ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.40 by pcg, Sat Dec 1 23:35:31 2007 UTC vs.
Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
51void 73void
52vpn::script_init_env () 74vpn::script_init_env ()
53{ 75{
54 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
… …
75 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
76 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
77 } 99 }
78} 100}
79 101
102inline const char *
80const char *vpn::script_if_init () 103vpn::script_if_init ()
81{ 104{
82 script_init_env (); 105 script_init_env ();
83 106
84 return tap->if_up (); 107 return tap->if_up ();
85} 108}
86 109
110inline const char *
87const char *vpn::script_if_up () 111vpn::script_if_up ()
88{ 112{
89 script_init_env (); 113 script_init_env ();
90 114
91 char *filename; 115 char *filename;
92 asprintf (&filename, 116 asprintf (&filename,
… …
96 120
97 return filename; 121 return filename;
98} 122}
99 123
100int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 setsockopt (ipv4_fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark);
141#endif
142
143 return fd;
144}
145
146int
101vpn::setup () 147vpn::setup ()
102{ 148{
149 int success = 0;
150
151 ipv4_tos = -1;
103 ipv4_fd = -1; 152 ipv4_fd = -1;
104 153
105 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 154 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106 { 155 {
107 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 156 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
108 157
109 if (ipv4_fd < 0) 158 if (ipv4_fd < 0)
110 return -1; 159 return -1;
111
112 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
113 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
114 160
115#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 161#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
116 // this I really consider a linux bug. I am neither connected 162 // this I really consider a linux bug. I am neither connected
117 // nor do I fragment myself. Linux still sets DF and doesn't 163 // nor do I fragment myself. Linux still sets DF and doesn't
118 // fragment for me sometimes. 164 // fragment for me sometimes.
… …
124 170
125 sockinfo si (THISNODE, PROT_IPv4); 171 sockinfo si (THISNODE, PROT_IPv4);
126 172
127 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 173 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
128 { 174 {
129 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 175 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
130 exit (EXIT_FAILURE); 176 return -1;
131 } 177 }
132 178
133 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 179 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
180 ++success;
134 } 181 }
182 else
183 THISNODE->protocols &= ~PROT_IPv4;
135 184
185 udpv4_tos = -1;
136 udpv4_fd = -1; 186 udpv4_fd = -1;
137 187
138 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 188 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
139 { 189 {
140 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 190 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
141 191
142 if (udpv4_fd < 0) 192 if (udpv4_fd < 0)
143 return -1; 193 return -1;
144
145 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
146 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
147 194
148 // standard daemon practise... 195 // standard daemon practise...
149 { 196 {
150 int oval = 1; 197 int oval = 1;
151 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 198 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
163 210
164 sockinfo si (THISNODE, PROT_UDPv4); 211 sockinfo si (THISNODE, PROT_UDPv4);
165 212
166 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 213 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
167 { 214 {
168 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 215 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
169 exit (EXIT_FAILURE); 216 return -1;
170 } 217 }
171 218
172 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 219 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
220 ++success;
173 } 221 }
222 else
223 THISNODE->protocols &= ~PROT_UDPv4;
174 224
225 icmpv4_tos = -1;
175 icmpv4_fd = -1; 226 icmpv4_fd = -1;
176 227
177#if ENABLE_ICMP 228#if ENABLE_ICMP
178 if (THISNODE->protocols & PROT_ICMPv4) 229 if (THISNODE->protocols & PROT_ICMPv4)
179 { 230 {
180 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 231 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
181 232
182 if (icmpv4_fd < 0) 233 if (icmpv4_fd < 0)
183 return -1; 234 return -1;
184
185 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
186 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
187 235
188#ifdef ICMP_FILTER 236#ifdef ICMP_FILTER
189 { 237 {
190 icmp_filter oval; 238 icmp_filter oval;
191 oval.data = 0xffffffff; 239 oval.data = 0xffffffff;
… …
208 256
209 sockinfo si (THISNODE, PROT_ICMPv4); 257 sockinfo si (THISNODE, PROT_ICMPv4);
210 258
211 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 259 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
212 { 260 {
213 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 261 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
214 exit (EXIT_FAILURE); 262 return -1;
215 } 263 }
216 264
217 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 265 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
266 ++success;
218 } 267 }
219#endif 268#endif
220 269
221 tcpv4_fd = -1; 270 tcpv4_fd = -1;
222 271
223#if ENABLE_TCP 272#if ENABLE_TCP
224 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 273 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
225 { 274 {
226 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 275 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
227 276
228 if (tcpv4_fd < 0) 277 if (tcpv4_fd < 0)
229 return -1; 278 return -1;
230 279
231 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
232 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
233
234 // standard daemon practise... 280 // standard daemon practise...
235 { 281 {
236 int oval = 1; 282 int oval = 1;
237 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 283 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
238 } 284 }
239 285
240 sockinfo si (THISNODE, PROT_TCPv4); 286 sockinfo si (THISNODE, PROT_TCPv4);
241 287
242 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 288 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
243 { 289 {
244 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 290 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
245 exit (EXIT_FAILURE); 291 return -1;
246 } 292 }
247 293
248 if (listen (tcpv4_fd, 5)) 294 if (listen (tcpv4_fd, 5))
249 { 295 {
250 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 296 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
251 exit (EXIT_FAILURE); 297 return -1;
252 } 298 }
253 299
254 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 300 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
301 ++success;
255 } 302 }
303 else
304 THISNODE->protocols &= ~PROT_TCPv4;
256#endif 305#endif
306
307 dnsv4_tos = -1;
308 dnsv4_fd = -1;
257 309
258#if ENABLE_DNS 310#if ENABLE_DNS
259 if (THISNODE->protocols & PROT_DNSv4) 311 if (THISNODE->protocols & PROT_DNSv4)
260 { 312 {
261 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 313 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
262 314
263 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 315 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
264 316
265 if (dnsv4_fd < 0) 317 if (dnsv4_fd < 0)
266 return -1; 318 return -1;
267
268 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
269 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
270 319
271# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 320# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
272 // this I really consider a linux bug. I am neither connected 321 // this I really consider a linux bug. I am neither connected
273 // nor do I fragment myself. Linux still sets DF and doesn't 322 // nor do I fragment myself. Linux still sets DF and doesn't
274 // fragment for me sometimes. 323 // fragment for me sometimes.
… …
288 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 337 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
289 PROT_DNSv4); 338 PROT_DNSv4);
290 339
291 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 340 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
292 { 341 {
293 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 342 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
294 exit (EXIT_FAILURE); 343 return -1;
295 } 344 }
296 345
297 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 346 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
347 ++success;
298 } 348 }
299#endif 349#endif
300 350
301 ///////////////////////////////////////////////////////////////////////////// 351 /////////////////////////////////////////////////////////////////////////////
352
353 if (!success)
354 {
355 slog (L_ERR, _("no protocols enabled."));
356 return -1;
357 }
302 358
303 reconnect_all (); 359 reconnect_all ();
304 360
305 ///////////////////////////////////////////////////////////////////////////// 361 /////////////////////////////////////////////////////////////////////////////
306 362
307 tap = new tap_device (); 363 tap = new tap_device ();
308 if (!tap) //D this, of course, never catches 364 if (!tap) //D this, of course, never catches
309 { 365 {
310 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 366 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
311 exit (EXIT_FAILURE); 367 return -1;
312 } 368 }
313 369
314 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 370 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
315 371
372 run_script_cb cb;
373 cb.set<vpn, &vpn::script_if_init> (this);
374
316 if (tap->if_up () && 375 if (tap->if_up () &&
317 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 376 !run_script (cb, true))
318 { 377 {
319 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 378 slog (L_ERR, _("interface initialization command '%s' failed."),
320 tap->if_up ()); 379 tap->if_up ());
321 exit (EXIT_FAILURE); 380 return -1;
322 }
323
324 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
325 { 381 }
382
383 cb.set<vpn, &vpn::script_if_up> (this);
384 if (!run_script (cb, true))
385 {
326 slog (L_ERR, _("if-up command execution failed, exiting.")); 386 slog (L_ERR, _("if-up command execution failed."));
327 exit (EXIT_FAILURE); 387 return -1;
328 } 388 }
329 389
330 tap_ev_watcher.start (tap->fd, EV_READ); 390 tap_ev_watcher.start (tap->fd, EV_READ);
331 391
332 return 0; 392 return 0;
333} 393}
334 394
335bool 395bool
336vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 396vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
337{ 397{
338#if defined(SOL_IP) && defined(IP_TOS) 398 set_tos (ipv4_fd, ipv4_tos, tos);
339 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
340#endif
341 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 399 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
342 400
343 return true; 401 return true;
344} 402}
345 403
… …
368 426
369#if ENABLE_ICMP 427#if ENABLE_ICMP
370bool 428bool
371vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 429vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
372{ 430{
373#if defined(SOL_IP) && defined(IP_TOS)
374 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
375#endif
376
377 pkt->unshift_hdr (4); 431 pkt->unshift_hdr (4);
378 432
379 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 433 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
380 hdr->type = ::conf.icmp_type; 434 hdr->type = ::conf.icmp_type;
381 hdr->code = 255; 435 hdr->code = 255;
382 hdr->checksum = 0; 436 hdr->checksum = 0;
383 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 437 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
384 438
439 set_tos (icmpv4_fd, icmpv4_tos, tos);
385 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 440 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
386 441
387 return true; 442 return true;
388} 443}
389#endif 444#endif
390 445
391bool 446bool
392vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 447vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
393{ 448{
394#if defined(SOL_IP) && defined(IP_TOS) 449 set_tos (udpv4_fd, udpv4_tos, tos);
395 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
396#endif
397 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 450 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
398 451
399 return true; 452 return true;
400} 453}
401 454
… …
412 { 465 {
413 // broadcast, this is ugly, but due to the security policy 466 // broadcast, this is ugly, but due to the security policy
414 // we have to connect to all hosts... 467 // we have to connect to all hosts...
415 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 468 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
416 if ((*c)->conf != THISNODE) 469 if ((*c)->conf != THISNODE)
417 (*c)->inject_data_packet (pkt, true); 470 (*c)->inject_data_packet (pkt);
418 } 471 }
419} 472}
420 473
421void 474void
422vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 475vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
423{ 476{
424 unsigned int src = pkt->src (); 477 unsigned int src = pkt->src ();
425 unsigned int dst = pkt->dst (); 478 unsigned int dst = pkt->dst ();
426 479
427 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 480 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
428 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 481 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
429 482
430 if (src == 0 || src > conns.size () 483 if (src == 0 || src > conns.size ()
431 || dst > conns.size () 484 || dst > conns.size ()
432 || pkt->typ () >= vpn_packet::PT_MAX) 485 || pkt->typ () >= vpn_packet::PT_MAX)
433 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 486 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
434 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 487 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
435 else if (dst > conns.size ()) 488 else if (dst > conns.size ())
436 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 489 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
437 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 490 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
438 else 491 else
439 { 492 {
440 connection *c = conns[src - 1]; 493 connection *c = conns[src - 1];
441 494
442 if (dst == 0) 495 if (dst == 0)
443 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 496 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
444 c->conf->nodename, (const char *)rsi); 497 c->conf->nodename, (const char *)rsi);
445 else if (dst != THISNODE->id) 498 else if (dst != THISNODE->id)
446 { 499 {
447 if (THISNODE->routerprio) 500 if (THISNODE->routerprio)
448 // the tos setting gets lost here. who cares. 501 // the tos setting gets lost here. who cares.
449 conns[dst - 1]->inject_vpn_packet (pkt); 502 conns[dst - 1]->inject_vpn_packet (pkt);
450 else 503 else
451 slog (L_WARN, 504 slog (L_WARN,
452 _("%s(%s): forwarding request (=> %s), but we are no router"), 505 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
453 c->conf->nodename, (const char *)rsi, 506 c->conf->nodename, (const char *)rsi,
454 conns[dst - 1]->conf->nodename); 507 conns[dst - 1]->conf->nodename);
455 } 508 }
456 else 509 else
457 c->recv_vpn_packet (pkt, rsi); 510 c->recv_vpn_packet (pkt, rsi);
… …
463{ 516{
464 switch (si.prot) 517 switch (si.prot)
465 { 518 {
466 case PROT_IPv4: 519 case PROT_IPv4:
467 return send_ipv4_packet (pkt, si, tos); 520 return send_ipv4_packet (pkt, si, tos);
521
468 case PROT_UDPv4: 522 case PROT_UDPv4:
469 return send_udpv4_packet (pkt, si, tos); 523 return send_udpv4_packet (pkt, si, tos);
524
470#if ENABLE_TCP 525#if ENABLE_TCP
471 case PROT_TCPv4: 526 case PROT_TCPv4:
472 return send_tcpv4_packet (pkt, si, tos); 527 return send_tcpv4_packet (pkt, si, tos);
473#endif 528#endif
474#if ENABLE_ICMP 529#if ENABLE_ICMP
… …
477#endif 532#endif
478#if ENABLE_DNS 533#if ENABLE_DNS
479 case PROT_DNSv4: 534 case PROT_DNSv4:
480 return send_dnsv4_packet (pkt, si, tos); 535 return send_dnsv4_packet (pkt, si, tos);
481#endif 536#endif
482
483 default: 537 default:
484 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 538 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
485 } 539 }
486 540
487 return false; 541 return false;
488} 542}
489 543
490void 544inline void
491vpn::ipv4_ev (ev::io &w, int revents) 545vpn::ipv4_ev (ev::io &w, int revents)
492{ 546{
493 if (revents & EV_READ) 547 if (revents & EV_READ)
494 { 548 {
495 vpn_packet *pkt = new vpn_packet; 549 vpn_packet *pkt = new vpn_packet;
… …
511 recv_vpn_packet (pkt, si); 565 recv_vpn_packet (pkt, si);
512 } 566 }
513 else 567 else
514 { 568 {
515 // probably ECONNRESET or somesuch 569 // probably ECONNRESET or somesuch
516 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 570 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
517 } 571 }
518 572
519 delete pkt; 573 delete pkt;
520 } 574 }
521 else 575 else
522 { 576 {
523 slog (L_ERR, 577 slog (L_ERR,
524 _("FATAL: unknown revents %08x in socket, terminating\n"), 578 _("FATAL: unknown revents %08x in socket, exiting.\n"),
525 revents); 579 revents);
526 exit (EXIT_FAILURE); 580 exit (EXIT_FAILURE);
527 } 581 }
528} 582}
529 583
530#if ENABLE_ICMP 584#if ENABLE_ICMP
531void 585inline void
532vpn::icmpv4_ev (ev::io &w, int revents) 586vpn::icmpv4_ev (ev::io &w, int revents)
533{ 587{
534 if (revents & EV_READ) 588 if (revents & EV_READ)
535 { 589 {
536 vpn_packet *pkt = new vpn_packet; 590 vpn_packet *pkt = new vpn_packet;
… …
559 } 613 }
560 } 614 }
561 else 615 else
562 { 616 {
563 // probably ECONNRESET or somesuch 617 // probably ECONNRESET or somesuch
564 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 618 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
565 } 619 }
566 620
567 delete pkt; 621 delete pkt;
568 } 622 }
569 else 623 else
570 { 624 {
571 slog (L_ERR, 625 slog (L_ERR,
572 _("FATAL: unknown revents %08x in socket, terminating\n"), 626 _("FATAL: unknown revents %08x in socket, exiting.\n"),
573 revents); 627 revents);
574 exit (EXIT_FAILURE); 628 exit (EXIT_FAILURE);
575 } 629 }
576} 630}
577#endif 631#endif
578 632
579void 633inline void
580vpn::udpv4_ev (ev::io &w, int revents) 634vpn::udpv4_ev (ev::io &w, int revents)
581{ 635{
582 if (revents & EV_READ) 636 if (revents & EV_READ)
583 { 637 {
584 vpn_packet *pkt = new vpn_packet; 638 vpn_packet *pkt = new vpn_packet;
… …
597 recv_vpn_packet (pkt, si); 651 recv_vpn_packet (pkt, si);
598 } 652 }
599 else 653 else
600 { 654 {
601 // probably ECONNRESET or somesuch 655 // probably ECONNRESET or somesuch
602 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 656 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
603 } 657 }
604 658
605 delete pkt; 659 delete pkt;
606 } 660 }
607 else 661 else
608 { 662 {
609 slog (L_ERR, 663 slog (L_ERR,
610 _("FATAL: unknown revents %08x in socket, terminating\n"), 664 _("FATAL: unknown revents %08x in socket, exiting.\n"),
611 revents); 665 revents);
612 exit (EXIT_FAILURE); 666 exit (EXIT_FAILURE);
613 } 667 }
614} 668}
615 669
616void 670inline void
617vpn::tap_ev (ev::io &w, int revents) 671vpn::tap_ev (ev::io &w, int revents)
618{ 672{
619 if (revents & EV_READ) 673 if (revents & EV_READ)
620 { 674 {
621 /* process data */ 675 /* process data */
… …
653 } 707 }
654 else 708 else
655 abort (); 709 abort ();
656} 710}
657 711
658void 712inline void
659vpn::event_cb (ev::timer &w, int) 713vpn::event_cb (ev::timer &w, int)
660{ 714{
661 if (events) 715 if (events)
662 { 716 {
663 if (events & EVENT_SHUTDOWN) 717 if (events & EVENT_SHUTDOWN)
664 { 718 {
665 slog (L_INFO, _("preparing shutdown...")); 719 slog (L_INFO, _("preparing shutdown..."));
666 720
667 shutdown_all (); 721 shutdown_all ();
668 remove_pid (conf.pidfilename); 722 remove_pid (conf.pidfilename);
669 slog (L_INFO, _("terminating")); 723 slog (L_INFO, _("exiting."));
670 exit (EXIT_SUCCESS); 724 exit (EXIT_SUCCESS);
671 } 725 }
672 726
673 if (events & EVENT_RECONNECT) 727 if (events & EVENT_RECONNECT)
674 { 728 {
675 slog (L_INFO, _("forced reconnect")); 729 slog (L_INFO, _("forced reconnect."));
676 730
677 reconnect_all (); 731 reconnect_all ();
678 } 732 }
679 733
680 events = 0; 734 events = 0;
… …
696 750
697 conns.clear (); 751 conns.clear ();
698 752
699 connection_init (); 753 connection_init ();
700 754
701 for (configuration::node_vector::iterator i = conf.nodes.begin (); 755 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
702 i != conf.nodes.end (); ++i) 756 conns.push_back (new connection (this, *i));
703 { 757
704 connection *conn = new connection (this, *i); 758 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
705 conns.push_back (conn);
706 conn->establish_connection (); 759 (*c)->establish_connection ();
707 }
708} 760}
709 761
710connection *vpn::find_router () 762bool vpn::can_direct (conf_node *src, conf_node *dst) const
711{ 763{
712 u32 prio = 1; 764 return src != dst
765 && src->may_direct (dst)
766 && dst->may_direct (src)
767 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
768 || (src->protocols & dst->connectable_protocols ()));
769}
770
771// only works for indirect and routed connections: find a router
772// from THISNODE to dst
773connection *vpn::find_router_for (const connection *dst)
774{
713 connection *router = 0; 775 connection *router = 0;
714 776
777 // first try to find a router with a direct connection, route there
778 // regardless of any other considerations.
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf != THISNODE
788 && can_direct (c->conf, dst->conf)
789 && c->ictx && c->octx)
790 {
791 prio = c->conf->routerprio;
792 router = c;
793 }
794 }
795 }
796
797 if (router)
798 return router;
799
800 // second try find the router with the highest priority, higher than ours
801 {
802 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
803
804 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
805 {
806 connection *c = *i;
807
808 if (c->conf->routerprio > prio
809 && c != dst
810 && c->conf != THISNODE
811 && c->ictx && c->octx)
812 {
813 prio = c->conf->routerprio;
814 router = c;
815 }
816 }
817 }
818
819 return router;
820}
821
822void vpn::connection_established (connection *c)
823{
715 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 824 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
716 { 825 {
717 connection *c = *i; 826 connection *o = *i;
718 827
719 if (c->conf->routerprio > prio 828 if (!o->is_direct
720 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 829 && o->si.valid ()
721 && c->ictx && c->octx 830 && c->si != o->si
722 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 831 && c == find_router_for (o))
723 {
724 prio = c->conf->routerprio;
725 router = c;
726 } 832 {
833 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
834 o->conf->nodename, c->conf->nodename);
835 o->rekey ();
836 }
727 } 837 }
728
729 return router;
730} 838}
731 839
732void vpn::send_connect_request (int id) 840void vpn::send_connect_request (connection *c)
733{ 841{
734 connection *c = find_router (); 842 connection *r = find_router_for (c);
735 843
736 if (c) 844 if (r)
845 {
846 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
847 c->conf->nodename, r->conf->nodename);
737 c->send_connect_request (id); 848 r->send_connect_request (c->conf->id);
849 }
738 else 850 else
739 // no router found, aggressively connect to all routers 851 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
740 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 852 c->conf->nodename);
741 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
742 (*i)->establish_connection ();
743} 853}
744 854
745void 855void
746connection::dump_status () 856connection::dump_status ()
747{ 857{
748 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 858 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
749 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 859 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
750 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 860 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
751 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 861 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
752 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 862 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
753 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
754 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
755} 863}
756 864
757void 865void
758vpn::dump_status () 866vpn::dump_status ()
759{ 867{
… …
764 872
765 slog (L_NOTICE, _("END status dump")); 873 slog (L_NOTICE, _("END status dump"));
766} 874}
767 875
768vpn::vpn (void) 876vpn::vpn (void)
877{
769: event (this, &vpn::event_cb) 878 event .set<vpn, &vpn::event_cb > (this);
770, udpv4_ev_watcher (this, &vpn::udpv4_ev) 879 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
771, ipv4_ev_watcher (this, &vpn::ipv4_ev) 880 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
772#if ENABLE_TCP 881#if ENABLE_TCP
773, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 882 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
774#endif 883#endif
775#if ENABLE_ICMP 884#if ENABLE_ICMP
776, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 885 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
777#endif 886#endif
778#if ENABLE_DNS 887#if ENABLE_DNS
779, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 888 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
780#endif 889#endif
781, tap_ev_watcher (this, &vpn::tap_ev) 890 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
782{
783} 891}
784 892
785vpn::~vpn () 893vpn::~vpn ()
786{ 894{
787} 895}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines