ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.44 by pcg, Tue Dec 4 17:17:20 2007 UTC vs.
Revision 1.58 by root, Tue Feb 15 13:31:23 2011 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
87 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
88 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
89 } 99 }
90} 100}
91 101
102inline const char *
92const char *vpn::script_if_init () 103vpn::script_if_init ()
93{ 104{
94 script_init_env (); 105 script_init_env ();
95 106
96 return tap->if_up (); 107 return tap->if_up ();
97} 108}
98 109
110inline const char *
99const char *vpn::script_if_up () 111vpn::script_if_up ()
100{ 112{
101 script_init_env (); 113 script_init_env ();
102 114
103 char *filename; 115 char *filename;
104 asprintf (&filename, 116 asprintf (&filename,
… …
108 120
109 return filename; 121 return filename;
110} 122}
111 123
112int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
145}
146
147int
113vpn::setup () 148vpn::setup ()
114{ 149{
150 int success = 0;
151
115 ipv4_tos = -1; 152 ipv4_tos = -1;
116 ipv4_fd = -1; 153 ipv4_fd = -1;
117 154
118 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 155 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
119 { 156 {
120 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 157 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
121 158
122 if (ipv4_fd < 0) 159 if (ipv4_fd < 0)
123 return -1; 160 return -1;
124
125 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
126 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
127 161
128#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 162#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
129 // this I really consider a linux bug. I am neither connected 163 // this I really consider a linux bug. I am neither connected
130 // nor do I fragment myself. Linux still sets DF and doesn't 164 // nor do I fragment myself. Linux still sets DF and doesn't
131 // fragment for me sometimes. 165 // fragment for me sometimes.
… …
137 171
138 sockinfo si (THISNODE, PROT_IPv4); 172 sockinfo si (THISNODE, PROT_IPv4);
139 173
140 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 174 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
141 { 175 {
142 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 176 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 177 return -1;
144 } 178 }
145 179
146 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 180 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
181 ++success;
147 } 182 }
183 else
184 THISNODE->protocols &= ~PROT_IPv4;
148 185
149 udpv4_tos = -1; 186 udpv4_tos = -1;
150 udpv4_fd = -1; 187 udpv4_fd = -1;
151 188
152 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 189 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
153 { 190 {
154 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 191 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
155 192
156 if (udpv4_fd < 0) 193 if (udpv4_fd < 0)
157 return -1; 194 return -1;
158
159 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
160 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
161 195
162 // standard daemon practise... 196 // standard daemon practise...
163 { 197 {
164 int oval = 1; 198 int oval = 1;
165 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 199 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
177 211
178 sockinfo si (THISNODE, PROT_UDPv4); 212 sockinfo si (THISNODE, PROT_UDPv4);
179 213
180 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 214 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
181 { 215 {
182 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 216 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
183 exit (EXIT_FAILURE); 217 return -1;
184 } 218 }
185 219
186 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 220 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
221 ++success;
187 } 222 }
223 else
224 THISNODE->protocols &= ~PROT_UDPv4;
188 225
189 icmpv4_tos = -1; 226 icmpv4_tos = -1;
190 icmpv4_fd = -1; 227 icmpv4_fd = -1;
191 228
192#if ENABLE_ICMP 229#if ENABLE_ICMP
193 if (THISNODE->protocols & PROT_ICMPv4) 230 if (THISNODE->protocols & PROT_ICMPv4)
194 { 231 {
195 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 232 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
196 233
197 if (icmpv4_fd < 0) 234 if (icmpv4_fd < 0)
198 return -1; 235 return -1;
199
200 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
201 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
202 236
203#ifdef ICMP_FILTER 237#ifdef ICMP_FILTER
204 { 238 {
205 icmp_filter oval; 239 icmp_filter oval;
206 oval.data = 0xffffffff; 240 oval.data = 0xffffffff;
… …
223 257
224 sockinfo si (THISNODE, PROT_ICMPv4); 258 sockinfo si (THISNODE, PROT_ICMPv4);
225 259
226 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 260 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
227 { 261 {
228 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 262 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
229 exit (EXIT_FAILURE); 263 return -1;
230 } 264 }
231 265
232 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 266 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
267 ++success;
233 } 268 }
234#endif 269#endif
235 270
236 tcpv4_fd = -1; 271 tcpv4_fd = -1;
237 272
238#if ENABLE_TCP 273#if ENABLE_TCP
239 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 274 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
240 { 275 {
241 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 276 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
242 277
243 if (tcpv4_fd < 0) 278 if (tcpv4_fd < 0)
244 return -1; 279 return -1;
245
246 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
247 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
248 280
249 // standard daemon practise... 281 // standard daemon practise...
250 { 282 {
251 int oval = 1; 283 int oval = 1;
252 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 284 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
254 286
255 sockinfo si (THISNODE, PROT_TCPv4); 287 sockinfo si (THISNODE, PROT_TCPv4);
256 288
257 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
258 { 290 {
259 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
260 exit (EXIT_FAILURE); 292 return -1;
261 } 293 }
262 294
263 if (listen (tcpv4_fd, 5)) 295 if (listen (tcpv4_fd, 5))
264 { 296 {
265 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 297 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
266 exit (EXIT_FAILURE); 298 return -1;
267 } 299 }
268 300
269 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 301 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
302 ++success;
270 } 303 }
304 else
305 THISNODE->protocols &= ~PROT_TCPv4;
271#endif 306#endif
272 307
273 dnsv4_tos = -1; 308 dnsv4_tos = -1;
274 dnsv4_fd = -1; 309 dnsv4_fd = -1;
275 310
276#if ENABLE_DNS 311#if ENABLE_DNS
277 if (THISNODE->protocols & PROT_DNSv4) 312 if (THISNODE->protocols & PROT_DNSv4)
278 { 313 {
279 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 314 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
280 315
281 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 316 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
282 317
283 if (dnsv4_fd < 0) 318 if (dnsv4_fd < 0)
284 return -1; 319 return -1;
285
286 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
287 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
288 320
289# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 321# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
290 // this I really consider a linux bug. I am neither connected 322 // this I really consider a linux bug. I am neither connected
291 // nor do I fragment myself. Linux still sets DF and doesn't 323 // nor do I fragment myself. Linux still sets DF and doesn't
292 // fragment for me sometimes. 324 // fragment for me sometimes.
… …
306 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 338 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
307 PROT_DNSv4); 339 PROT_DNSv4);
308 340
309 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 341 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
310 { 342 {
311 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 343 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
312 exit (EXIT_FAILURE); 344 return -1;
313 } 345 }
314 346
315 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 347 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
348 ++success;
316 } 349 }
317#endif 350#endif
318 351
319 ///////////////////////////////////////////////////////////////////////////// 352 /////////////////////////////////////////////////////////////////////////////
353
354 if (!success)
355 {
356 slog (L_ERR, _("no protocols enabled."));
357 return -1;
358 }
320 359
321 reconnect_all (); 360 reconnect_all ();
322 361
323 ///////////////////////////////////////////////////////////////////////////// 362 /////////////////////////////////////////////////////////////////////////////
324 363
325 tap = new tap_device (); 364 tap = new tap_device ();
326 if (!tap) //D this, of course, never catches 365 if (!tap) //D this, of course, never catches
327 { 366 {
328 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 367 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
329 exit (EXIT_FAILURE); 368 return -1;
330 } 369 }
331 370
332 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 371 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
333 372
334 run_script_cb cb; 373 run_script_cb cb;
335 cb.set<vpn, &vpn::script_if_init> (this); 374 cb.set<vpn, &vpn::script_if_init> (this);
336 375
337 if (tap->if_up () && 376 if (tap->if_up () &&
338 !run_script (cb, true)) 377 !run_script (cb, true))
339 { 378 {
340 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 379 slog (L_ERR, _("interface initialization command '%s' failed."),
341 tap->if_up ()); 380 tap->if_up ());
342 exit (EXIT_FAILURE); 381 return -1;
343 } 382 }
344 383
345 cb.set<vpn, &vpn::script_if_up> (this); 384 cb.set<vpn, &vpn::script_if_up> (this);
346 if (!run_script (cb, true)) 385 if (!run_script (cb, true))
347 { 386 {
348 slog (L_ERR, _("if-up command execution failed, exiting.")); 387 slog (L_ERR, _("if-up command execution failed."));
349 exit (EXIT_FAILURE); 388 return -1;
350 } 389 }
351 390
352 tap_ev_watcher.start (tap->fd, EV_READ); 391 tap_ev_watcher.start (tap->fd, EV_READ);
353 392
354 return 0; 393 return 0;
… …
427 { 466 {
428 // broadcast, this is ugly, but due to the security policy 467 // broadcast, this is ugly, but due to the security policy
429 // we have to connect to all hosts... 468 // we have to connect to all hosts...
430 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 469 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
431 if ((*c)->conf != THISNODE) 470 if ((*c)->conf != THISNODE)
432 (*c)->inject_data_packet (pkt, true); 471 (*c)->inject_data_packet (pkt);
433 } 472 }
434} 473}
435 474
436void 475void
437vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 476vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
438{ 477{
439 unsigned int src = pkt->src (); 478 unsigned int src = pkt->src ();
440 unsigned int dst = pkt->dst (); 479 unsigned int dst = pkt->dst ();
441 480
442 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 481 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
443 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 482 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
444 483
445 if (src == 0 || src > conns.size () 484 if (src == 0 || src > conns.size ()
446 || dst > conns.size () 485 || dst > conns.size ()
447 || pkt->typ () >= vpn_packet::PT_MAX) 486 || pkt->typ () >= vpn_packet::PT_MAX)
448 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 487 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
449 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 488 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
450 else if (dst > conns.size ()) 489 else if (dst > conns.size ())
451 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 490 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
452 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 491 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
453 else 492 else
454 { 493 {
455 connection *c = conns[src - 1]; 494 connection *c = conns[src - 1];
456 495
457 if (dst == 0) 496 if (dst == 0)
458 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 497 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
459 c->conf->nodename, (const char *)rsi); 498 c->conf->nodename, (const char *)rsi);
460 else if (dst != THISNODE->id) 499 else if (dst != THISNODE->id)
461 { 500 {
462 if (THISNODE->routerprio) 501 if (THISNODE->routerprio)
463 // the tos setting gets lost here. who cares. 502 // the tos setting gets lost here. who cares.
464 conns[dst - 1]->inject_vpn_packet (pkt); 503 conns[dst - 1]->inject_vpn_packet (pkt);
465 else 504 else
466 slog (L_WARN, 505 slog (L_WARN,
467 _("%s(%s): forwarding request (=> %s), but we are no router"), 506 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
468 c->conf->nodename, (const char *)rsi, 507 c->conf->nodename, (const char *)rsi,
469 conns[dst - 1]->conf->nodename); 508 conns[dst - 1]->conf->nodename);
470 } 509 }
471 else 510 else
472 c->recv_vpn_packet (pkt, rsi); 511 c->recv_vpn_packet (pkt, rsi);
… …
482 return send_ipv4_packet (pkt, si, tos); 521 return send_ipv4_packet (pkt, si, tos);
483 522
484 case PROT_UDPv4: 523 case PROT_UDPv4:
485 return send_udpv4_packet (pkt, si, tos); 524 return send_udpv4_packet (pkt, si, tos);
486 525
487#if ENABLE_TCP 526#if ENABLE_TCP
488 case PROT_TCPv4: 527 case PROT_TCPv4:
489 return send_tcpv4_packet (pkt, si, tos); 528 return send_tcpv4_packet (pkt, si, tos);
490#endif 529#endif
491#if ENABLE_ICMP 530#if ENABLE_ICMP
492 case PROT_ICMPv4: 531 case PROT_ICMPv4:
… …
495#if ENABLE_DNS 534#if ENABLE_DNS
496 case PROT_DNSv4: 535 case PROT_DNSv4:
497 return send_dnsv4_packet (pkt, si, tos); 536 return send_dnsv4_packet (pkt, si, tos);
498#endif 537#endif
499 default: 538 default:
500 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 539 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
501 } 540 }
502 541
503 return false; 542 return false;
504} 543}
505 544
506void 545inline void
507vpn::ipv4_ev (ev::io &w, int revents) 546vpn::ipv4_ev (ev::io &w, int revents)
508{ 547{
509 if (revents & EV_READ) 548 if (revents & EV_READ)
510 { 549 {
511 vpn_packet *pkt = new vpn_packet; 550 vpn_packet *pkt = new vpn_packet;
… …
527 recv_vpn_packet (pkt, si); 566 recv_vpn_packet (pkt, si);
528 } 567 }
529 else 568 else
530 { 569 {
531 // probably ECONNRESET or somesuch 570 // probably ECONNRESET or somesuch
532 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 571 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
533 } 572 }
534 573
535 delete pkt; 574 delete pkt;
536 } 575 }
537 else 576 else
538 { 577 {
539 slog (L_ERR, 578 slog (L_ERR,
540 _("FATAL: unknown revents %08x in socket, terminating\n"), 579 _("FATAL: unknown revents %08x in socket, exiting.\n"),
541 revents); 580 revents);
542 exit (EXIT_FAILURE); 581 exit (EXIT_FAILURE);
543 } 582 }
544} 583}
545 584
546#if ENABLE_ICMP 585#if ENABLE_ICMP
547void 586inline void
548vpn::icmpv4_ev (ev::io &w, int revents) 587vpn::icmpv4_ev (ev::io &w, int revents)
549{ 588{
550 if (revents & EV_READ) 589 if (revents & EV_READ)
551 { 590 {
552 vpn_packet *pkt = new vpn_packet; 591 vpn_packet *pkt = new vpn_packet;
… …
575 } 614 }
576 } 615 }
577 else 616 else
578 { 617 {
579 // probably ECONNRESET or somesuch 618 // probably ECONNRESET or somesuch
580 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 619 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
581 } 620 }
582 621
583 delete pkt; 622 delete pkt;
584 } 623 }
585 else 624 else
586 { 625 {
587 slog (L_ERR, 626 slog (L_ERR,
588 _("FATAL: unknown revents %08x in socket, terminating\n"), 627 _("FATAL: unknown revents %08x in socket, exiting.\n"),
589 revents); 628 revents);
590 exit (EXIT_FAILURE); 629 exit (EXIT_FAILURE);
591 } 630 }
592} 631}
593#endif 632#endif
594 633
595void 634inline void
596vpn::udpv4_ev (ev::io &w, int revents) 635vpn::udpv4_ev (ev::io &w, int revents)
597{ 636{
598 if (revents & EV_READ) 637 if (revents & EV_READ)
599 { 638 {
600 vpn_packet *pkt = new vpn_packet; 639 vpn_packet *pkt = new vpn_packet;
… …
613 recv_vpn_packet (pkt, si); 652 recv_vpn_packet (pkt, si);
614 } 653 }
615 else 654 else
616 { 655 {
617 // probably ECONNRESET or somesuch 656 // probably ECONNRESET or somesuch
618 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 657 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
619 } 658 }
620 659
621 delete pkt; 660 delete pkt;
622 } 661 }
623 else 662 else
624 { 663 {
625 slog (L_ERR, 664 slog (L_ERR,
626 _("FATAL: unknown revents %08x in socket, terminating\n"), 665 _("FATAL: unknown revents %08x in socket, exiting.\n"),
627 revents); 666 revents);
628 exit (EXIT_FAILURE); 667 exit (EXIT_FAILURE);
629 } 668 }
630} 669}
631 670
632void 671inline void
633vpn::tap_ev (ev::io &w, int revents) 672vpn::tap_ev (ev::io &w, int revents)
634{ 673{
635 if (revents & EV_READ) 674 if (revents & EV_READ)
636 { 675 {
637 /* process data */ 676 /* process data */
… …
669 } 708 }
670 else 709 else
671 abort (); 710 abort ();
672} 711}
673 712
674void 713inline void
675vpn::event_cb (ev::timer &w, int) 714vpn::event_cb (ev::timer &w, int)
676{ 715{
677 if (events) 716 if (events)
678 { 717 {
679 if (events & EVENT_SHUTDOWN) 718 if (events & EVENT_SHUTDOWN)
680 { 719 {
681 slog (L_INFO, _("preparing shutdown...")); 720 slog (L_INFO, _("preparing shutdown..."));
682 721
683 shutdown_all (); 722 shutdown_all ();
684 remove_pid (conf.pidfilename); 723 remove_pid (conf.pidfilename);
685 slog (L_INFO, _("terminating")); 724 slog (L_INFO, _("exiting."));
686 exit (EXIT_SUCCESS); 725 exit (EXIT_SUCCESS);
687 } 726 }
688 727
689 if (events & EVENT_RECONNECT) 728 if (events & EVENT_RECONNECT)
690 { 729 {
691 slog (L_INFO, _("forced reconnect")); 730 slog (L_INFO, _("forced reconnect."));
692 731
693 reconnect_all (); 732 reconnect_all ();
694 } 733 }
695 734
696 events = 0; 735 events = 0;
… …
712 751
713 conns.clear (); 752 conns.clear ();
714 753
715 connection_init (); 754 connection_init ();
716 755
717 for (configuration::node_vector::iterator i = conf.nodes.begin (); 756 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
718 i != conf.nodes.end (); ++i) 757 conns.push_back (new connection (this, *i));
719 { 758
720 connection *conn = new connection (this, *i); 759 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
721 conns.push_back (conn);
722 conn->establish_connection (); 760 (*c)->establish_connection ();
723 }
724} 761}
725 762
726connection *vpn::find_router () 763bool
764vpn::can_direct (conf_node *src, conf_node *dst) const
727{ 765{
728 u32 prio = 1; 766 return src != dst
767 && src->may_direct (dst)
768 && dst->may_direct (src)
769 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
770 || (src->protocols & dst->connectable_protocols ()));
771}
772
773// only works for indirect and routed connections: find a router
774// from THISNODE to dst
775connection *
776vpn::find_router_for (const connection *dst)
777{
729 connection *router = 0; 778 connection *router = 0;
730 779
780 // first try to find a router with a direct connection, route there
781 // regardless of any other considerations.
782 {
783 u32 prio = 1;
784
785 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
786 {
787 connection *c = *i;
788
789 if (c->conf->routerprio > prio
790 && c->conf != THISNODE
791 && can_direct (c->conf, dst->conf)
792 && c->ictx && c->octx)
793 {
794 prio = c->conf->routerprio;
795 router = c;
796 }
797 }
798 }
799
800 if (router)
801 return router;
802
803 // second try find the router with the highest priority, higher than ours
804 {
805 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
806
807 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
808 {
809 connection *c = *i;
810
811 if (c->conf->routerprio > prio
812 && c != dst
813 && c->conf != THISNODE
814 && c->ictx && c->octx)
815 {
816 prio = c->conf->routerprio;
817 router = c;
818 }
819 }
820 }
821
822 return router;
823}
824
825void
826vpn::connection_established (connection *c)
827{
731 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 828 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
732 { 829 {
733 connection *c = *i; 830 connection *o = *i;
734 831
735 if (c->conf->routerprio > prio 832 if (!o->is_direct
736 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 833 && o->si.valid ()
737 && c->ictx && c->octx 834 && c->si != o->si
738 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 835 && c == find_router_for (o))
739 {
740 prio = c->conf->routerprio;
741 router = c;
742 } 836 {
837 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
838 o->conf->nodename, c->conf->nodename);
839 o->rekey ();
840 }
743 } 841 }
744
745 return router;
746} 842}
747 843
844void
748void vpn::send_connect_request (int id) 845vpn::send_connect_request (connection *c)
749{ 846{
750 connection *c = find_router (); 847 connection *r = find_router_for (c);
751 848
752 if (c) 849 if (r)
850 {
851 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
852 c->conf->nodename, r->conf->nodename);
753 c->send_connect_request (id); 853 r->send_connect_request (c->conf->id);
854 }
754 else 855 else
755 // no router found, aggressively connect to all routers 856 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
756 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 857 c->conf->nodename);
757 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
758 (*i)->establish_connection ();
759} 858}
760 859
761void 860void
762connection::dump_status () 861connection::dump_status ()
763{ 862{
764 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 863 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
765 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 864 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
766 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 865 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
767 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 866 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
768 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 867 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
769 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
770 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
771} 868}
772 869
773void 870void
774vpn::dump_status () 871vpn::dump_status ()
775{ 872{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines