ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.34 by pcg, Sat Mar 26 03:16:24 2005 UTC vs.
Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
51void 73void
52vpn::script_init_env () 74vpn::script_init_env ()
53{ 75{
54 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
… …
75 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
76 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
77 } 99 }
78} 100}
79 101
102inline const char *
80const char *vpn::script_if_init () 103vpn::script_if_init ()
81{ 104{
82 script_init_env (); 105 script_init_env ();
83 106
84 return tap->if_up (); 107 return tap->if_up ();
85} 108}
86 109
110inline const char *
87const char *vpn::script_if_up () 111vpn::script_if_up ()
88{ 112{
89 script_init_env (); 113 script_init_env ();
90 114
91 char *filename; 115 char *filename;
92 asprintf (&filename, 116 asprintf (&filename,
… …
96 120
97 return filename; 121 return filename;
98} 122}
99 123
100int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 setsockopt (ipv4_fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark);
141#endif
142
143 return fd;
144}
145
146int
101vpn::setup () 147vpn::setup ()
102{ 148{
149 int success = 0;
150
151 ipv4_tos = -1;
103 ipv4_fd = -1; 152 ipv4_fd = -1;
104 153
105 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 154 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106 { 155 {
107 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 156 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
108 157
109 if (ipv4_fd < 0) 158 if (ipv4_fd < 0)
110 return -1; 159 return -1;
111
112 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
113 160
114#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 161#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
115 // this I really consider a linux bug. I am neither connected 162 // this I really consider a linux bug. I am neither connected
116 // nor do I fragment myself. Linux still sets DF and doesn't 163 // nor do I fragment myself. Linux still sets DF and doesn't
117 // fragment for me sometimes. 164 // fragment for me sometimes.
… …
123 170
124 sockinfo si (THISNODE, PROT_IPv4); 171 sockinfo si (THISNODE, PROT_IPv4);
125 172
126 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 173 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
127 { 174 {
128 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 175 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
129 exit (EXIT_FAILURE); 176 return -1;
130 } 177 }
131 178
132 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 179 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
180 ++success;
133 } 181 }
182 else
183 THISNODE->protocols &= ~PROT_IPv4;
134 184
185 udpv4_tos = -1;
135 udpv4_fd = -1; 186 udpv4_fd = -1;
136 187
137 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 188 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
138 { 189 {
139 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 190 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
140 191
141 if (udpv4_fd < 0) 192 if (udpv4_fd < 0)
142 return -1; 193 return -1;
143
144 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
145 194
146 // standard daemon practise... 195 // standard daemon practise...
147 { 196 {
148 int oval = 1; 197 int oval = 1;
149 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 198 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
161 210
162 sockinfo si (THISNODE, PROT_UDPv4); 211 sockinfo si (THISNODE, PROT_UDPv4);
163 212
164 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 213 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
165 { 214 {
166 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 215 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
167 exit (EXIT_FAILURE); 216 return -1;
168 } 217 }
169 218
170 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 219 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
220 ++success;
171 } 221 }
222 else
223 THISNODE->protocols &= ~PROT_UDPv4;
172 224
225 icmpv4_tos = -1;
173 icmpv4_fd = -1; 226 icmpv4_fd = -1;
174 227
175#if ENABLE_ICMP 228#if ENABLE_ICMP
176 if (THISNODE->protocols & PROT_ICMPv4) 229 if (THISNODE->protocols & PROT_ICMPv4)
177 { 230 {
178 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 231 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
179 232
180 if (icmpv4_fd < 0) 233 if (icmpv4_fd < 0)
181 return -1; 234 return -1;
182
183 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
184 235
185#ifdef ICMP_FILTER 236#ifdef ICMP_FILTER
186 { 237 {
187 icmp_filter oval; 238 icmp_filter oval;
188 oval.data = 0xffffffff; 239 oval.data = 0xffffffff;
… …
197 // this I really consider a linux bug. I am neither connected 248 // this I really consider a linux bug. I am neither connected
198 // nor do I fragment myself. Linux still sets DF and doesn't 249 // nor do I fragment myself. Linux still sets DF and doesn't
199 // fragment for me sometimes. 250 // fragment for me sometimes.
200 { 251 {
201 int oval = IP_PMTUDISC_DONT; 252 int oval = IP_PMTUDISC_DONT;
202 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 253 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
203 } 254 }
204#endif 255#endif
205 256
206 sockinfo si (THISNODE, PROT_ICMPv4); 257 sockinfo si (THISNODE, PROT_ICMPv4);
207 258
208 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 259 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
209 { 260 {
210 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 261 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
211 exit (EXIT_FAILURE); 262 return -1;
212 } 263 }
213 264
214 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 265 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
266 ++success;
215 } 267 }
216#endif 268#endif
217 269
218 tcpv4_fd = -1; 270 tcpv4_fd = -1;
219 271
220#if ENABLE_TCP 272#if ENABLE_TCP
221 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 273 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
222 { 274 {
223 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 275 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
224 276
225 if (tcpv4_fd < 0) 277 if (tcpv4_fd < 0)
226 return -1; 278 return -1;
227 279
228 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
229
230 // standard daemon practise... 280 // standard daemon practise...
231 { 281 {
232 int oval = 1; 282 int oval = 1;
233 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 283 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
234 } 284 }
235 285
236 sockinfo si (THISNODE, PROT_TCPv4); 286 sockinfo si (THISNODE, PROT_TCPv4);
237 287
238 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 288 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
239 { 289 {
240 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 290 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
241 exit (EXIT_FAILURE); 291 return -1;
242 } 292 }
243 293
244 if (listen (tcpv4_fd, 5)) 294 if (listen (tcpv4_fd, 5))
245 { 295 {
246 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 296 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
247 exit (EXIT_FAILURE); 297 return -1;
248 } 298 }
249 299
250 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 300 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
301 ++success;
251 } 302 }
303 else
304 THISNODE->protocols &= ~PROT_TCPv4;
252#endif 305#endif
306
307 dnsv4_tos = -1;
308 dnsv4_fd = -1;
253 309
254#if ENABLE_DNS 310#if ENABLE_DNS
255 if (THISNODE->protocols & PROT_DNSv4) 311 if (THISNODE->protocols & PROT_DNSv4)
256 { 312 {
257 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 313 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
258 314
259 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 315 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
260 316
261 if (dnsv4_fd < 0) 317 if (dnsv4_fd < 0)
262 return -1; 318 return -1;
263 319
264#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 320# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
265 // this I really consider a linux bug. I am neither connected 321 // this I really consider a linux bug. I am neither connected
266 // nor do I fragment myself. Linux still sets DF and doesn't 322 // nor do I fragment myself. Linux still sets DF and doesn't
267 // fragment for me sometimes. 323 // fragment for me sometimes.
268 { 324 {
269 int oval = IP_PMTUDISC_DONT; 325 int oval = IP_PMTUDISC_DONT;
270 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 326 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
271 } 327 }
272#endif 328# endif
273 329
274 // standard daemon practise... 330 // standard daemon practise...
275 { 331 {
276 int oval = 1; 332 int oval = 1;
277 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 333 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
281 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 337 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
282 PROT_DNSv4); 338 PROT_DNSv4);
283 339
284 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 340 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
285 { 341 {
286 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 342 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
287 exit (EXIT_FAILURE); 343 return -1;
288 } 344 }
289 345
290 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 346 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
347 ++success;
291 } 348 }
292#endif 349#endif
293 350
294 ///////////////////////////////////////////////////////////////////////////// 351 /////////////////////////////////////////////////////////////////////////////
352
353 if (!success)
354 {
355 slog (L_ERR, _("no protocols enabled."));
356 return -1;
357 }
295 358
296 reconnect_all (); 359 reconnect_all ();
297 360
298 ///////////////////////////////////////////////////////////////////////////// 361 /////////////////////////////////////////////////////////////////////////////
299 362
300 tap = new tap_device (); 363 tap = new tap_device ();
301 if (!tap) //D this, of course, never catches 364 if (!tap) //D this, of course, never catches
302 { 365 {
303 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 366 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
304 exit (EXIT_FAILURE); 367 return -1;
305 } 368 }
306 369
370 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
371
372 run_script_cb cb;
373 cb.set<vpn, &vpn::script_if_init> (this);
374
307 if (tap->if_up () && 375 if (tap->if_up () &&
308 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 376 !run_script (cb, true))
309 { 377 {
310 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 378 slog (L_ERR, _("interface initialization command '%s' failed."),
311 tap->if_up ()); 379 tap->if_up ());
312 exit (EXIT_FAILURE); 380 return -1;
313 }
314
315 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
316 { 381 }
382
383 cb.set<vpn, &vpn::script_if_up> (this);
384 if (!run_script (cb, true))
385 {
317 slog (L_ERR, _("if-up command execution failed, exiting.")); 386 slog (L_ERR, _("if-up command execution failed."));
318 exit (EXIT_FAILURE); 387 return -1;
319 } 388 }
320 389
321 tap_ev_watcher.start (tap->fd, EVENT_READ); 390 tap_ev_watcher.start (tap->fd, EV_READ);
322 391
323 return 0; 392 return 0;
324} 393}
325 394
326bool 395bool
327vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 396vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
328{ 397{
329#if defined(SOL_IP) && defined(IP_TOS) 398 set_tos (ipv4_fd, ipv4_tos, tos);
330 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
331#endif
332 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 399 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
333 400
334 return true; 401 return true;
335} 402}
336 403
… …
359 426
360#if ENABLE_ICMP 427#if ENABLE_ICMP
361bool 428bool
362vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 429vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
363{ 430{
364#if defined(SOL_IP) && defined(IP_TOS)
365 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
366#endif
367
368 pkt->unshift_hdr (4); 431 pkt->unshift_hdr (4);
369 432
370 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 433 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
371 hdr->type = ::conf.icmp_type; 434 hdr->type = ::conf.icmp_type;
372 hdr->code = 255; 435 hdr->code = 255;
373 hdr->checksum = 0; 436 hdr->checksum = 0;
374 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 437 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
375 438
439 set_tos (icmpv4_fd, icmpv4_tos, tos);
376 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 440 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
377 441
378 return true; 442 return true;
379} 443}
380#endif 444#endif
381 445
382bool 446bool
383vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 447vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
384{ 448{
385#if defined(SOL_IP) && defined(IP_TOS) 449 set_tos (udpv4_fd, udpv4_tos, tos);
386 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
387#endif
388 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 450 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
389 451
390 return true; 452 return true;
391} 453}
392 454
… …
403 { 465 {
404 // broadcast, this is ugly, but due to the security policy 466 // broadcast, this is ugly, but due to the security policy
405 // we have to connect to all hosts... 467 // we have to connect to all hosts...
406 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 468 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
407 if ((*c)->conf != THISNODE) 469 if ((*c)->conf != THISNODE)
408 (*c)->inject_data_packet (pkt, true); 470 (*c)->inject_data_packet (pkt);
409 } 471 }
410} 472}
411 473
412void 474void
413vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 475vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
414{ 476{
415 unsigned int src = pkt->src (); 477 unsigned int src = pkt->src ();
416 unsigned int dst = pkt->dst (); 478 unsigned int dst = pkt->dst ();
417 479
418 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 480 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
419 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 481 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
420 482
421 if (src == 0 || src > conns.size () 483 if (src == 0 || src > conns.size ()
422 || dst > conns.size () 484 || dst > conns.size ()
423 || pkt->typ () >= vpn_packet::PT_MAX) 485 || pkt->typ () >= vpn_packet::PT_MAX)
424 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 486 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
425 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 487 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
426 else if (dst > conns.size ()) 488 else if (dst > conns.size ())
427 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 489 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
428 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 490 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
429 else 491 else
430 { 492 {
431 connection *c = conns[src - 1]; 493 connection *c = conns[src - 1];
432 494
433 if (dst == 0) 495 if (dst == 0)
434 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 496 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
435 c->conf->nodename, (const char *)rsi); 497 c->conf->nodename, (const char *)rsi);
436 else if (dst != THISNODE->id) 498 else if (dst != THISNODE->id)
437 { 499 {
438 if (THISNODE->routerprio) 500 if (THISNODE->routerprio)
439 // the tos setting gets lost here. who cares. 501 // the tos setting gets lost here. who cares.
440 conns[dst - 1]->inject_vpn_packet (pkt); 502 conns[dst - 1]->inject_vpn_packet (pkt);
441 else 503 else
442 slog (L_WARN, 504 slog (L_WARN,
443 _("%s(%s): forwarding request (=> %s), but we are no router"), 505 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
444 c->conf->nodename, (const char *)rsi, 506 c->conf->nodename, (const char *)rsi,
445 conns[dst - 1]->conf->nodename); 507 conns[dst - 1]->conf->nodename);
446 } 508 }
447 else 509 else
448 c->recv_vpn_packet (pkt, rsi); 510 c->recv_vpn_packet (pkt, rsi);
… …
454{ 516{
455 switch (si.prot) 517 switch (si.prot)
456 { 518 {
457 case PROT_IPv4: 519 case PROT_IPv4:
458 return send_ipv4_packet (pkt, si, tos); 520 return send_ipv4_packet (pkt, si, tos);
521
459 case PROT_UDPv4: 522 case PROT_UDPv4:
460 return send_udpv4_packet (pkt, si, tos); 523 return send_udpv4_packet (pkt, si, tos);
524
461#if ENABLE_TCP 525#if ENABLE_TCP
462 case PROT_TCPv4: 526 case PROT_TCPv4:
463 return send_tcpv4_packet (pkt, si, tos); 527 return send_tcpv4_packet (pkt, si, tos);
464#endif 528#endif
465#if ENABLE_ICMP 529#if ENABLE_ICMP
… …
468#endif 532#endif
469#if ENABLE_DNS 533#if ENABLE_DNS
470 case PROT_DNSv4: 534 case PROT_DNSv4:
471 return send_dnsv4_packet (pkt, si, tos); 535 return send_dnsv4_packet (pkt, si, tos);
472#endif 536#endif
473
474 default: 537 default:
475 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 538 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
476 } 539 }
477 540
478 return false; 541 return false;
479} 542}
480 543
481void 544inline void
482vpn::ipv4_ev (io_watcher &w, short revents) 545vpn::ipv4_ev (ev::io &w, int revents)
483{ 546{
484 if (revents & EVENT_READ) 547 if (revents & EV_READ)
485 { 548 {
486 vpn_packet *pkt = new vpn_packet; 549 vpn_packet *pkt = new vpn_packet;
487 struct sockaddr_in sa; 550 struct sockaddr_in sa;
488 socklen_t sa_len = sizeof (sa); 551 socklen_t sa_len = sizeof (sa);
489 int len; 552 int len;
… …
502 recv_vpn_packet (pkt, si); 565 recv_vpn_packet (pkt, si);
503 } 566 }
504 else 567 else
505 { 568 {
506 // probably ECONNRESET or somesuch 569 // probably ECONNRESET or somesuch
507 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 570 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
508 } 571 }
509 572
510 delete pkt; 573 delete pkt;
511 } 574 }
512 else 575 else
513 { 576 {
514 slog (L_ERR, 577 slog (L_ERR,
515 _("FATAL: unknown revents %08x in socket, terminating\n"), 578 _("FATAL: unknown revents %08x in socket, exiting.\n"),
516 revents); 579 revents);
517 exit (EXIT_FAILURE); 580 exit (EXIT_FAILURE);
518 } 581 }
519} 582}
520 583
521#if ENABLE_ICMP 584#if ENABLE_ICMP
522void 585inline void
523vpn::icmpv4_ev (io_watcher &w, short revents) 586vpn::icmpv4_ev (ev::io &w, int revents)
524{ 587{
525 if (revents & EVENT_READ) 588 if (revents & EV_READ)
526 { 589 {
527 vpn_packet *pkt = new vpn_packet; 590 vpn_packet *pkt = new vpn_packet;
528 struct sockaddr_in sa; 591 struct sockaddr_in sa;
529 socklen_t sa_len = sizeof (sa); 592 socklen_t sa_len = sizeof (sa);
530 int len; 593 int len;
… …
550 } 613 }
551 } 614 }
552 else 615 else
553 { 616 {
554 // probably ECONNRESET or somesuch 617 // probably ECONNRESET or somesuch
555 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 618 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
556 } 619 }
557 620
558 delete pkt; 621 delete pkt;
559 } 622 }
560 else 623 else
561 { 624 {
562 slog (L_ERR, 625 slog (L_ERR,
563 _("FATAL: unknown revents %08x in socket, terminating\n"), 626 _("FATAL: unknown revents %08x in socket, exiting.\n"),
564 revents); 627 revents);
565 exit (EXIT_FAILURE); 628 exit (EXIT_FAILURE);
566 } 629 }
567} 630}
568#endif 631#endif
569 632
570void 633inline void
571vpn::udpv4_ev (io_watcher &w, short revents) 634vpn::udpv4_ev (ev::io &w, int revents)
572{ 635{
573 if (revents & EVENT_READ) 636 if (revents & EV_READ)
574 { 637 {
575 vpn_packet *pkt = new vpn_packet; 638 vpn_packet *pkt = new vpn_packet;
576 struct sockaddr_in sa; 639 struct sockaddr_in sa;
577 socklen_t sa_len = sizeof (sa); 640 socklen_t sa_len = sizeof (sa);
578 int len; 641 int len;
… …
588 recv_vpn_packet (pkt, si); 651 recv_vpn_packet (pkt, si);
589 } 652 }
590 else 653 else
591 { 654 {
592 // probably ECONNRESET or somesuch 655 // probably ECONNRESET or somesuch
593 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 656 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
594 } 657 }
595 658
596 delete pkt; 659 delete pkt;
597 } 660 }
598 else 661 else
599 { 662 {
600 slog (L_ERR, 663 slog (L_ERR,
601 _("FATAL: unknown revents %08x in socket, terminating\n"), 664 _("FATAL: unknown revents %08x in socket, exiting.\n"),
602 revents); 665 revents);
603 exit (EXIT_FAILURE); 666 exit (EXIT_FAILURE);
604 } 667 }
605} 668}
606 669
607void 670inline void
608vpn::tap_ev (io_watcher &w, short revents) 671vpn::tap_ev (ev::io &w, int revents)
609{ 672{
610 if (revents & EVENT_READ) 673 if (revents & EV_READ)
611 { 674 {
612 /* process data */ 675 /* process data */
613 tap_packet *pkt; 676 tap_packet *pkt;
614 677
615 pkt = tap->recv (); 678 pkt = tap->recv ();
… …
644 } 707 }
645 else 708 else
646 abort (); 709 abort ();
647} 710}
648 711
649void 712inline void
650vpn::event_cb (time_watcher &w) 713vpn::event_cb (ev::timer &w, int)
651{ 714{
652 if (events) 715 if (events)
653 { 716 {
654 if (events & EVENT_SHUTDOWN) 717 if (events & EVENT_SHUTDOWN)
655 { 718 {
656 slog (L_INFO, _("preparing shutdown...")); 719 slog (L_INFO, _("preparing shutdown..."));
657 720
658 shutdown_all (); 721 shutdown_all ();
659 remove_pid (conf.pidfilename); 722 remove_pid (conf.pidfilename);
660 slog (L_INFO, _("terminating")); 723 slog (L_INFO, _("exiting."));
661 exit (EXIT_SUCCESS); 724 exit (EXIT_SUCCESS);
662 } 725 }
663 726
664 if (events & EVENT_RECONNECT) 727 if (events & EVENT_RECONNECT)
665 { 728 {
666 slog (L_INFO, _("forced reconnect")); 729 slog (L_INFO, _("forced reconnect."));
667 730
668 reconnect_all (); 731 reconnect_all ();
669 } 732 }
670 733
671 events = 0; 734 events = 0;
… …
687 750
688 conns.clear (); 751 conns.clear ();
689 752
690 connection_init (); 753 connection_init ();
691 754
692 for (configuration::node_vector::iterator i = conf.nodes.begin (); 755 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
693 i != conf.nodes.end (); ++i) 756 conns.push_back (new connection (this, *i));
694 { 757
695 connection *conn = new connection (this, *i); 758 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
696 conns.push_back (conn);
697 conn->establish_connection (); 759 (*c)->establish_connection ();
698 }
699} 760}
700 761
701connection *vpn::find_router () 762bool vpn::can_direct (conf_node *src, conf_node *dst) const
702{ 763{
703 u32 prio = 1; 764 return src != dst
765 && src->may_direct (dst)
766 && dst->may_direct (src)
767 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
768 || (src->protocols & dst->connectable_protocols ()));
769}
770
771// only works for indirect and routed connections: find a router
772// from THISNODE to dst
773connection *vpn::find_router_for (const connection *dst)
774{
704 connection *router = 0; 775 connection *router = 0;
705 776
777 // first try to find a router with a direct connection, route there
778 // regardless of any other considerations.
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf != THISNODE
788 && can_direct (c->conf, dst->conf)
789 && c->ictx && c->octx)
790 {
791 prio = c->conf->routerprio;
792 router = c;
793 }
794 }
795 }
796
797 if (router)
798 return router;
799
800 // second try find the router with the highest priority, higher than ours
801 {
802 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
803
804 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
805 {
806 connection *c = *i;
807
808 if (c->conf->routerprio > prio
809 && c != dst
810 && c->conf != THISNODE
811 && c->ictx && c->octx)
812 {
813 prio = c->conf->routerprio;
814 router = c;
815 }
816 }
817 }
818
819 return router;
820}
821
822void vpn::connection_established (connection *c)
823{
706 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 824 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
707 { 825 {
708 connection *c = *i; 826 connection *o = *i;
709 827
710 if (c->conf->routerprio > prio 828 if (!o->is_direct
711 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 829 && o->si.valid ()
712 && c->ictx && c->octx 830 && c->si != o->si
713 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 831 && c == find_router_for (o))
714 {
715 prio = c->conf->routerprio;
716 router = c;
717 } 832 {
833 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
834 o->conf->nodename, c->conf->nodename);
835 o->rekey ();
836 }
718 } 837 }
719
720 return router;
721} 838}
722 839
723void vpn::send_connect_request (int id) 840void vpn::send_connect_request (connection *c)
724{ 841{
725 connection *c = find_router (); 842 connection *r = find_router_for (c);
726 843
727 if (c) 844 if (r)
845 {
846 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
847 c->conf->nodename, r->conf->nodename);
728 c->send_connect_request (id); 848 r->send_connect_request (c->conf->id);
849 }
729 else 850 else
730 // no router found, aggressively connect to all routers 851 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
731 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 852 c->conf->nodename);
732 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
733 (*i)->establish_connection ();
734} 853}
735 854
736void 855void
737connection::dump_status () 856connection::dump_status ()
738{ 857{
739 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 858 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
740 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 859 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
741 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 860 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
742 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 861 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
743 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 862 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
744 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
745 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
746} 863}
747 864
748void 865void
749vpn::dump_status () 866vpn::dump_status ()
750{ 867{
751 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 868 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
752 869
753 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 870 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
754 (*c)->dump_status (); 871 (*c)->dump_status ();
755 872
756 slog (L_NOTICE, _("END status dump")); 873 slog (L_NOTICE, _("END status dump"));
757} 874}
758 875
759vpn::vpn (void) 876vpn::vpn (void)
877{
760: event (this, &vpn::event_cb) 878 event .set<vpn, &vpn::event_cb > (this);
761, udpv4_ev_watcher (this, &vpn::udpv4_ev) 879 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
762, ipv4_ev_watcher (this, &vpn::ipv4_ev) 880 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
763#if ENABLE_TCP 881#if ENABLE_TCP
764, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 882 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
765#endif 883#endif
766#if ENABLE_ICMP 884#if ENABLE_ICMP
767, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 885 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
768#endif 886#endif
769#if ENABLE_DNS 887#if ENABLE_DNS
770, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 888 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
771#endif 889#endif
772, tap_ev_watcher (this, &vpn::tap_ev) 890 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
773{
774} 891}
775 892
776vpn::~vpn () 893vpn::~vpn ()
777{ 894{
778} 895}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines