ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.32 by pcg, Mon Mar 7 01:31:26 2005 UTC vs.
Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
51const char *vpn::script_if_up () 61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
73void
74vpn::script_init_env ()
52{ 75{
53 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
54 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
55 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 78 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
56 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 79 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
57 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
58 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
59 82
60 char *env; 83 char *env;
61 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
62 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
63 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
64 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
65 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 86 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
66 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 87 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
67 asprintf (&env, "MTU=%d", mtu); putenv (env); 88 asprintf (&env, "MTU=%d", mtu); putenv (env);
68 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 89 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
69 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 90 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
70 THISNODE->id & 0xff);
71 putenv (env);
72 91
92 conns [THISNODE->id - 1]->script_init_env ("");
93
94 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
95 {
96 char ext[16];
97 snprintf (ext, 16, "_%d", (*c)->conf->id);
98 (*c)->script_init_env (ext);
99 }
100}
101
102inline const char *
103vpn::script_if_init ()
104{
105 script_init_env ();
106
107 return tap->if_up ();
108}
109
110inline const char *
111vpn::script_if_up ()
112{
113 script_init_env ();
114
115 char *filename;
116 asprintf (&filename,
117 "%s/%s",
118 confbase,
73 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 119 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
120
121 return filename;
122}
123
124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 setsockopt (ipv4_fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark);
141#endif
142
143 return fd;
74} 144}
75 145
76int 146int
77vpn::setup () 147vpn::setup ()
78{ 148{
149 int success = 0;
150
151 ipv4_tos = -1;
79 ipv4_fd = -1; 152 ipv4_fd = -1;
80 153
81 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 154 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
82 { 155 {
83 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 156 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
84 157
85 if (ipv4_fd < 0) 158 if (ipv4_fd < 0)
86 return -1; 159 return -1;
87
88 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
89 160
90#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 161#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
91 // this I really consider a linux bug. I am neither connected 162 // this I really consider a linux bug. I am neither connected
92 // nor do I fragment myself. Linux still sets DF and doesn't 163 // nor do I fragment myself. Linux still sets DF and doesn't
93 // fragment for me sometimes. 164 // fragment for me sometimes.
… …
99 170
100 sockinfo si (THISNODE, PROT_IPv4); 171 sockinfo si (THISNODE, PROT_IPv4);
101 172
102 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 173 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
103 { 174 {
104 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 175 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
105 exit (EXIT_FAILURE); 176 return -1;
106 } 177 }
107 178
108 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 179 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
180 ++success;
109 } 181 }
182 else
183 THISNODE->protocols &= ~PROT_IPv4;
110 184
185 udpv4_tos = -1;
111 udpv4_fd = -1; 186 udpv4_fd = -1;
112 187
113 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 188 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
114 { 189 {
115 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 190 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
116 191
117 if (udpv4_fd < 0) 192 if (udpv4_fd < 0)
118 return -1; 193 return -1;
119
120 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
121 194
122 // standard daemon practise... 195 // standard daemon practise...
123 { 196 {
124 int oval = 1; 197 int oval = 1;
125 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 198 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
137 210
138 sockinfo si (THISNODE, PROT_UDPv4); 211 sockinfo si (THISNODE, PROT_UDPv4);
139 212
140 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 213 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
141 { 214 {
142 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 215 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 216 return -1;
144 } 217 }
145 218
146 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 219 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
220 ++success;
147 } 221 }
222 else
223 THISNODE->protocols &= ~PROT_UDPv4;
148 224
225 icmpv4_tos = -1;
149 icmpv4_fd = -1; 226 icmpv4_fd = -1;
150 227
151#if ENABLE_ICMP 228#if ENABLE_ICMP
152 if (THISNODE->protocols & PROT_ICMPv4) 229 if (THISNODE->protocols & PROT_ICMPv4)
153 { 230 {
154 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 231 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
155 232
156 if (icmpv4_fd < 0) 233 if (icmpv4_fd < 0)
157 return -1; 234 return -1;
158
159 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
160 235
161#ifdef ICMP_FILTER 236#ifdef ICMP_FILTER
162 { 237 {
163 icmp_filter oval; 238 icmp_filter oval;
164 oval.data = 0xffffffff; 239 oval.data = 0xffffffff;
… …
173 // this I really consider a linux bug. I am neither connected 248 // this I really consider a linux bug. I am neither connected
174 // nor do I fragment myself. Linux still sets DF and doesn't 249 // nor do I fragment myself. Linux still sets DF and doesn't
175 // fragment for me sometimes. 250 // fragment for me sometimes.
176 { 251 {
177 int oval = IP_PMTUDISC_DONT; 252 int oval = IP_PMTUDISC_DONT;
178 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 253 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
179 } 254 }
180#endif 255#endif
181 256
182 sockinfo si (THISNODE, PROT_ICMPv4); 257 sockinfo si (THISNODE, PROT_ICMPv4);
183 258
184 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 259 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
185 { 260 {
186 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 261 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
187 exit (EXIT_FAILURE); 262 return -1;
188 } 263 }
189 264
190 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 265 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
266 ++success;
191 } 267 }
192#endif 268#endif
193 269
194 tcpv4_fd = -1; 270 tcpv4_fd = -1;
195 271
196#if ENABLE_TCP 272#if ENABLE_TCP
197 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 273 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
198 { 274 {
199 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 275 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
200 276
201 if (tcpv4_fd < 0) 277 if (tcpv4_fd < 0)
202 return -1; 278 return -1;
203 279
204 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
205
206 // standard daemon practise... 280 // standard daemon practise...
207 { 281 {
208 int oval = 1; 282 int oval = 1;
209 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 283 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
210 } 284 }
211 285
212 sockinfo si (THISNODE, PROT_TCPv4); 286 sockinfo si (THISNODE, PROT_TCPv4);
213 287
214 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 288 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
215 { 289 {
216 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 290 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
217 exit (EXIT_FAILURE); 291 return -1;
218 } 292 }
219 293
220 if (listen (tcpv4_fd, 5)) 294 if (listen (tcpv4_fd, 5))
221 { 295 {
222 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 296 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
223 exit (EXIT_FAILURE); 297 return -1;
224 } 298 }
225 299
226 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 300 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
301 ++success;
227 } 302 }
303 else
304 THISNODE->protocols &= ~PROT_TCPv4;
228#endif 305#endif
306
307 dnsv4_tos = -1;
308 dnsv4_fd = -1;
229 309
230#if ENABLE_DNS 310#if ENABLE_DNS
231 if (THISNODE->protocols & PROT_DNSv4) 311 if (THISNODE->protocols & PROT_DNSv4)
232 { 312 {
233 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 313 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
234 314
235 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 315 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
236 316
237 if (dnsv4_fd < 0) 317 if (dnsv4_fd < 0)
238 return -1; 318 return -1;
239 319
240#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 320# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
241 // this I really consider a linux bug. I am neither connected 321 // this I really consider a linux bug. I am neither connected
242 // nor do I fragment myself. Linux still sets DF and doesn't 322 // nor do I fragment myself. Linux still sets DF and doesn't
243 // fragment for me sometimes. 323 // fragment for me sometimes.
244 { 324 {
245 int oval = IP_PMTUDISC_DONT; 325 int oval = IP_PMTUDISC_DONT;
246 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 326 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
247 } 327 }
248#endif 328# endif
249 329
250 // standard daemon practise... 330 // standard daemon practise...
251 { 331 {
252 int oval = 1; 332 int oval = 1;
253 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 333 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
257 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 337 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
258 PROT_DNSv4); 338 PROT_DNSv4);
259 339
260 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 340 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
261 { 341 {
262 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 342 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
263 exit (EXIT_FAILURE); 343 return -1;
264 } 344 }
265 345
266 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 346 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
347 ++success;
348 }
349#endif
350
351 /////////////////////////////////////////////////////////////////////////////
352
353 if (!success)
267 } 354 {
268#endif 355 slog (L_ERR, _("no protocols enabled."));
356 return -1;
357 }
358
359 reconnect_all ();
360
361 /////////////////////////////////////////////////////////////////////////////
269 362
270 tap = new tap_device (); 363 tap = new tap_device ();
271 if (!tap) //D this, of course, never catches 364 if (!tap) //D this, of course, never catches
272 { 365 {
273 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 366 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
274 exit (EXIT_FAILURE); 367 return -1;
275 } 368 }
276 369
277 run_script (run_script_cb (this, &vpn::script_if_up), true); 370 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
278 371
372 run_script_cb cb;
373 cb.set<vpn, &vpn::script_if_init> (this);
374
375 if (tap->if_up () &&
376 !run_script (cb, true))
377 {
378 slog (L_ERR, _("interface initialization command '%s' failed."),
379 tap->if_up ());
380 return -1;
381 }
382
383 cb.set<vpn, &vpn::script_if_up> (this);
384 if (!run_script (cb, true))
385 {
386 slog (L_ERR, _("if-up command execution failed."));
387 return -1;
388 }
389
279 tap_ev_watcher.start (tap->fd, EVENT_READ); 390 tap_ev_watcher.start (tap->fd, EV_READ);
280
281 reconnect_all ();
282 391
283 return 0; 392 return 0;
284} 393}
285 394
286bool 395bool
287vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 396vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
288{ 397{
289#if defined(SOL_IP) && defined(IP_TOS) 398 set_tos (ipv4_fd, ipv4_tos, tos);
290 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
291#endif
292 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 399 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
293 400
294 return true; 401 return true;
295} 402}
296 403
… …
319 426
320#if ENABLE_ICMP 427#if ENABLE_ICMP
321bool 428bool
322vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 429vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
323{ 430{
324#if defined(SOL_IP) && defined(IP_TOS)
325 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
326#endif
327
328 pkt->unshift_hdr (4); 431 pkt->unshift_hdr (4);
329 432
330 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 433 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
331 hdr->type = ::conf.icmp_type; 434 hdr->type = ::conf.icmp_type;
332 hdr->code = 255; 435 hdr->code = 255;
333 hdr->checksum = 0; 436 hdr->checksum = 0;
334 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 437 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
335 438
439 set_tos (icmpv4_fd, icmpv4_tos, tos);
336 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 440 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
337 441
338 return true; 442 return true;
339} 443}
340#endif 444#endif
341 445
342bool 446bool
343vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 447vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
344{ 448{
345#if defined(SOL_IP) && defined(IP_TOS) 449 set_tos (udpv4_fd, udpv4_tos, tos);
346 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
347#endif
348 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 450 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
349 451
350 return true; 452 return true;
351} 453}
352 454
… …
363 { 465 {
364 // broadcast, this is ugly, but due to the security policy 466 // broadcast, this is ugly, but due to the security policy
365 // we have to connect to all hosts... 467 // we have to connect to all hosts...
366 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 468 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
367 if ((*c)->conf != THISNODE) 469 if ((*c)->conf != THISNODE)
368 (*c)->inject_data_packet (pkt, true); 470 (*c)->inject_data_packet (pkt);
369 } 471 }
370} 472}
371 473
372void 474void
373vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 475vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
374{ 476{
375 unsigned int src = pkt->src (); 477 unsigned int src = pkt->src ();
376 unsigned int dst = pkt->dst (); 478 unsigned int dst = pkt->dst ();
377 479
378 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 480 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
379 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 481 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
380 482
381 if (src == 0 || src > conns.size () 483 if (src == 0 || src > conns.size ()
382 || dst > conns.size () 484 || dst > conns.size ()
383 || pkt->typ () >= vpn_packet::PT_MAX) 485 || pkt->typ () >= vpn_packet::PT_MAX)
384 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 486 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
385 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 487 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
386 else if (dst > conns.size ()) 488 else if (dst > conns.size ())
387 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 489 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
388 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 490 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
389 else 491 else
390 { 492 {
391 connection *c = conns[src - 1]; 493 connection *c = conns[src - 1];
392 494
393 if (dst == 0) 495 if (dst == 0)
394 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 496 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
395 c->conf->nodename, (const char *)rsi); 497 c->conf->nodename, (const char *)rsi);
396 else if (dst != THISNODE->id) 498 else if (dst != THISNODE->id)
397 { 499 {
398 if (THISNODE->routerprio) 500 if (THISNODE->routerprio)
399 // the tos setting gets lost here. who cares. 501 // the tos setting gets lost here. who cares.
400 conns[dst - 1]->inject_vpn_packet (pkt); 502 conns[dst - 1]->inject_vpn_packet (pkt);
401 else 503 else
402 slog (L_WARN, 504 slog (L_WARN,
403 _("%s(%s): forwarding request (=> %s), but we are no router"), 505 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
404 c->conf->nodename, (const char *)rsi, 506 c->conf->nodename, (const char *)rsi,
405 conns[dst - 1]->conf->nodename); 507 conns[dst - 1]->conf->nodename);
406 } 508 }
407 else 509 else
408 c->recv_vpn_packet (pkt, rsi); 510 c->recv_vpn_packet (pkt, rsi);
… …
414{ 516{
415 switch (si.prot) 517 switch (si.prot)
416 { 518 {
417 case PROT_IPv4: 519 case PROT_IPv4:
418 return send_ipv4_packet (pkt, si, tos); 520 return send_ipv4_packet (pkt, si, tos);
521
419 case PROT_UDPv4: 522 case PROT_UDPv4:
420 return send_udpv4_packet (pkt, si, tos); 523 return send_udpv4_packet (pkt, si, tos);
524
421#if ENABLE_TCP 525#if ENABLE_TCP
422 case PROT_TCPv4: 526 case PROT_TCPv4:
423 return send_tcpv4_packet (pkt, si, tos); 527 return send_tcpv4_packet (pkt, si, tos);
424#endif 528#endif
425#if ENABLE_ICMP 529#if ENABLE_ICMP
… …
428#endif 532#endif
429#if ENABLE_DNS 533#if ENABLE_DNS
430 case PROT_DNSv4: 534 case PROT_DNSv4:
431 return send_dnsv4_packet (pkt, si, tos); 535 return send_dnsv4_packet (pkt, si, tos);
432#endif 536#endif
433
434 default: 537 default:
435 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 538 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
436 } 539 }
437 540
438 return false; 541 return false;
439} 542}
440 543
441void 544inline void
442vpn::ipv4_ev (io_watcher &w, short revents) 545vpn::ipv4_ev (ev::io &w, int revents)
443{ 546{
444 if (revents & EVENT_READ) 547 if (revents & EV_READ)
445 { 548 {
446 vpn_packet *pkt = new vpn_packet; 549 vpn_packet *pkt = new vpn_packet;
447 struct sockaddr_in sa; 550 struct sockaddr_in sa;
448 socklen_t sa_len = sizeof (sa); 551 socklen_t sa_len = sizeof (sa);
449 int len; 552 int len;
… …
462 recv_vpn_packet (pkt, si); 565 recv_vpn_packet (pkt, si);
463 } 566 }
464 else 567 else
465 { 568 {
466 // probably ECONNRESET or somesuch 569 // probably ECONNRESET or somesuch
467 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 570 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
468 } 571 }
469 572
470 delete pkt; 573 delete pkt;
471 } 574 }
472 else 575 else
473 { 576 {
474 slog (L_ERR, 577 slog (L_ERR,
475 _("FATAL: unknown revents %08x in socket, terminating\n"), 578 _("FATAL: unknown revents %08x in socket, exiting.\n"),
476 revents); 579 revents);
477 exit (EXIT_FAILURE); 580 exit (EXIT_FAILURE);
478 } 581 }
479} 582}
480 583
481#if ENABLE_ICMP 584#if ENABLE_ICMP
482void 585inline void
483vpn::icmpv4_ev (io_watcher &w, short revents) 586vpn::icmpv4_ev (ev::io &w, int revents)
484{ 587{
485 if (revents & EVENT_READ) 588 if (revents & EV_READ)
486 { 589 {
487 vpn_packet *pkt = new vpn_packet; 590 vpn_packet *pkt = new vpn_packet;
488 struct sockaddr_in sa; 591 struct sockaddr_in sa;
489 socklen_t sa_len = sizeof (sa); 592 socklen_t sa_len = sizeof (sa);
490 int len; 593 int len;
… …
510 } 613 }
511 } 614 }
512 else 615 else
513 { 616 {
514 // probably ECONNRESET or somesuch 617 // probably ECONNRESET or somesuch
515 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 618 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
516 } 619 }
517 620
518 delete pkt; 621 delete pkt;
519 } 622 }
520 else 623 else
521 { 624 {
522 slog (L_ERR, 625 slog (L_ERR,
523 _("FATAL: unknown revents %08x in socket, terminating\n"), 626 _("FATAL: unknown revents %08x in socket, exiting.\n"),
524 revents); 627 revents);
525 exit (EXIT_FAILURE); 628 exit (EXIT_FAILURE);
526 } 629 }
527} 630}
528#endif 631#endif
529 632
530void 633inline void
531vpn::udpv4_ev (io_watcher &w, short revents) 634vpn::udpv4_ev (ev::io &w, int revents)
532{ 635{
533 if (revents & EVENT_READ) 636 if (revents & EV_READ)
534 { 637 {
535 vpn_packet *pkt = new vpn_packet; 638 vpn_packet *pkt = new vpn_packet;
536 struct sockaddr_in sa; 639 struct sockaddr_in sa;
537 socklen_t sa_len = sizeof (sa); 640 socklen_t sa_len = sizeof (sa);
538 int len; 641 int len;
… …
548 recv_vpn_packet (pkt, si); 651 recv_vpn_packet (pkt, si);
549 } 652 }
550 else 653 else
551 { 654 {
552 // probably ECONNRESET or somesuch 655 // probably ECONNRESET or somesuch
553 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 656 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
554 } 657 }
555 658
556 delete pkt; 659 delete pkt;
557 } 660 }
558 else 661 else
559 { 662 {
560 slog (L_ERR, 663 slog (L_ERR,
561 _("FATAL: unknown revents %08x in socket, terminating\n"), 664 _("FATAL: unknown revents %08x in socket, exiting.\n"),
562 revents); 665 revents);
563 exit (EXIT_FAILURE); 666 exit (EXIT_FAILURE);
564 } 667 }
565} 668}
566 669
567void 670inline void
568vpn::tap_ev (io_watcher &w, short revents) 671vpn::tap_ev (ev::io &w, int revents)
569{ 672{
570 if (revents & EVENT_READ) 673 if (revents & EV_READ)
571 { 674 {
572 /* process data */ 675 /* process data */
573 tap_packet *pkt; 676 tap_packet *pkt;
574 677
575 pkt = tap->recv (); 678 pkt = tap->recv ();
… …
604 } 707 }
605 else 708 else
606 abort (); 709 abort ();
607} 710}
608 711
609void 712inline void
610vpn::event_cb (time_watcher &w) 713vpn::event_cb (ev::timer &w, int)
611{ 714{
612 if (events) 715 if (events)
613 { 716 {
614 if (events & EVENT_SHUTDOWN) 717 if (events & EVENT_SHUTDOWN)
615 { 718 {
616 slog (L_INFO, _("preparing shutdown...")); 719 slog (L_INFO, _("preparing shutdown..."));
617 720
618 shutdown_all (); 721 shutdown_all ();
619 remove_pid (conf.pidfilename); 722 remove_pid (conf.pidfilename);
620 slog (L_INFO, _("terminating")); 723 slog (L_INFO, _("exiting."));
621 exit (EXIT_SUCCESS); 724 exit (EXIT_SUCCESS);
622 } 725 }
623 726
624 if (events & EVENT_RECONNECT) 727 if (events & EVENT_RECONNECT)
625 { 728 {
626 slog (L_INFO, _("forced reconnect")); 729 slog (L_INFO, _("forced reconnect."));
627 730
628 reconnect_all (); 731 reconnect_all ();
629 } 732 }
630 733
631 events = 0; 734 events = 0;
… …
647 750
648 conns.clear (); 751 conns.clear ();
649 752
650 connection_init (); 753 connection_init ();
651 754
652 for (configuration::node_vector::iterator i = conf.nodes.begin (); 755 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
653 i != conf.nodes.end (); ++i) 756 conns.push_back (new connection (this, *i));
654 { 757
655 connection *conn = new connection (this, *i); 758 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
656 conns.push_back (conn);
657 conn->establish_connection (); 759 (*c)->establish_connection ();
658 }
659} 760}
660 761
661connection *vpn::find_router () 762bool vpn::can_direct (conf_node *src, conf_node *dst) const
662{ 763{
663 u32 prio = 1; 764 return src != dst
765 && src->may_direct (dst)
766 && dst->may_direct (src)
767 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
768 || (src->protocols & dst->connectable_protocols ()));
769}
770
771// only works for indirect and routed connections: find a router
772// from THISNODE to dst
773connection *vpn::find_router_for (const connection *dst)
774{
664 connection *router = 0; 775 connection *router = 0;
665 776
777 // first try to find a router with a direct connection, route there
778 // regardless of any other considerations.
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf != THISNODE
788 && can_direct (c->conf, dst->conf)
789 && c->ictx && c->octx)
790 {
791 prio = c->conf->routerprio;
792 router = c;
793 }
794 }
795 }
796
797 if (router)
798 return router;
799
800 // second try find the router with the highest priority, higher than ours
801 {
802 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
803
804 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
805 {
806 connection *c = *i;
807
808 if (c->conf->routerprio > prio
809 && c != dst
810 && c->conf != THISNODE
811 && c->ictx && c->octx)
812 {
813 prio = c->conf->routerprio;
814 router = c;
815 }
816 }
817 }
818
819 return router;
820}
821
822void vpn::connection_established (connection *c)
823{
666 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 824 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
667 { 825 {
668 connection *c = *i; 826 connection *o = *i;
669 827
670 if (c->conf->routerprio > prio 828 if (!o->is_direct
671 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 829 && o->si.valid ()
672 && c->ictx && c->octx 830 && c->si != o->si
673 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 831 && c == find_router_for (o))
674 {
675 prio = c->conf->routerprio;
676 router = c;
677 } 832 {
833 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
834 o->conf->nodename, c->conf->nodename);
835 o->rekey ();
836 }
678 } 837 }
679
680 return router;
681} 838}
682 839
683void vpn::send_connect_request (int id) 840void vpn::send_connect_request (connection *c)
684{ 841{
685 connection *c = find_router (); 842 connection *r = find_router_for (c);
686 843
687 if (c) 844 if (r)
845 {
846 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
847 c->conf->nodename, r->conf->nodename);
688 c->send_connect_request (id); 848 r->send_connect_request (c->conf->id);
849 }
689 else 850 else
690 // no router found, aggressively connect to all routers 851 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
691 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 852 c->conf->nodename);
692 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
693 (*i)->establish_connection ();
694} 853}
695 854
696void 855void
697connection::dump_status () 856connection::dump_status ()
698{ 857{
699 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 858 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
700 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 859 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
701 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 860 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
702 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 861 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
703 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 862 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
704 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
705 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
706} 863}
707 864
708void 865void
709vpn::dump_status () 866vpn::dump_status ()
710{ 867{
711 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 868 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
712 869
713 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 870 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
714 (*c)->dump_status (); 871 (*c)->dump_status ();
715 872
716 slog (L_NOTICE, _("END status dump")); 873 slog (L_NOTICE, _("END status dump"));
717} 874}
718 875
719vpn::vpn (void) 876vpn::vpn (void)
877{
720: event (this, &vpn::event_cb) 878 event .set<vpn, &vpn::event_cb > (this);
721, udpv4_ev_watcher (this, &vpn::udpv4_ev) 879 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
722, ipv4_ev_watcher (this, &vpn::ipv4_ev) 880 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
723#if ENABLE_TCP 881#if ENABLE_TCP
724, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 882 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
725#endif 883#endif
726#if ENABLE_ICMP 884#if ENABLE_ICMP
727, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 885 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
728#endif 886#endif
729#if ENABLE_DNS 887#if ENABLE_DNS
730, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 888 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
731#endif 889#endif
732, tap_ev_watcher (this, &vpn::tap_ev) 890 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
733{
734} 891}
735 892
736vpn::~vpn () 893vpn::~vpn ()
737{ 894{
738} 895}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines