ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs.
Revision 1.57 by root, Tue Feb 8 23:13:48 2011 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
51void 73void
52vpn::script_init_env () 74vpn::script_init_env ()
53{ 75{
54 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
… …
58 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
59 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
60 82
61 char *env; 83 char *env;
62 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
63 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
64 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
65 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
66 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 86 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
67 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 87 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
68 asprintf (&env, "MTU=%d", mtu); putenv (env); 88 asprintf (&env, "MTU=%d", mtu); putenv (env);
69 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 89 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
70 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 90 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
71 THISNODE->id & 0xff); putenv (env);
72 91
73 // TODO: info for other nodes, maybe? 92 conns [THISNODE->id - 1]->script_init_env ("");
74}
75 93
94 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
95 {
96 char ext[16];
97 snprintf (ext, 16, "_%d", (*c)->conf->id);
98 (*c)->script_init_env (ext);
99 }
100}
101
102inline const char *
76const char *vpn::script_if_init () 103vpn::script_if_init ()
77{ 104{
78 script_init_env (); 105 script_init_env ();
79 106
80 return tap->if_up (); 107 return tap->if_up ();
81} 108}
82 109
110inline const char *
83const char *vpn::script_if_up () 111vpn::script_if_up ()
84{ 112{
85 script_init_env (); 113 script_init_env ();
86 114
87 char *filename; 115 char *filename;
88 asprintf (&filename, 116 asprintf (&filename,
… …
92 120
93 return filename; 121 return filename;
94} 122}
95 123
96int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
145}
146
147int
97vpn::setup () 148vpn::setup ()
98{ 149{
150 int success = 0;
151
152 ipv4_tos = -1;
99 ipv4_fd = -1; 153 ipv4_fd = -1;
100 154
101 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 155 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
102 { 156 {
103 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 157 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
104 158
105 if (ipv4_fd < 0) 159 if (ipv4_fd < 0)
106 return -1; 160 return -1;
107
108 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
109 161
110#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 162#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
111 // this I really consider a linux bug. I am neither connected 163 // this I really consider a linux bug. I am neither connected
112 // nor do I fragment myself. Linux still sets DF and doesn't 164 // nor do I fragment myself. Linux still sets DF and doesn't
113 // fragment for me sometimes. 165 // fragment for me sometimes.
… …
119 171
120 sockinfo si (THISNODE, PROT_IPv4); 172 sockinfo si (THISNODE, PROT_IPv4);
121 173
122 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 174 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
123 { 175 {
124 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 176 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
125 exit (EXIT_FAILURE); 177 return -1;
126 } 178 }
127 179
128 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 180 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
181 ++success;
129 } 182 }
183 else
184 THISNODE->protocols &= ~PROT_IPv4;
130 185
186 udpv4_tos = -1;
131 udpv4_fd = -1; 187 udpv4_fd = -1;
132 188
133 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 189 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
134 { 190 {
135 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 191 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
136 192
137 if (udpv4_fd < 0) 193 if (udpv4_fd < 0)
138 return -1; 194 return -1;
139
140 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
141 195
142 // standard daemon practise... 196 // standard daemon practise...
143 { 197 {
144 int oval = 1; 198 int oval = 1;
145 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 199 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
157 211
158 sockinfo si (THISNODE, PROT_UDPv4); 212 sockinfo si (THISNODE, PROT_UDPv4);
159 213
160 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 214 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
161 { 215 {
162 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 216 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
163 exit (EXIT_FAILURE); 217 return -1;
164 } 218 }
165 219
166 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 220 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
221 ++success;
167 } 222 }
223 else
224 THISNODE->protocols &= ~PROT_UDPv4;
168 225
226 icmpv4_tos = -1;
169 icmpv4_fd = -1; 227 icmpv4_fd = -1;
170 228
171#if ENABLE_ICMP 229#if ENABLE_ICMP
172 if (THISNODE->protocols & PROT_ICMPv4) 230 if (THISNODE->protocols & PROT_ICMPv4)
173 { 231 {
174 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 232 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
175 233
176 if (icmpv4_fd < 0) 234 if (icmpv4_fd < 0)
177 return -1; 235 return -1;
178
179 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
180 236
181#ifdef ICMP_FILTER 237#ifdef ICMP_FILTER
182 { 238 {
183 icmp_filter oval; 239 icmp_filter oval;
184 oval.data = 0xffffffff; 240 oval.data = 0xffffffff;
… …
193 // this I really consider a linux bug. I am neither connected 249 // this I really consider a linux bug. I am neither connected
194 // nor do I fragment myself. Linux still sets DF and doesn't 250 // nor do I fragment myself. Linux still sets DF and doesn't
195 // fragment for me sometimes. 251 // fragment for me sometimes.
196 { 252 {
197 int oval = IP_PMTUDISC_DONT; 253 int oval = IP_PMTUDISC_DONT;
198 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 254 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
199 } 255 }
200#endif 256#endif
201 257
202 sockinfo si (THISNODE, PROT_ICMPv4); 258 sockinfo si (THISNODE, PROT_ICMPv4);
203 259
204 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 260 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
205 { 261 {
206 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 262 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
207 exit (EXIT_FAILURE); 263 return -1;
208 } 264 }
209 265
210 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 266 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
267 ++success;
211 } 268 }
212#endif 269#endif
213 270
214 tcpv4_fd = -1; 271 tcpv4_fd = -1;
215 272
216#if ENABLE_TCP 273#if ENABLE_TCP
217 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 274 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
218 { 275 {
219 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 276 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
220 277
221 if (tcpv4_fd < 0) 278 if (tcpv4_fd < 0)
222 return -1; 279 return -1;
223
224 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
225 280
226 // standard daemon practise... 281 // standard daemon practise...
227 { 282 {
228 int oval = 1; 283 int oval = 1;
229 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 284 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
231 286
232 sockinfo si (THISNODE, PROT_TCPv4); 287 sockinfo si (THISNODE, PROT_TCPv4);
233 288
234 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
235 { 290 {
236 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
237 exit (EXIT_FAILURE); 292 return -1;
238 } 293 }
239 294
240 if (listen (tcpv4_fd, 5)) 295 if (listen (tcpv4_fd, 5))
241 { 296 {
242 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 297 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
243 exit (EXIT_FAILURE); 298 return -1;
244 } 299 }
245 300
246 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 301 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
302 ++success;
247 } 303 }
304 else
305 THISNODE->protocols &= ~PROT_TCPv4;
248#endif 306#endif
307
308 dnsv4_tos = -1;
309 dnsv4_fd = -1;
249 310
250#if ENABLE_DNS 311#if ENABLE_DNS
251 if (THISNODE->protocols & PROT_DNSv4) 312 if (THISNODE->protocols & PROT_DNSv4)
252 { 313 {
253 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 314 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
254 315
255 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 316 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
256 317
257 if (dnsv4_fd < 0) 318 if (dnsv4_fd < 0)
258 return -1; 319 return -1;
259 320
260#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 321# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
261 // this I really consider a linux bug. I am neither connected 322 // this I really consider a linux bug. I am neither connected
262 // nor do I fragment myself. Linux still sets DF and doesn't 323 // nor do I fragment myself. Linux still sets DF and doesn't
263 // fragment for me sometimes. 324 // fragment for me sometimes.
264 { 325 {
265 int oval = IP_PMTUDISC_DONT; 326 int oval = IP_PMTUDISC_DONT;
266 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 327 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
267 } 328 }
268#endif 329# endif
269 330
270 // standard daemon practise... 331 // standard daemon practise...
271 { 332 {
272 int oval = 1; 333 int oval = 1;
273 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 334 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
277 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 338 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
278 PROT_DNSv4); 339 PROT_DNSv4);
279 340
280 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 341 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
281 { 342 {
282 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 343 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
283 exit (EXIT_FAILURE); 344 return -1;
284 } 345 }
285 346
286 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 347 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
348 ++success;
349 }
350#endif
351
352 /////////////////////////////////////////////////////////////////////////////
353
354 if (!success)
287 } 355 {
288#endif 356 slog (L_ERR, _("no protocols enabled."));
357 return -1;
358 }
359
360 reconnect_all ();
361
362 /////////////////////////////////////////////////////////////////////////////
289 363
290 tap = new tap_device (); 364 tap = new tap_device ();
291 if (!tap) //D this, of course, never catches 365 if (!tap) //D this, of course, never catches
292 { 366 {
293 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 367 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
294 exit (EXIT_FAILURE); 368 return -1;
295 } 369 }
296 370
371 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
372
373 run_script_cb cb;
374 cb.set<vpn, &vpn::script_if_init> (this);
375
297 if (tap->if_up () && 376 if (tap->if_up () &&
298 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 377 !run_script (cb, true))
299 { 378 {
300 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 379 slog (L_ERR, _("interface initialization command '%s' failed."),
301 tap->if_up ()); 380 tap->if_up ());
302 exit (EXIT_FAILURE); 381 return -1;
303 }
304
305 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
306 { 382 }
383
384 cb.set<vpn, &vpn::script_if_up> (this);
385 if (!run_script (cb, true))
386 {
307 slog (L_ERR, _("if-up command execution failed, exiting.")); 387 slog (L_ERR, _("if-up command execution failed."));
308 exit (EXIT_FAILURE); 388 return -1;
309 } 389 }
310 390
311 tap_ev_watcher.start (tap->fd, EVENT_READ); 391 tap_ev_watcher.start (tap->fd, EV_READ);
312
313 reconnect_all ();
314 392
315 return 0; 393 return 0;
316} 394}
317 395
318bool 396bool
319vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 397vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
320{ 398{
321#if defined(SOL_IP) && defined(IP_TOS) 399 set_tos (ipv4_fd, ipv4_tos, tos);
322 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
323#endif
324 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 400 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
325 401
326 return true; 402 return true;
327} 403}
328 404
… …
351 427
352#if ENABLE_ICMP 428#if ENABLE_ICMP
353bool 429bool
354vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 430vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
355{ 431{
356#if defined(SOL_IP) && defined(IP_TOS)
357 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
358#endif
359
360 pkt->unshift_hdr (4); 432 pkt->unshift_hdr (4);
361 433
362 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 434 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
363 hdr->type = ::conf.icmp_type; 435 hdr->type = ::conf.icmp_type;
364 hdr->code = 255; 436 hdr->code = 255;
365 hdr->checksum = 0; 437 hdr->checksum = 0;
366 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 438 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
367 439
440 set_tos (icmpv4_fd, icmpv4_tos, tos);
368 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 441 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
369 442
370 return true; 443 return true;
371} 444}
372#endif 445#endif
373 446
374bool 447bool
375vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 448vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
376{ 449{
377#if defined(SOL_IP) && defined(IP_TOS) 450 set_tos (udpv4_fd, udpv4_tos, tos);
378 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
379#endif
380 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 451 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
381 452
382 return true; 453 return true;
383} 454}
384 455
… …
395 { 466 {
396 // broadcast, this is ugly, but due to the security policy 467 // broadcast, this is ugly, but due to the security policy
397 // we have to connect to all hosts... 468 // we have to connect to all hosts...
398 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 469 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
399 if ((*c)->conf != THISNODE) 470 if ((*c)->conf != THISNODE)
400 (*c)->inject_data_packet (pkt, true); 471 (*c)->inject_data_packet (pkt);
401 } 472 }
402} 473}
403 474
404void 475void
405vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 476vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
406{ 477{
407 unsigned int src = pkt->src (); 478 unsigned int src = pkt->src ();
408 unsigned int dst = pkt->dst (); 479 unsigned int dst = pkt->dst ();
409 480
410 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 481 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
411 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 482 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
412 483
413 if (src == 0 || src > conns.size () 484 if (src == 0 || src > conns.size ()
414 || dst > conns.size () 485 || dst > conns.size ()
415 || pkt->typ () >= vpn_packet::PT_MAX) 486 || pkt->typ () >= vpn_packet::PT_MAX)
416 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 487 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
417 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 488 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
418 else if (dst > conns.size ()) 489 else if (dst > conns.size ())
419 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 490 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
420 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 491 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
421 else 492 else
422 { 493 {
423 connection *c = conns[src - 1]; 494 connection *c = conns[src - 1];
424 495
425 if (dst == 0) 496 if (dst == 0)
426 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 497 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
427 c->conf->nodename, (const char *)rsi); 498 c->conf->nodename, (const char *)rsi);
428 else if (dst != THISNODE->id) 499 else if (dst != THISNODE->id)
429 { 500 {
430 if (THISNODE->routerprio) 501 if (THISNODE->routerprio)
431 // the tos setting gets lost here. who cares. 502 // the tos setting gets lost here. who cares.
432 conns[dst - 1]->inject_vpn_packet (pkt); 503 conns[dst - 1]->inject_vpn_packet (pkt);
433 else 504 else
434 slog (L_WARN, 505 slog (L_WARN,
435 _("%s(%s): forwarding request (=> %s), but we are no router"), 506 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
436 c->conf->nodename, (const char *)rsi, 507 c->conf->nodename, (const char *)rsi,
437 conns[dst - 1]->conf->nodename); 508 conns[dst - 1]->conf->nodename);
438 } 509 }
439 else 510 else
440 c->recv_vpn_packet (pkt, rsi); 511 c->recv_vpn_packet (pkt, rsi);
… …
446{ 517{
447 switch (si.prot) 518 switch (si.prot)
448 { 519 {
449 case PROT_IPv4: 520 case PROT_IPv4:
450 return send_ipv4_packet (pkt, si, tos); 521 return send_ipv4_packet (pkt, si, tos);
522
451 case PROT_UDPv4: 523 case PROT_UDPv4:
452 return send_udpv4_packet (pkt, si, tos); 524 return send_udpv4_packet (pkt, si, tos);
525
453#if ENABLE_TCP 526#if ENABLE_TCP
454 case PROT_TCPv4: 527 case PROT_TCPv4:
455 return send_tcpv4_packet (pkt, si, tos); 528 return send_tcpv4_packet (pkt, si, tos);
456#endif 529#endif
457#if ENABLE_ICMP 530#if ENABLE_ICMP
458 case PROT_ICMPv4: 531 case PROT_ICMPv4:
… …
460#endif 533#endif
461#if ENABLE_DNS 534#if ENABLE_DNS
462 case PROT_DNSv4: 535 case PROT_DNSv4:
463 return send_dnsv4_packet (pkt, si, tos); 536 return send_dnsv4_packet (pkt, si, tos);
464#endif 537#endif
465
466 default: 538 default:
467 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 539 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
468 } 540 }
469 541
470 return false; 542 return false;
471} 543}
472 544
473void 545inline void
474vpn::ipv4_ev (io_watcher &w, short revents) 546vpn::ipv4_ev (ev::io &w, int revents)
475{ 547{
476 if (revents & EVENT_READ) 548 if (revents & EV_READ)
477 { 549 {
478 vpn_packet *pkt = new vpn_packet; 550 vpn_packet *pkt = new vpn_packet;
479 struct sockaddr_in sa; 551 struct sockaddr_in sa;
480 socklen_t sa_len = sizeof (sa); 552 socklen_t sa_len = sizeof (sa);
481 int len; 553 int len;
… …
494 recv_vpn_packet (pkt, si); 566 recv_vpn_packet (pkt, si);
495 } 567 }
496 else 568 else
497 { 569 {
498 // probably ECONNRESET or somesuch 570 // probably ECONNRESET or somesuch
499 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 571 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
500 } 572 }
501 573
502 delete pkt; 574 delete pkt;
503 } 575 }
504 else 576 else
505 { 577 {
506 slog (L_ERR, 578 slog (L_ERR,
507 _("FATAL: unknown revents %08x in socket, terminating\n"), 579 _("FATAL: unknown revents %08x in socket, exiting.\n"),
508 revents); 580 revents);
509 exit (EXIT_FAILURE); 581 exit (EXIT_FAILURE);
510 } 582 }
511} 583}
512 584
513#if ENABLE_ICMP 585#if ENABLE_ICMP
514void 586inline void
515vpn::icmpv4_ev (io_watcher &w, short revents) 587vpn::icmpv4_ev (ev::io &w, int revents)
516{ 588{
517 if (revents & EVENT_READ) 589 if (revents & EV_READ)
518 { 590 {
519 vpn_packet *pkt = new vpn_packet; 591 vpn_packet *pkt = new vpn_packet;
520 struct sockaddr_in sa; 592 struct sockaddr_in sa;
521 socklen_t sa_len = sizeof (sa); 593 socklen_t sa_len = sizeof (sa);
522 int len; 594 int len;
… …
542 } 614 }
543 } 615 }
544 else 616 else
545 { 617 {
546 // probably ECONNRESET or somesuch 618 // probably ECONNRESET or somesuch
547 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 619 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
548 } 620 }
549 621
550 delete pkt; 622 delete pkt;
551 } 623 }
552 else 624 else
553 { 625 {
554 slog (L_ERR, 626 slog (L_ERR,
555 _("FATAL: unknown revents %08x in socket, terminating\n"), 627 _("FATAL: unknown revents %08x in socket, exiting.\n"),
556 revents); 628 revents);
557 exit (EXIT_FAILURE); 629 exit (EXIT_FAILURE);
558 } 630 }
559} 631}
560#endif 632#endif
561 633
562void 634inline void
563vpn::udpv4_ev (io_watcher &w, short revents) 635vpn::udpv4_ev (ev::io &w, int revents)
564{ 636{
565 if (revents & EVENT_READ) 637 if (revents & EV_READ)
566 { 638 {
567 vpn_packet *pkt = new vpn_packet; 639 vpn_packet *pkt = new vpn_packet;
568 struct sockaddr_in sa; 640 struct sockaddr_in sa;
569 socklen_t sa_len = sizeof (sa); 641 socklen_t sa_len = sizeof (sa);
570 int len; 642 int len;
… …
580 recv_vpn_packet (pkt, si); 652 recv_vpn_packet (pkt, si);
581 } 653 }
582 else 654 else
583 { 655 {
584 // probably ECONNRESET or somesuch 656 // probably ECONNRESET or somesuch
585 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 657 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
586 } 658 }
587 659
588 delete pkt; 660 delete pkt;
589 } 661 }
590 else 662 else
591 { 663 {
592 slog (L_ERR, 664 slog (L_ERR,
593 _("FATAL: unknown revents %08x in socket, terminating\n"), 665 _("FATAL: unknown revents %08x in socket, exiting.\n"),
594 revents); 666 revents);
595 exit (EXIT_FAILURE); 667 exit (EXIT_FAILURE);
596 } 668 }
597} 669}
598 670
599void 671inline void
600vpn::tap_ev (io_watcher &w, short revents) 672vpn::tap_ev (ev::io &w, int revents)
601{ 673{
602 if (revents & EVENT_READ) 674 if (revents & EV_READ)
603 { 675 {
604 /* process data */ 676 /* process data */
605 tap_packet *pkt; 677 tap_packet *pkt;
606 678
607 pkt = tap->recv (); 679 pkt = tap->recv ();
… …
636 } 708 }
637 else 709 else
638 abort (); 710 abort ();
639} 711}
640 712
641void 713inline void
642vpn::event_cb (time_watcher &w) 714vpn::event_cb (ev::timer &w, int)
643{ 715{
644 if (events) 716 if (events)
645 { 717 {
646 if (events & EVENT_SHUTDOWN) 718 if (events & EVENT_SHUTDOWN)
647 { 719 {
648 slog (L_INFO, _("preparing shutdown...")); 720 slog (L_INFO, _("preparing shutdown..."));
649 721
650 shutdown_all (); 722 shutdown_all ();
651 remove_pid (conf.pidfilename); 723 remove_pid (conf.pidfilename);
652 slog (L_INFO, _("terminating")); 724 slog (L_INFO, _("exiting."));
653 exit (EXIT_SUCCESS); 725 exit (EXIT_SUCCESS);
654 } 726 }
655 727
656 if (events & EVENT_RECONNECT) 728 if (events & EVENT_RECONNECT)
657 { 729 {
658 slog (L_INFO, _("forced reconnect")); 730 slog (L_INFO, _("forced reconnect."));
659 731
660 reconnect_all (); 732 reconnect_all ();
661 } 733 }
662 734
663 events = 0; 735 events = 0;
… …
679 751
680 conns.clear (); 752 conns.clear ();
681 753
682 connection_init (); 754 connection_init ();
683 755
684 for (configuration::node_vector::iterator i = conf.nodes.begin (); 756 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
685 i != conf.nodes.end (); ++i) 757 conns.push_back (new connection (this, *i));
686 { 758
687 connection *conn = new connection (this, *i); 759 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
688 conns.push_back (conn);
689 conn->establish_connection (); 760 (*c)->establish_connection ();
690 }
691} 761}
692 762
693connection *vpn::find_router () 763bool
764vpn::can_direct (conf_node *src, conf_node *dst) const
694{ 765{
695 u32 prio = 1; 766 return src != dst
767 && src->may_direct (dst)
768 && dst->may_direct (src)
769 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
770 || (src->protocols & dst->connectable_protocols ()));
771}
772
773// only works for indirect and routed connections: find a router
774// from THISNODE to dst
775connection *
776vpn::find_router_for (const connection *dst)
777{
696 connection *router = 0; 778 connection *router = 0;
697 779
780 // first try to find a router with a direct connection, route there
781 // regardless of any other considerations.
782 {
783 u32 prio = 1;
784
785 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
786 {
787 connection *c = *i;
788
789 if (c->conf->routerprio > prio
790 && c->conf != THISNODE
791 && can_direct (c->conf, dst->conf)
792 && c->ictx && c->octx)
793 {
794 prio = c->conf->routerprio;
795 router = c;
796 }
797 }
798 }
799
800 if (router)
801 return router;
802
803 // second try find the router with the highest priority, higher than ours
804 {
805 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
806
807 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
808 {
809 connection *c = *i;
810
811 if (c->conf->routerprio > prio
812 && c != dst
813 && c->conf != THISNODE
814 && c->ictx && c->octx)
815 {
816 prio = c->conf->routerprio;
817 router = c;
818 }
819 }
820 }
821
822 return router;
823}
824
825void
826vpn::connection_established (connection *c)
827{
698 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 828 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
699 { 829 {
700 connection *c = *i; 830 connection *o = *i;
701 831
702 if (c->conf->routerprio > prio 832 if (!o->is_direct
703 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 833 && o->si.valid ()
704 && c->ictx && c->octx 834 && c->si != o->si
705 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 835 && c == find_router_for (o))
706 {
707 prio = c->conf->routerprio;
708 router = c;
709 } 836 {
837 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
838 o->conf->nodename, c->conf->nodename);
839 o->rekey ();
840 }
710 } 841 }
711
712 return router;
713} 842}
714 843
844void
715void vpn::send_connect_request (int id) 845vpn::send_connect_request (connection *c)
716{ 846{
717 connection *c = find_router (); 847 connection *r = find_router_for (c);
718 848
719 if (c) 849 if (r)
850 {
851 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
852 c->conf->nodename, r->conf->nodename);
720 c->send_connect_request (id); 853 r->send_connect_request (c->conf->id);
854 }
721 else 855 else
722 // no router found, aggressively connect to all routers 856 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
723 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 857 c->conf->nodename);
724 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
725 (*i)->establish_connection ();
726} 858}
727 859
728void 860void
729connection::dump_status () 861connection::dump_status ()
730{ 862{
731 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 863 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
732 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 864 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
733 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 865 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
734 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 866 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
735 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 867 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
736 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
737 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
738} 868}
739 869
740void 870void
741vpn::dump_status () 871vpn::dump_status ()
742{ 872{
743 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 873 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
744 874
745 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 875 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
746 (*c)->dump_status (); 876 (*c)->dump_status ();
747 877
748 slog (L_NOTICE, _("END status dump")); 878 slog (L_NOTICE, _("END status dump"));
749} 879}
750 880
751vpn::vpn (void) 881vpn::vpn (void)
882{
752: event (this, &vpn::event_cb) 883 event .set<vpn, &vpn::event_cb > (this);
753, udpv4_ev_watcher (this, &vpn::udpv4_ev) 884 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
754, ipv4_ev_watcher (this, &vpn::ipv4_ev) 885 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
755#if ENABLE_TCP 886#if ENABLE_TCP
756, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 887 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
757#endif 888#endif
758#if ENABLE_ICMP 889#if ENABLE_ICMP
759, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 890 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
760#endif 891#endif
761#if ENABLE_DNS 892#if ENABLE_DNS
762, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 893 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
763#endif 894#endif
764, tap_ev_watcher (this, &vpn::tap_ev) 895 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
765{
766} 896}
767 897
768vpn::~vpn () 898vpn::~vpn ()
769{ 899{
770} 900}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines