[ViewVC] Diff of: cvs/gvpe/src/vpn.C

Comparing gvpe/src/vpn.C (file contents):
Revision 1.29 by pcg, Fri Mar 4 04:52:38 2005 UTC vs.
Revision 1.59 by root, Fri Sep 16 17:59:46 2011 UTC

…		…
1	/*	1	/*
2	vpn.C -- handle the protocol, encryption, handshaking etc.	2	vpn.C -- handle the protocol, encryption, handshaking etc.
3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>	3	Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4		4
5	This file is part of GVPE.	5	This file is part of GVPE.
6		6
7	GVPE is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
8	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
9	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
10	(at your option) any later version.	10	option) any later version.
11		11
12	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
13	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15	GNU General Public License for more details.	15	Public License for more details.
16		16
17	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
18	along with gvpe; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
20	*/	30	*/
21		31
22	#include "config.h"	32	#include "config.h"
23		33
24	#include <list>	34	#include <list>
46		56
47	vpn network; // THE vpn (bad design...)	57	vpn network; // THE vpn (bad design...)
48		58
49	/////////////////////////////////////////////////////////////////////////////	59	/////////////////////////////////////////////////////////////////////////////
50		60
51	const char *vpn::script_if_up ()	61	static void inline
		62	set_tos (int fd, int &tos_prev, int tos)
		63	{
		64	#if defined(SOL_IP) && defined(IP_TOS)
		65	if (tos_prev == tos)
		66	return;
		67
		68	tos_prev = tos;
		69	setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
		70	#endif
		71	}
		72
		73	void
		74	vpn::script_init_env ()
52	{	75	{
53	// the tunnel device mtu should be the physical mtu - overhead	76	// the tunnel device mtu should be the physical mtu - overhead
54	// the tricky part is rounding to the cipher key blocksize	77	// the tricky part is rounding to the cipher key blocksize
55	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;	78	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
56	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion	79	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
57	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round	80	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
58	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again	81	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
59		82
60	char *env;	83	char *env;
61	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);	84	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
62	asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
63	asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
64	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);	85	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
65	asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);	86	asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
66	asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);	87	asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
67	asprintf (&env, "MTU=%d", mtu); putenv (env);	88	asprintf (&env, "MTU=%d", mtu); putenv (env);
68	asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x",	89	asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
69	0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8,	90	asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
70	THISNODE->id & 0xff);
71	putenv (env);
72		91
		92	conns [THISNODE->id - 1]->script_init_env ("");
		93
		94	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
		95	{
		96	char ext[16];
		97	snprintf (ext, 16, "_%d", (*c)->conf->id);
		98	(*c)->script_init_env (ext);
		99	}
		100	}
		101
		102	inline const char *
		103	vpn::script_if_init ()
		104	{
		105	script_init_env ();
		106
		107	return tap->if_up ();
		108	}
		109
		110	inline const char *
		111	vpn::script_if_up ()
		112	{
		113	script_init_env ();
		114
		115	char *filename;
		116	asprintf (&filename,
		117	"%s/%s",
		118	confbase,
73	return ::conf.script_if_up ? ::conf.script_if_up : "if-up";	119	::conf.script_if_up ? ::conf.script_if_up : "if-up");
		120
		121	return filename;
		122	}
		123
		124	int
		125	vpn::setup_socket (u8 prot, int family, int type, int proto)
		126	{
		127	int fd = socket (family, type, proto);
		128
		129	if (fd < 0)
		130	{
		131	slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
		132	return fd;
		133	}
		134
		135	fcntl (fd, F_SETFL, O_NONBLOCK);
		136	fcntl (fd, F_SETFD, FD_CLOEXEC);
		137
		138	#ifdef SO_MARK
		139	if (::conf.nfmark)
		140	if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
		141	slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
		142	#endif
		143
		144	return fd;
74	}	145	}
75		146
76	int	147	int
77	vpn::setup ()	148	vpn::setup ()
78	{	149	{
		150	int success = 0;
		151
		152	ipv4_tos = -1;
79	ipv4_fd = -1;	153	ipv4_fd = -1;
80		154
81	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)	155	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
82	{	156	{
83	ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);	157	ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
84		158
85	if (ipv4_fd < 0)	159	if (ipv4_fd < 0)
86	return -1;	160	return -1;
87
88	fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
89		161
90	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	162	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
91	// this I really consider a linux bug. I am neither connected	163	// this I really consider a linux bug. I am neither connected
92	// nor do I fragment myself. Linux still sets DF and doesn't	164	// nor do I fragment myself. Linux still sets DF and doesn't
93	// fragment for me sometimes.	165	// fragment for me sometimes.
…		…
99		171
100	sockinfo si (THISNODE, PROT_IPv4);	172	sockinfo si (THISNODE, PROT_IPv4);
101		173
102	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))	174	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
103	{	175	{
104	slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));	176	slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
105	exit (EXIT_FAILURE);	177	return -1;
106	}	178	}
107		179
108	ipv4_ev_watcher.start (ipv4_fd, EVENT_READ);	180	ipv4_ev_watcher.start (ipv4_fd, EV_READ);
		181	++success;
109	}	182	}
		183	else
		184	THISNODE->protocols &= ~PROT_IPv4;
110		185
		186	udpv4_tos = -1;
111	udpv4_fd = -1;	187	udpv4_fd = -1;
112		188
113	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)	189	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
114	{	190	{
115	udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	191	udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
116		192
117	if (udpv4_fd < 0)	193	if (udpv4_fd < 0)
118	return -1;	194	return -1;
119
120	fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
121		195
122	// standard daemon practise...	196	// standard daemon practise...
123	{	197	{
124	int oval = 1;	198	int oval = 1;
125	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	199	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
137		211
138	sockinfo si (THISNODE, PROT_UDPv4);	212	sockinfo si (THISNODE, PROT_UDPv4);
139		213
140	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))	214	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
141	{	215	{
142	slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));	216	slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
143	exit (EXIT_FAILURE);	217	return -1;
144	}	218	}
145		219
146	udpv4_ev_watcher.start (udpv4_fd, EVENT_READ);	220	udpv4_ev_watcher.start (udpv4_fd, EV_READ);
		221	++success;
147	}	222	}
		223	else
		224	THISNODE->protocols &= ~PROT_UDPv4;
148		225
		226	icmpv4_tos = -1;
149	icmpv4_fd = -1;	227	icmpv4_fd = -1;
150		228
151	#if ENABLE_ICMP	229	#if ENABLE_ICMP
152	if (THISNODE->protocols & PROT_ICMPv4)	230	if (THISNODE->protocols & PROT_ICMPv4)
153	{	231	{
154	icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);	232	icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
155		233
156	if (icmpv4_fd < 0)	234	if (icmpv4_fd < 0)
157	return -1;	235	return -1;
158
159	fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
160		236
161	#ifdef ICMP_FILTER	237	#ifdef ICMP_FILTER
162	{	238	{
163	icmp_filter oval;	239	icmp_filter oval;
164	oval.data = 0xffffffff;	240	oval.data = 0xffffffff;
…		…
173	// this I really consider a linux bug. I am neither connected	249	// this I really consider a linux bug. I am neither connected
174	// nor do I fragment myself. Linux still sets DF and doesn't	250	// nor do I fragment myself. Linux still sets DF and doesn't
175	// fragment for me sometimes.	251	// fragment for me sometimes.
176	{	252	{
177	int oval = IP_PMTUDISC_DONT;	253	int oval = IP_PMTUDISC_DONT;
178	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);	254	setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
179	}	255	}
180	#endif	256	#endif
181		257
182	sockinfo si (THISNODE, PROT_ICMPv4);	258	sockinfo si (THISNODE, PROT_ICMPv4);
183		259
184	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))	260	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
185	{	261	{
186	slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno));	262	slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
187	exit (EXIT_FAILURE);	263	return -1;
188	}	264	}
189		265
190	icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ);	266	icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
		267	++success;
191	}	268	}
192	#endif	269	#endif
193		270
194	tcpv4_fd = -1;	271	tcpv4_fd = -1;
195		272
196	#if ENABLE_TCP	273	#if ENABLE_TCP
197	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)	274	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
198	{	275	{
199	tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);	276	tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
200		277
201	if (tcpv4_fd < 0)	278	if (tcpv4_fd < 0)
202	return -1;	279	return -1;
203
204	fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
205		280
206	// standard daemon practise...	281	// standard daemon practise...
207	{	282	{
208	int oval = 1;	283	int oval = 1;
209	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	284	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
211		286
212	sockinfo si (THISNODE, PROT_TCPv4);	287	sockinfo si (THISNODE, PROT_TCPv4);
213		288
214	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))	289	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
215	{	290	{
216	slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));	291	slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
217	exit (EXIT_FAILURE);	292	return -1;
218	}	293	}
219		294
220	if (listen (tcpv4_fd, 5))	295	if (listen (tcpv4_fd, 5))
221	{	296	{
222	slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));	297	slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
223	exit (EXIT_FAILURE);	298	return -1;
224	}	299	}
225		300
226	tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ);	301	tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
		302	++success;
227	}	303	}
		304	else
		305	THISNODE->protocols &= ~PROT_TCPv4;
228	#endif	306	#endif
		307
		308	dnsv4_tos = -1;
		309	dnsv4_fd = -1;
229		310
230	#if ENABLE_DNS	311	#if ENABLE_DNS
231	if (THISNODE->protocols & PROT_DNSv4)	312	if (THISNODE->protocols & PROT_DNSv4)
232	{	313	{
233	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	314	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
234		315
235	dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	316	dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
236		317
237	if (dnsv4_fd < 0)	318	if (dnsv4_fd < 0)
238	return -1;	319	return -1;
		320
		321	# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
		322	// this I really consider a linux bug. I am neither connected
		323	// nor do I fragment myself. Linux still sets DF and doesn't
		324	// fragment for me sometimes.
		325	{
		326	int oval = IP_PMTUDISC_DONT;
		327	setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
		328	}
		329	# endif
239		330
240	// standard daemon practise...	331	// standard daemon practise...
241	{	332	{
242	int oval = 1;	333	int oval = 1;
243	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	334	setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
244	}	335	}
245		336
246	sockinfo si (THISNODE, PROT_DNSv4);	337	sockinfo si (THISNODE->dns_hostname,
		338	THISNODE->dns_hostname ? THISNODE->dns_port : 0,
		339	PROT_DNSv4);
247		340
248	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))	341	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
249	{	342	{
250	slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno));	343	slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
251	exit (EXIT_FAILURE);	344	return -1;
252	}	345	}
253		346
254	dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ);	347	dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
		348	++success;
		349	}
		350	#endif
		351
		352	/////////////////////////////////////////////////////////////////////////////
		353
		354	if (!success)
255	}	355	{
256	#endif	356	slog (L_ERR, _("no protocols enabled."));
		357	return -1;
		358	}
		359
		360	reconnect_all ();
		361
		362	/////////////////////////////////////////////////////////////////////////////
257		363
258	tap = new tap_device ();	364	tap = new tap_device ();
259	if (!tap) //D this, of course, never catches	365	if (!tap) //D this, of course, never catches
260	{	366	{
261	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);	367	slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
262	exit (EXIT_FAILURE);	368	return -1;
263	}	369	}
264		370
265	run_script (run_script_cb (this, &vpn::script_if_up), true);	371	fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
266		372
		373	run_script_cb cb;
		374	cb.set<vpn, &vpn::script_if_init> (this);
		375
		376	if (tap->if_up () &&
		377	!run_script (cb, true))
		378	{
		379	slog (L_ERR, _("interface initialization command '%s' failed."),
		380	tap->if_up ());
		381	return -1;
		382	}
		383
		384	cb.set<vpn, &vpn::script_if_up> (this);
		385	if (!run_script (cb, true))
		386	{
		387	slog (L_ERR, _("if-up command execution failed."));
		388	return -1;
		389	}
		390
267	tap_ev_watcher.start (tap->fd, EVENT_READ);	391	tap_ev_watcher.start (tap->fd, EV_READ);
268
269	reconnect_all ();
270		392
271	return 0;	393	return 0;
272	}	394	}
273		395
274	bool	396	bool
275	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	397	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
276	{	398	{
277	#if defined(SOL_IP) && defined(IP_TOS)	399	set_tos (ipv4_fd, ipv4_tos, tos);
278	setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
279	#endif
280	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	400	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
281		401
282	return true;	402	return true;
283	}	403	}
284		404
…		…
307		427
308	#if ENABLE_ICMP	428	#if ENABLE_ICMP
309	bool	429	bool
310	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	430	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
311	{	431	{
312	#if defined(SOL_IP) && defined(IP_TOS)
313	setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
314	#endif
315
316	pkt->unshift_hdr (4);	432	pkt->unshift_hdr (4);
317		433
318	icmp_header hdr = (icmp_header )&((*pkt)[0]);	434	icmp_header hdr = (icmp_header )&((*pkt)[0]);
319	hdr->type = ::conf.icmp_type;	435	hdr->type = ::conf.icmp_type;
320	hdr->code = 255;	436	hdr->code = 255;
321	hdr->checksum = 0;	437	hdr->checksum = 0;
322	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);	438	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
323		439
		440	set_tos (icmpv4_fd, icmpv4_tos, tos);
324	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	441	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
325		442
326	return true;	443	return true;
327	}	444	}
328	#endif	445	#endif
329		446
330	bool	447	bool
331	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	448	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
332	{	449	{
333	#if defined(SOL_IP) && defined(IP_TOS)	450	set_tos (udpv4_fd, udpv4_tos, tos);
334	setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
335	#endif
336	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	451	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
337		452
338	return true;	453	return true;
339	}	454	}
340		455
…		…
351	{	466	{
352	// broadcast, this is ugly, but due to the security policy	467	// broadcast, this is ugly, but due to the security policy
353	// we have to connect to all hosts...	468	// we have to connect to all hosts...
354	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	469	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
355	if ((*c)->conf != THISNODE)	470	if ((*c)->conf != THISNODE)
356	(*c)->inject_data_packet (pkt, true);	471	(*c)->inject_data_packet (pkt);
357	}	472	}
358	}	473	}
359		474
360	void	475	void
361	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	476	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
362	{	477	{
363	unsigned int src = pkt->src ();	478	unsigned int src = pkt->src ();
364	unsigned int dst = pkt->dst ();	479	unsigned int dst = pkt->dst ();
365		480
366	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),	481	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
367	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);	482	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
368		483
369	if (src == 0 \|\| src > conns.size ()	484	if (src == 0 \|\| src > conns.size ()
370	\|\| dst > conns.size ()	485	\|\| dst > conns.size ()
371	\|\| pkt->typ () >= vpn_packet::PT_MAX)	486	\|\| pkt->typ () >= vpn_packet::PT_MAX)
372	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	487	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
373	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	488	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
374	else if (dst > conns.size ())	489	else if (dst > conns.size ())
375	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	490	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
376	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	491	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
377	else	492	else
378	{	493	{
379	connection *c = conns[src - 1];	494	connection *c = conns[src - 1];
380		495
381	if (dst == 0)	496	if (dst == 0)
382	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"),	497	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
383	c->conf->nodename, (const char *)rsi);	498	c->conf->nodename, (const char *)rsi);
384	else if (dst != THISNODE->id)	499	else if (dst != THISNODE->id)
385	{	500	{
386	if (THISNODE->routerprio)	501	if (THISNODE->routerprio)
387	// the tos setting gets lost here. who cares.	502	// the tos setting gets lost here. who cares.
388	conns[dst - 1]->inject_vpn_packet (pkt);	503	conns[dst - 1]->inject_vpn_packet (pkt);
389	else	504	else
390	slog (L_WARN,	505	slog (L_WARN,
391	_("%s(%s): forwarding request (=> %s), but we are no router"),	506	_("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
392	c->conf->nodename, (const char *)rsi,	507	c->conf->nodename, (const char *)rsi,
393	conns[dst - 1]->conf->nodename);	508	conns[dst - 1]->conf->nodename);
394	}	509	}
395	else	510	else
396	c->recv_vpn_packet (pkt, rsi);	511	c->recv_vpn_packet (pkt, rsi);
397	}	512	}
398	}	513	}
399		514
400	void	515	bool
		516	vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
		517	{
		518	switch (si.prot)
		519	{
		520	case PROT_IPv4:
		521	return send_ipv4_packet (pkt, si, tos);
		522
		523	case PROT_UDPv4:
		524	return send_udpv4_packet (pkt, si, tos);
		525
		526	#if ENABLE_TCP
		527	case PROT_TCPv4:
		528	return send_tcpv4_packet (pkt, si, tos);
		529	#endif
		530	#if ENABLE_ICMP
		531	case PROT_ICMPv4:
		532	return send_icmpv4_packet (pkt, si, tos);
		533	#endif
		534	#if ENABLE_DNS
		535	case PROT_DNSv4:
		536	return send_dnsv4_packet (pkt, si, tos);
		537	#endif
		538	default:
		539	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
		540	}
		541
		542	return false;
		543	}
		544
		545	inline void
401	vpn::ipv4_ev (io_watcher &w, short revents)	546	vpn::ipv4_ev (ev::io &w, int revents)
402	{	547	{
403	if (revents & EVENT_READ)	548	if (revents & EV_READ)
404	{	549	{
405	vpn_packet *pkt = new vpn_packet;	550	vpn_packet *pkt = new vpn_packet;
406	struct sockaddr_in sa;	551	struct sockaddr_in sa;
407	socklen_t sa_len = sizeof (sa);	552	socklen_t sa_len = sizeof (sa);
408	int len;	553	int len;
…		…
413		558
414	if (len > 0)	559	if (len > 0)
415	{	560	{
416	pkt->len = len;	561	pkt->len = len;
417		562
418	// raw sockets deliver the ipv4, but don't expect it on sends	563	// raw sockets deliver the ipv4 header, but don't expect it on sends
419	// this is slow, but...
420	pkt->skip_hdr (IP_OVERHEAD);	564	pkt->skip_ipv4_hdr ();
421		565
422	recv_vpn_packet (pkt, si);	566	recv_vpn_packet (pkt, si);
423	}	567	}
424	else	568	else
425	{	569	{
426	// probably ECONNRESET or somesuch	570	// probably ECONNRESET or somesuch
427	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	571	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
428	}	572	}
429		573
430	delete pkt;	574	delete pkt;
431	}	575	}
432	else	576	else
433	{	577	{
434	slog (L_ERR,	578	slog (L_ERR,
435	_("FATAL: unknown revents %08x in socket, terminating\n"),	579	_("FATAL: unknown revents %08x in socket, exiting.\n"),
436	revents);	580	revents);
437	exit (EXIT_FAILURE);	581	exit (EXIT_FAILURE);
438	}	582	}
439	}	583	}
440		584
441	#if ENABLE_ICMP	585	#if ENABLE_ICMP
442	void	586	inline void
443	vpn::icmpv4_ev (io_watcher &w, short revents)	587	vpn::icmpv4_ev (ev::io &w, int revents)
444	{	588	{
445	if (revents & EVENT_READ)	589	if (revents & EV_READ)
446	{	590	{
447	vpn_packet *pkt = new vpn_packet;	591	vpn_packet *pkt = new vpn_packet;
448	struct sockaddr_in sa;	592	struct sockaddr_in sa;
449	socklen_t sa_len = sizeof (sa);	593	socklen_t sa_len = sizeof (sa);
450	int len;	594	int len;
…		…
462	if (hdr->type == ::conf.icmp_type	606	if (hdr->type == ::conf.icmp_type
463	&& hdr->code == 255)	607	&& hdr->code == 255)
464	{	608	{
465	// raw sockets deliver the ipv4, but don't expect it on sends	609	// raw sockets deliver the ipv4, but don't expect it on sends
466	// this is slow, but...	610	// this is slow, but...
467	pkt->skip_hdr (ICMP_OVERHEAD);	611	pkt->skip_ipv4_hdr (ICMP_OVERHEAD - IP_OVERHEAD);
468		612
469	recv_vpn_packet (pkt, si);	613	recv_vpn_packet (pkt, si);
470	}	614	}
471	}	615	}
472	else	616	else
473	{	617	{
474	// probably ECONNRESET or somesuch	618	// probably ECONNRESET or somesuch
475	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	619	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
476	}	620	}
477		621
478	delete pkt;	622	delete pkt;
479	}	623	}
480	else	624	else
481	{	625	{
482	slog (L_ERR,	626	slog (L_ERR,
483	_("FATAL: unknown revents %08x in socket, terminating\n"),	627	_("FATAL: unknown revents %08x in socket, exiting.\n"),
484	revents);	628	revents);
485	exit (EXIT_FAILURE);	629	exit (EXIT_FAILURE);
486	}	630	}
487	}	631	}
488	#endif	632	#endif
489		633
490	void	634	inline void
491	vpn::udpv4_ev (io_watcher &w, short revents)	635	vpn::udpv4_ev (ev::io &w, int revents)
492	{	636	{
493	if (revents & EVENT_READ)	637	if (revents & EV_READ)
494	{	638	{
495	vpn_packet *pkt = new vpn_packet;	639	vpn_packet *pkt = new vpn_packet;
496	struct sockaddr_in sa;	640	struct sockaddr_in sa;
497	socklen_t sa_len = sizeof (sa);	641	socklen_t sa_len = sizeof (sa);
498	int len;	642	int len;
…		…
508	recv_vpn_packet (pkt, si);	652	recv_vpn_packet (pkt, si);
509	}	653	}
510	else	654	else
511	{	655	{
512	// probably ECONNRESET or somesuch	656	// probably ECONNRESET or somesuch
513	slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno));	657	slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
514	}	658	}
515		659
516	delete pkt;	660	delete pkt;
517	}	661	}
518	else	662	else
519	{	663	{
520	slog (L_ERR,	664	slog (L_ERR,
521	_("FATAL: unknown revents %08x in socket, terminating\n"),	665	_("FATAL: unknown revents %08x in socket, exiting.\n"),
522	revents);	666	revents);
523	exit (EXIT_FAILURE);	667	exit (EXIT_FAILURE);
524	}	668	}
525	}	669	}
526		670
527	void	671	inline void
528	vpn::tap_ev (io_watcher &w, short revents)	672	vpn::tap_ev (ev::io &w, int revents)
529	{	673	{
530	if (revents & EVENT_READ)	674	if (revents & EV_READ)
531	{	675	{
532	/* process data */	676	/* process data */
533	tap_packet *pkt;	677	tap_packet *pkt;
534		678
535	pkt = tap->recv ();	679	pkt = tap->recv ();
…		…
542	int dst = mac2id (pkt->dst);	686	int dst = mac2id (pkt->dst);
543	int src = mac2id (pkt->src);	687	int src = mac2id (pkt->src);
544		688
545	if (src != THISNODE->id)	689	if (src != THISNODE->id)
546	{	690	{
547	slog (L_ERR, _("FATAL: tap packet not originating on current node received, exiting."));	691	slog (L_ERR, _("FATAL: tap packet not originating on current node received (if-up script not working properly?), exiting."));
548	exit (EXIT_FAILURE);	692	exit (EXIT_FAILURE);
549	}	693	}
550		694
551	if (dst == THISNODE->id)	695	if (dst == THISNODE->id)
552	{	696	{
…		…
564	}	708	}
565	else	709	else
566	abort ();	710	abort ();
567	}	711	}
568		712
569	void	713	inline void
570	vpn::event_cb (time_watcher &w)	714	vpn::event_cb (ev::timer &w, int)
571	{	715	{
572	if (events)	716	if (events)
573	{	717	{
574	if (events & EVENT_SHUTDOWN)	718	if (events & EVENT_SHUTDOWN)
575	{	719	{
576	slog (L_INFO, _("preparing shutdown..."));	720	slog (L_INFO, _("preparing shutdown..."));
577		721
578	shutdown_all ();	722	shutdown_all ();
579	remove_pid (conf.pidfilename);	723	remove_pid (conf.pidfilename);
580	slog (L_INFO, _("terminating"));	724	slog (L_INFO, _("exiting."));
581	exit (EXIT_SUCCESS);	725	exit (EXIT_SUCCESS);
582	}	726	}
583		727
584	if (events & EVENT_RECONNECT)	728	if (events & EVENT_RECONNECT)
585	{	729	{
586	slog (L_INFO, _("forced reconnect"));	730	slog (L_INFO, _("forced reconnect."));
587		731
588	reconnect_all ();	732	reconnect_all ();
589	}	733	}
590		734
591	events = 0;	735	events = 0;
…		…
607		751
608	conns.clear ();	752	conns.clear ();
609		753
610	connection_init ();	754	connection_init ();
611		755
612	for (configuration::node_vector::iterator i = conf.nodes.begin ();	756	for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
613	i != conf.nodes.end (); ++i)	757	conns.push_back (new connection (this, *i));
614	{	758
615	connection conn = new connection (this, i);	759	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
616	conns.push_back (conn);
617	conn->establish_connection ();	760	(*c)->establish_connection ();
618	}
619	}	761	}
620		762
621	connection *vpn::find_router ()	763	bool
		764	vpn::can_direct (conf_node src, conf_node dst) const
622	{	765	{
623	u32 prio = 1;	766	return src != dst
		767	&& src->may_direct (dst)
		768	&& dst->may_direct (src)
		769	&& (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
		770	\|\| (src->protocols & dst->connectable_protocols ()));
		771	}
		772
		773	// only works for indirect and routed connections: find a router
		774	// from THISNODE to dst
		775	connection *
		776	vpn::find_router_for (const connection *dst)
		777	{
624	connection *router = 0;	778	connection *router = 0;
625		779
		780	// first try to find a router with a direct connection, route there
		781	// regardless of any other considerations.
		782	{
		783	u32 prio = 1;
		784
		785	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		786	{
		787	connection c = i;
		788
		789	if (c->conf->routerprio > prio
		790	&& c->conf != THISNODE
		791	&& can_direct (c->conf, dst->conf)
		792	&& c->ictx && c->octx)
		793	{
		794	prio = c->conf->routerprio;
		795	router = c;
		796	}
		797	}
		798	}
		799
		800	if (router)
		801	return router;
		802
		803	// second try find the router with the highest priority, higher than ours
		804	{
		805	u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
		806
		807	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		808	{
		809	connection c = i;
		810
		811	if (c->conf->routerprio > prio
		812	&& c != dst
		813	&& c->conf != THISNODE
		814	&& c->ictx && c->octx)
		815	{
		816	prio = c->conf->routerprio;
		817	router = c;
		818	}
		819	}
		820	}
		821
		822	return router;
		823	}
		824
		825	void
		826	vpn::connection_established (connection *c)
		827	{
626	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	828	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
627	{	829	{
628	connection c = i;	830	connection o = i;
629		831
630	if (c->conf->routerprio > prio	832	if (!o->is_direct
631	&& c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use	833	&& o->si.valid ()
632	&& c->ictx && c->octx	834	&& c->si != o->si
633	&& c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode	835	&& c == find_router_for (o))
634	{
635	prio = c->conf->routerprio;
636	router = c;
637	}	836	{
		837	slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
		838	o->conf->nodename, c->conf->nodename);
		839	o->rekey ();
		840	}
638	}	841	}
639
640	return router;
641	}	842	}
642		843
		844	void
643	void vpn::send_connect_request (int id)	845	vpn::send_connect_request (connection *c)
644	{	846	{
645	connection *c = find_router ();	847	connection *r = find_router_for (c);
646		848
647	if (c)	849	if (r)
		850	{
		851	slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
		852	c->conf->nodename, r->conf->nodename);
648	c->send_connect_request (id);	853	r->send_connect_request (c->conf->id);
		854	}
649	else	855	else
650	// no router found, aggressively connect to all routers	856	slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
651	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	857	c->conf->nodename);
652	if ((i)->conf->routerprio && (i)->conf != THISNODE)
653	(*i)->establish_connection ();
654	}	858	}
655		859
656	void	860	void
657	connection::dump_status ()	861	connection::dump_status ()
658	{	862	{
659	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);	863	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
660	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),	864	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
661	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);	865	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
662	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),	866	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
663	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);	867	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
664	slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
665	(long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
666	}	868	}
667		869
668	void	870	void
669	vpn::dump_status ()	871	vpn::dump_status ()
670	{	872	{
671	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);	873	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
672		874
673	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	875	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
674	(*c)->dump_status ();	876	(*c)->dump_status ();
675		877
676	slog (L_NOTICE, _("END status dump"));	878	slog (L_NOTICE, _("END status dump"));
677	}	879	}
678		880
679	vpn::vpn (void)	881	vpn::vpn (void)
		882	{
680	: event (this, &vpn::event_cb)	883	event .set<vpn, &vpn::event_cb > (this);
681	, udpv4_ev_watcher (this, &vpn::udpv4_ev)	884	udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
682	, ipv4_ev_watcher (this, &vpn::ipv4_ev)	885	ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
683	#if ENABLE_TCP	886	#if ENABLE_TCP
684	, tcpv4_ev_watcher (this, &vpn::tcpv4_ev)	887	tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
685	#endif	888	#endif
686	#if ENABLE_ICMP	889	#if ENABLE_ICMP
687	, icmpv4_ev_watcher(this, &vpn::icmpv4_ev)	890	icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
688	#endif	891	#endif
689	#if ENABLE_DNS	892	#if ENABLE_DNS
690	, dnsv4_ev_watcher (this, &vpn::dnsv4_ev)	893	dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
691	#endif	894	#endif
692	, tap_ev_watcher (this, &vpn::tap_ev)	895	tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
693	{
694	}	896	}
695		897
696	vpn::~vpn ()	898	vpn::~vpn ()
697	{	899	{
698	}	900	}

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/vpn.C (file contents): Revision 1.29 by pcg, Fri Mar 4 04:52:38 2005 UTC vs. Revision 1.59 by root, Fri Sep 16 17:59:46 2011 UTC

Diff Legend

Comparing gvpe/src/vpn.C (file contents):
Revision 1.29 by pcg, Fri Mar 4 04:52:38 2005 UTC vs.
Revision 1.59 by root, Fri Sep 16 17:59:46 2011 UTC