ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.43 by pcg, Tue Dec 4 15:01:12 2007 UTC vs.
Revision 1.71 by root, Thu Oct 6 03:25:54 2022 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
46 57
58using namespace std;
59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
61
62/////////////////////////////////////////////////////////////////////////////
63
64// hopefully temporary workaround for rare buffer full conditions
65// if it happens, usually instantly retrying or retrying ~5ms later
66// is good enough with current network technologies/kernels
67
68static ssize_t
69xsendto (int fd, const void *buf, size_t len, int flags,
70 const struct sockaddr *sa, socklen_t salen)
71{
72 ssize_t res;
73
74 for (int retry = 0; retry <= 13; ++retry) // ~100ms
75 {
76 res = sendto (fd, buf, len, flags, sa, salen);
77
78 if (res >= 0 || errno != ENOBUFS)
79 break;
80
81 struct timespec ts = { 0, 1000 * retry };
82 nanosleep (&ts, 0);
83 }
84
85 return res;
86}
48 87
49///////////////////////////////////////////////////////////////////////////// 88/////////////////////////////////////////////////////////////////////////////
50 89
51static void inline 90static void inline
52set_tos (int fd, int &tos_prev, int tos) 91set_tos (int fd, int &tos_prev, int tos)
… …
65{ 104{
66 // the tunnel device mtu should be the physical mtu - overhead 105 // the tunnel device mtu should be the physical mtu - overhead
67 // the tricky part is rounding to the cipher key blocksize 106 // the tricky part is rounding to the cipher key blocksize
68 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 107 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
69 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 108 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
70 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 109 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
71 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 110 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
72 111
73 char *env; 112 char *env;
74 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 113 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
75 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 114 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
… …
87 snprintf (ext, 16, "_%d", (*c)->conf->id); 126 snprintf (ext, 16, "_%d", (*c)->conf->id);
88 (*c)->script_init_env (ext); 127 (*c)->script_init_env (ext);
89 } 128 }
90} 129}
91 130
131inline const char *
92const char *vpn::script_if_init () 132vpn::script_if_init ()
93{ 133{
94 script_init_env (); 134 script_init_env ();
95 135
96 return tap->if_up (); 136 return tap->if_up ();
97} 137}
98 138
139inline const char *
99const char *vpn::script_if_up () 140vpn::script_if_up ()
100{ 141{
101 script_init_env (); 142 script_init_env ();
102 143
103 char *filename; 144 return conf.config_filename (::conf.script_if_up, "if-up");
104 asprintf (&filename, 145}
105 "%s/%s",
106 confbase,
107 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
108 146
109 return filename; 147int
148vpn::setup_socket (u8 prot, int family, int type, int proto)
149{
150 int fd = socket (family, type, proto);
151
152 if (fd < 0)
153 {
154 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
155 return fd;
156 }
157
158 fcntl (fd, F_SETFL, O_NONBLOCK);
159 fcntl (fd, F_SETFD, FD_CLOEXEC);
160
161#ifdef SO_MARK
162 if (::conf.nfmark)
163 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
164 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
165#endif
166
167 return fd;
110} 168}
111 169
112int 170int
113vpn::setup () 171vpn::setup ()
114{ 172{
173 int success = 0;
174
115 ipv4_tos = -1; 175 ipv4_tos = -1;
116 ipv4_fd = -1; 176 ipv4_fd = -1;
117 177
118 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 178 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
119 { 179 {
120 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 180 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
121 181
122 if (ipv4_fd < 0) 182 if (ipv4_fd < 0)
123 return -1; 183 return -1;
124
125 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
126 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
127 184
128#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 185#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
129 // this I really consider a linux bug. I am neither connected 186 // this I really consider a linux bug. I am neither connected
130 // nor do I fragment myself. Linux still sets DF and doesn't 187 // nor do I fragment myself. Linux still sets DF and doesn't
131 // fragment for me sometimes. 188 // fragment for me sometimes.
… …
137 194
138 sockinfo si (THISNODE, PROT_IPv4); 195 sockinfo si (THISNODE, PROT_IPv4);
139 196
140 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
141 { 198 {
142 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 200 return -1;
144 } 201 }
145 202
146 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 203 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
204 ++success;
147 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_IPv4;
148 208
149 udpv4_tos = -1; 209 udpv4_tos = -1;
150 udpv4_fd = -1; 210 udpv4_fd = -1;
151 211
152 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 212 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
153 { 213 {
154 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 214 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
155 215
156 if (udpv4_fd < 0) 216 if (udpv4_fd < 0)
157 return -1; 217 return -1;
158
159 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
160 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
161 218
162 // standard daemon practise... 219 // standard daemon practise...
163 { 220 {
164 int oval = 1; 221 int oval = 1;
165 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 222 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
177 234
178 sockinfo si (THISNODE, PROT_UDPv4); 235 sockinfo si (THISNODE, PROT_UDPv4);
179 236
180 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 237 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
181 { 238 {
182 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 239 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
183 exit (EXIT_FAILURE); 240 return -1;
184 } 241 }
185 242
186 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 243 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
244 ++success;
187 } 245 }
246 else
247 THISNODE->protocols &= ~PROT_UDPv4;
188 248
189 icmpv4_tos = -1; 249 icmpv4_tos = -1;
190 icmpv4_fd = -1; 250 icmpv4_fd = -1;
191 251
192#if ENABLE_ICMP 252#if ENABLE_ICMP
193 if (THISNODE->protocols & PROT_ICMPv4) 253 if (THISNODE->protocols & PROT_ICMPv4)
194 { 254 {
195 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 255 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
196 256
197 if (icmpv4_fd < 0) 257 if (icmpv4_fd < 0)
198 return -1; 258 return -1;
199 259
200 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK); 260// no clue where trhis is actually defined
201 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC); 261#if !defined(ICMP_FILTER) && defined(__linux)
262 #define ICMP_FILTER 1
263#endif
202 264
203#ifdef ICMP_FILTER 265#ifdef ICMP_FILTER
204 { 266 {
205 icmp_filter oval; 267 uint32_t oval;
206 oval.data = 0xffffffff; 268 oval = 0;
207 if (::conf.icmp_type < 32) 269 if (::conf.icmp_type < 32)
208 oval.data &= ~(1 << ::conf.icmp_type); 270 oval |= 1 << ::conf.icmp_type;
271 oval = ~oval;
209 272
210 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval); 273 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
211 } 274 }
212#endif 275#endif
213 276
… …
223 286
224 sockinfo si (THISNODE, PROT_ICMPv4); 287 sockinfo si (THISNODE, PROT_ICMPv4);
225 288
226 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
227 { 290 {
228 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
229 exit (EXIT_FAILURE); 292 return -1;
230 } 293 }
231 294
232 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 295 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
296 ++success;
233 } 297 }
234#endif 298#endif
235 299
236 tcpv4_fd = -1; 300 tcpv4_fd = -1;
237 301
238#if ENABLE_TCP 302#if ENABLE_TCP
239 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 303 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
240 { 304 {
241 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 305 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
242 306
243 if (tcpv4_fd < 0) 307 if (tcpv4_fd < 0)
244 return -1; 308 return -1;
245 309
246 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
247 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
248
249 // standard daemon practise... 310 // standard daemon practise...
250 { 311 {
251 int oval = 1; 312 int oval = 1;
252 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 313 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
253 } 314 }
254 315
255 sockinfo si (THISNODE, PROT_TCPv4); 316 sockinfo si (THISNODE, PROT_TCPv4);
256 317
257 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 318 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
258 { 319 {
259 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 320 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
260 exit (EXIT_FAILURE); 321 return -1;
261 } 322 }
262 323
263 if (listen (tcpv4_fd, 5)) 324 if (listen (tcpv4_fd, 5))
264 { 325 {
265 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 326 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
266 exit (EXIT_FAILURE); 327 return -1;
267 } 328 }
268 329
269 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 330 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
331 ++success;
270 } 332 }
333 else
334 THISNODE->protocols &= ~PROT_TCPv4;
271#endif 335#endif
272 336
273 dnsv4_tos = -1; 337 dnsv4_tos = -1;
274 dnsv4_fd = -1; 338 dnsv4_fd = -1;
275 339
276#if ENABLE_DNS 340#if ENABLE_DNS
277 if (THISNODE->protocols & PROT_DNSv4) 341 if (THISNODE->protocols & PROT_DNSv4)
278 { 342 {
279 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 343 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
280 344
281 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 345 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
282 346
283 if (dnsv4_fd < 0) 347 if (dnsv4_fd < 0)
284 return -1; 348 return -1;
285
286 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
287 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
288 349
289# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 350# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
290 // this I really consider a linux bug. I am neither connected 351 // this I really consider a linux bug. I am neither connected
291 // nor do I fragment myself. Linux still sets DF and doesn't 352 // nor do I fragment myself. Linux still sets DF and doesn't
292 // fragment for me sometimes. 353 // fragment for me sometimes.
… …
306 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 367 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
307 PROT_DNSv4); 368 PROT_DNSv4);
308 369
309 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 370 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
310 { 371 {
311 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 372 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
312 exit (EXIT_FAILURE); 373 return -1;
313 } 374 }
314 375
315 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 376 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
377 ++success;
316 } 378 }
317#endif 379#endif
318 380
319 ///////////////////////////////////////////////////////////////////////////// 381 /////////////////////////////////////////////////////////////////////////////
382
383 if (!success)
384 {
385 slog (L_ERR, _("no protocols enabled."));
386 return -1;
387 }
320 388
321 reconnect_all (); 389 reconnect_all ();
322 390
323 ///////////////////////////////////////////////////////////////////////////// 391 /////////////////////////////////////////////////////////////////////////////
324 392
325 tap = new tap_device (); 393 tap = new tap_device ();
326 if (!tap) //D this, of course, never catches 394 if (!tap) //D this, of course, never catches
327 { 395 {
328 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 396 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
329 exit (EXIT_FAILURE); 397 return -1;
330 } 398 }
331 399
332 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 400 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
333 401
334 run_script_cb cb; 402 run_script_cb cb;
403 cb.set<vpn, &vpn::script_if_init> (this);
335 404
336 callback_set (cb, this, vpn, script_if_init);
337 if (tap->if_up () && 405 if (tap->if_up () &&
338 !run_script (cb, true)) 406 !run_script (cb, true))
339 { 407 {
340 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 408 slog (L_ERR, _("interface initialization command '%s' failed."),
341 tap->if_up ()); 409 tap->if_up ());
342 exit (EXIT_FAILURE); 410 return -1;
343 } 411 }
344 412
345 callback_set (cb, this, vpn, script_if_up); 413 cb.set<vpn, &vpn::script_if_up> (this);
346 if (!run_script (cb, true)) 414 if (!run_script (cb, true))
347 { 415 {
348 slog (L_ERR, _("if-up command execution failed, exiting.")); 416 slog (L_ERR, _("if-up command execution failed."));
349 exit (EXIT_FAILURE); 417 return -1;
350 } 418 }
351 419
352 tap_ev_watcher.start (tap->fd, EV_READ); 420 tap_ev_watcher.start (tap->fd, EV_READ);
353 421
354 return 0; 422 return 0;
423}
424
425bool
426vpn::drop_privileges ()
427{
428 if (::conf.change_root)
429 {
430 if (!strcmp (::conf.change_root, "/"))
431 {
432 char dir [L_tmpnam];
433 if (!tmpnam (dir))
434 {
435 slog (L_CRIT, _("unable to create anonymous root path."));
436 return false;
437 }
438
439 if (mkdir (dir, 0700))
440 {
441 slog (L_CRIT, _("unable to create anonymous root directory."));
442 return false;
443 }
444
445 if (chdir (dir))
446 {
447 slog (L_CRIT, _("unable to change to anonymous root directory."));
448 return false;
449 }
450
451 if (rmdir (dir))
452 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
453 }
454 else
455 {
456 if (chdir (::conf.change_root))
457 {
458 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
459 return false;
460 }
461 }
462
463 if (chroot ("."))
464 {
465 slog (L_CRIT, _("unable to set new root directory."));
466 return false;
467 }
468
469 if (chdir ("/"))
470 {
471 slog (L_CRIT, _("unable to set cwd to new root directory."));
472 return false;
473 }
474 }
475
476 if (::conf.change_gid)
477 if (setgid (::conf.change_gid))
478 {
479 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
480 return false;
481 }
482
483 if (::conf.change_uid)
484 if (setuid (::conf.change_uid))
485 {
486 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
487 return false;
488 }
489
490 return true;
355} 491}
356 492
357bool 493bool
358vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 494vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
359{ 495{
360 set_tos (ipv4_fd, ipv4_tos, tos); 496 set_tos (ipv4_fd, ipv4_tos, tos);
361 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 497 xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
362 498
363 return true; 499 return true;
364} 500}
365 501
366static u16 502static u16
… …
397 hdr->code = 255; 533 hdr->code = 255;
398 hdr->checksum = 0; 534 hdr->checksum = 0;
399 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 535 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
400 536
401 set_tos (icmpv4_fd, icmpv4_tos, tos); 537 set_tos (icmpv4_fd, icmpv4_tos, tos);
402 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 538 xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
403 539
404 return true; 540 return true;
405} 541}
406#endif 542#endif
407 543
408bool 544bool
409vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 545vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
410{ 546{
411 set_tos (udpv4_fd, udpv4_tos, tos); 547 set_tos (udpv4_fd, udpv4_tos, tos);
412 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 548 xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
413 549
414 return true; 550 return true;
415} 551}
416 552
417void 553void
… …
427 { 563 {
428 // broadcast, this is ugly, but due to the security policy 564 // broadcast, this is ugly, but due to the security policy
429 // we have to connect to all hosts... 565 // we have to connect to all hosts...
430 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 566 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
431 if ((*c)->conf != THISNODE) 567 if ((*c)->conf != THISNODE)
432 (*c)->inject_data_packet (pkt, true); 568 (*c)->inject_data_packet (pkt);
433 } 569 }
434} 570}
435 571
436void 572void
437vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 573vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
438{ 574{
439 unsigned int src = pkt->src (); 575 unsigned int src = pkt->src ();
440 unsigned int dst = pkt->dst (); 576 unsigned int dst = pkt->dst ();
441 577
442 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 578 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
443 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 579 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
444 580
445 if (src == 0 || src > conns.size () 581 if (src == 0 || src > conns.size ()
446 || dst > conns.size () 582 || dst > conns.size ()
447 || pkt->typ () >= vpn_packet::PT_MAX) 583 || pkt->typ () >= vpn_packet::PT_MAX)
448 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 584 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
449 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
450 else if (dst > conns.size ())
451 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
452 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 585 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
453 else 586 else
454 { 587 {
455 connection *c = conns[src - 1]; 588 connection *c = conns[src - 1];
456 589
457 if (dst == 0) 590 if (dst == 0)
458 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 591 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
459 c->conf->nodename, (const char *)rsi); 592 c->conf->nodename, (const char *)rsi);
460 else if (dst != THISNODE->id) 593 else if (dst != THISNODE->id)
461 { 594 {
462 if (THISNODE->routerprio) 595 if (THISNODE->routerprio)
463 // the tos setting gets lost here. who cares. 596 // the tos setting gets lost here. who cares.
464 conns[dst - 1]->inject_vpn_packet (pkt); 597 conns[dst - 1]->inject_vpn_packet (pkt);
465 else 598 else
466 slog (L_WARN, 599 slog (L_WARN,
467 _("%s(%s): forwarding request (=> %s), but we are no router"), 600 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
468 c->conf->nodename, (const char *)rsi, 601 c->conf->nodename, (const char *)rsi,
469 conns[dst - 1]->conf->nodename); 602 conns[dst - 1]->conf->nodename);
470 } 603 }
471 else 604 else
472 c->recv_vpn_packet (pkt, rsi); 605 c->recv_vpn_packet (pkt, rsi);
… …
477vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 610vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
478{ 611{
479 switch (si.prot) 612 switch (si.prot)
480 { 613 {
481 case PROT_IPv4: 614 case PROT_IPv4:
482 return send_ipv4_packet (pkt, si, tos); 615 return send_ipv4_packet (pkt, si, tos);
483 616
484 case PROT_UDPv4: 617 case PROT_UDPv4:
485 return send_udpv4_packet (pkt, si, tos); 618 return send_udpv4_packet (pkt, si, tos);
486 619
487#if ENABLE_TCP 620#if ENABLE_TCP
488 case PROT_TCPv4: 621 case PROT_TCPv4:
489 return send_tcpv4_packet (pkt, si, tos); 622 return send_tcpv4_packet (pkt, si, tos);
490#endif 623#endif
491#if ENABLE_ICMP 624#if ENABLE_ICMP
492 case PROT_ICMPv4: 625 case PROT_ICMPv4:
493 return send_icmpv4_packet (pkt, si, tos); 626 return send_icmpv4_packet (pkt, si, tos);
494#endif 627#endif
495#if ENABLE_DNS 628#if ENABLE_DNS
496 case PROT_DNSv4: 629 case PROT_DNSv4:
497 return send_dnsv4_packet (pkt, si, tos); 630 return send_dnsv4_packet (pkt, si, tos);
498#endif 631#endif
499 default: 632 default:
500 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 633 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
501 } 634 }
502 635
503 return false; 636 return false;
504} 637}
505 638
506void 639inline void
507vpn::ipv4_ev (ev::io &w, int revents) 640vpn::ipv4_ev (ev::io &w, int revents)
508{ 641{
509 if (revents & EV_READ) 642 if (revents & EV_READ)
510 { 643 {
511 vpn_packet *pkt = new vpn_packet; 644 vpn_packet *pkt = new vpn_packet;
… …
520 if (len > 0) 653 if (len > 0)
521 { 654 {
522 pkt->len = len; 655 pkt->len = len;
523 656
524 // raw sockets deliver the ipv4 header, but don't expect it on sends 657 // raw sockets deliver the ipv4 header, but don't expect it on sends
525 pkt->skip_hdr (IP_OVERHEAD); 658 pkt->skip_hdr (pkt->ipv4_hdr_len ());
526 659
527 recv_vpn_packet (pkt, si); 660 recv_vpn_packet (pkt, si);
528 } 661 }
529 else 662 else
530 { 663 {
531 // probably ECONNRESET or somesuch 664 // probably ECONNRESET or somesuch
532 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 665 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
533 } 666 }
534 667
535 delete pkt; 668 delete pkt;
536 } 669 }
537 else 670 else
538 { 671 {
539 slog (L_ERR, 672 slog (L_ERR,
540 _("FATAL: unknown revents %08x in socket, terminating\n"), 673 _("FATAL: unknown revents %08x in socket, exiting.\n"),
541 revents); 674 revents);
542 exit (EXIT_FAILURE); 675 exit (EXIT_FAILURE);
543 } 676 }
544} 677}
545 678
546#if ENABLE_ICMP 679#if ENABLE_ICMP
547void 680inline void
548vpn::icmpv4_ev (ev::io &w, int revents) 681vpn::icmpv4_ev (ev::io &w, int revents)
549{ 682{
550 if (revents & EV_READ) 683 if (revents & EV_READ)
551 { 684 {
552 vpn_packet *pkt = new vpn_packet; 685 vpn_packet *pkt = new vpn_packet;
… …
567 if (hdr->type == ::conf.icmp_type 700 if (hdr->type == ::conf.icmp_type
568 && hdr->code == 255) 701 && hdr->code == 255)
569 { 702 {
570 // raw sockets deliver the ipv4, but don't expect it on sends 703 // raw sockets deliver the ipv4, but don't expect it on sends
571 // this is slow, but... 704 // this is slow, but...
572 pkt->skip_hdr (ICMP_OVERHEAD); 705 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
573 706
574 recv_vpn_packet (pkt, si); 707 recv_vpn_packet (pkt, si);
575 } 708 }
576 } 709 }
577 else 710 else
578 { 711 {
579 // probably ECONNRESET or somesuch 712 // probably ECONNRESET or somesuch
580 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 713 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
581 } 714 }
582 715
583 delete pkt; 716 delete pkt;
584 } 717 }
585 else 718 else
586 { 719 {
587 slog (L_ERR, 720 slog (L_ERR,
588 _("FATAL: unknown revents %08x in socket, terminating\n"), 721 _("FATAL: unknown revents %08x in socket, exiting.\n"),
589 revents); 722 revents);
590 exit (EXIT_FAILURE); 723 exit (EXIT_FAILURE);
591 } 724 }
592} 725}
593#endif 726#endif
594 727
595void 728inline void
596vpn::udpv4_ev (ev::io &w, int revents) 729vpn::udpv4_ev (ev::io &w, int revents)
597{ 730{
598 if (revents & EV_READ) 731 if (revents & EV_READ)
599 { 732 {
600 vpn_packet *pkt = new vpn_packet; 733 vpn_packet *pkt = new vpn_packet;
… …
613 recv_vpn_packet (pkt, si); 746 recv_vpn_packet (pkt, si);
614 } 747 }
615 else 748 else
616 { 749 {
617 // probably ECONNRESET or somesuch 750 // probably ECONNRESET or somesuch
618 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 751 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
619 } 752 }
620 753
621 delete pkt; 754 delete pkt;
622 } 755 }
623 else 756 else
624 { 757 {
625 slog (L_ERR, 758 slog (L_ERR,
626 _("FATAL: unknown revents %08x in socket, terminating\n"), 759 _("FATAL: unknown revents %08x in socket, exiting.\n"),
627 revents); 760 revents);
628 exit (EXIT_FAILURE); 761 exit (EXIT_FAILURE);
629 } 762 }
630} 763}
631 764
632void 765inline void
633vpn::tap_ev (ev::io &w, int revents) 766vpn::tap_ev (ev::io &w, int revents)
634{ 767{
635 if (revents & EV_READ) 768 if (revents & EV_READ)
636 { 769 {
637 /* process data */ 770 /* process data */
… …
669 } 802 }
670 else 803 else
671 abort (); 804 abort ();
672} 805}
673 806
674void 807inline void
675vpn::event_cb (ev::timer &w, int) 808vpn::event_cb (ev::timer &w, int)
676{ 809{
677 if (events) 810 if (events)
678 { 811 {
679 if (events & EVENT_SHUTDOWN) 812 if (events & EVENT_SHUTDOWN)
680 { 813 {
681 slog (L_INFO, _("preparing shutdown...")); 814 slog (L_INFO, _("preparing shutdown..."));
682 815
683 shutdown_all (); 816 shutdown_all ();
684 remove_pid (conf.pidfilename); 817 remove_pid (conf.pidfilename);
685 slog (L_INFO, _("terminating")); 818 slog (L_INFO, _("exiting."));
686 exit (EXIT_SUCCESS); 819 exit (EXIT_SUCCESS);
687 } 820 }
688 821
689 if (events & EVENT_RECONNECT) 822 if (events & EVENT_RECONNECT)
690 { 823 {
691 slog (L_INFO, _("forced reconnect")); 824 slog (L_INFO, _("forced reconnect."));
692 825
693 reconnect_all (); 826 reconnect_all ();
694 } 827 }
695 828
696 events = 0; 829 events = 0;
… …
712 845
713 conns.clear (); 846 conns.clear ();
714 847
715 connection_init (); 848 connection_init ();
716 849
717 for (configuration::node_vector::iterator i = conf.nodes.begin (); 850 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
718 i != conf.nodes.end (); ++i) 851 conns.push_back (new connection (this, *i));
719 { 852
720 connection *conn = new connection (this, *i); 853 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
721 conns.push_back (conn);
722 conn->establish_connection (); 854 (*c)->establish_connection ();
723 }
724} 855}
725 856
726connection *vpn::find_router () 857bool
858vpn::can_direct (conf_node *src, conf_node *dst) const
727{ 859{
728 u32 prio = 1; 860 return src != dst
861 && src->may_direct (dst)
862 && dst->may_direct (src)
863 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
864 || (src->protocols & dst->connectable_protocols ()));
865}
866
867// only works for indirect and routed connections: find a router
868// from THISNODE to dst
869connection *
870vpn::find_router_for (const connection *dst)
871{
729 connection *router = 0; 872 connection *router = 0;
730 873
874 // first try to find a router with a direct connection, route there
875 // regardless of any other considerations.
876 {
877 u32 prio = 1;
878
879 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
880 {
881 connection *c = *i;
882
883 if (c->conf->routerprio > prio
884 && c->conf != THISNODE
885 && can_direct (c->conf, dst->conf)
886 && c->ictx && c->octx)
887 {
888 prio = c->conf->routerprio;
889 router = c;
890 }
891 }
892 }
893
894 if (router)
895 return router;
896
897 // second try find the router with the highest priority, higher than ours
898 {
899 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
900
901 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
902 {
903 connection *c = *i;
904
905 if (c->conf->routerprio > prio
906 && c != dst
907 && c->conf != THISNODE
908 && c->ictx && c->octx)
909 {
910 prio = c->conf->routerprio;
911 router = c;
912 }
913 }
914 }
915
916 return router;
917}
918
919void
920vpn::connection_established (connection *c)
921{
731 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 922 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
732 { 923 {
733 connection *c = *i; 924 connection *o = *i;
734 925
735 if (c->conf->routerprio > prio 926 if (o->si.valid ()
736 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 927 && c->si != o->si
737 && c->ictx && c->octx 928 && c == find_router_for (o)
738 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 929 && !can_direct (THISNODE, o->conf))
739 {
740 prio = c->conf->routerprio;
741 router = c;
742 } 930 {
931 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
932 o->conf->nodename, c->conf->nodename);
933 o->rekey ();
934 }
743 } 935 }
744
745 return router;
746} 936}
747 937
938void
748void vpn::send_connect_request (int id) 939vpn::send_connect_request (connection *c)
749{ 940{
750 connection *c = find_router (); 941 connection *r = find_router_for (c);
751 942
752 if (c) 943 if (r)
944 {
945 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
946 c->conf->nodename, r->conf->nodename);
753 c->send_connect_request (id); 947 r->send_connect_request (c->conf->id);
948 }
754 else 949 else
755 // no router found, aggressively connect to all routers 950 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
756 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 951 c->conf->nodename);
757 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
758 (*i)->establish_connection ();
759} 952}
760 953
761void 954void
762connection::dump_status () 955connection::dump_status ()
763{ 956{
764 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 957 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
765 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 958 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
766 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 959 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
767 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 960 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
768 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 961 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
769 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
770 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
771} 962}
772 963
773void 964void
774vpn::dump_status () 965vpn::dump_status ()
775{ 966{
… …
780 971
781 slog (L_NOTICE, _("END status dump")); 972 slog (L_NOTICE, _("END status dump"));
782} 973}
783 974
784vpn::vpn (void) 975vpn::vpn (void)
976{
785: event (this, &vpn::event_cb) 977 event .set<vpn, &vpn::event_cb > (this);
786, udpv4_ev_watcher (this, &vpn::udpv4_ev) 978 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
787, ipv4_ev_watcher (this, &vpn::ipv4_ev) 979 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
788#if ENABLE_TCP 980#if ENABLE_TCP
789, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 981 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
790#endif 982#endif
791#if ENABLE_ICMP 983#if ENABLE_ICMP
792, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 984 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
793#endif 985#endif
794#if ENABLE_DNS 986#if ENABLE_DNS
795, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 987 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
796#endif 988#endif
797, tap_ev_watcher (this, &vpn::tap_ev) 989 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
798{
799} 990}
800 991
801vpn::~vpn () 992vpn::~vpn ()
802{ 993{
803} 994}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines