ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.35 by pcg, Fri Apr 8 16:12:49 2005 UTC vs.
Revision 1.53 by pcg, Fri Aug 15 17:50:10 2008 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
51void 73void
52vpn::script_init_env () 74vpn::script_init_env ()
53{ 75{
54 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
… …
75 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
76 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
77 } 99 }
78} 100}
79 101
102inline const char *
80const char *vpn::script_if_init () 103vpn::script_if_init ()
81{ 104{
82 script_init_env (); 105 script_init_env ();
83 106
84 return tap->if_up (); 107 return tap->if_up ();
85} 108}
86 109
110inline const char *
87const char *vpn::script_if_up () 111vpn::script_if_up ()
88{ 112{
89 script_init_env (); 113 script_init_env ();
90 114
91 char *filename; 115 char *filename;
92 asprintf (&filename, 116 asprintf (&filename,
… …
98} 122}
99 123
100int 124int
101vpn::setup () 125vpn::setup ()
102{ 126{
127 int success = 0;
128
129 ipv4_tos = -1;
103 ipv4_fd = -1; 130 ipv4_fd = -1;
104 131
105 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 132 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106 { 133 {
107 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 134 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
108 135
109 if (ipv4_fd < 0) 136 if (ipv4_fd < 0)
110 return -1; 137 return -1;
111 138
112 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK); 139 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
140 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
113 141
114#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 142#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
115 // this I really consider a linux bug. I am neither connected 143 // this I really consider a linux bug. I am neither connected
116 // nor do I fragment myself. Linux still sets DF and doesn't 144 // nor do I fragment myself. Linux still sets DF and doesn't
117 // fragment for me sometimes. 145 // fragment for me sometimes.
… …
123 151
124 sockinfo si (THISNODE, PROT_IPv4); 152 sockinfo si (THISNODE, PROT_IPv4);
125 153
126 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 154 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
127 { 155 {
128 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 156 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
129 exit (EXIT_FAILURE); 157 exit (EXIT_FAILURE);
130 } 158 }
131 159
132 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 160 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
161 ++success;
133 } 162 }
163 else
164 THISNODE->protocols &= ~PROT_IPv4;
134 165
166 udpv4_tos = -1;
135 udpv4_fd = -1; 167 udpv4_fd = -1;
136 168
137 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 169 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
138 { 170 {
139 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 171 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
140 172
141 if (udpv4_fd < 0) 173 if (udpv4_fd < 0)
142 return -1; 174 return -1;
143 175
144 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK); 176 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
177 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
145 178
146 // standard daemon practise... 179 // standard daemon practise...
147 { 180 {
148 int oval = 1; 181 int oval = 1;
149 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 182 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
161 194
162 sockinfo si (THISNODE, PROT_UDPv4); 195 sockinfo si (THISNODE, PROT_UDPv4);
163 196
164 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
165 { 198 {
166 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
167 exit (EXIT_FAILURE); 200 exit (EXIT_FAILURE);
168 } 201 }
169 202
170 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 203 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
204 ++success;
171 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_UDPv4;
172 208
209 icmpv4_tos = -1;
173 icmpv4_fd = -1; 210 icmpv4_fd = -1;
174 211
175#if ENABLE_ICMP 212#if ENABLE_ICMP
176 if (THISNODE->protocols & PROT_ICMPv4) 213 if (THISNODE->protocols & PROT_ICMPv4)
177 { 214 {
178 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 215 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
179 216
180 if (icmpv4_fd < 0) 217 if (icmpv4_fd < 0)
181 return -1; 218 return -1;
182 219
183 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK); 220 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
221 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
184 222
185#ifdef ICMP_FILTER 223#ifdef ICMP_FILTER
186 { 224 {
187 icmp_filter oval; 225 icmp_filter oval;
188 oval.data = 0xffffffff; 226 oval.data = 0xffffffff;
… …
197 // this I really consider a linux bug. I am neither connected 235 // this I really consider a linux bug. I am neither connected
198 // nor do I fragment myself. Linux still sets DF and doesn't 236 // nor do I fragment myself. Linux still sets DF and doesn't
199 // fragment for me sometimes. 237 // fragment for me sometimes.
200 { 238 {
201 int oval = IP_PMTUDISC_DONT; 239 int oval = IP_PMTUDISC_DONT;
202 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 240 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
203 } 241 }
204#endif 242#endif
205 243
206 sockinfo si (THISNODE, PROT_ICMPv4); 244 sockinfo si (THISNODE, PROT_ICMPv4);
207 245
208 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 246 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
209 { 247 {
210 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 248 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
211 exit (EXIT_FAILURE); 249 exit (EXIT_FAILURE);
212 } 250 }
213 251
214 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 252 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
253 ++success;
215 } 254 }
216#endif 255#endif
217 256
218 tcpv4_fd = -1; 257 tcpv4_fd = -1;
219 258
… …
224 263
225 if (tcpv4_fd < 0) 264 if (tcpv4_fd < 0)
226 return -1; 265 return -1;
227 266
228 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK); 267 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
268 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
229 269
230 // standard daemon practise... 270 // standard daemon practise...
231 { 271 {
232 int oval = 1; 272 int oval = 1;
233 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 273 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
235 275
236 sockinfo si (THISNODE, PROT_TCPv4); 276 sockinfo si (THISNODE, PROT_TCPv4);
237 277
238 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 278 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
239 { 279 {
240 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 280 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
241 exit (EXIT_FAILURE); 281 exit (EXIT_FAILURE);
242 } 282 }
243 283
244 if (listen (tcpv4_fd, 5)) 284 if (listen (tcpv4_fd, 5))
245 { 285 {
246 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 286 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
247 exit (EXIT_FAILURE); 287 exit (EXIT_FAILURE);
248 } 288 }
249 289
250 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 290 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
291 ++success;
251 } 292 }
293 else
294 THISNODE->protocols &= ~PROT_TCPv4;
252#endif 295#endif
296
297 dnsv4_tos = -1;
298 dnsv4_fd = -1;
253 299
254#if ENABLE_DNS 300#if ENABLE_DNS
255 if (THISNODE->protocols & PROT_DNSv4) 301 if (THISNODE->protocols & PROT_DNSv4)
256 { 302 {
257 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 303 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
258 304
259 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 305 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
260 306
261 if (dnsv4_fd < 0) 307 if (dnsv4_fd < 0)
262 return -1; 308 return -1;
309
310 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
311 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
263 312
264# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 313# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
265 // this I really consider a linux bug. I am neither connected 314 // this I really consider a linux bug. I am neither connected
266 // nor do I fragment myself. Linux still sets DF and doesn't 315 // nor do I fragment myself. Linux still sets DF and doesn't
267 // fragment for me sometimes. 316 // fragment for me sometimes.
… …
281 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 330 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
282 PROT_DNSv4); 331 PROT_DNSv4);
283 332
284 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 333 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
285 { 334 {
286 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 335 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
287 exit (EXIT_FAILURE); 336 exit (EXIT_FAILURE);
288 } 337 }
289 338
290 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 339 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
340 ++success;
291 } 341 }
292#endif 342#endif
293 343
294 ///////////////////////////////////////////////////////////////////////////// 344 /////////////////////////////////////////////////////////////////////////////
345
346 if (!success)
347 {
348 slog (L_ERR, _("no protocols enabled, exiting."));
349 exit (EXIT_FAILURE);
350 }
295 351
296 reconnect_all (); 352 reconnect_all ();
297 353
298 ///////////////////////////////////////////////////////////////////////////// 354 /////////////////////////////////////////////////////////////////////////////
299 355
300 tap = new tap_device (); 356 tap = new tap_device ();
301 if (!tap) //D this, of course, never catches 357 if (!tap) //D this, of course, never catches
302 { 358 {
303 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 359 slog (L_ERR, _("cannot create network interface '%s', exiting."), conf.ifname);
304 exit (EXIT_FAILURE); 360 exit (EXIT_FAILURE);
305 } 361 }
306 362
363 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
364
365 run_script_cb cb;
366 cb.set<vpn, &vpn::script_if_init> (this);
367
307 if (tap->if_up () && 368 if (tap->if_up () &&
308 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 369 !run_script (cb, true))
309 { 370 {
310 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 371 slog (L_ERR, _("interface initialization command '%s' failed, exiting."),
311 tap->if_up ()); 372 tap->if_up ());
312 exit (EXIT_FAILURE); 373 exit (EXIT_FAILURE);
313 } 374 }
314 375
315 if (!run_script (run_script_cb (this, &vpn::script_if_up), true)) 376 cb.set<vpn, &vpn::script_if_up> (this);
377 if (!run_script (cb, true))
316 { 378 {
317 slog (L_ERR, _("if-up command execution failed, exiting.")); 379 slog (L_ERR, _("if-up command execution failed, exiting."));
318 exit (EXIT_FAILURE); 380 exit (EXIT_FAILURE);
319 } 381 }
320 382
321 tap_ev_watcher.start (tap->fd, EVENT_READ); 383 tap_ev_watcher.start (tap->fd, EV_READ);
322 384
323 return 0; 385 return 0;
324} 386}
325 387
326bool 388bool
327vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 389vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
328{ 390{
329#if defined(SOL_IP) && defined(IP_TOS) 391 set_tos (ipv4_fd, ipv4_tos, tos);
330 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
331#endif
332 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 392 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
333 393
334 return true; 394 return true;
335} 395}
336 396
… …
359 419
360#if ENABLE_ICMP 420#if ENABLE_ICMP
361bool 421bool
362vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 422vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
363{ 423{
364#if defined(SOL_IP) && defined(IP_TOS)
365 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
366#endif
367
368 pkt->unshift_hdr (4); 424 pkt->unshift_hdr (4);
369 425
370 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 426 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
371 hdr->type = ::conf.icmp_type; 427 hdr->type = ::conf.icmp_type;
372 hdr->code = 255; 428 hdr->code = 255;
373 hdr->checksum = 0; 429 hdr->checksum = 0;
374 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 430 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
375 431
432 set_tos (icmpv4_fd, icmpv4_tos, tos);
376 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 433 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
377 434
378 return true; 435 return true;
379} 436}
380#endif 437#endif
381 438
382bool 439bool
383vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 440vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
384{ 441{
385#if defined(SOL_IP) && defined(IP_TOS) 442 set_tos (udpv4_fd, udpv4_tos, tos);
386 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
387#endif
388 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 443 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
389 444
390 return true; 445 return true;
391} 446}
392 447
… …
403 { 458 {
404 // broadcast, this is ugly, but due to the security policy 459 // broadcast, this is ugly, but due to the security policy
405 // we have to connect to all hosts... 460 // we have to connect to all hosts...
406 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 461 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
407 if ((*c)->conf != THISNODE) 462 if ((*c)->conf != THISNODE)
408 (*c)->inject_data_packet (pkt, true); 463 (*c)->inject_data_packet (pkt);
409 } 464 }
410} 465}
411 466
412void 467void
413vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 468vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
414{ 469{
415 unsigned int src = pkt->src (); 470 unsigned int src = pkt->src ();
416 unsigned int dst = pkt->dst (); 471 unsigned int dst = pkt->dst ();
417 472
418 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 473 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
419 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 474 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
420 475
421 if (src == 0 || src > conns.size () 476 if (src == 0 || src > conns.size ()
422 || dst > conns.size () 477 || dst > conns.size ()
423 || pkt->typ () >= vpn_packet::PT_MAX) 478 || pkt->typ () >= vpn_packet::PT_MAX)
424 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 479 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
425 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 480 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
426 else if (dst > conns.size ()) 481 else if (dst > conns.size ())
427 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 482 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
428 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 483 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
429 else 484 else
430 { 485 {
431 connection *c = conns[src - 1]; 486 connection *c = conns[src - 1];
432 487
433 if (dst == 0) 488 if (dst == 0)
434 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 489 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
435 c->conf->nodename, (const char *)rsi); 490 c->conf->nodename, (const char *)rsi);
436 else if (dst != THISNODE->id) 491 else if (dst != THISNODE->id)
437 { 492 {
438 if (THISNODE->routerprio) 493 if (THISNODE->routerprio)
439 // the tos setting gets lost here. who cares. 494 // the tos setting gets lost here. who cares.
440 conns[dst - 1]->inject_vpn_packet (pkt); 495 conns[dst - 1]->inject_vpn_packet (pkt);
441 else 496 else
442 slog (L_WARN, 497 slog (L_WARN,
443 _("%s(%s): forwarding request (=> %s), but we are no router"), 498 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
444 c->conf->nodename, (const char *)rsi, 499 c->conf->nodename, (const char *)rsi,
445 conns[dst - 1]->conf->nodename); 500 conns[dst - 1]->conf->nodename);
446 } 501 }
447 else 502 else
448 c->recv_vpn_packet (pkt, rsi); 503 c->recv_vpn_packet (pkt, rsi);
… …
454{ 509{
455 switch (si.prot) 510 switch (si.prot)
456 { 511 {
457 case PROT_IPv4: 512 case PROT_IPv4:
458 return send_ipv4_packet (pkt, si, tos); 513 return send_ipv4_packet (pkt, si, tos);
514
459 case PROT_UDPv4: 515 case PROT_UDPv4:
460 return send_udpv4_packet (pkt, si, tos); 516 return send_udpv4_packet (pkt, si, tos);
517
461#if ENABLE_TCP 518#if ENABLE_TCP
462 case PROT_TCPv4: 519 case PROT_TCPv4:
463 return send_tcpv4_packet (pkt, si, tos); 520 return send_tcpv4_packet (pkt, si, tos);
464#endif 521#endif
465#if ENABLE_ICMP 522#if ENABLE_ICMP
… …
468#endif 525#endif
469#if ENABLE_DNS 526#if ENABLE_DNS
470 case PROT_DNSv4: 527 case PROT_DNSv4:
471 return send_dnsv4_packet (pkt, si, tos); 528 return send_dnsv4_packet (pkt, si, tos);
472#endif 529#endif
473
474 default: 530 default:
475 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 531 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
476 } 532 }
477 533
478 return false; 534 return false;
479} 535}
480 536
481void 537inline void
482vpn::ipv4_ev (io_watcher &w, short revents) 538vpn::ipv4_ev (ev::io &w, int revents)
483{ 539{
484 if (revents & EVENT_READ) 540 if (revents & EV_READ)
485 { 541 {
486 vpn_packet *pkt = new vpn_packet; 542 vpn_packet *pkt = new vpn_packet;
487 struct sockaddr_in sa; 543 struct sockaddr_in sa;
488 socklen_t sa_len = sizeof (sa); 544 socklen_t sa_len = sizeof (sa);
489 int len; 545 int len;
… …
502 recv_vpn_packet (pkt, si); 558 recv_vpn_packet (pkt, si);
503 } 559 }
504 else 560 else
505 { 561 {
506 // probably ECONNRESET or somesuch 562 // probably ECONNRESET or somesuch
507 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 563 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
508 } 564 }
509 565
510 delete pkt; 566 delete pkt;
511 } 567 }
512 else 568 else
513 { 569 {
514 slog (L_ERR, 570 slog (L_ERR,
515 _("FATAL: unknown revents %08x in socket, terminating\n"), 571 _("FATAL: unknown revents %08x in socket, exiting.\n"),
516 revents); 572 revents);
517 exit (EXIT_FAILURE); 573 exit (EXIT_FAILURE);
518 } 574 }
519} 575}
520 576
521#if ENABLE_ICMP 577#if ENABLE_ICMP
522void 578inline void
523vpn::icmpv4_ev (io_watcher &w, short revents) 579vpn::icmpv4_ev (ev::io &w, int revents)
524{ 580{
525 if (revents & EVENT_READ) 581 if (revents & EV_READ)
526 { 582 {
527 vpn_packet *pkt = new vpn_packet; 583 vpn_packet *pkt = new vpn_packet;
528 struct sockaddr_in sa; 584 struct sockaddr_in sa;
529 socklen_t sa_len = sizeof (sa); 585 socklen_t sa_len = sizeof (sa);
530 int len; 586 int len;
… …
550 } 606 }
551 } 607 }
552 else 608 else
553 { 609 {
554 // probably ECONNRESET or somesuch 610 // probably ECONNRESET or somesuch
555 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 611 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
556 } 612 }
557 613
558 delete pkt; 614 delete pkt;
559 } 615 }
560 else 616 else
561 { 617 {
562 slog (L_ERR, 618 slog (L_ERR,
563 _("FATAL: unknown revents %08x in socket, terminating\n"), 619 _("FATAL: unknown revents %08x in socket, exiting.\n"),
564 revents); 620 revents);
565 exit (EXIT_FAILURE); 621 exit (EXIT_FAILURE);
566 } 622 }
567} 623}
568#endif 624#endif
569 625
570void 626inline void
571vpn::udpv4_ev (io_watcher &w, short revents) 627vpn::udpv4_ev (ev::io &w, int revents)
572{ 628{
573 if (revents & EVENT_READ) 629 if (revents & EV_READ)
574 { 630 {
575 vpn_packet *pkt = new vpn_packet; 631 vpn_packet *pkt = new vpn_packet;
576 struct sockaddr_in sa; 632 struct sockaddr_in sa;
577 socklen_t sa_len = sizeof (sa); 633 socklen_t sa_len = sizeof (sa);
578 int len; 634 int len;
… …
588 recv_vpn_packet (pkt, si); 644 recv_vpn_packet (pkt, si);
589 } 645 }
590 else 646 else
591 { 647 {
592 // probably ECONNRESET or somesuch 648 // probably ECONNRESET or somesuch
593 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 649 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
594 } 650 }
595 651
596 delete pkt; 652 delete pkt;
597 } 653 }
598 else 654 else
599 { 655 {
600 slog (L_ERR, 656 slog (L_ERR,
601 _("FATAL: unknown revents %08x in socket, terminating\n"), 657 _("FATAL: unknown revents %08x in socket, exiting.\n"),
602 revents); 658 revents);
603 exit (EXIT_FAILURE); 659 exit (EXIT_FAILURE);
604 } 660 }
605} 661}
606 662
607void 663inline void
608vpn::tap_ev (io_watcher &w, short revents) 664vpn::tap_ev (ev::io &w, int revents)
609{ 665{
610 if (revents & EVENT_READ) 666 if (revents & EV_READ)
611 { 667 {
612 /* process data */ 668 /* process data */
613 tap_packet *pkt; 669 tap_packet *pkt;
614 670
615 pkt = tap->recv (); 671 pkt = tap->recv ();
… …
644 } 700 }
645 else 701 else
646 abort (); 702 abort ();
647} 703}
648 704
649void 705inline void
650vpn::event_cb (time_watcher &w) 706vpn::event_cb (ev::timer &w, int)
651{ 707{
652 if (events) 708 if (events)
653 { 709 {
654 if (events & EVENT_SHUTDOWN) 710 if (events & EVENT_SHUTDOWN)
655 { 711 {
656 slog (L_INFO, _("preparing shutdown...")); 712 slog (L_INFO, _("preparing shutdown..."));
657 713
658 shutdown_all (); 714 shutdown_all ();
659 remove_pid (conf.pidfilename); 715 remove_pid (conf.pidfilename);
660 slog (L_INFO, _("terminating")); 716 slog (L_INFO, _("exiting."));
661 exit (EXIT_SUCCESS); 717 exit (EXIT_SUCCESS);
662 } 718 }
663 719
664 if (events & EVENT_RECONNECT) 720 if (events & EVENT_RECONNECT)
665 { 721 {
666 slog (L_INFO, _("forced reconnect")); 722 slog (L_INFO, _("forced reconnect."));
667 723
668 reconnect_all (); 724 reconnect_all ();
669 } 725 }
670 726
671 events = 0; 727 events = 0;
… …
687 743
688 conns.clear (); 744 conns.clear ();
689 745
690 connection_init (); 746 connection_init ();
691 747
692 for (configuration::node_vector::iterator i = conf.nodes.begin (); 748 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
693 i != conf.nodes.end (); ++i) 749 conns.push_back (new connection (this, *i));
694 { 750
695 connection *conn = new connection (this, *i); 751 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
696 conns.push_back (conn);
697 conn->establish_connection (); 752 (*c)->establish_connection ();
698 }
699} 753}
700 754
701connection *vpn::find_router () 755bool vpn::can_direct (conf_node *src, conf_node *dst) const
702{ 756{
703 u32 prio = 1; 757 return src != dst
758 && src->may_direct (dst)
759 && dst->may_direct (src)
760 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
761 || (src->protocols & dst->connectable_protocols ()));
762}
763
764// only works for indirect and routed connections: find a router
765// from THISNODE to dst
766connection *vpn::find_router_for (const connection *dst)
767{
704 connection *router = 0; 768 connection *router = 0;
705 769
770 // first try to find a router with a direct connection, route there
771 // regardless of any other considerations.
772 {
773 u32 prio = 1;
774
775 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
776 {
777 connection *c = *i;
778
779 if (c->conf->routerprio > prio
780 && c->conf != THISNODE
781 && can_direct (c->conf, dst->conf)
782 && c->ictx && c->octx)
783 {
784 prio = c->conf->routerprio;
785 router = c;
786 }
787 }
788 }
789
790 if (router)
791 return router;
792
793 // second try find the router with the highest priority, higher than ours
794 {
795 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
796
797 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
798 {
799 connection *c = *i;
800
801 if (c->conf->routerprio > prio
802 && c != dst
803 && c->conf != THISNODE
804 && c->ictx && c->octx)
805 {
806 prio = c->conf->routerprio;
807 router = c;
808 }
809 }
810 }
811
812 return router;
813}
814
815void vpn::connection_established (connection *c)
816{
706 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 817 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
707 { 818 {
708 connection *c = *i; 819 connection *o = *i;
709 820
710 if (c->conf->routerprio > prio 821 if (!o->is_direct
711 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 822 && o->si.valid ()
712 && c->ictx && c->octx 823 && c->si != o->si
713 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 824 && c == find_router_for (o))
714 {
715 prio = c->conf->routerprio;
716 router = c;
717 } 825 {
826 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
827 o->conf->nodename, c->conf->nodename);
828 o->rekey ();
829 }
718 } 830 }
719
720 return router;
721} 831}
722 832
723void vpn::send_connect_request (int id) 833void vpn::send_connect_request (connection *c)
724{ 834{
725 connection *c = find_router (); 835 connection *r = find_router_for (c);
726 836
727 if (c) 837 if (r)
838 {
839 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
840 c->conf->nodename, r->conf->nodename);
728 c->send_connect_request (id); 841 r->send_connect_request (c->conf->id);
842 }
729 else 843 else
730 // no router found, aggressively connect to all routers 844 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
731 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 845 c->conf->nodename);
732 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
733 (*i)->establish_connection ();
734} 846}
735 847
736void 848void
737connection::dump_status () 849connection::dump_status ()
738{ 850{
739 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 851 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
740 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 852 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
741 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 853 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
742 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 854 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
743 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 855 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
744 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
745 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
746} 856}
747 857
748void 858void
749vpn::dump_status () 859vpn::dump_status ()
750{ 860{
751 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 861 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
752 862
753 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 863 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
754 (*c)->dump_status (); 864 (*c)->dump_status ();
755 865
756 slog (L_NOTICE, _("END status dump")); 866 slog (L_NOTICE, _("END status dump"));
757} 867}
758 868
759vpn::vpn (void) 869vpn::vpn (void)
870{
760: event (this, &vpn::event_cb) 871 event .set<vpn, &vpn::event_cb > (this);
761, udpv4_ev_watcher (this, &vpn::udpv4_ev) 872 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
762, ipv4_ev_watcher (this, &vpn::ipv4_ev) 873 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
763#if ENABLE_TCP 874#if ENABLE_TCP
764, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 875 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
765#endif 876#endif
766#if ENABLE_ICMP 877#if ENABLE_ICMP
767, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 878 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
768#endif 879#endif
769#if ENABLE_DNS 880#if ENABLE_DNS
770, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 881 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
771#endif 882#endif
772, tap_ev_watcher (this, &vpn::tap_ev) 883 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
773{
774} 884}
775 885
776vpn::~vpn () 886vpn::~vpn ()
777{ 887{
778} 888}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines