ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.35 by pcg, Fri Apr 8 16:12:49 2005 UTC vs.
Revision 1.49 by pcg, Sun Aug 10 01:34:36 2008 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
51void 73void
52vpn::script_init_env () 74vpn::script_init_env ()
53{ 75{
54 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
… …
75 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
76 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
77 } 99 }
78} 100}
79 101
102inline const char *
80const char *vpn::script_if_init () 103vpn::script_if_init ()
81{ 104{
82 script_init_env (); 105 script_init_env ();
83 106
84 return tap->if_up (); 107 return tap->if_up ();
85} 108}
86 109
110inline const char *
87const char *vpn::script_if_up () 111vpn::script_if_up ()
88{ 112{
89 script_init_env (); 113 script_init_env ();
90 114
91 char *filename; 115 char *filename;
92 asprintf (&filename, 116 asprintf (&filename,
… …
98} 122}
99 123
100int 124int
101vpn::setup () 125vpn::setup ()
102{ 126{
127 ipv4_tos = -1;
103 ipv4_fd = -1; 128 ipv4_fd = -1;
104 129
105 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 130 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106 { 131 {
107 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 132 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
108 133
109 if (ipv4_fd < 0) 134 if (ipv4_fd < 0)
110 return -1; 135 return -1;
111 136
112 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK); 137 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
138 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
113 139
114#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 140#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
115 // this I really consider a linux bug. I am neither connected 141 // this I really consider a linux bug. I am neither connected
116 // nor do I fragment myself. Linux still sets DF and doesn't 142 // nor do I fragment myself. Linux still sets DF and doesn't
117 // fragment for me sometimes. 143 // fragment for me sometimes.
… …
123 149
124 sockinfo si (THISNODE, PROT_IPv4); 150 sockinfo si (THISNODE, PROT_IPv4);
125 151
126 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 152 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
127 { 153 {
128 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 154 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
129 exit (EXIT_FAILURE); 155 exit (EXIT_FAILURE);
130 } 156 }
131 157
132 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 158 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
133 } 159 }
134 160
161 udpv4_tos = -1;
135 udpv4_fd = -1; 162 udpv4_fd = -1;
136 163
137 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 164 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
138 { 165 {
139 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 166 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
140 167
141 if (udpv4_fd < 0) 168 if (udpv4_fd < 0)
142 return -1; 169 return -1;
143 170
144 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK); 171 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
172 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
145 173
146 // standard daemon practise... 174 // standard daemon practise...
147 { 175 {
148 int oval = 1; 176 int oval = 1;
149 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 177 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
161 189
162 sockinfo si (THISNODE, PROT_UDPv4); 190 sockinfo si (THISNODE, PROT_UDPv4);
163 191
164 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 192 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
165 { 193 {
166 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 194 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
167 exit (EXIT_FAILURE); 195 exit (EXIT_FAILURE);
168 } 196 }
169 197
170 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 198 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
171 } 199 }
172 200
201 icmpv4_tos = -1;
173 icmpv4_fd = -1; 202 icmpv4_fd = -1;
174 203
175#if ENABLE_ICMP 204#if ENABLE_ICMP
176 if (THISNODE->protocols & PROT_ICMPv4) 205 if (THISNODE->protocols & PROT_ICMPv4)
177 { 206 {
178 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 207 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
179 208
180 if (icmpv4_fd < 0) 209 if (icmpv4_fd < 0)
181 return -1; 210 return -1;
182 211
183 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK); 212 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
213 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
184 214
185#ifdef ICMP_FILTER 215#ifdef ICMP_FILTER
186 { 216 {
187 icmp_filter oval; 217 icmp_filter oval;
188 oval.data = 0xffffffff; 218 oval.data = 0xffffffff;
… …
197 // this I really consider a linux bug. I am neither connected 227 // this I really consider a linux bug. I am neither connected
198 // nor do I fragment myself. Linux still sets DF and doesn't 228 // nor do I fragment myself. Linux still sets DF and doesn't
199 // fragment for me sometimes. 229 // fragment for me sometimes.
200 { 230 {
201 int oval = IP_PMTUDISC_DONT; 231 int oval = IP_PMTUDISC_DONT;
202 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 232 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
203 } 233 }
204#endif 234#endif
205 235
206 sockinfo si (THISNODE, PROT_ICMPv4); 236 sockinfo si (THISNODE, PROT_ICMPv4);
207 237
208 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 238 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
209 { 239 {
210 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 240 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
211 exit (EXIT_FAILURE); 241 exit (EXIT_FAILURE);
212 } 242 }
213 243
214 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 244 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
215 } 245 }
216#endif 246#endif
217 247
218 tcpv4_fd = -1; 248 tcpv4_fd = -1;
219 249
… …
224 254
225 if (tcpv4_fd < 0) 255 if (tcpv4_fd < 0)
226 return -1; 256 return -1;
227 257
228 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK); 258 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
259 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
229 260
230 // standard daemon practise... 261 // standard daemon practise...
231 { 262 {
232 int oval = 1; 263 int oval = 1;
233 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 264 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
235 266
236 sockinfo si (THISNODE, PROT_TCPv4); 267 sockinfo si (THISNODE, PROT_TCPv4);
237 268
238 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 269 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
239 { 270 {
240 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 271 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
241 exit (EXIT_FAILURE); 272 exit (EXIT_FAILURE);
242 } 273 }
243 274
244 if (listen (tcpv4_fd, 5)) 275 if (listen (tcpv4_fd, 5))
245 { 276 {
246 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 277 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
247 exit (EXIT_FAILURE); 278 exit (EXIT_FAILURE);
248 } 279 }
249 280
250 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 281 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
251 } 282 }
252#endif 283#endif
284
285 dnsv4_tos = -1;
286 dnsv4_fd = -1;
253 287
254#if ENABLE_DNS 288#if ENABLE_DNS
255 if (THISNODE->protocols & PROT_DNSv4) 289 if (THISNODE->protocols & PROT_DNSv4)
256 { 290 {
257 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 291 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
258 292
259 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 293 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
260 294
261 if (dnsv4_fd < 0) 295 if (dnsv4_fd < 0)
262 return -1; 296 return -1;
297
298 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
299 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
263 300
264# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 301# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
265 // this I really consider a linux bug. I am neither connected 302 // this I really consider a linux bug. I am neither connected
266 // nor do I fragment myself. Linux still sets DF and doesn't 303 // nor do I fragment myself. Linux still sets DF and doesn't
267 // fragment for me sometimes. 304 // fragment for me sometimes.
… …
281 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 318 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
282 PROT_DNSv4); 319 PROT_DNSv4);
283 320
284 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 321 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
285 { 322 {
286 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 323 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
287 exit (EXIT_FAILURE); 324 exit (EXIT_FAILURE);
288 } 325 }
289 326
290 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 327 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
291 } 328 }
292#endif 329#endif
293 330
294 ///////////////////////////////////////////////////////////////////////////// 331 /////////////////////////////////////////////////////////////////////////////
295 332
… …
298 ///////////////////////////////////////////////////////////////////////////// 335 /////////////////////////////////////////////////////////////////////////////
299 336
300 tap = new tap_device (); 337 tap = new tap_device ();
301 if (!tap) //D this, of course, never catches 338 if (!tap) //D this, of course, never catches
302 { 339 {
303 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 340 slog (L_ERR, _("cannot create network interface '%s', exiting."), conf.ifname);
304 exit (EXIT_FAILURE); 341 exit (EXIT_FAILURE);
305 } 342 }
306 343
344 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
345
346 run_script_cb cb;
347 cb.set<vpn, &vpn::script_if_init> (this);
348
307 if (tap->if_up () && 349 if (tap->if_up () &&
308 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 350 !run_script (cb, true))
309 { 351 {
310 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 352 slog (L_ERR, _("interface initialization command '%s' failed, exiting."),
311 tap->if_up ()); 353 tap->if_up ());
312 exit (EXIT_FAILURE); 354 exit (EXIT_FAILURE);
313 } 355 }
314 356
315 if (!run_script (run_script_cb (this, &vpn::script_if_up), true)) 357 cb.set<vpn, &vpn::script_if_up> (this);
358 if (!run_script (cb, true))
316 { 359 {
317 slog (L_ERR, _("if-up command execution failed, exiting.")); 360 slog (L_ERR, _("if-up command execution failed, exiting."));
318 exit (EXIT_FAILURE); 361 exit (EXIT_FAILURE);
319 } 362 }
320 363
321 tap_ev_watcher.start (tap->fd, EVENT_READ); 364 tap_ev_watcher.start (tap->fd, EV_READ);
322 365
323 return 0; 366 return 0;
324} 367}
325 368
326bool 369bool
327vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 370vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
328{ 371{
329#if defined(SOL_IP) && defined(IP_TOS) 372 set_tos (ipv4_fd, ipv4_tos, tos);
330 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
331#endif
332 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 373 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
333 374
334 return true; 375 return true;
335} 376}
336 377
… …
359 400
360#if ENABLE_ICMP 401#if ENABLE_ICMP
361bool 402bool
362vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 403vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
363{ 404{
364#if defined(SOL_IP) && defined(IP_TOS)
365 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
366#endif
367
368 pkt->unshift_hdr (4); 405 pkt->unshift_hdr (4);
369 406
370 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 407 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
371 hdr->type = ::conf.icmp_type; 408 hdr->type = ::conf.icmp_type;
372 hdr->code = 255; 409 hdr->code = 255;
373 hdr->checksum = 0; 410 hdr->checksum = 0;
374 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 411 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
375 412
413 set_tos (icmpv4_fd, icmpv4_tos, tos);
376 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 414 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
377 415
378 return true; 416 return true;
379} 417}
380#endif 418#endif
381 419
382bool 420bool
383vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 421vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
384{ 422{
385#if defined(SOL_IP) && defined(IP_TOS) 423 set_tos (udpv4_fd, udpv4_tos, tos);
386 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
387#endif
388 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 424 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
389 425
390 return true; 426 return true;
391} 427}
392 428
… …
403 { 439 {
404 // broadcast, this is ugly, but due to the security policy 440 // broadcast, this is ugly, but due to the security policy
405 // we have to connect to all hosts... 441 // we have to connect to all hosts...
406 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 442 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
407 if ((*c)->conf != THISNODE) 443 if ((*c)->conf != THISNODE)
408 (*c)->inject_data_packet (pkt, true); 444 (*c)->inject_data_packet (pkt);
409 } 445 }
410} 446}
411 447
412void 448void
413vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 449vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
414{ 450{
415 unsigned int src = pkt->src (); 451 unsigned int src = pkt->src ();
416 unsigned int dst = pkt->dst (); 452 unsigned int dst = pkt->dst ();
417 453
418 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 454 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
419 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 455 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
420 456
421 if (src == 0 || src > conns.size () 457 if (src == 0 || src > conns.size ()
422 || dst > conns.size () 458 || dst > conns.size ()
423 || pkt->typ () >= vpn_packet::PT_MAX) 459 || pkt->typ () >= vpn_packet::PT_MAX)
424 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 460 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
425 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 461 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
426 else if (dst > conns.size ()) 462 else if (dst > conns.size ())
427 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 463 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
428 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 464 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
429 else 465 else
430 { 466 {
431 connection *c = conns[src - 1]; 467 connection *c = conns[src - 1];
432 468
433 if (dst == 0) 469 if (dst == 0)
434 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 470 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
435 c->conf->nodename, (const char *)rsi); 471 c->conf->nodename, (const char *)rsi);
436 else if (dst != THISNODE->id) 472 else if (dst != THISNODE->id)
437 { 473 {
438 if (THISNODE->routerprio) 474 if (THISNODE->routerprio)
439 // the tos setting gets lost here. who cares. 475 // the tos setting gets lost here. who cares.
440 conns[dst - 1]->inject_vpn_packet (pkt); 476 conns[dst - 1]->inject_vpn_packet (pkt);
441 else 477 else
442 slog (L_WARN, 478 slog (L_WARN,
443 _("%s(%s): forwarding request (=> %s), but we are no router"), 479 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
444 c->conf->nodename, (const char *)rsi, 480 c->conf->nodename, (const char *)rsi,
445 conns[dst - 1]->conf->nodename); 481 conns[dst - 1]->conf->nodename);
446 } 482 }
447 else 483 else
448 c->recv_vpn_packet (pkt, rsi); 484 c->recv_vpn_packet (pkt, rsi);
… …
454{ 490{
455 switch (si.prot) 491 switch (si.prot)
456 { 492 {
457 case PROT_IPv4: 493 case PROT_IPv4:
458 return send_ipv4_packet (pkt, si, tos); 494 return send_ipv4_packet (pkt, si, tos);
495
459 case PROT_UDPv4: 496 case PROT_UDPv4:
460 return send_udpv4_packet (pkt, si, tos); 497 return send_udpv4_packet (pkt, si, tos);
498
461#if ENABLE_TCP 499#if ENABLE_TCP
462 case PROT_TCPv4: 500 case PROT_TCPv4:
463 return send_tcpv4_packet (pkt, si, tos); 501 return send_tcpv4_packet (pkt, si, tos);
464#endif 502#endif
465#if ENABLE_ICMP 503#if ENABLE_ICMP
… …
468#endif 506#endif
469#if ENABLE_DNS 507#if ENABLE_DNS
470 case PROT_DNSv4: 508 case PROT_DNSv4:
471 return send_dnsv4_packet (pkt, si, tos); 509 return send_dnsv4_packet (pkt, si, tos);
472#endif 510#endif
473
474 default: 511 default:
475 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 512 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
476 } 513 }
477 514
478 return false; 515 return false;
479} 516}
480 517
481void 518inline void
482vpn::ipv4_ev (io_watcher &w, short revents) 519vpn::ipv4_ev (ev::io &w, int revents)
483{ 520{
484 if (revents & EVENT_READ) 521 if (revents & EV_READ)
485 { 522 {
486 vpn_packet *pkt = new vpn_packet; 523 vpn_packet *pkt = new vpn_packet;
487 struct sockaddr_in sa; 524 struct sockaddr_in sa;
488 socklen_t sa_len = sizeof (sa); 525 socklen_t sa_len = sizeof (sa);
489 int len; 526 int len;
… …
502 recv_vpn_packet (pkt, si); 539 recv_vpn_packet (pkt, si);
503 } 540 }
504 else 541 else
505 { 542 {
506 // probably ECONNRESET or somesuch 543 // probably ECONNRESET or somesuch
507 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 544 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
508 } 545 }
509 546
510 delete pkt; 547 delete pkt;
511 } 548 }
512 else 549 else
513 { 550 {
514 slog (L_ERR, 551 slog (L_ERR,
515 _("FATAL: unknown revents %08x in socket, terminating\n"), 552 _("FATAL: unknown revents %08x in socket, exiting.\n"),
516 revents); 553 revents);
517 exit (EXIT_FAILURE); 554 exit (EXIT_FAILURE);
518 } 555 }
519} 556}
520 557
521#if ENABLE_ICMP 558#if ENABLE_ICMP
522void 559inline void
523vpn::icmpv4_ev (io_watcher &w, short revents) 560vpn::icmpv4_ev (ev::io &w, int revents)
524{ 561{
525 if (revents & EVENT_READ) 562 if (revents & EV_READ)
526 { 563 {
527 vpn_packet *pkt = new vpn_packet; 564 vpn_packet *pkt = new vpn_packet;
528 struct sockaddr_in sa; 565 struct sockaddr_in sa;
529 socklen_t sa_len = sizeof (sa); 566 socklen_t sa_len = sizeof (sa);
530 int len; 567 int len;
… …
550 } 587 }
551 } 588 }
552 else 589 else
553 { 590 {
554 // probably ECONNRESET or somesuch 591 // probably ECONNRESET or somesuch
555 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 592 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
556 } 593 }
557 594
558 delete pkt; 595 delete pkt;
559 } 596 }
560 else 597 else
561 { 598 {
562 slog (L_ERR, 599 slog (L_ERR,
563 _("FATAL: unknown revents %08x in socket, terminating\n"), 600 _("FATAL: unknown revents %08x in socket, exiting.\n"),
564 revents); 601 revents);
565 exit (EXIT_FAILURE); 602 exit (EXIT_FAILURE);
566 } 603 }
567} 604}
568#endif 605#endif
569 606
570void 607inline void
571vpn::udpv4_ev (io_watcher &w, short revents) 608vpn::udpv4_ev (ev::io &w, int revents)
572{ 609{
573 if (revents & EVENT_READ) 610 if (revents & EV_READ)
574 { 611 {
575 vpn_packet *pkt = new vpn_packet; 612 vpn_packet *pkt = new vpn_packet;
576 struct sockaddr_in sa; 613 struct sockaddr_in sa;
577 socklen_t sa_len = sizeof (sa); 614 socklen_t sa_len = sizeof (sa);
578 int len; 615 int len;
… …
588 recv_vpn_packet (pkt, si); 625 recv_vpn_packet (pkt, si);
589 } 626 }
590 else 627 else
591 { 628 {
592 // probably ECONNRESET or somesuch 629 // probably ECONNRESET or somesuch
593 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 630 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
594 } 631 }
595 632
596 delete pkt; 633 delete pkt;
597 } 634 }
598 else 635 else
599 { 636 {
600 slog (L_ERR, 637 slog (L_ERR,
601 _("FATAL: unknown revents %08x in socket, terminating\n"), 638 _("FATAL: unknown revents %08x in socket, exiting.\n"),
602 revents); 639 revents);
603 exit (EXIT_FAILURE); 640 exit (EXIT_FAILURE);
604 } 641 }
605} 642}
606 643
607void 644inline void
608vpn::tap_ev (io_watcher &w, short revents) 645vpn::tap_ev (ev::io &w, int revents)
609{ 646{
610 if (revents & EVENT_READ) 647 if (revents & EV_READ)
611 { 648 {
612 /* process data */ 649 /* process data */
613 tap_packet *pkt; 650 tap_packet *pkt;
614 651
615 pkt = tap->recv (); 652 pkt = tap->recv ();
… …
644 } 681 }
645 else 682 else
646 abort (); 683 abort ();
647} 684}
648 685
649void 686inline void
650vpn::event_cb (time_watcher &w) 687vpn::event_cb (ev::timer &w, int)
651{ 688{
652 if (events) 689 if (events)
653 { 690 {
654 if (events & EVENT_SHUTDOWN) 691 if (events & EVENT_SHUTDOWN)
655 { 692 {
656 slog (L_INFO, _("preparing shutdown...")); 693 slog (L_INFO, _("preparing shutdown..."));
657 694
658 shutdown_all (); 695 shutdown_all ();
659 remove_pid (conf.pidfilename); 696 remove_pid (conf.pidfilename);
660 slog (L_INFO, _("terminating")); 697 slog (L_INFO, _("exiting."));
661 exit (EXIT_SUCCESS); 698 exit (EXIT_SUCCESS);
662 } 699 }
663 700
664 if (events & EVENT_RECONNECT) 701 if (events & EVENT_RECONNECT)
665 { 702 {
666 slog (L_INFO, _("forced reconnect")); 703 slog (L_INFO, _("forced reconnect."));
667 704
668 reconnect_all (); 705 reconnect_all ();
669 } 706 }
670 707
671 events = 0; 708 events = 0;
… …
696 conns.push_back (conn); 733 conns.push_back (conn);
697 conn->establish_connection (); 734 conn->establish_connection ();
698 } 735 }
699} 736}
700 737
701connection *vpn::find_router () 738bool vpn::can_direct (conf_node *src, conf_node *dst) const
702{ 739{
703 u32 prio = 1; 740 return src != dst
741 && src->may_direct (dst)
742 && dst->may_direct (src)
743 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
744 || (src->protocols & dst->connectable_protocols ()));
745}
746
747// only works for indirect and routed connections: find a router
748// from THISNODE to dst
749connection *vpn::find_router_for (const connection *dst)
750{
704 connection *router = 0; 751 connection *router = 0;
705 752
753 // first try to find a router with a direct connection
754 {
755 u32 prio = 1;
756
757 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
758 {
759 connection *c = *i;
760
761 if (c->conf->routerprio > prio
762 && c->conf != THISNODE
763 && c != dst
764 && can_direct (c->conf, dst->conf))
765 {
766 if (c->ictx && c->octx)
767 {
768 prio = c->conf->routerprio;
769 router = c;
770 }
771 else
772 c->establish_connection ();
773 }
774 }
775 }
776
777 if (router)
778 return router;
779
780 // second try find the router with the highest priority higher than ours
781 {
782 u32 prio = 1;
783
784 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
785 {
786 connection *c = *i;
787
788 if (c->conf->routerprio > prio
789 && c->conf->routerprio > THISNODE->routerprio
790 && c != dst
791 && c->conf != THISNODE)
792 {
793 if (c->ictx && c->octx)
794 {
795 prio = c->conf->routerprio;
796 router = c;
797 }
798 else
799 c->establish_connection ();
800 }
801 }
802 }
803 return router;
804}
805
806void vpn::connection_established (connection *c)
807{
706 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 808 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
707 { 809 {
708 connection *c = *i; 810 connection *o = *i;
709 811
710 if (c->conf->routerprio > prio 812 if (!o->is_direct
711 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 813 && o->si.valid ()
712 && c->ictx && c->octx 814 && c->si != o->si
713 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 815 && c == find_router_for (o))
714 {
715 prio = c->conf->routerprio;
716 router = c;
717 } 816 {
817 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
818 o->conf->nodename, c->conf->nodename);
819 o->rekey ();
820 }
718 } 821 }
719
720 return router;
721} 822}
722 823
723void vpn::send_connect_request (int id) 824void vpn::send_connect_request (int id)
724{ 825{
725 connection *c = find_router (); 826 connection *c = find_router_for (conns[id]);
726 827
727 if (c) 828 if (c)
829 {
830 slog (L_TRACE, _("%s: no way to connect, sending mediated connection request via %s."),
831 conns[id]->conf->nodename, c->conf->nodename);
728 c->send_connect_request (id); 832 c->send_connect_request (id);
833 }
729 else 834 else
730 // no router found, aggressively connect to all routers 835 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect."), conns[id]->conf->nodename);
731 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
732 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
733 (*i)->establish_connection ();
734} 836}
735 837
736void 838void
737connection::dump_status () 839connection::dump_status ()
738{ 840{
739 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 841 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
740 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 842 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
741 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 843 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
742 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 844 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
743 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 845 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
744 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
745 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
746} 846}
747 847
748void 848void
749vpn::dump_status () 849vpn::dump_status ()
750{ 850{
751 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 851 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
752 852
753 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 853 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
754 (*c)->dump_status (); 854 (*c)->dump_status ();
755 855
756 slog (L_NOTICE, _("END status dump")); 856 slog (L_NOTICE, _("END status dump"));
757} 857}
758 858
759vpn::vpn (void) 859vpn::vpn (void)
860{
760: event (this, &vpn::event_cb) 861 event .set<vpn, &vpn::event_cb > (this);
761, udpv4_ev_watcher (this, &vpn::udpv4_ev) 862 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
762, ipv4_ev_watcher (this, &vpn::ipv4_ev) 863 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
763#if ENABLE_TCP 864#if ENABLE_TCP
764, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 865 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
765#endif 866#endif
766#if ENABLE_ICMP 867#if ENABLE_ICMP
767, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 868 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
768#endif 869#endif
769#if ENABLE_DNS 870#if ENABLE_DNS
770, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 871 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
771#endif 872#endif
772, tap_ev_watcher (this, &vpn::tap_ev) 873 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
773{
774} 874}
775 875
776vpn::~vpn () 876vpn::~vpn ()
777{ 877{
778} 878}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines