[ViewVC] Diff of: cvs/gvpe/src/vpn.C

Comparing gvpe/src/vpn.C (file contents):
Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs.
Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC

…		…
1	/*	1	/*
2	vpn.C -- handle the protocol, encryption, handshaking etc.	2	vpn.C -- handle the protocol, encryption, handshaking etc.
3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>	3	Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4		4
5	This file is part of GVPE.	5	This file is part of GVPE.
6		6
7	GVPE is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
8	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
9	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
10	(at your option) any later version.	10	option) any later version.
11		11
12	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
13	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15	GNU General Public License for more details.	15	Public License for more details.
16		16
17	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
18	along with gvpe; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
20	*/	30	*/
21		31
22	#include "config.h"	32	#include "config.h"
23		33
24	#include <list>	34	#include <list>
46		56
47	vpn network; // THE vpn (bad design...)	57	vpn network; // THE vpn (bad design...)
48		58
49	/////////////////////////////////////////////////////////////////////////////	59	/////////////////////////////////////////////////////////////////////////////
50		60
		61	static void inline
		62	set_tos (int fd, int &tos_prev, int tos)
		63	{
		64	#if defined(SOL_IP) && defined(IP_TOS)
		65	if (tos_prev == tos)
		66	return;
		67
		68	tos_prev = tos;
		69	setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
		70	#endif
		71	}
		72
51	void	73	void
52	vpn::script_init_env ()	74	vpn::script_init_env ()
53	{	75	{
54	// the tunnel device mtu should be the physical mtu - overhead	76	// the tunnel device mtu should be the physical mtu - overhead
55	// the tricky part is rounding to the cipher key blocksize	77	// the tricky part is rounding to the cipher key blocksize
…		…
58	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round	80	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
59	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again	81	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
60		82
61	char *env;	83	char *env;
62	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);	84	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
63	asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
64	asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
65	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);	85	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
66	asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);	86	asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
67	asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);	87	asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
68	asprintf (&env, "MTU=%d", mtu); putenv (env);	88	asprintf (&env, "MTU=%d", mtu); putenv (env);
69	asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x",	89	asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
70	0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8,	90	asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
71	THISNODE->id & 0xff); putenv (env);
72		91
73	// TODO: info for other nodes, maybe?	92	conns [THISNODE->id - 1]->script_init_env ("");
74	}
75		93
		94	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
		95	{
		96	char ext[16];
		97	snprintf (ext, 16, "_%d", (*c)->conf->id);
		98	(*c)->script_init_env (ext);
		99	}
		100	}
		101
		102	inline const char *
76	const char *vpn::script_if_init ()	103	vpn::script_if_init ()
77	{	104	{
78	script_init_env ();	105	script_init_env ();
79		106
80	return tap->if_up ();	107	return tap->if_up ();
81	}	108	}
82		109
		110	inline const char *
83	const char *vpn::script_if_up ()	111	vpn::script_if_up ()
84	{	112	{
85	script_init_env ();	113	script_init_env ();
86		114
87	char *filename;	115	char *filename;
88	asprintf (&filename,	116	asprintf (&filename,
…		…
92		120
93	return filename;	121	return filename;
94	}	122	}
95		123
96	int	124	int
		125	vpn::setup_socket (u8 prot, int family, int type, int proto)
		126	{
		127	int fd = socket (family, type, proto);
		128
		129	if (fd < 0)
		130	{
		131	slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
		132	return fd;
		133	}
		134
		135	fcntl (fd, F_SETFL, O_NONBLOCK);
		136	fcntl (fd, F_SETFD, FD_CLOEXEC);
		137
		138	#ifdef SO_MARK
		139	if (::conf.nfmark)
		140	setsockopt (ipv4_fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark);
		141	#endif
		142
		143	return fd;
		144	}
		145
		146	int
97	vpn::setup ()	147	vpn::setup ()
98	{	148	{
		149	int success = 0;
		150
		151	ipv4_tos = -1;
99	ipv4_fd = -1;	152	ipv4_fd = -1;
100		153
101	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)	154	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
102	{	155	{
103	ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);	156	ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
104		157
105	if (ipv4_fd < 0)	158	if (ipv4_fd < 0)
106	return -1;	159	return -1;
107
108	fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
109		160
110	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	161	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
111	// this I really consider a linux bug. I am neither connected	162	// this I really consider a linux bug. I am neither connected
112	// nor do I fragment myself. Linux still sets DF and doesn't	163	// nor do I fragment myself. Linux still sets DF and doesn't
113	// fragment for me sometimes.	164	// fragment for me sometimes.
…		…
119		170
120	sockinfo si (THISNODE, PROT_IPv4);	171	sockinfo si (THISNODE, PROT_IPv4);
121		172
122	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))	173	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
123	{	174	{
124	slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));	175	slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
125	exit (EXIT_FAILURE);	176	return -1;
126	}	177	}
127		178
128	ipv4_ev_watcher.start (ipv4_fd, EVENT_READ);	179	ipv4_ev_watcher.start (ipv4_fd, EV_READ);
		180	++success;
129	}	181	}
		182	else
		183	THISNODE->protocols &= ~PROT_IPv4;
130		184
		185	udpv4_tos = -1;
131	udpv4_fd = -1;	186	udpv4_fd = -1;
132		187
133	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)	188	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
134	{	189	{
135	udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	190	udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
136		191
137	if (udpv4_fd < 0)	192	if (udpv4_fd < 0)
138	return -1;	193	return -1;
139
140	fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
141		194
142	// standard daemon practise...	195	// standard daemon practise...
143	{	196	{
144	int oval = 1;	197	int oval = 1;
145	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	198	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
157		210
158	sockinfo si (THISNODE, PROT_UDPv4);	211	sockinfo si (THISNODE, PROT_UDPv4);
159		212
160	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))	213	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
161	{	214	{
162	slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));	215	slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
163	exit (EXIT_FAILURE);	216	return -1;
164	}	217	}
165		218
166	udpv4_ev_watcher.start (udpv4_fd, EVENT_READ);	219	udpv4_ev_watcher.start (udpv4_fd, EV_READ);
		220	++success;
167	}	221	}
		222	else
		223	THISNODE->protocols &= ~PROT_UDPv4;
168		224
		225	icmpv4_tos = -1;
169	icmpv4_fd = -1;	226	icmpv4_fd = -1;
170		227
171	#if ENABLE_ICMP	228	#if ENABLE_ICMP
172	if (THISNODE->protocols & PROT_ICMPv4)	229	if (THISNODE->protocols & PROT_ICMPv4)
173	{	230	{
174	icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);	231	icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
175		232
176	if (icmpv4_fd < 0)	233	if (icmpv4_fd < 0)
177	return -1;	234	return -1;
178
179	fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
180		235
181	#ifdef ICMP_FILTER	236	#ifdef ICMP_FILTER
182	{	237	{
183	icmp_filter oval;	238	icmp_filter oval;
184	oval.data = 0xffffffff;	239	oval.data = 0xffffffff;
…		…
193	// this I really consider a linux bug. I am neither connected	248	// this I really consider a linux bug. I am neither connected
194	// nor do I fragment myself. Linux still sets DF and doesn't	249	// nor do I fragment myself. Linux still sets DF and doesn't
195	// fragment for me sometimes.	250	// fragment for me sometimes.
196	{	251	{
197	int oval = IP_PMTUDISC_DONT;	252	int oval = IP_PMTUDISC_DONT;
198	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);	253	setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
199	}	254	}
200	#endif	255	#endif
201		256
202	sockinfo si (THISNODE, PROT_ICMPv4);	257	sockinfo si (THISNODE, PROT_ICMPv4);
203		258
204	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))	259	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
205	{	260	{
206	slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno));	261	slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
207	exit (EXIT_FAILURE);	262	return -1;
208	}	263	}
209		264
210	icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ);	265	icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
		266	++success;
211	}	267	}
212	#endif	268	#endif
213		269
214	tcpv4_fd = -1;	270	tcpv4_fd = -1;
215		271
216	#if ENABLE_TCP	272	#if ENABLE_TCP
217	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)	273	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
218	{	274	{
219	tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);	275	tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
220		276
221	if (tcpv4_fd < 0)	277	if (tcpv4_fd < 0)
222	return -1;	278	return -1;
223		279
224	fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
225
226	// standard daemon practise...	280	// standard daemon practise...
227	{	281	{
228	int oval = 1;	282	int oval = 1;
229	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	283	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
230	}	284	}
231		285
232	sockinfo si (THISNODE, PROT_TCPv4);	286	sockinfo si (THISNODE, PROT_TCPv4);
233		287
234	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))	288	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
235	{	289	{
236	slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));	290	slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
237	exit (EXIT_FAILURE);	291	return -1;
238	}	292	}
239		293
240	if (listen (tcpv4_fd, 5))	294	if (listen (tcpv4_fd, 5))
241	{	295	{
242	slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));	296	slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
243	exit (EXIT_FAILURE);	297	return -1;
244	}	298	}
245		299
246	tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ);	300	tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
		301	++success;
247	}	302	}
		303	else
		304	THISNODE->protocols &= ~PROT_TCPv4;
248	#endif	305	#endif
		306
		307	dnsv4_tos = -1;
		308	dnsv4_fd = -1;
249		309
250	#if ENABLE_DNS	310	#if ENABLE_DNS
251	if (THISNODE->protocols & PROT_DNSv4)	311	if (THISNODE->protocols & PROT_DNSv4)
252	{	312	{
253	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	313	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
254		314
255	dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	315	dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
256		316
257	if (dnsv4_fd < 0)	317	if (dnsv4_fd < 0)
258	return -1;	318	return -1;
259		319
260	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	320	# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
261	// this I really consider a linux bug. I am neither connected	321	// this I really consider a linux bug. I am neither connected
262	// nor do I fragment myself. Linux still sets DF and doesn't	322	// nor do I fragment myself. Linux still sets DF and doesn't
263	// fragment for me sometimes.	323	// fragment for me sometimes.
264	{	324	{
265	int oval = IP_PMTUDISC_DONT;	325	int oval = IP_PMTUDISC_DONT;
266	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);	326	setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
267	}	327	}
268	#endif	328	# endif
269		329
270	// standard daemon practise...	330	// standard daemon practise...
271	{	331	{
272	int oval = 1;	332	int oval = 1;
273	setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	333	setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
277	THISNODE->dns_hostname ? THISNODE->dns_port : 0,	337	THISNODE->dns_hostname ? THISNODE->dns_port : 0,
278	PROT_DNSv4);	338	PROT_DNSv4);
279		339
280	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))	340	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
281	{	341	{
282	slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno));	342	slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
283	exit (EXIT_FAILURE);	343	return -1;
284	}	344	}
285		345
286	dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ);	346	dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
		347	++success;
		348	}
		349	#endif
		350
		351	/////////////////////////////////////////////////////////////////////////////
		352
		353	if (!success)
287	}	354	{
288	#endif	355	slog (L_ERR, _("no protocols enabled."));
		356	return -1;
		357	}
		358
		359	reconnect_all ();
		360
		361	/////////////////////////////////////////////////////////////////////////////
289		362
290	tap = new tap_device ();	363	tap = new tap_device ();
291	if (!tap) //D this, of course, never catches	364	if (!tap) //D this, of course, never catches
292	{	365	{
293	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);	366	slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
294	exit (EXIT_FAILURE);	367	return -1;
295	}	368	}
296		369
		370	fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
		371
		372	run_script_cb cb;
		373	cb.set<vpn, &vpn::script_if_init> (this);
		374
297	if (tap->if_up () &&	375	if (tap->if_up () &&
298	!run_script (run_script_cb (this, &vpn::script_if_init), true))	376	!run_script (cb, true))
299	{	377	{
300	slog (L_ERR, _("interface initialization command '%s' failed, exiting."),	378	slog (L_ERR, _("interface initialization command '%s' failed."),
301	tap->if_up ());	379	tap->if_up ());
302	exit (EXIT_FAILURE);	380	return -1;
303	}
304
305	if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
306	{	381	}
		382
		383	cb.set<vpn, &vpn::script_if_up> (this);
		384	if (!run_script (cb, true))
		385	{
307	slog (L_ERR, _("if-up command execution failed, exiting."));	386	slog (L_ERR, _("if-up command execution failed."));
308	exit (EXIT_FAILURE);	387	return -1;
309	}	388	}
310		389
311	tap_ev_watcher.start (tap->fd, EVENT_READ);	390	tap_ev_watcher.start (tap->fd, EV_READ);
312
313	reconnect_all ();
314		391
315	return 0;	392	return 0;
316	}	393	}
317		394
318	bool	395	bool
319	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	396	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
320	{	397	{
321	#if defined(SOL_IP) && defined(IP_TOS)	398	set_tos (ipv4_fd, ipv4_tos, tos);
322	setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
323	#endif
324	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	399	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
325		400
326	return true;	401	return true;
327	}	402	}
328		403
…		…
351		426
352	#if ENABLE_ICMP	427	#if ENABLE_ICMP
353	bool	428	bool
354	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	429	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
355	{	430	{
356	#if defined(SOL_IP) && defined(IP_TOS)
357	setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
358	#endif
359
360	pkt->unshift_hdr (4);	431	pkt->unshift_hdr (4);
361		432
362	icmp_header hdr = (icmp_header )&((*pkt)[0]);	433	icmp_header hdr = (icmp_header )&((*pkt)[0]);
363	hdr->type = ::conf.icmp_type;	434	hdr->type = ::conf.icmp_type;
364	hdr->code = 255;	435	hdr->code = 255;
365	hdr->checksum = 0;	436	hdr->checksum = 0;
366	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);	437	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
367		438
		439	set_tos (icmpv4_fd, icmpv4_tos, tos);
368	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	440	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
369		441
370	return true;	442	return true;
371	}	443	}
372	#endif	444	#endif
373		445
374	bool	446	bool
375	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	447	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
376	{	448	{
377	#if defined(SOL_IP) && defined(IP_TOS)	449	set_tos (udpv4_fd, udpv4_tos, tos);
378	setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
379	#endif
380	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	450	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
381		451
382	return true;	452	return true;
383	}	453	}
384		454
…		…
395	{	465	{
396	// broadcast, this is ugly, but due to the security policy	466	// broadcast, this is ugly, but due to the security policy
397	// we have to connect to all hosts...	467	// we have to connect to all hosts...
398	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	468	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
399	if ((*c)->conf != THISNODE)	469	if ((*c)->conf != THISNODE)
400	(*c)->inject_data_packet (pkt, true);	470	(*c)->inject_data_packet (pkt);
401	}	471	}
402	}	472	}
403		473
404	void	474	void
405	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	475	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
406	{	476	{
407	unsigned int src = pkt->src ();	477	unsigned int src = pkt->src ();
408	unsigned int dst = pkt->dst ();	478	unsigned int dst = pkt->dst ();
409		479
410	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),	480	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
411	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);	481	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
412		482
413	if (src == 0 \|\| src > conns.size ()	483	if (src == 0 \|\| src > conns.size ()
414	\|\| dst > conns.size ()	484	\|\| dst > conns.size ()
415	\|\| pkt->typ () >= vpn_packet::PT_MAX)	485	\|\| pkt->typ () >= vpn_packet::PT_MAX)
416	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	486	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
417	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	487	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
418	else if (dst > conns.size ())	488	else if (dst > conns.size ())
419	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	489	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
420	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	490	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
421	else	491	else
422	{	492	{
423	connection *c = conns[src - 1];	493	connection *c = conns[src - 1];
424		494
425	if (dst == 0)	495	if (dst == 0)
426	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"),	496	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
427	c->conf->nodename, (const char *)rsi);	497	c->conf->nodename, (const char *)rsi);
428	else if (dst != THISNODE->id)	498	else if (dst != THISNODE->id)
429	{	499	{
430	if (THISNODE->routerprio)	500	if (THISNODE->routerprio)
431	// the tos setting gets lost here. who cares.	501	// the tos setting gets lost here. who cares.
432	conns[dst - 1]->inject_vpn_packet (pkt);	502	conns[dst - 1]->inject_vpn_packet (pkt);
433	else	503	else
434	slog (L_WARN,	504	slog (L_WARN,
435	_("%s(%s): forwarding request (=> %s), but we are no router"),	505	_("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
436	c->conf->nodename, (const char *)rsi,	506	c->conf->nodename, (const char *)rsi,
437	conns[dst - 1]->conf->nodename);	507	conns[dst - 1]->conf->nodename);
438	}	508	}
439	else	509	else
440	c->recv_vpn_packet (pkt, rsi);	510	c->recv_vpn_packet (pkt, rsi);
…		…
446	{	516	{
447	switch (si.prot)	517	switch (si.prot)
448	{	518	{
449	case PROT_IPv4:	519	case PROT_IPv4:
450	return send_ipv4_packet (pkt, si, tos);	520	return send_ipv4_packet (pkt, si, tos);
		521
451	case PROT_UDPv4:	522	case PROT_UDPv4:
452	return send_udpv4_packet (pkt, si, tos);	523	return send_udpv4_packet (pkt, si, tos);
		524
453	#if ENABLE_TCP	525	#if ENABLE_TCP
454	case PROT_TCPv4:	526	case PROT_TCPv4:
455	return send_tcpv4_packet (pkt, si, tos);	527	return send_tcpv4_packet (pkt, si, tos);
456	#endif	528	#endif
457	#if ENABLE_ICMP	529	#if ENABLE_ICMP
…		…
460	#endif	532	#endif
461	#if ENABLE_DNS	533	#if ENABLE_DNS
462	case PROT_DNSv4:	534	case PROT_DNSv4:
463	return send_dnsv4_packet (pkt, si, tos);	535	return send_dnsv4_packet (pkt, si, tos);
464	#endif	536	#endif
465
466	default:	537	default:
467	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);	538	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
468	}	539	}
469		540
470	return false;	541	return false;
471	}	542	}
472		543
473	void	544	inline void
474	vpn::ipv4_ev (io_watcher &w, short revents)	545	vpn::ipv4_ev (ev::io &w, int revents)
475	{	546	{
476	if (revents & EVENT_READ)	547	if (revents & EV_READ)
477	{	548	{
478	vpn_packet *pkt = new vpn_packet;	549	vpn_packet *pkt = new vpn_packet;
479	struct sockaddr_in sa;	550	struct sockaddr_in sa;
480	socklen_t sa_len = sizeof (sa);	551	socklen_t sa_len = sizeof (sa);
481	int len;	552	int len;
…		…
494	recv_vpn_packet (pkt, si);	565	recv_vpn_packet (pkt, si);
495	}	566	}
496	else	567	else
497	{	568	{
498	// probably ECONNRESET or somesuch	569	// probably ECONNRESET or somesuch
499	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	570	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
500	}	571	}
501		572
502	delete pkt;	573	delete pkt;
503	}	574	}
504	else	575	else
505	{	576	{
506	slog (L_ERR,	577	slog (L_ERR,
507	_("FATAL: unknown revents %08x in socket, terminating\n"),	578	_("FATAL: unknown revents %08x in socket, exiting.\n"),
508	revents);	579	revents);
509	exit (EXIT_FAILURE);	580	exit (EXIT_FAILURE);
510	}	581	}
511	}	582	}
512		583
513	#if ENABLE_ICMP	584	#if ENABLE_ICMP
514	void	585	inline void
515	vpn::icmpv4_ev (io_watcher &w, short revents)	586	vpn::icmpv4_ev (ev::io &w, int revents)
516	{	587	{
517	if (revents & EVENT_READ)	588	if (revents & EV_READ)
518	{	589	{
519	vpn_packet *pkt = new vpn_packet;	590	vpn_packet *pkt = new vpn_packet;
520	struct sockaddr_in sa;	591	struct sockaddr_in sa;
521	socklen_t sa_len = sizeof (sa);	592	socklen_t sa_len = sizeof (sa);
522	int len;	593	int len;
…		…
542	}	613	}
543	}	614	}
544	else	615	else
545	{	616	{
546	// probably ECONNRESET or somesuch	617	// probably ECONNRESET or somesuch
547	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	618	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
548	}	619	}
549		620
550	delete pkt;	621	delete pkt;
551	}	622	}
552	else	623	else
553	{	624	{
554	slog (L_ERR,	625	slog (L_ERR,
555	_("FATAL: unknown revents %08x in socket, terminating\n"),	626	_("FATAL: unknown revents %08x in socket, exiting.\n"),
556	revents);	627	revents);
557	exit (EXIT_FAILURE);	628	exit (EXIT_FAILURE);
558	}	629	}
559	}	630	}
560	#endif	631	#endif
561		632
562	void	633	inline void
563	vpn::udpv4_ev (io_watcher &w, short revents)	634	vpn::udpv4_ev (ev::io &w, int revents)
564	{	635	{
565	if (revents & EVENT_READ)	636	if (revents & EV_READ)
566	{	637	{
567	vpn_packet *pkt = new vpn_packet;	638	vpn_packet *pkt = new vpn_packet;
568	struct sockaddr_in sa;	639	struct sockaddr_in sa;
569	socklen_t sa_len = sizeof (sa);	640	socklen_t sa_len = sizeof (sa);
570	int len;	641	int len;
…		…
580	recv_vpn_packet (pkt, si);	651	recv_vpn_packet (pkt, si);
581	}	652	}
582	else	653	else
583	{	654	{
584	// probably ECONNRESET or somesuch	655	// probably ECONNRESET or somesuch
585	slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno));	656	slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
586	}	657	}
587		658
588	delete pkt;	659	delete pkt;
589	}	660	}
590	else	661	else
591	{	662	{
592	slog (L_ERR,	663	slog (L_ERR,
593	_("FATAL: unknown revents %08x in socket, terminating\n"),	664	_("FATAL: unknown revents %08x in socket, exiting.\n"),
594	revents);	665	revents);
595	exit (EXIT_FAILURE);	666	exit (EXIT_FAILURE);
596	}	667	}
597	}	668	}
598		669
599	void	670	inline void
600	vpn::tap_ev (io_watcher &w, short revents)	671	vpn::tap_ev (ev::io &w, int revents)
601	{	672	{
602	if (revents & EVENT_READ)	673	if (revents & EV_READ)
603	{	674	{
604	/* process data */	675	/* process data */
605	tap_packet *pkt;	676	tap_packet *pkt;
606		677
607	pkt = tap->recv ();	678	pkt = tap->recv ();
…		…
636	}	707	}
637	else	708	else
638	abort ();	709	abort ();
639	}	710	}
640		711
641	void	712	inline void
642	vpn::event_cb (time_watcher &w)	713	vpn::event_cb (ev::timer &w, int)
643	{	714	{
644	if (events)	715	if (events)
645	{	716	{
646	if (events & EVENT_SHUTDOWN)	717	if (events & EVENT_SHUTDOWN)
647	{	718	{
648	slog (L_INFO, _("preparing shutdown..."));	719	slog (L_INFO, _("preparing shutdown..."));
649		720
650	shutdown_all ();	721	shutdown_all ();
651	remove_pid (conf.pidfilename);	722	remove_pid (conf.pidfilename);
652	slog (L_INFO, _("terminating"));	723	slog (L_INFO, _("exiting."));
653	exit (EXIT_SUCCESS);	724	exit (EXIT_SUCCESS);
654	}	725	}
655		726
656	if (events & EVENT_RECONNECT)	727	if (events & EVENT_RECONNECT)
657	{	728	{
658	slog (L_INFO, _("forced reconnect"));	729	slog (L_INFO, _("forced reconnect."));
659		730
660	reconnect_all ();	731	reconnect_all ();
661	}	732	}
662		733
663	events = 0;	734	events = 0;
…		…
679		750
680	conns.clear ();	751	conns.clear ();
681		752
682	connection_init ();	753	connection_init ();
683		754
684	for (configuration::node_vector::iterator i = conf.nodes.begin ();	755	for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
685	i != conf.nodes.end (); ++i)	756	conns.push_back (new connection (this, *i));
686	{	757
687	connection conn = new connection (this, i);	758	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
688	conns.push_back (conn);
689	conn->establish_connection ();	759	(*c)->establish_connection ();
690	}
691	}	760	}
692		761
693	connection *vpn::find_router ()	762	bool vpn::can_direct (conf_node src, conf_node dst) const
694	{	763	{
695	u32 prio = 1;	764	return src != dst
		765	&& src->may_direct (dst)
		766	&& dst->may_direct (src)
		767	&& (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
		768	\|\| (src->protocols & dst->connectable_protocols ()));
		769	}
		770
		771	// only works for indirect and routed connections: find a router
		772	// from THISNODE to dst
		773	connection vpn::find_router_for (const connection dst)
		774	{
696	connection *router = 0;	775	connection *router = 0;
697		776
		777	// first try to find a router with a direct connection, route there
		778	// regardless of any other considerations.
		779	{
		780	u32 prio = 1;
		781
		782	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		783	{
		784	connection c = i;
		785
		786	if (c->conf->routerprio > prio
		787	&& c->conf != THISNODE
		788	&& can_direct (c->conf, dst->conf)
		789	&& c->ictx && c->octx)
		790	{
		791	prio = c->conf->routerprio;
		792	router = c;
		793	}
		794	}
		795	}
		796
		797	if (router)
		798	return router;
		799
		800	// second try find the router with the highest priority, higher than ours
		801	{
		802	u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
		803
		804	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		805	{
		806	connection c = i;
		807
		808	if (c->conf->routerprio > prio
		809	&& c != dst
		810	&& c->conf != THISNODE
		811	&& c->ictx && c->octx)
		812	{
		813	prio = c->conf->routerprio;
		814	router = c;
		815	}
		816	}
		817	}
		818
		819	return router;
		820	}
		821
		822	void vpn::connection_established (connection *c)
		823	{
698	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	824	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
699	{	825	{
700	connection c = i;	826	connection o = i;
701		827
702	if (c->conf->routerprio > prio	828	if (!o->is_direct
703	&& c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use	829	&& o->si.valid ()
704	&& c->ictx && c->octx	830	&& c->si != o->si
705	&& c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode	831	&& c == find_router_for (o))
706	{
707	prio = c->conf->routerprio;
708	router = c;
709	}	832	{
		833	slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
		834	o->conf->nodename, c->conf->nodename);
		835	o->rekey ();
		836	}
710	}	837	}
711
712	return router;
713	}	838	}
714		839
715	void vpn::send_connect_request (int id)	840	void vpn::send_connect_request (connection *c)
716	{	841	{
717	connection *c = find_router ();	842	connection *r = find_router_for (c);
718		843
719	if (c)	844	if (r)
		845	{
		846	slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
		847	c->conf->nodename, r->conf->nodename);
720	c->send_connect_request (id);	848	r->send_connect_request (c->conf->id);
		849	}
721	else	850	else
722	// no router found, aggressively connect to all routers	851	slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
723	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	852	c->conf->nodename);
724	if ((i)->conf->routerprio && (i)->conf != THISNODE)
725	(*i)->establish_connection ();
726	}	853	}
727		854
728	void	855	void
729	connection::dump_status ()	856	connection::dump_status ()
730	{	857	{
731	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);	858	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
732	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),	859	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
733	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);	860	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
734	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),	861	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
735	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);	862	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
736	slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
737	(long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
738	}	863	}
739		864
740	void	865	void
741	vpn::dump_status ()	866	vpn::dump_status ()
742	{	867	{
743	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);	868	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
744		869
745	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	870	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
746	(*c)->dump_status ();	871	(*c)->dump_status ();
747		872
748	slog (L_NOTICE, _("END status dump"));	873	slog (L_NOTICE, _("END status dump"));
749	}	874	}
750		875
751	vpn::vpn (void)	876	vpn::vpn (void)
		877	{
752	: event (this, &vpn::event_cb)	878	event .set<vpn, &vpn::event_cb > (this);
753	, udpv4_ev_watcher (this, &vpn::udpv4_ev)	879	udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
754	, ipv4_ev_watcher (this, &vpn::ipv4_ev)	880	ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
755	#if ENABLE_TCP	881	#if ENABLE_TCP
756	, tcpv4_ev_watcher (this, &vpn::tcpv4_ev)	882	tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
757	#endif	883	#endif
758	#if ENABLE_ICMP	884	#if ENABLE_ICMP
759	, icmpv4_ev_watcher(this, &vpn::icmpv4_ev)	885	icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
760	#endif	886	#endif
761	#if ENABLE_DNS	887	#if ENABLE_DNS
762	, dnsv4_ev_watcher (this, &vpn::dnsv4_ev)	888	dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
763	#endif	889	#endif
764	, tap_ev_watcher (this, &vpn::tap_ev)	890	tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
765	{
766	}	891	}
767		892
768	vpn::~vpn ()	893	vpn::~vpn ()
769	{	894	{
770	}	895	}

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/vpn.C (file contents): Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs. Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC

Diff Legend

Comparing gvpe/src/vpn.C (file contents):
Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs.
Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC