ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.42 by pcg, Sun Dec 2 00:54:52 2007 UTC vs.
Revision 1.54 by pcg, Mon Mar 23 15:22:00 2009 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
87 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
88 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
89 } 99 }
90} 100}
91 101
102inline const char *
92const char *vpn::script_if_init () 103vpn::script_if_init ()
93{ 104{
94 script_init_env (); 105 script_init_env ();
95 106
96 return tap->if_up (); 107 return tap->if_up ();
97} 108}
98 109
110inline const char *
99const char *vpn::script_if_up () 111vpn::script_if_up ()
100{ 112{
101 script_init_env (); 113 script_init_env ();
102 114
103 char *filename; 115 char *filename;
104 asprintf (&filename, 116 asprintf (&filename,
… …
108 120
109 return filename; 121 return filename;
110} 122}
111 123
112int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 setsockopt (ipv4_fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark);
141#endif
142
143 return fd;
144}
145
146int
113vpn::setup () 147vpn::setup ()
114{ 148{
149 int success = 0;
150
115 ipv4_tos = -1; 151 ipv4_tos = -1;
116 ipv4_fd = -1; 152 ipv4_fd = -1;
117 153
118 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 154 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
119 { 155 {
120 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 156 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
121 157
122 if (ipv4_fd < 0) 158 if (ipv4_fd < 0)
123 return -1; 159 return -1;
124
125 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
126 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
127 160
128#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 161#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
129 // this I really consider a linux bug. I am neither connected 162 // this I really consider a linux bug. I am neither connected
130 // nor do I fragment myself. Linux still sets DF and doesn't 163 // nor do I fragment myself. Linux still sets DF and doesn't
131 // fragment for me sometimes. 164 // fragment for me sometimes.
… …
137 170
138 sockinfo si (THISNODE, PROT_IPv4); 171 sockinfo si (THISNODE, PROT_IPv4);
139 172
140 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 173 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
141 { 174 {
142 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 175 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 176 return -1;
144 } 177 }
145 178
146 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 179 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
180 ++success;
147 } 181 }
182 else
183 THISNODE->protocols &= ~PROT_IPv4;
148 184
149 udpv4_tos = -1; 185 udpv4_tos = -1;
150 udpv4_fd = -1; 186 udpv4_fd = -1;
151 187
152 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 188 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
153 { 189 {
154 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 190 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
155 191
156 if (udpv4_fd < 0) 192 if (udpv4_fd < 0)
157 return -1; 193 return -1;
158
159 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
160 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
161 194
162 // standard daemon practise... 195 // standard daemon practise...
163 { 196 {
164 int oval = 1; 197 int oval = 1;
165 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 198 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
177 210
178 sockinfo si (THISNODE, PROT_UDPv4); 211 sockinfo si (THISNODE, PROT_UDPv4);
179 212
180 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 213 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
181 { 214 {
182 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 215 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
183 exit (EXIT_FAILURE); 216 return -1;
184 } 217 }
185 218
186 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 219 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
220 ++success;
187 } 221 }
222 else
223 THISNODE->protocols &= ~PROT_UDPv4;
188 224
189 icmpv4_tos = -1; 225 icmpv4_tos = -1;
190 icmpv4_fd = -1; 226 icmpv4_fd = -1;
191 227
192#if ENABLE_ICMP 228#if ENABLE_ICMP
193 if (THISNODE->protocols & PROT_ICMPv4) 229 if (THISNODE->protocols & PROT_ICMPv4)
194 { 230 {
195 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 231 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
196 232
197 if (icmpv4_fd < 0) 233 if (icmpv4_fd < 0)
198 return -1; 234 return -1;
199
200 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
201 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
202 235
203#ifdef ICMP_FILTER 236#ifdef ICMP_FILTER
204 { 237 {
205 icmp_filter oval; 238 icmp_filter oval;
206 oval.data = 0xffffffff; 239 oval.data = 0xffffffff;
… …
223 256
224 sockinfo si (THISNODE, PROT_ICMPv4); 257 sockinfo si (THISNODE, PROT_ICMPv4);
225 258
226 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 259 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
227 { 260 {
228 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 261 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
229 exit (EXIT_FAILURE); 262 return -1;
230 } 263 }
231 264
232 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 265 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
266 ++success;
233 } 267 }
234#endif 268#endif
235 269
236 tcpv4_fd = -1; 270 tcpv4_fd = -1;
237 271
238#if ENABLE_TCP 272#if ENABLE_TCP
239 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 273 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
240 { 274 {
241 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 275 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
242 276
243 if (tcpv4_fd < 0) 277 if (tcpv4_fd < 0)
244 return -1; 278 return -1;
245 279
246 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
247 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
248
249 // standard daemon practise... 280 // standard daemon practise...
250 { 281 {
251 int oval = 1; 282 int oval = 1;
252 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 283 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
253 } 284 }
254 285
255 sockinfo si (THISNODE, PROT_TCPv4); 286 sockinfo si (THISNODE, PROT_TCPv4);
256 287
257 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 288 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
258 { 289 {
259 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 290 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
260 exit (EXIT_FAILURE); 291 return -1;
261 } 292 }
262 293
263 if (listen (tcpv4_fd, 5)) 294 if (listen (tcpv4_fd, 5))
264 { 295 {
265 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 296 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
266 exit (EXIT_FAILURE); 297 return -1;
267 } 298 }
268 299
269 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 300 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
301 ++success;
270 } 302 }
303 else
304 THISNODE->protocols &= ~PROT_TCPv4;
271#endif 305#endif
272 306
273 dnsv4_tos = -1; 307 dnsv4_tos = -1;
274 dnsv4_fd = -1; 308 dnsv4_fd = -1;
275 309
276#if ENABLE_DNS 310#if ENABLE_DNS
277 if (THISNODE->protocols & PROT_DNSv4) 311 if (THISNODE->protocols & PROT_DNSv4)
278 { 312 {
279 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 313 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
280 314
281 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 315 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
282 316
283 if (dnsv4_fd < 0) 317 if (dnsv4_fd < 0)
284 return -1; 318 return -1;
285
286 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
287 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
288 319
289# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 320# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
290 // this I really consider a linux bug. I am neither connected 321 // this I really consider a linux bug. I am neither connected
291 // nor do I fragment myself. Linux still sets DF and doesn't 322 // nor do I fragment myself. Linux still sets DF and doesn't
292 // fragment for me sometimes. 323 // fragment for me sometimes.
… …
306 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 337 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
307 PROT_DNSv4); 338 PROT_DNSv4);
308 339
309 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 340 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
310 { 341 {
311 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 342 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
312 exit (EXIT_FAILURE); 343 return -1;
313 } 344 }
314 345
315 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 346 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
347 ++success;
316 } 348 }
317#endif 349#endif
318 350
319 ///////////////////////////////////////////////////////////////////////////// 351 /////////////////////////////////////////////////////////////////////////////
352
353 if (!success)
354 {
355 slog (L_ERR, _("no protocols enabled."));
356 return -1;
357 }
320 358
321 reconnect_all (); 359 reconnect_all ();
322 360
323 ///////////////////////////////////////////////////////////////////////////// 361 /////////////////////////////////////////////////////////////////////////////
324 362
325 tap = new tap_device (); 363 tap = new tap_device ();
326 if (!tap) //D this, of course, never catches 364 if (!tap) //D this, of course, never catches
327 { 365 {
328 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 366 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
329 exit (EXIT_FAILURE); 367 return -1;
330 } 368 }
331 369
332 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 370 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
333 371
372 run_script_cb cb;
373 cb.set<vpn, &vpn::script_if_init> (this);
374
334 if (tap->if_up () && 375 if (tap->if_up () &&
335 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 376 !run_script (cb, true))
336 { 377 {
337 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 378 slog (L_ERR, _("interface initialization command '%s' failed."),
338 tap->if_up ()); 379 tap->if_up ());
339 exit (EXIT_FAILURE); 380 return -1;
340 }
341
342 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
343 { 381 }
382
383 cb.set<vpn, &vpn::script_if_up> (this);
384 if (!run_script (cb, true))
385 {
344 slog (L_ERR, _("if-up command execution failed, exiting.")); 386 slog (L_ERR, _("if-up command execution failed."));
345 exit (EXIT_FAILURE); 387 return -1;
346 } 388 }
347 389
348 tap_ev_watcher.start (tap->fd, EV_READ); 390 tap_ev_watcher.start (tap->fd, EV_READ);
349 391
350 return 0; 392 return 0;
… …
423 { 465 {
424 // broadcast, this is ugly, but due to the security policy 466 // broadcast, this is ugly, but due to the security policy
425 // we have to connect to all hosts... 467 // we have to connect to all hosts...
426 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 468 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
427 if ((*c)->conf != THISNODE) 469 if ((*c)->conf != THISNODE)
428 (*c)->inject_data_packet (pkt, true); 470 (*c)->inject_data_packet (pkt);
429 } 471 }
430} 472}
431 473
432void 474void
433vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 475vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
434{ 476{
435 unsigned int src = pkt->src (); 477 unsigned int src = pkt->src ();
436 unsigned int dst = pkt->dst (); 478 unsigned int dst = pkt->dst ();
437 479
438 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 480 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
439 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 481 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
440 482
441 if (src == 0 || src > conns.size () 483 if (src == 0 || src > conns.size ()
442 || dst > conns.size () 484 || dst > conns.size ()
443 || pkt->typ () >= vpn_packet::PT_MAX) 485 || pkt->typ () >= vpn_packet::PT_MAX)
444 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 486 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 487 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
446 else if (dst > conns.size ()) 488 else if (dst > conns.size ())
447 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 489 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
448 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 490 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
449 else 491 else
450 { 492 {
451 connection *c = conns[src - 1]; 493 connection *c = conns[src - 1];
452 494
453 if (dst == 0) 495 if (dst == 0)
454 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 496 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
455 c->conf->nodename, (const char *)rsi); 497 c->conf->nodename, (const char *)rsi);
456 else if (dst != THISNODE->id) 498 else if (dst != THISNODE->id)
457 { 499 {
458 if (THISNODE->routerprio) 500 if (THISNODE->routerprio)
459 // the tos setting gets lost here. who cares. 501 // the tos setting gets lost here. who cares.
460 conns[dst - 1]->inject_vpn_packet (pkt); 502 conns[dst - 1]->inject_vpn_packet (pkt);
461 else 503 else
462 slog (L_WARN, 504 slog (L_WARN,
463 _("%s(%s): forwarding request (=> %s), but we are no router"), 505 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
464 c->conf->nodename, (const char *)rsi, 506 c->conf->nodename, (const char *)rsi,
465 conns[dst - 1]->conf->nodename); 507 conns[dst - 1]->conf->nodename);
466 } 508 }
467 else 509 else
468 c->recv_vpn_packet (pkt, rsi); 510 c->recv_vpn_packet (pkt, rsi);
… …
491#if ENABLE_DNS 533#if ENABLE_DNS
492 case PROT_DNSv4: 534 case PROT_DNSv4:
493 return send_dnsv4_packet (pkt, si, tos); 535 return send_dnsv4_packet (pkt, si, tos);
494#endif 536#endif
495 default: 537 default:
496 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 538 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
497 } 539 }
498 540
499 return false; 541 return false;
500} 542}
501 543
502void 544inline void
503vpn::ipv4_ev (ev::io &w, int revents) 545vpn::ipv4_ev (ev::io &w, int revents)
504{ 546{
505 if (revents & EV_READ) 547 if (revents & EV_READ)
506 { 548 {
507 vpn_packet *pkt = new vpn_packet; 549 vpn_packet *pkt = new vpn_packet;
… …
523 recv_vpn_packet (pkt, si); 565 recv_vpn_packet (pkt, si);
524 } 566 }
525 else 567 else
526 { 568 {
527 // probably ECONNRESET or somesuch 569 // probably ECONNRESET or somesuch
528 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 570 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
529 } 571 }
530 572
531 delete pkt; 573 delete pkt;
532 } 574 }
533 else 575 else
534 { 576 {
535 slog (L_ERR, 577 slog (L_ERR,
536 _("FATAL: unknown revents %08x in socket, terminating\n"), 578 _("FATAL: unknown revents %08x in socket, exiting.\n"),
537 revents); 579 revents);
538 exit (EXIT_FAILURE); 580 exit (EXIT_FAILURE);
539 } 581 }
540} 582}
541 583
542#if ENABLE_ICMP 584#if ENABLE_ICMP
543void 585inline void
544vpn::icmpv4_ev (ev::io &w, int revents) 586vpn::icmpv4_ev (ev::io &w, int revents)
545{ 587{
546 if (revents & EV_READ) 588 if (revents & EV_READ)
547 { 589 {
548 vpn_packet *pkt = new vpn_packet; 590 vpn_packet *pkt = new vpn_packet;
… …
571 } 613 }
572 } 614 }
573 else 615 else
574 { 616 {
575 // probably ECONNRESET or somesuch 617 // probably ECONNRESET or somesuch
576 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 618 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
577 } 619 }
578 620
579 delete pkt; 621 delete pkt;
580 } 622 }
581 else 623 else
582 { 624 {
583 slog (L_ERR, 625 slog (L_ERR,
584 _("FATAL: unknown revents %08x in socket, terminating\n"), 626 _("FATAL: unknown revents %08x in socket, exiting.\n"),
585 revents); 627 revents);
586 exit (EXIT_FAILURE); 628 exit (EXIT_FAILURE);
587 } 629 }
588} 630}
589#endif 631#endif
590 632
591void 633inline void
592vpn::udpv4_ev (ev::io &w, int revents) 634vpn::udpv4_ev (ev::io &w, int revents)
593{ 635{
594 if (revents & EV_READ) 636 if (revents & EV_READ)
595 { 637 {
596 vpn_packet *pkt = new vpn_packet; 638 vpn_packet *pkt = new vpn_packet;
… …
609 recv_vpn_packet (pkt, si); 651 recv_vpn_packet (pkt, si);
610 } 652 }
611 else 653 else
612 { 654 {
613 // probably ECONNRESET or somesuch 655 // probably ECONNRESET or somesuch
614 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 656 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
615 } 657 }
616 658
617 delete pkt; 659 delete pkt;
618 } 660 }
619 else 661 else
620 { 662 {
621 slog (L_ERR, 663 slog (L_ERR,
622 _("FATAL: unknown revents %08x in socket, terminating\n"), 664 _("FATAL: unknown revents %08x in socket, exiting.\n"),
623 revents); 665 revents);
624 exit (EXIT_FAILURE); 666 exit (EXIT_FAILURE);
625 } 667 }
626} 668}
627 669
628void 670inline void
629vpn::tap_ev (ev::io &w, int revents) 671vpn::tap_ev (ev::io &w, int revents)
630{ 672{
631 if (revents & EV_READ) 673 if (revents & EV_READ)
632 { 674 {
633 /* process data */ 675 /* process data */
… …
665 } 707 }
666 else 708 else
667 abort (); 709 abort ();
668} 710}
669 711
670void 712inline void
671vpn::event_cb (ev::timer &w, int) 713vpn::event_cb (ev::timer &w, int)
672{ 714{
673 if (events) 715 if (events)
674 { 716 {
675 if (events & EVENT_SHUTDOWN) 717 if (events & EVENT_SHUTDOWN)
676 { 718 {
677 slog (L_INFO, _("preparing shutdown...")); 719 slog (L_INFO, _("preparing shutdown..."));
678 720
679 shutdown_all (); 721 shutdown_all ();
680 remove_pid (conf.pidfilename); 722 remove_pid (conf.pidfilename);
681 slog (L_INFO, _("terminating")); 723 slog (L_INFO, _("exiting."));
682 exit (EXIT_SUCCESS); 724 exit (EXIT_SUCCESS);
683 } 725 }
684 726
685 if (events & EVENT_RECONNECT) 727 if (events & EVENT_RECONNECT)
686 { 728 {
687 slog (L_INFO, _("forced reconnect")); 729 slog (L_INFO, _("forced reconnect."));
688 730
689 reconnect_all (); 731 reconnect_all ();
690 } 732 }
691 733
692 events = 0; 734 events = 0;
… …
708 750
709 conns.clear (); 751 conns.clear ();
710 752
711 connection_init (); 753 connection_init ();
712 754
713 for (configuration::node_vector::iterator i = conf.nodes.begin (); 755 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
714 i != conf.nodes.end (); ++i) 756 conns.push_back (new connection (this, *i));
715 { 757
716 connection *conn = new connection (this, *i); 758 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
717 conns.push_back (conn);
718 conn->establish_connection (); 759 (*c)->establish_connection ();
719 }
720} 760}
721 761
722connection *vpn::find_router () 762bool vpn::can_direct (conf_node *src, conf_node *dst) const
723{ 763{
724 u32 prio = 1; 764 return src != dst
765 && src->may_direct (dst)
766 && dst->may_direct (src)
767 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
768 || (src->protocols & dst->connectable_protocols ()));
769}
770
771// only works for indirect and routed connections: find a router
772// from THISNODE to dst
773connection *vpn::find_router_for (const connection *dst)
774{
725 connection *router = 0; 775 connection *router = 0;
726 776
777 // first try to find a router with a direct connection, route there
778 // regardless of any other considerations.
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf != THISNODE
788 && can_direct (c->conf, dst->conf)
789 && c->ictx && c->octx)
790 {
791 prio = c->conf->routerprio;
792 router = c;
793 }
794 }
795 }
796
797 if (router)
798 return router;
799
800 // second try find the router with the highest priority, higher than ours
801 {
802 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
803
804 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
805 {
806 connection *c = *i;
807
808 if (c->conf->routerprio > prio
809 && c != dst
810 && c->conf != THISNODE
811 && c->ictx && c->octx)
812 {
813 prio = c->conf->routerprio;
814 router = c;
815 }
816 }
817 }
818
819 return router;
820}
821
822void vpn::connection_established (connection *c)
823{
727 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 824 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
728 { 825 {
729 connection *c = *i; 826 connection *o = *i;
730 827
731 if (c->conf->routerprio > prio 828 if (!o->is_direct
732 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 829 && o->si.valid ()
733 && c->ictx && c->octx 830 && c->si != o->si
734 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 831 && c == find_router_for (o))
735 {
736 prio = c->conf->routerprio;
737 router = c;
738 } 832 {
833 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
834 o->conf->nodename, c->conf->nodename);
835 o->rekey ();
836 }
739 } 837 }
740
741 return router;
742} 838}
743 839
744void vpn::send_connect_request (int id) 840void vpn::send_connect_request (connection *c)
745{ 841{
746 connection *c = find_router (); 842 connection *r = find_router_for (c);
747 843
748 if (c) 844 if (r)
845 {
846 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
847 c->conf->nodename, r->conf->nodename);
749 c->send_connect_request (id); 848 r->send_connect_request (c->conf->id);
849 }
750 else 850 else
751 // no router found, aggressively connect to all routers 851 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
752 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 852 c->conf->nodename);
753 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
754 (*i)->establish_connection ();
755} 853}
756 854
757void 855void
758connection::dump_status () 856connection::dump_status ()
759{ 857{
760 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 858 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
761 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 859 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
762 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 860 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
763 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 861 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
764 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 862 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
765 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
766 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
767} 863}
768 864
769void 865void
770vpn::dump_status () 866vpn::dump_status ()
771{ 867{
… …
776 872
777 slog (L_NOTICE, _("END status dump")); 873 slog (L_NOTICE, _("END status dump"));
778} 874}
779 875
780vpn::vpn (void) 876vpn::vpn (void)
877{
781: event (this, &vpn::event_cb) 878 event .set<vpn, &vpn::event_cb > (this);
782, udpv4_ev_watcher (this, &vpn::udpv4_ev) 879 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
783, ipv4_ev_watcher (this, &vpn::ipv4_ev) 880 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
784#if ENABLE_TCP 881#if ENABLE_TCP
785, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 882 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
786#endif 883#endif
787#if ENABLE_ICMP 884#if ENABLE_ICMP
788, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 885 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
789#endif 886#endif
790#if ENABLE_DNS 887#if ENABLE_DNS
791, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 888 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
792#endif 889#endif
793, tap_ev_watcher (this, &vpn::tap_ev) 890 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
794{
795} 891}
796 892
797vpn::~vpn () 893vpn::~vpn ()
798{ 894{
799} 895}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines