ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.48 by pcg, Sat Aug 9 18:30:55 2008 UTC vs.
Revision 1.71 by root, Thu Oct 6 03:25:54 2022 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify it 7 GVPE is free software; you can redistribute it and/or modify it
8 under the terms of the GNU General Public License as published by the 8 under the terms of the GNU General Public License as published by the
… …
38#include <cstdlib> 38#include <cstdlib>
39 39
40#include <sys/types.h> 40#include <sys/types.h>
41#include <sys/socket.h> 41#include <sys/socket.h>
42#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
43#include <errno.h> 44#include <errno.h>
44#include <time.h> 45#include <time.h>
45#include <unistd.h> 46#include <unistd.h>
46#include <fcntl.h> 47#include <fcntl.h>
47#include <sys/socket.h> 48#include <sys/socket.h>
… …
52 53
53#include "connection.h" 54#include "connection.h"
54#include "util.h" 55#include "util.h"
55#include "vpn.h" 56#include "vpn.h"
56 57
58using namespace std;
59
57vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
61
62/////////////////////////////////////////////////////////////////////////////
63
64// hopefully temporary workaround for rare buffer full conditions
65// if it happens, usually instantly retrying or retrying ~5ms later
66// is good enough with current network technologies/kernels
67
68static ssize_t
69xsendto (int fd, const void *buf, size_t len, int flags,
70 const struct sockaddr *sa, socklen_t salen)
71{
72 ssize_t res;
73
74 for (int retry = 0; retry <= 13; ++retry) // ~100ms
75 {
76 res = sendto (fd, buf, len, flags, sa, salen);
77
78 if (res >= 0 || errno != ENOBUFS)
79 break;
80
81 struct timespec ts = { 0, 1000 * retry };
82 nanosleep (&ts, 0);
83 }
84
85 return res;
86}
58 87
59///////////////////////////////////////////////////////////////////////////// 88/////////////////////////////////////////////////////////////////////////////
60 89
61static void inline 90static void inline
62set_tos (int fd, int &tos_prev, int tos) 91set_tos (int fd, int &tos_prev, int tos)
… …
75{ 104{
76 // the tunnel device mtu should be the physical mtu - overhead 105 // the tunnel device mtu should be the physical mtu - overhead
77 // the tricky part is rounding to the cipher key blocksize 106 // the tricky part is rounding to the cipher key blocksize
78 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 107 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
79 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 108 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 109 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 110 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
82 111
83 char *env; 112 char *env;
84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 113 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 114 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
… …
110inline const char * 139inline const char *
111vpn::script_if_up () 140vpn::script_if_up ()
112{ 141{
113 script_init_env (); 142 script_init_env ();
114 143
115 char *filename; 144 return conf.config_filename (::conf.script_if_up, "if-up");
116 asprintf (&filename, 145}
117 "%s/%s",
118 confbase,
119 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
120 146
121 return filename; 147int
148vpn::setup_socket (u8 prot, int family, int type, int proto)
149{
150 int fd = socket (family, type, proto);
151
152 if (fd < 0)
153 {
154 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
155 return fd;
156 }
157
158 fcntl (fd, F_SETFL, O_NONBLOCK);
159 fcntl (fd, F_SETFD, FD_CLOEXEC);
160
161#ifdef SO_MARK
162 if (::conf.nfmark)
163 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
164 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
165#endif
166
167 return fd;
122} 168}
123 169
124int 170int
125vpn::setup () 171vpn::setup ()
126{ 172{
173 int success = 0;
174
127 ipv4_tos = -1; 175 ipv4_tos = -1;
128 ipv4_fd = -1; 176 ipv4_fd = -1;
129 177
130 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 178 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
131 { 179 {
132 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 180 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
133 181
134 if (ipv4_fd < 0) 182 if (ipv4_fd < 0)
135 return -1; 183 return -1;
136
137 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
138 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
139 184
140#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 185#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
141 // this I really consider a linux bug. I am neither connected 186 // this I really consider a linux bug. I am neither connected
142 // nor do I fragment myself. Linux still sets DF and doesn't 187 // nor do I fragment myself. Linux still sets DF and doesn't
143 // fragment for me sometimes. 188 // fragment for me sometimes.
… …
149 194
150 sockinfo si (THISNODE, PROT_IPv4); 195 sockinfo si (THISNODE, PROT_IPv4);
151 196
152 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
153 { 198 {
154 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
155 exit (EXIT_FAILURE); 200 return -1;
156 } 201 }
157 202
158 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 203 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
204 ++success;
159 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_IPv4;
160 208
161 udpv4_tos = -1; 209 udpv4_tos = -1;
162 udpv4_fd = -1; 210 udpv4_fd = -1;
163 211
164 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 212 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
165 { 213 {
166 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 214 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
167 215
168 if (udpv4_fd < 0) 216 if (udpv4_fd < 0)
169 return -1; 217 return -1;
170
171 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
172 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
173 218
174 // standard daemon practise... 219 // standard daemon practise...
175 { 220 {
176 int oval = 1; 221 int oval = 1;
177 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 222 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
189 234
190 sockinfo si (THISNODE, PROT_UDPv4); 235 sockinfo si (THISNODE, PROT_UDPv4);
191 236
192 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 237 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
193 { 238 {
194 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 239 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
195 exit (EXIT_FAILURE); 240 return -1;
196 } 241 }
197 242
198 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 243 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
244 ++success;
199 } 245 }
246 else
247 THISNODE->protocols &= ~PROT_UDPv4;
200 248
201 icmpv4_tos = -1; 249 icmpv4_tos = -1;
202 icmpv4_fd = -1; 250 icmpv4_fd = -1;
203 251
204#if ENABLE_ICMP 252#if ENABLE_ICMP
205 if (THISNODE->protocols & PROT_ICMPv4) 253 if (THISNODE->protocols & PROT_ICMPv4)
206 { 254 {
207 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 255 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
208 256
209 if (icmpv4_fd < 0) 257 if (icmpv4_fd < 0)
210 return -1; 258 return -1;
211 259
212 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK); 260// no clue where trhis is actually defined
213 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC); 261#if !defined(ICMP_FILTER) && defined(__linux)
262 #define ICMP_FILTER 1
263#endif
214 264
215#ifdef ICMP_FILTER 265#ifdef ICMP_FILTER
216 { 266 {
217 icmp_filter oval; 267 uint32_t oval;
218 oval.data = 0xffffffff; 268 oval = 0;
219 if (::conf.icmp_type < 32) 269 if (::conf.icmp_type < 32)
220 oval.data &= ~(1 << ::conf.icmp_type); 270 oval |= 1 << ::conf.icmp_type;
271 oval = ~oval;
221 272
222 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval); 273 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
223 } 274 }
224#endif 275#endif
225 276
… …
235 286
236 sockinfo si (THISNODE, PROT_ICMPv4); 287 sockinfo si (THISNODE, PROT_ICMPv4);
237 288
238 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
239 { 290 {
240 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
241 exit (EXIT_FAILURE); 292 return -1;
242 } 293 }
243 294
244 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 295 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
296 ++success;
245 } 297 }
246#endif 298#endif
247 299
248 tcpv4_fd = -1; 300 tcpv4_fd = -1;
249 301
250#if ENABLE_TCP 302#if ENABLE_TCP
251 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 303 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
252 { 304 {
253 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 305 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
254 306
255 if (tcpv4_fd < 0) 307 if (tcpv4_fd < 0)
256 return -1; 308 return -1;
257 309
258 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
259 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
260
261 // standard daemon practise... 310 // standard daemon practise...
262 { 311 {
263 int oval = 1; 312 int oval = 1;
264 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 313 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
265 } 314 }
266 315
267 sockinfo si (THISNODE, PROT_TCPv4); 316 sockinfo si (THISNODE, PROT_TCPv4);
268 317
269 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 318 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
270 { 319 {
271 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 320 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
272 exit (EXIT_FAILURE); 321 return -1;
273 } 322 }
274 323
275 if (listen (tcpv4_fd, 5)) 324 if (listen (tcpv4_fd, 5))
276 { 325 {
277 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 326 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
278 exit (EXIT_FAILURE); 327 return -1;
279 } 328 }
280 329
281 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 330 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
331 ++success;
282 } 332 }
333 else
334 THISNODE->protocols &= ~PROT_TCPv4;
283#endif 335#endif
284 336
285 dnsv4_tos = -1; 337 dnsv4_tos = -1;
286 dnsv4_fd = -1; 338 dnsv4_fd = -1;
287 339
288#if ENABLE_DNS 340#if ENABLE_DNS
289 if (THISNODE->protocols & PROT_DNSv4) 341 if (THISNODE->protocols & PROT_DNSv4)
290 { 342 {
291 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 343 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
292 344
293 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 345 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
294 346
295 if (dnsv4_fd < 0) 347 if (dnsv4_fd < 0)
296 return -1; 348 return -1;
297
298 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
299 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
300 349
301# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 350# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
302 // this I really consider a linux bug. I am neither connected 351 // this I really consider a linux bug. I am neither connected
303 // nor do I fragment myself. Linux still sets DF and doesn't 352 // nor do I fragment myself. Linux still sets DF and doesn't
304 // fragment for me sometimes. 353 // fragment for me sometimes.
… …
318 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 367 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
319 PROT_DNSv4); 368 PROT_DNSv4);
320 369
321 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 370 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
322 { 371 {
323 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 372 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
324 exit (EXIT_FAILURE); 373 return -1;
325 } 374 }
326 375
327 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 376 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
377 ++success;
328 } 378 }
329#endif 379#endif
330 380
331 ///////////////////////////////////////////////////////////////////////////// 381 /////////////////////////////////////////////////////////////////////////////
382
383 if (!success)
384 {
385 slog (L_ERR, _("no protocols enabled."));
386 return -1;
387 }
332 388
333 reconnect_all (); 389 reconnect_all ();
334 390
335 ///////////////////////////////////////////////////////////////////////////// 391 /////////////////////////////////////////////////////////////////////////////
336 392
337 tap = new tap_device (); 393 tap = new tap_device ();
338 if (!tap) //D this, of course, never catches 394 if (!tap) //D this, of course, never catches
339 { 395 {
340 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 396 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
341 exit (EXIT_FAILURE); 397 return -1;
342 } 398 }
343 399
344 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 400 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
345 401
346 run_script_cb cb; 402 run_script_cb cb;
347 cb.set<vpn, &vpn::script_if_init> (this); 403 cb.set<vpn, &vpn::script_if_init> (this);
348 404
349 if (tap->if_up () && 405 if (tap->if_up () &&
350 !run_script (cb, true)) 406 !run_script (cb, true))
351 { 407 {
352 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 408 slog (L_ERR, _("interface initialization command '%s' failed."),
353 tap->if_up ()); 409 tap->if_up ());
354 exit (EXIT_FAILURE); 410 return -1;
355 } 411 }
356 412
357 cb.set<vpn, &vpn::script_if_up> (this); 413 cb.set<vpn, &vpn::script_if_up> (this);
358 if (!run_script (cb, true)) 414 if (!run_script (cb, true))
359 { 415 {
360 slog (L_ERR, _("if-up command execution failed, exiting.")); 416 slog (L_ERR, _("if-up command execution failed."));
361 exit (EXIT_FAILURE); 417 return -1;
362 } 418 }
363 419
364 tap_ev_watcher.start (tap->fd, EV_READ); 420 tap_ev_watcher.start (tap->fd, EV_READ);
365 421
366 return 0; 422 return 0;
423}
424
425bool
426vpn::drop_privileges ()
427{
428 if (::conf.change_root)
429 {
430 if (!strcmp (::conf.change_root, "/"))
431 {
432 char dir [L_tmpnam];
433 if (!tmpnam (dir))
434 {
435 slog (L_CRIT, _("unable to create anonymous root path."));
436 return false;
437 }
438
439 if (mkdir (dir, 0700))
440 {
441 slog (L_CRIT, _("unable to create anonymous root directory."));
442 return false;
443 }
444
445 if (chdir (dir))
446 {
447 slog (L_CRIT, _("unable to change to anonymous root directory."));
448 return false;
449 }
450
451 if (rmdir (dir))
452 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
453 }
454 else
455 {
456 if (chdir (::conf.change_root))
457 {
458 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
459 return false;
460 }
461 }
462
463 if (chroot ("."))
464 {
465 slog (L_CRIT, _("unable to set new root directory."));
466 return false;
467 }
468
469 if (chdir ("/"))
470 {
471 slog (L_CRIT, _("unable to set cwd to new root directory."));
472 return false;
473 }
474 }
475
476 if (::conf.change_gid)
477 if (setgid (::conf.change_gid))
478 {
479 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
480 return false;
481 }
482
483 if (::conf.change_uid)
484 if (setuid (::conf.change_uid))
485 {
486 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
487 return false;
488 }
489
490 return true;
367} 491}
368 492
369bool 493bool
370vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 494vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
371{ 495{
372 set_tos (ipv4_fd, ipv4_tos, tos); 496 set_tos (ipv4_fd, ipv4_tos, tos);
373 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 497 xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
374 498
375 return true; 499 return true;
376} 500}
377 501
378static u16 502static u16
… …
409 hdr->code = 255; 533 hdr->code = 255;
410 hdr->checksum = 0; 534 hdr->checksum = 0;
411 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 535 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
412 536
413 set_tos (icmpv4_fd, icmpv4_tos, tos); 537 set_tos (icmpv4_fd, icmpv4_tos, tos);
414 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 538 xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
415 539
416 return true; 540 return true;
417} 541}
418#endif 542#endif
419 543
420bool 544bool
421vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 545vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
422{ 546{
423 set_tos (udpv4_fd, udpv4_tos, tos); 547 set_tos (udpv4_fd, udpv4_tos, tos);
424 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 548 xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
425 549
426 return true; 550 return true;
427} 551}
428 552
429void 553void
… …
449vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 573vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
450{ 574{
451 unsigned int src = pkt->src (); 575 unsigned int src = pkt->src ();
452 unsigned int dst = pkt->dst (); 576 unsigned int dst = pkt->dst ();
453 577
454 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 578 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
455 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 579 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
456 580
457 if (src == 0 || src > conns.size () 581 if (src == 0 || src > conns.size ()
458 || dst > conns.size () 582 || dst > conns.size ()
459 || pkt->typ () >= vpn_packet::PT_MAX) 583 || pkt->typ () >= vpn_packet::PT_MAX)
460 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 584 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
461 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
462 else if (dst > conns.size ())
463 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
464 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 585 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
465 else 586 else
466 { 587 {
467 connection *c = conns[src - 1]; 588 connection *c = conns[src - 1];
468 589
469 if (dst == 0) 590 if (dst == 0)
470 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 591 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
471 c->conf->nodename, (const char *)rsi); 592 c->conf->nodename, (const char *)rsi);
472 else if (dst != THISNODE->id) 593 else if (dst != THISNODE->id)
473 { 594 {
474 if (THISNODE->routerprio) 595 if (THISNODE->routerprio)
475 // the tos setting gets lost here. who cares. 596 // the tos setting gets lost here. who cares.
476 conns[dst - 1]->inject_vpn_packet (pkt); 597 conns[dst - 1]->inject_vpn_packet (pkt);
477 else 598 else
478 slog (L_WARN, 599 slog (L_WARN,
479 _("%s(%s): forwarding request (=> %s), but we are no router"), 600 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
480 c->conf->nodename, (const char *)rsi, 601 c->conf->nodename, (const char *)rsi,
481 conns[dst - 1]->conf->nodename); 602 conns[dst - 1]->conf->nodename);
482 } 603 }
483 else 604 else
484 c->recv_vpn_packet (pkt, rsi); 605 c->recv_vpn_packet (pkt, rsi);
… …
489vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 610vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
490{ 611{
491 switch (si.prot) 612 switch (si.prot)
492 { 613 {
493 case PROT_IPv4: 614 case PROT_IPv4:
494 return send_ipv4_packet (pkt, si, tos); 615 return send_ipv4_packet (pkt, si, tos);
495 616
496 case PROT_UDPv4: 617 case PROT_UDPv4:
497 return send_udpv4_packet (pkt, si, tos); 618 return send_udpv4_packet (pkt, si, tos);
498 619
499#if ENABLE_TCP 620#if ENABLE_TCP
500 case PROT_TCPv4: 621 case PROT_TCPv4:
501 return send_tcpv4_packet (pkt, si, tos); 622 return send_tcpv4_packet (pkt, si, tos);
502#endif 623#endif
503#if ENABLE_ICMP 624#if ENABLE_ICMP
504 case PROT_ICMPv4: 625 case PROT_ICMPv4:
505 return send_icmpv4_packet (pkt, si, tos); 626 return send_icmpv4_packet (pkt, si, tos);
506#endif 627#endif
507#if ENABLE_DNS 628#if ENABLE_DNS
508 case PROT_DNSv4: 629 case PROT_DNSv4:
509 return send_dnsv4_packet (pkt, si, tos); 630 return send_dnsv4_packet (pkt, si, tos);
510#endif 631#endif
511 default: 632 default:
512 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 633 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
513 } 634 }
514 635
515 return false; 636 return false;
516} 637}
517 638
… …
532 if (len > 0) 653 if (len > 0)
533 { 654 {
534 pkt->len = len; 655 pkt->len = len;
535 656
536 // raw sockets deliver the ipv4 header, but don't expect it on sends 657 // raw sockets deliver the ipv4 header, but don't expect it on sends
537 pkt->skip_hdr (IP_OVERHEAD); 658 pkt->skip_hdr (pkt->ipv4_hdr_len ());
538 659
539 recv_vpn_packet (pkt, si); 660 recv_vpn_packet (pkt, si);
540 } 661 }
541 else 662 else
542 { 663 {
543 // probably ECONNRESET or somesuch 664 // probably ECONNRESET or somesuch
544 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 665 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
545 } 666 }
546 667
547 delete pkt; 668 delete pkt;
548 } 669 }
549 else 670 else
550 { 671 {
551 slog (L_ERR, 672 slog (L_ERR,
552 _("FATAL: unknown revents %08x in socket, terminating\n"), 673 _("FATAL: unknown revents %08x in socket, exiting.\n"),
553 revents); 674 revents);
554 exit (EXIT_FAILURE); 675 exit (EXIT_FAILURE);
555 } 676 }
556} 677}
557 678
… …
579 if (hdr->type == ::conf.icmp_type 700 if (hdr->type == ::conf.icmp_type
580 && hdr->code == 255) 701 && hdr->code == 255)
581 { 702 {
582 // raw sockets deliver the ipv4, but don't expect it on sends 703 // raw sockets deliver the ipv4, but don't expect it on sends
583 // this is slow, but... 704 // this is slow, but...
584 pkt->skip_hdr (ICMP_OVERHEAD); 705 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
585 706
586 recv_vpn_packet (pkt, si); 707 recv_vpn_packet (pkt, si);
587 } 708 }
588 } 709 }
589 else 710 else
590 { 711 {
591 // probably ECONNRESET or somesuch 712 // probably ECONNRESET or somesuch
592 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 713 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
593 } 714 }
594 715
595 delete pkt; 716 delete pkt;
596 } 717 }
597 else 718 else
598 { 719 {
599 slog (L_ERR, 720 slog (L_ERR,
600 _("FATAL: unknown revents %08x in socket, terminating\n"), 721 _("FATAL: unknown revents %08x in socket, exiting.\n"),
601 revents); 722 revents);
602 exit (EXIT_FAILURE); 723 exit (EXIT_FAILURE);
603 } 724 }
604} 725}
605#endif 726#endif
… …
625 recv_vpn_packet (pkt, si); 746 recv_vpn_packet (pkt, si);
626 } 747 }
627 else 748 else
628 { 749 {
629 // probably ECONNRESET or somesuch 750 // probably ECONNRESET or somesuch
630 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 751 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
631 } 752 }
632 753
633 delete pkt; 754 delete pkt;
634 } 755 }
635 else 756 else
636 { 757 {
637 slog (L_ERR, 758 slog (L_ERR,
638 _("FATAL: unknown revents %08x in socket, terminating\n"), 759 _("FATAL: unknown revents %08x in socket, exiting.\n"),
639 revents); 760 revents);
640 exit (EXIT_FAILURE); 761 exit (EXIT_FAILURE);
641 } 762 }
642} 763}
643 764
… …
692 { 813 {
693 slog (L_INFO, _("preparing shutdown...")); 814 slog (L_INFO, _("preparing shutdown..."));
694 815
695 shutdown_all (); 816 shutdown_all ();
696 remove_pid (conf.pidfilename); 817 remove_pid (conf.pidfilename);
697 slog (L_INFO, _("terminating")); 818 slog (L_INFO, _("exiting."));
698 exit (EXIT_SUCCESS); 819 exit (EXIT_SUCCESS);
699 } 820 }
700 821
701 if (events & EVENT_RECONNECT) 822 if (events & EVENT_RECONNECT)
702 { 823 {
703 slog (L_INFO, _("forced reconnect")); 824 slog (L_INFO, _("forced reconnect."));
704 825
705 reconnect_all (); 826 reconnect_all ();
706 } 827 }
707 828
708 events = 0; 829 events = 0;
… …
724 845
725 conns.clear (); 846 conns.clear ();
726 847
727 connection_init (); 848 connection_init ();
728 849
729 for (configuration::node_vector::iterator i = conf.nodes.begin (); 850 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
730 i != conf.nodes.end (); ++i) 851 conns.push_back (new connection (this, *i));
731 { 852
732 connection *conn = new connection (this, *i); 853 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
733 conns.push_back (conn);
734 conn->establish_connection (); 854 (*c)->establish_connection ();
735 }
736} 855}
737 856
738connection *vpn::find_router () 857bool
858vpn::can_direct (conf_node *src, conf_node *dst) const
739{ 859{
740 u32 prio = 1; 860 return src != dst
861 && src->may_direct (dst)
862 && dst->may_direct (src)
863 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
864 || (src->protocols & dst->connectable_protocols ()));
865}
866
867// only works for indirect and routed connections: find a router
868// from THISNODE to dst
869connection *
870vpn::find_router_for (const connection *dst)
871{
741 connection *router = 0; 872 connection *router = 0;
742 873
874 // first try to find a router with a direct connection, route there
875 // regardless of any other considerations.
876 {
877 u32 prio = 1;
878
879 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
880 {
881 connection *c = *i;
882
883 if (c->conf->routerprio > prio
884 && c->conf != THISNODE
885 && can_direct (c->conf, dst->conf)
886 && c->ictx && c->octx)
887 {
888 prio = c->conf->routerprio;
889 router = c;
890 }
891 }
892 }
893
894 if (router)
895 return router;
896
897 // second try find the router with the highest priority, higher than ours
898 {
899 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
900
901 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
902 {
903 connection *c = *i;
904
905 if (c->conf->routerprio > prio
906 && c != dst
907 && c->conf != THISNODE
908 && c->ictx && c->octx)
909 {
910 prio = c->conf->routerprio;
911 router = c;
912 }
913 }
914 }
915
916 return router;
917}
918
919void
920vpn::connection_established (connection *c)
921{
743 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 922 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
744 { 923 {
745 connection *c = *i; 924 connection *o = *i;
746 925
747 if (c->conf->routerprio > prio 926 if (o->si.valid ()
748 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 927 && c->si != o->si
749 && c->ictx && c->octx 928 && c == find_router_for (o)
750 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 929 && !can_direct (THISNODE, o->conf))
751 {
752 prio = c->conf->routerprio;
753 router = c;
754 } 930 {
931 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
932 o->conf->nodename, c->conf->nodename);
933 o->rekey ();
934 }
755 } 935 }
756
757 return router;
758} 936}
759 937
938void
760void vpn::send_connect_request (int id) 939vpn::send_connect_request (connection *c)
761{ 940{
762 connection *c = find_router (); 941 connection *r = find_router_for (c);
763 942
764 if (c) 943 if (r)
944 {
945 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
946 c->conf->nodename, r->conf->nodename);
765 c->send_connect_request (id); 947 r->send_connect_request (c->conf->id);
948 }
766 else 949 else
767 // no router found, aggressively connect to all routers 950 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
768 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 951 c->conf->nodename);
769 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
770 (*i)->establish_connection ();
771} 952}
772 953
773void 954void
774connection::dump_status () 955connection::dump_status ()
775{ 956{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines