ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.24 by pcg, Fri Apr 2 14:42:45 2004 UTC vs.
Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE.
6
5 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
6 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
7 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
8 (at your option) any later version. 10 option) any later version.
9 11
10 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
11 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
13 GNU General Public License for more details. 15 Public License for more details.
14 16
15 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
16 along with this program; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
17 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
18*/ 30*/
19 31
20#include "config.h" 32#include "config.h"
21 33
22#include <list> 34#include <list>
… …
44 56
45vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
46 58
47///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
48 60
49const char *vpn::script_if_up () 61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
73void
74vpn::script_init_env ()
50{ 75{
51 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
52 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
53 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 78 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
54 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 79 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
55 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
56 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
57 82
58 char *env; 83 char *env;
59 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
60 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
61 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
62 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
63 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 86 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
64 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 87 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
65 asprintf (&env, "MTU=%d", mtu); putenv (env); 88 asprintf (&env, "MTU=%d", mtu); putenv (env);
66 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 89 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
67 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 90 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
68 THISNODE->id & 0xff);
69 putenv (env);
70 91
92 conns [THISNODE->id - 1]->script_init_env ("");
93
94 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
95 {
96 char ext[16];
97 snprintf (ext, 16, "_%d", (*c)->conf->id);
98 (*c)->script_init_env (ext);
99 }
100}
101
102inline const char *
103vpn::script_if_init ()
104{
105 script_init_env ();
106
107 return tap->if_up ();
108}
109
110inline const char *
111vpn::script_if_up ()
112{
113 script_init_env ();
114
115 char *filename;
116 asprintf (&filename,
117 "%s/%s",
118 confbase,
71 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 119 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
120
121 return filename;
122}
123
124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 setsockopt (ipv4_fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark);
141#endif
142
143 return fd;
72} 144}
73 145
74int 146int
75vpn::setup () 147vpn::setup ()
76{ 148{
149 int success = 0;
150
151 ipv4_tos = -1;
77 ipv4_fd = -1; 152 ipv4_fd = -1;
78 153
79 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 154 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
80 { 155 {
81 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 156 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
82 157
83 if (ipv4_fd < 0) 158 if (ipv4_fd < 0)
84 return -1; 159 return -1;
85
86 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
87 160
88#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 161#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
89 // this I really consider a linux bug. I am neither connected 162 // this I really consider a linux bug. I am neither connected
90 // nor do I fragment myself. Linux still sets DF and doesn't 163 // nor do I fragment myself. Linux still sets DF and doesn't
91 // fragment for me sometimes. 164 // fragment for me sometimes.
… …
97 170
98 sockinfo si (THISNODE, PROT_IPv4); 171 sockinfo si (THISNODE, PROT_IPv4);
99 172
100 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 173 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
101 { 174 {
102 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 175 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
103 exit (EXIT_FAILURE); 176 return -1;
104 } 177 }
105 178
106 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 179 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
180 ++success;
107 } 181 }
182 else
183 THISNODE->protocols &= ~PROT_IPv4;
108 184
185 udpv4_tos = -1;
109 udpv4_fd = -1; 186 udpv4_fd = -1;
110 187
111 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 188 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
112 { 189 {
113 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 190 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
114 191
115 if (udpv4_fd < 0) 192 if (udpv4_fd < 0)
116 return -1; 193 return -1;
117
118 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
119 194
120 // standard daemon practise... 195 // standard daemon practise...
121 { 196 {
122 int oval = 1; 197 int oval = 1;
123 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 198 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
135 210
136 sockinfo si (THISNODE, PROT_UDPv4); 211 sockinfo si (THISNODE, PROT_UDPv4);
137 212
138 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 213 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
139 { 214 {
140 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 215 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
141 exit (EXIT_FAILURE); 216 return -1;
142 } 217 }
143 218
144 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 219 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
220 ++success;
145 } 221 }
222 else
223 THISNODE->protocols &= ~PROT_UDPv4;
146 224
225 icmpv4_tos = -1;
147 icmpv4_fd = -1; 226 icmpv4_fd = -1;
148 227
149#if ENABLE_ICMP 228#if ENABLE_ICMP
150 if (THISNODE->protocols & PROT_ICMPv4) 229 if (THISNODE->protocols & PROT_ICMPv4)
151 { 230 {
152 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 231 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
153 232
154 if (icmpv4_fd < 0) 233 if (icmpv4_fd < 0)
155 return -1; 234 return -1;
156
157 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
158 235
159#ifdef ICMP_FILTER 236#ifdef ICMP_FILTER
160 { 237 {
161 icmp_filter oval; 238 icmp_filter oval;
162 oval.data = 0xffffffff; 239 oval.data = 0xffffffff;
… …
171 // this I really consider a linux bug. I am neither connected 248 // this I really consider a linux bug. I am neither connected
172 // nor do I fragment myself. Linux still sets DF and doesn't 249 // nor do I fragment myself. Linux still sets DF and doesn't
173 // fragment for me sometimes. 250 // fragment for me sometimes.
174 { 251 {
175 int oval = IP_PMTUDISC_DONT; 252 int oval = IP_PMTUDISC_DONT;
176 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 253 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
177 } 254 }
178#endif 255#endif
179 256
180 sockinfo si (THISNODE, PROT_ICMPv4); 257 sockinfo si (THISNODE, PROT_ICMPv4);
181 258
182 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 259 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
183 { 260 {
184 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 261 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
185 exit (EXIT_FAILURE); 262 return -1;
186 } 263 }
187 264
188 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 265 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
266 ++success;
189 } 267 }
190#endif 268#endif
191 269
192 tcpv4_fd = -1; 270 tcpv4_fd = -1;
193 271
194#if ENABLE_TCP 272#if ENABLE_TCP
195 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 273 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
196 { 274 {
197 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 275 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
198 276
199 if (tcpv4_fd < 0) 277 if (tcpv4_fd < 0)
200 return -1; 278 return -1;
201 279
202 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
203
204 // standard daemon practise... 280 // standard daemon practise...
205 { 281 {
206 int oval = 1; 282 int oval = 1;
207 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 283 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
208 } 284 }
209 285
210 sockinfo si (THISNODE, PROT_TCPv4); 286 sockinfo si (THISNODE, PROT_TCPv4);
211 287
212 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 288 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
213 { 289 {
214 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 290 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
215 exit (EXIT_FAILURE); 291 return -1;
216 } 292 }
217 293
218 if (listen (tcpv4_fd, 5)) 294 if (listen (tcpv4_fd, 5))
219 { 295 {
220 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 296 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
221 exit (EXIT_FAILURE); 297 return -1;
222 } 298 }
223 299
224 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 300 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
301 ++success;
225 } 302 }
303 else
304 THISNODE->protocols &= ~PROT_TCPv4;
226#endif 305#endif
306
307 dnsv4_tos = -1;
308 dnsv4_fd = -1;
227 309
228#if ENABLE_DNS 310#if ENABLE_DNS
229 if (THISNODE->protocols & PROT_DNSv4) 311 if (THISNODE->protocols & PROT_DNSv4)
230 { 312 {
313 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
314
231 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 315 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
232 316
233 if (dnsv4_fd < 0) 317 if (dnsv4_fd < 0)
234 return -1; 318 return -1;
235 319
320# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
321 // this I really consider a linux bug. I am neither connected
322 // nor do I fragment myself. Linux still sets DF and doesn't
323 // fragment for me sometimes.
324 {
325 int oval = IP_PMTUDISC_DONT;
326 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
327 }
328# endif
329
236 // standard daemon practise... 330 // standard daemon practise...
237 { 331 {
238 int oval = 1; 332 int oval = 1;
239 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 333 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
240 } 334 }
241 335
242 sockinfo si (THISNODE, PROT_DNSv4); 336 sockinfo si (THISNODE->dns_hostname,
337 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
338 PROT_DNSv4);
243 339
244 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 340 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
245 { 341 {
246 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 342 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
247 exit (EXIT_FAILURE); 343 return -1;
248 } 344 }
249 345
250 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 346 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
347 ++success;
348 }
349#endif
350
351 /////////////////////////////////////////////////////////////////////////////
352
353 if (!success)
251 } 354 {
252#endif 355 slog (L_ERR, _("no protocols enabled."));
356 return -1;
357 }
358
359 reconnect_all ();
360
361 /////////////////////////////////////////////////////////////////////////////
253 362
254 tap = new tap_device (); 363 tap = new tap_device ();
255 if (!tap) //D this, of course, never catches 364 if (!tap) //D this, of course, never catches
256 { 365 {
257 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 366 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
258 exit (EXIT_FAILURE); 367 return -1;
259 } 368 }
260 369
261 run_script (run_script_cb (this, &vpn::script_if_up), true); 370 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
262 371
372 run_script_cb cb;
373 cb.set<vpn, &vpn::script_if_init> (this);
374
375 if (tap->if_up () &&
376 !run_script (cb, true))
377 {
378 slog (L_ERR, _("interface initialization command '%s' failed."),
379 tap->if_up ());
380 return -1;
381 }
382
383 cb.set<vpn, &vpn::script_if_up> (this);
384 if (!run_script (cb, true))
385 {
386 slog (L_ERR, _("if-up command execution failed."));
387 return -1;
388 }
389
263 tap_ev_watcher.start (tap->fd, EVENT_READ); 390 tap_ev_watcher.start (tap->fd, EV_READ);
264
265 reconnect_all ();
266 391
267 return 0; 392 return 0;
268}
269
270// send a vpn packet out to other hosts
271bool
272vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
273{
274 switch (si.prot)
275 {
276 case PROT_IPv4:
277 return send_ipv4_packet (pkt, si, tos);
278
279 case PROT_UDPv4:
280 return send_udpv4_packet (pkt, si, tos);
281
282#if ENABLE_TCP
283 case PROT_TCPv4:
284 return send_tcpv4_packet (pkt, si, tos);
285#endif
286
287#if ENABLE_ICMP
288 case PROT_ICMPv4:
289 return send_icmpv4_packet (pkt, si, tos);
290#endif
291
292#if ENABLE_DNS
293 case PROT_DNSv4:
294 return send_dnsv4_packet (pkt, si, tos);
295#endif
296
297 default:
298 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);
299 return false;
300 }
301} 393}
302 394
303bool 395bool
304vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 396vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
305{ 397{
306#if defined(SOL_IP) && defined(IP_TOS) 398 set_tos (ipv4_fd, ipv4_tos, tos);
307 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
308#endif
309 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 399 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
310 400
311 return true; 401 return true;
312} 402}
313 403
… …
336 426
337#if ENABLE_ICMP 427#if ENABLE_ICMP
338bool 428bool
339vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 429vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
340{ 430{
341#if defined(SOL_IP) && defined(IP_TOS)
342 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
343#endif
344
345 pkt->unshift_hdr (4); 431 pkt->unshift_hdr (4);
346 432
347 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 433 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
348 hdr->type = ::conf.icmp_type; 434 hdr->type = ::conf.icmp_type;
349 hdr->code = 255; 435 hdr->code = 255;
350 hdr->checksum = 0; 436 hdr->checksum = 0;
351 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 437 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
352 438
439 set_tos (icmpv4_fd, icmpv4_tos, tos);
353 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 440 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
354 441
355 return true; 442 return true;
356} 443}
357#endif 444#endif
358 445
359bool 446bool
360vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 447vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
361{ 448{
362#if defined(SOL_IP) && defined(IP_TOS) 449 set_tos (udpv4_fd, udpv4_tos, tos);
363 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
364#endif
365 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 450 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
366 451
367 return true; 452 return true;
368} 453}
369 454
… …
380 { 465 {
381 // broadcast, this is ugly, but due to the security policy 466 // broadcast, this is ugly, but due to the security policy
382 // we have to connect to all hosts... 467 // we have to connect to all hosts...
383 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 468 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
384 if ((*c)->conf != THISNODE) 469 if ((*c)->conf != THISNODE)
385 (*c)->inject_data_packet (pkt, true); 470 (*c)->inject_data_packet (pkt);
386 } 471 }
387} 472}
388 473
389void 474void
390vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 475vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
391{ 476{
392 unsigned int src = pkt->src (); 477 unsigned int src = pkt->src ();
393 unsigned int dst = pkt->dst (); 478 unsigned int dst = pkt->dst ();
394 479
395 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 480 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
396 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 481 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
397 482
398 if (src == 0 || src > conns.size () 483 if (src == 0 || src > conns.size ()
399 || dst > conns.size () 484 || dst > conns.size ()
400 || pkt->typ () >= vpn_packet::PT_MAX) 485 || pkt->typ () >= vpn_packet::PT_MAX)
401 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 486 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
402 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 487 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
403 else if (dst > conns.size ()) 488 else if (dst > conns.size ())
404 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 489 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
405 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 490 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
406 else 491 else
407 { 492 {
408 connection *c = conns[src - 1]; 493 connection *c = conns[src - 1];
409 494
410 if (dst == 0) 495 if (dst == 0)
411 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 496 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
412 c->conf->nodename, (const char *)rsi); 497 c->conf->nodename, (const char *)rsi);
413 else if (dst != THISNODE->id) 498 else if (dst != THISNODE->id)
414 { 499 {
415 if (THISNODE->routerprio) 500 if (THISNODE->routerprio)
416 // the tos setting gets lost here. who cares. 501 // the tos setting gets lost here. who cares.
417 conns[dst - 1]->inject_vpn_packet (pkt); 502 conns[dst - 1]->inject_vpn_packet (pkt);
418 else 503 else
419 slog (L_WARN, 504 slog (L_WARN,
420 _("%s(%s): forwarding request (=> %s), but we are no router"), 505 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
421 c->conf->nodename, (const char *)rsi, 506 c->conf->nodename, (const char *)rsi,
422 conns[dst - 1]->conf->nodename); 507 conns[dst - 1]->conf->nodename);
423 } 508 }
424 else 509 else
425 c->recv_vpn_packet (pkt, rsi); 510 c->recv_vpn_packet (pkt, rsi);
426 } 511 }
427} 512}
428 513
429void 514bool
515vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
516{
517 switch (si.prot)
518 {
519 case PROT_IPv4:
520 return send_ipv4_packet (pkt, si, tos);
521
522 case PROT_UDPv4:
523 return send_udpv4_packet (pkt, si, tos);
524
525#if ENABLE_TCP
526 case PROT_TCPv4:
527 return send_tcpv4_packet (pkt, si, tos);
528#endif
529#if ENABLE_ICMP
530 case PROT_ICMPv4:
531 return send_icmpv4_packet (pkt, si, tos);
532#endif
533#if ENABLE_DNS
534 case PROT_DNSv4:
535 return send_dnsv4_packet (pkt, si, tos);
536#endif
537 default:
538 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
539 }
540
541 return false;
542}
543
544inline void
430vpn::ipv4_ev (io_watcher &w, short revents) 545vpn::ipv4_ev (ev::io &w, int revents)
431{ 546{
432 if (revents & EVENT_READ) 547 if (revents & EV_READ)
433 { 548 {
434 vpn_packet *pkt = new vpn_packet; 549 vpn_packet *pkt = new vpn_packet;
435 struct sockaddr_in sa; 550 struct sockaddr_in sa;
436 socklen_t sa_len = sizeof (sa); 551 socklen_t sa_len = sizeof (sa);
437 int len; 552 int len;
… …
442 557
443 if (len > 0) 558 if (len > 0)
444 { 559 {
445 pkt->len = len; 560 pkt->len = len;
446 561
447 // raw sockets deliver the ipv4, but don't expect it on sends 562 // raw sockets deliver the ipv4 header, but don't expect it on sends
448 // this is slow, but...
449 pkt->skip_hdr (IP_OVERHEAD); 563 pkt->skip_hdr (IP_OVERHEAD);
450 564
451 recv_vpn_packet (pkt, si); 565 recv_vpn_packet (pkt, si);
452 } 566 }
453 else 567 else
454 { 568 {
455 // probably ECONNRESET or somesuch 569 // probably ECONNRESET or somesuch
456 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 570 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
457 } 571 }
458 572
459 delete pkt; 573 delete pkt;
460 } 574 }
461 else 575 else
462 { 576 {
463 slog (L_ERR, 577 slog (L_ERR,
464 _("FATAL: unknown revents %08x in socket, terminating\n"), 578 _("FATAL: unknown revents %08x in socket, exiting.\n"),
465 revents); 579 revents);
466 exit (EXIT_FAILURE); 580 exit (EXIT_FAILURE);
467 } 581 }
468} 582}
469 583
470#if ENABLE_ICMP 584#if ENABLE_ICMP
471void 585inline void
472vpn::icmpv4_ev (io_watcher &w, short revents) 586vpn::icmpv4_ev (ev::io &w, int revents)
473{ 587{
474 if (revents & EVENT_READ) 588 if (revents & EV_READ)
475 { 589 {
476 vpn_packet *pkt = new vpn_packet; 590 vpn_packet *pkt = new vpn_packet;
477 struct sockaddr_in sa; 591 struct sockaddr_in sa;
478 socklen_t sa_len = sizeof (sa); 592 socklen_t sa_len = sizeof (sa);
479 int len; 593 int len;
… …
499 } 613 }
500 } 614 }
501 else 615 else
502 { 616 {
503 // probably ECONNRESET or somesuch 617 // probably ECONNRESET or somesuch
504 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 618 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
505 } 619 }
506 620
507 delete pkt; 621 delete pkt;
508 } 622 }
509 else 623 else
510 { 624 {
511 slog (L_ERR, 625 slog (L_ERR,
512 _("FATAL: unknown revents %08x in socket, terminating\n"), 626 _("FATAL: unknown revents %08x in socket, exiting.\n"),
513 revents); 627 revents);
514 exit (EXIT_FAILURE); 628 exit (EXIT_FAILURE);
515 } 629 }
516} 630}
517#endif 631#endif
518 632
519void 633inline void
520vpn::udpv4_ev (io_watcher &w, short revents) 634vpn::udpv4_ev (ev::io &w, int revents)
521{ 635{
522 if (revents & EVENT_READ) 636 if (revents & EV_READ)
523 { 637 {
524 vpn_packet *pkt = new vpn_packet; 638 vpn_packet *pkt = new vpn_packet;
525 struct sockaddr_in sa; 639 struct sockaddr_in sa;
526 socklen_t sa_len = sizeof (sa); 640 socklen_t sa_len = sizeof (sa);
527 int len; 641 int len;
… …
537 recv_vpn_packet (pkt, si); 651 recv_vpn_packet (pkt, si);
538 } 652 }
539 else 653 else
540 { 654 {
541 // probably ECONNRESET or somesuch 655 // probably ECONNRESET or somesuch
542 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 656 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
543 } 657 }
544 658
545 delete pkt; 659 delete pkt;
546 } 660 }
547 else 661 else
548 { 662 {
549 slog (L_ERR, 663 slog (L_ERR,
550 _("FATAL: unknown revents %08x in socket, terminating\n"), 664 _("FATAL: unknown revents %08x in socket, exiting.\n"),
551 revents); 665 revents);
552 exit (EXIT_FAILURE); 666 exit (EXIT_FAILURE);
553 } 667 }
554} 668}
555 669
556void 670inline void
557vpn::tap_ev (io_watcher &w, short revents) 671vpn::tap_ev (ev::io &w, int revents)
558{ 672{
559 if (revents & EVENT_READ) 673 if (revents & EV_READ)
560 { 674 {
561 /* process data */ 675 /* process data */
562 tap_packet *pkt; 676 tap_packet *pkt;
563 677
564 pkt = tap->recv (); 678 pkt = tap->recv ();
… …
571 int dst = mac2id (pkt->dst); 685 int dst = mac2id (pkt->dst);
572 int src = mac2id (pkt->src); 686 int src = mac2id (pkt->src);
573 687
574 if (src != THISNODE->id) 688 if (src != THISNODE->id)
575 { 689 {
576 slog (L_ERR, _("FATAL: tap packet not originating on current node received, exiting.")); 690 slog (L_ERR, _("FATAL: tap packet not originating on current node received (if-up script not working properly?), exiting."));
577 exit (EXIT_FAILURE); 691 exit (EXIT_FAILURE);
578 } 692 }
579 693
580 if (dst == THISNODE->id) 694 if (dst == THISNODE->id)
581 { 695 {
… …
593 } 707 }
594 else 708 else
595 abort (); 709 abort ();
596} 710}
597 711
598void 712inline void
599vpn::event_cb (time_watcher &w) 713vpn::event_cb (ev::timer &w, int)
600{ 714{
601 if (events) 715 if (events)
602 { 716 {
603 if (events & EVENT_SHUTDOWN) 717 if (events & EVENT_SHUTDOWN)
604 { 718 {
605 slog (L_INFO, _("preparing shutdown...")); 719 slog (L_INFO, _("preparing shutdown..."));
606 720
607 shutdown_all (); 721 shutdown_all ();
608 remove_pid (conf.pidfilename); 722 remove_pid (conf.pidfilename);
609 slog (L_INFO, _("terminating")); 723 slog (L_INFO, _("exiting."));
610 exit (EXIT_SUCCESS); 724 exit (EXIT_SUCCESS);
611 } 725 }
612 726
613 if (events & EVENT_RECONNECT) 727 if (events & EVENT_RECONNECT)
614 { 728 {
615 slog (L_INFO, _("forced reconnect")); 729 slog (L_INFO, _("forced reconnect."));
616 730
617 reconnect_all (); 731 reconnect_all ();
618 } 732 }
619 733
620 events = 0; 734 events = 0;
… …
636 750
637 conns.clear (); 751 conns.clear ();
638 752
639 connection_init (); 753 connection_init ();
640 754
641 for (configuration::node_vector::iterator i = conf.nodes.begin (); 755 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
642 i != conf.nodes.end (); ++i) 756 conns.push_back (new connection (this, *i));
643 {
644 connection *conn = new connection (this);
645 757
646 conn->conf = *i; 758 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
647 conns.push_back (conn);
648
649 conn->establish_connection (); 759 (*c)->establish_connection ();
650 }
651} 760}
652 761
653connection *vpn::find_router () 762bool vpn::can_direct (conf_node *src, conf_node *dst) const
654{ 763{
655 u32 prio = 1; 764 return src != dst
765 && src->may_direct (dst)
766 && dst->may_direct (src)
767 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
768 || (src->protocols & dst->connectable_protocols ()));
769}
770
771// only works for indirect and routed connections: find a router
772// from THISNODE to dst
773connection *vpn::find_router_for (const connection *dst)
774{
656 connection *router = 0; 775 connection *router = 0;
657 776
777 // first try to find a router with a direct connection, route there
778 // regardless of any other considerations.
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf != THISNODE
788 && can_direct (c->conf, dst->conf)
789 && c->ictx && c->octx)
790 {
791 prio = c->conf->routerprio;
792 router = c;
793 }
794 }
795 }
796
797 if (router)
798 return router;
799
800 // second try find the router with the highest priority, higher than ours
801 {
802 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
803
804 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
805 {
806 connection *c = *i;
807
808 if (c->conf->routerprio > prio
809 && c != dst
810 && c->conf != THISNODE
811 && c->ictx && c->octx)
812 {
813 prio = c->conf->routerprio;
814 router = c;
815 }
816 }
817 }
818
819 return router;
820}
821
822void vpn::connection_established (connection *c)
823{
658 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 824 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
659 { 825 {
660 connection *c = *i; 826 connection *o = *i;
661 827
662 if (c->conf->routerprio > prio 828 if (!o->is_direct
663 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 829 && o->si.valid ()
664 && c->ictx && c->octx 830 && c->si != o->si
665 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 831 && c == find_router_for (o))
666 {
667 prio = c->conf->routerprio;
668 router = c;
669 } 832 {
833 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
834 o->conf->nodename, c->conf->nodename);
835 o->rekey ();
836 }
670 } 837 }
671
672 return router;
673} 838}
674 839
675void vpn::send_connect_request (int id) 840void vpn::send_connect_request (connection *c)
676{ 841{
677 connection *c = find_router (); 842 connection *r = find_router_for (c);
678 843
679 if (c) 844 if (r)
845 {
846 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
847 c->conf->nodename, r->conf->nodename);
680 c->send_connect_request (id); 848 r->send_connect_request (c->conf->id);
849 }
681 else 850 else
682 // no router found, aggressively connect to all routers 851 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
683 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 852 c->conf->nodename);
684 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
685 (*i)->establish_connection ();
686} 853}
687 854
688void 855void
689connection::dump_status () 856connection::dump_status ()
690{ 857{
691 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 858 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
692 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 859 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
693 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 860 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
694 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 861 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
695 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 862 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
696 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
697 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
698} 863}
699 864
700void 865void
701vpn::dump_status () 866vpn::dump_status ()
702{ 867{
703 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 868 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
704 869
705 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 870 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
706 (*c)->dump_status (); 871 (*c)->dump_status ();
707 872
708 slog (L_NOTICE, _("END status dump")); 873 slog (L_NOTICE, _("END status dump"));
709} 874}
710 875
711vpn::vpn (void) 876vpn::vpn (void)
877{
712: event (this, &vpn::event_cb) 878 event .set<vpn, &vpn::event_cb > (this);
713, udpv4_ev_watcher (this, &vpn::udpv4_ev) 879 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
714, ipv4_ev_watcher (this, &vpn::ipv4_ev) 880 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
715#if ENABLE_TCP 881#if ENABLE_TCP
716, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 882 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
717#endif 883#endif
718#if ENABLE_ICMP 884#if ENABLE_ICMP
719, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 885 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
720#endif 886#endif
721#if ENABLE_DNS 887#if ENABLE_DNS
722, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 888 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
723#endif 889#endif
724, tap_ev_watcher (this, &vpn::tap_ev) 890 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
725{
726} 891}
727 892
728vpn::~vpn () 893vpn::~vpn ()
729{ 894{
730} 895}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines