ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.35 by pcg, Fri Apr 8 16:12:49 2005 UTC vs.
Revision 1.71 by root, Thu Oct 6 03:25:54 2022 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
46 57
58using namespace std;
59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
48 61
49///////////////////////////////////////////////////////////////////////////// 62/////////////////////////////////////////////////////////////////////////////
63
64// hopefully temporary workaround for rare buffer full conditions
65// if it happens, usually instantly retrying or retrying ~5ms later
66// is good enough with current network technologies/kernels
67
68static ssize_t
69xsendto (int fd, const void *buf, size_t len, int flags,
70 const struct sockaddr *sa, socklen_t salen)
71{
72 ssize_t res;
73
74 for (int retry = 0; retry <= 13; ++retry) // ~100ms
75 {
76 res = sendto (fd, buf, len, flags, sa, salen);
77
78 if (res >= 0 || errno != ENOBUFS)
79 break;
80
81 struct timespec ts = { 0, 1000 * retry };
82 nanosleep (&ts, 0);
83 }
84
85 return res;
86}
87
88/////////////////////////////////////////////////////////////////////////////
89
90static void inline
91set_tos (int fd, int &tos_prev, int tos)
92{
93#if defined(SOL_IP) && defined(IP_TOS)
94 if (tos_prev == tos)
95 return;
96
97 tos_prev = tos;
98 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
99#endif
100}
50 101
51void 102void
52vpn::script_init_env () 103vpn::script_init_env ()
53{ 104{
54 // the tunnel device mtu should be the physical mtu - overhead 105 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 106 // the tricky part is rounding to the cipher key blocksize
56 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 107 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
57 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 108 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
58 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 109 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
59 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 110 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
60 111
61 char *env; 112 char *env;
62 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 113 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
63 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 114 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
… …
75 snprintf (ext, 16, "_%d", (*c)->conf->id); 126 snprintf (ext, 16, "_%d", (*c)->conf->id);
76 (*c)->script_init_env (ext); 127 (*c)->script_init_env (ext);
77 } 128 }
78} 129}
79 130
131inline const char *
80const char *vpn::script_if_init () 132vpn::script_if_init ()
81{ 133{
82 script_init_env (); 134 script_init_env ();
83 135
84 return tap->if_up (); 136 return tap->if_up ();
85} 137}
86 138
139inline const char *
87const char *vpn::script_if_up () 140vpn::script_if_up ()
88{ 141{
89 script_init_env (); 142 script_init_env ();
90 143
91 char *filename; 144 return conf.config_filename (::conf.script_if_up, "if-up");
92 asprintf (&filename, 145}
93 "%s/%s",
94 confbase,
95 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
96 146
97 return filename; 147int
148vpn::setup_socket (u8 prot, int family, int type, int proto)
149{
150 int fd = socket (family, type, proto);
151
152 if (fd < 0)
153 {
154 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
155 return fd;
156 }
157
158 fcntl (fd, F_SETFL, O_NONBLOCK);
159 fcntl (fd, F_SETFD, FD_CLOEXEC);
160
161#ifdef SO_MARK
162 if (::conf.nfmark)
163 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
164 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
165#endif
166
167 return fd;
98} 168}
99 169
100int 170int
101vpn::setup () 171vpn::setup ()
102{ 172{
173 int success = 0;
174
175 ipv4_tos = -1;
103 ipv4_fd = -1; 176 ipv4_fd = -1;
104 177
105 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 178 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106 { 179 {
107 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 180 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
108 181
109 if (ipv4_fd < 0) 182 if (ipv4_fd < 0)
110 return -1; 183 return -1;
111
112 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
113 184
114#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 185#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
115 // this I really consider a linux bug. I am neither connected 186 // this I really consider a linux bug. I am neither connected
116 // nor do I fragment myself. Linux still sets DF and doesn't 187 // nor do I fragment myself. Linux still sets DF and doesn't
117 // fragment for me sometimes. 188 // fragment for me sometimes.
… …
123 194
124 sockinfo si (THISNODE, PROT_IPv4); 195 sockinfo si (THISNODE, PROT_IPv4);
125 196
126 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
127 { 198 {
128 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
129 exit (EXIT_FAILURE); 200 return -1;
130 } 201 }
131 202
132 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 203 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
204 ++success;
133 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_IPv4;
134 208
209 udpv4_tos = -1;
135 udpv4_fd = -1; 210 udpv4_fd = -1;
136 211
137 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 212 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
138 { 213 {
139 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 214 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
140 215
141 if (udpv4_fd < 0) 216 if (udpv4_fd < 0)
142 return -1; 217 return -1;
143
144 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
145 218
146 // standard daemon practise... 219 // standard daemon practise...
147 { 220 {
148 int oval = 1; 221 int oval = 1;
149 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 222 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
161 234
162 sockinfo si (THISNODE, PROT_UDPv4); 235 sockinfo si (THISNODE, PROT_UDPv4);
163 236
164 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 237 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
165 { 238 {
166 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 239 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
167 exit (EXIT_FAILURE); 240 return -1;
168 } 241 }
169 242
170 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 243 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
244 ++success;
171 } 245 }
246 else
247 THISNODE->protocols &= ~PROT_UDPv4;
172 248
249 icmpv4_tos = -1;
173 icmpv4_fd = -1; 250 icmpv4_fd = -1;
174 251
175#if ENABLE_ICMP 252#if ENABLE_ICMP
176 if (THISNODE->protocols & PROT_ICMPv4) 253 if (THISNODE->protocols & PROT_ICMPv4)
177 { 254 {
178 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 255 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
179 256
180 if (icmpv4_fd < 0) 257 if (icmpv4_fd < 0)
181 return -1; 258 return -1;
182 259
183 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK); 260// no clue where trhis is actually defined
261#if !defined(ICMP_FILTER) && defined(__linux)
262 #define ICMP_FILTER 1
263#endif
184 264
185#ifdef ICMP_FILTER 265#ifdef ICMP_FILTER
186 { 266 {
187 icmp_filter oval; 267 uint32_t oval;
188 oval.data = 0xffffffff; 268 oval = 0;
189 if (::conf.icmp_type < 32) 269 if (::conf.icmp_type < 32)
190 oval.data &= ~(1 << ::conf.icmp_type); 270 oval |= 1 << ::conf.icmp_type;
271 oval = ~oval;
191 272
192 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval); 273 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
193 } 274 }
194#endif 275#endif
195 276
… …
197 // this I really consider a linux bug. I am neither connected 278 // this I really consider a linux bug. I am neither connected
198 // nor do I fragment myself. Linux still sets DF and doesn't 279 // nor do I fragment myself. Linux still sets DF and doesn't
199 // fragment for me sometimes. 280 // fragment for me sometimes.
200 { 281 {
201 int oval = IP_PMTUDISC_DONT; 282 int oval = IP_PMTUDISC_DONT;
202 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 283 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
203 } 284 }
204#endif 285#endif
205 286
206 sockinfo si (THISNODE, PROT_ICMPv4); 287 sockinfo si (THISNODE, PROT_ICMPv4);
207 288
208 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
209 { 290 {
210 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
211 exit (EXIT_FAILURE); 292 return -1;
212 } 293 }
213 294
214 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 295 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
296 ++success;
215 } 297 }
216#endif 298#endif
217 299
218 tcpv4_fd = -1; 300 tcpv4_fd = -1;
219 301
220#if ENABLE_TCP 302#if ENABLE_TCP
221 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 303 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
222 { 304 {
223 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 305 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
224 306
225 if (tcpv4_fd < 0) 307 if (tcpv4_fd < 0)
226 return -1; 308 return -1;
227 309
228 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
229
230 // standard daemon practise... 310 // standard daemon practise...
231 { 311 {
232 int oval = 1; 312 int oval = 1;
233 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 313 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
234 } 314 }
235 315
236 sockinfo si (THISNODE, PROT_TCPv4); 316 sockinfo si (THISNODE, PROT_TCPv4);
237 317
238 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 318 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
239 { 319 {
240 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 320 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
241 exit (EXIT_FAILURE); 321 return -1;
242 } 322 }
243 323
244 if (listen (tcpv4_fd, 5)) 324 if (listen (tcpv4_fd, 5))
245 { 325 {
246 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 326 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
247 exit (EXIT_FAILURE); 327 return -1;
248 } 328 }
249 329
250 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 330 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
331 ++success;
251 } 332 }
333 else
334 THISNODE->protocols &= ~PROT_TCPv4;
252#endif 335#endif
336
337 dnsv4_tos = -1;
338 dnsv4_fd = -1;
253 339
254#if ENABLE_DNS 340#if ENABLE_DNS
255 if (THISNODE->protocols & PROT_DNSv4) 341 if (THISNODE->protocols & PROT_DNSv4)
256 { 342 {
257 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 343 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
258 344
259 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 345 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
260 346
261 if (dnsv4_fd < 0) 347 if (dnsv4_fd < 0)
262 return -1; 348 return -1;
263 349
264# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 350# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
… …
281 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 367 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
282 PROT_DNSv4); 368 PROT_DNSv4);
283 369
284 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 370 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
285 { 371 {
286 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 372 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
287 exit (EXIT_FAILURE); 373 return -1;
288 } 374 }
289 375
290 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 376 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
377 ++success;
291 } 378 }
292#endif 379#endif
293 380
294 ///////////////////////////////////////////////////////////////////////////// 381 /////////////////////////////////////////////////////////////////////////////
382
383 if (!success)
384 {
385 slog (L_ERR, _("no protocols enabled."));
386 return -1;
387 }
295 388
296 reconnect_all (); 389 reconnect_all ();
297 390
298 ///////////////////////////////////////////////////////////////////////////// 391 /////////////////////////////////////////////////////////////////////////////
299 392
300 tap = new tap_device (); 393 tap = new tap_device ();
301 if (!tap) //D this, of course, never catches 394 if (!tap) //D this, of course, never catches
302 { 395 {
303 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 396 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
304 exit (EXIT_FAILURE); 397 return -1;
305 } 398 }
306 399
400 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
401
402 run_script_cb cb;
403 cb.set<vpn, &vpn::script_if_init> (this);
404
307 if (tap->if_up () && 405 if (tap->if_up () &&
308 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 406 !run_script (cb, true))
309 { 407 {
310 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 408 slog (L_ERR, _("interface initialization command '%s' failed."),
311 tap->if_up ()); 409 tap->if_up ());
312 exit (EXIT_FAILURE); 410 return -1;
313 }
314
315 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
316 { 411 }
412
413 cb.set<vpn, &vpn::script_if_up> (this);
414 if (!run_script (cb, true))
415 {
317 slog (L_ERR, _("if-up command execution failed, exiting.")); 416 slog (L_ERR, _("if-up command execution failed."));
318 exit (EXIT_FAILURE); 417 return -1;
319 } 418 }
320 419
321 tap_ev_watcher.start (tap->fd, EVENT_READ); 420 tap_ev_watcher.start (tap->fd, EV_READ);
322 421
323 return 0; 422 return 0;
423}
424
425bool
426vpn::drop_privileges ()
427{
428 if (::conf.change_root)
429 {
430 if (!strcmp (::conf.change_root, "/"))
431 {
432 char dir [L_tmpnam];
433 if (!tmpnam (dir))
434 {
435 slog (L_CRIT, _("unable to create anonymous root path."));
436 return false;
437 }
438
439 if (mkdir (dir, 0700))
440 {
441 slog (L_CRIT, _("unable to create anonymous root directory."));
442 return false;
443 }
444
445 if (chdir (dir))
446 {
447 slog (L_CRIT, _("unable to change to anonymous root directory."));
448 return false;
449 }
450
451 if (rmdir (dir))
452 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
453 }
454 else
455 {
456 if (chdir (::conf.change_root))
457 {
458 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
459 return false;
460 }
461 }
462
463 if (chroot ("."))
464 {
465 slog (L_CRIT, _("unable to set new root directory."));
466 return false;
467 }
468
469 if (chdir ("/"))
470 {
471 slog (L_CRIT, _("unable to set cwd to new root directory."));
472 return false;
473 }
474 }
475
476 if (::conf.change_gid)
477 if (setgid (::conf.change_gid))
478 {
479 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
480 return false;
481 }
482
483 if (::conf.change_uid)
484 if (setuid (::conf.change_uid))
485 {
486 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
487 return false;
488 }
489
490 return true;
324} 491}
325 492
326bool 493bool
327vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 494vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
328{ 495{
329#if defined(SOL_IP) && defined(IP_TOS) 496 set_tos (ipv4_fd, ipv4_tos, tos);
330 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
331#endif
332 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 497 xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
333 498
334 return true; 499 return true;
335} 500}
336 501
337static u16 502static u16
… …
359 524
360#if ENABLE_ICMP 525#if ENABLE_ICMP
361bool 526bool
362vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 527vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
363{ 528{
364#if defined(SOL_IP) && defined(IP_TOS)
365 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
366#endif
367
368 pkt->unshift_hdr (4); 529 pkt->unshift_hdr (4);
369 530
370 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 531 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
371 hdr->type = ::conf.icmp_type; 532 hdr->type = ::conf.icmp_type;
372 hdr->code = 255; 533 hdr->code = 255;
373 hdr->checksum = 0; 534 hdr->checksum = 0;
374 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 535 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
375 536
537 set_tos (icmpv4_fd, icmpv4_tos, tos);
376 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 538 xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
377 539
378 return true; 540 return true;
379} 541}
380#endif 542#endif
381 543
382bool 544bool
383vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 545vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
384{ 546{
385#if defined(SOL_IP) && defined(IP_TOS) 547 set_tos (udpv4_fd, udpv4_tos, tos);
386 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
387#endif
388 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 548 xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
389 549
390 return true; 550 return true;
391} 551}
392 552
393void 553void
… …
403 { 563 {
404 // broadcast, this is ugly, but due to the security policy 564 // broadcast, this is ugly, but due to the security policy
405 // we have to connect to all hosts... 565 // we have to connect to all hosts...
406 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 566 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
407 if ((*c)->conf != THISNODE) 567 if ((*c)->conf != THISNODE)
408 (*c)->inject_data_packet (pkt, true); 568 (*c)->inject_data_packet (pkt);
409 } 569 }
410} 570}
411 571
412void 572void
413vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 573vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
414{ 574{
415 unsigned int src = pkt->src (); 575 unsigned int src = pkt->src ();
416 unsigned int dst = pkt->dst (); 576 unsigned int dst = pkt->dst ();
417 577
418 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 578 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
419 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 579 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
420 580
421 if (src == 0 || src > conns.size () 581 if (src == 0 || src > conns.size ()
422 || dst > conns.size () 582 || dst > conns.size ()
423 || pkt->typ () >= vpn_packet::PT_MAX) 583 || pkt->typ () >= vpn_packet::PT_MAX)
424 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 584 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
425 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
426 else if (dst > conns.size ())
427 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
428 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 585 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
429 else 586 else
430 { 587 {
431 connection *c = conns[src - 1]; 588 connection *c = conns[src - 1];
432 589
433 if (dst == 0) 590 if (dst == 0)
434 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 591 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
435 c->conf->nodename, (const char *)rsi); 592 c->conf->nodename, (const char *)rsi);
436 else if (dst != THISNODE->id) 593 else if (dst != THISNODE->id)
437 { 594 {
438 if (THISNODE->routerprio) 595 if (THISNODE->routerprio)
439 // the tos setting gets lost here. who cares. 596 // the tos setting gets lost here. who cares.
440 conns[dst - 1]->inject_vpn_packet (pkt); 597 conns[dst - 1]->inject_vpn_packet (pkt);
441 else 598 else
442 slog (L_WARN, 599 slog (L_WARN,
443 _("%s(%s): forwarding request (=> %s), but we are no router"), 600 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
444 c->conf->nodename, (const char *)rsi, 601 c->conf->nodename, (const char *)rsi,
445 conns[dst - 1]->conf->nodename); 602 conns[dst - 1]->conf->nodename);
446 } 603 }
447 else 604 else
448 c->recv_vpn_packet (pkt, rsi); 605 c->recv_vpn_packet (pkt, rsi);
… …
453vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 610vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
454{ 611{
455 switch (si.prot) 612 switch (si.prot)
456 { 613 {
457 case PROT_IPv4: 614 case PROT_IPv4:
458 return send_ipv4_packet (pkt, si, tos); 615 return send_ipv4_packet (pkt, si, tos);
616
459 case PROT_UDPv4: 617 case PROT_UDPv4:
460 return send_udpv4_packet (pkt, si, tos); 618 return send_udpv4_packet (pkt, si, tos);
619
461#if ENABLE_TCP 620#if ENABLE_TCP
462 case PROT_TCPv4: 621 case PROT_TCPv4:
463 return send_tcpv4_packet (pkt, si, tos); 622 return send_tcpv4_packet (pkt, si, tos);
464#endif 623#endif
465#if ENABLE_ICMP 624#if ENABLE_ICMP
466 case PROT_ICMPv4: 625 case PROT_ICMPv4:
467 return send_icmpv4_packet (pkt, si, tos); 626 return send_icmpv4_packet (pkt, si, tos);
468#endif 627#endif
469#if ENABLE_DNS 628#if ENABLE_DNS
470 case PROT_DNSv4: 629 case PROT_DNSv4:
471 return send_dnsv4_packet (pkt, si, tos); 630 return send_dnsv4_packet (pkt, si, tos);
472#endif 631#endif
473
474 default: 632 default:
475 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 633 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
476 } 634 }
477 635
478 return false; 636 return false;
479} 637}
480 638
481void 639inline void
482vpn::ipv4_ev (io_watcher &w, short revents) 640vpn::ipv4_ev (ev::io &w, int revents)
483{ 641{
484 if (revents & EVENT_READ) 642 if (revents & EV_READ)
485 { 643 {
486 vpn_packet *pkt = new vpn_packet; 644 vpn_packet *pkt = new vpn_packet;
487 struct sockaddr_in sa; 645 struct sockaddr_in sa;
488 socklen_t sa_len = sizeof (sa); 646 socklen_t sa_len = sizeof (sa);
489 int len; 647 int len;
… …
495 if (len > 0) 653 if (len > 0)
496 { 654 {
497 pkt->len = len; 655 pkt->len = len;
498 656
499 // raw sockets deliver the ipv4 header, but don't expect it on sends 657 // raw sockets deliver the ipv4 header, but don't expect it on sends
500 pkt->skip_hdr (IP_OVERHEAD); 658 pkt->skip_hdr (pkt->ipv4_hdr_len ());
501 659
502 recv_vpn_packet (pkt, si); 660 recv_vpn_packet (pkt, si);
503 } 661 }
504 else 662 else
505 { 663 {
506 // probably ECONNRESET or somesuch 664 // probably ECONNRESET or somesuch
507 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 665 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
508 } 666 }
509 667
510 delete pkt; 668 delete pkt;
511 } 669 }
512 else 670 else
513 { 671 {
514 slog (L_ERR, 672 slog (L_ERR,
515 _("FATAL: unknown revents %08x in socket, terminating\n"), 673 _("FATAL: unknown revents %08x in socket, exiting.\n"),
516 revents); 674 revents);
517 exit (EXIT_FAILURE); 675 exit (EXIT_FAILURE);
518 } 676 }
519} 677}
520 678
521#if ENABLE_ICMP 679#if ENABLE_ICMP
522void 680inline void
523vpn::icmpv4_ev (io_watcher &w, short revents) 681vpn::icmpv4_ev (ev::io &w, int revents)
524{ 682{
525 if (revents & EVENT_READ) 683 if (revents & EV_READ)
526 { 684 {
527 vpn_packet *pkt = new vpn_packet; 685 vpn_packet *pkt = new vpn_packet;
528 struct sockaddr_in sa; 686 struct sockaddr_in sa;
529 socklen_t sa_len = sizeof (sa); 687 socklen_t sa_len = sizeof (sa);
530 int len; 688 int len;
… …
542 if (hdr->type == ::conf.icmp_type 700 if (hdr->type == ::conf.icmp_type
543 && hdr->code == 255) 701 && hdr->code == 255)
544 { 702 {
545 // raw sockets deliver the ipv4, but don't expect it on sends 703 // raw sockets deliver the ipv4, but don't expect it on sends
546 // this is slow, but... 704 // this is slow, but...
547 pkt->skip_hdr (ICMP_OVERHEAD); 705 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
548 706
549 recv_vpn_packet (pkt, si); 707 recv_vpn_packet (pkt, si);
550 } 708 }
551 } 709 }
552 else 710 else
553 { 711 {
554 // probably ECONNRESET or somesuch 712 // probably ECONNRESET or somesuch
555 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 713 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
556 } 714 }
557 715
558 delete pkt; 716 delete pkt;
559 } 717 }
560 else 718 else
561 { 719 {
562 slog (L_ERR, 720 slog (L_ERR,
563 _("FATAL: unknown revents %08x in socket, terminating\n"), 721 _("FATAL: unknown revents %08x in socket, exiting.\n"),
564 revents); 722 revents);
565 exit (EXIT_FAILURE); 723 exit (EXIT_FAILURE);
566 } 724 }
567} 725}
568#endif 726#endif
569 727
570void 728inline void
571vpn::udpv4_ev (io_watcher &w, short revents) 729vpn::udpv4_ev (ev::io &w, int revents)
572{ 730{
573 if (revents & EVENT_READ) 731 if (revents & EV_READ)
574 { 732 {
575 vpn_packet *pkt = new vpn_packet; 733 vpn_packet *pkt = new vpn_packet;
576 struct sockaddr_in sa; 734 struct sockaddr_in sa;
577 socklen_t sa_len = sizeof (sa); 735 socklen_t sa_len = sizeof (sa);
578 int len; 736 int len;
… …
588 recv_vpn_packet (pkt, si); 746 recv_vpn_packet (pkt, si);
589 } 747 }
590 else 748 else
591 { 749 {
592 // probably ECONNRESET or somesuch 750 // probably ECONNRESET or somesuch
593 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 751 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
594 } 752 }
595 753
596 delete pkt; 754 delete pkt;
597 } 755 }
598 else 756 else
599 { 757 {
600 slog (L_ERR, 758 slog (L_ERR,
601 _("FATAL: unknown revents %08x in socket, terminating\n"), 759 _("FATAL: unknown revents %08x in socket, exiting.\n"),
602 revents); 760 revents);
603 exit (EXIT_FAILURE); 761 exit (EXIT_FAILURE);
604 } 762 }
605} 763}
606 764
607void 765inline void
608vpn::tap_ev (io_watcher &w, short revents) 766vpn::tap_ev (ev::io &w, int revents)
609{ 767{
610 if (revents & EVENT_READ) 768 if (revents & EV_READ)
611 { 769 {
612 /* process data */ 770 /* process data */
613 tap_packet *pkt; 771 tap_packet *pkt;
614 772
615 pkt = tap->recv (); 773 pkt = tap->recv ();
… …
644 } 802 }
645 else 803 else
646 abort (); 804 abort ();
647} 805}
648 806
649void 807inline void
650vpn::event_cb (time_watcher &w) 808vpn::event_cb (ev::timer &w, int)
651{ 809{
652 if (events) 810 if (events)
653 { 811 {
654 if (events & EVENT_SHUTDOWN) 812 if (events & EVENT_SHUTDOWN)
655 { 813 {
656 slog (L_INFO, _("preparing shutdown...")); 814 slog (L_INFO, _("preparing shutdown..."));
657 815
658 shutdown_all (); 816 shutdown_all ();
659 remove_pid (conf.pidfilename); 817 remove_pid (conf.pidfilename);
660 slog (L_INFO, _("terminating")); 818 slog (L_INFO, _("exiting."));
661 exit (EXIT_SUCCESS); 819 exit (EXIT_SUCCESS);
662 } 820 }
663 821
664 if (events & EVENT_RECONNECT) 822 if (events & EVENT_RECONNECT)
665 { 823 {
666 slog (L_INFO, _("forced reconnect")); 824 slog (L_INFO, _("forced reconnect."));
667 825
668 reconnect_all (); 826 reconnect_all ();
669 } 827 }
670 828
671 events = 0; 829 events = 0;
… …
687 845
688 conns.clear (); 846 conns.clear ();
689 847
690 connection_init (); 848 connection_init ();
691 849
692 for (configuration::node_vector::iterator i = conf.nodes.begin (); 850 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
693 i != conf.nodes.end (); ++i) 851 conns.push_back (new connection (this, *i));
694 { 852
695 connection *conn = new connection (this, *i); 853 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
696 conns.push_back (conn);
697 conn->establish_connection (); 854 (*c)->establish_connection ();
698 }
699} 855}
700 856
701connection *vpn::find_router () 857bool
858vpn::can_direct (conf_node *src, conf_node *dst) const
702{ 859{
703 u32 prio = 1; 860 return src != dst
861 && src->may_direct (dst)
862 && dst->may_direct (src)
863 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
864 || (src->protocols & dst->connectable_protocols ()));
865}
866
867// only works for indirect and routed connections: find a router
868// from THISNODE to dst
869connection *
870vpn::find_router_for (const connection *dst)
871{
704 connection *router = 0; 872 connection *router = 0;
705 873
874 // first try to find a router with a direct connection, route there
875 // regardless of any other considerations.
876 {
877 u32 prio = 1;
878
879 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
880 {
881 connection *c = *i;
882
883 if (c->conf->routerprio > prio
884 && c->conf != THISNODE
885 && can_direct (c->conf, dst->conf)
886 && c->ictx && c->octx)
887 {
888 prio = c->conf->routerprio;
889 router = c;
890 }
891 }
892 }
893
894 if (router)
895 return router;
896
897 // second try find the router with the highest priority, higher than ours
898 {
899 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
900
901 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
902 {
903 connection *c = *i;
904
905 if (c->conf->routerprio > prio
906 && c != dst
907 && c->conf != THISNODE
908 && c->ictx && c->octx)
909 {
910 prio = c->conf->routerprio;
911 router = c;
912 }
913 }
914 }
915
916 return router;
917}
918
919void
920vpn::connection_established (connection *c)
921{
706 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 922 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
707 { 923 {
708 connection *c = *i; 924 connection *o = *i;
709 925
710 if (c->conf->routerprio > prio 926 if (o->si.valid ()
711 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 927 && c->si != o->si
712 && c->ictx && c->octx 928 && c == find_router_for (o)
713 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 929 && !can_direct (THISNODE, o->conf))
714 {
715 prio = c->conf->routerprio;
716 router = c;
717 } 930 {
931 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
932 o->conf->nodename, c->conf->nodename);
933 o->rekey ();
934 }
718 } 935 }
719
720 return router;
721} 936}
722 937
938void
723void vpn::send_connect_request (int id) 939vpn::send_connect_request (connection *c)
724{ 940{
725 connection *c = find_router (); 941 connection *r = find_router_for (c);
726 942
727 if (c) 943 if (r)
944 {
945 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
946 c->conf->nodename, r->conf->nodename);
728 c->send_connect_request (id); 947 r->send_connect_request (c->conf->id);
948 }
729 else 949 else
730 // no router found, aggressively connect to all routers 950 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
731 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 951 c->conf->nodename);
732 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
733 (*i)->establish_connection ();
734} 952}
735 953
736void 954void
737connection::dump_status () 955connection::dump_status ()
738{ 956{
739 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 957 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
740 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 958 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
741 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 959 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
742 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 960 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
743 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 961 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
744 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
745 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
746} 962}
747 963
748void 964void
749vpn::dump_status () 965vpn::dump_status ()
750{ 966{
751 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 967 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
752 968
753 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 969 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
754 (*c)->dump_status (); 970 (*c)->dump_status ();
755 971
756 slog (L_NOTICE, _("END status dump")); 972 slog (L_NOTICE, _("END status dump"));
757} 973}
758 974
759vpn::vpn (void) 975vpn::vpn (void)
976{
760: event (this, &vpn::event_cb) 977 event .set<vpn, &vpn::event_cb > (this);
761, udpv4_ev_watcher (this, &vpn::udpv4_ev) 978 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
762, ipv4_ev_watcher (this, &vpn::ipv4_ev) 979 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
763#if ENABLE_TCP 980#if ENABLE_TCP
764, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 981 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
765#endif 982#endif
766#if ENABLE_ICMP 983#if ENABLE_ICMP
767, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 984 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
768#endif 985#endif
769#if ENABLE_DNS 986#if ENABLE_DNS
770, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 987 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
771#endif 988#endif
772, tap_ev_watcher (this, &vpn::tap_ev) 989 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
773{
774} 990}
775 991
776vpn::~vpn () 992vpn::~vpn ()
777{ 993{
778} 994}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines