ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.37 by pcg, Tue Apr 19 03:47:32 2005 UTC vs.
Revision 1.53 by pcg, Fri Aug 15 17:50:10 2008 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
51void 73void
52vpn::script_init_env () 74vpn::script_init_env ()
53{ 75{
54 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
… …
75 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
76 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
77 } 99 }
78} 100}
79 101
102inline const char *
80const char *vpn::script_if_init () 103vpn::script_if_init ()
81{ 104{
82 script_init_env (); 105 script_init_env ();
83 106
84 return tap->if_up (); 107 return tap->if_up ();
85} 108}
86 109
110inline const char *
87const char *vpn::script_if_up () 111vpn::script_if_up ()
88{ 112{
89 script_init_env (); 113 script_init_env ();
90 114
91 char *filename; 115 char *filename;
92 asprintf (&filename, 116 asprintf (&filename,
… …
98} 122}
99 123
100int 124int
101vpn::setup () 125vpn::setup ()
102{ 126{
127 int success = 0;
128
129 ipv4_tos = -1;
103 ipv4_fd = -1; 130 ipv4_fd = -1;
104 131
105 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 132 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106 { 133 {
107 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 134 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
108 135
… …
124 151
125 sockinfo si (THISNODE, PROT_IPv4); 152 sockinfo si (THISNODE, PROT_IPv4);
126 153
127 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 154 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
128 { 155 {
129 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 156 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
130 exit (EXIT_FAILURE); 157 exit (EXIT_FAILURE);
131 } 158 }
132 159
133 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 160 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
161 ++success;
134 } 162 }
163 else
164 THISNODE->protocols &= ~PROT_IPv4;
135 165
166 udpv4_tos = -1;
136 udpv4_fd = -1; 167 udpv4_fd = -1;
137 168
138 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 169 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
139 { 170 {
140 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 171 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
141 172
… …
163 194
164 sockinfo si (THISNODE, PROT_UDPv4); 195 sockinfo si (THISNODE, PROT_UDPv4);
165 196
166 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
167 { 198 {
168 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
169 exit (EXIT_FAILURE); 200 exit (EXIT_FAILURE);
170 } 201 }
171 202
172 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 203 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
204 ++success;
173 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_UDPv4;
174 208
209 icmpv4_tos = -1;
175 icmpv4_fd = -1; 210 icmpv4_fd = -1;
176 211
177#if ENABLE_ICMP 212#if ENABLE_ICMP
178 if (THISNODE->protocols & PROT_ICMPv4) 213 if (THISNODE->protocols & PROT_ICMPv4)
179 { 214 {
180 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 215 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
… …
208 243
209 sockinfo si (THISNODE, PROT_ICMPv4); 244 sockinfo si (THISNODE, PROT_ICMPv4);
210 245
211 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 246 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
212 { 247 {
213 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 248 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
214 exit (EXIT_FAILURE); 249 exit (EXIT_FAILURE);
215 } 250 }
216 251
217 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 252 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
253 ++success;
218 } 254 }
219#endif 255#endif
220 256
221 tcpv4_fd = -1; 257 tcpv4_fd = -1;
222 258
… …
239 275
240 sockinfo si (THISNODE, PROT_TCPv4); 276 sockinfo si (THISNODE, PROT_TCPv4);
241 277
242 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 278 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
243 { 279 {
244 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 280 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
245 exit (EXIT_FAILURE); 281 exit (EXIT_FAILURE);
246 } 282 }
247 283
248 if (listen (tcpv4_fd, 5)) 284 if (listen (tcpv4_fd, 5))
249 { 285 {
250 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 286 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
251 exit (EXIT_FAILURE); 287 exit (EXIT_FAILURE);
252 } 288 }
253 289
254 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 290 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
291 ++success;
255 } 292 }
293 else
294 THISNODE->protocols &= ~PROT_TCPv4;
256#endif 295#endif
296
297 dnsv4_tos = -1;
298 dnsv4_fd = -1;
257 299
258#if ENABLE_DNS 300#if ENABLE_DNS
259 if (THISNODE->protocols & PROT_DNSv4) 301 if (THISNODE->protocols & PROT_DNSv4)
260 { 302 {
261 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 303 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
… …
288 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 330 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
289 PROT_DNSv4); 331 PROT_DNSv4);
290 332
291 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 333 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
292 { 334 {
293 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 335 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
294 exit (EXIT_FAILURE); 336 exit (EXIT_FAILURE);
295 } 337 }
296 338
297 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 339 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
340 ++success;
298 } 341 }
299#endif 342#endif
300 343
301 ///////////////////////////////////////////////////////////////////////////// 344 /////////////////////////////////////////////////////////////////////////////
345
346 if (!success)
347 {
348 slog (L_ERR, _("no protocols enabled, exiting."));
349 exit (EXIT_FAILURE);
350 }
302 351
303 reconnect_all (); 352 reconnect_all ();
304 353
305 ///////////////////////////////////////////////////////////////////////////// 354 /////////////////////////////////////////////////////////////////////////////
306 355
307 tap = new tap_device (); 356 tap = new tap_device ();
308 if (!tap) //D this, of course, never catches 357 if (!tap) //D this, of course, never catches
309 { 358 {
310 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 359 slog (L_ERR, _("cannot create network interface '%s', exiting."), conf.ifname);
311 exit (EXIT_FAILURE); 360 exit (EXIT_FAILURE);
312 } 361 }
313 362
314 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 363 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
315 364
365 run_script_cb cb;
366 cb.set<vpn, &vpn::script_if_init> (this);
367
316 if (tap->if_up () && 368 if (tap->if_up () &&
317 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 369 !run_script (cb, true))
318 { 370 {
319 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 371 slog (L_ERR, _("interface initialization command '%s' failed, exiting."),
320 tap->if_up ()); 372 tap->if_up ());
321 exit (EXIT_FAILURE); 373 exit (EXIT_FAILURE);
322 } 374 }
323 375
324 if (!run_script (run_script_cb (this, &vpn::script_if_up), true)) 376 cb.set<vpn, &vpn::script_if_up> (this);
377 if (!run_script (cb, true))
325 { 378 {
326 slog (L_ERR, _("if-up command execution failed, exiting.")); 379 slog (L_ERR, _("if-up command execution failed, exiting."));
327 exit (EXIT_FAILURE); 380 exit (EXIT_FAILURE);
328 } 381 }
329 382
330 tap_ev_watcher.start (tap->fd, EVENT_READ); 383 tap_ev_watcher.start (tap->fd, EV_READ);
331 384
332 return 0; 385 return 0;
333} 386}
334 387
335bool 388bool
336vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 389vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
337{ 390{
338#if defined(SOL_IP) && defined(IP_TOS) 391 set_tos (ipv4_fd, ipv4_tos, tos);
339 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
340#endif
341 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 392 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
342 393
343 return true; 394 return true;
344} 395}
345 396
… …
368 419
369#if ENABLE_ICMP 420#if ENABLE_ICMP
370bool 421bool
371vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 422vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
372{ 423{
373#if defined(SOL_IP) && defined(IP_TOS)
374 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
375#endif
376
377 pkt->unshift_hdr (4); 424 pkt->unshift_hdr (4);
378 425
379 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 426 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
380 hdr->type = ::conf.icmp_type; 427 hdr->type = ::conf.icmp_type;
381 hdr->code = 255; 428 hdr->code = 255;
382 hdr->checksum = 0; 429 hdr->checksum = 0;
383 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 430 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
384 431
432 set_tos (icmpv4_fd, icmpv4_tos, tos);
385 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 433 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
386 434
387 return true; 435 return true;
388} 436}
389#endif 437#endif
390 438
391bool 439bool
392vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 440vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
393{ 441{
394#if defined(SOL_IP) && defined(IP_TOS) 442 set_tos (udpv4_fd, udpv4_tos, tos);
395 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
396#endif
397 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 443 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
398 444
399 return true; 445 return true;
400} 446}
401 447
… …
412 { 458 {
413 // broadcast, this is ugly, but due to the security policy 459 // broadcast, this is ugly, but due to the security policy
414 // we have to connect to all hosts... 460 // we have to connect to all hosts...
415 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 461 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
416 if ((*c)->conf != THISNODE) 462 if ((*c)->conf != THISNODE)
417 (*c)->inject_data_packet (pkt, true); 463 (*c)->inject_data_packet (pkt);
418 } 464 }
419} 465}
420 466
421void 467void
422vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 468vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
423{ 469{
424 unsigned int src = pkt->src (); 470 unsigned int src = pkt->src ();
425 unsigned int dst = pkt->dst (); 471 unsigned int dst = pkt->dst ();
426 472
427 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 473 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
428 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 474 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
429 475
430 if (src == 0 || src > conns.size () 476 if (src == 0 || src > conns.size ()
431 || dst > conns.size () 477 || dst > conns.size ()
432 || pkt->typ () >= vpn_packet::PT_MAX) 478 || pkt->typ () >= vpn_packet::PT_MAX)
433 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 479 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
434 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 480 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
435 else if (dst > conns.size ()) 481 else if (dst > conns.size ())
436 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 482 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
437 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 483 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
438 else 484 else
439 { 485 {
440 connection *c = conns[src - 1]; 486 connection *c = conns[src - 1];
441 487
442 if (dst == 0) 488 if (dst == 0)
443 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 489 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
444 c->conf->nodename, (const char *)rsi); 490 c->conf->nodename, (const char *)rsi);
445 else if (dst != THISNODE->id) 491 else if (dst != THISNODE->id)
446 { 492 {
447 if (THISNODE->routerprio) 493 if (THISNODE->routerprio)
448 // the tos setting gets lost here. who cares. 494 // the tos setting gets lost here. who cares.
449 conns[dst - 1]->inject_vpn_packet (pkt); 495 conns[dst - 1]->inject_vpn_packet (pkt);
450 else 496 else
451 slog (L_WARN, 497 slog (L_WARN,
452 _("%s(%s): forwarding request (=> %s), but we are no router"), 498 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
453 c->conf->nodename, (const char *)rsi, 499 c->conf->nodename, (const char *)rsi,
454 conns[dst - 1]->conf->nodename); 500 conns[dst - 1]->conf->nodename);
455 } 501 }
456 else 502 else
457 c->recv_vpn_packet (pkt, rsi); 503 c->recv_vpn_packet (pkt, rsi);
… …
463{ 509{
464 switch (si.prot) 510 switch (si.prot)
465 { 511 {
466 case PROT_IPv4: 512 case PROT_IPv4:
467 return send_ipv4_packet (pkt, si, tos); 513 return send_ipv4_packet (pkt, si, tos);
514
468 case PROT_UDPv4: 515 case PROT_UDPv4:
469 return send_udpv4_packet (pkt, si, tos); 516 return send_udpv4_packet (pkt, si, tos);
517
470#if ENABLE_TCP 518#if ENABLE_TCP
471 case PROT_TCPv4: 519 case PROT_TCPv4:
472 return send_tcpv4_packet (pkt, si, tos); 520 return send_tcpv4_packet (pkt, si, tos);
473#endif 521#endif
474#if ENABLE_ICMP 522#if ENABLE_ICMP
… …
477#endif 525#endif
478#if ENABLE_DNS 526#if ENABLE_DNS
479 case PROT_DNSv4: 527 case PROT_DNSv4:
480 return send_dnsv4_packet (pkt, si, tos); 528 return send_dnsv4_packet (pkt, si, tos);
481#endif 529#endif
482
483 default: 530 default:
484 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 531 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
485 } 532 }
486 533
487 return false; 534 return false;
488} 535}
489 536
490void 537inline void
491vpn::ipv4_ev (io_watcher &w, short revents) 538vpn::ipv4_ev (ev::io &w, int revents)
492{ 539{
493 if (revents & EVENT_READ) 540 if (revents & EV_READ)
494 { 541 {
495 vpn_packet *pkt = new vpn_packet; 542 vpn_packet *pkt = new vpn_packet;
496 struct sockaddr_in sa; 543 struct sockaddr_in sa;
497 socklen_t sa_len = sizeof (sa); 544 socklen_t sa_len = sizeof (sa);
498 int len; 545 int len;
… …
511 recv_vpn_packet (pkt, si); 558 recv_vpn_packet (pkt, si);
512 } 559 }
513 else 560 else
514 { 561 {
515 // probably ECONNRESET or somesuch 562 // probably ECONNRESET or somesuch
516 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 563 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
517 } 564 }
518 565
519 delete pkt; 566 delete pkt;
520 } 567 }
521 else 568 else
522 { 569 {
523 slog (L_ERR, 570 slog (L_ERR,
524 _("FATAL: unknown revents %08x in socket, terminating\n"), 571 _("FATAL: unknown revents %08x in socket, exiting.\n"),
525 revents); 572 revents);
526 exit (EXIT_FAILURE); 573 exit (EXIT_FAILURE);
527 } 574 }
528} 575}
529 576
530#if ENABLE_ICMP 577#if ENABLE_ICMP
531void 578inline void
532vpn::icmpv4_ev (io_watcher &w, short revents) 579vpn::icmpv4_ev (ev::io &w, int revents)
533{ 580{
534 if (revents & EVENT_READ) 581 if (revents & EV_READ)
535 { 582 {
536 vpn_packet *pkt = new vpn_packet; 583 vpn_packet *pkt = new vpn_packet;
537 struct sockaddr_in sa; 584 struct sockaddr_in sa;
538 socklen_t sa_len = sizeof (sa); 585 socklen_t sa_len = sizeof (sa);
539 int len; 586 int len;
… …
559 } 606 }
560 } 607 }
561 else 608 else
562 { 609 {
563 // probably ECONNRESET or somesuch 610 // probably ECONNRESET or somesuch
564 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 611 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
565 } 612 }
566 613
567 delete pkt; 614 delete pkt;
568 } 615 }
569 else 616 else
570 { 617 {
571 slog (L_ERR, 618 slog (L_ERR,
572 _("FATAL: unknown revents %08x in socket, terminating\n"), 619 _("FATAL: unknown revents %08x in socket, exiting.\n"),
573 revents); 620 revents);
574 exit (EXIT_FAILURE); 621 exit (EXIT_FAILURE);
575 } 622 }
576} 623}
577#endif 624#endif
578 625
579void 626inline void
580vpn::udpv4_ev (io_watcher &w, short revents) 627vpn::udpv4_ev (ev::io &w, int revents)
581{ 628{
582 if (revents & EVENT_READ) 629 if (revents & EV_READ)
583 { 630 {
584 vpn_packet *pkt = new vpn_packet; 631 vpn_packet *pkt = new vpn_packet;
585 struct sockaddr_in sa; 632 struct sockaddr_in sa;
586 socklen_t sa_len = sizeof (sa); 633 socklen_t sa_len = sizeof (sa);
587 int len; 634 int len;
… …
597 recv_vpn_packet (pkt, si); 644 recv_vpn_packet (pkt, si);
598 } 645 }
599 else 646 else
600 { 647 {
601 // probably ECONNRESET or somesuch 648 // probably ECONNRESET or somesuch
602 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 649 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
603 } 650 }
604 651
605 delete pkt; 652 delete pkt;
606 } 653 }
607 else 654 else
608 { 655 {
609 slog (L_ERR, 656 slog (L_ERR,
610 _("FATAL: unknown revents %08x in socket, terminating\n"), 657 _("FATAL: unknown revents %08x in socket, exiting.\n"),
611 revents); 658 revents);
612 exit (EXIT_FAILURE); 659 exit (EXIT_FAILURE);
613 } 660 }
614} 661}
615 662
616void 663inline void
617vpn::tap_ev (io_watcher &w, short revents) 664vpn::tap_ev (ev::io &w, int revents)
618{ 665{
619 if (revents & EVENT_READ) 666 if (revents & EV_READ)
620 { 667 {
621 /* process data */ 668 /* process data */
622 tap_packet *pkt; 669 tap_packet *pkt;
623 670
624 pkt = tap->recv (); 671 pkt = tap->recv ();
… …
653 } 700 }
654 else 701 else
655 abort (); 702 abort ();
656} 703}
657 704
658void 705inline void
659vpn::event_cb (time_watcher &w) 706vpn::event_cb (ev::timer &w, int)
660{ 707{
661 if (events) 708 if (events)
662 { 709 {
663 if (events & EVENT_SHUTDOWN) 710 if (events & EVENT_SHUTDOWN)
664 { 711 {
665 slog (L_INFO, _("preparing shutdown...")); 712 slog (L_INFO, _("preparing shutdown..."));
666 713
667 shutdown_all (); 714 shutdown_all ();
668 remove_pid (conf.pidfilename); 715 remove_pid (conf.pidfilename);
669 slog (L_INFO, _("terminating")); 716 slog (L_INFO, _("exiting."));
670 exit (EXIT_SUCCESS); 717 exit (EXIT_SUCCESS);
671 } 718 }
672 719
673 if (events & EVENT_RECONNECT) 720 if (events & EVENT_RECONNECT)
674 { 721 {
675 slog (L_INFO, _("forced reconnect")); 722 slog (L_INFO, _("forced reconnect."));
676 723
677 reconnect_all (); 724 reconnect_all ();
678 } 725 }
679 726
680 events = 0; 727 events = 0;
… …
696 743
697 conns.clear (); 744 conns.clear ();
698 745
699 connection_init (); 746 connection_init ();
700 747
701 for (configuration::node_vector::iterator i = conf.nodes.begin (); 748 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
702 i != conf.nodes.end (); ++i) 749 conns.push_back (new connection (this, *i));
703 { 750
704 connection *conn = new connection (this, *i); 751 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
705 conns.push_back (conn);
706 conn->establish_connection (); 752 (*c)->establish_connection ();
707 }
708} 753}
709 754
710connection *vpn::find_router () 755bool vpn::can_direct (conf_node *src, conf_node *dst) const
711{ 756{
712 u32 prio = 1; 757 return src != dst
758 && src->may_direct (dst)
759 && dst->may_direct (src)
760 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
761 || (src->protocols & dst->connectable_protocols ()));
762}
763
764// only works for indirect and routed connections: find a router
765// from THISNODE to dst
766connection *vpn::find_router_for (const connection *dst)
767{
713 connection *router = 0; 768 connection *router = 0;
714 769
770 // first try to find a router with a direct connection, route there
771 // regardless of any other considerations.
772 {
773 u32 prio = 1;
774
775 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
776 {
777 connection *c = *i;
778
779 if (c->conf->routerprio > prio
780 && c->conf != THISNODE
781 && can_direct (c->conf, dst->conf)
782 && c->ictx && c->octx)
783 {
784 prio = c->conf->routerprio;
785 router = c;
786 }
787 }
788 }
789
790 if (router)
791 return router;
792
793 // second try find the router with the highest priority, higher than ours
794 {
795 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
796
797 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
798 {
799 connection *c = *i;
800
801 if (c->conf->routerprio > prio
802 && c != dst
803 && c->conf != THISNODE
804 && c->ictx && c->octx)
805 {
806 prio = c->conf->routerprio;
807 router = c;
808 }
809 }
810 }
811
812 return router;
813}
814
815void vpn::connection_established (connection *c)
816{
715 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 817 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
716 { 818 {
717 connection *c = *i; 819 connection *o = *i;
718 820
719 if (c->conf->routerprio > prio 821 if (!o->is_direct
720 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 822 && o->si.valid ()
721 && c->ictx && c->octx 823 && c->si != o->si
722 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 824 && c == find_router_for (o))
723 {
724 prio = c->conf->routerprio;
725 router = c;
726 } 825 {
826 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
827 o->conf->nodename, c->conf->nodename);
828 o->rekey ();
829 }
727 } 830 }
728
729 return router;
730} 831}
731 832
732void vpn::send_connect_request (int id) 833void vpn::send_connect_request (connection *c)
733{ 834{
734 connection *c = find_router (); 835 connection *r = find_router_for (c);
735 836
736 if (c) 837 if (r)
838 {
839 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
840 c->conf->nodename, r->conf->nodename);
737 c->send_connect_request (id); 841 r->send_connect_request (c->conf->id);
842 }
738 else 843 else
739 // no router found, aggressively connect to all routers 844 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
740 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 845 c->conf->nodename);
741 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
742 (*i)->establish_connection ();
743} 846}
744 847
745void 848void
746connection::dump_status () 849connection::dump_status ()
747{ 850{
748 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 851 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
749 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 852 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
750 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 853 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
751 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 854 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
752 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 855 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
753 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
754 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
755} 856}
756 857
757void 858void
758vpn::dump_status () 859vpn::dump_status ()
759{ 860{
760 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 861 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
761 862
762 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 863 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
763 (*c)->dump_status (); 864 (*c)->dump_status ();
764 865
765 slog (L_NOTICE, _("END status dump")); 866 slog (L_NOTICE, _("END status dump"));
766} 867}
767 868
768vpn::vpn (void) 869vpn::vpn (void)
870{
769: event (this, &vpn::event_cb) 871 event .set<vpn, &vpn::event_cb > (this);
770, udpv4_ev_watcher (this, &vpn::udpv4_ev) 872 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
771, ipv4_ev_watcher (this, &vpn::ipv4_ev) 873 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
772#if ENABLE_TCP 874#if ENABLE_TCP
773, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 875 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
774#endif 876#endif
775#if ENABLE_ICMP 877#if ENABLE_ICMP
776, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 878 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
777#endif 879#endif
778#if ENABLE_DNS 880#if ENABLE_DNS
779, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 881 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
780#endif 882#endif
781, tap_ev_watcher (this, &vpn::tap_ev) 883 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
782{
783} 884}
784 885
785vpn::~vpn () 886vpn::~vpn ()
786{ 887{
787} 888}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines