ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.46 by pcg, Thu Aug 7 17:30:28 2008 UTC vs.
Revision 1.59 by root, Fri Sep 16 17:59:46 2011 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
110 120
111 return filename; 121 return filename;
112} 122}
113 123
114int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
145}
146
147int
115vpn::setup () 148vpn::setup ()
116{ 149{
150 int success = 0;
151
117 ipv4_tos = -1; 152 ipv4_tos = -1;
118 ipv4_fd = -1; 153 ipv4_fd = -1;
119 154
120 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 155 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
121 { 156 {
122 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 157 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
123 158
124 if (ipv4_fd < 0) 159 if (ipv4_fd < 0)
125 return -1; 160 return -1;
126
127 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
128 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
129 161
130#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 162#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
131 // this I really consider a linux bug. I am neither connected 163 // this I really consider a linux bug. I am neither connected
132 // nor do I fragment myself. Linux still sets DF and doesn't 164 // nor do I fragment myself. Linux still sets DF and doesn't
133 // fragment for me sometimes. 165 // fragment for me sometimes.
… …
139 171
140 sockinfo si (THISNODE, PROT_IPv4); 172 sockinfo si (THISNODE, PROT_IPv4);
141 173
142 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 174 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
143 { 175 {
144 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 176 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
145 exit (EXIT_FAILURE); 177 return -1;
146 } 178 }
147 179
148 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 180 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
181 ++success;
149 } 182 }
183 else
184 THISNODE->protocols &= ~PROT_IPv4;
150 185
151 udpv4_tos = -1; 186 udpv4_tos = -1;
152 udpv4_fd = -1; 187 udpv4_fd = -1;
153 188
154 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 189 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
155 { 190 {
156 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 191 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
157 192
158 if (udpv4_fd < 0) 193 if (udpv4_fd < 0)
159 return -1; 194 return -1;
160
161 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
162 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
163 195
164 // standard daemon practise... 196 // standard daemon practise...
165 { 197 {
166 int oval = 1; 198 int oval = 1;
167 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 199 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
179 211
180 sockinfo si (THISNODE, PROT_UDPv4); 212 sockinfo si (THISNODE, PROT_UDPv4);
181 213
182 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 214 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
183 { 215 {
184 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 216 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
185 exit (EXIT_FAILURE); 217 return -1;
186 } 218 }
187 219
188 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 220 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
221 ++success;
189 } 222 }
223 else
224 THISNODE->protocols &= ~PROT_UDPv4;
190 225
191 icmpv4_tos = -1; 226 icmpv4_tos = -1;
192 icmpv4_fd = -1; 227 icmpv4_fd = -1;
193 228
194#if ENABLE_ICMP 229#if ENABLE_ICMP
195 if (THISNODE->protocols & PROT_ICMPv4) 230 if (THISNODE->protocols & PROT_ICMPv4)
196 { 231 {
197 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 232 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
198 233
199 if (icmpv4_fd < 0) 234 if (icmpv4_fd < 0)
200 return -1; 235 return -1;
201
202 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
203 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
204 236
205#ifdef ICMP_FILTER 237#ifdef ICMP_FILTER
206 { 238 {
207 icmp_filter oval; 239 icmp_filter oval;
208 oval.data = 0xffffffff; 240 oval.data = 0xffffffff;
… …
225 257
226 sockinfo si (THISNODE, PROT_ICMPv4); 258 sockinfo si (THISNODE, PROT_ICMPv4);
227 259
228 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 260 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
229 { 261 {
230 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 262 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
231 exit (EXIT_FAILURE); 263 return -1;
232 } 264 }
233 265
234 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 266 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
267 ++success;
235 } 268 }
236#endif 269#endif
237 270
238 tcpv4_fd = -1; 271 tcpv4_fd = -1;
239 272
240#if ENABLE_TCP 273#if ENABLE_TCP
241 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 274 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
242 { 275 {
243 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 276 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
244 277
245 if (tcpv4_fd < 0) 278 if (tcpv4_fd < 0)
246 return -1; 279 return -1;
247
248 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
249 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
250 280
251 // standard daemon practise... 281 // standard daemon practise...
252 { 282 {
253 int oval = 1; 283 int oval = 1;
254 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 284 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
256 286
257 sockinfo si (THISNODE, PROT_TCPv4); 287 sockinfo si (THISNODE, PROT_TCPv4);
258 288
259 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
260 { 290 {
261 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
262 exit (EXIT_FAILURE); 292 return -1;
263 } 293 }
264 294
265 if (listen (tcpv4_fd, 5)) 295 if (listen (tcpv4_fd, 5))
266 { 296 {
267 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 297 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
268 exit (EXIT_FAILURE); 298 return -1;
269 } 299 }
270 300
271 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 301 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
302 ++success;
272 } 303 }
304 else
305 THISNODE->protocols &= ~PROT_TCPv4;
273#endif 306#endif
274 307
275 dnsv4_tos = -1; 308 dnsv4_tos = -1;
276 dnsv4_fd = -1; 309 dnsv4_fd = -1;
277 310
278#if ENABLE_DNS 311#if ENABLE_DNS
279 if (THISNODE->protocols & PROT_DNSv4) 312 if (THISNODE->protocols & PROT_DNSv4)
280 { 313 {
281 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 314 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
282 315
283 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 316 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
284 317
285 if (dnsv4_fd < 0) 318 if (dnsv4_fd < 0)
286 return -1; 319 return -1;
287
288 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
289 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
290 320
291# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 321# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
292 // this I really consider a linux bug. I am neither connected 322 // this I really consider a linux bug. I am neither connected
293 // nor do I fragment myself. Linux still sets DF and doesn't 323 // nor do I fragment myself. Linux still sets DF and doesn't
294 // fragment for me sometimes. 324 // fragment for me sometimes.
… …
308 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 338 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
309 PROT_DNSv4); 339 PROT_DNSv4);
310 340
311 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 341 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
312 { 342 {
313 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 343 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
314 exit (EXIT_FAILURE); 344 return -1;
315 } 345 }
316 346
317 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 347 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
348 ++success;
318 } 349 }
319#endif 350#endif
320 351
321 ///////////////////////////////////////////////////////////////////////////// 352 /////////////////////////////////////////////////////////////////////////////
353
354 if (!success)
355 {
356 slog (L_ERR, _("no protocols enabled."));
357 return -1;
358 }
322 359
323 reconnect_all (); 360 reconnect_all ();
324 361
325 ///////////////////////////////////////////////////////////////////////////// 362 /////////////////////////////////////////////////////////////////////////////
326 363
327 tap = new tap_device (); 364 tap = new tap_device ();
328 if (!tap) //D this, of course, never catches 365 if (!tap) //D this, of course, never catches
329 { 366 {
330 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 367 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
331 exit (EXIT_FAILURE); 368 return -1;
332 } 369 }
333 370
334 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 371 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
335 372
336 run_script_cb cb; 373 run_script_cb cb;
337 cb.set<vpn, &vpn::script_if_init> (this); 374 cb.set<vpn, &vpn::script_if_init> (this);
338 375
339 if (tap->if_up () && 376 if (tap->if_up () &&
340 !run_script (cb, true)) 377 !run_script (cb, true))
341 { 378 {
342 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 379 slog (L_ERR, _("interface initialization command '%s' failed."),
343 tap->if_up ()); 380 tap->if_up ());
344 exit (EXIT_FAILURE); 381 return -1;
345 } 382 }
346 383
347 cb.set<vpn, &vpn::script_if_up> (this); 384 cb.set<vpn, &vpn::script_if_up> (this);
348 if (!run_script (cb, true)) 385 if (!run_script (cb, true))
349 { 386 {
350 slog (L_ERR, _("if-up command execution failed, exiting.")); 387 slog (L_ERR, _("if-up command execution failed."));
351 exit (EXIT_FAILURE); 388 return -1;
352 } 389 }
353 390
354 tap_ev_watcher.start (tap->fd, EV_READ); 391 tap_ev_watcher.start (tap->fd, EV_READ);
355 392
356 return 0; 393 return 0;
… …
439vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 476vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
440{ 477{
441 unsigned int src = pkt->src (); 478 unsigned int src = pkt->src ();
442 unsigned int dst = pkt->dst (); 479 unsigned int dst = pkt->dst ();
443 480
444 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 481 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 482 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
446 483
447 if (src == 0 || src > conns.size () 484 if (src == 0 || src > conns.size ()
448 || dst > conns.size () 485 || dst > conns.size ()
449 || pkt->typ () >= vpn_packet::PT_MAX) 486 || pkt->typ () >= vpn_packet::PT_MAX)
450 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 487 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
451 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 488 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
452 else if (dst > conns.size ()) 489 else if (dst > conns.size ())
453 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 490 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
454 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 491 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
455 else 492 else
456 { 493 {
457 connection *c = conns[src - 1]; 494 connection *c = conns[src - 1];
458 495
459 if (dst == 0) 496 if (dst == 0)
460 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 497 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
461 c->conf->nodename, (const char *)rsi); 498 c->conf->nodename, (const char *)rsi);
462 else if (dst != THISNODE->id) 499 else if (dst != THISNODE->id)
463 { 500 {
464 if (THISNODE->routerprio) 501 if (THISNODE->routerprio)
465 // the tos setting gets lost here. who cares. 502 // the tos setting gets lost here. who cares.
466 conns[dst - 1]->inject_vpn_packet (pkt); 503 conns[dst - 1]->inject_vpn_packet (pkt);
467 else 504 else
468 slog (L_WARN, 505 slog (L_WARN,
469 _("%s(%s): forwarding request (=> %s), but we are no router"), 506 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
470 c->conf->nodename, (const char *)rsi, 507 c->conf->nodename, (const char *)rsi,
471 conns[dst - 1]->conf->nodename); 508 conns[dst - 1]->conf->nodename);
472 } 509 }
473 else 510 else
474 c->recv_vpn_packet (pkt, rsi); 511 c->recv_vpn_packet (pkt, rsi);
… …
484 return send_ipv4_packet (pkt, si, tos); 521 return send_ipv4_packet (pkt, si, tos);
485 522
486 case PROT_UDPv4: 523 case PROT_UDPv4:
487 return send_udpv4_packet (pkt, si, tos); 524 return send_udpv4_packet (pkt, si, tos);
488 525
489#if ENABLE_TCP 526#if ENABLE_TCP
490 case PROT_TCPv4: 527 case PROT_TCPv4:
491 return send_tcpv4_packet (pkt, si, tos); 528 return send_tcpv4_packet (pkt, si, tos);
492#endif 529#endif
493#if ENABLE_ICMP 530#if ENABLE_ICMP
494 case PROT_ICMPv4: 531 case PROT_ICMPv4:
… …
497#if ENABLE_DNS 534#if ENABLE_DNS
498 case PROT_DNSv4: 535 case PROT_DNSv4:
499 return send_dnsv4_packet (pkt, si, tos); 536 return send_dnsv4_packet (pkt, si, tos);
500#endif 537#endif
501 default: 538 default:
502 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 539 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
503 } 540 }
504 541
505 return false; 542 return false;
506} 543}
507 544
… …
522 if (len > 0) 559 if (len > 0)
523 { 560 {
524 pkt->len = len; 561 pkt->len = len;
525 562
526 // raw sockets deliver the ipv4 header, but don't expect it on sends 563 // raw sockets deliver the ipv4 header, but don't expect it on sends
527 pkt->skip_hdr (IP_OVERHEAD); 564 pkt->skip_ipv4_hdr ();
528 565
529 recv_vpn_packet (pkt, si); 566 recv_vpn_packet (pkt, si);
530 } 567 }
531 else 568 else
532 { 569 {
533 // probably ECONNRESET or somesuch 570 // probably ECONNRESET or somesuch
534 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 571 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
535 } 572 }
536 573
537 delete pkt; 574 delete pkt;
538 } 575 }
539 else 576 else
540 { 577 {
541 slog (L_ERR, 578 slog (L_ERR,
542 _("FATAL: unknown revents %08x in socket, terminating\n"), 579 _("FATAL: unknown revents %08x in socket, exiting.\n"),
543 revents); 580 revents);
544 exit (EXIT_FAILURE); 581 exit (EXIT_FAILURE);
545 } 582 }
546} 583}
547 584
… …
569 if (hdr->type == ::conf.icmp_type 606 if (hdr->type == ::conf.icmp_type
570 && hdr->code == 255) 607 && hdr->code == 255)
571 { 608 {
572 // raw sockets deliver the ipv4, but don't expect it on sends 609 // raw sockets deliver the ipv4, but don't expect it on sends
573 // this is slow, but... 610 // this is slow, but...
574 pkt->skip_hdr (ICMP_OVERHEAD); 611 pkt->skip_ipv4_hdr (ICMP_OVERHEAD - IP_OVERHEAD);
575 612
576 recv_vpn_packet (pkt, si); 613 recv_vpn_packet (pkt, si);
577 } 614 }
578 } 615 }
579 else 616 else
580 { 617 {
581 // probably ECONNRESET or somesuch 618 // probably ECONNRESET or somesuch
582 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 619 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
583 } 620 }
584 621
585 delete pkt; 622 delete pkt;
586 } 623 }
587 else 624 else
588 { 625 {
589 slog (L_ERR, 626 slog (L_ERR,
590 _("FATAL: unknown revents %08x in socket, terminating\n"), 627 _("FATAL: unknown revents %08x in socket, exiting.\n"),
591 revents); 628 revents);
592 exit (EXIT_FAILURE); 629 exit (EXIT_FAILURE);
593 } 630 }
594} 631}
595#endif 632#endif
… …
615 recv_vpn_packet (pkt, si); 652 recv_vpn_packet (pkt, si);
616 } 653 }
617 else 654 else
618 { 655 {
619 // probably ECONNRESET or somesuch 656 // probably ECONNRESET or somesuch
620 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 657 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
621 } 658 }
622 659
623 delete pkt; 660 delete pkt;
624 } 661 }
625 else 662 else
626 { 663 {
627 slog (L_ERR, 664 slog (L_ERR,
628 _("FATAL: unknown revents %08x in socket, terminating\n"), 665 _("FATAL: unknown revents %08x in socket, exiting.\n"),
629 revents); 666 revents);
630 exit (EXIT_FAILURE); 667 exit (EXIT_FAILURE);
631 } 668 }
632} 669}
633 670
… …
682 { 719 {
683 slog (L_INFO, _("preparing shutdown...")); 720 slog (L_INFO, _("preparing shutdown..."));
684 721
685 shutdown_all (); 722 shutdown_all ();
686 remove_pid (conf.pidfilename); 723 remove_pid (conf.pidfilename);
687 slog (L_INFO, _("terminating")); 724 slog (L_INFO, _("exiting."));
688 exit (EXIT_SUCCESS); 725 exit (EXIT_SUCCESS);
689 } 726 }
690 727
691 if (events & EVENT_RECONNECT) 728 if (events & EVENT_RECONNECT)
692 { 729 {
693 slog (L_INFO, _("forced reconnect")); 730 slog (L_INFO, _("forced reconnect."));
694 731
695 reconnect_all (); 732 reconnect_all ();
696 } 733 }
697 734
698 events = 0; 735 events = 0;
… …
714 751
715 conns.clear (); 752 conns.clear ();
716 753
717 connection_init (); 754 connection_init ();
718 755
719 for (configuration::node_vector::iterator i = conf.nodes.begin (); 756 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
720 i != conf.nodes.end (); ++i) 757 conns.push_back (new connection (this, *i));
721 { 758
722 connection *conn = new connection (this, *i); 759 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
723 conns.push_back (conn);
724 conn->establish_connection (); 760 (*c)->establish_connection ();
725 }
726} 761}
727 762
728connection *vpn::find_router () 763bool
764vpn::can_direct (conf_node *src, conf_node *dst) const
729{ 765{
730 u32 prio = 1; 766 return src != dst
767 && src->may_direct (dst)
768 && dst->may_direct (src)
769 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
770 || (src->protocols & dst->connectable_protocols ()));
771}
772
773// only works for indirect and routed connections: find a router
774// from THISNODE to dst
775connection *
776vpn::find_router_for (const connection *dst)
777{
731 connection *router = 0; 778 connection *router = 0;
732 779
780 // first try to find a router with a direct connection, route there
781 // regardless of any other considerations.
782 {
783 u32 prio = 1;
784
785 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
786 {
787 connection *c = *i;
788
789 if (c->conf->routerprio > prio
790 && c->conf != THISNODE
791 && can_direct (c->conf, dst->conf)
792 && c->ictx && c->octx)
793 {
794 prio = c->conf->routerprio;
795 router = c;
796 }
797 }
798 }
799
800 if (router)
801 return router;
802
803 // second try find the router with the highest priority, higher than ours
804 {
805 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
806
807 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
808 {
809 connection *c = *i;
810
811 if (c->conf->routerprio > prio
812 && c != dst
813 && c->conf != THISNODE
814 && c->ictx && c->octx)
815 {
816 prio = c->conf->routerprio;
817 router = c;
818 }
819 }
820 }
821
822 return router;
823}
824
825void
826vpn::connection_established (connection *c)
827{
733 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 828 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
734 { 829 {
735 connection *c = *i; 830 connection *o = *i;
736 831
737 if (c->conf->routerprio > prio 832 if (!o->is_direct
738 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 833 && o->si.valid ()
739 && c->ictx && c->octx 834 && c->si != o->si
740 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 835 && c == find_router_for (o))
741 {
742 prio = c->conf->routerprio;
743 router = c;
744 } 836 {
837 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
838 o->conf->nodename, c->conf->nodename);
839 o->rekey ();
840 }
745 } 841 }
746
747 return router;
748} 842}
749 843
844void
750void vpn::send_connect_request (int id) 845vpn::send_connect_request (connection *c)
751{ 846{
752 connection *c = find_router (); 847 connection *r = find_router_for (c);
753 848
754 if (c) 849 if (r)
850 {
851 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
852 c->conf->nodename, r->conf->nodename);
755 c->send_connect_request (id); 853 r->send_connect_request (c->conf->id);
854 }
756 else 855 else
757 // no router found, aggressively connect to all routers 856 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
758 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 857 c->conf->nodename);
759 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
760 (*i)->establish_connection ();
761} 858}
762 859
763void 860void
764connection::dump_status () 861connection::dump_status ()
765{ 862{
766 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 863 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
767 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 864 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
768 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 865 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
769 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 866 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
770 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 867 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
771 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
772 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
773} 868}
774 869
775void 870void
776vpn::dump_status () 871vpn::dump_status ()
777{ 872{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines