[ViewVC] Diff of: cvs/gvpe/src/vpn.C

Comparing gvpe/src/vpn.C (file contents):
Revision 1.46 by pcg, Thu Aug 7 17:30:28 2008 UTC vs.
Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC

…		…
1	/*	1	/*
2	vpn.C -- handle the protocol, encryption, handshaking etc.	2	vpn.C -- handle the protocol, encryption, handshaking etc.
3	Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de>	3	Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4		4
5	This file is part of GVPE.	5	This file is part of GVPE.
6		6
7	GVPE is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
8	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
9	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
10	(at your option) any later version.	10	option) any later version.
11		11
12	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
13	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15	GNU General Public License for more details.	15	Public License for more details.
16		16
17	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
18	along with gvpe; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
19	Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
20	*/	30	*/
21		31
22	#include "config.h"	32	#include "config.h"
23		33
24	#include <list>	34	#include <list>
110		120
111	return filename;	121	return filename;
112	}	122	}
113		123
114	int	124	int
		125	vpn::setup_socket (u8 prot, int family, int type, int proto)
		126	{
		127	int fd = socket (family, type, proto);
		128
		129	if (fd < 0)
		130	{
		131	slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
		132	return fd;
		133	}
		134
		135	fcntl (fd, F_SETFL, O_NONBLOCK);
		136	fcntl (fd, F_SETFD, FD_CLOEXEC);
		137
		138	#ifdef SO_MARK
		139	if (::conf.nfmark)
		140	setsockopt (ipv4_fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark);
		141	#endif
		142
		143	return fd;
		144	}
		145
		146	int
115	vpn::setup ()	147	vpn::setup ()
116	{	148	{
		149	int success = 0;
		150
117	ipv4_tos = -1;	151	ipv4_tos = -1;
118	ipv4_fd = -1;	152	ipv4_fd = -1;
119		153
120	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)	154	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
121	{	155	{
122	ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);	156	ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
123		157
124	if (ipv4_fd < 0)	158	if (ipv4_fd < 0)
125	return -1;	159	return -1;
126
127	fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
128	fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
129		160
130	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	161	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
131	// this I really consider a linux bug. I am neither connected	162	// this I really consider a linux bug. I am neither connected
132	// nor do I fragment myself. Linux still sets DF and doesn't	163	// nor do I fragment myself. Linux still sets DF and doesn't
133	// fragment for me sometimes.	164	// fragment for me sometimes.
…		…
139		170
140	sockinfo si (THISNODE, PROT_IPv4);	171	sockinfo si (THISNODE, PROT_IPv4);
141		172
142	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))	173	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
143	{	174	{
144	slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));	175	slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
145	exit (EXIT_FAILURE);	176	return -1;
146	}	177	}
147		178
148	ipv4_ev_watcher.start (ipv4_fd, EV_READ);	179	ipv4_ev_watcher.start (ipv4_fd, EV_READ);
		180	++success;
149	}	181	}
		182	else
		183	THISNODE->protocols &= ~PROT_IPv4;
150		184
151	udpv4_tos = -1;	185	udpv4_tos = -1;
152	udpv4_fd = -1;	186	udpv4_fd = -1;
153		187
154	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)	188	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
155	{	189	{
156	udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	190	udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
157		191
158	if (udpv4_fd < 0)	192	if (udpv4_fd < 0)
159	return -1;	193	return -1;
160
161	fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
162	fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
163		194
164	// standard daemon practise...	195	// standard daemon practise...
165	{	196	{
166	int oval = 1;	197	int oval = 1;
167	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	198	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
179		210
180	sockinfo si (THISNODE, PROT_UDPv4);	211	sockinfo si (THISNODE, PROT_UDPv4);
181		212
182	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))	213	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
183	{	214	{
184	slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));	215	slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
185	exit (EXIT_FAILURE);	216	return -1;
186	}	217	}
187		218
188	udpv4_ev_watcher.start (udpv4_fd, EV_READ);	219	udpv4_ev_watcher.start (udpv4_fd, EV_READ);
		220	++success;
189	}	221	}
		222	else
		223	THISNODE->protocols &= ~PROT_UDPv4;
190		224
191	icmpv4_tos = -1;	225	icmpv4_tos = -1;
192	icmpv4_fd = -1;	226	icmpv4_fd = -1;
193		227
194	#if ENABLE_ICMP	228	#if ENABLE_ICMP
195	if (THISNODE->protocols & PROT_ICMPv4)	229	if (THISNODE->protocols & PROT_ICMPv4)
196	{	230	{
197	icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);	231	icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
198		232
199	if (icmpv4_fd < 0)	233	if (icmpv4_fd < 0)
200	return -1;	234	return -1;
201
202	fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
203	fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
204		235
205	#ifdef ICMP_FILTER	236	#ifdef ICMP_FILTER
206	{	237	{
207	icmp_filter oval;	238	icmp_filter oval;
208	oval.data = 0xffffffff;	239	oval.data = 0xffffffff;
…		…
225		256
226	sockinfo si (THISNODE, PROT_ICMPv4);	257	sockinfo si (THISNODE, PROT_ICMPv4);
227		258
228	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))	259	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
229	{	260	{
230	slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno));	261	slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
231	exit (EXIT_FAILURE);	262	return -1;
232	}	263	}
233		264
234	icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);	265	icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
		266	++success;
235	}	267	}
236	#endif	268	#endif
237		269
238	tcpv4_fd = -1;	270	tcpv4_fd = -1;
239		271
240	#if ENABLE_TCP	272	#if ENABLE_TCP
241	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)	273	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
242	{	274	{
243	tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);	275	tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
244		276
245	if (tcpv4_fd < 0)	277	if (tcpv4_fd < 0)
246	return -1;	278	return -1;
247		279
248	fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
249	fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
250
251	// standard daemon practise...	280	// standard daemon practise...
252	{	281	{
253	int oval = 1;	282	int oval = 1;
254	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	283	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
255	}	284	}
256		285
257	sockinfo si (THISNODE, PROT_TCPv4);	286	sockinfo si (THISNODE, PROT_TCPv4);
258		287
259	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))	288	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
260	{	289	{
261	slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));	290	slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
262	exit (EXIT_FAILURE);	291	return -1;
263	}	292	}
264		293
265	if (listen (tcpv4_fd, 5))	294	if (listen (tcpv4_fd, 5))
266	{	295	{
267	slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));	296	slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
268	exit (EXIT_FAILURE);	297	return -1;
269	}	298	}
270		299
271	tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);	300	tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
		301	++success;
272	}	302	}
		303	else
		304	THISNODE->protocols &= ~PROT_TCPv4;
273	#endif	305	#endif
274		306
275	dnsv4_tos = -1;	307	dnsv4_tos = -1;
276	dnsv4_fd = -1;	308	dnsv4_fd = -1;
277		309
278	#if ENABLE_DNS	310	#if ENABLE_DNS
279	if (THISNODE->protocols & PROT_DNSv4)	311	if (THISNODE->protocols & PROT_DNSv4)
280	{	312	{
281	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	313	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
282		314
283	dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	315	dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
284		316
285	if (dnsv4_fd < 0)	317	if (dnsv4_fd < 0)
286	return -1;	318	return -1;
287
288	fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
289	fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
290		319
291	# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	320	# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
292	// this I really consider a linux bug. I am neither connected	321	// this I really consider a linux bug. I am neither connected
293	// nor do I fragment myself. Linux still sets DF and doesn't	322	// nor do I fragment myself. Linux still sets DF and doesn't
294	// fragment for me sometimes.	323	// fragment for me sometimes.
…		…
308	THISNODE->dns_hostname ? THISNODE->dns_port : 0,	337	THISNODE->dns_hostname ? THISNODE->dns_port : 0,
309	PROT_DNSv4);	338	PROT_DNSv4);
310		339
311	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))	340	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
312	{	341	{
313	slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno));	342	slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
314	exit (EXIT_FAILURE);	343	return -1;
315	}	344	}
316		345
317	dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);	346	dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
		347	++success;
318	}	348	}
319	#endif	349	#endif
320		350
321	/////////////////////////////////////////////////////////////////////////////	351	/////////////////////////////////////////////////////////////////////////////
		352
		353	if (!success)
		354	{
		355	slog (L_ERR, _("no protocols enabled."));
		356	return -1;
		357	}
322		358
323	reconnect_all ();	359	reconnect_all ();
324		360
325	/////////////////////////////////////////////////////////////////////////////	361	/////////////////////////////////////////////////////////////////////////////
326		362
327	tap = new tap_device ();	363	tap = new tap_device ();
328	if (!tap) //D this, of course, never catches	364	if (!tap) //D this, of course, never catches
329	{	365	{
330	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);	366	slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
331	exit (EXIT_FAILURE);	367	return -1;
332	}	368	}
333		369
334	fcntl (tap->fd, F_SETFD, FD_CLOEXEC);	370	fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
335		371
336	run_script_cb cb;	372	run_script_cb cb;
337	cb.set<vpn, &vpn::script_if_init> (this);	373	cb.set<vpn, &vpn::script_if_init> (this);
338		374
339	if (tap->if_up () &&	375	if (tap->if_up () &&
340	!run_script (cb, true))	376	!run_script (cb, true))
341	{	377	{
342	slog (L_ERR, _("interface initialization command '%s' failed, exiting."),	378	slog (L_ERR, _("interface initialization command '%s' failed."),
343	tap->if_up ());	379	tap->if_up ());
344	exit (EXIT_FAILURE);	380	return -1;
345	}	381	}
346		382
347	cb.set<vpn, &vpn::script_if_up> (this);	383	cb.set<vpn, &vpn::script_if_up> (this);
348	if (!run_script (cb, true))	384	if (!run_script (cb, true))
349	{	385	{
350	slog (L_ERR, _("if-up command execution failed, exiting."));	386	slog (L_ERR, _("if-up command execution failed."));
351	exit (EXIT_FAILURE);	387	return -1;
352	}	388	}
353		389
354	tap_ev_watcher.start (tap->fd, EV_READ);	390	tap_ev_watcher.start (tap->fd, EV_READ);
355		391
356	return 0;	392	return 0;
…		…
439	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	475	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
440	{	476	{
441	unsigned int src = pkt->src ();	477	unsigned int src = pkt->src ();
442	unsigned int dst = pkt->dst ();	478	unsigned int dst = pkt->dst ();
443		479
444	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),	480	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
445	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);	481	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
446		482
447	if (src == 0 \|\| src > conns.size ()	483	if (src == 0 \|\| src > conns.size ()
448	\|\| dst > conns.size ()	484	\|\| dst > conns.size ()
449	\|\| pkt->typ () >= vpn_packet::PT_MAX)	485	\|\| pkt->typ () >= vpn_packet::PT_MAX)
450	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	486	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
451	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	487	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
452	else if (dst > conns.size ())	488	else if (dst > conns.size ())
453	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	489	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
454	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	490	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
455	else	491	else
456	{	492	{
457	connection *c = conns[src - 1];	493	connection *c = conns[src - 1];
458		494
459	if (dst == 0)	495	if (dst == 0)
460	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"),	496	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
461	c->conf->nodename, (const char *)rsi);	497	c->conf->nodename, (const char *)rsi);
462	else if (dst != THISNODE->id)	498	else if (dst != THISNODE->id)
463	{	499	{
464	if (THISNODE->routerprio)	500	if (THISNODE->routerprio)
465	// the tos setting gets lost here. who cares.	501	// the tos setting gets lost here. who cares.
466	conns[dst - 1]->inject_vpn_packet (pkt);	502	conns[dst - 1]->inject_vpn_packet (pkt);
467	else	503	else
468	slog (L_WARN,	504	slog (L_WARN,
469	_("%s(%s): forwarding request (=> %s), but we are no router"),	505	_("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
470	c->conf->nodename, (const char *)rsi,	506	c->conf->nodename, (const char *)rsi,
471	conns[dst - 1]->conf->nodename);	507	conns[dst - 1]->conf->nodename);
472	}	508	}
473	else	509	else
474	c->recv_vpn_packet (pkt, rsi);	510	c->recv_vpn_packet (pkt, rsi);
…		…
497	#if ENABLE_DNS	533	#if ENABLE_DNS
498	case PROT_DNSv4:	534	case PROT_DNSv4:
499	return send_dnsv4_packet (pkt, si, tos);	535	return send_dnsv4_packet (pkt, si, tos);
500	#endif	536	#endif
501	default:	537	default:
502	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);	538	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
503	}	539	}
504		540
505	return false;	541	return false;
506	}	542	}
507		543
…		…
529	recv_vpn_packet (pkt, si);	565	recv_vpn_packet (pkt, si);
530	}	566	}
531	else	567	else
532	{	568	{
533	// probably ECONNRESET or somesuch	569	// probably ECONNRESET or somesuch
534	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	570	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
535	}	571	}
536		572
537	delete pkt;	573	delete pkt;
538	}	574	}
539	else	575	else
540	{	576	{
541	slog (L_ERR,	577	slog (L_ERR,
542	_("FATAL: unknown revents %08x in socket, terminating\n"),	578	_("FATAL: unknown revents %08x in socket, exiting.\n"),
543	revents);	579	revents);
544	exit (EXIT_FAILURE);	580	exit (EXIT_FAILURE);
545	}	581	}
546	}	582	}
547		583
…		…
577	}	613	}
578	}	614	}
579	else	615	else
580	{	616	{
581	// probably ECONNRESET or somesuch	617	// probably ECONNRESET or somesuch
582	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	618	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
583	}	619	}
584		620
585	delete pkt;	621	delete pkt;
586	}	622	}
587	else	623	else
588	{	624	{
589	slog (L_ERR,	625	slog (L_ERR,
590	_("FATAL: unknown revents %08x in socket, terminating\n"),	626	_("FATAL: unknown revents %08x in socket, exiting.\n"),
591	revents);	627	revents);
592	exit (EXIT_FAILURE);	628	exit (EXIT_FAILURE);
593	}	629	}
594	}	630	}
595	#endif	631	#endif
…		…
615	recv_vpn_packet (pkt, si);	651	recv_vpn_packet (pkt, si);
616	}	652	}
617	else	653	else
618	{	654	{
619	// probably ECONNRESET or somesuch	655	// probably ECONNRESET or somesuch
620	slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno));	656	slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
621	}	657	}
622		658
623	delete pkt;	659	delete pkt;
624	}	660	}
625	else	661	else
626	{	662	{
627	slog (L_ERR,	663	slog (L_ERR,
628	_("FATAL: unknown revents %08x in socket, terminating\n"),	664	_("FATAL: unknown revents %08x in socket, exiting.\n"),
629	revents);	665	revents);
630	exit (EXIT_FAILURE);	666	exit (EXIT_FAILURE);
631	}	667	}
632	}	668	}
633		669
…		…
682	{	718	{
683	slog (L_INFO, _("preparing shutdown..."));	719	slog (L_INFO, _("preparing shutdown..."));
684		720
685	shutdown_all ();	721	shutdown_all ();
686	remove_pid (conf.pidfilename);	722	remove_pid (conf.pidfilename);
687	slog (L_INFO, _("terminating"));	723	slog (L_INFO, _("exiting."));
688	exit (EXIT_SUCCESS);	724	exit (EXIT_SUCCESS);
689	}	725	}
690		726
691	if (events & EVENT_RECONNECT)	727	if (events & EVENT_RECONNECT)
692	{	728	{
693	slog (L_INFO, _("forced reconnect"));	729	slog (L_INFO, _("forced reconnect."));
694		730
695	reconnect_all ();	731	reconnect_all ();
696	}	732	}
697		733
698	events = 0;	734	events = 0;
…		…
714		750
715	conns.clear ();	751	conns.clear ();
716		752
717	connection_init ();	753	connection_init ();
718		754
719	for (configuration::node_vector::iterator i = conf.nodes.begin ();	755	for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
720	i != conf.nodes.end (); ++i)	756	conns.push_back (new connection (this, *i));
721	{	757
722	connection conn = new connection (this, i);	758	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
723	conns.push_back (conn);
724	conn->establish_connection ();	759	(*c)->establish_connection ();
725	}
726	}	760	}
727		761
728	connection *vpn::find_router ()	762	bool vpn::can_direct (conf_node src, conf_node dst) const
729	{	763	{
730	u32 prio = 1;	764	return src != dst
		765	&& src->may_direct (dst)
		766	&& dst->may_direct (src)
		767	&& (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
		768	\|\| (src->protocols & dst->connectable_protocols ()));
		769	}
		770
		771	// only works for indirect and routed connections: find a router
		772	// from THISNODE to dst
		773	connection vpn::find_router_for (const connection dst)
		774	{
731	connection *router = 0;	775	connection *router = 0;
732		776
		777	// first try to find a router with a direct connection, route there
		778	// regardless of any other considerations.
		779	{
		780	u32 prio = 1;
		781
		782	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		783	{
		784	connection c = i;
		785
		786	if (c->conf->routerprio > prio
		787	&& c->conf != THISNODE
		788	&& can_direct (c->conf, dst->conf)
		789	&& c->ictx && c->octx)
		790	{
		791	prio = c->conf->routerprio;
		792	router = c;
		793	}
		794	}
		795	}
		796
		797	if (router)
		798	return router;
		799
		800	// second try find the router with the highest priority, higher than ours
		801	{
		802	u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
		803
		804	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		805	{
		806	connection c = i;
		807
		808	if (c->conf->routerprio > prio
		809	&& c != dst
		810	&& c->conf != THISNODE
		811	&& c->ictx && c->octx)
		812	{
		813	prio = c->conf->routerprio;
		814	router = c;
		815	}
		816	}
		817	}
		818
		819	return router;
		820	}
		821
		822	void vpn::connection_established (connection *c)
		823	{
733	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	824	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
734	{	825	{
735	connection c = i;	826	connection o = i;
736		827
737	if (c->conf->routerprio > prio	828	if (!o->is_direct
738	&& c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use	829	&& o->si.valid ()
739	&& c->ictx && c->octx	830	&& c->si != o->si
740	&& c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode	831	&& c == find_router_for (o))
741	{
742	prio = c->conf->routerprio;
743	router = c;
744	}	832	{
		833	slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
		834	o->conf->nodename, c->conf->nodename);
		835	o->rekey ();
		836	}
745	}	837	}
746
747	return router;
748	}	838	}
749		839
750	void vpn::send_connect_request (int id)	840	void vpn::send_connect_request (connection *c)
751	{	841	{
752	connection *c = find_router ();	842	connection *r = find_router_for (c);
753		843
754	if (c)	844	if (r)
		845	{
		846	slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
		847	c->conf->nodename, r->conf->nodename);
755	c->send_connect_request (id);	848	r->send_connect_request (c->conf->id);
		849	}
756	else	850	else
757	// no router found, aggressively connect to all routers	851	slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
758	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	852	c->conf->nodename);
759	if ((i)->conf->routerprio && (i)->conf != THISNODE)
760	(*i)->establish_connection ();
761	}	853	}
762		854
763	void	855	void
764	connection::dump_status ()	856	connection::dump_status ()
765	{	857	{
766	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);	858	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
767	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),	859	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
768	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);	860	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
769	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),	861	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
770	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);	862	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
771	slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
772	(long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
773	}	863	}
774		864
775	void	865	void
776	vpn::dump_status ()	866	vpn::dump_status ()
777	{	867	{

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/vpn.C (file contents): Revision 1.46 by pcg, Thu Aug 7 17:30:28 2008 UTC vs. Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC

Diff Legend

Comparing gvpe/src/vpn.C (file contents):
Revision 1.46 by pcg, Thu Aug 7 17:30:28 2008 UTC vs.
Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC