788 if (c->conf->routerprio > prio
789 && c->conf->routerprio > THISNODE->routerprio
790 && c != dst
791 && c->conf != THISNODE)
792 {
793 if (c->ictx && c->octx)
794 {
795 prio = c->conf->routerprio;
796 router = c;
797 }
798 else
799 c->establish_connection ();
800 }
801 }
802 }
803 return router;
804}
805
806void vpn::connection_established (connection *c)
807{
622 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 808 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
623 { 809 {
624 connection *c = *i; 810 connection *o = *i;
625 811
626 if (c->conf->routerprio > prio 812 if (!o->is_direct
627 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 813 && o->si.valid ()
628 && c->ictx && c->octx 814 && c->si != o->si
629 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 815 && c == find_router_for (o))
630 {
631 prio = c->conf->routerprio;
632 router = c;
633 } 816 {
817 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
818 o->conf->nodename, c->conf->nodename);
819 o->rekey ();
820 }
634 } 821 }
635
636 return router;
637} 822}
638 823
639void vpn::send_connect_request (int id) 824void vpn::send_connect_request (int id)
640{ 825{
641 connection *c = find_router (); 826 connection *c = find_router_for (conns[id]);
642 827
643 if (c) 828 if (c)
829 {
830 slog (L_TRACE, _("%s: no way to connect, sending mediated connection request via %s."),
831 conns[id]->conf->nodename, c->conf->nodename);
644 c->send_connect_request (id); 832 c->send_connect_request (id);
833 }
645 else 834 else
646 // no router found, aggressively connect to all routers 835 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect."), conns[id]->conf->nodename);
647 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
648 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
649 (*i)->establish_connection ();
650} 836}
651 837
652void 838void
653connection::dump_status () 839connection::dump_status ()
654{ 840{
655 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 841 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
656 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 842 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
657 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 843 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
658 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 844 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
659 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 845 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
660 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
661 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
662} 846}
663 847
664void 848void
665vpn::dump_status () 849vpn::dump_status ()
666{ 850{
667 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 851 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
668 852
669 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 853 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
670 (*c)->dump_status (); 854 (*c)->dump_status ();
671 855
672 slog (L_NOTICE, _("END status dump")); 856 slog (L_NOTICE, _("END status dump"));
673} 857}
674 858
675vpn::vpn (void) 859vpn::vpn (void)
860{
676: event (this, &vpn::event_cb) 861 event .set<vpn, &vpn::event_cb > (this);
677, udpv4_ev_watcher (this, &vpn::udpv4_ev) 862 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
678, ipv4_ev_watcher (this, &vpn::ipv4_ev) 863 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
679#if ENABLE_TCP 864#if ENABLE_TCP
680, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 865 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
681#endif 866#endif
682#if ENABLE_ICMP 867#if ENABLE_ICMP
683, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 868 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
684#endif 869#endif
685#if ENABLE_DNS 870#if ENABLE_DNS
686, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 871 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
687#endif 872#endif
688, tap_ev_watcher (this, &vpn::tap_ev) 873 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
689{
690} 874}
691 875
692vpn::~vpn () 876vpn::~vpn ()
693{ 877{
694} 878}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines