ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.41 by pcg, Sun Dec 2 00:20:19 2007 UTC vs.
Revision 1.62 by root, Sat Dec 17 22:05:34 2011 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
87 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
88 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
89 } 99 }
90} 100}
91 101
102inline const char *
92const char *vpn::script_if_init () 103vpn::script_if_init ()
93{ 104{
94 script_init_env (); 105 script_init_env ();
95 106
96 return tap->if_up (); 107 return tap->if_up ();
97} 108}
98 109
110inline const char *
99const char *vpn::script_if_up () 111vpn::script_if_up ()
100{ 112{
101 script_init_env (); 113 script_init_env ();
102 114
103 char *filename; 115 char *filename;
104 asprintf (&filename, 116 asprintf (&filename,
… …
108 120
109 return filename; 121 return filename;
110} 122}
111 123
112int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
145}
146
147int
113vpn::setup () 148vpn::setup ()
114{ 149{
150 int success = 0;
151
152#if 1//D2
115 ipv4_tos = -1; 153 ipv42_tos = -1;
116 ipv4_fd = -1; 154 ipv42_fd = -1;
117 155
118 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 156 if (THISNODE->protocols & PROT_IPv42 && ::conf.ip_proto)
119 { 157 {
120 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 158 ipv42_fd = setup_socket (PROT_IPv42, PF_INET, SOCK_RAW, ::conf.ip2_proto);
121 159
122 if (ipv4_fd < 0) 160 if (ipv42_fd < 0)
123 return -1; 161 return -1;
124
125 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
126 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
127 162
128#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 163#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
129 // this I really consider a linux bug. I am neither connected 164 // this I really consider a linux bug. I am neither connected
130 // nor do I fragment myself. Linux still sets DF and doesn't 165 // nor do I fragment myself. Linux still sets DF and doesn't
131 // fragment for me sometimes. 166 // fragment for me sometimes.
132 { 167 {
133 int oval = IP_PMTUDISC_DONT; 168 int oval = IP_PMTUDISC_DONT;
134 setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 169 setsockopt (ipv42_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
135 } 170 }
136#endif 171#endif
137 172
138 sockinfo si (THISNODE, PROT_IPv4); 173 sockinfo si (THISNODE, PROT_IPv42);
139 174
140 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 175 if (bind (ipv42_fd, si.sav4 (), si.salenv4 ()))
141 { 176 {
142 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 177 slog (L_ERR, _("can't bind ipv42 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 178 return -1;
144 } 179 }
145 180
146 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 181 ipv42_ev_watcher.start (ipv42_fd, EV_READ);
182 ++success;
147 } 183 }
184 else
185 THISNODE->protocols &= ~PROT_IPv42;
186#endif
148 187
149 udpv4_tos = -1; 188 ipv4_tos = -1;
150 udpv4_fd = -1; 189 ipv4_fd = -1;
151 190
152 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 191 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
153 { 192 {
154 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 193 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
155 194
156 if (udpv4_fd < 0) 195 if (ipv4_fd < 0)
157 return -1; 196 return -1;
158
159 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
160 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
161
162 // standard daemon practise...
163 {
164 int oval = 1;
165 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
166 }
167 197
168#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 198#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
169 // this I really consider a linux bug. I am neither connected 199 // this I really consider a linux bug. I am neither connected
170 // nor do I fragment myself. Linux still sets DF and doesn't 200 // nor do I fragment myself. Linux still sets DF and doesn't
171 // fragment for me sometimes. 201 // fragment for me sometimes.
172 { 202 {
173 int oval = IP_PMTUDISC_DONT; 203 int oval = IP_PMTUDISC_DONT;
204 setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
205 }
206#endif
207
208 sockinfo si (THISNODE, PROT_IPv4);
209
210 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
211 {
212 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
213 return -1;
214 }
215
216 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
217 ++success;
218 }
219 else
220 THISNODE->protocols &= ~PROT_IPv4;
221
222 udpv4_tos = -1;
223 udpv4_fd = -1;
224
225 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
226 {
227 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
228
229 if (udpv4_fd < 0)
230 return -1;
231
232 // standard daemon practise...
233 {
234 int oval = 1;
235 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
236 }
237
238#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
239 // this I really consider a linux bug. I am neither connected
240 // nor do I fragment myself. Linux still sets DF and doesn't
241 // fragment for me sometimes.
242 {
243 int oval = IP_PMTUDISC_DONT;
174 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 244 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
175 } 245 }
176#endif 246#endif
177 247
178 sockinfo si (THISNODE, PROT_UDPv4); 248 sockinfo si (THISNODE, PROT_UDPv4);
179 249
180 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 250 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
181 { 251 {
182 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 252 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
183 exit (EXIT_FAILURE); 253 return -1;
184 } 254 }
185 255
186 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 256 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
257 ++success;
187 } 258 }
259 else
260 THISNODE->protocols &= ~PROT_UDPv4;
188 261
189 icmpv4_tos = -1; 262 icmpv4_tos = -1;
190 icmpv4_fd = -1; 263 icmpv4_fd = -1;
191 264
192#if ENABLE_ICMP 265#if ENABLE_ICMP
193 if (THISNODE->protocols & PROT_ICMPv4) 266 if (THISNODE->protocols & PROT_ICMPv4)
194 { 267 {
195 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 268 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
196 269
197 if (icmpv4_fd < 0) 270 if (icmpv4_fd < 0)
198 return -1; 271 return -1;
199
200 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
201 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
202 272
203#ifdef ICMP_FILTER 273#ifdef ICMP_FILTER
204 { 274 {
205 icmp_filter oval; 275 icmp_filter oval;
206 oval.data = 0xffffffff; 276 oval.data = 0xffffffff;
… …
223 293
224 sockinfo si (THISNODE, PROT_ICMPv4); 294 sockinfo si (THISNODE, PROT_ICMPv4);
225 295
226 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 296 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
227 { 297 {
228 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 298 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
229 exit (EXIT_FAILURE); 299 return -1;
230 } 300 }
231 301
232 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 302 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
303 ++success;
233 } 304 }
234#endif 305#endif
235 306
236 tcpv4_fd = -1; 307 tcpv4_fd = -1;
237 308
238#if ENABLE_TCP 309#if ENABLE_TCP
239 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 310 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
240 { 311 {
241 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 312 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
242 313
243 if (tcpv4_fd < 0) 314 if (tcpv4_fd < 0)
244 return -1; 315 return -1;
245 316
246 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
247 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
248
249 // standard daemon practise... 317 // standard daemon practise...
250 { 318 {
251 int oval = 1; 319 int oval = 1;
252 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 320 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
253 } 321 }
254 322
255 sockinfo si (THISNODE, PROT_TCPv4); 323 sockinfo si (THISNODE, PROT_TCPv4);
256 324
257 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 325 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
258 { 326 {
259 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 327 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
260 exit (EXIT_FAILURE); 328 return -1;
261 } 329 }
262 330
263 if (listen (tcpv4_fd, 5)) 331 if (listen (tcpv4_fd, 5))
264 { 332 {
265 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 333 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
266 exit (EXIT_FAILURE); 334 return -1;
267 } 335 }
268 336
269 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 337 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
338 ++success;
270 } 339 }
340 else
341 THISNODE->protocols &= ~PROT_TCPv4;
271#endif 342#endif
272 343
273 dnsv4_tos = -1; 344 dnsv4_tos = -1;
274 dnsv4_fd = -1; 345 dnsv4_fd = -1;
275 346
276#if ENABLE_DNS 347#if ENABLE_DNS
277 if (THISNODE->protocols & PROT_DNSv4) 348 if (THISNODE->protocols & PROT_DNSv4)
278 { 349 {
279 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 350 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
280 351
281 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 352 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
282 353
283 if (dnsv4_fd < 0) 354 if (dnsv4_fd < 0)
284 return -1; 355 return -1;
285
286 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
287 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
288 356
289# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 357# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
290 // this I really consider a linux bug. I am neither connected 358 // this I really consider a linux bug. I am neither connected
291 // nor do I fragment myself. Linux still sets DF and doesn't 359 // nor do I fragment myself. Linux still sets DF and doesn't
292 // fragment for me sometimes. 360 // fragment for me sometimes.
… …
306 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 374 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
307 PROT_DNSv4); 375 PROT_DNSv4);
308 376
309 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 377 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
310 { 378 {
311 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 379 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
312 exit (EXIT_FAILURE); 380 return -1;
313 } 381 }
314 382
315 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 383 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
384 ++success;
316 } 385 }
317#endif 386#endif
318 387
319 ///////////////////////////////////////////////////////////////////////////// 388 /////////////////////////////////////////////////////////////////////////////
389
390 if (!success)
391 {
392 slog (L_ERR, _("no protocols enabled."));
393 return -1;
394 }
320 395
321 reconnect_all (); 396 reconnect_all ();
322 397
323 ///////////////////////////////////////////////////////////////////////////// 398 /////////////////////////////////////////////////////////////////////////////
324 399
325 tap = new tap_device (); 400 tap = new tap_device ();
326 if (!tap) //D this, of course, never catches 401 if (!tap) //D this, of course, never catches
327 { 402 {
328 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 403 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
329 exit (EXIT_FAILURE); 404 return -1;
330 } 405 }
331 406
332 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 407 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
333 408
409 run_script_cb cb;
410 cb.set<vpn, &vpn::script_if_init> (this);
411
334 if (tap->if_up () && 412 if (tap->if_up () &&
335 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 413 !run_script (cb, true))
336 { 414 {
337 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 415 slog (L_ERR, _("interface initialization command '%s' failed."),
338 tap->if_up ()); 416 tap->if_up ());
339 exit (EXIT_FAILURE); 417 return -1;
340 }
341
342 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
343 { 418 }
419
420 cb.set<vpn, &vpn::script_if_up> (this);
421 if (!run_script (cb, true))
422 {
344 slog (L_ERR, _("if-up command execution failed, exiting.")); 423 slog (L_ERR, _("if-up command execution failed."));
345 exit (EXIT_FAILURE); 424 return -1;
346 } 425 }
347 426
348 tap_ev_watcher.start (tap->fd, EV_READ); 427 tap_ev_watcher.start (tap->fd, EV_READ);
349 428
350 return 0; 429 return 0;
… …
356 set_tos (ipv4_fd, ipv4_tos, tos); 435 set_tos (ipv4_fd, ipv4_tos, tos);
357 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 436 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
358 437
359 return true; 438 return true;
360} 439}
440
441#if 1 //D
442bool
443vpn::send_ipv42_packet (vpn_packet *pkt, const sockinfo &si, int tos)
444{
445 set_tos (ipv42_fd, ipv42_tos, tos);
446 sendto (ipv42_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
447
448 return true;
449}
450#endif
361 451
362static u16 452static u16
363ipv4_checksum (u16 *data, unsigned int len) 453ipv4_checksum (u16 *data, unsigned int len)
364{ 454{
365 // use 32 bit accumulator and fold back carry bits at the end 455 // use 32 bit accumulator and fold back carry bits at the end
… …
423 { 513 {
424 // broadcast, this is ugly, but due to the security policy 514 // broadcast, this is ugly, but due to the security policy
425 // we have to connect to all hosts... 515 // we have to connect to all hosts...
426 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 516 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
427 if ((*c)->conf != THISNODE) 517 if ((*c)->conf != THISNODE)
428 (*c)->inject_data_packet (pkt, true); 518 (*c)->inject_data_packet (pkt);
429 } 519 }
430} 520}
431 521
432void 522void
433vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 523vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
434{ 524{
435 unsigned int src = pkt->src (); 525 unsigned int src = pkt->src ();
436 unsigned int dst = pkt->dst (); 526 unsigned int dst = pkt->dst ();
437 527
438 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 528 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
439 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 529 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
440 530
441 if (src == 0 || src > conns.size () 531 if (src == 0 || src > conns.size ()
442 || dst > conns.size () 532 || dst > conns.size ()
443 || pkt->typ () >= vpn_packet::PT_MAX) 533 || pkt->typ () >= vpn_packet::PT_MAX)
444 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 534 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 535 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
446 else if (dst > conns.size ())
447 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
448 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
449 else 536 else
450 { 537 {
451 connection *c = conns[src - 1]; 538 connection *c = conns[src - 1];
452 539
453 if (dst == 0) 540 if (dst == 0)
454 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 541 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
455 c->conf->nodename, (const char *)rsi); 542 c->conf->nodename, (const char *)rsi);
456 else if (dst != THISNODE->id) 543 else if (dst != THISNODE->id)
457 { 544 {
458 if (THISNODE->routerprio) 545 if (THISNODE->routerprio)
459 // the tos setting gets lost here. who cares. 546 // the tos setting gets lost here. who cares.
460 conns[dst - 1]->inject_vpn_packet (pkt); 547 conns[dst - 1]->inject_vpn_packet (pkt);
461 else 548 else
462 slog (L_WARN, 549 slog (L_WARN,
463 _("%s(%s): forwarding request (=> %s), but we are no router"), 550 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
464 c->conf->nodename, (const char *)rsi, 551 c->conf->nodename, (const char *)rsi,
465 conns[dst - 1]->conf->nodename); 552 conns[dst - 1]->conf->nodename);
466 } 553 }
467 else 554 else
468 c->recv_vpn_packet (pkt, rsi); 555 c->recv_vpn_packet (pkt, rsi);
… …
472bool 559bool
473vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 560vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
474{ 561{
475 switch (si.prot) 562 switch (si.prot)
476 { 563 {
564#if 1//D2
565 case PROT_IPv42:
566 return send_ipv42_packet (pkt, si, tos);
567#endif
568
477 case PROT_IPv4: 569 case PROT_IPv4:
478 return send_ipv4_packet (pkt, si, tos); 570 return send_ipv4_packet (pkt, si, tos);
479 571
480 case PROT_UDPv4: 572 case PROT_UDPv4:
481 return send_udpv4_packet (pkt, si, tos); 573 return send_udpv4_packet (pkt, si, tos);
482 574
483#if ENABLE_TCP 575#if ENABLE_TCP
484 case PROT_TCPv4: 576 case PROT_TCPv4:
485 return send_tcpv4_packet (pkt, si, tos); 577 return send_tcpv4_packet (pkt, si, tos);
486#endif 578#endif
487#if ENABLE_ICMP 579#if ENABLE_ICMP
488 case PROT_ICMPv4: 580 case PROT_ICMPv4:
… …
491#if ENABLE_DNS 583#if ENABLE_DNS
492 case PROT_DNSv4: 584 case PROT_DNSv4:
493 return send_dnsv4_packet (pkt, si, tos); 585 return send_dnsv4_packet (pkt, si, tos);
494#endif 586#endif
495 default: 587 default:
496 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 588 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
497 } 589 }
498 590
499 return false; 591 return false;
500} 592}
501 593
502void 594#if 1//D2
595inline void
503vpn::ipv4_ev (ev::io &w, int revents) 596vpn::ipv42_ev (ev::io &w, int revents)
504{ 597{
505 if (revents & EV_READ) 598 if (revents & EV_READ)
506 { 599 {
507 vpn_packet *pkt = new vpn_packet; 600 vpn_packet *pkt = new vpn_packet;
508 struct sockaddr_in sa; 601 struct sockaddr_in sa;
509 socklen_t sa_len = sizeof (sa); 602 socklen_t sa_len = sizeof (sa);
510 int len; 603 int len;
511 604
512 len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len); 605 len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
513 606
514 sockinfo si(sa, PROT_IPv4); 607 sockinfo si(sa, PROT_IPv42);
515 608
516 if (len > 0) 609 if (len > 0)
517 { 610 {
518 pkt->len = len; 611 pkt->len = len;
519 612
520 // raw sockets deliver the ipv4 header, but don't expect it on sends 613 // raw sockets deliver the ipv4 header, but don't expect it on sends
521 pkt->skip_hdr (IP_OVERHEAD); 614 pkt->skip_hdr (pkt->ipv4_hdr_len ());
522 615
523 recv_vpn_packet (pkt, si); 616 recv_vpn_packet (pkt, si);
524 } 617 }
525 else 618 else
526 { 619 {
527 // probably ECONNRESET or somesuch 620 // probably ECONNRESET or somesuch
528 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 621 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
529 } 622 }
530 623
531 delete pkt; 624 delete pkt;
532 } 625 }
533 else 626 else
534 { 627 {
535 slog (L_ERR, 628 slog (L_ERR,
536 _("FATAL: unknown revents %08x in socket, terminating\n"), 629 _("FATAL: unknown revents %08x in socket, exiting.\n"),
537 revents); 630 revents);
538 exit (EXIT_FAILURE); 631 exit (EXIT_FAILURE);
539 } 632 }
540} 633}
634#endif
635
636inline void
637vpn::ipv4_ev (ev::io &w, int revents)
638{
639 if (revents & EV_READ)
640 {
641 vpn_packet *pkt = new vpn_packet;
642 struct sockaddr_in sa;
643 socklen_t sa_len = sizeof (sa);
644 int len;
645
646 len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
647
648 sockinfo si(sa, PROT_IPv4);
649
650 if (len > 0)
651 {
652 pkt->len = len;
653
654 // raw sockets deliver the ipv4 header, but don't expect it on sends
655 pkt->skip_hdr (pkt->ipv4_hdr_len ());
656
657 recv_vpn_packet (pkt, si);
658 }
659 else
660 {
661 // probably ECONNRESET or somesuch
662 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
663 }
664
665 delete pkt;
666 }
667 else
668 {
669 slog (L_ERR,
670 _("FATAL: unknown revents %08x in socket, exiting.\n"),
671 revents);
672 exit (EXIT_FAILURE);
673 }
674}
541 675
542#if ENABLE_ICMP 676#if ENABLE_ICMP
543void 677inline void
544vpn::icmpv4_ev (ev::io &w, int revents) 678vpn::icmpv4_ev (ev::io &w, int revents)
545{ 679{
546 if (revents & EV_READ) 680 if (revents & EV_READ)
547 { 681 {
548 vpn_packet *pkt = new vpn_packet; 682 vpn_packet *pkt = new vpn_packet;
… …
563 if (hdr->type == ::conf.icmp_type 697 if (hdr->type == ::conf.icmp_type
564 && hdr->code == 255) 698 && hdr->code == 255)
565 { 699 {
566 // raw sockets deliver the ipv4, but don't expect it on sends 700 // raw sockets deliver the ipv4, but don't expect it on sends
567 // this is slow, but... 701 // this is slow, but...
568 pkt->skip_hdr (ICMP_OVERHEAD); 702 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
569 703
570 recv_vpn_packet (pkt, si); 704 recv_vpn_packet (pkt, si);
571 } 705 }
572 } 706 }
573 else 707 else
574 { 708 {
575 // probably ECONNRESET or somesuch 709 // probably ECONNRESET or somesuch
576 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 710 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
577 } 711 }
578 712
579 delete pkt; 713 delete pkt;
580 } 714 }
581 else 715 else
582 { 716 {
583 slog (L_ERR, 717 slog (L_ERR,
584 _("FATAL: unknown revents %08x in socket, terminating\n"), 718 _("FATAL: unknown revents %08x in socket, exiting.\n"),
585 revents); 719 revents);
586 exit (EXIT_FAILURE); 720 exit (EXIT_FAILURE);
587 } 721 }
588} 722}
589#endif 723#endif
590 724
591void 725inline void
592vpn::udpv4_ev (ev::io &w, int revents) 726vpn::udpv4_ev (ev::io &w, int revents)
593{ 727{
594 if (revents & EV_READ) 728 if (revents & EV_READ)
595 { 729 {
596 vpn_packet *pkt = new vpn_packet; 730 vpn_packet *pkt = new vpn_packet;
… …
609 recv_vpn_packet (pkt, si); 743 recv_vpn_packet (pkt, si);
610 } 744 }
611 else 745 else
612 { 746 {
613 // probably ECONNRESET or somesuch 747 // probably ECONNRESET or somesuch
614 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 748 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
615 } 749 }
616 750
617 delete pkt; 751 delete pkt;
618 } 752 }
619 else 753 else
620 { 754 {
621 slog (L_ERR, 755 slog (L_ERR,
622 _("FATAL: unknown revents %08x in socket, terminating\n"), 756 _("FATAL: unknown revents %08x in socket, exiting.\n"),
623 revents); 757 revents);
624 exit (EXIT_FAILURE); 758 exit (EXIT_FAILURE);
625 } 759 }
626} 760}
627 761
628void 762inline void
629vpn::tap_ev (ev::io &w, int revents) 763vpn::tap_ev (ev::io &w, int revents)
630{ 764{
631 if (revents & EV_READ) 765 if (revents & EV_READ)
632 { 766 {
633 /* process data */ 767 /* process data */
… …
665 } 799 }
666 else 800 else
667 abort (); 801 abort ();
668} 802}
669 803
670void 804inline void
671vpn::event_cb (ev::timer &w, int) 805vpn::event_cb (ev::timer &w, int)
672{ 806{
673 if (events) 807 if (events)
674 { 808 {
675 if (events & EVENT_SHUTDOWN) 809 if (events & EVENT_SHUTDOWN)
676 { 810 {
677 slog (L_INFO, _("preparing shutdown...")); 811 slog (L_INFO, _("preparing shutdown..."));
678 812
679 shutdown_all (); 813 shutdown_all ();
680 remove_pid (conf.pidfilename); 814 remove_pid (conf.pidfilename);
681 slog (L_INFO, _("terminating")); 815 slog (L_INFO, _("exiting."));
682 exit (EXIT_SUCCESS); 816 exit (EXIT_SUCCESS);
683 } 817 }
684 818
685 if (events & EVENT_RECONNECT) 819 if (events & EVENT_RECONNECT)
686 { 820 {
687 slog (L_INFO, _("forced reconnect")); 821 slog (L_INFO, _("forced reconnect."));
688 822
689 reconnect_all (); 823 reconnect_all ();
690 } 824 }
691 825
692 events = 0; 826 events = 0;
… …
708 842
709 conns.clear (); 843 conns.clear ();
710 844
711 connection_init (); 845 connection_init ();
712 846
713 for (configuration::node_vector::iterator i = conf.nodes.begin (); 847 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
714 i != conf.nodes.end (); ++i) 848 conns.push_back (new connection (this, *i));
715 { 849
716 connection *conn = new connection (this, *i); 850 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
717 conns.push_back (conn);
718 conn->establish_connection (); 851 (*c)->establish_connection ();
719 }
720} 852}
721 853
722connection *vpn::find_router () 854bool
855vpn::can_direct (conf_node *src, conf_node *dst) const
723{ 856{
724 u32 prio = 1; 857 return src != dst
858 && src->may_direct (dst)
859 && dst->may_direct (src)
860 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
861 || (src->protocols & dst->connectable_protocols ()));
862}
863
864// only works for indirect and routed connections: find a router
865// from THISNODE to dst
866connection *
867vpn::find_router_for (const connection *dst)
868{
725 connection *router = 0; 869 connection *router = 0;
726 870
871 // first try to find a router with a direct connection, route there
872 // regardless of any other considerations.
873 {
874 u32 prio = 1;
875
876 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
877 {
878 connection *c = *i;
879
880 if (c->conf->routerprio > prio
881 && c->conf != THISNODE
882 && can_direct (c->conf, dst->conf)
883 && c->ictx && c->octx)
884 {
885 prio = c->conf->routerprio;
886 router = c;
887 }
888 }
889 }
890
891 if (router)
892 return router;
893
894 // second try find the router with the highest priority, higher than ours
895 {
896 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
897
898 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
899 {
900 connection *c = *i;
901
902 if (c->conf->routerprio > prio
903 && c != dst
904 && c->conf != THISNODE
905 && c->ictx && c->octx)
906 {
907 prio = c->conf->routerprio;
908 router = c;
909 }
910 }
911 }
912
913 return router;
914}
915
916void
917vpn::connection_established (connection *c)
918{
727 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 919 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
728 { 920 {
729 connection *c = *i; 921 connection *o = *i;
730 922
731 if (c->conf->routerprio > prio 923 if (!o->is_direct
732 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 924 && o->si.valid ()
733 && c->ictx && c->octx 925 && c->si != o->si
734 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 926 && c == find_router_for (o))
735 {
736 prio = c->conf->routerprio;
737 router = c;
738 } 927 {
928 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
929 o->conf->nodename, c->conf->nodename);
930 o->rekey ();
931 }
739 } 932 }
740
741 return router;
742} 933}
743 934
935void
744void vpn::send_connect_request (int id) 936vpn::send_connect_request (connection *c)
745{ 937{
746 connection *c = find_router (); 938 connection *r = find_router_for (c);
747 939
748 if (c) 940 if (r)
941 {
942 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
943 c->conf->nodename, r->conf->nodename);
749 c->send_connect_request (id); 944 r->send_connect_request (c->conf->id);
945 }
750 else 946 else
751 // no router found, aggressively connect to all routers 947 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
752 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 948 c->conf->nodename);
753 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
754 (*i)->establish_connection ();
755} 949}
756 950
757void 951void
758connection::dump_status () 952connection::dump_status ()
759{ 953{
760 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 954 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
761 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 955 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
762 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 956 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
763 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 957 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
764 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 958 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
765 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
766 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
767} 959}
768 960
769void 961void
770vpn::dump_status () 962vpn::dump_status ()
771{ 963{
… …
776 968
777 slog (L_NOTICE, _("END status dump")); 969 slog (L_NOTICE, _("END status dump"));
778} 970}
779 971
780vpn::vpn (void) 972vpn::vpn (void)
973{
781: event (this, &vpn::event_cb) 974 event .set<vpn, &vpn::event_cb > (this);
782, udpv4_ev_watcher (this, &vpn::udpv4_ev) 975 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
783, ipv4_ev_watcher (this, &vpn::ipv4_ev) 976 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
977#if 1//D2
978 ipv42_ev_watcher .set<vpn, &vpn::ipv42_ev > (this);
979#endif
784#if ENABLE_TCP 980#if ENABLE_TCP
785, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 981 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
786#endif 982#endif
787#if ENABLE_ICMP 983#if ENABLE_ICMP
788, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 984 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
789#endif 985#endif
790#if ENABLE_DNS 986#if ENABLE_DNS
791, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 987 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
792#endif 988#endif
793, tap_ev_watcher (this, &vpn::tap_ev) 989 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
794{
795} 990}
796 991
797vpn::~vpn () 992vpn::~vpn ()
798{ 993{
799} 994}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines