ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.40 by pcg, Sat Dec 1 23:35:31 2007 UTC vs.
Revision 1.70 by root, Thu Oct 6 03:03:09 2022 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
46 57
58using namespace std;
59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
48 61
49///////////////////////////////////////////////////////////////////////////// 62/////////////////////////////////////////////////////////////////////////////
63
64// hopefully temporary workaround for rare buffer full conditions
65// if it happens, usually instantly retrying or retrying ~5ms later
66// is good enough with current network technologies/kernels
67
68static ssize_t
69xsendto (int fd, const void *buf, size_t len, int flags,
70 const struct sockaddr *sa, socklen_t salen)
71{
72 ssize_t res;
73
74 for (int retry = 0; retry <= 13; ++retry) // ~100ms
75 {
76 res = sendto (fd, buf, len, flags, sa, salen);
77
78 if (res >= 0 || errno != ENOBUFS)
79 break;
80
81 struct timespec ts = { 0, 1000 * retry };
82 nanosleep (&ts, 0);
83 }
84
85 return res;
86}
87
88/////////////////////////////////////////////////////////////////////////////
89
90static void inline
91set_tos (int fd, int &tos_prev, int tos)
92{
93#if defined(SOL_IP) && defined(IP_TOS)
94 if (tos_prev == tos)
95 return;
96
97 tos_prev = tos;
98 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
99#endif
100}
50 101
51void 102void
52vpn::script_init_env () 103vpn::script_init_env ()
53{ 104{
54 // the tunnel device mtu should be the physical mtu - overhead 105 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 106 // the tricky part is rounding to the cipher key blocksize
56 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 107 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
57 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 108 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
58 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 109 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
59 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 110 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
60 111
61 char *env; 112 char *env;
62 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 113 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
63 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 114 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
… …
75 snprintf (ext, 16, "_%d", (*c)->conf->id); 126 snprintf (ext, 16, "_%d", (*c)->conf->id);
76 (*c)->script_init_env (ext); 127 (*c)->script_init_env (ext);
77 } 128 }
78} 129}
79 130
131inline const char *
80const char *vpn::script_if_init () 132vpn::script_if_init ()
81{ 133{
82 script_init_env (); 134 script_init_env ();
83 135
84 return tap->if_up (); 136 return tap->if_up ();
85} 137}
86 138
139inline const char *
87const char *vpn::script_if_up () 140vpn::script_if_up ()
88{ 141{
89 script_init_env (); 142 script_init_env ();
90 143
91 char *filename; 144 return conf.config_filename (::conf.script_if_up, "if-up");
92 asprintf (&filename, 145}
93 "%s/%s",
94 confbase,
95 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
96 146
97 return filename; 147int
148vpn::setup_socket (u8 prot, int family, int type, int proto)
149{
150 int fd = socket (family, type, proto);
151
152 if (fd < 0)
153 {
154 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
155 return fd;
156 }
157
158 fcntl (fd, F_SETFL, O_NONBLOCK);
159 fcntl (fd, F_SETFD, FD_CLOEXEC);
160
161#ifdef SO_MARK
162 if (::conf.nfmark)
163 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
164 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
165#endif
166
167 return fd;
98} 168}
99 169
100int 170int
101vpn::setup () 171vpn::setup ()
102{ 172{
173 int success = 0;
174
175 ipv4_tos = -1;
103 ipv4_fd = -1; 176 ipv4_fd = -1;
104 177
105 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 178 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106 { 179 {
107 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 180 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
108 181
109 if (ipv4_fd < 0) 182 if (ipv4_fd < 0)
110 return -1; 183 return -1;
111
112 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
113 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
114 184
115#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 185#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
116 // this I really consider a linux bug. I am neither connected 186 // this I really consider a linux bug. I am neither connected
117 // nor do I fragment myself. Linux still sets DF and doesn't 187 // nor do I fragment myself. Linux still sets DF and doesn't
118 // fragment for me sometimes. 188 // fragment for me sometimes.
… …
124 194
125 sockinfo si (THISNODE, PROT_IPv4); 195 sockinfo si (THISNODE, PROT_IPv4);
126 196
127 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
128 { 198 {
129 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
130 exit (EXIT_FAILURE); 200 return -1;
131 } 201 }
132 202
133 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 203 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
204 ++success;
134 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_IPv4;
135 208
209 udpv4_tos = -1;
136 udpv4_fd = -1; 210 udpv4_fd = -1;
137 211
138 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 212 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
139 { 213 {
140 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 214 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
141 215
142 if (udpv4_fd < 0) 216 if (udpv4_fd < 0)
143 return -1; 217 return -1;
144
145 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
146 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
147 218
148 // standard daemon practise... 219 // standard daemon practise...
149 { 220 {
150 int oval = 1; 221 int oval = 1;
151 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 222 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
163 234
164 sockinfo si (THISNODE, PROT_UDPv4); 235 sockinfo si (THISNODE, PROT_UDPv4);
165 236
166 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 237 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
167 { 238 {
168 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 239 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
169 exit (EXIT_FAILURE); 240 return -1;
170 } 241 }
171 242
172 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 243 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
244 ++success;
173 } 245 }
246 else
247 THISNODE->protocols &= ~PROT_UDPv4;
174 248
249 icmpv4_tos = -1;
175 icmpv4_fd = -1; 250 icmpv4_fd = -1;
176 251
177#if ENABLE_ICMP 252#if ENABLE_ICMP
178 if (THISNODE->protocols & PROT_ICMPv4) 253 if (THISNODE->protocols & PROT_ICMPv4)
179 { 254 {
180 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 255 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
181 256
182 if (icmpv4_fd < 0) 257 if (icmpv4_fd < 0)
183 return -1; 258 return -1;
184 259
185 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
186 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
187
188#ifdef ICMP_FILTER 260#ifdef ICMP_FILTER
189 { 261 {
190 icmp_filter oval; 262 icmp_filter oval;
191 oval.data = 0xffffffff; 263 oval.data = 0;
192 if (::conf.icmp_type < 32) 264 if (::conf.icmp_type < 32)
193 oval.data &= ~(1 << ::conf.icmp_type); 265 oval.data |= 1 << ::conf.icmp_type;
266 oval.data = ~oval.data;
194 267
195 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval); 268 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
196 } 269 }
197#endif 270#endif
198 271
… …
208 281
209 sockinfo si (THISNODE, PROT_ICMPv4); 282 sockinfo si (THISNODE, PROT_ICMPv4);
210 283
211 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 284 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
212 { 285 {
213 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 286 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
214 exit (EXIT_FAILURE); 287 return -1;
215 } 288 }
216 289
217 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 290 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
291 ++success;
218 } 292 }
219#endif 293#endif
220 294
221 tcpv4_fd = -1; 295 tcpv4_fd = -1;
222 296
223#if ENABLE_TCP 297#if ENABLE_TCP
224 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 298 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
225 { 299 {
226 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 300 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
227 301
228 if (tcpv4_fd < 0) 302 if (tcpv4_fd < 0)
229 return -1; 303 return -1;
230 304
231 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
232 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
233
234 // standard daemon practise... 305 // standard daemon practise...
235 { 306 {
236 int oval = 1; 307 int oval = 1;
237 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 308 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
238 } 309 }
239 310
240 sockinfo si (THISNODE, PROT_TCPv4); 311 sockinfo si (THISNODE, PROT_TCPv4);
241 312
242 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 313 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
243 { 314 {
244 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 315 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
245 exit (EXIT_FAILURE); 316 return -1;
246 } 317 }
247 318
248 if (listen (tcpv4_fd, 5)) 319 if (listen (tcpv4_fd, 5))
249 { 320 {
250 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 321 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
251 exit (EXIT_FAILURE); 322 return -1;
252 } 323 }
253 324
254 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 325 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
326 ++success;
255 } 327 }
328 else
329 THISNODE->protocols &= ~PROT_TCPv4;
256#endif 330#endif
331
332 dnsv4_tos = -1;
333 dnsv4_fd = -1;
257 334
258#if ENABLE_DNS 335#if ENABLE_DNS
259 if (THISNODE->protocols & PROT_DNSv4) 336 if (THISNODE->protocols & PROT_DNSv4)
260 { 337 {
261 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 338 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
262 339
263 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 340 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
264 341
265 if (dnsv4_fd < 0) 342 if (dnsv4_fd < 0)
266 return -1; 343 return -1;
267
268 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
269 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
270 344
271# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 345# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
272 // this I really consider a linux bug. I am neither connected 346 // this I really consider a linux bug. I am neither connected
273 // nor do I fragment myself. Linux still sets DF and doesn't 347 // nor do I fragment myself. Linux still sets DF and doesn't
274 // fragment for me sometimes. 348 // fragment for me sometimes.
… …
288 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 362 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
289 PROT_DNSv4); 363 PROT_DNSv4);
290 364
291 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 365 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
292 { 366 {
293 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 367 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
294 exit (EXIT_FAILURE); 368 return -1;
295 } 369 }
296 370
297 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 371 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
372 ++success;
298 } 373 }
299#endif 374#endif
300 375
301 ///////////////////////////////////////////////////////////////////////////// 376 /////////////////////////////////////////////////////////////////////////////
377
378 if (!success)
379 {
380 slog (L_ERR, _("no protocols enabled."));
381 return -1;
382 }
302 383
303 reconnect_all (); 384 reconnect_all ();
304 385
305 ///////////////////////////////////////////////////////////////////////////// 386 /////////////////////////////////////////////////////////////////////////////
306 387
307 tap = new tap_device (); 388 tap = new tap_device ();
308 if (!tap) //D this, of course, never catches 389 if (!tap) //D this, of course, never catches
309 { 390 {
310 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 391 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
311 exit (EXIT_FAILURE); 392 return -1;
312 } 393 }
313 394
314 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 395 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
315 396
397 run_script_cb cb;
398 cb.set<vpn, &vpn::script_if_init> (this);
399
316 if (tap->if_up () && 400 if (tap->if_up () &&
317 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 401 !run_script (cb, true))
318 { 402 {
319 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 403 slog (L_ERR, _("interface initialization command '%s' failed."),
320 tap->if_up ()); 404 tap->if_up ());
321 exit (EXIT_FAILURE); 405 return -1;
322 }
323
324 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
325 { 406 }
407
408 cb.set<vpn, &vpn::script_if_up> (this);
409 if (!run_script (cb, true))
410 {
326 slog (L_ERR, _("if-up command execution failed, exiting.")); 411 slog (L_ERR, _("if-up command execution failed."));
327 exit (EXIT_FAILURE); 412 return -1;
328 } 413 }
329 414
330 tap_ev_watcher.start (tap->fd, EV_READ); 415 tap_ev_watcher.start (tap->fd, EV_READ);
331 416
332 return 0; 417 return 0;
418}
419
420bool
421vpn::drop_privileges ()
422{
423 if (::conf.change_root)
424 {
425 if (!strcmp (::conf.change_root, "/"))
426 {
427 char dir [L_tmpnam];
428 if (!tmpnam (dir))
429 {
430 slog (L_CRIT, _("unable to create anonymous root path."));
431 return false;
432 }
433
434 if (mkdir (dir, 0700))
435 {
436 slog (L_CRIT, _("unable to create anonymous root directory."));
437 return false;
438 }
439
440 if (chdir (dir))
441 {
442 slog (L_CRIT, _("unable to change to anonymous root directory."));
443 return false;
444 }
445
446 if (rmdir (dir))
447 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
448 }
449 else
450 {
451 if (chdir (::conf.change_root))
452 {
453 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
454 return false;
455 }
456 }
457
458 if (chroot ("."))
459 {
460 slog (L_CRIT, _("unable to set new root directory."));
461 return false;
462 }
463
464 if (chdir ("/"))
465 {
466 slog (L_CRIT, _("unable to set cwd to new root directory."));
467 return false;
468 }
469 }
470
471 if (::conf.change_gid)
472 if (setgid (::conf.change_gid))
473 {
474 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
475 return false;
476 }
477
478 if (::conf.change_uid)
479 if (setuid (::conf.change_uid))
480 {
481 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
482 return false;
483 }
484
485 return true;
333} 486}
334 487
335bool 488bool
336vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 489vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
337{ 490{
338#if defined(SOL_IP) && defined(IP_TOS) 491 set_tos (ipv4_fd, ipv4_tos, tos);
339 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
340#endif
341 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 492 xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
342 493
343 return true; 494 return true;
344} 495}
345 496
346static u16 497static u16
… …
368 519
369#if ENABLE_ICMP 520#if ENABLE_ICMP
370bool 521bool
371vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 522vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
372{ 523{
373#if defined(SOL_IP) && defined(IP_TOS)
374 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
375#endif
376
377 pkt->unshift_hdr (4); 524 pkt->unshift_hdr (4);
378 525
379 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 526 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
380 hdr->type = ::conf.icmp_type; 527 hdr->type = ::conf.icmp_type;
381 hdr->code = 255; 528 hdr->code = 255;
382 hdr->checksum = 0; 529 hdr->checksum = 0;
383 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 530 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
384 531
532 set_tos (icmpv4_fd, icmpv4_tos, tos);
385 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 533 xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
386 534
387 return true; 535 return true;
388} 536}
389#endif 537#endif
390 538
391bool 539bool
392vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 540vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
393{ 541{
394#if defined(SOL_IP) && defined(IP_TOS) 542 set_tos (udpv4_fd, udpv4_tos, tos);
395 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
396#endif
397 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 543 xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
398 544
399 return true; 545 return true;
400} 546}
401 547
402void 548void
… …
412 { 558 {
413 // broadcast, this is ugly, but due to the security policy 559 // broadcast, this is ugly, but due to the security policy
414 // we have to connect to all hosts... 560 // we have to connect to all hosts...
415 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 561 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
416 if ((*c)->conf != THISNODE) 562 if ((*c)->conf != THISNODE)
417 (*c)->inject_data_packet (pkt, true); 563 (*c)->inject_data_packet (pkt);
418 } 564 }
419} 565}
420 566
421void 567void
422vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 568vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
423{ 569{
424 unsigned int src = pkt->src (); 570 unsigned int src = pkt->src ();
425 unsigned int dst = pkt->dst (); 571 unsigned int dst = pkt->dst ();
426 572
427 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 573 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
428 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 574 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
429 575
430 if (src == 0 || src > conns.size () 576 if (src == 0 || src > conns.size ()
431 || dst > conns.size () 577 || dst > conns.size ()
432 || pkt->typ () >= vpn_packet::PT_MAX) 578 || pkt->typ () >= vpn_packet::PT_MAX)
433 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 579 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
434 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
435 else if (dst > conns.size ())
436 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
437 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 580 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
438 else 581 else
439 { 582 {
440 connection *c = conns[src - 1]; 583 connection *c = conns[src - 1];
441 584
442 if (dst == 0) 585 if (dst == 0)
443 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 586 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
444 c->conf->nodename, (const char *)rsi); 587 c->conf->nodename, (const char *)rsi);
445 else if (dst != THISNODE->id) 588 else if (dst != THISNODE->id)
446 { 589 {
447 if (THISNODE->routerprio) 590 if (THISNODE->routerprio)
448 // the tos setting gets lost here. who cares. 591 // the tos setting gets lost here. who cares.
449 conns[dst - 1]->inject_vpn_packet (pkt); 592 conns[dst - 1]->inject_vpn_packet (pkt);
450 else 593 else
451 slog (L_WARN, 594 slog (L_WARN,
452 _("%s(%s): forwarding request (=> %s), but we are no router"), 595 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
453 c->conf->nodename, (const char *)rsi, 596 c->conf->nodename, (const char *)rsi,
454 conns[dst - 1]->conf->nodename); 597 conns[dst - 1]->conf->nodename);
455 } 598 }
456 else 599 else
457 c->recv_vpn_packet (pkt, rsi); 600 c->recv_vpn_packet (pkt, rsi);
… …
462vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 605vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
463{ 606{
464 switch (si.prot) 607 switch (si.prot)
465 { 608 {
466 case PROT_IPv4: 609 case PROT_IPv4:
467 return send_ipv4_packet (pkt, si, tos); 610 return send_ipv4_packet (pkt, si, tos);
611
468 case PROT_UDPv4: 612 case PROT_UDPv4:
469 return send_udpv4_packet (pkt, si, tos); 613 return send_udpv4_packet (pkt, si, tos);
614
470#if ENABLE_TCP 615#if ENABLE_TCP
471 case PROT_TCPv4: 616 case PROT_TCPv4:
472 return send_tcpv4_packet (pkt, si, tos); 617 return send_tcpv4_packet (pkt, si, tos);
473#endif 618#endif
474#if ENABLE_ICMP 619#if ENABLE_ICMP
475 case PROT_ICMPv4: 620 case PROT_ICMPv4:
476 return send_icmpv4_packet (pkt, si, tos); 621 return send_icmpv4_packet (pkt, si, tos);
477#endif 622#endif
478#if ENABLE_DNS 623#if ENABLE_DNS
479 case PROT_DNSv4: 624 case PROT_DNSv4:
480 return send_dnsv4_packet (pkt, si, tos); 625 return send_dnsv4_packet (pkt, si, tos);
481#endif 626#endif
482
483 default: 627 default:
484 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 628 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
485 } 629 }
486 630
487 return false; 631 return false;
488} 632}
489 633
490void 634inline void
491vpn::ipv4_ev (ev::io &w, int revents) 635vpn::ipv4_ev (ev::io &w, int revents)
492{ 636{
493 if (revents & EV_READ) 637 if (revents & EV_READ)
494 { 638 {
495 vpn_packet *pkt = new vpn_packet; 639 vpn_packet *pkt = new vpn_packet;
… …
504 if (len > 0) 648 if (len > 0)
505 { 649 {
506 pkt->len = len; 650 pkt->len = len;
507 651
508 // raw sockets deliver the ipv4 header, but don't expect it on sends 652 // raw sockets deliver the ipv4 header, but don't expect it on sends
509 pkt->skip_hdr (IP_OVERHEAD); 653 pkt->skip_hdr (pkt->ipv4_hdr_len ());
510 654
511 recv_vpn_packet (pkt, si); 655 recv_vpn_packet (pkt, si);
512 } 656 }
513 else 657 else
514 { 658 {
515 // probably ECONNRESET or somesuch 659 // probably ECONNRESET or somesuch
516 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 660 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
517 } 661 }
518 662
519 delete pkt; 663 delete pkt;
520 } 664 }
521 else 665 else
522 { 666 {
523 slog (L_ERR, 667 slog (L_ERR,
524 _("FATAL: unknown revents %08x in socket, terminating\n"), 668 _("FATAL: unknown revents %08x in socket, exiting.\n"),
525 revents); 669 revents);
526 exit (EXIT_FAILURE); 670 exit (EXIT_FAILURE);
527 } 671 }
528} 672}
529 673
530#if ENABLE_ICMP 674#if ENABLE_ICMP
531void 675inline void
532vpn::icmpv4_ev (ev::io &w, int revents) 676vpn::icmpv4_ev (ev::io &w, int revents)
533{ 677{
534 if (revents & EV_READ) 678 if (revents & EV_READ)
535 { 679 {
536 vpn_packet *pkt = new vpn_packet; 680 vpn_packet *pkt = new vpn_packet;
… …
551 if (hdr->type == ::conf.icmp_type 695 if (hdr->type == ::conf.icmp_type
552 && hdr->code == 255) 696 && hdr->code == 255)
553 { 697 {
554 // raw sockets deliver the ipv4, but don't expect it on sends 698 // raw sockets deliver the ipv4, but don't expect it on sends
555 // this is slow, but... 699 // this is slow, but...
556 pkt->skip_hdr (ICMP_OVERHEAD); 700 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
557 701
558 recv_vpn_packet (pkt, si); 702 recv_vpn_packet (pkt, si);
559 } 703 }
560 } 704 }
561 else 705 else
562 { 706 {
563 // probably ECONNRESET or somesuch 707 // probably ECONNRESET or somesuch
564 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 708 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
565 } 709 }
566 710
567 delete pkt; 711 delete pkt;
568 } 712 }
569 else 713 else
570 { 714 {
571 slog (L_ERR, 715 slog (L_ERR,
572 _("FATAL: unknown revents %08x in socket, terminating\n"), 716 _("FATAL: unknown revents %08x in socket, exiting.\n"),
573 revents); 717 revents);
574 exit (EXIT_FAILURE); 718 exit (EXIT_FAILURE);
575 } 719 }
576} 720}
577#endif 721#endif
578 722
579void 723inline void
580vpn::udpv4_ev (ev::io &w, int revents) 724vpn::udpv4_ev (ev::io &w, int revents)
581{ 725{
582 if (revents & EV_READ) 726 if (revents & EV_READ)
583 { 727 {
584 vpn_packet *pkt = new vpn_packet; 728 vpn_packet *pkt = new vpn_packet;
… …
597 recv_vpn_packet (pkt, si); 741 recv_vpn_packet (pkt, si);
598 } 742 }
599 else 743 else
600 { 744 {
601 // probably ECONNRESET or somesuch 745 // probably ECONNRESET or somesuch
602 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 746 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
603 } 747 }
604 748
605 delete pkt; 749 delete pkt;
606 } 750 }
607 else 751 else
608 { 752 {
609 slog (L_ERR, 753 slog (L_ERR,
610 _("FATAL: unknown revents %08x in socket, terminating\n"), 754 _("FATAL: unknown revents %08x in socket, exiting.\n"),
611 revents); 755 revents);
612 exit (EXIT_FAILURE); 756 exit (EXIT_FAILURE);
613 } 757 }
614} 758}
615 759
616void 760inline void
617vpn::tap_ev (ev::io &w, int revents) 761vpn::tap_ev (ev::io &w, int revents)
618{ 762{
619 if (revents & EV_READ) 763 if (revents & EV_READ)
620 { 764 {
621 /* process data */ 765 /* process data */
… …
653 } 797 }
654 else 798 else
655 abort (); 799 abort ();
656} 800}
657 801
658void 802inline void
659vpn::event_cb (ev::timer &w, int) 803vpn::event_cb (ev::timer &w, int)
660{ 804{
661 if (events) 805 if (events)
662 { 806 {
663 if (events & EVENT_SHUTDOWN) 807 if (events & EVENT_SHUTDOWN)
664 { 808 {
665 slog (L_INFO, _("preparing shutdown...")); 809 slog (L_INFO, _("preparing shutdown..."));
666 810
667 shutdown_all (); 811 shutdown_all ();
668 remove_pid (conf.pidfilename); 812 remove_pid (conf.pidfilename);
669 slog (L_INFO, _("terminating")); 813 slog (L_INFO, _("exiting."));
670 exit (EXIT_SUCCESS); 814 exit (EXIT_SUCCESS);
671 } 815 }
672 816
673 if (events & EVENT_RECONNECT) 817 if (events & EVENT_RECONNECT)
674 { 818 {
675 slog (L_INFO, _("forced reconnect")); 819 slog (L_INFO, _("forced reconnect."));
676 820
677 reconnect_all (); 821 reconnect_all ();
678 } 822 }
679 823
680 events = 0; 824 events = 0;
… …
696 840
697 conns.clear (); 841 conns.clear ();
698 842
699 connection_init (); 843 connection_init ();
700 844
701 for (configuration::node_vector::iterator i = conf.nodes.begin (); 845 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
702 i != conf.nodes.end (); ++i) 846 conns.push_back (new connection (this, *i));
703 { 847
704 connection *conn = new connection (this, *i); 848 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
705 conns.push_back (conn);
706 conn->establish_connection (); 849 (*c)->establish_connection ();
707 }
708} 850}
709 851
710connection *vpn::find_router () 852bool
853vpn::can_direct (conf_node *src, conf_node *dst) const
711{ 854{
712 u32 prio = 1; 855 return src != dst
856 && src->may_direct (dst)
857 && dst->may_direct (src)
858 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
859 || (src->protocols & dst->connectable_protocols ()));
860}
861
862// only works for indirect and routed connections: find a router
863// from THISNODE to dst
864connection *
865vpn::find_router_for (const connection *dst)
866{
713 connection *router = 0; 867 connection *router = 0;
714 868
869 // first try to find a router with a direct connection, route there
870 // regardless of any other considerations.
871 {
872 u32 prio = 1;
873
874 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
875 {
876 connection *c = *i;
877
878 if (c->conf->routerprio > prio
879 && c->conf != THISNODE
880 && can_direct (c->conf, dst->conf)
881 && c->ictx && c->octx)
882 {
883 prio = c->conf->routerprio;
884 router = c;
885 }
886 }
887 }
888
889 if (router)
890 return router;
891
892 // second try find the router with the highest priority, higher than ours
893 {
894 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
895
896 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
897 {
898 connection *c = *i;
899
900 if (c->conf->routerprio > prio
901 && c != dst
902 && c->conf != THISNODE
903 && c->ictx && c->octx)
904 {
905 prio = c->conf->routerprio;
906 router = c;
907 }
908 }
909 }
910
911 return router;
912}
913
914void
915vpn::connection_established (connection *c)
916{
715 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 917 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
716 { 918 {
717 connection *c = *i; 919 connection *o = *i;
718 920
719 if (c->conf->routerprio > prio 921 if (o->si.valid ()
720 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 922 && c->si != o->si
721 && c->ictx && c->octx 923 && c == find_router_for (o)
722 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 924 && !can_direct (THISNODE, o->conf))
723 {
724 prio = c->conf->routerprio;
725 router = c;
726 } 925 {
926 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
927 o->conf->nodename, c->conf->nodename);
928 o->rekey ();
929 }
727 } 930 }
728
729 return router;
730} 931}
731 932
933void
732void vpn::send_connect_request (int id) 934vpn::send_connect_request (connection *c)
733{ 935{
734 connection *c = find_router (); 936 connection *r = find_router_for (c);
735 937
736 if (c) 938 if (r)
939 {
940 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
941 c->conf->nodename, r->conf->nodename);
737 c->send_connect_request (id); 942 r->send_connect_request (c->conf->id);
943 }
738 else 944 else
739 // no router found, aggressively connect to all routers 945 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
740 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 946 c->conf->nodename);
741 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
742 (*i)->establish_connection ();
743} 947}
744 948
745void 949void
746connection::dump_status () 950connection::dump_status ()
747{ 951{
748 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 952 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
749 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 953 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
750 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 954 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
751 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 955 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
752 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 956 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
753 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
754 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
755} 957}
756 958
757void 959void
758vpn::dump_status () 960vpn::dump_status ()
759{ 961{
… …
764 966
765 slog (L_NOTICE, _("END status dump")); 967 slog (L_NOTICE, _("END status dump"));
766} 968}
767 969
768vpn::vpn (void) 970vpn::vpn (void)
971{
769: event (this, &vpn::event_cb) 972 event .set<vpn, &vpn::event_cb > (this);
770, udpv4_ev_watcher (this, &vpn::udpv4_ev) 973 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
771, ipv4_ev_watcher (this, &vpn::ipv4_ev) 974 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
772#if ENABLE_TCP 975#if ENABLE_TCP
773, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 976 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
774#endif 977#endif
775#if ENABLE_ICMP 978#if ENABLE_ICMP
776, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 979 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
777#endif 980#endif
778#if ENABLE_DNS 981#if ENABLE_DNS
779, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 982 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
780#endif 983#endif
781, tap_ev_watcher (this, &vpn::tap_ev) 984 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
782{
783} 985}
784 986
785vpn::~vpn () 987vpn::~vpn ()
786{ 988{
787} 989}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines