ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.29 by pcg, Fri Mar 4 04:52:38 2005 UTC vs.
Revision 1.61 by root, Fri Sep 16 18:08:03 2011 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
51const char *vpn::script_if_up () 61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
73void
74vpn::script_init_env ()
52{ 75{
53 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
54 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
55 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 78 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
56 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 79 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
57 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
58 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
59 82
60 char *env; 83 char *env;
61 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
62 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
63 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
64 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
65 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 86 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
66 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 87 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
67 asprintf (&env, "MTU=%d", mtu); putenv (env); 88 asprintf (&env, "MTU=%d", mtu); putenv (env);
68 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 89 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
69 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 90 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
70 THISNODE->id & 0xff);
71 putenv (env);
72 91
92 conns [THISNODE->id - 1]->script_init_env ("");
93
94 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
95 {
96 char ext[16];
97 snprintf (ext, 16, "_%d", (*c)->conf->id);
98 (*c)->script_init_env (ext);
99 }
100}
101
102inline const char *
103vpn::script_if_init ()
104{
105 script_init_env ();
106
107 return tap->if_up ();
108}
109
110inline const char *
111vpn::script_if_up ()
112{
113 script_init_env ();
114
115 char *filename;
116 asprintf (&filename,
117 "%s/%s",
118 confbase,
73 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 119 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
120
121 return filename;
122}
123
124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
74} 145}
75 146
76int 147int
77vpn::setup () 148vpn::setup ()
78{ 149{
150 int success = 0;
151
152 ipv4_tos = -1;
79 ipv4_fd = -1; 153 ipv4_fd = -1;
80 154
81 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 155 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
82 { 156 {
83 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 157 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
84 158
85 if (ipv4_fd < 0) 159 if (ipv4_fd < 0)
86 return -1; 160 return -1;
87
88 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
89 161
90#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 162#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
91 // this I really consider a linux bug. I am neither connected 163 // this I really consider a linux bug. I am neither connected
92 // nor do I fragment myself. Linux still sets DF and doesn't 164 // nor do I fragment myself. Linux still sets DF and doesn't
93 // fragment for me sometimes. 165 // fragment for me sometimes.
… …
99 171
100 sockinfo si (THISNODE, PROT_IPv4); 172 sockinfo si (THISNODE, PROT_IPv4);
101 173
102 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 174 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
103 { 175 {
104 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 176 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
105 exit (EXIT_FAILURE); 177 return -1;
106 } 178 }
107 179
108 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 180 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
181 ++success;
109 } 182 }
183 else
184 THISNODE->protocols &= ~PROT_IPv4;
110 185
186 udpv4_tos = -1;
111 udpv4_fd = -1; 187 udpv4_fd = -1;
112 188
113 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 189 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
114 { 190 {
115 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 191 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
116 192
117 if (udpv4_fd < 0) 193 if (udpv4_fd < 0)
118 return -1; 194 return -1;
119
120 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
121 195
122 // standard daemon practise... 196 // standard daemon practise...
123 { 197 {
124 int oval = 1; 198 int oval = 1;
125 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 199 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
137 211
138 sockinfo si (THISNODE, PROT_UDPv4); 212 sockinfo si (THISNODE, PROT_UDPv4);
139 213
140 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 214 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
141 { 215 {
142 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 216 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 217 return -1;
144 } 218 }
145 219
146 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 220 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
221 ++success;
147 } 222 }
223 else
224 THISNODE->protocols &= ~PROT_UDPv4;
148 225
226 icmpv4_tos = -1;
149 icmpv4_fd = -1; 227 icmpv4_fd = -1;
150 228
151#if ENABLE_ICMP 229#if ENABLE_ICMP
152 if (THISNODE->protocols & PROT_ICMPv4) 230 if (THISNODE->protocols & PROT_ICMPv4)
153 { 231 {
154 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 232 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
155 233
156 if (icmpv4_fd < 0) 234 if (icmpv4_fd < 0)
157 return -1; 235 return -1;
158
159 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
160 236
161#ifdef ICMP_FILTER 237#ifdef ICMP_FILTER
162 { 238 {
163 icmp_filter oval; 239 icmp_filter oval;
164 oval.data = 0xffffffff; 240 oval.data = 0xffffffff;
… …
173 // this I really consider a linux bug. I am neither connected 249 // this I really consider a linux bug. I am neither connected
174 // nor do I fragment myself. Linux still sets DF and doesn't 250 // nor do I fragment myself. Linux still sets DF and doesn't
175 // fragment for me sometimes. 251 // fragment for me sometimes.
176 { 252 {
177 int oval = IP_PMTUDISC_DONT; 253 int oval = IP_PMTUDISC_DONT;
178 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 254 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
179 } 255 }
180#endif 256#endif
181 257
182 sockinfo si (THISNODE, PROT_ICMPv4); 258 sockinfo si (THISNODE, PROT_ICMPv4);
183 259
184 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 260 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
185 { 261 {
186 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 262 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
187 exit (EXIT_FAILURE); 263 return -1;
188 } 264 }
189 265
190 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 266 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
267 ++success;
191 } 268 }
192#endif 269#endif
193 270
194 tcpv4_fd = -1; 271 tcpv4_fd = -1;
195 272
196#if ENABLE_TCP 273#if ENABLE_TCP
197 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 274 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
198 { 275 {
199 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 276 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
200 277
201 if (tcpv4_fd < 0) 278 if (tcpv4_fd < 0)
202 return -1; 279 return -1;
203 280
204 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
205
206 // standard daemon practise... 281 // standard daemon practise...
207 { 282 {
208 int oval = 1; 283 int oval = 1;
209 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 284 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
210 } 285 }
211 286
212 sockinfo si (THISNODE, PROT_TCPv4); 287 sockinfo si (THISNODE, PROT_TCPv4);
213 288
214 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
215 { 290 {
216 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
217 exit (EXIT_FAILURE); 292 return -1;
218 } 293 }
219 294
220 if (listen (tcpv4_fd, 5)) 295 if (listen (tcpv4_fd, 5))
221 { 296 {
222 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 297 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
223 exit (EXIT_FAILURE); 298 return -1;
224 } 299 }
225 300
226 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 301 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
302 ++success;
227 } 303 }
304 else
305 THISNODE->protocols &= ~PROT_TCPv4;
228#endif 306#endif
307
308 dnsv4_tos = -1;
309 dnsv4_fd = -1;
229 310
230#if ENABLE_DNS 311#if ENABLE_DNS
231 if (THISNODE->protocols & PROT_DNSv4) 312 if (THISNODE->protocols & PROT_DNSv4)
232 { 313 {
233 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 314 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
234 315
235 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 316 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
236 317
237 if (dnsv4_fd < 0) 318 if (dnsv4_fd < 0)
238 return -1; 319 return -1;
239 320
321# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
322 // this I really consider a linux bug. I am neither connected
323 // nor do I fragment myself. Linux still sets DF and doesn't
324 // fragment for me sometimes.
325 {
326 int oval = IP_PMTUDISC_DONT;
327 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
328 }
329# endif
330
240 // standard daemon practise... 331 // standard daemon practise...
241 { 332 {
242 int oval = 1; 333 int oval = 1;
243 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 334 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
244 } 335 }
245 336
246 sockinfo si (THISNODE, PROT_DNSv4); 337 sockinfo si (THISNODE->dns_hostname,
338 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
339 PROT_DNSv4);
247 340
248 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 341 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
249 { 342 {
250 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 343 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
251 exit (EXIT_FAILURE); 344 return -1;
252 } 345 }
253 346
254 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 347 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
348 ++success;
349 }
350#endif
351
352 /////////////////////////////////////////////////////////////////////////////
353
354 if (!success)
255 } 355 {
256#endif 356 slog (L_ERR, _("no protocols enabled."));
357 return -1;
358 }
359
360 reconnect_all ();
361
362 /////////////////////////////////////////////////////////////////////////////
257 363
258 tap = new tap_device (); 364 tap = new tap_device ();
259 if (!tap) //D this, of course, never catches 365 if (!tap) //D this, of course, never catches
260 { 366 {
261 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 367 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
262 exit (EXIT_FAILURE); 368 return -1;
263 } 369 }
264 370
265 run_script (run_script_cb (this, &vpn::script_if_up), true); 371 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
266 372
373 run_script_cb cb;
374 cb.set<vpn, &vpn::script_if_init> (this);
375
376 if (tap->if_up () &&
377 !run_script (cb, true))
378 {
379 slog (L_ERR, _("interface initialization command '%s' failed."),
380 tap->if_up ());
381 return -1;
382 }
383
384 cb.set<vpn, &vpn::script_if_up> (this);
385 if (!run_script (cb, true))
386 {
387 slog (L_ERR, _("if-up command execution failed."));
388 return -1;
389 }
390
267 tap_ev_watcher.start (tap->fd, EVENT_READ); 391 tap_ev_watcher.start (tap->fd, EV_READ);
268
269 reconnect_all ();
270 392
271 return 0; 393 return 0;
272} 394}
273 395
274bool 396bool
275vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 397vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
276{ 398{
277#if defined(SOL_IP) && defined(IP_TOS) 399 set_tos (ipv4_fd, ipv4_tos, tos);
278 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
279#endif
280 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 400 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
281 401
282 return true; 402 return true;
283} 403}
284 404
… …
307 427
308#if ENABLE_ICMP 428#if ENABLE_ICMP
309bool 429bool
310vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 430vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
311{ 431{
312#if defined(SOL_IP) && defined(IP_TOS)
313 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
314#endif
315
316 pkt->unshift_hdr (4); 432 pkt->unshift_hdr (4);
317 433
318 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 434 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
319 hdr->type = ::conf.icmp_type; 435 hdr->type = ::conf.icmp_type;
320 hdr->code = 255; 436 hdr->code = 255;
321 hdr->checksum = 0; 437 hdr->checksum = 0;
322 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 438 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
323 439
440 set_tos (icmpv4_fd, icmpv4_tos, tos);
324 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 441 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
325 442
326 return true; 443 return true;
327} 444}
328#endif 445#endif
329 446
330bool 447bool
331vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 448vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
332{ 449{
333#if defined(SOL_IP) && defined(IP_TOS) 450 set_tos (udpv4_fd, udpv4_tos, tos);
334 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
335#endif
336 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 451 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
337 452
338 return true; 453 return true;
339} 454}
340 455
… …
351 { 466 {
352 // broadcast, this is ugly, but due to the security policy 467 // broadcast, this is ugly, but due to the security policy
353 // we have to connect to all hosts... 468 // we have to connect to all hosts...
354 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 469 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
355 if ((*c)->conf != THISNODE) 470 if ((*c)->conf != THISNODE)
356 (*c)->inject_data_packet (pkt, true); 471 (*c)->inject_data_packet (pkt);
357 } 472 }
358} 473}
359 474
360void 475void
361vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 476vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
362{ 477{
363 unsigned int src = pkt->src (); 478 unsigned int src = pkt->src ();
364 unsigned int dst = pkt->dst (); 479 unsigned int dst = pkt->dst ();
365 480
366 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 481 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
367 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 482 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
368 483
369 if (src == 0 || src > conns.size () 484 if (src == 0 || src > conns.size ()
370 || dst > conns.size () 485 || dst > conns.size ()
371 || pkt->typ () >= vpn_packet::PT_MAX) 486 || pkt->typ () >= vpn_packet::PT_MAX)
372 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 487 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
373 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 488 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
374 else if (dst > conns.size ())
375 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
376 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
377 else 489 else
378 { 490 {
379 connection *c = conns[src - 1]; 491 connection *c = conns[src - 1];
380 492
381 if (dst == 0) 493 if (dst == 0)
382 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 494 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
383 c->conf->nodename, (const char *)rsi); 495 c->conf->nodename, (const char *)rsi);
384 else if (dst != THISNODE->id) 496 else if (dst != THISNODE->id)
385 { 497 {
386 if (THISNODE->routerprio) 498 if (THISNODE->routerprio)
387 // the tos setting gets lost here. who cares. 499 // the tos setting gets lost here. who cares.
388 conns[dst - 1]->inject_vpn_packet (pkt); 500 conns[dst - 1]->inject_vpn_packet (pkt);
389 else 501 else
390 slog (L_WARN, 502 slog (L_WARN,
391 _("%s(%s): forwarding request (=> %s), but we are no router"), 503 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
392 c->conf->nodename, (const char *)rsi, 504 c->conf->nodename, (const char *)rsi,
393 conns[dst - 1]->conf->nodename); 505 conns[dst - 1]->conf->nodename);
394 } 506 }
395 else 507 else
396 c->recv_vpn_packet (pkt, rsi); 508 c->recv_vpn_packet (pkt, rsi);
397 } 509 }
398} 510}
399 511
400void 512bool
513vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
514{
515 switch (si.prot)
516 {
517 case PROT_IPv4:
518 return send_ipv4_packet (pkt, si, tos);
519
520 case PROT_UDPv4:
521 return send_udpv4_packet (pkt, si, tos);
522
523#if ENABLE_TCP
524 case PROT_TCPv4:
525 return send_tcpv4_packet (pkt, si, tos);
526#endif
527#if ENABLE_ICMP
528 case PROT_ICMPv4:
529 return send_icmpv4_packet (pkt, si, tos);
530#endif
531#if ENABLE_DNS
532 case PROT_DNSv4:
533 return send_dnsv4_packet (pkt, si, tos);
534#endif
535 default:
536 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
537 }
538
539 return false;
540}
541
542inline void
401vpn::ipv4_ev (io_watcher &w, short revents) 543vpn::ipv4_ev (ev::io &w, int revents)
402{ 544{
403 if (revents & EVENT_READ) 545 if (revents & EV_READ)
404 { 546 {
405 vpn_packet *pkt = new vpn_packet; 547 vpn_packet *pkt = new vpn_packet;
406 struct sockaddr_in sa; 548 struct sockaddr_in sa;
407 socklen_t sa_len = sizeof (sa); 549 socklen_t sa_len = sizeof (sa);
408 int len; 550 int len;
… …
413 555
414 if (len > 0) 556 if (len > 0)
415 { 557 {
416 pkt->len = len; 558 pkt->len = len;
417 559
418 // raw sockets deliver the ipv4, but don't expect it on sends 560 // raw sockets deliver the ipv4 header, but don't expect it on sends
419 // this is slow, but... 561 pkt->skip_hdr (pkt->ipv4_hdr_len ());
420 pkt->skip_hdr (IP_OVERHEAD);
421 562
422 recv_vpn_packet (pkt, si); 563 recv_vpn_packet (pkt, si);
423 } 564 }
424 else 565 else
425 { 566 {
426 // probably ECONNRESET or somesuch 567 // probably ECONNRESET or somesuch
427 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 568 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
428 } 569 }
429 570
430 delete pkt; 571 delete pkt;
431 } 572 }
432 else 573 else
433 { 574 {
434 slog (L_ERR, 575 slog (L_ERR,
435 _("FATAL: unknown revents %08x in socket, terminating\n"), 576 _("FATAL: unknown revents %08x in socket, exiting.\n"),
436 revents); 577 revents);
437 exit (EXIT_FAILURE); 578 exit (EXIT_FAILURE);
438 } 579 }
439} 580}
440 581
441#if ENABLE_ICMP 582#if ENABLE_ICMP
442void 583inline void
443vpn::icmpv4_ev (io_watcher &w, short revents) 584vpn::icmpv4_ev (ev::io &w, int revents)
444{ 585{
445 if (revents & EVENT_READ) 586 if (revents & EV_READ)
446 { 587 {
447 vpn_packet *pkt = new vpn_packet; 588 vpn_packet *pkt = new vpn_packet;
448 struct sockaddr_in sa; 589 struct sockaddr_in sa;
449 socklen_t sa_len = sizeof (sa); 590 socklen_t sa_len = sizeof (sa);
450 int len; 591 int len;
… …
462 if (hdr->type == ::conf.icmp_type 603 if (hdr->type == ::conf.icmp_type
463 && hdr->code == 255) 604 && hdr->code == 255)
464 { 605 {
465 // raw sockets deliver the ipv4, but don't expect it on sends 606 // raw sockets deliver the ipv4, but don't expect it on sends
466 // this is slow, but... 607 // this is slow, but...
467 pkt->skip_hdr (ICMP_OVERHEAD); 608 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
468 609
469 recv_vpn_packet (pkt, si); 610 recv_vpn_packet (pkt, si);
470 } 611 }
471 } 612 }
472 else 613 else
473 { 614 {
474 // probably ECONNRESET or somesuch 615 // probably ECONNRESET or somesuch
475 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 616 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
476 } 617 }
477 618
478 delete pkt; 619 delete pkt;
479 } 620 }
480 else 621 else
481 { 622 {
482 slog (L_ERR, 623 slog (L_ERR,
483 _("FATAL: unknown revents %08x in socket, terminating\n"), 624 _("FATAL: unknown revents %08x in socket, exiting.\n"),
484 revents); 625 revents);
485 exit (EXIT_FAILURE); 626 exit (EXIT_FAILURE);
486 } 627 }
487} 628}
488#endif 629#endif
489 630
490void 631inline void
491vpn::udpv4_ev (io_watcher &w, short revents) 632vpn::udpv4_ev (ev::io &w, int revents)
492{ 633{
493 if (revents & EVENT_READ) 634 if (revents & EV_READ)
494 { 635 {
495 vpn_packet *pkt = new vpn_packet; 636 vpn_packet *pkt = new vpn_packet;
496 struct sockaddr_in sa; 637 struct sockaddr_in sa;
497 socklen_t sa_len = sizeof (sa); 638 socklen_t sa_len = sizeof (sa);
498 int len; 639 int len;
… …
508 recv_vpn_packet (pkt, si); 649 recv_vpn_packet (pkt, si);
509 } 650 }
510 else 651 else
511 { 652 {
512 // probably ECONNRESET or somesuch 653 // probably ECONNRESET or somesuch
513 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 654 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
514 } 655 }
515 656
516 delete pkt; 657 delete pkt;
517 } 658 }
518 else 659 else
519 { 660 {
520 slog (L_ERR, 661 slog (L_ERR,
521 _("FATAL: unknown revents %08x in socket, terminating\n"), 662 _("FATAL: unknown revents %08x in socket, exiting.\n"),
522 revents); 663 revents);
523 exit (EXIT_FAILURE); 664 exit (EXIT_FAILURE);
524 } 665 }
525} 666}
526 667
527void 668inline void
528vpn::tap_ev (io_watcher &w, short revents) 669vpn::tap_ev (ev::io &w, int revents)
529{ 670{
530 if (revents & EVENT_READ) 671 if (revents & EV_READ)
531 { 672 {
532 /* process data */ 673 /* process data */
533 tap_packet *pkt; 674 tap_packet *pkt;
534 675
535 pkt = tap->recv (); 676 pkt = tap->recv ();
… …
542 int dst = mac2id (pkt->dst); 683 int dst = mac2id (pkt->dst);
543 int src = mac2id (pkt->src); 684 int src = mac2id (pkt->src);
544 685
545 if (src != THISNODE->id) 686 if (src != THISNODE->id)
546 { 687 {
547 slog (L_ERR, _("FATAL: tap packet not originating on current node received, exiting.")); 688 slog (L_ERR, _("FATAL: tap packet not originating on current node received (if-up script not working properly?), exiting."));
548 exit (EXIT_FAILURE); 689 exit (EXIT_FAILURE);
549 } 690 }
550 691
551 if (dst == THISNODE->id) 692 if (dst == THISNODE->id)
552 { 693 {
… …
564 } 705 }
565 else 706 else
566 abort (); 707 abort ();
567} 708}
568 709
569void 710inline void
570vpn::event_cb (time_watcher &w) 711vpn::event_cb (ev::timer &w, int)
571{ 712{
572 if (events) 713 if (events)
573 { 714 {
574 if (events & EVENT_SHUTDOWN) 715 if (events & EVENT_SHUTDOWN)
575 { 716 {
576 slog (L_INFO, _("preparing shutdown...")); 717 slog (L_INFO, _("preparing shutdown..."));
577 718
578 shutdown_all (); 719 shutdown_all ();
579 remove_pid (conf.pidfilename); 720 remove_pid (conf.pidfilename);
580 slog (L_INFO, _("terminating")); 721 slog (L_INFO, _("exiting."));
581 exit (EXIT_SUCCESS); 722 exit (EXIT_SUCCESS);
582 } 723 }
583 724
584 if (events & EVENT_RECONNECT) 725 if (events & EVENT_RECONNECT)
585 { 726 {
586 slog (L_INFO, _("forced reconnect")); 727 slog (L_INFO, _("forced reconnect."));
587 728
588 reconnect_all (); 729 reconnect_all ();
589 } 730 }
590 731
591 events = 0; 732 events = 0;
… …
607 748
608 conns.clear (); 749 conns.clear ();
609 750
610 connection_init (); 751 connection_init ();
611 752
612 for (configuration::node_vector::iterator i = conf.nodes.begin (); 753 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
613 i != conf.nodes.end (); ++i) 754 conns.push_back (new connection (this, *i));
614 { 755
615 connection *conn = new connection (this, *i); 756 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
616 conns.push_back (conn);
617 conn->establish_connection (); 757 (*c)->establish_connection ();
618 }
619} 758}
620 759
621connection *vpn::find_router () 760bool
761vpn::can_direct (conf_node *src, conf_node *dst) const
622{ 762{
623 u32 prio = 1; 763 return src != dst
764 && src->may_direct (dst)
765 && dst->may_direct (src)
766 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
767 || (src->protocols & dst->connectable_protocols ()));
768}
769
770// only works for indirect and routed connections: find a router
771// from THISNODE to dst
772connection *
773vpn::find_router_for (const connection *dst)
774{
624 connection *router = 0; 775 connection *router = 0;
625 776
777 // first try to find a router with a direct connection, route there
778 // regardless of any other considerations.
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf != THISNODE
788 && can_direct (c->conf, dst->conf)
789 && c->ictx && c->octx)
790 {
791 prio = c->conf->routerprio;
792 router = c;
793 }
794 }
795 }
796
797 if (router)
798 return router;
799
800 // second try find the router with the highest priority, higher than ours
801 {
802 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
803
804 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
805 {
806 connection *c = *i;
807
808 if (c->conf->routerprio > prio
809 && c != dst
810 && c->conf != THISNODE
811 && c->ictx && c->octx)
812 {
813 prio = c->conf->routerprio;
814 router = c;
815 }
816 }
817 }
818
819 return router;
820}
821
822void
823vpn::connection_established (connection *c)
824{
626 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 825 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
627 { 826 {
628 connection *c = *i; 827 connection *o = *i;
629 828
630 if (c->conf->routerprio > prio 829 if (!o->is_direct
631 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 830 && o->si.valid ()
632 && c->ictx && c->octx 831 && c->si != o->si
633 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 832 && c == find_router_for (o))
634 {
635 prio = c->conf->routerprio;
636 router = c;
637 } 833 {
834 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
835 o->conf->nodename, c->conf->nodename);
836 o->rekey ();
837 }
638 } 838 }
639
640 return router;
641} 839}
642 840
841void
643void vpn::send_connect_request (int id) 842vpn::send_connect_request (connection *c)
644{ 843{
645 connection *c = find_router (); 844 connection *r = find_router_for (c);
646 845
647 if (c) 846 if (r)
847 {
848 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
849 c->conf->nodename, r->conf->nodename);
648 c->send_connect_request (id); 850 r->send_connect_request (c->conf->id);
851 }
649 else 852 else
650 // no router found, aggressively connect to all routers 853 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
651 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 854 c->conf->nodename);
652 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
653 (*i)->establish_connection ();
654} 855}
655 856
656void 857void
657connection::dump_status () 858connection::dump_status ()
658{ 859{
659 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 860 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
660 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 861 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
661 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 862 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
662 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 863 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
663 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 864 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
664 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
665 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
666} 865}
667 866
668void 867void
669vpn::dump_status () 868vpn::dump_status ()
670{ 869{
671 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 870 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
672 871
673 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 872 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
674 (*c)->dump_status (); 873 (*c)->dump_status ();
675 874
676 slog (L_NOTICE, _("END status dump")); 875 slog (L_NOTICE, _("END status dump"));
677} 876}
678 877
679vpn::vpn (void) 878vpn::vpn (void)
879{
680: event (this, &vpn::event_cb) 880 event .set<vpn, &vpn::event_cb > (this);
681, udpv4_ev_watcher (this, &vpn::udpv4_ev) 881 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
682, ipv4_ev_watcher (this, &vpn::ipv4_ev) 882 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
683#if ENABLE_TCP 883#if ENABLE_TCP
684, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 884 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
685#endif 885#endif
686#if ENABLE_ICMP 886#if ENABLE_ICMP
687, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 887 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
688#endif 888#endif
689#if ENABLE_DNS 889#if ENABLE_DNS
690, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 890 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
691#endif 891#endif
692, tap_ev_watcher (this, &vpn::tap_ev) 892 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
693{
694} 893}
695 894
696vpn::~vpn () 895vpn::~vpn ()
697{ 896{
698} 897}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines