ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.46 by pcg, Thu Aug 7 17:30:28 2008 UTC vs.
Revision 1.71 by root, Thu Oct 6 03:25:54 2022 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
46 57
58using namespace std;
59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
61
62/////////////////////////////////////////////////////////////////////////////
63
64// hopefully temporary workaround for rare buffer full conditions
65// if it happens, usually instantly retrying or retrying ~5ms later
66// is good enough with current network technologies/kernels
67
68static ssize_t
69xsendto (int fd, const void *buf, size_t len, int flags,
70 const struct sockaddr *sa, socklen_t salen)
71{
72 ssize_t res;
73
74 for (int retry = 0; retry <= 13; ++retry) // ~100ms
75 {
76 res = sendto (fd, buf, len, flags, sa, salen);
77
78 if (res >= 0 || errno != ENOBUFS)
79 break;
80
81 struct timespec ts = { 0, 1000 * retry };
82 nanosleep (&ts, 0);
83 }
84
85 return res;
86}
48 87
49///////////////////////////////////////////////////////////////////////////// 88/////////////////////////////////////////////////////////////////////////////
50 89
51static void inline 90static void inline
52set_tos (int fd, int &tos_prev, int tos) 91set_tos (int fd, int &tos_prev, int tos)
… …
65{ 104{
66 // the tunnel device mtu should be the physical mtu - overhead 105 // the tunnel device mtu should be the physical mtu - overhead
67 // the tricky part is rounding to the cipher key blocksize 106 // the tricky part is rounding to the cipher key blocksize
68 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 107 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
69 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 108 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
70 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 109 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
71 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 110 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
72 111
73 char *env; 112 char *env;
74 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 113 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
75 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 114 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
… …
100inline const char * 139inline const char *
101vpn::script_if_up () 140vpn::script_if_up ()
102{ 141{
103 script_init_env (); 142 script_init_env ();
104 143
105 char *filename; 144 return conf.config_filename (::conf.script_if_up, "if-up");
106 asprintf (&filename, 145}
107 "%s/%s",
108 confbase,
109 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
110 146
111 return filename; 147int
148vpn::setup_socket (u8 prot, int family, int type, int proto)
149{
150 int fd = socket (family, type, proto);
151
152 if (fd < 0)
153 {
154 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
155 return fd;
156 }
157
158 fcntl (fd, F_SETFL, O_NONBLOCK);
159 fcntl (fd, F_SETFD, FD_CLOEXEC);
160
161#ifdef SO_MARK
162 if (::conf.nfmark)
163 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
164 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
165#endif
166
167 return fd;
112} 168}
113 169
114int 170int
115vpn::setup () 171vpn::setup ()
116{ 172{
173 int success = 0;
174
117 ipv4_tos = -1; 175 ipv4_tos = -1;
118 ipv4_fd = -1; 176 ipv4_fd = -1;
119 177
120 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 178 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
121 { 179 {
122 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 180 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
123 181
124 if (ipv4_fd < 0) 182 if (ipv4_fd < 0)
125 return -1; 183 return -1;
126
127 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
128 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
129 184
130#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 185#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
131 // this I really consider a linux bug. I am neither connected 186 // this I really consider a linux bug. I am neither connected
132 // nor do I fragment myself. Linux still sets DF and doesn't 187 // nor do I fragment myself. Linux still sets DF and doesn't
133 // fragment for me sometimes. 188 // fragment for me sometimes.
… …
139 194
140 sockinfo si (THISNODE, PROT_IPv4); 195 sockinfo si (THISNODE, PROT_IPv4);
141 196
142 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
143 { 198 {
144 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
145 exit (EXIT_FAILURE); 200 return -1;
146 } 201 }
147 202
148 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 203 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
204 ++success;
149 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_IPv4;
150 208
151 udpv4_tos = -1; 209 udpv4_tos = -1;
152 udpv4_fd = -1; 210 udpv4_fd = -1;
153 211
154 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 212 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
155 { 213 {
156 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 214 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
157 215
158 if (udpv4_fd < 0) 216 if (udpv4_fd < 0)
159 return -1; 217 return -1;
160
161 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
162 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
163 218
164 // standard daemon practise... 219 // standard daemon practise...
165 { 220 {
166 int oval = 1; 221 int oval = 1;
167 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 222 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
179 234
180 sockinfo si (THISNODE, PROT_UDPv4); 235 sockinfo si (THISNODE, PROT_UDPv4);
181 236
182 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 237 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
183 { 238 {
184 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 239 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
185 exit (EXIT_FAILURE); 240 return -1;
186 } 241 }
187 242
188 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 243 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
244 ++success;
189 } 245 }
246 else
247 THISNODE->protocols &= ~PROT_UDPv4;
190 248
191 icmpv4_tos = -1; 249 icmpv4_tos = -1;
192 icmpv4_fd = -1; 250 icmpv4_fd = -1;
193 251
194#if ENABLE_ICMP 252#if ENABLE_ICMP
195 if (THISNODE->protocols & PROT_ICMPv4) 253 if (THISNODE->protocols & PROT_ICMPv4)
196 { 254 {
197 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 255 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
198 256
199 if (icmpv4_fd < 0) 257 if (icmpv4_fd < 0)
200 return -1; 258 return -1;
201 259
202 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK); 260// no clue where trhis is actually defined
203 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC); 261#if !defined(ICMP_FILTER) && defined(__linux)
262 #define ICMP_FILTER 1
263#endif
204 264
205#ifdef ICMP_FILTER 265#ifdef ICMP_FILTER
206 { 266 {
207 icmp_filter oval; 267 uint32_t oval;
208 oval.data = 0xffffffff; 268 oval = 0;
209 if (::conf.icmp_type < 32) 269 if (::conf.icmp_type < 32)
210 oval.data &= ~(1 << ::conf.icmp_type); 270 oval |= 1 << ::conf.icmp_type;
271 oval = ~oval;
211 272
212 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval); 273 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
213 } 274 }
214#endif 275#endif
215 276
… …
225 286
226 sockinfo si (THISNODE, PROT_ICMPv4); 287 sockinfo si (THISNODE, PROT_ICMPv4);
227 288
228 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
229 { 290 {
230 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
231 exit (EXIT_FAILURE); 292 return -1;
232 } 293 }
233 294
234 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 295 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
296 ++success;
235 } 297 }
236#endif 298#endif
237 299
238 tcpv4_fd = -1; 300 tcpv4_fd = -1;
239 301
240#if ENABLE_TCP 302#if ENABLE_TCP
241 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 303 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
242 { 304 {
243 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 305 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
244 306
245 if (tcpv4_fd < 0) 307 if (tcpv4_fd < 0)
246 return -1; 308 return -1;
247 309
248 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
249 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
250
251 // standard daemon practise... 310 // standard daemon practise...
252 { 311 {
253 int oval = 1; 312 int oval = 1;
254 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 313 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
255 } 314 }
256 315
257 sockinfo si (THISNODE, PROT_TCPv4); 316 sockinfo si (THISNODE, PROT_TCPv4);
258 317
259 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 318 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
260 { 319 {
261 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 320 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
262 exit (EXIT_FAILURE); 321 return -1;
263 } 322 }
264 323
265 if (listen (tcpv4_fd, 5)) 324 if (listen (tcpv4_fd, 5))
266 { 325 {
267 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 326 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
268 exit (EXIT_FAILURE); 327 return -1;
269 } 328 }
270 329
271 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 330 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
331 ++success;
272 } 332 }
333 else
334 THISNODE->protocols &= ~PROT_TCPv4;
273#endif 335#endif
274 336
275 dnsv4_tos = -1; 337 dnsv4_tos = -1;
276 dnsv4_fd = -1; 338 dnsv4_fd = -1;
277 339
278#if ENABLE_DNS 340#if ENABLE_DNS
279 if (THISNODE->protocols & PROT_DNSv4) 341 if (THISNODE->protocols & PROT_DNSv4)
280 { 342 {
281 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 343 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
282 344
283 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 345 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
284 346
285 if (dnsv4_fd < 0) 347 if (dnsv4_fd < 0)
286 return -1; 348 return -1;
287
288 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
289 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
290 349
291# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 350# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
292 // this I really consider a linux bug. I am neither connected 351 // this I really consider a linux bug. I am neither connected
293 // nor do I fragment myself. Linux still sets DF and doesn't 352 // nor do I fragment myself. Linux still sets DF and doesn't
294 // fragment for me sometimes. 353 // fragment for me sometimes.
… …
308 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 367 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
309 PROT_DNSv4); 368 PROT_DNSv4);
310 369
311 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 370 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
312 { 371 {
313 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 372 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
314 exit (EXIT_FAILURE); 373 return -1;
315 } 374 }
316 375
317 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 376 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
377 ++success;
318 } 378 }
319#endif 379#endif
320 380
321 ///////////////////////////////////////////////////////////////////////////// 381 /////////////////////////////////////////////////////////////////////////////
382
383 if (!success)
384 {
385 slog (L_ERR, _("no protocols enabled."));
386 return -1;
387 }
322 388
323 reconnect_all (); 389 reconnect_all ();
324 390
325 ///////////////////////////////////////////////////////////////////////////// 391 /////////////////////////////////////////////////////////////////////////////
326 392
327 tap = new tap_device (); 393 tap = new tap_device ();
328 if (!tap) //D this, of course, never catches 394 if (!tap) //D this, of course, never catches
329 { 395 {
330 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 396 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
331 exit (EXIT_FAILURE); 397 return -1;
332 } 398 }
333 399
334 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 400 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
335 401
336 run_script_cb cb; 402 run_script_cb cb;
337 cb.set<vpn, &vpn::script_if_init> (this); 403 cb.set<vpn, &vpn::script_if_init> (this);
338 404
339 if (tap->if_up () && 405 if (tap->if_up () &&
340 !run_script (cb, true)) 406 !run_script (cb, true))
341 { 407 {
342 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 408 slog (L_ERR, _("interface initialization command '%s' failed."),
343 tap->if_up ()); 409 tap->if_up ());
344 exit (EXIT_FAILURE); 410 return -1;
345 } 411 }
346 412
347 cb.set<vpn, &vpn::script_if_up> (this); 413 cb.set<vpn, &vpn::script_if_up> (this);
348 if (!run_script (cb, true)) 414 if (!run_script (cb, true))
349 { 415 {
350 slog (L_ERR, _("if-up command execution failed, exiting.")); 416 slog (L_ERR, _("if-up command execution failed."));
351 exit (EXIT_FAILURE); 417 return -1;
352 } 418 }
353 419
354 tap_ev_watcher.start (tap->fd, EV_READ); 420 tap_ev_watcher.start (tap->fd, EV_READ);
355 421
356 return 0; 422 return 0;
423}
424
425bool
426vpn::drop_privileges ()
427{
428 if (::conf.change_root)
429 {
430 if (!strcmp (::conf.change_root, "/"))
431 {
432 char dir [L_tmpnam];
433 if (!tmpnam (dir))
434 {
435 slog (L_CRIT, _("unable to create anonymous root path."));
436 return false;
437 }
438
439 if (mkdir (dir, 0700))
440 {
441 slog (L_CRIT, _("unable to create anonymous root directory."));
442 return false;
443 }
444
445 if (chdir (dir))
446 {
447 slog (L_CRIT, _("unable to change to anonymous root directory."));
448 return false;
449 }
450
451 if (rmdir (dir))
452 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
453 }
454 else
455 {
456 if (chdir (::conf.change_root))
457 {
458 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
459 return false;
460 }
461 }
462
463 if (chroot ("."))
464 {
465 slog (L_CRIT, _("unable to set new root directory."));
466 return false;
467 }
468
469 if (chdir ("/"))
470 {
471 slog (L_CRIT, _("unable to set cwd to new root directory."));
472 return false;
473 }
474 }
475
476 if (::conf.change_gid)
477 if (setgid (::conf.change_gid))
478 {
479 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
480 return false;
481 }
482
483 if (::conf.change_uid)
484 if (setuid (::conf.change_uid))
485 {
486 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
487 return false;
488 }
489
490 return true;
357} 491}
358 492
359bool 493bool
360vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 494vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
361{ 495{
362 set_tos (ipv4_fd, ipv4_tos, tos); 496 set_tos (ipv4_fd, ipv4_tos, tos);
363 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 497 xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
364 498
365 return true; 499 return true;
366} 500}
367 501
368static u16 502static u16
… …
399 hdr->code = 255; 533 hdr->code = 255;
400 hdr->checksum = 0; 534 hdr->checksum = 0;
401 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 535 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
402 536
403 set_tos (icmpv4_fd, icmpv4_tos, tos); 537 set_tos (icmpv4_fd, icmpv4_tos, tos);
404 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 538 xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
405 539
406 return true; 540 return true;
407} 541}
408#endif 542#endif
409 543
410bool 544bool
411vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 545vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
412{ 546{
413 set_tos (udpv4_fd, udpv4_tos, tos); 547 set_tos (udpv4_fd, udpv4_tos, tos);
414 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 548 xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
415 549
416 return true; 550 return true;
417} 551}
418 552
419void 553void
… …
439vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 573vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
440{ 574{
441 unsigned int src = pkt->src (); 575 unsigned int src = pkt->src ();
442 unsigned int dst = pkt->dst (); 576 unsigned int dst = pkt->dst ();
443 577
444 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 578 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 579 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
446 580
447 if (src == 0 || src > conns.size () 581 if (src == 0 || src > conns.size ()
448 || dst > conns.size () 582 || dst > conns.size ()
449 || pkt->typ () >= vpn_packet::PT_MAX) 583 || pkt->typ () >= vpn_packet::PT_MAX)
450 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 584 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
451 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
452 else if (dst > conns.size ())
453 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
454 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 585 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
455 else 586 else
456 { 587 {
457 connection *c = conns[src - 1]; 588 connection *c = conns[src - 1];
458 589
459 if (dst == 0) 590 if (dst == 0)
460 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 591 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
461 c->conf->nodename, (const char *)rsi); 592 c->conf->nodename, (const char *)rsi);
462 else if (dst != THISNODE->id) 593 else if (dst != THISNODE->id)
463 { 594 {
464 if (THISNODE->routerprio) 595 if (THISNODE->routerprio)
465 // the tos setting gets lost here. who cares. 596 // the tos setting gets lost here. who cares.
466 conns[dst - 1]->inject_vpn_packet (pkt); 597 conns[dst - 1]->inject_vpn_packet (pkt);
467 else 598 else
468 slog (L_WARN, 599 slog (L_WARN,
469 _("%s(%s): forwarding request (=> %s), but we are no router"), 600 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
470 c->conf->nodename, (const char *)rsi, 601 c->conf->nodename, (const char *)rsi,
471 conns[dst - 1]->conf->nodename); 602 conns[dst - 1]->conf->nodename);
472 } 603 }
473 else 604 else
474 c->recv_vpn_packet (pkt, rsi); 605 c->recv_vpn_packet (pkt, rsi);
… …
479vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 610vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
480{ 611{
481 switch (si.prot) 612 switch (si.prot)
482 { 613 {
483 case PROT_IPv4: 614 case PROT_IPv4:
484 return send_ipv4_packet (pkt, si, tos); 615 return send_ipv4_packet (pkt, si, tos);
485 616
486 case PROT_UDPv4: 617 case PROT_UDPv4:
487 return send_udpv4_packet (pkt, si, tos); 618 return send_udpv4_packet (pkt, si, tos);
488 619
489#if ENABLE_TCP 620#if ENABLE_TCP
490 case PROT_TCPv4: 621 case PROT_TCPv4:
491 return send_tcpv4_packet (pkt, si, tos); 622 return send_tcpv4_packet (pkt, si, tos);
492#endif 623#endif
493#if ENABLE_ICMP 624#if ENABLE_ICMP
494 case PROT_ICMPv4: 625 case PROT_ICMPv4:
495 return send_icmpv4_packet (pkt, si, tos); 626 return send_icmpv4_packet (pkt, si, tos);
496#endif 627#endif
497#if ENABLE_DNS 628#if ENABLE_DNS
498 case PROT_DNSv4: 629 case PROT_DNSv4:
499 return send_dnsv4_packet (pkt, si, tos); 630 return send_dnsv4_packet (pkt, si, tos);
500#endif 631#endif
501 default: 632 default:
502 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 633 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
503 } 634 }
504 635
505 return false; 636 return false;
506} 637}
507 638
… …
522 if (len > 0) 653 if (len > 0)
523 { 654 {
524 pkt->len = len; 655 pkt->len = len;
525 656
526 // raw sockets deliver the ipv4 header, but don't expect it on sends 657 // raw sockets deliver the ipv4 header, but don't expect it on sends
527 pkt->skip_hdr (IP_OVERHEAD); 658 pkt->skip_hdr (pkt->ipv4_hdr_len ());
528 659
529 recv_vpn_packet (pkt, si); 660 recv_vpn_packet (pkt, si);
530 } 661 }
531 else 662 else
532 { 663 {
533 // probably ECONNRESET or somesuch 664 // probably ECONNRESET or somesuch
534 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 665 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
535 } 666 }
536 667
537 delete pkt; 668 delete pkt;
538 } 669 }
539 else 670 else
540 { 671 {
541 slog (L_ERR, 672 slog (L_ERR,
542 _("FATAL: unknown revents %08x in socket, terminating\n"), 673 _("FATAL: unknown revents %08x in socket, exiting.\n"),
543 revents); 674 revents);
544 exit (EXIT_FAILURE); 675 exit (EXIT_FAILURE);
545 } 676 }
546} 677}
547 678
… …
569 if (hdr->type == ::conf.icmp_type 700 if (hdr->type == ::conf.icmp_type
570 && hdr->code == 255) 701 && hdr->code == 255)
571 { 702 {
572 // raw sockets deliver the ipv4, but don't expect it on sends 703 // raw sockets deliver the ipv4, but don't expect it on sends
573 // this is slow, but... 704 // this is slow, but...
574 pkt->skip_hdr (ICMP_OVERHEAD); 705 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
575 706
576 recv_vpn_packet (pkt, si); 707 recv_vpn_packet (pkt, si);
577 } 708 }
578 } 709 }
579 else 710 else
580 { 711 {
581 // probably ECONNRESET or somesuch 712 // probably ECONNRESET or somesuch
582 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 713 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
583 } 714 }
584 715
585 delete pkt; 716 delete pkt;
586 } 717 }
587 else 718 else
588 { 719 {
589 slog (L_ERR, 720 slog (L_ERR,
590 _("FATAL: unknown revents %08x in socket, terminating\n"), 721 _("FATAL: unknown revents %08x in socket, exiting.\n"),
591 revents); 722 revents);
592 exit (EXIT_FAILURE); 723 exit (EXIT_FAILURE);
593 } 724 }
594} 725}
595#endif 726#endif
… …
615 recv_vpn_packet (pkt, si); 746 recv_vpn_packet (pkt, si);
616 } 747 }
617 else 748 else
618 { 749 {
619 // probably ECONNRESET or somesuch 750 // probably ECONNRESET or somesuch
620 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 751 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
621 } 752 }
622 753
623 delete pkt; 754 delete pkt;
624 } 755 }
625 else 756 else
626 { 757 {
627 slog (L_ERR, 758 slog (L_ERR,
628 _("FATAL: unknown revents %08x in socket, terminating\n"), 759 _("FATAL: unknown revents %08x in socket, exiting.\n"),
629 revents); 760 revents);
630 exit (EXIT_FAILURE); 761 exit (EXIT_FAILURE);
631 } 762 }
632} 763}
633 764
… …
682 { 813 {
683 slog (L_INFO, _("preparing shutdown...")); 814 slog (L_INFO, _("preparing shutdown..."));
684 815
685 shutdown_all (); 816 shutdown_all ();
686 remove_pid (conf.pidfilename); 817 remove_pid (conf.pidfilename);
687 slog (L_INFO, _("terminating")); 818 slog (L_INFO, _("exiting."));
688 exit (EXIT_SUCCESS); 819 exit (EXIT_SUCCESS);
689 } 820 }
690 821
691 if (events & EVENT_RECONNECT) 822 if (events & EVENT_RECONNECT)
692 { 823 {
693 slog (L_INFO, _("forced reconnect")); 824 slog (L_INFO, _("forced reconnect."));
694 825
695 reconnect_all (); 826 reconnect_all ();
696 } 827 }
697 828
698 events = 0; 829 events = 0;
… …
714 845
715 conns.clear (); 846 conns.clear ();
716 847
717 connection_init (); 848 connection_init ();
718 849
719 for (configuration::node_vector::iterator i = conf.nodes.begin (); 850 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
720 i != conf.nodes.end (); ++i) 851 conns.push_back (new connection (this, *i));
721 { 852
722 connection *conn = new connection (this, *i); 853 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
723 conns.push_back (conn);
724 conn->establish_connection (); 854 (*c)->establish_connection ();
725 }
726} 855}
727 856
728connection *vpn::find_router () 857bool
858vpn::can_direct (conf_node *src, conf_node *dst) const
729{ 859{
730 u32 prio = 1; 860 return src != dst
861 && src->may_direct (dst)
862 && dst->may_direct (src)
863 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
864 || (src->protocols & dst->connectable_protocols ()));
865}
866
867// only works for indirect and routed connections: find a router
868// from THISNODE to dst
869connection *
870vpn::find_router_for (const connection *dst)
871{
731 connection *router = 0; 872 connection *router = 0;
732 873
874 // first try to find a router with a direct connection, route there
875 // regardless of any other considerations.
876 {
877 u32 prio = 1;
878
879 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
880 {
881 connection *c = *i;
882
883 if (c->conf->routerprio > prio
884 && c->conf != THISNODE
885 && can_direct (c->conf, dst->conf)
886 && c->ictx && c->octx)
887 {
888 prio = c->conf->routerprio;
889 router = c;
890 }
891 }
892 }
893
894 if (router)
895 return router;
896
897 // second try find the router with the highest priority, higher than ours
898 {
899 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
900
901 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
902 {
903 connection *c = *i;
904
905 if (c->conf->routerprio > prio
906 && c != dst
907 && c->conf != THISNODE
908 && c->ictx && c->octx)
909 {
910 prio = c->conf->routerprio;
911 router = c;
912 }
913 }
914 }
915
916 return router;
917}
918
919void
920vpn::connection_established (connection *c)
921{
733 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 922 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
734 { 923 {
735 connection *c = *i; 924 connection *o = *i;
736 925
737 if (c->conf->routerprio > prio 926 if (o->si.valid ()
738 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 927 && c->si != o->si
739 && c->ictx && c->octx 928 && c == find_router_for (o)
740 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 929 && !can_direct (THISNODE, o->conf))
741 {
742 prio = c->conf->routerprio;
743 router = c;
744 } 930 {
931 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
932 o->conf->nodename, c->conf->nodename);
933 o->rekey ();
934 }
745 } 935 }
746
747 return router;
748} 936}
749 937
938void
750void vpn::send_connect_request (int id) 939vpn::send_connect_request (connection *c)
751{ 940{
752 connection *c = find_router (); 941 connection *r = find_router_for (c);
753 942
754 if (c) 943 if (r)
944 {
945 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
946 c->conf->nodename, r->conf->nodename);
755 c->send_connect_request (id); 947 r->send_connect_request (c->conf->id);
948 }
756 else 949 else
757 // no router found, aggressively connect to all routers 950 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
758 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 951 c->conf->nodename);
759 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
760 (*i)->establish_connection ();
761} 952}
762 953
763void 954void
764connection::dump_status () 955connection::dump_status ()
765{ 956{
766 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 957 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
767 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 958 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
768 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 959 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
769 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 960 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
770 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 961 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
771 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
772 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
773} 962}
774 963
775void 964void
776vpn::dump_status () 965vpn::dump_status ()
777{ 966{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines